Are there any differences between mounting a /proc filesystem inside a chroot compared to mounting it from the outside

chrootfilesystemsSecurity

Compare the following:

mount -t proc none ./my_chroot/proc

and:

chroot ./mychroot mount -t proc none /proc

Best Answer

There are no differences with respect to the underlying kernel state.

There is a minor difference with respect to the operation of the mount command: it keeps track of its actions in /etc/mtab, so running mount under chroot will update a different mtab file.

You could also use mount --bind /proc ./my_chroot/proc. As far as I know, there is no practical difference between that and mount -t proc none ./mychroot/proc: you can mount the proc filesystem as many times as you like, and mount options are ignored. mount --bind will prevent you from unmounting the filesystem on /proc outside the chroot, but that should never happen anyway.

As an aside, I would recommend mount -t proc proc …/proc because seeing proc in the device field in a mtab or in /proc/mounts is clearer than seeing none.

Related Question