Running Jails as an Unprivileged User
reddit / freebsd

----------------------------------------------------------------------
bawdyanarchist · 2021-12-10 11:14

My system is configured to run basically everything in a jail. Jailed
VPN tunnels for network traffic isolation, browsers and other GUI apps
are jailed; with a mind towards separating high security items like
financial accounts from say, social media, or torrenting.

And even though I do all activities as an unprivileged user inside the
jails, and even though host is almost never exposed to an online
interface (just for updates), I'm still coordinating all of that as
root on host, and I don't think this is ideal.

It looks like only root can create/remove jails (turn them on/off);
but if I could at least grant permission for a regular user *ON HOST*
to launch and run apps inside of a jail, that would go a long way
towards ending my bad practice of operating as root.

Am I missing something? I looked around and played around, and I kept
getting permissions errors when, as an unprivileged user on host,
tried to launch even just /bin/csh inside of a jail.

----------------------------------------------------------------------
rykolepl · 2021-12-10 16:06

> It looks like only root can create/remove jails (turn them on/off);
but if I could at least grant permission for a regular user *ON HOST*
to launch and run apps inside of a jail, that would go a long way
towards ending my bad practice of operating as root.

You can restrict which commands user is allowed to run via sudo.

Since jails are based on chroot, and chroot requiring root privileges,
and because jails are very low-level, I doubt that you can start
applications in jails or manage jails in any way without actual root
privileges. Maybe someone will correct me on that, if that's not
right.