¡¡¡¡ÕâÒ»½ÚÖ÷Òª»ùÓÚ Simon L. Nielsen <simon@FreeBSD.org>
µÄ http://simon.nitro.dk/service-jails.html ÖеÄ˼·£¬ ÒÔ¼°ÓÉ Ken Tom
<locals@gmail.com>
¸üеÄÎĵµ¡£ ÕâÒ»½ÚÖÐÃèÊöÁËÈçºÎÅäÖà FreeBSD ϵͳµÄ jail(8)
¹¦ÄÜΪÆäÔö¼ÓÒ»¸ö°²È«²ã´Î¡£ Õⲿ·Ö¼Ù¶¨ÄúÔËÐÐ RELENG_6_0 »ò¸üа汾£¬
²¢Àí½â±¾ÕÂ֮ǰ²¿·ÖµÄÄÚÈÝ¡£
¡¡¡¡jail µÄÒ»¸öÖ÷ÒªÎÊÌâÊÇÈçºÎ¶ÔËüÃǽøÐÐÉý¼¶ºÍ¹ÜÀí¡£ ÓÉÓÚÿ¸ö jail ¶¼ÊÇ´ÓÍ·Áª±àµÄ£¬ ¶ÔÓÚµ¥¸ö jail ¶øÑÔÉý¼¶Ò²Ðí»¹²»ÊǸöºÜÑÏÖØµÄÎÊÌ⣬ ÒòΪÉý¼¶²»»áÌ«¹ýÂé·³£¬ ¶ø¶ÔÓÚ¶à¸ö jail ¶øÑÔ£¬ Éý¼¶²»½ö»áºÄ·Ñ´óÁ¿Ê±¼ä£¬ ²¢ÇÒÊÇÊ®·Ö·¦Î¶µÄ¹ý³Ì¡£
¾¯¸æ: Õâ¸öÅäÖùý³ÌÐèÒªÄú¶Ô FreeBSD Óн϶àµÄÅäÖúÍʹÓþÑé¡£ Èç¹ûÕâЩ¹ý³ÌÏÔµÃÌ«¹ý¸´ÔÓ£¬ ÄúÓ¦¿¼ÂÇʹÓýϼòµ¥µÄϵͳ£¬ ÀýÈç sysutils/ezjail£¬ ËüÌṩÁ˸ü¼òµ¥µÄ¹ÜÀí FreeBSD jail µÄ·½·¨¡£
¡¡¡¡»ù±¾µÄÏë·¨ÊÇ£¬ ÔÚ²»Í¬µÄ jail Öо¡¿ÉÄÜ¶àµØÒÔ°²È«µÄ·½Ê½Ê¹Óù²ÏíµÄ×ÊÔ´ ©¤©¤ ʹÓÃÖ»¶ÁµÄ mount_nullfs(8) ¹Ò½Ó£¬ Õâ»áÈÃÉý¼¶¼òµ¥Ðí¶à£¬ ´Ó¶øÊ¹ÎªÃ¿¸ö·þÎñ½¨Á¢²»Í¬µÄ jail ÕâÖÖ·½°¸±äµÃ¸ü¼Ó¿ÉÐС£ ÁíÍ⣬ ËüҲΪÔö¼Ó¡¢É¾³ýÒÔ¼°Éý¼¶ jail ÌṩÁ˸üΪ±ã½ÝµÄ·½·¨¡£
×¢Òâ: ÔÚÕâÀï·þÎñµÄ³£¼ûÀý×Ó°üÀ¨£º HTTP ·þÎñ¡¢ DNS ·þÎñ¡¢ SMTP ·þÎñµÈµÈ£¬ ÖîÈç´ËÀà¡£
¡¡¡¡Õâ½Ú½éÉܵÄÅäÖõÄÄ¿µÄ°üÀ¨£º
½¨Á¢¼òµ¥²¢Ò×ÓÚÀí½âµÄ jail ½á¹¹¡£ Ò²¾ÍÊÇ˵ ²»±Ø Ϊÿ¸ö jail Ö´ÐÐÍêÕûµÄ installworld ²Ù×÷¡£
ʹÔöɾ jail ¸üÈÝÒס£
ʹ¸üлòÉý¼¶ jail ¸üÈÝÒס£
ʹÔËÐÐ×Ô¶©µÄ FreeBSD ·ÖÖ§³ÉΪ¿ÉÄÜ¡£
¶Ô°²È«µÄ¸üƫִµÄ×·Çó£¬ ¾¡¿ÉÄܼõÉÙ±»¹¥ÏݵĿÉÄÜ¡£
¾¡¿ÉÄܽÚÊ¡¿Õ¼äºÍ inode¡£
¡¡¡¡ÈçÇ°ÃæÌáµ½µÄÄÇÑù£¬ Õâ¸öÉè¼Æ¼«´ó³Ì¶ÈÉÏÒÀÀµÓÚ½«Ò»·ÝÖ»¶ÁµÄÖ÷Ä£°å (known as nullfs) ¹Ò½Óµ½Ã¿Ò»¸ö jail ÖУ¬ ²¢ÎªÃ¿¸ö jail ÅäÖÃÒ»¸ö¿É¶ÁдµÄÉ豸¡£ ÕâÖÖÉ豸¿ÉÒÔÊÇÎïÀí´ÅÅÌ¡¢ ·ÖÇø£¬ »òÒÔ vnode Ϊºó¶ËµÄ md(4) É豸¡£ ÔÚÕâ¸öÀý×ÓÖУ¬ ÎÒÃǽ«Ê¹ÓÿɶÁдµÄ nullfs ¹Ò½Ó¡£
¡¡¡¡ÏÂÃæµÄ±íÖÐÃèÊöÁËÎļþϵͳ¸ñ¾Ö£º
