A chroot on Unix operating systems is an operation that changes the apparent root directory for the current running process and its children. A program that is run in such a modified environment cannot name (and therefore normally not access) files outside the designated directory tree.

learn more… | top users | synonyms

40
votes
2answers
25k views

Getting “Not found” message when running a 32-bit binary on a 64-bit system

I have currently a strange problem on debian (wheezy/amd64). I have created a chroot to install a server (i can't give any more detail about it, sorry). Let's call its path /chr_path/. To make things ...
31
votes
3answers
42k views

Restricting an SSH/SCP/SFTP user to a directory

Is there a simple way to restrict an SCP/SFTP user to a directory? All methods that I've come across require me to set a chroot jail up by copying binaries, but I don't think that should be necessary. ...
31
votes
3answers
9k views

chroot “jail” - what is it and how do I use it?

I have heard/read a lot about the chroot jail under linux but have never yet used it (I use Fedora day-to-day), so what is a chroot "jail"? When and why might I use it/not use it and is there anything ...
25
votes
2answers
10k views

How do I tell I'm running in a chroot?

I have a unix installation that's supposed to be usable both as a chroot and as a standalone system. If it's running as a chroot, I don't want to run any service (cron, inetd, and so on), because they ...
20
votes
5answers
132k views

How to create a FTP user with specific /dir/ access only on a Centos / linux installation

So I'm on a VPS - CentOS Linux installation. I have vsFTPd on the server. I currently have SFTP access to the server via my root user, but am now trying to create a new user with FTP access to a ...
19
votes
4answers
124k views

Limit FTP access only to the /var/www with vsftpd

I am running vsftpd as ftp server on my linux (rasbian), I log in to the machine as a root user. I would like to be still locked to using only /var/www, how can I configure vsftpd conf to accomplish ...
18
votes
2answers
6k views

What to use to harden Linux box? Apparmor, SELinux, grsecurity, SMACK, chroot?

I am planning to go back to Linux as a Desktop machine. I would like to make it more secure. And try a few hardening techniques, especially since I plan to get my own server. What would be a good, ...
16
votes
6answers
19k views

How can I chroot into a filesystem with a different architechture?

I'm trying to chroot into a Arch Linux ARM filesystem from x86_64. I've seen that it's possible to do using static qemu by copying the binary into the chroot system: $ cp /usr/bin/qemu-arm ...
15
votes
1answer
11k views

How can I access a directory outside a chroot from within it?

I have a user which is chrooted to her home directory, but I want her to also be able to manage files within /var/www. As such, I did the following: root@server:/home/username# ln -s /var/www www ...
13
votes
4answers
5k views

Lightweight isolated linux environment

I want an isolated (guest) Linux environment on my computer that I can mess up without worrying about the host. E.g. install a lot of stuff from source without package management, pollute environment ...
11
votes
3answers
10k views

How to unmount a formerly chroot'd filesystem?

I'm using a rescue-live-system (similar to a live-cd) to fix some issues with my Debian server, like that: # mkdir -p /mnt/rescue # mount /dev/md2 /mnt/rescue # mount --bind /dev /mnt/rescue/dev/ # ...
9
votes
3answers
2k views

Providing /bin and /lib inside a chroot jail

I need to be able to provide the /bin and /lib directories inside a chroot jail so that programs can dynamically link properly. Is there a way to accomplish this without making a copy of the /bin and ...
8
votes
2answers
46k views

chroot: failed to run command ‘/bin/bash’: No such file or directory [duplicate]

When I run the chroot command an error is given: failed to run command ‘/bin/bash’: No such file or directory
8
votes
2answers
934 views

Boot into a chroot?

I have Linux (Debian Jessie) installed on a hard drive. Drive - sda1, ext4fs, and sda2 - swap I have a /chroot folder. There is installed another system, in /chroot folder. Question: How to tell ...
7
votes
3answers
1k views

How do Linux permissions work when a process is running as a specific group?

This is something I haven't been able to find much info on so any help would be appreciated. My understanding is thus. Take the following file: -rw-r----- 1 root adm 69524 May 21 17:31 ...
7
votes
4answers
1k views

Is there a pbuilder-like environment for RedHat?

