Relax the prohibition of usage fchdir(2) to quit a chroot

["Kamil Rytarowski" <n54%gmx.com@localhost>]

Hello,

There is a security feature in sys_fchdir [1] with the following comment: 
        /*  
         * Disallow changing to a directory not under the process's
         * current root directory (if there is one). 
         */

This feature actually kills functionality of i.e. misc/rpm with the '--root' 
feature.

Linux by default doesn't make this restriction, it's enabled i.e. with 
grecurity [2].
I need to use this feature, without tools like fakechroot.. so am I free to 
propose a patch swapping this feature on and off in runtime with sysctl?

My proposition is:
security.chroot.allow_fchdir_out_of_chroot (sorry I'm bad at brief names).

Maybe try to implement other chroot restrictions and make them swappable in 
runtime as well?

With regards,


[1] 
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/kern/vfs_syscalls.c?annotate=1.491
[2] http://en.wikipedia.org/wiki/Grsecurity#Chroot_restrictions