Chroot

De Wikipedia, la enciclopedia libre

Un chroot en un sistema operativo Unix es una operación que cambia el directorio raiz, afectando solamente al procerso actual y a sus procesos hijos. "chroot" se refiere a la llamada de sistema chroot(2) o al programa ejecutable chroot(8).

Un programa que se ejecuta en un entorno de directorio raiz cambiado, no puede acceder a archivos fuera de ese directorio. Esto provoca un conveniente entorno seguro para probar programas sospechozos o peligrosos. También es una forma simple de mecanismo de jaula.

En la práctica, hace un chroot es complicado ya que los programas esperan encontrar en lugares predeterminados el espacio de almacenamiento, archivos de configuración, sus bibliotecas de enlace dinámico; entonces para habilitar a los programas que puedan correr dentro de un directorio chroot, se debe incluir también el grupo mínimo de estos archivos, ya que el programa no accede fuera de la jaula.

---

Programs are allowed to carry open file descriptors (for files, pipelines and network connections) into the chroot, which can simplify jail design by making it unnecessary to leave working files inside the chroot directory. This also works as a simple capability system, in which the program is explicitly granted access to resources outside the chroot based on the descriptors it can carry in.

Tabla de contenidos 1 Uses 2 Limitations 3 References 4 See also 5 Enlaces externos

[editar] Uses

Privilege separation 

A chroot can be used as a pre-emptive way of containing a security breach by preventing a would-be attacker from doing any damage or probing the host system with a compromised program. A network file server, for example, can chroot to the directory it is serving files from just after accepting a network connection from a client. A similar approach is used by the Postfix mail transfer agent, which divides its work up into a pipeline of smaller, individually chroot-jailed programs.

Honeypotting 

A chroot directory can be populated so as to simulate a real system running network services. The chroot mechanism can then prevent attackers who do compromise the system from discovering that it is an artificial environment, or from breaking out into the real system.

Testing 

The isolation provided by the chroot mechanism is also useful for testing purposes. A separate copy of the operating system can be installed into the chroot directory as a test environment for software that would otherwise be too risky to deploy on a production system.

Development Isolation

A chroot environment is an effective way of isolating a development project to enforce the use of a specific set of libraries and limit some of the autoconf and similar dependencies against which programs are linked. A developer may have a set of libraries installed on his or her workstation which are used for general purpose computing tasks (such as web browsing, etc) while having the need to work on a project that is targeted for systems that are not intended to have those same libraries installed. By using a chroot "jail" the developer can still use autoconfiguration tools and the normal linking resolution defaults while still controlling exactly which libraries and dependencies become part of any specific project.

Chroot jails are also used by AMD64 Linux users who need to run 32-bit programs like Skype, Picasa and WMV codecs.

[editar] Limitations

Only the root user can perform a chroot. This is intended to prevent users from putting a setuid program inside a specially-crafted chroot jail (for example, with a fake /etc/passwd file) that would fool it into giving out privileges. It also, however, prevents non-root users from using the chroot mechanism to create sandboxes of their own.

The chroot mechanism itself is not entirely secure on all systems. On some systems, chroot contexts do not stack properly; on such a system, if a chrooted program has root privileges, it can perform a second chroot to break out.

Most Unixes are not completely file system-oriented and leave potentially disruptive functionality like networking and process control available through the system call interface to a chrooted program.

The chroot mechanism in itself also does not restrict the use of resources like I/O bandwidth, disk space or CPU time.

A chroot prison is a form of jail implemented on UNIX-like systems using the chroot command. It is a context within which a process can be run with limited access to the file-system.

[editar] References

• FreeBSD chroot(2) and chroot(8) manual pages.

[editar] See also

• List of Unix programs
• Operating system-level virtualization
• Linux-VServer

[editar] Enlaces externos

• Jailkit: A set of utilities to build chroot environments.
• Jail: Another set of utilities to build chroot environments.
• Virtfs: chrooted virtual server administration tool(s)
• Article "Setting up a Chroot Jail for CVS" by Frank Schoep
• Article "Bind-Chroot-Howto (Debian)" by Falko Timme

Plantilla:Unix commands