I would like to know if is there any utility like Debian's pbuilder, to build RPM packages on RedHat using a clean environment (chroot). I've found mach which has support for something like this but ...
7
votes
2answers
702 views

replicate and isolating user environments on the fly

I will be using Ubuntu Linux for this project. For training of a particular application at a conference I need: To have each student be able to ssh into the same user account on a server Upon each ...
7
votes
2answers
1k views

Which of proc, sys etc. should be bind-mounted (or not) when chrooting into a “replacement” distribution?

This answer to another question basically boils down to chrooting into another Linux distribution in order to mainly use that as a replacement to its too restricted (but irreplaceable) parent. The ...
6
votes
1answer
5k views

deleting a 'file' under /proc or /dev

I am using a cowdancer/debootstrap setup to generate a chroot. Of course, as I iterate, I generate some chroot configurations that are bad. I have found myself in an awkward situation where I have ...
6
votes
3answers
506 views

Why are web servers traditionally started as superuser?

Thinking about a future web server setup, it struck me that for some reason web servers usually start as root and then drop certain rights (setuid) for the worker processes. In addition there is often ...
6
votes
1answer
468 views

Real chroot on a systemd machine

I'm trying to get used to systemd, because it seems to be the way that Debian is going. I want to run Xorg in a chroot on hardware, rather than using networking (which seems to be the canonical way ...
6
votes
1answer
724 views

Simulate chroot with unshare

I am trying to write a bootstrapper for a minimal, from-source linux distribution. I would like to build in a chroot-like environment. This should simplify packaging. I do not care about security at ...
6
votes
1answer
3k views

chroot fails with --userspec when chroot is i686

I'm experiencing a problem with chroot... I'm running on Arch Linux x86_64. I have a 64 bit chroot and a 32 bit chroot. They are identical except that one is 32 bit and one is 64 bit. I can enter ...
5
votes
3answers
4k views

chroot permission denied! But Im root!

I am trying to chroot into an old HD to change a forgotten password, but chroot says permission denied? what gives? I am root! The harddrive I am trying to chroot into is an old version of edUbuntu ...
5
votes
3answers
8k views

What to do to run GUI Java app in chrooted environment?

In my case Java app is JDownloader. I prepared chroot environment as explained here: http://www.0x61.com/forum/post5240333.html#p5240333 and here: http://interreality.org/~reed/java-chroot.html ...
5
votes
1answer
391 views

Why is it possible to leave CHROOT with this sftp config?

I'm trying to create the user lenny, that has read and write permissions in the folder /home/lenny/ and has no shell but only access via SFTP. I'm doing the following: useradd lenny mkdir /home/lenny ...
5
votes
1answer
67 views

PID in arch-chroot is incorrect

I am trying to run a python script in a chroot (specifically, the chroot is created with arch-chroot). The python script relies on os.getpid(), but this seems to be returning an incorrect PID within ...
5
votes
3answers
2k views

Restrict ssh login from LDAP to users who have a /home directory

I have an Apache server (RHEL 6) hosting multiple user web pages which currently is connected to my Active Directory environment to authenticate users. The server is used to automatically host content ...
5
votes
2answers
2k views

How to use/test pivot_root?

I want to test the pivot_root command which moves the root file system of the current process to the directory put_old and makes new_root the new root file system. But I always get the following ...
5
votes
1answer
925 views

Debian chroot blocking PTTYs on host

I've created a Debian-based chroot environment using debootstrap under Arch Linux, and fill it with life like this: #!/bin/sh mount -t proc proc $CHROOT/proc mount -t devpts devpts $CHROOT/dev/pts ...
5
votes
1answer
387 views

Backtrace of “git clone” running inside qemu-user-emulation based arm-chroot

I'm running a wheezy:armhf chroot using qemu user emulation on my jessie:x86_64 system. Somehow, a git clone on a particular private repository will hang inside the chroot, while succeed natively. ...
4
votes
3answers
2k views

Boot Linux system from a subdirectory on a partition?

I would like to try to set up a computer so that it has multiple Linux installs all in the same filesystem. For example, the filesytem would have 3 folders: /Ubuntu_Precise, /Ubuntu_Oneiric, and ...
4
votes
2answers
669 views

chroot jail that can access the filesystem

chroot jails seem to be simply a different world, with no interaction with the actual filesystem. Thus, the entire environment has to be replicated inside the chroot, which would mean making a full ...
4
votes
1answer
2k views

When can one reboot from inside a chroot environment?

