Skip to main content
LPIC-3 Exam 303

Chroot Jails and LPIC-3 303 Linux Security

By May 3, 2018November 18th, 2018One Comment

Chroot JailsMany services offer the option to run in a so-called “chrooted” environment or chroot jail. Simply put, the service starts with a false root directory. Everything that the service requires to run is copied to the chroot directory upon startup. This would include binaries and libraries that the service requires whilst running and configuration files. Running in a false root helps protect the system from malicious attacks, the only files and directories that are available are those in the chrooted setup and they do not persist on a restart of the service. It also limits the contention to files that may occur between different services as they each have their own copy while the service is running.

Each objective is available to view online. However if you prefer to have all the content in one place and study from an eBook then the objective ‘LPIC 3 Linux Security 326.1 Host Hardening’ is now available to download for just £0.99.

Download

You also may use the command chroot when you want to recover a lost root password. Booting to a live CD and mounting your server’s root disk partition before chrooting to the partition to reset the root password. The /bin/passwd program will write to the /etc/shadow file, simple enough. However, we probably want to write to the /mnt/etc/shadow file if that is where the disk is mounted to. We would chroot to /mnt to allow this to happen. This type of chroot environment is easy to setup as all of the required files are on the existing disk partition; services have to create their own environment of startup. They will create the directory and copy all the required file resources to their correct locations in the chroot directory. In this module we will show you how to configure a simple chroot environment to run the  /bin/bash and /bin/ls programs. The demonstration runs on an Ubuntu 16.04 system but is similar for any Linux distribution but the library file names may differ as may their location.

Managing Chroot Jails

Initially, we will create the chroot top-level directory. It’s name can be anything but we call it /bashjail.

$ sudo mkdir /bashjail

This directory will become the false root that we use. We know that we will need the bin directory for the ls and bash programs and an etc directory for configuration files. We will create these directories below /bashjail:

$ sudo mkdir /bashjail/{bin,etc}

We will also need one or more library directories to support the dynamic libraries used by ls and bash. We need to locate the directory names by using the ldd command for both programs we will run in the jail.

$ ldd /bin/bash /bin/ls
 /bin/bash:
 linux-vdso.so.1 =>  (0x00007ffc278ab000)
 libtinfo.so.5 => /lib/x86_64-linux-gnu/libtinfo.so.5 (0x00007f28dc3a5000)
 libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f28dc1a1000)
 libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f28dbdd6000)
 /lib64/ld-linux-x86-64.so.2 (0x0000564afa459000)
 /bin/ls:
 linux-vdso.so.1 =>  (0x00007ffdeb3ac000)
 libselinux.so.1 => /lib/x86_64-linux-gnu/libselinux.so.1 (0x00007f6c0a767000)
 libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f6c0a39d000)
 libpcre.so.3 => /lib/x86_64-linux-gnu/libpcre.so.3 (0x00007f6c0a12c000)
 libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f6c09f28000)
 /lib64/ld-linux-x86-64.so.2 (0x0000564646696000)
 libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f6c09d0b000)

From the output we will need the /lib64/ and /lib/x86_64-linux-gnu/ directories to exist within the chrooted environment.

$ sudo mkdir -p /bashjail/{lib64,lib/x86_64-linux-gnu}

The tree command is useful to display the structure we have created. If required you can install the tree program with either yum or apt:

$ sudo apt -y  install tree

We can display the directories with the following command:

$ tree -d /bashjail

From the output, we are able to gain a better comprehension of what we mean by a chrooted environment. We emulate what we would expect at any root folder. We can get by with the minimum number of supported files and directories that are required by commands that we run from the chroot environment.

Now that we have created the directories, we will need to add the files required. First, the binaries:

$ sudo cp /bin/bash /bashjail/bin
$ sudo cp /bin/ls /bashjail/bin

The central bash login script in Ubuntu is /etc/bash.bashrc in CentOS it is /etc/bashrc. We will create this file in order to customize the prompt we see whilst in the jail:

$ echo "PS1='JAIL $ '" | sudo tee /bashjail/etc/bash.bashrc

Next, we will need the library files used by the binaries. We need to copy each one to the correct directory in the jail. We can use the ldd command again if we need to remind ourselves of the files we need to copy. These files may be different on your system.

For the ls program:

$ for i in \
 /lib/x86_64-linux-gnu/libselinux.so.1 /lib/x86_64-linux-gnu/libpcre.so.3 \
 /lib/x86_64-linux-gnu/libdl.so.2 /lib/x86_64-linux-gnu/libpthread.so.0 ; do \
 sudo cp -v $i /bashjail/lib/x86_64-linux-gnu/; done

And for bash:

$ for i in \
 /lib/x86_64-linux-gnu/libtinfo.so.5 /lib/x86_64-linux-gnu/libdl.so.2 \
 /lib/x86_64-linux-gnu/libc.so.6 /lib64/ld-linux-x86-64.so.2 ; do \
 sudo cp -v $i /bashjail/lib/x86_64-linux-gnu/; done

Finally we have one library file in /lib64 that is shared by both programs:

$ sudo cp /lib64/ld-linux-x86-64.so.2 /bashjail/lib64/

The chroot jail will now be correct and on my Ubuntu 16.04 system looks like the  to the following graphic produced from the output of tree:

To execute and enter the chroot environment we need to run the command chroot with root privileges:

$ sudo chroot /bashjail /bin/bash
 JAIL $

We are now in the false root and we have access only to the files within /bashjail. The custom login script has executed and we see the prompt we configured. If we list the root directory we will see just the structure we created. Using the command ls -R can emulate the tree command, as we did not copy the tree command and its modules to the chrooted environment and, as such, is not available to use:

JAIL $ ls -R /
 /:
 bin  etc  lib  lib64
 
 /bin:
 bash  ls
 
 /etc:
 bash.bashrc
 
 /lib:
 x86_64-linux-gnu
 
 /lib/x86_64-linux-gnu:
 ld-linux-x86-64.so.2  libdl.so.2    libpthread.so.0  libtinfo.so.5
 libc.so.6       libpcre.so.3  libselinux.so.1
 
 /lib64:
 ld-linux-x86-64.so.2

We are restricted to just these files and nothing else. To leave the chroot environment we just type exit. The command exit is a shell builtin so is always available to bash.

 

 

One Comment

  • Bartonzpi says:

    At their root, Lamastu, Lilith and related early vampires are explanations for a terrifying thriller, the sudden demise of young kids and fetuses within the womb. That is the kind of nationality that will strive to create a robust family and, of course, increase kids. Lilith, Lamastu and the other early vampire demonesses are the alternative of the “good spouse and mom.” As an alternative of caring for children and honoring a husband, they destroy infants and seduce men. With Chinese language women, everything is exactly the other. Nonetheless, observe that Chinese beauties aren’t incessantly enthusiastic about extremely muscular dudes, due to this fact it’s your opportunity! Volunteer activities, resembling serving to out at a soup kitchen or at a shelter, are well-liked methods to spend Thanksgiving Day. Every spa ought to have its personal filtration system that cleans, refreshes and sanitizes the water frequently all through the day. Fifteen years later, the mine still doesn’t exist — insecurity and disagreements between Beijing and Kabul over financial terms of the contract have brought on delays. Based on some believers, this form of vampire has been round for hundreds of years. They ­lived in Holland for plenty of years until a bunch of English buyers — the Service provider Adventurers — financed a visit for greater than one hundred passengers to the brand new World.

    In 1609, a gaggle of Puritans fleeing religious persecution in England moved to Holland. ­On Sept. 6, 1620, they set sail on a ship called the Mayflower, leaving from England and arriving in the new World after sixty five days. Embalming was unknown in most of the world till relatively lately, so a body would have been put proper in the ground as is. They’ve free jiayuan type, and also you will surely love every jiayuan that they’ll cook for you. Next, you will get acquainted with suggestions that can help with courting a Chinese language woman. Solely dependable companies will provide help to hit the bull’s eye. If you happen to want help on methods to arrange a profile and what to write down in your preliminary and observe up messages, try my e-e-book, Online Courting Success: How to find Love Wherever in the world. He taught them how to get sap out of the maple timber, how one can keep away from plants that were poisonous and methods to plant corn and different crops. Regardless of how previous they are, Chinese girls like to get children’s toys as presents. By defining evil through supernatural figures, individuals can get a greater handle on their very own evil tendencies — they externalize them.

    People with the extra extreme forms of porphyria are extremely sensitive to sunlight, experience severe abdominal ache and may undergo from acute delirium. Those affected by neuropathic ache – commonly caused by alcoholism, amputation, spine surgery, HIV or MS – often flip to medicinal cannabis as a source of relief. These works in flip inspired an Irishman named Bram Stoker to jot down his vampire novel, “Dracula.” In the subsequent section, we’ll see how this work suits into the evolution of vampire lore. Can a human turn into a vampire? When European explorers discovered the unusual animals, they had been quickly incorporated into the vampire fantasy. Vampire bats are only found in Central America and South America, so the Europeans and Asians who originally conceived of those monsters did not know about them. With so quite a few diverse kinds of therapeutic therapeutic massage therapy readily obtainable, the rewards of therapeutic therapeutic massage are massive and can be suited to your sure requirements and troubles. Aromatherapy, acupuncture, crystal therapy and lots of more are common replacements to the normal physician’s office visit. In fact, they are small, reclusive, docile animals (see How Bats Work to learn extra). Chinese language women are really good and difficult. China is a reasonably fashionable country and the same can definitely be said about Chinese ladies.

    This femininity is rooted in Chinese language tradition-Chinese language ladies are expected to be as feminine as potential since their childhood; that is [url=https://www.bestbrides.net/chinese-brides/]hotchina girls[/url] how it really works in China (and in different Asian international locations aside from Korea and Japan, possibly). It is not any secret that each one Asian girls are extra gentle, fragile, and total feminine than western ladies. While Western girl are scorching with their freckled, transparent pores and skin, Chinese lady has a clear and flawless pores and skin. I’ve had several close friendships (and relationships) with girls from China in the past, and all of them informed me that males from the United States have been typically very fascinating to Chinese language females. Correct education is a key factor to achieve success in China. Initially, you need to purchase a present, nonetheless, additionally, you will have to watch out, because gifts are quite symbolic in China. 4. Precious gifts. Meet single Chinese language women and convey them gifts on the first date. In relation to courting a Chinese girl, it might all the time be greatest to ensure that you are clear about your intentions. One attainable treatment for porphyria prior to now might have been to drink blood, to right the imbalance in the physique (though there isn’t any clear evidence of this).

Leave a Reply