disable by default --chroot feature at compile time;

use ./configure --enable-chroot to enable this feature

configure

@@ -1384,7 +1384,7 @@ Optional Features:
   --disable-dbusproxy     disable dbus proxy
   --disable-output        disable --output logging
   --disable-private-lib   disable private lib feature
-  --disable-chroot        disable chroot
+  --enable-chroot         disable chroot
   --disable-network       disable network
   --disable-userns        disable user namespace
   --disable-x11           disable X11 sandboxing support
@@ -4302,7 +4302,7 @@ then :
   enableval=$enable_chroot;
 fi
 
-if test "x$enable_chroot" != "xno"
+if test "x$enable_chroot" == "xyes"
 then :
 
 	HAVE_CHROOT="-DHAVE_CHROOT"

configure.ac

@@ -130,8 +130,8 @@ AS_IF([test "x$enable_private_lib" = "xyes"], [
 HAVE_CHROOT=""
 AC_SUBST([HAVE_CHROOT])
 AC_ARG_ENABLE([chroot],
-    [AS_HELP_STRING([--disable-chroot], [disable chroot])])
-AS_IF([test "x$enable_chroot" != "xno"], [
+    [AS_HELP_STRING([--enable-chroot], [disable chroot])])
+AS_IF([test "x$enable_chroot" == "xyes"], [
 	HAVE_CHROOT="-DHAVE_CHROOT"
 ])
 

src/firejail/chroot.c

@@ -266,6 +266,9 @@ void fs_chroot(const char *rootdir) {
 	if (chroot(oroot) < 0)
 		errExit("chroot");
 
+	if (chdir("/"))
+		errExit("chdir");
+	
 	// mount a new proc filesystem
 	if (arg_debug)
 		printf("Mounting /proc filesystem representing the PID namespace\n");