text: Attached is a patch carrying the documentation for the bsdjail LSM.Please apply.Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>-sergediff -Nru /home/hallyn/kernels/linux-2.6.8.1/Documentation/bsdjail.txt linux-2.6.8.1/Documentation/bsdjail.txt--- /home/hallyn/kernels/linux-2.6.8.1/Documentation/bsdjail.txt 1969-12-31 18:00:00.000000000 -0600+++ linux-2.6.8.1/Documentation/bsdjail.txt 2004-09-10 14:12:59.163385088 -0500@@ -0,0 +1,99 @@+BSD Jail Linux Security Module+Serge E. Hallyn <serue@us.ibm.com>++Description:++Implements a subset of the BSD Jail functionality as a Linux LSM.+What is currently implemented:++ If a proces is in a jail, it:++ 1. Is locked under a chroot (as are all children) which is not+ vulnerable to the well-known chdir(..)(etc)chroot(.) escape.+ in). To protect against this, use jails+ in private namespaces, with the jail filesystems mounted+ ONLY within the jail namespaces. For instance:++$ # (Make sure /dev/hdc5 is not mounted anywhere)+$ new_namespace_shell /bin/bash+$ mount /dev/hdc5 /opt+$ mount -t proc proc /opt/proc+$ echo -n "root /opt" > /proc/$$/attr/exec+$ echo -n "ip 9.53.94.111" > /proc/$$/attr/exec+$ exec /bin/sh+$ sshd+$ apachectl start+$ exit++How to use:+ 1. modprobe bsdjail+ [ 1.5 /sbin/ifconfig eth0:0 2.2.2.2;+ 1.6 /sbin/route add -host 2.2.2.2 dev eth0:0+ (optional) ]+ 2. Make sure the root filesystem (ie /dev/hdc5) is not mounted+ anywhere else.+ 3. exec_private_namespace /bin/sh+ 4. mount /dev/hdc5 /opt+ 5. mount -t proc proc /opt/proc+ 6. echo -n "root /opt" > /proc/$$/attr/exec+ echo -n "ip 2.2.2.2" > /proc/$$/attr/exec (optional)+ 7. exec /bin/sh+ 8. sshd+ 9. exit++The new shell will now run in a private jail on the filesystem on+/dev/hdc5. If proc has been mounted under /dev/hdc5, then a "ps -auxw"+under the jailed shell:++ root: Root of jail's fs+ ip: Ip