I'm currently working on a side project that will allow users from the public Internet to access a Linux server that I manage.
As you might imagine, there are a host of security concerns that come along with this requirement. I started looking for solutions and came across the idea of a chroot.
NOTE: I will be learning as I write this. This post is not intended to be a tutorial, but more a log of my working sessions and debugging efforts with this topic -- recording my thought process and what I learned along the way in a very informal matter.
What is chroot?
The idea is to create an isolated environment for a user (or users) so that they are limited in what they can see and do.
This is similar to the idea of a Docker container, but not quite the same.
A chroot lives inside an existing Linux install. You can almost think of it as an operating system within an operating system. Even if there are technically other users outside the chroot, the users inside the chroot are not aware of their existence. This is why a chroot is sometimes referred to as a "chroot jail".
The root user within a chroot is a sort of pseudo root. They do have root privileges within their sectioned-off operating system (the chroot jail), but those root privileges are being provisioned by the true root user, the one who set up the chroot.
Chroot creation -- first pass
I'm currently using a Raspberry Pi as my development server for this project, so that is where I'll be implementing the chroot.
I start by following this guide. The instructions are for Ubuntu (which is not what the Raspberry Pi is running), but the instructions here are more clear to me than others I've found so I'm going to try and make it work.
I install the schroot and debootstrap packages as instructed, create my /var/chroot directory, then open the /etc/schroot/schroot.conf file. I know I probably need to make some changes, but for now, I just leave it the way they suggest:
[lucid]
description=Ubuntu Lucid
location=/var/chroot
priority=3
users=your_username
groups=sbuild
root-groups=root
Here's the command they give to install the operating system within the chroot:
sudo debootstrap --variant=buildd --arch i386 lucid /var/chroot/ http://mirror.url.com/ubuntu/
The instructions say I need to replace mirror.url.com with a valid mirror, so I find a Raspbian mirror online and give it a go:
sudo debootstrap --variant=buildd --arch i386 lucid /var/chroot/ http://raspbian.mirrors.lucidnetworks.net/raspbian/
E: Failed getting release file http://raspbian.mirrors.lucidnetworks.net/raspbian/dists/lucid/Release
At first, I thought that I just needed to find a Raspbian mirror that had /lucid under the /dists directory. I wasn't finding one. Then I thought that changing lucid to jammy would work, because I thought I saw jammy somewhere...
So I tried it
sudo debootstrap --variant=buildd --arch i386 jammy /var/chroot/ https://mirror.vcu.edu/pub/gnu_linux/ubuntu/
E: No such script: /usr/share/debootstrap/scripts/jammy
Even though it didn't work, at least it was a new error!
I decided to look at the contents of the mentioned /scripts/ directory and see what was listed:
ls -la /usr/share/debootstrap/scripts
drwxr-xr-x 2 root root 4096 May 16 06:40 .
drwxr-xr-x 3 root root 4096 May 16 06:40 ..
-rw-r--r-- 1 root root 6044 Jul 13 2022 aequorea
-rw-r--r-- 1 root root 6639 Jul 13 2022 amber
lrwxrwxrwx 1 root root 5 Jul 28 2022 artful -> gutsy
lrwxrwxrwx 1 root root 3 Jul 28 2022 ascii -> sid
lrwxrwxrwx 1 root root 8 Jul 28 2022 bartholomea -> aequorea
lrwxrwxrwx 1 root root 3 Jul 28 2022 beowulf -> sid
lrwxrwxrwx 1 root root 5 Jul 28 2022 bionic -> gutsy
lrwxrwxrwx 1 root root 3 Jul 28 2022 bookworm -> sid
-rw-r--r-- 1 root root 5404 Jul 13 2022 breezy
lrwxrwxrwx 1 root root 3 Jul 28 2022 bullseye -> sid
Although lucid is listed here (not shown in the output), I stopped when I saw bullseye because I know that is what my Raspberry Pi is running.
