Re: chroot useful?

It is important to understand what chroot() is and what it isn't. It is
not a virtualization of the machine. Attempts to use it as such are
quite likely doomed. It is a mechanism to virtualize file name access;
at that, it does quite a good job, and has since shortly after the first
public release in 1979. (That version permitted chroot("..") out of the
subtree.)

Standard UNIX systems do not have a complete virtual environment. There
have been various attempts to add these on, with more or less success.
But it's an area where one should tread cautiously.

                --Steve Bellovin
Received on Nov 13 1997