path: root/zh_CN.GB2312/books/handbook/jails/chapter.sgml

<!--
    The FreeBSD Documentation Project
    The FreeBSD Simplified Chinese Project

    Original Revision: 1.18
    $FreeBSD$
-->
<chapter id="jails">
  <chapterinfo>
    <authorgroup>
      <author>
	<firstname>Matteo</firstname>
	<surname>Riondato</surname>
	<contrib>Ô­×÷ </contrib>
      </author>
    </authorgroup>
  </chapterinfo>

  <title>Jails</title>

  <indexterm><primary>jails</primary></indexterm>

  <sect1 id="jails-synopsis">
    <title>¸ÅÊö</title>

    <para>ÕâÒ»Õ½«ÎªÄú½éÉÜ &os; jail ÊÇʲô£¬ ÒÔ¼°ÈçºÎʹÓÃËüÃÇ¡£
      Jail£¬ ÓÐʱҲ±»ÈÏΪÊÇ¶Ô <emphasis>chroot »·¾³</emphasis>
      µÄÒ»ÖÖÔöÇ¿ÐÍÌæ´úÆ·£¬ ¶ÔÓÚ¹ÜÀíÔ±¶øÑÔÊǷdz£Ç¿´óµÄ¹¤¾ß£¬ ͬʱ£¬
      ËüµÄһЩ»ù±¾Ó÷¨£¬ ¶Ô¸ß¼¶Óû§¶øÑÔÒ²Ï൱ÓÐÓá£</para>

    <para>¶ÁÍêÕâÕ£¬ Äú½«Á˽⣺</para>

    <itemizedlist>
      <listitem>
	<para>jail ÊÇʲô£¬ ÒÔ¼°ËüÔÚÄú°²×°µÄ &os;
	  ÖÐËùÄÜ·¢»ÓµÄ×÷Óá£</para>
      </listitem>

      <listitem>
	<para>ÈçºÎÁª±à¡¢ Æô¶¯ºÍÍ£Ö¹ jail¡£</para>
      </listitem>

      <listitem>
	<para>ÈçºÎ´Ó jail ÄÚ²¿»òÖ÷»úÉϽøÐйÜÀíµÄһЩ»ù´¡ÖªÊ¶¡£</para>
      </listitem>
    </itemizedlist>

    <para>ÆäËûһЩÄܹ»ÎªÄúÌṩ¹ØÓÚ jail µÄÓÐÓÃÐÅÏ¢µÄµØ·½»¹ÓУº</para>

    <itemizedlist>
      <listitem>
	<para>&man.jail.8; Áª»úÊֲᡣ ÕâÊǹØÓÚ <command>jail</command> &mdash;
	  ÓÃÓÚÔÚ &os; ÖÐÆô¶¯¡¢ Í£Ö¹ºÍ¿ØÖÆ &os; jails &mdash; ¹¤¾ßµÄÍêÕû˵Ã÷Êé¡£</para>
      </listitem>

      <listitem>
	<para>ÓʼþÁÐ±í¼°Æä´æµµ¡£ ÓÉ &a.mailman.lists; ÌṩµÄ
	  &a.questions; ºÍÆäËûÓʼþÁбíµÄ´æµµ£¬ ÒѾ­°üº¬ÁËһϵÁйØÓÚ
	  jails µÄÓмÛÖµµÄÐÅÏ¢¡£ ͨ³£ËÑË÷´æµµ»òѯÎÊ &a.questions.name;
	  ÓʼþÁбíÄܹ»¸øÄú´øÀ´ºÜ¶àÓÐÓõÄÐÅÏ¢¡£</para>
      </listitem>
    </itemizedlist>

  </sect1>

  <sect1 id="jails-terms">
    <title>Óë Jail Ïà¹ØµÄһЩÊõÓï</title>

    <para>ΪÁË°ïÖúÄú¸üºÃµØÀí½âÓë jail ÓÐ¹ØµÄ &os; ϵͳ֪ʶ£¬
      ÒÔ¼°ËüÃÇÈçºÎÓë &os; µÄÆäËü²¿·ÖÏ໥×÷Ó㬠ÄúÓ¦Àí½âÏÂÁÐÊõÓ</para>

    <variablelist>
      <varlistentry>
        <term>&man.chroot.2; (ÃüÁî)</term>
        <listitem>
	  <para>&os; µÄÒ»¸öϵͳµ÷Ó㬠Æä×÷ÓÃÊǸıä½ø³Ì¼°ÆäÑÜÉú½ø³ÌËùÄÜ¿´µ½µÄ¸ùĿ¼¡£</para>
	</listitem>
      </varlistentry>

      <varlistentry>
        <term>&man.chroot.2; (»·¾³)</term>
        <listitem>
	  <para>ÔÚ <quote>chroot</quote> ÖÐÔËÐеĽø³Ì»·¾³¡£
	    Õâ°üÀ¨ÀàËÆÎļþϵͳÖеĿɼû²¿·Ö¡¢ ¿ÉÓõÄÓû§¼°Óû§×é ID¡¢
	    ÍøÂç½Ó¿ÚÒÔ¼°ÆäËû IPC »úÖƵÈ×ÊÔ´¡£</para>
	</listitem>
      </varlistentry>

      <varlistentry>
        <term>&man.jail.8; (ÃüÁî)</term>
        <listitem>
	  <para>ÓÃÒÔÔÚ jail »·¾³ÖÐÔËÐнø³ÌµÄϵͳ¹ÜÀí¹¤¾ß¡£</para>
	</listitem>
      </varlistentry>

      <varlistentry>
        <term>ËÞÖ÷ (ϵͳ¡¢ ½ø³Ì¡¢ Óû§µÈµÈ)</term>
        <listitem>
	  <para>Äܹ»¿ØÖÆ jail »·¾³µÄϵͳ¡£ ËÞÖ÷ϵͳÄܹ»·ÃÎÊÈ«²¿¿ÉÓõÄÓ²¼þ×ÊÔ´£¬
	    ²¢Äܹ»¿ØÖÆ jail »·¾³ÄÚÍâµÄ½ø³Ì¡£ ËÞÖ÷ϵͳÓë jail µÄÒ»ÏîÖØÒªÇø±ðÊÇ£¬
	    ÔÚËÞÖ÷ϵͳÖеij¬¼¶Óû§½ø³Ì£¬ ²¢²»ÏñÔÚ
	    jail ÖÐÄÇÑùÊܵ½Ò»ÏµÁÐÏÞÖÆ¡£</para>
	</listitem>
      </varlistentry>

      <varlistentry>
        <term>hosted (ϵͳ¡¢ ½ø³Ì¡¢ Óû§µÈµÈ)</term>
        <listitem>
	  <para>¿É·ÃÎÊ×ÊÔ´ÊÜ &os; jail ÏÞÖƵĽø³Ì¡¢ Óû§»òÆäËûʵÌå¡£</para>
	</listitem>
      </varlistentry>
    </variablelist>
  </sect1>

  <sect1 id="jails-intro">
    <title>½éÉÜ</title>

    <para>ÓÉÓÚϵͳ¹ÜÀíÊÇÒ»ÏîÀ§ÄѶøÓÖÁîÈ˷ѽâµÄÈÎÎñ£¬ Òò´ËÈËÃÇ¿ª·¢ÁËһϵÁÐÇ¿´óµÄ¹¤¾ß£¬
      À´ÈùÜÀíÔ±µÄ¹¤×÷±äµÃ¸ü¼Ó¼òµ¥¡£ ÕâЩ¸Ä½øͨ³£ÊÇÈÃϵͳÄܹ»ÒÔ¸ü¼òµ¥µÄ·½Ê½°²×°¡¢
      ÅäÖ㬠²¢ºÁÎÞÎÊÌâµØ³ÖÐøÔËת¡£ ÕâÆäÖУ¬ Ðí¶à¹ÜÀíԱϣÍûÄܹ»ÎªÏµÍ³ÕýÈ·µØ½øÐа²È«·½ÃæµÄÅäÖã¬
      ʹÆäÄܹ»ÓÃÓÚÕæÕýµÄÓÃ;£¬ ¶ø×èÖ¹°²È«·½ÃæµÄ·çÏÕ¡£</para>

