Chrooting proxy services

Today there are many process isolation techniques. Most of therm are based on virtualization or containers. And less of them are focus on security... We will use hardened chroot to isolate Internet services.

Kernel options
To create hardened jail we need hardened-sources to be installed (it is wise to use one of hardened profiles). So emerge it:

Then set necessary hardened chroot options:

Chroot
As en example, of building chroot services, take a look at home proxy server. Usual home proxy looks like: +-+                 |  Chrooted sockd  <->  Other Internet applications           | |     ^                                                      |                  |      |                                                      |                  |                                Chrooted          HTTP*      | +--+    |  Chrooted  <->  Chrooted  <->    HAVP    <->    Internet    | | Internet | <-> |    Tor         Privoxy            +          applications  | +--+    |                    ^           libClamAV                    | |                   |                                        |                  |                                                             |                  |                 Chrooted                                    | |                FreshClam                                   | +-+

Best way is write ebuild to do build chroot of the service!!! So generally for chroot tor service Gentoo user want run:

and that is all... But developers don't want support so complicate ebuild. ;) So hire we show example of bash scripts to build chroot and examples of chrooted init scripts for all shown above services.

First of all install services and build binary packages for them:

Then configure all of them, configuration is not a part of this how to... ;)

Next scripts build chroot services even if all executeble file system mounted as readonly and all writeable file system mounted as noexecutable. But you must allow write to / and /usr file system when execute it!

You must manually run build chroot scripts any time when you update or reconfigure the service or update his library!

Reminder
Also you must:
 * proper configure iptables, so only tor service can output packets to Internet;
 * proper setup proxy variables to all you internet applications and torify them;
 * install and proper configure [|some privacy addons] to you browser.