restarting a jail

[kr651129]

I have a jail setup inside my FreeBSD installation. I do not allow ssh into the core system, just to the jail. Is there a way to restart the jail from inside itself?

 

[Beeblebrox]

You can shut down the jail from within as jail(8) states:

Normal machine shutdown commands, such as halt(8), reboot(8), and shutdown(8), cannot be used successfully within the jail. To kill all processes from within a jail, you may use one of the following commands, depending on what you want to accomplish:
kill -TERM -1
kill -KILL -1
This will send the SIGTERM or SIGKILL signals to all processes in the jail - be careful not to run this from the host environment! Once all of the jail's processes have died, unless the jail was created with the persist parameter, the jail will be removed. Depending on the intended use of the jail, you may also want to run /etc/rc.shutdown from within the jail.

The problem of course, is getting the jail to re-start, which is against the purpose of jails (segregating host processes from jailed processes), from within the jail its self.

Maybe you can start a jail-status monitoring daemon, which re-starts jails within 60 seconds after shutdown. Something like:

List of jails to monitor
Get PID's of Monitor_List
If PID=null, wait 60s
Jail -c $jailname

 

[ShelLuser]

As @Beeblebrox already mentioned; the answer is basically no because this isn't the way the jail system works. A jail isn't a full blown virtual environment running on top of your own, it's basically a specific kernel process which provides a whole new userland environment.

But it's not a virtual machine therefore you can't perform tasks such as a # shutdown -r now.

Still, I'd like to suggest another method than @Beeblebrox. His method works perfectly, no comments there, but automatically restarting processes can also become a nuisance the moment you work on such an environment and forgot about this process being in place. For example; it's not uncommon not to automatically fire up a jail right after you performed a system upgrade.

I ran into such a scenario myself once on a customer server. I had suggested the local admin to use the monitoring feature of sysutils/webmin to make sure his webserver kept running, but in a controlled fashion (it doesn't continuously restart no matter what). He started using it without documenting this. So the next time I had to perform some (emergency) maintenance with taking down the MySQL and Apache server I suddenly was facing a magically restarting Apache webserver and feared for the worst at first (compromised server).

So instead I would suggest a "restart on demand" approach. For example; in your jail you create a "syscontrol" directory somewhere and make sure that only the users who are allowed to 'control' the jail have access here.

Then set it up so that your monitoring system (which runs on your host) checks for a file (a so called semaphore) to be present in this directory. If it is it will restart the jail. For example, set up a cronjob which can then periodically run this shell script:

#!/bin/sh

## Semaphore check

if [ -e /home/yourjail/syscontrol/reboot ]; then
        rm /home/yourjail/syscontrol/reboot
        jail -rc yourjail
fi

if [ -e /home/yourjail/syscontrol/shutdown ]; then
        rm /home/yourjail/syscontrol/shutdown
        jail -r yourjail
fi

Obviously yourjail represents the name of your jail and I also made up the directory locations. Should be easy to adjust.

Now, all that's left to do is create a semaphore. You can use touch for that. So within the jail go to the syscontrol directory and then issue this command: touch reboot.

Then as soon as the cronjob activates it will remove the semaphore and reset your jail. Keep in mind that any other connected users will be disconnected without a warning!

As said the main advantage here is control. Only people using your jail need to know about this whereas the admins of the host environment don't have to worry about "automagically" reappearing processes.

Edit: null edit

 

[Beeblebrox]

@ShelLuser: I thought of suggesting a cron job, but I decided against it, because the jail could be randomly started while the ssh client is trying to do some work.

Obviously your solution is better, because it combines cron (periodic checking) and PID (or similar file) checking to ensure the cron condition gets executed when there is no process file for the jail.

 

[jamie]

A bit late, I know, but someone may arrive here from a web search.

here is a way to effectively do this:

Within the jail, launch a process, daemonize it, and set it to ignore all signals. then get it to run /etc/rc.shutdown, then kill anything left, and when it's the only process running in the jail, run /etc/rc

Or just install /usr/ports/sysutils/jailutils and copy jkill to /sbin/reboot (which more or less does just that) as shown here: http://thewalter.net/stef/freebsd/jails ... jkill.html