can't start tmux or screen under ssh chrooted user

I think my ssh chrooted user couldn't get a tty, is this a common problem and is there a fix?

When logged in via ssh mylinode (this is a chrooted user) and run tty I got "not a tty", I think this is the root problem of not being able to start tmux or screen.

I didn't mount /proc but I have /dev/pts mounted.

I have glibc-2.17, gentoo hardened with grsecurity, according to this http://rpmfind.net/linux/RPM/centos/6.5 … 86_64.html">http://rpmfind.net/linux/RPM/centos/6.5/x8664/Packages/glibc-common-2.12-1.132.el6.x8664.html not mounting /proc should be sufficient.

> The ttyname and ttyname_r functions on Linux now fall back to searching for the tty file descriptor in /dev/pts or /dev if /proc is not available. This allows creation of chroots without the procfs mounted on /proc. (#851470)

I am unsure, but I think I've had problem compiling glibc because /dev/pts was owned by group "adm", as noted here http://forums.gentoo.org/viewtopic-p-7452100.html it should be owned by group "tty", I forgot where that was, I think that was when using xen in my laptop.

What I did was lazy unmount /dev/pts, then mount devpts as group "tty", that way I can continue installing glibc.

This setup worked in my laptop, I can ssh mylinodedev then tmux. tty returned "/dev/pts/0".

I can start tmux if I mount /proc to chrooted environment on linode, but I think this is a poor security setup.

I plan on renting my linode node to users, hehe, chroot is a way to not let different users see each other files.

I've just started using grsecurity, maybe I could use grsecurity to provide the same functionality but I haven't learnt that deep.

Edit1:

This is the script that mount devpts to chrooted user:

homes=(/home/*)
for home in ${homes[@]}
do
    rm -r "$home/tmp/*"

    if [[ -d "$home/dev/pts" ]]
    then
        mount -t devpts -o gid=tty,mode=620 none "$home/dev/pts"
    fi
done

2 Replies

It should be fine to mount /proc in each chroot, it's not like normal users can write to anything in there anyway. Lots of tools need data from /proc, normal users may want stuff like ps and top.

If you really care about security, and really distrust your users, maybe you want to look into Linux containers? They could be a lot more effort to setup though.

Found the problem, my rsync from laptop to linode, haha, for the binary files removed this file /lib/modules/pv-grub_x86_64-5/modules.dep, just need to exclude this one on the next upload, or reboot the linode when I did :/

/proc is like a pond of unknown entities, that I fear of giving access to the user, and I can't invest time to understand it.

Will look into Linux containers, thanks.

Reply

Please enter an answer
Tips:

You can mention users to notify them: @username

You can use Markdown to format your question. For more examples see the Markdown Cheatsheet.

> I’m a blockquote.

I’m a blockquote.

[I'm a link] (https://www.google.com)

I'm a link

**I am bold** I am bold

*I am italicized* I am italicized

Community Code of Conduct