5

How do I allow a user to use SCREEN on a chrooted user?

I have tried everything but I keep on failing.

I need the user to be able to use SCREEN when they are logged in bash as a chrooted user.

1
  • The chrooted user must have enough access to open a new pty, also your question needs more info, do you use any extra security on your system (grsec, selinux, other)?
    – xception
    Oct 12, 2012 at 20:09

2 Answers 2

5

SCREEN probably needs devpts, the pseudo-terminal filesystem, to be mounted on /dev/pts inside the chroot.

mount -t devpts none "$rootpath/dev/pts" -o ptmxmode=0666,newinstance

ln -fs "pts/ptmx" "$rootpath/dev/ptmx"

(The newinstance flag is optional; it gives the user a completely separate pty list, preventing them from knowing what other users are logged in.)

10
  • Do I do that on the root user? Oct 12, 2012 at 20:16
  • @MuktadirMiah: Yes, and you do that for every user's chroot. (You can automate it with pam_exec.)
    – user1686
    Oct 12, 2012 at 20:32
  • "I ran "mount -t devpts none "/home/jail/dev/pts" -o ptmxmode=0666,newinstance" I get the error "mount: mount point /home/jail/dev/pts does not exist" I used this tutorial to chroot the user: dharmitshah.blogspot.co.uk/2011/12/… Oct 14, 2012 at 17:06
  • If the mountpoint does not exist, create it. With mkdir.
    – user1686
    Oct 14, 2012 at 17:17
  • I have done it but still I get "-su: screen: command not found" on the chrooted user. Oct 14, 2012 at 17:23
1

In out-of-stock Ubuntu-14.04 this also can be achieved with one "mount" and one "chmod".

Here is /mnt/old is chroot's target directory (new "root"). Also assumed user user belongs to group of /mnt/old/run directory (will be a /run in chroot-ed environment).

sudo mount --bind /dev/pts /mnt/old/dev/pts sudo chmod g+w /mnt/old/run sudo chroot --userspec=user:user /mnt/old screen

Caveats: Not sure if sharing of /dev/pts is really a good idea from security perspective, and I would not recommend this method if security is of concern.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.