chroot-distro 2.3.1__tar.gz → 2.3.2__tar.gz

{chroot_distro-2.3.1 → chroot_distro-2.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: chroot-distro
-Version: 2.3.1
+Version: 2.3.2
 Summary: chroot-distro is a lightweight Linux container management utility built around chroot.
 Project-URL: Homepage, https://github.com/sabamdarif/chroot-distro
 Project-URL: Repository, https://github.com/sabamdarif/chroot-distro
@@ -468,7 +468,7 @@ chroot-distro login ubuntu --get-chroot-cmd
 | Option | Description |
 |---|---|
 | `-u`, `--user USER` | Log in as USER (default: `root`). Accepts `name`, numeric `uid`, `name:group`, or `uid:gid`. |
-| `--isolated` | Reduce host exposure and enable namespace isolation (mount, PID, UTS, IPC via `unshare`/`nsenter`). On Termux: also skip Android system, storage, and `$PREFIX` binds unless you opt in with `--shared-*` or `--bind`. (Fresh `/tmp` and `/run` are the default in every mode now, not just `--isolated`.) Mutually exclusive with `--minimal`. |
+| `--isolated` | Reduce host exposure and enable namespace isolation (mount, PID, UTS, IPC, and cgroup when supported, via `unshare`/`nsenter`). On Termux: also skip Android system, storage, and `$PREFIX` binds unless you opt in with `--shared-*` or `--bind`. (Fresh `/tmp` and `/run` are the default in every mode now, not just `--isolated`.) Mutually exclusive with `--minimal`. To get the same namespace isolation **without** reducing the mount set, set `CD_USE_NS=1` instead (see [Environment variables](#environment-variables)). |
 | `--minimal` | Bare minimum chroot: core pseudo-filesystems only (`/dev`, `/proc`, `/sys`, plus `/run`, `/dev/pts`, `/dev/shm` when present). Stripped guest environment. Mutually exclusive with `--isolated`. |
 | `--shared-home` | Bind the invoking user's host home into the guest home (or `/root` for root). On Termux, binds `TERMUX_HOME`. |
 | `--shared-tmp` | Bind host tmp (`/tmp` on Linux, `$PREFIX/tmp` on Termux) to `/tmp` in the guest. Opt-in only: by default the container gets its own fresh `/tmp`, not the host's. |
@@ -562,23 +562,38 @@ Termux.)
 - Guest `ldconfig` is run inside the chroot to refresh the shared library
   cache after the new libraries are bind-mounted.
 
-#### Namespace isolation (`--isolated`)
+#### Namespace isolation (`--isolated` and `CD_USE_NS`)
 
 With `--isolated`, chroot-distro creates a per-container namespace holder
 (`unshare`) and runs bind mounts, special mounts, and `chroot` inside that
 environment (`nsenter`). Supported namespaces: **mount**, **PID**, **UTS**,
-and **IPC**. Isolation is **all-or-nothing**: chroot-distro probes the full
-requested namespace set first, and if any one of them is unsupported on the
-kernel it acquires none of them and falls back fully to a non-isolated
-login (with a warning naming the missing namespace), so a session is never
-left half-isolated. This is inspired by
+**IPC**, and **cgroup**. The cgroup namespace is acquired best-effort (used
+when the kernel supports it, skipped otherwise); the **mount/PID/UTS/IPC**
+set is **all-or-nothing**: chroot-distro probes that set first, and if any
+one of them is unsupported on the kernel it acquires none of them and falls
+back fully to a non-isolated login (with a warning naming the missing
+namespace), so a session is never left half-isolated. This is inspired by
 [Ubuntu-Chroot](Ubuntu-Chroot/tools/chroot.sh) and is **not** a full
 container runtime: there is no network namespace, no user namespace
 mapping, and no image layering.
 
-Do not mix `--isolated` and non-isolated logins on the same container
-without running `chroot-distro unmount <name>` first. Concurrent
-`--isolated` sessions share the same holder and mounts.
+`--isolated` couples two things: namespace isolation **and** a reduced set
+of host bind mounts (it skips the Android system/storage/`$PREFIX` binds on
+Termux, and `/tmp`/display sharing on Linux, unless re-enabled with
+`--shared-*` / `--bind`). If you want **only** the namespace isolation
+while keeping every default mount, set the `CD_USE_NS=1` environment
+variable instead: every `login`/`run` then runs in the same
+mount/PID/UTS/IPC/cgroup namespaces but with the full default mount set
+intact. `CD_USE_NS` accepts `1`/`true`/`yes`/`on`.
+
+> `CD_USE_NS` is set by the invoking user but the tool re-executes itself
+> as root; chroot-distro forwards the variable across `sudo`/`doas`/`pkexec`
+> /`su` automatically, so it keeps working even when the `sudo` line prints
+> `'-E' is ignored`.
+
+Do not mix isolated (via `--isolated` or `CD_USE_NS`) and non-isolated
+logins on the same container without running `chroot-distro unmount <name>`
+first. Concurrent isolated sessions share the same holder and mounts.
 
 #### Host bindings (Termux, default mode)
 
@@ -635,9 +650,10 @@ entries win):
    `LIBGL_ALWAYS_SOFTWARE`. Your `--env` entries override these.
 
 `HOSTNAME` is always set to the host system hostname name. The
-`hostname`/`uname` commands report it only under `--isolated`, where the
-UTS namespace is given a real hostname; without `--isolated` they still
-report the host's name (no UTS namespace to change).
+`hostname`/`uname` commands report it only when namespace isolation is
+active (via `--isolated` or `CD_USE_NS`), where the UTS namespace is given
+a real hostname; otherwise they still report the host's name (no UTS
+namespace to change).
 
 On Termux (unless isolated or minimal), `$PREFIX/bin` is appended to
 `PATH`. A snippet at `/etc/profile.d/termux-profile.sh` re-applies
@@ -1168,6 +1184,7 @@ paths on Linux are typically under `/root/.local/share/` and
 | `CD_DOWNLOAD_WORKERS` | Parallel registry layer downloads during `install` (default `4`, maximum `10`). Invalid values use the default; out-of-range values are clamped. |
 | `CD_DOWNLOAD_RATE_LIMIT` | Bandwidth limit for downloads (e.g., `5M` for 5 MiB/s, default `0` = unlimited). Supports suffixes `K`, `M`, `G` (case-insensitive). |
 | `CD_DOWNLOAD_MAX_RETRIES` | Maximum retry attempts per connection failure (default `3`, clamped between `0` and `20`). |
+| `CD_USE_NS` | When truthy (`1`/`true`/`yes`/`on`), every `login`/`run` uses full Linux namespace isolation (mount, PID, UTS, IPC, and cgroup when supported) **without** skipping any default bind mounts. Differs from `--isolated`, which also reduces the mount set. Forwarded across privilege elevation automatically. |
 | `CD_FORCE_NO_COLORS` | When set, disables ANSI colours in Chroot-Distro output. |
 | `COLUMNS` | Fallback terminal width for `--help` rendering. |
 | `TERM`, `COLORTERM` | Inherited into the guest (always; even in `--minimal`). `TERM` defaults to `xterm-256color` when unset on the host. |
@@ -1260,9 +1277,10 @@ cp src/chroot_distro/completions/chroot-distro.fish \
 - **Kernel features**: FUSE modules, real `iptables`, custom cgroup
   hierarchies, and similar kernel-module features may not work inside the
   guest.
-- **Namespaces**: `--isolated` provides mount/PID/UTS/IPC isolation via
-  `unshare`/`nsenter`, but there is no network namespace and no parity with
-  Docker or Podman.
+- **Namespaces**: `--isolated` (or `CD_USE_NS=1`) provides
+  mount/PID/UTS/IPC isolation, plus the cgroup namespace when the kernel
+  supports it, via `unshare`/`nsenter` — but there is no network namespace,
+  no user-namespace mapping, and no parity with Docker or Podman.
 - **Bind mount hygiene**: crashed sessions or orphan processes can leave
   mounts busy; `unmount` and lazy unmount mitigate this but orphaned
   processes should be cleaned up.

{chroot_distro-2.3.1 → chroot_distro-2.3.2}/README.md

@@ -439,7 +439,7 @@ chroot-distro login ubuntu --get-chroot-cmd
 | Option | Description |
 |---|---|
 | `-u`, `--user USER` | Log in as USER (default: `root`). Accepts `name`, numeric `uid`, `name:group`, or `uid:gid`. |
-| `--isolated` | Reduce host exposure and enable namespace isolation (mount, PID, UTS, IPC via `unshare`/`nsenter`). On Termux: also skip Android system, storage, and `$PREFIX` binds unless you opt in with `--shared-*` or `--bind`. (Fresh `/tmp` and `/run` are the default in every mode now, not just `--isolated`.) Mutually exclusive with `--minimal`. |
+| `--isolated` | Reduce host exposure and enable namespace isolation (mount, PID, UTS, IPC, and cgroup when supported, via `unshare`/`nsenter`). On Termux: also skip Android system, storage, and `$PREFIX` binds unless you opt in with `--shared-*` or `--bind`. (Fresh `/tmp` and `/run` are the default in every mode now, not just `--isolated`.) Mutually exclusive with `--minimal`. To get the same namespace isolation **without** reducing the mount set, set `CD_USE_NS=1` instead (see [Environment variables](#environment-variables)). |
 | `--minimal` | Bare minimum chroot: core pseudo-filesystems only (`/dev`, `/proc`, `/sys`, plus `/run`, `/dev/pts`, `/dev/shm` when present). Stripped guest environment. Mutually exclusive with `--isolated`. |
 | `--shared-home` | Bind the invoking user's host home into the guest home (or `/root` for root). On Termux, binds `TERMUX_HOME`. |
 | `--shared-tmp` | Bind host tmp (`/tmp` on Linux, `$PREFIX/tmp` on Termux) to `/tmp` in the guest. Opt-in only: by default the container gets its own fresh `/tmp`, not the host's. |
@@ -533,23 +533,38 @@ Termux.)
 - Guest `ldconfig` is run inside the chroot to refresh the shared library
   cache after the new libraries are bind-mounted.
 
