Entering A Safe Mirror When Logging In With Unionfs And Chroot
1. Introduction
When reading a 'hint' on the website of LinuxFromScratch I discovered the special capabilities of unionfs, specially in combination with chroot. Later I read a HowTo on a wikiwebsite of Gentoo, about entering a chrooted homedirectory when using a special script as shell. Combining these two brings me to using a chrooted environment, which you enter when logging in as a special user. This environment is a exact copy (mirror) of the system you're working on. Because you're in safe copy of the real system, you can do whatever you like, it will never change the system, everything stays inside the cache (the readwrite branch).
Links:
TRIP, a TRIvial Packager for LFS (and other linux systems) - Original hint at the website of LFS
Home_directory_jail - Guide to set up a chroot jail at Gentoo
2. Basic technique
Do whatever you like, install, change and remove files from the system, and no harm whatsoever. Your real system stays untouched. This may sound like magic, but is in reality just possible by combining some techniques from all those available for Linux.
By using the filesystem Unionfs, a chroot and some well chosen remounted directories, you can set up this virtual system.
2.1 Unionfs
The most important part is the use of unionfs. Unionfs gives you the possibility to create a filesystem, which is the union of at least two others. See www.unionfs.org for more info. Now by letting the new filesystem be the union of our original filesytem (the root) in only read mode, and of a temporary filesystem (the cache) in readwrite mode, you'll have a filesystem which looks exactly like your original filesystem, but in which you can modify, delete and/or add files without doing anything to your original system. This is not possible, because the root is mounted readonly. Every modification is by the unionfs stored in the cache.
The only difference between the original and the newly created system is the path: in the new system it always starts with the path of the mountpoint of the union. This is why the next step is necessary.
A special note: today [june 2007] it looks as if unionfs will be included in the kernel. Unionfs is undergoing heavy development at this moment. Look at the website for more info.
On the website you will find information howto enable unionfs. For thye latest kernels (later than 2.6.19) there is a patch for the kernelsource, for not so recent kernels there is a external module.
2.2 (Re)Mounting
One extra thing you'll have to do is (re)mounting several crucial directories like /dev, /proc and /sys. This is because the union filesystem does not preserve existing mount points.
It's also recommended to remount some special directories like /tmp and the directory you're building the software in.
2.3 Chroot
By chrooting to this mountpoint, you enter an environment which is absolutely a copy of your system. You can do whatever you like, even remove crucial directories and files. Test it! Look how far you can go before your system gets stuck.
2.4 Logging in to this environment
Like the concept explained in Home_directory_jail it is possible by creating a special loginshell to enter the environment created with unionfs and chroot.
The idea explained here is to create a special user, with a special shell. This shell will, before entering a interactive shell, first do the necessary steps like mounting the unionfilesystem, remounting some important directories and do the chroot.
3. Preparation
3.1 The cache partition
To start a partition with sufficient space to function as cache. This does not have to be a physical partition, it may be a virtual drive.
Create this drive with:
dd if=/dev/zero of=/mnt/cache.img bs=1M count=500
mkfs.ext2 /mnt/cache.img
mkdir /mnt/cache
mount /mnt/cache.img /mnt/cache -o loop
chmod 777 /mnt/cache
mkdir /mnt/union
This creates a virtual partition (or drive) of 500M.
(Note: the loopback device has to be supported in your kernel. Kernels of most distributions do.)
3.2 Special loginshell
Create a shellscript chroot-union which will do all the necessary steps:
The chroot-union script in /bin:
#!/bin/bash
function mount_unionfs {
# mount temporary filesystems
if [ -z "$(mount -t unionfs | grep -w /mnt/union )" ]; then
sudo /bin/mount -t unionfs -o dirs=/mnt/cache:/=ro unionfs /mnt/union
fi
if [ -n "$(mount -t unionfs | grep -w /mnt/union )" ]; then
# basic system mounts
if [ -z "$(mount | grep -w /mnt/union/dev)" ]; then
sudo /bin/mount --bind /dev /mnt/union/dev 2> /dev/null
fi
if [ -z "$(mount -t devpts | grep -w /mnt/union/dev/pts)" ]; then
sudo /bin/mount -t devpts devpts /mnt/union/dev/pts 2> /dev/null
fi
if [ -z "$(mount -t tmpfs | grep -w /mnt/union/dev/shm)" ]; then
sudo /bin/mount -t tmpfs shm /mnt/union/dev/shm 2> /dev/null
fi
if [ -z "$(mount -t sysfs | grep -w /mnt/union/sys)" ]; then
sudo /bin/mount -t sysfs sysfs /mnt/union/sys 2> /dev/null
fi
if [ -z "$(mount -t proc | grep -w /mnt/union/proc)" ]; then
sudo /bin/mount -t proc proc /mnt/union/proc 2> /dev/null
fi
if [ -z "$(mount | grep -w /mnt/union/tmp)" ]; then
sudo /bin/mount --bind /tmp /mnt/union/tmp 2> /dev/null
fi
else
echo "Mount of /mnt/union failed."