ÿ¸ö jail ¹Ò½Óµ½ /home/j Ŀ¼ÏµÄÒ»¸öĿ¼¡£
/home/j/mroot ÊÇÿ¸ö jail ¹²ÓõÄÄ£°å£¬ ¶ÔÓÚËùÓÐµÄ jail ¶øÑÔ¶¼ÊÇÖ»¶ÁµÄ¡£
ÔÚ /home/j Ŀ¼ÖУ¬ ÿ¸ö jail ÓÐÒ»¸ö¶ÔÓ¦µÄ¿ÕĿ¼¡£
ÿ¸ö jail Öж¼ÓÐÒ»¸ö /s Ŀ¼£¬ Õâ¸öĿ¼½«Á¬½Óµ½ÏµÍ³ÖеĿɶÁд²¿·Ö¡£
ÿ¸ö jail Ó¦»ùÓÚ /home/j/skel ½¨Á¢Æä¿É¶Áд¿Õ¼ä¡£
ÿ¸ö jailspace (jail ÖеĿɶÁд²¿·Ö) Ó¦´´½¨µ½ /home/js¡£
×¢Òâ: Õâ¼Ù¶¨ËùÓÐµÄ jail ¶¼·ÅÖÃÓÚ /home ·ÖÇøÖС£ µ±È»£¬ Äú¿ÉÒÔ¸ù¾ÝÐèÒª½«Õâ¸öÅäÖøÄΪÐèÒªµÄÈκÎÑù×Ó£¬ µ«ÔÚ½ÓÏÂÀ´µÄÀý×ÓÖУ¬ Ò²Ó¦ÏàÓ¦µØ¼ÓÒԱ䶯¡£
¡¡¡¡ÕâÒ»½Ú½«½éÉÜ´´½¨ jail ËùÐèµÄÖ»¶ÁÖ÷Ä£°åËùÐèµÄ²½Öè¡£
¡¡¡¡
¡¡¡¡Ò»°ãÀ´Ëµ£¬ ÄúÓ¦½«ÏµÍ³Éý¼¶µ½×îÐ嵀 FreeBSD -RELEASE ·ÖÖ§£¬ ¾ßÌå×ö·¨Çë²Î¼û±¾ÊÖ²áµÄÏà¹Ø Õ½ڡ£ µ±¸üв»¿ÉÐÐʱ£¬ ÔòÐèÒªÍê³É buildworld ¹ý³Ì£¬ ÁíÍ⣬ Äú»¹ÐèÒª sysutils/cpdup Èí¼þ°ü¡£ ÎÒÃǽ«Ê¹Óà portsnap(8) ¹¤¾ßÀ´ÏÂÔØ FreeBSD Ports Ì×¼þ¡£ ÔÚʹÓÃÊÖ²áµÄ Portsnap ÕÂ½Ú ÖУ¬ ÌṩÁËÕë¶Ô³õѧÕߵĽéÉÜ¡£
Ê×ÏÈ£¬ ÐèҪΪ½«Òª´æ·ÅÖ»¶ÁµÄ FreeBSD Ö´ÐÐÎļþµÄÎļþϵͳ½¨Á¢Ò»¸öĿ¼£¬ ½Ó׎øÈë FreeBSD Ô´´úÂëµÄĿ¼£¬ ²¢ÔÚÆäÖа²×° jail Ä£°å£º
# mkdir /home/j /home/j/mroot # cd /usr/src # make installworld DESTDIR=/home/j/mroot
½Ó×Å£¬ ×¼±¸Ò»·Ý FreeBSD Ports Ì×¼þ£¬ ÒÔ¼°ÓÃÓÚÖ´ÐÐ mergemaster µÄ FreeBSD Ô´´úÂ룺
# cd /home/j/mroot # mkdir usr/ports # portsnap -p /home/j/mroot/usr/ports fetch extract # cpdup /usr/src /home/j/mroot/usr/src
´´½¨ÏµÍ³ÖпɶÁд²¿·ÖµÄ¹Ç¼Ü£º
# mkdir /home/j/skel /home/j/skel/home /home/j/skel/usr-X11R6 /home/j/skel/distfiles # mv etc /home/j/skel # mv usr/local /home/j/skel/usr-local # mv tmp /home/j/skel # mv var /home/j/skel # mv root /home/j/skel
ʹÓà mergemaster °²×°È±Ê§µÄÅäÖÃÎļþ¡£ ½ÓÏÂÀ´£¬ ɾ³ý mergemaster ´´½¨µÄ¶àÓàĿ¼£º
# mergemaster -t /home/j/skel/var/tmp/temproot -D /home/j/skel -i # cd /home/j/skel # rm -R bin boot lib libexec mnt proc rescue sbin sys usr dev
ÏÖÔÚ£¬ ½«¿É¶ÁдÎļþϵͳÁ¬½Óµ½Ö»¶ÁÎļþϵͳÖС£ ÇëÈ·±£ÄúÔÚ s/ Ŀ¼Öн¨Á¢ÁËÊʵ±µÄ·ûºÅÁ¬½Ó¡£ Èç¹ûûÓн¨Á¢Ä¿Â¼»ò½¨Á¢µÄλÖò»ÕýÈ·£¬ ¿ÉÄܻᵼÖ°²×°Ê§°Ü¡£
# cd /home/j/mroot # mkdir s # ln -s s/etc etc # ln -s s/home home # ln -s s/root root # ln -s ../s/usr-local usr/local # ln -s ../s/usr-X11R6 usr/X11R6 # ln -s ../../s/distfiles usr/ports/distfiles # ln -s s/tmp tmp # ln -s s/var var
×îºó£¬ ´´½¨Ò»¸öĬÈϵİüº¬ÏÂÁÐÅäÖÃµÄ /home/j/skel/etc/make.conf£º
WRKDIRPREFIX?= /s/portbuild
ÅäÖà WRKDIRPREFIX ʹµÃÔÚÿ¸ö jail Öзֱð±àÒë FreeBSD ³ÉΪ¿ÉÄÜ¡£ Çë×¢Òâ ports Ŀ¼ÊÇÖ»¶ÁϵͳµÄÒ»²¿·Ö¡£ ¶ø×Ô¶©µÄ WRKDIRPREFIX ÔòʹµÃÁª±à¹ý³ÌµÃÒÔÔÚ jail ÖеĿɶÁд²¿·ÖÍê³É¡£
¡¡¡¡ÏÖÔÚÎÒÃÇÒѾÓÐÁËÍêÕûµÄ FreeBSD jail Ä£°å£¬ ¿ÉÒÔÔÚ /etc/rc.conf Öа²×°²¢ÅäÖÃËüÃÇÁË¡£ Õâ¸öÀý×ÓÖÐÑÝʾÁ˽¨Á¢ 3 ¸ö jail£º ¡°NS¡±¡¢ ¡°MAIL¡± ºÍ ¡°WWW¡±¡£
¡¡¡¡
ÔÚ /etc/fstab ÎļþÖмÓÈëÏÂÁÐÅäÖ㬠ÒÔ±ãÈÃϵͳ×Ô¶¯¹Ò½Ó jail µÄÖ»¶ÁÄ£°åºÍ¶Áд¿Õ¼ä£º
/home/j/mroot /home/j/ns nullfs ro 0 0 /home/j/mroot /home/j/mail nullfs ro 0 0 /home/j/mroot /home/j/www nullfs ro 0 0 /home/js/ns /home/j/ns/s nullfs rw 0 0 /home/js/mail /home/j/mail/s nullfs rw 0 0 /home/js/www /home/j/www/s nullfs rw 0 0
ÔÚ /etc/rc.conf ÖÐÅäÖà jail£º
jail_enable="YES" jail_set_hostname_allow="NO" jail_list="ns mail www" jail_ns_hostname="ns.example.org" jail_ns_ip="192.168.3.17" jail_ns_rootdir="/usr/home/j/ns" jail_ns_devfs_enable="YES" jail_mail_hostname="mail.example.org" jail_mail_ip="192.168.3.18" jail_mail_rootdir="/usr/home/j/mail" jail_mail_devfs_enable="YES" jail_www_hostname="www.example.org" jail_www_ip="62.123.43.14" jail_www_rootdir="/usr/home/j/www" jail_www_devfs_enable="YES"
