4

I just created a chroot jail with inetutils, coreutils and bash. Most of the things seem to work. I can ping ip addresses and hosts that are inside /etc/hosts, however, I can't ping hosts that are not in /etc/hosts. I copied both resolv.conf and protocols to the chroot jail, but I still cannot ping hostnames. Which file am I supposed to put inside the jail so I can resolve hostnames? I have also read some stuff about scutil, but I want to avoid copying more binaries as much as possible.

$ ping 8.8.8.8 
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: icmp_seq=0 ttl=120 time=22.322 ms
64 bytes from 8.8.8.8: icmp_seq=1 ttl=120 time=26.672 ms

$ ping google.com   # Host not in /etc/hosts
ping: unknown host

$ ping example.com  # Host in /etc/hosts
PING example.com (93.184.216.34): 56 data bytes
64 bytes from 93.184.216.34: icmp_seq=0 ttl=50 time=160.226 ms
64 bytes from 93.184.216.34: icmp_seq=1 ttl=50 time=147.602 ms
  • 1
    Is there a cookbook or list of steps for which your jail was constructed? If no answers start flowing an edit to document how you set your jail up might help narrow what step broke DNS for you. – bmike Aug 19 '18 at 20:28
  • @bmike I am actually working on a script that automatically creates a chroot jail. You can find the script as a gist on Github. I don't think this is considered a programming question since I'm not asking for programming help. This script simply downloads the files from GNU, compiles them, puts them in the jail and adds the macOS specific files. – pixelomer Aug 19 '18 at 20:32
  • Wonderful details. This is 100% on topic here. Let me know by pinging me or flagging if this gets closed for any reason. This will be a nice alternative for someone that doesn’t want to just make a container os and virtualize their jail on top of macos. – bmike Aug 19 '18 at 20:36
  • 1
    Interesting script, you should consider creating a github repository for it. – Ortomala Lokni Aug 19 '18 at 20:56
  • This is a duplicate of this question: stackoverflow.com/questions/33356677/… Unfortunately I'm not able to tag this as a duplicate. – jksoegaard Aug 20 '18 at 6:24
2

I was able to get it to work by making sure the /etc/resolver.conf existed in the chroot and then symlinking /var/run/mDNSResponder into the chroot.

$ sudo chroot -u user "/Users/user/Source/macos-mkjail/test_jail" /bin/bash
bash-4.4$ ping www.google.com
PING www.google.com (216.58.194.164): 56 data bytes
64 bytes from 216.58.194.164: icmp_seq=0 ttl=53 time=10326.366 ms
64 bytes from 216.58.194.164: icmp_seq=1 ttl=53 time=44.899 ms
64 bytes from 216.58.194.164: icmp_seq=2 ttl=53 time=39.388 ms
^C--- www.google.com ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max/stddev = 39.388/3470.218/10326.366/4848.030 ms
bash-4.4$exit
$
  • This worked flawlessly. Thanks! I'll make sure to add this to mkjail, both in the interactive shell (since copying the files to a different system will break the hard link) and as a part of the creation process. – pixelomer Feb 23 at 18:12
3

Basically the problem is that newer macOS versions use mDNSResponder to resolve host names, and the standard library inside the chroot isn't able to contact the mDNSResponder. Without that communication, resolving names isn't possible. You'll want to install an responder inside the chroot jail in order to get it working.

You can find more information in this post:

https://stackoverflow.com/questions/33356677/how-can-i-get-dns-resolution-to-work-inside-a-mac-os-x-chroot-on-el-capitan

  • Sorry for being late, but how do I install a responder and does it have to be the one built into macOS or can I use a different responder if there is such a thing? – pixelomer Sep 19 '18 at 18:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .