Questions tagged [chroot]

A chroot on Unix operating systems is an operation that changes the apparent root directory for the current running process and its children. A program that is run in such a modified environment cannot name (and therefore normally not access) files outside the designated directory tree.

94
votes
4answers
96k views

chroot “jail” - what is it and how do I use it?

I have heard/read a lot about the chroot jail under linux but have never yet used it (I use Fedora day-to-day), so what is a chroot "jail"? When and why might I use it/not use it and is there anything ...
50
votes
5answers
176k views

chroot: failed to run command ‘/bin/bash’: No such file or directory

When I run the chroot command an error is given: failed to run command ‘/bin/bash’: No such file or directory
46
votes
3answers
26k views

How do I tell I'm running in a chroot?

I have a unix installation that's supposed to be usable both as a chroot and as a standalone system. If it's running as a chroot, I don't want to run any service (cron, inetd, and so on), because they ...
41
votes
5answers
362k views

How to create a FTP user with specific /dir/ access only on a Centos / linux installation

So I'm on a VPS - CentOS Linux installation. I have vsFTPd on the server. I currently have SFTP access to the server via my root user, but am now trying to create a new user with FTP access to a ...
39
votes
4answers
332k views

Limit FTP access only to the /var/www with vsftpd

I am running vsftpd as ftp server on my linux (rasbian), I log in to the machine as a root user. I would like to be still locked to using only /var/www, how can I configure vsftpd conf to accomplish ...
37
votes
9answers
50k views

How can I chroot into a filesystem with a different architechture?

I'm trying to chroot into a Arch Linux ARM filesystem from x86_64. I've seen that it's possible to do using static qemu by copying the binary into the chroot system: $ cp /usr/bin/qemu-arm archarm-...
37
votes
3answers
71k views

Restricting an SSH/SCP/SFTP user to a directory

Is there a simple way to restrict an SCP/SFTP user to a directory? All methods that I've come across require me to set a chroot jail up by copying binaries, but I don't think that should be necessary.
31
votes
1answer
34k views

How can I access a directory outside a chroot from within it?

I have a user which is chrooted to her home directory, but I want her to also be able to manage files within /var/www. As such, I did the following: root@server:/home/username# ln -s /var/www www ...
20
votes
2answers
8k views

What to use to harden Linux box? Apparmor, SELinux, grsecurity, SMACK, chroot?

I am planning to go back to Linux as a Desktop machine. I would like to make it more secure. And try a few hardening techniques, especially since I plan to get my own server. What would be a good, ...
15
votes
5answers
31k views

How to unmount a formerly chroot'd filesystem?

I'm using a rescue-live-system (similar to a live-cd) to fix some issues with my Debian server, like that: # mkdir -p /mnt/rescue # mount /dev/md2 /mnt/rescue # mount --bind /dev /mnt/rescue/dev/ # ...
15
votes
4answers
7k views

Lightweight isolated linux environment

I want an isolated (guest) Linux environment on my computer that I can mess up without worrying about the host. E.g. install a lot of stuff from source without package management, pollute environment ...
14
votes
3answers
1k views

Why would I chroot for sandboxing for security if my application can from the beginning run at a lower level?

I am writing an HTTP server daemon in C (there are reasons why), managing it with systemd unit file. I am rewriting an application designed 20 years ago, around 1995. And the system they use is that ...
13
votes
3answers
5k views

Boot into a chroot?

I have Linux (Debian Jessie) installed on a hard drive. Drive - sda1, ext4fs, and sda2 - swap I have a /chroot folder. There is installed another system, in /chroot folder. Question: How to tell ...
13
votes
2answers
4k views

Simulate chroot with unshare

I am trying to write a bootstrapper for a minimal, from-source linux distribution. I would like to build in a chroot-like environment. This should simplify packaging. I do not care about security at ...
12
votes
1answer
1k views

How to perform chroot with Linux namespaces?

After reading about Linux namespaces I was under the impression that they are, amongst a lot of other features, an alternative to chroot. For example, in this article: Other uses [of namespaces] ...
12
votes
1answer
3k views

Why do I need to use chroot

This question chroot-jail-what-is-it-and-how-do-i-use-it refers to what is and how to use chroot. What I don't understand is why do I need to use chroot. I understand what it does, but I can't think ...
11
votes
3answers
11k views

How do Linux permissions work when a process is running as a specific group?

