I hear about needing to chroot BIND all the time. Fair enough. But what about other programs? What are the "rules" (either personal or widely accepted/established) for deciding which programs should be jailed?
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
In general, you might want to use chroot for several reasons:
When the answer isn't 'for security purposes.' See Abusing chroot.
When it was suggested that chroot is frequently used as a security tool, Adrian Bunk retorted, "incompetent people implementing security solutions are a real problem." Alan added, "chroot is not and never has been a security tool. People have built things based upon the properties of chroot but extended (BSD jails, Linux vserver) but they are quite different."
If you have a program that require a set/versions of libraries which is different from what is installed on your system, that would be a good candidate for a "chrooted" install.
chroot is also handy for installing different version of Linux distribution inside their own environment, without using a VM or emulator (Setting up a Debian chroot under Red Hat).
It all depends on how paranoid you are. For most intents and purposes, each service should be chroot-ed for security reasons. However, it may not be feasible to do this for everything as it can get a bit tedious trying to replicate everything. Another possibility to consider for isolation purposes is the use of light-weight virtual machines like OpenVZ/VServer, which are essentially like chroot, only more so.