1.\" Copyright (c) 1988, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. Neither the name of the University nor the names of its contributors 13.\" may be used to endorse or promote products derived from this software 14.\" without specific prior written permission. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26.\" SUCH DAMAGE. 27.\" 28.Dd July 25, 2025 29.Dt CHROOT 8 30.Os 31.Sh NAME 32.Nm chroot 33.Nd change root directory 34.Sh SYNOPSIS 35.Nm 36.Op Fl G Ar group Ns Op Cm \&, Ns Ar group ... 37.Op Fl g Ar group 38.Op Fl u Ar user 39.Op Fl n 40.Ar newroot 41.Op Ar command Op Ar arg ... 42.Sh DESCRIPTION 43The 44.Nm 45utility changes its current and root directories to the supplied directory 46.Ar newroot 47and then exec's 48.Ar command 49with provided arguments, if supplied, 50or an interactive copy of the user's login shell. 51.Pp 52The options are as follows: 53.Bl -tag -width "-G group[,group ...]" 54.It Fl G Ar group Ns Op Cm \&, Ns Ar group ... 55Run the command with the specified groups as supplementary groups. 56.It Fl g Ar group 57Run the command with the specified 58.Ar group 59as the real, effective and saved groups. 60.It Fl u Ar user 61Run the command with the specified 62.Ar user 63as the real, effective and saved users. 64.It Fl n 65Use the 66.Dv PROC_NO_NEW_PRIVS_CTL 67.Xr procctl 2 68command before chrooting, effectively disabling SUID/SGID bits 69for the calling process and its descendants. 70If 71.Dv security.bsd.unprivileged_chroot 72sysctl is set to 1, it will make it possible to chroot without 73superuser privileges. 74.El 75.Sh ENVIRONMENT 76The following environment variable is referenced by 77.Nm : 78.Bl -tag -width "SHELL" 79.It Ev SHELL 80If set, 81the string specified by 82.Ev SHELL 83is interpreted as the name of 84the shell to exec. 85If the variable 86.Ev SHELL 87is not set, 88.Pa /bin/sh 89is used. 90.El 91.Sh EXAMPLES 92.Bl -tag -width 0n 93.It Sy Example 1\&: No Chrooting into a New Root Directory 94.Pp 95The following command opens the 96.Xr csh 1 97shell after chrooting to the standard root directory. 98.Bd -literal -offset 2n 99.Li # Ic chroot / /bin/csh 100.Ed 101.It Sy Example 2\&: No Execution of a Command with a Changed Root Directory 102.Pp 103The following command changes a root directory with 104.Nm 105and then runs 106.Xr ls 1 107to list the contents of 108.Pa /sbin . 109.Bd -literal -offset 2n 110.Li # Ic chroot /tmp/testroot ls /sbin 111.Ed 112.El 113.Sh SEE ALSO 114.Xr chdir 2 , 115.Xr chroot 2 , 116.Xr setgid 2 , 117.Xr setgroups 2 , 118.Xr setuid 2 , 119.Xr getgrnam 3 , 120.Xr environ 7 , 121.Xr jail 8 122.Sh HISTORY 123The 124.Nm 125utility first appeared in 126.At III 127and 128.Bx 4.3 Reno . 129