¾¯¸æ: Ó¦°Ñ
jail_name_rootdir
±äÁ¿ÉèÖÃ³É /usr/home ¶ø²»ÊÇ /home µÄÔÒòÊÇ /home Ŀ¼ÔÚĬÈϰ²×°µÄ FreeBSD ÉÏÊÇÖ¸Ïò /usr/home µÄÒ»¸ö·ûºÅÁ¬½Ó¡£ ¶øjail_name_rootdir
±äÁ¿±ØÐëÊÇÒ»¸ö ²» °üº¬·ûºÅÁ¬½ÓµÄ·¾¶£¬ ·ñÔò jail ½«¾Ü¾øÆô¶¯¡£ ¿ÉÒÔʹÓà realpath(1) ¹¤¾ßÀ´¾ö¶¨ÕâÒ»±äÁ¿Ó¦±»¸³ÓèÒ»¸öʲôÑùµÄÖµ¡£ ¸üÏêϸµÄÐÅÏ¢Çë²ÎÔݲȫ¹«¸æ FreeBSD-SA-07:01.jail
Ϊÿ¸ö jail ´´½¨ËùÐèµÄÖ»¶ÁÎļþϵͳ¹Ò½Óµã£º
# mkdir /home/j/ns /home/j/mail /home/j/www
ÔÚ jail Öа²×°¿É¶ÁдµÄÄ£°å¡£ ×¢ÒâÄúÐèҪʹÓà sysutils/cpdup£¬ ËüÄܹ»°ïÖúÄúÈ·±£Ã¿¸öĿ¼¶¼ÊÇÕýÈ·µØ¸´ÖƵģº
# mkdir /home/js # cpdup /home/j/skel /home/js/ns # cpdup /home/j/skel /home/js/mail # cpdup /home/j/skel /home/js/www
ÕâÑù£¬ ¾ÍÍê³ÉÁË jail µÄÖÆ×÷£¬ ¿ÉÒÔÔËÐÐÁË¡£ Ê×ÏÈΪ jail ¹Ò½ÓÎļþϵͳ£¬ È»ºóʹÓà /etc/rc.d/jail ½Å±¾À´Æô¶¯ËüÃÇ£º
# mount -a # /etc/rc.d/jail start
¡¡¡¡ÏÖÔÚ jail Ó¦¸Ã¾ÍÆô¶¯ÆðÀ´ÁË¡£ Òª¼ì²éËüÃÇÊÇ·ñÔËÐÐÕý³££¬ ¿ÉÒÔʹÓà jls(8) ÃüÁî¡£ ËüµÄÊä³öÓ¦¸ÃÀàËÆÕâÑù£º
# jls JID IP Address Hostname Path 3 192.168.3.17 ns.example.org /home/j/ns 2 192.168.3.18 mail.example.org /home/j/mail 1 62.123.43.14 www.example.org /home/j/www
¡¡¡¡Õâʱ£¬ ¾Í¿ÉÒÔµÇÈë jail ²¢Ôö¼ÓÓû§ºÍÅäÖ÷þÎñÁË¡£ JID Áиø³öÁËÕýÔÚÔËÐÐµÄ jail µÄ±êʶ±àºÅ¡£ Äú¿ÉÒÔʹÓÃÏÂÃæµÄÃüÁîÀ´ÔÚ JID ±àºÅΪ 3 µÄ jail ÖÐÖ´ÐйÜÀíÈÎÎñ£º
# jexec 3 tcsh
¡¡¡¡ÓÐʱ£¬ ÓÉÓÚ°²È«ÎÊÌ⣬ »òÐÂÔö¹¦ÄÜÓÐÓ㬠»áÏ£Íû½«ÏµÍ³Éý¼¶µ½Ò»¸öа汾µÄ FreeBSD¡£ ÕâÖÖ°²×°·½Ê½µÄÉè¼ÆÊ¹µÃÉý¼¶ÏÖÓÐ jail ±äµÃºÜÈÝÒס£ ÁíÍ⣬ ËüÒ²ÄÜ×î´óÏ޶ȵؼõСͣ»úʱ¼ä£¬ ÒòΪ jail Ö»ÔÚ×îºóʱ¿Ì²ÅÐèÒª¹Ø±Õ¡£ ÁíÍ⣬ ËüÒ²ÌṩÁ˼òµ¥µÄ»ØÍ˵½ÏÈǰ°æ±¾µÄ·½·¨¡£
