¥»¸`¥Dn¥H Simon L. Nielsen <simon@FreeBSD.org>
¼gªº http://simon.nitro.dk/service-jails.html ¬°¥D¡A¥[¤W Ken Tom <locals@gmail.com>
©Ò§ó·sªº¤å³¹¡C ¥»¸`¤¶²Ð¦p¦ó³]©w FreeBSD ¥H jail(8)
¥\¯à¨Ó¼W¥[ÃB¥~ªº¦w¥þ¼h±¡C ³o³¡¤À°²³]±z¨t²Î¶]ªº¬O RELENG_6_0 ©Î§ó·sªºª©¥»¡A
¨Ã¥B¹ï¥»³¹¥ý«e³¡¤À§¡¯à²z¸Ñ¡C
Jail ªº¥Dn°ÝÃD¤§¤@¦b©ó¦p¦ó¹ï¨ä¶i¦æ§ó·s¡B¤É¯Å©MºÞ²z¡C ¥Ñ©ó¨CÓ jail ³£¬O±qÀY«·s½sĶ¡A¹ï©ó³æ¤@ jail ¦Ó¨¥¡A ¤É¯Å¤]³\ÁÙ¤£¬O«ÜÄY«ªº°ÝÃD¡A¦]¬°§ó·s¡B¤É¯Å¨Ã¤£·|¤Ó³Â·Ð¡C ¦ý¹ï©ó¤@°ï jail ¦Ó¨¥¡A¤É¯Å¤£¶È·|¯Ó¶O¤Ó¦h®É¶¡¡A¨Ã¬Û·í¬\Àê¥F¨ý¡C
Warning: ³o¨Ç³]©wªº«e´£¬O±z¹ï FreeBSD ¨Ï¥Î¡B¥\¯à¹B¥Î¤W¦³¬Û·íªº¸gÅç¡A Y¤U±ªº³]©w¹ï±z¨Ó»¡¤Ó¹L½ÆÂø¡A«ØÄ³±z¸Ó¦Ò¼{¥Î¸û²©öªº¨t²Î¡A¹³¬O sysutils/ezjail¡A¨ä´£¨Ñ§ó²³æªº FreeBSD jail ºÞ²z¤è¦¡¡C
°ò¥»ªº·Qªk¬O¦b¤£¦Pªº jail ¤¤¾¨¶q¥H¦w¥þªº¤è¦¡¨Ó¦@¥Î¸ê·½ ¡X¡X ±Ä¥Î°ßŪªº mount_nullfs(8) ±¾¸ü¡A¨ÓÅý¤É¯Å§ó²³æ¡A ¨Ã§â¦UÓ service ©ñ¨ì¤£¦Pªº jail ªº§@ªk·|§ó¥[¥i¦æ¡C ¦¹¥~¡A ¨ä¤]´£¨Ñ¹ï©ó¦p¦ó¼W¥[¡B§R°£¡B¤É¯Å jail ªºÂ²«K¤è¦¡¡C
Note: service ±`¨£ªº¨Ò¤l¥]¬A¡G HTTP server¡BDNS server¡BSMTP server µ¥µ¥¡C
¥»¸`¤¶²Ðªº³]©w¥Øªº¦b©ó¡G
«Ø¥ß²©ö¥B®e©ö²z¸Ñªº jail ¬[ºc¡C ¤]´N¬O»¡ ¤£¥²¬°¨CÓ jail ³£°õ¦æ§¹¾ãªº installworld ¡C
Åý jail ªº·s¼W¡B²¾°£§ó²³æ¡C
Åý jail ªº§ó·s¡B¤É¯Å§ó»´ÃP¡C
¥i¥H¶]¦Û¦æ¥´³yªº FreeBSD ¤À¤ä¡C
¹ï¦w¥þ¦³§ó°¾°õ¨gªº°l¨D¡A¾¨¥i¯à°§C³Q§ð³´ªº¥i¯à¡C
¾¨¶q¸`¬ÙªÅ¶¡»P inode¡C
¦p¦P¥ý«e©Ò´£¨ìªº¡A³o³]p¥Dn¬O¾a§â°ßŪªº¥Dn¼Òª© (¤]´N¬O¤j®a©Ò¼ôª¾ªº nullfs)±¾¸ü¨ì¨CÓ jail¡A¨Ã¥BÅý¨CÓ jail ¦³Ó¥iŪ¡B¼gªº³]³Æ¡A³o³]³Æ¥i¥H¬O¿W¥ß¹êÅéµwºÐ¡B ¡B¤À³Î°Ï¡B©Î¥H vnode ¬°«áºÝªº md(4) ³]³Æ¡C ¦b¥»¨Ò·í¤¤¡A §Ú̱ĥΥiŪ¼gªº nullfs ±¾¸ü¡C
¤U±ªºªí«h¤¶²ÐÀɮרt²Îªº°t¸m¡G
¨CÓ jail ³£·|±¾¸ü¨ì /home/j ©³¤Uªº¨ä¤¤¤@ӥؿý¡C
/home/j/mroot «h¬O¨CÓ jail ¦@¥Îªº¼Òª©¡A¨Ã¹ï©ó©Ò¦³ jail ¦Ó¨¥³£¬O°ßŪ¡C
¨CÓ jail ¦b /home/j ©³¤U³£¦³¤@Ó¬Û¹ïÀ³ªºªÅ¥Ø¿ý¡C
¨CÓ jail ³£·|¦³ /s ¥Ø¿ý¡A ¸Ó¥Ø¿ý·|³s¨ì¨t²Îªº¥iŪ¼g³¡¤À¡C
¨CÓ jail ³£·|¦b /home/j/skel ¥Ø¿ý«Ø¥ß¦ÛÄݪº¥iŪ¼gªÅ¶¡ ¡C
¨CÓ jailspace (¦U jail ¥iŪ¼gªº³¡¤À) ³£«Ø¦b /home/js>¡C
Note: ³oÃä°²³]©Ò¦³ jail ³£©ñ¦b /home ¤À³Î°Ï¡C ·íµM¡A ¤]¥i¥H¨Ì¦Û¨»Ý¨D§ó§ï¡A¦ý±µ¤U¨Óªº¨Ò¤l¤¤¡A ¤]n°O±o×§ï¬Û¹ïÀ³ªº¦a¤è¡C
¥»¸`±N³v¨B¤¶²Ð¦p¦ó«Ø¥ß jail n¥Îªº°ßŪ¥D¼Òª©¡C
«ØÄ³¥ý§â FreeBSD ¨t²Î¤É¯Å¨ì³Ì·sªº -RELEASE ¤À¤ä¡A¦Ü©ó¦p¦ó°µ½Ð°Ñ¾\ Handbook ªº ¬ÛÃö³¹¸`¡C ·í§ó·s§¹¦¨¤§«á¡A´Nn¶i¦æ buildworld µ{§Ç¡A¦¹¥~ÁÙn¸Ë sysutils/cpdup ®M¥ó¡C §Ú̱N¥Î portsnap(8) ¨Ó¤U¸ü FreeBSD Ports Collection¡A ¦b Handbook ¤¤¹ï Portsnap ³¹¸` ¤¤¦³¬ÛÃö¤¶²Ð¡Aªì¾ÇªÌ¥i¥H¬Ý¬Ý¡C
º¥ý¡A¥ý«Ø¥ß°ßŪªº¥Ø¿ýµ²ºcµ¹ jail ©ñ FreeBSD binary¡A ±µµÛ¨ì FreeBSD source tree ¥Ø¿ý¡A¨Ã¦w¸Ë jail ¼Òª©¡G
# mkdir -p /home/j/mroot # cd /usr/src # make installworld DESTDIR=/home/j/mroot
±µµÛ¸ò FreeBSD source tree ¤@¼Ë¡A¤]§â FreeBSD Ports Collection ©ñ¤@¥÷¨Ñ jail ¨Ï¥Î¡A¥H³Æ mergemaster ¡G
# cd /home/j/mroot # mkdir usr/ports # portsnap -p /home/j/mroot/usr/ports fetch extract # cpdup /usr/src /home/j/mroot/usr/src
«Ø¥ß¥iŪ¼g³¡¤Àªº°©¬[¡G
# mkdir /home/j/skel /home/j/skel/home /home/j/skel/usr-X11R6 /home/j/skel/distfiles # mv etc /home/j/skel # mv usr/local /home/j/skel/usr-local # mv tmp /home/j/skel # mv var /home/j/skel # mv root /home/j/skel
¥Î mergemaster ¨Ó¸Ëº|±¼ªº³]©wÀÉ¡C ±µ¤U¨Ó§R°£ mergemaster ©Ò«Ø¥ßªº¦h¾l¥Ø¿ý¡G
# mergemaster -t /home/j/skel/var/tmp/temproot -D /home/j/skel -i # cd /home/j/skel # rm -R bin boot lib libexec mnt proc rescue sbin sys usr dev
²{¦b§â¥iŪ¼gªºÀɮרt²Î¥H symlink ¤è¦¡³s¨ì°ßŪªºÀɮרt²Î¡C ½Ð½T»{ symbolic link ¬O§_¦³¥¿½T³s¨ì s/ ¥Ø¿ý¡AY¥Ø¿ý«Ø¥ß¤è¦¡¤£¹ï¡A ©Î«ü¦V¦ì¸m¤£¹ï¡A¥i¯à·|¾ÉP¦w¸Ë¥¢±Ñ¡C
# cd /home/j/mroot # mkdir s # ln -s s/etc etc # ln -s s/home home # ln -s s/root root # ln -s ../s/usr-local usr/local # ln -s ../s/usr-X11R6 usr/X11R6 # ln -s ../../s/distfiles usr/ports/distfiles # ln -s s/tmp tmp # ln -s s/var var
³Ì«á«h¬O·s¼W /home/j/skel/etc/make.conf ¡A¨Ã¶ñ¤J¥H¤U¤º®e¡G
WRKDIRPREFIX?= /s/portbuild
n³]©w WRKDIRPREFIX ¤~¥i¥HÅý¦U jail ±o¥H¶¶§Q½sĶ FreeBSD ports¡C½Ð°O¦í ports ¥Ø¿ý¬OÄݰßŪÀɮרt²Î¡C ¦Ó·f°t¦Ûqªº WRKDIRPREFIX ¤~¥i¥HÅý¦U jail ¦b¥iŪ¼gªÅ¶¡¶i¦æ½sĶ¡C
²{¦b¤w¸g¦³§¹¾ãªº FreeBSD jail ¼Òª©¡A¥i¥H¦b /etc/rc.conf ¤º°µ¬ÛÃö³]©w¡C ¤U±³o¨Ò¤l«h¥Ü½d¦p¦ó«Ø¥ß 3 Ó jail¡G¡§NS¡¨¡B ¡§MAIL¡¨¡B¡§WWW¡¨¡C
¦b /etc/fstab ¥[¤W¤U¦C³]©w¡A ¥H«KÅý¨t²Î¦Û°Ê±¾¸ü¦U jail ©Ò»Ýªº°ßŪ¼Òª©»PŪ¼gªÅ¶¡¡G
/home/j/mroot /home/j/ns nullfs ro 0 0 /home/j/mroot /home/j/mail nullfs ro 0 0 /home/j/mroot /home/j/www nullfs ro 0 0 /home/js/ns /home/j/ns/s nullfs rw 0 0 /home/js/mail /home/j/mail/s nullfs rw 0 0 /home/js/www /home/j/www/s nullfs rw 0 0
¦b /etc/rc.conf ¤º³]©w jail¡G
jail_enable="YES" jail_set_hostname_allow="NO" jail_list="ns mail www" jail_ns_hostname="ns.example.org" jail_ns_ip="192.168.3.17" jail_ns_rootdir="/usr/home/j/ns" jail_ns_devfs_enable="YES" jail_mail_hostname="mail.example.org" jail_mail_ip="192.168.3.18" jail_mail_rootdir="/usr/home/j/mail" jail_mail_devfs_enable="YES" jail_www_hostname="www.example.org" jail_www_ip="62.123.43.14" jail_www_rootdir="/usr/home/j/www" jail_www_devfs_enable="YES"
Warning: ¤§©Ò¥Hn§â
jail_name_rootdir
±q /home §ï¬° /usr/home ªºì¦]¦b©ó FreeBSD ¹w³]¦w¸Ëªº /home ¥Ø¿ý¨ä¹ê¥u¬O«ü¦V /usr/home ªº symbolic link¡C ¦Ójail_name_rootdir
Åܼƶ·¬° ¹êÅ饨¿ý ¦Ó«D symbolic link¡A §_«h jail ·|©Úµ´±Ò°Ê¡C ¥i¥H¥Î realpath(1) ¨Ó¨M©w¸ÓÅܼơC ¸Ô±¡½Ð°Ñ¾\ FreeBSD-SA-07:01.jail ¦w¥þ³q§i¡C
´À¨CÓ jail «Ø¥ß¥²¶·ªº°ßŪÀɮרt²Î±¾¸üÂI¡G
# mkdir /home/j/ns /home/j/mail /home/j/www
¬°¨CÓ jail ¦w¸Ë¥iŪ¼gªº¼Òª©¡C ½Ðª`·N³o®Én¥Î sysutils/cpdup ¡A¥¦¯à½T«O¨Cӥؿý³£¦³¥¿½T½Æ»s¡C
# mkdir /home/js # cpdup /home/j/skel /home/js/ns # cpdup /home/j/skel /home/js/mail # cpdup /home/j/skel /home/js/www
¦p¦¹¤@¨Ó´N¤w§¹¦¨ jail Àô¹Ò«Ø¥ß¡A¥i¥H·Ç³Æ¦nn¥Î¤F¡C ½Ð¥ý¬°¦U jail ±¾¸ü©Ò¶·ªºÀɮרt²Î¡A¦A¥Î /etc/rc.d/jail script ¨Ó±Ò°Ê¡G
# mount -a # /etc/rc.d/jail start
²{¦b jail À³¸Ó´N·|±Ò°Ê¤F¡C YnÀˬd¬O§_¦³¥¿±`±Ò°Ê¡A¥i¥H¥Î jls(8) «ü¥O¨Ó¬Ý¡A¸Ó«ü¥Oªº°õ¦æµ²ªGÀ³¸ÓÃþ¦ü¤U±¡G
# jls JID IP Address Hostname Path 3 192.168.3.17 ns.example.org /home/j/ns 2 192.168.3.18 mail.example.org /home/j/mail 1 62.123.43.14 www.example.org /home/j/www
¦¹®É´N¥i¥Hµn¤J¦U jail ¨Ã·s¼W±b¸¹»P³]©w¬ÛÃö service n¥Îªº daemon ¡C ¤W±ªº JID Äæ¥Nªí¥¿¦b¹B§@¤¤ªº jail ½s¸¹¡C ¥i¥Î¤U¦C«ü¥O¥H¦b JID ½s¸¹ 3 ªº jail °õ¦æºÞ²z¤u§@¡G
# jexec 3 tcsh
¦³®É¥Ñ©ó¦w¥þ°ÝÃD©ÎªÌ jail ¤ºn¥Î·s¥\¯à¡A¦Ó»Ýn§â FreeBSD ¨t²Î¤É¯Å¨ì§ó·s¡C ³oºØ¦w¸Ë³]p¤è¦¡Åý¬J¦³ªº jail ¤É¯ÅÅܱo§ó¥[®e©ö¡C jail ¤]¥i¥H§â service °±¾÷®É¶¡(downtime)°¨ì³Ì§C¡A¦]¬° jail ¥u»Ý¦b³Ì«áÃöÁä¤~»Ýn«¶}¡C ¦¹¥~¡A¸U¤@·sª©¦³°ÝÃDªº¸Ü¡A ¥¦¤]´£¨Ñ»´ÃP¦^·¹¨ìª©ªº¥\¯à¡C
