在 Mac OSX 上的 chrooted PHP 环境中运行时，如何找出 Curl 需要哪些文件或套接字？
我最近通过 chrooting PHP 保护了我的网站，但现在每次通过其 API 调用 Amazon S3 都会失败，并显示错误消息：
Resource id #43; cURL error: Couldn't resolve host 's3.amazonaws.com'
从非 chroot 命令行调用时，相同的代码运行良好，因此推测可能是某些需要通过 CURL 打开的文件无法打开。
我如何确定它试图打开哪些文件以便能够将它们映射到 chroot 目录中？
在 Andrei 的建议下，我使用 strace（或者更确切地说是 Mac 等效的 dtruss）来获取一些调试输出。
这是一个 chrooted 并且不起作用的请求。
lstat64("/lib/amazonWS/lib\0", 0x7FFF5FBF97D0, 0x26) = 0 0
lstat64("/lib/amazonWS\0", 0x7FFF5FBF9630, 0x182) = 0 0
open("/lib/amazonWS/lib/requestcore/requestcore.class.php\0", 0x0, 0x1B6) = 5 0
fstat64(0x5, 0x100A9F448, 0x8) = 0 0
fstat64(0x5, 0x100A9F448, 0x90) = 0 0
fstat64(0x5, 0x100A9F448, 0x1001B1FE4) = 0 0
mmap(0x0, 0x72D1, 0x1, 0x1, 0x5, 0xFFFFFF8016E89160) = 0x3BF0000 0
stat64("/lib/amazonWS/lib/requestcore/requestcore.class.php\0", 0x10621CD68, 0x10621C847) = 0 0
munmap(0x103BF0000, 0x72D1) = 0 0
close(0x5) = 0 0
setitimer(0x2, 0x7FFF5FBFBCE0, 0x0) = 0 0
kqueue(0x7FFF5FBFB000, 0x0, 0x50) = 5 0
kevent(0x5, 0x7FFF5FBFB000, 0x1) = 0 0
socket(0x1, 0x1, 0x0) = 6 0
setsockopt(0x6, 0xFFFF, 0x1022) = 0 0
connect_nocancel(0x6, 0x7FFF5FBFADD0, 0x6A) = -1 Err#2
close_nocancel(0x6) = 0 0
close_nocancel(0x5) = 0 0
kqueue(0x7FFF5FBFB000, 0x0, 0x50) = 5 0
kevent(0x5, 0x7FFF5FBFB000, 0x1) = 0 0
socket(0x1, 0x1, 0x0) = 6 0
setsockopt(0x6, 0xFFFF, 0x1022) = 0 0
connect_nocancel(0x6, 0x7FFF5FBFADD0, 0x6A) = -1 Err#2
close_nocancel(0x6) = 0 0
close_nocancel(0x5) = 0 0
open_nocancel(".\0", 0x0, 0x0) = 5 0
fstat64(0x5, 0x7FFF5FBFBA80, 0x0) = 0 0
fcntl_nocancel(0x5, 0x32, 0x7FFF5FBFBCB0) = 0 0
close_nocancel(0x5) = 0 0
stat64("/basereality\0", 0x7FFF5FBFB9F0, 0x0) = 0 0
lstat64("/basereality/../BaseReality/html/50x.html\0", 0x7FFF5FBFB730, 0x23D) = 0 0
这是一个请求不是chrooted 并运行：
1806/0x1dd3: 149524 5 3 open("/documents/projects/intahwebz/intahwebz/lib/amazonWS/lib/requestcore/requestcore.class.php\0", 0x0, 0x1B6) = 5 0
1806/0x1dd3: 149525 3 0 fstat64(0x5, 0x100A9F578, 0x8) = 0 0
1806/0x1dd3: 149527 2 0 fstat64(0x5, 0x100A9F578, 0x90) = 0 0
1806/0x1dd3: 149528 2 0 fstat64(0x5, 0x100A9F578, 0x1001B1FE4) = 0 0
1806/0x1dd3: 149531 5 2 mmap(0x0, 0x72D1, 0x1, 0x1, 0x5, 0x1F) = 0x3BF0000 0
1806/0x1dd3: 149535 4 2 stat64("/documents/projects/intahwebz/intahwebz/lib/amazonWS/lib/requestcore/requestcore.class.php\0", 0x1061966D0, 0x106196057) = 0 0
1806/0x1dd3: 149565 6 3 munmap(0x103BF0000, 0x72D1) = 0 0
1806/0x1dd3: 149568 4 2 close(0x5) = 0 0
1806/0x1dd3: 149661 4 1 setitimer(0x2, 0x7FFF5FBFBCE0, 0x0) = 0 0
1806/0x1dd3: 149767 90 2 kqueue(0x7FFF5FBFB000, 0x0, 0x50) = 5 0
1806/0x1dd3: 149770 4 1 kevent(0x5, 0x7FFF5FBFB000, 0x1) = 0 0
1806/0x1dd3: 149782 12 8 socketpair(0x1, 0x1, 0x0) = 0 0
1806/0x1dd3: 149792 12 9 sendto_nocancel(0x6, 0x105D8FCF0, 0x3A) = 58 0
1806/0x1dd3: 149796 7 3 sendmsg_nocancel(0x6, 0x7FFF5FBFAD30, 0x0) = 1 0
1806/0x1dd3: 149797 4 0 close_nocancel(0x9) = 0 0
1806/0x1dd3: 149802 45 4 recvfrom_nocancel(0x7, 0x7FFF5FBFAD7C, 0x4) = 4 0
1806/0x1dd3: 149806 5 2 close_nocancel(0x7) = 0 0
1806/0x1dd3: 149814 6 3 socketpair(0x1, 0x1, 0x0) = 0 0
1806/0x1dd3: 149816 4 1 sendto_nocancel(0x6, 0x105D8FCF0, 0x3A) = 58 0
1806/0x1dd3: 149818 5 2 sendmsg_nocancel(0x6, 0x7FFF5FBFAD30, 0x0) = 1 0
1806/0x1dd3: 149819 3 0 close_nocancel(0x9) = 0 0
1806/0x1dd3: 149822 215 2 recvfrom_nocancel(0x7, 0x7FFF5FBFAD7C, 0x4) = 4 0
1806/0x1dd3: 149840 20 17 close_nocancel(0x7) = 0 0
1806/0x1dd3: 149843 4 1 kevent(0x5, 0x7FFF5FBFB000, 0x1) = 0 0
1806/0x1dd3: 149844 3 1 kevent(0x5, 0x0, 0x0) = 1 0
1806/0x1dd3: 149846 2 0 kevent(0x5, 0x0, 0x0) = 1 0
1806/0x1dd3: 149848 5 2 recvfrom_nocancel(0x6, 0x7FFF5FBFAE30, 0x1C) = 28 0
1806/0x1dd3: 149851 5 1 recvfrom_nocancel(0x6, 0x105D8FCF0, 0x40) = 64 0
1806/0x1dd3: 149856 8 3 select_nocancel(0x7, 0x7FFF5FBFADB0, 0x0) = 1 0
1806/0x1dd3: 149861 3 1 kevent(0x5, 0x7FFF5FBFA860, 0x1) = 0 0
1806/0x1dd3: 149863 4 1 recvfrom_nocancel(0x6, 0x7FFF5FBFAE30, 0x1C) = 28 0
1806/0x1dd3: 149864 3 1 recvfrom_nocancel(0x6, 0x105D85990, 0x42) = 66 0
1806/0x1dd3: 149867 4 1 select_nocancel(0x7, 0x7FFF5FBFADB0, 0x0) = 0 0
1806/0x1dd3: 149869 2 0 kevent(0x5, 0x7FFF5FBFA860, 0x1) = 0 0
1806/0x1dd3: 149871 3 1 kevent(0x5, 0x0, 0x0) = 1 0
1806/0x1dd3: 149872 2 0 kevent(0x5, 0x0, 0x0) = 1 0
1806/0x1dd3: 149873 2 0 kevent(0x5, 0x0, 0x0) = 1 0
1806/0x1dd3: 149874 2 0 kevent(0x5, 0x0, 0x0) = 1 0
1806/0x1dd3: 149876 4 1 recvfrom_nocancel(0x6, 0x7FFF5FBFAE30, 0x1C) = 28 0
1806/0x1dd3: 149877 4 0 recvfrom_nocancel(0x6, 0x105D859E0, 0x40) = 64 0
1806/0x1dd3: 149879 3 1 select_nocancel(0x7, 0x7FFF5FBFADB0, 0x0) = 1 0
1806/0x1dd3: 149881 2 0 kevent(0x5, 0x7FFF5FBFA860, 0x1) = 0 0
1806/0x1dd3: 149883 3 0 recvfrom_nocancel(0x6, 0x7FFF5FBFAE30, 0x1C) = 28 0
1806/0x1dd3: 149884 3 0 recvfrom_nocancel(0x6, 0x105D85A20, 0x42) = 66 0
1806/0x1dd3: 149886 3 1 select_nocancel(0x7, 0x7FFF5FBFADB0, 0x0) = 0 0
1806/0x1dd3: 149888 2 0 kevent(0x5, 0x7FFF5FBFA860, 0x1) = 0 0
1806/0x1dd3: 149889 2 0 kevent(0x5, 0x0, 0x0) = 1 0
1806/0x1dd3: 149890 2 0 kevent(0x5, 0x0, 0x0) = 0 0
1806/0x1dd3: 149900 389953 9 kevent(0x5, 0x0, 0x0) = 1 0
1806/0x1dd3: 149904 60 1 kevent(0x5, 0x0, 0x0) = 1 0
1806/0x1dd3: 149909 7 3 recvfrom_nocancel(0x6, 0x7FFF5FBFAE30, 0x1C) = 28 0
1806/0x1dd3: 149913 7 2 recvfrom_nocancel(0x6, 0x105D8FD10, 0x2E) = 46 0
1806/0x1dd3: 149921 9 4 select_nocancel(0x7, 0x7FFF5FBFADB0, 0x0) = 0 0
1806/0x1dd3: 149928 5 1 kevent(0x5, 0x7FFF5FBFA860, 0x1) = 0 0
