11

This question chroot-jail-what-is-it-and-how-do-i-use-it refers to what is and how to use chroot.

What I don't understand is why do I need to use chroot. I understand what it does, but I can't think of a case when I need to use it, given the fact that it is not a security mechanism or a sandbox, as the answer points out "you shouldn't use chroot as a security measure to prevent a program from modifying files outside your simulated filesystem".

Specifically, why does a certain process need to map a sub-directory as the rootfilesystem?

  • to have more distributions in one filesystem. – Ipor Sircer Jan 26 '17 at 13:10
  • what does that mean? – Alexandru Irimiea Jan 26 '17 at 13:14
  • 1
    While it might not prevent a determined hacker from breaking out of the jail, it makes it harder and will almost certainly prevent accidental accesses. – Barmar Jan 26 '17 at 19:01
  • if you want to build a new os from scratch, this can be used to setup a fresh environment which is independent on the host file system. take a look in the LFS project (linux from scratch) – chenchuk May 17 '18 at 7:55
12

There are a lot of reasons to use a chrooted environment, you can use it to keep different versions of one program, you can use it to simulate an specific environment in order to test some features, to create images of a system different from your main one, etc.

Wikipedia can tell you more about chroot jails and its usages.

From there:

Testing and development: A test environment can be set up in the chroot for software that would otherwise be too risky to deploy on a production system.

Dependency control: Software can be developed, built and tested in a chroot populated only with its expected dependencies. This can prevent some kinds of linkage skew that can result from developers building projects with different sets of program libraries installed.

Compatibility: Legacy software or software using a different ABI must sometimes be run in a chroot because their supporting libraries or data files may otherwise clash in name or linkage with those of the host system.

Recovery: Should a system be rendered unbootable, a chroot can be used to move back into the damaged environment after bootstrapping from an alternate root file system (such as from installation media, or a Live CD).

Privilege separation: Programs are allowed to carry open file descriptors (for files, pipelines and network connections) into the chroot, which can simplify jail design by making it unnecessary to leave working files inside the chroot directory. This also simplifies the common arrangement of running the potentially vulnerable parts of a privileged program in a sandbox, in order to pre-emptively contain a security breach. Note that chroot is not necessarily enough to contain a process with root privileges.

  • 3
    Basically if you are running a set of programs that want to read/write specific things in place starting from /, but you don't want to mess up your existing system, a chroot is useful even if run as root (which is when it's pointless from a security perspective). It functions as a "redirector" which as long as you trust the program is useful. – LawrenceC Jan 26 '17 at 15:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.