    <para>&os; ϵͳÌṩµÄÒ»ÏîÓÃÓÚ¸ÄÉÆ°²È«µÄ¹¤¾ß¾ÍÊÇ <emphasis>jail</emphasis>¡£
      jail ÊÇÔÚ &os;&nbsp;4.X ÖÐÓÉ &a.phk; ÒýÈëµÄ£¬ ËüÔÚ
      &os;&nbsp;5.X ÖÐÓÖ½øÐÐÁËһϵÁиĽø£¬ ʹµÃËü³ÉΪÁËÒ»¸öÇ¿´ó¶øÁé»îµÄϵͳ¡£
      Ä¿Ç°ÈÔÈ»ÔÚ¶ÔÆä½øÐгÖÐøµÄ¿ª·¢£¬ ÒÔÌá¸ßÆä¿ÉÓÃÐÔ¡¢ ÐÔÄܺͰ²È«ÐÔ¡£</para>

    <sect2 id="jails-what">
      <title>Jail ÊÇʲô</title>

      <para>BSD-ÀàµÄ²Ù×÷ϵͳ´Ó 4.2BSD ¿ªÊ¼¼´ÌṩÁË &man.chroot.8;¡£
	&man.chroot.2; ¹¤¾ßÄܹ»¸Ä±äÒ»×é½ø³ÌµÄ¸ùĿ¼µÄλÖã¬
	´Ó¶ø½¨Á¢Ò»¸öÓëϵͳÖÐÆäËû²¿·ÖÏà¸ôÀëµÄ°²È«»·¾³£º ÔÚ chroot »·¾³ÖеĽø³Ì£¬
	½«ÎÞ·¨·ÃÎÊÆäÍâµÄÎļþ»òÆäËû×ÊÔ´¡£ ÕýÊÇÓÉÓÚÕâÖÖÄÜÁ¦£¬
	¼´Ê¹¹¥»÷Õß¹¥ÆÆÁËijһ¸öÔËÐÐÓÚ chroot »·¾³µÄ·þÎñ£¬ Ò²²»Äܹ¥ÆÆÕû¸öϵͳ¡£
	&man.chroot.8; ¶ÔÓÚÄÇЩ²»ÐèÒªºÜ¶àÁé»îÐÔ»ò¸´Ôӵĸ߼¶¹¦Äܵļòµ¥Ó¦ÓöøÑÔÏ൱ºÃÓá£
	ÁíÍ⣬ ÔÚÒýÈë chroot ¸ÅÄîµÄ¹ý³ÌÖУ¬ Ôø¾­·¢ÏÖ¹ýÐí¶àÌø³ö
	chroot »·¾³µÄ·½·¨£¬ ¾¡¹ÜÕâЩÎÊÌâÔÚ½ÏÐ嵀 &os; °æ±¾ÖÐÒѾ­ÐÞÕý£¬ µ«ºÜÃ÷ÏԵأ¬
	&man.chroot.8; ²¢²»ÊÇÒ»ÏîÓÃÓڼӹ̷þÎñ°²È«µÄÀíÏë½â¾ö·½°¸¡£
	Òò´Ë£¬ ±ØÐëʵÏÖÒ»¸öеÄ×ÓϵͳÀ´½â¾öÕâЩÎÊÌâ¡£</para>

      <para>Õâ¾ÍÊÇΪʲôҪ¿ª·¢
	<emphasis>jail</emphasis> ×îÖ÷ÒªµÄÔ­Òò¡£</para>

      <para>Jail ÒÔ¶àÖÖ·½Ê½¸Ä½øÁË´«Í³µÄ
	&man.chroot.2; »·¾³¸ÅÄî¡£ ÔÚ´«Í³µÄ
	&man.chroot.2; »·¾³ÖУ¬ Ö»ÏÞÖÆÁ˽ø³ÌÄܹ»·ÃÎÊÎļþϵͳµÄÄÄЩ²¿·Ö¡£
	ÆäËû²¿·ÖµÄϵͳ×ÊÔ´ (ÀýÈçϵͳÓû§¡¢ ÕýÔÚÔËÐеĽø³Ì£¬ ÒÔ¼°ÍøÂç×Óϵͳ)
	ÊÇÓÉ chroot ½ø³ÌÓëËÞÖ÷ϵͳÖеÄÆäËû½ø³Ì¹²ÏíµÄ¡£ jail À©Õ¹ÁËÕâ¸öÄ£ÐÍ£¬
	Ëü²»½ö½«ÎļþϵͳµÄ·ÃÎÊÐéÄ⻯£¬ ¶øÇÒ»¹½«Óû§¡¢ &os; µÄÍøÂç×Óϵͳ£¬
	ÒÔ¼°Ò»Ð©ÆäËûϵͳ×ÊÔ´ÐéÄ⻯¡£ ¹ØÓÚÕâЩ¾«Ï¸¿ØÖÆÒÔ¼°µ÷Õû jail
	»·¾³·ÃÎÊÄÜÁ¦µÄ¸ü¾ßÌåµÄ½éÉÜ£¬ ¿É²Î¼û <xref
	  linkend="jails-tuning">¡£</para>

      <para>jail ¾ßÓÐÒÔÏÂËÄÏîÌص㣺</para>

      <itemizedlist>
	<listitem>
	  <para>Ŀ¼×ÓÊ÷ &mdash; ½øÈë jail µÄÆðµã¡£ Ò»µ©½øÈëÁË jail£¬
	    ½ø³Ì¾Í²»ÔÙ±»ÔÊÐí·ÃÎÊÕâ¿Ã×ÓÊ÷ÒÔÍâµÄ¶ÔÏó¡£ ´«Í³ÉÏÓ°Ïìµ½×î³õ
	    &man.chroot.2; Éè¼ÆµÄ°²È«ÎÊÌâ²»»áÓ°Ïì &os; jail¡£</para>
	</listitem>

	<listitem>
	  <para>Ö÷»úÃû &mdash; ½«ÓÃÓÚ jail µÄÖ÷»úÃû¡£ jail Ö÷ÒªÓÃÓÚ´æ·ÅÍøÂç·þÎñ£¬
	    Òò´ËÔÚÿ¸ö mail ÉÏÄܹ»±ê×¢Ò»¸öÓÐÒâÒåµÄÖ÷»úÃû£¬
	    Äܹ»Ôںܴó³Ì¶ÈÉϼò»¯ÏµÍ³¹ÜÀíÔ±µÄ¹¤×÷¡£</para>
	</listitem>

	<listitem>
	  <para><acronym>IP</acronym> µØÖ· &mdash; Õâ¸öµØÖ·ÊÇÖ¸¶¨¸ø jail µÄ£¬
	    ÔÚ jail µÄÉúÃüÖÜÆÚÄÚ¶¼ÎÞ·¨¸Ä±ä¡£ ͨ³£ jail µÄ IP µØÖ·ÊÇijһ¸öÍøÂç½Ó¿ÚÉϵıðÃûµØÖ·£¬
	    µ«Õâ²¢²»ÊDZØÐèµÄ¡£</para>
	</listitem>

	<listitem>
	  <para>ÃüÁî &mdash; ×¼±¸ÔÚ jail ÖÐÖ´ÐеĿÉÖ´ÐÐÎļþµÄÍêÕû·¾¶Ãû¡£
	    Õâ¸öÃüÁîÊÇÏà¶ÔÓÚ jail »·¾³µÄ¸ùĿ¼µÄ£¬ Ëæ jail »·¾³µÄÀàÐͲ»Í¬£¬
	    ¿ÉÄÜ»áÓкܶ಻֮ͬ´¦¡£</para>
	</listitem>
      </itemizedlist>

      <para>³ýÁËÕâЩ֮Í⣬ jail Ò²¿ÉÒÔÓµÓÐ×Ô¼ºµÄÓû§ºÍ×Ô¼ºµÄ
	<username>root</username> Óû§¡£ ×ÔÈ»£¬ ÕâÀïµÄ <username>root</username>
	Óû§µÄȨÁ¦»áÊÜÏÞÓÚ jail »·¾³£¬ ²¢ÇÒ£¬ ´ÓËÞÖ÷ϵͳµÄ¹Ûµã¿´À´£¬
	jail <username>root</username> Óû§²¢²»ÊÇÒ»¸öÎÞËù²»ÄܵÄÓû§¡£
	´ËÍ⣬ jail ÖÐµÄ <username>root</username> Óû§²»ÄÜÖ´ÐгýÁËÆä¶ÔÓ¦ &man.jail.8;
	»·¾³Ö®ÍâµÄϵͳÖеÄһЩ¹Ø¼ü²Ù×÷¡£ ¹ØÓÚ
	<username>root</username> Óû§µÄÄÜÁ¦ºÍÏÞÖÆ£¬ ÔÚºóÃæµÄ <xref
	  linkend="jails-tuning"> Öн«¼ÓÒÔ½éÉÜ¡£</para>
    </sect2>
  </sect1>