I also did not realize that the different names (lucid, bullseye, etc.) corresponded to different versions of Debian. After looking into it a bit, I learned that lucid is quite old (Ubuntu 10.04), while bullseye is much newer (18.04 +).
With that, I change my configuration:
[bullseye]
description=Raspbian Bullseye
location=/var/chroot
priority=3
users=sharif
groups=sbuild
root-groups=root
Changing lucid to bullseye is easy enough, but the mirror is a bit more involved. First, I need to find a list of mirrors, then find a mirror that is close to my geographical location.
I find the United States mirror and view its contents in the browser. From the error message I received previously, I know that the command looks for the version inside the dists/ directory from the provided mirror URL.
I navigate to the dists/ directory within the browser, and see that bullseye/ is listed.
Bingo!
So I go ahead and update my command with the correct version and mirror:
sudo debootstrap --variant=buildd --arch i386 bullseye /var/chroot/ http://ftp.us.debian.org/debian
It runs for a while and gets further than any of the previous attempts, but there's an issue at the very end:
W: Failure trying to run: chroot "/var/chroot" /bin/true
W: See /var/chroot/debootstrap/debootstrap.log for details
What happened here is that the bullseye version of Linux installed successfully within my /var/chroot/ directory, but the system failed to open a shell within the chroot environment.
I follow the output instructions and view the contents of debootstrap.log. At the end of the log is a more detailed error:
chroot: failed to run command ‘/bin/true’: Exec format error
I Google this error, and the suggested fix is to:
install the qemu-user-static package (required for user emulation)
sudo cp /usr/bin/qemu-arm-static /path/to/mount/usr/bin
systemctl restart systemd-binfmt.service
Now I can try to launch the shell again:
sudo chroot /var/chroot
bash: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
I have no name!@raspberrypi:/
I'm now logged in, but there's no user associated with the session:
whoami
whoami: cannot find name for user ID 0: No such file or directory
Digging deeper
Going through the above guide did not get me where I wanted to be. It was a good start, but I wasn't sure how to add a user in the chroot, or why it was launched without a user in the first place.
The guide also referenced some mount commands that I wasn't familiar with.
The end of the guide also mentioned using schroot instead of chroot, but I felt like I could use a bit more detail.
The last thing that spooked me a bit was that it seemed to imply that doing things incorrectly could result in the accidental erasure of data. That's not what I want.
So I decided to poke around a bit for other resources so that I could broaden my understanding. Some of the references in the initial guide seemed to assume I was more familiar with Linux than I am, so maybe I can find some more beginner-friendly material.
I found this post, which seems to make things a bit more simple, so I follow along with its example.
Making another chroot
Following the Linode guide linked in the last section, I proceed to make a new chroot:
mkdir ~/chroot-jail
sudo debootstrap bullseye ~/chroot-jail
sudo chroot ~/chroot-jail /bin/bash
This time when the chroot launches, I am the root user. I also didn't need to mess with any mirrors or config files. So far, this is much better.
But I still need to learn how to do things in the chroot. I need to explore what I'm able to do, and what I'm not able to do. I also need to figure out what the users of my app should and shouldn't be able to do.
Lots of work ahead.
Let's keep following the guide; it says to install sudo, but I seem to need to do some work before I can get there because I get this error when I run apt install sudo:
E: Can not write log (Is /dev/pts mounted?) - posix_openpt (19: No such device)
Scrolling down in that section of the guide, I see that it instructs to mount the /dev/ directory inside the chroot, along with some other directories:
exit
sudo mount --bind /proc ~/chroot-jail/proc/
sudo mount --bind /sys ~/chroot-jail/sys/
sudo mount --bind /dev ~/chroot-jail/dev/
sudo chroot ~/chroot-jail /bin/bash
apt install sudo
This is better so far, but now I'm starting to see the issue behind the mount points. In this configuration, a user could alter or delete a file in the /proc, /sys or /dev directories, and it would impact the main OS.
I can see that the next section in the guide mentions using schroot instead of chroot to limit the user's access.
schroot
I want to prevent the chroot user from having root access, even inside the chroot, as we have just seen that it has the potential to be dangerous.
