1.\" 2.\"---------------------------------------------------------------------------- 3.\""THE BEER-WARE LICENSE" (Revision 42): 4.\"<[email protected]> wrote this file. As long as you retain this notice you 5.\"can do whatever you want with this stuff. If we meet some day, and you think 6.\"this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp 7.\"---------------------------------------------------------------------------- 8.\" 9.\"$FreeBSD$ 10.\" 11.Dd April 8, 2003 12.Dt JAIL 2 13.Os 14.Sh NAME 15.Nm jail , jail_attach 16.Nd imprison current process and future descendants 17.Sh LIBRARY 18.Lb libc 19.Sh SYNOPSIS 20.In sys/param.h 21.In sys/jail.h 22.Ft int 23.Fn jail "struct jail *jail" 24.Ft int 25.Fn jail_attach "int jid" 26.Sh DESCRIPTION 27The 28.Fn jail 29system call sets up a jail and locks the current process in it. 30.Pp 31The argument is a pointer to a structure describing the prison: 32.Bd -literal -offset indent 33struct jail { 34 u_int32_t version; 35 char *path; 36 char *hostname; 37 u_int32_t ip_number; 38}; 39.Ed 40.Pp 41.Dq Li version 42defines the version of the API in use. 43It should be set to zero at this time. 44.Pp 45The 46.Dq Li path 47pointer should be set to the directory which is to be the root of the 48prison. 49.Pp 50The 51.Dq Li hostname 52pointer can be set to the hostname of the prison. 53This can be changed 54from the inside of the prison. 55.Pp 56The 57.Dq Li ip_number 58can be set to the IP number assigned to the prison. 59.Pp 60The 61.Fn jail_attach 62system call attaches the current process to an existing jail, 63identified by 64.Fa jid . 65.Sh RETURN VALUES 66If successful, 67.Fn jail 68returns a non-negative integer, termed the jail identifier (JID). 69It returns \-1 on failure, and sets 70.Va errno 71to indicate the error. 72.Pp 73.Rv -std jail_attach 74.Sh PRISON? 75Once a process has been put in a prison, it and its descendants cannot escape 76the prison. 77.Pp 78Inside the prison, the concept of 79.Dq superuser 80is very diluted. 81In general, 82it can be assumed that nothing can be mangled from inside a prison which 83does not exist entirely inside that prison. 84For instance the directory 85tree below 86.Dq Li path 87can be manipulated all the ways a root can normally do it, including 88.Dq Li "rm -rf /*" 89but new device special nodes cannot be created because they reference 90shared resources (the device drivers in the kernel). 91The effective 92.Dq securelevel 93for a process is the greater of the global 94.Dq securelevel 95or, if present, the per-jail 96.Dq securelevel . 97.Pp 98All IP activity will be forced to happen to/from the IP number specified, 99which should be an alias on one of the network interfaces. 100.Pp 101It is possible to identify a process as jailed by examining 102.Dq Li /proc/<pid>/status : 103it will show a field near the end of the line, either as 104a single hyphen for a process at large, or the hostname currently 105set for the prison for jailed processes. 106.Sh ERRORS 107The 108.Fn jail 109system call 110will fail if: 111.Bl -tag -width Er 112.It Bq Er EINVAL 113The version number of the argument is not correct. 114.El 115.Pp 116Further 117.Fn jail 118calls 119.Xr chroot 2 120internally, so it can fail for all the same reasons. 121Please consult the 122.Xr chroot 2 123manual page for details. 124.Sh SEE ALSO 125.Xr chdir 2 , 126.Xr chroot 2 127.Sh HISTORY 128The 129.Fn jail 130system call appeared in 131.Fx 4.0 . 132The 133.Fn jail_attach 134system call appeared in 135.Fx 5.1 . 136.Sh AUTHORS 137The jail feature was written by 138.An Poul-Henning Kamp 139for R&D Associates 140.Dq Li http://www.rndassociates.com/ 141who contributed it to 142.Fx . 143