Need to use chroot

chroot

This question chroot-jail-what-is-it-and-how-do-i-use-it refers to what is and how to use chroot.

What I don't understand is why do I need to use chroot. I understand what it does, but I can't think of a case when I need to use it, given the fact that it is not a security mechanism or a sandbox, as the answer points out "you shouldn't use chroot as a security measure to prevent a program from modifying files outside your simulated filesystem".

Specifically, why does a certain process need to map a sub-directory as the rootfilesystem?

Best Answer

There are a lot of reasons to use a chrooted environment, you can use it to keep different versions of one program, you can use it to simulate an specific environment in order to test some features, to create images of a system different from your main one, etc.

Wikipedia can tell you more about chroot jails and its usages.

From there:

Testing and development: A test environment can be set up in the chroot for software that would otherwise be too risky to deploy on a production system.

Dependency control: Software can be developed, built and tested in a chroot populated only with its expected dependencies. This can prevent some kinds of linkage skew that can result from developers building projects with different sets of program libraries installed.

Compatibility: Legacy software or software using a different ABI must sometimes be run in a chroot because their supporting libraries or data files may otherwise clash in name or linkage with those of the host system.

Recovery: Should a system be rendered unbootable, a chroot can be used to move back into the damaged environment after bootstrapping from an alternate root file system (such as from installation media, or a Live CD).

Privilege separation: Programs are allowed to carry open file descriptors (for files, pipelines and network connections) into the chroot, which can simplify jail design by making it unnecessary to leave working files inside the chroot directory. This also simplifies the common arrangement of running the potentially vulnerable parts of a privileged program in a sandbox, in order to pre-emptively contain a security breach. Note that chroot is not necessarily enough to contain a process with root privileges.

Related Question