Question

I chrooted directory using following commands:

os.chroot("/mydir")

How to return to directory to previous – before chrooting?
Maybe it is possible to unchroot directory?

SOLUTION:

Thanks to Phihag. I found a solution. Simple example:

import os
os.mkdir('/tmp/new_dir')
dir1 = os.open('.', os.O_RDONLY)
dir2 = os.open('/tmp/new_dir', os.O_RDONLY)

os.getcwd()                # we are in 'tmp'
os.chroot('/tmp/new_dir')  # chrooting 'new_dir' directory
os.fchdir(dir2)
os.getcwd()                # we are in chrooted directory, but path is '/'. It's OK.
os.fchdir(dir1)
os.getcwd()                # we came back to not chrooted 'tmp' directory

os.close(dir1)
os.close(dir2)

More info

Answer 1

If you haven’t changed your current working directory, you can simply call

os.chroot('../..') # Add '../' as needed

Of course, this requires the CAP_SYS_CHROOT capability (usually only given to root).

If you have changed your working directory, you can still escape, but it’s harder:

os.mkdir('tmp')
os.chroot('tmp')
os.chdir('../../') # Add '../' as needed
os.chroot('.')

If chroot changes the current working directory, you can get around that by opening the directory, and using fchdir to go back.

Of course, if you intend to go out of a chroot in the course of a normal program (i.e. not a demonstration or security exploit), you should rethink your program. First of all, do you really need to escape the chroot? Why can’t you just copy the required info into it beforehand?

Also, consider using a second process that stays outside of the chroot and answers to the requests of the chrooted one.