One of the problems using chroots is getting all the binaries and libraries installed.
It just occurred to me that there might be another way. The TSocks project uses a technique they call "shared library interceptor" to intercept system calls from a .so that is dynamically loaded into arbitrary executables.
Wouldn't it be possible to make a shared library which chroots (and drops root priveleges) right before the entry point of main()? Then, you'd be able to have chroot functionality in any program on your system without setting up any special tree of files (with the possible exception of still needing a copy of some dev nodes).
Has anyone done this already? (can't find any on Google yet).
Does someone know what syscall could be hooked that happens right before main()?