schroot - chroot for any users
Posted by amadeu on Tue 27 Nov 2007 at 15:06
schroot allows the user to run a command or a login shell in a chroot environment. If no command is specified, a login shell will be started in the user current working directory inside the chroot.
I've been trying some virtual machines solutions to execute some programs 32bits in my machine. But it's take very time, start a xen VM or virtualbox. Often this solutions needs some maintain additional costs to setup a X server to run any X-based program.
My initial motivation was that wengophone wasn't in Debian lenny for amd64 until some days ago. Thus I did want to run a x-based program in a single chroot as normal user.
The schroot makes a chroot's use easy! Very easy for end users.
- install into your original installation:
# aptitude install schroot
- configure the /etc/schroot/schroot.conf like:
[sid] description=Debian sid (unstable) type=directory location=/srv/chroot/sid priority=3 users=YOUR_USER groups=SOME_GROUP_LIKE_users root-groups=YOUR_ADMIN_USER run-setup-scripts=true run-exec-scripts=true
- creating a chroot:
# debootstrap --arch i386 sid /srv/chroot/sid http://ftp.br.debian.org/debian
- installing 32bit programs in the chroot:
# schroot -c sid -p aptitude install wengophone
- to run X programs make sure that your X session accept it and execute the schroot:
$ xhost + $ schroot -c sid -p wengophone
- there is a more safer way to run X programs like comments below and a example of wengophone_wrapper script
- it isn't need mount /proc on fstab or other because run-setup-scripts and run-exec-scripts take care of this, but you should look the /etc/schroot/mount-defaults to set your specific directories
- create a wrapper script /usr/local/bin/wengophone_wrapper:
#!/bin/bash ## UPDATED after the comment #16 to reduce security risk ;-) # right way for export Xauthority file xauth extract /srv/chroot/sid$HOME/.Xauthority $DISPLAY # run your command schroot -c sid -p wengophone # remove the Xauthority rm -f /srv/chroot/sid$HOME/.Xauthority
- permissions :
# chmod +x /usr/local/bin/wengophone_wrapper
- now you could create some wengo.desktop for your users :-)
Cheers
--
Dave
[ Parent | Reply to this comment ]
[ Send Message | View Steve's Scratchpad | View Weblogs ]
Fixed now, thanks. I didn't test all the steps myself on this one - I'll be more careful in the future.
[ Parent | Reply to this comment ]
xhost localhost
Even though the chances of someone exploiting your explicit allow of x clients is unlikely, it isn't impossible.
---
Jeff Schroeder
http://www.digitalprognosis.com
[ Parent | Reply to this comment ]
Back when I used a chroot I followed the guide on Alioth:
https://alioth.debian.org/docman/view.php/30192/21/debian-amd64-h owto.html
--
"It's Not Magic, It's Work"
Adam
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
--
"It's Not Magic, It's Work"
Adam
[ Parent | Reply to this comment ]
amadeu@sarang:~$ xhost access control enabled, only authorized clients can connect amadeu@sarang:~$ xhost localhost localhost being added to access control list amadeu@sarang:~$ schroot -c sid -p skype I: [sid chroot] Running command: "skype" Xlib: connection to ":0.0" refused by server Xlib: No protocol specified
But when I try xhost + works.. then I recommend xhost + before the schroot and xhost - after. Really I didn't understand why xhost localhost don't work with me.. ;) Amadeu
[ Parent | Reply to this comment ]
If you want to enable local connections (as in DISPLAY=:0.0), "xhost +local:" is your command.
Cheers,
Johannes
[ Parent | Reply to this comment ]
ssh -Y node22chr matlabindeed it requers to setup chroot in a bit fuller way -- user accounts, restart on boot, etc; but it had its benefit: I had fully functional chrooted environment which looked the same as the original host (but of different architecture) for any user who logged in into node22chr instead of node22 ;-)
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
--
"It's Not Magic, It's Work"
Adam
[ Parent | Reply to this comment ]
From the Debian AMD64 Howto (Site currently down):
To run an application inside the chroot you will need some parts of your 64bit system tree inside the chroot. This can be achieved with a bind mount. In this example we will bind /tmp to the chroot for the X11 sockets which are in /tmp, and bind /home to access the home directories from within the chroot. You may also want to mount the /dev, /proc and /sys filesystems within the chroot. Edit your fstab and add the required paths:
# sid32 chroot
/home /var/chroot/sid-ia32/home none bind 0 0
/tmp /var/chroot/sid-ia32/tmp none bind 0 0
/dev /var/chroot/sid-ia32/dev none bind 0 0
/proc /var/chroot/sid-ia32/proc none bind 0 0Then mount them:
mount /var/chroot/sid-ia32/home
mount /var/chroot/sid-ia32/tmp
mount /var/chroot/sid-ia32/dev
mount /var/chroot/sid-ia32/proc
I use this to run 32-bit programs on my 64-bit system, which works very well, since I can just work in my normal home directory.
