jk_chrootsh(8)

✨ jk_chrootsh 💅

okay bestie, so jk_chrootsh is a shell — but like, a shell shell — and its whole thing is that it drops your user inside a changed root. that's the manual for the jk_chrootsh page in the jk_chrootsh section of the jk_chrootsh manual, iykyk. let's get into it 🫶

---

🌸 SYNOPSIS 🌸

jk_chrootsh

that's it. that's the whole vibe. no flags, no args, it just goes 💫

---

🎀 DESCRIPTION 🎀

so jk_chrootsh is meant to be used as the shell for a user — like, the shell field in /etc/passwd, or in your ldap store, wherever you keep your people. when that user logs in, they get put into a changed root. iconic behavior tbh.

where do we put them? we read the user's home directory, and the last occurring /./ sequence in it marks the spot where the changed root lives. the last one, bestie, don't forget. 🙈

an example line in /etc/passwd would look like:

test:x:10000:10000::/home/testchroot/./home/test:/usr/sbin/jk_chrootsh

so in this example the user gets chroot-ed into /home/testchroot. slay. ✨

inside that chroot-ed directory, it looks for /etc/passwd and it will execute the shell for the user from that file. for the example above, the /etc/passwd inside the jail should have an entry like:

test:x:10000:10000::/home/test:/usr/sbin/jk_lsh

heads up: the home directory and the shell are local inside the chroot. so they're not the same paths as outside. it's giving two different worlds. 🌈

now, jk_chrootsh needs certain elevated privileges to make the chroot(2) system call. that's why it's setuid root. but it drops its root privileges immediately after making the chroot() system call — no lingering, we don't do that here 💅. and since Jailkit 2.8, jk_chrootsh may also use the CAP_SYS_CHROOT capability on systems that support capabilities, and then the setuid bit can be removed. glow up fr fr. ⭐

by default jk_chrootsh does not copy any environment variables. nope, none, zero, not a single one. 🙅‍♀️ but for some functionality, environment variables need to be copied — like the TERM variable for a functional terminal emulation, or the DISPLAY variable for X forwarding. in /etc/jailkit/jk_chrootsh.ini you can list the required environment variables. an example config file is shown below. in the example, user bill will get the DISPLAY variable, and all users in group jail will get the TERM and PATH variables.

by default jk_chrootsh requires a home directory owned by the user, with the same group as the primary group from the user, and it requires the home directory to be non-writable for group and others. you can relax these requirements in the configfile, as shown below. 🧚

[DEFAULT]
relax_home_group=1

[bill]
env= DISPLAY
relax_home_owner=1
relax_home_group_permissions=1
relax_home_other_permissions=1

[group jail]
env = TERM, PATH
injail_login_shell=1

okay so here's the plot twist 😭 — if user bill is in group jail, he will not get the TERM variable in the above example. and neither will any user with primary group jail get relaxed requirements for the ownership and the permissions of the home directory. why? because first the user is checked, and only if no user section is found does it look for the primary group section, and if no group section is found, the DEFAULT section is used. the way that precedence works... it's giving strict hierarchy. 👑

normally jk_chrootsh will pass all arguments it is called with to the shell in the jail. but you can force it to call the shell inside the jail with a single argument --login by setting injail_login_shell=1 in the config file. cute, right? 🎀

and jk_chrootsh can be configured to not read the final shell from the /etc/passwd file in the jail. an example configfile is shown below:

[group jail2]
skip_injail_passwd_check=1
injail_shell=/bin/bash

---

🦋 FILES 🦋

• /etc/passwd
• /etc/jailkit/jk_chrootsh.ini

---

💜 DIAGNOSTICS 💜

jk_chrootsh logs everything to syslog, so please check the log files, bestie. logging is sent to the LOG_AUTH facility with levels LOG_ERR and LOG_CRIT for critical errors, LOG_NOTICE for non-critical errors, and LOG_INFO for normal events. on most systems the command:

grep jk_ /var/log/*

will give you the information you need. go look, it's all there. 🔥

commonly made mistakes are:

• forgetting to add the user to JAIL/etc/passwd or the group to JAIL/etc/group
• forgetting to have the correct permissions on all files inside the jail, or forgetting files inside the jail (the shell itself, or any libraries used by the shell)
• referring to a file outside the chroot

these are the classic oopsies. not me doing all three at once 💀

---

🌈 SEE ALSO 🌈

jailkit(8) jk_check(8) jk_chrootlaunch(8) jk_cp(8) jk_init(8) jk_jailuser(8) jk_list(8) jk_lsh(8) jk_procmailwrapper(8) jk_socketd(8) jk_uchroot(8) jk_update(8) chroot(2) syslogd(8)

---

👑 COPYRIGHT 👑

Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013, 2014, 2018 Olivier Sessink

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved.

---

okay and that's the whole page bestie 🫶 this one's from the JAILKIT era, dated 07-02-2010, and it's the jk_chrootsh(8) manual. go forth and chroot responsibly, mwah 💖✨