Idea about "skeleton jail"

From: Xin LI (delphij_at_frontfree.net)
Date: 01/31/05

  • Next message: Dmitry Morozovsky: "GVRP announces under FreeBSD" 
    To: freebsd-hackers@FreeBSD.org
Date: Mon, 31 Jan 2005 21:39:52 +0800

    Dear folks,

    The recent discussion about whether we should have the perl port to
    touch/install /usr/bin/perl. While I'm not interested in joining the
    discussion, it inspired me that we can make use of the fact that ports
    should not install things to "system" area and take advantage from it.
    Finally these ideas results me to hack up something that might be
    valuable to share with our users.

    What I am going to proposal is a concept that I call it "skeleton jail",
    or "skeljail" for short. A skel jail is something that shares most base
    system binaries/libraries with the host, through read-only mount_null's.

    I have already done some experiments. Basically we want the following
    directories to be mount_null'ed:
            /bin, /sbin, /lib, /libexec, /usr/bin, /usr/sbin, /usr/include,
            /usr/lib, /usr/libdata, /usr/libexec, /usr/sbin, /usr/share

    To get most of what we want the jail to do, to work, this includes
    ssh(1) and something else. Optionally, we may want to mount_nullfs a
    read-write /usr/ports/distfiles, a readonly /usr/ports, and something
    like /usr/game to be mounted into the skeljail.

    In order to avoid having to do something magic instead of "make
    installworld", I have a patchset against src/Makefile and
    src/Makefile.incl to make the work a bit easier. It adds a so-called
    "installskel" target that creates a skeljail that contains necessary
    directory hierarchy, and a set of /etc configuration files that will be
    useful to start the jail. The target must be used after a ``make
    buildworld''

    The two major benefits for the skeljail are:
    - Reduces the ordinary management cost because many base system files
    are shared, hence you patch only once to get all jails patched.
    - Reduces the space cost that needed for a newly created jail. It used
    to need about 110MB and with skeljail you will only need no more than
    3MB.

    Apparantly skeljail is not suitable for those who want:
    - Run different FreeBSD releases on a single box.
    - Run ports that does touch system area.

    But having it doesn't hurt the ability for you to run a full jail.

    I have some handcrafted shell scripts to implement skeljail by having
    everything automatically mounted/dismounted. However, I think it might
    be better if we can have jail_<name>_skeljail="YES" switch in our jail
    rc.d(8) startup script. Please let me know if you are interested in the
    idea and I'll post a patch for review if there's enough people that
    wants this.

    Thanks in advance!

    Cheers, 

    -- 
Xin LI <delphij delphij net>  http://www.delphij.net/

  • Next message: Dmitry Morozovsky: "GVRP announces under FreeBSD"

    Relevant Pages

    • Re: Idea about "skeleton jail"
      ... > useful to start the jail. ... > to need about 110MB and with skeljail you will only need no more than ... > - Run ports that does touch system area. ... usage and synchonize automatically jails with base system. ...
      (freebsd-hackers)
    • Re: Jails
      ... My questions are realating to a recent dev install I did with FreeBSD 5.1 ... The jail was setup on a fresh install, with no other ports or mods ... Q2, When one installs new things to the main server, how do you add them to ...
      (freebsd-questions)
    • ccache and DESTDIR for ports?
      ... I'm installing a small set of ports into lots of jails, using the DESTDIR support recently added to the ports system. ... I'd like to speed up compiles by using ccache, but as I understand it, I'll have to install ccache into each jail since the DESTDIR implementation chroot's into the jail. ...
      (freebsd-questions)
    • Re: Jail question
      ... on that machine then it would be pretty much safe, close all ports but port ... Subject: Jail question ... > I want to install the jail for a mail server. ...
      (FreeBSD-Security)
    • Re: Linux Binary Compatibility
      ... > FreeBsd jail using ports with no success. ... > Can some one please ex plane how to get Linux to run in a jail. ... Install the port from outside the jail. ...
      (freebsd-questions)