Arch Linux

_Mike_

Member

Registered: 2005-03-09

Posts: 30

About chroot jails and ACL

I want to run rtorrent in a chroot jail. Correct me if wrong, but jailing rtorrent would consume much more RAM cause rtorrent will not use libraries that it needs and may be already in memory.
So I wonder, why people just don't create a new user, install ACL, block everything to that user but read access to /lib and some config files, and execute permission to only the needed binaries. It would be easy to do since as I understand if you block all /bin permissions to the restricted user, all future files there will inherit those permissions. The only problem I see is that if you update, you will have to set some permissions again, easily fixed with a script. ACL seems much more easier to setup than chroot jails!

When you run rtorrent under that restricted user, even if rtorrent is exploited, the attacker will not be able to do much, as ACL will not let him execute but basic commands.

So, why is it that people seem to prefer chroot jails? Does installing ACL has some kind of performance penalty?

jnguyen

Member

Registered: 2011-02-17

Posts: 139

Website

Re: About chroot jails and ACL

Does installing ACL has some kind of performance penalty?

Do you mean Mandatory Access Control? Filesystem ACL is already installed on every Linux system.

When you run rtorrent under that restricted user, even if rtorrent is exploited, the attacker will not be able to do much, as ACL will not let him execute but basic commands.

Chroot jails were not created to be used as a security tool and are very easy to break out of. Filesystem ACL is very limited in scope and also provides little security.

You might want to look into using Mandatory Access Control (MAC) which is available with TOMOYO Linux, AppArmor, SELinux or SMACK. SELinux is the most powerful, but will take a long time to master. TOMOYO Linux is easier to use and the relevant packages are already in [community]. See the wiki page for more information.

All MAC implementations have a small degree of performance penalty. SELinux probably has the greatest penalty, but overall you probably won't notice anything with any of the implementations.

Last edited by jnguyen (2011-04-13 06:48:36)

---

TOMOYO Linux: Mandatory Access Control.
My AUR packages

_Mike_

Member

Registered: 2005-03-09

Posts: 30

Re: About chroot jails and ACL

By ACL I mean this http://www.suse.de/~agruen/acl/linux-acls/online/

I think that you may be wrong in that it is easy to escape a chroot jail. It says so in many pages because they suppose you run the vulnerable program inside the jail as root. If you set the jail right, I doubt it's easy to escape.

I do know AppArmor and SELinux, they will secure rtorrent and I would still be thinking if I could secure it with ACLs and why people seem to prefer chroot jails.