On a Debian based system...
I have created a minimal chroot/jail using a script similar to the one at https://github.com/pmenhart/make_chroot_jail/blob/master/make_chroot_jail.sh with the goal of creating a jail that can basically do nothing other than run desired programs (for security). My question is, once the jail has been set up, what is considered the best method to install programs into the jail? Since the jail is minimal, there is no package manager such as apt and there is no build tools.
Would I have to install the program into a normal account and copy all required files to the chroot directory? If so, how would I keep track of all of the changes that were made to know what I need to do? A small program such as rkhunter I can easily keep track of, but a larger one such as MySQL I would not be able to as there'd be too many files to copy and config files to modify.
Alternatively, is there a way of installing a minimal package manager, such as apt, into the jail, install the required program, and finally remove the package manager?
Is there a better way of doing this that I don't know about?
Thanks!
Before anybody suggests otherwise:
- I know about the additional burden of maintaining multiple chroot installs
- I know it doesn't add as much security as you would hope as an improperly configured chroot can be broken out of. Containers are probably a better alternative.
- I know that some programs already have chroot-like functionality inbuilt but I want to know a generic method of installing a program.