> For the complete documentation index, see [llms.txt](https://book.bsdcn.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://book.bsdcn.org/handbook/di-17-zhang-jail-yu-rong-qi/17.11.-cong-jail-nei-bu-guan-li.md).

# 17.11.从 jail 内部管理

大多数 jail 管理工作是从宿主完成的，但有些任务需在 jail 内部执行，且 jail 内部运行的脚本有时需要知道自己在 jail 中。本节介绍管理员从 jail 内部看到的内容以及可执行的操作。

进程可通过读取 `security.jail.jailed` sysctl 来检测自己是否运行在 jail 内，该值在 jail 内为 `1`，在宿主上为 `0`：

```sh
# sysctl security.jail.jailed
security.jail.jailed: 1
```

在 jail 内部，环境被刻意限制：

* 宿主的系统视图被隐藏。jail 中的进程只能看到自己 jail 的进程、套接字和文件系统，看不到宿主或其他 jail 的。
* 内核状态在很大程度上是只读的。无法从 jail 内部写入内核可调参数，不允许 [kldload(8)](https://man.freebsd.org/cgi/man.cgi?query=kldload\&sektion=8\&format=html) 和 [kldunload(8)](https://man.freebsd.org/cgi/man.cgi?query=kldunload\&sektion=8\&format=html)，并且 [dmesg(8)](https://man.freebsd.org/cgi/man.cgi?query=dmesg\&sektion=8\&format=html) 和内核消息缓冲区不可用，除非设置了 `allow.read_msgbuf`。
* 跨越 jail 边界的特权操作会被拒绝，除非宿主明确允许。创建原始套接字——[ping(8)](https://man.freebsd.org/cgi/man.cgi?query=ping\&sektion=8\&format=html) 和 [traceroute(8)](https://man.freebsd.org/cgi/man.cgi?query=traceroute\&sektion=8\&format=html) 所需——需要 `allow.raw_sockets`（参见 [jail 配置文件](/handbook/di-17-zhang-jail-yu-rong-qi/17.3.-zhu-ji-pei-zhi-jail.md) 中的参数说明），挂载文件系统需要 `allow.mount` 及其按文件系统类型的子参数，而 [chflags(1)](https://man.freebsd.org/cgi/man.cgi?query=chflags\&sektion=1\&format=html) 默认禁用（参见 [升级 jail](/handbook/di-17-zhang-jail-yu-rong-qi/17.12.-geng-xin-jail.md)）。

少数按 jail 设置的 sysctl 变量可在 jail 内部更改而不影响宿主，包括 `kern.hostname`、`kern.domainname`、`kern.hostid`、`kern.hostuuid`、`kern.securelevel` 和 `security.bsd.suser_enabled`。可用的 jail 参数集合可通过 [sysctl(8)](https://man.freebsd.org/cgi/man.cgi?query=sysctl\&sektion=8\&format=html) 列出：

```sh
# sysctl -d security.jail.param
```

从 jail 内部管理其自身的服务，方式与未 jailed 系统完全相同：[service(8)](https://man.freebsd.org/cgi/man.cgi?query=service\&sektion=8\&format=html) 和 [sysrc(8)](https://man.freebsd.org/cgi/man.cgi?query=sysrc\&sektion=8\&format=html) 作用于 jail 自己的 [rc(8)](https://man.freebsd.org/cgi/man.cgi?query=rc\&sektion=8\&format=html) 配置。这是上面所示的宿主侧 [service -j 和 sysrc -j](/handbook/di-17-zhang-jail-yu-rong-qi/17.10.-guan-li-jail.md) 的 jail 内对应方式。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://book.bsdcn.org/handbook/di-17-zhang-jail-yu-rong-qi/17.11.-cong-jail-nei-bu-guan-li.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.