Alexander Leidinger

Just another weblog

Apr
07

A desk­top envi­ron­ment in a jail.

Yeah! Finally I got time to fin­ish my work to put a desk­top envi­ron­ment (in this case GNOME) into a jail. At least I have a proof of con­cept (I write this with fire­fox run­ning in my “desk­jail”). No, I don’t do this for addi­tional secu­rity (there’s more secu­rity than in a non-jailed setup, but less secu­rity than in an ordi­nary jail, as you have to allow access to a lot more devices than in an ordi­nary jail), I do this for addi­tional flex­i­bil­ity: Mov­ing my desk­top is now only the install of FreeBSD on a new machine and rsync­ing the jail over to it. As the machine will also be a host of sev­eral jails where I have some com­mon users with the same UID in each jail, I don’t pol­lute the jail-host with the desk­top stuff and I have every­thing nicely separated.

With­out a ker­nel patch and good devfs rules you will not get Xorg up and run­ning in a jail (at least I didn’t man­aged to let it rec­og­nize my graphic card with­out the ker­nel patch). Now I have to beef up the patch a lit­tle bit and ask for review (it weak­ens up the secu­rity a lit­tle bit like the sysctl security.jail.sysvipc_allowed=1 or security.jail.allow_raw_sockets=1).

But first I have to fin­ish the move of all my ser­vices I use at home to the jail-host now.

GD Star Rat­ing
load­ing…
GD Star Rat­ing
load­ing…
Share

Tags: , , , , , , , , ,

6 Responses to “A desk­top envi­ron­ment in a jail.”

  1. We got ZFS! at Alexander Leidinger Says:

    […] About « A desk­top envi­ron­ment in a jail. […]

  2. Carlos Watson Says:

    Hi, Alexan­der I spoke with Dru Lav­i­gne about “Trans­la­tors are vol­un­teers who are inter­ested” I inter­ests in that. He send a email about that.

    Best regards,

    GD Star Rating
    loading...
    GD Star Rating
    loading...
  3. grUNIX » Blog Archiv » ZFS: FreeBSD mit ZFS im BASE Says:

    […] sind, ein­fach durch ein ZFS ersetzt wer­den. Inter­es­sant in diesem Zusam­men­hang ist auch die Nachricht von Alexan­der Lei­dinger, der nun in einer Jail eine kom­plette Desk­top­umge­bung am laufen […]

  4. Ian Pulsford Says:

    You can at least run a head­less X lis­ten­ing for XDM requests in a jail, I just tried it.

    GD Star Rating
    loading...
    GD Star Rating
    loading...
  5. openwiki Says:

    Hi Alexan­der,

    I’m cur­rently test­ing also a X desk­top envi­ron­ment in a jail (with­out tcp for­ward­ing).
    I’m fight­ing with devfs.rules.
    Have you a link for ker­nel patch ?

    GD Star Rating
    loading...
    GD Star Rating
    loading...
  6. netchild Says:

    Have a look at http://www.leidinger.net/FreeBSD/current-patches/ and at the jail-mailinglist, I wrote about the devfs.rules which are needed there.

    GD Star Rating
    loading...
    GD Star Rating
    loading...

Leave a Reply