15.6 Jail µÄÓ¦ÓÃ

15.6.1 ·þÎñ Jail

Ô­×÷ Daniel Gerzo.

¡¡¡¡ÕâÒ»½ÚÖ÷Òª»ùÓÚ Simon L. Nielsen µÄ http://simon.nitro.dk/service-jails.html ÖеÄ˼·£¬ ÒÔ¼°ÓÉ Ken Tom ¸üеÄÎĵµ¡£ ÕâÒ»½ÚÖÐÃèÊöÁËÈçºÎÅäÖà FreeBSD ϵͳµÄ jail(8) ¹¦ÄÜΪÆäÔö¼ÓÒ»¸ö°²È«²ã´Î¡£ Õⲿ·Ö¼Ù¶¨ÄúÔËÐÐ RELENG_6_0 »ò¸üа汾£¬ ²¢Àí½â±¾ÕÂ֮ǰ²¿·ÖµÄÄÚÈÝ¡£

15.6.1.1 Éè¼Æ

¡¡¡¡jail µÄÒ»¸öÖ÷ÒªÎÊÌâÊÇÈçºÎ¶ÔËüÃǽøÐÐÉý¼¶ºÍ¹ÜÀí¡£ ÓÉÓÚÿ¸ö jail ¶¼ÊÇ´ÓÍ·Áª±àµÄ£¬ ¶ÔÓÚµ¥¸ö jail ¶øÑÔÉý¼¶Ò²Ðí»¹²»ÊǸöºÜÑÏÖØµÄÎÊÌ⣬ ÒòΪÉý¼¶²»»áÌ«¹ýÂé·³£¬ ¶ø¶ÔÓÚ¶à¸ö jail ¶øÑÔ£¬ Éý¼¶²»½ö»áºÄ·Ñ´óÁ¿Ê±¼ä£¬ ²¢ÇÒÊÇÊ®·Ö·¦Î¶µÄ¹ý³Ì¡£

¾¯¸æ: Õâ¸öÅäÖùý³ÌÐèÒªÄú¶Ô FreeBSD Óн϶àµÄÅäÖúÍʹÓþ­Ñé¡£ Èç¹ûÕâЩ¹ý³ÌÏÔµÃÌ«¹ý¸´ÔÓ£¬ ÄúÓ¦¿¼ÂÇʹÓýϼòµ¥µÄϵͳ£¬ ÀýÈç sysutils/ezjail£¬ ËüÌṩÁ˸ü¼òµ¥µÄ¹ÜÀí FreeBSD jail µÄ·½·¨¡£

¡¡¡¡»ù±¾µÄÏë·¨ÊÇ£¬ ÔÚ²»Í¬µÄ jail Öо¡¿ÉÄÜ¶àµØÒÔ°²È«µÄ·½Ê½Ê¹Óù²ÏíµÄ×ÊÔ´ ©¤©¤ ʹÓÃÖ»¶ÁµÄ mount_nullfs(8) ¹Ò½Ó£¬ Õâ»áÈÃÉý¼¶¼òµ¥Ðí¶à£¬ ´Ó¶øÊ¹ÎªÃ¿¸ö·þÎñ½¨Á¢²»Í¬µÄ jail ÕâÖÖ·½°¸±äµÃ¸ü¼Ó¿ÉÐС£ ÁíÍ⣬ ËüҲΪÔö¼Ó¡¢É¾³ýÒÔ¼°Éý¼¶ jail ÌṩÁ˸üΪ±ã½ÝµÄ·½·¨¡£

×¢Òâ: ÔÚÕâÀï·þÎñµÄ³£¼ûÀý×Ó°üÀ¨£º HTTP ·þÎñ¡¢ DNS ·þÎñ¡¢ SMTP ·þÎñµÈµÈ£¬ ÖîÈç´ËÀà¡£

¡¡¡¡Õâ½Ú½éÉܵÄÅäÖõÄÄ¿µÄ°üÀ¨£º

  • ½¨Á¢¼òµ¥²¢Ò×ÓÚÀí½âµÄ jail ½á¹¹¡£ Ò²¾ÍÊÇ˵ ²»±Ø Ϊÿ¸ö jail Ö´ÐÐÍêÕûµÄ installworld ²Ù×÷¡£