A word of caution though: schroot generates sessions that are stored in /var/lib/schroot/session/ and if you don't end these sessions then they accumulate. Each time you do a reboot your system will power up more slowly, because it starts recovering those schroot sessions. For some reason my sessions did not get ended, despite using the --automatic-session option.
So one night late I did something that I later on deeply regretted: I wanted to delete the accumulated schroot sessions, and for some reason could not get them removed using the schroot -e command. So I uninstalled schroot, but the /var/lib/schroot/session directory was still present. Using the power of root I deleted this directory. This was not a good idea! My entire home partition was deleted, along with the other partitions that were bound!
I should have unmounted the bound directories first and everything would have been fine.
[ Parent | Reply to this comment ]
of mad tweaking on a new system. I learned to backup more frequently
and to selectively bind mount.
Here's a basic recipe for X.
[/etc/fstab additions]
/tmp/.X11-unix /srv/chroot/sid_i386/tmp/.X11-unix none rbind,user,noauto 0 0
/home/joe/.Xauthority /srv/chroot/sid_i386/home/joe/.Xauthority none rbind,user,noauto 0 0
[commands]
# sudo touch /srv/chroot/sid_i386/home/joe/.Xauthority
# mount /srv/chroot/sid_i386/home/joe/.Xauthority
# mount /srv/chroot/sid_i386/tmp/.X11-unix
# schroot -p -c sid_i386 -- ls -l .Xauthority
I: [sid_i386-b53b5f82-46d0-4e15-b95e-8129e22f9dc9 chroot] Running command: "ls -l .Xauthority"
-rw------- 1 joe joe 171 2007-12-12 00:03 .Xauthority
# schroot -p -c xterm
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
Please read manpage (look for "startup scripts", "exec scripts")
[ Parent | Reply to this comment ]
Thanks again.. :)
PS: I updated the article because this ;-)
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
1. use the file /etc/schroot/mount-defaults (in debian works) and add there lines like in /etc/fstab
2. example, to mount a directory from my main installation:
/home /home none rw,bind 0 0
/dev/hda /media/cdrom udf,iso9660 user,noauto 0 0
If you want usb devices and others.. I think the right way is to install hal/dbus in your chroot installation. If you want 'automount' feature from autofs, you need just put some line in mount-defaults as in /etc/fstab (tips: http://www.linuxfocus.org/Turkce/January2001/article141.meta.shtm l).
Regards, Amadeu.
[ Parent | Reply to this comment ]
For auto-mounting from /etc/schroot/mount-defaults to work, you must have a 'type=' in schroot.conf set to one of the types other than 'plain'. If type is 'plain' or is omitted, auto-mounting is disabled. See 'man schroot.conf' for details.
[ Parent | Reply to this comment ]
'xhost +local:'
instead of
'xhost +'
which is muuuuuuuuuuuch safer
[ Parent | Reply to this comment ]
Thanks a lot.
[ Parent | Reply to this comment ]
schroot -p xterm
I: [my_system chroot] Running command: "xterm"
Warning: Tried to connect to session manager, Authentication Rejected, reason : None of the authentication protocols specified are supported and host-based authentication failed
xterm: Error 32, errno 2: No such file or directory
Reason: get_pty: not enough ptys
try adding:
/dev/pts /path_to_chroot/dev/pts devpts bind,defaults 0 0
in /etc/fstab
and executing
mount -a
[ Parent | Reply to this comment ]
Use openroot for this: http://www.elstel.com/openroot/
other features: auto-mounting of /dev, /proc, /media, ...
other features: chroot to read-only partition with temporary changes
[ Parent | Reply to this comment ]