On a Debian based system...

I have created a minimal chroot/jail using a script similar to the one at https://github.com/pmenhart/make_chroot_jail/blob/master/make_chroot_jail.sh with the goal of creating a jail that can basically do nothing other than run desired programs (for security). My question is, once the jail has been set up, what is considered the best method to install programs into the jail? Since the jail is minimal, there is no package manager such as apt and there is no build tools.

Would I have to install the program into a normal account and copy all required files to the chroot directory? If so, how would I keep track of all of the changes that were made to know what I need to do? A small program such as rkhunter I can easily keep track of, but a larger one such as MySQL I would not be able to as there'd be too many files to copy and config files to modify.

Alternatively, is there a way of installing a minimal package manager, such as apt, into the jail, install the required program, and finally remove the package manager?

Is there a better way of doing this that I don't know about?


Before anybody suggests otherwise:

  • I know about the additional burden of maintaining multiple chroot installs
  • I know it doesn't add as much security as you would hope as an improperly configured chroot can be broken out of. Containers are probably a better alternative.
  • I know that some programs already have chroot-like functionality inbuilt but I want to know a generic method of installing a program.
  1. There are multiple ways to setup chroot jails. Personally I've seen over 50 different scripts for that. All jails are similar, but have smaller or bigger differences, so there is no generic way to do anything inside them.

  2. The most common usage of chroot jails regarding installing software, is installing everything from source. Sometimes chroot jails are used especially to install software from source, avoiding dependiences installed on local machine from packages (eg. zlib, libpng or other common libraries).

  3. What is unfortunately common between many different chroot jail scripts, is that they don't have any "upgrade mode", so each time you want to upgrade your base system software packages, or software inside jail, you have to setup this jail again. This of course can be scripted, but this differs from normal package upgrading.

  4. Search for OpenVZ or LXC paravirtualization technologies. Both of them are used to create "containers" (separate systems with shared kernel). Both are based on chroot concept, but with added separation on many other layers inside kernel.

LXC is newer and more modern, however OpenVZ provides much better security isolation. And in both of them you can install almost complete system, with package manager, libraries from packages etc., so you can normally install and upgrade software, just like in your base system.

  • I was hoping to avoid containers since I didn't need to go that far, but it seems like it's the best option to take. Thanks for the information, Tomasz :) – Phil Jul 16 '15 at 21:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.