2

I need to run a process in a chroot with a virtual /proc filesystem, so the process is unable to get access to other processes running on the same host. The process must be run under root and have full access to files in chroot. Also any changes to the filesystem must be preserved in the chrooted directory.

Is it even possible?

user unknown
  • 1,872
user4674453
  • 131

2 Answers2

0

It is possible to mount /proc in a chroot environment - see this answer for more on that.

I would have concerns that the program would not be able to get access to other processes as much (if not all) of this information can be accessed through /proc (/proc/[pid number] will give you access to this ).

Its unclear what you mean by "changes to the filesystem", but if these changes are to the filesystem excluding special bits like /proc, /dev/ etc, these will stay in the chroot.

davidgo
  • 73,366
0

You can accomplish this using Linux namespaces. Containers (Docker, lxc) are made out of those. man unshare is Your friend. Beware that attacker can easily escape chroot if You use it improperly. Read up on this before using it. You have been warned.

lynx
  • 109