View Single Post
  #9   (View Single Post)  
Old 21st March 2009
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
 
Join Date: May 2008
Location: USA
Posts: 7,983
Default

Here's one perspective on naked chroot:
  • The only thing virtualized is the filesystem.
  • Everything else remains exactly the same. This includes the process tree, memory access, and system calls.
  • There are some restrictions on filesystem activity that block the use of features which might allow a surreptitious "breaking out" of the chroot.
Jails add process policy restrictions that either virtualize the chrooted processes, or limit their capabilities. The no-longer-active "sysjail" technique developed for OpenBSD used systrace(4) for this purpose.
Reply With Quote