d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
5d49283f88
freebsd-nq/usr.sbin/jail/jail.8

1428 lines
42 KiB
Groff
Raw Normal View History

No need to copy sysinstall into a jail with -CURRENT, since in -CURRENT, we have /usr/sbin/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 02:46:44 +00:00
.\" Copyright (c) 2000, 2003 Robert N. M. Watson
A new jail(8) with a configuration file, ultimately to replace the work currently done by /etc/rc.d/jail. MFC after: 3 months
2012-04-26 17:36:05 +00:00
.\" Copyright (c) 2008-2012 James Gritton
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.\" All rights reserved.
- As jail(8) has been almost completely rewritten, prepend another copyright/ BSD-style license, as an add-on to phk's beerware license. Please fedex some beer to phk. - Add a ``make depend'' line to the jail-building, which fixes openssl, among other things. Suggested by: kris - Add ``newaliases'' to the list of things to do when setting up a new jail, so that the jailed sendmail doesn't complain. - Correct references to ``kern.jail.set_hostname_allowed'' which now read ``jail.set_hostname_allowed''. - Add a reference to sysctl.conf where the sysctl can easily be set in a persistent way. - Add a list of cross references to the man page. - Fix a formatting nit or two.
2000-02-20 02:51:11 +00:00
.\"
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\" notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\" notice, this list of conditions and the following disclaimer in the
.\" documentation and/or other materials provided with the distribution.
- As jail(8) has been almost completely rewritten, prepend another copyright/ BSD-style license, as an add-on to phk's beerware license. Please fedex some beer to phk. - Add a ``make depend'' line to the jail-building, which fixes openssl, among other things. Suggested by: kris - Add ``newaliases'' to the list of things to do when setting up a new jail, so that the jailed sendmail doesn't complain. - Correct references to ``kern.jail.set_hostname_allowed'' which now read ``jail.set_hostname_allowed''. - Add a reference to sysctl.conf where the sysctl can easily be set in a persistent way. - Add a list of cross references to the man page. - Fix a formatting nit or two.
2000-02-20 02:51:11 +00:00
.\"
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
- As jail(8) has been almost completely rewritten, prepend another copyright/ BSD-style license, as an add-on to phk's beerware license. Please fedex some beer to phk. - Add a ``make depend'' line to the jail-building, which fixes openssl, among other things. Suggested by: kris - Add ``newaliases'' to the list of things to do when setting up a new jail, so that the jailed sendmail doesn't complain. - Correct references to ``kern.jail.set_hostname_allowed'' which now read ``jail.set_hostname_allowed''. - Add a reference to sysctl.conf where the sysctl can easily be set in a persistent way. - Add a list of cross references to the man page. - Fix a formatting nit or two.
2000-02-20 02:51:11 +00:00
.\"
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.\" $FreeBSD$
Fix various bogons. Submitted by: Rudolf Cejka <cejkar@dcse.fee.vutbr.cz> Reviewed by: phk
1999-05-04 18:20:53 +00:00
.\"
jail: introduce per jail suser_enabled setting The suser_enable sysctl allows to remove a privileged rights from uid 0. This change introduce per jail setting which allow to make root a normal user. Reviewed by: jamie Previous version reviewed by: kevans, emaste, markj, me_igalic.co Discussed with: pjd Differential Revision: https://reviews.freebsd.org/D27128
2020-11-18 21:07:08 +00:00
.Dd November 18, 2020
This Implements the mumbled about "Jail" feature. This is a seriously beefed up chroot kind of thing. The process is jailed along the same lines as a chroot does it, but with additional tough restrictions imposed on what the superuser can do. For all I know, it is safe to hand over the root bit inside a prison to the customer living in that prison, this is what it was developed for in fact: "real virtual servers". Each prison has an ip number associated with it, which all IP communications will be coerced to use and each prison has its own hostname. Needless to say, you need more RAM this way, but the advantage is that each customer can run their own particular version of apache and not stomp on the toes of their neighbors. It generally does what one would expect, but setting up a jail still takes a little knowledge. A few notes: I have no scripts for setting up a jail, don't ask me for them. The IP number should be an alias on one of the interfaces. mount a /proc in each jail, it will make ps more useable. /proc/<pid>/status tells the hostname of the prison for jailed processes. Quotas are only sensible if you have a mountpoint per prison. There are no privisions for stopping resource-hogging. Some "#ifdef INET" and similar may be missing (send patches!) If somebody wants to take it from here and develop it into more of a "virtual machine" they should be most welcome! Tools, comments, patches & documentation most welcome. Have fun... Sponsored by: http://www.rndassociates.com/ Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
.Dt JAIL 8
mdoc(7) police: removed HISTORY info from the .Os call.
2001-07-10 15:12:08 +00:00
.Os
This Implements the mumbled about "Jail" feature. This is a seriously beefed up chroot kind of thing. The process is jailed along the same lines as a chroot does it, but with additional tough restrictions imposed on what the superuser can do. For all I know, it is safe to hand over the root bit inside a prison to the customer living in that prison, this is what it was developed for in fact: "real virtual servers". Each prison has an ip number associated with it, which all IP communications will be coerced to use and each prison has its own hostname. Needless to say, you need more RAM this way, but the advantage is that each customer can run their own particular version of apache and not stomp on the toes of their neighbors. It generally does what one would expect, but setting up a jail still takes a little knowledge. A few notes: I have no scripts for setting up a jail, don't ask me for them. The IP number should be an alias on one of the interfaces. mount a /proc in each jail, it will make ps more useable. /proc/<pid>/status tells the hostname of the prison for jailed processes. Quotas are only sensible if you have a mountpoint per prison. There are no privisions for stopping resource-hogging. Some "#ifdef INET" and similar may be missing (send patches!) If somebody wants to take it from here and develop it into more of a "virtual machine" they should be most welcome! Tools, comments, patches & documentation most welcome. Have fun... Sponsored by: http://www.rndassociates.com/ Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
.Sh NAME
.Nm jail
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Nd "manage system jails"
This Implements the mumbled about "Jail" feature. This is a seriously beefed up chroot kind of thing. The process is jailed along the same lines as a chroot does it, but with additional tough restrictions imposed on what the superuser can do. For all I know, it is safe to hand over the root bit inside a prison to the customer living in that prison, this is what it was developed for in fact: "real virtual servers". Each prison has an ip number associated with it, which all IP communications will be coerced to use and each prison has its own hostname. Needless to say, you need more RAM this way, but the advantage is that each customer can run their own particular version of apache and not stomp on the toes of their neighbors. It generally does what one would expect, but setting up a jail still takes a little knowledge. A few notes: I have no scripts for setting up a jail, don't ask me for them. The IP number should be an alias on one of the interfaces. mount a /proc in each jail, it will make ps more useable. /proc/<pid>/status tells the hostname of the prison for jailed processes. Quotas are only sensible if you have a mountpoint per prison. There are no privisions for stopping resource-hogging. Some "#ifdef INET" and similar may be missing (send patches!) If somebody wants to take it from here and develop it into more of a "virtual machine" they should be most welcome! Tools, comments, patches & documentation most welcome. Have fun... Sponsored by: http://www.rndassociates.com/ Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
.Sh SYNOPSIS
mdoc(7) police: use the new features of the Nm macro.
2000-11-20 20:10:44 +00:00
.Nm
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Op Fl dhilqv
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Op Fl J Ar jid_file
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Op Fl u Ar username
.Op Fl U Ar username
.Op Fl cmr
.Ar param Ns = Ns Ar value ...
.Op Cm command Ns = Ns Ar command ...
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Nm
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Op Fl dqv
.Op Fl f Ar conf_file
.Op Fl p Ar limit
.Op Fl cmr
.Op Ar jail
.Nm
.Op Fl qv
.Op Fl f Ar conf_file
.Op Fl rR
.Op Cm * | Ar jail ...
.Nm
.Op Fl dhilqv
Add [-J jid_file] option to write out a JidFile, similar to a PidFile, containing the jailid, path, hostname, ip and the command used to start the jail. PR: misc/89883 Submitted by: L. Jason Godsey <lannygodsey -at- yahoo.com> Reviewed by: phk MFC after: 1 week
2005-12-03 17:32:39 +00:00
.Op Fl J Ar jid_file
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Op Fl u Ar username
.Op Fl U Ar username
.Op Fl n Ar jailname
Add the -s option to set jail's securelevel. This is useful for jails run with non-root privileges. PR: bin/80242 MFC after: 2 weeks
2006-05-11 13:04:23 +00:00
.Op Fl s Ar securelevel
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Op Ar path hostname [ Ar ip Ns [ Ns Ar ,... Ns ]] Ar command ...
jail(8): improve manual and usage information with more clear description for "jail -e" mode to show that it does not take additional jail name argument. Reported by: David Marec <david.marec@davenulle.org> MFC after: 3 days
2020-04-17 10:12:11 +00:00
.Nm
.Op Fl f Ar conf_file
.Fl e
.Ar separator
This Implements the mumbled about "Jail" feature. This is a seriously beefed up chroot kind of thing. The process is jailed along the same lines as a chroot does it, but with additional tough restrictions imposed on what the superuser can do. For all I know, it is safe to hand over the root bit inside a prison to the customer living in that prison, this is what it was developed for in fact: "real virtual servers". Each prison has an ip number associated with it, which all IP communications will be coerced to use and each prison has its own hostname. Needless to say, you need more RAM this way, but the advantage is that each customer can run their own particular version of apache and not stomp on the toes of their neighbors. It generally does what one would expect, but setting up a jail still takes a little knowledge. A few notes: I have no scripts for setting up a jail, don't ask me for them. The IP number should be an alias on one of the interfaces. mount a /proc in each jail, it will make ps more useable. /proc/<pid>/status tells the hostname of the prison for jailed processes. Quotas are only sensible if you have a mountpoint per prison. There are no privisions for stopping resource-hogging. Some "#ifdef INET" and similar may be missing (send patches!) If somebody wants to take it from here and develop it into more of a "virtual machine" they should be most welcome! Tools, comments, patches & documentation most welcome. Have fun... Sponsored by: http://www.rndassociates.com/ Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
.Sh DESCRIPTION
The
.Nm
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
utility creates new jails, or modifies or removes existing jails.
jail(8): introduce new command option -e to exhibit a list of configured non-wildcard jails with their parameters, no matter running or not. The option -e takes separator argument that is used to separate printed parameters. It will be used with following additions to system periodic scripts to differentiate parts of directory tree belonging jails as opposed to host's. MFC after: 1 month
2018-11-10 12:03:57 +00:00
It can also print a list of configured jails and their parameters.
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
A jail
.Pq or Dq prison
is specified via parameters on the command line, or in the
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Xr jail.conf 5
file.
This Implements the mumbled about "Jail" feature. This is a seriously beefed up chroot kind of thing. The process is jailed along the same lines as a chroot does it, but with additional tough restrictions imposed on what the superuser can do. For all I know, it is safe to hand over the root bit inside a prison to the customer living in that prison, this is what it was developed for in fact: "real virtual servers". Each prison has an ip number associated with it, which all IP communications will be coerced to use and each prison has its own hostname. Needless to say, you need more RAM this way, but the advantage is that each customer can run their own particular version of apache and not stomp on the toes of their neighbors. It generally does what one would expect, but setting up a jail still takes a little knowledge. A few notes: I have no scripts for setting up a jail, don't ask me for them. The IP number should be an alias on one of the interfaces. mount a /proc in each jail, it will make ps more useable. /proc/<pid>/status tells the hostname of the prison for jailed processes. Quotas are only sensible if you have a mountpoint per prison. There are no privisions for stopping resource-hogging. Some "#ifdef INET" and similar may be missing (send patches!) If somebody wants to take it from here and develop it into more of a "virtual machine" they should be most welcome! Tools, comments, patches & documentation most welcome. Have fun... Sponsored by: http://www.rndassociates.com/ Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
.Pp
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
At least one of the options
.Fl c ,
jail(8): introduce new command option -e to exhibit a list of configured non-wildcard jails with their parameters, no matter running or not. The option -e takes separator argument that is used to separate printed parameters. It will be used with following additions to system periodic scripts to differentiate parts of directory tree belonging jails as opposed to host's. MFC after: 1 month
2018-11-10 12:03:57 +00:00
.Fl e ,
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Fl m
or
.Fl r
must be specified.
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
These options are used alone or in combination to describe the operation to
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
perform:
.Bl -tag -width indent
.It Fl c
Create a new jail.
Remove end of line whitespace.
2012-05-12 19:59:37 +00:00
The jail
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Va jid
and
.Va name
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
parameters (if specified on the command line)
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
must not refer to an existing jail.
jail(8): introduce new command option -e to exhibit a list of configured non-wildcard jails with their parameters, no matter running or not. The option -e takes separator argument that is used to separate printed parameters. It will be used with following additions to system periodic scripts to differentiate parts of directory tree belonging jails as opposed to host's. MFC after: 1 month
2018-11-10 12:03:57 +00:00
.It Fl e Ar separator
Exhibit a list of all configured non-wildcard jails and their parameters.
No jail creation, modification or removal performed if this option is used.
The
.Ar separator
string is used to separate parameters.
Use
.Xr jls 8
utility to list running jails.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.It Fl m
Modify an existing jail.
One of the
.Va jid
or
.Va name
parameters must exist and refer to an existing jail.
Some parameters may not be changed on a running jail.
.It Fl r
Remove the
.Ar jail
specified by jid or name.
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
All jailed processes are killed, and all jails that are
children of this jail are also
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
removed.
.It Fl rc
Restart an existing jail.
The jail is first removed and then re-created, as if
.Dq Nm Fl r
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
and
.Dq Nm Fl c
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
were run in succession.
.It Fl cm
Create a jail if it does not exist, or modify the jail if it does exist.
.It Fl mr
Modify an existing jail.
The jail may be restarted if necessary to modify parameters than could
not otherwise be changed.
.It Fl cmr
Create a jail if it doesn't exist, or modify (and possibly restart) the
jail if it does exist.
.El
This Implements the mumbled about "Jail" feature. This is a seriously beefed up chroot kind of thing. The process is jailed along the same lines as a chroot does it, but with additional tough restrictions imposed on what the superuser can do. For all I know, it is safe to hand over the root bit inside a prison to the customer living in that prison, this is what it was developed for in fact: "real virtual servers". Each prison has an ip number associated with it, which all IP communications will be coerced to use and each prison has its own hostname. Needless to say, you need more RAM this way, but the advantage is that each customer can run their own particular version of apache and not stomp on the toes of their neighbors. It generally does what one would expect, but setting up a jail still takes a little knowledge. A few notes: I have no scripts for setting up a jail, don't ask me for them. The IP number should be an alias on one of the interfaces. mount a /proc in each jail, it will make ps more useable. /proc/<pid>/status tells the hostname of the prison for jailed processes. Quotas are only sensible if you have a mountpoint per prison. There are no privisions for stopping resource-hogging. Some "#ifdef INET" and similar may be missing (send patches!) If somebody wants to take it from here and develop it into more of a "virtual machine" they should be most welcome! Tools, comments, patches & documentation most welcome. Have fun... Sponsored by: http://www.rndassociates.com/ Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
.Pp
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
Other available options are:
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Bl -tag -width indent
.It Fl d
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
Allow making changes to a dying jail, equivalent to the
.Va allow.dying
parameter.
.It Fl f Ar conf_file
Use configuration file
.Ar conf_file
instead of the default
.Pa /etc/jail.conf .
