Can't link to files in /usr/bin, but can copy

[phssthpok2]

I've run a few programs in chroot environments. I've always had to copy over anything I needed from /etc, /lib, etc., into the equivalent locations in the jail. No links, but actual copies of the files.

Which is very inefficient if you're setting up sandboxes dynamically, as I am. Linking is much faster and more efficient.

As I said, my workaround is to make copies of all the necessary files in a directory under /home, and then create hard links to those copies. This means I only have to copy the files once, but it means I have to re-copy them every so often if there are updates (but a cron job can check each file against the original and copy them if there are any changes).

I assume it's some sort of security policy that Ubuntu is applying -- I created a file /foo (as root) and couldn't link to that either, but when I made myself the owner instead of root, it worked. Can't find anything in the docs that explains this.

[phssthpok2]

I've run a few programs in chroot environments. I've always had to copy over anything I needed from /etc, /lib, etc., into the equivalent locations in the jail. No links, but actual copies of the files.

The problem that this is inefficient when you're dynamically creating sandboxes (as I am) and you have to copy the files into each one. My workaround is to copy the files I need into a directory under $HOME, and link to those, with a cron job to check each of them periodically and re-copy them if the originals have changed.

Experiments show that I can't create hard links to ANY file that I don't own -- not just files owned by root, but files owned by absolutely anyone except myself. Perhaps ln tries to create the links with the same ownership as the original file? Can't see anything in the docs about this...

[phssthpok2]

Oops. Couldn't see reply #11 and assumed I'd forgotten to hit submit, so posted again #12. Is there a way to delete messages here?

[phssthpok2]

I've run a few programs in chroot environments. I've always had to copy over anything I needed from /etc, /lib, etc., into the equivalent locations in the jail. No links, but actual copies of the files.

You can also use mount -bind for /lib, /lib64, /dev and /proc.

[phssthpok2]

Perhaps ln tries to create the links with the same ownership as the original file?

Silly me, of course it is, since ownership & permission info is in the inode, not the directory entry...!