diff --git a/configure b/configure index ab57a1df5..87278b2aa 100755 --- a/configure +++ b/configure @@ -1384,7 +1384,7 @@ Optional Features: --disable-dbusproxy disable dbus proxy --disable-output disable --output logging --disable-private-lib disable private lib feature - --disable-chroot disable chroot + --enable-chroot disable chroot --disable-network disable network --disable-userns disable user namespace --disable-x11 disable X11 sandboxing support @@ -4302,7 +4302,7 @@ then : enableval=$enable_chroot; fi -if test "x$enable_chroot" != "xno" +if test "x$enable_chroot" == "xyes" then : HAVE_CHROOT="-DHAVE_CHROOT" diff --git a/configure.ac b/configure.ac index d7595be08..f63436132 100644 --- a/configure.ac +++ b/configure.ac @@ -130,8 +130,8 @@ AS_IF([test "x$enable_private_lib" = "xyes"], [ HAVE_CHROOT="" AC_SUBST([HAVE_CHROOT]) AC_ARG_ENABLE([chroot], - [AS_HELP_STRING([--disable-chroot], [disable chroot])]) -AS_IF([test "x$enable_chroot" != "xno"], [ + [AS_HELP_STRING([--enable-chroot], [disable chroot])]) +AS_IF([test "x$enable_chroot" == "xyes"], [ HAVE_CHROOT="-DHAVE_CHROOT" ]) diff --git a/src/firejail/chroot.c b/src/firejail/chroot.c index 5def9aa47..e213a9347 100644 --- a/src/firejail/chroot.c +++ b/src/firejail/chroot.c @@ -266,6 +266,9 @@ void fs_chroot(const char *rootdir) { if (chroot(oroot) < 0) errExit("chroot"); + if (chdir("/")) + errExit("chdir"); + // mount a new proc filesystem if (arg_debug) printf("Mounting /proc filesystem representing the PID namespace\n");