A chroot on Unix operating systems is an operation that changes the apparent root directory for the current running process and its children. A program that is run in such a modified environment cannot name (and therefore normally not access) files outside the designated directory tree.

learn more… | top users | synonyms

21
votes
3answers
11k views

Restricting an SSH/SCP/SFTP user to a directory

Is there a simple way to restrict an SCP/SFTP user to a directory? All methods that I've come across require me to set a chroot jail up by copying binaries, but I don't think that should be necessary. ...
21
votes
2answers
8k views

Getting “Not found” message when running a 32-bit binary on a 64-bit system

I have currently a strange problem on debian (wheezy/amd64). I have created a chroot to install a server (i can't give any more detail about it, sorry). Let's call its path /chr_path/. To make things ...
18
votes
3answers
2k views

chroot “jail” - what is it and how do I use it?

I have heard/read a lot about the chroot jail under linux but have never yet used it (I use Fedora day-to-day), so what is a chroot "jail"? When and why might I use it/not use it and is there anything ...
17
votes
2answers
4k views

How do I tell I'm running in a chroot?

I have a unix installation that's supposed to be usable both as a chroot and as a standalone system. If it's running as a chroot, I don't want to run any service (cron, inetd, and so on), because they ...
16
votes
2answers
3k views

What to use to harden Linux box? Apparmor, SELinux, grsecurity, SMACK, chroot?

I am planning to go back to Linux as a Desktop machine. I would like to make it more secure. And try a few hardening techniques, especially since I plan to get my own server. What would be a good, ...
8
votes
4answers
2k views

Lightweight isolated linux environment

I want an isolated (guest) Linux environment on my computer that I can mess up without worrying about the host. E.g. install a lot of stuff from source without package management, pollute environment ...
8
votes
3answers
9k views

How can I chroot into a filesystem with a different architechture?

I'm trying to chroot into a Arch Linux ARM filesystem from x86_64. I've seen that it's possible to do using static qemu by copying the binary into the chroot system: $ cp /usr/bin/qemu-arm ...
7
votes
2answers
1k views

Providing /bin and /lib inside a chroot jail

I need to be able to provide the /bin and /lib directories inside a chroot jail so that programs can dynamically link properly. Is there a way to accomplish this without making a copy of the /bin and ...
7
votes
1answer
2k views

How can I access a directory outside a chroot from within it?

I have a user which is chrooted to her home directory, but I want her to also be able to manage files within /var/www. As such, I did the following: root@server:/home/username# ln -s /var/www www ...
7
votes
1answer
139 views

Boot into a chroot?

I have Linux (Debian Jessie) installed on a hard drive. Drive - sda1, ext4fs, and sda2 - swap I have a /chroot folder. There is installed another system, in /chroot folder. Question: How to tell ...
6
votes
4answers
754 views

Is there a pbuilder-like environment for RedHat?

I would like to know if is there any utility like Debian's pbuilder, to build RPM packages on RedHat using a clean environment (chroot). I've found mach which has support for something like this but ...
6
votes
3answers
358 views

Why are web servers traditionally started as superuser?

Thinking about a future web server setup, it struck me that for some reason web servers usually start as root and then drop certain rights (setuid) for the worker processes. In addition there is often ...
6
votes
2answers
132 views

Which of proc, sys etc. should be bind-mounted (or not) when chrooting into a “replacement” distribution?

This answer to another question basically boils down to chrooting into another Linux distribution in order to mainly use that as a replacement to its too restricted (but irreplaceable) parent. The ...
6
votes
1answer
1k views

chroot fails with --userspec when chroot is i686

I'm experiencing a problem with chroot... I'm running on Arch Linux x86_64. I have a 64 bit chroot and a 32 bit chroot. They are identical except that one is 32 bit and one is 64 bit. I can enter ...
5
votes
1answer
330 views

Why is it possible to leave CHROOT with this sftp config?

I'm trying to create the user lenny, that has read and write permissions in the folder /home/lenny/ and has no shell but only access via SFTP. I'm doing the following: useradd lenny mkdir /home/lenny ...
4
votes
1answer
2k views

deleting a 'file' under /proc or /dev

I am using a cowdancer/debootstrap setup to generate a chroot. Of course, as I iterate, I generate some chroot configurations that are bad. I have found myself in an awkward situation where I have ...
4
votes
3answers
1k views

Boot Linux system from a subdirectory on a partition?