MFp4: Bring in updated jail support from bz_jail branch. This enhances the current jail implementation to permit multiple addresses per jail. In addtion to IPv4, IPv6 is supported as well. Due to updated checks it is even possible to have jails without an IP address at all, which basically gives one a chroot with restricted process view, no networking,.. SCTP support was updated and supports IPv6 in jails as well. Cpuset support permits jails to be bound to specific processor sets after creation. Jails can have an unrestricted (no duplicate protection, etc.) name in addition to the hostname. The jail name cannot be changed from within a jail and is considered to be used for management purposes or as audit-token in the future. DDB 'show jails' command was added to aid debugging. Proper compat support permits 32bit jail binaries to be used on 64bit systems to manage jails. Also backward compatibility was preserved where possible: for jail v1 syscalls, as well as with user space management utilities. Both jail as well as prison version were updated for the new features. A gap was intentionally left as the intermediate versions had been used by various patches floating around the last years. Bump __FreeBSD_version for the afore mentioned and in kernel changes. Special thanks to: - Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches and Olivier Houchard (cognet) for initial single-IPv6 patches. - Jeff Roberson (jeff) and Randall Stewart (rrs) for their help, ideas and review on cpuset and SCTP support. - Robert Watson (rwatson) for lots and lots of help, discussions, suggestions and review of most of the patch at various stages. - John Baldwin (jhb) for his help. - Simon L. Nielsen (simon) as early adopter testing changes on cluster machines as well as all the testers and people who provided feedback the last months on freebsd-jail and other channels. - My employer, CK Software GmbH, for the support so I could work on this. Reviewed by: (see above) MFC after: 3 months (this is just so that I get the mail) X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
.It Fl h
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
Resolve the
.Va host.hostname
parameter (or
.Va hostname )
MFp4: Bring in updated jail support from bz_jail branch. This enhances the current jail implementation to permit multiple addresses per jail. In addtion to IPv4, IPv6 is supported as well. Due to updated checks it is even possible to have jails without an IP address at all, which basically gives one a chroot with restricted process view, no networking,.. SCTP support was updated and supports IPv6 in jails as well. Cpuset support permits jails to be bound to specific processor sets after creation. Jails can have an unrestricted (no duplicate protection, etc.) name in addition to the hostname. The jail name cannot be changed from within a jail and is considered to be used for management purposes or as audit-token in the future. DDB 'show jails' command was added to aid debugging. Proper compat support permits 32bit jail binaries to be used on 64bit systems to manage jails. Also backward compatibility was preserved where possible: for jail v1 syscalls, as well as with user space management utilities. Both jail as well as prison version were updated for the new features. A gap was intentionally left as the intermediate versions had been used by various patches floating around the last years. Bump __FreeBSD_version for the afore mentioned and in kernel changes. Special thanks to: - Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches and Olivier Houchard (cognet) for initial single-IPv6 patches. - Jeff Roberson (jeff) and Randall Stewart (rrs) for their help, ideas and review on cpuset and SCTP support. - Robert Watson (rwatson) for lots and lots of help, discussions, suggestions and review of most of the patch at various stages. - John Baldwin (jhb) for his help. - Simon L. Nielsen (simon) as early adopter testing changes on cluster machines as well as all the testers and people who provided feedback the last months on freebsd-jail and other channels. - My employer, CK Software GmbH, for the support so I could work on this. Reviewed by: (see above) MFC after: 3 months (this is just so that I get the mail) X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
and add all IP addresses returned by the resolver
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
to the list of addresses for this jail.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
This is equivalent to the
.Va ip_hostname
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
parameter.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.It Fl i
Output (only) the jail identifier of the newly created jail(s).
This implies the
.Fl q
option.
Add [-J jid_file] option to write out a JidFile, similar to a PidFile, containing the jailid, path, hostname, ip and the command used to start the jail. PR: misc/89883 Submitted by: L. Jason Godsey <lannygodsey -at- yahoo.com> Reviewed by: phk MFC after: 1 week
2005-12-03 17:32:39 +00:00
.It Fl J Ar jid_file
Markup fixes.
2006-09-29 17:57:04 +00:00
Write a
.Ar jid_file
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
file, containing the parameters used to start the jail.
o Add -l option to jail(8) similar to su(1): before running jail'ed program under specific user's credentials, clean the environment and set only a few variables. PR: bin/70024 Submitted by: demon MFC after: 1 month
2004-08-15 08:21:50 +00:00
.It Fl l
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
Run commands in a clean environment.
This is deprecated and is equivalent to the exec.clean parameter.
.It Fl n Ar jailname
Set the jail's name.
This is deprecated and is equivalent to the
.Va name
parameter.
.It Fl p Ar limit
Limit the number of commands from
.Va exec.*
that can run simultaneously.
.It Fl q
Suppress the message printed whenever a jail is created, modified or removed.
Only error messages will be printed.
.It Fl R
A variation of the
.Fl r
option that removes an existing jail without using the configuration file.
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
No removal-related parameters for this jail will be used \(em the jail will
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
simply be removed.
Add the -s option to set jail's securelevel. This is useful for jails run with non-root privileges. PR: bin/80242 MFC after: 2 weeks
2006-05-11 13:04:23 +00:00
.It Fl s Ar securelevel
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
Set the
Markup fixes.
2006-09-29 17:57:04 +00:00
.Va kern.securelevel
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
MIB entry to the specified value inside the newly created jail.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
This is deprecated and is equivalent to the
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Va securelevel
parameter.
o Add -u <username> flag to jail(8): set user context before exec. PR: bin/44320 Submitted by: Mike Matsnev <mike@po.cs.msu.su> Reviewed by: -current MFC after: 6 weeks
2003-03-27 12:16:58 +00:00
.It Fl u Ar username
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
The user name from host environment as whom jailed commands should run.
This is deprecated and is equivalent to the
.Va exec.jail_user
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
and
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Va exec.system_jail_user
parameters.
.It Fl U Ar username
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
The user name from the jailed environment as whom jailed commands should run.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
This is deprecated and is equivalent to the
.Va exec.jail_user
parameter.
.It Fl v
Print a message on every operation, such as running commands and
mounting filesystems.
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.El
.Pp
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
If no arguments are given after the options, the operation (except
remove) will be performed on all jails specified in the
.Xr jail.conf 5
file.
A single argument of a jail name will operate only on the specified jail.
The
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Fl r
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
and
.Fl R
options can also remove running jails that aren't in the
.Xr jail.conf 5
file, specified by name or jid.
Fix .Pp macro.
2012-05-11 22:05:30 +00:00
.Pp
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
An argument of
.Dq *
Better communicate the purpose of "-r *".
2012-01-31 19:45:32 +00:00
is a wildcard that will operate on all jails, regardless of whether
they appear in
.Xr jail.conf 5 ;
this is the surest way for
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Fl r
to remove all jails.
If hierarchical jails exist, a partial-matching wildcard definition may
be specified.
Remove end of line whitespace.
2012-05-12 19:59:37 +00:00
For example, an argument of
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Dq foo.*
would apply to jails with names like
.Dq foo.bar
and
.Dq foo.bar.baz .
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Pp
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
A jail may be specified with parameters directly on the command line.
In this case, the
.Xr jail.conf 5
file will not be used.
For backward compatibility, the command line may also have four fixed
parameters, without names:
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Ar path ,
.Ar hostname ,
.Ar ip ,
and
.Ar command .
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
This mode will always create a new jail, and the
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Fl c
and
Fix some inaccuracies in the extensible parameter addition. Approved by: bz (mentor)
2009-05-29 21:17:22 +00:00
.Fl m
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
options do not apply (and must not be present).
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Ss Jail Parameters
Parameters in the
.Xr jail.conf 5
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
file, or on the command line, are generally of the form
.Dq name=value .
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
Some parameters are boolean, and do not have a value but are set by the
name alone with or without a
.Dq no
prefix, e.g.
.Va persist
or
.Va nopersist .
They can also be given the values
.Dq true
and
.Dq false .
Fixes to man8 groff mandoc style, usage mistakes, or typos. PR: 168016 Submitted by: Nobuyuki Koganemaru Approved by: gjb MFC after: 3 days
2012-05-24 02:24:03 +00:00
Other parameters may have more than one value, specified as a
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
comma-separated list or with
.Dq +=
in the configuration file (see
.Xr jail.conf 5
for details).
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Pp
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
The
.Nm
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
utility recognizes two classes of parameters.
There are the true jail
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
parameters that are passed to the kernel when the jail is created,
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
which can be seen with
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Xr jls 8 ,
and can (usually) be changed with
Fixes to man8 groff mandoc style, usage mistakes, or typos. PR: 168016 Submitted by: Nobuyuki Koganemaru Approved by: gjb MFC after: 3 days
2012-05-24 02:24:03 +00:00
.Dq Nm Fl m .
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
Then there are pseudo-parameters that are only used by
.Nm
itself.
.Pp
Allow the kern.osrelease and kern.osreldate sysctl values to be set in a jail's creation parameters. This allows the kernel version to be reliably spoofed within the jail whether examined directly with sysctl or indirectly with the uname -r and -K options. The values can only be set at jail creation time, to eliminate the need for any locking when accessing the values via sysctl. The overridden values are inherited by nested jails (unless the config for the nested jails also overrides the values). There is no sanity or range checking, other than disallowing an empty release string or a zero release date, by design. The system administrator is trusted to set sane values. Setting values that are newer than the actual running kernel will likely cause compatibility problems. Differential Revision: https://reviews.freebsd.org/D1948 Relnotes: yes
2015-02-27 16:28:55 +00:00
Jails have a set of core parameters, and kernel modules can add their own
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
jail parameters.
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
The current set of available parameters can be retrieved via
.Dq Nm sysctl Fl d Va security.jail.param .
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
Any parameters not set will be given default values, often based on the
current environment.
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
The core parameters are:
.Bl -tag -width indent
.It Va jid
The jail identifier.
This will be assigned automatically to a new jail (or can be explicitly
set), and can be used to identify the jail for later modification, or
for such commands as
.Xr jls 8
or
.Xr jexec 8 .
.It Va name
The jail name.
This is an arbitrary string that identifies a jail (except it may not
contain a
.Sq \&. ) .
Like the
.Va jid ,
it can be passed to later
.Nm
commands, or to
.Xr jls 8
or
.Xr jexec 8 .
If no
.Va name
is supplied, a default is assumed that is the same as the
.Va jid .
The
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Va name
parameter is implied by the
.Xr jail.conf 5
file format, and need not be explicitly set when using the configuration
file.
.It Va path
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
The directory which is to be the root of the jail.
Any commands run inside the jail, either by
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Nm
or from
.Xr jexec 8 ,
are run from this directory.
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.It Va ip4.addr
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
A list of IPv4 addresses assigned to the jail.
- fix typo
2010-05-05 08:43:47 +00:00
If this is set, the jail is restricted to using only these addresses.
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
Any attempts to use other addresses fail, and attempts to use wildcard
addresses silently use the jailed address instead.
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
For IPv4 the first address given will be used as the source address
when source address selection on unbound sockets cannot find a better
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
match.
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
It is only possible to start multiple jails with the same IP address
MFp4: Bring in updated jail support from bz_jail branch. This enhances the current jail implementation to permit multiple addresses per jail. In addtion to IPv4, IPv6 is supported as well. Due to updated checks it is even possible to have jails without an IP address at all, which basically gives one a chroot with restricted process view, no networking,.. SCTP support was updated and supports IPv6 in jails as well. Cpuset support permits jails to be bound to specific processor sets after creation. Jails can have an unrestricted (no duplicate protection, etc.) name in addition to the hostname. The jail name cannot be changed from within a jail and is considered to be used for management purposes or as audit-token in the future. DDB 'show jails' command was added to aid debugging. Proper compat support permits 32bit jail binaries to be used on 64bit systems to manage jails. Also backward compatibility was preserved where possible: for jail v1 syscalls, as well as with user space management utilities. Both jail as well as prison version were updated for the new features. A gap was intentionally left as the intermediate versions had been used by various patches floating around the last years. Bump __FreeBSD_version for the afore mentioned and in kernel changes. Special thanks to: - Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches and Olivier Houchard (cognet) for initial single-IPv6 patches. - Jeff Roberson (jeff) and Randall Stewart (rrs) for their help, ideas and review on cpuset and SCTP support. - Robert Watson (rwatson) for lots and lots of help, discussions, suggestions and review of most of the patch at various stages. - John Baldwin (jhb) for his help. - Simon L. Nielsen (simon) as early adopter testing changes on cluster machines as well as all the testers and people who provided feedback the last months on freebsd-jail and other channels. - My employer, CK Software GmbH, for the support so I could work on this. Reviewed by: (see above) MFC after: 3 months (this is just so that I get the mail) X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
if none of the jails has more than this single overlapping IP address
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
assigned to itself.
Add ip4.saddrsel/ip4.nosaddrsel (and equivalent for ip6) to control whether to use source address selection (default) or the primary jail address for unbound outgoing connections. This is intended to be used by people upgrading from single-IP jails to multi-IP jails but not having to change firewall rules, application ACLs, ... but to force their connections (unless otherwise changed) to the primry jail IP they had been used for years, as well as for people prefering to implement similar policies. Note that for IPv6, if configured incorrectly, this might lead to scope violations, which single-IPv6 jails could as well, as by the design of jails. [1] Reviewed by: jamie, hrs (ipv6 part) Pointed out by: hrs [1] MFC After: 2 weeks Asked for by: Jase Thew (bazerka beardz.net)
2010-01-17 12:57:11 +00:00
.It Va ip4.saddrsel
A boolean option to change the formerly mentioned behaviour and disable
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
IPv4 source address selection for the jail in favour of the primary
Add ip4.saddrsel/ip4.nosaddrsel (and equivalent for ip6) to control whether to use source address selection (default) or the primary jail address for unbound outgoing connections. This is intended to be used by people upgrading from single-IP jails to multi-IP jails but not having to change firewall rules, application ACLs, ... but to force their connections (unless otherwise changed) to the primry jail IP they had been used for years, as well as for people prefering to implement similar policies. Note that for IPv6, if configured incorrectly, this might lead to scope violations, which single-IPv6 jails could as well, as by the design of jails. [1] Reviewed by: jamie, hrs (ipv6 part) Pointed out by: hrs [1] MFC After: 2 weeks Asked for by: Jase Thew (bazerka beardz.net)
2010-01-17 12:57:11 +00:00
IPv4 address of the jail.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
Source address selection is enabled by default for all jails and the
Add ip4.saddrsel/ip4.nosaddrsel (and equivalent for ip6) to control whether to use source address selection (default) or the primary jail address for unbound outgoing connections. This is intended to be used by people upgrading from single-IP jails to multi-IP jails but not having to change firewall rules, application ACLs, ... but to force their connections (unless otherwise changed) to the primry jail IP they had been used for years, as well as for people prefering to implement similar policies. Note that for IPv6, if configured incorrectly, this might lead to scope violations, which single-IPv6 jails could as well, as by the design of jails. [1] Reviewed by: jamie, hrs (ipv6 part) Pointed out by: hrs [1] MFC After: 2 weeks Asked for by: Jase Thew (bazerka beardz.net)
2010-01-17 12:57:11 +00:00
.Va ip4.nosaddrsel
setting of a parent jail is not inherited for any child jails.
Some jail parameters (in particular, "ip4" and "ip6" for IP address restrictions) were found to be inadequately described by a boolean. Define a new parameter type with three values (disable, new, inherit) to handle these and future cases. Approved by: re (kib), bz (mentor) Discussed with: rwatson
2009-07-25 14:48:57 +00:00
.It Va ip4
Spelling fixes.
2010-08-01 09:37:36 +00:00
Control the availability of IPv4 addresses.
Some jail parameters (in particular, "ip4" and "ip6" for IP address restrictions) were found to be inadequately described by a boolean. Define a new parameter type with three values (disable, new, inherit) to handle these and future cases. Approved by: re (kib), bz (mentor) Discussed with: rwatson
2009-07-25 14:48:57 +00:00
Possible values are
.Dq inherit
to allow unrestricted access to all system addresses,
.Dq new
to restrict addresses via
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
.Va ip4.addr ,
and
Some jail parameters (in particular, "ip4" and "ip6" for IP address restrictions) were found to be inadequately described by a boolean. Define a new parameter type with three values (disable, new, inherit) to handle these and future cases. Approved by: re (kib), bz (mentor) Discussed with: rwatson
2009-07-25 14:48:57 +00:00
.Dq disable
to stop the jail from using IPv4 entirely.
Setting the
.Va ip4.addr
parameter implies a value of
.Dq new .
