On 27/03/2021 00:12, Askar Safin wrote: > Hi. Unprivileged users already can do chroot. He should simply create userns and then call "chroot" inside. As an LWN commenter noted, you can simply run > "unshare -r /usr/sbin/chroot some-dir". (I recommend reading all comments: https://lwn.net/Articles/849125/ .) We know that userns can be use to get the required capability in a new namespace, but this patch is to not require to use this namespace, as explained in the commit message. I already added some comments in the LWN article though. > > Also: if you need chroot for path resolving only, consider openat2 with RESOLVE_IN_ROOT ( https://lwn.net/Articles/796868/ ). openat2 was also discussed in previous versions of this patch.
