2 ms·
The man page is out-dated (and Michael Kerrisk has posted on LKML that he plans to rewrite it). You don't need to do chroot("/") -- that operation makes no sens
by cyphar 7y ago
The man page is out-dated (and Michael Kerrisk has posted on LKML that he plans to rewrite it). You don't need to do chroot("/") -- that operation makes no sense because there is no semantic difference between chroot("/") and doing nothing (even the kernel can't distinguish the two cases).
What you need to do is the following:
mkdir newroot/oldroot
mount --rbind newroot newroot # if newroot isn't a mountpoint
pivot_root newroot oldroot
cd /
# and now get rid of the old root's mounts
mount --make-rslave oldroot
umount -lR oldroot
At least, approximately. There is a more clever way to do it by doing "pivot_root . ."[1] but posting that here just makes it more confusing. As a complete aside, this is what container runtimes do when switching to the container rootfs -- and is the main reason why --no-pivot-root is incredibly insecure (because it uses chroot).
[1]: https://github.com/opencontainers/runc/blob/v1.0.0-rc8/libcontainer/rootfs_linux.go#L700-L757 https://github.com/opencontainers/runc/blob/v1.0.0-rc8/libco...