如何创建git账户的chroot

    最近想搭建一个git仓库给团队使用，虽然git-shell，但是还是想尝试用chroot，于是折腾了一下。

步骤一、 运行脚本

脚本内容请看

 

https://github.com/SweetTool/MakeChroot/blob/master/create_chroot_sharegit.sh

#!/bin/sh
# script to automate the creation of chroot jail
# w/ minimal executables to run git

export CHROOT=/home/sunny/chroot

function copy_binary()
{
    for i in $(ldd $*|grep -v dynamic|cut -d " " -f 3|sed 's/://'|sort|uniq)
        do
          cp --parents $i $CHROOT
	    done

    # ARCH amd64
    if [ -f /lib64/ld-linux-x86-64.so.2 ]; then
       cp --parents /lib64/ld-linux-x86-64.so.2 $CHROOT
    fi

    # ARCH i386
    if [ -f  /lib/ld-linux.so.2 ]; then
        cp --parents /lib/ld-linux.so.2 $CHROOT
    fi
}

# setup directory layout
mkdir $CHROOT
mkdir -p $CHROOT/{dev,etc,home,tmp,proc,root,var}

# setup device
mknod $CHROOT/dev/null c 1 3
mknod $CHROOT/dev/zero c 1 5
mknod $CHROOT/dev/tty  c 5 0
mknod $CHROOT/dev/random c 1 8
mknod $CHROOT/dev/urandom c 1 9
chmod 0666 $CHROOT/dev/{null,tty,zero}
chown root.tty $CHROOT/dev/tty

# copy programs and libraries
copy_binary /bin/{bash,ls,cp,rm,cat,mkdir,ln,grep,cut,sed} /usr/bin/{vim,ssh,head,tail,which,id,find,xargs} 
copy_binary  `which git` `which git-receive-pack` `which git-shell` `which git-upload-archive` `which git-upload-pack` 

# copy git resource files
cp -r --parents /usr/share/git-core $CHROOT
# copy vim resource files
cp -r --parents /usr/share/vim $CHROOT
# copy basic system level files
cp --parents /etc/group $CHROOT
cp --parents /etc/passwd $CHROOT
cp --parents /etc/shadow $CHROOT
cp --parents /etc/nsswitch.conf $CHROOT
cp --parents /etc/resolv.conf $CHROOT
cp --parents /etc/hosts $CHROOT
cp --parents /lib/libnss_* $CHROOT
cp -r --parents /usr/share/terminfo $CHROOT

# setup public key for root
#mkdir -p $CHROOT/root/.ssh
#chmod 0700 $CHROOT/root/.ssh
#cp {id_rsa,id_rsa.pub} $CHROOT/root/.ssh

# setup public key for qbot
#mkdir -p $CHROOT/home/qbot/.ssh
#chmod 0700 $CHROOT/home/qbot/.ssh
#cp {id_rsa,id_rsa.pub} $CHROOT/home/qbot/.ssh
#chown -R qbot.qbot $CHROOT/home/qbot/.ssh

# create symlinks
cd $CHROOT/usr/bin
ln -s vim vi

echo "chroot jail is created. type: chroot $CHROOT to access it"

2. 创建用户projects

3. 在chroot/home目录下创建相同的用户目录文件夹

4.  ssh配置chroot

$ sudo vim /etc/ssh/sshd_config

在最后添加

Match User skygit
    ChrootDirectory ~/home/chroot

二、遇到的问题解决

1. ls命令不能存在“-bash: ls: command not found”

在centos上会存在这样的问题，这是因为centos上的命令是通过软链接引用的，实际的ls命令在/usr/bin下

[sunny@icentos ~]$ ls -al /
total 80
dr-xr-xr-x. 19 root root  4096 Mar 24 17:29 .
dr-xr-xr-x. 19 root root  4096 Mar 24 17:29 ..
-rw-r--r--   1 root root     0 Apr 21  2016 .autorelabel
lrwxrwxrwx   1 root root     7 May 25  2017 bin -> usr/bin
dr-xr-xr-x.  4 root root  4096 Jun 26  2017 boot
drwxr-xr-x   2 root root  4096 Apr 21  2016 data
drwxr-xr-x  18 root root  2900 Mar  4 10:17 dev
drwxr-xr-x. 91 root root 12288 Mar  4 10:17 etc
drwxr-xr-x.  5 root root  4096 Mar  3 00:45 home
lrwxrwxrwx   1 root root     7 May 25  2017 lib -> usr/lib
lrwxrwxrwx   1 root root     9 May 25  2017 lib64 -> usr/lib64
drwx------.  2 root root 16384 Apr 21  2016 lost+found
drwxr-xr-x.  2 root root  4096 Nov  5  2016 media
drwxr-xr-x.  2 root root  4096 Nov  5  2016 mnt
drwxr-xr-x.  3 root root  4096 Nov  5  2016 opt
dr-xr-xr-x  83 root root     0 Mar  4 10:17 proc
dr-xr-x---.  4 root root  4096 Mar 24 17:24 root
drwxr-xr-x  23 root root   800 Mar  5 02:34 run
lrwxrwxrwx   1 root root     8 May 25  2017 sbin -> usr/sbin
drwxr-xr-x.  2 root root  4096 Nov  5  2016 srv
dr-xr-xr-x  13 root root     0 Mar  4 10:17 sys
drwxrwxrwt.  7 root root  4096 Mar 24 03:22 tmp
drwxr-xr-x. 13 root root  4096 May 25  2017 usr
drwxr-xr-x. 19 root root  4096 Mar  4 10:17 var

而ssh登录上去的环境变量为“/usr/local/bin:/usr/bin”，github上的脚本只复制了/bin目录下的文件，显然没有拷贝/usr/bin目录下的命令，造成/bin的文件没有拷贝成功。

-bash-4.2$ echo $PATH
/usr/local/bin:/usr/bin

解决方案：按照根目录下/bin的格式从/usr/bin目录下拷贝文件。

 

2. 运行脚本./create_chroot_sharegit.sh: 7: ./create_chroot_sharegit.sh: Syntax error: "(" unexpected

在Ubuntu上运行chroot脚本会报错

sunny@sunny-virtual-machine:~/chroot/MakeChroot$ sudo ./create_chroot_sharegit.sh 
[sudo] password for sunny: 
./create_chroot_sharegit.sh: 7: ./create_chroot_sharegit.sh: Syntax error: "(" unexpected

这是因为chroot脚本用了bash脚本写，而Ubuntu默认是dash

Ubuntu

sunny@sunny-virtual-machine:~/chroot/MakeChroot$ ls -al /bin/sh
lrwxrwxrwx 1 root root 4 10月 31 11:22 /bin/sh -> dash

centos或者Fedora

[sunny@icentos ~]$ ls -al /bin/sh
lrwxrwxrwx 1 root root 4 May 25  2017 /bin/sh -> bash

解决方法： 直接用bash运行

$ sudo /bin/bash ./create_chroot_sharegit.sh