º¥ý¬O·Ó¤@¯ë¤è¦¡¨Ó¤É¯Å host system¡A¦A·s¼WÁ{®Éªº°ßŪ¼Òª© /home/j/mroot2¡G
# mkdir /home/j/mroot2 # cd /usr/src # make installworld DESTDIR=/home/j/mroot2 # cd /home/j/mroot2 # cpdup /usr/src usr/src # mkdir s
¦P¼Ë¦a¡A¦b°õ¦æ installworld ®É·|«Ø¥ß¤@¨Ç¥Î¤£µÛªº¥Ø¿ý¡A½Ð§â³o¨Ç¬å±¼¡G
# chflags -R 0 var # rm -R etc var root usr/local tmp
«·s«Ø¥ß¨ì¥D¨t²Îªº¥iŪ¼gªÅ¶¡ symlink¡G
# ln -s s/etc etc # ln -s s/root root # ln -s s/home home # ln -s ../s/usr-local usr/local # ln -s ../s/usr-X11R6 usr/X11R6 # ln -s s/tmp tmp # ln -s s/var var
²{¦b¥i¥HÃö³¬ jail¡G
# /etc/rc.d/jail stop
¨ø¸üì¥ýªºÀɮרt²Î¡G
# umount /home/j/ns/s # umount /home/j/ns # umount /home/j/mail/s # umount /home/j/mail # umount /home/j/www/s # umount /home/j/www
Note: ¥iŪ¼gªÅ¶¡(/s) ¬O±¾¸ü¦b°ßŪÀɮרt²Î©³¤U¡A¬Gn¥ý¨ø¸ü¡C
§âªº°ßŪ¨t²Î·h¨«¡A´«¦¨·sªº¡C ¦p¦¹¤@¨Ó¡A ¥i¦P®É«O¯d¥ý«e¨t²Îªº³Æ¥÷¡A¥H³Æ¸U¤@¤É¯Å«á¦³°ÝÃD¥i¦^´_¡C ³oÃ䪺©R¦W¤è¦¡±Ä·s°ßŪÀɮרt²Îªº«Ø¥ß®É¶¡¡A¦¹¥~ì¥ý FreeBSD Ports Collection ª½±µ·h¨ì·sªºÀɮרt²Î¡A¥H¸`¬ÙµwºÐªÅ¶¡»P inode ¡G
# cd /home/j # mv mroot mroot.20060601 # mv mroot2 mroot # mv mroot.20060601/usr/ports mroot/usr
²{¦b·sªº°ßŪ¼Òª©·Ç³Æ¦n¤F¡A¥u³Ñ¤U«·s±¾¸ü¥H¤Î±Ò°Ê jail¡G
# mount -a # /etc/rc.d/jail start
³Ì«á¥H jls(8) ¨ÓÀˬd jail ¬O§_§¡¥¿±`±Ò°Ê¡C §O§Ñ¤Fn¦b¦U jail ¤º°õ¦æ mergemaster¡AÁÙ¦³¬ÛÃö³]©wÀÉ¥H¤Î rc.d scripts §¡n§ó·s¡C
¥»¤å¤Î¨ä¥L¤å¥ó¡A¥i¥Ñ¦¹¤U¸ü¡Gftp://ftp.FreeBSD.org/pub/FreeBSD/doc/¡C
Y¦³ FreeBSD ¤è±ºÃ°Ý¡A½Ð¥ý¾\Ū FreeBSD ¬ÛÃö¤å¥ó¡A¦p¤£¯à¸Ñ¨Mªº¸Ü¡A¦A¬¢¸ß
<questions@FreeBSD.org>¡C
Ãö©ó¥»¤å¥óªº°ÝÃD¡A½Ð¬¢¸ß <doc@FreeBSD.org>¡C