linux-kernel - Re: chroot(2) and bind mounts as non-root

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 08 Dec 2011 11:10:52 -0500
From:	Colin Walters <walters@...bum.org>
To:	John Stoffel <john@...ffel.org>
Cc:	LKML <linux-kernel@...r.kernel.org>
Subject: Re: chroot(2) and bind mounts as non-root

On Wed, 2011-12-07 at 14:36 -0500, John Stoffel wrote:
> >>>>> "Colin" == Colin Walters <walters@...bum.org> writes:
> 
> Colin> I've recently been doing some work in software compilation, and it'd be
> Colin> really handy if I could call chroot(2) as a non-root user.  The reason
> Colin> to chroot is to help avoid "host contamination" - I can set up a build
> Colin> root and then chroot in.  The reason to do it as non-root is, well,
> Colin> requiring root to build software sucks for multiple obvious reasons.
> 
> What's wrong with using 'fakeroot' or tools like that instead? 

I assume you mean
"fakechroot" ( https://github.com/fakechroot/fakechroot/wiki )

The answer is twofold:

1) It's a pile of gross hacks that can easily be buggy, and will be
permanently trying to keep up with newer system calls.
2) It's slower.  My edit-compile-debug cycle REALLY matters to me.  If
you're a developer, it should matter to you - it directly impacts your
productivity.

How much slower?  Okay, well I tried "fakechroot" from Fedora 15.  It
appears to break parallel make.  Which obviously already disqualifies it
from being a core part of my edit-compile-debug cycle.

But here's an example of a small autotools (~6000 significant lines of
C) project, of which running configure is by far the slowest part.  Note
'metabuild' is a trivial script which wraps the
'autogen.sh;configure;make' dance:

$ metabuild   # to prime the caches
...
$ git clean -dfx
...
$ time ostbuild-user-chroot --unshare-ipc --unshare-pid --unshare-net
--mount-bind /src /src --mount-proc /proc
--mount-bind /dev /dev / /bin/sh -c 'cd /src/test-project; metabuild'
...
real	0m17.627s
user	0m9.397s
sys	0m5.074s
$ git clean -dfx
...
$ time fakeroot fakechroot chroot / /bin/sh -c 'cd /src/test-project;
metabuild -j 1'
real	0m35.327s
user	0m13.118s
sys	0m10.639s

So it almost exactly doubles...Oh, crap, I just remembered I have
ccache, so we're really only timing configure runs here.  Anyways, you
get the point.  Doubling my compile time is bad.  And this is a
relatively small project.

One of the best parts of Linux is the filesystem and VFS - it's really
amazingly fast compared to other OSes, especially if you know how to use
it.  Adding in layers of emulation and crap in between the program and
the filesystem takes that away.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/