Add ip4.saddrsel/ip4.nosaddrsel (and equivalent for ip6) to control whether to use source address selection (default) or the primary jail address for unbound outgoing connections. This is intended to be used by people upgrading from single-IP jails to multi-IP jails but not having to change firewall rules, application ACLs, ... but to force their connections (unless otherwise changed) to the primry jail IP they had been used for years, as well as for people prefering to implement similar policies. Note that for IPv6, if configured incorrectly, this might lead to scope violations, which single-IPv6 jails could as well, as by the design of jails. [1] Reviewed by: jamie, hrs (ipv6 part) Pointed out by: hrs [1] MFC After: 2 weeks Asked for by: Jase Thew (bazerka beardz.net)
2010-01-17 12:57:11 +00:00
.It Va ip6.addr , Va ip6.saddrsel , Va ip6
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
A set of IPv6 options for the jail, the counterparts to
Add ip4.saddrsel/ip4.nosaddrsel (and equivalent for ip6) to control whether to use source address selection (default) or the primary jail address for unbound outgoing connections. This is intended to be used by people upgrading from single-IP jails to multi-IP jails but not having to change firewall rules, application ACLs, ... but to force their connections (unless otherwise changed) to the primry jail IP they had been used for years, as well as for people prefering to implement similar policies. Note that for IPv6, if configured incorrectly, this might lead to scope violations, which single-IPv6 jails could as well, as by the design of jails. [1] Reviewed by: jamie, hrs (ipv6 part) Pointed out by: hrs [1] MFC After: 2 weeks Asked for by: Jase Thew (bazerka beardz.net)
2010-01-17 12:57:11 +00:00
.Va ip4.addr ,
.Va ip4.saddrsel
Some jail parameters (in particular, "ip4" and "ip6" for IP address restrictions) were found to be inadequately described by a boolean. Define a new parameter type with three values (disable, new, inherit) to handle these and future cases. Approved by: re (kib), bz (mentor) Discussed with: rwatson
2009-07-25 14:48:57 +00:00
and
.Va ip4
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
above.
Add allow.mount.fdescfs jail flag. PR: 192951 Submitted by: ruben@verweg.com MFC after: 3 days
2015-01-28 21:08:09 +00:00
.It Va vnet
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
Create the jail with its own virtual network stack,
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
with its own network interfaces, addresses, routing table, etc.
The kernel must have been compiled with the
.Sy VIMAGE option
for this to be available.
Possible values are
.Dq inherit
to use the system network stack, possibly with restricted IP addresses,
and
.Dq new
to create a new network stack.
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.It Va host.hostname
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
The hostname of the jail.
Place hostnames and similar information fully under the prison system. The system hostname is now stored in prison0, and the global variable "hostname" has been removed, as has the hostname_mtx mutex. Jails may have their own host information, or they may inherit it from the parent/system. The proper way to read the hostname is via getcredhostname(), which will copy either the hostname associated with the passed cred, or the system hostname if you pass NULL. The system hostname can still be accessed directly (and without locking) at prison0.pr_host, but that should be avoided where possible. The "similar information" referred to is domainname, hostid, and hostuuid, which have also become prison parameters and had their associated global variables removed. Approved by: bz (mentor)
2009-05-29 21:27:12 +00:00
Other similar parameters are
.Va host.domainname ,
.Va host.hostuuid
and
.Va host.hostid .
Some jail parameters (in particular, "ip4" and "ip6" for IP address restrictions) were found to be inadequately described by a boolean. Define a new parameter type with three values (disable, new, inherit) to handle these and future cases. Approved by: re (kib), bz (mentor) Discussed with: rwatson
2009-07-25 14:48:57 +00:00
.It Va host
Set the origin of hostname and related information.
Possible values are
.Dq inherit
to use the system information and
.Dq new
for the jail to use the information from the above fields.
Setting any of the above fields implies a value of
.Dq new .
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.It Va securelevel
The value of the jail's
.Va kern.securelevel
sysctl.
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
A jail never has a lower securelevel than its parent system, but by
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
setting this parameter it may have a higher one.
If the system securelevel is changed, any jail securelevels will be at
least as secure.
Add support for mounting devfs inside jails. A new jail(8) option "devfs_ruleset" defines the ruleset enforcement for mounting devfs inside jails. A value of -1 disables mounting devfs in jails, a value of zero means no restrictions. Nested jails can only have mounting devfs disabled or inherit parent's enforcement as jails are not allowed to view or manipulate devfs(8) rules. Utilizes new functions introduced in r231265. Reviewed by: jamie MFC after: 1 month
2012-02-09 10:22:08 +00:00
.It Va devfs_ruleset
The number of the devfs ruleset that is enforced for mounting devfs in
mdoc(7) stype - start new sentences on new line MFC after: 1 week
2012-02-28 07:35:07 +00:00
this jail.
A value of zero (default) means no ruleset is enforced.
Descendant jails inherit the parent jail's devfs ruleset enforcement.
Mounting devfs inside a jail is possible only if the
Add support for mounting devfs inside jails. A new jail(8) option "devfs_ruleset" defines the ruleset enforcement for mounting devfs inside jails. A value of -1 disables mounting devfs in jails, a value of zero means no restrictions. Nested jails can only have mounting devfs disabled or inherit parent's enforcement as jails are not allowed to view or manipulate devfs(8) rules. Utilizes new functions introduced in r231265. Reviewed by: jamie MFC after: 1 month
2012-02-09 10:22:08 +00:00
.Va allow.mount
To improve control over the use of mount(8) inside a jail(8), introduce a new jail parameter node with the following parameters: allow.mount.devfs: allow mounting the devfs filesystem inside a jail allow.mount.nullfs: allow mounting the nullfs filesystem inside a jail Both parameters are disabled by default (equals the behavior before devfs and nullfs in jails). Administrators have to explicitly allow mounting devfs and nullfs for each jail. The value "-1" of the devfs_ruleset parameter is removed in favor of the new allow setting. Reviewed by: jamie Suggested by: pjd MFC after: 2 weeks
2012-02-23 18:51:24 +00:00
and
.Va allow.mount.devfs
permissions are effective and
Add support for mounting devfs inside jails. A new jail(8) option "devfs_ruleset" defines the ruleset enforcement for mounting devfs inside jails. A value of -1 disables mounting devfs in jails, a value of zero means no restrictions. Nested jails can only have mounting devfs disabled or inherit parent's enforcement as jails are not allowed to view or manipulate devfs(8) rules. Utilizes new functions introduced in r231265. Reviewed by: jamie MFC after: 1 month
2012-02-09 10:22:08 +00:00
.Va enforce_statfs
mdoc(7) stype - start new sentences on new line MFC after: 1 week
2012-02-28 07:35:07 +00:00
is set to a value lower than 2.
Devfs rules and rulesets cannot be viewed or modified from inside a jail.
A new jail(8) with a configuration file, ultimately to replace the work currently done by /etc/rc.d/jail. MFC after: 3 months
2012-04-26 17:36:05 +00:00
.Pp
NOTE: It is important that only appropriate device nodes in devfs be
exposed to a jail; access to disk devices in the jail may permit processes
in the jail to bypass the jail sandboxing by modifying files outside of
the jail.
See
.Xr devfs 8
for information on how to use devfs rules to limit access to entries
in the per-jail devfs.
A simple devfs ruleset for jails is available as ruleset #4 in
.Pa /etc/defaults/devfs.rules .
Add a limit for child jails via the "children.cur" and "children.max" parameters. This replaces the simple "allow.jails" permission. Approved by: bz (mentor)
2009-06-23 20:35:51 +00:00
.It Va children.max
The number of child jails allowed to be created by this jail (or by
other jails under this jail).
This limit is zero by default, indicating the jail is not allowed to
create child jails.
See the
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Sx "Hierarchical Jails"
Add a limit for child jails via the "children.cur" and "children.max" parameters. This replaces the simple "allow.jails" permission. Approved by: bz (mentor)
2009-06-23 20:35:51 +00:00
section for more information.
.It Va children.cur
Minor spelling fixes.
2012-06-03 11:29:48 +00:00
The number of descendants of this jail, including its own child jails
Add a limit for child jails via the "children.cur" and "children.max" parameters. This replaces the simple "allow.jails" permission. Approved by: bz (mentor)
2009-06-23 20:35:51 +00:00
and any jails created under them.
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.It Va enforce_statfs
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
This determines what information processes in a jail are able to get
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
about mount points.
It affects the behaviour of the following syscalls:
.Xr statfs 2 ,
.Xr fstatfs 2 ,
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
.Xr getfsstat 2 ,
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
and
.Xr fhstatfs 2
(as well as similar compatibility syscalls).
When set to 0, all mount points are available without any restrictions.
When set to 1, only mount points below the jail's chroot directory are
visible.
In addition to that, the path to the jail's chroot directory is removed
from the front of their pathnames.
When set to 2 (default), above syscalls can operate only on a mount-point
where the jail's chroot directory is located.
.It Va persist
Setting this boolean parameter allows a jail to exist without any
processes.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
Normally, a command is run as part of jail creation, and then the jail
is destroyed as its last process exits.
Back out r210975, which changed documentation to match the now backed-out r210974.
2010-08-08 23:24:23 +00:00
A new jail must have either the
Note that a jail without a command parameter will be persistent, instead of explicitly requiring one of "command" or "persist". MFC after: 3 days
2010-08-06 22:06:12 +00:00
.Va persist
Back out r210975, which changed documentation to match the now backed-out r210974.
2010-08-08 23:24:23 +00:00
parameter or
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Va exec.start
or
Back out r210975, which changed documentation to match the now backed-out r210974.
2010-08-08 23:24:23 +00:00
.Va command
pseudo-parameter set.
Fix some inaccuracies in the extensible parameter addition. Approved by: bz (mentor)
2009-05-29 21:17:22 +00:00
.It Va cpuset.id
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
The ID of the cpuset associated with this jail (read-only).
.It Va dying
This is true if the jail is in the process of shutting down (read-only).
.It Va parent
The
.Va jid
of the parent of this jail, or zero if this is a top-level jail
(read-only).
Allow the kern.osrelease and kern.osreldate sysctl values to be set in a jail's creation parameters. This allows the kernel version to be reliably spoofed within the jail whether examined directly with sysctl or indirectly with the uname -r and -K options. The values can only be set at jail creation time, to eliminate the need for any locking when accessing the values via sysctl. The overridden values are inherited by nested jails (unless the config for the nested jails also overrides the values). There is no sanity or range checking, other than disallowing an empty release string or a zero release date, by design. The system administrator is trusted to set sane values. Setting values that are newer than the actual running kernel will likely cause compatibility problems. Differential Revision: https://reviews.freebsd.org/D1948 Relnotes: yes
2015-02-27 16:28:55 +00:00
.It Va osrelease
The string for the jail's
.Va kern.osrelease
sysctl and uname -r.
.It Va osreldate
The number for the jail's
.Va kern.osreldate
and uname -K.
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.It Va allow.*
Some restrictions of the jail environment may be set on a per-jail
basis.
With the exception of
Strip EOL whitespace in usr.sbin/{jail,jexec}
2017-11-10 14:53:16 +00:00
.Va allow.set_hostname
Jails: Optionally prevent jailed root from binding to privileged ports You may now optionally specify allow.noreserved_ports to prevent root inside a jail from using privileged ports (less than 1024) PR: 217728 Submitted by: Matt Miller <mattm916@pulsar.neomailbox.ch> Reviewed by: jamie, cem, smh Relnotes: yes Differential Revision: https://reviews.freebsd.org/D10202
2017-06-06 02:15:00 +00:00
and
.Va allow.reserved_ports ,
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
these boolean parameters are off by default.
.Bl -tag -width indent
.It Va allow.set_hostname
The jail's hostname may be changed via
.Xr hostname 1
or
.Xr sethostname 3 .
.It Va allow.sysvipc
A process within the jail has access to System V IPC primitives.
Encapsulate SYSV IPC objects in jails. Define per-module parameters sysvmsg, sysvsem, and sysvshm, with the following bahavior: inherit: allow full access to the IPC primitives. This is the same as the current setup with allow.sysvipc is on. Jails and the base system can see (and moduly) each other's objects, which is generally considered a bad thing (though may be useful in some circumstances). disable: all no access, same as the current setup with allow.sysvipc off. new: A jail may see use the IPC objects that it has created. It also gets its own IPC key namespace, so different jails may have their own objects using the same key value. The parent jail (or base system) can see the jail's IPC objects, but not its keys. PR: 48471 Submitted by: based on work by kikuchan98@gmail.com MFC after: 5 days
2016-04-25 17:06:50 +00:00
This is deprecated in favor of the per-module parameters (see below).
When this parameter is set, it is equivalent to setting
.Va sysvmsg ,
.Va sysvsem ,
and
.Va sysvshm
all to
.Dq inherit .
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.It Va allow.raw_sockets
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
The jail root is allowed to create raw sockets.
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
Setting this parameter allows utilities like
.Xr ping 8
and
.Xr traceroute 8
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
to operate inside the jail.
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
If this is set, the source IP addresses are enforced to comply
with the IP address bound to the jail, regardless of whether or not
the
.Dv IP_HDRINCL
flag has been set on the socket.
Since raw sockets can be used to configure and interact with various
network subsystems, extra caution should be used where privileged access
to jails is given out to untrusted parties.
.It Va allow.chflags
Fix a typo in the jail(8) manpage. Submitted by: Jille Timmermans <jille quis cx> MFC after: 1 week
2009-10-18 19:50:15 +00:00
Normally, privileged users inside a jail are treated as unprivileged by
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Xr chflags 2 .
When this parameter is set, such users are treated as privileged, and
may manipulate system file flags subject to the usual constraints on
.Va kern.securelevel .
.It Va allow.mount
privileged users inside the jail will be able to mount and unmount file
system types marked as jail-friendly.
The
.Xr lsvfs 1
command can be used to find file system types available for mount from
within a jail.
Always disable mount and unmount for jails with enforce_statfs==2. A working statfs(2) is required for umount(8) in jail. Reviewed by: pjd, kib Approved by: re (kib) MFC after: 2 weeks
2011-08-02 19:44:40 +00:00
This permission is effective only if
.Va enforce_statfs
is set to a value lower than 2.
To improve control over the use of mount(8) inside a jail(8), introduce a new jail parameter node with the following parameters: allow.mount.devfs: allow mounting the devfs filesystem inside a jail allow.mount.nullfs: allow mounting the nullfs filesystem inside a jail Both parameters are disabled by default (equals the behavior before devfs and nullfs in jails). Administrators have to explicitly allow mounting devfs and nullfs for each jail. The value "-1" of the devfs_ruleset parameter is removed in favor of the new allow setting. Reviewed by: jamie Suggested by: pjd MFC after: 2 weeks
2012-02-23 18:51:24 +00:00
.It Va allow.mount.devfs
privileged users inside the jail will be able to mount and unmount the
devfs file system.
This permission is effective only together with
.Va allow.mount
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
and only when
To improve control over the use of mount(8) inside a jail(8), introduce a new jail parameter node with the following parameters: allow.mount.devfs: allow mounting the devfs filesystem inside a jail allow.mount.nullfs: allow mounting the nullfs filesystem inside a jail Both parameters are disabled by default (equals the behavior before devfs and nullfs in jails). Administrators have to explicitly allow mounting devfs and nullfs for each jail. The value "-1" of the devfs_ruleset parameter is removed in favor of the new allow setting. Reviewed by: jamie Suggested by: pjd MFC after: 2 weeks
2012-02-23 18:51:24 +00:00
.Va enforce_statfs
mdoc(7) stype - start new sentences on new line MFC after: 1 week
2012-02-28 07:35:07 +00:00
is set to a value lower than 2.
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
The devfs ruleset should be restricted from the default by using the
To improve control over the use of mount(8) inside a jail(8), introduce a new jail parameter node with the following parameters: allow.mount.devfs: allow mounting the devfs filesystem inside a jail allow.mount.nullfs: allow mounting the nullfs filesystem inside a jail Both parameters are disabled by default (equals the behavior before devfs and nullfs in jails). Administrators have to explicitly allow mounting devfs and nullfs for each jail. The value "-1" of the devfs_ruleset parameter is removed in favor of the new allow setting. Reviewed by: jamie Suggested by: pjd MFC after: 2 weeks
2012-02-23 18:51:24 +00:00
.Va devfs_ruleset
option.
Make it easier for filesystems to count themselves as jail-enabled, by doing most of the work in a new function prison_add_vfs in kern_jail.c Now a jail-enabled filesystem need only mark itself with VFCF_JAIL, and the rest is taken care of. This includes adding a jail parameter like allow.mount.foofs, and a sysctl like security.jail.mount_foofs_allowed. Both of these used to be a static list of known filesystems, with predefined permission bits. Reviewed by: kib Differential Revision: D14681
2018-05-04 20:54:27 +00:00
.It Va allow.quotas
The jail root may administer quotas on the jail's filesystem(s).
This includes filesystems that the jail may share with other jails or
with non-jailed parts of the system.
Add a new jail permission, allow.read_msgbuf. When true, jailed processes can see the dmesg buffer (this is the current behavior). When false (the new default), dmesg will be unavailable to jailed users, whether root or not. The security.bsd.unprivileged_read_msgbuf sysctl still works as before, controlling system-wide whether non-root users can see the buffer. PR: 211580 Submitted by: bz Approved by: re@ (kib@) MFC after: 3 days
2018-10-17 16:11:43 +00:00
.It Va allow.read_msgbuf
Jailed users may read the kernel message buffer.
If the
.Va security.bsd.unprivileged_read_msgbuf
Fix typos from r339409. Reported by: maxim Approved by: re (gjb)
2018-10-18 15:02:57 +00:00
MIB entry is zero, this will be restricted to the root user.
Make it easier for filesystems to count themselves as jail-enabled, by doing most of the work in a new function prison_add_vfs in kern_jail.c Now a jail-enabled filesystem need only mark itself with VFCF_JAIL, and the rest is taken care of. This includes adding a jail parameter like allow.mount.foofs, and a sysctl like security.jail.mount_foofs_allowed. Both of these used to be a static list of known filesystems, with predefined permission bits. Reviewed by: kib Differential Revision: D14681
2018-05-04 20:54:27 +00:00
.It Va allow.socket_af
Sockets within a jail are normally restricted to IPv4, IPv6, local
(UNIX), and route. This allows access to other protocol stacks that
have not had jail functionality added to them.
Add allow.mlock to jail parameters It allows locking or unlocking physical pages in memory within a jail This allows running elasticsearch with "bootstrap.memory_lock" inside a jail Reviewed by: jamie@ Differential Revision: https://reviews.freebsd.org/D16342
2018-07-29 12:41:56 +00:00
.It Va allow.mlock
Locking or unlocking physical pages in memory are normally not available
within a jail.
When this parameter is set, users may
.Xr mlock 2
or
.Xr munlock 2
memory subject to
.Va security.bsd.unprivileged_mlock
and resource limits.
Make it easier for filesystems to count themselves as jail-enabled, by doing most of the work in a new function prison_add_vfs in kern_jail.c Now a jail-enabled filesystem need only mark itself with VFCF_JAIL, and the rest is taken care of. This includes adding a jail parameter like allow.mount.foofs, and a sysctl like security.jail.mount_foofs_allowed. Both of these used to be a static list of known filesystems, with predefined permission bits. Reviewed by: kib Differential Revision: D14681
2018-05-04 20:54:27 +00:00
.It Va allow.reserved_ports
The jail root may bind to ports lower than 1024.
In hardened systems, where the security.bsd.unprivileged_proc_debug sysctl node is set, allow setting security.bsd.unprivileged_proc_debug per-jail. In part, this is needed to create jails in which the Address Sanitizer (ASAN) fully works as ASAN utilizes libkvm to inspect the virtual address space. Instead of having to allow unprivileged process debugging for the entire system, allow setting it on a per-jail basis. The sysctl node is still security.bsd.unprivileged_proc_debug and the jail(8) param is allow.unprivileged_proc_debug. The sysctl code is now a sysctl proc rather than a sysctl int. This allows us to determine setting the flag for the corresponding jail (or prison0). As part of the change, the dynamic allow.* API needed to be modified to take into account pr_allow flags which may now be disabled in prison0. This prevents conflicts with new pr_allow flags (like that of vmm(4)) that are added (and removed) dynamically. Also teach the jail creation KPI to allow differences for certain pr_allow flags between the parent and child jail. This can happen when unprivileged process debugging is disabled in the parent prison, but enabled in the child. Submitted by: Shawn Webb <lattera at gmail.com> Obtained from: HardenedBSD (45b3625edba0f73b3e3890b1ec3d0d1e95fd47e1, deba0b5078cef0faae43cbdafed3035b16587afc, ab21eeb3b4c72f2500987c96ff603ccf3b6e7de8) Relnotes: yes Sponsored by: HardenedBSD and G2, Inc Differential Revision: https://reviews.freebsd.org/D18319
2018-11-27 17:51:50 +00:00
.It Va allow.unprivileged_proc_debug
Unprivileged processes in the jail may use debugging facilities.
jail: introduce per jail suser_enabled setting The suser_enable sysctl allows to remove a privileged rights from uid 0. This change introduce per jail setting which allow to make root a normal user. Reviewed by: jamie Previous version reviewed by: kevans, emaste, markj, me_igalic.co Discussed with: pjd Differential Revision: https://reviews.freebsd.org/D27128
2020-11-18 21:07:08 +00:00
.It Va allow.suser
The value of the jail's
.Va security.bsd.suser_enabled
sysctl.
The super-user will be disabled automatically if its parent system has it
disabled.
The super-user is enabled by default.
Make it easier for filesystems to count themselves as jail-enabled, by doing most of the work in a new function prison_add_vfs in kern_jail.c Now a jail-enabled filesystem need only mark itself with VFCF_JAIL, and the rest is taken care of. This includes adding a jail parameter like allow.mount.foofs, and a sysctl like security.jail.mount_foofs_allowed. Both of these used to be a static list of known filesystems, with predefined permission bits. Reviewed by: kib Differential Revision: D14681
2018-05-04 20:54:27 +00:00
.El
.El
.Pp
Kernel modules may add their own parameters, which only exist when the
module is loaded.
These are typically headed under a parameter named after the module,
with values of
.Dq inherit
to give the jail full use of the module,
.Dq new
to encapsulate the jail in some module-specific way,
and
.Dq disable
to make the module unavailable to the jail.
There also may be other parameters to define jail behavior within the module.
Module-specific parameters include:
.Bl -tag -width indent
Add allow.mount.fdescfs jail flag. PR: 192951 Submitted by: ruben@verweg.com MFC after: 3 days
2015-01-28 21:08:09 +00:00
.It Va allow.mount.fdescfs
privileged users inside the jail will be able to mount and unmount the
fdescfs file system.
This permission is effective only together with
.Va allow.mount
and only when
.Va enforce_statfs
is set to a value lower than 2.
Allow mounting FUSE filesystems in jails Reviewed by: jamie MFC after: 2 weeks Relnotes: yes Differential Revision: https://reviews.freebsd.org/D16371
2018-07-20 21:35:31 +00:00
.It Va allow.mount.fusefs
privileged users inside the jail will be able to mount and unmount
fuse-based file systems.
This permission is effective only together with
.Va allow.mount
and only when
.Va enforce_statfs
is set to a value lower than 2.
To improve control over the use of mount(8) inside a jail(8), introduce a new jail parameter node with the following parameters: allow.mount.devfs: allow mounting the devfs filesystem inside a jail allow.mount.nullfs: allow mounting the nullfs filesystem inside a jail Both parameters are disabled by default (equals the behavior before devfs and nullfs in jails). Administrators have to explicitly allow mounting devfs and nullfs for each jail. The value "-1" of the devfs_ruleset parameter is removed in favor of the new allow setting. Reviewed by: jamie Suggested by: pjd MFC after: 2 weeks
2012-02-23 18:51:24 +00:00
.It Va allow.mount.nullfs
privileged users inside the jail will be able to mount and unmount the
nullfs file system.
This permission is effective only together with
.Va allow.mount
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
and only when
To improve control over the use of mount(8) inside a jail(8), introduce a new jail parameter node with the following parameters: allow.mount.devfs: allow mounting the devfs filesystem inside a jail allow.mount.nullfs: allow mounting the nullfs filesystem inside a jail Both parameters are disabled by default (equals the behavior before devfs and nullfs in jails). Administrators have to explicitly allow mounting devfs and nullfs for each jail. The value "-1" of the devfs_ruleset parameter is removed in favor of the new allow setting. Reviewed by: jamie Suggested by: pjd MFC after: 2 weeks
2012-02-23 18:51:24 +00:00
.Va enforce_statfs
is set to a value lower than 2.
Add procfs to jail-mountable filesystems. Reviewed by: jamie MFC after: 1 week
2012-02-29 00:30:18 +00:00
.It Va allow.mount.procfs
privileged users inside the jail will be able to mount and unmount the
procfs file system.
This permission is effective only together with
.Va allow.mount
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
and only when
Add procfs to jail-mountable filesystems. Reviewed by: jamie MFC after: 1 week
2012-02-29 00:30:18 +00:00
.Va enforce_statfs
is set to a value lower than 2.
Add support to the jail framework to be able to mount linsysfs(5) and linprocfs(5). Differential Revision: D2846 Submitted by: Nikolai Lifanov <lifanov@mail.lifanov.com> Reviewed by: jamie
2015-07-19 08:52:35 +00:00
.It Va allow.mount.linprocfs
privileged users inside the jail will be able to mount and unmount the
linprocfs file system.
This permission is effective only together with
.Va allow.mount
and only when
.Va enforce_statfs
is set to a value lower than 2.
.It Va allow.mount.linsysfs
privileged users inside the jail will be able to mount and unmount the
linsysfs file system.
This permission is effective only together with
.Va allow.mount
and only when
.Va enforce_statfs
is set to a value lower than 2.
Allow tmpfs be mounted inside jail.
2013-08-23 22:52:20 +00:00
.It Va allow.mount.tmpfs
privileged users inside the jail will be able to mount and unmount the
tmpfs file system.
This permission is effective only together with
.Va allow.mount
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
and only when
Allow tmpfs be mounted inside jail.
2013-08-23 22:52:20 +00:00
.Va enforce_statfs
is set to a value lower than 2.
Analogous to r232059, add a parameter for the ZFS file system: allow.mount.zfs: allow mounting the zfs filesystem inside a jail This way the permssions for mounting all current VFCF_JAIL filesystems inside a jail are controlled wia allow.mount.* jail parameters. Update sysctl descriptions. Update jail(8) and zfs(8) manpages. TODO: document the connection of allow.mount.* and VFCF_JAIL for kernel developers MFC after: 10 days
2012-02-26 16:30:39 +00:00
.It Va allow.mount.zfs
privileged users inside the jail will be able to mount and unmount the
ZFS file system.
This permission is effective only together with
.Va allow.mount
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
and only when
Analogous to r232059, add a parameter for the ZFS file system: allow.mount.zfs: allow mounting the zfs filesystem inside a jail This way the permssions for mounting all current VFCF_JAIL filesystems inside a jail are controlled wia allow.mount.* jail parameters. Update sysctl descriptions. Update jail(8) and zfs(8) manpages. TODO: document the connection of allow.mount.* and VFCF_JAIL for kernel developers MFC after: 10 days
2012-02-26 16:30:39 +00:00
.Va enforce_statfs
mdoc(7) stype - start new sentences on new line MFC after: 1 week
2012-02-28 07:35:07 +00:00
is set to a value lower than 2.
See
Analogous to r232059, add a parameter for the ZFS file system: allow.mount.zfs: allow mounting the zfs filesystem inside a jail This way the permssions for mounting all current VFCF_JAIL filesystems inside a jail are controlled wia allow.mount.* jail parameters. Update sysctl descriptions. Update jail(8) and zfs(8) manpages. TODO: document the connection of allow.mount.* and VFCF_JAIL for kernel developers MFC after: 10 days
2012-02-26 16:30:39 +00:00
.Xr zfs 8
for information on how to configure the ZFS filesystem to operate from
within a jail.
- Add the ability to run bhyve(8) within a jail(8). This patch adds a new sysctl(8) knob "security.jail.vmm_allowed", by default this option is disable. Submitted by: Shawn Webb <shawn.webb____hardenedbsd.org> Reviewed by: jamie@ and myself. Relnotes: Yes. Sponsored by: HardenedBSD and G2, Inc. Differential Revision: https://reviews.freebsd.org/D16057
2018-08-01 00:39:21 +00:00
.It Va allow.vmm
The jail may access
.Xr vmm 4 .
This flag is only available when the
.Xr vmm 4
kernel module is loaded.
Note the existence of module-specific jail paramters, starting with the linux.* parameters when linux emulation is loaded. MFC after: 5 days
2016-04-25 17:01:13 +00:00
.It Va linux
Determine how a jail's Linux emulation environment appears.
A value of
.Dq inherit
will keep the same environment, and
.Dq new
add ability to set watchdog timeout for a shutdown This change allows to specify a watchdog(9) timeout for a system shutdown. The timeout is activated when the watchdogd daemon is stopped. The idea is to a prevent any indefinite hang during late stages of the shutdown. The feature is implemented in rc.d/watchdogd, it builds upon watchdogd -x option. Note that the shutdown timeout is not actiavted when the watchdogd service is individually stopped by an operator. It is also not activated for the 'shutdown' to the single-user mode. In those cases it is assumed that the operator knows what they are doing and they have means to recover the system should it hang. Significant subchanges and implementation details: - the argument to rc.shutdown, completely unused before, is assigned to rc_shutdown variable that can be inspected by rc scripts - init(8) passes "single" or "reboot" as the argument, this is not changed - the argument is not mandatory and if it is not set then rc_shutdown is set to "unspecified" - however, the default jail management scripts and jail configuration examples have been updated to pass "jail" to rc.shutdown, just in case - the new timeout can be set via watchdogd_shutdown_timeout rc option - for consistency, the regular timeout can now be set via watchdogd_timeout rc option - watchdogd_shutdown_timeout and watchdogd_timeout override timeout specifications in watchdogd_flags - existing configurations, where the new rc options are not set, should keep working as before I am not particularly wed to any of the implementation specifics. I am open to changing or removing any of them as long as the provided functionality is the same (or very close) to the proposed one. For example, I think it can be implemented without using watchdogd -x, by means of watchdog(1) alone. In that case there would be a small window between stopping watchdogd and running watchdog, but I think that that is acceptable. Reviewed by: bcr (man page changes) MFC after: 5 weeks Relnotes: yes Differential Revision: https://reviews.freebsd.org/D21221
2019-10-03 11:23:10 +00:00
will give the jail its own environment (still originally inherited when
Note the existence of module-specific jail paramters, starting with the linux.* parameters when linux emulation is loaded. MFC after: 5 days
2016-04-25 17:01:13 +00:00
the jail is created).
.It Va linux.osname , linux.osrelease , linux.oss_version
The Linux OS name, OS release, and OSS version associated with this jail.
Encapsulate SYSV IPC objects in jails. Define per-module parameters sysvmsg, sysvsem, and sysvshm, with the following bahavior: inherit: allow full access to the IPC primitives. This is the same as the current setup with allow.sysvipc is on. Jails and the base system can see (and moduly) each other's objects, which is generally considered a bad thing (though may be useful in some circumstances). disable: all no access, same as the current setup with allow.sysvipc off. new: A jail may see use the IPC objects that it has created. It also gets its own IPC key namespace, so different jails may have their own objects using the same key value. The parent jail (or base system) can see the jail's IPC objects, but not its keys. PR: 48471 Submitted by: based on work by kikuchan98@gmail.com MFC after: 5 days
2016-04-25 17:06:50 +00:00
.It Va sysvmsg
Allow access to SYSV IPC message primitives.
If set to
.Dq inherit ,
all IPC objects on the system are visible to this jail, whether they
were created by the jail itself, the base system, or other jails.
If set to
.Dq new ,
the jail will have its own key namespace, and can only see the objects
that it has created;
the system (or parent jail) has access to the jail's objects, but not to
its keys.
If set to
.Dq disable ,
the jail cannot perform any sysvmsg-related system calls.
typo Submitted by: Jimmy Olgeni
2016-05-01 16:48:03 +00:00
.It Va sysvsem, sysvshm
Encapsulate SYSV IPC objects in jails. Define per-module parameters sysvmsg, sysvsem, and sysvshm, with the following bahavior: inherit: allow full access to the IPC primitives. This is the same as the current setup with allow.sysvipc is on. Jails and the base system can see (and moduly) each other's objects, which is generally considered a bad thing (though may be useful in some circumstances). disable: all no access, same as the current setup with allow.sysvipc off. new: A jail may see use the IPC objects that it has created. It also gets its own IPC key namespace, so different jails may have their own objects using the same key value. The parent jail (or base system) can see the jail's IPC objects, but not its keys. PR: 48471 Submitted by: based on work by kikuchan98@gmail.com MFC after: 5 days
2016-04-25 17:06:50 +00:00
Allow access to SYSV IPC semaphore and shared memory primitives, in the
same manner as
.Va sysvmsg.
Note the existence of module-specific jail paramters, starting with the linux.* parameters when linux emulation is loaded. MFC after: 5 days
2016-04-25 17:01:13 +00:00
.El
.Pp
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
There are pseudo-parameters that are not passed to the kernel, but are
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
used by
.Nm
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
to set up the jail environment, often by running specified commands
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
when jails are created or removed.
The
.Va exec.*
command parameters are
.Xr sh 1
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
command lines that are run in either the system or jail environment.
Fix transposed words in man page. PR: 201752 Reviewed by: bcr MFC after: 3 days Sponsored by: Essen FreeBSD Hackathon
2015-07-25 11:10:49 +00:00
They may be given multiple values, which would run the specified
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
commands in sequence.
