Program run though chroot jail gives error about encoding?

Question

I'm new to chroot jails; so far I've setup bash using this tutorial, and I've been able to login with the user through ssh secured with a public key.

The SSH configuration takes care of running the chroot jail:

AllowUsers <username>
Match User <username>
        ChrootDirectory "/home/<username>"

/etc/sshd_config

Basically I took every one of the dependencies listed and copied it to /home/username/<rest-of-the-path-to-dependency-file> and did the same with the executable.

I did nothing with linux-vdso as it doesn't play by the same rules.

They only thing I can do in the jail is cd and execute programs, my shell prompt appears like this:

-bash-4.4$

I added another program and in the same manner as the tutorial above, adding ldd dependencies and copying over the executable to the directory IU found it in

When I run the program it creates a directory and folders in /.config/taskell/config.ini and a couple of other files.

But when the program runs it gives me an error related to the encoding of the file /home/username/.config/taskell/config.ini: hGetContents: invalid argument (invalid byte sequence), but when I run it in my bash shell on the computer directly it works fine.

Did setting up the chroot jail change the way the shell or this program interprets the files it is reading? The -bash-4.4$ prompt seems to indicate that there's some kind of defaults set that aren't there when I initially log in using the regular prompt.

Additionally, I'm trying to do this on WSL Ubuntu 18.08 which appears to have something to do with the encoding issue I linked.

The only three commands I wish to be able to run are the command I'm trying to run, git, and vim, but I'm starting with this one and not having much luck.

Answer 1

Instead of chroot, use a container, such as docker (there are many others):

• It does more: chroot, namespace isolation, cgroups, etc.
• It manages it for you.
• For docker there are pre-built images.

However what I see you asking for, but be more easily solved with simple user isolation: A separate account for each user. You could then augment this with Mandatory-Access-Control (e.g. app armour).

However, all of this is complicated by you using WSL. WSL is Gnu/Linux on MS-Windows. WSL is Gnu/Linux with the Linux replaced. I am not sure if WSL2 is much better. All the stuff that we are discussing is done in the Linux part of Gnu/Linux, and is the most prone to not working (or working differently), if not running a real Gnu/Linux system. The shared file-system, is a big area of incompatibility. It makes it difficult to use file permissions, to keep users apart.

I have heard that docker works on MS-Windows, I think it does this by putting Gnu/Linux in a virtual machine (but am not sure).