Re: [PATCH v5 1/1] fs: Allow no_new_privs tasks to call chroot(2)

Askar Safin safinaskar at
Fri Mar 26 23:12:42 UTC 2021

Hi. Unprivileged users already can do chroot. He should simply create userns and then call "chroot" inside. As an LWN commenter noted, you can simply run 
"unshare -r /usr/sbin/chroot some-dir". (I recommend reading all comments: .)

Also: if you need chroot for path resolving only, consider openat2 with RESOLVE_IN_ROOT ( ).

Askar Safin

More information about the Linux-security-module-archive mailing list