This is something I haven't been able to find much info on so any help would be appreciated. My understanding is thus. Take the following file: -rw-r----- 1 root adm 69524 May 21 17:31 ...
10
votes
3answers
4k views

Providing /bin and /lib inside a chroot jail

I need to be able to provide the /bin and /lib directories inside a chroot jail so that programs can dynamically link properly. Is there a way to accomplish this without making a copy of the /bin and ...
10
votes
4answers
5k views

Boot Linux system from a subdirectory on a partition?

I would like to try to set up a computer so that it has multiple Linux installs all in the same filesystem. For example, the filesytem would have 3 folders: /Ubuntu_Precise, /Ubuntu_Oneiric, and /...
9
votes
3answers
6k views

Which of proc, sys etc. should be bind-mounted (or not) when chrooting into a “replacement” distribution?

This answer to another question basically boils down to chrooting into another Linux distribution in order to mainly use that as a replacement to its too restricted (but irreplaceable) parent. The ...
9
votes
4answers
2k views

Is there a pbuilder-like environment for RedHat?

I would like to know if is there any utility like Debian's pbuilder, to build RPM packages on RedHat using a clean environment (chroot). I've found mach which has support for something like this but ...
8
votes
2answers
5k views

How to execute “ ls ” command in the chroot?

I have browser shell leash and I'm executing shell commands in php and returing them to the browser and I just discovered chroot command and I want to run for example ls on root directory on changed ...
8
votes
2answers
2k views

replicate and isolating user environments on the fly

I will be using Ubuntu Linux for this project. For training of a particular application at a conference I need: To have each student be able to ssh into the same user account on a server Upon each ...
8
votes
1answer
2k views

Debian chroot blocking PTTYs on host

I've created a Debian-based chroot environment using debootstrap under Arch Linux, and fill it with life like this: #!/bin/sh mount -t proc proc $CHROOT/proc mount -t devpts devpts $CHROOT/dev/pts ...
7
votes
3answers
14k views

chroot permission denied! But I'm root!

I am trying to chroot into an old HD to change a forgotten password, but chroot says permission denied? what gives? I am root! The harddrive I am trying to chroot into is an old version of edUbuntu 7....
7
votes
1answer
11k views

deleting a 'file' under /proc or /dev

I am using a cowdancer/debootstrap setup to generate a chroot. Of course, as I iterate, I generate some chroot configurations that are bad. I have found myself in an awkward situation where I have ...
7
votes
3answers
452 views

Why is chroot(2) unavailable to unprivileged users?

Why is chroot(2) unavailable to unprivileged users? I don't understand existing answers on the Internet. For example this one https://lists.freebsd.org/pipermail/freebsd-security/2003-April/000123....
7
votes
3answers
1k views

Why are web servers traditionally started as superuser?

Thinking about a future web server setup, it struck me that for some reason web servers usually start as root and then drop certain rights (setuid) for the worker processes. In addition there is often ...
7
votes
2answers
10k views

How to use/test pivot_root?

I want to test the pivot_root command which moves the root file system of the current process to the directory put_old and makes new_root the new root file system. But I always get the following ...
7
votes
1answer
2k views

Real chroot on a systemd machine

I'm trying to get used to systemd, because it seems to be the way that Debian is going. I want to run Xorg in a chroot on hardware, rather than using networking (which seems to be the canonical way ...
6
votes
3answers
12k views

Chroot doesn't find `/bin/bash`

I would assume the following would work: mkdir /tmp/chrootTest # Create chroot folder. mkdir /tmp/chrootTest/bin # Create `/bin` in the chroot folder. sudo mount -B /bin /tmp/chrootTest/bin/ # Bind-...
6
votes
3answers
13k views

What to do to run GUI Java app in chrooted environment?

In my case Java app is JDownloader. I prepared chroot environment as explained here: http://www.0x61.com/forum/post5240333.html#p5240333 and here: http://interreality.org/~reed/java-chroot.html ...
6
votes
4answers
2k views

Is there a linux vfs tool that allows bind a directory in different location (like mount --bind) in user space?

For a user process, I want to mount a directory in other location but in user space without root privilieges. Something like mount --bind /origin /dest, but with a vfs wrapper. Like a usermode fine-...
6
votes
1answer
7k views

How can I mount a directory of the host system for use inside a FreeBSD jail?

I am performing the following on FreeBSD 9.0-STABLE: mount_nullfs /foo /jail/foo After that, from within the host system, the mount works. So this works: touch /foo/bar && ls /jail/foo/bar ...
6
votes
1answer
379 views

X.org working with no socket in chroot?

I have a chroot setup and I've been running graphical applications from it with no problem. The only setup I've done is set DISPLAY=:0 and it works. However I always thought Unix domain sockets were ...
6
votes
1answer
2k views

chroot with unionfs-fuse, can't access /dev/*

I have created the a chroot jail in combination with unionfs-fuse so that I don't need to install another system inside it. However, the resulting system's /dev entries are not readable.This is ...
6
votes
1answer
2k views

chroot into a sshfs folder

I am trying to chroot into a sshfs-mounted directory: mkdir remoteroot sshfs remote:/ remoteroot/ sudo chroot remoteroot/ but I get chroot: cannot change root directory to remoteroot/: Permission ...
6
votes
1answer
9k views

loadkeys says “Couldn't get a file descriptor referring to the console” in chroot on ChromeOS

I've been trying the "Developer console" in ChromeOS( dev mode), which is entered by Ctrl+Alt+Forward but when switching the keyboard layout with loadkeys cz I got an error saying Couldn't get a file ...
6
votes
1answer
5k views

chroot fails with --userspec when chroot is i686

I'm experiencing a problem with chroot... I'm running on Arch Linux x86_64. I have a 64 bit chroot and a 32 bit chroot. They are identical except that one is 32 bit and one is 64 bit. I can enter ...
6
votes
1answer
1k views

suexec with chrooted environment

I'm trying to get a chrooted Apache environment working running mod_fcgid with suexec. Looking at suexec log inside jail, the wrapper scripts are being executed with no problems, however, when I look ...
5
votes
3answers
11k views

Unable to reach network from chroot

I have a complicated scenario, with most of the complicated parts working: SD card contains a Fedora 23 Raspberry Pi install on a LUKS/BTRFS filesystem. Fedora 23 x86-64 VM being used to manage the ...
5
votes
2answers
145 views

how to change a file's content for a specific process only?

For the purpose of this question, let us assume that there is a file (/path/to/file) in the filesystem with a certain content like this: $> cat /path/to/file this is the content of the file /path/...
5
votes
2answers
4k views

How to achieve the effect of chroot in userspace in Linux (without being root)?

The goal is to install and run programs in a displaced (relocated) distro (whose / must not coincide with the global /) inside a host Linux system. The programs are not adapted for using a different / ...
5
votes
2answers
3k views

chroot jail that can access the filesystem

chroot jails seem to be simply a different world, with no interaction with the actual filesystem. Thus, the entire environment has to be replicated inside the chroot, which would mean making a full ...
5
votes
2answers
6k views

How to assign an additional IP/hostname to a chrooted environment?

While I can simply have e.g. sshd in a chroot environment ("chrootenv") listen to a different port than its parent ("parentenv"), it would be more convenient to have that environment have an ...
5
votes
1answer
4k views

When can one reboot from inside a chroot environment?

Sometimes when I chroot into some folder , I could use reboot to reset my box, but sometimes I can't. So I want to know why I could do that sometimes and why. UPDATE The chroot environment is ...
5
votes
2answers
24k views

Disable operations outside user's home directory with chroot jail?

I'm trying to restrict a user to a specific directory called gclegal using a chroot jail. I've uncommented the line in the /etc/vsftpd.conf file chroot_local_user=YES Created a new user called kg: $...
5
votes
1answer
5k views

Error message: unknown user 'geoclue' in statoverride file

I obtained a strange error message inside a chroot: unknown user 'geoclue' in statoverride file when running apt-get install or apt-get upgrade. I use schroot to enter this chroot. I found that I ...
5
votes
2answers
1k views

Chroot Risks w/ /dev and /proc

I am planning to set up a few chroot jails for some users to run/test Java applications (lets just assume each application is untrusted). Is there any risk involved with mounting /dev and /proc into ...
5
votes
2answers
2k views

Unable to umount after pivot_root

On a board, I would like to flash the (NAND) partition where my current rootfs is without restarting and being able to check if the flash succeeded. To do so, I try to: kill every unnecessary ...