Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Assume you have a chroot environment where you need a resource - an application or a library - which resides on the host (external to the chroot).

Which are the security implications (if any) of performing a mount --bind (from the host to the chroot) on that resource rather than installing it on the chroot - i.e. via an apt-get install -?

share|improve this question
up vote 2 down vote accepted

As I see it both a mount --bind of a directory and a hard link of a file share the same security problem: files in the chroot end up being the same (that is, pointing to the same inode) than files outside the chroot. So if the chroot user finds a way to modify these files inside the chroot they've essentially found a way to modify your files.

This may or may not be a serious security issue depending on the environment you're setting up, but you have to take it into account when making this choice.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.