Is there a way to tell if a process is chrooted?

Question

I am still new to understanding chroot. Some packages install their own users (_packagedaemon) and create their own directories (/var/package/).

However, I cannot tell if the process is configured to run in a chroot, and I'm not sure where to check.

Answer 1

fstat will indicate where a (running) process is rooted.

Example 1: nginx

nginx's workers run chrooted. You can use pgrep get the process' ID:

# pgrep -lf nginx
58845 nginx: worker process
41019 nginx: master process /usr/local/sbin/nginx

and then use fstat to check which files/sockets it has open:

# fstat -p 58845 | grep -e MODE -e " root"
USER     CMD          PID   FD MOUNT        INUM  MODE         R/W    SZ|DV
www      nginx      58845 root /var/www        2  drwxr-xr-x     r      512

This line, the one with root in the FD column, indicates that the process is rooted on inode 2 (INUM column) of mount point /var/www. You can then find out that node's name using find:

# find -x /var/www -inum 2
/var/www

So, in this case, nginx's workers are chrooted to /var/www. Note that the master process doesn't run chrooted:

# fstat -p 41019 | grep " root"

comes up empty. The master process reads all config files and then forks chrooted workers.

Example 2: nsd

nsd is a bit different from nginx, as even the main process runs chrooted in /var/nsd:

# pgrep -lf nsd
28155 nsd: server 1
45373 nsd: main
3681 nsd: xfrd

# fstat -p 45373 | grep -e MODE -e " root"
USER     CMD          PID   FD MOUNT        INUM  MODE         R/W    SZ|DV
_nsd     nsd        45373 root /var         8580  drwxr-xr-x     r      512

# find -x /var -inum 8580
/var/nsd