Question

For security reasons, some applications are isolated in a chroot environment. I need to call this applications through a PHP script. Something like that :

exec('chroot /path/to/chroot command')

I need to be root for using chroot. There is a chroot() in the PHP manual but this function also requires root privileges.

So, how to use chrooted commands in PHP?

Answer 1

chroot can only be called by privileged users. Otherwise, normal users could trick setuid applications such as passwd or sudo into accessing files in an unexpected location.

Therefore, if your php application is not running as root, the one thing you can do is set up a setuid wrapper script and call that from php. It should promptly drop privileges after calling chroot, as root can trivially break out of chroots.

Alternatively, you can configure sudo to allow the php user to execute chroot /path/to/chroot command and prepend sudo to the exec call in php.