This script creates a chroot environment for use with php-fpm.

To be called with the chroot directory and a php binary.

./scriptname /dir/to/chroot /usr/bin/php

It copies all libraries needed by php (by using ldd) and it also copies timedata and dns data (or there will be errors when a php script tries to access a hostname in the web).
Make sure to name all chrooted directory different, e.g. /website1 /website 2 etc. or you could run into weird caching issues, like getting a different website then requested.

DIR=$1 mkdir -p $DIR mkdir -p $DIR/dev mkdir -p $DIR/var mkdir -p $DIR/etc mkdir -p $DIR/usr mkdir -p $DIR/usr/lib64 mkdir -p $DIR/usr/local/nginx mkdir -p $DIR/usr/share mkdir -p $DIR/tmp chmod -R 770 $DIR/tmp mkdir -p $DIR/var/tmp chmod -R 770 $DIR/var/tmp mkdir -p $DIR/lib64 mkdir -p $DIR/lib mkdir -p $DIR/var/lib/php/session /bin/mknod -m 0600 $DIR/dev/null c 1 3 /bin/mknod -m 0400 $DIR/dev/random c 1 8 /bin/mknod -m 0400 $DIR/dev/urandom c 1 9

cp -fv /etc/{prelink.cache,services,adjtime,hosts.deny,localtime,nsswitch.conf,nscd.conf,prelink.conf,protocols,hosts,ld.so.cache,ld.so.conf,resolv.conf,hosts,host.conf} $DIR/etc cp -avr /etc/{ld.so.conf.d,prelink.conf.d} $DIR/etc

#ssl mkdir -p $DIR/etc/pki cp -fvr /etc/pki $DIR/etc

copy specific libraries (not covered by ldd)

dns

cp -fv /lib64/libnss* $DIR/lib64 cp -fv /lib/libnss* $DIR/lib

timezones

cp -frv /usr/share/zoneinfo/ $DIR/usr/share/

other

cp -fv /lib64/libsoftokn3.so $DIR/lib64

cp -fv /lib64/libcurl* $DIR/lib64 cp -fv /lib64/libssl* $DIR/lib64 cp -fv /lib64/libcrypt* $DIR/lib64 cp -fv /usr/lib64/libnss* $DIR/usr/lib64 cp -fv /usr/lib64/libnsspem.so $DIR/usr/lib64 cp -fv /usr/lib64/libsoftokn3.so $DIR/usr/lib64

from https://www.cyberciti.biz/files/lighttpd/l2chroot.txt

iggy ld-linux* file as it is not shared one

FILES=”$(ldd $2 | awk ’{ print $3 }’ |egrep -v ^’\(’)”

echo “Copying shared files/libs to $BASE…” for i in $FILES do d=”$(dirname $i)” [ ! -d $DIR$d ] && mkdir -p $DIR$d || : /bin/cp $i $DIR$d done

copy /lib/ld-linux* or /lib64/ld-linux* to $BASE/$sldlsubdir

get ld-linux full file location

sldl=”$(ldd $2 | grep ‘ld-linux’ | awk ’{ print $2}’)“

now get sub-dir

sldlsubdir=”$(dirname $sldl)”

if [ ! -f $DIR $sldl ]; then echo “Copying $sldl $DIR$sldlsubdir…” /bin/cp $sldl $DIR$sldlsubdir else : fi

Mainly this approach is used for security, but this solution is difficult to maintain and error-prone. So it might be better to set up SELinux or GRSecurity with restrictive rules instead.