Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible for a non-root user to run a chroot process on Ubuntu?

share|improve this question
    
chroot jails are specific to bsd. a chroot in linux is not a jail. Last I checked it was not possible to chroot as a user. –  xenoterracide Apr 25 '10 at 10:11
1  
@xenoterracide Jails are BSD specific, but chroot is commonly known as a "chroot jail" in the Linux community. It's quite confused. –  pehrs Apr 25 '10 at 19:46
1  
What are you trying to do and why? There are tools like fakechroot, and schroot that make provide a workable alternative depending on your requirements. –  Zoredache Apr 25 '10 at 22:32
add comment

5 Answers

up vote 4 down vote accepted

On Linux the chroot(2) system call can only be made by a process that is privileged. The capability the process needs is CAP_SYS_CHROOT.

The reason you can't chroot as a user is pretty simple. Assume you have a setuid program such as sudo that checks /etc/sudoers if you are allowed to do something. Now put it in a chroot chroot with your own /etc/sudoers. Suddenly you have an instant privilege escalation.

It is possible to design a program to chroot itself and run it as a setuid process, but this is generally considered bad design. The extra security of the chroot does not motivate the security issues with the setuid.

share|improve this answer
    
With the new possibilities of namespaces in linux, perhaps it's possible to create (unshare) a new "user" namespace, where there would be an "embedded" root user, and perform chroot then. –  imz -- Ivan Zakharyaschev Jan 10 '13 at 16:46
add comment

These days, you want to be looking at LXC (Linux Containers) instead of chroot/BSD jail. It's somewhere between a chroot and a virtual machine, giving you a lot of security control and general configurability. I believe all you need to run it as a user is to be a member of the group that owns the necessary files/devices, but there might also be capabilities/system permissions involved. Either way, it should be very doable, since LXC is quite recent, long after SELinux etc. was added to the Linux kernel.

Also, bear in mind that you can just write scripts as root but give users secure permission to run those scripts (without a password if you like, but make sure the script is secure) using sudo.

share|improve this answer
add comment

This old FreeBSD thread covers the same question:

http://lists.freebsd.org/pipermail/freebsd-security/2003-April/000123.html

Short answer: No, you cannot run a process as root within a non-root chroot jail.

share|improve this answer
1  
Noce that he didn't say "as root" on his question –  chmeee Apr 25 '10 at 10:06
add comment

No. If I recall correctly there is some kernel level thing that chroot does that prevents it. I don't recall what that thing was. I investigated it back when messing with Gentoo's Catalyst Build tool (and a chroot on gentoo is the same as a chroot on ubuntu). Though it would be possible to make it happen without a passwd... but such things are left to the realm of potential security vulnerabilities and making sure you know what you are doing.

share|improve this answer
add comment

There was also more related discussion at How to “jail” a process without being root? with more working or tentative approaches to solving this task listed.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.