-#### Namespace isolation (`--isolated`)
+#### Namespace isolation (`--isolated` and `CD_USE_NS`)
 
 With `--isolated`, chroot-distro creates a per-container namespace holder
 (`unshare`) and runs bind mounts, special mounts, and `chroot` inside that
 environment (`nsenter`). Supported namespaces: **mount**, **PID**, **UTS**,
-and **IPC**. Isolation is **all-or-nothing**: chroot-distro probes the full
-requested namespace set first, and if any one of them is unsupported on the
-kernel it acquires none of them and falls back fully to a non-isolated
-login (with a warning naming the missing namespace), so a session is never
-left half-isolated. This is inspired by
+**IPC**, and **cgroup**. The cgroup namespace is acquired best-effort (used
+when the kernel supports it, skipped otherwise); the **mount/PID/UTS/IPC**
+set is **all-or-nothing**: chroot-distro probes that set first, and if any
+one of them is unsupported on the kernel it acquires none of them and falls
+back fully to a non-isolated login (with a warning naming the missing
+namespace), so a session is never left half-isolated. This is inspired by
 [Ubuntu-Chroot](Ubuntu-Chroot/tools/chroot.sh) and is **not** a full
 container runtime: there is no network namespace, no user namespace
 mapping, and no image layering.
 
-Do not mix `--isolated` and non-isolated logins on the same container
-without running `chroot-distro unmount <name>` first. Concurrent
-`--isolated` sessions share the same holder and mounts.
+`--isolated` couples two things: namespace isolation **and** a reduced set
+of host bind mounts (it skips the Android system/storage/`$PREFIX` binds on
+Termux, and `/tmp`/display sharing on Linux, unless re-enabled with
+`--shared-*` / `--bind`). If you want **only** the namespace isolation
+while keeping every default mount, set the `CD_USE_NS=1` environment
+variable instead: every `login`/`run` then runs in the same
+mount/PID/UTS/IPC/cgroup namespaces but with the full default mount set
+intact. `CD_USE_NS` accepts `1`/`true`/`yes`/`on`.
+
+> `CD_USE_NS` is set by the invoking user but the tool re-executes itself
+> as root; chroot-distro forwards the variable across `sudo`/`doas`/`pkexec`
+> /`su` automatically, so it keeps working even when the `sudo` line prints
+> `'-E' is ignored`.
+
+Do not mix isolated (via `--isolated` or `CD_USE_NS`) and non-isolated
+logins on the same container without running `chroot-distro unmount <name>`
+first. Concurrent isolated sessions share the same holder and mounts.
 
 #### Host bindings (Termux, default mode)
 
@@ -606,9 +621,10 @@ entries win):
    `LIBGL_ALWAYS_SOFTWARE`. Your `--env` entries override these.
 
 `HOSTNAME` is always set to the host system hostname name. The
-`hostname`/`uname` commands report it only under `--isolated`, where the
-UTS namespace is given a real hostname; without `--isolated` they still
-report the host's name (no UTS namespace to change).
+`hostname`/`uname` commands report it only when namespace isolation is
+active (via `--isolated` or `CD_USE_NS`), where the UTS namespace is given
+a real hostname; otherwise they still report the host's name (no UTS
+namespace to change).
 
