Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

This page describes how you can use the debootstrap utility to install a base Debian unstable/sid system on an existing Linux machine. The new install is accessible using chroot.

When doing this, what security issues should be kept in mind? For example, what needs to be done to stop background/startup processes from starting in the new chroot or otherwise interfering with the main system?

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

Chroot alone doesn't bring any kind of security. In other words, treat a chroot as if the chrooted processes could access everything on the system — because often they do. See also chroot "jail" - what is it and how do I use it? — note in particular Michael Mrozek's remark

"chroot jail" is a misnomer that should really die out

Chroot is a containment method for files only, and it's more of a convenience than a security feature. If you have a process that lets untrusted users specify file names (an FTP server, for example), chroot is a way to make sure that the users aren't going to be able to reference files outside the chroot directly. You should to make sure that the chroot doesn't contain any file that could lead to an escape; in particular:

  • Put only the bare minimum of device files (/dev/*) in the chroot. Don't bind-mount /dev, for example you don't want block devices there. Only put tty devices and the miscellaneous data devices (/dev/null, /dev/zero, /dev/urandom, …).
  • Don't mount /proc. This is a big constraint, but /proc exposes a lot of information by design. For example, if you have a process 1234 is running as a certain user outside the chroot, then any process (chrooted or not) can access the root directory as /proc/1234/root.

A chrooted process can still send signals to non-chrooted processes, open network sockets, access shared memory (on Linux, nowadays, only if /dev/shm is available), etc. If you're using chroot for containment, don't run any process outside the chroot as a user who's running processes inside the chroot.

Chroot remains a good way to run a different version of the same OS (with the same kernel)¹. When there are security concerns, there are better tools nowadays, in particular FreeBSD jails and Linux cgroups and LXC. Compared with the old days, full virtualization (VirtualBox, KVM, …) has also become a more viable option even on commodity hardware.

¹ By the way, in my answer there I explain how to not start services inside a Debian chroot. This isn't a security concern, and there's an assumption that the services are cooperative and correctly written.

share|improve this answer
    
Thanks! Is creating the policy-rc.d (as you explain in your other answer) all that needs to be done to prevent processes (that you don't explicitly start) from running in the chroot? –  jrdioko Jul 25 '11 at 4:04
    
@jrdioko policy-rc.d is specific to Debian and Ubuntu; it tells init whether to run services in /etc/init. It doesn't prevent processes per se; the main advantage in practice is that you can install packages with daemons and they won't be started when you install the package. –  Gilles Jul 25 '11 at 8:36
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.