security_path_chroot(9)

🎀 NAME 🎀

okay so welcome to the security_path_chroot(9) page, part of the Kernel API Manual (yes that's the whole manual name, we're fancy now 💅). This one is short and sweet:

security_path_chroot — checks if changing the root directory is allowed. that's it. that's the function. she's a vibe check for chroot, basically 🦋

---

✨ SYNOPSIS ✨

int security_path_chroot (const struct path *path );

literally one line, copy it exactly bestie, spacing and all — the space before that closing paren is part of the fit and we do not touch it 🙈

---

🫶 ARGUMENTS 🫶

• path — a directory. the directory in question. the one we're being nosy about 👀

---

🌸 DESCRIPTION 🌸

check for permission to change root directory.

that's the whole description. no cap, that's it. this function is the one asking "hey, are we allowed to swap the root dir or nah?" and the LSM hooks get to weigh in 🧚

---

⭐ RETURN ⭐

returns 0 if permission is granted. zero means yes, go off, root is root 👑

reminder bestie: the docs here only promise the 0 case, so don't go inventing meanings for other values out of thin air 💀

---

🔥 SEE ALSO 🔥

the kernel file ./security/security.c, and then... the entire extended squad 😭 like genuinely hold my iced coffee, this is the full list, copied character for character because we do not drop references in this house:

