Creation of chroot Jail Without Changing Working Directory

The chroot() system call isolates a process within a specific directory subtree, known as a jail. However, a critical step is often missed: chroot() does not automatically change the process's current working directory. If the working directory remains outside the new root, any relative path operations (like opening '../etc/passwd') can still traverse the original filesystem, completely bypassing the intended isolation. To properly secure the jail, you must immediately call chdir('/') after chroot(). This changes the working directory to be inside the new root, ensuring all subsequent relative path references are confined. Without this step, the chroot jail provides a false sense of security and is trivial for an attacker to escape.