Hot answers tagged

66

Method 1: Changing the user's home directory Make sure the following line exists chroot_local_user=YES Set user HOME Directory to /var/www/ , if you want to change for existing user then you can use: usermod --home /var/www/ username then set required permission on /var/www/ Method 2: Use user_sub_token If you don't want to change user's Home ...


42

I use an ARM chroot from time to time: my phone runs Linux Deploy and the image dies now and then. I then copy it to my computer and examine the situation with chroot like this: # This provides the qemu-arm-static binary apt-get install qemu-user-static # Mount my target filesystem on /mnt mount -o loop fs.img /mnt # Copy the static ARM binary that ...


40

This error means that there is no /bin/bash directory inside chroot. Make sure you point it to where bash (or other shell's) executable is in chroot directory. If you have /mnt/somedir/usr/bin/bash then execute chroot /mnt/somedir /usr/bin/bash. Apart from the above, you also need to add libc directory dependencies, as mentioned in the answer here.


31

I had /bin/bash inside chrooted directory, but I didn't have /lib and /lib64 inside it. The message from chroot could be more descriptive. "no such file or directory" really means "I can't run this...". /bin/bash depends of course on libc, ld-linux, libdl etc., you can use ldd /bin/bash to see which libraries it requires. 1) You can mount -o bind these ...


28

It seems that others have missed your point, which was not reasons why to use changed roots, which of course you clearly already know, nor what else you can do to place limits on dæmons, when you also clearly know about running under the aegides of unprivileged user accounts; but why to do this stuff inside the application. There's actually a fairly ...


22

To set up networking for your chrooted session you need to copy the DNS configuration into the chroot environment : cp /etc/resolv.conf /mnt/etc/resolv.conf Or ln -s /etc/resolv.conf /mnt/etc/resolv.conf


18

Entering a mount namespace before setting up a chroot, lets you avoid cluttering the host namespace with additional mounts, e.g. for /proc. You can use chroot inside a mount namespace as a nice and simple hack. I think there are advantages to understanding pivot_root, but it has a bit of a learning curve. The documentation does not quite explain ...


16

Execute the below command to force and Detach the filesystem from the filesystem hierarchy, and cleanup all references to the filesystem as soon as it is not busy anymore. umount -lf /mnt/rescue


14

If /bin/bash is a binary with shared library dependencies, these dependencies needs to be able to be resolved within the chroot. On my system: $ ldd $( command -v bash ) /usr/local/bin/bash: Start End Type Open Ref GrpRef Name 0000115f08700000 0000115f08a0c000 exe 1 0 0 /usr/local/bin/bash ...


14

There are a lot of reasons to use a chrooted environment, you can use it to keep different versions of one program, you can use it to simulate an specific environment in order to test some features, to create images of a system different from your main one, etc. Wikipedia can tell you more about chroot jails and its usages. From there: Testing and ...


13

One option is to use tokens to give each user a unique authorized_keys file. From man sshd_config: AuthorizedKeysFile Specifies the file that contains the public keys that can be used for user authentication. The format is described in the AUTHORIZED_KEYS FILE FORMAT section of sshd(8). AuthorizedKeysFile may contain ...


12

Chroot in ubuntu or recovering Ubuntu,Debian Linux boot from livecd of ubuntu, if you installed with system 32bit use 32bit Live CD, If 64bit use 64 bit live cd. Mount the Linux Partitions using # sudo blkid Output: sysadmin@localhost:~$ sudo blkid [sudo] password for sysadmin: /dev/sda1: UUID="846589d1-af7a-498f-91de-9da0b18eb54b" TYPE="ext4" /dev/...


12

chroot: failed to run command ‘ls’: No such file or directory To run any command inside the chroot, you need to have this program available in the chroot (since it can not use the program installed in the / of filesystem. The simplest way is to copy the /usr/bin/ls from to /home/kuba/projects/jcubic/leash/usr/bin/ (you will also need the dependent shared ...


11

You should read about .bash_profile and .bashrc. The bracketed information is just a preference in those files which typically live in your home directory and/or /etc/profile (look for the line that starts PS1=). I'm assuming that when you're chrooted, that user does not have access to its home folder to load these files, so your prompt is, essentially, un-...


11

On Linux, /dev/fd is a symbolic link to /proc/self/fd, where /proc/self is a symlink to the process directory of the calling process. /proc/$pid/fd then contains magic links to the open filehandles. Bash uses that to make pipes that can be accessed by filename without needing to leave anything on the actual filesystem. So, you'd need to mount /proc and make ...


