63
Method 1: Changing the user's home directory
Make sure the following line exists
chroot_local_user=YES
Set user HOME Directory to /var/www/ , if you want to change for existing user then you can use:
usermod --home /var/www/ username
then set required permission on /var/www/
Method 2: Use user_sub_token
If you don't want to change user's Home ...
50
Symlinks are essentially just pointers to another file, you can't point to something outside the chroot because it is looking for a file with that name (/var/www, which doesn't exist inside the chroot). Hardlinks on the other hand are pointers to the inode. As such, if you want to do that, you need to use a hard link by omitting -s. However, you cannot hard ...
44
What I've done here is to test whether the root of the init process (PID 1) is the same as the root of the current process. Although /proc/1/root is always a link to / (unless init itself is chrooted, but that's not a case I care about), following it leads to the “master” root directory. This technique is used in a few maintenance scripts in Debian, for ...
32
This error means that there is no /bin/bash directory inside chroot. Make sure you point it to where bash (or other shell's) executable is in chroot directory.
If you have /mnt/somedir/usr/bin/bash then execute chroot /mnt/somedir /usr/bin/bash
30
SSH Supports chrooting an SFTP user natively. You just need to supply
ChrootDirectory
In your sshd config file, and restart sshd.
If you are just doing sftp, then you don't have to do anything more. Unfortunately, this doesn't work for scp. For interactive shell, you will need to copy binaries, and /dev nodes into the chroot.
An example config, for ...
29
I use an ARM chroot from time to time: my phone runs Linux Deploy and the image dies now and then. I then copy it to my computer and examine the situation with chroot like this:
# This provides the qemu-arm-static binary
apt-get install qemu-user-static
# Mount my target filesystem on /mnt
mount -o loop fs.img /mnt
# Copy the static ARM binary that ...
27
It seems that others have missed your point, which was not reasons why to use changed roots, which of course you clearly already know, nor what else you can do to place limits on dæmons, when you also clearly know about running under the aegides of unprivileged user accounts; but why to do this stuff inside the application. There's actually a fairly ...
21
As mentioned in Portable way to find inode number and Detecting a chroot jail from within, you can check whether the inode number of / is 2:
$ ls -di /
2 /
An inode number that's different from 2 indicates that the apparent root is not the actual root of a filesystem. This will not detect chroots that happen to be rooted on a mount point, or on operating ...
15
Chroot is the lightest weight environment that could suit you. It allows you to install another distribution (or another installation of the same distribution), with the same users, with the same network configuration, etc. Chroot only provides some crude isolation at the filesystem level. Browsing this site for chroot might help, if you're still not sure ...
14
You cannot chroot into different architecture.
By chrooting, you are executing the binaries (from the chroot) on your architecture. Executing ARM binaries on x86 (and x86_64 in that matter) would lead to "Exec format error".
If you want to run binaries from different architecture you will need an Emulator. Qemu is a good candidate for this, but you will ...
13
You have to first exit the chroot session, usually a simple exit will do:
exit
Then umount ALL binded directories:
umount /mnt/rescue/dev/
umount /mnt/rescue/proc/
umount /mnt/rescue/sys/
Then:
umount /mnt/rescue
In case you were worried that sync isn't used here, note that it has no influence on whether unmounting is possible. Unmounting flushes ...
13
Execute the below command to force and Detach the filesystem from the filesystem hierarchy, and cleanup all references to the filesystem as soon as it is not busy anymore.
umount -lf /mnt/rescue
13
To set up networking for your chrooted session you need to copy the DNS configuration into the chroot environment :
cp /etc/resolv.conf /mnt/etc/resolv.conf
Or
ln -s /etc/resolv.conf /mnt/etc/resolv.conf
13
If /bin/bash is a binary with shared library dependencies, these dependencies needs to be able to be resolved within the chroot.
On my system:
$ ldd $( command -v bash )
/usr/local/bin/bash:
Start End Type Open Ref GrpRef Name
0000115f08700000 0000115f08a0c000 exe 1 0 0 /usr/local/bin/bash
...
12
/proc and (usually) much of /dev are read only kernel-generated "filesystems". You don't delete them, you just umount the filesystem. If rm -r /proc/6352 worked, it would have to be semantically equivalent to kill -9 6352, since it's really just presenting information about pid 6352, not actual files anywhere.
Use mount to see what mounted filesystems are ...
