Chroot jails made simpler

Jail Management

© Lead Image © Ints Vikmanis, 123RF.com

© Lead Image © Ints Vikmanis, 123RF.com

Article from Issue 244/2021
Author(s):

Setting up chroot jails is no simple task. Jailkit can make this job a little easier by automating setup and configuration.

Both the chroot command and a container are ways to isolate parts of a system. However, their methods are quite different. While a container is a form of virtualization with its own allocated resources, chroot is a way to limit a user account's access to the parts of the directory tree by – as the name of the command implies – changing its root directory. The result is what is known as a chroot or, sometimes, a chroot jail, which draws on the larger system's resources as needed. The result is more economical, if less trendy than containers, but it is difficult to set up. Fortunately most distros include jailkit [1], a collection of utilities that helps to automate setup and configuration.

Contrary to widespread misinformation, a chroot is not a security measure unless specifically configured as one. Although confinement in a jail can limit what an uninformed user can do, expert users could escape a jail by creating a second jail within the first. In addition, any process run with root privileges can access resources outside the chroot. Similarly, if a user has permissions for any files outside their home directory, they are not jailed. In addition, any user with root privileges can access the chroot from the main system, including those using sudo.

A chroot can be made secure with some effort. But more commonly, a chroot has other purposes, including:

[...]

Use Express-Checkout link below to read the full article (PDF).

Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy Linux Magazine

SINGLE ISSUES
 
SUBSCRIPTIONS
 
TABLET & SMARTPHONE APPS
Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

  • Command Line: Debootstrap

    We provide basic instructions for using Debian's debootstrap to create a schroot jail for building and testing packages.

  • Sandboxing

     

  • dgamelaunch

    If you are into retrogaming, dgamelaunch lets you set up a server to play Roguelike games and compete with friends, all while preserving a piece of gaming history.

  • UCK

    We’ll show you how to create a custom Ubuntu ISO with the Ubuntu Customization Kit.

  • VServer

    The VServer project offers a secure and highly efficient virtualization alternative.

comments powered by Disqus

Direct Download

Read full article as PDF:

Price $2.95

News