From da61847df97ec541c4e1275452836f4ccf5c9596 Mon Sep 17 00:00:00 2001
From: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
Date: Fri, 2 Jan 2026 16:58:14 +0100
Subject: [PATCH] isolate: ensure calling chdir('/') after chroot

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
---
 src/isolate.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/isolate.c b/src/isolate.c
index e3e8944b..ef30cc9f 100644
--- a/src/isolate.c
+++ b/src/isolate.c
@@ -69,6 +69,14 @@ void drop_privileges(struct worker_st *ws, main_server_st *s)
 			      GETPCONFIG(s)->chroot_dir, strerror(e));
 			exit(EXIT_FAILURE);
 		}
+
+		ret = chdir("/");
+		if (ret != 0) {
+			e = errno;
+			oclog(ws, LOG_ERR, "cannot chdir to '/': %s",
+			      strerror(e));
+			exit(EXIT_FAILURE);
+		}
 	}
 
 	if (GETPCONFIG(s)->gid != -1 && (getgid() == 0 || getegid() == 0)) {