Which of the following statements is true about chroot environments?

Question

Options

• ASymbolic links to data outside the chroot path are followed, making files and directories accessible
• BHard links to files outside the chroot path are not followed, to increase security
• CThe chroot path needs to contain all data required by the programs running in the chroot
• DPrograms are not able to set a chroot path by using a function call, they have to use the command
• EWhen using the command chroot, the started command is running in its own namespace and

• C
  92% (33)
• D
  3% (1)
• E
  6% (2)

Explanation

Option C is correct because a chroot jail changes the apparent root directory for a process, meaning the process can only see and access the filesystem subtree rooted at the chroot path. For programs to function, every dependency - shared libraries, configuration files, device nodes, etc. - must be present inside that directory.

Why the distractors are wrong:

• A is false: symbolic links using absolute paths are resolved relative to the chroot root, so they cannot escape the jail and reach outside data.
• B is the reverse of reality: hard links are a known weakness of chroot, because they link directly to inodes (not paths), so hard links to outside files placed inside the chroot can be accessible - which is a security concern, not a protection.
• D is false: the chroot() system call exists and allows privileged programs to programmatically change their root directory without using the command-line tool.
• E is false: chroot does not create a new namespace. Namespace isolation (PID, network, mount, etc.) is a separate Linux feature used by containers; chroot only affects filesystem visibility.

Memory tip: Think of chroot as a self-contained box - if you forget to pack something (a library, config file, binary), the program inside the box simply can't find it. The box has walls, but not magic: hard links poke through, and it's not the same as full container isolation.

No community discussion yet for this question.