  <sect1 id="jails-build">
    <title>½¨Á¢ºÍ¿ØÖÆ jail</title>

    <para>һЩϵͳ¹ÜÀíԱϲ»¶½« jail ·ÖΪÁ½Àࣺ
      <quote>ÍêÕûµÄ</quote> jail£¬ ͨ³£°üº¬ÕæÕýµÄ &os; ϵͳ£¬
      ÒÔ¼° <quote>·þÎñ</quote> jail£¬ רÓÃÓÚÖ´ÐÐÒ»¸ö¿ÉÄÜʹÓÃÌØȨµÄÓ¦Óûò·þÎñ¡£
      ÕâÖ»ÊÇÒ»ÖÖ¸ÅÄîÉϵÄÇø·Ö£¬ ²¢²»Ó°ÏìÈçºÎ½¨Á¢ jail µÄ¹ý³Ì¡£
      ÔÚÁª»úÊÖ²á &man.jail.8; ÖжÔÈçºÎ´´½¨ jail ½øÐÐÁËÇåÎúµÄ²ûÊö£º</para>

      <screen>&prompt.root; <userinput>setenv D <replaceable>/here/is/the/jail</replaceable></userinput>
&prompt.root; <userinput>mkdir -p $D</userinput> <co id="jailpath">
&prompt.root; <userinput>cd /usr/src</userinput>
&prompt.root; <userinput>make buildworld</userinput> <co id="jailbuildworld">
&prompt.root; <userinput>make installworld DESTDIR=$D</userinput> <co id="jailinstallworld">
&prompt.root; <userinput>cd etc/</userinput> <footnote><para>ÔÚ &os; 6.0 ¼°
Ö®ºóµÄ°æ±¾Öв»±ØÐë½øÐÐÕâ¸ö²½Öè¡£</para></footnote>
&prompt.root; <userinput>make distribution DESTDIR=$D</userinput> <co id="jaildistrib">
&prompt.root; <userinput>mount -t devfs devfs $D/dev</userinput> <co id="jaildevfs"></screen>

    <calloutlist>
      <callout arearefs="jailpath">
	<para>µÚÒ»²½¾ÍÊÇΪ jail Ñ¡ÔñÒ»¸öλÖᣠÕâ¸ö·¾¶ÊÇÔÚËÞÖ÷ϵͳÖÐ jail
	  µÄÎïÀíλÖᣠһÖÖ³£ÓõÄÑ¡ÔñÊÇ <filename
	    class="directory">/usr/jail/<replaceable>jailname</replaceable></filename>£¬
	  ´Ë´¦ <replaceable>jailname</replaceable> ÊÇ jail µÄÖ÷»úÃû¡£ <filename
	    class="directory">/usr/</filename> Îļþϵͳͨ³£»áÓÐ×ã¹»µÄ¿Õ¼äÀ´±£´æ jail
	  Îļþϵͳ£¬ ¶ÔÓÚ <quote>ÍêÕû</quote> µÄ jail ¶øÑÔ£¬
	  Ëüͨ³£°üº¬ÁË &os; ĬÈÏ°²×°µÄ»ù±¾ÏµÍ³ÖÐÿ¸öÎļþµÄ¸±±¾¡£</para>
      </callout>

      <callout arearefs="jailbuildworld">
        <para>Èç¹ûÄãÒѾ­Í¨¹ýʹÓà <command>make world</command>
          »òÕß <command>make buildworld</command> ÖØбàÒë¹ýÁËÄãµÄ userland£¬
          Ôò¿ÉÒÔÌø¹ýÕâÒ»²½Öè²¢°ÑÏÖÓÐµÄ userland °²×°½øÐ嵀 jail¡£</para>
      </callout>

      <callout arearefs="jailinstallworld">
	<para>Õâ¸öÃüÁÔÚ jail Ŀ¼Öа²×°ËùÐèµÄ¿ÉÖ´ÐÐÎļþ¡¢
          º¯Êý¿âÒÔ¼°Áª»úÊÖ²áµÈ¡£</para>
      </callout>

      <callout arearefs="jaildistrib">
	<para><maketarget>distribution</maketarget> Õâ¸ö
	  <application>make</application> target ½«°²×°È«²¿ÅäÖÃÎļþ£¬
	  »òÕß»»¾ä»°Ëµ£¬ ¾ÍÊǽ«
	  <filename class="directory">/usr/src/etc/</filename> ¸´ÖƵ½ jail »·¾³ÖеÄ
	  <filename class="directory">/etc</filename>£º
	  <filename class="directory">$D/etc/</filename>¡£</para>
      </callout>

      <callout arearefs="jaildevfs">
	<para>ÔÚ jail Öв»ÊDZØÐëÒª¹Ò½Ó &man.devfs.8; Îļþϵͳ¡£
	  ¶øÁíÒ»·½Ã棬 ¼¸ºõËùÓеÄÓ¦ÓóÌÐò¶¼»áÐèÒª·ÃÎÊÖÁÉÙÒ»¸öÉ豸£¬
	  ÕâÖ÷Ҫȡ¾öÓÚÓ¦ÓóÌÐòµÄÐÔÖʺÍÄ¿µÄ¡£ ¿ØÖÆ jail ÖÐÄܹ»·ÃÎʵÄÉ豸·Ç³£ÖØÒª£¬
	  ÒòΪ²»ÕýÈ·µÄÅäÖ㬠ºÜ¿ÉÄÜÔÊÐí¹¥»÷ÕßÔÚ
	  jail ÖнøÐÐһЩ¶ñÒâµÄ²Ù×÷¡£ ͨ¹ý &man.devfs.8; ʵʩµÄ¿ØÖÆ£¬
	  ¿ÉÒÔͨ¹ýÓÉÁª»úÊÖ²á &man.devfs.8; ºÍ
	  &man.devfs.conf.5; ½éÉܵĹæÔò¼¯ÅäÖÃÀ´ÊµÏÖ¡£</para>
      </callout>
    </calloutlist>

    <para>Ò»µ©×°ºÃÁË jail£¬ ¾Í¿ÉÒÔʹÓÃ
      &man.jail.8; ¹¤¾ßÀ´°²×°ËüÁË¡£ &man.jail.8; ¹¤¾ßÐèÒªËĸö±ØÌî²ÎÊý£¬
      ÕâЩ²ÎÊýÔÚ <xref
	linkend="jails-what"> ÖнøÐÐÁ˽éÉÜ¡£ ³ýÁËÕâËĸö²ÎÊýÖ®Í⣬
      Äú»¹¿ÉÒÔÖ¸¶¨Ò»Ð©ÆäËû²ÎÊý£¬ ÀýÈ磬 ÒÔÌض¨Óû§Éí·ÝÀ´ÔÚ jail ÖÐÔËÐгÌÐòµÈµÈ¡£
      ÕâÀ  <option><replaceable>command</replaceable></option> ²ÎÊýÈ¡¾öÓÚÄúÏ£Íû½¨Á¢µÄ jail
      µÄÀàÐÍ£» ¶ÔÓÚ <emphasis>ÐéÄâϵͳ</emphasis>£¬ ¿ÉÒÔÑ¡Ôñ
      <filename>/etc/rc</filename>£¬ ÒòΪËü»áÍê³ÉÕæÕýµÄ &os; ϵͳÆô¶¯ËùÐèµÄ²Ù×÷¡£ ¶ÔÓÚ
      <emphasis>·þÎñ</emphasis> jail£¬ Ö´ÐеÄÃüÁîÈ¡¾öÓÚ½«ÔÚ jail
      ÖÐÔËÐеÄÓ¦ÓóÌÐò¡£</para>

    <para>Jail ͨ³£Ó¦ÔÚϵͳÆô¶¯Ê±Æô¶¯£¬ Òò´Ë£¬ &os;
      <filename>rc</filename> »úÖÆÌṩÁËһЩºÜ·½±ãµÄ»úÖÆÀ´¼ò»¯ÕâЩ¹¤×÷¡£</para>

    <procedure>
      <step>
	<para>ÔÚÒýµ¼Ê±ÐèÒªÆô¶¯µÄ jail ÁбíӦдÈë &man.rc.conf.5; Îļþ£º</para>

