Jails for OpenBSD

[gpatrick]

Since jails have been around for some time, I don't expect OpenBSD to adopt them, but is there a reason why jails have not been added?

[ocicat]

Originally Posted by gpatrick

...but is there a reason why jails have not been added?

OpenBSD's feature set comes from within -- meaning the developers have to be motivated enough to see ideas through to implementation. Few project developers visit this site, so the answers you will get here will be conjecture based on experience & reading OpenBSD's misc@ mailing list.

Having said that, it appears that the chroot(8) + systrace(1) combination is considered good enough that no one is motivated to do more. Numerous threads can be found on misc@ which basically comes to the same conclusion:

http://marc.info/?l=openbsd-misc&w=2&r=2&s=jails&q=b

In these misc@ threads, you will find occasional mention of the following project:

http://sysjail.bsd.lv/

...but note there is a statement at their Website stating that the project is now dormant.

[gpatrick]

I read on misc@ :

"Jail really is nice, but you can accomplish the same thing when using
chroot + systrace if you just want a single running service per
virtual jail. You can make it even tighter then a jail. But ok, it is
a lot of work, jails make it easy to implement virtual servers. It is
a nice feature, but I don't miss it on OpenBSD."

The reason for jails is to run multiple domains on one machine and each jail would be a separate domain, such as, example.org; example.com; example.net. If I need to make changes or remove a domain it's simple.

I understand how chroot works, but I am using Perl and MySQL for my sites and it is a little work to get that in chroot.

According to the above statement chroot+systrace is tighter than jails, but is there an example somewhere of how to use chroot and systrace to make it that way for a specific domain.

Also, could I chroot multiple domains, such as /var/www/example.org; /var/www/example.com; /var/www/example.net ?

Thanks!

[ocicat]

Originally Posted by gpatrick

...but is there an example somewhere of how to use chroot and systrace to make it that way for a specific domain.

The modified version of Apache 1.3 available in OpenBSD can be run from within a chroot(8):

http://openbsd.org/faq/faq10.html#httpdchroot

As for tightening down what syscalls are allowed, both Lucas (author of Absolute OpenBSD) and Palmer & Nazario (authors of Securing Architectures with OpenBSD) cover this in the following sets of articles:

• http://onlamp.com/pub/a/bsd/2003/01/...y_Daemons.html
  http://onlamp.com/pub/a/bsd/2003/02/...y_Daemons.html
• http://www.informit.com/articles/article.aspx?p=363731

Both sets of authors discuss iteratively constraining what syscalls are allowed by pouring over the output from:

# systrace -A /usr/sbin/inetd

The basic question you are asking is how can Apache be made to talk to multiple chroot(8)'s. While I suspect the answer will be quite tedious in looking through systrace -A output (which is error-prone & requires constant maintenance...), I would be remiss if I didn't mention three important points:

• systrace(1) has been cracked:
  
  http://undeadly.org/cgi?action=artic...20070809201304
  
• systrace(1) has lost favor with the OpenBSD developers:
  
  http://marc.info/?l=openbsd-misc&m=124767408201308&w=2
  
• The independent repository for systrace(1) policies (the Hairy Eyeball Project) is defunct.

This should indicate that acceptance/interest in systrace(1) has waned. Even the information from Lucas and Palmer & Nazario is dated (circa 2003-2004). You need to think twice before committing your business to rely on a technology that is no longer regarded as being secure.

I understand how chroot works, but I am using Perl and MySQL for my sites and it is a little work to get that in chroot.

As I understand, Perl code can be written to jump out of a chroot(8). This further supports the developers' sentiment that systrace(1) creates a false sense of security.

[jggimi]

The OP is looking to use "jail"-like technologies for virtualization.

I have used chroot for virtualization on OpenBSD. For some purposes, it works well, but there are some caveats for using it this way, requireing careful planning:

• The use of chroot only virtualizes file systems. Processes, network stack, and kernel remain unvirtualized.
• Superuser functionality in a chrooted environment is not equivalent to running as the superuser in normal operation. Some functionality is intentionally eliminated.

