Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 2 down vote favorite

I always used to keep my bind9 installation in a chroot jail. Now I upgraded my vServer and have to install bind9 over again. Due to the virtualization solution my hosting provider uses, I cannot create devices (/jail/dev/random and /jail/dev/null) myself, and my hosting provider charges 20€ for it.

To quote Adrian Bunk,

Incompetent people implementing security solutions are a real problem. Chroot is not and never has been a security tool. People have built things based upon the properties of chroot but extended (BSD jails, Linux vserver) but they are quite different.

As far as I've understood this discussion, running software as root in a chroot is worthless, as the root user can always escape the jail. But if I run it as an unprivileged user, it should still provide additional security, correct?

To sum up, is it worth 20€ to put bind9 in a chroot jail?

share|improve this question
While true that unprivileged users can't escape the chroot; root-elevation exploits are all too common once you've compromised the chrooted process. This was a driving force, and the namesake, of 'jail' technology. – Chris S♦ Sep 2 '11 at 15:35

2 Answers

up vote 2 down vote

Well, lkml discussion is about root user escaping chroot jail and bind never runs in the chroot jail using root privileges. So, an attacker still have to find an exploit to escape chroot jail if he or she compromises the bind process.

share|improve this answer
Thanks for your comment. Your answer is true, but @chris-s is also correct that a serious attacker that could break bind would also be able to gain root privileges. So I'd conclude that the jail is not worth it, as it provides no real security. – Danilo Bargen Sep 2 '11 at 15:55
up vote 0 down vote

Doesn't chroot restrict the attacker's access to a sub-set of the files, making it more difficult to find a privilege escalation bug in the first place? If so, then it could be used as a security tool. Relevant reading: http://www.openbsd.org/faq/faq10.html#httpdchroot

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.