jk_uchroot(8)

💖 jk_uchroot — the jk_uchroot(8) page, but make it make sense 💖

okay bestie, sit down, hydrate, and let me tell you about jk_uchroot, section 8 of the manual. this one's a little gateway between regular-user life and root life, and honestly? it's giving ✨trust issues but make it secure✨.

---

🌸 NAME 🌸

jk_uchroot — the whole point of her is to let regular users (yes, the normies, the unprivileged, the "i just work here" girlies) get the right to change root into certain directories. no cap. 🎀

---

🦋 SYNOPSIS 🦋

jk_uchroot -j <jail> -x <executable>

that's the vibe. you hand her a jail, you hand her an executable, and she does her little magic. 💅

---

✨ DESCRIPTION ✨

so here's the tea. jk_uchroot exists so that regular users can use the chroot() system call in a safe way. not the chaotic way. the safe way. she's not about to let just anyone wander into any directory like it's an unlocked dorm room. 🙈

she will only grant a chroot into a jail if the configuration file actually lists this user and this jail combination. if your name isn't on the list with that specific jail? it's a no from her. periodt.

and that's not even the whole vibe check. she will also only grant access if the chroot jail is safe. and "safe," in her words, means:

• the jail is owned by uid 0 gid 0
• it is not writable for others
• and that includes the system directories such as /bin, /lib, /dev/, /sbin, and /usr

like, if other people can write to it, that's not a jail, that's a group chat with no admin. absolutely not. 😭

---

👑 the privilege situation (iconic, honestly)

jk_uchroot needs certain elevated privileges to make the chroot(2) system call. therefore, bestie, she is setuid root. main character energy requires a little bit of power, okay?

but — and this is the important part — she will drop her root privileges immediately after making the chroot() system call. she takes what she needs and she lets it go. emotionally mature. we stan. 🫶

and since Jailkit 2.8, jk_uchroot may also use the CAP_SYS_CHROOT capability on systems that support capabilities. on those systems, the setuid bit can be removed. glow-up behavior. ✨

---

🍓 the config example, look at her

[john]
allowed_jails = /srv/johnjail, /srv/commonjail
skip_injail_passwd_check = 1

[group users]
allowed_jails = /srv/commonjail
skip_injail_passwd_check = 1

in the above example, jk_uchroot is configured not to check if the user exists in the /etc/passwd file in the jails. so like, skip_injail_passwd_check = 1 is her little "i'll allow it, don't worry about it" flag. 💜

---

🎀 FILES 🎀

• /etc/jailkit/jk_uchroot.ini — the config file where all the user/jail pairings live. this is her notes app. 📝

---

💀 DIAGNOSTICS 💀

jk_uchroot logs everything to syslog. everything. she is not subtle and she is not secretive. so please, bestie, check the log files. 🔥

logging is sent to the LOG_AUTH facility, with these levels:

• LOG_ERR and LOG_CRIT — for critical errors 😭
• LOG_NOTICE — for non-critical errors 🙈
• LOG_INFO — for normal events 🌈

on most systems, this command right here:

grep jk_ /var/log/*

will give you the information you need. it's giving detective. it's giving "i read the receipts." 💅

---

🌸 SEE ALSO 🌸

jailkit(8) jk_check(8) jk_chrootlaunch(8) jk_chrootsh(8) jk_cp(8) jk_init(8) jk_jailuser(8) jk_list(8) jk_lsh(8) jk_procmailwrapper(8) jk_socketd(8) jk_update(8) chroot(2) syslogd(8)

the whole friend group. go say hi. 🦋

---

💖 COPYRIGHT 💖

Copyright (C) 2003, 2004, 2005, 2006, 2007, 2018 Olivier Sessink

copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved. so like, take her, share her, just keep the credit. it's the least you can do. 🫶

---

and that's the page, bestie. jk_uchroot — grant regular users the right to change root into certain directories, but safely, and with boundaries. iconic behavior only. ⭐

this little sign-off is brought to you by the JAILKIT crew, dated 07-02-2010, and yes, this is the jk_uchroot(8) page. love u, log ur errors, bye 💜