Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [chroot]

A chroot on Unix operating systems is an operation that changes the apparent root directory for the current running process and its children. A program that is run in such a modified environment cannot name (and therefore normally not access) files outside the designated directory tree.

37
votes
3answers
70k views

Restricting an SSH/SCP/SFTP user to a directory

Is there a simple way to restrict an SCP/SFTP user to a directory? All methods that I've come across require me to set a chroot jail up by copying binaries, but I don't think that should be necessary.
94
votes
4answers
92k views

chroot “jail” - what is it and how do I use it?

I have heard/read a lot about the chroot jail under linux but have never yet used it (I use Fedora day-to-day), so what is a chroot "jail"? When and why might I use it/not use it and is there anything ...
39
votes
4answers
326k views

Limit FTP access only to the /var/www with vsftpd

I am running vsftpd as ftp server on my linux (rasbian), I log in to the machine as a root user. I would like to be still locked to using only /var/www, how can I configure vsftpd conf to accomplish ...
46
votes
3answers
25k views

How do I tell I'm running in a chroot?

I have a unix installation that's supposed to be usable both as a chroot and as a standalone system. If it's running as a chroot, I don't want to run any service (cron, inetd, and so on), because they ...
4
votes
2answers
11k views

Disable direct login for normal users (like oracle) in linux but allow scp and sftp?

Is it possible to disable direct login for normal users (like oracle) in linux but allow scp and sftp for that use?
13
votes
2answers
3k views

Simulate chroot with unshare

I am trying to write a bootstrapper for a minimal, from-source linux distribution. I would like to build in a chroot-like environment. This should simplify packaging. I do not care about security at ...
20
votes
2answers
8k views

What to use to harden Linux box? Apparmor, SELinux, grsecurity, SMACK, chroot?

I am planning to go back to Linux as a Desktop machine. I would like to make it more secure. And try a few hardening techniques, especially since I plan to get my own server. What would be a good, ...
10
votes
1answer
964 views

How to perform chroot with Linux namespaces?

After reading about Linux namespaces I was under the impression that they are, amongst a lot of other features, an alternative to chroot. For example, in this article: Other uses [of namespaces] ...
5
votes
2answers
4k views

How to achieve the effect of chroot in userspace in Linux (without being root)?

The goal is to install and run programs in a displaced (relocated) distro (whose / must not coincide with the global /) inside a host Linux system. The programs are not adapted for using a different / ...
2
votes
1answer
581 views

Debian unstable chroot security issues

This page describes how you can use the debootstrap utility to install a base Debian unstable/sid system on an existing Linux machine. The new install is accessible using chroot. When doing this, ...
6
votes
4answers
2k views

Is there a linux vfs tool that allows bind a directory in different location (like mount --bind) in user space?

For a user process, I want to mount a directory in other location but in user space without root privilieges. Something like mount --bind /origin /dest, but with a vfs wrapper. Like a usermode fine-...
46
votes
5answers
169k views

chroot: failed to run command ‘/bin/bash’: No such file or directory

When I run the chroot command an error is given: failed to run command ‘/bin/bash’: No such file or directory
5
votes
2answers
24k views

Disable operations outside user's home directory with chroot jail?

I'm trying to restrict a user to a specific directory called gclegal using a chroot jail. I've uncommented the line in the /etc/vsftpd.conf file chroot_local_user=YES Created a new user called kg: $...
9
votes
4answers
5k views

Boot Linux system from a subdirectory on a partition?

I would like to try to set up a computer so that it has multiple Linux installs all in the same filesystem. For example, the filesytem would have 3 folders: /Ubuntu_Precise, /Ubuntu_Oneiric, and /...
5
votes
2answers
2k views

Unable to umount after pivot_root

On a board, I would like to flash the (NAND) partition where my current rootfs is without restarting and being able to check if the flash succeeded. To do so, I try to: kill every unnecessary ...
5
votes
1answer
410 views

PID in arch-chroot is incorrect

I am trying to run a python script in a chroot (specifically, the chroot is created with arch-chroot). The python script relies on os.getpid(), but this seems to be returning an incorrect PID within ...
2
votes
1answer
518 views

chpasswd apply changes in the chroot directory

I have debootstraped version of wheezy on my Archlinux machine and would like to change it's root password: echo "root:toor" | chpasswd --root /home/containers/wheezy/ However I get an error: ...
36
votes
9answers
49k views

How can I chroot into a filesystem with a different architechture?

