Network namespaces in FreeBSD
ihor at antonovs.family
Thu Dec 24 16:52:39 UTC 2020
On 12/24/20 8:22 AM, Arthur Chance wrote:
>>> Wouldn't a VNET jail rooted at / effectively be that?
>> Last time I played with jails setting jail's root to '/' was not allowed
>> for some reason. I don't remember exact error message though.
> I think that must have changed. Using a jail rooted at / used to be the
> recommended way of preventing rpcbind's wildcard listen from being a
> security loophole.
You have inspired in me a desire to play again
> I do remember that you can't nullfs mount / under itself.
>> I remember that I ended up null-mounting every directory in / (like bin,
>> sbin, etc,) to jail's root directory, and that was quite painful to do
> I'm increasingly thinking that the file system layout needs a rethink to
> be able to handle jails and minimal app style devices like firewalls.
> Sadly inertia (and standards) will prevent that from happening.
Yes, there are some pain points with Jails, especially if we try to
simulate some nice features from Linux world. Here are some of my pain
- we can't null-mount a single file (useful to inject configs or
sockets; linux has mount --bind for that)
- combining with jail's root on / it would be nice to be able to make
some parts of the tree read-only for the jail (or even hide them)
Fixing things like these would make it a lot easier and attractive to
build container orchestration systems on FreeBSD, or get better security
to run applications that need root.
But I think it is not too much, it can be fixed. I feel that dynamics of
FreeBSD development is shifting a bit lately, so I stay hopeful.
I'd say that we need to collect all the use-cases where people feel pain
using jails and write it down somewhere on wiki. It would be a nice
More information about the freebsd-questions