2012/6/8 (c) Hiroki Sato 2 / 70

Size: px

Start display at page:

Download "2012/6/8 (c) Hiroki Sato 2 / 70"

さゆりやたけ
6 years ago
Views:

1 FreeBSD Jail / FreeBSD Project 2012/6/8 2012/6/8 (c) Hiroki Sato 1 / 70

2 2012/6/8 (c) Hiroki Sato 2 / 70

3 RACCT / RCTL 2012/6/8 (c) Hiroki Sato 3 / 70

4 UNIX OS 2012/6/8 (c) Hiroki Sato 4 / 70

5 UNIX OS 2012/6/8 (c) Hiroki Sato 5 / 70

6 UNIX OS /bin/sh (grep) 2012/6/8 (c) Hiroki Sato 6 / 70

7 UNIX OS 2012/6/8 (c) Hiroki Sato 7 / 70

8 UNIX OS 2012/6/8 (c) Hiroki Sato 8 / 70

9 UNIX OS 2012/6/8 (c) Hiroki Sato 9 / 70

10 UNIX OS 2012/6/8 (c) Hiroki Sato 10 / 70

11 UNIX OS 2012/6/8 (c) Hiroki Sato 11 / 70

12 UNIX OS 2012/6/8 (c) Hiroki Sato 12 / 70

13 UNIX OS 2012/6/8 (c) Hiroki Sato 13 / 70

14 UNIX OS 2012/6/8 (c) Hiroki Sato 14 / 70

15 UNIX OS 2012/6/8 (c) Hiroki Sato 15 / 70

16 UNIX OS 2012/6/8 (c) Hiroki Sato 16 / 70

17 UNIX OS 2012/6/8 (c) Hiroki Sato 17 / 70

18 UNIX OS 2012/6/8 (c) Hiroki Sato 18 / 70

19 UNIX OS 2012/6/8 (c) Hiroki Sato 19 / 70

20 UNIX OS 2012/6/8 (c) Hiroki Sato 20 / 70

21 /6/8 (c) Hiroki Sato 21 / 70

22 Subject Action Object 2012/6/8 (c) Hiroki Sato 22 / 70

23 Subject Action Object 2012/6/8 (c) Hiroki Sato 23 / 70

24 (ACL) Subject Action Object 2012/6/8 (c) Hiroki Sato 24 / 70

25 (ACL) Subject Action Object : {S,A,O} = or 2012/6/8 (c) Hiroki Sato 25 / 70

26 (ACL) Subject Action Object : {S,A,O} = or 2012/6/8 (c) Hiroki Sato 26 / 70

27 (ACL) Subject Action Object {S, O} UID ACL 2012/6/8 (c) Hiroki Sato 27 / 70

28 2012/6/8 (c) Hiroki Sato 28 / 70

29 2012/6/8 (c) Hiroki Sato 29 / 70

30 setrlimit(2) 2012/6/8 (c) Hiroki Sato 30 / 70

31 setrlimit # cat /etc/login.conf default:\ :passwd_format=md5:\ :copyright=/etc/copyright:\ :welcome=/etc/motd:\ :setenv=mail=/var/mail/$,blocksize=k,ftp_passive_mode=yes:\ :path=/sbin /bin /usr/sbin /usr/bin /usr/games /usr/local/sbin /usr/local/bin ~/bin:\ :nologin=/var/run/nologin:\ :cputime=unlimited:\ :datasize=unlimited:\ :stacksize=unlimited:\ :memorylocked=unlimited:\ :memoryuse=unlimited:\ :filesize=unlimited:\ :coredumpsize=unlimited:\ :openfiles=unlimited:\ :maxproc=unlimited:\ :sbsize=unlimited:\ :vmemoryuse=unlimited:\ :swapuse=unlimited:\ :pseudoterminals=unlimited:\ :priority=0:\ :ignoretime@:\ :umask=022: 2012/6/8 (c) Hiroki Sato 31 / 70

32 setrlimit # cat /etc/login.conf default:\ setrlimit :passwd_format=md5:\ PID :copyright=/etc/copyright:\ :welcome=/etc/motd:\ UID :setenv=mail=/var/mail/$,blocksize=k,ftp_passive_mode=yes:\ :path=/sbin /bin /usr/sbin /usr/bin /usr/games /usr/local/sbin /usr/local/bin ~/bin:\ :nologin=/var/run/nologin:\ :cputime=unlimited:\ :datasize=unlimited:\ :stacksize=unlimited:\ :memorylocked=unlimited:\ :memoryuse=unlimited:\ :filesize=unlimited:\ :coredumpsize=unlimited:\ :openfiles=unlimited:\ :maxproc=unlimited:\ :sbsize=unlimited:\ setrlimit(2) :vmemoryuse=unlimited:\ :swapuse=unlimited:\ :pseudoterminals=unlimited:\ :priority=0:\ :ignoretime@:\ :umask=022: 2012/6/8 (c) Hiroki Sato 32 / 70

