Network namespaces in FreeBSD

[Ihor Antonov]

On 12/24/20 8:22 AM, Arthur Chance wrote:
>>> Wouldn't a VNET jail rooted at / effectively be that?
>>>
>>
>> Last time I played with jails setting jail's root to '/' was not allowed
>> for some reason. I don't remember exact error message though.
> 
> I think that must have changed. Using a jail rooted at / used to be the
> recommended way of preventing rpcbind's wildcard listen from being a
> security loophole.

You have inspired in me a desire to play again

> I do remember that you can't nullfs mount / under itself.
> 
>> I remember that I ended up null-mounting every directory in / (like bin,
>> sbin, etc,) to jail's root directory, and that was quite painful to do
>> manually.
> 
> I'm increasingly thinking that the file system layout needs a rethink to
> be able to handle jails and minimal app style devices like firewalls.
> Sadly inertia (and standards) will prevent that from happening.

Yes, there are some pain points with Jails, especially if we try to 
simulate some nice features from Linux world. Here are some of my pain 
points:

- we can't null-mount a single file (useful to inject configs or 
sockets; linux has mount --bind for that)
- combining with jail's root on / it would be nice to be able to make 
some parts of the tree read-only for the jail (or even hide them)

Fixing things like these would make it a lot easier and attractive to 
build container orchestration systems on FreeBSD, or get better security 
to run applications that need root.

But I think it is not too much, it can be fixed. I feel that dynamics of 
FreeBSD development is shifting a bit lately, so I stay hopeful.
I'd say that we need to collect all the use-cases where people feel pain 
using jails and write it down somewhere on wiki. It would be a nice 
starting point.


Ihor