Fixes to man8 groff mandoc style, usage mistakes, or typos. PR: 168016 Submitted by: Nobuyuki Koganemaru Approved by: gjb MFC after: 3 days
2012-05-24 02:24:03 +00:00
All commands must succeed (return a zero exit status), or the jail will
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
not be created or removed, as appropriate.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Pp
The pseudo-parameters are:
.Bl -tag -width indent
jail: Add exec.prepare and exec.release command hooks This change introduces new jail command hooks that run before and after any other actions. The exec.prepare hook can be used for example to invoke a script that checks if the jail's root exists, creating it if it does not. Since arbitrary variables in jail.conf can be passed to the command, it can be pretty useful for templating jails. An example use case for exec.release would be to remove the filesystem of an ephemeral jail. The names "prepare" and "release" are borrowed from the names of similar hooks in libvirt. Reviewed by: jamie, manpages, mmacy Approved by: mmacy (mentor) MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D24829
2020-05-14 23:38:11 +00:00
.It Va exec.prepare
Command(s) to run in the system environment to prepare a jail for creation.
These commands are executed before assigning IP addresses and mounting
filesystems, so they may be used to create a new jail filesystem if it does
not already exist.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.It Va exec.prestart
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
Command(s) to run in the system environment before a jail is created.
- Add exec hook "exec.created". This is called when the jail is created and before exec.start is called. [1] - Bump __FreeBSD_version. This allows to attach ZFS datasets and various other things to be done before any command/service/rc-script is started in the new jail. PR: 228066 [1] Reviewed by: jamie [1] Submitted by: Stefan Grönke <stefan@gronke.net> [1] Differential Revision: https://reviews.freebsd.org/D15330 [1]
2018-08-15 18:35:42 +00:00
.It Va exec.created
Command(s) to run in the system environment right after a jail has been
created, but before commands (or services) get executed in the jail.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.It Va exec.start
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
Command(s) to run in the jail environment when a jail is created.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
A typical command to run is
.Dq sh /etc/rc .
.It Va command
A synonym for
.Va exec.start
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
for use when specifying a jail directly on the command line.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
Unlike other parameters whose value is a single string,
.Va command
uses the remainder of the
.Nm
command line as its own arguments.
.It Va exec.poststart
Command(s) to run in the system environment after a jail is created,
and after any
.Va exec.start
commands have completed.
.It Va exec.prestop
Command(s) to run in the system environment before a jail is removed.
.It Va exec.stop
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
Command(s) to run in the jail environment before a jail is removed,
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
and after any
.Va exec.prestop
commands have completed.
A typical command to run is
add ability to set watchdog timeout for a shutdown This change allows to specify a watchdog(9) timeout for a system shutdown. The timeout is activated when the watchdogd daemon is stopped. The idea is to a prevent any indefinite hang during late stages of the shutdown. The feature is implemented in rc.d/watchdogd, it builds upon watchdogd -x option. Note that the shutdown timeout is not actiavted when the watchdogd service is individually stopped by an operator. It is also not activated for the 'shutdown' to the single-user mode. In those cases it is assumed that the operator knows what they are doing and they have means to recover the system should it hang. Significant subchanges and implementation details: - the argument to rc.shutdown, completely unused before, is assigned to rc_shutdown variable that can be inspected by rc scripts - init(8) passes "single" or "reboot" as the argument, this is not changed - the argument is not mandatory and if it is not set then rc_shutdown is set to "unspecified" - however, the default jail management scripts and jail configuration examples have been updated to pass "jail" to rc.shutdown, just in case - the new timeout can be set via watchdogd_shutdown_timeout rc option - for consistency, the regular timeout can now be set via watchdogd_timeout rc option - watchdogd_shutdown_timeout and watchdogd_timeout override timeout specifications in watchdogd_flags - existing configurations, where the new rc options are not set, should keep working as before I am not particularly wed to any of the implementation specifics. I am open to changing or removing any of them as long as the provided functionality is the same (or very close) to the proposed one. For example, I think it can be implemented without using watchdogd -x, by means of watchdog(1) alone. In that case there would be a small window between stopping watchdogd and running watchdog, but I think that that is acceptable. Reviewed by: bcr (man page changes) MFC after: 5 weeks Relnotes: yes Differential Revision: https://reviews.freebsd.org/D21221
2019-10-03 11:23:10 +00:00
.Dq sh /etc/rc.shutdown jail .
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.It Va exec.poststop
Command(s) to run in the system environment after a jail is removed.
jail: Add exec.prepare and exec.release command hooks This change introduces new jail command hooks that run before and after any other actions. The exec.prepare hook can be used for example to invoke a script that checks if the jail's root exists, creating it if it does not. Since arbitrary variables in jail.conf can be passed to the command, it can be pretty useful for templating jails. An example use case for exec.release would be to remove the filesystem of an ephemeral jail. The names "prepare" and "release" are borrowed from the names of similar hooks in libvirt. Reviewed by: jamie, manpages, mmacy Approved by: mmacy (mentor) MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D24829
2020-05-14 23:38:11 +00:00
.It Va exec.release
Command(s) to run in the system environment after all other actions are done.
These commands are executed after unmounting filesystems and removing IP
addresses, so they may be used to remove a jail filesystem if it is no longer
needed.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.It Va exec.clean
Run commands in a clean environment.
The environment is discarded except for
.Ev HOME , SHELL , TERM
and
.Ev USER .
.Ev HOME
and
.Ev SHELL
are set to the target login's default values.
.Ev USER
is set to the target login.
.Ev TERM
is imported from the current environment.
The environment variables from the login class capability database for the
target login are also set.
.It Va exec.jail_user
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
The user to run commands as, when running in the jail environment.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
The default is to run the commands as the current user.
.It Va exec.system_jail_user
This boolean option looks for the
.Va exec.jail_user
in the system
.Xr passwd 5
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
file, instead of in the jail's file.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.It Va exec.system_user
The user to run commands as, when running in the system environment.
The default is to run the commands as the current user.
.It Va exec.timeout
Reword an awkward option description PR: 191726 Reported by: yaneurabeya gmail.com MFC after: 3 days
2014-07-10 10:00:10 +00:00
The maximum amount of time to wait for a command to complete, in
seconds.
If a command is still running after this timeout has passed,
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
the jail will not be created or removed, as appropriate.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.It Va exec.consolelog
A file to direct command output (stdout and stderr) to.
.It Va exec.fib
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
The FIB (routing table) to set when running commands inside the jail.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.It Va stop.timeout
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
The maximum amount of time to wait for a jail's processes to exit
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
after sending them a
.Dv SIGTERM
signal (which happens after the
Fixes to man8 groff mandoc style, usage mistakes, or typos. PR: 168016 Submitted by: Nobuyuki Koganemaru Approved by: gjb MFC after: 3 days
2012-05-24 02:24:03 +00:00
.Va exec.stop
commands have completed).
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
After this many seconds have passed, the jail will be removed, which
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
will kill any remaining processes.
If this is set to zero, no
.Dv SIGTERM
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
is sent and the jail is immediately removed.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
The default is 10 seconds.
.It Va interface
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
A network interface to add the jail's IP addresses
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Va ( ip4.addr
and
.Va ip6.addr )
to.
An alias for each address will be added to the interface before the
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
jail is created, and will be removed from the interface after the
jail is removed.
- Add mount.fdescfs parameter to jail(8). This is similar to mount.devfs but mounts fdescfs. The mount happens just after mount.devfs. - rc.d/jail now displays whole error message from jail(8) when a jail fails to start. Approved by: re (gjb)
2013-10-12 17:27:59 +00:00
.It Va ip4.addr
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
In addition to the IP addresses that are passed to the kernel, an
Fix typo in jail(8) man page PR: 198790 Differential Revision: https://reviews.freebsd.org/D2111 Submitted by: Jimmy Olgeni Approved by: wblock (mentor) Sponsored by: ScaleEngine Inc.
2015-03-22 20:38:28 +00:00
interface, netmask and additional parameters (as supported by
Added support for extra ifconfig args to jail ip4.addr & ip6.addr params This allows for CARP interfaces to be used in jails e.g. ip4.addr = "em0|10.10.1.20/32 vhid 1 pass MyPass advskew 100" Before this change using exec.prestart to configure a CARP address would result in the wrong MAC being broadcast on startup as jail creates IP aliases to support ip[4|6].addr before exec.prestart is executed. PR: 191832 Reviewed by: jamie MFC after: 1 week X-MFC-With: r269340 Phabric: D528 Sponsored by: Multiplay
2014-08-04 16:32:08 +00:00
.Xr ifconfig 8 Ns )
may also be specified, in the form
.Dq Ar interface Ns | Ns Ar ip-address Ns / Ns Ar netmask param ... .
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
If an interface is given before the IP address, an alias for the address
will be added to that interface, as it is with the
.Va interface
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
parameter.
If a netmask in either dotted-quad or CIDR form is given
after an IP address, it will be used when adding the IP alias.
Added support for extra ifconfig args to jail ip4.addr & ip6.addr params This allows for CARP interfaces to be used in jails e.g. ip4.addr = "em0|10.10.1.20/32 vhid 1 pass MyPass advskew 100" Before this change using exec.prestart to configure a CARP address would result in the wrong MAC being broadcast on startup as jail creates IP aliases to support ip[4|6].addr before exec.prestart is executed. PR: 191832 Reviewed by: jamie MFC after: 1 week X-MFC-With: r269340 Phabric: D528 Sponsored by: Multiplay
2014-08-04 16:32:08 +00:00
If additional parameters are specified then they will also be used when
adding the IP alias.
- Add mount.fdescfs parameter to jail(8). This is similar to mount.devfs but mounts fdescfs. The mount happens just after mount.devfs. - rc.d/jail now displays whole error message from jail(8) when a jail fails to start. Approved by: re (gjb)
2013-10-12 17:27:59 +00:00
.It Va ip6.addr
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
In addition to the IP addresses that are passed to the kernel,
Added support for extra ifconfig args to jail ip4.addr & ip6.addr params This allows for CARP interfaces to be used in jails e.g. ip4.addr = "em0|10.10.1.20/32 vhid 1 pass MyPass advskew 100" Before this change using exec.prestart to configure a CARP address would result in the wrong MAC being broadcast on startup as jail creates IP aliases to support ip[4|6].addr before exec.prestart is executed. PR: 191832 Reviewed by: jamie MFC after: 1 week X-MFC-With: r269340 Phabric: D528 Sponsored by: Multiplay
2014-08-04 16:32:08 +00:00
an interface, prefix and additional parameters (as supported by
.Xr ifconfig 8 Ns )
may also be specified, in the form
.Dq Ar interface Ns | Ns Ar ip-address Ns / Ns Ar prefix param ... .
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.It Va vnet.interface
A network interface to give to a vnet-enabled jail after is it created.
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
The interface will automatically be released when the jail is removed.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.It Va ip_hostname
Resolve the
.Va host.hostname
parameter and add all IP addresses returned by the resolver
to the list of addresses
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
.Po Va ip4.addr
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
or
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
.Va ip6.addr Pc
for this jail.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
This may affect default address selection for outgoing IPv4 connections
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
from jails.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
The address first returned by the resolver for each address family
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
will be used as the primary address.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.It Va mount
A filesystem to mount before creating the jail (and to unmount after
removing it), given as a single
.Xr fstab 5
line.
.It Va mount.fstab
An
.Xr fstab 5
format file containing filesystems to mount before creating a jail.
.It Va mount.devfs
Mount a
- Add mount.fdescfs parameter to jail(8). This is similar to mount.devfs but mounts fdescfs. The mount happens just after mount.devfs. - rc.d/jail now displays whole error message from jail(8) when a jail fails to start. Approved by: re (gjb)
2013-10-12 17:27:59 +00:00
.Xr devfs 5
filesystem on the chrooted
.Pa /dev
directory, and apply the ruleset in the
Use the defvs_ruleset paramater when mounting a jail's /dev, instead of a mount.devfs.ruleset pseudo-parameter.
2012-02-27 22:37:35 +00:00
.Va devfs_ruleset
parameter (or a default of ruleset 4: devfsrules_jail)
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
to restrict the devices visible inside the jail.
- Add mount.fdescfs parameter to jail(8). This is similar to mount.devfs but mounts fdescfs. The mount happens just after mount.devfs. - rc.d/jail now displays whole error message from jail(8) when a jail fails to start. Approved by: re (gjb)
2013-10-12 17:27:59 +00:00
.It Va mount.fdescfs
Mount a
.Xr fdescfs 5
filesystem on the chrooted
.Pa /dev/fd
directory.
Add mount.procfs jail parameter, so procfs can be mounted when a prison's root is in its fstab. Also fix a typo while I'm at it. PR: 197237 197066 MFC after: 3 days
2015-02-06 17:54:53 +00:00
.It Va mount.procfs
Mount a
.Xr procfs 5
filesystem on the chrooted
.Pa /proc
directory.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.It Va allow.dying
Allow making changes to a
.Va dying
jail.
.It Va depend
Specify a jail (or jails) that this jail depends on.
Clarify when happens when there is a "depend" parameter in jail.conf, and how this affects the "jail_list" option in rc.conf.
2016-04-30 21:27:41 +00:00
When this jail is to be created, any jail(s) it depends on must already exist.
If not, they will be created automatically, up to the completion of the last
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Va exec.poststart
command, before any action will taken to create this jail.
When jails are removed the opposite is true:
Clarify when happens when there is a "depend" parameter in jail.conf, and how this affects the "jail_list" option in rc.conf.
2016-04-30 21:27:41 +00:00
this jail will be removed, up to the last
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Va exec.poststop
Clarify when happens when there is a "depend" parameter in jail.conf, and how this affects the "jail_list" option in rc.conf.
2016-04-30 21:27:41 +00:00
command, before any jail(s) it depends on are stopped.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.El
.Sh EXAMPLES
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
Jails are typically set up using one of two philosophies: either to
constrain a specific application (possibly running with privilege), or
Markup nits.
2004-06-05 20:27:10 +00:00
to create a
.Dq "virtual system image"
running a variety of daemons and services.
In both cases, a fairly complete file system install of
.Fx
is
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
required, so as to provide the necessary command line tools, daemons,
Typos and nits.
2004-05-20 06:37:44 +00:00
libraries, application configuration files, etc.
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
However, for a virtual server configuration, a fair amount of
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
additional work is required so as to replace the
Markup nits.
2004-06-05 20:27:10 +00:00
.Dq boot
process.
Typos and nits.
2004-05-20 06:37:44 +00:00
This manual page documents the configuration steps necessary to support
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
either of these steps, although the configuration steps may need to be
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
refined based on local requirements.
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Ss "Setting up a Jail Directory Tree"
Note that the jail setup example is meant to be fed to sh(1), not csh(1). PR: docs/87351 Submitted by: "Eli K. Breen" <bsd@unixforge.net> Approved by: simon, brooks MFC after: 3 days
2005-10-26 20:19:39 +00:00
To set up a jail directory tree containing an entire
mdoc(7) police: tidy up previous delta.
2002-01-10 15:14:22 +00:00
.Fx
Note that the jail setup example is meant to be fed to sh(1), not csh(1). PR: docs/87351 Submitted by: "Eli K. Breen" <bsd@unixforge.net> Approved by: simon, brooks MFC after: 3 days
2005-10-26 20:19:39 +00:00
distribution, the following
.Xr sh 1
command script can be used:
Remove whitespace at EOL.
2001-07-15 08:06:20 +00:00
.Bd -literal
Add example of how to create a jail.
1999-07-09 21:35:50 +00:00
D=/here/is/the/jail
cd /usr/src
Revert r221655: Various people voiced their concerns about these changes. Until this is resolved, we should use the old version.
2011-05-08 14:57:01 +00:00
mkdir -p $D
o Replace part-wise instructions for building world for jail(8) with a simple make world; while this does a bit more work, it means that jail(8) doesn't have to be kept in sync with /usr/src/Makefile{,.inc1} which is a moving target. MFC candidate. Submitted by: FUJISHIMA Satsuki <sf@FreeBSD.org> Reviewed by: phk Also pointed out by: Phil Kernick <Phil@Kernick.org>
2001-03-11 20:37:11 +00:00
make world DESTDIR=$D
Fix example, we do not need NO_MAKEDEV_RUN any more. XXX: this example should be updated with a good example of devfs(8) rules.
2002-10-22 15:03:51 +00:00
make distribution DESTDIR=$D
Add example of how to create a jail.
