2

I am lloking forward to compile for my ARM target on my host Ubuntu.
http://www.raspberrypi.org/phpBB3/viewtopic.php?f=31&t=8478

Above links states to use chroot & directly compile your program into the rootfile system of your target on your host.

Some suggest to use jail virtual enviroment like scratchbox.
Setting up a cross-compilation environment for a specific target platform

https://en.wikipedia.org/wiki/Chroot

The chroot mechanism is not intended to defend against intentional tampering by privileged (root) users. On most systems, chroot contexts do not stack properly and chrooted programs with sufficient privileges may perform a second chroot to break out. To mitigate the risk of this security weakness, chrooted programs should relinquish root privileges as soon as practical after chrooting, or other mechanisms – such as FreeBSD Jails - should be used instead. Note that some systems, such as FreeBSD, take precautions to prevent the second chroot attack.[1]
So i am investigating on it for few days here i am not able to understand what above statement means. 

1> What exact advantage is virtual jail enviroment over chroot ?

2> Does chroot affect all the terminals opened or .. a particular terminal on which command is run ?

3> What exactly should we use for cross-compiling Jail like scratch-box or chroot.

Community
  • 1
  • 1
Katoch
  • 2,709
  • 9
  • 51
  • 84
  • please, any one who will like to suggest on this thread ? – Katoch Feb 21 '13 at 04:08
  • I don't know about virtual jail environment, but would caution with using chroot. chroot will modify your file system so that the root is changed, freeing your tool chain to explicitly set up the paths to tools, etc. If you forget that you are in a chroot environment or make certain mistakes and don't exit properly you can wipe out your file system. This has happened to me in the Portage build environment. That is why you need to be a super user to enter chroot. Be sure to back up your critical files or experiment on a dev box you can afford to break. – Peter L. Feb 22 '13 at 18:18

1 Answers1

2

Wikipedia talks about the security of chroot, because chroot is often compared to sandbox (which don't provide chroot) or others with the purpose of providing security with isolation.
chroot() (it is a UNIX system call) is the process of changing the the apparent root directory (/) to an another one pointed by the system call. It means if a chrooted executable to /dir/target want to access to load/lib/ld-linux.so.2(hard-coded path in the executable), the real access will occur to/dir/target/lib/ld-linux.so.2
So it implies that each files and library the program need to access need to have their usual real path (prefixed with/) to the chrooted path (/dir/target in this example). If you use a full system inside a chroot you will finally end-up with the directory structure described in man hier but prefixed (for the chrooted programs) with the chrooted path. It also means you may use different binaries of a different architecture (if your CPU supports several ones; such providing a kind of isolation).

As you can see when you look at chroot, the primary purpose doesn't look to provide security, and it is used for other purposes switching from the initramfs root in Linux to the mounted root on the disk (except there's the process mount -o move).
However, as stated by the Wikipedia article, certain implementations such as FreeBSD choose to provide a certain level of security : like disabling the possibility to make a secound chroot inside a chroot. Wikipedia is wrong when it tell chroot need to be run as root. Most systems today have more fine-grained mechanism than user/group permissions.

Jails are designed for providing isolation directly, it allows one to limit the amount of RAM and CPU a process may use; disabling shared memory; restrict permissions...
Some implementations (like with the sandbox command) don't provide chroot. Jails have applications in Operating system–level virtualization, or avoiding damages to the remaining of the system when testing special code.
If you take the example of the sandbox command, you'll see it can't use an alternate root directory structure by itself.

http://www.raspberrypi.org/forums/viewtopic.php?f=31&t=8478 is mentioning qemu-user which is clearly to test programs without having to put them on the Rasberry Pi. This is different than virtual-machines, because no hardware is virtualized here : The binary instructions of the program are converted into native ones which mean system-calls are handled as if the program was run natively.
Here's come the need to use a different root directory structure : some shared object files path names are common over all distributions and architecture (like/lib/ld-linux.so.2). You can't mix several architecture into the same binary. If you replace a shared library by its ARM equivalent, then the files won't be usable for native executables. qemu-user or the whole target system need to be compiled statically for the same reason.

I really suggest you install and set up binfmt. It will enable you to run programs as if they had the same architecture of your machine by launching the qemu-arm-static command automatically...
Then you may want to compile software without cross-compiling, by simply installing a native ARM compiler inside your chroot.

Rasmus
  • 3
  • 3
user2284570
  • 2,891
  • 3
  • 26
  • 74