 On Termux (unless isolated or minimal), `$PREFIX/bin` is appended to
 `PATH`. A snippet at `/etc/profile.d/termux-profile.sh` re-applies
@@ -1139,6 +1155,7 @@ paths on Linux are typically under `/root/.local/share/` and
 | `CD_DOWNLOAD_WORKERS` | Parallel registry layer downloads during `install` (default `4`, maximum `10`). Invalid values use the default; out-of-range values are clamped. |
 | `CD_DOWNLOAD_RATE_LIMIT` | Bandwidth limit for downloads (e.g., `5M` for 5 MiB/s, default `0` = unlimited). Supports suffixes `K`, `M`, `G` (case-insensitive). |
 | `CD_DOWNLOAD_MAX_RETRIES` | Maximum retry attempts per connection failure (default `3`, clamped between `0` and `20`). |
+| `CD_USE_NS` | When truthy (`1`/`true`/`yes`/`on`), every `login`/`run` uses full Linux namespace isolation (mount, PID, UTS, IPC, and cgroup when supported) **without** skipping any default bind mounts. Differs from `--isolated`, which also reduces the mount set. Forwarded across privilege elevation automatically. |
 | `CD_FORCE_NO_COLORS` | When set, disables ANSI colours in Chroot-Distro output. |
 | `COLUMNS` | Fallback terminal width for `--help` rendering. |
 | `TERM`, `COLORTERM` | Inherited into the guest (always; even in `--minimal`). `TERM` defaults to `xterm-256color` when unset on the host. |
@@ -1231,9 +1248,10 @@ cp src/chroot_distro/completions/chroot-distro.fish \
 - **Kernel features**: FUSE modules, real `iptables`, custom cgroup
   hierarchies, and similar kernel-module features may not work inside the
   guest.
-- **Namespaces**: `--isolated` provides mount/PID/UTS/IPC isolation via
-  `unshare`/`nsenter`, but there is no network namespace and no parity with
-  Docker or Podman.
+- **Namespaces**: `--isolated` (or `CD_USE_NS=1`) provides
+  mount/PID/UTS/IPC isolation, plus the cgroup namespace when the kernel
+  supports it, via `unshare`/`nsenter` — but there is no network namespace,
+  no user-namespace mapping, and no parity with Docker or Podman.
 - **Bind mount hygiene**: crashed sessions or orphan processes can leave
   mounts busy; `unmount` and lazy unmount mitigate this but orphaned
   processes should be cleaned up.

{chroot_distro-2.3.1 → chroot_distro-2.3.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "chroot-distro"
-version = "2.3.1"
+version = "2.3.2"
 description = "chroot-distro is a lightweight Linux container management utility built around chroot."
 readme = "README.md"
 requires-python = ">=3.10"

{chroot_distro-2.3.1 → chroot_distro-2.3.2}/src/chroot_distro/commands/help/pages.py

@@ -402,6 +402,19 @@ HELP_PAGES: dict[str, dict[str, typing.Any]] = {
                 if IS_TERMUX
                 else []
             ),
+            {
+                "title": "ENVIRONMENT",
+                "intro": (
+                    "CD_USE_NS=1 enables full Linux namespace isolation "
+                    "(mount, PID, UTS, IPC via unshare/nsenter) by default for "
+                    "every login, while still keeping all the default bind "
+                    "mounts. Unlike --isolated, it does NOT skip the extra "
+                    "Android system/storage/$PREFIX (or Linux /tmp and display) "
+                    "mounts: the goal is only namespace isolation, not a "
+                    "reduced mount set. Accepts 1/true/yes/on. Use --isolated "
+                    "when you also want the reduced mount set."
+                ),
+            },
             {
                 "title": "NOTES",
                 "intro": (
@@ -563,6 +576,19 @@ HELP_PAGES: dict[str, dict[str, typing.Any]] = {
             f"{PROGRAM_NAME} run nextcloud",
             f"{PROGRAM_NAME} run ubuntu --isolated -- /bin/echo hi",
         ],
+        "footer": [
+            {
+                "title": "ENVIRONMENT",
+                "intro": (
+                    "CD_USE_NS=1 enables full Linux namespace isolation "
+                    "(mount, PID, UTS, IPC via unshare/nsenter) by default for "
+                    "every run, while still keeping all the default bind "
+                    "mounts. Unlike --isolated, it does NOT skip the extra "
+                    "Android system/storage/$PREFIX (or Linux /tmp and display) "
+                    "mounts. Accepts 1/true/yes/on."
+                ),
+            },
+        ],
     },
     "kill": {
         "usage": "kill CONTAINER",

{chroot_distro-2.3.1 → chroot_distro-2.3.2}/src/chroot_distro/commands/login/__init__.py

