How does the changeroot mechanism work?

chroot changes the root directory of the currently running process and its descendants, isolating them in subdirectories of the filesystem. Processes inside chroot cannot access files or directories above the new root directory. This is achieved by modifying the filesystem structure that the kernel sees for that process. That is, calls to system functions that access files by absolute path (e.g., /usr/bin/ls) are resolved relative to the new root directory.

Applications:

• Process isolation: Creating a sandbox for testing or running untrusted code.
• System recovery: Running a shell in a damaged filesystem using a working instance of another OS.
• Application deployment: Packaging applications with their dependencies to ensure portability.
• Network services: Isolating daemons to limit damage in case of compromise.

Limitations:

• Not complete isolation: A process inside chroot can still influence the system, for example, by using CPU and memory resources, changing kernel settings (if it has the appropriate privileges).
• Dependencies required: Files necessary to run programs inside chroot (executable files, libraries) must be copied into the new root directory.
• Exiting chroot: A process with root privileges can exit chroot using system calls, although this is non-trivial.

Example of usage:

# Creating a directory for chroot
sudo mkdir /my_chroot

# Copying necessary files (example)
sudo cp /bin/bash /my_chroot/bin/
sudo cp /bin/ls /my_chroot/bin/
# Also, libraries that these programs depend on need to be copied

# Changing the root directory
sudo chroot /my_chroot /bin/bash

After executing the last command, the new bash shell will operate inside the /my_chroot directory, and its root directory will be considered /my_chroot. The command ls / inside this bash will show the list of files and directories inside /my_chroot.