2 .\"----------------------------------------------------------------------------
3 .\""THE BEER-WARE LICENSE" (Revision 42):
4 .\"<phk@FreeBSD.ORG> wrote this file. As long as you retain this notice you
5 .\"can do whatever you want with this stuff. If we meet some day, and you think
6 .\"this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp
7 .\"----------------------------------------------------------------------------
16 .Nd imprison current process and future decendants
23 .Fn jail "struct jail *jail"
27 system call sets up a jail and locks the current process in it.
29 The argument is a pointer to a structure describing the prison:
30 .Bd -literal -offset indent
40 defines the version of the API in use. It should be set to zero at this time.
44 pointer should be set to the directory which is to be the root of the
49 pointer can be set to the hostname of the prison. This can be changed
50 from the inside of the prison.
54 can be set to the IP number assigned to the prison.
56 Once a process has been put in a prison, it and its decendants cannot escape
57 the prison. It is not possible to add a process to a preexisting prison.
59 Inside the prison, the concept of "superuser" is very diluted. In general,
60 it can be assumed that nothing can be mangled from inside a prison which
61 does not exist entirely inside that prison. For instance the directory
64 can be manipulated all the ways a root can normally do it, including
66 but new device special nodes cannot be created because they reference
67 shared resources (the device drivers in the kernel).
69 All IP activity will be forced to happen to/from the IP number specified,
70 which should be an alias on one of the network interfaces.
72 It is possible to identify a process as jailed by examining
73 .Dq Li /proc/<pid>/status :
74 it will show a field near the end of the line, either as
75 a single hyphen for a process at large, or the hostname currently
76 set for the prison for jailed processes.
82 The version number of the argument is not correct.
89 internally, so it can fail for all the same reasons.
92 manual page for details.
99 function call appeared in
102 The jail feature was written by
103 .An Poul-Henning Kamp
105 .Dq Li http://www.rndassociates.com/
106 who contributed it to