I have a web application where I create some folders on my server and put executables there. Then I try to run them with chroot but I get a message that access is denied there.
I tried chmod -R 777 blah blah.... and then I get a message that the folder or the file that I call (sudo chroot mydirectory myfile_inside_Mydirectory) does not exist. This happens only when I call chroot on folders created by the web server. My web application is in php and I use:

shell_exec("cp -R /var/www/comp/prison/bin $dir");

shell_exec("cp -R /var/www/comp/prison/lib $dir");

shell_exec("cp /var/www/janitor.out $dir/janitor.out");

shell_exec("sudo chmod -R 777 $dir");

$process = proc_open("sudo chroot $dir janitor.out", $descriptorspec, $pipes);

sudo does not need password.

  • Allowing sudo + chroot without a password is asking for problems. sudo chroot makes an application root, so if someone gets access to your webserver, you're f*cked up. – Lekensteyn Jan 28 '11 at 14:04
  • I knoe :D that's why I use janitor. janitor.out is a program written on C which calls the program the user wants to run (the user writes the program and then it gets compiled) and every restriction that is on janitor.out passes on the called executable. – Paris Jan 28 '11 at 15:55

Well I finally found out that I copied the required libraries on wrong folder, because when I tested chroot for first time I was on a 32bit Ubuntu Machine, while my server is 64bit. So, I copied the required libraries and bin/sh at the proper folders at my directory that I would like to jail and it worked just fine. :D Thanks you all!


What kind of file is janitor.out? If it's dynamically linked, you'll also need the linked libraries, which on their turn might need other libraries as well. You can use the ldd program to check which shared libraries are required. For example, the output of ldd /bin/ls:

    linux-vdso.so.1 =>  (0x00007fffac983000)
    libselinux.so.1 => /lib/libselinux.so.1 (0x00007f8adda8f000)
    librt.so.1 => /lib/librt.so.1 (0x00007f8add887000)
    libacl.so.1 => /lib/libacl.so.1 (0x00007f8add67e000)
    libc.so.6 => /lib/libc.so.6 (0x00007f8add2fb000)
    libdl.so.2 => /lib/libdl.so.2 (0x00007f8add0f7000)
    /lib64/ld-linux-x86-64.so.2 (0x00007f8addccc000)
    libpthread.so.0 => /lib/libpthread.so.0 (0x00007f8adced9000)
    libattr.so.1 => /lib/libattr.so.1 (0x00007f8adccd4000)

And ldd /lib/libacl.so.1: linux-vdso.so.1 => (0x00007fffd462f000) libattr.so.1 => /lib/libattr.so.1 (0x00007f4e348aa000) libc.so.6 => /lib/libc.so.6 (0x00007f4e34527000) /lib64/ld-linux-x86-64.so.2 (0x00007f4e34cd6000) If one of these libraries are not satisfied, the program will report "No such file or directory", even if the program itself exist.

Edit: the following more likely the problem in this case. I'm keeping the above answer because it could be helpful to someone with the same error message.

You are running:

sudo chroot $dir janitor.out

This will cause the chroot to search for janitor.out in $PATH (/bin, /sbin, ...). You need to prefix janitor.out with a slash in order to run janitor.out, located in the root of your chroot:

sudo chroot $dir /janitor.out
  • I did ldd but only gave me: linux.gate.so.1 => (0xf777e000) libc.so.6 => /lib32/libc.so.6 (0xf760500) /lib/ld-linux.so.2 (0xf777f000) and I copied them, except the first to the chroot directory (inside lib subfolder) – Paris Jan 28 '11 at 15:39
  • I copied all of your libraries but it doesn't work :P – Paris Jan 28 '11 at 15:49
  • You shouldn't copy these libaries, but the libraries which are required for your program. If you run it manually from the command line, does the same error occur? – Lekensteyn Jan 28 '11 at 16:15
  • What I get from ldd is: linux-vdso.so.1 => (0x00007ffff1956000) libc.so.6 => /lib/libc.so.6 (0x00007f9e1e742000) /lib64/ld-linux-x86-64.so.2 (0x00007f9e1eae3000) but I copy only the last two ones. – Paris Jan 29 '11 at 0:06
  • That should be fine. Oh... Now I get it, hang on, I update the answer. – Lekensteyn Jan 29 '11 at 9:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.