  • ʹÔöɾ jail ¸üÈÝÒס£

  • ʹ¸üлòÉý¼¶ jail ¸üÈÝÒס£

  • ʹÔËÐÐ×Ô¶©µÄ FreeBSD ·ÖÖ§³ÉΪ¿ÉÄÜ¡£

  • ¶Ô°²È«µÄ¸üƫִµÄ×·Çó£¬ ¾¡¿ÉÄܼõÉÙ±»¹¥ÏݵĿÉÄÜ¡£

  • ¾¡¿ÉÄܽÚÊ¡¿Õ¼äºÍ inode¡£

¡¡¡¡ÈçÇ°ÃæÌáµ½µÄÄÇÑù£¬ Õâ¸öÉè¼Æ¼«´ó³Ì¶ÈÉÏÒÀÀµÓÚ½«Ò»·ÝÖ»¶ÁµÄÖ÷Ä£°å (known as nullfs) ¹Ò½Óµ½Ã¿Ò»¸ö jail ÖУ¬ ²¢ÎªÃ¿¸ö jail ÅäÖÃÒ»¸ö¿É¶ÁдµÄÉ豸¡£ ÕâÖÖÉ豸¿ÉÒÔÊÇÎïÀí´ÅÅÌ¡¢ ·ÖÇø£¬ »òÒÔ vnode Ϊºó¶ËµÄ md(4) É豸¡£ ÔÚÕâ¸öÀý×ÓÖУ¬ ÎÒÃǽ«Ê¹ÓÿɶÁдµÄ nullfs ¹Ò½Ó¡£

¡¡¡¡ÏÂÃæµÄ±íÖÐÃèÊöÁËÎļþϵͳ¸ñ¾Ö£º

  • ÿ¸ö jail ¹Ò½Óµ½ /home/j Ŀ¼ÏµÄÒ»¸öĿ¼¡£

  • /home/j/mroot ÊÇÿ¸ö jail ¹²ÓõÄÄ£°å£¬ ¶ÔÓÚËùÓÐµÄ jail ¶øÑÔ¶¼ÊÇÖ»¶ÁµÄ¡£

  • ÔÚ /home/j Ŀ¼ÖУ¬ ÿ¸ö jail ÓÐÒ»¸ö¶ÔÓ¦µÄ¿ÕĿ¼¡£

  • ÿ¸ö jail Öж¼ÓÐÒ»¸ö /s Ŀ¼£¬ Õâ¸öĿ¼½«Á¬½Óµ½ÏµÍ³ÖеĿɶÁд²¿·Ö¡£

  • ÿ¸ö jail Ó¦»ùÓÚ /home/j/skel ½¨Á¢Æä¿É¶Áд¿Õ¼ä¡£

  • ÿ¸ö jailspace (jail ÖеĿɶÁд²¿·Ö) Ó¦´´½¨µ½ /home/js¡£

×¢Òâ: Õâ¼Ù¶¨ËùÓÐµÄ jail ¶¼·ÅÖÃÓÚ /home ·ÖÇøÖС£ µ±È»£¬ Äú¿ÉÒÔ¸ù¾ÝÐèÒª½«Õâ¸öÅäÖøÄΪÐèÒªµÄÈκÎÑù×Ó£¬ µ«ÔÚ½ÓÏÂÀ´µÄÀý×ÓÖУ¬ Ò²Ó¦ÏàÓ¦µØ¼ÓÒԱ䶯¡£

