Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FreeBSD Jails for Fun and Profit (2020)

topikettunen.com

Post reply on HN
Print view View original

121–130 of 161 posts

Re: FreeBSD Jails for Fun and Profit (2020)

#121

Post by lmm »

unbanned wrote: post #98
rsync wrote: post #46

One thing I find so valuable about jails is the ability to jail a single command with no other userland than what that binary requires. Here's an example from my personal name server: /usr/sbin/jail /jails/www www 10.10.10.36 /lighttpd -f conf/lighttpd.conf ... and although this jail has a lot of content files in it, the actual UNIX userland is only what is required to run 'lighttpd': # find /jails/www/usr | wc -l 43…

And? How is this more secure. Just seems unnecessarily complicated.

The complete mess that is containers on linux seems a whole lot more complicated to me. Jails do what you want in a simple way that works; containers are endlessly customizable such that you require a whole runtime and management daemon and message-bus integration and goodness knows what else.

Re: FreeBSD Jails for Fun and Profit (2020)

#122

Post by ajross »

int_19h wrote: post #105
shatteredgate wrote: post #104

Earlier quoted context omitted.

In my experience, both Linux developers and BSD developers don't seem to care too much about porting things to the other's operating system. If you want to do things the Linux way you can use Linux, and if you want to do things the BSD way you can use BSD. That's seen as easier than trying to glue two incompatible things together.

BSD developers can't port things from Linux in a straightforward manner due to license issues. But that doesn't apply the other way around.

Won't, not can't. *BSDs shipped GPL components for decades before they decided to go for purity. It's a policy decision, not a incapability or mandate.

Re: FreeBSD Jails for Fun and Profit (2020)

#123

Post by shatteredgate »

shatteredgate wrote: post #113
ori_b wrote: post #107

Earlier quoted context omitted.

What are you adding gradually, specifically? Like, a concrete example that names a namespace you may want to use. I'm trying to figure out what problems a half sandbox solves, and a vague "I just want to enable some capabilities" doesn't help here.

A lot of the various security options in systemd: https://www.freedesktop.org/software/systemd/man/systemd.exe... The sandboxing and mount-related ones are implemented with namespaces, and the idea with them is to not make any of them mandatory so they can be slowly added to system services. That way you can get some of the benefits without needing to build a full rootfs/container for the service. I am not sure how a…

Side note: I suppose you could chroot to /.

Re: FreeBSD Jails for Fun and Profit (2020)

#124

Post by [deleted] »

ajross wrote: post #122
int_19h wrote: post #105

Earlier quoted context omitted.

BSD developers can't port things from Linux in a straightforward manner due to license issues. But that doesn't apply the other way around.

Won't, not can't. *BSDs shipped GPL components for decades before they decided to go for purity. It's a policy decision, not a incapability or mandate.

[deleted]

Re: FreeBSD Jails for Fun and Profit (2020)

#125

Post by heavyset_go »

trasz wrote: post #115
tome wrote: post #83

Earlier quoted context omitted.

Could you elaborate on the differences? As far as I understood it firejail, or rather the Linux features that it depends upon, is far more powerful than FreeBSD jails.

From what I understand, firejail is a "syscall filter". This moves it to the same category as capsicum ( https://www.freebsd.org/cgi/man.cgi?capsicum ), but without Capsicum's security model, instead implementing something ad-hoc, probably by using Linux' seccmp. Jails, on the other hand, are not a sandboxing mechanism - they are system-level virtualization, like Linux namespaces, but with a simpler interface. You ca…

Firejail does more than just syscall filtering.

Re: FreeBSD Jails for Fun and Profit (2020)

#126

Post by vegai_ »

kazen44 wrote: post #55
vegai_ wrote: post #44

Earlier quoted context omitted.

Is there a reason why FreeBSD doesn't default to running all applications in jails? Seems like this would be a pretty huge advantage compared to the typical Unix system's almost complete lack of sandboxing.

what should run in a jail? you need the base system to run jails. and that is pretty much the only thing that is installed.

Because if I don't run in a jail, every software I run has full read/write access to all my files. Almost none of the software I run needs even read access to anything except its own files.

Re: FreeBSD Jails for Fun and Profit (2020)

#127

Post by nix23 »

vegai_ wrote: post #126
kazen44 wrote: post #55

Earlier quoted context omitted.

what should run in a jail? you need the base system to run jails. and that is pretty much the only thing that is installed.

Because if I don't run in a jail, every software I run has full read/write access to all my files. Almost none of the software I run needs even read access to anything except its own files.

Jail is not a Sandbox but OS-Virtualization, those are two different things, Capsicum is the sandbox for FreeBSD...like secomp is for Linux.

Re: FreeBSD Jails for Fun and Profit (2020)

#128

Post by tome »

VTimofeenko wrote: post #57
rsync wrote: post #47

Earlier quoted context omitted.

"... I even had a separate Firefox jail that was only allowed to get out via a Tor socks proxy to avoid leaks ..." I have looked into doing this many times and it's neither simple nor straightforward. Specifically: jailing a GUI app that you can interact with on your desktop. I can't remember what the most promising recipe I saw for this was but it wasn't quite promising enough to compel me to built it up ... and thi…

Firejail with spawning nested Xorg works fine for me, including text-only copypaste between "host" and "guest" and automatic file synchronization through bind-like mounts. For some firejails I also use Linux network namespaces to control traffic going through taps. My introduction to this approach was the alternative Gentoo handbook by Sakaki[1], but the principles would apply on any distro. There's also a very inter…

What's nested Xorg? Do you mean you run each app in a separate VNC or RDP server?

Re: FreeBSD Jails for Fun and Profit (2020)

#129

Post by trasz »

shatteredgate wrote: post #102
trasz wrote: post #99

Earlier quoted context omitted.

This doesn't really answer the question. Yes, the Linux API seems more flexible, but when you think about it, it really isn't, because all the models that actually make any sense can be implemented using simpler interface, which is what jails provide. One real difference is that you need to be root to create a jail. It'll get fixed eventually - FreeBSD already has unprivileged chroot, jail isn't that much different.

>Yes, the Linux API seems more flexible, but when you think about it, it really isn't, because all the models that actually make any sense can be implemented using simpler interface, which is what jails provide. Not really, the example of Docker would probably be the most straightforward there. I don't think it's possible to fully port Docker to jails or at least I've never seen a successful port, some of the network…

Docker is literally just a jail. You can do whatever network topology you want using vnet.

And yes, having to use root is a major issue. Looks fixable though.

Re: FreeBSD Jails for Fun and Profit (2020)

#130

Post by trasz »

heavyset_go wrote: post #125
trasz wrote: post #115

Earlier quoted context omitted.

From what I understand, firejail is a "syscall filter". This moves it to the same category as capsicum ( https://www.freebsd.org/cgi/man.cgi?capsicum ), but without Capsicum's security model, instead implementing something ad-hoc, probably by using Linux' seccmp. Jails, on the other hand, are not a sandboxing mechanism - they are system-level virtualization, like Linux namespaces, but with a simpler interface. You ca…

Firejail does more than just syscall filtering.

Please tell more.
Post reply on HN