mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2024-12-25 11:37:56 +00:00
Code Issues Releases Activity
2e27f04f55
freebsd/usr.sbin/jail/jail.8

1227 lines
36 KiB
Groff
Raw Normal View History

No need to copy sysinstall into a jail with -CURRENT, since in -CURRENT, we have /usr/sbin/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 02:46:44 +00:00
.\" Copyright (c) 2000, 2003 Robert N. M. Watson
A new jail(8) with a configuration file, ultimately to replace the work currently done by /etc/rc.d/jail. MFC after: 3 months
2012-04-26 17:36:05 +00:00
.\" Copyright (c) 2008-2012 James Gritton
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.\" All rights reserved.
- As jail(8) has been almost completely rewritten, prepend another copyright/ BSD-style license, as an add-on to phk's beerware license. Please fedex some beer to phk. - Add a ``make depend'' line to the jail-building, which fixes openssl, among other things. Suggested by: kris - Add ``newaliases'' to the list of things to do when setting up a new jail, so that the jailed sendmail doesn't complain. - Correct references to ``kern.jail.set_hostname_allowed'' which now read ``jail.set_hostname_allowed''. - Add a reference to sysctl.conf where the sysctl can easily be set in a persistent way. - Add a list of cross references to the man page. - Fix a formatting nit or two.
2000-02-20 02:51:11 +00:00
.\"
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\" notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\" notice, this list of conditions and the following disclaimer in the
.\" documentation and/or other materials provided with the distribution.
- As jail(8) has been almost completely rewritten, prepend another copyright/ BSD-style license, as an add-on to phk's beerware license. Please fedex some beer to phk. - Add a ``make depend'' line to the jail-building, which fixes openssl, among other things. Suggested by: kris - Add ``newaliases'' to the list of things to do when setting up a new jail, so that the jailed sendmail doesn't complain. - Correct references to ``kern.jail.set_hostname_allowed'' which now read ``jail.set_hostname_allowed''. - Add a reference to sysctl.conf where the sysctl can easily be set in a persistent way. - Add a list of cross references to the man page. - Fix a formatting nit or two.
2000-02-20 02:51:11 +00:00
.\"
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
- As jail(8) has been almost completely rewritten, prepend another copyright/ BSD-style license, as an add-on to phk's beerware license. Please fedex some beer to phk. - Add a ``make depend'' line to the jail-building, which fixes openssl, among other things. Suggested by: kris - Add ``newaliases'' to the list of things to do when setting up a new jail, so that the jailed sendmail doesn't complain. - Correct references to ``kern.jail.set_hostname_allowed'' which now read ``jail.set_hostname_allowed''. - Add a reference to sysctl.conf where the sysctl can easily be set in a persistent way. - Add a list of cross references to the man page. - Fix a formatting nit or two.
2000-02-20 02:51:11 +00:00
.\"
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.\" $FreeBSD$
Fix various bogons. Submitted by: Rudolf Cejka <cejkar@dcse.fee.vutbr.cz> Reviewed by: phk
1999-05-04 18:20:53 +00:00
.\"
A new jail(8) with a configuration file, ultimately to replace the work currently done by /etc/rc.d/jail. MFC after: 3 months
2012-04-26 17:36:05 +00:00
.Dd April 26, 2012
This Implements the mumbled about "Jail" feature. This is a seriously beefed up chroot kind of thing. The process is jailed along the same lines as a chroot does it, but with additional tough restrictions imposed on what the superuser can do. For all I know, it is safe to hand over the root bit inside a prison to the customer living in that prison, this is what it was developed for in fact: "real virtual servers". Each prison has an ip number associated with it, which all IP communications will be coerced to use and each prison has its own hostname. Needless to say, you need more RAM this way, but the advantage is that each customer can run their own particular version of apache and not stomp on the toes of their neighbors. It generally does what one would expect, but setting up a jail still takes a little knowledge. A few notes: I have no scripts for setting up a jail, don't ask me for them. The IP number should be an alias on one of the interfaces. mount a /proc in each jail, it will make ps more useable. /proc/<pid>/status tells the hostname of the prison for jailed processes. Quotas are only sensible if you have a mountpoint per prison. There are no privisions for stopping resource-hogging. Some "#ifdef INET" and similar may be missing (send patches!) If somebody wants to take it from here and develop it into more of a "virtual machine" they should be most welcome! Tools, comments, patches & documentation most welcome. Have fun... Sponsored by: http://www.rndassociates.com/ Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
.Dt JAIL 8
mdoc(7) police: removed HISTORY info from the .Os call.
2001-07-10 15:12:08 +00:00
.Os
This Implements the mumbled about "Jail" feature. This is a seriously beefed up chroot kind of thing. The process is jailed along the same lines as a chroot does it, but with additional tough restrictions imposed on what the superuser can do. For all I know, it is safe to hand over the root bit inside a prison to the customer living in that prison, this is what it was developed for in fact: "real virtual servers". Each prison has an ip number associated with it, which all IP communications will be coerced to use and each prison has its own hostname. Needless to say, you need more RAM this way, but the advantage is that each customer can run their own particular version of apache and not stomp on the toes of their neighbors. It generally does what one would expect, but setting up a jail still takes a little knowledge. A few notes: I have no scripts for setting up a jail, don't ask me for them. The IP number should be an alias on one of the interfaces. mount a /proc in each jail, it will make ps more useable. /proc/<pid>/status tells the hostname of the prison for jailed processes. Quotas are only sensible if you have a mountpoint per prison. There are no privisions for stopping resource-hogging. Some "#ifdef INET" and similar may be missing (send patches!) If somebody wants to take it from here and develop it into more of a "virtual machine" they should be most welcome! Tools, comments, patches & documentation most welcome. Have fun... Sponsored by: http://www.rndassociates.com/ Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
.Sh NAME
.Nm jail
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Nd "manage system jails"
This Implements the mumbled about "Jail" feature. This is a seriously beefed up chroot kind of thing. The process is jailed along the same lines as a chroot does it, but with additional tough restrictions imposed on what the superuser can do. For all I know, it is safe to hand over the root bit inside a prison to the customer living in that prison, this is what it was developed for in fact: "real virtual servers". Each prison has an ip number associated with it, which all IP communications will be coerced to use and each prison has its own hostname. Needless to say, you need more RAM this way, but the advantage is that each customer can run their own particular version of apache and not stomp on the toes of their neighbors. It generally does what one would expect, but setting up a jail still takes a little knowledge. A few notes: I have no scripts for setting up a jail, don't ask me for them. The IP number should be an alias on one of the interfaces. mount a /proc in each jail, it will make ps more useable. /proc/<pid>/status tells the hostname of the prison for jailed processes. Quotas are only sensible if you have a mountpoint per prison. There are no privisions for stopping resource-hogging. Some "#ifdef INET" and similar may be missing (send patches!) If somebody wants to take it from here and develop it into more of a "virtual machine" they should be most welcome! Tools, comments, patches & documentation most welcome. Have fun... Sponsored by: http://www.rndassociates.com/ Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
.Sh SYNOPSIS
mdoc(7) police: use the new features of the Nm macro.
2000-11-20 20:10:44 +00:00
.Nm
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Op Fl dhilqv
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Op Fl J Ar jid_file
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Op Fl u Ar username
.Op Fl U Ar username
.Op Fl cmr
.Ar param Ns = Ns Ar value ...
.Op Cm command Ns = Ns Ar command ...
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Nm
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Op Fl dqv
.Op Fl f Ar conf_file
.Op Fl p Ar limit
.Op Fl cmr
.Op Ar jail
.Nm
.Op Fl qv
.Op Fl f Ar conf_file
.Op Fl rR
.Op Cm * | Ar jail ...
.Nm
.Op Fl dhilqv
Add [-J jid_file] option to write out a JidFile, similar to a PidFile, containing the jailid, path, hostname, ip and the command used to start the jail. PR: misc/89883 Submitted by: L. Jason Godsey <lannygodsey -at- yahoo.com> Reviewed by: phk MFC after: 1 week
2005-12-03 17:32:39 +00:00
.Op Fl J Ar jid_file
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Op Fl u Ar username
.Op Fl U Ar username
.Op Fl n Ar jailname
Add the -s option to set jail's securelevel. This is useful for jails run with non-root privileges. PR: bin/80242 MFC after: 2 weeks
2006-05-11 13:04:23 +00:00
.Op Fl s Ar securelevel
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Op Ar path hostname [ Ar ip Ns [ Ns Ar ,... Ns ]] Ar command ...
This Implements the mumbled about "Jail" feature. This is a seriously beefed up chroot kind of thing. The process is jailed along the same lines as a chroot does it, but with additional tough restrictions imposed on what the superuser can do. For all I know, it is safe to hand over the root bit inside a prison to the customer living in that prison, this is what it was developed for in fact: "real virtual servers". Each prison has an ip number associated with it, which all IP communications will be coerced to use and each prison has its own hostname. Needless to say, you need more RAM this way, but the advantage is that each customer can run their own particular version of apache and not stomp on the toes of their neighbors. It generally does what one would expect, but setting up a jail still takes a little knowledge. A few notes: I have no scripts for setting up a jail, don't ask me for them. The IP number should be an alias on one of the interfaces. mount a /proc in each jail, it will make ps more useable. /proc/<pid>/status tells the hostname of the prison for jailed processes. Quotas are only sensible if you have a mountpoint per prison. There are no privisions for stopping resource-hogging. Some "#ifdef INET" and similar may be missing (send patches!) If somebody wants to take it from here and develop it into more of a "virtual machine" they should be most welcome! Tools, comments, patches & documentation most welcome. Have fun... Sponsored by: http://www.rndassociates.com/ Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
.Sh DESCRIPTION
The
.Nm
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
utility creates new jails, or modifies or removes existing jails.
A jail is specified via parameters on the command line, or in the
.Xr jail.conf 5
file.
This Implements the mumbled about "Jail" feature. This is a seriously beefed up chroot kind of thing. The process is jailed along the same lines as a chroot does it, but with additional tough restrictions imposed on what the superuser can do. For all I know, it is safe to hand over the root bit inside a prison to the customer living in that prison, this is what it was developed for in fact: "real virtual servers". Each prison has an ip number associated with it, which all IP communications will be coerced to use and each prison has its own hostname. Needless to say, you need more RAM this way, but the advantage is that each customer can run their own particular version of apache and not stomp on the toes of their neighbors. It generally does what one would expect, but setting up a jail still takes a little knowledge. A few notes: I have no scripts for setting up a jail, don't ask me for them. The IP number should be an alias on one of the interfaces. mount a /proc in each jail, it will make ps more useable. /proc/<pid>/status tells the hostname of the prison for jailed processes. Quotas are only sensible if you have a mountpoint per prison. There are no privisions for stopping resource-hogging. Some "#ifdef INET" and similar may be missing (send patches!) If somebody wants to take it from here and develop it into more of a "virtual machine" they should be most welcome! Tools, comments, patches & documentation most welcome. Have fun... Sponsored by: http://www.rndassociates.com/ Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
.Pp
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
At least one of the options
.Fl c ,
.Fl m
or
.Fl r
must be specified.
These options are used alone or in combination describe the operation to
perform:
.Bl -tag -width indent
.It Fl c
Create a new jail.
The jail
.Va jid
and
.Va name
parameters (if specified) on the command line,
or any jails
must not refer to an existing jail.
.It Fl m
Modify an existing jail.
One of the
.Va jid
or
.Va name
parameters must exist and refer to an existing jail.
Some parameters may not be changed on a running jail.
