---
name: "chcontext"
section: "8"
platform: "linux"
package: "util-vserver"
version: "0.30.216-pre3120-1.4+b11"
release: "Debian 10 (Buster)"
platforms: ["linux"]
url: "https://new.carta.tech/chcontext"
---

# chcontext(8)

chcontext allocates a new security context and executes a command in that context.

## NAME

chcontext - chcontext allocates a new security context and executes a command in that context.

## SYNTAX

chcontext \[*options*\] \<*command arguments*\>

## DESCRIPTION

chcontext allocates a new security context and executes a command in that context. By default, a new/unused context is allocated

## OPTIONS

- **--cap** CAP\_NAME

  Add a capability from the command. This option may be repeated several time. See /usr/include/linux/capability.h In general, this option is used with the --secure option. --secure removes most critical capabilities and --cap adds specific ones.

- **--cap** !CAP\_NAME

  Remove a capability from the command. This option may be repeated several time. See /usr/include/linux/capability.h

- **--ctx** num

  Select the context. Only root in context 0 is allowed to select a specific context. Context number 1 is special. It can see all processes in any contexts, but can't kill them though.

- **--disconnect**

  Start the command in background and make the process a child of process 1.

- **--domainname** new\_domainname

  Set the domainname (NIS) in the new security context. Use "none" to unset the domainname.

- **--flag**

  Set one flag in the new or current security context. The following flags are supported. The option may be used several time.\
      lock: The new process is trapped and can't use\
            chcontext anymore.\
      sched: The new process and its children will\
             share a common execution priority.\
      nproc: Limit the number of process in the \
             vserver according to ulimit setting.\
             Normally, ulimit is a per user thing.\
             With this flag, it becomes a per vserver\
             thing.\
      private: No one can join this security context\
               once created.

- **--hostname** new\_hostname

  Set the hostname in the new security context. This is needed because if you create a less privileged security context, it may be unable to change its hostname.

- **--secure**

  Remove all the capabilities to make a virtual server trustable.

- **--silent**

  Do not print the allocated context number.

Information about context is found in /proc/self/status

## FILES

*/usr/sbin/chcontext*

## EXAMPLES

\# You must be root, running X.               # We start an xterm in another security context    /usr/sbin/chcontext xterm &

\# We check, there is no xterm running, yet we can # see it. ps ax \| grep xterm

\# Are we running in security context 0 # We check the s\_context line in /proc/self/status cat /proc/self/status

\# Ok we in security context 0 # Try the security context 1 /usr/sbin/chcontext --ctx 1 ps ax \| grep xterm

\# Ok, we see the xterm, we try to kill it /usr/sbin/chcontext --ctx 1 killall xterm

\# No, security context 1 can see, but can't kill # let's find out in which security context this # xterm is running /usr/sbin/chcontext --ctx 1 ps ax \| grep xterm

\# Ok, this is PID XX. We need the security context /usr/sbin/chcontext --ctx 1 cat /proc/XX/status

\# We see the s\_context, this is SS. # We want to kill this process /usr/sbin/chcontext --ctx SS killall xterm

Please contribute some, if you feel it's important.

## AUTHORS

This Man page was written by Klavs Klavsen \<kl@vsen.dk\> and based upon the helpful output from the program itself and the documentation on the Virtual Server site \<http://www.solucorp.qc.ca/miscprj/s\_context.hc?prjstate=1&nodoc=0\>

## SEE ALSO

[chbind(8)](/chbind/8.md) [rebootmgr(8)](/rebootmgr/8.md) [reducecap(8)](/reducecap/8.md) [vps(8)](/vps/8.md) [vpstree(8)](/vpstree/8.md) [vrpm(8)](/vrpm/8.md) [vserver(8)](/vserver/8.md) [vserver-stat(8)](/vserver-stat/8.md) [vtop(8)](/vtop/8.md)