Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Yeah, so what's the point? If you have a separate user, you can't access other users' files anyway, unless you have root. You can access the system files, but there should be nothing of much interest in there anyway.


You should have only the minimum necessary commands and libraries in your chroot jail which minimizes the attack surface. For instance, I use chroot with rssh to only allow sFTP/scp/rsync and not allowing chroot users to get to a shell prompt.

In my chroot /usr/bin, there are only two files (rssh, scp). In my chroot /lib there are only 16 files.

Compare to:

1670 in /bin /usr/bin /sbin

50507 in /lib /usr/lib /usr/lib64


Unless some of those files are setuid root ... what does it matter? Your chroot jail is still going to have a very rich attack surface - the kernel.


I guess to prevent an application (e.g a web server running as a non root user) from easily reaching outside and running arbitrary shell commands or reading files.

For example if you have something horrible like a PHP script that does: echo system($_POST['whatever']) you at least should try and prevent it from doing "ls" and "cat" to start exploring the filesystem.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: