4 ms·

Changes the filesystem root to be inside a certain folder.

• StavrosK 14y ago
  Yeah, so what's the point? If you have a separate user, you can't access other users' files anyway, unless you have root. You can access the system files, but there should be nothing of much interest in there anyway.
  • gvb 14y ago
    You should have only the minimum necessary commands and libraries in your chroot jail which minimizes the attack surface. For instance, I use chroot with rssh to only allow sFTP/scp/rsync and not allowing chroot users to get to a shell prompt. In my chroot /usr/bin, there are only two files (rssh, scp). In my chroot /lib there are only 16 files. Compare to: 1670 in /bin /usr/bin /sbin 50507 in /lib /usr/lib /usr/lib64
    • munin 14y ago
      Unless some of those files are setuid root ... what does it matter? Your chroot jail is still going to have a very rich attack surface - the kernel.
  • jiggy2011 14y ago
    I guess to prevent an application (e.g a web server running as a non root user) from easily reaching outside and running arbitrary shell commands or reading files. For example if you have something horrible like a PHP script that does: echo system($_POST['whatever']) you at least should try and prevent it from doing "ls" and "cat" to start exploring the filesystem.