Date: Sat, 13 Sep 2008 19:31:02 +0200 From: Tobias Rehbein <tobias.rehbein@web.de> To: freebsd-questions@freebsd.org Subject: Re: Jailing net/skype Message-ID: <20080913173102.GA84554@sushi.pseudo.local> In-Reply-To: <20080911174721.GA10261@sushi.pseudo.local> References: <20080911174721.GA10261@sushi.pseudo.local>
next in thread | previous in thread | raw e-mail | index | archive | help
Am Thu, Sep 11, 2008 at 07:47:21PM +0200 schrieb Tobias Rehbein:
> I have net/skype installed on my workstation and it just works fine. Now I
> wonder if it's possible to run skype in a jail.
>
> Before I start investing time in this I would like to know if someone has
> done it before or if it would be just a waste of time.
Hello all.
As nobody seems to have experience with this I decided to set up a simple jail
to test this. Unfortunately skype keeps dumping core when I'm trying to start
it. Perhaps someone has a hint for me how to deal with this.
I tried to set up a jail as unrestrictve as possible. My goal was to get whole
thing running and lock down the jail later.
#uname -a
FreeBSD sushi.pseudo.local 7.1-PRERELEASE FreeBSD 7.1-PRERELEASE #17:
Thu Sep 11 19:04:40 CEST 2008
tobi@sushi.pseudo.local:/usr/obj/usr/src/sys/SUSHI i386
#sysctl security.jail.
security.jail.jailed: 1
security.jail.mount_allowed: 0
security.jail.chflags_allowed: 0
security.jail.allow_raw_sockets: 1
security.jail.enforce_statfs: 2
security.jail.sysvipc_allowed: 1
security.jail.socket_unixiproute_only: 0
security.jail.set_hostname_allowed: 1
#sysctl compat.linux
compat.linux.oss_version: 198144
compat.linux.osrelease: 2.6.16
compat.linux.osname: Linux
#pkg_info | grep linux_base
linux_base-fc6-6_5 Base set of packages needed in Linux mode (for i386/amd64)
#grep LINUX /etc/make.conf
OVERRIDE_LINUX_BASE_PORT=fc6
devfs is mounted and I use the same ruleset as in the host system.
#kdump -f ktrace.out | head
84180 skype CALL access(0x292b2b61,R_OK)
84180 skype NAMI "/compat/linux/etc/ld.so.preload"
84180 skype NAMI "/etc/ld.so.preload"
84180 skype RET access JUSTRETURN
84180 skype CALL open(0x292b2d49,O_RDONLY,<unused>0)
84180 skype NAMI "/compat/linux/etc/ld.so.cache"
84180 skype NAMI "/compat/linux"
84180 skype NAMI "/compat/linux/etc/ld.so.cache"
84180 skype RET open 3
84180 skype CALL freebsd6_mmap(0x3,0xbfbfe324,<invalid>690704336,MAP_SHARED|MAP_PRIVATE|MAP_RENAME|MAP_NORESERVE|MAP_HASSEMAPHORE|MAP_STACK|MAP_NOSYNC,0x2e6f732e,0x68636163,0x646165,0,0,0,0,0,0,0,0,0,... (lots of '0,'s)
The funny thing is kdump itself coredumps when dumping the whole thing out (I
guess that has something todo with this endless '...0,0,0,0,0...' sequence).
Last but not least my kernel config:
cpu I686_CPU
ident SUSHI
options SCHED_ULE # ULE scheduler
options PREEMPTION # Enable kernel thread preemption
options INET # InterNETworking
options INET6 # IPv6 communications protocols
options SCTP # Stream Control Transmission Protocol
options FFS # Berkeley Fast Filesystem
options SOFTUPDATES # Enable FFS soft updates support
options UFS_DIRHASH # Improve performance on big directories
options MSDOSFS # MSDOS Filesystem
options CD9660 # ISO 9660 Filesystem
options PSEUDOFS # Pseudo-filesystem framework
options GEOM_LABEL # Provides labelization
options COMPAT_43TTY # BSD 4.3 TTY compat [KEEP THIS!]
options SCSI_DELAY=5000 # Delay (in ms) before probing SCSI
options KTRACE # ktrace(1) support
options STACK # stack(9) support
options SYSVSHM # SYSV-style shared memory
options SYSVMSG # SYSV-style message queues
options SYSVSEM # SYSV-style semaphores
options _KPOSIX_PRIORITY_SCHEDULING # POSIX P1003_1B real-time extensions
options KBD_INSTALL_CDEV # install a CDEV entry in /dev
options ADAPTIVE_GIANT # Giant mutex is adaptive.
options STOP_NMI # Stop CPUS using NMI instead of IPI
options SMP # Symmetric MultiProcessor Kernel
device apic # I/O APIC
device cpufreq
device eisa
device pci
device ata
device atadisk # ATA disk drives
device atapicd # ATAPI CDROM drives
options ATA_STATIC_ID # Static device numbering
options AHC_REG_PRETTY_PRINT # Print register bitfields in debug
# output. Adds ~128k to driver.
options AHD_REG_PRETTY_PRINT # Print register bitfields in debug
# output. Adds ~215k to driver.
device scbus # SCSI bus (required for SCSI)
device da # Direct Access (disks)
device cd # CD
device pass # Passthrough device (direct SCSI access)
device atkbdc # AT keyboard controller
device atkbd # AT keyboard
device psm # PS/2 mouse
device vga # VGA video card driver
device splash # Splash screen and screen saver support
device sc
device agp # support several AGP chipsets
device sio # 8250, 16[45]50 based serial ports
device ppc
device ppbus # Parallel port bus (required)
device miibus # MII bus support
device re # RealTek 8139C+/8169/8169S/8110S
device wlan # 802.11 support
device wlan_wep # 802.11 WEP support
device wlan_ccmp # 802.11 CCMP support
device wlan_tkip # 802.11 TKIP support
device wlan_amrr # AMRR transmit rate control algorithm
device wlan_scan_ap # 802.11 AP mode scanning
device wlan_scan_sta # 802.11 STA mode scanning
device loop # Network loopback
device random # Entropy device
device ether # Ethernet support
device pty # Pseudo-ttys (telnet etc)
device md # Memory "disks"
device firmware # firmware assist module
device bpf # Berkeley packet filter
device uhci # UHCI PCI->USB interface
device ehci # EHCI PCI->USB interface (USB 2.0)
device usb # USB Bus (required)
device umass # Disks/Mass storage - Requires scbus and da
device ums # Mouse
device firewire # FireWire bus code
device sbp # SCSI over FireWire (Requires scbus and da)
device atapicam
device sound
device snd_hda
device wpi
device drm
device radeondrm
options NULLFS
options ATKBD_DFLT_KEYMAP
makeoptions ATKBD_DFLT_KEYMAP=german.iso.acc
options IPFIREWALL
options IPDIVERT
options COMPAT_LINUX
Any help would be appreciated.
Regards Tobias
--
Tobias Rehbein
PGP key: 4F2AE314
server: keys.gnupg.net
fingerprint: ECDA F300 1B6E 9B87 8524 8663 E8B6 3138 4F2A E314
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20080913173102.GA84554>