Following the guide:
exit
which schroot
/usr/bin/schroot
sudo vim /etc/schroot/schroot.conf
[bullseye]
description=Raspbian Bullseye
location=/home/sharif/chroot-jail
priority=3
users=sharif
groups=sbuild
root-groups=root
schroot -c bullseye
W: line 87 [bullseye] priority: Could not parse value ‘3’
W: line 86 [bullseye]: Obsolete key ‘location’ used
I: This option has been removed, and no longer has any effect
W: Failed to change to directory ‘/home/sharif’: No such file or directory
I: The directory does not exist inside the chroot. Use the --directory option to run the command in a di
fferent directory.
W: Falling back to directory ‘/’
W: Shell ‘/usr/bin/zsh’ not available: /usr/bin/zsh: Failed to stat file: No such file or directory
W: Falling back to shell ‘/bin/bash’
Going through the output line by line, I can start to see what's happening:
W: line 87 [bullseye] priority: Could not parse value ‘3’
- the
priority line was leftover from the first guide I followed. I'll remove it
W: line 86 [bullseye]: Obsolete key ‘location’ used
I: This option has been removed, and no longer has any effect
- looks like another issue from the previous config file. I see in the new guide that the key has been updated to
directory instead of location, so I make that change
W: Failed to change to directory ‘/home/sharif’: No such file or directory
I: The directory does not exist inside the chroot. Use the --directory option to run the command in a different directory.
it looks like I misunderstood what I was specifying in the config file. I thought I was pointing to the directory that the chroot was under, but it instead wants the directory to load inside the chroot
I assume I will need to first create a user inside the chroot, then point to that user's directory in the config file
W: Falling back to directory ‘/’
- since there was no valid user for the chroot to load, we default to the root user directory
W: Shell ‘/usr/bin/zsh’ not available: /usr/bin/zsh: Failed to stat file: No such file or directory
W: Falling back to shell ‘/bin/bash’
I believe what happened here is that it tried to load zsh as my shell from the main operating system, because that is my user's default shell
This error should go away once I create a new user because their default shell will be bash and not zsh
So the first thing I need to do is create a user within the chroot. I remember now that I had to follow the guide's instructions out of order, and that there were steps on creating a user in the guide:
adduser chroot-test sudo
-bash: adduser: command not found
man useradd
-bash: man: command not found
$ which useradd
$ man useradd
-bash: man: command not found
Looks like I'm not able to add users within the chroot. I'll try installing the package(s) it calls out:
$ apt-get install man
E: Could not open lock file /var/lib/dpkg/lock-frontend - open (13: Permission denied)
E: Unable to acquire the dpkg frontend lock (/var/lib/dpkg/lock-frontend), are you root?
$ pwd
/
$ whoami
whoami: cannot find name for user ID 1000
Ah, that's right. I'm still in the chroot that was launched with schroot, not the initial one I launched to install sudo. So I'll switch back to that:
exit
sudo chroot ~/chroot-jail /bin/bash
useradd -m chroot-user
ls /home
chroot-user
usermod -aG sudo chroot-user
groups chroot-user
chroot-user : chroot-user sudo
Now I need to exit the chroot, go back to the schroot configuration file, and see if it works with my new user:
exit
sudo vim /etc/schroot/schroot.conf
[bullseye]
description=Raspbian Bullseye
directory=/home/sharif/chroot-jail
users=chroot-user
groups=sbuild
root-groups=root
schroot -c bullseye
E: Access not authorised
I: You do not have permission to access the schroot service
I: This failure will be reported.
sudo schroot -c bullseye
W: Failed to change to directory ‘/home/sharif’: No such file or directory
I: The directory does not exist inside the chroot. Use the --directory option to run the command in a different directory.
W: Falling back to directory ‘/root’
exit
sudo vim /etc/schroot/schroot.conf
[bullseye]
description=Raspbian Bullseye
directory=/home/chroot-user
users=chroot-user
groups=sbuild
root-groups=root
sudo schroot -c bullseye
E: Failed to change to directory ‘/home/chroot-user’: No such file or directory
Seems to be some sort of circular logic here. I look back at the guide and see that it specifically says the user we are using in the chroot must match the user we are using to access the chroot.
I read this as: I need to also create a chroot-user in the actual operating system before I can use it in the chroot.
But, I'm tired, and sort of did the opposite by adding a sharif user to the chroot. Let's look at the effects of this mistake before correcting it:
sudo chroot ~/chroot-jail /bin/bash
useradd -m sharif
ls /home
chroot-user sharif
groups sharif
sharif : sharif
sudo usermod -aG sudo sharif
exit
sudo vim /etc/schroot/schroot.conf
[bullseye]
description=Raspbian Bullseye
directory=/home/sharif/chroot-jail
users=sharif
groups=sbuild
root-groups=root
schroot -c bullseye
W: Shell ‘/usr/bin/zsh’ not available: /usr/bin/zsh: Failed to stat file: No such file or directory
W: Falling back to shell ‘/bin/bash’
chroot-user@raspberrypi:~$ pwd
/home/sharif
chroot-user@raspberrypi:~$ whoami
chroot-user
chroot-user@raspberrypi:~$ cd ..
chroot-user@raspberrypi:/home$ ls
chroot-user sharif
chroot-user@raspberrypi:/home$ cd sharif/
chroot-user@raspberrypi:~$ ls -la
total 20
drwxr-xr-x 2 sharif sharif 4096 May 17 11:59 .
drwxr-xr-x 4 root root 4096 May 17 11:59 ..
-rw-r--r-- 1 sharif sharif 220 Mar 27 2022 .bash_logout
-rw-r--r-- 1 sharif sharif 3526 Mar 27 2022 .bashrc
-rw-r--r-- 1 sharif sharif 807 Mar 27 2022 .profile
chroot-user@raspberrypi:~$ pwd
/home/sharif
chroot-user@raspberrypi:~$ cd ../chroot-user/
chroot-user@raspberrypi:/home/chroot-user$ ls -la
total 20
drwxr-xr-x 2 chroot-user chroot-user 4096 May 17 11:41 .
drwxr-xr-x 4 root root 4096 May 17 11:59 ..
-rw-r--r-- 1 chroot-user chroot-user 220 Mar 27 2022 .bash_logout
-rw-r--r-- 1 chroot-user chroot-user 3526 Mar 27 2022 .bashrc
-rw-r--r-- 1 chroot-user chroot-user 807 Mar 27 2022 .profile
chroot-user@raspberrypi:/home/chroot-user$ exit
So the problem is that I am logged into the chroot as the correct user, chroot-user, but there are some issues
The first logical step is to remove the sharif user from the chroot:
schroot -c bullseye
cd /home/chroot-user
sudo userdel -r sharif
We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:
[sudo] password for chroot-user:
Oops, I never set a password when I created chroot-user. Let's see if I can fix that from within the chroot:
passwd chroot-user
Changing password for chroot-user.
Current password:
Hm, I'm prompted for a password when trying to change the password. That won't do. Let me try in the original chroot:
exit
sudo chroot ~/chroot-jail /bin/bash
ls /home
chroot-user sharif
userdel -r sharif
userdel: sharif mail spool (/var/mail/sharif) not found
ls /home
chroot-user
passwd chroot-user
New password:
Retype new password:
passwd: password updated successfully
cat /etc/passwd
Now I can do what I should have done originally -- create chroot-user on the base OS
exit
sudo adduser chroot-user
sudo adduser chroot-user sudo
Now I need to adjust the schroot config again to make sure it points to the right user directory:
sudo vim /etc/schroot/schroot.conf
[bullseye]
description=Raspbian Bullseye
directory=/home/sharif/chroot-jail
users=chroot-user
groups=sbuild
root-groups=root
schroot -c bullseye
E: Access not authorised
I: You do not have permission to access the schroot service.