exit 2
fi
}
function umount_unionfs {
#
# unmount /tmp
#
if [ -n "$(mount | grep -w /mnt/union/tmp)" ]; then
sudo /bin/umount /mnt/union/tmp 2> /dev/null
fi
#
# unmount /proc
#
if [ -n "$(mount -t proc | grep -w /mnt/union/proc)" ]; then
sudo /bin/umount /mnt/union/proc 2> /dev/null
fi
#
# unmount /sys
#
if [ -n "$(mount -t sysfs | grep -w /mnt/union/sys)" ]; then
sudo /bin/umount /mnt/union/sys 2> /dev/null
fi
#
# unmount /dev/shm
#
if [ -n "$(mount -t tmpfs | grep -w /mnt/union/dev/shm)" ]; then
sudo /bin/umount /mnt/union/dev/shm 2> /dev/null
fi
#
# unmount /dev/pts
#
if [ -n "$(mount -t devpts | grep -w /mnt/union/dev/pts)" ]; then
sudo /bin/umount /mnt/union/dev/pts 2> /dev/null
fi
#
# unmount /dev
#
if [ -n "$(mount | grep -w /mnt/union/dev)" ]; then
sudo /bin/umount /mnt/union/dev 2> /dev/null
fi
if [ -n "$(mount | grep -w /mnt/union )" ]; then
sudo /bin/umount /mnt/union 2> /dev/null
fi
}
mount_unionfs
# enter the chroot
sudo /usr/sbin/chroot /mnt/union /bin/su --shell /bin/bash --login $USER
# umount temporary filesystems
umount_unionfs
EOF
Add the new loginshell to the /etc/shells file. You'll have to do this when PAM will check the shell.
3.3 Create user and group.
Create a new group and user with this script as shell:
groupadd -g 27 uniongroup
useradd -c "Test user for chrooted union." -d /home/unionuser \
-m -s /bin/chroot-union -g uniongroup -u 27 unionuser
passwd unionuser
3.4 Give the user enough rights
Give the new user more rights with sudo. Add the following line to the configurationfile of sudo, /etc/sudoers:
unionuser ALL=(ALL) ALL
Note: there are other ways to give this user the permissions. I'm looking at them at this moment.
Note: giving these full permissions is too much for a normal user. But for a user which will install software and modify your system it's necessary.
What is possible
Safe and secure environment for normal users
This construction is very suitable for guest users, which you cannot trust. The first thing I'v tried is starting a graphical session. I did not have any problem.
Install software as this user
Another possible use is the installation of software as this user. This can be done as follows:
- as this user install your software. Because of the special construction, all the changes go to the cache.
- after logging out, compare the contents of the cache with the real system.
- the controlling user (root) has the choice to do the real install by simply moving the contents from the cache to the root
For example the compilation and installation of a small package, audiofile-0.2.6. Assume the source is in /tmp. First login:
[root@hostname ]# login
hostname login: unionuser
Password:
Last login: Wed Jun 20 19:58:32 CEST 2007 on pts/0
[unionuser@hostname ]$
Now compile and install the package:
[unionuser@hostname ]$ cd /tmp/audiofile-0.2.6
[unionuser@hostname ]$ ./configure --prefix=/usr
[unionuser@hostname ]$ make
[unionuser@hostname ]$ sudo make install
Now exit the session and check the contents of the cache:
[unionuser@hostname ]$exit
[root@hostname ]# cd /mnt/cache
[root@hostname ]# ls -Al
drwxr-xr-x 3 root root 1024 2007-06-05 17:32 home
drwxr-xr-x 6 root root 1024 2007-06-05 17:37 usr
drwxr-xr-x 3 root root 1024 2007-06-05 17:32 var
[root@hostname ]#
The home directory appears here because the shell Bash changes the file .bash_history; the var directory shows up because of changes in the file /var/run/utmp and directory /var/run/sudo. This proves it works like it should.
Now, when looking to the changes in de /usr directory where I've installed the software gives:
[root@hostname ]# find usr -type f
usr/lib/pkgconfig/audiofile.pc
usr/lib/libaudiofile.la
usr/lib/libaudiofile.a
usr/lib/libaudiofile.so.0.0.2
usr/include/audiofile.h
usr/include/aupvlist.h
usr/include/af_vfs.h
usr/bin/audiofile-config
usr/bin/sfconvert
usr/bin/sfinfo
usr/share/aclocal/audiofile.m4
[root@hostname ]# find usr -type d
usr
usr/lib
usr/lib/pkgconfig
usr/include
usr/bin
usr/share
usr/share/aclocal
As you can see everything is in the /mnt/cache/usr directory.
You can make a backup of this:
[root@hostname ]# find usr | sort -u > /tmp/filelist-audiofile-0.2.6
[root@hostname ]# tar --create --files-from=/tmp/filelist-audiofile-0.2.6 \
--file=/tmp/install-audiofile-0.2.6.tar --directory=/mnt/cache \
--no-recursion --absolute-names --preserve-permissions
It's also very possible to make a backup of all the files which will be overwritten:
[root@hostname ]# for installfile in $(cat /tmp/filelist-audiofile-0.2.6); do \
if [ -e "/$installfile ]; then \
echo "/$installfile" >> /tmp/backup-audiofile-0.2.6 \
fi \
done
[root@hostname ]# tar --create --files-from=/tmp/backup-audiofile-0.2.6 \
--file=/tmp/backup-audiofile-0.2.6.tar --directory=/mnt/cache \
--no-recursion --absolute-names --preserve-permissions
Now do the real install by copying all the files to the root:
[root@hostname ]# for installfile in $(cat /tmp/filelist-audiofile-0.2.6); do \
cp --verbose --force --recursive --parents --no-dereference \
--preserve --target-directory=/ $installfile \
done
Note: the commands above are to illustrate the idea. I've created scripts doing the backing up, checking and installing, and it works very good.
