FreeBSD-11 Jails and PKI

[Erich Dollansky]

Hi,

On Fri, 6 Jan 2017 12:01:57 -0500
"James B. Byrne via freebsd-questions" <freebsd-questions at freebsd.org>
wrote:

> If I want to make a binary application available to all jails do I put
> it in /usr/jails/basejail/bin or somewhere else?  Or is this
> impossible?
> 
> If possible then do such applications need to be statically linked?
> 
> Similarly, given that I wish to maintain a common repository of pki
> keys and certificates that are shared between jails, do I place these
> in or under /usr/jails/basejail/usr/share/openssl/? or somewhere else?
> Or not at all and place them separately in each and every jail that
> requires TLS?
> 
> The main issue I am dealing with is that we run a private PKI CA and
> need to add our root certificates to the ca-bundle after each update
> to  /usr/local/share/certs/ca-root-nss.crt.
> 

you have two options. Copy the files required to run your program into
each jail or hard link them. But - very big but - do the hard linking
only if you know what you are doing.

Erich