OpenWalnut in a chroot-environment

This article describes how to use NeuroDebian and OpenWalnut from within another Linux distribution easily. It has a very distinct advantage over using the NeuroDebian virtual machine: it runs directly on your machine, no virtualization layer is need. This can be done by installing a minimal Debian system inside a chroot-environment. Unfortunately, a pure chroot is very restricted and even running GUI applications can be tricky. We, therefore, use OpenRoot. This piece of software handles the whole X forwarding and media access hassle automatically.

One of the major advantages of using the chroot instead of the virtual machine is the possibility to fully support your graphics hardware. Also nice is the fact that this chroot can be created once by a system administrator and deployed to all work-group systems, still allowing each employee to have full installation rights inside the chroot to choose the needed software individually.

HINT: a chroot can introduce security problems, especially in very strictly administrated IT environments.

Creating the Debian chroot

NOTE: The following steps need to be done as root

Before we can use openroot, we need to create the Debian base system. This can be done easily using the debootstrap program. Download the debootstrap package and install it on your Linux as root using

cd /home/myhome/Downloads
ar -xf debootstrap_1.0.36_all.deb
cd /
zcat /home/myhome/Downloads/data.tar.gz | tar xv

Now, you have debootstrap installed on your machine. This program can now be used to create a Debian or Ubuntu base system. Lets create a Debian sid system:

cd /home/myhome/
mkdir neurodebian-sid
debootstrap sid ./neurodebian-sid http://ftp.de.debian.org/debian

This process takes some time and requires and active internet connection.

Configuring Debian

Now, we have a fresh installation of a very very basic Debian. The easiest way of directly working with the chroot is to download openroot and to add the executable flag (chmod +x). Also install the program socat. Unfortunately, the current version of openroot (1.1) is not using the famous "xhost-trick" to allow chrooted apps to access the X server. Please open the openroot script and search for the word "xhost". You'll find the line commented out. Un-comment it and save the file.

openroot neurodebian-sid

Now you get a bash shell inside Debian! Awesome isn't it? Technically, there are a lot of things that need to be set up now. We do not handle this entirely here. Have a look at the corresponding Debian documentation. We only setup the locales and the keyboard settings used in your chroot:

aptitude install locales console-data
dpkg-reconfigure locales
dpkg-reconfigure console-data

You will see a text based interface asking you to select which locales you want to support on your system. Select the languages and let dpkg complete. At this point, you can execute X programs. What you cannot do currently: execute an OpenGL program. Therefore, you need to install the same GLX/DRI libs inside the chroot, which you also use on your host system. As we recommend to use NVIDIA or ATI graphics cards, it is very easy to install the proper driver inside the chroot:

echo "deb http://ftp.de.debian.org/debian sid main contrib non-free" > /etc/apt/sources.list
aptitude install nvidia-glx | fglrx-glx

This later allows OpenWalnut to use your Linux's GLX/DRI facilities from within the chroot. Finally, you should consider creating user inside the chroot. This is especially interesting if you mount external directories inside the chroot and create files in it (data directory and similar). You can create a user with the same user ID as your current user account, which means that you avoid the hassle of user-rights inside your mounted directories.

HINT: you can also use the tasksel program of Debian to configure all the standard packages by issuing

tasksel install standard

After everything is installed, you should clean the packaging system's cache, since aptitude has downloaded a lot of packages. This can be done by calling

aptitude clean

Configuring NeuroDebian and OpenWalnut

Now, we need to configure our new system to use the NeuroDebian repository. Following the documentation at http://neuro.debian.net/#get-neurodebian, we select "Debian unstable" in the list of distributions and a nearby server. Simply copy the commands specified for the distribution to your bash running inside the chroot. This adds the NeuroDebian repository to the packaging system of Debian.

Do not forget to update packaging information after adding the repository:

aptitude update

Thats it. You now have Debian plus NeuroDebian ready to use. You can enjoy all the software offered by Debian and NeuroDebian. We can search for the OpenWalnut packages:

aptitude search openwalnut

A list of packages is shown. As described in Getting_OpenWalnut, you need to install the package openwalnut-qt4

aptitude install openwalnut-qt4

Accessing your data

Inside the chroot, you do not have direct access to your home or any other directory. You most probably want to have your data directory mounted somewhere inside the chroot.

To allow access to your datasets and files from within the chroot, you can mount these directories to your chroot:

mkdir neurodebian-sid/mnt/mydatasets
mount -o bind /home/myhome/mydatasets neurodebian-sid/mnt/mydatasets

To automate this, you can either modify the openroot script or add this line to your "/etc/fstab" file.

Using the chroot in daily routine

Most probably, the command line is not your preferred option to start software? No problem. OpenRoot offers the possibility to directly call an application from outside the chroot, to execute inside the chroot. To call OpenWalnut directly one can issue

sudo openroot neurodebian-sid openwalnut

on the command line. This command can now be added to your Desktop's menu. The Gnome and KDE desktops provide comfortable tools to add custom entries to their application menus. If you want to add this entry system-wide, you need to write your own FreeDesktop conform "/usr/share/applications/openwalnut.desktop" file:

[Desktop Entry]
Categories=Education;Science;
Exec=sudo openroot /home/myhome/neurodebian-sid openwalnut
Name=OpenWalnut
Icon= /home/myhome/neurodebian-sid/usr/share/pixmaps/openwalnut.png
Terminal=false
Type=Application

You might have noticed the sudo command. Using a chroot currently involves being root. Maybe, it is possible to modify openroot to use the schroot system instead, allowing arbitrary users to use the chroot environment. Another, most probably easier solution is to allow a certain user-group to sudo-execute openroot. This can be done in the file "/etc/sudoers". Here is an example:

%neurodebian-users  localhost = NOPASSWD: /path/to/openroot

This allows all users inside the group "neurodebian-users" to execute openroot as root without annoying password query.

Thats it. You now have the complete world of Debian and NeuroDebian at your finger-tips. In this tutorial we have shown how to setup the system inside your Linux distribution. We basically described how to setup the system and how to install OpenWalnut and other software.

Security issues

From the system-security side (and from the administrators point of view), using a chroot can be dangerous. You basically grant root access to the user which might use these rights to do bad stuff. Especially the root access to the stuff in /dev can be critical. An advanced administrator can avoid this by not using mount-bind for /dev but selectively create the device nodes needed. There is a lot of literature available handling this topic. An alternative to chroot could be schroot, which provides the chroot functionality to ordinary users. Another option is to create a user account inside the chroot and to modify the openroot script to "log-in" this user only.