Differences

This shows you the differences between two versions of the page.

--- jailingguiapplications [2017/08/05 09:17] – VladimirKrstulja
+++ jailingguiapplications [2021/04/29 11:37] (current) – Fix a typo DanielEbdrup
@@ Line 87: / Line 87: @@
 # We use the 10.0.0.0/29 range just as an example for up to 6 jails
 #
-cloned_interfaces = lo1
+cloned_interfaces=lo1
-ifconfig_lo1_aliases = "10.0.0.1-6/29"
+ifconfig_lo1_aliases="10.0.0.1-6/29"
 # And this to enable pf rules for NAT
@@ Line 130: / Line 130: @@
 So now we're ready to start the jail and jexec into it for final setup.
+<callout type="info">
+**A note on DISPLAY env variable**
+The below approach uses a custom shell script that's started by the jail's ''%%exec.start%%'', in which the DISPLAY environment variable is set. This is not strictly needed or the best approach. It suffices to put the in-jail users into a login class, and define an ENV for that class in ''%%/etc/login.conf%%'':
+''%%:setenv=DISPLAY=\c0:\%%''
+Don't forget to ''%%cap_mkdb /etc/login.conf%%'' in the jail. \c is escape sequence for colon.
+</callout>
 <code bash>
@@ Line 198: / Line 209: @@
 <code>
 exec.prestart = "mount | grep ' on /zroot/jails/${name}/root/tmp/.X11-unix` || mount_nullfs /tmp/.X11-unix /zroot/jails/${name}/root/tmp/.X11-unix"
+</code>
+===== Integrating host-side browser launchers with jailed Firefox =====
+Various launchers will want to launch local ''%%/usr/local/bin/firefox%%'' when an URL is clicked or otherwise selected to be open in the default browser. To integrate this with jailed Firefox, one needs a wrapper script that will convert local Firefox calls to ''%%jexec%%'' calls. Three things are needed for this:
+  - Local "firefox" binary that will be used as the wrapper
+  - A sudo-enabled NOPASSWD script that's called by the local "firefox" wrapper, and that executes ''%%jexec%%'' in the jail
+  - A ''%%sudoer%%'' rule allowing the script in #2 to be started with NOPASSWD
+As a simple example, assuming local "firefox" will be called with first param being the URL, eg. ''%%/usr/local/bin/firefox http://google.com%%'', we then set up (all on the host):
+<code bash>
+#!/bin/sh
+# This is /usr/local/bin/firefox
+if [ -z "$1" ]; then
+	exit 1
+fi
+sudo /home/user/bin/jail-firefox-exec $1
+</code>
+<code bash>
+#!/bin/sh
+# This is /home/user/bin/jail-firefox-exec
+if [ -z "$1" ]; then
+	exit 1
+fi
+jexec -U firefox firefox firefox $1
+</code>
+<code>
+# In sudoers (called by sudo visudo), for example:
+%wheel ALL=(ALL) NOPASSWD: /home/user/bin/jail-firefox-exec
 </code>