Где-нибудь существует ли сценарий сборки chroot?

I would suggest creating a template chroot and installing all the packages you want just like it was a normal OS. After that you can manage the chroot using your typical tools (update scripts, package manager, etc.) and rsync the updates into each chroot built using that template.

There are a few advantages to this approach. The two big ones are you can manage the template using familiar tools (no strange hoops to jump through to upgrade your chroot), and if you have one chroot which can't be updated for some reason (say it needs a particular version of some package) you can exclude it from the rsync upgrade process and manage it independently as though it were a standalone machine, marking the package as "held" or equivalent so it doesn't get stomped on.

Your mileage (and implementation requirements) may vary...

Первый подход (сервис - это само приложение): Выполните bind-ro-mount в chroot для всех «обычных» двоичных файлов, библиотек и т.д ...:

• / etc
• / bin
• / usr
• / lib
• / lib64
• / var
• / home / used_accounts
• / opt / service

Теперь можно было проверить, работает ли служба в chroot. К моему удивлению, мой HIDS сообщил мне, что запись находится в подкаталоге в / opt / service .

Так что я вручную переключился на это с помощью оболочки и протестировал доступ для записи - который работал !

Так что если ничего не помогает - RTFM. man mount намекнул, что монтирование-привязка только для чтения работает только с ядром 2.6.26 или выше (неудача здесь: CentOS 5 - это 2.6.18).

Другой недостаток: это оставляет потенциальную возможность злоумышленник с полным набором инструментов операционной системы.

Now this is, where my scipt is at the moment:

mkchroot.cfg:

# Configuration file for building a chroot envirnoment with Linux
#
# V 1.2 2012-10-24
#
# Define which directories to scan for executables
#  use space to separate directories
DIRS="/opt/application /opt/bin"
#
# Define a number of files to check outside the dirctories set in the DIRS
# directive above. Use space to separate entries.
FILES="/bin/sh"
#
# Define additional things that should be added to chroot without check.
# This could be block or char-devices. Use space to separate entries. 
ADDITIONAL="/dev/urandom /dev/null /var/lock/subsys /var/application"
#
# Target chroot-directory
TARGETDIR=="/var/lib/application"
#
# Here goes the list of files that has to be synced to chroot
FILELIST="/tmp/chroot_files.dat"
#

mkchroot.sh

#!/bin/sh
. /opt/application/mkchroot.cfg
getlibs ()
{
  # Parameter1: Name of a file containing files to check
  for b in $(cat ${1})
    do
      ldd $b |grep -v ":"|grep "/"|sed "s/.*>//g; s/ (.*//g"|awk '{print $1}'
  done
}
# Main program
clear
for f in ${FILELIST}_bin ${FILELIST}_tmp ${FILELIST}_lib ${FILELIST}
  do
    [ -f $f ] && rm $f
done
for d in $DIRS
  do
    echo Build filelist for directory $d
    find $d -type f -exec file {} \; 2>/dev/null |grep ELF |cut -d : -f 1 >>${FILELIST}_bin
done
for f in $FILES
  do
    echo $f >>${FILELIST}_bin
done
echo Find libaries on stage 1
getlibs ${FILELIST}_bin >>${FILELIST}_tmp
# Now find indirect libraries until list does not get any longer...
sort -u ${FILELIST}_tmp >${FILELIST}_lib
typeset -i LIBNEW="$(wc -l <${FILELIST}_lib )" LIBOLD=0 STAGE=2
while [ $LIBNEW -ne $LIBOLD ]
  do
    echo Find libaries on stage $STAGE
    let STAGE++
    LIBOLD=$LIBNEW
    cp ${FILELIST}_lib ${FILELIST}_tmp
    getlibs ${FILELIST}_lib >>${FILELIST}_tmp
    sort -u ${FILELIST}_tmp >${FILELIST}_lib
    LIBNEW=$(wc -l <${FILELIST}_lib)
done
cp ${FILELIST}_lib ${FILELIST}_tmp
for e in $ADDITIONAL
  do
    echo $e >>${FILELIST}_tmp
done
echo Für chroot zu synchronisierende Dateien:
GDIRS=$(echo $DIRS |sed "s/ /\\\|/g;")
grep -v "$GDIRS" ${FILELIST}_tmp |sort -u >${FILELIST}
cat $FILELIST

Problem that still exists: There are shell-files within my chroot. They might reference some other binaries.

As workaround these have to be put manually into $FILES.