66
Method 1: Changing the user's home directory
Make sure the following line exists
chroot_local_user=YES
Set user HOME Directory to /var/www/ , if you want to change for existing user then you can use:
usermod --home /var/www/ username
then set required permission on /var/www/
Method 2: Use user_sub_token
If you don't want to change user's Home ...
42
I use an ARM chroot from time to time: my phone runs Linux Deploy and the image dies now and then. I then copy it to my computer and examine the situation with chroot like this:
# This provides the qemu-arm-static binary
apt-get install qemu-user-static
# Mount my target filesystem on /mnt
mount -o loop fs.img /mnt
# Copy the static ARM binary that ...
40
This error means that there is no /bin/bash directory inside chroot. Make sure you point it to where bash (or other shell's) executable is in chroot directory.
If you have /mnt/somedir/usr/bin/bash then execute chroot /mnt/somedir /usr/bin/bash.
Apart from the above, you also need to add libc directory dependencies, as mentioned in the answer here.
31
I had /bin/bash inside chrooted directory, but I didn't have /lib and /lib64 inside it. The message from chroot could be more descriptive. "no such file or directory" really means "I can't run this...".
/bin/bash depends of course on libc, ld-linux, libdl etc., you can use ldd /bin/bash to see which libraries it requires.
1) You can mount -o bind these ...
28
It seems that others have missed your point, which was not reasons why to use changed roots, which of course you clearly already know, nor what else you can do to place limits on dæmons, when you also clearly know about running under the aegides of unprivileged user accounts; but why to do this stuff inside the application. There's actually a fairly ...
22
To set up networking for your chrooted session you need to copy the DNS configuration into the chroot environment :
cp /etc/resolv.conf /mnt/etc/resolv.conf
Or
ln -s /etc/resolv.conf /mnt/etc/resolv.conf
18
Entering a mount namespace before setting up a chroot, lets you avoid cluttering the host namespace with additional mounts, e.g. for /proc. You can use chroot inside a mount namespace as a nice and simple hack.
I think there are advantages to understanding pivot_root, but it has a bit of a learning curve. The documentation does not quite explain ...
16
Execute the below command to force and Detach the filesystem from the filesystem hierarchy, and cleanup all references to the filesystem as soon as it is not busy anymore.
umount -lf /mnt/rescue
14
If /bin/bash is a binary with shared library dependencies, these dependencies needs to be able to be resolved within the chroot.
On my system:
$ ldd $( command -v bash )
/usr/local/bin/bash:
Start End Type Open Ref GrpRef Name
0000115f08700000 0000115f08a0c000 exe 1 0 0 /usr/local/bin/bash
...
14
There are a lot of reasons to use a chrooted environment, you can use it to keep different versions of one program, you can use it to simulate an specific environment in order to test some features, to create images of a system different from your main one, etc.
Wikipedia can tell you more about chroot jails and its usages.
From there:
Testing and ...
13
One option is to use tokens to give each user a unique authorized_keys file.
From man sshd_config:
AuthorizedKeysFile
Specifies the file that contains the public keys that can be used
for user authentication. The format is described in the AUTHORIZED_KEYS FILE FORMAT section of sshd(8). AuthorizedKeysFile
may contain ...
12
Chroot in ubuntu or recovering Ubuntu,Debian Linux
boot from livecd of ubuntu, if you installed with system 32bit use 32bit Live CD, If 64bit use 64 bit live cd.
Mount the Linux Partitions using
# sudo blkid
Output:
sysadmin@localhost:~$ sudo blkid
[sudo] password for sysadmin:
/dev/sda1: UUID="846589d1-af7a-498f-91de-9da0b18eb54b" TYPE="ext4"
/dev/...
12
chroot: failed to run command ‘ls’: No such file or directory
To run any command inside the chroot, you need to have this program available in the chroot (since it can not use the program installed in the / of filesystem.
The simplest way is to copy the /usr/bin/ls from to /home/kuba/projects/jcubic/leash/usr/bin/ (you will also need the dependent shared ...
11
You should read about .bash_profile and .bashrc. The bracketed information is just a preference in those files which typically live in your home directory and/or /etc/profile (look for the line that starts PS1=). I'm assuming that when you're chrooted, that user does not have access to its home folder to load these files, so your prompt is, essentially, un-...
11
On Linux, /dev/fd is a symbolic link to /proc/self/fd, where /proc/self is a symlink to the process directory of the calling process. /proc/$pid/fd then contains magic links to the open filehandles. Bash uses that to make pipes that can be accessed by filename without needing to leave anything on the actual filesystem.