I: This failure will be reported.
sudo schroot -c bullseye
W: Failed to change to directory ‘/home/sharif’: No such file or directory
I: The directory does not exist inside the chroot. Use the --directory option to run the command in a different directory.
W: Falling back to directory ‘/root’
I think I finally understand the issue (at least partially).
It's trying to start the chroot from the base OS in the directory /home/sharif/chroot-jail, which does exist -- but that path (up until /chroot-jail also needs to be mirrored in the chroot OS, and since I removed thesharif user from the chroot, it no longer exists.
I believe the directory key will force the directory to be created on the base OS if it isn't already, but it can't create a folder in the chroot OS.
Time to try it out
sudo vim /etc/schroot/schroot.conf
[bullseye]
description=Raspbian Bullseye
directory=/home/chroot-user/chroot-jail
users=chroot-user
groups=sbuild
root-groups=root
schroot -c bullseye
E: Access not authorised
I: You do not have permission to access the schroot service.
I: This failure will be reported.
sudo schroot -c bullseye
E: Failed to change to directory ‘/home/chroot-user/chroot-jail’: No such file or directory
Okay, so I think the issue is that I set up the chroot-jail folder under my sharif user, and I now need to move it to chroot-user for the above to work:
sudo mv /home/sharif/chroot-jail /home/chroot-user/
ls ~/
ls /home/chroot-user
chroot-jail
schroot -c bullseye
E: Access not authorised
I: You do not have permission to access the schroot service.
I: This failure will be reported.
sudo schroot -c bullseye
W: Failed to change to directory ‘/home/sharif’: No such file or directory
I: The directory does not exist inside the chroot. Use the --directory option to run the command in a different directory.
And now I am back to being confused. I am not sure why the chroot is trying to access /home/sharif because it is not referenced in the configuration file.
I source my shell, then get a more fitting error message:
source ~/.zshrc
sudo schroot -c bullseye
E: Failed to change to directory ‘/home/chroot-user/chroot-jail ’: No such file or directory
ls /home/chroot-user
chroot-jail
The folder looks like it's there. so maybe it's a permissions issue?
ls -la /home/chroot-user
drwxr-xr-x 3 chroot-user chroot-user 4096 May 17 09:55 .
drwxr-xr-x 5 root root 4096 May 17 09:41 ..
-rw-r--r-- 1 chroot-user chroot-user 220 May 17 09:41 .bash_logout
-rw-r--r-- 1 chroot-user chroot-user 3523 May 17 09:41 .bashrc
drwxr-xr-x 17 root root 4096 May 17 05:48 chroot-jail
Maybe it's because the chroot-jail folder is owned by root?
sudo chown chroot-user:chroot-user /home/chroot-user/chroot-jail
ls -la /home/chroot-user
drwxr-xr-x 3 chroot-user chroot-user 4096 May 17 09:55 .
drwxr-xr-x 5 root root 4096 May 17 09:41 ..
-rw-r--r-- 1 chroot-user chroot-user 220 May 17 09:41 .bash_logout
-rw-r--r-- 1 chroot-user chroot-user 3523 May 17 09:41 .bashrc
drwxr-xr-x 17 chroot-user chroot-user 4096 May 17 05:48 chroot-jail
-rw-r--r-- 1 chroot-user chroot-user 1670 May 17 09:41 .mkshrc
-rw-r--r-- 1 chroot-user chroot-user 807 May 17 09:41 .profile
schroot -c bullseye
E: Access not authorised
I: You do not have permission to access the schroot service.
I: This failure will be reported.
sudo schroot -c bullseye
E: Failed to change to directory ‘/home/chroot-user/chroot-jail ’: No such file or directory
sudo vim /etc/schroot/schroot.conf
schroot -c bullseye
E: Access not authorised
I: You do not have permission to access the schroot service.
I: This failure will be reported.
sudo schroot -c bullseye
W: Failed to change to directory ‘/home/sharif’: No such file or directory
I: The directory does not exist inside the chroot. Use the --directory option to run the command in a different directory.