	<programlisting>jail_enable="YES"   # Èç¹ûÉèΪ NO Ôò±íʾ²»×Ô¶¯Æô¶¯ jail
jail_list="<replaceable>www</replaceable>"     # ÒÔ¿Õ¸ñ·Ö¸ôµÄ jail Ãû×ÖÁбí</programlisting>
      </step>

      <step>
	<para>¶ÔÓÚ <varname>jail_list</varname> ÖÐÁгöµÄ jail£¬
	  »¹Ó¦Ö¸¶¨Ò»ÏµÁжÔÓ¦µÄ &man.rc.conf.5; ÉèÖ㬠ÓÃÒÔÃèÊö¾ßÌåµÄ jail£º</para>

	<programlisting>jail_<replaceable>www</replaceable>_rootdir="/usr/jail/www"     # jail µÄ¸ùĿ¼
jail_<replaceable>www</replaceable>_hostname="<replaceable>www</replaceable>.example.org"   # jail µÄÖ÷»úÃû
jail_<replaceable>www</replaceable>_ip="192.168.0.10"          # jail µÄ IP µØÖ·
jail_<replaceable>www</replaceable>_devfs_enable="YES"          # ÔÚ jail ÖÐ¹Ò½Ó devfs
jail_<replaceable>www</replaceable>_devfs_ruleset="<replaceable>www_ruleset</replaceable>" # ÔÚ jail ÖÐÓ¦ÓõÄdevfs ¹æÔò¼¯</programlisting>

	<para>ĬÈÏÇé¿öÏ£¬ ÔÚ
	  &man.rc.conf.5; ÖÐÅäÖÃÆô¶¯µÄ jail »áÖ´ÐÐÆäÖÐµÄ <filename>/etc/rc</filename>
	  ½Å±¾£¬ Ò²¾ÍÊÇ˵£¬ ĬÈÏÇé¿öϽ« jail ×÷ΪÐéÄâϵͳ·½Ê½À´Æô¶¯¡£
	  ¶ÔÓÚ·þÎñ jail£¬ ÄúÓ¦ÁíÍâÖ¸¶¨Æô¶¯ÃüÁ ·½·¨ÊÇÉèÖöÔÓ¦µÄ
	  <varname>jail_<replaceable>jailname</replaceable>_exec_start</varname>
	  ÅäÖá£</para>

	<note>
	  <para>ÈçÓûÁ˽âÈ«²¿¿ÉÓõÄÑ¡Ï Çë²ÎÔÄÁª»úÊÖ²á
	    &man.rc.conf.5;¡£</para>
	</note>
      </step>
    </procedure>

    <para><filename>/etc/rc.d/jail</filename> ½Å±¾Ò²¿ÉÒÔÓÃÓÚÊÖ¹¤Æô¶¯»òÍ£Ö¹
      <filename>rc.conf</filename> ÖÐÅäÖÃµÄ jail£º</para>

    <screen>&prompt.root; <userinput>/etc/rc.d/jail start <replaceable>www</replaceable></userinput>
&prompt.root; <userinput>/etc/rc.d/jail stop <replaceable>www</replaceable></userinput></screen>

    <para>Ä¿Ç°£¬ ÉÐûÓÐÒ»ÖÖ·½·¨À´ºÜ¸É¾»µØ¹Ø±Õ &man.jail.8;¡£
      ÕâÊÇÒòΪͨ³£ÓÃÓÚÕý³£¹Ø±ÕϵͳµÄÃüÁ Ä¿Ç°Éв»ÄÜÔÚ jail ÖÐʹÓá£
      Ä¿Ç°£¬ ¹Ø±Õ jail ×îºÃµÄ·½Ê½£¬ ÊÇÔÚ jail Íâͨ¹ý &man.jexec.8; ¹¤¾ß£¬
      ÔÚ jail ÖÐÖ´ÐÐÏÂÁÐÃüÁ</para>

    <screen>&prompt.root; <userinput>sh /etc/rc.shutdown</userinput></screen>

    <para>¸ü½øÒ»²½µÄÏêϸ˵Ã÷£¬ Çë²Î¼ûÁª»úÊÖ²á &man.jail.8;¡£</para>
  </sect1>

  <sect1 id="jails-tuning">
    <title>΢µ÷ºÍ¹ÜÀí</title>

    <para>Äú¿ÉÒÔΪ jail ÉèÖÃÐí¶à²»Í¬µÄÑ¡Ï ²¢Èà &os; ËÞÖ÷ϵͳÒÔ²»Í¬µÄ·½Ê½Óë jail ½»»¥£¬
      ÒÔÖ§³Ö¸ü¸ß¼¶±ðµÄÓ¦ÓᣠÕâÒ»½Ú½«½éÉÜ£º</para>

    <itemizedlist>
      <listitem>
	<para>һЩÓÃÓÚ΢µ÷ jail ÐÐΪºÍ°²È«ÏÞÖƵÄÑ¡Ïî¡£</para>
      </listitem>

      <listitem>
	<para>һЩ¿ÉÒÔͨ¹ý &os; Ports Ì×¼þ°²×°µÄ¸ß¼¶ jail ¹ÜÀíÓ¦ÓóÌÐò£¬
	  ÕâЩ³ÌÐò¿ÉÒÔÓÃÓÚʵÏÖÒ»°ãµÄ»ùÓÚ jail µÄ½â¾ö·½°¸¡£</para>
    </itemizedlist>

    <sect2 id="jails-tuning-utilities">
      <title>&os; ÌṩµÄÓÃÓÚ΢µ÷ jail µÄϵͳ¹¤¾ß</title>

      <para>¶ÔÓÚ jail µÄÅäÖÃ΢µ÷£¬ »ù±¾É϶¼ÊÇͨ¹ýÉèÖà &man.sysctl.8; ±äÁ¿À´Íê³ÉµÄ¡£
	ϵͳÌṩÁËÒ»¸öÌØÊâµÄ sysctl ×ÓÊ÷£¬ È«²¿Ïà¹ØµÄÑ¡Ïî¾ùÔÚÕâ¿Ã×ÓÊ÷ÖУ» Õâ¾ÍÊÇ &os; Äں˵Ä
	<varname>security.jail.*</varname> Ñ¡Ïî×ÓÊ÷¡£ ÏÂÃæÊÇÓë jail ÓйصÄÖ÷Òª sysctl£¬
	ÒÔ¼°ÕâЩ±äÁ¿µÄĬÈÏÖµ¡£ ÕâЩÃû×Ö¶¼±È½ÏÈÝÒ×Àí½â£¬ ÈçÓûÁ˽â½øÒ»²½µÄÏêÇ飬
	Çë²ÎÔÄÁª»úÊÖ²á &man.jail.8; ºÍ &man.sysctl.8;¡£</para>

      <itemizedlist>
	<listitem>
	  <para><varname>security.jail.set_hostname_allowed:
	     1</varname></para>
	</listitem>

	<listitem>
	  <para><varname>security.jail.socket_unixiproute_only:
	     1</varname></para>
	</listitem>

	<listitem>
	  <para><varname>security.jail.sysvipc_allowed:
	     0</varname></para>
	</listitem>

	<listitem>
	  <para><varname>security.jail.enforce_statfs:
	     2</varname></para>
	</listitem>

	<listitem>
	  <para><varname>security.jail.allow_raw_sockets:
	     0</varname></para>
	</listitem>

	<listitem>
	  <para><varname>security.jail.chflags_allowed:
	    0</varname></para>
	</listitem>

	<listitem>
	  <para><varname>security.jail.jailed: 0</varname></para>
	</listitem>
      </itemizedlist>

      <para>ϵͳ¹ÜÀíÔ±¿ÉÒÔÔÚ <emphasis>ËÞÖ÷ϵͳ</emphasis> ÖУ¬
	͸¹ýÉèÖÃÕâЩ±äÁ¿µÄÖµÀ´Ä¬ÈÏΪ
	<username>root</username> Óû§Ôö¼Ó»òÈ¡ÏûÏÞÖÆ¡£ ÐèҪעÒâµÄÊÇ£¬
	ijЩÏÞÖÆÊDz»Äܹ»È¡ÏûµÄ¡£ ÔÚ  &man.jail.8; ÖеÄ
	<username>root</username> Óû§£¬ ÎÞ·¨¹ÒÔØ»òжÏÂÎļþϵͳ£¬ ´ËÍâÔÚ jail ÖеÄ
	<username>root</username> Óû§Ò²²»ÄܼÓÔØ»òжÔØ
	&man.devfs.8; ¹æÔò¼¯¡¢ ÅäÖ÷À»ðǽ¹æÔò£¬ »òÖ´ÐÐÆäËûÐèÒªÐÞ¸ÄÄÚºËÊý¾ÝµÄ¹ÜÀí²Ù×÷£¬
	ÀýÈçÉèÖÃÄÚºËµÄ <varname>securelevel</varname> µÈµÈ¡£</para>

