From owner-freebsd-jail@FreeBSD.ORG Mon Jun 15 17:32:55 2015 Return-Path: Delivered-To: freebsd-jail@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id A9C3B4A6; Mon, 15 Jun 2015 17:32:55 +0000 (UTC) (envelope-from bzeeb-lists@lists.zabbadoz.net) Received: from mx1.sbone.de (mx1.sbone.de [IPv6:2a01:4f8:130:3ffc::401:25]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (Client CN "mx1.sbone.de", Issuer "SBone.DE" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 616A9DC0; Mon, 15 Jun 2015 17:32:55 +0000 (UTC) (envelope-from bzeeb-lists@lists.zabbadoz.net) Received: from mail.sbone.de (mail.sbone.de [IPv6:fde9:577b:c1a9:31::2013:587]) (using TLSv1 with cipher ADH-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by mx1.sbone.de (Postfix) with ESMTPS id 44C9225D3891; Mon, 15 Jun 2015 17:32:51 +0000 (UTC) Received: from content-filter.sbone.de (content-filter.sbone.de [IPv6:fde9:577b:c1a9:31::2013:2742]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.sbone.de (Postfix) with ESMTPS id 56210C77036; Mon, 15 Jun 2015 17:32:50 +0000 (UTC) X-Virus-Scanned: amavisd-new at sbone.de Received: from mail.sbone.de ([IPv6:fde9:577b:c1a9:31::2013:587]) by content-filter.sbone.de (content-filter.sbone.de [fde9:577b:c1a9:31::2013:2742]) (amavisd-new, port 10024) with ESMTP id Fvpq1GMwVR0V; Mon, 15 Jun 2015 17:32:48 +0000 (UTC) Received: from [IPv6:fde9:577b:c1a9:4420:cabc:c8ff:fe8b:4fe6] (orange-tun0-ula.sbone.de [IPv6:fde9:577b:c1a9:4420:cabc:c8ff:fe8b:4fe6]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.sbone.de (Postfix) with ESMTPSA id D8381C76FD3; Mon, 15 Jun 2015 17:32:47 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2098\)) Subject: Re: How to implement jail-aware SysV IPC (with my nasty patch) From: "Bjoern A. Zeeb" In-Reply-To: Date: Mon, 15 Jun 2015 17:32:45 +0000 Cc: freebsd-jail@freebsd.org, freebsd-virtualization@freebsd.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <2B7AA933-CB74-4737-8330-6E623A31C6DA@lists.zabbadoz.net> To: kikuchan@uranus.dti.ne.jp X-Mailer: Apple Mail (2.2098) X-BeenThere: freebsd-jail@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Discussion about FreeBSD jail\(8\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Jun 2015 17:32:55 -0000 > On 15 Jun 2015, at 17:10 , kikuchan@uranus.dti.ne.jp wrote: >=20 > On Mon, 15 Jun 2015 09:53:53 +0000, "Bjoern A. Zeeb" = wrote: >> Hi, >>=20 >> removed hackers, added virtualization. >>=20 >>=20 >>> On 12 Jun 2015, at 01:17 , kikuchan@uranus.dti.ne.jp wrote: >>>=20 >>> Hello, >>>=20 >>> I=E2=80=99m (still) trying to figure out how jail-aware SysV IPC = mechanism should be. >>=20 >> The best way probably is to finally get the =E2=80=9Ccommon=E2=80=9D = VIMAGE framework into HEAD to allow easy virtualisation of other = services. That work has been sitting in perforce for a few years and = simply needs updating for sysctls I think. >>=20 >> Then use that to virtualise things and have a vipc like we have = vnets. The good news is that you have identified most places and have = the cleanup functions already so it=E2=80=99d be a matter of = transforming your changes (assuming they are correct and working fine; = haven=E2=80=99t actually read the patch in detail;-) to the different = infrastructure. And that=E2=80=99s the easiest part. >>=20 >>=20 >> Bjoern >=20 > Hi Bjoern, > Thank you for your reply. >=20 > The "common" VIMAGE framework sounds good, I really want it. >=20 > I want to know what the IPC system looks like for user-land after = virtualized, > and what happen if vnet like vipc is implemented. >=20 > For example, jail 1, 2, 3 join vipc group A, and jail 4, 5, 6 join = vipc group B ?? > Hmm, it looks good. That=E2=80=99s not exactly how it works currently and I think the mixing = of options will be harder and something we=E2=80=99l have to figure out = more carefully. You would be able to say jail 1 has a vipc and jail 2 and 3 and =E2=80=9Cc= hild jails=E2=80=9D and inherit it. (similar for 4 + 5,6) so it=E2=80=99s= nested but not side-by-side. If we want more of the =E2=80=9Cmixing=E2=80=9D and independentness = we=E2=80=99ll have to re-think the way we =E2=80=9Cmanage=E2=80=9D = jails. Bjoern=