I'm trying to chroot into a Arch Linux ARM filesystem from x86_64. I've seen that it's possible to do using static qemu by copying the binary into the chroot system: $ cp /usr/bin/qemu-arm archarm-...
15
votes
4answers
7k views

Lightweight isolated linux environment

I want an isolated (guest) Linux environment on my computer that I can mess up without worrying about the host. E.g. install a lot of stuff from source without package management, pollute environment ...
9
votes
3answers
6k views

Which of proc, sys etc. should be bind-mounted (or not) when chrooting into a “replacement” distribution?

This answer to another question basically boils down to chrooting into another Linux distribution in order to mainly use that as a replacement to its too restricted (but irreplaceable) parent. The ...
5
votes
2answers
6k views

How to assign an additional IP/hostname to a chrooted environment?

While I can simply have e.g. sshd in a chroot environment ("chrootenv") listen to a different port than its parent ("parentenv"), it would be more convenient to have that environment have an ...
10
votes
3answers
4k views

Providing /bin and /lib inside a chroot jail

I need to be able to provide the /bin and /lib directories inside a chroot jail so that programs can dynamically link properly. Is there a way to accomplish this without making a copy of the /bin and ...
6
votes
3answers
12k views

What to do to run GUI Java app in chrooted environment?

In my case Java app is JDownloader. I prepared chroot environment as explained here: http://www.0x61.com/forum/post5240333.html#p5240333 and here: http://interreality.org/~reed/java-chroot.html ...
5
votes
2answers
2k views

chroot jail that can access the filesystem

chroot jails seem to be simply a different world, with no interaction with the actual filesystem. Thus, the entire environment has to be replicated inside the chroot, which would mean making a full ...
3
votes
1answer
2k views

Building GCC inside a chroot from source

In a previous question I asked about creating a chroot that simulates my embedded device environment. It was suggested that I build from source GCC and binutils first inside my chroot. To attempt this ...
14
votes
3answers
1k views

Why would I chroot for sandboxing for security if my application can from the beginning run at a lower level?

I am writing an HTTP server daemon in C (there are reasons why), managing it with systemd unit file. I am rewriting an application designed 20 years ago, around 1995. And the system they use is that ...
11
votes
3answers
11k views

How do Linux permissions work when a process is running as a specific group?

This is something I haven't been able to find much info on so any help would be appreciated. My understanding is thus. Take the following file: -rw-r----- 1 root adm 69524 May 21 17:31 ...
7
votes
3answers
414 views

Why is chroot(2) unavailable to unprivileged users?

Why is chroot(2) unavailable to unprivileged users? I don't understand existing answers on the Internet. For example this one https://lists.freebsd.org/pipermail/freebsd-security/2003-April/000123....
6
votes
1answer
11k views

deleting a 'file' under /proc or /dev

I am using a cowdancer/debootstrap setup to generate a chroot. Of course, as I iterate, I generate some chroot configurations that are bad. I have found myself in an awkward situation where I have ...
5
votes
1answer
5k views

Error message: unknown user 'geoclue' in statoverride file

I obtained a strange error message inside a chroot: unknown user 'geoclue' in statoverride file when running apt-get install or apt-get upgrade. I use schroot to enter this chroot. I found that I ...
5
votes
2answers
1k views

How to prevent schroot from overridding passwd file and others files already present on the chrooted system?

When I had to repair my Debian system, I tried to use schroot due the convenience of not having to mount bind several partitions. But, contrary to my expectations, schroot decided to override my ...
5
votes
2answers
136 views

how to change a file's content for a specific process only?

For the purpose of this question, let us assume that there is a file (/path/to/file) in the filesystem with a certain content like this: $> cat /path/to/file this is the content of the file /path/...
4
votes
0answers
2k views

How do I run chromium inside a chroot?

