Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I read this tutorial - https://help.ubuntu.com/community/BasicChroot - and what I understood is that, chroot is the process of changing the / while the new restricted environment created is the "jail". But some people say I am wrong and chroot and jails are 2 completely different things.

Can someone actually explain me the difference in simple terms ?

share|improve this question
1  
Another option could be a restricted shell instead of chroot. It may be less secure tho. –  ott-- Apr 14 '13 at 20:06
add comment

4 Answers 4

Jail term comes from FreeBSD world and refers to more strict way of limiting user access to the system, altough chroot exists in FreeBSD as a separate mechanism. It is something like (sorted by the level of separation):

Chroot < OS-level virtualization: (FreeBSD's Jail ≤ Linux OpenVZ) < Paravirtualization: XEN

share|improve this answer
add comment

I would say that "jail" is a general term while "chroot" is not. chroot is just one of several possibilities to limit a process's accesses. I have never heard of "jail" in another context though. You may use AppArmor, SELinux and the like to reach similar results but "AppArmor jail" seems to be an uncommon term. On the other hand security is not the only reason for using chroot. Though the effect may be the same it may make little sense to speak of a "chroot jail" in certain situations when the aim is not security but a special configuration for a certain process.

share|improve this answer
add comment

"chroot" says "Start the filesystem root here" and has applications beyond a "jail", e.g. accessing/repair a broken OS from a LiveCD; it also happens to be "the way to do a jail in Linux".

share|improve this answer
add comment

The short answer is "You're both correct" --

A chroot'ed environment is often called a "chroot jail". It basically restricts the view of a set of processes so they think that the specified directory is the filesystem root.

This should not be confused with FreeBSD's jail functionality, which is a chroot on steroids (with lots of additional functionality that provides more isolation than a simple chroot would).


For the sake of clarity it's best to refer to chrooted environments as "chrooted environment" (or use the full phrase "chroot jail") to distinguish them - especially when talking about a FreeBSD system.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.