Chroot jails made simpler
Jail Management

© Lead Image © Ints Vikmanis, 123RF.com
Setting up chroot jails is no simple task. Jailkit can make this job a little easier by automating setup and configuration.
Both the chroot
command and a container are ways to isolate parts of a system. However, their methods are quite different. While a container is a form of virtualization with its own allocated resources, chroot is a way to limit a user account's access to the parts of the directory tree by – as the name of the command implies – changing its root directory. The result is what is known as a chroot or, sometimes, a chroot jail, which draws on the larger system's resources as needed. The result is more economical, if less trendy than containers, but it is difficult to set up. Fortunately most distros include jailkit [1], a collection of utilities that helps to automate setup and configuration.
Contrary to widespread misinformation, a chroot is not a security measure unless specifically configured as one. Although confinement in a jail can limit what an uninformed user can do, expert users could escape a jail by creating a second jail within the first. In addition, any process run with root privileges can access resources outside the chroot. Similarly, if a user has permissions for any files outside their home directory, they are not jailed. In addition, any user with root privileges can access the chroot from the main system, including those using sudo
.
A chroot can be made secure with some effort. But more commonly, a chroot has other purposes, including:
- Sandboxing: Safely testing unstable builds without risking the rest of the system
- Creating a new environment: Usually for testing purposes
- Dependency control: Giving an application access to only certain versions of dependencies
- Running old software: Denying access to hardware that the software cannot handle
- Recovery: Making the entire chroot a filesystem that can be accessed after boot from a single drive, with utilities to help in restoring the system
Most of these purposes do not require a desktop environment, although you can add one to the chroot by installing the X clients section when using jk_init
, if desired.
Chroot's Wikipedia entry lists a number of common uses, including Postfix utilities, FTP servers, and package-building farms for Debian, Ubuntu, SUSE, Fedora, and Red Hat when they test for dependencies [2]. Despite being added to Version 7 Unix as long ago as 1982 – and possibly earlier – chroot remains a versatile tool today.
Whatever your purpose, setting up a chroot can be a laborious task. First, the chroot needs to be initialized. Then, depending on your purposes, you may need to configure the files, the access to devices, the shell, the user access, and daemons in the chroot. There is even a separate wrapper for using procmail within the jail. A time may come, as well, when you want to edit or update files. About half of these actions have a default configuration file in /etc/jailkit
, although you will probably need to edit it for your own purposes. However, the advantage is that, should you require a clone of a chroot, it can be created quickly. You might also locate an online example you can modify to suit your purpose. Note, though, that many examples assume a Debian or Ubuntu installation and may need to be modified for other distributions. You should also check the synopsis at the start of each man page to learn whether the command can be run from outside or inside the chroot.
More to the point, these actions can be simplified by jailkit's utilities, many of which have their own man page with more examples. Generally, however, the first option in a command will be
--jail-CHROOT -j CHROOT
and the last one the command, user, or other element of the main system that will interact with the jail.
To set up a chroot, you should run the utilities in the order listed below, skipping any that are irrelevant to your purposes. Those at the end of the list can be run periodically as the chroot evolves or needs updating.
jk_init
Begin the creation of a chroot with jk_init
(Figure 1). At the very least, the command must specify the directory for the chroot plus the .ini
file plus the sections to install:
-usr/sbin/jk_init -j CHROOT-DIRECTORY INI-FILE --configfile =FILE (-c FILE) SECTION
Alternatively, you can make configuration choices from the command line, which may be a more secure choice if you are not familiar with the contents of the .ini
file:
jk_init -v CHROOT-DIRECTORY FILES-TO-INSTALL
The chroot's root directory, as well as its parent directories, will be made if they do not already exist, while possible sections of the .ini
file for jk_init.ini
can be read by using the --list
option (Figure 2).
The jk_init.ini
file defines the basic configuration of the chroot, as well as the behavior of the other jailkit utilities. Jailkit installs with an .ini
file for a set of general purpose paths and applications (Figure 3), but often you can create a much simpler chroot. For instance, Listing 1 shows an example from the man page that creates the chroot with a limited shell so it can run the sftp
command.
Listing 1
Creating a Limited Shell
[jk_lsh] comment = Jailkit limited shell paths = /usr/sbin/jk_lsh, /etc/jailkit/jk_lsh.ini users = root groups = root need_logsocket = 1 includesections = uidbasics [sftp] comment = ssh secure ftp with Jailkit limited shell paths = /usr/lib/sftp-server includesections = netbasics, uidbasics devices = /dev/urandom, /dev/null emptydirs = /svr

jk_cp
Because a chroot is isolated from the rest of the system, you need to copy into the chroot any files or devices you want to run within it. This command is simply a space-separated list of the full path to files to add to the chroot. If a command is copied, its dependencies are as well – a great time-saver to manual creation using the chroot
command. The copy of each file has the same permissions as the original, except that setuid
and setgid
permissions are removable.
jk_chrootsh
This command creates a login shell for the chroot. Since the shell has no access to the system's libraries or commands, most of those it needs must be copied into the chroot using jk_cp
. Only a minimum set of commands is installed by default, such as the files in /etc/passwd
needed for the user to log in. Other commands that can be executed in the chroot are defined in /etc/jailkit/jk_lsh.ini
(see next).
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Direct Download
Read full article as PDF:
Price $2.95
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Find SysAdmin Jobs
News
-
CarbonOS: A New Linux Distro with a Focus on User Experience
CarbonOS is a brand new, built-from-scratch Linux distribution that uses the Gnome desktop and has a special feature that makes it appealing to all types of users.
-
Kubuntu Focus Announces XE Gen 2 Linux Laptop
Another Kubuntu-based laptop has arrived to be your next ultra-portable powerhouse with a Linux heart.
-
MNT Seeks Financial Backing for New Seven-Inch Linux Laptop
MNT Pocket Reform is a tiny laptop that is modular, upgradable, recyclable, reusable, and ships with Debian Linux.
-
Ubuntu Flatpak Remix Adds Flatpak Support Preinstalled
If you're looking for a version of Ubuntu that includes Flatpak support out of the box, there's one clear option.
-
Gnome 44 Release Candidate Now Available
The Gnome 44 release candidate has officially arrived and adds a few changes into the mix.
-
Flathub Vying to Become the Standard Linux App Store
If the Flathub team has any say in the matter, their product will become the default tool for installing Linux apps in 2023.
-
Debian 12 to Ship with KDE Plasma 5.27
The Debian development team has shifted to the latest version of KDE for their testing branch.
-
Planet Computers Launches ARM-based Linux Desktop PCs
The firm that originally released a line of mobile keyboards has taken a different direction and has developed a new line of out-of-the-box mini Linux desktop computers.
-
Ubuntu No Longer Shipping with Flatpak
In a move that probably won’t come as a shock to many, Ubuntu and all of its official spins will no longer ship with Flatpak installed.
-
openSUSE Leap 15.5 Beta Now Available
The final version of the Leap 15 series of openSUSE is available for beta testing and offers only new software versions.