4 ms·
chroot is a layer in the security onion. Like every other layer it adds security but isn't perfect. Security will never be 100%. If you want more security, t
by nickcw 7y ago
chroot is a layer in the security onion.
Like every other layer it adds security but isn't perfect. Security will never be 100%. If you want more security, then likely you want another layer in the onion.
- cyphar 7y agoYes, but pivot_root(2) is a far more robust and secure way of doing the same thing. There really is no reason to use chroot(2) instead of pivot_root(2) (unless you are running code on initramfs -- and even then you should do the tmpfs trick that everyone else uses).
- weinzierl 7y ago> There really is no reason to use chroot(2) You mentioned intiramfs yourself, but there are other uses of chroot where security doesn't play a role. Deterministic build environments are an example.