@@ -445,6 +445,12 @@ def _command_login_inner(container_name: str, args) -> None:
     login_wd = getattr(args, "work_dir", "") or ""
     isolated = getattr(args, "isolated", False)
     minimal = getattr(args, "minimal", False)
+    # `--isolated` skips the extra Android/host mounts AND uses namespaces.
+    # `CD_USE_NS` only turns on namespace isolation, keeping every mount.
+    # `skip_extra_mounts` therefore tracks only the real `--isolated` flag,
+    # while namespace setup is decided separately by should_use_namespaces().
+    skip_extra_mounts = isolated
+    use_ns_requested = namespace.should_use_namespaces(isolated)
     use_shared_home = getattr(args, "shared_home", False)
     shared_tmp = getattr(args, "shared_tmp", False)
     shared_display = getattr(args, "shared_display", False)
@@ -504,13 +510,13 @@ def _command_login_inner(container_name: str, args) -> None:
             container_path,
             extra_env,
             minimal,
-            isolated,
+            skip_extra_mounts,
             container_name=hostname_arg,
         )
 
         # A termux-type guest still needs its own cache dir to exist; create
         # it inside the rootfs (never bound from the host).
-        if IS_TERMUX and not isolated:
+        if IS_TERMUX and not skip_extra_mounts:
             os.makedirs(
                 os.path.join(rootfs, "data", "data", TERMUX_APP_PACKAGE, "cache"),
                 exist_ok=True,
@@ -656,7 +662,7 @@ def _command_login_inner(container_name: str, args) -> None:
             login_home,
             extra_env,
             minimal,
-            isolated,
+            skip_extra_mounts,
             container_name=hostname_arg,
         )
 
@@ -671,18 +677,18 @@ def _command_login_inner(container_name: str, args) -> None:
     # guest's supplementary groups, DNS and all networking fail inside the
     # chroot ("Temporary failure resolving"). Grant them on Termux unless the
     # session is isolated or minimal.
-    if IS_TERMUX and not isolated and not minimal:
+    if IS_TERMUX and not skip_extra_mounts and not minimal:
         groups = list(groups)
         for net_gid in ("3003", "3004"):
             if net_gid not in groups:
                 groups.append(net_gid)
 
-    if IS_TERMUX and not isolated and not minimal:
+    if IS_TERMUX and not skip_extra_mounts and not minimal:
         termux_bin = f"{TERMUX_PREFIX}/bin"
         components = [c for c in child_env.get("PATH", "").split(":") if c and c != termux_bin]
         child_env["PATH"] = ":".join(components)
 
-    if dist_type == "normal" and IS_TERMUX and not isolated and not minimal:
+    if dist_type == "normal" and IS_TERMUX and not skip_extra_mounts and not minimal:
         profile_uid = int(login_uid) if login_uid is not None else 0
         profile_gid = int(login_gid) if login_gid is not None else profile_uid
         inject_termux_profile(
@@ -775,7 +781,8 @@ def _command_login_inner(container_name: str, args) -> None:
     resolved_binds, rslave_targets = bindings.get_bindings(
         rootfs=rootfs,
         minimal=minimal,
-        isolated=isolated,
+        isolated=skip_extra_mounts,
+        use_namespaces=use_ns_requested and not minimal,
         shared_home=use_shared_home,
         shared_tmp=shared_tmp,
         shared_display=shared_display,
@@ -795,7 +802,7 @@ def _command_login_inner(container_name: str, args) -> None:
             if key not in user_env_keys_all:
                 child_env[key] = val
 
-    use_namespaces = isolated and not minimal
+    use_namespaces = use_ns_requested and not minimal
     holder = None
     pipe_w = None
     chroot_args = None
@@ -812,7 +819,6 @@ def _command_login_inner(container_name: str, args) -> None:
                 f"(missing: {' '.join(missing)}). Falling back to non-isolated login."
             )
             use_namespaces = False
-            isolated = False
 
     try:
         host_mounts_exist = bool(mount_manager.get_active_mounts(rootfs))
@@ -874,7 +880,7 @@ def _command_login_inner(container_name: str, args) -> None:
             else:
                 namespace.write_isolation_mode(container_name, namespace.ISOLATION_MODE_HOST)
 
-            if IS_TERMUX and not isolated and not minimal:
+            if IS_TERMUX and not skip_extra_mounts and not minimal:
                 ensure_data_suid()
             # Pre-clean stale mounts if any
             with contextlib.suppress(Exception):

{chroot_distro-2.3.1 → chroot_distro-2.3.2}/src/chroot_distro/commands/login/bindings.py

@@ -424,6 +424,7 @@ def get_bindings(
     *,
     minimal: bool = False,
     isolated: bool = False,
+    use_namespaces: bool | None = None,
     shared_home: bool = False,
     shared_tmp: bool = False,
     shared_display: bool = False,
@@ -444,11 +445,19 @@ def get_bindings(
     binds = []
     rslave_targets: list[str] = []
 