      <para>&os; µÄ»ù±¾ÏµÍ³°üº¬Ò»ÏµÁÐÓÃÓڲ鿴ĿǰÔÚʹÓÃµÄ jail ÐÅÏ¢£¬ ÒÔ¼°½ÓÈë
	jail ²¢Ö´ÐйÜÀíÃüÁîËùÐèµÄ»ù±¾¹¤¾ß¡£ &man.jls.8; ºÍ
	&man.jexec.8; ÃüÁÊÇ &os; »ù±¾ÏµÍ³µÄÒ»²¿·Ö£¬ ²¢¿ÉÓÃÓÚÖ´Ðмòµ¥µÄÈÎÎñ£º</para>

      <itemizedlist>
	<listitem>
	  <para>ÁгöÔÚÓÃµÄ jail ÒÔ¼°¶ÔÓ¦µÄ
	    jail ±êʶ (<acronym>JID</acronym>)¡¢
	    <acronym>IP</acronym> µØÖ·¡¢ Ö÷»úÃûºÍ·¾¶¡£</para>
	</listitem>

	<listitem>
	  <para>´ÓËÞÖ÷ϵͳÖнÓÈëÕýÔÚÔËÐÐµÄ jail£¬ ²¢ÔÚÆäÖÐÖ´ÐÐÃüÁ ÒÔÍê³ÉһϵÁÐ
	    jail ¹ÜÀíÈÎÎñ¡£ ÕâÔÚ
	    <username>root</username> Ï£Íû¸É¾»µØ¹Ø±Õ
	    jail ʱ·Ç³£ÓÐÓᣠ&man.jexec.8; ¹¤¾ßÒ²¿ÉÒÔÓÃÓÚÔÚ jail ÖÐÆô¶¯
	    shell ÒÔ±ã¶ÔÆä½øÐйÜÀí£» ÀýÈ磺</para>

	  <screen>&prompt.root; <userinput>jexec <replaceable>1</replaceable> tcsh</userinput></screen>
	</listitem>
      </itemizedlist>
    </sect2>

    <sect2 id="jails-tuning-admintools">
      <title>ÓÉ &os; Ports Ì×¼þÌṩµÄ¸ß¼¶¹ÜÀí¹¤¾ß</title>

    <para>ÔÚÖÚ¶àµÚÈý·½ jail ¹ÜÀí¹¤¾ßÖУ¬ <filename
	role="package">sysutils/jailutils</filename> ÊÇ×îÍêÕûºÍºÃÓõġ£ 
      ËüÊÇһϵÁз½±ã &man.jail.8; ¹ÜÀíµÄС¹¤¾ß¡£ Çë²Î¼ûÆäÍøÕ¾ÒÔÁ˽â½øÒ»²½µÄÏêÇé¡£</para>
    </sect2>
  </sect1>

  <sect1 id="jails-application">
    <title>Jail µÄÓ¦ÓÃ</title>

    <sect2 id="jails-service-jails">
      <sect2info>
	<authorgroup>
	  <author>
	    <firstname>Daniel</firstname>
	    <surname>Gerzo</surname>
	    <contrib>Ô­×÷ </contrib>
	    <!-- 15. May 2007 -->
	  </author>
	</authorgroup>
      </sect2info>

      <title>·þÎñ Jail</title>

      <para>ÕâÒ»½ÚÖ÷Òª»ùÓÚ
	&a.simon; µÄ <ulink
	url="http://simon.nitro.dk/service-jails.html"></ulink> ÖеÄ˼·£¬
	ÒÔ¼°ÓÉ Ken Tom
	<email>locals@gmail.com</email> ¸üеÄÎĵµ¡£ ÕâÒ»½ÚÖÐÃèÊöÁËÈçºÎÅäÖÃ
	&os; ϵͳµÄ &man.jail.8; ¹¦ÄÜΪÆäÔö¼ÓÒ»¸ö°²È«²ã´Î¡£
	Õⲿ·Ö¼Ù¶¨ÄúÔËÐÐ RELENG_6_0 »ò¸üа汾£¬ ²¢Àí½â±¾ÕÂ֮ǰ²¿·ÖµÄÄÚÈÝ¡£</para>

      <sect3 id="jails-service-jails-design">
       <title>Éè¼Æ</title>

	<para>jail µÄÒ»¸öÖ÷ÒªÎÊÌâÊÇÈçºÎ¶ÔËüÃǽøÐÐÉý¼¶ºÍ¹ÜÀí¡£
	  ÓÉÓÚÿ¸ö jail ¶¼ÊÇ´ÓÍ·Áª±àµÄ£¬ ¶ÔÓÚµ¥¸ö jail ¶øÑÔÉý¼¶Ò²Ðí»¹²»ÊǸöºÜÑÏÖصÄÎÊÌ⣬
	  ÒòΪÉý¼¶²»»áÌ«¹ýÂé·³£¬ ¶ø¶ÔÓÚ¶à¸ö jail ¶øÑÔ£¬ Éý¼¶²»½ö»áºÄ·Ñ´óÁ¿Ê±¼ä£¬
	  ²¢ÇÒÊÇÊ®·Ö·¦Î¶µÄ¹ý³Ì¡£</para>

	<warning>
	  <para>Õâ¸öÅäÖùý³ÌÐèÒªÄú¶Ô &os; Óн϶àµÄÅäÖúÍʹÓþ­Ñé¡£
	    Èç¹ûÕâЩ¹ý³ÌÏÔµÃÌ«¹ý¸´ÔÓ£¬ ÄúÓ¦¿¼ÂÇʹÓýϼòµ¥µÄϵͳ£¬ ÀýÈç <filename
	      role="package">sysutils/ezjail</filename>£¬
	    ËüÌṩÁ˸ü¼òµ¥µÄ¹ÜÀí &os; jail µÄ·½·¨¡£</para>
	</warning>

	<para>»ù±¾µÄÏë·¨ÊÇ£¬ ÔÚ²»Í¬µÄ jail Öо¡¿ÉÄܶàµØÒÔ°²È«µÄ·½Ê½Ê¹Óù²ÏíµÄ×ÊÔ´
	  &mdash; ʹÓÃÖ»¶ÁµÄ &man.mount.nullfs.8; ¹Ò½Ó£¬ Õâ»áÈÃÉý¼¶¼òµ¥Ðí¶à£¬
	  ´Ó¶øʹΪÿ¸ö·þÎñ½¨Á¢²»Í¬µÄ jail ÕâÖÖ·½°¸±äµÃ¸ü¼Ó¿ÉÐС£ ÁíÍ⣬
	  ËüҲΪÔö¼Ó¡¢É¾³ýÒÔ¼°Éý¼¶ jail ÌṩÁ˸üΪ±ã½ÝµÄ·½·¨¡£</para>

	<note>
	  <para>ÔÚÕâÀï·þÎñµÄ³£¼ûÀý×Ó°üÀ¨£º
	  <acronym>HTTP</acronym> ·þÎñ¡¢ <acronym>DNS</acronym>
	  ·þÎñ¡¢ <acronym>SMTP</acronym> ·þÎñµÈµÈ£¬ ÖîÈç´ËÀà¡£</para>
	</note>

	<para>Õâ½Ú½éÉܵÄÅäÖõÄÄ¿µÄ°üÀ¨£º</para>

	<itemizedlist>
	  <listitem>
	    <para>½¨Á¢¼òµ¥²¢Ò×ÓÚÀí½âµÄ jail ½á¹¹¡£
	      Ò²¾ÍÊÇ˵ <emphasis>²»±Ø</emphasis> Ϊÿ¸ö jail Ö´ÐÐÍêÕûµÄ
	      installworld ²Ù×÷¡£</para>
	  </listitem>
	  <listitem>
	    <para>ʹÔöɾ jail ¸üÈÝÒס£</para>
	  </listitem>
	  <listitem>
	    <para>ʹ¸üлòÉý¼¶ jail ¸üÈÝÒס£</para>
	  </listitem>
	  <listitem>
	    <para>ʹÔËÐÐ×Ô¶©µÄ &os; ·ÖÖ§³ÉΪ¿ÉÄÜ¡£</para>
	  </listitem>
	  <listitem>
	    <para>¶Ô°²È«µÄ¸üÆ«Ö´µÄ×·Çó£¬ ¾¡¿ÉÄܼõÉÙ±»¹¥ÏݵĿÉÄÜ¡£</para>
	  </listitem>
	  <listitem>
	    <para>¾¡¿ÉÄܽÚÊ¡¿Õ¼äºÍ inode¡£</para>
	  </listitem>
	</itemizedlist>

	<para>ÈçÇ°ÃæÌáµ½µÄÄÇÑù£¬ Õâ¸öÉè¼Æ¼«´ó³Ì¶ÈÉÏÒÀÀµÓÚ½«Ò»·ÝÖ»¶ÁµÄÖ÷Ä£°å
	  (known as <application>nullfs</application>) ¹Ò½Óµ½Ã¿Ò»¸ö
	  jail ÖУ¬ ²¢ÎªÃ¿¸ö jail ÅäÖÃÒ»¸ö¿É¶ÁдµÄÉ豸¡£ ÕâÖÖÉ豸¿ÉÒÔÊÇÎïÀí´ÅÅÌ¡¢
	  ·ÖÇø£¬ »òÒÔ vnode Ϊºó¶ËµÄ
	  &man.md.4; É豸¡£ ÔÚÕâ¸öÀý×ÓÖУ¬ ÎÒÃǽ«Ê¹ÓÿɶÁдµÄ
	  <application>nullfs</application> ¹Ò½Ó¡£</para>

	<para>ÏÂÃæµÄ±íÖÐÃèÊöÁËÎļþϵͳ¸ñ¾Ö£º</para>

	<itemizedlist>
	  <listitem>
	    <para>ÿ¸ö jail ¹Ò½Óµ½ <filename
	      class="directory">/home/j</filename> Ŀ¼ÏµÄÒ»¸öĿ¼¡£</para>
	  </listitem>
	  <listitem>
	    <para><filename class="directory">/home/j/mroot</filename>
	      ÊÇÿ¸ö jail ¹²ÓõÄÄ£°å£¬ ¶ÔÓÚËùÓÐµÄ jail ¶øÑÔ¶¼ÊÇÖ»¶ÁµÄ¡£</para>
	  </listitem>
	  <listitem>
	    <para>ÔÚ <filename class="directory">/home/j</filename>
	      Ŀ¼ÖУ¬ ÿ¸ö jail ÓÐÒ»¸ö¶ÔÓ¦µÄ¿ÕĿ¼¡£</para>
	  </listitem>
	  <listitem>
	    <para>ÿ¸ö jail Öж¼ÓÐÒ»¸ö <filename
		class="directory">/s</filename> Ŀ¼£¬ Õâ¸öĿ¼½«Á¬½Óµ½ÏµÍ³ÖеĿɶÁд²¿·Ö¡£</para>
	  </listitem>
	  <listitem>
	    <para>ÿ¸ö jail Ó¦»ùÓÚ <filename
		class="directory">/home/j/skel</filename> ½¨Á¢Æä¿É¶Áд¿Õ¼ä¡£</para>
	  </listitem>
	  <listitem>
	    <para>ÿ¸ö jailspace (jail ÖеĿɶÁд²¿·Ö) Ó¦´´½¨µ½ <filename
		class="directory">/home/js</filename>¡£<para>
	  </listitem>
	</itemizedlist>

	<note>
	  <para>Õâ¼Ù¶¨ËùÓÐµÄ jail ¶¼·ÅÖÃÓÚ
	    <filename class="directory">/home</filename> ·ÖÇøÖС£ µ±È»£¬
	    Äú¿ÉÒÔ¸ù¾ÝÐèÒª½«Õâ¸öÅäÖøÄΪÐèÒªµÄÈκÎÑù×Ó£¬
	    µ«ÔÚ½ÓÏÂÀ´µÄÀý×ÓÖУ¬ Ò²Ó¦ÏàÓ¦µØ¼ÓÒԱ䶯¡£</para>
	</note>
	<!-- Insert an image or drawing here to illustrate the example. -->
      </sect3>

      <sect3 id="jails-service-jails-template">
	<title>½¨Á¢Ä£°å</title>

	<para>ÕâÒ»½Ú½«½éÉÜ´´½¨ jail ËùÐèµÄÖ»¶ÁÖ÷Ä£°åËùÐèµÄ²½Öè¡£<para>

	<para>Ò»°ãÀ´Ëµ£¬ ÄúÓ¦½«ÏµÍ³Éý¼¶µ½×îÐ嵀 &os; -RELEASE ·ÖÖ§£¬ ¾ßÌå×ö·¨Çë²Î¼û±¾ÊÖ²áµÄÏà¹Ø
	  <ulink url="&url.books.handbook;/makeworld.html">Õ½Ú</ulink>¡£
	  µ±¸üв»¿ÉÐÐʱ£¬ ÔòÐèÒªÍê³É buildworld ¹ý³Ì£¬ ÁíÍ⣬ Äú»¹ÐèÒª <filename
	    role="package">sysutils/cpdup</filename> Èí¼þ°ü¡£
	  ÎÒÃǽ«Ê¹Óà &man.portsnap.8; ¹¤¾ßÀ´ÏÂÔØ &os; Ports Ì×¼þ¡£ ÔÚʹÓÃÊÖ²áµÄ <ulink
	    url="&url.books.handbook;/portsnap.html">Portsnap Õ½Ú</ulink>
	  ÖУ¬ ÌṩÁËÕë¶Ô³õѧÕߵĽéÉÜ¡£</para>

	<procedure>
	  <step>
	    <para>Ê×ÏÈ£¬ ÐèҪΪ½«Òª´æ·ÅÖ»¶ÁµÄ &os; Ö´ÐÐÎļþµÄÎļþϵͳ½¨Á¢Ò»¸öĿ¼£¬
	      ½Ó׎øÈë &os; Ô´´úÂëµÄĿ¼£¬ ²¢ÔÚÆäÖа²×° jail
	      Ä£°å£º</para>

	    <screen>&prompt.root; <userinput>mkdir /home/j /home/j/mroot</userinput>
&prompt.root; <userinput>cd /usr/src</userinput>
&prompt.root; <userinput>make installworld DESTDIR=/home/j/mroot</userinput></screen>
	  </step>
	  <step>
	    <para>½Ó×Å£¬ ×¼±¸Ò»·Ý &os; Ports Ì×¼þ£¬ ÒÔ¼°ÓÃÓÚÖ´ÐÐ
	      <application>mergemaster</application> µÄ &os; Ô´´úÂ룺</para>

	    <screen>&prompt.root; <userinput>cd /home/j/mroot</userinput>
&prompt.root; <userinput>mkdir usr/ports</userinput>
&prompt.root; <userinput>portsnap -p /home/j/mroot/usr/ports fetch extract</userinput>
&prompt.root; <userinput>cpdup /usr/src /home/j/mroot/usr/src</userinput></screen>
	  </step>
	  <step>
	    <para>´´½¨ÏµÍ³ÖпɶÁд²¿·ÖµÄ¹Ç¼Ü£º</para>

	    <screen>&prompt.root; <userinput>mkdir /home/j/skel /home/j/skel/home /home/j/skel/usr-X11R6 /home/j/skel/distfiles</userinput>
&prompt.root; <userinput>mv etc /home/j/skel</userinput>
&prompt.root; <userinput>mv usr/local /home/j/skel/usr-local</userinput>
&prompt.root; <userinput>mv tmp /home/j/skel</userinput>
&prompt.root; <userinput>mv var /home/j/skel</userinput>
&prompt.root; <userinput>mv root /home/j/skel</userinput></screen>
	  </step>
	  <step>
	    <para>ʹÓà <application>mergemaster</application> °²×°È±Ê§µÄÅäÖÃÎļþ¡£
	      ½ÓÏÂÀ´£¬ ɾ³ý <application>mergemaster</application>
	      ´´½¨µÄ¶àÓàĿ¼£º</para>

	    <screen>&prompt.root; <userinput>mergemaster -t /home/j/skel/var/tmp/temproot -D /home/j/skel -i</userinput>
&prompt.root; <userinput>cd /home/j/skel</userinput>
&prompt.root; <userinput>rm -R bin boot lib libexec mnt proc rescue sbin sys usr dev</userinput></screen>
	  </step>
	  <step>
	    <para>ÏÖÔÚ£¬ ½«¿É¶ÁдÎļþϵͳÁ¬½Óµ½Ö»¶ÁÎļþϵͳÖС£ ÇëÈ·±£ÄúÔÚ <filename
		class="directory">s/</filename> Ŀ¼Öн¨Á¢ÁËÊʵ±µÄ·ûºÅÁ¬½Ó¡£
	      Èç¹ûûÓн¨Á¢Ä¿Â¼»ò½¨Á¢µÄλÖò»ÕýÈ·£¬ ¿ÉÄܻᵼÖ°²×°Ê§°Ü¡£</para>

	    <screen>&prompt.root; <userinput>cd /home/j/mroot</userinput>
&prompt.root; <userinput>mkdir s</userinput>
&prompt.root; <userinput>ln -s s/etc etc</userinput>
&prompt.root; <userinput>ln -s s/home home</userinput>
&prompt.root; <userinput>ln -s s/root root</userinput>
&prompt.root; <userinput>ln -s ../s/usr-local usr/local</userinput>
&prompt.root; <userinput>ln -s ../s/usr-X11R6 usr/X11R6</userinput>
&prompt.root; <userinput>ln -s ../../s/distfiles usr/ports/distfiles</userinput>
&prompt.root; <userinput>ln -s s/tmp tmp</userinput>
&prompt.root; <userinput>ln -s s/var var</userinput></screen>
	  </step>
	  <step>
	    <para>×îºó£¬ ´´½¨Ò»¸öĬÈϵİüº¬ÏÂÁÐÅäÖõÄ
	      <filename>/home/j/skel/etc/make.conf</filename>£º</para>

	      <programlisting>WRKDIRPREFIX?=  /s/portbuild</programlisting>


	      <para>ÅäÖà <literal>WRKDIRPREFIX</literal> ʹµÃÔÚÿ¸ö jail
	      Öзֱð±àÒë &os; ³ÉΪ¿ÉÄÜ¡£ Çë×¢Òâ ports Ŀ¼ÊÇÖ»¶ÁϵͳµÄÒ»²¿·Ö¡£ ¶ø×Ô¶©µÄ
	      <literal>WRKDIRPREFIX</literal> ÔòʹµÃÁª±à¹ý³ÌµÃÒÔÔÚ jail
	      ÖеĿɶÁд²¿·ÖÍê³É¡£</para>
	  </step>
	</procedure>
      </sect3>

      <sect3 id="jails-service-jails-creating">
	<title>½¨Á¢ Jail</title>

	<para>ÏÖÔÚÎÒÃÇÒѾ­ÓÐÁËÍêÕûµÄ &os; jail Ä£°å£¬ ¿ÉÒÔÔÚ
	  <filename>/etc/rc.conf</filename> Öа²×°²¢ÅäÖÃËüÃÇÁË¡£
	  Õâ¸öÀý×ÓÖÐÑÝʾÁ˽¨Á¢ 3 ¸ö jail£º <quote>NS</quote>¡¢
	  <quote>MAIL</quote> ºÍ <quote>WWW</quote>¡£<para>

	<procedure>
	  <step>
	    <para>ÔÚ <filename>/etc/fstab</filename> ÎļþÖмÓÈëÏÂÁÐÅäÖã¬
	      ÒÔ±ãÈÃϵͳ×Ô¶¯¹Ò½Ó jail µÄÖ»¶ÁÄ£°åºÍ¶Áд¿Õ¼ä£º</para>

	    <programlisting>/home/j/mroot   /home/j/ns     nullfs  ro  0   0
/home/j/mroot   /home/j/mail   nullfs  ro  0   0
/home/j/mroot   /home/j/www    nullfs  ro  0   0
/home/js/ns     /home/j/ns/s   nullfs  rw  0   0
/home/js/mail   /home/j/mail/s nullfs  rw  0   0
/home/js/www    /home/j/www/s  nullfs  rw  0   0</programlisting>
	
	    <note>
	      <para>ɨÃèÅú´ÎºÅ (pass number) Ϊ 0 µÄ·ÖÇø²»»áÔÚÆô¶¯Ê±Ê¹Óà &man.fsck.8;
		½øÐмì²é£¬ ¶øת´æÅú´ÎºÅ (dump number) Ϊ 0 µÄ·ÖÇøÔò²»»áÔÚ
		&man.dump.8; ʱ±¸·Ý¡£ ÎÒÃDz»Ï£Íû
		<application>fsck</application> ¼ì²é
		<application>nullfs</application> ¹Ò½Ó£¬ »òÈÃ
		<application>dump</application> ±¸·Ý jail ÖеÄÖ»¶Á
		nullfs ¹Ò½Ó¡£ Õâ¾ÍÊÇΪʲôÔÚÿ¸ö <filename>fstab</filename>
		ÌõÄ¿µÄ×îºóÁ½ÁÐÊÇ <quote>0&nbsp;0</quote> µÄÔ­Òò¡£</para>
	    </note>
	  </step>
	  <step>
	    <para>ÔÚ
	      <filename>/etc/rc.conf</filename> ÖÐÅäÖà jail£º</para>

	    <programlisting>jail_enable="YES"
jail_set_hostname_allow="NO"
jail_list="ns mail www"
jail_ns_hostname="ns.example.org"
jail_ns_ip="192.168.3.17"
jail_ns_rootdir="/usr/home/j/ns"
jail_ns_devfs_enable="YES"
jail_mail_hostname="mail.example.org"
jail_mail_ip="192.168.3.18"
jail_mail_rootdir="/usr/home/j/mail"
jail_mail_devfs_enable="YES"
jail_www_hostname="www.example.org"
jail_www_ip="62.123.43.14"
jail_www_rootdir="/usr/home/j/www"
jail_www_devfs_enable="YES"</programlisting>

	    <warning>
	      <para>Ó¦°Ñ
		<varname>jail_<replaceable>name</replaceable>_rootdir</varname>
		±äÁ¿ÉèÖÃ³É <filename
		  class="directory">/usr/home</filename> ¶ø²»ÊÇ
		<filename class="directory">/home</filename> µÄÔ­ÒòÊÇ
		 <filename class="directory">/home</filename>
		 Ŀ¼ÔÚĬÈÏ°²×°µÄ &os; ÉÏÊÇÖ¸Ïò
		 <filename class="directory">/usr/home</filename>
		 µÄÒ»¸ö·ûºÅÁ¬½Ó¡£ ¶ø
		<varname>jail_<replaceable>name</replaceable>_rootdir</varname>
		±äÁ¿±ØÐëÊÇÒ»¸ö <emphasis>²»</emphasis> °üº¬·ûºÅÁ¬½ÓµÄ·¾¶£¬
		·ñÔò jail ½«¾Ü¾øÆô¶¯¡£ ¿ÉÒÔʹÓà &man.realpath.1;
		¹¤¾ßÀ´¾ö¶¨ÕâÒ»±äÁ¿Ó¦±»¸³ÓèÒ»¸öʲôÑùµÄÖµ¡£
		¸üÏêϸµÄÐÅÏ¢Çë²ÎÔÄ°²È«¹«¸æ &os;-SA-07:01.jail</para>
	    </warning>
	  </step>
	  <step>
	    <para>Ϊÿ¸ö jail ´´½¨ËùÐèµÄÖ»¶ÁÎļþϵͳ¹Ò½Óµã£º</para>

	    <screen>&prompt.root; <userinput>mkdir /home/j/ns /home/j/mail /home/j/www</userinput></screen>
	  </step>
	  <step>
	    <para>ÔÚ jail Öа²×°¿É¶ÁдµÄÄ£°å¡£ ×¢ÒâÄúÐèҪʹÓà <filename
		role="package">sysutils/cpdup</filename>£¬
	      ËüÄܹ»°ïÖúÄúÈ·±£Ã¿¸öĿ¼¶¼ÊÇÕýÈ·µØ¸´ÖƵģº</para>
	    <!-- keramida: Why is cpdup required here?  Doesn't cpio(1)
	     already include adequate functionality for performing this
	     job *and* have the advantage of being part of the base
	     system of FreeBSD? -->

	    <screen>&prompt.root; <userinput>mkdir /home/js</userinput>
&prompt.root; <userinput>cpdup /home/j/skel /home/js/ns</userinput>
&prompt.root; <userinput>cpdup /home/j/skel /home/js/mail</userinput>
&prompt.root; <userinput>cpdup /home/j/skel /home/js/www</userinput></screen>
	  </step>
	  <step>
	    <para>ÕâÑù£¬ ¾ÍÍê³ÉÁË jail µÄÖÆ×÷£¬ ¿ÉÒÔÔËÐÐÁË¡£ Ê×ÏÈΪ
	      jail ¹Ò½ÓÎļþϵͳ£¬ È»ºóʹÓÃ
	      <filename>/etc/rc.d/jail</filename> ½Å±¾À´Æô¶¯ËüÃÇ£º</para>