1999-07-09 21:35:50 +00:00
.Ed
Add some wisdom to the jail setup instructions.
2001-12-14 20:20:50 +00:00
.Pp
Typos and nits.
2004-05-20 06:37:44 +00:00
In many cases this example would put far more in the jail than needed.
In the other extreme case a jail might contain only one file:
Add some wisdom to the jail setup instructions.
2001-12-14 20:20:50 +00:00
the executable to be run in the jail.
.Pp
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
We recommend experimentation, and caution that it is a lot easier to
mdoc(7) police: tidy up previous delta.
2002-01-10 15:14:22 +00:00
start with a
.Dq fat
jail and remove things until it stops working,
than it is to start with a
.Dq thin
jail and add things until it works.
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Ss "Setting Up a Jail"
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
Do what was described in
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Sx "Setting Up a Jail Directory Tree"
to build the jail directory tree.
For the sake of this example, we will
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
assume you built it in
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Pa /data/jail/testjail ,
for a jail named
.Dq testjail .
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
Substitute below as needed with your
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
own directory, IP address, and hostname.
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
.Ss "Setting up the Host Environment"
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
First, set up the real system's environment to be
mdoc(7) police: split punctuation characters + misc fixes.
2001-02-01 16:44:04 +00:00
.Dq jail-friendly .
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
For consistency, we will refer to the parent box as the
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Dq "host environment" ,
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
and to the jailed virtual machine as the
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Dq "jail environment" .
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
Since jails are implemented using IP aliases, one of the first things to do
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
is to disable IP services on the host system that listen on all local
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
IP addresses for a service.
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
If a network service is present in the host environment that binds all
available IP addresses rather than specific IP addresses, it may service
MFp4: Bring in updated jail support from bz_jail branch. This enhances the current jail implementation to permit multiple addresses per jail. In addtion to IPv4, IPv6 is supported as well. Due to updated checks it is even possible to have jails without an IP address at all, which basically gives one a chroot with restricted process view, no networking,.. SCTP support was updated and supports IPv6 in jails as well. Cpuset support permits jails to be bound to specific processor sets after creation. Jails can have an unrestricted (no duplicate protection, etc.) name in addition to the hostname. The jail name cannot be changed from within a jail and is considered to be used for management purposes or as audit-token in the future. DDB 'show jails' command was added to aid debugging. Proper compat support permits 32bit jail binaries to be used on 64bit systems to manage jails. Also backward compatibility was preserved where possible: for jail v1 syscalls, as well as with user space management utilities. Both jail as well as prison version were updated for the new features. A gap was intentionally left as the intermediate versions had been used by various patches floating around the last years. Bump __FreeBSD_version for the afore mentioned and in kernel changes. Special thanks to: - Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches and Olivier Houchard (cognet) for initial single-IPv6 patches. - Jeff Roberson (jeff) and Randall Stewart (rrs) for their help, ideas and review on cpuset and SCTP support. - Robert Watson (rwatson) for lots and lots of help, discussions, suggestions and review of most of the patch at various stages. - John Baldwin (jhb) for his help. - Simon L. Nielsen (simon) as early adopter testing changes on cluster machines as well as all the testers and people who provided feedback the last months on freebsd-jail and other channels. - My employer, CK Software GmbH, for the support so I could work on this. Reviewed by: (see above) MFC after: 3 months (this is just so that I get the mail) X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
requests sent to jail IP addresses if the jail did not bind the port.
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
This means changing
Some minor mdoc style and spelling fixes.
2000-03-24 02:05:54 +00:00
.Xr inetd 8
to only listen on the
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
appropriate IP address, and so forth.
Add the following to
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
.Pa /etc/rc.conf
in the host environment:
.Bd -literal -offset indent
sendmail_enable="NO"
Use IP addresses out of "TEST-NET" (for use in documentation and example code) [RFC3330]. Reviewed by: simon
2006-06-11 12:57:41 +00:00
inetd_flags="-wW -a 192.0.2.23"
portmap_enable -> rpcbind_enable. Spotted by: Andrew Khlebutin <andreyh@perm.ru>
2003-03-18 14:01:02 +00:00
rpcbind_enable="NO"
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
.Ed
.Pp
Use IP addresses out of "TEST-NET" (for use in documentation and example code) [RFC3330]. Reviewed by: simon
2006-06-11 12:57:41 +00:00
.Li 192.0.2.23
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
is the native IP address for the host system, in this example.
Daemons that run out of
Fix up a few documentation nits in jail(8), as well as improve the instructions so as to reduce warnings during jail startup, etc. Add a somewhat bolder warning recommending the use of kern.jail.set_hostname to limit jail renamining.
2000-02-18 19:02:22 +00:00
.Xr inetd 8
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
can be easily configured to use only the specified host IP address.
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
Other daemons
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
will need to be manually configured \(em for some this is possible through
Fix up a few documentation nits in jail(8), as well as improve the instructions so as to reduce warnings during jail startup, etc. Add a somewhat bolder warning recommending the use of kern.jail.set_hostname to limit jail renamining.
2000-02-18 19:02:22 +00:00
.Xr rc.conf 5
Typos and nits.
2004-05-20 06:37:44 +00:00
flags entries; for others it is necessary to modify per-application
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
configuration files, or to recompile the application.
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
The following frequently deployed services must have their individual
configuration files modified to limit the application to listening
to a specific IP address:
.Pp
To configure
.Xr sshd 8 ,
it is necessary to modify
.Pa /etc/ssh/sshd_config .
Fix up a few documentation nits in jail(8), as well as improve the instructions so as to reduce warnings during jail startup, etc. Add a somewhat bolder warning recommending the use of kern.jail.set_hostname to limit jail renamining.
2000-02-18 19:02:22 +00:00
.Pp
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
To configure
Fix up a few documentation nits in jail(8), as well as improve the instructions so as to reduce warnings during jail startup, etc. Add a somewhat bolder warning recommending the use of kern.jail.set_hostname to limit jail renamining.
2000-02-18 19:02:22 +00:00
.Xr sendmail 8 ,
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
it is necessary to modify
.Pa /etc/mail/sendmail.cf .
.Pp
For
Fix up a few documentation nits in jail(8), as well as improve the instructions so as to reduce warnings during jail startup, etc. Add a somewhat bolder warning recommending the use of kern.jail.set_hostname to limit jail renamining.
2000-02-18 19:02:22 +00:00
.Xr named 8 ,
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
it is necessary to modify
.Pa /etc/namedb/named.conf .
.Pp
In addition, a number of services must be recompiled in order to run
them in the host environment.
This includes most applications providing services using
.Xr rpc 3 ,
such as
Fixed punctuation in xrefs.
2005-01-21 20:48:00 +00:00
.Xr rpcbind 8 ,
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
.Xr nfsd 8 ,
Fix up a few documentation nits in jail(8), as well as improve the instructions so as to reduce warnings during jail startup, etc. Add a somewhat bolder warning recommending the use of kern.jail.set_hostname to limit jail renamining.
2000-02-18 19:02:22 +00:00
and
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
.Xr mountd 8 .
In general, applications for which it is not possible to specify which
IP address to bind should not be run in the host environment unless they
should also service requests sent to jail IP addresses.
syslogd can now be configured to bind to a specific address.
2001-09-03 15:42:10 +00:00
Attempting to serve
Fix up a few documentation nits in jail(8), as well as improve the instructions so as to reduce warnings during jail startup, etc. Add a somewhat bolder warning recommending the use of kern.jail.set_hostname to limit jail renamining.
2000-02-18 19:02:22 +00:00
NFS from the host environment may also cause confusion, and cannot be
easily reconfigured to use only specific IPs, as some NFS services are
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
hosted directly from the kernel.
Typos and nits.
2004-05-20 06:37:44 +00:00
Any third-party network software running
Fix up a few documentation nits in jail(8), as well as improve the instructions so as to reduce warnings during jail startup, etc. Add a somewhat bolder warning recommending the use of kern.jail.set_hostname to limit jail renamining.
2000-02-18 19:02:22 +00:00
in the host environment should also be checked and configured so that it
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
does not bind all IP addresses, which would result in those services also
Fix up a few documentation nits in jail(8), as well as improve the instructions so as to reduce warnings during jail startup, etc. Add a somewhat bolder warning recommending the use of kern.jail.set_hostname to limit jail renamining.
2000-02-18 19:02:22 +00:00
appearing to be offered by the jail environments.
.Pp
Once
these daemons have been disabled or fixed in the host environment, it is
best to reboot so that all daemons are in a known state, to reduce the
potential for confusion later (such as finding that when you send mail
to a jail, and its sendmail is down, the mail is delivered to the host,
Markup nits.
2004-06-05 20:27:10 +00:00
etc.).
.Ss "Configuring the Jail"
Typos and nits.
2004-05-20 06:37:44 +00:00
Start any jail for the first time without configuring the network
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
interface so that you can clean it up a little and set up accounts.
As
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
with any machine (virtual or not), you will need to set a root password, time
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
zone, etc.
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
Some of these steps apply only if you intend to run a full virtual server
Typos and nits.
2004-05-20 06:37:44 +00:00
inside the jail; others apply both for constraining a particular application
or for running a virtual server.
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
.Pp
No need to copy sysinstall into a jail with -CURRENT, since in -CURRENT, we have /usr/sbin/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 02:46:44 +00:00
Start a shell in the jail:
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Bd -literal -offset indent
Line-wrapping tweak: make the sample jail command line fit in 80 characters. MFC after: 3 days
2014-03-17 14:19:42 +00:00
jail -c path=/data/jail/testjail mount.devfs \\
host.hostname=testhostname ip4.addr=192.0.2.100 \\
command=/bin/sh
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Ed
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Pp
Typos and nits.
2004-05-20 06:37:44 +00:00
Assuming no errors, you will end up with a shell prompt within the jail.
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
You can now run
In r324732 sysinstall was replaced by bsdinstall. However, for post-install configuration, bsdinstall is not of much use. Point the user to bsdconfig instead. Reviewed by: 0mp, bcr Approved by: 0mp, bcr Differential Revision: https://reviews.freebsd.org/D16751
2018-08-20 18:17:50 +00:00
.Xr bsdconfig 8
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
and do the post-install configuration to set various configuration options,
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
or perform these actions manually by editing
.Pa /etc/rc.conf ,
etc.
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
.Pp
.Bl -bullet -offset indent -compact
.It
Move DNS configuration before sendmail configuration, because newaliases(1) may hang without proper DNS configuration. Approved by: brueffer
2005-07-25 16:04:30 +00:00
Configure
.Pa /etc/resolv.conf
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
so that name resolution within the jail will work correctly.
Move DNS configuration before sendmail configuration, because newaliases(1) may hang without proper DNS configuration. Approved by: brueffer
2005-07-25 16:04:30 +00:00
.It
- As jail(8) has been almost completely rewritten, prepend another copyright/ BSD-style license, as an add-on to phk's beerware license. Please fedex some beer to phk. - Add a ``make depend'' line to the jail-building, which fixes openssl, among other things. Suggested by: kris - Add ``newaliases'' to the list of things to do when setting up a new jail, so that the jailed sendmail doesn't complain. - Correct references to ``kern.jail.set_hostname_allowed'' which now read ``jail.set_hostname_allowed''. - Add a reference to sysctl.conf where the sysctl can easily be set in a persistent way. - Add a list of cross references to the man page. - Fix a formatting nit or two.
2000-02-20 02:51:11 +00:00
Run
.Xr newaliases 1
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
to quell
.Xr sendmail 8
warnings.
- As jail(8) has been almost completely rewritten, prepend another copyright/ BSD-style license, as an add-on to phk's beerware license. Please fedex some beer to phk. - Add a ``make depend'' line to the jail-building, which fixes openssl, among other things. Suggested by: kris - Add ``newaliases'' to the list of things to do when setting up a new jail, so that the jailed sendmail doesn't complain. - Correct references to ``kern.jail.set_hostname_allowed'' which now read ``jail.set_hostname_allowed''. - Add a reference to sysctl.conf where the sysctl can easily be set in a persistent way. - Add a list of cross references to the man page. - Fix a formatting nit or two.
2000-02-20 02:51:11 +00:00
.It
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
Set a root password, probably different from the real host system.
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
.It
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
Set the timezone.
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
.It
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
Add accounts for users in the jail environment.
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
.It
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
Install any packages the environment requires.
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
.El
.Pp
Fix up a few documentation nits in jail(8), as well as improve the instructions so as to reduce warnings during jail startup, etc. Add a somewhat bolder warning recommending the use of kern.jail.set_hostname to limit jail renamining.
2000-02-18 19:02:22 +00:00
You may also want to perform any package-specific configuration (web servers,
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
SSH servers, etc), patch up
.Pa /etc/syslog.conf
so it logs as you would like, etc.
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
If you are not using a virtual server, you may wish to modify
.Xr syslogd 8
in the host environment to listen on the syslog socket in the jail
environment; in this example, the syslog socket would be stored in
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Pa /data/jail/testjail/var/run/log .
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
.Pp
Exit from the shell, and the jail will be shut down.
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Ss "Starting the Jail"
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
You are now ready to restart the jail and bring up the environment with
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
all of its daemons and other programs.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
Create an entry for the jail in
.Pa /etc/jail.conf :
.Bd -literal -offset indent
testjail {
path = /tmp/jail/testjail;
mount.devfs;
host.hostname = testhostname;
ip4.addr = 192.0.2.100;
Change ed(4), ep(4), and fxp(4) examples to em(4). ed(4) and ep(4) have been removed. fxp(4) remains popular in older systems, but isn't as future proof as em(4). Reviewed by: bz, jhb MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D20311
2019-05-18 21:01:36 +00:00
interface = em0;
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
exec.start = "/bin/sh /etc/rc";
add ability to set watchdog timeout for a shutdown This change allows to specify a watchdog(9) timeout for a system shutdown. The timeout is activated when the watchdogd daemon is stopped. The idea is to a prevent any indefinite hang during late stages of the shutdown. The feature is implemented in rc.d/watchdogd, it builds upon watchdogd -x option. Note that the shutdown timeout is not actiavted when the watchdogd service is individually stopped by an operator. It is also not activated for the 'shutdown' to the single-user mode. In those cases it is assumed that the operator knows what they are doing and they have means to recover the system should it hang. Significant subchanges and implementation details: - the argument to rc.shutdown, completely unused before, is assigned to rc_shutdown variable that can be inspected by rc scripts - init(8) passes "single" or "reboot" as the argument, this is not changed - the argument is not mandatory and if it is not set then rc_shutdown is set to "unspecified" - however, the default jail management scripts and jail configuration examples have been updated to pass "jail" to rc.shutdown, just in case - the new timeout can be set via watchdogd_shutdown_timeout rc option - for consistency, the regular timeout can now be set via watchdogd_timeout rc option - watchdogd_shutdown_timeout and watchdogd_timeout override timeout specifications in watchdogd_flags - existing configurations, where the new rc options are not set, should keep working as before I am not particularly wed to any of the implementation specifics. I am open to changing or removing any of them as long as the provided functionality is the same (or very close) to the proposed one. For example, I think it can be implemented without using watchdogd -x, by means of watchdog(1) alone. In that case there would be a small window between stopping watchdogd and running watchdog, but I think that that is acceptable. Reviewed by: bcr (man page changes) MFC after: 5 weeks Relnotes: yes Differential Revision: https://reviews.freebsd.org/D21221
2019-10-03 11:23:10 +00:00
exec.stop = "/bin/sh /etc/rc.shutdown jail";
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
}
.Ed
.Pp
A variety of content cleanups: (1) Document the notion of using jail(8) to run "virtual servers" or just to constrain specific applications. If only running specific applications, some configuration steps are unnecessary (such as editing rc.conf). (2) Add some more subsection headers to break up the bigger chunks of text. (3) Clarify the problems associated with applications binding all IP addresses in the host, and attempt to be more specific about potential application problems. Document how to force sshd to bind the the right socket. (4) Suggest that in a jailed application scenario, you might want to have the host syslogd listen on the socket in the jail, rather than running syslogd in the jail. (5) Catch another reference to /stand/sysinstall. Approved by: re (bmah implicitly)
2003-11-20 03:47:50 +00:00
To start a virtual server environment,
.Pa /etc/rc
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
is run to launch various daemons and services, and
.Pa /etc/rc.shutdown
is run to shut them down when the jail is removed.
If you are running a single application in the jail,
substitute the command used to start the application for
.Dq /bin/sh /etc/rc ;
there may be some script available to cleanly shut down the application,
or it may be sufficient to go without a stop command, and have
.Nm
send
.Dv SIGTERM
to the application.
