15

I read this tutorial - https://help.ubuntu.com/community/BasicChroot - and what I understood is that, chroot is the process of changing the / while the new restricted environment created is the "jail". But some people say I am wrong and chroot and jails are 2 completely different things.

Can someone actually explain me the difference in simple terms ?

HopelessN00b
  • 53,385
  • 32
  • 133
  • 208
user1437328
  • 251
  • 1
  • 2
  • 5
  • 1
    Another option could be a restricted shell instead of chroot. It may be less secure tho. – ott-- Apr 14 '13 at 20:06

4 Answers4

7

The short answer is "You're both correct" --

A chroot'ed environment is often called a "chroot jail". It basically restricts the view of a set of processes so they think that the specified directory is the filesystem root.

This should not be confused with FreeBSD's jail functionality, which is a chroot on steroids (with lots of additional functionality that provides more isolation than a simple chroot would).


For the sake of clarity it's best to refer to chrooted environments as "chrooted environment" (or use the full phrase "chroot jail") to distinguish them - especially when talking about a FreeBSD system.

voretaq7
  • 79,345
  • 17
  • 128
  • 213
5

Jail term comes from FreeBSD world and refers to more strict way of limiting user access to the system, altough chroot exists in FreeBSD as a separate mechanism. It is something like (sorted by the level of separation):

Chroot < OS-level virtualization: (FreeBSD's Jail ≤ Linux OpenVZ) < Paravirtualization: XEN

poige
  • 9,171
  • 2
  • 24
  • 50
Andrei Mikhaltsov
  • 2,987
  • 1
  • 22
  • 31
4

I would say that "jail" is a general term while "chroot" is not. chroot is just one of several possibilities to limit a process's accesses. I have never heard of "jail" in another context though. You may use AppArmor, SELinux and the like to reach similar results but "AppArmor jail" seems to be an uncommon term. On the other hand security is not the only reason for using chroot. Though the effect may be the same it may make little sense to speak of a "chroot jail" in certain situations when the aim is not security but a special configuration for a certain process.

Hauke Laging
  • 5,157
  • 2
  • 23
  • 40
1

"chroot" says "Start the filesystem root here" and has applications beyond a "jail", e.g. accessing/repair a broken OS from a LiveCD; it also happens to be "the way to do a jail in Linux".

Andrew
  • 7,772
  • 3
  • 34
  • 43