.It Fl r
Remove the
.Ar jail
specified by jid or name.
All jailed processes are killed, and all children of this jail are also
removed.
.It Fl rc
Restart an existing jail.
The jail is first removed and then re-created, as if
.Dq Nm Fl c
and
.Dq Nm Fl r
were run in succession.
.It Fl cm
Create a jail if it does not exist, or modify the jail if it does exist.
.It Fl mr
Modify an existing jail.
The jail may be restarted if necessary to modify parameters than could
not otherwise be changed.
.It Fl cmr
Create a jail if it doesn't exist, or modify (and possibly restart) the
jail if it does exist.
.El
This Implements the mumbled about "Jail" feature. This is a seriously beefed up chroot kind of thing. The process is jailed along the same lines as a chroot does it, but with additional tough restrictions imposed on what the superuser can do. For all I know, it is safe to hand over the root bit inside a prison to the customer living in that prison, this is what it was developed for in fact: "real virtual servers". Each prison has an ip number associated with it, which all IP communications will be coerced to use and each prison has its own hostname. Needless to say, you need more RAM this way, but the advantage is that each customer can run their own particular version of apache and not stomp on the toes of their neighbors. It generally does what one would expect, but setting up a jail still takes a little knowledge. A few notes: I have no scripts for setting up a jail, don't ask me for them. The IP number should be an alias on one of the interfaces. mount a /proc in each jail, it will make ps more useable. /proc/<pid>/status tells the hostname of the prison for jailed processes. Quotas are only sensible if you have a mountpoint per prison. There are no privisions for stopping resource-hogging. Some "#ifdef INET" and similar may be missing (send patches!) If somebody wants to take it from here and develop it into more of a "virtual machine" they should be most welcome! Tools, comments, patches & documentation most welcome. Have fun... Sponsored by: http://www.rndassociates.com/ Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
.Pp
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
Other available options are:
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Bl -tag -width indent
.It Fl d
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
Allow making changes to a dying jail, equivalent to the
.Va allow.dying
parameter.
.It Fl f Ar conf_file
Use configuration file
.Ar conf_file
instead of the default
.Pa /etc/jail.conf .
MFp4: Bring in updated jail support from bz_jail branch. This enhances the current jail implementation to permit multiple addresses per jail. In addtion to IPv4, IPv6 is supported as well. Due to updated checks it is even possible to have jails without an IP address at all, which basically gives one a chroot with restricted process view, no networking,.. SCTP support was updated and supports IPv6 in jails as well. Cpuset support permits jails to be bound to specific processor sets after creation. Jails can have an unrestricted (no duplicate protection, etc.) name in addition to the hostname. The jail name cannot be changed from within a jail and is considered to be used for management purposes or as audit-token in the future. DDB 'show jails' command was added to aid debugging. Proper compat support permits 32bit jail binaries to be used on 64bit systems to manage jails. Also backward compatibility was preserved where possible: for jail v1 syscalls, as well as with user space management utilities. Both jail as well as prison version were updated for the new features. A gap was intentionally left as the intermediate versions had been used by various patches floating around the last years. Bump __FreeBSD_version for the afore mentioned and in kernel changes. Special thanks to: - Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches and Olivier Houchard (cognet) for initial single-IPv6 patches. - Jeff Roberson (jeff) and Randall Stewart (rrs) for their help, ideas and review on cpuset and SCTP support. - Robert Watson (rwatson) for lots and lots of help, discussions, suggestions and review of most of the patch at various stages. - John Baldwin (jhb) for his help. - Simon L. Nielsen (simon) as early adopter testing changes on cluster machines as well as all the testers and people who provided feedback the last months on freebsd-jail and other channels. - My employer, CK Software GmbH, for the support so I could work on this. Reviewed by: (see above) MFC after: 3 months (this is just so that I get the mail) X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
.It Fl h
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
Resolve the
.Va host.hostname
parameter (or
.Va hostname )
MFp4: Bring in updated jail support from bz_jail branch. This enhances the current jail implementation to permit multiple addresses per jail. In addtion to IPv4, IPv6 is supported as well. Due to updated checks it is even possible to have jails without an IP address at all, which basically gives one a chroot with restricted process view, no networking,.. SCTP support was updated and supports IPv6 in jails as well. Cpuset support permits jails to be bound to specific processor sets after creation. Jails can have an unrestricted (no duplicate protection, etc.) name in addition to the hostname. The jail name cannot be changed from within a jail and is considered to be used for management purposes or as audit-token in the future. DDB 'show jails' command was added to aid debugging. Proper compat support permits 32bit jail binaries to be used on 64bit systems to manage jails. Also backward compatibility was preserved where possible: for jail v1 syscalls, as well as with user space management utilities. Both jail as well as prison version were updated for the new features. A gap was intentionally left as the intermediate versions had been used by various patches floating around the last years. Bump __FreeBSD_version for the afore mentioned and in kernel changes. Special thanks to: - Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches and Olivier Houchard (cognet) for initial single-IPv6 patches. - Jeff Roberson (jeff) and Randall Stewart (rrs) for their help, ideas and review on cpuset and SCTP support. - Robert Watson (rwatson) for lots and lots of help, discussions, suggestions and review of most of the patch at various stages. - John Baldwin (jhb) for his help. - Simon L. Nielsen (simon) as early adopter testing changes on cluster machines as well as all the testers and people who provided feedback the last months on freebsd-jail and other channels. - My employer, CK Software GmbH, for the support so I could work on this. Reviewed by: (see above) MFC after: 3 months (this is just so that I get the mail) X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
and add all IP addresses returned by the resolver
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
to the list of addresses for this prison.
This is equivalent to the
.Va ip_hostname
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
parameter.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.It Fl i
Output (only) the jail identifier of the newly created jail(s).
This implies the
.Fl q
option.
Add [-J jid_file] option to write out a JidFile, similar to a PidFile, containing the jailid, path, hostname, ip and the command used to start the jail. PR: misc/89883 Submitted by: L. Jason Godsey <lannygodsey -at- yahoo.com> Reviewed by: phk MFC after: 1 week
2005-12-03 17:32:39 +00:00
.It Fl J Ar jid_file
Markup fixes.
2006-09-29 17:57:04 +00:00
Write a
.Ar jid_file
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
file, containing parameters used to start the jail.
o Add -l option to jail(8) similar to su(1): before running jail'ed program under specific user's credentials, clean the environment and set only a few variables. PR: bin/70024 Submitted by: demon MFC after: 1 month
2004-08-15 08:21:50 +00:00
.It Fl l
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
Run commands in a clean environment.
This is deprecated and is equivalent to the exec.clean parameter.
.It Fl n Ar jailname
Set the jail's name.
This is deprecated and is equivalent to the
.Va name
parameter.
.It Fl p Ar limit
Limit the number of commands from
.Va exec.*
that can run simultaneously.
.It Fl q
Suppress the message printed whenever a jail is created, modified or removed.
Only error messages will be printed.
.It Fl R
A variation of the
.Fl r
option that removes an existing jail without using the configuration file.
No removal-related parameters for this jail will be used - the jail will
simply be removed.
Add the -s option to set jail's securelevel. This is useful for jails run with non-root privileges. PR: bin/80242 MFC after: 2 weeks
2006-05-11 13:04:23 +00:00
.It Fl s Ar securelevel
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
Set the
Markup fixes.
2006-09-29 17:57:04 +00:00
.Va kern.securelevel
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
MIB entry to the specified value inside the newly created jail.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
This is deprecated and is equivalent to the
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Va securelevel
parameter.
o Add -u <username> flag to jail(8): set user context before exec. PR: bin/44320 Submitted by: Mike Matsnev <mike@po.cs.msu.su> Reviewed by: -current MFC after: 6 weeks
2003-03-27 12:16:58 +00:00
.It Fl u Ar username
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
The user name from host environment as whom jailed commands should run.
This is deprecated and is equivalent to the
.Va exec.jail_user
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
and
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Va exec.system_jail_user
parameters.
.It Fl U Ar username
The user name from jailed environment as whom jailed commands should run.
This is deprecated and is equivalent to the
.Va exec.jail_user
parameter.
.It Fl v
Print a message on every operation, such as running commands and
mounting filesystems.
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.El
.Pp
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
If no arguments are given after the options, the operation (except
remove) will be performed on all jails specified in the
.Xr jail.conf 5
file.
A single argument of a jail name will operate only on the specified jail.
The
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Fl r
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
and
.Fl R
options can also remove running jails that aren't in the
.Xr jail.conf 5
file, specified by name or jid.
Fix .Pp macro.
2012-05-11 22:05:30 +00:00
.Pp
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
An argument of
.Dq *
Better communicate the purpose of "-r *".
2012-01-31 19:45:32 +00:00
is a wildcard that will operate on all jails, regardless of whether
they appear in
.Xr jail.conf 5 ;
this is the surest way for
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Fl r
to remove all jails.
If hierarchical jails exist, a partial-matching wildcard definition may
be specified.
For example, an argument of
.Dq foo.*
would apply to jails with names like
.Dq foo.bar
and
.Dq foo.bar.baz .
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Pp
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
A jail may be specified with parameters directly on the command line.
In this case, the
.Xr jail.conf 5
file will not be used.
For backward compatibility, the command line may also have four fixed
parameters, without names:
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Ar path ,
.Ar hostname ,
.Ar ip ,
and
.Ar command .
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
This mode will always create a new jail, and the
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Fl c
and
Fix some inaccuracies in the extensible parameter addition. Approved by: bz (mentor)
2009-05-29 21:17:22 +00:00
.Fl m
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
options don't apply (and must not exist).
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Ss Jail Parameters
Parameters in the
.Xr jail.conf 5
file, or on the command line, are generally in
.Dq name=value
form.
Some parameters are boolean, and do not have a value but are set by the
name alone with or without a
.Dq no
prefix, e.g.
.Va persist
or
.Va nopersist .
They can also be given the values
.Dq true
and
.Dq false .
Other partameters may have more than one value, specified as a
comma-separated list or with
.Dq +=
in the configuration file (see
.Xr jail.conf 5
for details).
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Pp
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
The
.Nm
utility recognizes two classes of parameters. There are the true jail
parameters that are passed to the kernel when the jail is created,
can be seen with
.Xr jls 8 ,
and can (usually) be changed with
.Dq Nm Fl m.
Then there are pseudo-parameters that are only used by
.Nm
itself.
.Pp
Jails have a set a core parameters, and kernel modules can add their own
jail parameters.
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
The current set of available parameters can be retrieved via
.Dq Nm sysctl Fl d Va security.jail.param .
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
Any parameters not set will be given default values, often based on the
current environment.
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
The core parameters are:
.Bl -tag -width indent
.It Va jid
The jail identifier.
This will be assigned automatically to a new jail (or can be explicitly
set), and can be used to identify the jail for later modification, or
for such commands as
.Xr jls 8
or
.Xr jexec 8 .
.It Va name
The jail name.
This is an arbitrary string that identifies a jail (except it may not
contain a
.Sq \&. ) .
Like the
.Va jid ,
it can be passed to later
.Nm
commands, or to
.Xr jls 8
or
.Xr jexec 8 .
If no
.Va name
is supplied, a default is assumed that is the same as the
.Va jid .
The
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Va name
parameter is implied by the
.Xr jail.conf 5
file format, and need not be explicitly set when using the configuration
file.
.It Va path
The directory which is to be the root of the prison.
Any commands run inside the prison, either by
.Nm
or from
.Xr jexec 8 ,
are run from this directory.
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.It Va ip4.addr
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
A list of IPv4 addresses assigned to the prison.
