Is there a way to run a program in a chroot while still having access to stdin/stdout?
My first attempt was a shell script:
/usr/local/bin/real-app:
--------
#!/bin/bash
chroot /var/lib/app-root /usr/bin/app $*
Then symlinked it where things expect to see it:
ln -s /usr/local/bin/real-app /usr/local/bin/app
But two issues here. First, the program requires root to run. I can deal with that. But second, there no longer seems to be a connection to STDIN/STDOUT which is how the parent process expects to control this application.
Is there a way to make this work? Do I need to have the app modified so it performs the chroot syscall itself?
chroot should not affect stdin, stdout or any other file descriptors which are open at exec time. I don't know what your shell chroot command does, but provided it doesn't close them, then it should all work fine.
That is, provided the program doesn't do something really silly like rely on opening /dev/stdout or anything.