1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
|
#!/bin/bash
# This file is part of Firejail project
# Copyright (C) 2014-2023 Firejail Authors
# License GPL v2
# build a very small chroot
ROOTDIR="/tmp/chroot" # default chroot directory
DEFAULT_FILES="/bin/bash /bin/sh " # basic chroot files
DEFAULT_FILES+="/etc/passwd /etc/nsswitch.conf /etc/group "
DEFAULT_FILES+=`find /lib -name libnss*` # files required by glibc
DEFAULT_FILES+=" /bin/cp /bin/ls /bin/cat /bin/ps /bin/netstat /bin/ping /sbin/ifconfig /usr/bin/touch /bin/ip /bin/hostname /bin/grep /usr/bin/dig /usr/bin/openssl /usr/bin/id /usr/bin/getent /usr/bin/whoami /usr/bin/wc /usr/bin/wget /bin/umount"
rm -fr $ROOTDIR
mkdir -p $ROOTDIR/{root,bin,lib,lib64,usr,home,etc,dev/shm,tmp,var/run,var/tmp,var/lock,var/log,proc,sys}
chmod 777 $ROOTDIR/tmp
mkdir -p $ROOTDIR/etc/firejail
mkdir -p $ROOTDIR/home/netblue/.config/firejail
chown netblue:netblue $ROOTDIR/home/netblue
chown netblue:netblue $ROOTDIR/home/netblue/.config
cp /home/netblue/.Xauthority $ROOTDIR/home/netblue/.
cp -a /etc/skel $ROOTDIR/etc/.
mkdir $ROOTDIR/home/someotheruser
mkdir $ROOTDIR/boot
mkdir $ROOTDIR/selinux
cp /etc/passwd $ROOTDIR/etc/.
cp /etc/group $ROOTDIR/etc/.
cp /etc/hosts $ROOTDIR/etc/.
cp /etc/hostname $ROOTDIR/etc/.
mkdir -p $ROOTDIR/usr/lib/x86_64-linux-gnu
cp -a /usr/lib/x86_64-linux-gnu/openssl-1.0.0 $ROOTDIR/usr/lib/x86_64-linux-gnu/.
cp -a /usr/lib/ssl $ROOTDIR/usr/lib/.
touch $ROOTDIR/var/log/syslog
touch $ROOTDIR/var/tmp/somefile
SORTED=`for FILE in $* $DEFAULT_FILES; do echo " $FILE "; ldd $FILE | grep -v dynamic | cut -d " " -f 3; done | sort -u`
for FILE in $SORTED
do
cp --parents $FILE $ROOTDIR
done
cp --parents /lib64/ld-linux-x86-64.so.2 $ROOTDIR
cp --parents /lib/ld-linux.so.2 $ROOTDIR
cp unchroot $ROOTDIR/.
touch $ROOTDIR/this-is-my-chroot
cd $ROOTDIR; find .
mkdir -p usr/lib/firejail/
cp /usr/lib/firejail/libtrace.so usr/lib/firejail/.
echo "To enter the chroot directory run: firejail --chroot=$ROOTDIR"
|
