Creating and Using a Chroot Jail in Ubuntu Linux | Part 2

The Filesystem Hierarchy Standard (FHS) is a reference guide that defines the standard directory structure for UNIX-like operating systems, helping users predict where files and directories should be located; key directories include /bin for essential user commands, /etc for system-wide configuration files, /home for user home directories, /lib for shared libraries, /proc for kernel information, /root for the root user's home directory, /sbin for system administrator commands, /tmp for temporary files, /usr for user applications, and /var for variable state data like logs and databases.

This comprehensive overview covers the entire Linux filesystem hierarchy. File system formatting transforms raw disk bytes into organized files with metadata and permissions. Linux is technically GNU/Linux combining GNU core utilities with the Linux kernel. Core directories include /bin for essential commands, /sbin for system recovery, and /lib for shared libraries. System directories encompass /dev treating hardware as files, /etc for configurations, /home for regular users, and /root for the administrator. Runtime directories include /proc for process information, /run for transient data, /srv for server hosting, and /tmp for temporary files cleared at reboot. User-facing directories are /sys for kernel/hardware state, /usr for applications and resources, and /var for variable-size data like logs. The Filesystem Hierarchy Standard (FHS) provides a trailing standard that distributions follow with variations.

The Filesystem Hierarchy Standard (FHS) is a standardized directory structure for Unix-like operating systems that defines specific locations for system files, configurations, user data, and applications, ensuring consistency across different Linux distributions and Unix-based systems.

The Linux Filesystem Hierarchy Standard (FHS) defines a standardized directory structure for Linux distributions, organizing files into key directories such as /bin (essential binaries), /etc (configuration files), /home (user directories), /tmp (temporary files), /usr (user programs), and /var (variable data), while Linux files come in various types including regular files, directories, symbolic links, character devices, and block devices, all accessible through a single hierarchical root directory (/) rather than separate drive letters like Windows.

Linux organizes all files in a unified inverted tree structure called the Filesystem Hierarchy Standard (FHS), where the root directory (/) sits at the top and all files and directories exist beneath it regardless of physical storage location. The filesystem categorizes content into static (configuration files in /etc that persist across reboots) and dynamic (runtime data in /var, /run that changes during operation and is removed at reboot). Key directories include /usr for user programs and libraries, /etc for system configuration, /var for variable data like logs and caches, /home for user data, /root for the superuser's home directory, /boot for boot files, /dev for device files, /proc for process information, and /sys for system information. Modern Linux distributions (RHEL 7+) use symbolic links to consolidate directories like /bin, /sbin, /lib, and /lib64 into /usr equivalents.

Linux executable files use the ELF (Executable and Linkable Format). The 'file' command identifies executable files and their properties, including whether they are 32-bit or 64-bit and which processor architecture they target. Executable files may have no extension. Linux programs typically use shared libraries (dynamic linking) rather than embedding all code directly. The 'ldd' command shows which libraries a program depends on, including libc.so (C library), librt.so (real-time functions), and libmagic.so (file type identification). Libraries are stored in /lib and /usr/lib directories. The 'ldd' command reveals the dependency tree, showing both direct and indirect library dependencies. This modular approach allows multiple programs to share the same library code, reducing memory usage and simplifying updates. Linux programs access kernel functionality through the Linux Gate (glibc), which acts as an interface between user-space programs and the kernel. The 'ldd' command shows that programs depend on 'libc.so.6' and 'ld-linux.so.2'. The Linux Gate is implemented by the kernel itself and provides a standardized interface for system calls. This abstraction layer allows programs to interact with the kernel without needing to know kernel internals, making the system more maintainable and secure.

Shared libraries in Linux are files containing functions, methods, and procedures that can be shared by multiple applications; the dynamic linker ld.so automatically locates and links these libraries when executing programs by searching in a specific order: the LD_LIBRARY_PATH environment variable, the /etc/ld.so.cache file, and then /lib and /usr/lib directories; administrators can add new library directories by editing /etc/ld.so.conf and running ldconfig to update the cache, while ldd displays the libraries required by specific programs.

