use CHROOT_SH instead of CHROOT_*