Howto properly mount /proc, /run to prevent chroot from being able to see or kill processes belonging to the host

Question

I use a loop in a script to mount --bind special filesystems such as /dev, /dev/pts, /proc, /run, /sys (and /sys/firmware/efi/efivars optionally) this way :

for specialFS in dev dev/pts proc run sys
do
    test -d $destinationRootDir/$specialFS/ || sudo mkdir $destinationRootDir/$specialFS/
    sudo mount -v --bind /$specialFS $destinationRootDir/$specialFS
done
[ -d /sys/firmware/efi ] && sudo mkdir -p $destinationRootDir/sys/firmware/efi/efivars && sudo mount -v --bind /sys/firmware/efi/efivars $destinationRootDir/sys/firmware/efi/efivars

Then I go into the chroot :

sudo chroot $destinationRootDir

mount -a
update-grub
[ -d /sys/firmware/efi ] && grub-install --efi-directory=$(mount | awk '/\/efi /{print$3}') || grub-install $destinationDisk
umount -a
umount /usr && exit

The problem is that /usr cannot be unmounted because the chroot environment thinks /usr is being used by processes that I was able to find running on the host.

So I guess I should NOT use mount --bind for /proc and/or for /run.

Ho can I mount these two properly for my chroot environment to be isolated on the process level ?

Answer 1

chroot wasn't designed as security boundary so you shouldn't use it if you don't trust the code inside jail. Check https://access.redhat.com/blogs/766093/posts/1975883 Additionaly if you expose dev/pts it's big chance that your command is launched outside jail via pseudoterminal. It's hard to guess without exact command and parent pid of that command.