Skip to main content

Safely Identify Dependencies for Chrooting

The most difficult part of setting up a chroot environment is identifying dependencies for the programs you want to copy to the jail. For example, to make cp available, not only do you need to copy its binary from /bin and any shared libraries it depends on, but the dependencies can have their own dependencies too that need to be copied.

The internet suggests using ldd to list a binary’s dependencies, but that has its own problems. The man page for ldd warns not to use the script for untrusted programs because it works by setting a special environment variable and then executes the program. What’s a security-conscious systems administrator to do?

The ldd man page recommends objdump as a safe alternative. objdump outputs information about an object file, including what shared libraries it links against. It doesn’t identify the dependencies’ dependencies, but it’s still a good start because it doesn’t try to execute the target file. We can overcome the dependencies of dependencies problem later using recursion.

First, let’s look at the output of objdump to see what we have to work with.

$ objdump -p /bin/cp

/bin/cp:   file format elf64-x86-64

Program Header:
   PHDR off    0x00004000 vaddr 0x00400040 paddr 0x00400040 align 2**3
        fliesz 0x000001f8 memsz 0x000001f8 flags r-x
 INTERP off    0x00000238 vaddr 0x00400238 paddr 0x00400238 align 2**0
        fliesz 0x0000001c memsz 0x0000001c flags r-x
...
Dynamic Section:
 NEEDED    libselinux.so.1
 NEEDED    libacl.so.1
 NEEDED    libattr.so
 NEEDED    libc.so.6
 INIT      0x00402bb8
...

The libraries we’re interested in are listed under Dynamic Section and preceded by NEEDED. We can fetch the list using awk to match those lines and return the second column.

$ objdump -p /bin/cp | awk '/NEEDED/ { print $2 }'
libselinux.so.1
libacl.so.1
libattr.so.1
libc.so.6

Next, we need to find the actual libraries within the filesystem because the paths are needed to find their dependencies with objdump. We can do this with find to search the root filesystem for each item and print its location.

$ shared=$(objdump -p /bin/cp | awk '/NEEDED/ { print $2 }')
$ for s in $shared; do
>   find / -name "$s" -executable -print -quit
> done
/usr/lib/64/libselinux.so.1
/usr/lib/64/libacl.so.1
/usr/lib/64/libattr.so.1
/usr/lib/64/libc.so.6

The hard part is behind us—finding the program’s dependencies. The next step is to create a recursive function to identify the dependencies of each dependency.

$ deplibs()(
>  shared=$(objdump -p "$1" | awk '/NEEDED/ { print $2 }')
>  for s in $shared; do
>    dep=$(find / -name "$s" -executable -print -quit)
>    echo "$dep"
>    deplibs "$dep"
>  done
>)
$ deplibs /usr/bin/cp
/usr/lib64/libselinux.so.1
/usr/lib64/libpcre.so.1
/usr/lib64/libpthread.so.0
/usr/lib64/libc.so.6
/usr/lib64/ld-linux-x86-64.so.2
/usr/lib64/ld-linux-x86-64.so.2
/usr/lib64/libc.so.6
...

Invoking the function now gives us a full list... well, almost too full of a list. Notice there are some libraries listed multiple times. They’re a dependency of multiple items and are identified repeatedly by the recursive calls. It’s trivial to eliminate the duplicates with sort.

$ deplibs /usr/bin/cp | sort -u
/usr/lib64/ld-linux-x86-64.so.2
/usr/lib64/libacl.so.1
/usr/lib64/libattr.so.1
/usr/lib64/libc.so.6
/usr/lib64/libdl.so.2
/usr/lib64/liblzma.so.5
/usr/lib64/libpcre.so.1
/usr/lib64/libpthread.so.0
/usr/lib64/libselinux.so.1

Now we have a safe alternative to lld.

To see how you might take this a step further and use deplibs in a shell script, check out my gist on GitHub of a script to find and copy commands and their dependencies to a chroot filesystem.

Comments

Popular posts from this blog

Composing Music with PHP

I’m not an expert on probability theory, artificial intelligence, and machine learning. And even my Music 201 class from years ago has been long forgotten. But if you’ll indulge me for the next 10 minutes, I think you’ll find that even just a little knowledge can yield impressive results if creatively woven together. I’d like to share with you how to teach PHP to compose music. Here’s an example: You’re looking at a melody generated by PHP. It’s not the most memorable, but it’s not unpleasant either. And surprisingly, the code to generate such sequences is rather brief. So what’s going on? The script calculates a probability map of melodic intervals and applies a Markov process to generate a new sequence. In friendlier terms, musical data is analyzed by a script to learn which intervals make up pleasing melodies. It then creates a new composition by selecting pitches based on the possibilities it’s observed. . Standing on Shoulders Composition doesn’t happen in a vacuum. Bach wa

Learning Prolog

I'm not quite sure exactly I was searching for, but somehow I serendipitously stumbled upon the site learnprolognow.org a few months ago. It's the home for an introductory Prolog programming course. Logic programming offers an interesting way to think about your problems; I've been doing so much procedural and object-oriented programming in the past decade that it really took effort to think at a higher level! I found the most interesting features to be definite clause grammars (DCG), and unification. Difference lists are very powerful and Prolog's DCG syntax makes it easy to work with them. Specifying a grammar such as: s(s(NP,VP)) --> np(NP,X,Y,subject), vp(VP,X,Y). np(np(DET,NBAR,PP),X,Y,_) --> det(DET,X), nbar(NBAR,X,Y), pp(PP). np(np(DET,NBAR),X,Y,_) --> det(DET,X), nbar(NBAR,X,Y). np(np(PRO),X,Y,Z) --> pro(PRO,X,Y,Z). vp(vp(V),X,Y) --> v(V,X,Y). vp(vp(V,NP),X,Y) --> v(V,X,Y), np(NP,_,_,object). nbar(nbar(JP),X,3) --> jp(JP,X). pp(pp(PREP,N

What's Wrong with OOP

Proponents of Object Oriented Programming feel the paradigm yields code that is better organized, easier to understand and maintain, and reusable. They view procedural programming code as unwieldy spaghetti and embrace OO-centric design patterns as the "right way" to do things. They argue objects are easier to grasp because they model how we view the world. If the popularity of languages like Java and C# is any indication, they may be right. But after almost 20 years of OOP in the mainstream, there's still a large portion of programmers who resist it. If objects truly model the way people think of things in the real world, then why do people have a hard time understanding and working in OOP? I suspect the problem might be the focus on objects instead of actions. If I may quote from Steve Yegge's Execution in the Kingdom of Nouns : Verbs in Javaland are responsible for all the work, but as they are held in contempt by all, no Verb is ever permitted to wander about