You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/cloudlinuxos/cloudlinux_os_components/README.md
+48-53Lines changed: 48 additions & 53 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1503,29 +1503,29 @@ To see which letters were sent via lves-tats notifier in the logs, do the follow
1503
1503
1504
1504
## CageFS
1505
1505
1506
-
### General information and requirements
1506
+
### General Information and Requirements
1507
1507
1508
1508
* [Minimum Requirements](./#minimum-requirements)
1509
-
* [CageFS quirks](./#cagefs-quirks)
1509
+
* [CageFS Quirks](./#cagefs-quirks)
1510
1510
1511
-
CageFS is a virtualized file system and a set of tools to contain each user in its own 'cage'. Each customer will have its own fully functional CageFS, with all the system files, tools, etc.
1511
+
CageFS is a virtualized file system and a set of tools designed to isolate each user in their own 'cage.' Each customer gets their own fully functional CageFS environment, complete with system files, tools, and more.
1512
1512
1513
-
The benefits of CageFS are:
1513
+
Benefits of CageFS:
1514
1514
1515
-
* Only safe binaries are available to user
1516
-
* User will not see any other users, and would have no way to detect presence of other users & their user names on the server
1517
-
* User will not be able to see server configuration files, such as Apache config files.
1518
-
* User's will have limited view of _/proc_ file system, and will not be able to see other users' processes
1515
+
* Only safe binaries are available to the user.
1516
+
* Users cannot see or detect other users or their usernames on the server.
1517
+
* Users cannot access server configuration files, such as Apache configuration files.
1518
+
* Users have a restricted view of the _/proc_ file system and cannot see other users' processes.
1519
1519
1520
-
At the same time, user's environment will be fully functional, and user should not feel in any way restricted. No adjustments to user's scripts are needed. CageFS will cage any scripts execution done via:
1520
+
Despite these restrictions, the user's environment remains fully functional, and users should not feel limited in any way. No changes to user scripts are required. CageFS will isolate any script execution performed via:
* <span class="notranslate"> LiteSpeed Web Server </span>
1523
-
* <span class="notranslate"> Cron Jobs </span>
1523
+
* <span class="notranslate"> Cron Jobs </span>
1524
1524
* SSH
1525
-
* Any other <span class="notranslate"> PAM </span>enabled service
1525
+
* Any other <span class="notranslate"> PAM </span>-enabled service
1526
1526
1527
1527
::: tip Note
1528
-
mod_php is not supported, MPM ITK requires a custom patch
1528
+
mod_php is not supported, and MPM ITK requires a custom patch.
1529
1529
:::
1530
1530
1531
1531
::: tip Note
@@ -1536,29 +1536,27 @@ See also [Compatibility Matrix](/cloudlinuxos/limits/#compatibility-matrix).
1536
1536
1537
1537
#### Minimum Requirements:
1538
1538
1539
-
* kernel: CL6 with lve1.2.17.1 or later, CL7.
1539
+
* Kernel: CL6 with lve1.2.17.1 or later, CL7.
1540
1540
* 7GB of disk space.
1541
1541
1542
-
Depending on your setup, and number of users, you might also need:
1543
-
* Up to 8MB per customer in `/var` directory (to store custom `/etc` directory)
1544
-
* 5GB to 20GB in `/usr/share` directory (to store safe skeleton of a filesystem)
1542
+
Depending on your setup and the number of users, you might also need:
1543
+
* Up to 8MB per customer in the `/var` directory (to store custom `/etc` directories).
1544
+
* 5GB to 20GB in the `/usr/share` directory (to store a safe skeleton of a filesystem).
1545
1545
1546
1546
::: danger Warning
1547
-
If at any time you decide to uninstall CageFS, please make sure you follow [uninstall instructions](./#uninstalling)
1547
+
If you decide to uninstall CageFS, ensure you follow the [uninstall instructions](./#uninstalling).
1548
1548
:::
1549
1549
1550
-
#### CageFS quirks
1551
-
1550
+
#### CageFS Quirks
1552
1551
1553
-
Due to the nature of CageFS, some options will not work as before or will require some changes:
1552
+
Due to its design, some features may not work as expected or may require adjustments:
1554
1553
1555
-
* lastlog will not work (<span class="notranslate">`/var/log/lastlog`</span>).
1556
-
* PHP will load `php.ini` from <span class="notranslate">`/usr/selector/php.ini`</span>. That file is actually a link to the real `php.ini` file from your system. So the same `php.ini` will be loaded in the end.
