Does it make sense to use SELinux inside a
chroot jail? I am thinking that since in the
chroot jail there should only be the bare minimum, not much else could be compromised.
Is there still a benefit of using SELinux inside a
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
Yes, it might be worth enforcing SELinux policies even in a container. One idea behind SELinux is to have a second line of defense, i.e. if some container (or
chroot) breaks, a process within it might still not do what it wants - or, it may not even be able to break the container due to SELinux - or, it cannot even do something undesirable within the container/chroot.
A chroot jail only prevents processes that are running in the chroot from directly accessing files outside the chroot. It doesn't prevent processes in the chroot from accessing things other than files, such as other processes (which can be killed and ptraced if running as the same user), the network, etc. It also doesn't prevent processes in the chroot from exploiting bugs of other processes (e.g. setuid programs).
Chroot itself is not much of a security tool. Chroot only provides security in combination with other measures; at least, any process running inside the jail must be running under a different user ID from any process running outside the jail.
SELinux, if set up properly (which can be difficult), provides isolation, even for processes running as root. Chroot is in fact redundant as a security tool if you have SELinux — you could set up SELinux to restrict a program to certain directories — but it's a lot easier to set up correctly.