Apache itself can provide virtual hosting, and that is probably the easiest way to accomplish the appearance of multiple webservers within a single OS.

[BSDfan666]

The jail functionality in FreeBSD required significant kernel changes in almost every area imaginable, it would be difficult to to introduce similar functionality in OpenBSD without a developing being really motivated to do so (..and perhaps such changes would be rejected by the other developers anyway).

In OpenBSD, daemons are privileged separated and use chroot(2) where it's deemed necessary.. if you absolutely require that 'domains' be separated, then consider obtaining additional systems.

Hope that helps.

[TerryP]

My suggestion is skip jails and use appropriate virtualization software.

[BSDfan666]

Originally Posted by TerryP

My suggestion is skip jails and use appropriate virtualization software.

While virtualization is a popular option these days, it may not be the best one.. the security aspect of such things is questionable, and you won't get much support from the developers if you're using one (..and can't replicate any problems on a real system, of course).

Ones ability to use OpenBSD as a host for virtualization is also impaired, QEMU is the only option available.. and due to portability issues, the port has been stuck at 0.9.x for some time.

[jggimi]

Virtualization has its values, but neither -security- nor -isolation from all problems- are among them. And that is so, whether chroot, jail, virtual machine, or "hypervisor" solution is selected.

Before anyone asks -- yes, even "firmware" hypervisor virtual machine systems, such as those used in mainframe systems since the 1970s, or on large scale Unix servers beginning in the late 1990s. Even today, on the most modern systems, a failure of a component in one virtual machine can require the entire platform be reset, affecting all virtual machines. Firmware in microcode on the hardware platform is still software, written by human beings.

[gpatrick]

Thanks everyone for your helpful replies.

As mentioned before, I have three personal websites and might add one or two more and prefer to run on my own hardware. That being the case I was looking at OpenBSD as my platform. MySQL is my database for two sites and I run a caching-only name server on the server currently.

Since this is personal only I want to run the database and domains on one server. My current platform in OpenSolaris with network virtualization (Crossbow) and zones. Currently I have an nginx reverse proxy that is redirected from ipf. Each domain is in a separate zone. I'm using ipf because OpenSolaris doesn't support pf. I did have VirtualBox running an OpenBSD guest but then when I tried to upgrade to the newest version of VirtualBox I couldn't start any guests, and when I attempted to go back to the previous version, I still couldn't get any guests to run. So I'm moving to another platform and would like to use OpenBSD.

It seems that using Apache virtual hosts would be the way to go, or would it be possible to chroot nginx and then chroot each domain?

[ocicat]

Originally Posted by gpatrick

It seems that using Apache virtual hosts would be the way to go, or would it be possible to chroot nginx and then chroot each domain?

It sounds like you are asking if one chroot(8)'ed subtree can talk to a different chroot(8)'ed subtree. By definition, this isn't what chroot(8) does/is. What you are hoping for is to a hierarchy of chroot(8)'ed directories, but from what I see in the manpage, this isn't possible.

[gpatrick]

I'm coming from OpenSolaris where I used zones (similar to FreeBSD jails) so chroot is different to me. On OpenSolaris I had an ipf zone to rdr to my nginx reverse proxy zone which then directed traffic to each specific domain which had its own zone and own Apache instance. I also had a separate MySQL zone and mail zone. Just want to replicate this somehow on OpenBSD.

chroot lighthttpd as a reverse proxy and then send to the chroot apache with multiple virutal hosts doesn't sound like it will work either since chroot can't talk to other chroot's?

If I can't chroot lighthttpd as a reverse proxy, then how do I direct traffic to multiple domains with chroot?

[jggimi]

Because chroot -only- "virtualizes" the filesystem, the network stack is shared.

Without knowing your situation, and only from your brief descriptions here, it appears you are trying to kill a canary with a machine gun. Why not run a single instance of Apache, with multiple virtual hosts, and a single instance of your DBMS? Each virtual host "webserver" can still address a unique table space.