12
A chroot is a reasonably simple method. Since the operating system already has this security feature, daemon writers tend not to attempt to reimplement it.
Rssh comes with a guide on setting up a chroot jail. It's in the CHROOT file in the source distribution. In a nutshell, you need to have:
A few binaries, copied from the root: /usr/bin/scp, /usr/libexec/...
12
Chroot in ubuntu or recovering Ubuntu,Debian Linux
boot from livecd of ubuntu, if you installed with system 32bit use 32bit Live CD, If 64bit use 64 bit live cd.
Mount the Linux Partitions using
# sudo blkid
Output:
sysadmin@localhost:~$ sudo blkid
[sudo] password for sysadmin:
/dev/sda1: UUID="846589d1-af7a-498f-91de-9da0b18eb54b" TYPE="ext4"
/dev/...
12
There are a lot of reasons to use a chrooted environment, you can use it to keep different versions of one program, you can use it to simulate an specific environment in order to test some features, to create images of a system different from your main one, etc.
Wikipedia can tell you more about chroot jails and its usages.
From there:
Testing and ...
12
One option is to use tokens to give each user a unique authorized_keys file.
From man sshd_config:
AuthorizedKeysFile
Specifies the file that contains the public keys that can be used
for user authentication. The format is described in the AUTHORIZED_KEYS FILE FORMAT section of sshd(8). AuthorizedKeysFile
may contain ...
12
chroot: failed to run command ‘ls’: No such file or directory
To run any command inside the chroot, you need to have this program available in the chroot (since it can not use the program installed in the / of filesystem.
The simplest way is to copy the /usr/bin/ls from to /home/kuba/projects/jcubic/leash/usr/bin/ (you will also need the dependent shared ...
11
You should read about .bash_profile and .bashrc. The bracketed information is just a preference in those files which typically live in your home directory and/or /etc/profile (look for the line that starts PS1=). I'm assuming that when you're chrooted, that user does not have access to its home folder to load these files, so your prompt is, essentially, un-...
11
On Linux, /dev/fd is a symbolic link to /proc/self/fd, where /proc/self is a symlink to the process directory of the calling process. /proc/$pid/fd then contains magic links to the open filehandles. Bash uses that to make pipes that can be accessed by filename without needing to leave anything on the actual filesystem.
So, you'd need to mount /proc and make ...
11
Entering a mount namespace before setting up a chroot, lets you avoid cluttering the host namespace with additional mounts, e.g. for /proc. You can use chroot inside a mount namespace as a nice and simple hack.
I think there are advantages to understanding pivot_root, but it has a bit of a learning curve. The documentation does not quite explain ...
10
If you're trying to get any chrooted app to show up in X11, you will need a couple of things set up correctly. One is a valid DISPLAY environment variable, second is a proper Xauthority file, and third and most important, access to the socket used by X11/Xorg. X11 can use either a TCP network socket or a Unix Domain socket. A TCP socket will be easier to ...
10
Short answer -- there is as far as I know no out of the box working solution for your specific requirements. You will have to adjust each initramfs of each distribution to support your specific needs.
Long answer -- yes it is possible. Nowadays most Linux distributions use an initramfs which will be loaded into memory by the bootloader and then unpacked by ...
10
I had /bin/bash inside chrooted directory, but I didn't have /lib and /lib64 inside it. The message from chroot could be more descriptive. "no such file or directory" really means "I can't run this...".
/bin/bash depends of course on libc, ld-linux, libdl etc., you can use ldd /bin/bash to see which libraries it requires.
1) You can mount -o bind these ...
9
I think the problem is that you should not copy qemu-arm but qemu-arm-static. This is a static compiled executable able to run from inside the chroot without any libraries.
You can also look in /proc/sys/fs/binfmt_misc if there exists a file qemu-arm. If not restart the service binfmt_support.
9
The solution must probably be based either on ptrace or namespaces (unshare).
ptrace-based solutions are probably less efficient then namespaces/unshare-based (but the latter technology is cutting-edge and is not well explored path, probably).
ptrace-based
UMView
As for ptrced-based solutions, thanks to the comments at https://stackoverflow.com/a/1019720/...
8
You might want to look at scponly (or more recently, rssh); it's essentially a login shell that can only be used to launch scp or the sftpd subsystem. In the scponlyc variant it performs a chroot before activating the subsystem in question.
Only top voted, non community-wiki answers of a minimum length are eligible
