chroot --userspec keeps root environment variables

Gullible Jones · 2012-09-11 00:09:53

So I'm trying to write a very simple chroot sandboxing script. I want zero suid binaries inside the sandbox, so I remount all the requisite directories ro,nosuid. I figure I can avoid using su (and get a slightly more secure sandbox) by using --userspec when chrooting into the sandbox.

This mostly works - it chroots in with the limited user's permissions. Unfortunately though, it somehow keeps all the environment variables from when it was running as root. These can be changed manually, but I figure there has to be a better way.

Is there? Or is this another case of Linux chroot not being designed for security?

djgera · 2012-09-11 01:17:16

execute with "env -i", or if you are using systemd, there is a much better tool: systemd-nspawn.;)

Gullible Jones · 2012-09-11 02:29:25

Close but not quite there, that just wipes all the environment variables. Any idea how I could get the default variables for $USER from there? Thanks, BTW.

djgera · 2012-09-11 16:25:24

Assign each one, for example:

chroot $BASE /usr/bin/env -i HOME=/root USER=root /bin/bash -l

Arch Linux

#1 2012-09-11 00:09:53

chroot --userspec keeps root environment variables

#2 2012-09-11 01:17:16

Re: chroot --userspec keeps root environment variables

#3 2012-09-11 02:29:25

Re: chroot --userspec keeps root environment variables

#4 2012-09-11 16:25:24

Re: chroot --userspec keeps root environment variables

Board footer