Jailkit and jails - Jailing a user

Running a public-facing computer like suda (on the internet or physical) requires puting the public user in "jail", making it run in "kiosk mode". We are basically whitelisting what a specific user can do, limiting attempts to turn the computer off, put offensive images on the desktop background or worse.

Jailing a user on suda using jailkit

Primary sources:https://olivier.sessink.nl/jailkit/jailkit.8.htmlhttps://askubuntu.com/questions/93411/simple-easy-way-to-jail-users

Secondary sources:

https://www.howtoforge.com/debian-9-jail-jailkit/
http://www.linuxmisc.com/1-linux-setup/9de37a1b1aca86d8.htm
https://linuxize.com/post/how-to-delete-users-in-linux-using-the-userdel-command/https://wiki.archlinux.org/title/Linux_console/Keyboard_configuration

A guide:
https://askubuntu.com/questions/93411/simple-easy-way-to-jail-users

Rundown:

1) Download Jailkit from the website of the maintainer here https://olivier.sessink.nl/jailkit/index.html#download

2) Extract and issue

./configure, make and sudo make install.

3) Create a none privileged user (let's call it guest)

sudo useradd -m guest

4) add password for that user

sudo passwd guest

Before moving the user to jail or running the jailkit scripts its easier to go into the guest account as that user and add in the basic scripts for suda and the ctwmrc configuration for ctwm.

5) Create a jail

sudo mkdir /home/jail

6) Make root the owner of /home/jail (so no one can write to it)

sudo chown root:root /home/jail

Then populate the jail with the basic things the user will use - remembering that a chroot jail is a little like a virtual system so whatever we want the user to be able to use must be accessible within the jail.

7) Use jk_init (one of the scripts provided by jailkit) to transfer basic necessities to the jail

sudo jk_init -v /home/jail netutils basicshell jk_lsh (note no ssh etc)

8) Jail the user

sudo jk_jailuser -m -j /home/jail/ guest

9) copy the bash libraries to the jail -

sudo jk_cp -v -f /home/jail /bin/bash

10) Edit /home/jail/etc/passwd so that this line:

guest:x:1001:1001::/home/guest:/usr/sbin/jk_lsh

Looks like this

guest:x:1001:1001::/home/guest:/bin/bash

The jk_cp script is used to copy over binaries and their dependencies into the jail environment so we don’t have to do it manually.

11) Copy additional (suda specific) software to the jail

sudo jk_cp -v -j /home/jail/ /usr/bin/xsetroot xfontsel xdotool xdg-settings xclock vim script ffmpeg ffplay ffprobe xterm lxterminal xloadimage scrot xwininfo xxd

12) To get Xorg to run correctly we need the xdg folder and the X11 folder to the /etc/ of the jail as well.

To copy those over we issue:

sudo jk_cp -v -j /home/jail/ /etc/xdg

sudo jk_cp -v -j /home/jail/ /etc/X11

13) Create a locale configuration (and a keyboard configuration) otherwise it defaults to c locale which can stop certain things running correctly.

touch /home/jail/etc/vconsole.conf

sudo touch /home/jail/etc/locale.conf

sudo nano /home/jail/etc/locale.conf

- add the required locale, in our case

LANG=en_GB.UTF-8

- edit the console keymap (this doesn't affect xorg)

sudo nano /home/jail/etc/vconsole.conf

KEYMAP=uk

Suda-specific notes

Certain scripts needed, like sudacam 1 and 2 and the later mantissacam1 and 2  scripts had to be alteredč. In the case of sudacam1.sh it originally read

lxterminal --geometry=17x18+0+3 -e 'ffplay -f x11grab -follow_mouse centered -framerate 10 -video_size 640x480 -i :0.0'

(which launches an lxterminal within which the command runs and thus the pipe/ffplay window)

To avoid calling an lxterminal or xterm and the script crashing out or not starting due to other dependencies not being present within the jail environment or hitting the 'get_pty:not enough ptys' error (which for reference is talked about here https://www.linuxquestions.org/questions/linux-desktop-74/get_pty-not-enough-ptys-error-4175533684/) changing the script to this

ffplay -f x11grab -follow_mouse centered -framerate 10 -video_size 640x480 -i :0.0

Worked equally well as it did as originally implemented. The manifesto and glitchify scripts did not need any changes.