Okay, I can run Iceweasel 17 ESR fine and some simple X apps like xkill, so I know that it's not merely an X display problem. However any version of Chromium and Iceweasel 24 fail with the following ...
4
votes
1answer
1k views

ssh in chrooted jail doesn't work because of /dev/null operation not supported

I am trying to set up a ssh-chroot jail on one of my NAS servers. The system runs on NAS4Free (which is based on nanobsd). The user should be able to run only one command, which is a bash-script that ...
4
votes
2answers
9k views

Chroot SFTP users who require access to multiple directories under same parent folder

I have a RHEL 6 server with a /Documents directory, and it has child directories 1 2 3 4 5.... right under the /Documents directory. Is it possible to create an SFTP chroot jail that only gives a ...
4
votes
3answers
2k views

Chroot into a different architecture?

I have a filesystem image that's going to be used for an ARM processor, but I want to install some things on it first, like a Desktop, etc. So I want to mount the filesystem on my Linux machine and ...
4
votes
2answers
2k views

Is there a drawback when using a chroot in high performance computing?

My (small) company uses an out-of-date linux (centos) software stack to run a proprietary software on a small cluster. Understandingly, IT is reluctant to upgrade since everything works now. I'd like ...
2
votes
1answer
116 views

Deterministic method to find out whether some other process is in a chroot jail and where?

NOTE: I'm familiar with this U&L Q&A titled: How do I tell I'm running in a chroot? that sounds similar to what I'm asking, but there's a subtle difference to what I'm looking for. That ...
1
vote
2answers
962 views

Running systemd utilities like systemctl under an nspawn?

If I have a directory that I bootstraped with debootstrap that I got inside of running systemd-nspawn what do I have to do make its internal systemd functional? $ sudo systemd-nspawn -D ./foo ...
8
votes
1answer
2k views

Debian chroot blocking PTTYs on host

I've created a Debian-based chroot environment using debootstrap under Arch Linux, and fill it with life like this: #!/bin/sh mount -t proc proc $CHROOT/proc mount -t devpts devpts $CHROOT/dev/pts ...
3
votes
1answer
3k views

SELinux and chroot system call

TL; DR: This is a question about the final step, in a portable, developer-oriented rooting process, that works across all Android machines. It is not based on any exploit - it is something that we are ...
3
votes
1answer
821 views

Are there any differences between mounting a /proc filesystem inside a chroot compared to mounting it from the outside?

Compare the following: mount -t proc none ./my_chroot/proc and: chroot ./mychroot mount -t proc none /proc
3
votes
0answers
1k views

remount chrooted read-only subdirectory (non-mountpoint) to read-write from within jail?

I'm trying to do the same of this question (multiple linux installation on same filesystem) but I get this result (root filesystem mounted as read-only) . I'm using debian/sid, have successfully ...
3
votes
1answer
946 views

How does chroot's use of qemu for cross compile environments work?

To be able to do cross compiling there's a trick where you copy a static qemu binary into your <different-arch-root-to-be>/usr/bin and when you chroot into that filesystem, which has non-native ...
2
votes
1answer
4k views

vsftpd does not allow chrooted users write to directory

I installed vsftpd on ubuntu 12.04 and chrooted local users, in order not to let them see the other parts of system. but when a local user wants to login into ftp it gives out this error: 500 OOPS: ...
2
votes
1answer
78 views

Does `build_packages` download all libraries again in the case of a failed build?

I have been trying to set up and build an image of the Chromium OS from the instructions available here. My laptop was running the build_packages script for about 7-8 hours after which it failed on ...
2
votes
2answers
3k views

OpenSSH, chroot user: Root needs to own the user directory, is there any consequence?

I want to create an account for my friend on my computer, but I don't want my friend to be able to view all my files. I saw that with OpenSSH, there is an option for that. Inside the SSHD ...
2
votes
2answers
166 views

Trying to transplant bash to /mnt for chroot, what does bash want in order to work?

I have a stage 3 gentoo tarball.. extracted it to /mnt which is hosting /dev/sda3. Though there was no bin and no sign of bash after unpacking. Far as I'm aware, the rest of the configuration involves ...
1
vote
1answer
158 views

I don't understand how entering a mount namespace can work

either if you fork into a new mount namespace, or enter an existing one. It is possible to hold file descriptors from a foreign mount namespace. You can demonstrate this very easily, by finding a ...
1
vote
1answer
252 views

How do I tell I'm running in a chroot if /proc is not mounted?

I wanted to find whether I am inside a chroot as part of a script where I'm not allowed to mount /proc if it is not (unlike the case in How do I tell I'm running in a chroot?). How to find whether ...