This tutorial will explain the chroot Linux command using real examples.
The chroot Linux command is a shorthand for “change root”. We use it to change the apparent root directory for a running process and its children. Chroot runs a command with a specified root directory and is executed by the superuser, commonly known as the root user on many Linux systems. In the following paragraphs, we will explain the syntax of the command, describe the options within the command in more detail, and show you real-life examples used daily by Linux system administrators.
Table of Contents
Prerequisites
- A server running Ubuntu 22.04 or any Linux OS (CentOS, Debian, or AlmaLinux)
- User privileges: root or non-root user with sudo privileges
Chroot Linux Syntax
The syntax of the chroot command is the following one:
chroot option newroot [command [args]…]
Chroot changes the root directory to the newroot directory on the server, which must exist. It then changes the working directory to / and finally runs the command with optional arguments. We go over this in more detail in the following paragraphs:
Chroot Linux Options
The chroot command accepts a couple of options:
- –groups=groups: The group option overrides the supplementary group used by the new process. If we want to disable the supplementary group, we need to use –groups=” and separate them by commas.
- –userspec=user[:group]: This option is to run the command with a different user and/or with a different group. If the user is specified, then the groups are set according to the system-defined list for that user.
- –skip-chdir: Using this option will not change the working directory to / after changing the root directory to newroot inside the chroot. Remember that this option is permitted only when the newroot is some old directory on the server.
Chroot Linux Examples
We already mentioned in the previous paragraphs that chroot changes the root directory of the running process with its children. It is good to know, that this modifies the environment of the process and the process can not access the files outside the root directory. This modified directory is called chroot jailed directory.
Let’s proceed with a real example and create a new jailed root directory on our server located in the home directory.
mkdir -p /home/jail/
Once the directory is created, we have to create a couple of directories from the / directory. Let’s first list the content of / directory:
ls -al /
You should receive the following output:
root@host:/# ls -al / total 76 drwxr-xr-x 20 root root 4096 Mar 2 04:13 . drwxr-xr-x 20 root root 4096 Mar 2 04:13 .. lrwxrwxrwx 1 root root 7 Aug 9 2023 bin -> usr/bin drwxr-xr-x 3 root root 4096 Mar 2 04:12 boot dr-xr-xr-x 2 root root 4096 Aug 10 2023 cdrom drwxr-xr-x 19 root root 3960 Mar 2 08:29 dev drwxr-xr-x 107 root root 4096 Mar 2 04:14 etc drwxr-xr-x 2 root root 4096 Jan 16 04:29 home lrwxrwxrwx 1 root root 7 Aug 9 2023 lib -> usr/lib lrwxrwxrwx 1 root root 9 Aug 9 2023 lib32 -> usr/lib32 lrwxrwxrwx 1 root root 9 Aug 9 2023 lib64 -> usr/lib64 lrwxrwxrwx 1 root root 10 Aug 9 2023 libx32 -> usr/libx32 drwx------ 2 root root 16384 Jan 16 04:22 lost+found drwxr-xr-x 2 root root 4096 Aug 9 2023 media drwxr-xr-x 2 root root 4096 Aug 9 2023 mnt drwxr-xr-x 3 root root 4096 Mar 4 08:15 opt dr-xr-xr-x 172 root root 0 Mar 2 08:29 proc drwx------ 6 root root 4096 Mar 4 07:55 root drwxr-xr-x 31 root root 920 Mar 4 08:16 run lrwxrwxrwx 1 root root 8 Aug 9 2023 sbin -> usr/sbin drwxr-xr-x 6 root root 4096 Aug 9 2023 snap drwxr-xr-x 2 root root 4096 Aug 9 2023 srv dr-xr-xr-x 13 root root 0 Mar 2 08:29 sys drwxrwxrwt 13 root root 4096 Mar 4 08:09 tmp drwxr-xr-x 14 root root 4096 Aug 9 2023 usr drwxr-xr-x 14 root root 4096 Mar 2 04:13 var
Now, let’s choose one directory from this list, for example, bin, and create it into the new jailed root:
mkdir -p /home/jail/bin/
After creation, copy bash from /bin to the new jail root /home/jail/bin/
rsync -Waq /bin/bash /home/jail/bin
Next is to copy the required libraries into the /home/jail/. To check those libraries execute the following command:
ldd /bin/bash
Copy them into the /home/jail/lib64/
rsync -Waq /lib/x86_64-linux-gnu/libtinfo.so.6 /lib/x86_64-linux-gnu/libc.so.6 /lib64/ld-linux-x86-64.so.2 /home/jail/lib64
Next is to chroot to the new jailed directory:
chroot /home/jail/ /bin/bash
That’s it. Now, the user sees the /home/jail directory as its root directory. Of course, you do not have to create jailed roots alone. Sign up for one of our NVMe VPS plans and submit a support ticket. Our admins will help you with any aspect of this. Feel free to contact us. We are available 24/7.
PS. If you liked this post about the chroot Linux commands with examples, please share it with your friends on social networks or comment in the comments section. Thank you.