+    # When namespaces are active, a fresh procfs is mounted in the PID
+    # namespace by get_special_mounts(). CD_USE_NS keeps every other mount
+    # (isolated=False) but still namespaces PIDs, so the /proc decision must
+    # follow namespace use, not the mount-skipping flag. Default to *isolated*
+    # for backward compatibility when the caller does not pass it explicitly.
+    if use_namespaces is None:
+        use_namespaces = isolated
+
     # 1. Base Linux mounts (always needed for chroot to function correctly)
     # Target paths are absolute guest paths (e.g. /dev) which we will mount nested under rootfs.
     binds.append(("/dev", "/dev"))
     # Host /proc bind breaks PID namespace isolation; mount procfs in get_special_mounts().
-    if not isolated:
+    if not use_namespaces:
         binds.append(("/proc", "/proc"))
     binds.append(("/sys", "/sys"))
 

{chroot_distro-2.3.1 → chroot_distro-2.3.2}/src/chroot_distro/elevate.py

@@ -6,12 +6,35 @@ import sys
 from chroot_distro.constants import IS_TERMUX
 from chroot_distro.exceptions import RootRequiredError
 
+# Runtime CD_* environment variables that influence behaviour *after* the
+# tool re-executes as root. They must be forwarded explicitly across the
+# privilege-elevation boundary because many sudoers policies strip the
+# environment and ignore `sudo -E` ("preserving the entire environment is
+# not supported, '-E' is ignored").
+_FORWARDED_ENV_VARS = (
+    "CD_USE_NS",
+    "CD_DOCKER_AUTH",
+    "CD_DOWNLOAD_WORKERS",
+    "CD_DOWNLOAD_MAX_RETRIES",
+    "CD_DOWNLOAD_RATE_LIMIT",
+)
+
 
 def is_root() -> bool:
     """Check if the current process is running with root privileges (UID 0)."""
     return os.getuid() == 0
 
 
+def _forwarded_env_assignments() -> list[str]:
+    """Return ``VAR=value`` strings for the CD_* vars present in the env."""
+    assignments: list[str] = []
+    for name in _FORWARDED_ENV_VARS:
+        value = os.environ.get(name)
+        if value is not None:
+            assignments.append(f"{name}={value}")
+    return assignments
+
+
 def get_reexec_argv() -> list[str]:
     """Build the argument list for re-executing the current process."""
     args = list(sys.argv)
@@ -71,14 +94,30 @@ def elevate_or_die() -> None:
 
     reexec_argv = get_reexec_argv()
 
+    # Runtime CD_* vars set by the invoking user must cross the elevation
+    # boundary explicitly: `sudo -E` is frequently ignored by sudoers policy,
+    # which would silently drop e.g. CD_USE_NS and skip namespace isolation.
+    # The loop sentinel is forwarded the same way so it survives a stripped
+    # environment and still prevents an elevation loop.
+    env_assignments = ["_CHROOT_DISTRO_ELEVATING=1", *_forwarded_env_assignments()]
+
+    tool_name = tool_cmd[0]
+
+    # Prefix the re-executed program with `env VAR=value ...` so the
+    # forwarded variables are set by the root-side `env` binary. This is
+    # independent of the elevation tool's own environment policy (sudoers
+    # env_keep / -E, doas keepenv, pkexec sanitisation), which can otherwise
+    # silently drop CD_USE_NS and skip namespace isolation.
+    env_prefix = ["env", *env_assignments] if env_assignments else []
+
     # Construct the final command line
     if tool_cmd[-1] == "-c":
-        cmd_str = shlex.join(reexec_argv)
+        # su -c "<command string>": the whole invocation is a single string.
+        cmd_str = shlex.join([*env_prefix, *reexec_argv])
         full_argv = [*tool_cmd, cmd_str]
     else:
-        full_argv = [*tool_cmd, *reexec_argv]
-
-    tool_name = tool_cmd[0]
+        # sudo / doas / pkexec: run `env VAR=value <reexec>` as root.
+        full_argv = [*tool_cmd, *env_prefix, *reexec_argv]
 
     try:
         os.execvp(full_argv[0], full_argv)

{chroot_distro-2.3.1 → chroot_distro-2.3.2}/src/chroot_distro/helpers/namespace.py

@@ -16,17 +16,51 @@ from chroot_distro.exceptions import ChrootDistroError
 
 log = logging.getLogger(__name__)
 
