Unverified50% confidenceFactExact time
chroot only changes a process's perception of the root directory; a process with CAP_SYS_CHROOT capability can escape back to the host filesystem, making it unsafe to use alone.
1
Sources
50%
Confidence
Long-term
Relevance
10/5/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedThe chroot mechanism in Unix systems restricts the scope of file system access by changing a process's root directory, and is one of the earliest sandbox prototypes.65% similarVerifiedSandbox technology confines the execution of untrusted code to a controlled environment through means such as process isolation, file system isolation, and network isolation.58% similarUnverifiedmacOS SIP（系统完整性保护）机制自 macOS El Capitan（10.11）引入，通过内核级强制访问控制使普通进程即便拥有 root 权限也无法修改受保护路径58% similarUnverifiedEnabling dangerous-class access bypasses file isolation, and isolation, auditing, and permission control must be handled by the user before running untrusted code58% similarUnverifiedseccomp是Linux内核提供的安全机制，允许进程声明只使用哪些系统调用，内核会拒绝所有未声明的系统调用57% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/977467API
curl https://kongchang.com/api/v1/knowledge/claims/977467MCP
get_claim(id=977467)