1.\" Copyright (c) 1988, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. Neither the name of the University nor the names of its contributors 13.\" may be used to endorse or promote products derived from this software 14.\" without specific prior written permission. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26.\" SUCH DAMAGE. 27.\" 28.\" @(#)chroot.8 8.1 (Berkeley) 6/9/93 29.\" 30.Dd July 20, 2021 31.Dt CHROOT 8 32.Os 33.Sh NAME 34.Nm chroot 35.Nd change root directory 36.Sh SYNOPSIS 37.Nm 38.Op Fl G Ar group Ns Op Cm \&, Ns Ar group ... 39.Op Fl g Ar group 40.Op Fl u Ar user 41.Op Fl n 42.Ar newroot 43.Op Ar command Op Ar arg ... 44.Sh DESCRIPTION 45The 46.Nm 47utility changes its current and root directories to the supplied directory 48.Ar newroot 49and then exec's 50.Ar command 51with provided arguments, if supplied, 52or an interactive copy of the user's login shell. 53.Pp 54The options are as follows: 55.Bl -tag -width "-G group[,group ...]" 56.It Fl G Ar group Ns Op Cm \&, Ns Ar group ... 57Run the command with the permissions of the specified groups. 58.It Fl g Ar group 59Run the command with the permissions of the specified 60.Ar group . 61.It Fl u Ar user 62Run the command as the 63.Ar user . 64.It Fl n 65Use the 66.Dv PROC_NO_NEW_PRIVS_CTL 67.Xr procctl 2 68command before chrooting, effectively disabling SUID/SGID bits 69for the calling process and its descendants. 70If 71.Dv security.bsd.unprivileged_chroot 72sysctl is set to 1, it will make it possible to chroot without 73superuser privileges. 74.El 75.Sh ENVIRONMENT 76The following environment variable is referenced by 77.Nm : 78.Bl -tag -width "SHELL" 79.It Ev SHELL 80If set, 81the string specified by 82.Ev SHELL 83is interpreted as the name of 84the shell to exec. 85If the variable 86.Ev SHELL 87is not set, 88.Pa /bin/sh 89is used. 90.El 91.Sh EXAMPLES 92.Bl -tag -width 0n 93.It Sy Example 1\&: No Chrooting into a New Root Directory 94.Pp 95The following command opens the 96.Xr csh 1 97shell after chrooting to the standard root directory. 98.Bd -literal -offset 2n 99.Li # Ic chroot / /bin/csh 100.Ed 101.It Sy Example 2\&: No Execution of a Command with a Changed Root Directory 102.Pp 103The following command changes a root directory with 104.Nm 105and then runs 106.Xr ls 1 107to list the contents of 108.Pa /sbin . 109.Bd -literal -offset 2n 110.Li # Ic chroot /tmp/testroot ls /sbin 111.Ed 112.El 113.Sh SEE ALSO 114.Xr chdir 2 , 115.Xr chroot 2 , 116.Xr setgid 2 , 117.Xr setgroups 2 , 118.Xr setuid 2 , 119.Xr getgrnam 3 , 120.Xr environ 7 , 121.Xr jail 8 122.Sh HISTORY 123The 124.Nm 125utility first appeared in 126.At III 127and 128.Bx 4.3 Reno . 129