chroot pre/post requests
Wed 05 February 2014
[caption id="" align="alignright" width="350"]
changed roots (Photo credit: Wikipedia)[/caption]
The chroot command is quite simple but I almost always forget all the prerequest and post-chroot checks that should be done to have a fully operational chrooted environment.
The, chroot operation consist in changing the apparent root of the whole filesystem. Chrooted environnement is usefull mainly for two usages
- maintenance
- isolation
maintenance
for maintenance operation, you typically boot on a live medium (live-USB, live-CD,...) and then chroot onto the usual root of your computer's OS. This operation is done when you cannot boot your normal OS.
prerequests
You must boot from a working linux and take care of the kernel architecture (amd64, i386, ...) that MUST be the same in both chrooted and non-chrooted environment. You also need to be root (the superuser).
Also note your the partition table (mount, /etc/mtab and /etc/fstab are some of your friends). Don't worry for the pseudo-filesystems /dev, /proc and /sys. These lines are ugly, but it is normal.
chroot operation
The recipe looks like:
- prepare your chrooted root filesystem
- create a the directory that will contain the root
- mount the partition in the root (`man mount <http://linux.die.net/man/8/mount>`__)
- mount partition that will be mounted in the future root (e.g. a future /home). note that a partition can be mounted several times
- check the mount options and correct them if necessary (`mount -o remount <http://linux.die.net/man/8/mount>`__)
- mount the pseudo filesystems
- it easier if you chang directory to the futur root
- procfs: mount -t proc proc proc/
- sysfs: mount -t sysfs sys sys/
- devfs: mount -o bind /dev dev/
- /dev/pts: mount -t devfspts pts dev/pts/
- chroot
- `chroot <newroot> <http://linux.die.net/man/1/chroot>`__
- make your maintenance stuff (mkinitramfs, grub-install, grub-update, ...)
post operations
Check that the needed commands work. If they can't, you probably have architecture problems. You should check that your pseudo-filesystem is mounted. Some operations cannot be done without mounting properly /dev, /proc and/or /sys. Most of the time, you won't have any problem without mounting pseudo-filesystem.
You should exit the chrooted environment properly. It is also OK if you only (soft-)reboot.
isolation
In this case, the goal is to present a limited filesystem to an application, so that the application cannot access the OS essential files. In short, you define a filesystem tree in which the application will be jailed. The recipe is the following
- create the, chrooted directory
- copy all needed files into it
- create needed (empty) directories (/dev, /etc, /lib, /usr/sbin, /var/run)
- copy the application-specific config files (should be in /etc/ or /usr/local/etc/)
- copy specific needed binaries (e.g. /usr/sbin/httpd)
- copy data directory (e.g. /var/www)
- you may have trouble with special files (e.g. /dev/null). Use `mknod <http://linux.die.net/man/1/mknod>`__ in this case.
- launch the command into the newly created chrooted environment (chroot <new_root> <command>).
Note that some application (such as proftpd) automatically chroot to release some right. In this case, there is no need to copy needed files and to chroot manually
(Non-)Related articles
- Change Root (wiki.archlinux.org)
- Chroot (wiki.debian.org)
- Debian Virtualization: Back to the Basics (l3net.wordpress.com)
