I'm new to chroot jails; so far I've setup bash using this tutorial, and I've been able to login with the user through ssh secured with a public key.

The SSH configuration takes care of running the chroot jail:

AllowUsers <username>
Match User <username>
        ChrootDirectory "/home/<username>"


Basically I took every one of the dependencies listed and copied it to /home/username/<rest-of-the-path-to-dependency-file> and did the same with the executable.

I did nothing with linux-vdso as it doesn't play by the same rules.

They only thing I can do in the jail is cd and execute programs, my shell prompt appears like this:


I added another program and in the same manner as the tutorial above, adding ldd dependencies and copying over the executable to the directory IU found it in

When I run the program it creates a directory and folders in /.config/taskell/config.ini and a couple of other files.

But when the program runs it gives me an error related to the encoding of the file /home/username/.config/taskell/config.ini: hGetContents: invalid argument (invalid byte sequence), but when I run it in my bash shell on the computer directly it works fine.

Did setting up the chroot jail change the way the shell or this program interprets the files it is reading? The -bash-4.4$ prompt seems to indicate that there's some kind of defaults set that aren't there when I initially log in using the regular prompt.

Additionally, I'm trying to do this on WSL Ubuntu 18.08 which appears to have something to do with the encoding issue I linked.

The only three commands I wish to be able to run are the command I'm trying to run, git, and vim, but I'm starting with this one and not having much luck.

  • What's your goal with the chroot? If you're just looking for a sandbox in which to run some process(es), you might also consider containers. Commented Jan 11, 2020 at 3:02
  • @AndyDalton I want to securely connect to my laptop over ssh with a nice long prime number securing it and a passphrase; then I’d like to keep my todo list (taskell is a bash based kanban) there and maybe be able to store and edit it with vi and git; I want to allow others in to collaborate, by adding their public key, but not to get to the files outside that directory.
    – leeand00
    Commented Jan 11, 2020 at 4:43
  • @AndyDalton So does a container just automate what I’m trying to do here? I’m making the chroot jail using the sshd_config and the username I’m trying to let in.
    – leeand00
    Commented Jan 11, 2020 at 4:58
  • Additionally, I don't want to give a would be attacker access to any more libraries than are necessary for running the todo list.
    – leeand00
    Commented Jan 11, 2020 at 20:10
  • @ctrl-alt-delor beat me to it with the answer below Commented Jan 11, 2020 at 23:55

1 Answer 1


Instead of chroot, use a container, such as docker (there are many others):

  • It does more: chroot, namespace isolation, cgroups, etc.
  • It manages it for you.
  • For docker there are pre-built images.

However what I see you asking for, but be more easily solved with simple user isolation: A separate account for each user. You could then augment this with Mandatory-Access-Control (e.g. app armour).

However, all of this is complicated by you using WSL. WSL is Gnu/Linux on MS-Windows. WSL is Gnu/Linux with the Linux replaced. I am not sure if WSL2 is much better. All the stuff that we are discussing is done in the Linux part of Gnu/Linux, and is the most prone to not working (or working differently), if not running a real Gnu/Linux system. The shared file-system, is a big area of incompatibility. It makes it difficult to use file permissions, to keep users apart.

I have heard that docker works on MS-Windows, I think it does this by putting Gnu/Linux in a virtual machine (but am not sure).

  • No it is not a VM it’s more akin to Wine in Linux where the Linux system calls call windows system calls; before I read that I was afraid to use it.
    – leeand00
    Commented Jan 11, 2020 at 14:56
  • I’m using it because every employer I’ve ever worked for has always insisted I used Windows. Note that I’m not using the chroot command at all, that is all being done with sshd.
    – leeand00
    Commented Jan 11, 2020 at 14:58
  • stackoverflow.com/questions/41550727/… Commented Jan 11, 2020 at 14:58
  • They do that. I have even seen (many) adverts for a job, where they say that you will be a system architect designing a new system from the ground up (green field), then they tell you what OS, programming language, database, etc. that you will be using. Commented Jan 11, 2020 at 15:01
  • 1
    Or are saying after you were already connected?
    – leeand00
    Commented Jan 11, 2020 at 22:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .