Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've Debian Squeeze running and setup a chroot environment (/jail) with debootstrap.

As seen in a tutorial, I mounted the following:

proc on /jail/proc type proc (rw)
devpts on /jail/dev/pts type devpts (rw)

Within the jail, i've running an additional sshd on a different port as the "parent" system.

So far, all is working fine and as expected.

But I just noticed, that i am able to change the host IP address from within the jail. Is this a normal behaviour? I tought, that the chrooted environment cannot change things on the "real" system? But after changing ip address and running

/etc/init.d/networking restart

the system was only reachable via the new ip address.

Please can someone explain, why this behaves like it does? Is there a way to prevent this? So that everything within the jail, "stays in the jail"

Thank you very much in advance.

Casper

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

chroots ONLY change the visible root of the filesystem for child-processes of the chroot-ing command. Everything else - sending signals, manipulating the kernel, etc- is unaffected. It quite simple to leave the chroot again, if it is the only security you have in place.

Take a look at LXC, Linux-VServer or OpenVZ for proper containers in Linux, that do protect from more than accidental directory traversals.

share|improve this answer
1  
+1 for OpenVZ. OpenVZ has "virtualized" network so the guest (think of jail) can have different IP address. FreeBSD has jail which is like openvz. Linux chroot != jail (in the sense of freebsd). –  cstamas May 24 '11 at 18:28
    
Correct me if I am wrong. But it's still quit harder to get access to files outside the chroot via a possible exploit in sshd running in a chroot instead of running the sshd without chroot? –  casper May 24 '11 at 20:21
    
@casper: as soon as you're root, you're not confined by the chroot. It MAY be that scripts won't try to escape, but nevertheless the whole box is compromised. –  David Schmitt May 24 '11 at 21:11
    
Usually you only need to mknod the device of the root fs and mount it somwhere. Voila! –  David Schmitt May 24 '11 at 21:11
    
Okay, thank you for the information so far!! What about running sshd as a non-root user within the chroot? Then any concerns? –  casper May 25 '11 at 17:17
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.