And please stop showing what you have been able to do
Really?Stai focused because if I find some error on your tutorial,you "should" fix it. Your work is under examination
And please stop showing what you have been able to do
Really?Stai focused because if I find some error on your tutorial,you "should" fix it. Your work is under examination
# tar xvfp ubuntu-base-24.04-base-amd64.tar.gz -C /mnt/da4p2/Backup/compat/noble
# nano /etc/jail.conf.d/noble.conf
noble {
# hostname/path
host.hostname = "${name}";
path = "/mnt/da4p2/Backup/compat/${name}";
# permissions
allow.raw_sockets;
exec.clean;
persist;
sysvmsg=inherit;
sysvsem=inherit;
sysvshm=inherit;
enforce_statfs=1;
# permissions
devfs_ruleset=7;
# network
ip4.addr="lo1|10.10.0.5/24";
# mount
mount += "devfs $path/dev devfs rw 0 0";
mount += "tmpfs $path/dev/shm tmpfs rw,size=1g,mode=1777 0 0";
mount += "fdescfs $path/dev/fd fdescfs rw,linrdlnk 0 0";
mount += "linprocfs $path/proc linprocfs rw 0 0";
mount += "linsysfs $path/sys linsysfs rw 0 0";
mount += "/tmp $path/tmp nullfs rw 0 0";
mount += "/home $path/home nullfs rw 0 0";
mount += "/root $path/root nullfs rw 0 0";
# mount the video directory from the host to the jail after creating it
# mount += "/home/djwilcox/video $path/home/djwilcox/video nullfs rw 0 0";
# uncomment the line below for the xdg runtime directory for wayland after creating it
mount += "/var/run/user/0 $path/run/user/0 nullfs rw 0 0";
}
# nano /etc/fstab :
proc /proc procfs rw 0 0
#nano /etc/rc.conf
# noble="YES"
jail_enable="YES"
jail_parallel_start="YES"
[root@marietto /mnt/da4p2/Backup/compat]==> service jail onestart noble
Starting jails: noble.
[root@marietto /mnt/da4p2/Backup/compat]==> jexec noble /bin/bash
ELF binary type "0" not known.
ELF binary type "0" not known.
jexec: execvp: /bin/bash: Exec format error
sudo pkg install doas
/usr/local/etc/doas.conf
# permit user
permit keepenv :username
# jail
permit nopass :username cmd jexec
# root as root
permit nopass keepenv root as root
/etc/devfs.rules
[jail=7]
add include $devfsrules_jail
add path 'mixer*' unhide
add path 'dsp*' unhide
add path 'dri*' unhide
add path 'drm*' unhide
add path 'nvidia*' unhide
add path 'speaker*' unhide
sudo sysrc jail_enable="YES"
sudo sysrc cloned_interfaces="lo1"
sudo sysrc ifconfig_lo1_aliases="inet 10.10.0.1-12/24"
/etc/rc.conf
jail_enable="YES"
cloned_interfaces="lo1"
ifconfig_lo1_aliases="inet 10.10.0.1-12/24"
sudo zfs create zroot/jails
sudo zfs set mountpoint=/usr/local/jails zroot/jails
sudo zfs create zroot/jails/linux
sudo zfs set mountpoint=/usr/local/jails/linux zroot/jails/linux
sudo zfs create zroot/jails/linux/ubuntu
sudo zfs set mountpoint=/usr/local/jails/linux/ubuntu zroot/jails/linux/ubuntu
/etc/jail.conf
# startup/logging
exec.start = "/bin/sh /etc/rc";
exec.stop = "/bin/sh /etc/rc.shutdown";
exec.consolelog = "/var/log/jail_console_${name}.log";
sudo mkdir -p /etc/jail.conf.d/
/etc/jail.conf.d/ubuntu.conf
ubuntu {
# hostname/path
host.hostname = "${name}";
path = "/usr/local/jails/linux/${name}";
# permissions
allow.raw_sockets;
exec.clean;
persist;
sysvmsg=inherit;
sysvsem=inherit;
sysvshm=inherit;
enforce_statfs=1;
# permissions
devfs_ruleset=7;
# network
ip4.addr="lo1|10.10.0.5/24";
# mount
mount += "devfs $path/dev devfs rw 0 0";
mount += "tmpfs $path/dev/shm tmpfs rw,size=1g,mode=1777 0 0";
mount += "fdescfs $path/dev/fd fdescfs rw,linrdlnk 0 0";
mount += "linprocfs $path/proc linprocfs rw 0 0";
mount += "linsysfs $path/sys linsysfs rw 0 0";
mount += "/tmp $path/tmp nullfs rw 0 0";
mount += "/home $path/home nullfs rw 0 0";
# mount the video directory from the host to the jail after creating it
#mount += "/home/username/video $path/home/username/video nullfs rw 0 0";