-_PROBE_FLAGS = ("--pid", "--mount", "--uts", "--ipc")
+# Namespaces that must all be available for isolation to be acquired. The
+# pre-flight check in command_login is all-or-nothing over this set, so it is
+# kept to the widely supported namespaces; missing any of them means a full
+# fall back to host mode rather than a half-isolated session.
+_REQUIRED_PROBE_FLAGS = ("--pid", "--mount", "--uts", "--ipc")
+# The cgroup namespace is acquired opportunistically: it is added to the
+# holder when the kernel supports it (probe_unshare_flags drops unsupported
+# flags), but it is NOT part of the strict pre-check because several Android
+# kernels lack cgroupns and we still want pid/mount/uts/ipc isolation there.
+_OPTIONAL_PROBE_FLAGS = ("--cgroup",)
+_PROBE_FLAGS = _REQUIRED_PROBE_FLAGS + _OPTIONAL_PROBE_FLAGS
 _LONG_TO_SHORT = {
     "--mount": "-m",
     "--uts": "-u",
     "--ipc": "-i",
     "--pid": "-p",
+    "--cgroup": "-C",
 }
 
 ISOLATION_MODE_NAMESPACE = "namespace"
 ISOLATION_MODE_HOST = "host"
 
+# Truthy spellings accepted for the CD_USE_NS environment variable.
+_TRUTHY_ENV_VALUES = frozenset({"1", "true", "yes", "on"})
+
+
+def use_ns_env_enabled() -> bool:
+    """Return True when CD_USE_NS requests full namespace isolation.
+
+    CD_USE_NS turns on the same PID/UTS/IPC/mount namespace isolation that
+    ``--isolated`` uses, but *without* skipping any of the default bind
+    mounts. Accepts ``1``/``true``/``yes``/``on`` (case-insensitive).
+    """
+    return os.environ.get("CD_USE_NS", "").strip().lower() in _TRUTHY_ENV_VALUES
+
+
+def should_use_namespaces(isolated: bool) -> bool:
+    """Decide whether to set up Linux namespace isolation.
+
+    Namespaces are used when the user passes ``--isolated`` (which also
+    skips the extra host mounts) or when ``CD_USE_NS`` is set (which keeps
+    every default mount and only adds namespace isolation).
+    """
+    return bool(isolated) or use_ns_env_enabled()
+
 # Android's toybox/toolbox `sleep` rejects the GNU coreutils `infinity`
 # keyword ("sleep: Not a number 'infinity'") and aborts immediately, which
 # tears down the namespace holder the moment it is created. Use a large
@@ -126,7 +160,7 @@ def probe_unshare_flags() -> list[str]:
     return supported
 
 
-def probe_namespace_support(flags: tuple[str, ...] = _PROBE_FLAGS) -> list[str]:
+def probe_namespace_support(flags: tuple[str, ...] = _REQUIRED_PROBE_FLAGS) -> list[str]:
     """Return the subset of *flags* the kernel does NOT support.
 
     Probes each flag with `unshare <flag> true` without entering any

{chroot_distro-2.3.1 → chroot_distro-2.3.2}/tests/unit/test_elevate.py

@@ -5,6 +5,7 @@ import pytest
 
 from chroot_distro.elevate import (
     _find_escalation_tool,
+    _forwarded_env_assignments,
     elevate_or_die,
     get_reexec_argv,
     is_root,
@@ -127,14 +128,24 @@ def test_elevate_or_die_exec_sudo():
         patch("chroot_distro.elevate._find_escalation_tool", return_value=["sudo", "-E"]),
         patch("chroot_distro.elevate.get_reexec_argv", return_value=["/usr/bin/chroot-distro", "login", "alpine"]),
         patch("os.execvp", mock_exec),
-        patch.dict("os.environ", {}),
+        patch.dict("os.environ", {}, clear=True),
     ):
         elevate_or_die()
 
         mock_exec.assert_called_once()
         args, _kwargs = mock_exec.call_args
         assert args[0] == "sudo"
-        assert args[1] == ["sudo", "-E", "/usr/bin/chroot-distro", "login", "alpine"]
+        # The loop sentinel is always forwarded via the `env` prefix so it
+        # survives a stripped environment.
+        assert args[1] == [
+            "sudo",
+            "-E",
+            "env",
+            "_CHROOT_DISTRO_ELEVATING=1",
+            "/usr/bin/chroot-distro",
+            "login",
+            "alpine",
+        ]
         assert os.environ.get("_CHROOT_DISTRO_ELEVATING") == "1"
 