Dynamic libraries are not shipped with the application but are loaded at runtime. They are created using the shared flag during compilation. On Linux, they have the .so extension with a lib prefix (e.g., libmylib.so). Dynamic libraries allow a single library to be loaded once into memory and shared by multiple applications, and they separate application code from library code so recompilation is not needed when libraries change. Libraries must be placed in a location where the operating system can find them (default: lib folder on Linux). The ldconfig command updates the dynamic library loader. Dynamic libraries can be loaded at compilation time using the -l flag or lazily at runtime using kernel system calls. The ldd command shows which dynamic libraries are linked in an application.

The ldd (list Dynamic dependencies) command in Linux is used to display the shared library dependencies of an executable file, showing three key pieces of information: the library name, its installation path on the system, and its memory address; this tool helps identify missing or mismatched libraries that could prevent a command from running properly, allowing users to troubleshoot and resolve dependency issues by installing the necessary libraries.

Programs require shared libraries that may not be present in the target environment. Using ldd on each binary reveals all required shared libraries. These libraries must be copied to the target file system's library directories. In complex cases with many dependencies, tools like Vim can be used to process ldd output efficiently, recording macros to automate repetitive tasks like copying files and joining lines of text.

Microkernel security relies on process isolation through separate page tables and capability-based access control. Each task has a domain containing pointers to other objects it can access. Domains can form hierarchical trees, allowing tasks to index into other tasks' domains if they have capabilities to those domains. This enables preparing environments for spawning new tasks. The security model is described as 'pretty simple textbook stuff' - a fundamental approach to process isolation in operating systems.

Microkernels minimize trusted computing bases—Minix 3's 6,000-line kernel versus Linux's 6 million lines. Every component runs as a user process with least privilege: no direct I/O access, no privileged instructions, no address space manipulation without authorization. Each server has permission bitmaps restricting which kernel calls it can make and which servers it can communicate with. This isolation ensures that even compromised drivers cannot corrupt kernel memory or affect other components, fundamentally changing how operating system reliability is achieved.

Microkernel architectures enforce communication isolation through need-to-know basis—processes cannot freely communicate; the kernel authorizes each interaction. Low-level kernel calls are controlled by bitmaps, preventing unauthorized process creation. Fixed-length message passing (64 bytes) prevents buffer overflows by eliminating variable-length allocation. The reincarnation server acts as a parent process monitoring all components, periodically pinging each server and driver—if no response, it kills the dead component and starts a new instance. Replacement drivers can be fetched from RAM or disk, and state can be restored. This self-healing capability allows automatic recovery from component failures. Moving all drivers and servers to user mode minimizes the trusted computing base—the minimal code that must be correct for security. Unlike other systems requiring foreign driver code in the kernel, user-mode drivers cannot directly compromise the kernel. Bugs are contained within isolated processes; infinite loops can be detected and restarted without system-wide hangs. Experimental fault injection introduced 800,000 carefully orchestrated faults into drivers—despite frequent crashes, the underlying system remained operational, demonstrating the effectiveness of isolation-based reliability.

The 'Secure by Design' philosophy integrates security into system architecture from the ground up rather than adding it as an afterthought. Research demonstrates that switching from monolithic to microkernel architecture reduces critical vulnerabilities by over 90%, with 29% of vulnerability types disappearing. Kaspersky OS leverages this principle with a microkernel containing under 100,000 lines of code versus Linux's 29 million lines. The three core scientific principles implemented are: (1) Microkernel architecture isolating minimal essential functions; (2) MILS (Multiple Independent Levels of Security) creating separate security domains with individual access policies; (3) FLK (Flex Advanced Security Kernel) providing dedicated monitoring for component interactions. The company follows an evolutionary development path: starting with industrial IoT devices in 2016, moving to automotive applications (Atom project), then targeting general-purpose mobile OS. Products target B2B markets including thin clients, automotive security gateways, industrial automation, and financial sectors. The company operates on a long-term investment model, beginning technology development years before threats emerge, with talent acquisition focusing on identifying promising students early through programs like 'Sabor.'

Magnetite implements three key security mechanisms: (1) Separate services for networking, synchronization primitives, and memory management, reducing privilege escalation risk; (2) Time-bound trust where services don't have long-term access to application capabilities, receiving them only temporarily during specific calls; (3) Bounded data flow where silos are isolated by default, and communication channels are explicitly configured at build time. The root task sets up silos and channels, then tears itself down, making configuration immutable to prevent attackers from modifying system structure during runtime.