15.6 Jail ªºÀ³¥Î

15.6.1 Service Jails

Contributed by Daniel Gerzo.

¥»¸`¥D­n¥H Simon L. Nielsen ¼gªº http://simon.nitro.dk/service-jails.html ¬°¥D¡A¥[¤W Ken Tom ©Ò§ó·sªº¤å³¹¡C ¥»¸`¤¶²Ð¦p¦ó³]©w FreeBSD ¥H jail(8) ¥\¯à¨Ó¼W¥[ÃB¥~ªº¦w¥þ¼h­±¡C ³o³¡¤À°²³]±z¨t²Î¶]ªº¬O RELENG_6_0 ©Î§ó·sªºª©¥»¡A ¨Ã¥B¹ï¥»³¹¥ý«e³¡¤À§¡¯à²z¸Ñ¡C

15.6.1.1 Design

Jail ªº¥D­n°ÝÃD¤§¤@¦b©ó¦p¦ó¹ï¨ä¶i¦æ§ó·s¡B¤É¯Å©MºÞ²z¡C ¥Ñ©ó¨C­Ó jail ³£¬O±qÀY­«·s½sĶ¡A¹ï©ó³æ¤@ jail ¦Ó¨¥¡A ¤É¯Å¤]³\ÁÙ¤£¬O«ÜÄY­«ªº°ÝÃD¡A¦]¬°§ó·s¡B¤É¯Å¨Ã¤£·|¤Ó³Â·Ð¡C ¦ý¹ï©ó¤@°ï jail ¦Ó¨¥¡A¤É¯Å¤£¶È·|¯Ó¶O¤Ó¦h®É¶¡¡A¨Ã¬Û·í¬\Àê¥F¨ý¡C

Warning: ³o¨Ç³]©wªº«e´£¬O±z¹ï FreeBSD ¨Ï¥Î¡B¥\¯à¹B¥Î¤W¦³¬Û·íªº¸gÅç¡A ­Y¤U­±ªº³]©w¹ï±z¨Ó»¡¤Ó¹L½ÆÂø¡A«ØÄ³±z¸Ó¦Ò¼{¥Î¸û²©öªº¨t²Î¡A¹³¬O sysutils/ezjail¡A¨ä´£¨Ñ§ó²³æªº FreeBSD jail ºÞ²z¤è¦¡¡C

°ò¥»ªº·Qªk¬O¦b¤£¦Pªº jail ¤¤¾¨¶q¥H¦w¥þªº¤è¦¡¨Ó¦@¥Î¸ê·½ ¡X¡X ±Ä¥Î°ßŪªº mount_nullfs(8) ±¾¸ü¡A¨ÓÅý¤É¯Å§ó²³æ¡A ¨Ã§â¦U­Ó service ©ñ¨ì¤£¦Pªº jail ªº§@ªk·|§ó¥[¥i¦æ¡C ¦¹¥~¡A ¨ä¤]´£¨Ñ¹ï©ó¦p¦ó¼W¥[¡B§R°£¡B¤É¯Å jail ªºÂ²«K¤è¦¡¡C

Note: service ±`¨£ªº¨Ò¤l¥]¬A¡G HTTP server¡BDNS server¡BSMTP server µ¥µ¥¡C

¥»¸`¤¶²Ðªº³]©w¥Øªº¦b©ó¡G

  • «Ø¥ß²©ö¥B®e©ö²z¸Ñªº jail ¬[ºc¡C ¤]´N¬O»¡ ¤£¥²¬°¨C­Ó jail ³£°õ¦æ§¹¾ãªº installworld ¡C

  • Åý jail ªº·s¼W¡B²¾°£§ó²³æ¡C

  • Åý jail ªº§ó·s¡B¤É¯Å§ó»´ÃP¡C

  • ¥i¥H¶]¦Û¦æ¥´³yªº FreeBSD ¤À¤ä¡C

  • ¹ï¦w¥þ¦³§ó°¾°õ¨gªº°l¨D¡A¾¨¥i¯à­°§C³Q§ð³´ªº¥i¯à¡C

  • ¾¨¶q¸`¬ÙªÅ¶¡»P inode¡C

¦p¦P¥ý«e©Ò´£¨ìªº¡A³o³]­p¥D­n¬O¾a§â°ßŪªº¥D­n¼Òª© (¤]´N¬O¤j®a©Ò¼ôª¾ªº nullfs)±¾¸ü¨ì¨C­Ó jail¡A¨Ã¥BÅý¨C­Ó jail ¦³­Ó¥iŪ¡B¼gªº³]³Æ¡A³o³]³Æ¥i¥H¬O¿W¥ß¹êÅéµwºÐ¡B ¡B¤À³Î°Ï¡B©Î¥H vnode ¬°«áºÝªº md(4) ³]³Æ¡C ¦b¥»¨Ò·í¤¤¡A §Ú­Ì±Ä¥Î¥iŪ¼gªº nullfs ±¾¸ü¡C