W: Failed to change to directory ‘/root’: No such file or directory
I: The directory does not exist inside the chroot. Use the --directory option to run the command in a different directory.
W: Falling back to directory ‘/’
W: Shell ‘/bin/bash’ not available: /bin/bash: Failed to stat file: No such file or directory
W: Shell ‘/bin/sh’ not available: /bin/sh: Failed to stat file: No such file or directory
W: Falling back to shell ‘/bin/sh’
E: Failed to execute “/bin/sh”: No such file or directory
Now I get even more errors! My understanding of the configuration needs a little work. One thing that I can say is that it seems related to file permissions between the base OS and the chroot.
I decide to look up the documentation for schroot, and it looks like I might need to specify my chroot type as directory :
[bullseye]
description=Raspbian Bullseye
type=directory
directory=/home/chroot-user/chroot-jail
users=chroot-user
groups=sbuild
root-groups=root
schroot -c bullseye
E: Access not authorised
I: You do not have permission to access the schroot service.
I: This failure will be reported.
sudo schroot -c bullseye
I know that I should be able to run the schroot -c bullseye command without elevated permissions. When I get an error, I know that there is something amiss with the configuration. However, when I run it with sudo, I typically get some more information about why the command failed.
This time, when I run it with sudo, I get no errors, but I still don't get the desired behavior. For one, it puts me in the /home/sharif directory on the base OS, not the chroot. Even worse, when I run a whoami, I get back root.
I need to understand why this is happening. I think I will try un-commenting one of the more basic-looking configs in the schroot.conf file and see what happens:
[sid]
description=Debian sid (unstable)
directory=/srv/chroot/sid
users=rleigh
groups=sbuild
root-groups=root
aliases=unstable,default
schroot -c sid
E: Access not authorised
I: You do not have permission to access the schroot service.
I: This failure will be reported.
sudo schroot -c sid
E: Failed to change to directory ‘/srv/chroot/sid’: No such file or directory
Running the command with sudo gives an error that the directory doesn't exist, so I create it and try again:
sudo mkdir -p /srv/chroot/sid
sudo schroot -c sid
W: Failed to change to directory ‘/home/sharif’: No such file or directory
I: The directory does not exist inside the chroot. Use the --directory option to run the command in a different directory.
W: Failed to change to directory ‘/root’: No such file or directory
I: The directory does not exist inside the chroot. Use the --directory option to run the command in a different directory.
W: Falling back to directory ‘/’
W: Shell ‘/bin/bash’ not available: /bin/bash: Failed to stat file: No such file or directory
W: Shell ‘/bin/sh’ not available: /bin/sh: Failed to stat file: No such file or directory
W: Falling back to shell ‘/bin/sh’
E: Failed to execute “/bin/sh”: No such file or directory
So, this is strange... even though there is no reference to /home/sharif in the config file, it is looking for that directory in the chroot. Did I maybe mess something up with the chroot-user ?
I decide to look back at the guide I was originally following, and start fresh. Maybe I will notice something that I didn't before, now that I have a bit more experience with it.