10

The solution must probably be based either on ptrace or namespaces (unshare). ptrace-based solutions are probably less efficient then namespaces/unshare-based (but the latter technology is cutting-edge and is not well explored path, probably). ptrace-based UMView As for ptrced-based solutions, thanks to the comments at https://stackoverflow.com/a/1019720/...


10

I think the problem is that you should not copy qemu-arm but qemu-arm-static. This is a static compiled executable able to run from inside the chroot without any libraries. You can also look in /proc/sys/fs/binfmt_misc if there exists a file qemu-arm. If not restart the service binfmt_support.


10

A process is run with a uid ang a gid. Both have permissions assigned to them. You could call chroot with a userspec of a user and group, where actually the user is not in that group. The process would then executed with the users uid and the given groups gid. See an example. I have a user called user, and he is in the group student: root@host:~$ id user ...


10

On Debian, to remove all GUI packages, you can remove the two libraries used to connect to display servers: apt purge libx11-6 libwayland-client0 This will remove all packages depending on these libraries. The removals will be logged in the history logs in /var/log/apt, so you can look there if you need to revert a removal. This might catch some packages ...


10

The VDSO is special, it is directly provided by the kernel. You see that it has addresses, even if it doesn't have a file name, so it got mapped fine. You don't need to do anything to get the VDSO in the chroot. The kernel VDSO is a collection of kernel functions that don't always require a mode switch, e.g. reading exact timers is handled by the rdtsc ...


9

On Arch, Install qemu-user-static and binfmt-qemu-static from the AUR . Then make sure to copy the qemu-*-static to the usr/bin/ directory in the thing you want to chroot to and then the chroot should work with something like chroot /mnt qemu-arm-static /bin/bash


9

/etc/resolv.conf is copied in order not to lose the DNSs. /lib/modules is copied because because it may be necessary to use some hardware component that need not be present at the time of setting up the chroot. You must remember that the original question you refer to in your OP concerns the replacement of a NAS OS with Arch Linux. You will thus need ...


9

Although POSIX has a standard for capabilities which I think includes CAP_NET_BIND_SERVICE, these are not required for conformance and may in some ways be incompatible with the implementation on, e.g., linux. Since webservers like apache are not written for only one platform, using root privileges is the most portable method. I suppose it could do this ...


9

I know that this question is too old, but because there is no accepted answer and none of these answers solved the issue in my case; I am writing how I solved this today: When running this command, get this error: $ sudo modprobe vboxdrv modprobe: ERROR: could not insert 'vboxdrv': Required key not available The problem is that the module is not signed ...


8

While clearly not as portable as many other options listed here, if you're on a Debian-based system, try ischroot. See: https://manpages.debian.org/jessie/debianutils/ischroot.1.en.html To get the status in the console directly, using ischroot: ischroot;echo $? Exit codes: 0 if currently running in a chroot 1 if currently not running in a chroot 2 if ...


8

This cannot be done by the bootloader or kernel. The parameter to the kernel root option such as in root=/dev/sda1 looks like a standard Unix pathname, but such pathnames are interpreted according to currently mounted filesystem. At the time the root option is interpreted, there are no mounted filesystems. Well, almost none. At kernel initialization time ...


8

I came across the same issue and ended up writing this to make it work painlessly across different systems (debian, ubuntu currently): Run make_chroot_initrd script to create a new chroot-enabled initrd image from the existing one: # ./make_chroot_initrd /chroot/trusty/boot/initrd.img-3.13.0-32-generic making new initrd: /chroot/trusty/boot/initrd.img-3....


8

Normally, chroot is about "limiting privileges", not granting users their own IF to play with... But in any case: if you feel like doing some work, you may start your chroot environment within a new network namespace. You find an introduction here. Then the last command, the one that places you into the new network namespace, which in the guide above is ...


8

With Docker you can do this very easily. docker pull ubuntu docker run -t -i ubuntu /bin/bash # make your changes and then log out docker commit $(docker ps -a -q | head -n 1) sandbox cat > /usr/local/bin/sandbox <<EOF #!/bin/sh exec docker run -t -i --rm=true sandbox /bin/bash EOF chmod a+x /usr/local/bin/sandbox echo /usr/local/bin/sandbox >...


Only top voted, non community-wiki answers of a minimum length are eligible