# uncomment the line below for the xdg runtime directory for wayland after creating it
#mount += "/var/run/xdg/username $path/run/user/1001 nullfs rw 0 0";
}
/etc/pf.conf
nat on $int_if from {lo1:network} to any -> ($int_if)
antispoof log quick for { lo $int_if } label "block_spoofing"
#=========================================================================#
# variables, macro and tables #
#=========================================================================#
int_if="ue0" # usb to ethernet adaptor
#int_if="bge0" # thunderbolt to ethernet adaptor
#int_if="wlan0" # ralink usb wifi
vpn_if="tun0" # vpn interface
all_networks="0.0.0.0/0"
vpn_network="$vpn_if:network"
# 6881, 6882 = transmission. 22000, 21025 = syncthing
tcp_services = "{ ntp, 6881, 22000 }" # tcp services - torrent
udp_services = "{ ntp, 6882, 21025 }" # udp services - torrent
icmp_types = "{ echoreq, unreach }"
tcp_state="flags S/SA keep state"
udp_state="keep state"
#table <internet> { $all_networks, !self, !$int_if:network } # internet
#table <lan> { $int_if:network, !self } # lan network
table <myself> { self } # self
table <martians> { 0.0.0.0/8 10.0.0.0/8 127.0.0.0/8 169.254.0.0/16 \
172.16.0.0/12 192.0.0.0/24 192.0.2.0/24 224.0.0.0/3 \
192.168.0.0/16 198.18.0.0/15 198.51.100.0/24 \
203.0.113.0/24 } # broken networks
#=========================================================================#
# global policy #
#=========================================================================#
set block-policy drop
set loginterface $int_if
set fingerprints "/etc/pf.os"
set skip on lo0
scrub in all fragment reassemble no-df max-mss 1440
# nat jail
nat on $int_if from {lo1:network} to any -> ($int_if)
antispoof log quick for { lo $int_if } label "block_spoofing"
#=========================================================================#
# block #
#=========================================================================#
block log all # block log all
block return out quick inet6 all tag IPV6 # block ipv6
block in quick inet6 all tag IPV6 # block ipv6
# block broken networks - turned off for synergy
# block in quick from { <martians> no-route urpf-failed } to any tag BAD_PACKET
#=========================================================================#
# anchors #
#=========================================================================#
# emerging threats - anchor
#anchor "emerging-threats"
#load anchor "emerging-threats" from "/etc/pf.anchors/emerging-threats"
# openvpn - anchor
anchor "openvpn"
#=========================================================================#
# traffic tag #
#=========================================================================#
# icmp
pass inet proto icmp all icmp-type $icmp_types keep state tag ICMP
# Allow the tcp and udp services defined in the macros at the top of the file
pass in on $int_if inet proto tcp from any to ($int_if) port $tcp_services $tcp_state tag TCP_IN
pass in on $int_if inet proto udp from any to ($int_if) port $udp_services $udp_state tag UDP_IN
# outbound traffic
block out on $int_if all
pass out quick on $int_if all modulate state
#pass out quick on $int_if from <myself> to <lan> modulate state tag LAN_OUT
#pass out quick on $int_if from <myself> to <internet> modulate state tag INTERNET_OUT
sudo sysrc linux_enable="YES"
sudo service linux onestart
/etc/fstab
proc /proc procfs rw 0 0
fetch 'https://cdimage.ubuntu.com/ubuntu-base/releases/24.10/release/ubuntu-base-24.10-base-amd64.tar.gz'
I can't go on if I don't fix this error. If I came to that stage,I did the configuration before to reach it.
