Mdthbs

I've booted a live-cd in order to download, compile and install a few packages on a otherwise working system without actually booting said system.

I've created a build user on the system by issuing useradd -m -G wheel -s /bin/bash builder

I then proceed to mounting my partition and a chroot environment:

# mount /dev/mapper/luksdev on /mnt

# cd /mnt

# cp /etc/resolv.conf etc

# mount -t proc /proc proc

# mount --make-rslave --rbind /sys sys

# mount --make-rslave --rbind /dev dev

# mount --make-rslave --rbind /run run

# chroot /mnt /bin/bash

After this, I clone, chown and move into the project to build.

(chroot)# git clone https://aur.archlinux.org/lighttpd2-git.git /home/builder/lighttpd2

(chroot)# chown -R builder.builder /home/builder/lighttpd2

(chroot)# sudo -u builder -s

(chroot|builder ~)$ cd /home/builder/lighttpd2/

(chroot|builder lighttpd2)$ /usr/bin/makepkg -s --noconfirm

As root, I have no issues performing name lookups, so the git clone will work as inteded. But switching to any other user during the build process of this package (or if I run the git clone as non-root), I will get:

fatal: unable to access 'https://git.lighttpd.net/lighttpd/lighttpd2.git/': Could not resolve host: git.lighttpd.net

So I thought of doing simple ping check to isolate the issue. Doing ping www.google.com works as root, but not as builder.
However, doing ping 8.8.8.8 works for both root & builder.

(chroot)# ping -c 1 www.google.com

PING www.google.com (172.217.22.164) 56(84) bytes of data.

64 bytes from arn09s11-in-f164.1e100.net (172.217.22.164): icmp_seq=1 ttl=55 time=2.03 ms



(chroot|builder)$ ping -c 1 www.google.com

ping: www.google.com: Name or service not known



(chroot)# ping -c 1 8.8.8.8

PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.

64 bytes from 8.8.8.8: icmp_seq=1 ttl=121 time=1.97 ms



(chroot|builder)$  ping -c 1 8.8.8.8

PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.

64 bytes from 8.8.8.8: icmp_seq=1 ttl=121 time=1.98 ms

logically, I thought it has to do with the name resolutions for the specific user.. But doing:

(chroot)# nslookup www.google.com

Server:    8.8.8.8

Name:      www.google.com

Address: 216.58.207.196



(chroot|builder)$ nslookup www.google.com

Server:    8.8.8.8

Name:      www.google.com

Address: 216.58.207.196

Both users can do nslookup and shows that /etc/resolv.conf is present and works. But pinging a hostname or using any type of name-resolve tasks outside of nslookup/dig won't work:

(chroot|builder)$ python

>>> from socket import *

>>> s = socket()

>>> s.connect(('www.google.com', 80))

socket.gaierror: [Errno -2] Name or service not known

I tried sticking solely to ping to keep things simple.

I've also tried making sure nothing's blocking my ping usage:

(chroot)# chown root:root /bin/ping; chmod u+srwx,go=rx /bin/ping

(chroot)# getcap /usr/bin/ping

/usr/bin/ping = cap_net_raw+ep

But even then, I'm not allowed to ping using hostnames, but IP's still work.

(chroot|builder)$ strace ping www.google.com

socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP) = -1 EACCESS (Permission denied)

socket(AF_INET, SOCK_RAW, IPPROTO_ICMP) = -1 EPERM (Operation not permitted)

write(2, "ping: socket: Operation not perm"..., 38ping: socket: Operation not permitted)= 38

/home and /root are not mounted with nosuid either. Sadly, this is a VM so I can only supply a screenshot of it.

Since I'm trying ping from /home, I don't see a reason why this would cause the issue either. If I boot into the system, and do the exact same thing with the user I created during the live-cd boot.. I can ping hostnames.

At this point I mainly want to understand why some users can perform ping, lookups etc. And some don't during a chroot environment. I'm not sure where to debug/continue from here on in order to try and fix or understand the underlying problem. A couple of helpful souls over at IRC also tried to give a helping hand but we're all baffled.

Edit:

I've narrowed it down to the mount --make-rslave --rbind /run run being the issue. It's the cause for whatever reason. If I try to ping www.google.com after each mount command (at the start of the question), it stops right after /run is mounted.