       lsm_file_alloc(9),
       lsm_backing_file_alloc(9), lsm_blob_alloc(9), lsm_cred_alloc(9),
       lsm_inode_alloc(9), lsm_task_alloc(9), lsm_ipc_alloc(9),
       lsm_key_alloc(9), lsm_msg_msg_alloc(9), lsm_bdev_alloc(9),
       lsm_bpf_map_alloc(9), lsm_bpf_prog_alloc(9), lsm_bpf_token_alloc(9),
       lsm_superblock_alloc(9), lsm_fill_user_ctx(9),
       security_binder_set_context_mgr(9), security_binder_transaction(9),
       security_binder_transfer_binder(9), security_binder_transfer_file(9),
       security_ptrace_access_check(9), security_ptrace_traceme(9),
       security_capget(9), security_capset(9), security_capable(9),
       security_quotactl(9), security_quota_on(9), security_syslog(9),
       security_settime64(9), security_vm_enough_memory_mm(9),
       security_bprm_creds_for_exec(9), security_bprm_creds_from_file(9),
       security_bprm_check(9), security_bprm_committing_creds(9),
       security_bprm_committed_creds(9), security_fs_context_submount(9),
       security_fs_context_dup(9), security_fs_context_parse_param(9),
       security_sb_alloc(9), security_sb_delete(9), security_sb_free(9),
       security_free_mnt_opts(9), security_sb_eat_lsm_opts(9),
       security_sb_mnt_opts_compat(9), security_sb_remount(9),
       security_sb_kern_mount(9), security_sb_show_options(9),
       security_sb_statfs(9), security_sb_mount(9), security_sb_umount(9),
       security_sb_pivotroot(9), security_sb_set_mnt_opts(9),
       security_sb_clone_mnt_opts(9), security_move_mount(9),
       security_path_notify(9), security_inode_alloc(9),
       security_inode_free(9), security_dentry_init_security(9),
       security_dentry_create_files_as(9), security_inode_init_security(9),
       security_inode_init_security_anon(9), security_path_mknod(9),
       security_path_post_mknod(9), security_path_mkdir(9),
       security_path_rmdir(9), security_path_unlink(9),
       security_path_symlink(9), security_path_link(9),
       security_path_rename(9), security_path_truncate(9),
       security_path_chmod(9), security_path_chown(9),
       security_inode_create(9), security_inode_post_create_tmpfile(9),
       security_inode_link(9), security_inode_unlink(9),
       security_inode_symlink(9), security_inode_mkdir(9),
       security_inode_rmdir(9), security_inode_mknod(9),
       security_inode_rename(9), security_inode_readlink(9),
       security_inode_follow_link(9), security_inode_permission(9),
       security_inode_setattr(9), security_inode_post_setattr(9),
       security_inode_getattr(9), security_inode_setxattr(9),
       security_inode_set_acl(9), security_inode_post_set_acl(9),
       security_inode_get_acl(9), security_inode_remove_acl(9),
       security_inode_post_remove_acl(9), security_inode_post_setxattr(9),
       security_inode_getxattr(9), security_inode_listxattr(9),
       security_inode_removexattr(9), security_inode_post_removexattr(9),
       security_inode_file_setattr(9), security_inode_file_getattr(9),
       security_inode_need_killpriv(9), security_inode_killpriv(9),
       security_inode_getsecurity(9), security_inode_setsecurity(9),
       security_inode_listsecurity(9), security_inode_getlsmprop(9),
       security_inode_copy_up(9), security_inode_copy_up_xattr(9),
       security_inode_setintegrity(9), security_kernfs_init_security(9),
       security_file_permission(9), security_file_alloc(9),
       security_file_release(9), security_file_free(9),
       security_backing_file_alloc(9), security_backing_file_free(9),
       security_file_ioctl(9), security_file_ioctl_compat(9),
       security_mmap_file(9), security_mmap_backing_file(9),
       security_mmap_addr(9), security_file_mprotect(9), security_file_lock(9),
       security_file_fcntl(9), security_file_set_fowner(9),
       security_file_send_sigiotask(9), security_file_receive(9),
       security_file_open(9), security_file_post_open(9),
       security_file_truncate(9), security_task_alloc(9),
       security_task_free(9), security_cred_alloc_blank(9),
       security_cred_free(9), security_prepare_creds(9),
       security_transfer_creds(9), security_cred_getsecid(9),
       security_cred_getlsmprop(9), security_kernel_act_as(9),
       security_kernel_create_files_as(9), security_kernel_module_request(9),
       security_kernel_read_file(9), security_kernel_post_read_file(9),
       security_kernel_load_data(9), security_kernel_post_load_data(9),
       security_task_fix_setuid(9), security_task_fix_setgid(9),
       security_task_fix_setgroups(9), security_task_setpgid(9),
       security_task_getpgid(9), security_task_getsid(9),
       security_current_getlsmprop_subj(9), security_task_getlsmprop_obj(9),
       security_task_setnice(9), security_task_setioprio(9),
       security_task_getioprio(9), security_task_prlimit(9),
       security_task_setrlimit(9), security_task_setscheduler(9),
       security_task_getscheduler(9), security_task_movememory(9),
       security_task_kill(9), security_task_prctl(9),
       security_task_to_inode(9), security_create_user_ns(9),
       security_ipc_permission(9), security_ipc_getlsmprop(9),
       security_msg_msg_alloc(9), security_msg_msg_free(9),
       security_msg_queue_alloc(9), security_msg_queue_free(9),
       security_msg_queue_associate(9), security_msg_queue_msgctl(9),
       security_msg_queue_msgsnd(9), security_msg_queue_msgrcv(9),
       security_shm_alloc(9), security_shm_free(9), security_shm_associate(9),
       security_shm_shmctl(9), security_shm_shmat(9), security_sem_alloc(9),
       security_sem_free(9), security_sem_associate(9), security_sem_semctl(9),
       security_sem_semop(9), security_d_instantiate(9),
       security_getselfattr(9), security_setselfattr(9),
       security_getprocattr(9), security_setprocattr(9),
       security_ismaclabel(9), security_secid_to_secctx(9),
       security_lsmprop_to_secctx(9), security_secctx_to_secid(9),
       security_release_secctx(9), security_inode_invalidate_secctx(9),
       security_inode_notifysecctx(9), security_inode_setsecctx(9),
       security_inode_getsecctx(9), security_post_notification(9),
       security_watch_key(9), security_netlink_send(9),
       security_unix_stream_connect(9), security_unix_may_send(9),
       security_socket_create(9), security_socket_post_create(9),
       security_socket_socketpair(9), security_socket_bind(9),
       security_socket_connect(9), security_socket_listen(9),
       security_socket_accept(9), security_socket_sendmsg(9),
       security_socket_recvmsg(9), security_socket_getsockname(9),
       security_socket_getpeername(9), security_socket_getsockopt(9),
       security_socket_setsockopt(9), security_socket_shutdown(9),
       security_sock_rcv_skb(9), security_socket_getpeersec_stream(9),
       security_socket_getpeersec_dgram(9), lsm_sock_alloc(9),
       security_sk_alloc(9), security_sk_free(9), security_sk_clone(9),
       security_sk_classify_flow(9), security_req_classify_flow(9),
       security_sock_graft(9), security_inet_conn_request(9),
       security_inet_csk_clone(9), security_inet_conn_established(9),
       security_secmark_relabel_packet(9), security_secmark_refcount_inc(9),
       security_secmark_refcount_dec(9), security_tun_dev_alloc_security(9),
       security_tun_dev_free_security(9), security_tun_dev_create(9),
       security_tun_dev_attach_queue(9), security_tun_dev_attach(9),
       security_tun_dev_open(9), security_sctp_assoc_request(9),
       security_sctp_bind_connect(9), security_sctp_sk_clone(9),
       security_sctp_assoc_established(9), security_mptcp_add_subflow(9),
       security_unix_find(9), security_ib_pkey_access(9),
       security_ib_endport_manage_subnet(9), security_ib_alloc_security(9),
       security_ib_free_security(9), security_xfrm_policy_alloc(9),
       security_xfrm_policy_clone(9), security_xfrm_policy_free(9),
       security_xfrm_policy_delete(9), security_xfrm_state_alloc(9),
       security_xfrm_state_alloc_acquire(9), security_xfrm_state_delete(9),
       security_xfrm_state_free(9), security_xfrm_policy_lookup(9),
       security_xfrm_state_pol_flow_match(9), security_xfrm_decode_session(9),
       security_key_alloc(9), security_key_free(9), security_key_permission(9),
       security_key_getsecurity(9), security_key_post_create_or_update(9),
       security_audit_rule_init(9), security_audit_rule_known(9),
       security_audit_rule_free(9), security_audit_rule_match(9),
       security_bpf(9), security_bpf_map(9), security_bpf_prog(9),
       security_bpf_map_create(9), security_bpf_prog_load(9),
       security_bpf_token_create(9), security_bpf_token_cmd(9),
       security_bpf_token_capable(9), security_bpf_map_free(9),
       security_bpf_prog_free(9), security_bpf_token_free(9),
       security_locked_down(9), security_bdev_alloc(9), security_bdev_free(9),
       security_bdev_setintegrity(9), security_perf_event_open(9),
       security_perf_event_alloc(9), security_perf_event_free(9),
       security_perf_event_read(9), security_perf_event_write(9),
       security_uring_override_creds(9), security_uring_sqpoll(9),
       security_uring_cmd(9), security_uring_allowed(9),
       security_initramfs_populated(9)

okay that was a lot, drink some water bestie 🍓

---

and that's the whole page!! this one came from the source ./security and it's dated October 2026 — so like, future-coded of it, but we move 💜 hope chroot treats you kindly and every permission check comes back 0 for you, mwah 🧚‍♀️✨