2

I'd like to verify the security of chroot and default programs in a linux distribution (say Ubuntu).

Example: I set up jail directory 'A'. Every linux binary from the distribution is placed in 'A' with ACLs being the same.

e.g. A/usr/bin contains all executables /usr/bin, A/bin has exe's from /bin, etc.

Assume no other files are written.

An untrusted user is then placed into chroot jail 'A' and operates as some random uid.

The question: Is this environment as secure as an unjailed one? Is it impossible for him to either get root access or break out of the jail? (barring linux root exploits)

For instance, I was initially worried that now the user could write his own sudoers file. But fortunately, sudo verifies that sudoers is owned by root. Is every standard setuid'd program this careful?

Improve this question

2 Answers 2

Reset to default
1

I cannot specifically answer your question, so mod me down if you like. However, many people before me, and many after, will confirm for you the obvious: that chroot jail is not a security mechanism (you talked about Linux; BSD jails are different enough I am not talking about them). To quote a very well-known kernel hacker, Alan Cox, they are not a security mechanism. To be honest, I only see/hear/read about successful use of the chroot for packing building and test environment. This is where it shines. It is specifically not a good security platform, especially if only in isolation.

These days, people talk about Linux containers with cgroups and other heftier virtualization solutions like OpenVZ or Linux VServer. I am not saying they are definitively the answer, but the impact of performance degradation is that there is good isolation between the host and guest virtual machines. I hope this has been useful.

Improve this answer
2
  • I am looking to use chroot more as a special environment. However, I am concerned that I could be opening a security hole by doing that. I just want to make sure that the chroot jailed (non-root) user is no less secure than a regular (non-root) user.
    – user80203
    May 4, 2011 at 0:24
  • Fine, but modify your question to help us. "Linux" is not specific. Why type of binary is not specific (you have to control access from the jail to the main OS, so certain device nodes need to be configured if you need, say, internet access or not). Also, certain Linux flavors have different bootstrapping procedures. What you will be doing is basically shoe-horning a Linux OS in userland, so you will need to have all the dependencies inside that chroot jail. So, knowing which bootstrapping procedure we need to tell you about makes a big difference.
    – songei2f
    May 4, 2011 at 6:50
0

I recommend taking a look at the general limitations of the chrooting process and what projects like OpenVZ do to restrict resource usage within the chroot jail or virtualization environment to answer your "is it impossible to break out" question.

If you simply try to manually chroot a user in a copy of the whole system plus modifying permissions here and there and trying to keep it up to date with security updates of the main system you won't have the same security standard.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .