pivot_root tips — authorized root-pivot literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may run pivot_root on the lab host (syllabus box you own; typically needs CAP_SYS_ADMIN inside a mount namespace).
2. Prefer documenting who / why / ticket before any root pivot — never pivot production without change control.
3. Record short factual notes; quote short Evidence (new_root/put_old labels — never secrets or foreign rootfs dumps).
4. Optional: classic root-change peer → chroot-tips.
5. Optional: namespace peer → unshare-tips / nsenter-tips.
6. Prefer disposable lab mount trees for pivot_root drills; quote non-secret new_root/put_old labels afterward as Evidence.
7. Prefer syllabus-approved mount namespaces and put_old directories — refuse escape/jailbreak cookbooks.
8. Stop at literacy — no attack, jailbreak, or unauthorized escape cookbooks.

Allowed framing

• Classroom labs reviewing pivot_root new_root put_old on authorized disposable mount namespaces.
• Binding short factual notes as Evidence (new_root/put_old — no secrets).
• Documenting expected vs observed root-pivot behaviour for authorized inventory notes.
• Comparing pivot_root ↔ chroot / unshare / nsenter / bubblewrap peer tip pages under one binder.
• Preferring modern namespace + bubblewrap peers when the syllabus offers them instead of classic pivot alone.

Scope we will not cover

• No crack/pirate/keygen via pivot_root.
• No intentional unauthorized pivot or escape against foreign hosts.
• No jailbreak / breakout / container-escape cookbooks.
• No secret-theft or rootfs credential harvesting against hosts you do not own.
• No cookbooks that weaken pivot isolation without authorization.

Beginner path (authorized only)

1. Obtain one syllabus-approved disposable lab host with a prepared lab mount namespace and put_old directory.
2. Prefer a throwaway lab mount tree before any pivot drill.
3. With authorization, run a syllabus-approved pivot_root on that lab tree; quote non-secret new_root/put_old labels as Evidence.
4. Optional: prefer unshare-tips / bubblewrap-tips when the syllabus offers modern peers.
5. Stop at literacy — no jailbreak or unauthorized escape cookbooks.

Practical notes for authorized labs

• pivot_root swaps the root mount — keep Evidence labels distinct from chroot-tips classic root-change drills.
• Classic pivot_root is typically used inside a mount namespace — document that honesty; prefer namespace peers when the syllabus allows.
• Root trees may embed sensitive configs — never paste secrets into notes or git.
• Prefer documenting new_root/put_old labels the syllabus authorized without dumping full privileged inspect JSON.
• Never commit pivot_root rootfs dumps with secrets to git — even for labs.

FAQ-aligned refusals (quick)

• Foreign-host pivot / escape drills → refuse.
• Jailbreak / breakout / container-escape cookbooks → refuse.
• Attack/credential-theft framing → refuse.

For legal, authorized and educational use only.

FAQ

Sources