I always used to keep my bind9 installation in a chroot jail. Now I upgraded my vServer and have to install bind9 over again. Due to the virtualization solution my hosting provider uses, I cannot create devices (
/jail/dev/null) myself, and my hosting provider charges 20€ for it.
To quote Adrian Bunk,
Incompetent people implementing security solutions are a real problem. Chroot is not and never has been a security tool. People have built things based upon the properties of chroot but extended (BSD jails, Linux vserver) but they are quite different.
As far as I've understood this discussion, running software as root in a chroot is worthless, as the root user can always escape the jail. But if I run it as an unprivileged user, it should still provide additional security, correct?
To sum up, is it worth 20€ to put bind9 in a chroot jail?