Abhishekmishra2808 commented on code in PR #19900:
URL: https://github.com/apache/nuttx/pull/19900#discussion_r3837955262
##########
Documentation/applications/nsh/commands.rst:
##########
@@ -215,6 +215,44 @@ Also sets the previous working directory environment
variable
``cd ..`` sets the current working directory to the parent
directory.
================== =====================================
+.. _cmdchroot:
+
+``chroot`` Change Root Directory
+================================
+
+**Command Syntax**::
+
+ chroot <newroot> [<command> [args...]]
+
+**Synopsis**. Change the filesystem root of the current task group so
+absolute path lookups start at ``<newroot>``. Requires
+``CONFIG_FS_CHROOT``. This is a filesystem jail, not a container.
+
+The command performs ``chdir(newroot)``, ``chroot(".")``, then
+``chdir("/")``. With no extra arguments the current NSH session stays
+jailed (``pwd`` shows ``/``). An optional command is executed with
+``execvp()`` after the jail is in place.
+
+When ``CONFIG_SCHED_USER_IDENTITY`` is enabled, ``chroot()`` requires
+effective UID 0. Drop extra privilege after jailing so a later
+``chroot()`` cannot be used to escape.
+
+File descriptors opened before ``chroot()`` are not retroactively
+contained. The ``chroot <newroot> <command>`` form closes non-stdio
+descriptors that are not already ``O_CLOEXEC`` before ``execvp()``.
+The no-command form leaves the current session's existing descriptors
+usable, including any that point outside the jail.
+
+**Example**::
+
+ nsh> mkdir /tmp/jail
+ nsh> echo hello > /tmp/jail/marker
+ nsh> chroot /tmp/jail
+ nsh> pwd
+ /
Review Comment:
Done
##########
Documentation/implementation/chroot.rst:
##########
@@ -0,0 +1,88 @@
+.. _chroot:
+
+======
+chroot
+======
+
+``chroot()`` is a kernel-enforced filesystem jail. When
+``CONFIG_FS_CHROOT`` is enabled, each task group may pin a directory as
+its root. Absolute path lookup starts there, so the group cannot see
+files outside that tree.
+
+This is **not** a container. NuttX does not provide PID, mount, or
+network namespaces. ``chroot()`` only changes where pathname lookup
+begins.
Review Comment:
Done
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
