88 lines
2.4 KiB
Groff
88 lines
2.4 KiB
Groff
|
.\"
|
||
|
|
.\"----------------------------------------------------------------------------
|
||
|
|
.\""THE BEER-WARE LICENSE" (Revision 42):
|
||
|
|
.\"<phk@FreeBSD.ORG> wrote this file. As long as you retain this notice you
|
||
|
|
.\"can do whatever you want with this stuff. If we meet some day, and you think
|
||
|
|
.\"this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp
|
||
|
|
.\"----------------------------------------------------------------------------
|
||
|
|
.\"
|
||
|
|
.\"$Id: malloc.c,v 1.44 1999/03/28 14:16:05 phk Exp $
|
||
|
|
.\"
|
||
|
|
.\"
|
||
|
|
.Dd April 28, 1999
|
||
|
|
.Dt JAIL 2
|
||
|
|
.Os FreeBSD 4.0
|
||
|
|
.Sh NAME
|
||
|
|
.Nm jail
|
||
|
|
.Nd Imprison current process and future decendants.
|
||
|
|
.Sh SYNOPSIS
|
||
|
|
.Fd #include <sys/types.h>
|
||
|
|
.Fd #include <sys/jail.h>
|
||
|
|
.Ft int
|
||
|
|
.Fn jail "struct *jail"
|
||
|
|
.Sh DESCRIPTION
|
||
|
|
The
|
||
|
|
.Nm
|
||
|
|
system call sets up a jail and locks the current process in it.
|
||
|
|
.Pp
|
||
|
|
The argument is a pointer to a structure describing the prison:
|
||
|
|
.Bd -literal -offset indent
|
||
|
|
struct jail {
|
||
|
|
char *path;
|
||
|
|
char *hostname;
|
||
|
|
u_int32_t ip_number;
|
||
|
|
};
|
||
|
|
.Ed
|
||
|
|
.Pp
|
||
|
|
The
|
||
|
|
.Dq Li path
|
||
|
|
pointer should be set to the directory which is to be the root of the
|
||
|
|
prison.
|
||
|
|
.Pp
|
||
|
|
The
|
||
|
|
.Dq Li hostname
|
||
|
|
pointer can be set the hostname of the prison. This can be changed
|
||
|
|
from the inside of the prison.
|
||
|
|
.Pp
|
||
|
|
The
|
||
|
|
.Dq Li ip_number
|
||
|
|
can be set to the IP number assigned to the prison.
|
||
|
|
.Sh PRISON ?
|
||
|
|
Once a process has been put in a prison, it and its decendants cannot escape
|
||
|
|
the prison. It is not possible to add a process to a preexisting prison.
|
||
|
|
.Pp
|
||
|
|
Inside the prison, the concept of "superuser" is very diluted, in general
|
||
|
|
it can be assumed that nothing can be mangled from inside a prison, that
|
||
|
|
doesn't exist inside that prison (ie: the directory tree below
|
||
|
|
.Dq Li path .
|
||
|
|
.Pp
|
||
|
|
All IP activity will be forced to happen to/from the IP number specified,
|
||
|
|
which should be an alias on one of the systems interfaces.
|
||
|
|
.Pp
|
||
|
|
It is possible to identify a process as jailed by examining
|
||
|
|
.Dq Li /proc/<pid>/status :
|
||
|
|
it will show a field near the end of the line, either as
|
||
|
|
a single hyphen for a process at large, or the hostname currently
|
||
|
|
set for the prison for jailed processes.
|
||
|
|
.Sh ERRORS
|
||
|
|
.Fn Jail
|
||
|
|
calls
|
||
|
|
.Xr chroot 2
|
||
|
|
internally, so the it can fail for all the same reasons.
|
||
|
|
Please consult the
|
||
|
|
.Xr chroot 2
|
||
|
|
manual page for details.
|
||
|
|
.Sh SEE ALSO
|
||
|
|
.Xr chroot 2
|
||
|
|
.Xr chdir 2
|
||
|
|
.Sh HISTORY
|
||
|
|
The
|
||
|
|
.Fn jail
|
||
|
|
function call appeared in
|
||
|
|
.Fx 4.0 .
|
||
|
|
.Pp
|
||
|
|
The jail feature was written by Poul-Henning Kamp for
|
||
|
|
R&D Associates
|
||
|
|
.Dq Li http://www.rndassociates.com/
|
||
|
|
who contributed it to FreeBSD.
|