1806/0x1dd3: 149932 3 1 kevent(0x5, 0x0, 0x0) = 1 0
1806/0x1dd3: 149932 2 0 kevent(0x5, 0x0, 0x0) = 0 0
1806/0x1dd3: 149945 439745 12 kevent(0x5, 0x0, 0x0) = 1 0
1806/0x1dd3: 149952 13 3 kevent(0x5, 0x0, 0x0) = 1 0
1806/0x1dd3: 149961 15 6 recvfrom_nocancel(0x6, 0x7FFF5FBFAE30, 0x1C) = 28 0
1806/0x1dd3: 149969 11 4 recvfrom_nocancel(0x6, 0x105D8FD10, 0x2A) = 42 0
1806/0x1dd3: 149981 16 8 select_nocancel(0x7, 0x7FFF5FBFADB0, 0x0) = 0 0
1806/0x1dd3: 149987 9 3 kevent(0x5, 0x7FFF5FBFA860, 0x1) = 0 0
1806/0x1dd3: 150002 19 9 sendto_nocancel(0x6, 0x105D8FCF0, 0x1C) = 28 0
1806/0x1dd3: 150011 12 5 sendto_nocancel(0x6, 0x105D8FCF0, 0x1C) = 28 0
1806/0x1dd3: 150025 22 10 close_nocancel(0x5) = 0 0
1806/0x1dd3: 150095 26 18 socket(0x2, 0x1, 0x6) = 5 0
1806/0x1dd3: 150109 12 4 setsockopt(0x5, 0xFFFF, 0x1022) = 0 0
1806/0x1dd3: 150113 9 2 fcntl(0x5, 0x3, 0x0) = 2 0
1806/0x1dd3: 150117 7 2 fcntl(0x5, 0x4, 0x6) = 0 0
1806/0x1dd3: 150191 81 73 connect(0x5, 0x7FFF5FBFB9F0, 0x10) = -1 Err#36
1806/0x1dd3: 150217 689426 21 select(0x6, 0x7FFF5FBFB730, 0x7FFF5FBFB6B0, 0x7FFF5FBFB630, 0x7FFF5FBFB7D0) = 1 0
1806/0x1dd3: 150226 72 2 getsockopt(0x5, 0xFFFF, 0x1007) = 0 0
1806/0x1dd3: 150230 6 2 getpeername(0x5, 0x7FFF5FBFB780, 0x7FFF5FBFB6FC) = 0 0
1806/0x1dd3: 150232 4 1 getsockname(0x5, 0x7FFF5FBFB700, 0x7FFF5FBFB6FC) = 0 0
1806/0x1dd3: 150332 23 17 open_nocancel("/opt/local/share/curl/curl-ca-bundle.crt\0", 0x0, 0x1B6) = 7 0
1806/0x1dd3: 150339 6 2 fstat64(0x7, 0x7FFF5FBFB440, 0x7FFF5FBFB50C) = 0 0
1806/0x1dd3: 150350 14 9 read_nocancel(0x7, "##\n## lib/ca-bundle.crt -- Bundle of CA Root Certificates\n##\n## Certificate data from Mozilla as of: Thu Nov 22 00:12:21 2012\n##\n## This is a bundle of X.509 certificates of public Certificate Authorities\n## (CA). These were automatically extracted from Mo", 0x1000) = 4096 0
因此，看起来进程中失败的不是直接文件访问，而是套接字发送。我按照一些说明尝试将 /dev/urandom 和其他非文件路径设置到 chrooted 环境中，但是，有没有办法知道什么socketpair(0x1, 0x1, 0x0)是套接字，而不是在黑暗中工作？
更新 2
在 OSX 上，在 chroot 内部进行 DNS 查找有一个已知问题： https://lists.macosforge.org/pipermail/macports-dev/2011-April/014565.html
显然我需要在 /path/to/chroot/var/run/mDNSResponder 运行 mDNSResponder 服务
答案1
可能存在 DNS 问题，请检查您的 chroot 环境下是否有正确的 resolv.conf。
答案2
因此，显然在 OSX 上，所有系统调用gethostbyname都是通过 mDNSResponder 服务定向的，该服务作为 /var/run/mDNSResponder 上的套接字运行，这与 Linux 平台不同，在 Linux 平台上，DNS 请求只是通过 resolv.conf 等文件发送。
mDNSResponder 在 chroot 环境中不可用，因此所有 DNS 查找都将失败。
理论上，可以创建一个重复的 mDNSResponder 服务，该服务在 /chroot/var/run/mDNSResponder 的套接字上进行监听。但是似乎没有人真正这样做过。
更简单的方法是设置代理服务，例如鱿鱼人在本地主机上运行，然后通过它发出所有 HTTP 请求。
还要注意，在 chroot 中创建自己的 dev/random 和 dev/urandommknod似乎不起作用，因为它们会耗尽随机性，并且代理请求将失败。相反，你应该将它们链接到sudo ln -s /dev/urandom /chroot/dev/urandom