15.6.1.2 ½¨Á¢Ä£°å

¡¡¡¡ÕâÒ»½Ú½«½éÉÜ´´½¨ jail ËùÐèµÄÖ»¶ÁÖ÷Ä£°åËùÐèµÄ²½Öè¡£

¡¡¡¡

¡¡¡¡Ò»°ãÀ´Ëµ£¬ ÄúÓ¦½«ÏµÍ³Éý¼¶µ½×îÐ嵀 FreeBSD -RELEASE ·ÖÖ§£¬ ¾ßÌå×ö·¨Çë²Î¼û±¾ÊÖ²áµÄÏà¹Ø Õ½ڡ£ µ±¸üв»¿ÉÐÐʱ£¬ ÔòÐèÒªÍê³É buildworld ¹ý³Ì£¬ ÁíÍ⣬ Äú»¹ÐèÒª sysutils/cpdup Èí¼þ°ü¡£ ÎÒÃǽ«Ê¹Óà portsnap(8) ¹¤¾ßÀ´ÏÂÔØ FreeBSD Ports Ì×¼þ¡£ ÔÚʹÓÃÊÖ²áµÄ Portsnap ÕÂ½Ú ÖУ¬ ÌṩÁËÕë¶Ô³õѧÕߵĽéÉÜ¡£

  1. Ê×ÏÈ£¬ ÐèҪΪ½«Òª´æ·ÅÖ»¶ÁµÄ FreeBSD Ö´ÐÐÎļþµÄÎļþϵͳ½¨Á¢Ò»¸öĿ¼£¬ ½Ó׎øÈë FreeBSD Ô´´úÂëµÄĿ¼£¬ ²¢ÔÚÆäÖа²×° jail Ä£°å£º

    # mkdir /home/j /home/j/mroot
    # cd /usr/src
    # make installworld DESTDIR=/home/j/mroot
    
  2. ½Ó×Å£¬ ×¼±¸Ò»·Ý FreeBSD Ports Ì×¼þ£¬ ÒÔ¼°ÓÃÓÚÖ´ÐÐ mergemaster µÄ FreeBSD Ô´´úÂ룺

    # cd /home/j/mroot
    # mkdir usr/ports
    # portsnap -p /home/j/mroot/usr/ports fetch extract
    # cpdup /usr/src /home/j/mroot/usr/src
    
  3. ´´½¨ÏµÍ³ÖпɶÁд²¿·ÖµÄ¹Ç¼Ü£º

    # mkdir /home/j/skel /home/j/skel/home /home/j/skel/usr-X11R6 /home/j/skel/distfiles
    # mv etc /home/j/skel
    # mv usr/local /home/j/skel/usr-local
    # mv tmp /home/j/skel
    # mv var /home/j/skel
    # mv root /home/j/skel
    
  4. ʹÓà mergemaster °²×°È±Ê§µÄÅäÖÃÎļþ¡£ ½ÓÏÂÀ´£¬ ɾ³ý mergemaster ´´½¨µÄ¶àÓàĿ¼£º

    # mergemaster -t /home/j/skel/var/tmp/temproot -D /home/j/skel -i
    # cd /home/j/skel
    # rm -R bin boot lib libexec mnt proc rescue sbin sys usr dev
    
  5. ÏÖÔÚ£¬ ½«¿É¶ÁдÎļþϵͳÁ¬½Óµ½Ö»¶ÁÎļþϵͳÖС£ ÇëÈ·±£ÄúÔÚ s/ Ŀ¼Öн¨Á¢ÁËÊʵ±µÄ·ûºÅÁ¬½Ó¡£ Èç¹ûûÓн¨Á¢Ä¿Â¼»ò½¨Á¢µÄλÖò»ÕýÈ·£¬ ¿ÉÄܻᵼÖ°²×°Ê§°Ü¡£

    # cd /home/j/mroot
    # mkdir s
    # ln -s s/etc etc
    # ln -s s/home home
    # ln -s s/root root
    # ln -s ../s/usr-local usr/local
    # ln -s ../s/usr-X11R6 usr/X11R6
    # ln -s ../../s/distfiles usr/ports/distfiles
    # ln -s s/tmp tmp
    # ln -s s/var var
    
  6. ×îºó£¬ ´´½¨Ò»¸öĬÈϵİüº¬ÏÂÁÐÅäÖÃµÄ /home/j/skel/etc/make.conf£º

    WRKDIRPREFIX?=  /s/portbuild
    

    ÅäÖà WRKDIRPREFIX ʹµÃÔÚÿ¸ö jail Öзֱð±àÒë FreeBSD ³ÉΪ¿ÉÄÜ¡£ Çë×¢Òâ ports Ŀ¼ÊÇÖ»¶ÁϵͳµÄÒ»²¿·Ö¡£ ¶ø×Ô¶©µÄ WRKDIRPREFIX ÔòʹµÃÁª±à¹ý³ÌµÃÒÔÔÚ jail ÖеĿɶÁд²¿·ÖÍê³É¡£

15.6.1.3 ½¨Á¢ Jail

¡¡¡¡ÏÖÔÚÎÒÃÇÒѾ­ÓÐÁËÍêÕûµÄ FreeBSD jail Ä£°å£¬ ¿ÉÒÔÔÚ /etc/rc.conf Öа²×°²¢ÅäÖÃËüÃÇÁË¡£ Õâ¸öÀý×ÓÖÐÑÝʾÁ˽¨Á¢ 3 ¸ö jail£º ¡°NS¡±¡¢ ¡°MAIL¡± ºÍ ¡°WWW¡±¡£

¡¡¡¡

  1. ÔÚ /etc/fstab ÎļþÖмÓÈëÏÂÁÐÅäÖ㬠ÒÔ±ãÈÃϵͳ×Ô¶¯¹Ò½Ó jail µÄÖ»¶ÁÄ£°åºÍ¶Áд¿Õ¼ä£º

    /home/j/mroot   /home/j/ns     nullfs  ro  0   0
    /home/j/mroot   /home/j/mail   nullfs  ro  0   0
    /home/j/mroot   /home/j/www    nullfs  ro  0   0
    /home/js/ns     /home/j/ns/s   nullfs  rw  0   0
    /home/js/mail   /home/j/mail/s nullfs  rw  0   0
    /home/js/www    /home/j/www/s  nullfs  rw  0   0
    

    ×¢Òâ: ɨÃèÅú´ÎºÅ (pass number) Ϊ 0 µÄ·ÖÇø²»»áÔÚÆô¶¯Ê±Ê¹Óà fsck(8) ½øÐмì²é£¬ ¶ø×ª´æÅú´ÎºÅ (dump number) Ϊ 0 µÄ·ÖÇøÔò²»»áÔÚ dump(8) ʱ±¸·Ý¡£ ÎÒÃDz»Ï£Íû fsck ¼ì²é nullfs ¹Ò½Ó£¬ »òÈà dump ±¸·Ý jail ÖеÄÖ»¶Á nullfs ¹Ò½Ó¡£ Õâ¾ÍÊÇΪʲôÔÚÿ¸ö fstab ÌõÄ¿µÄ×îºóÁ½ÁÐÊÇ ¡°0 0¡± µÄÔ­Òò¡£

  2. ÔÚ /etc/rc.conf ÖÐÅäÖà jail£º

    jail_enable="YES"
    jail_set_hostname_allow="NO"
    jail_list="ns mail www"
    jail_ns_hostname="ns.example.org"
    jail_ns_ip="192.168.3.17"
    jail_ns_rootdir="/usr/home/j/ns"
    jail_ns_devfs_enable="YES"
    jail_mail_hostname="mail.example.org"
    jail_mail_ip="192.168.3.18"
    jail_mail_rootdir="/usr/home/j/mail"
    jail_mail_devfs_enable="YES"
    jail_www_hostname="www.example.org"
    jail_www_ip="62.123.43.14"
    jail_www_rootdir="/usr/home/j/www"
    jail_www_devfs_enable="YES"
    

    ¾¯¸æ: Ó¦°Ñ jail_name_rootdir ±äÁ¿ÉèÖÃ³É /usr/home ¶ø²»ÊÇ /home µÄÔ­ÒòÊÇ /home Ŀ¼ÔÚĬÈϰ²×°µÄ FreeBSD ÉÏÊÇÖ¸Ïò /usr/home µÄÒ»¸ö·ûºÅÁ¬½Ó¡£ ¶ø jail_name_rootdir ±äÁ¿±ØÐëÊÇÒ»¸ö ²» °üº¬·ûºÅÁ¬½ÓµÄ·¾¶£¬ ·ñÔò jail ½«¾Ü¾øÆô¶¯¡£ ¿ÉÒÔʹÓà realpath(1) ¹¤¾ßÀ´¾ö¶¨ÕâÒ»±äÁ¿Ó¦±»¸³ÓèÒ»¸öʲôÑùµÄÖµ¡£ ¸üÏêϸµÄÐÅÏ¢Çë²ÎÔݲȫ¹«¸æ FreeBSD-SA-07:01.jail

