From owner-freebsd-hackers Thu May 16 8:44:59 2002 Delivered-To: freebsd-hackers@freebsd.org Received: from south.nanolink.com (south.nanolink.com [217.75.134.10]) by hub.freebsd.org (Postfix) with SMTP id ACF0A37B40A for ; Thu, 16 May 2002 08:44:15 -0700 (PDT) Received: (qmail 58102 invoked from network); 16 May 2002 15:51:56 -0000 Received: from unknown (HELO straylight.ringlet.net) (212.116.140.125) by south.nanolink.com with SMTP; 16 May 2002 15:51:56 -0000 Received: (qmail 46792 invoked by uid 1000); 16 May 2002 15:43:26 -0000 Date: Thu, 16 May 2002 18:43:26 +0300 From: Peter Pentchev To: Attila Nagy Cc: freebsd-hackers@FreeBSD.org Subject: Re: reboot your own jail ? Message-ID: <20020516184326.I349@straylight.oblivion.bg> Mail-Followup-To: Attila Nagy , freebsd-hackers@FreeBSD.org References: <20020516003127.I17484-100000@utility.clubscholarship.com> <20020516144159.C349@straylight.oblivion.bg> <20020516162219.E45898@mail.webmonster.de> <20020516180414.H349@straylight.oblivion.bg> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-md5; protocol="application/pgp-signature"; boundary="mhOzvPhkurUs4vA9" Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: ; from bra@fsn.hu on Thu, May 16, 2002 at 05:10:06PM +0200 Sender: owner-freebsd-hackers@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG --mhOzvPhkurUs4vA9 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, May 16, 2002 at 05:10:06PM +0200, Attila Nagy wrote: > Hello, >=20 > > Okay, forget I said anything about supervise; it does not seem to be > > applicable for jails at all :( > Why? >=20 > ns# cat /var/service/ns.XXX.hu/run > #!/bin/sh >=20 > exec /usr/sbin/jail /data/jail/ns.XXX.hu ns.XXX.hu 192.168.2.2 \ > /usr/local/sbin/chrootuid / bind /usr/local/sbin/named -c \ > /etc/bind/named.conf -f >=20 > In /data/jail/ns.XXX.hu there is only a single, statically linked named > binary, and the config files. named runs on a high port (>1024), so I can > start as the bind user. In front of the machine there is a packet filter, > which does NAT. >=20 > It is perfectly working with daemontools/supervise :) Yes, for your particular kind of jail :) And as a matter of fact, most things could be started like that, indeed.. Seems I need to really wake up and start thinking, and think myself away from the 'default' concept of starting a full-fledged /bin/sh /etc/rc jail. G'luck, Peter --=20 Peter Pentchev roam@ringlet.net roam@FreeBSD.org PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint FDBA FD79 C26F 3C51 C95E DF9E ED18 B68D 1619 4553 This would easier understand fewer had omitted. --mhOzvPhkurUs4vA9 Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (FreeBSD) iD8DBQE849Oe7Ri2jRYZRVMRAmmkAJwIU4XW+nIC7e9Ac+pejGl7h8ddkQCgqGiR OxxpePI67SFR+jSS+4vyx8o= =ZwFu -----END PGP SIGNATURE----- --mhOzvPhkurUs4vA9-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message