News for hackers. Stuff that matters.
Re:FreeBSD Jails the hard way by toast0 on Friday January 08, 2016 @09:56PM (#10869877)
FreeBSD jails can absolute have just the application you want sandboxed (and its config, datafiles, and linked libraries, and the library loader), at work I have a couple jails like that. We also have jails that have a full os.

It's not as obvious or well documented how to set it up this way, but it was maybe a couple days work, including my first rc script ever, and the script to assemble the jail in our environment (you could probably have a tar file with the contents of the jail, and just add the conf/data files)

Re:FreeBSD Jails the hard way by laumars on Saturday January 09, 2016 @07:31AM (#10871021)
Did you document your process? I'd love to read about it
Re:FreeBSD Jails the hard way by toast0 on Saturday January 09, 2016 @06:44PM (#10873370)
Did not document (other than the assembly script that I can't share), although I did post my jail.conf (essentially) in an earlier FreeBSD thread https://news.ycombinator.com/item?id=10602990

If you know how to build a minimal chroot, you know how to build a minimal jail, and then you just need to configure it, etc... If you don't know how to build a minimal chroot, check out option 3 'most minimal chroot possible' here: http://ram.kossboss.com/debian-ubuntu-build-minimal-chroot/

It's written against Debian Linux, but the same thing basically works for FreeBSD, except ldd on FreeBSD omits the loader (/libexec/ld-elf.so.1), but I sort of remembered that from somewhere, and I used truss to see what system calls were being used before it died.