¤U­±ªºªí«h¤¶²ÐÀɮרt²Îªº°t¸m¡G

  • ¨C­Ó jail ³£·|±¾¸ü¨ì /home/j ©³¤Uªº¨ä¤¤¤@­Ó¥Ø¿ý¡C

  • /home/j/mroot «h¬O¨C­Ó jail ¦@¥Îªº¼Òª©¡A¨Ã¹ï©ó©Ò¦³ jail ¦Ó¨¥³£¬O°ßŪ¡C

  • ¨C­Ó jail ¦b /home/j ©³¤U³£¦³¤@­Ó¬Û¹ïÀ³ªºªÅ¥Ø¿ý¡C

  • ¨C­Ó jail ³£·|¦³ /s ¥Ø¿ý¡A ¸Ó¥Ø¿ý·|³s¨ì¨t²Îªº¥iŪ¼g³¡¤À¡C

  • ¨C­Ó jail ³£·|¦b /home/j/skel ¥Ø¿ý«Ø¥ß¦ÛÄݪº¥iŪ¼gªÅ¶¡ ¡C

  • ¨C­Ó jailspace (¦U jail ¥iŪ¼gªº³¡¤À) ³£«Ø¦b /home/js>¡C

Note: ³oÃä°²³]©Ò¦³ jail ³£©ñ¦b /home ¤À³Î°Ï¡C ·íµM¡A ¤]¥i¥H¨Ì¦Û¨­»Ý¨D§ó§ï¡A¦ý±µ¤U¨Óªº¨Ò¤l¤¤¡A ¤]­n°O±o­×§ï¬Û¹ïÀ³ªº¦a¤è¡C

15.6.1.2 «Ø¥ß¼Òª©

¥»¸`±N³v¨B¤¶²Ð¦p¦ó«Ø¥ß jail ­n¥Îªº°ßŪ¥D¼Òª©¡C

«ØÄ³¥ý§â FreeBSD ¨t²Î¤É¯Å¨ì³Ì·sªº -RELEASE ¤À¤ä¡A¦Ü©ó¦p¦ó°µ½Ð°Ñ¾\ Handbook ªº ¬ÛÃö³¹¸`¡C ·í§ó·s§¹¦¨¤§«á¡A´N­n¶i¦æ buildworld µ{§Ç¡A¦¹¥~ÁÙ­n¸Ë sysutils/cpdup ®M¥ó¡C §Ú­Ì±N¥Î portsnap(8) ¨Ó¤U¸ü FreeBSD Ports Collection¡A ¦b Handbook ¤¤¹ï Portsnap ³¹¸` ¤¤¦³¬ÛÃö¤¶²Ð¡Aªì¾ÇªÌ¥i¥H¬Ý¬Ý¡C

  1. ­º¥ý¡A¥ý«Ø¥ß°ßŪªº¥Ø¿ýµ²ºcµ¹ jail ©ñ FreeBSD binary¡A ±µµÛ¨ì FreeBSD source tree ¥Ø¿ý¡A¨Ã¦w¸Ë jail ¼Òª©¡G

    # mkdir -p /home/j/mroot
    # cd /usr/src
    # make installworld DESTDIR=/home/j/mroot
    
  2. ±µµÛ¸ò FreeBSD source tree ¤@¼Ë¡A¤]§â FreeBSD Ports Collection ©ñ¤@¥÷¨Ñ jail ¨Ï¥Î¡A¥H³Æ mergemaster ¡G

    # cd /home/j/mroot
    # mkdir usr/ports
    # portsnap -p /home/j/mroot/usr/ports fetch extract
    # cpdup /usr/src /home/j/mroot/usr/src
    
  3. «Ø¥ß¥iŪ¼g³¡¤Àªº°©¬[¡G

    # mkdir /home/j/skel /home/j/skel/home /home/j/skel/usr-X11R6 /home/j/skel/distfiles
    # mv etc /home/j/skel
    # mv usr/local /home/j/skel/usr-local
    # mv tmp /home/j/skel
    # mv var /home/j/skel
    # mv root /home/j/skel
    
  4. ¥Î mergemaster ¨Ó¸Ëº|±¼ªº³]©wÀÉ¡C ±µ¤U¨Ó§R°£ mergemaster ©Ò«Ø¥ßªº¦h¾l¥Ø¿ý¡G

    # mergemaster -t /home/j/skel/var/tmp/temproot -D /home/j/skel -i
    # cd /home/j/skel
    # rm -R bin boot lib libexec mnt proc rescue sbin sys usr dev
    
  5. ²{¦b§â¥iŪ¼gªºÀɮרt²Î¥H symlink ¤è¦¡³s¨ì°ßŪªºÀɮרt²Î¡C ½Ð½T»{ symbolic link ¬O§_¦³¥¿½T³s¨ì s/ ¥Ø¿ý¡A­Y¥Ø¿ý«Ø¥ß¤è¦¡¤£¹ï¡A ©Î«ü¦V¦ì¸m¤£¹ï¡A¥i¯à·|¾É­P¦w¸Ë¥¢±Ñ¡C

    # cd /home/j/mroot
    # mkdir s
    # ln -s s/etc etc
    # ln -s s/home home
    # ln -s s/root root
    # ln -s ../s/usr-local usr/local
    # ln -s ../s/usr-X11R6 usr/X11R6
    # ln -s ../../s/distfiles usr/ports/distfiles
    # ln -s s/tmp tmp
    # ln -s s/var var
    
  6. ³Ì«á«h¬O·s¼W /home/j/skel/etc/make.conf ¡A¨Ã¶ñ¤J¥H¤U¤º®e¡G

    WRKDIRPREFIX?=  /s/portbuild
    

    ­n³]©w WRKDIRPREFIX ¤~¥i¥HÅý¦U jail ±o¥H¶¶§Q½sĶ FreeBSD ports¡C½Ð°O¦í ports ¥Ø¿ý¬OÄݰßŪÀɮרt²Î¡C ¦Ó·f°t¦Û­qªº WRKDIRPREFIX ¤~¥i¥HÅý¦U jail ¦b¥iŪ¼gªÅ¶¡¶i¦æ½sĶ¡C

15.6.1.3 «Ø¥ß Jail

²{¦b¤w¸g¦³§¹¾ãªº FreeBSD jail ¼Òª©¡A¥i¥H¦b /etc/rc.conf ¤º°µ¬ÛÃö³]©w¡C ¤U­±³o¨Ò¤l«h¥Ü½d¦p¦ó«Ø¥ß 3 ­Ó jail¡G¡§NS¡¨¡B ¡§MAIL¡¨¡B¡§WWW¡¨¡C

  1. ¦b /etc/fstab ¥[¤W¤U¦C³]©w¡A ¥H«KÅý¨t²Î¦Û°Ê±¾¸ü¦U jail ©Ò»Ýªº°ßŪ¼Òª©»PŪ¼gªÅ¶¡¡G

    /home/j/mroot   /home/j/ns     nullfs  ro  0   0
    /home/j/mroot   /home/j/mail   nullfs  ro  0   0
    /home/j/mroot   /home/j/www    nullfs  ro  0   0
    /home/js/ns     /home/j/ns/s   nullfs  rw  0   0
    /home/js/mail   /home/j/mail/s nullfs  rw  0   0
    /home/js/www    /home/j/www/s  nullfs  rw  0   0
    

    Note: ¤À³Î°Ïªº pass number ¼Ð¥Ü¬° 0 ´N¤£·|¦b¶}¾÷®É°µ fsck(8) Àˬd¡F¦Ó¤À³Î°Ïªº dump number ¼Ð¥Ü¬° 0 «h¤£·|³Q dump(8) ©Ò³Æ¥÷¡C §Ú­Ì¨Ã¤£§Æ±æ fsck Àˬd nullfs ªº±¾¸ü¡A©ÎªÌÅý dump ³Æ¥÷ jail ¤º°ßŪªº nullfs ±¾¸ü¡C ³o¤]´N¬O¬°¦ó¤W­z fstab ¨C¦æ³]©w«á­±³£¦³¨âÄæ¬° ¡§0 0¡¨¡C

  2. ¦b /etc/rc.conf ¤º³]©w jail¡G

    jail_enable="YES"
    jail_set_hostname_allow="NO"
    jail_list="ns mail www"
    jail_ns_hostname="ns.example.org"
    jail_ns_ip="192.168.3.17"
    jail_ns_rootdir="/usr/home/j/ns"
    jail_ns_devfs_enable="YES"
    jail_mail_hostname="mail.example.org"
    jail_mail_ip="192.168.3.18"
    jail_mail_rootdir="/usr/home/j/mail"
    jail_mail_devfs_enable="YES"
    jail_www_hostname="www.example.org"
    jail_www_ip="62.123.43.14"
    jail_www_rootdir="/usr/home/j/www"
    jail_www_devfs_enable="YES"
    

    Warning: ¤§©Ò¥H­n§â jail_name_rootdir ±q /home §ï¬° /usr/home ªº­ì¦]¦b©ó FreeBSD ¹w³]¦w¸Ëªº /home ¥Ø¿ý¨ä¹ê¥u¬O«ü¦V /usr/home ªº symbolic link¡C ¦Ó jail_name_rootdir Åܼƶ·¬° ¹êÅ饨¿ý ¦Ó«D symbolic link¡A §_«h jail ·|©Úµ´±Ò°Ê¡C ¥i¥H¥Î realpath(1) ¨Ó¨M©w¸ÓÅܼơC ¸Ô±¡½Ð°Ñ¾\ FreeBSD-SA-07:01.jail ¦w¥þ³q§i¡C

  3. ´À¨C­Ó jail «Ø¥ß¥²¶·ªº°ßŪÀɮרt²Î±¾¸üÂI¡G

    # mkdir /home/j/ns /home/j/mail /home/j/www
    
  4. ¬°¨C­Ó jail ¦w¸Ë¥iŪ¼gªº¼Òª©¡C ½Ðª`·N³o®É­n¥Î sysutils/cpdup ¡A¥¦¯à½T«O¨C­Ó¥Ø¿ý³£¦³¥¿½T½Æ»s¡C

    # mkdir /home/js
    # cpdup /home/j/skel /home/js/ns
    # cpdup /home/j/skel /home/js/mail
    # cpdup /home/j/skel /home/js/www
    
  5. ¦p¦¹¤@¨Ó´N¤w§¹¦¨ jail Àô¹Ò«Ø¥ß¡A¥i¥H·Ç³Æ¦n­n¥Î¤F¡C ½Ð¥ý¬°¦U jail ±¾¸ü©Ò¶·ªºÀɮרt²Î¡A¦A¥Î /etc/rc.d/jail script ¨Ó±Ò°Ê¡G

    # mount -a
    # /etc/rc.d/jail start
    

²{¦b jail À³¸Ó´N·|±Ò°Ê¤F¡C ­Y­nÀˬd¬O§_¦³¥¿±`±Ò°Ê¡A¥i¥H¥Î jls(8) «ü¥O¨Ó¬Ý¡A¸Ó«ü¥Oªº°õ¦æµ²ªGÀ³¸ÓÃþ¦ü¤U­±¡G

# jls
   JID  IP Address      Hostname                      Path
     3  192.168.3.17    ns.example.org                /home/j/ns
     2  192.168.3.18    mail.example.org              /home/j/mail
     1  62.123.43.14    www.example.org               /home/j/www

¦¹®É´N¥i¥Hµn¤J¦U jail ¨Ã·s¼W±b¸¹»P³]©w¬ÛÃö service ­n¥Îªº daemon ¡C ¤W­±ªº JID Äæ¥Nªí¥¿¦b¹B§@¤¤ªº jail ½s¸¹¡C ¥i¥Î¤U¦C«ü¥O¥H¦b JID ½s¸¹ 3 ªº jail °õ¦æºÞ²z¤u§@¡G

# jexec 3 tcsh

15.6.1.4 ¤É¯Å

¦³®É¥Ñ©ó¦w¥þ°ÝÃD©ÎªÌ jail ¤º­n¥Î·s¥\¯à¡A¦Ó»Ý­n§â FreeBSD ¨t²Î¤É¯Å¨ì§ó·s¡C ³oºØ¦w¸Ë³]­p¤è¦¡Åý¬J¦³ªº jail ¤É¯ÅÅܱo§ó¥[®e©ö¡C jail ¤]¥i¥H§â service °±¾÷®É¶¡(downtime)­°¨ì³Ì§C¡A¦]¬° jail ¥u»Ý¦b³Ì«áÃöÁä¤~»Ý­n­«¶}¡C ¦¹¥~¡A¸U¤@·sª©¦³°ÝÃDªº¸Ü¡A ¥¦¤]´£¨Ñ»´ÃP¦^·¹¨ìª©ªº¥\¯à¡C

  1. ­º¥ý¬O·Ó¤@¯ë¤è¦¡¨Ó¤É¯Å host system¡A¦A·s¼WÁ{®Éªº°ßŪ¼Òª© /home/j/mroot2¡G

    # mkdir /home/j/mroot2
    # cd /usr/src
    # make installworld DESTDIR=/home/j/mroot2
    # cd /home/j/mroot2
    # cpdup /usr/src usr/src
    # mkdir s
    

    ¦P¼Ë¦a¡A¦b°õ¦æ installworld ®É·|«Ø¥ß¤@¨Ç¥Î¤£µÛªº¥Ø¿ý¡A½Ð§â³o¨Ç¬å±¼¡G

    # chflags -R 0 var
    # rm -R etc var root usr/local tmp
    
  2. ­«·s«Ø¥ß¨ì¥D¨t²Îªº¥iŪ¼gªÅ¶¡ symlink¡G

    # ln -s s/etc etc
    # ln -s s/root root
    # ln -s s/home home
    # ln -s ../s/usr-local usr/local
    # ln -s ../s/usr-X11R6 usr/X11R6
    # ln -s s/tmp tmp
    # ln -s s/var var
    
  3. ²{¦b¥i¥HÃö³¬ jail¡G

    # /etc/rc.d/jail stop
    
  4. ¨ø¸ü­ì¥ýªºÀɮרt²Î¡G

    # umount /home/j/ns/s
    # umount /home/j/ns
    # umount /home/j/mail/s
    # umount /home/j/mail
    # umount /home/j/www/s
    # umount /home/j/www
    

    Note: ¥iŪ¼gªÅ¶¡(/s) ¬O±¾¸ü¦b°ßŪÀɮרt²Î©³¤U¡A¬G­n¥ý¨ø¸ü¡C

  5. §âªº°ßŪ¨t²Î·h¨«¡A´«¦¨·sªº¡C ¦p¦¹¤@¨Ó¡A ¥i¦P®É«O¯d¥ý«e¨t²Îªº³Æ¥÷¡A¥H³Æ¸U¤@¤É¯Å«á¦³°ÝÃD¥i¦^´_¡C ³oÃ䪺©R¦W¤è¦¡±Ä·s°ßŪÀɮרt²Îªº«Ø¥ß®É¶¡¡A¦¹¥~­ì¥ý FreeBSD Ports Collection ª½±µ·h¨ì·sªºÀɮרt²Î¡A¥H¸`¬ÙµwºÐªÅ¶¡»P inode ¡G

    # cd /home/j
    # mv mroot mroot.20060601
    # mv mroot2 mroot
    # mv mroot.20060601/usr/ports mroot/usr
    
  6. ²{¦b·sªº°ßŪ¼Òª©·Ç³Æ¦n¤F¡A¥u³Ñ¤U­«·s±¾¸ü¥H¤Î±Ò°Ê jail¡G

    # mount -a
    # /etc/rc.d/jail start
    

³Ì«á¥H jls(8) ¨ÓÀˬd jail ¬O§_§¡¥¿±`±Ò°Ê¡C §O§Ñ¤F­n¦b¦U jail ¤º°õ¦æ mergemaster¡AÁÙ¦³¬ÛÃö³]©wÀÉ¥H¤Î rc.d scripts §¡­n§ó·s¡C

¥»¤å¤Î¨ä¥L¤å¥ó¡A¥i¥Ñ¦¹¤U¸ü¡Gftp://ftp.FreeBSD.org/pub/FreeBSD/doc/¡C

­Y¦³ FreeBSD ¤è­±ºÃ°Ý¡A½Ð¥ý¾\Ū FreeBSD ¬ÛÃö¤å¥ó¡A¦p¤£¯à¸Ñ¨Mªº¸Ü¡A¦A¬¢¸ß <questions@FreeBSD.org>¡C
Ãö©ó¥»¤å¥óªº°ÝÃD¡A½Ð¬¢¸ß <doc@FreeBSD.org>¡C