I start by deleting the chroot-jail folder that I tried to assign to the chroot-user, delete the user, recreate the chroot-jail folder, and reinstall the chroot OS there:
sudo rm -rf /home/chroot-user/chroot-jail
sudo userdel -r chroot-user
mkdir ~/chroot-jail
sudo debootstrap bullseye ~/chroot-jail
The install runs for a while, but ends with an error when trying to run the chroot:
W: Failure trying to run: chroot "/home/sharif/chroot-jail" dpkg --force-overwrite --force-confold --skip-same-version -
-install /var/cache/apt/archives/libapparmor1_2.13.6-10_armhf.deb /var/cache/apt/archives/libargon2-1_0~20171227-0.2_arm
hf.deb /var/cache/apt/archives/libcryptsetup12_2%3a2.3.7-1+deb11u1_armhf.deb /var/cache/apt/archives/libip4tc2_1.8.7-1_a
rmhf.deb /var/cache/apt/archives/libjson-c5_0.15-2_armhf.deb /var/cache/apt/archives/libkmod2_28-1_armhf.deb /var/cache/
apt/archives/libcap2_1%3a2.44-1_armhf.deb /var/cache/apt/archives/dmsetup_2%3a1.02.175-2.1_armhf.deb /var/cache/apt/arch
ives/libdevmapper1.02.1_2%3a1.02.175-2.1_armhf.deb /var/cache/apt/archives/systemd_247.3-7+deb11u2_armhf.deb
W: See /home/sharif/chroot-jail/debootstrap/debootstrap.log for details (possibly the package systemd is at fault)
The first message is a bit tough to unpack, so I go to the second, which gives me a file path for a log that I can view:
cat /home/sharif/chroot-jail/debootstrap/debootstrap.log
dpkg: error processing package systemd (--install):
installed systemd package post-installation script subprocess returned error exit status 73
Processing triggers for libc-bin (2.31-13+deb11u6) ...
Errors were encountered while processing:
systemd
The dpkg error seems more specific, so I start by googling that.
I end up on this post, and give the accepted answer a try:
stat / /dev /var
It looks like root is the owner of all those directories, so I believe my problem is a different one. The post above gives credit to another post, which has another answer that includes removing /var/lib/dpkg/info/systemd*. Somebody in the comments said this fixed the problem, but now they have warnings about missing files when they use apt-get to install something. I'm not sure if I like this solution.
I decide to go back to my Google search results. Another post suggests running sudo apt update:
sudo apt update
Now I should be able to try and run the chroot again since the install worked; the problem is with launching the chroot. Time to see if the update fixed it:
sudo chroot ~/chroot-jail /bin/bash
This works, but now the problem is that I'm using chroot, which gives full access to the chroot, when I need to be using schroot for limited access.
I continue following the instructions in the guide:
adduser sharif
adduser sharif sudo
exit
sudo mount --bind /proc ~/chroot-jail/proc/
sudo mount --bind /sys ~/chroot-jail/sys/
sudo mount --bind /dev ~/chroot-jail/dev/
[bullseye]
description=Raspbian Bullseye
directory=/home/sharif/chroot-jail
users=sharif
groups=sbuild
root-groups=root
aliases=bullseye
schroot -c bullseye
It works! The issue was that the user you are launching the command as in the base operating system must match the user in the chroot. I was only halfway there before since I had a matching user in the chroot, but I was not executing the command as that user from the base OS.
Now, the issue is that I don't think the sharif user in the chroot should have root privileges, but my sharif user in the base OS does have root privileges. I think I need to do this again, but with a non-elevated user on both sides:
sudo rm -rf ~/chroot-jail
Ah, that's right. I need to follow the instructions for removing a chroot.
sudo umount ~/chroot-jail/dev
sudo umount ~/chroot-jail/sys
sudo umount ~/chroot-jail/proc
git_prompt_info:3: permission denied: /dev/null
sudo rm -R ~/chroot-jail
git_prompt_info:3: permission denied: /dev/null
It looks like the removal worked, but I'm not sure what the error is for, so back to Google..
Looks like rebooting the system will do the trick:
sudo reboot
Now I need to create the non-root user in the base OS, install the chroot jail under their user this time, then add the user in the chroot:
sudo adduser schrooty
su - schrooty
mkdir ~/chroot-jail
And it is at this point that I realize that I was incorrect in my thought process. Following the instructions for setting up the chroot, sudo is required. That means that I either need to:
run the commands as my sharif user in the base OS, and point to /home/schrooty/root-jail when I install and run chroot
create another user that I add to sudo, which will be used for managing the chroot (I don't want to manage it with my normal user account that I use for everything else)
It's also worth calling out that I'm not sure if the chroot user needs to own the chroot-jail folder, or if it needs to be owned by root. I assume it needs to be owned by the chroot user, as the instructions do not say to run the mkdir command with sudo
It may also be the case that the folder needs to be owned by whatever user is spawning the chroot.
