Schroot does a number of things to make the chrooted system usable. This job is performed by scripts in /etc/schroot/setup.d/. These actions are configured by files in the profile directory of the schroot, which is indicated by the profile key in the schroot configuration and defaults to /etc/schroot/default/ (the schroot configuration can also specify other file locations, see the manual for details). Startup actions include:
- Mount some filesystems as indicated by the file
fstab in the profile directory.
- Copy files from the host system to the chroot. The list of files to copy is read from the file
copyfiles from the profile directory.
- Overwrite NSS databases in the chroot, read from the host. The list of databases to overwrite is read from the file
nssdatabases from the profile directory. This is similar to copying files, but it doesn't just e.g. copy /etc/passwd into the chroot, it also retrieves entries from other sources such as NIS or LDAP.
By default, copyfiles contains /etc/resolv.conf, to ensure that programs in the chroot will have DNS access like those outside the chroot. The default chroot setup assumes that you want the same users inside and outside the chroot, so nssdatabases contains all the usual databases including passwd, and the default profile's fstab contains not only filesystems like /proc and /dev which are essential to the working of many programs, but also /home.
If you don't want to overwrite anything in the chroot, declare a schroot profile without copyfiles and nssdatabases. You'll probably want to have an fstab that mounts the essentials but not /home.
A more useful schroot configuration would reproduce the human user accounts and their home directories, but not the system accounts. Reproducing the system accounts is unfortunate because there may be different accounts inside and outside the chroot. For example, Debian and their derivatives use dynamically-assigned accounts for most system software, so the correspondence between username and number for most system accounts depends on the order in which programs were installed. To do that, remove passwd, shadow, group and gshadow from the nssdatabases file, and write your own script that adds only the accounts that should be copied.
You can write the following script as /etc/schroot/setup.d/20appendaccounts to copy only accounts in the real user range.
#!/bin/sh
## Append users and groups from the host.
set -e
. "$SETUP_DATA_DIR/common-data"
. "$SETUP_DATA_DIR/common-functions"
. "$SETUP_DATA_DIR/common-config"
if [ -z "$SETUP_NSSDATABASES" ] || ! [ -f "$SETUP_NSSDATABASES" ]; then
exit 0
fi
DATABASES='group gshadow passwd shadow'
want () {
grep -qx "#>>$1" "$SETUP_NSSDATABASES"
}
start () {
sed -i -e '/^#begin added by schroot$/,/^#end added by schroot$/d' "$tmpfile"
{
echo '#begin added by schroot'
getent "$db" | case $db in
## passwd, group: copy the range for local human accounts
passwd) awk -F : "$FIRST_UID <= \$3 && \$3 <= $LAST_UID";;
group) awk -F : "$FIRST_GID <= \$3 && \$3 <= $LAST_GID";;
## shadow, gshadow: copy only entries with a password hash
shadow|gshadow) awk -F : '$2 ~ /^\$/';;
esac
echo '#end added by schroot'
} >>"$tmpfile"
}
iterate () {
for db in $DATABASES; do
want "$db" || continue
dbfile=$CHROOT_PATH/etc/$db
tmpfile=$dbfile.$$
[ -f "$dbfile" ] || continue
cp -f -- "$dbfile" "$tmpfile"
"$@"
if ! [ -s "$tmpfile" ] || cmp -s -- "$dbfile" "$tmpfile"; then
rm -f -- "$tmpfile"
else
mv -- "$tmpfile" "$dbfile"
fi
done
}
case $STAGE in
setup-start|setup-recover)
FIRST_UID=1000
LAST_UID=29999
FIRST_GID=1000
LAST_GID=29999
if [ -e /etc/adduser.conf ]; then . /etc/adduser.conf; fi
umask 600
iterate start;;
esac
Edit the nssdatabases file of your profile to contain the following lines, or put setup.nssdatabases=default/nssdatabases-append in the schroot profile and write the following lines to default/nssdatabases.
#>>passwd
#>>shadow
#>>group
#>>gshadow
services
protocols
networks
hosts
Schroot does not overwrite any file in your home directory in its default configuration. --preserve-environment is about environment variables and not relevant here.