Sometimes when I chroot into some folder , I could use reboot to reset my box, but sometimes I can't. So I want to know why I could do that sometimes and why. UPDATE The chroot environment is ...
4
votes
2answers
2k views

Mount points in a chroot

I have some device (say /dev/sda1) mounted at /home/user1. I also have a full Linux system under /tmp/chroot, and the directory /tmp/chroot/home contains only one directory named user2. If I chroot ...
4
votes
1answer
742 views

How to disable certain system calls for a given user?

I am creating a web app similar to codepad and for each run-action my app copies a directory (/home/radeks/voidptr/private/chroot-root) to /tmp/voidptr/[random-id]/chroot-root. This chroot directory ...
4
votes
2answers
416 views

Could you explain this “chroot” /tmp directory creation?

In the following linked article they explain how to create a "chroot" /tmp directory. I'm a bit confused by what they did. Could someone explain what the following commands are doing? Noexec and /tmp ...
4
votes
2answers
398 views

How to prevent schroot from overridding passwd file and others files already present on the chrooted system?

When I had to repair my Debian system, I tried to use schroot due the convenience of not having to mount bind several partitions. But, contrary to my expectations, schroot decided to override my ...
4
votes
1answer
182 views

Automate chroot into broken system

Every time you have to mount a system with a live-boot-CD and chroot into the system to repair grub, you have to type so many lines to mount into the right partition: fdisk -l find the right ...
4
votes
2answers
950 views

Chroot Risks w/ /dev and /proc

I am planning to set up a few chroot jails for some users to run/test Java applications (lets just assume each application is untrusted). Is there any risk involved with mounting /dev and /proc into ...
4
votes
1answer
445 views

Can you Chroot a program from an OpenVZ environment?

I just recently purchased a Virtual Private Server, and it is OpenVZ virtualization. I am setting up my LAMP stack, and in the past I have always just set up my BIND dns set up in a chrooted ...
4
votes
2answers
6k views

Disable direct login for normal users (like oracle) in linux but allow scp and sftp?

Is it possible to disable direct login for normal users (like oracle) in linux but allow scp and sftp for that use?
4
votes
3answers
1k views

Is there a linux vfs tool that allows bind a directory in different location (like mount --bind) in user space?

For a user process, I want to mount a directory in other location but in user space without root privilieges. Something like mount --bind /origin /dest, but with a vfs wrapper. Like a usermode ...
4
votes
1answer
104 views

Seperate messages of multiple sshds in syslog-ng

Is there a common way of distinguishing between the messages of multiple processes in syslog-ng beside setting different facilities? +1 if filtering and therefore logging in different files would be ...
4
votes
1answer
3k views

How can I mount a directory of the host system for use inside a FreeBSD jail?

I am performing the following on FreeBSD 9.0-STABLE: mount_nullfs /foo /jail/foo After that, from within the host system, the mount works. So this works: touch /foo/bar && ls /jail/foo/bar ...
4
votes
2answers
694 views

How to rsync a chroot without breaking symlinks?

I'd like to rsync (backup) a chroot environment from outside the chroot. For that I first make a lvm snapshot of the chroot volume and then run rsync on that. The only problem with this approach: ...
4
votes
1answer
8k views

Chrooted SFTP with full access to SSH stopped working (Debian)

I've got a home server on Debian 6 for backups. I'd like to setup chrooted SFTP environment with SSH access for some users (only for my knowledge, there are two users now). It almost works or rather ...
4
votes
3answers
841 views

Unabled to get rid of BIND 9 chroot

I had installed bind-chroot from yum not long ago, and saw that there were errors in the daily logs from named. Under further investigation, I noticed a directory loop. The named files resided under ...
4
votes
0answers
185 views

Unable to view mounted directories in a chroot [closed]

Here is a quick description of what I have done: I have a chrooted user (username: clientdev) which I have jailed inside their home directory. This chroot directory is /home/clientdev/ which is ...
4
votes
1answer
807 views

How do I run chromium inside a chroot?

Okay, I can run Iceweasel 17 ESR fine and some simple X apps like xkill, so I know that it's not merely an X display problem. However any version of Chromium and Iceweasel 24 fail with the following ...