So, you'd need to mount /proc and make ...
10
The solution must probably be based either on ptrace or namespaces (unshare).
ptrace-based solutions are probably less efficient then namespaces/unshare-based (but the latter technology is cutting-edge and is not well explored path, probably).
ptrace-based
UMView
As for ptrced-based solutions, thanks to the comments at https://stackoverflow.com/a/1019720/...
answered Apr 17 '13 at 3:11
imz -- Ivan Zakharyaschev
13.5k11 gold badges53 silver badges112 bronze badges
10
I think the problem is that you should not copy qemu-arm but qemu-arm-static. This is a static compiled executable able to run from inside the chroot without any libraries.
You can also look in /proc/sys/fs/binfmt_misc if there exists a file qemu-arm. If not restart the service binfmt_support.
10
A process is run with a uid ang a gid. Both have permissions assigned to them. You could call chroot with a userspec of a user and group, where actually the user is not in that group. The process would then executed with the users uid and the given groups gid.
See an example. I have a user called user, and he is in the group student:
root@host:~$ id user
...
10
On Debian, to remove all GUI packages, you can remove the two libraries used to connect to display servers:
apt purge libx11-6 libwayland-client0
This will remove all packages depending on these libraries. The removals will be logged in the history logs in /var/log/apt, so you can look there if you need to revert a removal.
This might catch some packages ...
10
The VDSO is special, it is directly provided by the kernel.
You see that it has addresses, even if it doesn't have a file name, so it got mapped fine. You don't need to do anything to get the VDSO in the chroot.
The kernel VDSO is a collection of kernel functions that don't always require a mode switch, e.g. reading exact timers is handled by the rdtsc ...
9
On Arch, Install qemu-user-static and binfmt-qemu-static from the AUR .
Then make sure to copy the qemu-*-static to the usr/bin/ directory in the thing you want to chroot to and then the chroot should work with something like chroot /mnt qemu-arm-static /bin/bash
9
/etc/resolv.conf is copied in order not to lose the DNSs.
/lib/modules is copied because because it may be necessary to use some hardware component that need not be present at the time of setting up the chroot. You must remember that the original question you refer to in your OP concerns the replacement of a NAS OS with Arch Linux. You will thus need ...
9
Although POSIX has a standard for capabilities which I think includes CAP_NET_BIND_SERVICE, these are not required for conformance and may in some ways be incompatible with the implementation on, e.g., linux.
Since webservers like apache are not written for only one platform, using root privileges is the most portable method. I suppose it could do this ...
9
I know that this question is too old, but because there is no accepted answer and none of these answers solved the issue in my case; I am writing how I solved this today:
When running this command, get this error:
$ sudo modprobe vboxdrv
modprobe: ERROR: could not insert 'vboxdrv': Required key not available
The problem is that the module is not signed ...
8
While clearly not as portable as many other options listed here, if you're on a Debian-based system, try ischroot.
See: https://manpages.debian.org/jessie/debianutils/ischroot.1.en.html
To get the status in the console directly, using ischroot:
ischroot;echo $?
Exit codes:
0 if currently running in a chroot
1 if currently not running in a chroot
2 if ...
8
This cannot be done by the bootloader or kernel. The parameter to the kernel root option such as in root=/dev/sda1 looks like a standard Unix pathname, but such pathnames are interpreted according to currently mounted filesystem. At the time the root option is interpreted, there are no mounted filesystems. Well, almost none. At kernel initialization time ...
8
I came across the same issue and ended up writing this to make it work painlessly across different systems (debian, ubuntu currently):
Run make_chroot_initrd script to create a new chroot-enabled initrd image from the existing one:
# ./make_chroot_initrd /chroot/trusty/boot/initrd.img-3.13.0-32-generic
making new initrd: /chroot/trusty/boot/initrd.img-3....
8
Normally, chroot is about "limiting privileges", not granting users their own IF to play with...
But in any case: if you feel like doing some work, you may start your chroot environment within a new network namespace. You find an introduction here. Then the last command, the one that places you into the new network namespace, which in the guide above is
...
8
With Docker you can do this very easily.
docker pull ubuntu
docker run -t -i ubuntu /bin/bash
# make your changes and then log out
docker commit $(docker ps -a -q | head -n 1) sandbox
cat > /usr/local/bin/sandbox <<EOF
#!/bin/sh
exec docker run -t -i --rm=true sandbox /bin/bash
EOF
chmod a+x /usr/local/bin/sandbox
echo /usr/local/bin/sandbox >...
Only top voted, non community-wiki answers of a minimum length are eligible
