chroot and reload daemon action

[craig08]

When I reload the hitch daemon (in Ubuntu 16.04 systemd), I get following errors:

Apr 25 19:42:33 localhost systemd[1]: Reloading Hitch TLS unwrapping daemon.
Apr 25 19:42:33 localhost hitch[4035284]: Received SIGHUP: Initiating configuration reload.
Apr 25 19:42:33 localhost hitch[4035284]: 20170425T194233.871567 [4035284] Received SIGHUP: Initiating configuration reload.
Apr 25 19:42:33 localhost systemd[1]: Reloaded Hitch TLS unwrapping daemon.
Apr 25 19:42:33 localhost hitch[4035284]: Config reload failed: Unable to open configuration file '/etc/hitch/hitch.conf': No such file or directory
Apr 25 19:42:33 localhost hitch[4035284]: 20170425T194233.895107 [4035284] Config reload failed: Unable to open configuration file '/etc/hitch/hitch.conf': No such file or directory

After tracing code, I found that the reason was I had turned on the chroot config to /tmp, so the hitch service was actually jailed and unable to see the config file and the certificates outside.

I am wondering if this restriction can be solved, to have both chroot security and reloading mechanism.

[dridi]

Maybe you could add/mount all the needed pieces in the "jail" before starting hitch?

[craig08]

Hitch needs configuration file and certificates. I don't think it is secure to put my certificates together in the jail.

Besides, hitch still wants to chroot to the specified location after reload command. That is, if I specify /hitch as my chroot directory, after the first start, it changes its root to /hitch successfully. But after reload, it wants to chroot to /hitch under current root, that is /hitch/hitch.

Apr 25 20:41:40 localhost systemd[1]: Reloading Hitch TLS unwrapping daemon.
Apr 25 20:41:40 localhost hitch[428268]: Received SIGHUP: Initiating configuration reload.
Apr 25 20:41:40 localhost hitch[428268]: 20170425T204140.130764 [428268] Received SIGHUP: Initiating configuration reload.
Apr 25 20:41:40 localhost hitch[428268]: Config reload failed: Error in configuration file '', line 187: Unable to stat directory '/hitch': No such file or directory'.
Apr 25 20:41:40 localhost hitch[428268]: 20170425T204140.131366 [428268] Config reload failed: Error in configuration file '', line 187: Unable to stat directory '/hitch': No such file or directory'.
Apr 25 20:41:40 localhost systemd[1]: Reloaded Hitch TLS unwrapping daemon.

Not only chroot command will cascade, but also the location of configuration file and certificates. Thus if I use chroot with other than / directory, it is weird to put needed files in the jail if I want multiple reload action.