jk_init(8)

jk_init(8) 💖

okay bestie, welcome to the jk_init page from the Jailkit manual, section 8. this is the glow-up guide to making jail directories that actually work, and yes it's giving main character energy. let's go ✨

---

NAME 🎀

jk_init — a utility to quickly create functional jail directories 🦋

---

SYNOPSIS 💅

jk_init -j jail section

jk_init -v -f -k -j jail section

---

DESCRIPTION 🌸

okay so, setting up a jail (a changed root) in a way that's actually functional? not easy. like, at all. imagine you want your user to be able to run cvs. you can't just copy the cvs binary into the user's jail and call it a day — bestie, cvs needs libraries too. and it needs the /dev/null device. and then you need something to start cvs, which means you need a shell too. and that shell might need files like /etc/passwd and /etc/nsswitch.conf. the rabbit hole is deep, fr fr 😭

with jk_init you can automate all of this. you make a section in the configfile /etc/jailkit/jk_init.ini that has all the files, directories and devices, and then you use jk_init to set up that jail with a single command. slay. 💅

the default configfile has examples for cvs, sftp, scp, rsync and more, for Debian and Ubuntu Linux. for other operating systems the defaults might need some (minor) updates. not me telling you your distro might need a lil tweak 🙈

---

EXAMPLE ✨

an example configfile section might look like this:

[jk_lsh]
comment = Jailkit limited shell
paths = /usr/sbin/jk_lsh, /etc/jailkit/jk_lsh.ini
users = root
groups = root
need_logsocket = 1
includesections = uidbasics

[sftp]
comment = ssh secure ftp with Jailkit limited shell
paths = /usr/lib/sftp-server
includesections = netbasics, uidbasics
devices = /dev/urandom, /dev/null
emptydirs = /svr

let's break down every single one of these entries, because they all matter 👑

• the comment entry specifies the comment that's shown if the jk_init option -l or --list is used.
• the paths entry specifies which files and directories need to be copied into the jail. executables and libraries get checked for any required libraries, and those requirements get copied too. all files are created with user root as owner.
• the paths_w_owner entry specifies which paths need to be copied with their current ownership. this is for copying files that need to be writable by a server process that doesn't run as user root (for example, database files, iykyk).
• the users and groups entries specify which users and groups need to be present in <jail>/etc/passwd.
• if the need_logsocket entry is set to "1", the jk_socketd.ini file is modified to include a /dev/log socket in this jail.
• the devices entry specifies which devices are required in the jail.
• the includesections entry specifies which other sections need to be processed as well when processing the current section. in the above example, the jk_lsh section is automatically included if the sftp section is processed. obsessed with the auto-include honestly 🫶
• finally, the emptydirs entry specifies which directories to create as empty directories. this can be useful to create for example mountpoints in the jail. iconic. 🌈

---

DEPRECATED CONFIGFILE ENTRIES 💀

heads up bestie, these are old news:

the entries executables, regularfiles, directories and libraries are all replaced by the entry paths.

they're still supported, but they're handled similar to the paths entry. so like, they work, but they're not the vibe anymore. periodt.

---

LIMITATIONS 😭

many unix like operating systems install files in different locations. the default jk_init config file has defaults taken from Debian and Ubuntu. the default config file may not work on other platforms. you probably need to customise jk_init.ini for your platform and your applications. ngl that's just how it is 🙈

---

✨ OPTIONS ✨

• -f, --force — force overwriting of existing files. it's giving "no takebacks" 💅
• -v, --verbose — will give verbose output. she's chatty, we love her 🗣️
• -k, --hardlink — try to create hardlinks instead of copying the files. efficient queen 👑
• -c configfile, --configfile=configfile — use alternative configfile
• -l, --list — list available sections in the config file. window shopping fr fr 🛍️
• *-j, --jail *<jail> — specify the jail directory to operate on.
• -h, --help — the help screen. bestie, when in doubt 🫶

---

FILES 🍓

• /etc/jailkit/jk_init.ini

---

SEE ALSO 🦋

jailkit(8) jk_check(8) jk_chrootlaunch(8) jk_chrootsh(8) jk_cp(8) jk_jailuser(8) jk_list(8) jk_lsh(8) jk_procmailwrapper(8) jk_socketd(8) jk_uchroot(8) jk_update(8) chroot(2) ldd(1) mknod(1) ln(1) chmod(1) mkdir(1)

the whole friend group, literally the entire squad 🌸

---

COPYRIGHT 💜

Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010 Olivier Sessink

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved.

legal bestie said "spread the love, just keep the receipts" 💖

---

that's the whole page, no cap. this came from the JAILKIT source, dated 07-02-2010, and it's page jk_init(8) — love that for us. bye bestie, go build a jail that actually works 💅✨🦋