4 ms·

I see there's a similar wrapper binary - but apparently you need to both pivot and chroot? https://linux.die.net/man/8/pivot_root https://linux.die.net/man/8/p

• cyphar 7y ago
  The man page is out-dated (and Michael Kerrisk has posted on LKML that he plans to rewrite it). You don't need to do chroot("/") -- that operation makes no sense because there is no semantic difference between chroot("/") and doing nothing (even the kernel can't distinguish the two cases). What you need to do is the following: mkdir newroot/oldroot mount --rbind newroot newroot # if newroot isn't a mountpoint pivot_root newroot oldroot cd / # and now get rid of the old root's mounts mount --make-rslave oldroot umount -lR oldroot At least, approximately. There is a more clever way to do it by doing "pivot_root . ."[1] but posting that here just makes it more confusing. As a complete aside, this is what container runtimes do when switching to the container rootfs -- and is the main reason why --no-pivot-root is incredibly insecure (because it uses chroot). [1]: https://github.com/opencontainers/runc/blob/v1.0.0-rc8/libcontainer/rootfs_linux.go#L700-L757 https://github.com/opencontainers/runc/blob/v1.0.0-rc8/libco...