jk_chrootlaunch(8)

okay so bestie, you've stumbled into the manual page for jk_chrootlaunch(8) and honestly? it's giving small utility, big responsibility. ✨ Stay with me, it's not long and it's lowkey iconic. 🦋

---

✨ NAME ✨

jk_chrootlaunch — a launcher that can start a daemon in a jail, with a specified uid and gid 💅

---

🎀 SYNOPSIS 🎀

jk_chrootlaunch [-h] [-p pidfile ] [-u user] [-g group] -j jaildir -x
executable -- [executable options]

jk_chrootlaunch [--help] [--pidfile= pidfile ] [--user user] [--group
group] --jail jaildir --exec executable -- [executable options]

two ways to say the exact same thing, pick whichever one your fingers vibe with — short flags or long flags, both slay. 🌈

psst, notice how the synopsis shows -h / --help and -p pidfile / --pidfile=pidfile? that's literally all this page tells you about them, iykyk 🙈

---

🌸 DESCRIPTION 🌸

So here's the whole vibe: this launcher starts some other process inside a jail. That process is usually a daemon that can't do chroot(2) on its own — tragic, honestly. 😭 And if you want, you can start that process as a certain user ID or group ID. You can also, optionally, have this utility write a pidfile somewhere. Cute, right? 🎀

Now the part where you need to pay attention, bestie. This utility has to make the chroot(2) call itself to jail the process, which means the only useful way to start it is as user root. And here's the tea: because root privileges let you break out of a jail, it's recommended you start the daemon as some other user and group with the --user and --group options. 💅

⚠️ If you can't drop privileges — say the daemon genuinely needs root, like to open a port below 1024 — then the jail can perhaps delay a hacker, but it cannot prevent it. Not a vibe. Not a slay. Just facts. 💀

Also, there are several daemons that should not be started by jk_chrootlaunch, and I need you to hear me on this:

• Every daemon that does a chroot(2) itself — for example jk_socketd, postfix and openvpn — can do it themselves much better. Let them cook. 🔥
• Daemons that need access to files on the real system (for example the samba smbd daemon) can also not be jailed — unless you can move all those files into the jail and do not need them on the real system. 🌈

---

💅 OPTIONS 💅

• -j, --jail — the directory to jail the process in 🏠
• -u, --user — the name or uid of the user to start the process as 👤
• -g, --group — the name or gid of the group to start the process as 👥
• -x, --exec — the executable to start 🚀
• -- — any options after the -- are passed to the executable 🫶

---

⭐ EXAMPLE ⭐

Okay so picture this: you want to start Apache inside a jail. 🧚

Apache needs root privileges because it needs to open TCP port 80. But — and this is the main character moment — after opening port 80 it will start subprocesses as a regular user (for example user www-data). Which means those subprocesses cannot break out of the jail. 👑

Apache can also write its own pidfile, so we also don't need that option. Slay.

Step one: create the jail using jk_init(8). The apachectl program is a shell script, so it also needs /bin/sh and /usr/bin/kill. We also have to copy these into the jail using jk_cp(8). Apache also needs its modules from /usr/lib/apache — copy those as well. Then we can start Apache:

jk_chrootlaunch -j /home/webjail -x /home/webjail/usr/sbin/apachectl -- start

There are some smarter ways to do this, ngl. You can remove the /bin/sh and /bin/kill executables from the jail if you edit the apachectl script, and add jk_chrootlaunch to the script itself. 🌟

---

🩺 DIAGNOSTICS 🩺

jk_chrootlaunch logs errors to syslog, so check your log files. 👀 On most systems this:

grep jk_ /var/log/*

will give you the information you need. Fr fr. 💖

---

👀 SEE ALSO 👀

• jailkit(8)
• jk_check(8)
• jk_chrootlaunch(8)
• jk_chrootsh(8)
• jk_cp(8)
• jk_init(8)
• jk_jailuser(8)
• jk_list(8)
• jk_lsh(8)
• jk_procmailwrapper(8)
• jk_socketd(8)
• jk_uchroot(8)
• jk_update(8)
• chroot(2)

---

📜 COPYRIGHT 📜

Copyright (C) 2003, 2004, 2005, 2006, 2007, 2018 Olivier Sessink

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved.

---

and that's the whole page, bestie — you ate that 💖✨ This one's from JAILKIT, dated 07-02-2010, and yeah, it's still serving. Now go jail something responsibly. 🎀🦋