I have successfully created a jail & installed Firefox inside the jail problem Firefox is completely mute. I can't watch Youtube. How do I enable sound in the jailed Firefox ?
Jails, by default, have limited access to devices. You'll need to set up proper devfs.rules(5) to allow the jail access to the audio devices.
I have added
devfs_ruleset = 4 to# cat jail.conf
ffjailed {
devfs_ruleset = 4;
enforce_statfs = 2;
exec.clean;
exec.consolelog = /var/log/bastille/ffjailed_console.log;
exec.start = '/bin/sh /etc/rc';
exec.stop = '/bin/sh /etc/rc.shutdown';
host.hostname = ffjailed;
mount.devfs;
mount.fstab = /usr/local/bastille/jails/ffjailed/fstab;
path = /usr/local/bastille/jails/ffjailed/root;
securelevel = 2;
interface = wlan0;
ip4.addr = 192.168.225.10;
ip6 = disable;
devfs_ruleset=4;
}That's the default (look at the first line of the jail configuration).
[devfsrules_jail=4]
add include $devfsrules_hide_all
add include $devfsrules_unhide_basic
add include $devfsrules_unhide_login
add path fuse unhide
add path zfs unhideIf somehow I can manage to enable the sound in Firefox then its a success. Any ideas ? So what number should I try ?
Agreed. Posts split off to its own thread.
[bastille=20]
add include $devfsrules_hide_all
add include $devfsrules_unhide_basic
add include $devfsrules_unhide_login
add path fuse unhide
add path zfs unhideadd include $devfsrules_jail, it unhid everything which defeated the purpose of restricting dev access.
(1) So should I create a regular user inside the Jail that I have created & use it to run Firefox ?
vnet either. Note that bastille(8) has specific options for this. https://bastille.readthedocs.io/en/latest/chapters/networking.html#virtual-network-vnet vnet Create the jail with its own virtual network stack, with its own
network interfaces, addresses, routing table, etc. The kernel
must have been compiled with the VIMAGE option for this to be
available. Possible values are “inherit” to use the system
network stack, possibly with restricted IP addresses, and “new”
to create a new network stack. sudo bastille console ffjailed I get the root account of the jail by default. The prompt looks like this root@ffjailed:~ #. Now when I type the exit command I am out of the jail & back to my host. How do I login to my newly created account ? login.
setenv DISPLAY :1 to .cshrc of my new user account exactly the same way I did for the root account & rebooted the Jail but I am still getting~ $ firefox
Error: no DISPLAY environment variable specified Xnest :1 -listen tcp
Actually, no. A jail is the logical consequence of the idea to use chroot(8) for "secure" isolation. It wasn't designed for that, but was just a nice tool to be able to do something "inside" a userland mounted on a path prefix (instead of /). For isolation, the first problem was protection against trickeries with paths (like, very simple symlinks) allowing file access outside the chroot. This was solved in many implementations, but there were still other things missing like restricted device access, resource limits, networking restrictions etc, and all these things were added to create FreeBSD's "jails".
[devfsrules_desktop_jail=5]
add include $devfsrules_hide_all
add include $devfsrules_unhide_basic
add include $devfsrules_unhide_login
add path zfs unhide
add path 'mixer*' unhide
add path 'dsp*' unhideallow.raw_sockets = 1;
exec.start = "/bin/sh /etc/rc";
exec.stop = "/bin/sh /etc/rc.shutdown";
exec.clean;
devfs_ruleset = 5;
mount.devfs;
fox {
path = "/usr/jails/fox";
host.hostname = "fox";
ip4.addr = "10.0.0.3";
interface = "lo1";
mount.fstab = "/etc/fstab.fox";
}