.Pp
Start the jail by running:
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
.Bd -literal -offset indent
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
jail -c testjail
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
.Ed
.Pp
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
A few warnings may be produced; however, it should all work properly.
Remove single-space hard sentence breaks. These degrade the quality of the typeset output, tend to make diffs harder to read and provide bad examples for new-comers to mdoc.
2000-03-01 14:09:25 +00:00
You should be able to see
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
.Xr inetd 8 ,
.Xr syslogd 8 ,
and other processes running within the jail using
.Xr ps 1 ,
with the
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Ql J
flag appearing beside jailed processes.
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
To see an active list of jails, use
.Xr jls 8 .
If
.Xr sshd 8
is enabled in the jail environment, you should be able to
.Xr ssh 1
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
to the hostname or IP address of the jailed environment, and log
Some minor mdoc style and spelling fixes.
2000-03-24 02:05:54 +00:00
in using the accounts you created previously.
Add some more info about jail startup and shutdown. Submitted by: Jeremie Le Hen <jeremie@le-hen.org> MFC after: 3 days
2005-08-07 20:53:29 +00:00
.Pp
It is possible to have jails started at boot time.
Please refer to the
.Dq jail_*
variables in
.Xr rc.conf 5
for more information.
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Ss "Managing the Jail"
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
Normal machine shutdown commands, such as
.Xr halt 8 ,
.Xr reboot 8 ,
and
.Xr shutdown 8 ,
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
cannot be used successfully within the jail.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
To kill all processes from within a jail, you may use one of the
following commands, depending on what you want to accomplish:
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Bd -literal -offset indent
kill -TERM -1
kill -KILL -1
.Ed
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
.Pp
This will send the
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Dv SIGTERM
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
or
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Dv SIGKILL
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
signals to all processes in the jail \(em be careful not to run this from
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
the host environment!
Once all of the jail's processes have died, unless the jail was created
with the
.Va persist
parameter, the jail will be removed.
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
Depending on
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
the intended use of the jail, you may also want to run
.Pa /etc/rc.shutdown
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
from within the jail.
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Pp
To shut down the jail from the outside, simply remove it with
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Nm
.Ar -r ,
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
which will run any commands specified by
.Va exec.stop ,
and then send
.Dv SIGTERM
and eventually
.Dv SIGKILL
to any remaining jailed processes.
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
.Pp
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
The
.Pa /proc/ Ns Ar pid Ns Pa /status
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
file contains, as its last field, the name of the jail in which the
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
process runs, or
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Dq Li -
to indicate that the process is not running within a jail.
The
Add Robert Watson's much extended documentation including that of the kern.jail.set_hostname_allowed sysctl MIB. Submitted by: rwatson
2000-02-13 05:15:29 +00:00
.Xr ps 1
command also shows a
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Ql J
flag for processes in a jail.
Document 'jid' keyword for ps(1) and '-j' option for pgrep(1)/pkill(1).
2005-05-28 16:23:29 +00:00
.Pp
You can also list/kill processes based on their jail ID.
Markup fixes. Approved by: re (blanket)
2005-06-14 12:26:36 +00:00
To show processes and their jail ID, use the following command:
Document 'jid' keyword for ps(1) and '-j' option for pgrep(1)/pkill(1).
2005-05-28 16:23:29 +00:00
.Pp
Markup fixes. Approved by: re (blanket)
2005-06-14 12:26:36 +00:00
.Dl "ps ax -o pid,jid,args"
Document 'jid' keyword for ps(1) and '-j' option for pgrep(1)/pkill(1).
2005-05-28 16:23:29 +00:00
.Pp
To show and then kill processes in jail number 3 use the following commands:
.Bd -literal -offset indent
pgrep -lfj 3
pkill -j 3
.Ed
Markup fixes. Approved by: re (blanket)
2005-06-14 12:26:36 +00:00
or:
Document 'jid' keyword for ps(1) and '-j' option for pgrep(1)/pkill(1).
2005-05-28 16:23:29 +00:00
.Pp
Markup fixes. Approved by: re (blanket)
2005-06-14 12:26:36 +00:00
.Dl "killall -j 3"
Add a short section talking about jails and file systems; mention the mountand jail-aware file systems as well as quota. PR: kern/68192 Reviewed by: simon MFC after: 2 weeks
2009-01-11 18:40:56 +00:00
.Ss "Jails and File Systems"
It is not possible to
.Xr mount 8
or
s,unmount 8,umount 8, it is unmount(2) which I did not mean. Submitted by: pluknet@gmail.com MFC after: 1 week
2009-01-17 14:52:26 +00:00
.Xr umount 8
Add a short section talking about jails and file systems; mention the mountand jail-aware file systems as well as quota. PR: kern/68192 Reviewed by: simon MFC after: 2 weeks
2009-01-11 18:40:56 +00:00
any file system inside a jail unless the file system is marked
Always disable mount and unmount for jails with enforce_statfs==2. A working statfs(2) is required for umount(8) in jail. Reviewed by: pjd, kib Approved by: re (kib) MFC after: 2 weeks
2011-08-02 19:44:40 +00:00
jail-friendly, the jail's
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Va allow.mount
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
parameter is set, and the jail's
Always disable mount and unmount for jails with enforce_statfs==2. A working statfs(2) is required for umount(8) in jail. Reviewed by: pjd, kib Approved by: re (kib) MFC after: 2 weeks
2011-08-02 19:44:40 +00:00
.Va enforce_statfs
parameter is lower than 2.
Add a short section talking about jails and file systems; mention the mountand jail-aware file systems as well as quota. PR: kern/68192 Reviewed by: simon MFC after: 2 weeks
2009-01-11 18:40:56 +00:00
.Pp
Multiple jails sharing the same file system can influence each other.
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
For example, a user in one jail can fill the file system,
Add a short section talking about jails and file systems; mention the mountand jail-aware file systems as well as quota. PR: kern/68192 Reviewed by: simon MFC after: 2 weeks
2009-01-11 18:40:56 +00:00
leaving no space for processes in the other jail.
Trying to use
.Xr quota 1
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
to prevent this will not work either, as the file system quotas
Add a short section talking about jails and file systems; mention the mountand jail-aware file systems as well as quota. PR: kern/68192 Reviewed by: simon MFC after: 2 weeks
2009-01-11 18:40:56 +00:00
are not aware of jails but only look at the user and group IDs.
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
This means the same user ID in two jails share a single file
Add a short section talking about jails and file systems; mention the mountand jail-aware file systems as well as quota. PR: kern/68192 Reviewed by: simon MFC after: 2 weeks
2009-01-11 18:40:56 +00:00
system quota.
Fix grammar. Submitted by: richardtoohey at paradise dot net dot nz on -doc
2009-06-08 03:37:25 +00:00
One would need to use one file system per jail to make this work.
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.Ss "Sysctl MIB Entries"
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
The read-only entry
o Document security.jail.jailed sysctl. PR: docs/94711 Submitted by: Andreas Kohn MFC after: 2 weeks
2006-05-03 20:13:33 +00:00
.Va security.jail.jailed
Markup fixes.
2006-09-29 17:57:04 +00:00
can be used to determine if a process is running inside a jail (value
o Document security.jail.jailed sysctl. PR: docs/94711 Submitted by: Andreas Kohn MFC after: 2 weeks
2006-05-03 20:13:33 +00:00
is one) or not (value is zero).
.Pp
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
The variable
.Va security.jail.max_af_ips
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
determines how may address per address family a jail may have.
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
The default is 255.
document security.jail.list sysctl in jail(8) PR: docs/96807 MFC after: 3
2006-05-08 19:55:17 +00:00
.Pp
Place hostnames and similar information fully under the prison system. The system hostname is now stored in prison0, and the global variable "hostname" has been removed, as has the hostname_mtx mutex. Jails may have their own host information, or they may inherit it from the parent/system. The proper way to read the hostname is via getcredhostname(), which will copy either the hostname associated with the passed cred, or the system hostname if you pass NULL. The system hostname can still be accessed directly (and without locking) at prison0.pr_host, but that should be avoided where possible. The "similar information" referred to is domainname, hostid, and hostuuid, which have also become prison parameters and had their associated global variables removed. Approved by: bz (mentor)
2009-05-29 21:27:12 +00:00
Some MIB variables have per-jail settings.
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
Changes to these variables by a jailed process do not affect the host
- Add a note that there are two MIB variables that have per-jail settings. Reviewed by: rwatson Approved by: blackend (mentor)
2003-11-11 18:34:29 +00:00
environment, only the jail environment.
Place hostnames and similar information fully under the prison system. The system hostname is now stored in prison0, and the global variable "hostname" has been removed, as has the hostname_mtx mutex. Jails may have their own host information, or they may inherit it from the parent/system. The proper way to read the hostname is via getcredhostname(), which will copy either the hostname associated with the passed cred, or the system hostname if you pass NULL. The system hostname can still be accessed directly (and without locking) at prison0.pr_host, but that should be avoided where possible. The "similar information" referred to is domainname, hostid, and hostuuid, which have also become prison parameters and had their associated global variables removed. Approved by: bz (mentor)
2009-05-29 21:27:12 +00:00
These variables are
.Va kern.securelevel ,
jail: introduce per jail suser_enabled setting The suser_enable sysctl allows to remove a privileged rights from uid 0. This change introduce per jail setting which allow to make root a normal user. Reviewed by: jamie Previous version reviewed by: kevans, emaste, markj, me_igalic.co Discussed with: pjd Differential Revision: https://reviews.freebsd.org/D27128
2020-11-18 21:07:08 +00:00
.Va security.bsd.suser_enabled ,
Place hostnames and similar information fully under the prison system. The system hostname is now stored in prison0, and the global variable "hostname" has been removed, as has the hostname_mtx mutex. Jails may have their own host information, or they may inherit it from the parent/system. The proper way to read the hostname is via getcredhostname(), which will copy either the hostname associated with the passed cred, or the system hostname if you pass NULL. The system hostname can still be accessed directly (and without locking) at prison0.pr_host, but that should be avoided where possible. The "similar information" referred to is domainname, hostid, and hostuuid, which have also become prison parameters and had their associated global variables removed. Approved by: bz (mentor)
2009-05-29 21:27:12 +00:00
.Va kern.hostname ,
.Va kern.domainname ,
.Va kern.hostid ,
- Add a note that there are two MIB variables that have per-jail settings. Reviewed by: rwatson Approved by: blackend (mentor)
2003-11-11 18:34:29 +00:00
and
Place hostnames and similar information fully under the prison system. The system hostname is now stored in prison0, and the global variable "hostname" has been removed, as has the hostname_mtx mutex. Jails may have their own host information, or they may inherit it from the parent/system. The proper way to read the hostname is via getcredhostname(), which will copy either the hostname associated with the passed cred, or the system hostname if you pass NULL. The system hostname can still be accessed directly (and without locking) at prison0.pr_host, but that should be avoided where possible. The "similar information" referred to is domainname, hostid, and hostuuid, which have also become prison parameters and had their associated global variables removed. Approved by: bz (mentor)
2009-05-29 21:27:12 +00:00
.Va kern.hostuuid .
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Ss "Hierarchical Jails"
By setting a jail's
Add a limit for child jails via the "children.cur" and "children.max" parameters. This replaces the simple "allow.jails" permission. Approved by: bz (mentor)
2009-06-23 20:35:51 +00:00
.Va children.max
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
parameter, processes within a jail may be able to create jails of their own.
These child jails are kept in a hierarchy, with jails only able to see and/or
modify the jails they created (or those jails' children).
Each jail has a read-only
.Va parent
parameter, containing the
.Va jid
of the jail that created it; a
.Va jid
of 0 indicates the jail is a child of the current jail (or is a top-level
jail if the current process isn't jailed).
.Pp
Jailed processes are not allowed to confer greater permissions than they
Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
2014-05-16 01:50:04 +00:00
themselves are given, e.g., if a jail is created with
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Va allow.nomount ,
it is not able to create a jail with
.Va allow.mount
set.
Similarly, such restrictions as
.Va ip4.addr
and
.Va securelevel
may not be bypassed in child jails.
.Pp
A child jail may in turn create its own child jails if its own
Add a limit for child jails via the "children.cur" and "children.max" parameters. This replaces the simple "allow.jails" permission. Approved by: bz (mentor)
2009-06-23 20:35:51 +00:00
.Va children.max
parameter is set (remember it is zero by default).
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
These jails are visible to and can be modified by their parent and all
ancestors.
.Pp
Jail names reflect this hierarchy, with a full name being an MIB-type string
separated by dots.
For example, if a base system process creates a jail
.Dq foo ,
and a process under that jail creates another jail
.Dq bar ,
then the second jail will be seen as
.Dq foo.bar
in the base system (though it is only seen as
.Dq bar
to any processes inside jail
.Dq foo ) .
Jids on the other hand exist in a single space, and each jail must have a
unique jid.
.Pp
Like the names, a child jail's
.Va path
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
appears relative to its creator's own
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Va path .
This is by virtue of the child jail being created in the chrooted
environment of the first jail.
This Implements the mumbled about "Jail" feature. This is a seriously beefed up chroot kind of thing. The process is jailed along the same lines as a chroot does it, but with additional tough restrictions imposed on what the superuser can do. For all I know, it is safe to hand over the root bit inside a prison to the customer living in that prison, this is what it was developed for in fact: "real virtual servers". Each prison has an ip number associated with it, which all IP communications will be coerced to use and each prison has its own hostname. Needless to say, you need more RAM this way, but the advantage is that each customer can run their own particular version of apache and not stomp on the toes of their neighbors. It generally does what one would expect, but setting up a jail still takes a little knowledge. A few notes: I have no scripts for setting up a jail, don't ask me for them. The IP number should be an alias on one of the interfaces. mount a /proc in each jail, it will make ps more useable. /proc/<pid>/status tells the hostname of the prison for jailed processes. Quotas are only sensible if you have a mountpoint per prison. There are no privisions for stopping resource-hogging. Some "#ifdef INET" and similar may be missing (send patches!) If somebody wants to take it from here and develop it into more of a "virtual machine" they should be most welcome! Tools, comments, patches & documentation most welcome. Have fun... Sponsored by: http://www.rndassociates.com/ Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
.Sh SEE ALSO
o Add jls(8) for listing active jails. o Add jexec(8) to execute a command in an existing jail. o Add -j option for killall(1) to kill all processes in a specified jail. o Add -i option to jail(8) to output jail ID of newly created jail.
2003-04-09 03:04:12 +00:00
.Xr killall 1 ,
Add security.jail.mount_allowed sysctl, which allows to mount and unmount jail-friendly file systems from within a jail. Precisely it grants PRIV_VFS_MOUNT, PRIV_VFS_UNMOUNT and PRIV_VFS_MOUNT_NONUSER privileges for a jailed super-user. It is turned off by default. A jail-friendly file system is a file system which driver registers itself with VFCF_JAIL flag via VFS_SET(9) API. The lsvfs(1) command can be used to see which file systems are jail-friendly ones. There currently no jail-friendly file systems, ZFS will be the first one. In the future we may consider marking file systems like nullfs as jail-friendly. Reviewed by: rwatson
2007-04-05 21:03:05 +00:00
.Xr lsvfs 1 ,
- As jail(8) has been almost completely rewritten, prepend another copyright/ BSD-style license, as an add-on to phk's beerware license. Please fedex some beer to phk. - Add a ``make depend'' line to the jail-building, which fixes openssl, among other things. Suggested by: kris - Add ``newaliases'' to the list of things to do when setting up a new jail, so that the jailed sendmail doesn't complain. - Correct references to ``kern.jail.set_hostname_allowed'' which now read ``jail.set_hostname_allowed''. - Add a reference to sysctl.conf where the sysctl can easily be set in a persistent way. - Add a list of cross references to the man page. - Fix a formatting nit or two.
2000-02-20 02:51:11 +00:00
.Xr newaliases 1 ,
Document 'jid' keyword for ps(1) and '-j' option for pgrep(1)/pkill(1).
2005-05-28 16:23:29 +00:00
.Xr pgrep 1 ,
.Xr pkill 1 ,
- As jail(8) has been almost completely rewritten, prepend another copyright/ BSD-style license, as an add-on to phk's beerware license. Please fedex some beer to phk. - Add a ``make depend'' line to the jail-building, which fixes openssl, among other things. Suggested by: kris - Add ``newaliases'' to the list of things to do when setting up a new jail, so that the jailed sendmail doesn't complain. - Correct references to ``kern.jail.set_hostname_allowed'' which now read ``jail.set_hostname_allowed''. - Add a reference to sysctl.conf where the sysctl can easily be set in a persistent way. - Add a list of cross references to the man page. - Fix a formatting nit or two.
