---
name: "jk_chrootlaunch"
section: "8"
platform: "linux"
package: "jailkit"
version: "2.23-2+b1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/jk_chrootlaunch"
---

# jk\_chrootlaunch(8)

a launcher that can start a daemon in a jail, with a specified uid and gid

## NAME

jk\_chrootlaunch - a launcher that can start a daemon in a jail, with a specified uid and gid

## SYNOPSIS

**jk\_chrootlaunch \[-h\] \[-p** *pidfile* **\] \[-u user\] \[-g group\] -j** *jaildir* **-x** *executable* **-- \[executable options\]**

**jk\_chrootlaunch \[--help\] \[--pidfile=** *pidfile* **\] \[--user user\] \[--group group\] --jail** *jaildir* **--exec** *executable* **-- \[executable options\]**

## DESCRIPTION

This launcher can be used to start some other process inside a jail. That process is typically a daemon that cannot do  **[chroot(2)](/chroot/2.md)** itself. The process can optionally be started with a certain user ID or group ID. Optionally this utility can write a pidfile to some location.

This utility needs to make the  **[chroot(2)](/chroot/2.md)** call to jail the process, therefore it can only be started in a useful way by user root. Because you can break out of a jail with root privileges it is recommended to start the daemon as some other user and group using the --user and --group options. If this is not possible because that daemon needs root privileges as well (for example to open a port below 1024) the jail can perhaps delay a hacker, but it cannot prevent it.

There are several daemons that should not be started by jk\_chrootlaunch. All daemons that do a  **[chroot(2)](/chroot/2.md)** themselves (for example jk\_socketd, postfix and openvpn) can do it themselves much better. Daemons that need access to files on the real system (for example the samba smbd daemon) can also not be jailed, unless you can move all those files into the jail and do not need them on the real system.

## OPTIONS

- **-j --jail**

  the directory to jail the process in

- **-u --user**

  the name or uid of the user to start the process as

- **-g --group**

  the name or gid of the group to start the process as

- **-x --exec**

  the executable to start

- **--**

  any options after the -- are passed to the executable

## EXAMPLE

Suppose you want to start Apache inside a jail. Apache needs root privileges because it needs to open TCP port 80. But after opening port 80 it will start subprocesses as a regular user (for example user www-data). Therefore the subprocesses cannot break out of the jail. Apache can also write it's own pidfile, so we also don't need that option.

First we create the jail using  **[jk\_init(8)](/jk_init/8.md).** The apachectl program is a shell script, it also needs /bin/sh and /usr/bin/kill. We also have to copy these into the jail using  **[jk\_cp(8)](/jk_cp/8.md).** Apache also needs its modules from /usr/lib/apache, copy those as well. Then we can start Apache:

jk\_chrootlaunch -j /home/webjail -x /home/webjail/usr/sbin/apachectl -- start

There are some smarter ways to do this. You can remove the /bin/sh and /bin/kill executables from the jail if you edit the apachectl script, and add jk\_chrootlaunch to the script itself.

## DIAGNOSTICS

jk\_chrootlaunch logs errors to syslog, so check your log files. On most systems the command **grep jk\_ /var/log/\*** will give you the information you need.

## SEE ALSO

**jailkit(8)** **[jk\_check(8)](/jk_check/8.md)** **[jk\_chrootlaunch(8)](/jk_chrootlaunch/8.md)** **[jk\_chrootsh(8)](/jk_chrootsh/8.md)** **[jk\_cp(8)](/jk_cp/8.md)** **[jk\_init(8)](/jk_init/8.md)** **[jk\_jailuser(8)](/jk_jailuser/8.md)** **[jk\_list(8)](/jk_list/8.md)** **[jk\_lsh(8)](/jk_lsh/8.md)** **jk\_procmailwrapper(8)** **[jk\_socketd(8)](/jk_socketd/8.md)** **[jk\_uchroot(8)](/jk_uchroot/8.md)** **[jk\_update(8)](/jk_update/8.md)** **[chroot(2)](/chroot/2.md)**

## COPYRIGHT

Copyright (C) 2003, 2004, 2005, 2006, 2007, 2018 Olivier Sessink

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved.