FreeBSD 8.0 kommt näher und eines der letzten ausstehenden Features waren weiter Verbesserungen der Jails. James Gritton hat heute Nachmittag die lange gewünschte Fähigkeit eingefügt, um Jails verschachteln zu können. Es können nun also Jails in Jails in Jails und so weiter erstellt werden.
Code:
From: Jamie Gritton <jamie@FreeBSD.org>
Date: Wed, 27 May 2009 14:11:23 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
svn-src-head@freebsd.org
Cc:
Subject: svn commit: r192895 - in head: . lib/libc/sys sys/compat/freebsd32
sys/compat/linux sys/contrib/ipfilter/netinet sys/fs/procfs
sys/kern sys/net sys/netinet sys/netinet6 sys/nfsserver
sys/security/m...
Author: jamie
Date: Wed May 27 14:11:23 2009
New Revision: 192895
URL: http://svn.freebsd.org/changeset/base/192895
Log:
Add hierarchical jails. A jail may further virtualize its environment
by creating a child jail, which is visible to that jail and to any
parent jails. Child jails may be restricted more than their parents,
but never less. Jail names reflect this hierarchy, being MIB-style
dot-separated strings.
Every thread now points to a jail, the default being prison0, which
contains information about the physical system. Prison0's root
directory is the same as rootvnode; its hostname is the same as the
global hostname, and its securelevel replaces the global securelevel.
Note that the variable "securelevel" has actually gone away, which
should not cause any problems for code that properly uses
securelevel_gt() and securelevel_ge().
Some jail-related permissions that were kept in global variables and
set via sysctls are now per-jail settings. The sysctls still exist for
backward compatibility, used only by the now-deprecated jail(2) system
call.
Approved by: bz (mentor)