- fix typo
2010-05-05 08:43:47 +00:00
If this is set, the jail is restricted to using only these addresses.
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
Any attempts to use other addresses fail, and attempts to use wildcard
addresses silently use the jailed address instead.
For IPv4 the first address given will be kept used as the source address
in case source address selection on unbound sockets cannot find a better
match.
MFp4: Bring in updated jail support from bz_jail branch. This enhances the current jail implementation to permit multiple addresses per jail. In addtion to IPv4, IPv6 is supported as well. Due to updated checks it is even possible to have jails without an IP address at all, which basically gives one a chroot with restricted process view, no networking,.. SCTP support was updated and supports IPv6 in jails as well. Cpuset support permits jails to be bound to specific processor sets after creation. Jails can have an unrestricted (no duplicate protection, etc.) name in addition to the hostname. The jail name cannot be changed from within a jail and is considered to be used for management purposes or as audit-token in the future. DDB 'show jails' command was added to aid debugging. Proper compat support permits 32bit jail binaries to be used on 64bit systems to manage jails. Also backward compatibility was preserved where possible: for jail v1 syscalls, as well as with user space management utilities. Both jail as well as prison version were updated for the new features. A gap was intentionally left as the intermediate versions had been used by various patches floating around the last years. Bump __FreeBSD_version for the afore mentioned and in kernel changes. Special thanks to: - Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches and Olivier Houchard (cognet) for initial single-IPv6 patches. - Jeff Roberson (jeff) and Randall Stewart (rrs) for their help, ideas and review on cpuset and SCTP support. - Robert Watson (rwatson) for lots and lots of help, discussions, suggestions and review of most of the patch at various stages. - John Baldwin (jhb) for his help. - Simon L. Nielsen (simon) as early adopter testing changes on cluster machines as well as all the testers and people who provided feedback the last months on freebsd-jail and other channels. - My employer, CK Software GmbH, for the support so I could work on this. Reviewed by: (see above) MFC after: 3 months (this is just so that I get the mail) X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
It is only possible to start multiple jails with the same IP address,
if none of the jails has more than this single overlapping IP address
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
assigned to itself.
Add ip4.saddrsel/ip4.nosaddrsel (and equivalent for ip6) to control whether to use source address selection (default) or the primary jail address for unbound outgoing connections. This is intended to be used by people upgrading from single-IP jails to multi-IP jails but not having to change firewall rules, application ACLs, ... but to force their connections (unless otherwise changed) to the primry jail IP they had been used for years, as well as for people prefering to implement similar policies. Note that for IPv6, if configured incorrectly, this might lead to scope violations, which single-IPv6 jails could as well, as by the design of jails. [1] Reviewed by: jamie, hrs (ipv6 part) Pointed out by: hrs [1] MFC After: 2 weeks Asked for by: Jase Thew (bazerka beardz.net)
2010-01-17 12:57:11 +00:00
.It Va ip4.saddrsel
A boolean option to change the formerly mentioned behaviour and disable
IPv4 source address selection for the prison in favour of the primary
IPv4 address of the jail.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
Source address selection is enabled by default for all jails and the
Add ip4.saddrsel/ip4.nosaddrsel (and equivalent for ip6) to control whether to use source address selection (default) or the primary jail address for unbound outgoing connections. This is intended to be used by people upgrading from single-IP jails to multi-IP jails but not having to change firewall rules, application ACLs, ... but to force their connections (unless otherwise changed) to the primry jail IP they had been used for years, as well as for people prefering to implement similar policies. Note that for IPv6, if configured incorrectly, this might lead to scope violations, which single-IPv6 jails could as well, as by the design of jails. [1] Reviewed by: jamie, hrs (ipv6 part) Pointed out by: hrs [1] MFC After: 2 weeks Asked for by: Jase Thew (bazerka beardz.net)
2010-01-17 12:57:11 +00:00
.Va ip4.nosaddrsel
setting of a parent jail is not inherited for any child jails.
Some jail parameters (in particular, "ip4" and "ip6" for IP address restrictions) were found to be inadequately described by a boolean. Define a new parameter type with three values (disable, new, inherit) to handle these and future cases. Approved by: re (kib), bz (mentor) Discussed with: rwatson
2009-07-25 14:48:57 +00:00
.It Va ip4
Spelling fixes.
2010-08-01 09:37:36 +00:00
Control the availability of IPv4 addresses.
Some jail parameters (in particular, "ip4" and "ip6" for IP address restrictions) were found to be inadequately described by a boolean. Define a new parameter type with three values (disable, new, inherit) to handle these and future cases. Approved by: re (kib), bz (mentor) Discussed with: rwatson
2009-07-25 14:48:57 +00:00
Possible values are
.Dq inherit
to allow unrestricted access to all system addresses,
.Dq new
to restrict addresses via
.Va ip4.addr
above, and
.Dq disable
to stop the jail from using IPv4 entirely.
Setting the
.Va ip4.addr
parameter implies a value of
.Dq new .
Add ip4.saddrsel/ip4.nosaddrsel (and equivalent for ip6) to control whether to use source address selection (default) or the primary jail address for unbound outgoing connections. This is intended to be used by people upgrading from single-IP jails to multi-IP jails but not having to change firewall rules, application ACLs, ... but to force their connections (unless otherwise changed) to the primry jail IP they had been used for years, as well as for people prefering to implement similar policies. Note that for IPv6, if configured incorrectly, this might lead to scope violations, which single-IPv6 jails could as well, as by the design of jails. [1] Reviewed by: jamie, hrs (ipv6 part) Pointed out by: hrs [1] MFC After: 2 weeks Asked for by: Jase Thew (bazerka beardz.net)
2010-01-17 12:57:11 +00:00
.It Va ip6.addr , Va ip6.saddrsel , Va ip6
A set of IPv6 options for the prison, the counterparts to
.Va ip4.addr ,
.Va ip4.saddrsel
Some jail parameters (in particular, "ip4" and "ip6" for IP address restrictions) were found to be inadequately described by a boolean. Define a new parameter type with three values (disable, new, inherit) to handle these and future cases. Approved by: re (kib), bz (mentor) Discussed with: rwatson
2009-07-25 14:48:57 +00:00
and
.Va ip4
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
above.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.It vnet
Create the prison with its own virtual network stack,
with its own network interfaces, addresses, routing table, etc.
The kernel must have been compiled with the
.Sy VIMAGE option
for this to be available.
Possible values are
.Dq inherit
to use the system network stack, possibly with restricted IP addresses,
and
.Dq new
to create a new network stack.
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.It Va host.hostname
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
The hostname of the prison.
Place hostnames and similar information fully under the prison system. The system hostname is now stored in prison0, and the global variable "hostname" has been removed, as has the hostname_mtx mutex. Jails may have their own host information, or they may inherit it from the parent/system. The proper way to read the hostname is via getcredhostname(), which will copy either the hostname associated with the passed cred, or the system hostname if you pass NULL. The system hostname can still be accessed directly (and without locking) at prison0.pr_host, but that should be avoided where possible. The "similar information" referred to is domainname, hostid, and hostuuid, which have also become prison parameters and had their associated global variables removed. Approved by: bz (mentor)
2009-05-29 21:27:12 +00:00
Other similar parameters are
.Va host.domainname ,
.Va host.hostuuid
and
.Va host.hostid .
Some jail parameters (in particular, "ip4" and "ip6" for IP address restrictions) were found to be inadequately described by a boolean. Define a new parameter type with three values (disable, new, inherit) to handle these and future cases. Approved by: re (kib), bz (mentor) Discussed with: rwatson
2009-07-25 14:48:57 +00:00
.It Va host
Set the origin of hostname and related information.
Possible values are
.Dq inherit
to use the system information and
.Dq new
for the jail to use the information from the above fields.
Setting any of the above fields implies a value of
.Dq new .
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.It Va securelevel
The value of the jail's
.Va kern.securelevel
sysctl.
A jail never has a lower securelevel than the default system, but by
setting this parameter it may have a higher one.
If the system securelevel is changed, any jail securelevels will be at
least as secure.
Add support for mounting devfs inside jails. A new jail(8) option "devfs_ruleset" defines the ruleset enforcement for mounting devfs inside jails. A value of -1 disables mounting devfs in jails, a value of zero means no restrictions. Nested jails can only have mounting devfs disabled or inherit parent's enforcement as jails are not allowed to view or manipulate devfs(8) rules. Utilizes new functions introduced in r231265. Reviewed by: jamie MFC after: 1 month
2012-02-09 10:22:08 +00:00
.It Va devfs_ruleset
The number of the devfs ruleset that is enforced for mounting devfs in
mdoc(7) stype - start new sentences on new line MFC after: 1 week
2012-02-28 07:35:07 +00:00
this jail.
A value of zero (default) means no ruleset is enforced.
Descendant jails inherit the parent jail's devfs ruleset enforcement.
Mounting devfs inside a jail is possible only if the
Add support for mounting devfs inside jails. A new jail(8) option "devfs_ruleset" defines the ruleset enforcement for mounting devfs inside jails. A value of -1 disables mounting devfs in jails, a value of zero means no restrictions. Nested jails can only have mounting devfs disabled or inherit parent's enforcement as jails are not allowed to view or manipulate devfs(8) rules. Utilizes new functions introduced in r231265. Reviewed by: jamie MFC after: 1 month
2012-02-09 10:22:08 +00:00
.Va allow.mount
To improve control over the use of mount(8) inside a jail(8), introduce a new jail parameter node with the following parameters: allow.mount.devfs: allow mounting the devfs filesystem inside a jail allow.mount.nullfs: allow mounting the nullfs filesystem inside a jail Both parameters are disabled by default (equals the behavior before devfs and nullfs in jails). Administrators have to explicitly allow mounting devfs and nullfs for each jail. The value "-1" of the devfs_ruleset parameter is removed in favor of the new allow setting. Reviewed by: jamie Suggested by: pjd MFC after: 2 weeks
2012-02-23 18:51:24 +00:00
and
.Va allow.mount.devfs
permissions are effective and
Add support for mounting devfs inside jails. A new jail(8) option "devfs_ruleset" defines the ruleset enforcement for mounting devfs inside jails. A value of -1 disables mounting devfs in jails, a value of zero means no restrictions. Nested jails can only have mounting devfs disabled or inherit parent's enforcement as jails are not allowed to view or manipulate devfs(8) rules. Utilizes new functions introduced in r231265. Reviewed by: jamie MFC after: 1 month
2012-02-09 10:22:08 +00:00
.Va enforce_statfs
mdoc(7) stype - start new sentences on new line MFC after: 1 week
2012-02-28 07:35:07 +00:00
is set to a value lower than 2.
Devfs rules and rulesets cannot be viewed or modified from inside a jail.
A new jail(8) with a configuration file, ultimately to replace the work currently done by /etc/rc.d/jail. MFC after: 3 months
2012-04-26 17:36:05 +00:00
.Pp
NOTE: It is important that only appropriate device nodes in devfs be
exposed to a jail; access to disk devices in the jail may permit processes
in the jail to bypass the jail sandboxing by modifying files outside of
the jail.
See
.Xr devfs 8
for information on how to use devfs rules to limit access to entries
in the per-jail devfs.
A simple devfs ruleset for jails is available as ruleset #4 in
.Pa /etc/defaults/devfs.rules .
Add a limit for child jails via the "children.cur" and "children.max" parameters. This replaces the simple "allow.jails" permission. Approved by: bz (mentor)
2009-06-23 20:35:51 +00:00
.It Va children.max
The number of child jails allowed to be created by this jail (or by
other jails under this jail).
This limit is zero by default, indicating the jail is not allowed to
create child jails.
See the
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Sx "Hierarchical Jails"
Add a limit for child jails via the "children.cur" and "children.max" parameters. This replaces the simple "allow.jails" permission. Approved by: bz (mentor)
2009-06-23 20:35:51 +00:00
section for more information.
.It Va children.cur
The number of descendents of this jail, including its own child jails
and any jails created under them.
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.It Va enforce_statfs
This determines which information processes in a jail are able to get
about mount points.
It affects the behaviour of the following syscalls:
.Xr statfs 2 ,
.Xr fstatfs 2 ,
.Xr getfsstat 2
and
.Xr fhstatfs 2
(as well as similar compatibility syscalls).
When set to 0, all mount points are available without any restrictions.
When set to 1, only mount points below the jail's chroot directory are
visible.
In addition to that, the path to the jail's chroot directory is removed
from the front of their pathnames.
When set to 2 (default), above syscalls can operate only on a mount-point
where the jail's chroot directory is located.
.It Va persist
Setting this boolean parameter allows a jail to exist without any
processes.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
Normally, a command is run as part of jail creation, and then the jail
is destroyed as its last process exits.
Back out r210975, which changed documentation to match the now backed-out r210974.
2010-08-08 23:24:23 +00:00
A new jail must have either the
Note that a jail without a command parameter will be persistent, instead of explicitly requiring one of "command" or "persist". MFC after: 3 days
2010-08-06 22:06:12 +00:00
.Va persist
Back out r210975, which changed documentation to match the now backed-out r210974.
2010-08-08 23:24:23 +00:00
parameter or
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Va exec.start
or
Back out r210975, which changed documentation to match the now backed-out r210974.
2010-08-08 23:24:23 +00:00
.Va command
pseudo-parameter set.
Fix some inaccuracies in the extensible parameter addition. Approved by: bz (mentor)
2009-05-29 21:17:22 +00:00
.It Va cpuset.id
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
The ID of the cpuset associated with this jail (read-only).
.It Va dying
This is true if the jail is in the process of shutting down (read-only).
.It Va parent
The
.Va jid
of the parent of this jail, or zero if this is a top-level jail
(read-only).
.It Va allow.*
Some restrictions of the jail environment may be set on a per-jail
basis.
With the exception of
.Va allow.set_hostname ,
these boolean parameters are off by default.
.Bl -tag -width indent
.It Va allow.set_hostname
The jail's hostname may be changed via
.Xr hostname 1
or
.Xr sethostname 3 .
.It Va allow.sysvipc
A process within the jail has access to System V IPC primitives.
In the current jail implementation, System V primitives share a single
namespace across the host and jail environments, meaning that processes
within a jail would be able to communicate with (and potentially interfere
with) processes outside of the jail, and in other jails.
.It Va allow.raw_sockets
The prison root is allowed to create raw sockets.
Setting this parameter allows utilities like
.Xr ping 8
and
.Xr traceroute 8
to operate inside the prison.
If this is set, the source IP addresses are enforced to comply
with the IP address bound to the jail, regardless of whether or not
the
.Dv IP_HDRINCL
flag has been set on the socket.
Since raw sockets can be used to configure and interact with various
network subsystems, extra caution should be used where privileged access
to jails is given out to untrusted parties.
.It Va allow.chflags
Fix a typo in the jail(8) manpage. Submitted by: Jille Timmermans <jille quis cx> MFC after: 1 week
2009-10-18 19:50:15 +00:00
Normally, privileged users inside a jail are treated as unprivileged by
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Xr chflags 2 .
When this parameter is set, such users are treated as privileged, and
may manipulate system file flags subject to the usual constraints on
.Va kern.securelevel .
.It Va allow.mount
privileged users inside the jail will be able to mount and unmount file
system types marked as jail-friendly.
The
.Xr lsvfs 1
command can be used to find file system types available for mount from
within a jail.
Always disable mount and unmount for jails with enforce_statfs==2. A working statfs(2) is required for umount(8) in jail. Reviewed by: pjd, kib Approved by: re (kib) MFC after: 2 weeks
2011-08-02 19:44:40 +00:00
This permission is effective only if
.Va enforce_statfs
is set to a value lower than 2.
To improve control over the use of mount(8) inside a jail(8), introduce a new jail parameter node with the following parameters: allow.mount.devfs: allow mounting the devfs filesystem inside a jail allow.mount.nullfs: allow mounting the nullfs filesystem inside a jail Both parameters are disabled by default (equals the behavior before devfs and nullfs in jails). Administrators have to explicitly allow mounting devfs and nullfs for each jail. The value "-1" of the devfs_ruleset parameter is removed in favor of the new allow setting. Reviewed by: jamie Suggested by: pjd MFC after: 2 weeks
2012-02-23 18:51:24 +00:00
.It Va allow.mount.devfs
privileged users inside the jail will be able to mount and unmount the
devfs file system.
This permission is effective only together with
.Va allow.mount
and if
.Va enforce_statfs
mdoc(7) stype - start new sentences on new line MFC after: 1 week
2012-02-28 07:35:07 +00:00
is set to a value lower than 2.
Please consider restricting the devfs ruleset with the
To improve control over the use of mount(8) inside a jail(8), introduce a new jail parameter node with the following parameters: allow.mount.devfs: allow mounting the devfs filesystem inside a jail allow.mount.nullfs: allow mounting the nullfs filesystem inside a jail Both parameters are disabled by default (equals the behavior before devfs and nullfs in jails). Administrators have to explicitly allow mounting devfs and nullfs for each jail. The value "-1" of the devfs_ruleset parameter is removed in favor of the new allow setting. Reviewed by: jamie Suggested by: pjd MFC after: 2 weeks
2012-02-23 18:51:24 +00:00
.Va devfs_ruleset
option.
.It Va allow.mount.nullfs
privileged users inside the jail will be able to mount and unmount the
nullfs file system.
This permission is effective only together with
.Va allow.mount
and if
.Va enforce_statfs
is set to a value lower than 2.
Add procfs to jail-mountable filesystems. Reviewed by: jamie MFC after: 1 week
2012-02-29 00:30:18 +00:00
.It Va allow.mount.procfs
privileged users inside the jail will be able to mount and unmount the
procfs file system.
This permission is effective only together with
.Va allow.mount
and if
.Va enforce_statfs
is set to a value lower than 2.
Analogous to r232059, add a parameter for the ZFS file system: allow.mount.zfs: allow mounting the zfs filesystem inside a jail This way the permssions for mounting all current VFCF_JAIL filesystems inside a jail are controlled wia allow.mount.* jail parameters. Update sysctl descriptions. Update jail(8) and zfs(8) manpages. TODO: document the connection of allow.mount.* and VFCF_JAIL for kernel developers MFC after: 10 days
2012-02-26 16:30:39 +00:00
.It Va allow.mount.zfs
privileged users inside the jail will be able to mount and unmount the
ZFS file system.
This permission is effective only together with
.Va allow.mount
and if
.Va enforce_statfs
mdoc(7) stype - start new sentences on new line MFC after: 1 week
2012-02-28 07:35:07 +00:00
is set to a value lower than 2.
See
Analogous to r232059, add a parameter for the ZFS file system: allow.mount.zfs: allow mounting the zfs filesystem inside a jail This way the permssions for mounting all current VFCF_JAIL filesystems inside a jail are controlled wia allow.mount.* jail parameters. Update sysctl descriptions. Update jail(8) and zfs(8) manpages. TODO: document the connection of allow.mount.* and VFCF_JAIL for kernel developers MFC after: 10 days
2012-02-26 16:30:39 +00:00
.Xr zfs 8
for information on how to configure the ZFS filesystem to operate from
within a jail.
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.It Va allow.quotas
The prison root may administer quotas on the jail's filesystem(s).
This includes filesystems that the jail may share with other jails or
with non-jailed parts of the system.
.It Va allow.socket_af
Sockets within a jail are normally restricted to IPv4, IPv6, local
(UNIX), and route. This allows access to other protocol stacks that
have not had jail functionality added to them.
.El
o Add -u <username> flag to jail(8): set user context before exec. PR: bin/44320 Submitted by: Mike Matsnev <mike@po.cs.msu.su> Reviewed by: -current MFC after: 6 weeks
2003-03-27 12:16:58 +00:00
.El
.Pp
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
There are pseudo-parameters that aren't passed to the kernel, but are
used by
.Nm
to set up the prison environment, often by running specified commands
when jails are created or removed.
The
.Va exec.*
command parameters are
.Xr sh 1
command lines that are run in either the system or prison environment.
They may be given multiple values, which run would the specified
commands in sequence.
All commands must succed (return a zero exit status), or the jail will
not be created or removed.
.Pp
The pseudo-parameters are:
.Bl -tag -width indent
.It Va exec.prestart
Command(s) to run in the system environment before a prison is created.
.It Va exec.start
Command(s) to run in the prison environment when a jail is created.
A typical command to run is
.Dq sh /etc/rc .
.It Va command
A synonym for
.Va exec.start
for use when specifying a prison directly on the command line.
Unlike other parameters whose value is a single string,
.Va command
uses the remainder of the
.Nm
command line as its own arguments.
.It Va exec.poststart
Command(s) to run in the system environment after a jail is created,
and after any
.Va exec.start
commands have completed.
.It Va exec.prestop
Command(s) to run in the system environment before a jail is removed.
.It Va exec.stop
Command(s) to run in the prison environment before a jail is removed,
and after any
.Va exec.prestop
commands have completed.
A typical command to run is
.Dq sh /etc/rc.shutdown .
.It Va exec.poststop
Command(s) to run in the system environment after a jail is removed.
.It Va exec.clean
Run commands in a clean environment.
The environment is discarded except for
.Ev HOME , SHELL , TERM
and
.Ev USER .
.Ev HOME
and
.Ev SHELL
are set to the target login's default values.
.Ev USER
is set to the target login.
.Ev TERM
is imported from the current environment.
The environment variables from the login class capability database for the
target login are also set.
.It Va exec.jail_user
The user to run commands as, when running in the prison environment.
The default is to run the commands as the current user.
.It Va exec.system_jail_user
This boolean option looks for the
.Va exec.jail_user
in the system
.Xr passwd 5
file, instead of in the prison's file.
.It Va exec.system_user
The user to run commands as, when running in the system environment.
The default is to run the commands as the current user.
.It Va exec.timeout
The maximum amount of time to wait for a command to complete.
If a command is still running after this many seconds have passed,
the jail not be created or removed.
.It Va exec.consolelog
A file to direct command output (stdout and stderr) to.
.It Va exec.fib
The FIB (routing table) to set when running commands inside the prison.
.It Va stop.timeout
The maximum amount of time to wait for a prison's processes to exit
after sending them a
.Dv SIGTERM
signal (which happens after the
.Va exec.stop commands have completed).
After this many seconds have passed, the prison will be removed, which
will kill any remaining processes.
If this is set to zero, no
.Dv SIGTERM
is sent and the prison is immediately removed.
The default is 10 seconds.
.It Va interface
A network interface to add the prison's IP addresses
.Va ( ip4.addr
and
.Va ip6.addr )
to.
An alias for each address will be added to the interface before the
prison is created, and will be removed from the interface after the
prison is removed.
.It Op Va ip4.addr
In addition to the IP addresses that are passed to the kernel, and
interface and/or a netmask may also be specified, in the form
.Dq Ar interface Ns | Ns Ar ip-address Ns / Ns Ar netmask .
If an interface is given before the IP address, an alias for the address
will be added to that interface, as it is with the
.Va interface
parameter. If a netmask in either dotted-quad or CIDR form is given
after IP address, it will be used when adding the IP alias.
.It Op Va ip6.addr
In addition to the IP addresses that are passed to the kernel,
and interface and/or a prefix may also be specified, in the form
.Dq Ar interface Ns | Ns Ar ip-address Ns / Ns Ar prefix .
.It Va vnet.interface
A network interface to give to a vnet-enabled jail after is it created.
The interface will automatically be returned when the jail is removed.
.It Va ip_hostname
Resolve the
.Va host.hostname
parameter and add all IP addresses returned by the resolver
to the list of addresses
.Va ( ip4.addr
or
.Va ip6.addr )
for this prison.
This may affect default address selection for outgoing IPv4 connections
of prisons.
The address first returned by the resolver for each address family
will be used as primary address.
.It Va mount
A filesystem to mount before creating the jail (and to unmount after
removing it), given as a single
.Xr fstab 5
line.
.It Va mount.fstab
An
.Xr fstab 5
format file containing filesystems to mount before creating a jail.
.It Va mount.devfs
Mount a
.Xr devfs
Use the defvs_ruleset paramater when mounting a jail's /dev, instead of a mount.devfs.ruleset pseudo-parameter.
2012-02-27 22:37:35 +00:00
filesystem on the chrooted /dev directory, and apply the ruleset in the
.Va devfs_ruleset
parameter (or a default of ruleset 4: devfsrules_jail)
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
to restrict the devices visible inside the prison.
.It Va allow.dying
Allow making changes to a
.Va dying
jail.
.It Va depend
Specify a jail (or jails) that this jail depends on.
Any such jails must be fully created, up to the last
.Va exec.poststart
command, before any action will taken to create this jail.
When jails are removed the opposite is true:
this jail must be fully removed, up to the last
.Va exec.poststop
command, before the jail(s) it depends on are stopped.
.El
.Sh EXAMPLES
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
Jails are typically set up using one of two philosophies: either to
constrain a specific application (possibly running with privilege), or
Markup nits.
2004-06-05 20:27:10 +00:00
to create a
.Dq "virtual system image"
running a variety of daemons and services.
In both cases, a fairly complete file system install of
.Fx
is
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
required, so as to provide the necessary command line tools, daemons,
Typos and nits.
2004-05-20 06:37:44 +00:00
libraries, application configuration files, etc.
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
However, for a virtual server configuration, a fair amount of
Markup nits.
2004-06-05 20:27:10 +00:00
additional work is required so as to configure the
.Dq boot
process.
Typos and nits.
2004-05-20 06:37:44 +00:00
This manual page documents the configuration steps necessary to support
Correct typo.
2004-02-06 21:05:42 +00:00
either of these steps, although the configuration steps may be
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
refined based on local requirements.
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Ss "Setting up a Jail Directory Tree"
Note that the jail setup example is meant to be fed to sh(1), not csh(1). PR: docs/87351 Submitted by: "Eli K. Breen" <bsd@unixforge.net> Approved by: simon, brooks MFC after: 3 days
2005-10-26 20:19:39 +00:00
To set up a jail directory tree containing an entire
mdoc(7) police: tidy up previous delta.
2002-01-10 15:14:22 +00:00
.Fx
Note that the jail setup example is meant to be fed to sh(1), not csh(1). PR: docs/87351 Submitted by: "Eli K. Breen" <bsd@unixforge.net> Approved by: simon, brooks MFC after: 3 days
2005-10-26 20:19:39 +00:00
distribution, the following
.Xr sh 1
command script can be used:
Remove whitespace at EOL.
2001-07-15 08:06:20 +00:00
.Bd -literal
Add example of how to create a jail.
1999-07-09 21:35:50 +00:00
D=/here/is/the/jail
cd /usr/src
Revert r221655: Various people voiced their concerns about these changes. Until this is resolved, we should use the old version.
2011-05-08 14:57:01 +00:00
mkdir -p $D
o Replace part-wise instructions for building world for jail(8) with a simple make world; while this does a bit more work, it means that jail(8) doesn't have to be kept in sync with /usr/src/Makefile{,.inc1} which is a moving target. MFC candidate. Submitted by: FUJISHIMA Satsuki <sf@FreeBSD.org> Reviewed by: phk Also pointed out by: Phil Kernick <Phil@Kernick.org>
2001-03-11 20:37:11 +00:00
make world DESTDIR=$D
Fix example, we do not need NO_MAKEDEV_RUN any more. XXX: this example should be updated with a good example of devfs(8) rules.
2002-10-22 15:03:51 +00:00
make distribution DESTDIR=$D
Add example of how to create a jail.
1999-07-09 21:35:50 +00:00
.Ed
Add some wisdom to the jail setup instructions.
2001-12-14 20:20:50 +00:00
.Pp
Typos and nits.
2004-05-20 06:37:44 +00:00
In many cases this example would put far more in the jail than needed.
In the other extreme case a jail might contain only one file:
Add some wisdom to the jail setup instructions.
2001-12-14 20:20:50 +00:00
the executable to be run in the jail.
.Pp
We recommend experimentation and caution that it is a lot easier to
mdoc(7) police: tidy up previous delta.
2002-01-10 15:14:22 +00:00
start with a
.Dq fat
jail and remove things until it stops working,
than it is to start with a
.Dq thin
jail and add things until it works.
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Ss "Setting Up a Jail"
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
Do what was described in
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Sx "Setting Up a Jail Directory Tree"
to build the jail directory tree.
For the sake of this example, we will
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
assume you built it in
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Pa /data/jail/testjail ,
for a jail named
.Dq testjail .
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
Substitute below as needed with your
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
own directory, IP address, and hostname.
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
.Ss "Setting up the Host Environment"
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
First, you will want to set up your real system's environment to be
mdoc(7) police: split punctuation characters + misc fixes.
2001-02-01 16:44:04 +00:00
.Dq jail-friendly .
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
For consistency, we will refer to the parent box as the
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Dq "host environment" ,
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
and to the jailed virtual machine as the
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Dq "jail environment" .
Sentences should not start with conjunctions. Change "Because" to "Since". Pointed out by: Ceri
2004-06-01 20:32:44 +00:00
Since jail is implemented using IP aliases, one of the first things to do
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
is to disable IP services on the host system that listen on all local
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
IP addresses for a service.
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
If a network service is present in the host environment that binds all
available IP addresses rather than specific IP addresses, it may service
MFp4: Bring in updated jail support from bz_jail branch. This enhances the current jail implementation to permit multiple addresses per jail. In addtion to IPv4, IPv6 is supported as well. Due to updated checks it is even possible to have jails without an IP address at all, which basically gives one a chroot with restricted process view, no networking,.. SCTP support was updated and supports IPv6 in jails as well. Cpuset support permits jails to be bound to specific processor sets after creation. Jails can have an unrestricted (no duplicate protection, etc.) name in addition to the hostname. The jail name cannot be changed from within a jail and is considered to be used for management purposes or as audit-token in the future. DDB 'show jails' command was added to aid debugging. Proper compat support permits 32bit jail binaries to be used on 64bit systems to manage jails. Also backward compatibility was preserved where possible: for jail v1 syscalls, as well as with user space management utilities. Both jail as well as prison version were updated for the new features. A gap was intentionally left as the intermediate versions had been used by various patches floating around the last years. Bump __FreeBSD_version for the afore mentioned and in kernel changes. Special thanks to: - Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches and Olivier Houchard (cognet) for initial single-IPv6 patches. - Jeff Roberson (jeff) and Randall Stewart (rrs) for their help, ideas and review on cpuset and SCTP support. - Robert Watson (rwatson) for lots and lots of help, discussions, suggestions and review of most of the patch at various stages. - John Baldwin (jhb) for his help. - Simon L. Nielsen (simon) as early adopter testing changes on cluster machines as well as all the testers and people who provided feedback the last months on freebsd-jail and other channels. - My employer, CK Software GmbH, for the support so I could work on this. Reviewed by: (see above) MFC after: 3 months (this is just so that I get the mail) X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
requests sent to jail IP addresses if the jail did not bind the port.
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
This means changing
Some minor mdoc style and spelling fixes.
2000-03-24 02:05:54 +00:00
.Xr inetd 8
to only listen on the
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
appropriate IP address, and so forth.
Add the following to
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
.Pa /etc/rc.conf
in the host environment:
.Bd -literal -offset indent
sendmail_enable="NO"
Use IP addresses out of "TEST-NET" (for use in documentation and example code) [RFC3330]. Reviewed by: simon
2006-06-11 12:57:41 +00:00
inetd_flags="-wW -a 192.0.2.23"
portmap_enable -> rpcbind_enable. Spotted by: Andrew Khlebutin <andreyh@perm.ru>
2003-03-18 14:01:02 +00:00
rpcbind_enable="NO"
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
.Ed
.Pp
Use IP addresses out of "TEST-NET" (for use in documentation and example code) [RFC3330]. Reviewed by: simon
2006-06-11 12:57:41 +00:00
.Li 192.0.2.23
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
is the native IP address for the host system, in this example.
Daemons that run out of
Fix up a few documentation nits in jail(8), as well as improve the instructions so as to reduce warnings during jail startup, etc. Add a somewhat bolder warning recommending the use of kern.jail.set_hostname to limit jail renamining.
2000-02-18 19:02:22 +00:00
.Xr inetd 8
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
can be easily set to use only the specified host IP address.
Other daemons
will need to be manually configured\(emfor some this is possible through
Fix up a few documentation nits in jail(8), as well as improve the instructions so as to reduce warnings during jail startup, etc. Add a somewhat bolder warning recommending the use of kern.jail.set_hostname to limit jail renamining.
2000-02-18 19:02:22 +00:00
the
.Xr rc.conf 5
Typos and nits.
2004-05-20 06:37:44 +00:00
flags entries; for others it is necessary to modify per-application
configuration files, or to recompile the applications.
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
The following frequently deployed services must have their individual
configuration files modified to limit the application to listening
to a specific IP address:
.Pp
To configure
.Xr sshd 8 ,
it is necessary to modify
.Pa /etc/ssh/sshd_config .
Fix up a few documentation nits in jail(8), as well as improve the instructions so as to reduce warnings during jail startup, etc. Add a somewhat bolder warning recommending the use of kern.jail.set_hostname to limit jail renamining.
2000-02-18 19:02:22 +00:00
.Pp
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
To configure
Fix up a few documentation nits in jail(8), as well as improve the instructions so as to reduce warnings during jail startup, etc. Add a somewhat bolder warning recommending the use of kern.jail.set_hostname to limit jail renamining.
2000-02-18 19:02:22 +00:00
.Xr sendmail 8 ,
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
it is necessary to modify
.Pa /etc/mail/sendmail.cf .
.Pp
For
Fix up a few documentation nits in jail(8), as well as improve the instructions so as to reduce warnings during jail startup, etc. Add a somewhat bolder warning recommending the use of kern.jail.set_hostname to limit jail renamining.
2000-02-18 19:02:22 +00:00
.Xr named 8 ,
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
it is necessary to modify
.Pa /etc/namedb/named.conf .
.Pp
In addition, a number of services must be recompiled in order to run
them in the host environment.
This includes most applications providing services using
.Xr rpc 3 ,
such as
Fixed punctuation in xrefs.
2005-01-21 20:48:00 +00:00
.Xr rpcbind 8 ,
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
.Xr nfsd 8 ,
Fix up a few documentation nits in jail(8), as well as improve the instructions so as to reduce warnings during jail startup, etc. Add a somewhat bolder warning recommending the use of kern.jail.set_hostname to limit jail renamining.
2000-02-18 19:02:22 +00:00
and
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
.Xr mountd 8 .
In general, applications for which it is not possible to specify which
IP address to bind should not be run in the host environment unless they
should also service requests sent to jail IP addresses.
syslogd can now be configured to bind to a specific address.
2001-09-03 15:42:10 +00:00
Attempting to serve
Fix up a few documentation nits in jail(8), as well as improve the instructions so as to reduce warnings during jail startup, etc. Add a somewhat bolder warning recommending the use of kern.jail.set_hostname to limit jail renamining.
2000-02-18 19:02:22 +00:00
NFS from the host environment may also cause confusion, and cannot be
easily reconfigured to use only specific IPs, as some NFS services are
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
hosted directly from the kernel.
Typos and nits.
2004-05-20 06:37:44 +00:00
Any third-party network software running
Fix up a few documentation nits in jail(8), as well as improve the instructions so as to reduce warnings during jail startup, etc. Add a somewhat bolder warning recommending the use of kern.jail.set_hostname to limit jail renamining.
2000-02-18 19:02:22 +00:00
in the host environment should also be checked and configured so that it
Typos and nits.
2004-05-20 06:37:44 +00:00
does not bind all IP addresses, which would result in those services' also
Fix up a few documentation nits in jail(8), as well as improve the instructions so as to reduce warnings during jail startup, etc. Add a somewhat bolder warning recommending the use of kern.jail.set_hostname to limit jail renamining.
2000-02-18 19:02:22 +00:00
appearing to be offered by the jail environments.
.Pp
Once
these daemons have been disabled or fixed in the host environment, it is
best to reboot so that all daemons are in a known state, to reduce the
potential for confusion later (such as finding that when you send mail
to a jail, and its sendmail is down, the mail is delivered to the host,
Markup nits.
2004-06-05 20:27:10 +00:00
etc.).
.Ss "Configuring the Jail"
Typos and nits.
2004-05-20 06:37:44 +00:00
Start any jail for the first time without configuring the network
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
interface so that you can clean it up a little and set up accounts.
As
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
with any machine (virtual or not) you will need to set a root password, time
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
zone, etc.
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
Some of these steps apply only if you intend to run a full virtual server
Typos and nits.
2004-05-20 06:37:44 +00:00
inside the jail; others apply both for constraining a particular application
or for running a virtual server.
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
.Pp
No need to copy sysinstall into a jail with -CURRENT, since in -CURRENT, we have /usr/sbin/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 02:46:44 +00:00
Start a shell in the jail:
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Bd -literal -offset indent
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
jail -c path=/data/jail/testjail mount.devfs host.hostname=testhostname \\
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
ip4.addr=192.0.2.100 command=/bin/sh
.Ed
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Pp
Typos and nits.
2004-05-20 06:37:44 +00:00
Assuming no errors, you will end up with a shell prompt within the jail.
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
You can now run
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
.Pa /usr/sbin/sysinstall
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
and do the post-install configuration to set various configuration options,
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
or perform these actions manually by editing
.Pa /etc/rc.conf ,
etc.
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
.Pp
.Bl -bullet -offset indent -compact
.It
Move DNS configuration before sendmail configuration, because newaliases(1) may hang without proper DNS configuration. Approved by: brueffer
2005-07-25 16:04:30 +00:00
Configure
.Pa /etc/resolv.conf
so that name resolution within the jail will work correctly
.It
- As jail(8) has been almost completely rewritten, prepend another copyright/ BSD-style license, as an add-on to phk's beerware license. Please fedex some beer to phk. - Add a ``make depend'' line to the jail-building, which fixes openssl, among other things. Suggested by: kris - Add ``newaliases'' to the list of things to do when setting up a new jail, so that the jailed sendmail doesn't complain. - Correct references to ``kern.jail.set_hostname_allowed'' which now read ``jail.set_hostname_allowed''. - Add a reference to sysctl.conf where the sysctl can easily be set in a persistent way. - Add a list of cross references to the man page. - Fix a formatting nit or two.
2000-02-20 02:51:11 +00:00
Run
.Xr newaliases 1
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
to quell
.Xr sendmail 8
warnings.
- As jail(8) has been almost completely rewritten, prepend another copyright/ BSD-style license, as an add-on to phk's beerware license. Please fedex some beer to phk. - Add a ``make depend'' line to the jail-building, which fixes openssl, among other things. Suggested by: kris - Add ``newaliases'' to the list of things to do when setting up a new jail, so that the jailed sendmail doesn't complain. - Correct references to ``kern.jail.set_hostname_allowed'' which now read ``jail.set_hostname_allowed''. - Add a reference to sysctl.conf where the sysctl can easily be set in a persistent way. - Add a list of cross references to the man page. - Fix a formatting nit or two.
2000-02-20 02:51:11 +00:00
.It
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
Set a root password, probably different from the real host system
.It
Set the timezone
.It
Add accounts for users in the jail environment
.It
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
Install any packages the environment requires
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
.El
.Pp
Fix up a few documentation nits in jail(8), as well as improve the instructions so as to reduce warnings during jail startup, etc. Add a somewhat bolder warning recommending the use of kern.jail.set_hostname to limit jail renamining.
2000-02-18 19:02:22 +00:00
You may also want to perform any package-specific configuration (web servers,
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
SSH servers, etc), patch up
.Pa /etc/syslog.conf
so it logs as you would like, etc.
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
If you are not using a virtual server, you may wish to modify
.Xr syslogd 8
in the host environment to listen on the syslog socket in the jail
environment; in this example, the syslog socket would be stored in
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Pa /data/jail/testjail/var/run/log .
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
.Pp
Exit from the shell, and the jail will be shut down.
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Ss "Starting the Jail"
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
You are now ready to restart the jail and bring up the environment with
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
all of its daemons and other programs.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
Create an entry for the jail in
.Pa /etc/jail.conf :
.Bd -literal -offset indent
testjail {
path = /tmp/jail/testjail;
mount.devfs;
host.hostname = testhostname;
ip4.addr = 192.0.2.100;
interface = ed0;
exec.start = "/bin/sh /etc/rc";
exec.stop = "/bin/sh /etc/rc.shutdown";
}
.Ed
.Pp
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
To start a virtual server environment,
.Pa /etc/rc
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
is run to launch various daemons and services, and
.Pa /etc/rc.shutdown
is run to shut them down when the jail is removed.
If you are running a single application in the jail,
substitute the command used to start the application for
.Dq /bin/sh /etc/rc ;
there may be some script available to cleanly shut down the application,
or it may be sufficient to go without a stop command, and have
.Nm
send
.Dv SIGTERM
to the application.
.Pp
Start the jail by running:
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
.Bd -literal -offset indent
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
jail -c testjail
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
.Ed
.Pp
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
A few warnings may be produced; however, it should all work properly.
Remove single-space hard sentence breaks. These degrade the quality of the typeset output, tend to make diffs harder to read and provide bad examples for new-comers to mdoc.
2000-03-01 14:09:25 +00:00
You should be able to see
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
.Xr inetd 8 ,
.Xr syslogd 8 ,
and other processes running within the jail using
.Xr ps 1 ,
with the
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Ql J
flag appearing beside jailed processes.
o Add jls(8) for listing active jails. o Add jexec(8) to execute a command in an existing jail. o Add -j option for killall(1) to kill all processes in a specified jail. o Add -i option to jail(8) to output jail ID of newly created jail.
2003-04-09 03:04:12 +00:00
To see an active list of jails, use the
.Xr jls 8
utility.
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
You should also be able to
.Xr telnet 1
to the hostname or IP address of the jailed environment, and log
Some minor mdoc style and spelling fixes.
2000-03-24 02:05:54 +00:00
in using the accounts you created previously.
Add some more info about jail startup and shutdown. Submitted by: Jeremie Le Hen <jeremie@le-hen.org> MFC after: 3 days
2005-08-07 20:53:29 +00:00
.Pp
It is possible to have jails started at boot time.
Please refer to the
.Dq jail_*
variables in
.Xr rc.conf 5
for more information.
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Ss "Managing the Jail"
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
Normal machine shutdown commands, such as
.Xr halt 8 ,
.Xr reboot 8 ,
and
.Xr shutdown 8 ,
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
cannot be used successfully within the jail.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
To kill all processes from within a jail, you may use one of the
following commands, depending on what you want to accomplish:
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Bd -literal -offset indent
kill -TERM -1
kill -KILL -1
.Ed
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
.Pp
This will send the
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Dv SIGTERM
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
or
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Dv SIGKILL
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
signals to all processes in the jail - be careful not to run this from
the host environment!
Once all of the jail's processes have died, unless the jail was created
with the
.Va persist
parameter, the jail will be removed.
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
Depending on
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
the intended use of the jail, you may also want to run
.Pa /etc/rc.shutdown
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
from within the jail.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Pp
To shut down the jail from the outside, simply remove it with
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Nm
.Ar -r ,
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
which will run any commands specified by
.Va exec.stop ,
and then send
.Dv SIGTERM
and eventually
.Dv SIGKILL
to any remaining jailed processes.
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
.Pp
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
The
.Pa /proc/ Ns Ar pid Ns Pa /status
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
file contains, as its last field, the name of the jail in which the
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
process runs, or
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Dq Li -
to indicate that the process is not running within a jail.
The
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
.Xr ps 1
command also shows a
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Ql J
flag for processes in a jail.
Document 'jid' keyword for ps(1) and '-j' option for pgrep(1)/pkill(1).
2005-05-28 16:23:29 +00:00
.Pp
You can also list/kill processes based on their jail ID.
Markup fixes. Approved by: re (blanket)
2005-06-14 12:26:36 +00:00
To show processes and their jail ID, use the following command:
Document 'jid' keyword for ps(1) and '-j' option for pgrep(1)/pkill(1).
2005-05-28 16:23:29 +00:00
.Pp
Markup fixes. Approved by: re (blanket)
2005-06-14 12:26:36 +00:00
.Dl "ps ax -o pid,jid,args"
Document 'jid' keyword for ps(1) and '-j' option for pgrep(1)/pkill(1).
2005-05-28 16:23:29 +00:00
.Pp
To show and then kill processes in jail number 3 use the following commands:
.Bd -literal -offset indent
pgrep -lfj 3
pkill -j 3
.Ed
Markup fixes. Approved by: re (blanket)
2005-06-14 12:26:36 +00:00
or:
Document 'jid' keyword for ps(1) and '-j' option for pgrep(1)/pkill(1).
2005-05-28 16:23:29 +00:00
.Pp
Markup fixes. Approved by: re (blanket)
2005-06-14 12:26:36 +00:00
.Dl "killall -j 3"
Add a short section talking about jails and file systems; mention the mountand jail-aware file systems as well as quota. PR: kern/68192 Reviewed by: simon MFC after: 2 weeks
2009-01-11 18:40:56 +00:00
.Ss "Jails and File Systems"
It is not possible to
.Xr mount 8
or
s,unmount 8,umount 8, it is unmount(2) which I did not mean. Submitted by: pluknet@gmail.com MFC after: 1 week
2009-01-17 14:52:26 +00:00
.Xr umount 8
Add a short section talking about jails and file systems; mention the mountand jail-aware file systems as well as quota. PR: kern/68192 Reviewed by: simon MFC after: 2 weeks
2009-01-11 18:40:56 +00:00
any file system inside a jail unless the file system is marked
Always disable mount and unmount for jails with enforce_statfs==2. A working statfs(2) is required for umount(8) in jail. Reviewed by: pjd, kib Approved by: re (kib) MFC after: 2 weeks
2011-08-02 19:44:40 +00:00
jail-friendly, the jail's
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Va allow.mount
Always disable mount and unmount for jails with enforce_statfs==2. A working statfs(2) is required for umount(8) in jail. Reviewed by: pjd, kib Approved by: re (kib) MFC after: 2 weeks
2011-08-02 19:44:40 +00:00
parameter is set and the jail's
.Va enforce_statfs
parameter is lower than 2.
