---
name: "jk_uchroot"
section: "8"
platform: "linux"
package: "jailkit"
version: "2.23-2+b1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/jk_uchroot"
---

# jk\_uchroot(8)

grant regular users the right to change root into certain directories

## NAME

jk\_uchroot - grant regular users the right to change root into certain directories

## SYNOPSIS

**jk\_uchroot -j \<jail\> -x \<executable\>**

## DESCRIPTION

jk\_uchroot can be used to give regular users access to the chroot() system call in a safe way. jk\_uchroot will only grant chroot into a jail if the configuration file lists this user and jail combination. jk\_uchroot will furthermore only grant access if the chroot jail is safe. Safe means that it is owned by uid 0 gid 0 and not writable for others, including the system directories such as  /bin, /lib, /dev/, /sbin, and /usr.

jk\_uchroot needs certain elevated privileges to make the  **[chroot(2)](/chroot/2.md)** system call. Therefore it is setuid root. It will drop its root privileges immediately after making the chroot() system call. Since Jailkit 2.8 jk\_uchroot may also use the CAP\_SYS\_CHROOT capability on systems that support capabilities, and then the setuid bit can be removed.

```

[john]
allowed_jails = /srv/johnjail, /srv/commonjail
skip_injail_passwd_check = 1
[group users]
allowed_jails = /srv/commonjail
skip_injail_passwd_check = 1
```

In the above example jk\_uchroot is configured not to check if the user exists in the /etc/passwd file in the jails.

## FILES

*/etc/jailkit/jk\_uchroot.ini*

## DIAGNOSTICS

jk\_uchroot logs everything to syslog, please check the log files. Logging is sent to the LOG\_AUTH facility with levels LOG\_ERR and LOG\_CRIT for critical errors, LOG\_NOTICE for non-critical errors,  and LOG\_INFO for normal events. On most systems the command **grep jk\_ /var/log/\*** will give you the information you need.

## SEE ALSO

**jailkit(8)** **[jk\_check(8)](/jk_check/8.md)** **[jk\_chrootlaunch(8)](/jk_chrootlaunch/8.md)** **[jk\_chrootsh(8)](/jk_chrootsh/8.md)** **[jk\_cp(8)](/jk_cp/8.md)** **[jk\_init(8)](/jk_init/8.md)** **[jk\_jailuser(8)](/jk_jailuser/8.md)** **[jk\_list(8)](/jk_list/8.md)** **[jk\_lsh(8)](/jk_lsh/8.md)** **jk\_procmailwrapper(8)** **[jk\_socketd(8)](/jk_socketd/8.md)** **[jk\_update(8)](/jk_update/8.md)** **[chroot(2)](/chroot/2.md)** **[syslogd(8)](/syslogd/8.md)**

## COPYRIGHT

Copyright (C) 2003, 2004, 2005, 2006, 2007, 2018 Olivier Sessink

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved.