In this video, I will tell you how to work with cheroot DILs.
So what is it?
Well, a cheroot DIL is an isolated environment where users and processes don't get access
to other parts of the operating system.
You use them typically for specific processes that need an extra layer of security.
And in order to use them, you need to set it up correctly.
In a cheroot DIL, the user that runs the process needs to have access to all relevant files
and processes.
So you need more than just the program file in this DIL.
You also need all the relevant configuration.
On modern Linux, cheroot has further evolved into namespaces.
And namespaces are pretty important in container environments.
Now the cheroot DIL itself should include a shell, binaries like LS if these are needed,
but above all, also the libraries that are used by these binaries.
And which files these are is different per process.
So let's talk a bit about namespaces as well.
The Linux kernel implements isolation at different levels using namespaces.
There's a network namespace, a mount namespace, a process namespace, a user namespace.
And these namespaces make that you are all alone, well, you think you're all alone in
your network.
You only see your own mounts.
You only see your own process table.
And you also only see your own user accounts.
Namespaces are used a lot by containers.
And if you want to do a quick test, you can use sudo unshare, minus minus fork, minus
minus PID, minus minus mount proc bash and see what is happening.
Let's do that.
So I'm going to an ordinary, oops, editor, let's start it again.
So this time from a non-privileged shell, I'm using sudo unshare.
It's a default command, how you can run namespaces, minus minus fork, minus minus PID, minus minus
mount proc.
This is making sure that we have sufficient information available in the namespace.
And then I'm using PSAUX.
And do you see what is happening?
This unshare has unshared my bash process from the current environment.
And the result is that I have bash being PID number one.
And the good thing is that if you start your application in this way, your application
doesn't even see other processes on your system.
And that makes it really secure.
Now type exit to get out of the namespace.
And I would also like to show you the chroot environment.
Step one, I'm going into the boot directory, and I'm using chroot.
And that is giving me an error because I made a typo.
And here we get fail to run command bin bash, no such file or directory.
Why is that?
Well, in the chrooted environment, you need a minimal system environment.
And that includes a bash shell, some libraries, and more.
Let me show you a practical case of the chroot environment.
I'm going to reboot.
And while rebooting, I'm entering my grub boot prompt.
And I'll have to enter a password all the time now.
And I'm going to start with the option rd.break.
That will break into the init.ramfs.
And in the init.ramfs, you get in a specific environment, that's a system image that is
within the init.ramfs.
And what we will see is that the real system environment is available on a specific directory.
And let me first type my password.
And then let me type ls, oh, cd slash, and then ls where we can see the sysroot environment.
So here, you can see the dracu.sh file, that's my init.ramfs.
Now I'm going into the sysroot environment.
And there I can find my entire on-disk root file system.
And now I can use chroot dot.
And oh, boy, command not found.
Why is that?
Well, that's probably because it's not in the path.
So I need user has been chroot on dot.
And I think I made the wrong guess.
And I also need to refer to it from this slash sysroot directory.
So slash sysroot slash user slash has been.
And there we go.
Now it works.
PWD, look at that.
Suddenly, I am in the root of the file system.
Even if we see that a couple of lines above, I changed into the sysroot directory.
Now when I use exit, then I'm out of it again.
And why would I want to be in this slash sysroot directory using chroot?
Well, for troubleshooting, that is convenient, because all utilities will be in the right
location if we do.