  3. Ϊÿ¸ö jail ´´½¨ËùÐèµÄÖ»¶ÁÎļþϵͳ¹Ò½Óµã£º

    # mkdir /home/j/ns /home/j/mail /home/j/www
    
  4. ÔÚ jail Öа²×°¿É¶ÁдµÄÄ£°å¡£ ×¢ÒâÄúÐèҪʹÓà sysutils/cpdup£¬ ËüÄܹ»°ïÖúÄúÈ·±£Ã¿¸öĿ¼¶¼ÊÇÕýÈ·µØ¸´ÖƵģº

    # mkdir /home/js
    # cpdup /home/j/skel /home/js/ns
    # cpdup /home/j/skel /home/js/mail
    # cpdup /home/j/skel /home/js/www
    
  5. ÕâÑù£¬ ¾ÍÍê³ÉÁË jail µÄÖÆ×÷£¬ ¿ÉÒÔÔËÐÐÁË¡£ Ê×ÏÈΪ jail ¹Ò½ÓÎļþϵͳ£¬ È»ºóʹÓà /etc/rc.d/jail ½Å±¾À´Æô¶¯ËüÃÇ£º

    # mount -a
    # /etc/rc.d/jail start
    

¡¡¡¡ÏÖÔÚ jail Ó¦¸Ã¾ÍÆô¶¯ÆðÀ´ÁË¡£ Òª¼ì²éËüÃÇÊÇ·ñÔËÐÐÕý³££¬ ¿ÉÒÔʹÓà jls(8) ÃüÁî¡£ ËüµÄÊä³öÓ¦¸ÃÀàËÆÕâÑù£º

# jls
   JID  IP Address      Hostname                      Path
     3  192.168.3.17    ns.example.org                /home/j/ns
     2  192.168.3.18    mail.example.org              /home/j/mail
     1  62.123.43.14    www.example.org               /home/j/www

¡¡¡¡Õâʱ£¬ ¾Í¿ÉÒÔµÇÈë jail ²¢Ôö¼ÓÓû§ºÍÅäÖ÷þÎñÁË¡£ JID Áиø³öÁËÕýÔÚÔËÐÐµÄ jail µÄ±êʶ±àºÅ¡£ Äú¿ÉÒÔʹÓÃÏÂÃæµÄÃüÁîÀ´ÔÚ JID ±àºÅΪ 3 µÄ jail ÖÐÖ´ÐйÜÀíÈÎÎñ£º

# jexec 3 tcsh

15.6.1.4 Éý¼¶

¡¡¡¡ÓÐʱ£¬ ÓÉÓÚ°²È«ÎÊÌ⣬ »òÐÂÔö¹¦ÄÜÓÐÓ㬠»áÏ£Íû½«ÏµÍ³Éý¼¶µ½Ò»¸öа汾µÄ FreeBSD¡£ ÕâÖÖ°²×°·½Ê½µÄÉè¼ÆÊ¹µÃÉý¼¶ÏÖÓÐ jail ±äµÃºÜÈÝÒס£ ÁíÍ⣬ ËüÒ²ÄÜ×î´óÏ޶ȵؼõСͣ»úʱ¼ä£¬ ÒòΪ jail Ö»ÔÚ×îºóʱ¿Ì²ÅÐèÒª¹Ø±Õ¡£ ÁíÍ⣬ ËüÒ²ÌṩÁ˼òµ¥µÄ»ØÍ˵½ÏÈǰ°æ±¾µÄ·½·¨¡£

  1. µÚÒ»²½Êǰ´Í¨³£µÄ·½·¨Éý¼¶Ö÷»úµÄϵͳ¡£ ½Ó×Å£¬ ÔÚ /home/j/mroot2 Öн¨Á¢Ò»¸öеÄÁÙʱģ°å£º

