Re: PRoot experiments

[Claudius Heine <claudius.heine.ext@siemens.com>]

Hi

On 10/19/2017 12:14 PM, Alexander Smirnov wrote:
> Hi,
> 
> On 10/19/2017 01:07 PM, 'Ben Brenson' via isar-users wrote:
>> Am Mittwoch, 18. Oktober 2017 14:29:45 UTC+2 schrieb Alexander Smirnov:
>>
>>     Hi all,
>>
>>     I've performed several experiments with PRoot:
>>
>>     1. Generate multistrap filesystem:
>>
>>     As reference I've used the following resource:
>>     https://github.com/josch/polystrap/blob/master/polystrap.sh
>>     <https://github.com/josch/polystrap/blob/master/polystrap.sh>
>>
>>     So, I was able to run the following command without root permissions:
>>
>>     $ PROOT_NO_SECCOMP=1 proot -0 /usr/sbin/multistrap -f
>>     multistrap.conf -d
>>     test
>>
>>     After this command execution I have 'test' folder which looks quite
>>     similar to one, generated with sudo (at least 'du -sm' is the same).
>>
>>     2. Run commands in PRoot chroot:
>>
>>     I'm successfully able to run PRoot chroot for various architectures:
>>
>>     $ PROOT_NO_SECCOMP=1 proot -0 -r ./test /bin/bash
>>
>>     Also I was able to run: 'dpkg --configure -a' in these chroots.
>>
>>     3. Mount of various work folders:
>>
>>     Mount forlder using PRoot seems also works good:
>>
>>     $ PROOT_NO_SECCOMP=1 proot -0 -b /proc -b /dev -r ./test /bin/bash
>>
>>     And in this chroot I have /proc and /dev mounted.
>>
>>
>>     So, my brief conclusion is: PRoot could be a good option for Isar. It
>>     seems that it's designed to support exact features that are required
>>     for
>>     Isar. :-)
>>
>>     I'd like to try to implement simple PoC to test if *.deb package 
>> could
>>     be generated in Isar without 'sudo'.
>>
>>     BTW: PRoot is a part of standard Debian, so it could be installed via
>>     'apt-get', no custom repos required.
>>
>>     --     With best regards,
>>     Alexander Smirnov
>>
>>
>>
>>
>> Sounds nice...
>>
>> What is the PROOT_NO_SECCOMP=1 for?
> 
> Don't remember exactly, I derived this as workaround from issues in 
> PRoot guthub (will analyze it in details later). As I got it, there was 
> some change related to ptrace systemcall in recent kernel and this 
> option helps old PRoot to workaround this change. I use jessie on my 
> host so my proot is quite old, probably in stretch this issue is already 
> fixed.

PROOT_NO_SECCOMP=1 should not be necessary if you are using the kas-isar 
container with '--security-opt=seccomp:unconfined'.

I would also advice to used at least version 5.* (I use 5.1.0) because 
with the version 4.* I had bad experiences previously.

Claudius


-- 
DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-54 Fax: (+49)-8142-66989-80 Email: ch@denx.de