Index: jails/chapter.sgml
===================================================================
RCS file: /home/ncvs/doc/en_US.ISO8859-1/books/handbook/jails/chapter.sgml,v
retrieving revision 1.22
diff -u -r1.22 chapter.sgml
--- jails/chapter.sgml	8 Mar 2011 09:47:13 -0000	1.22
+++ jails/chapter.sgml	25 May 2011 17:26:16 -0000
@@ -239,13 +239,14 @@
       affected by it.  The &man.jail.8; manual page is quite clear about
       the procedure for building a jail:</para>
 
-      <screen>&prompt.root; <userinput>setenv D <replaceable>/here/is/the/jail</replaceable></userinput>
-&prompt.root; <userinput>mkdir -p $D</userinput> <co id="jailpath">
+      <screen>&prompt.root; <userinput>setenv D <replaceable>/where/jails/live</replaceable></userinput>
+&prompt.root; <userinput>mkdir -p $D/<replaceable>jailname</replaceable></userinput> <co id="jailpath">
+&prompt.root; <userinput>chmod 0700 $D</userinput> <co id="chmod">
 &prompt.root; <userinput>cd /usr/src</userinput>
 &prompt.root; <userinput>make buildworld</userinput> <co id="jailbuildworld">
-&prompt.root; <userinput>make installworld DESTDIR=$D</userinput> <co id="jailinstallworld">
-&prompt.root; <userinput>make distribution DESTDIR=$D</userinput> <co id="jaildistrib">
-&prompt.root; <userinput>mount -t devfs devfs $D/dev</userinput> <co id="jaildevfs"></screen>
+&prompt.root; <userinput>make installworld DESTDIR=$D/<replaceable>jailname</replaceable></userinput> <co id="jailinstallworld">
+&prompt.root; <userinput>make distribution DESTDIR=$D/<replaceable>jailname</replaceable></userinput> <co id="jaildistrib">
+&prompt.root; <userinput>mount -t devfs devfs $D/<replaceable>jailname</replaceable>/dev</userinput> <co id="jaildevfs"></screen>
 
     <calloutlist>
       <callout arearefs="jailpath">
@@ -261,6 +262,18 @@
 	  of the &os; base system.</para>
       </callout>
 
+      <callout arearefs="chmod">
+	<para>It is important to restrict access to the jail from the host
+	  system to ensure that setuid files (for example) created in the jail
+	  are not usable in the host system; otherwise an attacker with root
+	  access to the jail and non-root access to the host system could
+	  create a setuid program in the jail and execute it in the host.
+	  For similar reasons it is a bad idea to share read/write
+	  <application>nullfs</application> mounts between jails, although
+	  <application>NFS</application> is fine, because of the way file
+	  descripters are handled.</para>
+      </callout>
+
       <callout arearefs="jailbuildworld">
 	<para>If you have already rebuilt your userland using
 	  <command>make world</command> or <command>make buildworld</command>,
@@ -281,7 +294,7 @@
 	  <filename class="directory">/usr/src/etc/</filename> to the
 	  <filename class="directory">/etc</filename> directory of the jail
 	  environment:
-	  <filename class="directory">$D/etc/</filename>.</para>
+	  <filename class="directory">$D/jailname/etc/</filename>.</para>
       </callout>
 
       <callout arearefs="jaildevfs">
@@ -297,6 +310,13 @@
       </callout>
     </calloutlist>
 
+    <note>
+      <para>Although hiding the jail directory using &man.chmod.1; prevents
+	the more obvious security problems, it is inadvisable to allow access to
+	the host system to anyone who has access to <username>root</username>
+	in a jail.</para>
+    </note>
+
     <para>Once a jail is installed, it can be started by using the
       &man.jail.8; utility.  The  &man.jail.8; utility takes four
       mandatory arguments which are described in the <xref
@@ -667,7 +687,7 @@
 	      install the read-only file system to the jail
 	      template:</para>
 
-	    <screen>&prompt.root; <userinput>mkdir /home/j /home/j/mroot</userinput>
+	    <screen>&prompt.root; <userinput>mkdir -m 0700 /home/j && mkdir /home/j/mroot</userinput>
 &prompt.root; <userinput>cd /usr/src</userinput>
 &prompt.root; <userinput>make installworld DESTDIR=/home/j/mroot</userinput></screen>
 	  </step>
@@ -831,7 +851,7 @@
 	     job *and* have the advantage of being part of the base
 	     system of FreeBSD? -->
 
-	    <screen>&prompt.root; <userinput>mkdir /home/js</userinput>
+	    <screen>&prompt.root; <userinput>mkdir -m 0700 /home/js</userinput>
 &prompt.root; <userinput>cpdup /home/j/skel /home/js/ns</userinput>
 &prompt.root; <userinput>cpdup /home/j/skel /home/js/mail</userinput>
 &prompt.root; <userinput>cpdup /home/j/skel /home/js/www</userinput></screen>
