> > Have I missed something?
> 
> -C. And if I'm not wrong, thats positional, so potentially multiple -Cs.
> 

-C ?

You could always vfork and do the chroot in the child.....
Alternatively root can move its chroot point...

Actually netbsd chroot seems to have fixed the easy escape,
can fchroot be used instead:
	fd = open("/",..);
	chroot(path);
	....
	fchroot(fd);

	David

-- 
David Laight: david@l8s.co.uk