Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have heard/read a lot about the chroot jail under linux but have never yet used it (I use Fedora day-to-day), so what is a chroot "jail"? When and why might I use it/not use it and is there anything else I should know? How would I go about creating one?

share|improve this question
add comment

3 Answers 3

up vote 14 down vote accepted

A chroot jail is a way to isolate a process from the rest of the system. It should only be used for processes that don't run as root, as root users can break out of the jail very easily.

The idea is that you create a directory tree where you copy or link in all the system files needed for a process to run. You then use the chroot system call to change the root directory to be at the base of this new tree and start the process running in that chroot'd environment. Since it can't actually reference paths outside the modified root, it can't maliciously read or write to those locations.

On Linux, using a bind mounts is a great way to populate the chroot tree. Using that, you can pull in folders like /lib and /usr/lib while not pulling in /user, for example. Just bind the directory trees you want to directories you create in the jail directory.

share|improve this answer
3  
Your answer is great. One thing to mention though, chroot is not a secure mechanism (a process can break out of the jail if it becomes root and sometimes even if not). Real jails can be enforced with freebsd jails and the like. See this en.wikipedia.org/wiki/FreeBSD_jail#Similar_technologies –  nc3b Aug 10 '10 at 20:30
1  
The Gentoo install process uses a chroot so you can setup your new OS before you have installed GRUB and the Linux kernel etc. –  Chris Huang-Leaver Aug 10 '10 at 20:38
add comment

Basically you are just changing the root directory of your environment. So

/

becomes

/some-jail/ (or whatever directory you want)

When an application accesses / they'll get /some-jail/. Also the application can't break out of /some-jail/ so you know it won't access anything else on your machine. Its a very simple way of saying 'hey you can only access these things that I am giving you, and you can't access anything else on the system.

share|improve this answer
add comment

"chroot jail" is a misnomer that should really die out, but people keep using it. chroot is a tool that lets you simulate a directory on your filesystem as the root of the filesystem. That means you can have a folder structure like:

-- foo
    -- bar
    -- baz
-- bazz

If you chroot foo and do ls /, you'll see:

-- bar
-- baz

As far as ls (and any other tools you run) are concerned, those are the only directories on the filesystem. The reason "jail" is a misnomer is chroot is not intended to force a program to stay in that simulated filesystem; a program that knows it's in a chroot "jail" can fairly easily escape, so you shouldn't use chroot as a security measure to prevent a program from modifying files outside your simulated filesystem

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.