1557
-
* You have to run <span class="notranslate">`cagefsctl --update`</span> any time you have modified `php.ini`, or you want to get new/updated software inside CageFS.
1558
-
* CageFS installation changes <span class="notranslate">`jailshell`</span> to regular bash on cPanel - [read why](https://cloudlinux.zendesk.com/hc/articles/115004517685-Why-CageFS-installation-changes-jailshell-to-regular-bash-on-cPanel-).
1554
+
* The `lastlog` command will not work (<span class="notranslate">`/var/log/lastlog`</span>).
1555
+
* PHP will load `php.ini` from <span class="notranslate">`/usr/selector/php.ini`</span>. This file is a link to the actual `php.ini` file on your system, ensuring the same `php.ini` is ultimately loaded.
1556
+
* You must run <span class="notranslate">`cagefsctl --update`</span> whenever you modify `php.ini` or need new/updated software inside CageFS.
1557
+
* CageFS installation changes <span class="notranslate">`jailshell`</span> to regular bash on cPanel. [Learn why](https://cloudlinux.zendesk.com/hc/articles/115004517685-Why-CageFS-installation-changes-jailshell-to-regular-bash-on-cPanel-).
1559
1558
1560
-
1561
-
### Installation and update
1559
+
### Installation and Update
1562
1560
1563
1561
To install CageFS:
1564
1562
<div class="notranslate">
@@ -1569,7 +1567,7 @@ yum install cagefs
1569
1567
```
1570
1568
</div>
1571
1569
1572
-
That last command will create skeleton directory that might be around 7GB in size. If you don't have enough disk space in _/usr/share_, use following commands to have <span class="notranslate"> `cagefs-skeleton` </span> being placed in a different location:
1570
+
The last command creates a skeleton directory, which may require around 7GB of disk space. If you lack sufficient space in _/usr/share_, use the following commands to place the <span class="notranslate"> `cagefs-skeleton` </span> in a different location:
The commands above should be executed before the <span class="notranslate">`cagefsctl --init`</span>.
1579
+
Execute these commands before running <span class="notranslate">`cagefsctl --init`</span>.
1582
1580
1583
-
Also, it is needed approximately 4Kb of disk space per one user for the <span class="notranslate">`/var/cagefs`</span> directory. You should place the <span class="notranslate">`/var/cagefs`</span> directory on partition, which is large enough and has disk quota enabled.
1581
+
Additionally, approximately 4KB of disk space per user is required for the <span class="notranslate">`/var/cagefs`</span> directory. Ensure this directory is located on a partition with sufficient space and disk quota enabled.
1584
1582
1585
-
For example, to create the <span class="notranslate">`/var/cagefs`</span> directory on the <span class="notranslate">`/home`</span> partition, execute the following commands before the <span class="notranslate">`cagefsctl --init`</span>:
1583
+
For example, to create the <span class="notranslate">`/var/cagefs`</span> directory on the <span class="notranslate">`/home`</span> partition, execute the following commands before running <span class="notranslate">`cagefsctl --init`</span>:
Please make sure to turn on disk quota for a partition where the <span class="notranslate">`/var/cagefs`</span> directory is located, or move the <span class="notranslate">`/var/cagefs`</span> to a partition where disk quota is enabled. This is needed to prevent users from abusing disk quota inside CageFS.
1594
+
Ensure disk quota is enabled for the partition where the <span class="notranslate">`/var/cagefs`</span> directory is located, or move it to a partition with disk quota enabled. This prevents users from abusing disk quota inside CageFS.
1598
1595
:::
1599
1596
1600
-
If the `/var/cagefs` directory is already created, you can move it. How to move the `/var/cagefs` directory:
1597
+
If the `/var/cagefs` directory already exists, you can move it. Learn how to move the `/var/cagefs` directory:
If you are placing skeleton in <span class="notranslate">`/home`</span> directory on cPanel servers, you must configure the following option in cPanel WHM: <span class="notranslate"> **WHM -> Server Configuration -> Basic cPanel/WHM Setup -> Basic Config -> Additional home directories** </span>
1606
-
Change the value to blank (not default <span class="notranslate"> Home </span>). Without changing this option, cPanel will create new accounts in incorrect places.
1601
+
If you place the skeleton in the <span class="notranslate">`/home`</span> directory on cPanel servers, configure the following option in cPanel WHM: <span class="notranslate"> **WHM -> Server Configuration -> Basic cPanel/WHM Setup -> Basic Config -> Additional home directories** </span>.
