Filesystem permission problems with user namespaces and debootstrap
Clash Royale CLAN TAG#URR8PPP
I want to build a lightweight process isolation tool built on linux features like namespaces and chroot (in order to understand them better).
I am currently running the following commands to start an isolated process:
sudo debootstrap --no-merged-usr stable /container/1 # get a root file system
unshare --mount --uts --ipc --net --fork --user --map-root-user /bin/bash
chroot /container/1 /bin/bash
unshare --pid --fork /bin/bash # Just to have PID=1
mount -t proc none /proc
mount -t sysfs none /sys
mount -t tmpfs none /tmp
As far as I can tell this isolates the /bin/bash process from all other processes and filesystems. The problem is that every file in the chroot environment (and beyond) is owned by nobody:nogroup, which means nothing works that includes changing files.
In the root namespace the files are owned by the root user (from the debootstrap command).
My idea to fix this was to run the debootstrap command in the same user namespace as the final process. I got this result:
$ unshare --fork --user --map-root-user
# debootstrap stable /container/2
mknod: /home/mocc/test2/test-dev-null: Operation not permitted
E: Cannot install into target '/home/mocc/test2' mounted with noexec or nodev
Remounting the filesystem as mentioned in Cannot install into target mounted with noexec or nodev while doing qemu-deboot strapping didn't work.
Does someone know how to run debootstrap within a user namespace or another solution to the initial problem?
namespace debootstrap unshare
asked Dec 13 at 21:12
Benedikt Bock
10813
add a comment |
I want to build a lightweight process isolation tool built on linux features like namespaces and chroot (in order to understand them better).
I am currently running the following commands to start an isolated process:
sudo debootstrap --no-merged-usr stable /container/1 # get a root file system
unshare --mount --uts --ipc --net --fork --user --map-root-user /bin/bash
chroot /container/1 /bin/bash
unshare --pid --fork /bin/bash # Just to have PID=1
mount -t proc none /proc
mount -t sysfs none /sys
mount -t tmpfs none /tmp
As far as I can tell this isolates the /bin/bash process from all other processes and filesystems. The problem is that every file in the chroot environment (and beyond) is owned by nobody:nogroup, which means nothing works that includes changing files.
In the root namespace the files are owned by the root user (from the debootstrap command).
My idea to fix this was to run the debootstrap command in the same user namespace as the final process. I got this result:
$ unshare --fork --user --map-root-user
# debootstrap stable /container/2
mknod: /home/mocc/test2/test-dev-null: Operation not permitted
E: Cannot install into target '/home/mocc/test2' mounted with noexec or nodev
Remounting the filesystem as mentioned in Cannot install into target mounted with noexec or nodev while doing qemu-deboot strapping didn't work.
Does someone know how to run debootstrap within a user namespace or another solution to the initial problem?
namespace debootstrap unshare
asked Dec 13 at 21:12
Benedikt Bock
10813
1
the unshare command is not designed to handle complex uid translations (it translates only current user to root with --map-root-user). So you'll need an other tool to handle this (eg lxc, or maybe newuidmap), along first a translation (using some manual script doing a lot of chown) of all the uid to an other range. Seeman subuidto get an idea.
– A.B
Dec 13 at 23:53
add a comment |
I want to build a lightweight process isolation tool built on linux features like namespaces and chroot (in order to understand them better).
I am currently running the following commands to start an isolated process:
sudo debootstrap --no-merged-usr stable /container/1 # get a root file system
unshare --mount --uts --ipc --net --fork --user --map-root-user /bin/bash
chroot /container/1 /bin/bash
unshare --pid --fork /bin/bash # Just to have PID=1
mount -t proc none /proc
mount -t sysfs none /sys
mount -t tmpfs none /tmp
As far as I can tell this isolates the /bin/bash process from all other processes and filesystems. The problem is that every file in the chroot environment (and beyond) is owned by nobody:nogroup, which means nothing works that includes changing files.
In the root namespace the files are owned by the root user (from the debootstrap command).
