|
In FreeBSD, a JailEnvironment is similar to a ChRoot? restriction, except that it adds extra limits to the processes running under it:
|
|
- Processes within the jail cannot "see" process that are not inside it.
- Various syscalls, such as mknod, are disallowed
|
|
<
< |
It's quite possible to establish many JailEnvironments within one running system. For example, you could have a webserver, a mailserver, and a DNS server operating within completely isolated environments. If one of those systems is compromised, the system administrator can shut down that environment without disturbing the others.
|
>
> |
It's quite possible to establish many JailEnvironments within one running system. For example, you could have a webserver, a mailserver, and a NameServer operating within completely isolated environments. If one of those systems is compromised, the system administrator can shut down that environment without disturbing the others.
|
|
It's not terribly difficult to BuildAndUpdateJails once you've done it once or twice. There is a somewhat high-level administration tool, JailAdmin, to assist in the day-to-day operation and monitoring of a server's JailEnvironments.
|
|
|
|
<
< |
|
>
> |
|
|
| META TOPICMOVED | KirkStrauser? | date="1031881653" from="Freebsd.JailEnvironments" to="Freebsd.JailEnvironment" |
|---|
|