1602
+
Set the value to blank (not the default <span class="notranslate"> Home </span>). Without this change, cPanel will create new accounts in incorrect locations.
1607
1603
:::
1608
1604
1609
-
CageFS will automatically detect and configure all necessary files for:
1605
+
CageFS automatically detects and configures all necessary files for:
1610
1606
* cPanel
1611
1607
* Plesk
1612
1608
* DirectAdmin
@@ -1616,19 +1612,18 @@ CageFS will automatically detect and configure all necessary files for:
1616
1612
* PostgreSQL
1617
1613
* LiteSpeed
1618
1614
1619
-
Web interface to manage CageFS is available for cPanel, Plesk 10+, DirectAdmin, ISPmanager & Interworx. Command line tool would need to be used for other control panels.
1620
-
1621
-
Once you initialized the template you can start enabling users. By default CageFS is disabled for all users.
1615
+
A web interface for managing CageFS is available for cPanel, Plesk 10+, DirectAdmin, ISPmanager, and Interworx. For other control panels, use the command-line tool.
1622
1616
1623
-
Starting from **cagefs-6.1-27** <span class="notranslate">`fs.proc_can_see_other_uid`</span> will be migrated (one time) from _/etc/sysctl.conf_ into _/etc/sysctl.d/90-cloudlinux.conf_ . If this variable is not set in either file, it will default to 0.
1617
+
Once the template is initialized, you can start enabling users. By default, CageFS is disabled for all users.
1624
1618
1625
-
It is strongly advised against setting this variable in `90-cloudlinux.conf`. Define it in `/etc/sysctl.conf` or in some other config file with an index number greater than `90-cloudlinux.conf`, e.g. `/etc/sysctl.d/95-custom.conf`.
1619
+
Starting from **cagefs-6.1-27**, the <span class="notranslate">`fs.proc_can_see_other_uid`</span> setting is migrated (one time) from _/etc/sysctl.conf_ to _/etc/sysctl.d/90-cloudlinux.conf_. If this variable is not set in either file, it defaults to 0.
1626
1620
1627
-
You can find more information on <span class="notranslate">`fs.proc_can_see_other_uid`</span> automatic migration in [Kernel Config Variables](/cloudlinuxos/cloudlinux_os_kernel/#kernel-config-variables).
1621
+
It is strongly recommended not to set this variable in `90-cloudlinux.conf`. Instead, define it in `/etc/sysctl.conf` or another config file with an index number greater than `90-cloudlinux.conf`, such as `/etc/sysctl.d/95-custom.conf`.
1628
1622
1623
+
For more information on the automatic migration of <span class="notranslate">`fs.proc_can_see_other_uid`</span>, see [Kernel Config Variables](/cloudlinuxos/cloudlinux_os_kernel/#kernel-config-variables).
1629
1624
1630
1625
:::tip Note
1631
-
You can also use [CageFS CLI](/cloudlinuxos/command-line_tools/#cagefs)
1626
+
You can also use [CageFS CLI](/cloudlinuxos/command-line_tools/#cagefs).
1632
1627
:::
1633
1628
1634
1629
### Uninstalling
@@ -1642,9 +1637,9 @@ To uninstall CageFS, start by disabling and removing all directories:
1642
1637
```
1643
1638
</div>
1644
1639
1645
-
That command will: disable CageFS for all customers, unmount CageFS for all users, removes <span class="notranslate"> _/usr/share/cagefs-skeleton_ & _/var/cagefs_ </span> directories. It will not remove _/etc/cagefs_ directory.
1640
+
This command disables CageFS for all customers, unmounts CageFS for all users, and removes the <span class="notranslate"> _/usr/share/cagefs-skeleton_ & _/var/cagefs_ </span> directories. It does not remove the _/etc/cagefs_ directory.
1646
1641
1647
-
Remove CageFS RPM:
1642
+
To remove the CageFS RPM:
1648
1643
1649
1644
<div class="notranslate">
1650
1645
@@ -1870,22 +1865,22 @@ ffmpeg RPM should be installed on the system already.
1870
1865
:::
1871
1866
1872
1867
1873
-
#### Excluding files
1868
+
#### Excluding Files
1874
1869
1870
+
To exclude files and directories from CageFS, create a file with the <span class="notranslate">`.black.list`</span> extension inside the <span class="notranslate">`/etc/cagefs/`</span> directory.
1871
+
List the files or directories to exclude, one per line.
1875
1872
1876
-
To exclude files and directories from CageFS, edit file:
0 commit comments