Ezjail

Revision as of 01:13, 7 March 2015

Ezjail is much easier to install and configure than using the sole program jail.

Installing and updating

Install ezjail:

% cd /usr/ports/sysutils/ezjail
% make install clean

Then create the basejail, manpages, source and ports tree in the basejail:

% ezjail-admin install -msp

In order to update the base through quick binary, and ports:

% ezjail-admin update -uP

For a better understanding of the options, type:

% man ezjail
% man ezjail-admin

• Note: the -s flag has a different function when using the options install and update.

Configuring

% ifconfig wlan0 alias 192.168.1.20 netmask 0xffffff00 broadcast 192.168.1.255

To enable ezjail and its network connection, add to rc.conf:

% ifconfig_wlan0_alias0="inet 192.168.1.20 netmask 0xffffff00 broadcast 192.168.1.255"
% cloned_interfaces="${cloned_interfaces} lo1"
% ezjail_enable="YES"

% ezjail-admin create myjail 192.168.1.20
% cp /etc/resolv.conf /usr/jails/myjail/etc/

Your created jailname file in the directory /usr/local/etc/ezjail/ is where options can be set:

export jail_jailname_parameters="allow.raw_sockets=1"  # This allows network programs including ping to be used from the jail

Filesystems

Jail uses the module nullfs; it may be quickloaded or compiled into the kernel:

% kldload nullfs
% echo 'nullfs_load="YES"' >> /etc/rc.conf

options   NULLFS

Starting

% ezjail-admin start

• restart, stop, startcrypto, and stopcrypto are other options

To see your jail and log in to it type:

% ezjail-admin list
% ezjail-admin console myjail

Once inside the jail, configure your date, and network settings similarly to how its done in the root operating system.

From outside the jail, the program jexec may run a program from inside the jail:

% jexec myjail program

Archiving a jail

% ezjail-admin stop myjail
% ezjail-admin archive myjail
% ls /usr/jails/ezjail-archives/

Accessing hardware

To access /dev files from the jail, take a look at the following line in /usr/local/etc/ezjail.conf in the base-system:

ezjail_devfs_ruleset="devfsrules_jail"

Now, take a look at the base-system's file /etc/defaults/devfs.rules for context, but don't edit it. In this file, [devfsrules_jail] refers to ezjail_devfs_ruleset="devfsrules_jail" in the personalized devfs.rules file. To create custom rules, copy devfs.rules to /usr/local/etc then edit it.

Individual rules may be added after [devfsrules_jail] inside /usr/local/etc/devfs.rules.

For customizing a jail individually, take a look at the file based on your created jail /usr/local/etc/ezjail/myjail for the associated line:

export jail_qt4_devfs_ruleset="devfsrules_jail"

(accessing X display from jail not solved)

See also

• Jail Facility - mentions ezjail alternative qjail

References

• BSD Now: Everything you need to know about Jails
• FreeBSD Handbook: Managing Jails with ezjail
• filesystem documentation
• Network Administration with FreeBSD 7 (2008)