My idea to fix this was to run the debootstrap command in the same user namespace as the final process. I got this result:
$ unshare --fork --user --map-root-user
# debootstrap stable /container/2
mknod: /home/mocc/test2/test-dev-null: Operation not permitted
E: Cannot install into target '/home/mocc/test2' mounted with noexec or nodev
Remounting the filesystem as mentioned in Cannot install into target mounted with noexec or nodev while doing qemu-deboot strapping didn't work.
Does someone know how to run debootstrap within a user namespace or another solution to the initial problem?
namespace debootstrap unshare
asked Dec 13 at 21:12
Benedikt Bock
10813
I want to build a lightweight process isolation tool built on linux features like namespaces and chroot (in order to understand them better).
I am currently running the following commands to start an isolated process:
sudo debootstrap --no-merged-usr stable /container/1 # get a root file system
unshare --mount --uts --ipc --net --fork --user --map-root-user /bin/bash
chroot /container/1 /bin/bash
unshare --pid --fork /bin/bash # Just to have PID=1
mount -t proc none /proc
mount -t sysfs none /sys
mount -t tmpfs none /tmp
As far as I can tell this isolates the /bin/bash process from all other processes and filesystems. The problem is that every file in the chroot environment (and beyond) is owned by nobody:nogroup, which means nothing works that includes changing files.
In the root namespace the files are owned by the root user (from the debootstrap command).
My idea to fix this was to run the debootstrap command in the same user namespace as the final process. I got this result:
$ unshare --fork --user --map-root-user
# debootstrap stable /container/2
mknod: /home/mocc/test2/test-dev-null: Operation not permitted
E: Cannot install into target '/home/mocc/test2' mounted with noexec or nodev
Remounting the filesystem as mentioned in Cannot install into target mounted with noexec or nodev while doing qemu-deboot strapping didn't work.
Does someone know how to run debootstrap within a user namespace or another solution to the initial problem?
namespace debootstrap unshare
namespace debootstrap unshare
asked Dec 13 at 21:12
Benedikt Bock
10813
asked Dec 13 at 21:12
Benedikt Bock
10813
asked Dec 13 at 21:12
Benedikt Bock
10813
asked Dec 13 at 21:12
Benedikt Bock
10813
asked Dec 13 at 21:12
Benedikt Bock
10813
10813
1
the unshare command is not designed to handle complex uid translations (it translates only current user to root with --map-root-user). So you'll need an other tool to handle this (eg lxc, or maybe newuidmap), along first a translation (using some manual script doing a lot of chown) of all the uid to an other range. Seeman subuidto get an idea.
– A.B
Dec 13 at 23:53
add a comment |
1
the unshare command is not designed to handle complex uid translations (it translates only current user to root with --map-root-user). So you'll need an other tool to handle this (eg lxc, or maybe newuidmap), along first a translation (using some manual script doing a lot of chown) of all the uid to an other range. Seeman subuidto get an idea.
– A.B
Dec 13 at 23:53
1
1
the unshare command is not designed to handle complex uid translations (it translates only current user to root with --map-root-user). So you'll need an other tool to handle this (eg lxc, or maybe newuidmap), along first a translation (using some manual script doing a lot of chown) of all the uid to an other range. See
man subuid to get an idea.– A.B
Dec 13 at 23:53
the unshare command is not designed to handle complex uid translations (it translates only current user to root with --map-root-user). So you'll need an other tool to handle this (eg lxc, or maybe newuidmap), along first a translation (using some manual script doing a lot of chown) of all the uid to an other range. See
man subuid to get an idea.– A.B
Dec 13 at 23:53
add a comment |
active
oldest
votes
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f487870%2ffilesystem-permission-problems-with-user-namespaces-and-debootstrap%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f487870%2ffilesystem-permission-problems-with-user-namespaces-and-debootstrap%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
the unshare command is not designed to handle complex uid translations (it translates only current user to root with --map-root-user). So you'll need an other tool to handle this (eg lxc, or maybe newuidmap), along first a translation (using some manual script doing a lot of chown) of all the uid to an other range. See
man subuidto get an idea.– A.B
Dec 13 at 23:53