Re: PRoot experiments

[Benedikt Niedermayr <benbrenson89@googlemail.com>]

Am 19.10.2017 um 12:39 schrieb Claudius Heine:
> Hi
>
> On 10/19/2017 12:14 PM, Alexander Smirnov wrote:
>> Hi,
>>
>> On 10/19/2017 01:07 PM, 'Ben Brenson' via isar-users wrote:
>>> Am Mittwoch, 18. Oktober 2017 14:29:45 UTC+2 schrieb Alexander Smirnov:
>>>
>>>     Hi all,
>>>
>>>     I've performed several experiments with PRoot:
>>>
>>>     1. Generate multistrap filesystem:
>>>
>>>     As reference I've used the following resource:
>>> https://github.com/josch/polystrap/blob/master/polystrap.sh
>>> <https://github.com/josch/polystrap/blob/master/polystrap.sh>
>>>
>>>     So, I was able to run the following command without root 
>>> permissions:
>>>
>>>     $ PROOT_NO_SECCOMP=1 proot -0 /usr/sbin/multistrap -f
>>>     multistrap.conf -d
>>>     test
>>>
>>>     After this command execution I have 'test' folder which looks quite
>>>     similar to one, generated with sudo (at least 'du -sm' is the 
>>> same).
>>>
>>>     2. Run commands in PRoot chroot:
>>>
>>>     I'm successfully able to run PRoot chroot for various 
>>> architectures:
>>>
>>>     $ PROOT_NO_SECCOMP=1 proot -0 -r ./test /bin/bash
>>>
>>>     Also I was able to run: 'dpkg --configure -a' in these chroots.
>>>
>>>     3. Mount of various work folders:
>>>
>>>     Mount forlder using PRoot seems also works good:
>>>
>>>     $ PROOT_NO_SECCOMP=1 proot -0 -b /proc -b /dev -r ./test /bin/bash
>>>
>>>     And in this chroot I have /proc and /dev mounted.
>>>
>>>
>>>     So, my brief conclusion is: PRoot could be a good option for 
>>> Isar. It
>>>     seems that it's designed to support exact features that are 
>>> required
>>>     for
>>>     Isar. :-)
>>>
>>>     I'd like to try to implement simple PoC to test if *.deb package 
>>> could
>>>     be generated in Isar without 'sudo'.
>>>
>>>     BTW: PRoot is a part of standard Debian, so it could be 
>>> installed via
>>>     'apt-get', no custom repos required.
>>>
>>>     --     With best regards,
>>>     Alexander Smirnov
>>>
>>>
>>>
>>>
>>> Sounds nice...
>>>
>>> What is the PROOT_NO_SECCOMP=1 for?
>>
>> Don't remember exactly, I derived this as workaround from issues in 
>> PRoot guthub (will analyze it in details later). As I got it, there 
>> was some change related to ptrace systemcall in recent kernel and 
>> this option helps old PRoot to workaround this change. I use jessie 
>> on my host so my proot is quite old, probably in stretch this issue 
>> is already fixed.
>
> PROOT_NO_SECCOMP=1 should not be necessary if you are using the 
> kas-isar container with '--security-opt=seccomp:unconfined'.
>
> I would also advice to used at least version 5.* (I use 5.1.0) because 
> with the version 4.* I had bad experiences previously.
>
> Claudius
>
>

So I tried to do similiar steps as Alexander,
mkdir -r proot_tests/test
cd proot_tests
PROOT_NO_SECCOMP=1 proot -0 /usr/sbin/multistrap -a amd64 -d test -f 
multistrap.conf

But after a while the following error appears:

chroot: cannot change root directory to 
'/home/brenson/Schreibtisch/mixed_mode/siemens/proot_tests/test/': 
Operation not permitted

Regards,
Benedikt