4

How do I allow a user to use SCREEN on a chrooted user?

I have tried everything but I keep on failing.

I need the user to be able to use SCREEN when they are logged in bash as a chrooted user.

  • The chrooted user must have enough access to open a new pty, also your question needs more info, do you use any extra security on your system (grsec, selinux, other)? – xception Oct 12 '12 at 20:09
5

SCREEN probably needs devpts, the pseudo-terminal filesystem, to be mounted on /dev/pts inside the chroot.

mount -t devpts none "$rootpath/dev/pts" -o ptmxmode=0666,newinstance

ln -fs "pts/ptmx" "$rootpath/dev/ptmx"

(The newinstance flag is optional; it gives the user a completely separate pty list, preventing them from knowing what other users are logged in.)

| improve this answer | |
  • Do I do that on the root user? – Muktadir Miah Oct 12 '12 at 20:16
  • @MuktadirMiah: Yes, and you do that for every user's chroot. (You can automate it with pam_exec.) – user1686 Oct 12 '12 at 20:32
  • "I ran "mount -t devpts none "/home/jail/dev/pts" -o ptmxmode=0666,newinstance" I get the error "mount: mount point /home/jail/dev/pts does not exist" I used this tutorial to chroot the user: dharmitshah.blogspot.co.uk/2011/12/… – Muktadir Miah Oct 14 '12 at 17:06
  • If the mountpoint does not exist, create it. With mkdir. – user1686 Oct 14 '12 at 17:17
  • I have done it but still I get "-su: screen: command not found" on the chrooted user. – Muktadir Miah Oct 14 '12 at 17:23
1

In out-of-stock Ubuntu-14.04 this also can be achieved with one "mount" and one "chmod".

Here is /mnt/old is chroot's target directory (new "root"). Also assumed user user belongs to group of /mnt/old/run directory (will be a /run in chroot-ed environment).

sudo mount --bind /dev/pts /mnt/old/dev/pts sudo chmod g+w /mnt/old/run sudo chroot --userspec=user:user /mnt/old screen

Caveats: Not sure if sharing of /dev/pts is really a good idea from security perspective, and I would not recommend this method if security is of concern.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.