2

I have a daemon running in a chroot jail that I have generated with debootstrap.

I'd like to remove apt and dpkg from the jail, but I want to keep the other packages updated.

Can I upgrade the packages in the jail, running apt-get from outside?

3

I'm not sure why you want to do this. dpkg and apt are fundamental parts of a Debian system, and your chroot won't function independently without them. Running

chroot /path/to/chroot apt-get update

and so on is a supported method that doesn't require removing dpkg and apt.

But if you're sure you want to do it, you can run

APT_CONFIG=/path/to/apt.conf apt-get update

where /path/to/apt.conf is the path of an apt.conf file that includes

RootDir /path/to/chroot;

The rest of the apt configuration will then be read from /path/to/chroot/etc/apt/apt.conf.d, or somewhere else under /path/to/chroot if you change Dir::Etc in the apt.conf file. See the Description and Directories sections of man apt.conf for details.

  • I don't trust the daemon, and I want to harden the chroot a bit. I have already changed permissions in the chroot to avoid the user running the daemon can mknod, mount and so on... I want to remove apt and dpkg just because that they are not needed by the daemon to run: IMHO minimalism is a powerful security tool! – Giacomo Tesio Dec 31 '14 at 11:51
  • Reading the man page again, I'm not sure if this will cause the packages to install into the chroot. Have you tried it, and did it work? – Andrew Schulman Jan 1 '15 at 11:01
  • Didn't tried yet. But I've found a debian bug report related to this option. However defining "DPkg::Run-Directory" as "/" should be a viable workaround to that (still unfixed!) bug. As a last resort, I could use dpkg --root=/chroot -i package.deb – Giacomo Tesio Jan 2 '15 at 11:34

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.