I would like to try to set up a computer so that it has multiple Linux installs all in the same filesystem. For example, the filesytem would have 3 folders: /Ubuntu_Precise, /Ubuntu_Oneiric, and ...
4
votes
3answers
5k views

What to do to run GUI Java app in chrooted environment?

In my case Java app is JDownloader. I prepared chroot environment as explained here: http://www.0x61.com/forum/post5240333.html#p5240333 and here: http://interreality.org/~reed/java-chroot.html ...
4
votes
1answer
462 views

How to disable certain system calls for a given user?

I am creating a web app similar to codepad and for each run-action my app copies a directory (/home/radeks/voidptr/private/chroot-root) to /tmp/voidptr/[random-id]/chroot-root. This chroot directory ...
4
votes
1answer
279 views

Can you Chroot a program from an OpenVZ environment?

I just recently purchased a Virtual Private Server, and it is OpenVZ virtualization. I am setting up my LAMP stack, and in the past I have always just set up my BIND dns set up in a chrooted ...
4
votes
1answer
744 views

How can I mount a directory of the host system for use inside a FreeBSD jail?

I am performing the following on FreeBSD 9.0-STABLE: mount_nullfs /foo /jail/foo After that, from within the host system, the mount works. So this works: touch /foo/bar && ls /jail/foo/bar ...
4
votes
2answers
482 views

How to rsync a chroot without breaking symlinks?

I'd like to rsync (backup) a chroot environment from outside the chroot. For that I first make a lvm snapshot of the chroot volume and then run rsync on that. The only problem with this approach: ...
4
votes
2answers
3k views

Disable direct login for normal users (like oracle) in linux but allow scp and sftp?

Is it possible to disable direct login for normal users (like oracle) in linux but allow scp and sftp for that use?
4
votes
1answer
16k views

How to create a FTP user with specific /dir/ access only on a Centos / linux installation

So I'm on a VPS - CentOS Linux installation. I have vsFTPd on the server. I currently have SFTP access to the server via my root user, but am now trying to create a new user with FTP access to a ...
4
votes
1answer
24 views

Seperate messages of multiple sshds in syslog-ng

is there a common way of distinguishing between the messages of multiple processes in syslog-ng beside setting different facilities? I have a system setup with two running sshd instances. One is ...
4
votes
3answers
820 views

Restrict ssh login from LDAP to users who have a /home directory

I have an Apache server (RHEL 6) hosting multiple user web pages which currently is connected to my Active Directory environment to authenticate users. The server is used to automatically host content ...
4
votes
0answers
56 views

CHROOT : Unable to view mounted directories

I posted a question on stack overflow, but I was told that my question was more relevant to this section so I thought I'd repost it here. Here is a quick description of what I have done: I have a ...
3
votes
1answer
660 views

When can one reboot from inside a chroot environment?

Sometimes when I chroot into some folder , I could use reboot to reset my box, but sometimes I can't. So I want to know why I could do that sometimes and why. UPDATE The chroot environment is ...
3
votes
1answer
2k views

How to unmount a formerly chroot'd filesystem?

I'm using a rescue-live-system (similar to a live-cd) to fix some issues with my Debian server, like that: # mkdir -p /mnt/rescue # mount /dev/md2 /mnt/rescue # mount --bind /dev /mnt/rescue/dev/ # ...
3
votes
2answers
719 views

Is there a drawback when using a chroot in high performance computing?

My (small) company uses an out-of-date linux (centos) software stack to run a proprietary software on a small cluster. Understandingly, IT is reluctant to upgrade since everything works now. I'd like ...
3
votes
1answer
958 views

Chroot debian squeeze for shell access

A user requires shell access to an Ubuntu server from the WAN side. There are many shell accounts with simple passwords. So shell port (port 22) is blocked in the firewall. For my WAN side user I am ...
3
votes
1answer
5k views

Chrooted SFTP with full access to SSH stopped working (Debian)

I've got a home server on Debian 6 for backups. I'd like to setup chrooted SFTP environment with SSH access for some users (only for my knowledge, there are two users now). It almost works or rather ...
3
votes
3answers
394 views

