Re: rc.shutdown and jails

From: Nielsen (nielsen_at_memberwebs.com)
Date: 12/12/04

  • Next message: Julian Elischer: "Re: rc.shutdown and jails" 
    Date: Sun, 12 Dec 2004 04:35:09 +0000 (GMT)

    Julian Elischer wrote:
    > I think we should introduce an "init" process for jails..
    >
    > It would be responsible for all that the normal init is responsible for
    > except for being the default parent.. (some might argue for that too).
    > Sending it a particular signal would notify it to
    > send shutdown signals to all its compatriots in the jail etc.

    This was necessary pre 5.2. Now that's it's possible to do all of this
    from the host system (by adding a process to a jail) there's no real
    need for an init type process anymore.

    As Michal mentioned, utilities like 'jailer' or 'kjailer' used to be
    necessary, but now a few simple utilities or scripts can manage a jail
    from the host system just fine. If these utilities were found in FreeBSD
    itself, it would round out the jail side of things nicely.

    Of course I'm partial to my own 'jailutils' but others that served the
    same purpose would work just as well.

    http://memberwebs.com/nielsen/freebsd/jails/jailutils/

    The only thing I miss from this change is the inability to have per-jail
    consoles (which was possible with the 'jailer' package in 4.x), but
    that's another topic.

    Cheers,
    Nate

    _______________________________________________
    freebsd-hackers@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
    To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"

  • Next message: Julian Elischer: "Re: rc.shutdown and jails"

    Relevant Pages

    • Re: unprivileged users are able to kill certain jailed processes
      ... Furthermore they are able to send signals to these processes. ... In attempt to enforce stronger isolation between the host and the jail, you will run into other, more significant problems. ... Since the host environment is typically rooted at the "real" root, and guest environments are typically chrooted to specific subtrees, containment is enforced. ... However, file system access control isn't aware of jails, so a uid in the host environment still "owns" files that appear in the chrooted name spaces. ...
      (freebsd-current)
    • Re: unprivileged users are able to kill certain jailed processes
      ... Furthermore they are able to send signals to these processes. ... In attempt to enforce stronger isolation between the host and the jail, you will run into other, more significant problems. ... Since the host environment is typically rooted at the "real" root, and guest environments are typically chrooted to specific subtrees, containment is enforced. ... However, file system access control isn't aware of jails, so a uid in the host environment still "owns" files that appear in the chrooted name spaces. ...
      (freebsd-current)
    • Re: rc.shutdown and jails
      ... >> send shutdown signals to all its compatriots in the jail etc. ... > need for an init type process anymore. ... We could also suport it even better with a few kernel assists. ...
      (freebsd-hackers)