Chroot allows user based namespace isolation on many standard Linux deployments.

## 1. Prerequisites

- Familiarity with [chroot](http://man7.org/linux/man-pages/man2/chroot.2.html)
- Chroot installed on your machine.

## 2. Install MinIO in Chroot

```sh
mkdir -p /mnt/export/${USER}/bin

	if [ -n "${MINIO_USERNAME}" ] && [ -n "${MINIO_GROUPNAME}" ]; then
		if [ -n "${MINIO_UID}" ] && [ -n "${MINIO_GID}" ]; then
			chroot --userspec=${MINIO_UID}:${MINIO_GID} / "$@"
		else
			echo "${MINIO_USERNAME}:x:1000:1000:${MINIO_USERNAME}:/:/sbin/nologin" >>/etc/passwd
			echo "${MINIO_GROUPNAME}:x:1000" >>/etc/group
			chroot --userspec=${MINIO_USERNAME}:${MINIO_GROUPNAME} / "$@"
		fi
	else
		exec "$@"
	fi
}

pkg syscall (freebsd-arm64), func CheckBpfVersion //deprecated
pkg syscall (freebsd-arm64), func CheckBpfVersion(int) error
pkg syscall (freebsd-arm64), func Chflags(string, int) error
pkg syscall (freebsd-arm64), func Chroot(string) error
pkg syscall (freebsd-arm64), func Close(int) error
pkg syscall (freebsd-arm64), func CloseOnExec(int)
pkg syscall (freebsd-arm64), func CmsgLen(int) int
pkg syscall (freebsd-arm64), func CmsgSpace(int) int

pkg syscall (darwin-arm64), func CheckBpfVersion //deprecated
pkg syscall (darwin-arm64), func CheckBpfVersion(int) error
pkg syscall (darwin-arm64), func Chflags(string, int) error
pkg syscall (darwin-arm64), func Chroot(string) error
pkg syscall (darwin-arm64), func Close(int) error
pkg syscall (darwin-arm64), func CloseOnExec(int)
pkg syscall (darwin-arm64), func CmsgLen(int) int
pkg syscall (darwin-arm64), func CmsgSpace(int) int

pkg syscall (freebsd-riscv64), func CheckBpfVersion(int) error #53466
pkg syscall (freebsd-riscv64), func Chflags(string, int) error #53466
pkg syscall (freebsd-riscv64), func Chroot(string) error #53466
pkg syscall (freebsd-riscv64), func Close(int) error #53466
pkg syscall (freebsd-riscv64), func CloseOnExec(int) #53466
pkg syscall (freebsd-riscv64), func CmsgLen(int) int #53466

    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ matrix.go-version }}
          check-latest: true
      - name: Start root lockdown tests
        run: |

if [ $? -ne 0 ]; then
	echo "listing failed, 'minioadmin' should be enabled"
	exit 1
fi

killall -9 minio

rm -rf /tmp/multisitea/
rm -rf /tmp/multisiteb/

echo "Setup site-replication and then disable root credentials"

minio server --address 127.0.0.1:9001 "http://127.0.0.1:9001/tmp/multisitea/data/disterasure/xl{1...4}" \
	"http://127.0.0.1:9002/tmp/multisitea/data/disterasure/xl{5...8}" >/tmp/sitea_1.log 2>&1 &

		// Version test
		{
			name:   "version as root want success",
			method: http.MethodGet,
			path:   kmsVersionPath,
			asRoot: true,

			wantStatusCode: http.StatusOK,
			wantResp:       []string{"version"},
		},
		{
			name:   "version as user with no policy want forbidden",
			method: http.MethodGet,
			path:   kmsVersionPath,
			asRoot: false,

			wantStatusCode: http.StatusForbidden,

	# /tmp/xxx/mnt/disk4 will be the same as '/' and it
	# will be detected as root disk
	while [ "$u" != "0" ]; do
		sudo umount ${WORK_DIR}/mnt/disk4/
		u=$?
		sleep 1
	done

	# Wait until MinIO self heal kicks in
	sleep 60

	if [ -f ${WORK_DIR}/mnt/disk4/.minio.sys/format.json ]; then
		echo "A root disk is formatted unexpectedely"
		cat "${WORK_DIR}/server4.log"
		exit -1
	fi
}

        void rootUrlIsRoot() throws Exception {
            DummySmbResourceLocator root = new DummySmbResourceLocator("smb://server/");
            // last component includes trailing slash per specification
            assertEquals("server/", root.getName());
            assertEquals("smb://", root.getParent());
            assertTrue(root.isRoot());
        }

        @Test