On: Is chroot a security feature?

[bluecmd]

I've never seen this advice, would you mind elaborating or citing a more elaborate source?

Since pivot_root requires the old root to be a child of the new root, traversing back to the full system seems trivial. Actually, I don't see why this syscall isn't worse than chroot due to this.

[cyphar → bluecmd]

> Actually, I don't see why this syscall isn't worse than chroot due to this.

You can (and everyone does) unmount the oldroot. Then in your mount namespace the old root is not reachable through the VFS alone. You need to make use of procfs's magic-links or other such tricks.

[ece → bluecmd]

grsec doesn't use pivot_root, you can read into that however much you'd like: https://en.wikipedia.org/wiki/Grsecurity#Chroot_restrictions