33 =limits(1) # /usr/bin/limits Resource limits (current): cputime infinity secs filesize infinity kb datasize kb stacksize kb coredumpsize-cur 0 kb memoryuse infinity kb memorylocked infinity kb maxprocesses 5547 openfiles sbsize infinity bytes vmemoryuse infinity kb pseudo-terminals infinity swapuse infinity kb # limits -u Resource limits (current): maxprocesses /6/8 (c) Hiroki Sato 33 / 70

34 limit/ulimit # limit cputime unlimited filesize unlimited datasize kbytes stacksize kbytes coredumpsize 0 kbytes memoryuse unlimited vmemoryuse unlimited descriptors memorylocked unlimited maxproc 5547 sbsize unlimited swapsize unlimited 2012/6/8 (c) Hiroki Sato 34 / 70

35 2012/6/8 (c) Hiroki Sato 35 / 70

36 2 root /6/8 (c) Hiroki Sato 36 / 70

37 2 root 2012/6/8 (c) Hiroki Sato 37 / 70

38 1 2 2? root 2012/6/8 (c) Hiroki Sato 38 / 70

39 /etc/passwd 2012/6/8 (c) Hiroki Sato 39 / 70

40 UNIX = 2012/6/8 (c) Hiroki Sato 40 / 70

41 UNIX = chroot 2012/6/8 (c) Hiroki Sato 41 / 70

42 # mkdir -p /a/jail /a/jail/dev /a/jail/tmp # cp -Rp /etc /lib /bin /sbin /usr /var /a/jail # cd / # mount -t devfs devfs /a/jail/dev # chroot /a/jail /bin/sh make installworld /etc # mkdir -p /a/jail # cd /usr/src && make DESTDIR=/a/jail installworld 2012/6/8 (c) Hiroki Sato 42 / 70

43 chroot 2012/6/8 (c) Hiroki Sato 43 / 70

44 kill 2012/6/8 (c) Hiroki Sato 44 / 70

45 FreeBSD chroot FreeBSD Jail chroot + α sysctl MIB proc list PID PID + Jail ID UID Jail 2012/6/8 (c) Hiroki Sato 45 / 70

46 FreeBSD Jail # mkdir -p /a/jail /a/jail/dev /a/jail/tmp # cp -Rp /etc /lib /bin /sbin /usr /var /a/jail # cd / # mount -t devfs devfs /a/jail/dev # jail -c name=j1 host.hostname=j1.example.com path=/a/jail command=/bin/sh 2012/6/8 (c) Hiroki Sato 46 / 70

47 FreeBSD Jail # mkdir -p /a/jail /a/jail/dev /a/jail/tmp # cp -Rp /etc /lib /bin /sbin /usr /var /a/jail # cd / # mount -t devfs devfs /a/jail/dev # jail -c name=j1 host.hostname=j1.example.com path=/a/jail command=/bin/sh # ps auwwx USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND SJ 6:08AM 0:00.01 /bin/sh R+J 6:11AM 0:00.00 ps auwwx # 2012/6/8 (c) Hiroki Sato 47 / 70

48 FreeBSD Jail # mkdir -p /a/jail /a/jail/dev /a/jail/tmp # cp -Rp /etc /lib /bin /sbin /usr /var /a/jail # cd / # mount -t devfs devfs /a/jail/dev # chroot /a/jail/bin/sh # ps auwwx USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND ?? RL 7:59AM 2611:43.88 [idle] ?? DLs 7:59AM 0:00.06 [kernel] : : : : : : 2012/6/8 (c) Hiroki Sato 48 / 70

49 FreeBSD Jail # mkdir -p /a/jail /a/jail/dev /a/jail/tmp # cp -Rp /etc /lib /bin /sbin /usr /var /a/jail # cd / # mount -t devfs devfs /a/jail/dev # jail -c name=j1 host.hostname=j1.example.com path=/a/jail command=/bin/sh # ps auwwx USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND SJ 6:08AM 0:00.01 /bin/sh R+J 6:11AM 0:00.00 ps auwwx 2012/6/8 (c) Hiroki Sato 49 / 70

50 FreeBSD Jail 2012/6/8 (c) Hiroki Sato 50 / 70

51 FreeBSD Jail jail_enable="yes" jail_list="j1" jail_j1_rootdir="/a/basejail" jail_j1_hostname="j1.example.com jail_j1_interface="" jail_j1_ip=" " jail_j1="/bin/sh /etc/rc" # /etc/rc.d/jail start FreeBSD Jail 2012/6/8 (c) Hiroki Sato 51 / 70

$FreeBSD Jail struct jail { u_int32_t version; char$ ip4s; unsigned int ip6s; struct in_addr *ip4;

52 FreeBSD Jail struct jail { u_int32_t version; char *path; char *hostname; char *jailname; unsigned int ip4s; unsigned int ip6s; struct in_addr *ip4; struct in6_addr *ip6; }; 2012/6/8 (c) Hiroki Sato 52 / 70