root@noble:/# uname -a
Linux noble 5.15.0 FreeBSD 14.1-RELEASE-p4 GENERIC x86_64 x86_64 x86_64 GNU/Linux
root@noble:/# echo nameserver 8.8.8.8 > /etc/resolv.conf
root@noble:/# printf "APT::Cache-Start 251658240;" > /etc/apt/apt.conf.d/00aptitude root@noble:/# printf "%b\n" "0.0 0 0.0\n0\nUTC" > /etc/adjtime
root@noble:/# apt update
Error: List directory /var/lib/apt/lists/partial is missing. - Acquire (2: No such file or directory)
root@noble:/# cd /var
bash: cd: /var: No such file or directory
root@noble:/# ls
bin boot dev etc home lib lib64 media mnt opt proc root run sbin srv sys tmp usr
root@noble:/# cd var
bash: cd: var: No such file or directory
Name=DaVinci Resolve
Exec=/home/djwilcox/bin/wrapper-freebsd -j 'ubuntu' -a 'resolve' -p 'on'
Name=Google Earth
Exec=/home/djwilcox/bin/wrapper-freebsd -j 'ubuntu' -a 'google-earth-pro'
~/.local/share/applications
[Desktop Entry]
Version=1.0
Encoding=UTF-8
Type=Application
Name=DaVinci Resolve
Exec=/home/djwilcox/bin/wrapper-freebsd -j 'ubuntu' -a 'resolve' -p 'on'
Icon=/usr/local/jails/linux/ubuntu/opt/resolve/graphics/DV_Resolve.png
Terminal=false
MimeType=application/x-resolveproj;
StartupNotify=true
Categories=AudioVideo
[Desktop Entry]
Version=1.0
Encoding=UTF-8
Type=Application
Name=Google Earth
Exec=/home/djwilcox/bin/wrapper-freebsd -j 'ubuntu' -a 'google-earth-pro'
Terminal=false
MimeType=application/x-resolveproj;
StartupNotify=true
Categories=AudioVideo
~/.config/pulse/default.pa
#!/usr/local/bin/pulseaudio -nF
# include default.pa and override
.include /usr/local/etc/pulse/default.pa
# jail
.ifexists module-esound-protocol-unix.so
load-module module-esound-protocol-unix
.endif
load-module module-native-protocol-unix socket=/tmp/pulseaudio.socket
# default sink
#set-default-sink oss_output.dsp1
#set-default-source oss_input.dsp0
~/bin/wrapper-freebsd
#!/bin/sh
# wrapper-freebsd
#===============================================================================
# script usage
#===============================================================================
usage () {
# if argument passed to function echo it
[ -z "${1}" ] || echo "! ${1}"
# display help
echo "\
# script usage
$(basename "$0") -j jail -a application -p on
-p on = enable audio on the freebsd host for the jail
"
exit 2
}
#===============================================================================
# check the number of arguments passed to the script
#===============================================================================
[ $# -gt 0 ] || usage "${WRONG_ARGS_ERR}"
#===============================================================================
# getopts check the options passed to the script
#===============================================================================
while getopts ':j:a:p:h' opt
do
case ${opt} in
j) jail="${OPTARG}";;
a) app="${OPTARG}";;
p) audio="${OPTARG}";;
h) usage;;
\?) usage "${INVALID_OPT_ERR} ${OPTARG}" 1>&2;;
:) usage "${INVALID_OPT_ERR} ${OPTARG} ${REQ_ARG_ERR}" 1>&2;;
esac
done
shift $((OPTIND-1))
#===============================================================================
# start audio if -p on option is specified
#===============================================================================
# default audio off
audio_default="off"
# start audio
audio () {
pulseaudio --start --daemonize 2>/dev/null
}
# check if pulseaudio should be started
case "${audio:=${audio_default}}" in
on) audio;;
off) echo 'off';;
*) usage;;
esac
#===============================================================================
# doas jexec into the jail and run the wrapper script to start the application
#===============================================================================
doas jexec "${jail}" \
/usr/local/bin/wrapper-jail \
-u "${USER}" \
-d "DBUS_SESSION_BUS_ADDRESS=${DBUS_SESSION_BUS_ADDRESS}" \
-a "${app}" \
"$@"
