FreeBSD Jails

BSD Forums writes "A common security breach involves exploiting one application to gain access to another. Keeping separate applications separate can limit the potential damage. OnLamp's Mike DeGraw-Bertsch explains how FreeBSD's jails can help secure necessary applications."

Comments

Jails addons

[rf0]

For some fun jail patches have a look at garage.freebsd.pl

Rus

Re:sandbox

[ctr2sprt]

No, not really. The problem with all these fine-grained access controls is that they are painfully difficult to use. Unix admins get worked up about the complexity introduced by simple POSIX filesystem ACLs, how do you think they'll be able to tolerate having per-process syscall control? It would just never get used. Incidentally, they are patches which allow exactly the functionality you describe. And nobody uses them except for people with a really exceptional need for security.

Jails have other uses too, by the way. Website hosting is one such example. You can set up jails for each person using the machine, and then he gets his own root login. He can modify Apache config files himself and do any other configuration stuff, but he can't break out of the jail to interfere with other users. There are actually providers out there that do this, though I don't know any of them by name.

My jailadmin stuff...

[Just Some Guy]

I wrote (in Perl) a set of jail management scripts. They're available at SubWiki:Freebsd/JailAdmin.

The main feature is a configuration that lets you act on jails by name. For instance:

jailadmin start web3 news7 shell1 shell2

will start those jails, and

jailadmin stop shell4

will stop that instance. Basically, I wanted to make a system that was convenient for people with large numbers of jails on one machine, but easy enough for everyone.

Included are an rc.d script for starting/stopping a set of jails at boot/shutdown, and an snmpd plugin for remote monitoring.