Complexity [LWN.net]

Complexity

Posted Mar 22, 2013 8:48 UTC (Fri) by jezuch (subscriber, #52988)
In reply to: Complexity by dlang
Parent article: Anatomy of a user namespaces vulnerability

> the problem with chroot has been that it's not perfect.

The problem with chroot, as I was told, is that it is not and has never been a security mechanism.

to post comments

Complexity

Posted Mar 22, 2013 18:41 UTC (Fri) by dlang (guest, #313) [Link]

> The problem with chroot, as I was told, is that it is not and has never been a security mechanism.

It depends on how you define 'security mechanism'

chroot has always provided security in that processes in a chroot in that it prevented that process from accessing any files outside that chroot.

This doesn't mean that this security couldn't be bypassed (if you could get root inside the chroot), but if you did not have root in the chroot, it helped.

for example, if a server had a vulerability that allowed it to access arbitrary files on the filesystem, putting it in a chroot can be very useful.