In FreeBSD, a JailEnvironment is similar to a ChRoot^? restriction, except that it adds extra limits to the processes running under it:

• All networking code is limited to listening to or connecting from the IP address specified when starting the jail.
• Processes within the jail cannot "see" process that are not inside it.
• Various syscalls, such as mknod, are disallowed

It's quite possible to establish many JailEnvironments within one running system. For example, you could have a webserver, a mailserver, and a NameServer operating within completely isolated environments. If one of those systems is compromised, the system administrator can shut down that environment without disturbing the others.

It's not terribly difficult to BuildAndUpdateJails once you've done it once or twice. There is a somewhat high-level administration tool, JailAdmin, to assist in the day-to-day operation and monitoring of a server's JailEnvironments.

-- KirkStrauser - 12 Sep 2002