Re: [gentoo-hardened] to chroot or not to chroot

[Patrick Grieshaber]

Hi,

there are multiple ways to break out of a chroot-jail (example:
http://www.bpfh.net/simes/computing/chroot-break.html). So don't rely
on chroot's "security".

In my opinion I can't recommend chrooting a apache because:
  - time (chrooting apache costs a lot of time)
  - complexity -> unstable (if you forget to cpy a lib to the chroot  
env apache crashes during usage)
  - obsecurity

If you need a webserver with a good protection you should consider  
using SELinux for example. This is a bit better security. But of  
course - the complexity is far more harder then a chroot...
If SELinux is too much for you, use a virtual machine and secure the  
apache with nice settings, mod_security, php-ids and similiar  
technologies. I think I'd do it like that... just my 2 cents.

sysspoof


> Hello,
> I would like to see some opinions on chrooting -
>
> 1) how big are possible risks of hardened gentoo system compromise,
if apache
> is run normally, therefore a need of chrooting?
>
> 2) suppose I chroot Apache: what chances it still has to harm 
> something in the
> outside OS? My knowledge about various system capabilities, network
etc is
> too little, so enlighten me... And how big is an Apache chroot?
>
> And by the way, how big are the risks for sshd and ntpd to open up
a way into
> the hardened gentoo system? Can that recent ntp glsa be ignored, if
its
> hardened with memory protections?
>
> Jan
>
>