Force change of a user's cwd as root

Question

I'm looking to change a user's process such that I can set it's cwd.

Related, and secondary to the question, I have a filesystem I want to unmount but a user is sitting on it with a bash process. I don't want to kill that user's process but I'd like to gently redirect them to say ... /tmp while I unmount the disk.

I'm root obviously.

Answer 1

There's no way to change a process's working directory from outside of it, root or not. That would be extremely disturbing to the victim process, and there is just no API for it.

Now you could use dirty tricks. One of them is attaching a debugger to your target process, and forcing a chdir on it - see this question on Stack Overflow. Some operating systems might offer other APIs to do such tasks (injecting syscalls in unsuspecting processes).

As for your goal of remounting a filesystem from under someone, that's essentially hopeless, even if you technically manage to hack it - chances are the process will have open file descriptors on the "old" mount, and there is no portable way to correctly re-attach them to files on the "new" mount, even if the corresponding files are still there.
An approach that would seem to work in theory would be to sort of hibernate the processes you want out of the way for that maintenance. But there are a lot of issues with that, especially considering not just plain files but network sockets. (See this other question for some interesting points.)

In short, you're better off with a polite kill (with a grace period), there is no telling what unexpected consequences could arise from playing games with cwd on a random process.

Answer 2

A process is responsible for managing its own current directory. There's no way to change it from the outside.

You can cheat, by making the process change its own directory. If you're running as root, or as the same user as the process, you can use the ptrace system call to do all manner of invasive things on a process, including changing its memory under its nose and performing system calls. This is what debuggers use.

Treat this like an experimental surgical operation. The patient may wake up unscathed or die. This should work if the process doesn't really care what its current directory is. A program that has an intimate relationship with its current directory, such as a shell, is unlikely to survive.

Here's a script I've used in the past to move processes out of hung NFS mounts. Use at your own risk.

#!/bin/sh
if [ $# -ne 2 ]; then
  echo 1>&2 "Usage: $0 PID DIR"
  exit 120
fi
case "$1" in
  *[!0-9]*) echo 1>&2 "Invalid pid \`$1'"; exit 3;;
esac
case "$2" in
  *[\\\"]*)
    echo 1>&2 "Unsupported character in directory name, sorry."
    exit 3;;
esac

gdb -n -pid "$1" -batch -x /dev/stdin <<EOF
call chdir("$2")
detach
quit
EOF