zfs create -o compress=lz4 -o atime=off zroot/jails
zfs create zroot/jails/basejail
fetch https://download.freebsd.org/releases/amd64/13.0-RELEASE/base.txz ; tar xf base.txz -C /zroot/jails/basejail
env PAGER=cat freebsd-update -b /zroot/jails/basejail fetch install
Configure inside jail /etc/resolv.conf
zfs snapshot zroot/jails/basejail@latest
zfs create zroot/jails/firefox
zfs clone zroot/jails/basejail@latest zroot/jails/firefox/root
zfs create zroot/jails/firefox/var
zfs create zroot/jails/firefox/tmp
zfs create zroot/jails/firefox/home
rsync -a /zroot/jails/firefox/root/var/ /zroot/jails/firefox/var/
zfs set mountpoint=/zroot/jails/firefox/root/var zroot/jails/firefox/var
zfs set mountpoint=/zroot/jails/firefox/root/tmp zroot/jails/firefox/tmp
zfs set mountpoint=/zroot/jails/firefox/root/usr/home zroot/jails/firefox/home
zfs set setuid=off exec=off zroot/jails/firefox/var
zfs set setuid=off exec=off zroot/jails/firefox/tmp
zfs set setuid=off exec=off zroot/jails/firefox/home
pkg -c /zroot/jails/firefox/root install firefox xauth liberation-fonts-ttf
pkg -c /zroot/jails/firefox/root install -f gdk-pixbuf2
### ON HOST
/etc/jail.conf
allow.nomount;
exec.clean;
mount.devfs;
host.hostname = "$name.your-host-name.lan";
path = "/zroot/jails/${name}/root";
#securelevel = 3;
firefox {
ip4.addr = "10.0.0.2";
#exec.start = "/bin/sh /home/firefox/run-firefox";
#exec.jail_user = "firefox";
persist;
devfs_ruleset = 5;
}
At this point, we comment out the exec. directives, and uncomment the persist directive because we want to get inside the jail with no processes running, to bootstrap it. But before we do that, there are two more undefined items here, the devfs ruleset and jail's ip address. So, let's handle those first.
Configure inside jail /etc/resolv.conf
ON HOST
# cat /etc/jail.conf
/etc/jail.conf
allow.nomount;
exec.clean;
mount.devfs;
host.hostname = "$name.your-host-name.lan";
path = "/zroot/jails/${name}/root";
#securelevel = 3;
firefox {
ip4.addr = "10.0.0.2";
#exec.start = "/bin/sh /home/firefox/run-firefox";
#exec.jail_user = "firefox";
persist;
devfs_ruleset = 5;
}
ON HOST
# /etc/rc.conf
#
# Among other thigns you set up in rc.conf, the following is minimum required for jail networking.
#
# We use the 10.0.0.0/29 range just as an example for up to 6 jails
#
cloned_interfaces=lo1
ifconfig_lo1_aliases="10.0.0.1-6/29"
# And this to enable pf rules for NAT
pf_enable="YES"
pf_rules="/etc/pf.conf"
ON HOST
# /etc/pf.conf
extif = "re0"
intif = "lo1"
set skip on lo
set state-policy if-bound
nat on $extif inet from ($intif) to ! ($intif) -> ($extif)
block all
pass out proto { tcp udp } to port { 53 80 443 995 6697 123 }
pass out inet proto icmp icmp-type { echoreq }
ON HOST
# /etc/devfs.rules
[devfsrules_desktop_jail=5]
add include $devfsrules_hide_all
add include $devfsrules_unhide_basic
add include $devfsrules_unhide_login
add path 'mixer*' unhide
add path 'dsp*' unhide
# Start the jail
jail -c firefox
# jexec into it (the commands listed here after this are done inside the jail)
jexec -l firefox
# First, create a user for firefox (note the exec.jail_user = "firefox" in the jail.conf, so that's the user)
pw useradd firefox -w random -m
# Write out the "init" script (note the exec.start path in jail.conf, so that's the init script)
cat << EOF > /home/firefox/run-firefox
#!/bin/sh
export DISPLAY=:0.0
/usr/local/bin/firefox > /dev/null &
EOF
# We did all this as root, so:
chown firefox:firefox /home/firefox/run-firefox
chmod u+x /home/firefox/run-firefox
# Prepare the mountpoint for host's X unix socket
mkdir /tmp/.X11-unix
chmod 777 /tmp/.X11-unix
# Done!
Exit
We stop the jail with jail -r firefox, uncomment the exec. bits from jail.conf, comment the persist bit, and the jail is almost ready to run.
ON HOST
Allow jails to talk to xorg
xhost +
# Mount the host's X unix socket into the jail
mount_nullfs /tmp/.X11-unix /zroot/jails/firefox/root/tmp/.X11-unix
# And finally make the jail's root readonly:
zfs set readonly=on zroot/jails/firefox/root
We start firefox by starting the jail itself:
Toggle line numbers
jail -c firefox
ON HOST
Install security/doas, edit /usr/local/etc/doas.conf
permit nopass <user name> as root cmd jail
ON HOST
In host users home directory, create ~/bin dir, create file, e.g. startjailfirefox
#!/bin/sh
xhost +
doas jail -c firefox
Make script executable
# chmod 700 startjailfirefox
ON HOST
Edit /zroot/jails/firefox/root/home/firefox/run-firefox, add '-P' option
For launcher (icon) on desktop search in your DE's/WM's documentation, point the execution of the program (shell script in this case) to ~/bin/startjailfirefox
## Update Jail
freebsd-update -b /zroot/jails/basejail fetch install