2000-02-20 02:51:11 +00:00
.Xr ps 1 ,
Add a short section talking about jails and file systems; mention the mountand jail-aware file systems as well as quota. PR: kern/68192 Reviewed by: simon MFC after: 2 weeks
2009-01-11 18:40:56 +00:00
.Xr quota 1 ,
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Xr jail_set 2 ,
- Add the ability to run bhyve(8) within a jail(8). This patch adds a new sysctl(8) knob "security.jail.vmm_allowed", by default this option is disable. Submitted by: Shawn Webb <shawn.webb____hardenedbsd.org> Reviewed by: jamie@ and myself. Relnotes: Yes. Sponsored by: HardenedBSD and G2, Inc. Differential Revision: https://reviews.freebsd.org/D16057
2018-08-01 00:39:21 +00:00
.Xr vmm 4 ,
- Add mount.fdescfs parameter to jail(8). This is similar to mount.devfs but mounts fdescfs. The mount happens just after mount.devfs. - rc.d/jail now displays whole error message from jail(8) when a jail fails to start. Approved by: re (gjb)
2013-10-12 17:27:59 +00:00
.Xr devfs 5 ,
.Xr fdescfs 5 ,
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Xr jail.conf 5 ,
Add support to the jail framework to be able to mount linsysfs(5) and linprocfs(5). Differential Revision: D2846 Submitted by: Nikolai Lifanov <lifanov@mail.lifanov.com> Reviewed by: jamie
2015-07-19 08:52:35 +00:00
.Xr linprocfs 5 ,
.Xr linsysfs 5 ,
- As jail(8) has been almost completely rewritten, prepend another copyright/ BSD-style license, as an add-on to phk's beerware license. Please fedex some beer to phk. - Add a ``make depend'' line to the jail-building, which fixes openssl, among other things. Suggested by: kris - Add ``newaliases'' to the list of things to do when setting up a new jail, so that the jailed sendmail doesn't complain. - Correct references to ``kern.jail.set_hostname_allowed'' which now read ``jail.set_hostname_allowed''. - Add a reference to sysctl.conf where the sysctl can easily be set in a persistent way. - Add a list of cross references to the man page. - Fix a formatting nit or two.
2000-02-20 02:51:11 +00:00
.Xr procfs 5 ,
.Xr rc.conf 5 ,
.Xr sysctl.conf 5 ,
In r324732 sysinstall was replaced by bsdinstall. However, for post-install configuration, bsdinstall is not of much use. Point the user to bsdconfig instead. Reviewed by: 0mp, bcr Approved by: 0mp, bcr Differential Revision: https://reviews.freebsd.org/D16751
2018-08-20 18:17:50 +00:00
.Xr bsdconfig 8 ,
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
.Xr chroot 8 ,
When pointing users at mount_devfs to populate the /dev of a jail, tell them that they also need to use devfs rules to prevent inappropriate devices from appearing in the jail; add an Xref. In earlier versions of this man page, the user was instructed to use sh MAKEDEV jail, which only created a minimal set of device nodes.
2003-06-26 19:04:15 +00:00
.Xr devfs 8 ,
- As jail(8) has been almost completely rewritten, prepend another copyright/ BSD-style license, as an add-on to phk's beerware license. Please fedex some beer to phk. - Add a ``make depend'' line to the jail-building, which fixes openssl, among other things. Suggested by: kris - Add ``newaliases'' to the list of things to do when setting up a new jail, so that the jailed sendmail doesn't complain. - Correct references to ``kern.jail.set_hostname_allowed'' which now read ``jail.set_hostname_allowed''. - Add a reference to sysctl.conf where the sysctl can easily be set in a persistent way. - Add a list of cross references to the man page. - Fix a formatting nit or two.
2000-02-20 02:51:11 +00:00
.Xr halt 8 ,
mdoc: sort SEE ALSO.
2014-12-26 21:56:23 +00:00
.Xr ifconfig 8 ,
- As jail(8) has been almost completely rewritten, prepend another copyright/ BSD-style license, as an add-on to phk's beerware license. Please fedex some beer to phk. - Add a ``make depend'' line to the jail-building, which fixes openssl, among other things. Suggested by: kris - Add ``newaliases'' to the list of things to do when setting up a new jail, so that the jailed sendmail doesn't complain. - Correct references to ``kern.jail.set_hostname_allowed'' which now read ``jail.set_hostname_allowed''. - Add a reference to sysctl.conf where the sysctl can easily be set in a persistent way. - Add a list of cross references to the man page. - Fix a formatting nit or two.
2000-02-20 02:51:11 +00:00
.Xr inetd 8 ,
o Add jls(8) for listing active jails. o Add jexec(8) to execute a command in an existing jail. o Add -j option for killall(1) to kill all processes in a specified jail. o Add -i option to jail(8) to output jail ID of newly created jail.
2003-04-09 03:04:12 +00:00
.Xr jexec 8 ,
.Xr jls 8 ,
Change mount_devfs reference to "mount -t devfs". Reminded by: ru
2006-11-21 23:45:44 +00:00
.Xr mount 8 ,
- As jail(8) has been almost completely rewritten, prepend another copyright/ BSD-style license, as an add-on to phk's beerware license. Please fedex some beer to phk. - Add a ``make depend'' line to the jail-building, which fixes openssl, among other things. Suggested by: kris - Add ``newaliases'' to the list of things to do when setting up a new jail, so that the jailed sendmail doesn't complain. - Correct references to ``kern.jail.set_hostname_allowed'' which now read ``jail.set_hostname_allowed''. - Add a reference to sysctl.conf where the sysctl can easily be set in a persistent way. - Add a list of cross references to the man page. - Fix a formatting nit or two.
2000-02-20 02:51:11 +00:00
.Xr named 8 ,
.Xr reboot 8 ,
mdoc(7) police: sort xrefs.
2001-07-05 08:13:03 +00:00
.Xr rpcbind 8 ,
- As jail(8) has been almost completely rewritten, prepend another copyright/ BSD-style license, as an add-on to phk's beerware license. Please fedex some beer to phk. - Add a ``make depend'' line to the jail-building, which fixes openssl, among other things. Suggested by: kris - Add ``newaliases'' to the list of things to do when setting up a new jail, so that the jailed sendmail doesn't complain. - Correct references to ``kern.jail.set_hostname_allowed'' which now read ``jail.set_hostname_allowed''. - Add a reference to sysctl.conf where the sysctl can easily be set in a persistent way. - Add a list of cross references to the man page. - Fix a formatting nit or two.
2000-02-20 02:51:11 +00:00
.Xr sendmail 8 ,
.Xr shutdown 8 ,
.Xr sysctl 8 ,
o Sort .Xr.
2009-01-12 07:45:03 +00:00
.Xr syslogd 8 ,
s,unmount 8,umount 8, it is unmount(2) which I did not mean. Submitted by: pluknet@gmail.com MFC after: 1 week
2009-01-17 14:52:26 +00:00
.Xr umount 8
This Implements the mumbled about "Jail" feature. This is a seriously beefed up chroot kind of thing. The process is jailed along the same lines as a chroot does it, but with additional tough restrictions imposed on what the superuser can do. For all I know, it is safe to hand over the root bit inside a prison to the customer living in that prison, this is what it was developed for in fact: "real virtual servers". Each prison has an ip number associated with it, which all IP communications will be coerced to use and each prison has its own hostname. Needless to say, you need more RAM this way, but the advantage is that each customer can run their own particular version of apache and not stomp on the toes of their neighbors. It generally does what one would expect, but setting up a jail still takes a little knowledge. A few notes: I have no scripts for setting up a jail, don't ask me for them. The IP number should be an alias on one of the interfaces. mount a /proc in each jail, it will make ps more useable. /proc/<pid>/status tells the hostname of the prison for jailed processes. Quotas are only sensible if you have a mountpoint per prison. There are no privisions for stopping resource-hogging. Some "#ifdef INET" and similar may be missing (send patches!) If somebody wants to take it from here and develop it into more of a "virtual machine" they should be most welcome! Tools, comments, patches & documentation most welcome. Have fun... Sponsored by: http://www.rndassociates.com/ Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
.Sh HISTORY
The
This is not jail(2), or anything else suitable to be referenced with .Fn.
2001-08-27 12:15:44 +00:00
.Nm
The .Nm utility
2002-07-14 14:47:15 +00:00
utility appeared in
This Implements the mumbled about "Jail" feature. This is a seriously beefed up chroot kind of thing. The process is jailed along the same lines as a chroot does it, but with additional tough restrictions imposed on what the superuser can do. For all I know, it is safe to hand over the root bit inside a prison to the customer living in that prison, this is what it was developed for in fact: "real virtual servers". Each prison has an ip number associated with it, which all IP communications will be coerced to use and each prison has its own hostname. Needless to say, you need more RAM this way, but the advantage is that each customer can run their own particular version of apache and not stomp on the toes of their neighbors. It generally does what one would expect, but setting up a jail still takes a little knowledge. A few notes: I have no scripts for setting up a jail, don't ask me for them. The IP number should be an alias on one of the interfaces. mount a /proc in each jail, it will make ps more useable. /proc/<pid>/status tells the hostname of the prison for jailed processes. Quotas are only sensible if you have a mountpoint per prison. There are no privisions for stopping resource-hogging. Some "#ifdef INET" and similar may be missing (send patches!) If somebody wants to take it from here and develop it into more of a "virtual machine" they should be most welcome! Tools, comments, patches & documentation most welcome. Have fun... Sponsored by: http://www.rndassociates.com/ Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
.Fx 4.0 .
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
Hierarchical/extensible jails were introduced in
.Fx 8.0 .
A new jail(8) with a configuration file, ultimately to replace the work currently done by /etc/rc.d/jail. MFC after: 3 months
2012-04-26 17:36:05 +00:00
The configuration file was introduced in
Note that the new jail(8) will be appearing in 9.1.
2012-05-23 15:30:13 +00:00
.Fx 9.1 .
Properly manify this manpage.
1999-12-21 11:25:10 +00:00
.Sh AUTHORS
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.An -nosplit
Some minor mdoc style and spelling fixes.
2000-03-24 02:05:54 +00:00
The jail feature was written by
.An Poul-Henning Kamp
for R&D Associates
Use Fx macro wherever possible.
2000-11-14 11:20:58 +00:00
who contributed it to
.Fx .
- As jail(8) has been almost completely rewritten, prepend another copyright/ BSD-style license, as an add-on to phk's beerware license. Please fedex some beer to phk. - Add a ``make depend'' line to the jail-building, which fixes openssl, among other things. Suggested by: kris - Add ``newaliases'' to the list of things to do when setting up a new jail, so that the jailed sendmail doesn't complain. - Correct references to ``kern.jail.set_hostname_allowed'' which now read ``jail.set_hostname_allowed''. - Add a reference to sysctl.conf where the sysctl can easily be set in a persistent way. - Add a list of cross references to the man page. - Fix a formatting nit or two.
2000-02-20 02:51:11 +00:00
.Pp
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
.An Robert Watson
wrote the extended documentation, found a few bugs, added
Modified jail.8 to correct a typo (inetd_flas vs. inetd_flags), and add a comment to the effect that I'm responsible for the additional documentation, et al, so that phk gets fewer messages about my errors.
2000-02-16 23:50:43 +00:00
a few new features, and cleaned up the userland jail environment.
MFp4: Bring in updated jail support from bz_jail branch. This enhances the current jail implementation to permit multiple addresses per jail. In addtion to IPv4, IPv6 is supported as well. Due to updated checks it is even possible to have jails without an IP address at all, which basically gives one a chroot with restricted process view, no networking,.. SCTP support was updated and supports IPv6 in jails as well. Cpuset support permits jails to be bound to specific processor sets after creation. Jails can have an unrestricted (no duplicate protection, etc.) name in addition to the hostname. The jail name cannot be changed from within a jail and is considered to be used for management purposes or as audit-token in the future. DDB 'show jails' command was added to aid debugging. Proper compat support permits 32bit jail binaries to be used on 64bit systems to manage jails. Also backward compatibility was preserved where possible: for jail v1 syscalls, as well as with user space management utilities. Both jail as well as prison version were updated for the new features. A gap was intentionally left as the intermediate versions had been used by various patches floating around the last years. Bump __FreeBSD_version for the afore mentioned and in kernel changes. Special thanks to: - Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches and Olivier Houchard (cognet) for initial single-IPv6 patches. - Jeff Roberson (jeff) and Randall Stewart (rrs) for their help, ideas and review on cpuset and SCTP support. - Robert Watson (rwatson) for lots and lots of help, discussions, suggestions and review of most of the patch at various stages. - John Baldwin (jhb) for his help. - Simon L. Nielsen (simon) as early adopter testing changes on cluster machines as well as all the testers and people who provided feedback the last months on freebsd-jail and other channels. - My employer, CK Software GmbH, for the support so I could work on this. Reviewed by: (see above) MFC after: 3 months (this is just so that I get the mail) X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
.Pp
.An Bjoern A. Zeeb
added multi-IP jail support for IPv4 and IPv6 based on a patch
originally done by
.An Pawel Jakub Dawidek
for IPv4.
Add support for the arbitrary named jail parameters used by jail_set(2) and jail_get(2). Jail(8) can now create jails using a "name=value" format instead of just specifying a limited set of fixed parameters; it can also modify parameters of existing jails. Jls(8) can display all parameters of jails, or a specified set of parameters. The available parameters are gathered from the kernel, and not hard-coded into these programs. Small patches on killall(1) and jexec(8) to support jail names with jail_get(2). Approved by: bz (mentor)
2009-05-27 14:30:26 +00:00
.Pp
.An James Gritton
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
added the extensible jail parameters, hierarchical jails,
and the configuration file.
Fix up a few documentation nits in jail(8), as well as improve the instructions so as to reduce warnings during jail startup, etc. Add a somewhat bolder warning recommending the use of kern.jail.set_hostname to limit jail renamining.
2000-02-18 19:02:22 +00:00
.Sh BUGS
Initial work on the new jail(8). There are more features to add, and some cleaning up to do on existing features, but this is pretty much what the final product will look like.
2010-10-20 20:42:33 +00:00
It might be a good idea to add an
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
address alias flag such that daemons listening on all IPs
.Pq Dv INADDR_ANY
Fix up a few documentation nits in jail(8), as well as improve the instructions so as to reduce warnings during jail startup, etc. Add a somewhat bolder warning recommending the use of kern.jail.set_hostname to limit jail renamining.
2000-02-18 19:02:22 +00:00
will not bind on that address, which would facilitate building a safe
host environment such that host daemons do not impose on services offered
mdoc(7) police overhaul.
2001-12-14 10:18:15 +00:00
from within jails.
Typos and nits.
2004-05-20 06:37:44 +00:00
Currently, the simplest answer is to minimize services
Some minor mdoc style and spelling fixes.
2000-03-24 02:05:54 +00:00
offered on the host, possibly limiting it to services offered from
.Xr inetd 8
Fix up a few documentation nits in jail(8), as well as improve the instructions so as to reduce warnings during jail startup, etc. Add a somewhat bolder warning recommending the use of kern.jail.set_hostname to limit jail renamining.
2000-02-18 19:02:22 +00:00
which is easily configurable.
Document the potential for jail escape. Submitted by: Vedad KAJTAZ (vedad % kajtaz net) PR: 142341 Reviewed by: bz, rwatson Rewording by: rwatson Approved by: re (kensmith) MFC after: 3 days
2011-07-24 03:34:38 +00:00
.Sh NOTES
Great care should be taken when managing directories visible within the jail.
For example, if a jailed process has its current working directory set to a
directory that is moved out of the jail's chroot, then the process may gain
access to the file space outside of the jail.
It is recommended that directories always be copied, rather than moved, out
of a jail.
Warn about filesystem-based attacks.
2012-09-16 15:22:15 +00:00
.Pp
In addition, there are several ways in which an unprivileged user
outside the jail can cooperate with a privileged user inside the jail
and thereby obtain elevated privileges in the host environment.
Most of these attacks can be mitigated by ensuring that the jail root
is not accessible to unprivileged users in the host environment.
Regardless, as a general rule, untrusted users with privileged access
to a jail should not be given access to the host environment.
Reference in New Issue Copy Permalink