diff -r 5eb4d7541107 src/core/nginx.c
--- a/src/core/nginx.c	Sun Jul 12 08:31:38 2015 -0700
+++ b/src/core/nginx.c	Mon Oct 05 09:56:23 2015 +0100
@@ -49,6 +49,13 @@
       offsetof(ngx_core_conf_t, master),
       NULL },
 
+    { ngx_string("chroot"),
+      NGX_MAIN_CONF|NGX_DIRECT_CONF|NGX_CONF_FLAG,
+      ngx_conf_set_flag_slot,
+      0,
+      offsetof(ngx_core_conf_t, chroot),
+      NULL },
+
     { ngx_string("timer_resolution"),
       NGX_MAIN_CONF|NGX_DIRECT_CONF|NGX_CONF_TAKE1,
       ngx_conf_set_msec_slot,
@@ -909,6 +916,9 @@
 #endif
     }
 
+    cycle->chroot.len = cycle->prefix.len;
+    cycle->chroot.data = ngx_pstrdup(cycle->pool, &cycle->prefix);
+
     if (ngx_conf_file) {
         cycle->conf_file.len = ngx_strlen(ngx_conf_file);
         cycle->conf_file.data = ngx_conf_file;
@@ -967,6 +977,7 @@
 
     ccf->daemon = NGX_CONF_UNSET;
     ccf->master = NGX_CONF_UNSET;
+    ccf->chroot = NGX_CONF_UNSET;
     ccf->timer_resolution = NGX_CONF_UNSET_MSEC;
 
     ccf->worker_processes = NGX_CONF_UNSET;
@@ -995,6 +1006,7 @@
 
     ngx_conf_init_value(ccf->daemon, 1);
     ngx_conf_init_value(ccf->master, 1);
+    ngx_conf_init_value(ccf->chroot, 0);
     ngx_conf_init_msec_value(ccf->timer_resolution, 0);
 
     ngx_conf_init_value(ccf->worker_processes, 1);
diff -r 5eb4d7541107 src/core/ngx_cycle.c
--- a/src/core/ngx_cycle.c	Sun Jul 12 08:31:38 2015 -0700
+++ b/src/core/ngx_cycle.c	Mon Oct 05 09:56:23 2015 +0100
@@ -94,6 +94,11 @@
         return NULL;
     }
 
+    if (old_cycle->chroot.data != NULL) {
+        cycle->chroot.len = old_cycle->chroot.len;
+        cycle->chroot.data = ngx_pstrdup(pool, &old_cycle->chroot);
+    }
+
     cycle->conf_file.len = old_cycle->conf_file.len;
     cycle->conf_file.data = ngx_pnalloc(pool, old_cycle->conf_file.len + 1);
     if (cycle->conf_file.data == NULL) {
diff -r 5eb4d7541107 src/core/ngx_cycle.h
--- a/src/core/ngx_cycle.h	Sun Jul 12 08:31:38 2015 -0700
+++ b/src/core/ngx_cycle.h	Mon Oct 05 09:56:23 2015 +0100
@@ -68,6 +68,7 @@
     ngx_str_t                 conf_file;
     ngx_str_t                 conf_param;
     ngx_str_t                 conf_prefix;
+    ngx_str_t                 chroot;
     ngx_str_t                 prefix;
     ngx_str_t                 lock_file;
     ngx_str_t                 hostname;
@@ -77,6 +78,7 @@
 typedef struct {
      ngx_flag_t               daemon;
      ngx_flag_t               master;
+     ngx_flag_t               chroot;
 
      ngx_msec_t               timer_resolution;
 
diff -r 5eb4d7541107 src/http/ngx_http_core_module.c
--- a/src/http/ngx_http_core_module.c	Sun Jul 12 08:31:38 2015 -0700
+++ b/src/http/ngx_http_core_module.c	Mon Oct 05 09:56:23 2015 +0100
@@ -4429,6 +4429,7 @@
 static char *
 ngx_http_core_root(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
 {
+    ngx_core_conf_t          *ccf;
     ngx_http_core_loc_conf_t *clcf = conf;
 
     ngx_str_t                  *value;
@@ -4437,6 +4438,7 @@
     ngx_http_script_compile_t   sc;
 
     alias = (cmd->name.len == sizeof("alias") - 1) ? 1 : 0;
+    ccf = (ngx_core_conf_t *)ngx_get_conf(cf->cycle->conf_ctx, ngx_core_module);
 
     if (clcf->root.data) {
 
@@ -4499,6 +4501,17 @@
         }
     }
 
+    if (ccf->chroot && clcf->root.len >= cf->cycle->chroot.len) {
+        u_char *chrootdir = cf->cycle->chroot.data;
+        chrootdir[cf->cycle->chroot.len] = '\0';
+
+        if (ngx_strnstr(clcf->root.data, (char *)chrootdir,
+            cf->cycle->chroot.len)) {
+            clcf->root.data += cf->cycle->chroot.len;
+            clcf->root.len -= cf->cycle->chroot.len;
+        }
+    }
+
     n = ngx_http_script_variables_count(&clcf->root);
 
     ngx_memzero(&sc, sizeof(ngx_http_script_compile_t));
diff -r 5eb4d7541107 src/os/unix/ngx_process_cycle.c
--- a/src/os/unix/ngx_process_cycle.c	Sun Jul 12 08:31:38 2015 -0700
+++ b/src/os/unix/ngx_process_cycle.c	Mon Oct 05 09:56:23 2015 +0100
@@ -828,6 +828,28 @@
     }
 
     if (geteuid() == 0) {
+        if (ccf->chroot) {
+            u_char *chrootdir = cycle->chroot.data;
+            chrootdir[cycle->chroot.len] = '\0';
+
+            if (chroot((const char *)chrootdir) == -1) {
+                ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_errno,
+                              "chroot(%s) failed", chroot);
+                exit(2);
+            }
+
+            if (chdir("/") == -1) {
+                ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_errno,
+                              "chdir failed");
+                exit(2);
+            }
+
+            cycle->prefix.data[0] = '\0';
+            cycle->prefix.len = 0;
+
+            ngx_log_error(NGX_LOG_NOTICE, cycle->log, 0, "chrooted on %s", chrootdir);
+        }
+
         if (setgid(ccf->group) == -1) {
             ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_errno,
                           "setgid(%d) failed", ccf->group);