~/.config/pulse/client.conf
# This file is part of PulseAudio.
#
# PulseAudio is free software; you can redistribute it and/or modify
# it under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# PulseAudio is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public License
# along with PulseAudio; if not, see <http://www.gnu.org/licenses/>.
## Configuration file for PulseAudio clients. See pulse-client.conf(5) for
## more information. Default values are commented out. Use either ; or # for
## commenting.
; default-sink = oss_output.dsp1
; default-source =
default-server = /tmp/pulseaudio.socket
; default-dbus-server =
; autospawn = yes
; daemon-binary = /usr/local/bin/pulseaudio
; extra-arguments = --log-target=syslog
; cookie-file =
; enable-shm = yes
; shm-size-bytes = 0 # setting this 0 will use the system-default, usually 64 MiB
; auto-connect-localhost = no
; auto-connect-display = no
# ~/.zshenv
# for ZSH
case "$OSTYPE" in
freebsd*)
# Path
typeset -U PATH path
path=("$path[@]")
export PATH
# XDG_RUNTIME_DIR
export XDG_RUNTIME_DIR=/var/run/xdg/"${USER}"
# wayland - uncomment to use wayland
export WAYLAND_DISPLAY=wayland-0
export QT_QPA_PLATFORM=wayland
export GDK_BACKEND=wayland
;;
linux*)
typeset -U PATH path
path=("/opt/resolve/bin" "/bin" "/usr/bin" "$path[@]")
export PATH
# XDG_RUNTIME_DIR
export XDG_RUNTIME_DIR="/run/user/`id -u`"
# dummy-uvm.so for access to the gpu
export LD_PRELOAD="${HOME}"/.config/gpu/dummy-uvm.so
export __NV_PRIME_RENDER_OFFLOAD=1
export __GLX_VENDOR_LIBRARY_NAME=nvidia
# wayland - uncomment to use wayland
#export WAYLAND_DISPLAY=wayland-0
#export QT_QPA_PLATFORM=wayland
#export GDK_BACKEND=wayland
# x11 - comment out to use wayland
#export DISPLAY=unix:0
export DISPLAY=:0
export QT_QPA_PLATFORM=xcb
export GDK_BACKEND=x11
;;
esac
# xdg directories
export XDG_CONFIG_HOME="$HOME/.config"
export XDG_CACHE_HOME="$HOME/.cache"
export XDG_DATA_HOME="$HOME/.local/share"
# qt5
export QT_QPA_PLATFORMTHEME=qt5ct
/usr/local/bin/wrapper-jail
#!/bin/sh
#===============================================================================
# wrapper-jail
#===============================================================================
#===============================================================================
# script usage
#===============================================================================
usage () {
# if argument passed to function echo it
[ -z "${1}" ] || echo "! ${1}"
# display help
echo "\
# script usage
$(basename "$0") -u ${USER}"
exit 2
}
#===============================================================================
# check the number of arguments passed to the script
#===============================================================================
[ $# -gt 0 ] || usage "${WRONG_ARGS_ERR}"
#===============================================================================
# getopts check the options passed to the script
#===============================================================================
while getopts ':u:d:a:h' opt
do
case ${opt} in
u) username="${OPTARG}";;
d) dbus="${OPTARG}";;
a) app="${OPTARG}";;
h) usage;;
\?) usage "${INVALID_OPT_ERR} ${OPTARG}" 1>&2;;
