| |||||||||||||
chroot jailchroot jailPosted Oct 12, 2007 1:06 UTC (Fri) by dpotapov (guest, #46495)Parent article: What chroot() is really for
I believe that the term "chroot jail" is essentially correct as it does not allow non-root processes to escape it, but people who believe they can keep omnipotent root in "chroot jail" know nothing about *nix.
So, usefulness of "chroot jail" from the security point of view is to run applications like Apache in the environment where there is no suid programs, which may have vulnerabilities leading to gaining the root access.
If you have to have some suid programs in the chroot environment, you can use SELinux's capacities to limited what they can do, so dramatically decrease possibility that a newly found bug can be used to gain the root access.
(Log in to post comments)
|
|||||||||||||