can't start tmux or screen under ssh chrooted user
When logged in via ssh mylinode
(this is a chrooted user) and run tty
I got "not a tty", I think this is the root problem of not being able to start tmux or screen.
I didn't mount /proc but I have /dev/pts mounted.
I have glibc-2.17, gentoo hardened with grsecurity, according to this
> The ttyname and ttyname_r functions on Linux now fall back to searching for the tty file descriptor in /dev/pts or /dev if /proc is not available. This allows creation of chroots without the procfs mounted on /proc. (#851470)
I am unsure, but I think I've had problem compiling glibc because /dev/pts was owned by group "adm", as noted here
What I did was lazy unmount /dev/pts, then mount devpts as group "tty", that way I can continue installing glibc.
This setup worked in my laptop, I can ssh mylinodedev
then tmux
. tty
returned "/dev/pts/0".
I can start tmux
if I mount /proc to chrooted environment on linode, but I think this is a poor security setup.
I plan on renting my linode node to users, hehe, chroot is a way to not let different users see each other files.
I've just started using grsecurity, maybe I could use grsecurity to provide the same functionality but I haven't learnt that deep.
Edit1:
This is the script that mount devpts to chrooted user:
homes=(/home/*)
for home in ${homes[@]}
do
rm -r "$home/tmp/*"
if [[ -d "$home/dev/pts" ]]
then
mount -t devpts -o gid=tty,mode=620 none "$home/dev/pts"
fi
done
2 Replies
If you really care about security, and really distrust your users, maybe you want to look into Linux containers? They could be a lot more effort to setup though.
/lib/modules/pv-grub_x86_64-5/modules.dep
, just need to exclude this one on the next upload, or reboot the linode when I did :/
/proc is like a pond of unknown entities, that I fear of giving access to the user, and I can't invest time to understand it.
Will look into Linux containers, thanks.