:) usage "${INVALID_OPT_ERR} ${OPTARG} ${REQ_ARG_ERR}" 1>&2;;
esac
done
shift $((OPTIND-1))
#===============================================================================
# switch to our user in the jail and start the application
#===============================================================================
su "${username}" -c "${dbus} ${app} ${@}" 2>/dev/null
~/.local/share/applications/google-chome.desktop
[Desktop Entry]
Version=1.0
Encoding=UTF-8
Type=Application
Name=Google Chrome
Exec=/home/djwilcox/bin/wrapper-freebsd -j 'ubuntu' -p 'on' -a 'google-chrome --no-sandbox --no-zygote --ozone-platform=wayland --ignore-gpu-blocklist --disable-gpu-driver-bug-workarounds --enable-gpu-rasterization --enable-unsafe-webgpu --enable-zero-copy --enable-drdc --skia-graphite --enable-webgl-draft-extensions --enable-features=Vulkan,UseSkiaRendererer --use-vulkan --enable-features=VaapiVideoDecoder,VaapiVideoEncoder --canvas-oop-rasterization --enable-webgpu-developer-features --origin-trial-enabled-features=WebGPU --test-type --v=0 "$@"'
Terminal=false
MimeType=application/x-resolveproj;
StartupNotify=true
Categories=AudioVideo
wrapper-freebsd -j 'ubuntu' -p 'on' -a 'google-chrome --no-sandbox --no-zygote --ozone-platform=wayland --ignore-gpu-blocklist --disable-gpu-driver-bug-workarounds --enable-gpu-rasterization --enable-unsafe-webgpu --enable-zero-copy --enable-drdc --skia-graphite --enable-webgl-draft-extensions --enable-features=Vulkan,UseSkiaRendererer --use-vulkan --enable-features=VaapiVideoDecoder,VaapiVideoEncoder --canvas-oop-rasterization --enable-webgpu-developer-features --origin-trial-enabled-features=WebGPU --test-type --v=0 "$@"'
im installing linux in a jail and not in /compat
im not using the linuxulator so couldnt say
you dont need to add linprocfs and linsysfs to your fstab
one issue is if you close google chrome
you need to restart the jail before you can open it again
dont know why
# doas service jail stop noble
# doas service jail start noble
# doas jexec noble bash start-chrome
#!/mnt/da4p2/Backup/compat/noble/bin/bash
#
# chrome wrapper script from patovm04:
# https://forums.freebsd.org/threads/linuxulator-how-to-run-google-chrome-linux-binary-on-freebsd.77559/
#
export CHROME_PATH="/opt/google/chrome/chrome"
export CHROME_WRAPPER="$(readlink -f "$0")"
export LD_LIBRARY_PATH=/usr/local/steam-utils/lib64/fakeudev
export LD_PRELOAD=/usr/local/steam-utils/lib64/webfix/webfix.so
export LIBGL_DRI3_DISABLE=1
exec -a "$0" "$CHROME_PATH" \
--password-store=basic \
--use-gl=desktop \
--use-cmd-decoder=validating \
--disable-software-rasterizer \
--disable-font-subpixel-positioning \
--disable-gpu-driver-bug-workarounds \
--disable-gpu-driver-workarounds \
--disable-gpu-vsync \
--enable-accelerated-video-decode \
--enable-accelerated-mjpeg-decode \
--enable-features=VaapiVideoDecoder,VaapiVideoEncoder,CanvasOopRasterization \
--enable-gpu-compositing \
--enable-gpu-rasterization \
--enable-native-gpu-memory-buffers \
--enable-oop-rasterization \
--canvas-oop-rasterization \
--enable-raw-draw \
--use-vulkan \
--enable-zero-copy \
--ignore-gpu-blocklist \
--check-for-update-interval=604800 \
--no-sandbox --no-zygote --test-type --v=0 "$@"