Add a short section talking about jails and file systems; mention the mountand jail-aware file systems as well as quota. PR: kern/68192 Reviewed by: simon MFC after: 2 weeks
2009-01-11 18:40:56 +00:00
.Pp
Multiple jails sharing the same file system can influence each other.
For example a user in one jail can fill the file system also
leaving no space for processes in the other jail.
Trying to use
.Xr quota 1
to prevent this will not work either as the file system quotas
are not aware of jails but only look at the user and group IDs.
This means the same user ID in two jails share the same file
system quota.
Fix grammar. Submitted by: richardtoohey at paradise dot net dot nz on -doc
2009-06-08 03:37:25 +00:00
One would need to use one file system per jail to make this work.
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Ss "Sysctl MIB Entries"
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
The read-only entry
o Document security.jail.jailed sysctl. PR: docs/94711 Submitted by: Andreas Kohn MFC after: 2 weeks
2006-05-03 20:13:33 +00:00
.Va security.jail.jailed
Markup fixes.
2006-09-29 17:57:04 +00:00
can be used to determine if a process is running inside a jail (value
o Document security.jail.jailed sysctl. PR: docs/94711 Submitted by: Andreas Kohn MFC after: 2 weeks
2006-05-03 20:13:33 +00:00
is one) or not (value is zero).
.Pp
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
The variable
.Va security.jail.max_af_ips
determines how may address per address family a prison may have.
The default is 255.
document security.jail.list sysctl in jail(8) PR: docs/96807 MFC after: 3
2006-05-08 19:55:17 +00:00
.Pp
Place hostnames and similar information fully under the prison system. The system hostname is now stored in prison0, and the global variable "hostname" has been removed, as has the hostname_mtx mutex. Jails may have their own host information, or they may inherit it from the parent/system. The proper way to read the hostname is via getcredhostname(), which will copy either the hostname associated with the passed cred, or the system hostname if you pass NULL. The system hostname can still be accessed directly (and without locking) at prison0.pr_host, but that should be avoided where possible. The "similar information" referred to is domainname, hostid, and hostuuid, which have also become prison parameters and had their associated global variables removed. Approved by: bz (mentor)
2009-05-29 21:27:12 +00:00
Some MIB variables have per-jail settings.
- Add a note that there are two MIB variables that have per-jail settings. Reviewed by: rwatson Approved by: blackend (mentor)
2003-11-11 18:34:29 +00:00
Changes to these variables by a jailed process do not effect the host
environment, only the jail environment.
Place hostnames and similar information fully under the prison system. The system hostname is now stored in prison0, and the global variable "hostname" has been removed, as has the hostname_mtx mutex. Jails may have their own host information, or they may inherit it from the parent/system. The proper way to read the hostname is via getcredhostname(), which will copy either the hostname associated with the passed cred, or the system hostname if you pass NULL. The system hostname can still be accessed directly (and without locking) at prison0.pr_host, but that should be avoided where possible. The "similar information" referred to is domainname, hostid, and hostuuid, which have also become prison parameters and had their associated global variables removed. Approved by: bz (mentor)
2009-05-29 21:27:12 +00:00
These variables are
.Va kern.securelevel ,
.Va kern.hostname ,
.Va kern.domainname ,
.Va kern.hostid ,
- Add a note that there are two MIB variables that have per-jail settings. Reviewed by: rwatson Approved by: blackend (mentor)
2003-11-11 18:34:29 +00:00
and
Place hostnames and similar information fully under the prison system. The system hostname is now stored in prison0, and the global variable "hostname" has been removed, as has the hostname_mtx mutex. Jails may have their own host information, or they may inherit it from the parent/system. The proper way to read the hostname is via getcredhostname(), which will copy either the hostname associated with the passed cred, or the system hostname if you pass NULL. The system hostname can still be accessed directly (and without locking) at prison0.pr_host, but that should be avoided where possible. The "similar information" referred to is domainname, hostid, and hostuuid, which have also become prison parameters and had their associated global variables removed. Approved by: bz (mentor)
2009-05-29 21:27:12 +00:00
.Va kern.hostuuid .
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Ss "Hierarchical Jails"
By setting a jail's
Add a limit for child jails via the "children.cur" and "children.max" parameters. This replaces the simple "allow.jails" permission. Approved by: bz (mentor)
2009-06-23 20:35:51 +00:00
.Va children.max
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
parameter, processes within a jail may be able to create jails of their own.
These child jails are kept in a hierarchy, with jails only able to see and/or
modify the jails they created (or those jails' children).
Each jail has a read-only
.Va parent
parameter, containing the
.Va jid
of the jail that created it; a
.Va jid
of 0 indicates the jail is a child of the current jail (or is a top-level
jail if the current process isn't jailed).
.Pp
Jailed processes are not allowed to confer greater permissions than they
themselves are given, e.g. if a jail is created with
.Va allow.nomount ,
it is not able to create a jail with
.Va allow.mount
set.
Similarly, such restrictions as
.Va ip4.addr
and
.Va securelevel
may not be bypassed in child jails.
.Pp
A child jail may in turn create its own child jails if its own
Add a limit for child jails via the "children.cur" and "children.max" parameters. This replaces the simple "allow.jails" permission. Approved by: bz (mentor)
2009-06-23 20:35:51 +00:00
.Va children.max
parameter is set (remember it is zero by default).
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
These jails are visible to and can be modified by their parent and all
ancestors.
.Pp
Jail names reflect this hierarchy, with a full name being an MIB-type string
separated by dots.
For example, if a base system process creates a jail
.Dq foo ,
and a process under that jail creates another jail
.Dq bar ,
then the second jail will be seen as
.Dq foo.bar
in the base system (though it is only seen as
.Dq bar
to any processes inside jail
.Dq foo ) .
Jids on the other hand exist in a single space, and each jail must have a
unique jid.
.Pp
Like the names, a child jail's
.Va path
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
appears relative to its creator's own
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Va path .
This is by virtue of the child jail being created in the chrooted
environment of the first jail.
This Implements the mumbled about "Jail" feature. This is a seriously beefed up chroot kind of thing. The process is jailed along the same lines as a chroot does it, but with additional tough restrictions imposed on what the superuser can do. For all I know, it is safe to hand over the root bit inside a prison to the customer living in that prison, this is what it was developed for in fact: "real virtual servers". Each prison has an ip number associated with it, which all IP communications will be coerced to use and each prison has its own hostname. Needless to say, you need more RAM this way, but the advantage is that each customer can run their own particular version of apache and not stomp on the toes of their neighbors. It generally does what one would expect, but setting up a jail still takes a little knowledge. A few notes: I have no scripts for setting up a jail, don't ask me for them. The IP number should be an alias on one of the interfaces. mount a /proc in each jail, it will make ps more useable. /proc/<pid>/status tells the hostname of the prison for jailed processes. Quotas are only sensible if you have a mountpoint per prison. There are no privisions for stopping resource-hogging. Some "#ifdef INET" and similar may be missing (send patches!) If somebody wants to take it from here and develop it into more of a "virtual machine" they should be most welcome! Tools, comments, patches & documentation most welcome. Have fun... Sponsored by: http://www.rndassociates.com/ Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
.Sh SEE ALSO
o Add jls(8) for listing active jails. o Add jexec(8) to execute a command in an existing jail. o Add -j option for killall(1) to kill all processes in a specified jail. o Add -i option to jail(8) to output jail ID of newly created jail.
2003-04-09 03:04:12 +00:00
.Xr killall 1 ,
Add security.jail.mount_allowed sysctl, which allows to mount and unmount jail-friendly file systems from within a jail. Precisely it grants PRIV_VFS_MOUNT, PRIV_VFS_UNMOUNT and PRIV_VFS_MOUNT_NONUSER privileges for a jailed super-user. It is turned off by default. A jail-friendly file system is a file system which driver registers itself with VFCF_JAIL flag via VFS_SET(9) API. The lsvfs(1) command can be used to see which file systems are jail-friendly ones. There currently no jail-friendly file systems, ZFS will be the first one. In the future we may consider marking file systems like nullfs as jail-friendly. Reviewed by: rwatson
2007-04-05 21:03:05 +00:00
.Xr lsvfs 1 ,
- As jail(8) has been almost completely rewritten, prepend another copyright/ BSD-style license, as an add-on to phk's beerware license. Please fedex some beer to phk. - Add a ``make depend'' line to the jail-building, which fixes openssl, among other things. Suggested by: kris - Add ``newaliases'' to the list of things to do when setting up a new jail, so that the jailed sendmail doesn't complain. - Correct references to ``kern.jail.set_hostname_allowed'' which now read ``jail.set_hostname_allowed''. - Add a reference to sysctl.conf where the sysctl can easily be set in a persistent way. - Add a list of cross references to the man page. - Fix a formatting nit or two.
2000-02-20 02:51:11 +00:00
.Xr newaliases 1 ,
Document 'jid' keyword for ps(1) and '-j' option for pgrep(1)/pkill(1).
2005-05-28 16:23:29 +00:00
.Xr pgrep 1 ,
.Xr pkill 1 ,
- As jail(8) has been almost completely rewritten, prepend another copyright/ BSD-style license, as an add-on to phk's beerware license. Please fedex some beer to phk. - Add a ``make depend'' line to the jail-building, which fixes openssl, among other things. Suggested by: kris - Add ``newaliases'' to the list of things to do when setting up a new jail, so that the jailed sendmail doesn't complain. - Correct references to ``kern.jail.set_hostname_allowed'' which now read ``jail.set_hostname_allowed''. - Add a reference to sysctl.conf where the sysctl can easily be set in a persistent way. - Add a list of cross references to the man page. - Fix a formatting nit or two.
2000-02-20 02:51:11 +00:00
.Xr ps 1 ,
Add a short section talking about jails and file systems; mention the mountand jail-aware file systems as well as quota. PR: kern/68192 Reviewed by: simon MFC after: 2 weeks
2009-01-11 18:40:56 +00:00
.Xr quota 1 ,
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Xr jail_set 2 ,
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Xr jail.conf 5 ,
- As jail(8) has been almost completely rewritten, prepend another copyright/ BSD-style license, as an add-on to phk's beerware license. Please fedex some beer to phk. - Add a ``make depend'' line to the jail-building, which fixes openssl, among other things. Suggested by: kris - Add ``newaliases'' to the list of things to do when setting up a new jail, so that the jailed sendmail doesn't complain. - Correct references to ``kern.jail.set_hostname_allowed'' which now read ``jail.set_hostname_allowed''. - Add a reference to sysctl.conf where the sysctl can easily be set in a persistent way. - Add a list of cross references to the man page. - Fix a formatting nit or two.
2000-02-20 02:51:11 +00:00
.Xr procfs 5 ,
.Xr rc.conf 5 ,
.Xr sysctl.conf 5 ,
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Xr chroot 8 ,
When pointing users at mount_devfs to populate the /dev of a jail, tell them that they also need to use devfs rules to prevent inappropriate devices from appearing in the jail; add an Xref. In earlier versions of this man page, the user was instructed to use sh MAKEDEV jail, which only created a minimal set of device nodes.