	    <screen>&prompt.root; <userinput>mount -a</userinput>
&prompt.root; <userinput>/etc/rc.d/jail start</userinput></screen>
	  </step>
	</procedure>

	<para>ÏÖÔÚ jail Ó¦¸Ã¾ÍÆô¶¯ÆðÀ´ÁË¡£ Òª¼ì²éËüÃÇÊÇ·ñÔËÐÐÕý³££¬
	  ¿ÉÒÔʹÓà &man.jls.8; ÃüÁî¡£ ËüµÄÊä³öÓ¦¸ÃÀàËÆÕâÑù£º</para>

	<screen>&prompt.root; <userinput>jls</userinput>
   JID  IP Address      Hostname                      Path
     3  192.168.3.17    ns.example.org                /home/j/ns
     2  192.168.3.18    mail.example.org              /home/j/mail
     1  62.123.43.14    www.example.org               /home/j/www</screen>

	<para>Õâʱ£¬ ¾Í¿ÉÒÔµÇÈë jail ²¢Ôö¼ÓÓû§ºÍÅäÖ÷þÎñÁË¡£
	  <literal>JID</literal> Áиø³öÁËÕýÔÚÔËÐÐµÄ jail µÄ±êʶ±àºÅ¡£
	  Äú¿ÉÒÔʹÓÃÏÂÃæµÄÃüÁîÀ´ÔÚ <literal>JID</literal> ±àºÅΪ 3 µÄ jail
	  ÖÐÖ´ÐйÜÀíÈÎÎñ£º</para>

	<screen>&prompt.root; <userinput>jexec 3 tcsh</userinput></screen>
      </sect3>

      <sect3 id="jails-service-jails-upgrading">
	<title>Éý¼¶</title>

	<para>ÓÐʱ£¬ ÓÉÓÚ°²È«ÎÊÌ⣬ »òÐÂÔö¹¦ÄÜÓÐÓ㬠»áÏ£Íû½«ÏµÍ³Éý¼¶µ½Ò»¸öа汾µÄ &os;¡£
	  ÕâÖÖ°²×°·½Ê½µÄÉè¼ÆʹµÃÉý¼¶ÏÖÓÐ jail ±äµÃºÜÈÝÒס£ ÁíÍ⣬
	  ËüÒ²ÄÜ×î´óÏ޶ȵؼõСͣ»úʱ¼ä£¬ ÒòΪ jail Ö»ÔÚ×îºóʱ¿Ì²ÅÐèÒª¹Ø±Õ¡£
	  ÁíÍ⣬ ËüÒ²ÌṩÁ˼òµ¥µÄ»ØÍ˵½ÏÈÇ°°æ±¾µÄ·½·¨¡£</para>

	<procedure>
	  <step>
	    <para>µÚÒ»²½ÊÇ°´Í¨³£µÄ·½·¨Éý¼¶Ö÷»úµÄϵͳ¡£ ½Ó×Å£¬
	      ÔÚ <filename
		class="directory">/home/j/mroot2</filename> Öн¨Á¢Ò»¸öеÄÁÙʱģ°å£º</para>

	    <screen>&prompt.root; <userinput>mkdir /home/j/mroot2</userinput>
&prompt.root; <userinput>cd /usr/src</userinput>
&prompt.root; <userinput>make installworld DESTDIR=/home/j/mroot2</userinput>
&prompt.root; <userinput>cd /home/j/mroot2</userinput>
&prompt.root; <userinput>cpdup /usr/src usr/src</userinput>
&prompt.root; <userinput>mkdir s</userinput></screen>

	    <para>ÔÚÔËÐÐ <maketarget>installworld</maketarget> ʱ»á´´½¨Ò»Ð©²»ÐèÒªµÄĿ¼£¬
	      Ó¦½«ËüÃÇɾ³ý£º</para>

	    <screen>&prompt.root; <userinput>chflags -R 0 var</userinput>
&prompt.root; <userinput>rm -R etc var root usr/local tmp</userinput></screen>
	  </step>
	  <step>
	    <para>Öؽ¨µ½Ö÷ϵͳÖеĿɶÁд·ûºÅÁ¬½Ó£º</para>

	    <screen>&prompt.root; <userinput>ln -s s/etc etc</userinput>
&prompt.root; <userinput>ln -s s/root root</userinput>
&prompt.root; <userinput>ln -s s/home home</userinput>
&prompt.root; <userinput>ln -s ../s/usr-local usr/local</userinput>
&prompt.root; <userinput>ln -s ../s/usr-X11R6 usr/X11R6</userinput>
&prompt.root; <userinput>ln -s s/tmp tmp</userinput>
&prompt.root; <userinput>ln -s s/var var</userinput></screen>
	  </step>
	  <step>
	    <para>ÏÖÔÚÊÇʱºò¹Ø±Õ jail ÁË£º</para>

	    <screen>&prompt.root; <userinput>/etc/rc.d/jail stop</userinput></screen>
	  </step>
	  <step>
	    <para>жÏÂÔ­ÏȵÄÎļþϵͳ£º</para>
	    <!-- keramida: Shouldn't we suggest a short script-based
	     loop here, instead of tediously copying the same commands
	     multiple times? -->

	    <screen>&prompt.root; <userinput>umount /home/j/ns/s</userinput>
&prompt.root; <userinput>umount /home/j/ns</userinput>
&prompt.root; <userinput>umount /home/j/mail/s</userinput>
&prompt.root; <userinput>umount /home/j/mail</userinput>
&prompt.root; <userinput>umount /home/j/www/s</userinput>
&prompt.root; <userinput>umount /home/j/www</userinput></screen>

	    <note>
	      <para>¿É¶ÁдµÄÎļþϵͳ
		(<filename class="directory">/s</filename>)
		»áÔÚÖ»¶Áϵͳ֮ºó¹Ò½Ó£¬ Òò´ËÓ¦Ê×ÏÈжÔØ¡£</para>
	    </note>
	  </step>
	  <step>
	    <para>½«ÏÈÇ°µÄÖ»¶ÁÎļþϵͳŲ×ߣ¬ »»³ÉеÄϵͳ¡£
	      ÕâÑù×öҲͬʱ±£ÁôÁËÏÈǰϵͳµÄ±¸·Ý£¬ ´Ó¶ø¿ÉÒÔÔÚ³öÏÖÎÊÌâʱ´ÓÖлָ´¡£
	      ÕâÀïÎÒÃǸù¾ÝÐÂϵͳµÄ´´½¨Ê±¼äÀ´ÃüÃû¡£ ´ËÍâÎÒÃÇ°ÑÏÈÇ°µÄ
	      &os; Ports Ì×¼þÖ±½ÓÒƶ¯µ½ÐµÄÎļþϵͳÖУ¬
	      ÒÔ½ÚÊ¡´ÅÅÌ¿Õ¼äºÍ inode£º</para>

	    <screen>&prompt.root; <userinput>cd /home/j</userinput>
&prompt.root; <userinput>mv mroot mroot.20060601</userinput>
&prompt.root; <userinput>mv mroot2 mroot</userinput>
&prompt.root; <userinput>mv mroot.20060601/usr/ports mroot/usr</userinput></screen>
	  </step>
	  <step>
	    <para>ÏÖÔÚеÄÖ»¶ÁÄ£°å¾Í¿ÉÒÔÓÃÁË£¬ ʣϵÄÊÂÇéÊÇÖØйҽÓÎļþϵͳ²¢Æô¶¯
	      jails£º</para>

	    <screen>&prompt.root; <userinput>mount -a</userinput>
&prompt.root; <userinput>/etc/rc.d/jail start</userinput></screen>
	  </step>
	</procedure>

	<para>×îºóÓà &man.jls.8; ¼ì²é jail Æô¶¯ÊÇ·ñÕý³£¡£
	  ²»ÒªÍü¼ÇÔÚ jail ÖÐÔËÐÐ mergemaster¡£ ÅäÖÃÎļþºÍ
	  rc.d ½Å±¾ÔÚÉý¼¶Ê±Ó¦½øÐиüС£</para>
      </sect3>
    </sect2>
  </sect1>
</chapter>