 
@@ -145,12 +156,98 @@ def test_elevate_or_die_exec_su():
         patch("chroot_distro.elevate._find_escalation_tool", return_value=["su", "-c"]),
         patch("chroot_distro.elevate.get_reexec_argv", return_value=["/usr/bin/chroot-distro", "login", "alpine"]),
         patch("os.execvp", mock_exec),
-        patch.dict("os.environ", {}),
+        patch.dict("os.environ", {}, clear=True),
     ):
         elevate_or_die()
 
         mock_exec.assert_called_once()
         args, _kwargs = mock_exec.call_args
         assert args[0] == "su"
-        assert args[1] == ["su", "-c", "/usr/bin/chroot-distro login alpine"]
+        # su -c gets a single command string with the env prefix embedded.
+        assert args[1] == [
+            "su",
+            "-c",
+            "env _CHROOT_DISTRO_ELEVATING=1 /usr/bin/chroot-distro login alpine",
+        ]
         assert os.environ.get("_CHROOT_DISTRO_ELEVATING") == "1"
+
+
+def test_forwarded_env_assignments_only_present_vars():
+    with patch.dict(
+        "os.environ",
+        {"CD_USE_NS": "1", "CD_DOWNLOAD_WORKERS": "8", "UNRELATED": "x"},
+        clear=True,
+    ):
+        assignments = _forwarded_env_assignments()
+    assert "CD_USE_NS=1" in assignments
+    assert "CD_DOWNLOAD_WORKERS=8" in assignments
+    # Variables that are not set must not appear.
+    assert all(not a.startswith("CD_DOCKER_AUTH=") for a in assignments)
+    # Unrelated host vars are never forwarded.
+    assert all(not a.startswith("UNRELATED=") for a in assignments)
+
+
+def test_elevate_forwards_cd_use_ns_via_sudo():
+    mock_exec = MagicMock()
+    with (
+        patch("chroot_distro.elevate.is_root", return_value=False),
+        patch("chroot_distro.elevate._find_escalation_tool", return_value=["sudo", "-E"]),
+        patch("chroot_distro.elevate.get_reexec_argv", return_value=["/usr/bin/chroot-distro", "login", "ubuntu"]),
+        patch("os.execvp", mock_exec),
+        patch.dict("os.environ", {"CD_USE_NS": "1"}, clear=True),
+    ):
+        elevate_or_die()
+
+    args, _kwargs = mock_exec.call_args
+    full_argv = args[1]
+    # CD_USE_NS must cross the boundary via the root-side `env` binary, not
+    # via `sudo -E` (which sudoers policy often ignores).
+    assert "env" in full_argv
+    assert "CD_USE_NS=1" in full_argv
+    # The forwarded assignments must precede the re-exec'd program.
+    assert full_argv.index("CD_USE_NS=1") < full_argv.index("/usr/bin/chroot-distro")
+
+
+@pytest.mark.parametrize(
+    "tool_cmd",
+    [
+        ["doas", "--"],
+        ["pkexec", "--disable-internal-agent"],
+    ],
+)
+def test_elevate_forwards_cd_use_ns_via_other_tools(tool_cmd):
+    mock_exec = MagicMock()
+    with (
+        patch("chroot_distro.elevate.is_root", return_value=False),
+        patch("chroot_distro.elevate._find_escalation_tool", return_value=tool_cmd),
+        patch("chroot_distro.elevate.get_reexec_argv", return_value=["/usr/bin/chroot-distro", "login", "ubuntu"]),
+        patch("os.execvp", mock_exec),
+        patch.dict("os.environ", {"CD_USE_NS": "yes"}, clear=True),
+    ):
+        elevate_or_die()
+
+    args, _kwargs = mock_exec.call_args
+    full_argv = args[1]
+    assert full_argv[: len(tool_cmd)] == tool_cmd
+    assert "env" in full_argv
+    assert "CD_USE_NS=yes" in full_argv
+    assert full_argv.index("CD_USE_NS=yes") < full_argv.index("/usr/bin/chroot-distro")
+
+
+def test_elevate_forwards_cd_use_ns_via_su():
+    mock_exec = MagicMock()
+    with (
+        patch("chroot_distro.elevate.is_root", return_value=False),
+        patch("chroot_distro.elevate._find_escalation_tool", return_value=["su", "-c"]),
+        patch("chroot_distro.elevate.get_reexec_argv", return_value=["/usr/bin/chroot-distro", "login", "ubuntu"]),
+        patch("os.execvp", mock_exec),
+        patch.dict("os.environ", {"CD_USE_NS": "1"}, clear=True),
+    ):
+        elevate_or_die()
+
+    args, _kwargs = mock_exec.call_args
+    cmd_str = args[1][2]
+    assert "env" in cmd_str
+    assert "CD_USE_NS=1" in cmd_str
+    # Sentinel + CD_USE_NS appear before the program inside the command string.
+    assert cmd_str.index("CD_USE_NS=1") < cmd_str.index("/usr/bin/chroot-distro")