µÚÒ»²½Êǰ´Í¨³£µÄ·½·¨Éý¼¶Ö÷»úµÄϵͳ¡£ ½Ó×Å£¬ ÔÚ /home/j/mroot2 Öн¨Á¢Ò»¸öеÄÁÙʱģ°å£º
# mkdir /home/j/mroot2 # cd /usr/src # make installworld DESTDIR=/home/j/mroot2 # cd /home/j/mroot2 # cpdup /usr/src usr/src # mkdir s
ÔÚÔËÐÐ installworld ʱ»á´´½¨Ò»Ð©²»ÐèÒªµÄĿ¼£¬ Ó¦½«ËüÃÇɾ³ý£º
# chflags -R 0 var # rm -R etc var root usr/local tmp
ÖØ½¨µ½Ö÷ϵͳÖеĿɶÁд·ûºÅÁ¬½Ó£º
# ln -s s/etc etc # ln -s s/root root # ln -s s/home home # ln -s ../s/usr-local usr/local # ln -s ../s/usr-X11R6 usr/X11R6 # ln -s s/tmp tmp # ln -s s/var var
ÏÖÔÚÊÇʱºò¹Ø±Õ jail ÁË£º
# /etc/rc.d/jail stop
жÏÂÔÏȵÄÎļþϵͳ£º
# umount /home/j/ns/s # umount /home/j/ns # umount /home/j/mail/s # umount /home/j/mail # umount /home/j/www/s # umount /home/j/www
×¢Òâ: ¿É¶ÁдµÄÎļþϵͳ (/s) »áÔÚÖ»¶Áϵͳ֮ºó¹Ò½Ó£¬ Òò´ËÓ¦Ê×ÏÈÐ¶ÔØ¡£
½«ÏÈǰµÄÖ»¶ÁÎļþϵͳŲ×ߣ¬ »»³ÉеÄϵͳ¡£ ÕâÑù×öҲͬʱ±£ÁôÁËÏÈǰϵͳµÄ±¸·Ý£¬ ´Ó¶ø¿ÉÒÔÔÚ³öÏÖÎÊÌâʱ´ÓÖлָ´¡£ ÕâÀïÎÒÃǸù¾ÝÐÂϵͳµÄ´´½¨Ê±¼äÀ´ÃüÃû¡£ ´ËÍâÎÒÃǰÑÏÈǰµÄ FreeBSD Ports Ì×¼þÖ±½ÓÒÆ¶¯µ½ÐµÄÎļþϵͳÖУ¬ ÒÔ½ÚÊ¡´ÅÅ̿ռäºÍ inode£º
# cd /home/j # mv mroot mroot.20060601 # mv mroot2 mroot # mv mroot.20060601/usr/ports mroot/usr
ÏÖÔÚеÄÖ»¶ÁÄ£°å¾Í¿ÉÒÔÓÃÁË£¬ ʣϵÄÊÂÇéÊÇÖØÐ¹ҽÓÎļþϵͳ²¢Æô¶¯ jails£º
# mount -a # /etc/rc.d/jail start
¡¡¡¡×îºóÓà jls(8) ¼ì²é jail Æô¶¯ÊÇ·ñÕý³£¡£ ²»ÒªÍü¼ÇÔÚ jail ÖÐÔËÐÐ mergemaster¡£ ÅäÖÃÎļþºÍ rc.d ½Å±¾ÔÚÉý¼¶Ê±Ó¦½øÐиüС£
±¾ÎĵµºÍÆäËüÎĵµ¿É´ÓÕâÀïÏÂÔØ£ºftp://ftp.FreeBSD.org/pub/FreeBSD/doc/.
Èç¹û¶ÔÓÚFreeBSDÓÐÎÊÌ⣬ÇëÏÈÔĶÁÎĵµ£¬Èç²»Äܽâ¾öÔÙÁªÏµ<questions@FreeBSD.org>.
¹ØÓÚ±¾ÎĵµµÄÎÊÌâÇë·¢ÐÅÁªÏµ <doc@FreeBSD.org>.