Linux – Chroot Risks w/ /dev and /proc

chrootdeviceslinuxprocSecurity

I am planning to set up a few chroot jails for some users to run/test Java applications (lets just assume each application is untrusted). Is there any risk involved with mounting /dev and /proc into each jail? If there is, what steps can be taken to get rid of this risk?

Best Answer

Exposing /proc and /dev exposes some more information and grants more rights to the users inside the jail.

Beware that uids and gids may be different inside and outside the jail. For instance, inside the jail, user "x" may be member of group 123, which in the jail is for "users" while on the system is for "disk". By bind-mounting /dev, you would grant them access to raw disk devices which would allow them virtually root access and get out of the jail.

I would not bind-mount /dev. Only create a few devices in there that the java application may need (null, tty, zero...) with the proper ownership and rights.

Have you considered linux containers instead of chroot jails which would isolate them more (lxcs are just a step further to chroot jails).

Related Question