Hot answers tagged jail
Jail term comes from FreeBSD world and refers to more strict way of limiting user access to the system, altough chroot exists in FreeBSD as a separate mechanism. It is something like (sorted by the level of separation): Chroot < OS-level virtualization: (FreeBSD's Jail ≤ Linux OpenVZ) < Paravirtualization: XEN
I think what you want here, is to bind mount the target directory inside the jail of the user. You can't symlink out of a jail. Look at this, for instance: mount --bind /media/sdb2/mydocs/archive /home/username/archive
The solution should have been obvious from the problem that the address translation was always occurring before state rules were checked. The address translation needs to be split. The corrected version of the rules found above is: add 00050 divert natd ip4 from any to any via wan0 in add 00060 check-state # Talking to myself add 00200 allow ip from me to ...
FreeBSD comes with great handbook. Really must read, dude. For e. g., its chapter 16 describes Jails in depth. UPDATE: Yes, you can use the same IP for Jail as non-jailed processes use, but of course, they can't bind the same IP:Ports, as it usually got used to be.
I would say that "jail" is a general term while "chroot" is not. chroot is just one of several possibilities to limit a process's accesses. I have never heard of "jail" in another context though. You may use AppArmor, SELinux and the like to reach similar results but "AppArmor jail" seems to be an uncommon term. On the other hand security is not the only ...
Only top voted, non community-wiki answers of a minimum length are eligible