3 ms·

Can't unshare essentially do the same thing? unshare --map-current-user --root=<new root> <program> And works completely unprivileged using namespaces.

• raimue 6y ago
  Be aware that on some distributions such as Debian or RHEL, user namespaces are restricted by default and cannot be used like this from unprivileged user accounts. Although Debian is going to change the default with the next release. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=898446 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=898446
  • georgyo 6y ago
    Interesting. Still, as namespaces gain more and more traction, the value of adding rootless chroot goes down.
  • zimbatm 6y ago
    If those distros are paranoid about the security implications of user namespaces, then they would certainly apply that reasoning to user chroot.
• zokier 6y ago
  unshare calls chroot behind the scenes: https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/tree/sys-utils/unshare.c#n643 https://git.kernel.org/pub/scm/utils/util-linux/util-linux.g...
  • CyberRabbi 6y ago
    Yes but it does so as the root user in the new user namespace, which is allowed according to existing rules. The change in question is about not requiring root in any user namespace.
  • georgyo 6y ago
    Thanks for the link! In that case, it seems completely arbitrary to not make chroot work as a normal user then.