Questions tagged [jail]

"The FreeBSD jail mechanism is an implementation of operating system-level virtualization that allows administrators to partition a FreeBSD-based computer system into several independent mini-systems called jails." source: Wikipedia

A jail is characterized by four elements:

  • A directory subtree -- the starting point from which a jail is entered. Once inside the jail, a process is not permitted to escape outside of this subtree. Traditional security issues which plagued the original chroot(2) design will not affect FreeBSD jails.

  • A hostname -- the hostname which will be used within the jail. Jails are mainly used for hosting network services, therefore having a descriptive hostname for each jail can really help the system administrator.

  • An IP address -- this will be assigned to the jail and cannot be changed in any way during the jail's life span. The IP address of a jail is usually an alias address for an existing network interface, but this is not strictly necessary.

  • A command -- the path name of an executable to run inside the jail. This is relative to the root directory of the jail environment, and may vary a lot, depending on the type of the specific jail environment.

source: https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/jails.html#jails-synopsis

Links

75 questions
16
votes
1 answer

What's the difference between a Linux chroot jail and a FreeBSD jail?

What's the difference between a Linux chroot jail and a FreeBSD jail? Are they synonyms in modern systems? Is one more secure than the other? Is one more flexible?
Nektarios
  • 9,551
  • 7
  • 57
  • 91
12
votes
2 answers

Python: Securing untrusted scripts/subprocess with chroot and chjail?

I'm writing a web server based on Python which should be able to execute "plugins" so that functionality can be easily extended. For this I considered the approach to have a number of folders (one for each plugin) and a number of shell/python…
BastiBen
  • 18,671
  • 10
  • 51
  • 82
9
votes
5 answers

FreeBSD: jail can not set security.jail.sysvipc_allowed

There is a problem when I init a PostgreSQL database in a FreeBSD jail. I found an article about the problem. I tried its advice but I didn't have any luck and I don't know why. There is the link: PostgreSQL in jail . I also read the PostgreSQL…
randomness2077
  • 1,042
  • 2
  • 13
  • 20
7
votes
3 answers

Running arbitrary unfriendly Python code on my server

I'm making a game where users can write Python programs to control robots that fight each other. Every turn (in a thousand-turn game) their script will be run on my server to determine the robot's next move. How can I prevent these users from being…
user2058002
6
votes
2 answers

PHP jailing arbitrary code

We have a Java IRC application where users are allowed to execute arbitrary PHP and get the result. Here is one example of what this is used for: btc: $btc = json_decode(file_get_contents('https://btc-e.com/api/2/1/ticker'), true); $ticker =…
Riking
  • 2,149
  • 19
  • 33
5
votes
6 answers

How to jail linux user

Is there something similar to chroot, but for users? We are about to grant access to our servers for a client and would like them to see only the directories we allow.
Andrei Serdeliuc ॐ
  • 5,590
  • 5
  • 37
  • 64
4
votes
2 answers

Securing git server

I setup a git server over ssh as http://blog.commonthread.com/post/1034988660/setting-up-a-git-server However, I am still able to access the server by ssh and see all the folders on the server. How do you usually secure the server so that the git…
jimiyash
  • 2,444
  • 2
  • 20
  • 28
4
votes
1 answer

What is needed to run a Haskell program in a jailed environment

I want to run a simple Haskell program from a jailed environment that I construct myself. The following Haskell program I want to run: import System.IO main = do hPutStrLn stderr "test standard error!" hPutStrLn stdout "test standard…
AIJim
  • 73
  • 3
4
votes
1 answer

Configuring devices in chroot-environment OpenBSD

I have been scratching my head for a while now and cannot find a way to make it work... I want to run some cgi scripts (written in Python) on my OpenBSD server. Since the web-server on OpenBSD runs in a jail I recreated the whole folder structure…
TDrabas
  • 691
  • 4
  • 12
3
votes
2 answers

Host-only networking for FreeBSD jails

I have inherited an environment with multiple FreeBSD6.1 machines running jails. Due to IP exhaustion on the local network, I want to change the jails so that there is 1 routable IP on the physical network, and another non-routable virtual network…
BSD Bertie
  • 31
  • 2
3
votes
2 answers

FreeBSD jails and Sockets

I'm quite new to freeBSD switching from Linux. I read about jail, the solution sound great for Server Systems. So my idea for my webserver was to create 3 jails. One jail for mysql, one for nginx and one for php-fpm. Now the jails have to…
Johannes
  • 31
  • 1
  • 2
3
votes
0 answers

Container for threads process isolation

I want to know if is possible to customize an LXC kernel (or relation system like OpenVZ, etc) to work just for threads process, see this mention: Unlike Docker, Virtuozzo, and LXC, which operate on the process level, LVE is able to operate on…
Imylor
  • 376
  • 1
  • 9
3
votes
1 answer

Limit SSH - bash with no commands

So I have been working on this for some time. Would like to know if there is a better way or if I am on the right track. I would basically like to allow some users to login to my server via SSH and then have a squid tunnel via that SSH…
David
  • 33
  • 5
3
votes
2 answers

What is needed to create a jailed environment for Scala

I'm developer of a website where programmers can submit bots that compete against each other in a game. I'm trying to add Scala to our list of supported languages, but I'm having trouble here. The problem is that every bot runs from it's own jail…
AIJim
  • 73
  • 3
3
votes
1 answer

Fair, secure, efficient, and multi-lingual sandboxing

I'm working on developing a online-judge type system where maybe 100 or so untrusted executables will all be running simultaneously and evaluating the same input data. I'd like each executable to be limited to an equal share of CPU, memory, disk…
thinkski
  • 1,236
  • 1
  • 13
  • 23
1
2 3 4 5