0

I use a loop in a script to mount --bind special filesystems such as /dev, /dev/pts, /proc, /run, /sys (and /sys/firmware/efi/efivars optionally) this way :

for specialFS in dev dev/pts proc run sys
do
    test -d $destinationRootDir/$specialFS/ || sudo mkdir $destinationRootDir/$specialFS/
    sudo mount -v --bind /$specialFS $destinationRootDir/$specialFS
done
[ -d /sys/firmware/efi ] && sudo mkdir -p $destinationRootDir/sys/firmware/efi/efivars && sudo mount -v --bind /sys/firmware/efi/efivars $destinationRootDir/sys/firmware/efi/efivars

Then I go into the chroot :

sudo chroot $destinationRootDir

mount -a
update-grub
[ -d /sys/firmware/efi ] && grub-install --efi-directory=$(mount | awk '/\/efi /{print$3}') || grub-install $destinationDisk
umount -a
umount /usr && exit

The problem is that /usr cannot be unmounted because the chroot environment thinks /usr is being used by processes that I was able to find running on the host.

So I guess I should NOT use mount --bind for /proc and/or for /run.

Ho can I mount these two properly for my chroot environment to be isolated on the process level ?

0

chroot wasn't designed as security boundary so you shouldn't use it if you don't trust the code inside jail. Check https://access.redhat.com/blogs/766093/posts/1975883 Additionaly if you expose dev/pts it's big chance that your command is launched outside jail via pseudoterminal. It's hard to guess without exact command and parent pid of that command.

| improve this answer | |
  • I don't use chroot for security purposes. I use chroot to repair another Linux system. Still, how can I mount /run for the chroot environment ? – SebMa yesterday
  • You need to answer first why would you like to mount /run, what parts of it to access and under what privileges - you are saying that something is modified while you don't intended to do so - then it's about security. But to configure it properly you need to identify what you or your tool want exactly want achieve under the hood so those mount points are needed – nusch yesterday
  • update-grub (or grub-install, I cant remember which one) needs /run – SebMa yesterday

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.