    # mkdir /home/j/mroot2
    # cd /usr/src
    # make installworld DESTDIR=/home/j/mroot2
    # cd /home/j/mroot2
    # cpdup /usr/src usr/src
    # mkdir s
    

    ÔÚÔËÐÐ installworld ʱ»á´´½¨Ò»Ð©²»ÐèÒªµÄĿ¼£¬ Ó¦½«ËüÃÇɾ³ý£º

    # chflags -R 0 var
    # rm -R etc var root usr/local tmp
    
  2. ÖØ½¨µ½Ö÷ϵͳÖеĿɶÁд·ûºÅÁ¬½Ó£º

    # ln -s s/etc etc
    # ln -s s/root root
    # ln -s s/home home
    # ln -s ../s/usr-local usr/local
    # ln -s ../s/usr-X11R6 usr/X11R6
    # ln -s s/tmp tmp
    # ln -s s/var var
    
  3. ÏÖÔÚÊÇʱºò¹Ø±Õ jail ÁË£º

    # /etc/rc.d/jail stop
    
  4. жÏÂÔ­ÏȵÄÎļþϵͳ£º

    # umount /home/j/ns/s
    # umount /home/j/ns
    # umount /home/j/mail/s
    # umount /home/j/mail
    # umount /home/j/www/s
    # umount /home/j/www
    

    ×¢Òâ: ¿É¶ÁдµÄÎļþϵͳ (/s) »áÔÚÖ»¶Áϵͳ֮ºó¹Ò½Ó£¬ Òò´ËÓ¦Ê×ÏÈÐ¶ÔØ¡£

  5. ½«ÏÈǰµÄÖ»¶ÁÎļþϵͳŲ×ߣ¬ »»³ÉеÄϵͳ¡£ ÕâÑù×öҲͬʱ±£ÁôÁËÏÈǰϵͳµÄ±¸·Ý£¬ ´Ó¶ø¿ÉÒÔÔÚ³öÏÖÎÊÌâʱ´ÓÖлָ´¡£ ÕâÀïÎÒÃǸù¾ÝÐÂϵͳµÄ´´½¨Ê±¼äÀ´ÃüÃû¡£ ´ËÍâÎÒÃǰÑÏÈǰµÄ FreeBSD Ports Ì×¼þÖ±½ÓÒÆ¶¯µ½ÐµÄÎļþϵͳÖУ¬ ÒÔ½ÚÊ¡´ÅÅ̿ռäºÍ inode£º

    # cd /home/j
    # mv mroot mroot.20060601
    # mv mroot2 mroot
    # mv mroot.20060601/usr/ports mroot/usr
    
  6. ÏÖÔÚеÄÖ»¶ÁÄ£°å¾Í¿ÉÒÔÓÃÁË£¬ ʣϵÄÊÂÇéÊÇÖØÐ¹ҽÓÎļþϵͳ²¢Æô¶¯ jails£º

    # mount -a
    # /etc/rc.d/jail start
    

¡¡¡¡×îºóÓà jls(8) ¼ì²é jail Æô¶¯ÊÇ·ñÕý³£¡£ ²»ÒªÍü¼ÇÔÚ jail ÖÐÔËÐÐ mergemaster¡£ ÅäÖÃÎļþºÍ rc.d ½Å±¾ÔÚÉý¼¶Ê±Ó¦½øÐиüС£

±¾ÎĵµºÍÆäËüÎĵµ¿É´ÓÕâÀïÏÂÔØ£ºftp://ftp.FreeBSD.org/pub/FreeBSD/doc/.

Èç¹û¶ÔÓÚFreeBSDÓÐÎÊÌ⣬ÇëÏÈÔĶÁÎĵµ£¬Èç²»Äܽâ¾öÔÙÁªÏµ<questions@FreeBSD.org>.
¹ØÓÚ±¾ÎĵµµÄÎÊÌâÇë·¢ÐÅÁªÏµ <doc@FreeBSD.org>.