Chroot for individual users

TheHebes · 2012-03-13 18:14:49

The security advantages to providing each user with a subfilesystem in their home directory that is automatically chrooted'd into at login seems pretty good. Also, it would help prevent "junk" (stuff resulting from installations/ uninstallations, normal system operation, etc.) from building up in important system directories (most importantly, /etc). Are there any shortcomings to such a model?

karol · 2012-03-13 18:34:22

It will probably waste some space + http://en.wikipedia.org/wiki/Chroot#Gra … _on_chroot

TheHebes · 2012-03-14 02:26:30

Well, yes, naturally, it IS after all a separate filesystem
But my real question is if it will cause any other detrimental effects, such as perhaps decreased performance, permissions errors, whatever?

rwd · 2012-03-22 16:52:36

Chroot isn't really a security feature, if you want to use it that way. Separate virtual machines seems like a more straightforward way to isolate users, or just letting them install software in their ~/bin .

hadrons123 · 2012-03-22 17:33:58

When using separate virtual machines, the user shall still have access to the other applications in the host, which itself doesn't mean good security , right?

cfr · 2012-03-23 00:20:47

The user has access to other applications in the sense of being able to run them, you mean? But not in the sense that they can alter those applications or write to /etc, for example, right? Not unless you give them permissions...

If each user has a separate filesystem, do you then rely on each user to keep it up to date? Or do you then need some system to enforce that, as well as updating the main install? And each user will have to build any packages desired from AUR and keep those up to date, as well. And the applications run by users will all be installed as owned by them with their privileges, right? Seems like that would make it easier for an imposter to be installed masquerading as, say, ls. And then it depends on how far the chroot can be relied on...

Just trying to think it through... It sounds very complicated and I always think complicated is dangerous because it is that much harder for a human being to see the obvious...

anrxc · 2012-03-25 20:14:42

> The security advantages to providing each user with a subfilesystem in their
> home directory that is automatically chrooted'd into at login seems pretty good.

Not really they can be breaken out of, look into LXC containers for a more advanced solution building
on top of old chroot solutions http://lxc.sourceforge.net

Arch Linux

#1 2012-03-13 18:14:49

Chroot for individual users

#2 2012-03-13 18:34:22

Re: Chroot for individual users

#3 2012-03-14 02:26:30

Re: Chroot for individual users

#4 2012-03-22 16:52:36

Re: Chroot for individual users

#5 2012-03-22 17:33:58

Re: Chroot for individual users

#6 2012-03-23 00:20:47

Re: Chroot for individual users

#7 2012-03-25 20:14:42

Re: Chroot for individual users

Board footer