From owner-freebsd-jail@freebsd.org Tue Jan 8 20:14:40 2019 Return-Path: Delivered-To: freebsd-jail@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 0A89914896AA for ; Tue, 8 Jan 2019 20:14:40 +0000 (UTC) (envelope-from mjguzik@gmail.com) Received: from mailman.ysv.freebsd.org (mailman.ysv.freebsd.org [IPv6:2001:1900:2254:206a::50:5]) by mx1.freebsd.org (Postfix) with ESMTP id 5A72A75C0E for ; Tue, 8 Jan 2019 20:14:39 +0000 (UTC) (envelope-from mjguzik@gmail.com) Received: by mailman.ysv.freebsd.org (Postfix) id 1D7CE14896A9; Tue, 8 Jan 2019 20:14:39 +0000 (UTC) Delivered-To: jail@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id EEECB14896A8 for ; Tue, 8 Jan 2019 20:14:38 +0000 (UTC) (envelope-from mjguzik@gmail.com) Received: from mail-wr1-x433.google.com (mail-wr1-x433.google.com [IPv6:2a00:1450:4864:20::433]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 5A1A875C0D for ; Tue, 8 Jan 2019 20:14:38 +0000 (UTC) (envelope-from mjguzik@gmail.com) Received: by mail-wr1-x433.google.com with SMTP id q18so5345706wrx.9 for ; Tue, 08 Jan 2019 12:14:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=zmMc/kAFS8QTcpQ42dBV3KA98xE9DH/AGAb+icHrv5s=; b=R/2z1qW+scW52HhkvHZh0K1AKnVl7B/3a4tPk00JFwA/F0S2iKSO/9j3+HW4RDbqrT bAV+4XACbqHhAxRqyP8yFZJl+h3ZSj8fFIe34PqUEQHCNr/1h/ispVrXmlhwKsJBgBWP yfWx3RczBHKBqn6AsL2R4snCylXsiSTUPAD+STLLkuwLW2NbGeD/Dfb3eJCWaWlyNIVv mmELcrz4dSJbHdTKVJqLmAjAzr/XBgUhngiQfRhlK3+pdUIMLl/z1WMG8f64fTaz3ohy v1bIBk8byVBEOaSitt414qSX7rQOIwh5kC+1hckys0eoBx/dvb0CcYGvQ0O6TSTFcgbr 65ug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=zmMc/kAFS8QTcpQ42dBV3KA98xE9DH/AGAb+icHrv5s=; b=naLpYi6cCxuci11MWM9qFFwosnMl7YSAMbWlkZSnWTA8NzKL5Wr7SlxPCFOX8nUl5Z 1TPi2dvNK4j4UnWTQAlfBASgFejn6kGtLEjGCMqzAB7VZ/y+muSxxMeNSMxQhzjYYzwm IiBpplrCTMeQNw0yFV4sAsMiE1JT1XELtEfJxFDqhG1wjcc4l57I7pg1Esa7wEo4+LcM mq5XufT189JFjWppvqzQq0Kr0k8n47tbsCvhqUMy5U/HpfUR+rfLmEywStiQOWqi2FjM EQdR7njLAYOfq+E3s59zBHs9jbI64snTi7bpC/h+WZhm+FzIgTFhpBdKvMz/uqUnSjNX Argw== X-Gm-Message-State: AJcUukc4VUqHwHspzDAkgMWTnv4ywlnfX04VVzu7cIj0NufwqhyISide Xq+Fhq2+L+f73Br3XoPXwMGrlA6gZDm+zhRqSd1deg== X-Google-Smtp-Source: ALg8bN5nyljNkHCDYa0ucQLPs4jVFNs2Oey/qhw54iHX6eXCDJ2xMc7YnFbGVGJ56W39BUMs01APETSh7sS3/Z6PgbA= X-Received: by 2002:adf:8323:: with SMTP id 32mr2413214wrd.176.1546978477266; Tue, 08 Jan 2019 12:14:37 -0800 (PST) MIME-Version: 1.0 Received: by 2002:a5d:4602:0:0:0:0:0 with HTTP; Tue, 8 Jan 2019 12:14:36 -0800 (PST) In-Reply-To: <20190108190347.GA89234@mail.michaelwlucas.com> References: <20190108190347.GA89234@mail.michaelwlucas.com> From: Mateusz Guzik Date: Tue, 8 Jan 2019 21:14:36 +0100 Message-ID: Subject: Re: enforce_statfs showing leading path To: "Michael W. Lucas" Cc: jail@freebsd.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Rspamd-Queue-Id: 5A1A875C0D X-Spamd-Bar: ------ Authentication-Results: mx1.freebsd.org X-Spamd-Result: default: False [-7.00 / 15.00]; NEURAL_HAM_MEDIUM(-1.00)[-0.999,0]; NEURAL_HAM_SHORT(-1.00)[-0.997,0]; NEURAL_HAM_LONG(-1.00)[-1.000,0]; REPLY(-4.00)[] X-BeenThere: freebsd-jail@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Discussion about FreeBSD jail\(8\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Jan 2019 20:14:40 -0000 On 1/8/19, Michael W. Lucas wrote: > Hi, > > I'm experimenting with enforce_statfs for the jails book, and have hit > an inconsistency. Not sure if the bug should go to src or doc. Running > last week's -current. > > According to jail(8): > > When set to 1, only mount points below the jail's chroot > directory are visible. In addition to that, the path to the > jail's chroot directory is removed from the front of their > path=E2=80=90 > names. > > Seems pretty clear that I shouldn't see anything other than > > # jls -h name enforce_statfs > ... > ioc-www1 1 > > So, as I read it, the jail's chroot directory should be stripped down > to /. But inside the jail: > > root@www1:~ # mount > iocage/iocage/jails/www1/root on / (zfs, local, nfsv4acls) > devfs on /dev (devfs, local, multilabel) > fdescfs on /dev/fd (fdescfs) > > I see the jail's chroot directory. > > This seems to contradict the man page, unless I'm misunderstanding. > > Is this a software bug? A ZFS thing? A doc bug? Or am I just an idiot? > > Also, should this path be stripped when enforce_statfs is set to 1 *or > above*? Or is this strictly when set to 1? If I'm filing a bug, it > might as well be complete... > The "path" you are seeing is dataset name, which you made to resemble the mount point. Whether full dataset name should be exposed or not is a very different question, does illumos do it? Worst case it should be trivial to add a sysctl to just obfuscate the name. --=20 Mateusz Guzik