Re: chroot with --userspec when chrooting from x86_64 to i686

[Pádraig Brady]

On 05/02/2012 10:37 AM, Dmitry V. Levin wrote:
> Hi,
> 
> On Tue, May 01, 2012 at 09:32:20PM +0100, John Lane wrote:
>> Hello, this is my first post here, I hope this is the right place to ask 
>> this question. I have also asked this on Stack Exchange but I think this 
>> might be a more appropriate audience. I hope that's ok. I'm experencing 
>> a problem with chroot and I am running on Arch Linux x86_64.
>>
>> I have a 64 bit chroot and a 32 bit chroot. They are identical except 
>> that one is 32 bit and one is 64 bit.
>>
>> I can enter either of them using "chroot /path/to/chroot". No problems.
>>
>> If I want to do that as a specific user the command is "chroot 
>> --userspec=user:group /path/to/chroot"
>>
>> This also works fine for the 64 bit chroot. However it fails for the 32 
>> bit chroot. It fails with status 125 and the message "chroot: invalid user"
> 
> Looks like your 64-bit glibc failed to load 32-bit NSS plugins.
> Please try this tentative patch:
> 
> diff --git a/src/chroot.c b/src/chroot.c
> index dbb5c6d..195c43e 100644
> --- a/src/chroot.c
> +++ b/src/chroot.c
> @@ -198,6 +198,22 @@ main (int argc, char **argv)
>        usage (EXIT_CANCELED);
>      }
>  
> +  /* We have to call parse_user_spec twice:
> +     - first time outside chroot to load potentially necessary passwd/group
> +       parsing plugins (e.g. NSS);
> +     - second time inside chroot to do actual parsing. */
> +  if (userspec)
> +    {
> +      uid_t uid = -1;
> +      gid_t gid = -1;
> +      char *user = NULL;
> +      char *group = NULL;
> +
> +      parse_user_spec (userspec, &uid, &gid, &user, &group);
> +      free (user);
> +      free (group);
> +    }
> +
>    if (chroot (argv[optind]) != 0)
>      error (EXIT_CANCELED, errno, _("cannot change root directory to %s"),
>             argv[optind]);

Thanks for looking at this Dmitry.

Note this very related issue/patch here:

http://lists.gnu.org/archive/html/coreutils/2011-07/msg00057.html

It might be best Dmitry to call parse_user_spec twice as you do,
but fall back to the initial uid, gid if the latter fails?

cheers,
Pádraig.