1. A UNIX feature that creates a limited sandbox allowing a process to view only a single subtree of the filesystem. The jail call in BSD is a more advanced version for creating the same sort of sandbox. Point: In order for it to work properly, some common programs and libraries (e.g. /bin/sh, /usr/lib/libc.so.1, ...) need to be copied/linked to the appropriate locations in the new directory tree. Key point: A process running with root access can break out of a chrooted environment. Therefore, it should be used in conjunction with setuid. From Hacking-Lexicon