Linux Process Containment - A practical look at chroot and User Mode

Process containment has been used for quite a long time in the computing world for the use of testing beta software and increasing the security of a process. Containing a process, which is commonly known as 'jailing' a process removes a process from the full system and stops activity inside of the container from affecting anything outside the container. There are several jailing tools available but this paper will discuss two tools available as part of all major Linux distributions: chroot and User-mode Linux. This document will explore some of the general ideas of how process containment is performed with chroot and User-mode Linux and how to help ensure that a successful attack on a jailed process does not affect the main system. The benefits of each tool is contrasted and in conclusion is shown that neither tool is best for containing all processes for all environments individually but rather the tools can complement each other to add even more security.