Unabled to get rid of BIND 9 chroot

I had installed bind-chroot from yum not long ago, and saw that there were errors in the daily logs from named. Under further investigation, I noticed a directory loop. The named files resided under ...
3
votes
2answers
2k views

getting 553 - cannot create file in vsftpd (ubuntu 12.04)

I'm trying to setup a ftp account for a user that has read/write access to one folder: /items/myuser I've set up the account with username 'myuser' in Linux with the adduser command. After that, I've ...
3
votes
1answer
5k views

How to restrict ssh users to browse only /home/%u contents

Can I confine my users to their /home/%u directory using only OpenSSH configuration? From instructions I found on the Internet, I stopped the SSH server and appended the following to the sshd_config ...
3
votes
1answer
368 views

Are there any differences between mounting a /proc filesystem inside a chroot compared to mounting it from the outside?

Compare the following: mount -t proc none ./my_chroot/proc and: chroot ./mychroot mount -t proc none /proc
3
votes
1answer
289 views

Simulate chroot with unshare

I am trying to write a bootstrapper for a minimal, from-source linux distribution. I would like to build in a chroot-like environment. This should simplify packaging. I do not care about security at ...
3
votes
0answers
511 views

Slow system after running a KDE GUI application from a Debian Squeeze chroot

I have a PC with Ubuntu 11.04 and a Debian Squeeze chroot installed in it. As soon as I start any KDE application from within chroot (and installed there), e.g. Kompare for viewing git diff output, ...
3
votes
2answers
69 views

Denying “/opt/” access for SFTP Users other than particular dir

This is my first (newbie) post here in unix stackexchange. I want to use my WebServer (Debian) as SFTPServer giving access to particular employees. The dir structure is as follows under root: ...
2
votes
2answers
139 views

How do I `umount` /proc?

I am following this tutorial on how to do a firmware update to my NAND flash. I followed it only changing the directory where I am placing my new root. I am copying all of the /bin /dev /sbin /usr ...
2
votes
5answers
2k views

How to completely hide stuff from a user?

I want to let some of my friends access my computer by making them user accounts. They will mostly access my computer by sftp and ssh, but they could also sometimes access it at my home. However I ...
2
votes
1answer
111 views

Is it possible to log directly into chroot?

Lets say I boot up my computer and I see the login screen. When I log in as myuser, I want to be restricted to a certain root directory via. chroot. Let's assume that the directory is ...
2
votes
1answer
1k views

How to run Firefox in a chroot jail?

I've got this chroot jail all setup. I try to run Firefox in it, and get the message: "Gtk-WARNING ** cannot open display: " I know I have to invoke Firefox with --display= something. I probably ...
2
votes
1answer
69 views

SFTP chroot jail/access based on wildcard

I want to give a list of people SFTP access to /webdocs/ABC* where they will read-write access to only directories that match this wildcard. How do I do this? Can I create a chroot jaill or some ...
2
votes
1answer
587 views

How to achieve the effect of chroot in userspace in Linux (without being root)?

The goal is to install and run programs in a displaced (relocated) distro (whose / must not coincide with the global /) inside a host Linux system. The programs are not adapted for using a different / ...
2
votes
1answer
475 views

Sudo does not work in chroot

I would like to be able to use the sudo command in a chroot environment. I start the chroot as follows: chroot /debian-squeeze /bin/bash Now I'm logged in as root in the chroot. I can do su user ...
2
votes
1answer
699 views

SFTP: give user access to folder outside home

I have a machine running Ubuntu 12.04 LTS with OpenSSH server installed. I have created a user with a jailed home account. When I log in with the user's account, I can only access his home (duh). ...
2
votes
2answers
1k views

OpenSSH, chroot user: Root needs to own the user directory, is there any consequence?

I want to create an account for my friend on my computer, but I don't want my friend to be able to view all my files. I saw that with OpenSSH, there is an option for that. Inside the SSHD ...
2
votes
3answers
2k views

Display X applications on an Android system

Host system: Android 3.2.1 Honeycomb Chroot system: Debian Testing lxde Hardware: Asus eee pad transformer tablet nvidia arm architecture Note 1: The Debian system boots on this hardware, thus it ...
2
votes
2answers
684 views

Mount points in a chroot

I have some device (say /dev/sda1) mounted at /home/user1. I also have a full Linux system under /tmp/chroot, and the directory /tmp/chroot/home contains only one directory named user2. If I chroot ...