3

Does it make sense to use SELinux inside a chroot jail? I am thinking that since in the chroot jail there should only be the bare minimum, not much else could be compromised.

Is there still a benefit of using SELinux inside a chroot jail?

4

Yes, it might be worth enforcing SELinux policies even in a container. One idea behind SELinux is to have a second line of defense, i.e. if some container (or chroot) breaks, a process within it might still not do what it wants - or, it may not even be able to break the container due to SELinux - or, it cannot even do something undesirable within the container/chroot.

4

A chroot jail only prevents processes that are running in the chroot from directly accessing files outside the chroot. It doesn't prevent processes in the chroot from accessing things other than files, such as other processes (which can be killed and ptraced if running as the same user), the network, etc. It also doesn't prevent processes in the chroot from exploiting bugs of other processes (e.g. setuid programs).

Chroot itself is not much of a security tool. Chroot only provides security in combination with other measures; at least, any process running inside the jail must be running under a different user ID from any process running outside the jail.

SELinux, if set up properly (which can be difficult), provides isolation, even for processes running as root. Chroot is in fact redundant as a security tool if you have SELinux — you could set up SELinux to restrict a program to certain directories — but it's a lot easier to set up correctly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.