freebsd idea: “user jails”.

inspired by the new service jails in 15.0, but for users. when a user logs in, their shell process is put into a newly created jail called “usrj-<uid>”, or added to the existing jail of that name if there is one. the jail would have its root filesystem set to / (like service jails do), so things would look the same from the user's point of view, just with fewer privileges.

which users to jail and the jail privileges to give them could be specified in /etc/login.conf, and a default template could be supplied that provides the most common options (like ip4=inherit ip6=inherit). the administrator could provide custom restrictions to e.g. restrict a user to a particular set of IP addresses.

ideally, this would eventually allow restricting what files a user jail is allowed to read/write, separately from DAC permissions, and perhaps some other things.

what do you think?

i very interested in applications like this which treat lightweight jails as basically "FreeBSD cgroups" (or "FreeBSD process contracts", in Solaris terminology).

userjails initial proof of concept: github.com/freebsd/freebsd-src

DO NOT USE THIS IN PRODUCTION

it's configured in /etc/login.conf by setting 'userjail' for a login class:

jailed:\
:userjail:\
:tc=default

pam_userjail creates/configures the jail and the process is transparent to the user:

% ssh jivy@freebsd15
Last login: Sat Mar 22 14:22:11 2025
% sysctl security.jail.jailed
security.jail.jailed: 1
% ping bbc.co.uk
ping: socket ssend: Operation not permitted
%

future work: make jail options configurable in login.conf (“userjail.ip4=1.1.1.1”).

0

If you have a fediverse account, you can quote this note from your own instance. Search https://mastodon.bsd.cafe/users/lw/statuses/114206550364443137 on your instance and quote it. (Note that quoting is not supported in Mastodon.)