53 FreeBSD Jail % df Filesystem 1K-blocks Used Avail Capacity Mounted on /dev/da0s1a % / devfs % /dev /dev/da0s1d % /tmp /dev/da0s1f % /usr /dev/da0s1e % /var /dev/da0s1g % /a devfs % /a/altroot/a/centos/4.8/dev linprocfs % /a/altroot/a/centos/4.8/proc :/home % /a/altroot/a/centos/4.8/home 2012/6/8 (c) Hiroki Sato 53 / 70

54 FreeBSD Jail % uname -a Linux cadmaster2.vlsi.ee.noda.tus.ac.jp FreeBSD 8.2-STABLE #4: Thu Dec 29 09:05:09 JST 2011 i686 i686 i386 GNU/Linux 2012/6/8 (c) Hiroki Sato 54 / 70

55 FreeBSD Jail 2012/6/8 (c) Hiroki Sato 55 / 70

56 FreeBSD Jail 2012/6/8 (c) Hiroki Sato 56 / 70

57 2012/6/8 (c) Hiroki Sato 57 / 70

58 2012/6/8 (c) Hiroki Sato 58 / 70

59 RACCT / RCTL 2012/6/8 (c) Hiroki Sato 59 / 70

60 RACCT / RCTL 2012/6/8 (c) Hiroki Sato 60 / 70

61 RACCT / RCTL # rctl -hu user:hrs cputime=4214 datasize=21m stacksize=0 coredumpsize=0 memoryuse=33m memorylocked=0 maxproc=12 openfiles=0 vmemoryuse=446m pseudoterminals=0 swapuse=9620k nthr=12 msgqqueued=0 msgqsize=0 nmsgq=0 nsem=0 nsemop=0 nshm=0 shmsize=0 wallclock=899k -u 2012/6/8 (c) Hiroki Sato 61 / 70

62 RACCT / RCTL # rctl -hu user:hrs cputime=4214 datasize=21m stacksize=0 coredumpsize=0 memoryuse=33m memorylocked=0 maxproc=12 openfiles=0 vmemoryuse=446m pseudoterminals=0 swapuse=9620k nthr=12 msgqqueued=0 msgqsize=0 nmsgq=0 nsem=0 nsemop=0 nshm=0 shmsize=0 wallclock=899k -u 2012/6/8 (c) Hiroki Sato 62 / 70

63 RACCT / RCTL # rctl -hu user:hrs cputime=4214 datasize=21m stacksize=0 coredumpsize=0 memoryuse=33m memorylocked=0 maxproc=12 openfiles=0 vmemoryuse=446m pseudoterminals=0 swapuse=9620k nthr=12 msgqqueued=0 msgqsize=0 nmsgq=0 nsem=0 nsemop=0 nshm=0 shmsize=0 wallclock=899k -u 2012/6/8 (c) Hiroki Sato 63 / 70

64 RACCT / RCTL # rctl -hu user:hrs cputime=4214 datasize=21m stacksize=0 coredumpsize=0 memoryuse=33m memorylocked=0 maxproc=12 openfiles=0 vmemoryuse=446m pseudoterminals=0 swapuse=9620k nthr=12 msgqqueued=0 msgqsize=0 nmsgq=0 nsem=0 nsemop=0 nshm=0 shmsize=0 wallclock=899k -u 2012/6/8 (c) Hiroki Sato 64 / 70

65 RACCT / RCTL # rctl -a user:hrs:maxproc:deny=10 # rctl -a jail:j1:maxproc:log=10/user -a -r 2012/6/8 (c) Hiroki Sato 65 / 70

66 RACCT / RCTL # rctl -a jail:j1:maxproc:devctl=5 # /etc/devd.conf notify 0 { match "system" match "rule" action }; "RCTL"; "jail:j1:maxproc:.*"; "/etc/maxproc.sh restart"; action = devctl devd(8) devd.conf action 2012/6/8 (c) Hiroki Sato 66 / 70

67 RACCT / RCTL # rctl -a user:70:swap:devctl=1g # /etc/devd.conf notify 0 { match "system" match "rule" action }; "RCTL"; "user:70:swap:.*"; "/usr/local/etc/rc.d/postgresql restart"; UID swap 1GB 2012/6/8 (c) Hiroki Sato 67 / 70

68 RACCT / RCTL # /etc/rctl.conf user:70:swap:devctl=1g jail:j1:maxproc:devctl=5 # /etc/rc.conf rctl_enable= YES 2012/6/8 (c) Hiroki Sato 68 / 70

69 2012/6/8 (c) Hiroki Sato 69 / 70

70 2012/6/8 (c) Hiroki Sato 70 / 70

sato-FBSDW key

sato-FBSDW key 4 FreeBSD (18:30 / FreeBSD Project 2015/1/30 2015/01/30 (c) Hiroki Sato 1 / 45 2015/01/30 (c) Hiroki Sato 2 / 45 2015/01/30 (c) Hiroki Sato 3 / 45 2015/01/30 (c) Hiroki Sato 4 / 45 2015/01/30