I am planning to set up a few chroot jails for some users to run/test Java applications (lets just assume each application is untrusted). Is there any risk involved with mounting /dev and /proc into each jail? If there is, what steps can be taken to get rid of this risk?
Beware that uids and gids may be different inside and outside the jail. For instance, inside the jail, user "x" may be member of group 123, which in the jail is for "users" while on the system is for "disk". By bind-mounting
I would not bind-mount /dev. Only create a few devices in there that the java application may need (
Have you considered linux containers instead of chroot jails which would isolate them more (lxcs are just a step further to chroot jails).
By mounting /proc into a chroot, all users in the chroot can kill processes outside the chroot if they have the same permissions as some user outside. For example a user test can kill processes from outside the chroot by the user test (maybe it's the user-ID and not the username).
By mounting /dev you give access to the available devices, but this can be controlled by the group permissions of every devicefile. If the users inside the chroot aren't members of the according groups, they aren't able to do any harm (or anything at all, if to restricted).
EDIT: Killing processes is possible without having /proc mounted. (thanks sch)
This is quite a big subject, and quite a lot has been written about it on the web, so I'd encourage you to read around a little.
The basic summary is that chroot was never designed as a security feature. There are many ways a root user can 'escape' a chroot jail, and quite a few ways a normal user can escape. For example, the chroot does not have a separate process space, so a process within the chroot can 'attach' to any external process using the normal debug mechanisms. Some modern distros have protection enabled that would foil that particular attack, but not all. In any case, a root user is immune to almost all such protection devices, and there's nothing to stop it mounting any file-system it chooses.
LXC is better, and is also built-in to many modern distros (I believe) but suffers from some of the same issues (in particular, the /sys filesystem is open to abuse).
OpenVZ is supposedly safer, but it's a lot harder to set up, and I've not tried it myself.