2003-06-26 19:04:15 +00:00
.Xr devfs 8 ,
- As jail(8) has been almost completely rewritten, prepend another copyright/ BSD-style license, as an add-on to phk's beerware license. Please fedex some beer to phk. - Add a ``make depend'' line to the jail-building, which fixes openssl, among other things. Suggested by: kris - Add ``newaliases'' to the list of things to do when setting up a new jail, so that the jailed sendmail doesn't complain. - Correct references to ``kern.jail.set_hostname_allowed'' which now read ``jail.set_hostname_allowed''. - Add a reference to sysctl.conf where the sysctl can easily be set in a persistent way. - Add a list of cross references to the man page. - Fix a formatting nit or two.
2000-02-20 02:51:11 +00:00
.Xr halt 8 ,
.Xr inetd 8 ,
o Add jls(8) for listing active jails. o Add jexec(8) to execute a command in an existing jail. o Add -j option for killall(1) to kill all processes in a specified jail. o Add -i option to jail(8) to output jail ID of newly created jail.
2003-04-09 03:04:12 +00:00
.Xr jexec 8 ,
.Xr jls 8 ,
Change mount_devfs reference to "mount -t devfs". Reminded by: ru
2006-11-21 23:45:44 +00:00
.Xr mount 8 ,
- As jail(8) has been almost completely rewritten, prepend another copyright/ BSD-style license, as an add-on to phk's beerware license. Please fedex some beer to phk. - Add a ``make depend'' line to the jail-building, which fixes openssl, among other things. Suggested by: kris - Add ``newaliases'' to the list of things to do when setting up a new jail, so that the jailed sendmail doesn't complain. - Correct references to ``kern.jail.set_hostname_allowed'' which now read ``jail.set_hostname_allowed''. - Add a reference to sysctl.conf where the sysctl can easily be set in a persistent way. - Add a list of cross references to the man page. - Fix a formatting nit or two.
2000-02-20 02:51:11 +00:00
.Xr named 8 ,
.Xr reboot 8 ,
mdoc(7) police: sort xrefs.
2001-07-05 08:13:03 +00:00
.Xr rpcbind 8 ,
- As jail(8) has been almost completely rewritten, prepend another copyright/ BSD-style license, as an add-on to phk's beerware license. Please fedex some beer to phk. - Add a ``make depend'' line to the jail-building, which fixes openssl, among other things. Suggested by: kris - Add ``newaliases'' to the list of things to do when setting up a new jail, so that the jailed sendmail doesn't complain. - Correct references to ``kern.jail.set_hostname_allowed'' which now read ``jail.set_hostname_allowed''. - Add a reference to sysctl.conf where the sysctl can easily be set in a persistent way. - Add a list of cross references to the man page. - Fix a formatting nit or two.
2000-02-20 02:51:11 +00:00
.Xr sendmail 8 ,
.Xr shutdown 8 ,
.Xr sysctl 8 ,
o Sort .Xr.
2009-01-12 07:45:03 +00:00
.Xr syslogd 8 ,
s,unmount 8,umount 8, it is unmount(2) which I did not mean. Submitted by: pluknet@gmail.com MFC after: 1 week
2009-01-17 14:52:26 +00:00
.Xr umount 8
This Implements the mumbled about "Jail" feature. This is a seriously beefed up chroot kind of thing. The process is jailed along the same lines as a chroot does it, but with additional tough restrictions imposed on what the superuser can do. For all I know, it is safe to hand over the root bit inside a prison to the customer living in that prison, this is what it was developed for in fact: "real virtual servers". Each prison has an ip number associated with it, which all IP communications will be coerced to use and each prison has its own hostname. Needless to say, you need more RAM this way, but the advantage is that each customer can run their own particular version of apache and not stomp on the toes of their neighbors. It generally does what one would expect, but setting up a jail still takes a little knowledge. A few notes: I have no scripts for setting up a jail, don't ask me for them. The IP number should be an alias on one of the interfaces. mount a /proc in each jail, it will make ps more useable. /proc/<pid>/status tells the hostname of the prison for jailed processes. Quotas are only sensible if you have a mountpoint per prison. There are no privisions for stopping resource-hogging. Some "#ifdef INET" and similar may be missing (send patches!) If somebody wants to take it from here and develop it into more of a "virtual machine" they should be most welcome! Tools, comments, patches & documentation most welcome. Have fun... Sponsored by: http://www.rndassociates.com/ Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
.Sh HISTORY
The
This is not jail(2), or anything else suitable to be referenced with .Fn.
2001-08-27 12:15:44 +00:00
.Nm
The .Nm utility
2002-07-14 14:47:15 +00:00
utility appeared in
This Implements the mumbled about "Jail" feature. This is a seriously beefed up chroot kind of thing. The process is jailed along the same lines as a chroot does it, but with additional tough restrictions imposed on what the superuser can do. For all I know, it is safe to hand over the root bit inside a prison to the customer living in that prison, this is what it was developed for in fact: "real virtual servers". Each prison has an ip number associated with it, which all IP communications will be coerced to use and each prison has its own hostname. Needless to say, you need more RAM this way, but the advantage is that each customer can run their own particular version of apache and not stomp on the toes of their neighbors. It generally does what one would expect, but setting up a jail still takes a little knowledge. A few notes: I have no scripts for setting up a jail, don't ask me for them. The IP number should be an alias on one of the interfaces. mount a /proc in each jail, it will make ps more useable. /proc/<pid>/status tells the hostname of the prison for jailed processes. Quotas are only sensible if you have a mountpoint per prison. There are no privisions for stopping resource-hogging. Some "#ifdef INET" and similar may be missing (send patches!) If somebody wants to take it from here and develop it into more of a "virtual machine" they should be most welcome! Tools, comments, patches & documentation most welcome. Have fun... Sponsored by: http://www.rndassociates.com/ Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
.Fx 4.0 .
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
Hierarchical/extensible jails were introduced in
.Fx 8.0 .
A new jail(8) with a configuration file, ultimately to replace the work currently done by /etc/rc.d/jail. MFC after: 3 months
2012-04-26 17:36:05 +00:00
The configuration file was introduced in
.Fx 10.0 .
Properly manify this manpage.
1999-12-21 11:25:10 +00:00
.Sh AUTHORS
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.An -nosplit
Some minor mdoc style and spelling fixes.
2000-03-24 02:05:54 +00:00
The jail feature was written by
.An Poul-Henning Kamp
for R&D Associates
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Pa http://www.rndassociates.com/
Use Fx macro wherever possible.
2000-11-14 11:20:58 +00:00
who contributed it to
.Fx .
- As jail(8) has been almost completely rewritten, prepend another copyright/ BSD-style license, as an add-on to phk's beerware license. Please fedex some beer to phk. - Add a ``make depend'' line to the jail-building, which fixes openssl, among other things. Suggested by: kris - Add ``newaliases'' to the list of things to do when setting up a new jail, so that the jailed sendmail doesn't complain. - Correct references to ``kern.jail.set_hostname_allowed'' which now read ``jail.set_hostname_allowed''. - Add a reference to sysctl.conf where the sysctl can easily be set in a persistent way. - Add a list of cross references to the man page. - Fix a formatting nit or two.
2000-02-20 02:51:11 +00:00
.Pp
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.An Robert Watson
wrote the extended documentation, found a few bugs, added
Modified jail.8 to correct a typo (inetd_flas vs. inetd_flags), and add a comment to the effect that I'm responsible for the additional documentation, et al, so that phk gets fewer messages about my errors.
2000-02-16 23:50:43 +00:00
a few new features, and cleaned up the userland jail environment.
MFp4: Bring in updated jail support from bz_jail branch. This enhances the current jail implementation to permit multiple addresses per jail. In addtion to IPv4, IPv6 is supported as well. Due to updated checks it is even possible to have jails without an IP address at all, which basically gives one a chroot with restricted process view, no networking,.. SCTP support was updated and supports IPv6 in jails as well. Cpuset support permits jails to be bound to specific processor sets after creation. Jails can have an unrestricted (no duplicate protection, etc.) name in addition to the hostname. The jail name cannot be changed from within a jail and is considered to be used for management purposes or as audit-token in the future. DDB 'show jails' command was added to aid debugging. Proper compat support permits 32bit jail binaries to be used on 64bit systems to manage jails. Also backward compatibility was preserved where possible: for jail v1 syscalls, as well as with user space management utilities. Both jail as well as prison version were updated for the new features. A gap was intentionally left as the intermediate versions had been used by various patches floating around the last years. Bump __FreeBSD_version for the afore mentioned and in kernel changes. Special thanks to: - Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches and Olivier Houchard (cognet) for initial single-IPv6 patches. - Jeff Roberson (jeff) and Randall Stewart (rrs) for their help, ideas and review on cpuset and SCTP support. - Robert Watson (rwatson) for lots and lots of help, discussions, suggestions and review of most of the patch at various stages. - John Baldwin (jhb) for his help. - Simon L. Nielsen (simon) as early adopter testing changes on cluster machines as well as all the testers and people who provided feedback the last months on freebsd-jail and other channels. - My employer, CK Software GmbH, for the support so I could work on this. Reviewed by: (see above) MFC after: 3 months (this is just so that I get the mail) X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
.Pp
.An Bjoern A. Zeeb
added multi-IP jail support for IPv4 and IPv6 based on a patch
originally done by
.An Pawel Jakub Dawidek
for IPv4.
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Pp
.An James Gritton
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
added the extensible jail parameters, hierarchical jails,
and the configuration file.
Fix up a few documentation nits in jail(8), as well as improve the instructions so as to reduce warnings during jail startup, etc. Add a somewhat bolder warning recommending the use of kern.jail.set_hostname to limit jail renamining.
2000-02-18 19:02:22 +00:00
.Sh BUGS
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
It might be a good idea to add an
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
address alias flag such that daemons listening on all IPs
.Pq Dv INADDR_ANY
Fix up a few documentation nits in jail(8), as well as improve the instructions so as to reduce warnings during jail startup, etc. Add a somewhat bolder warning recommending the use of kern.jail.set_hostname to limit jail renamining.
2000-02-18 19:02:22 +00:00
will not bind on that address, which would facilitate building a safe
host environment such that host daemons do not impose on services offered
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
from within jails.
Typos and nits.
2004-05-20 06:37:44 +00:00
Currently, the simplest answer is to minimize services
Some minor mdoc style and spelling fixes.
2000-03-24 02:05:54 +00:00
offered on the host, possibly limiting it to services offered from
.Xr inetd 8
Fix up a few documentation nits in jail(8), as well as improve the instructions so as to reduce warnings during jail startup, etc. Add a somewhat bolder warning recommending the use of kern.jail.set_hostname to limit jail renamining.
2000-02-18 19:02:22 +00:00
which is easily configurable.
Document the potential for jail escape. Submitted by: Vedad KAJTAZ (vedad % kajtaz net) PR: 142341 Reviewed by: bz, rwatson Rewording by: rwatson Approved by: re (kensmith) MFC after: 3 days
2011-07-24 03:34:38 +00:00
.Sh NOTES
Great care should be taken when managing directories visible within the jail.
For example, if a jailed process has its current working directory set to a
directory that is moved out of the jail's chroot, then the process may gain
access to the file space outside of the jail.
It is recommended that directories always be copied, rather than moved, out
of a jail.
Reference in New Issue Copy Permalink