su - sharif
sudo debootstrap bullseye /home/schrooty/chroot-jail
W: Failure trying to run: chroot "/home/schrooty/chroot-jail" dpkg --force-overwrite --force-confold --skip-same-version --install /var/cache/apt/archives/libapparmor1_2.13.6-10_armhf.deb /var/cache/apt/archives/libargon2-1_0~20171227-0.2_armhf.deb /var/cache/apt/archives/libcryptsetup12_2%3a2.3.7-1+deb11u1_armhf.deb /var/cache/apt/archives/libip4tc2_1.8.7-1_armhf.deb /var/cache/apt/archives/libjson-c5_0.15-2_armhf.deb /var/cache/apt/archives/libkmod2_28-1_armhf.deb /var/cache/apt/archives/libcap2_1%3a2.44-1_armhf.deb /var/cache/apt/archives/dmsetup_2%3a1.02.175-2.1_armhf.deb /var/cache/apt/archives/libdevmapper1.02.1_2%3a1.02.175-2.1_armhf.deb /var/cache/apt/archives/systemd_247.3-7+deb11u2_armhf.deb
W: See /home/schrooty/chroot-jail/debootstrap/debootstrap.log for details (possibly the package systemd is at fault)
It's the same error I got last time. I guess running the update didn't do anything. I decide to ignore the warning and try to run the chroot:
sudo chroot /home/schrooty/chroot-jail /bin/bash
adduser schrooty
exit
sudo mount --bind /proc /home/schrooty/chroot-jail/proc/
sudo mount --bind /sys /home/schrooty/chroot-jail/sys/
sudo mount --bind /dev /home/schrooty/chroot-jail/dev/
sudo vim /etc/schroot/schroot.conf
[bullseye]
description=Raspbian Bullseye
directory=/home/schrooty/chroot-jail
users=schrooty
groups=sbuild
root-groups=root
aliases=bullseye
schroot -c bullseye
W: line 91 [bullseye] aliases: Alias ‘bullseye’ already associated with ‘unknown’ chroot
E: Access not authorised
I: You do not have permission to access the schroot service.
I: This failure will be reported.
sudo vim /etc/schroot/schroot.conf
schroot -c bullseye
E: Access not authorised
I: You do not have permission to access the schroot service.
I: This failure will be reported.
sudo schroot -c bullseye
W: Failed to change to directory ‘/home/sharif’: No such file or directory
I: The directory does not exist inside the chroot. Use the --directory option to run the command in a different directory.
W: Falling back to directory ‘/root’
exit
su - schrooty
schroot -c bullseye
It works this time, but there are some issues:
the prompt shows up as I have no name!@raspberrypi
running groups yields: groups: cannot find name for group ID 1003
running whoami yields: whoami: cannot find name for user ID 1002
However, the chroot did launch in the correct directory: /home/schrooty. The problem seems to be that it's not launching the session as schrooty.
After looking online, I learn that is not the reason for this behavior. It is because files like /etc/passwd and /etc/shadow are not present in the chroot, so they need to be mounted like the other directories from the config instructions.
I will keep this post as reference, as the answer was given by the author of the schrooty package
exit
su - sharif
sudo mount --bind /etc/passwd /home/schrooty/chroot-jail/etc/passwd
sudo mount --bind /etc/shadow /home/schrooty/chroot-jail/etc/shadow
su - schrooty
schroot -c bullseye
whoami
schrooty
groups
groups: cannot find name for group ID 1003
Much better! Except I now need to copy the file for groups over to the chroot:
exit
su - sharif
sudo mount --bind /etc/group /home/schrooty/chroot-jail/etc/group
su - schrooty
schroot -c bullseye
pwd
whoami
groups
After alllll of this, I decided to look into how secure chroot (even with schroot) actually is...
And it's not good. It looks relatively easy to exploit.
It looks like a Docker container is going to give me what I'm after, but I still think this was a good exercise.
So, stay tuned for the Docker version of this one I guess 😅
