You should have only the minimum necessary commands and libraries in your chroot jail which minimizes the attack surface. For instance, I use chroot with rssh

You should have only the minimum necessary commands and libraries in your chroot jail which minimizes the attack surface. For instance, I use chroot with rssh to only allow sFTP/scp/rsync and not allowing chroot users to get to a shell prompt. In my chroot /usr/bin, there are only two files (rssh, scp). In my chroot /lib there are only 16 files. Compare to: 1670 in /bin /usr/bin /sbin 50507 in /lib /usr/lib /usr/lib64