From owner-freebsd-questions@FreeBSD.ORG Tue May 14 06:50:34 2013 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.FreeBSD.org [8.8.178.115]) by hub.freebsd.org (Postfix) with ESMTP id 64998A5B for ; Tue, 14 May 2013 06:50:34 +0000 (UTC) (envelope-from demelier.david@gmail.com) Received: from mail-we0-x235.google.com (mail-we0-x235.google.com [IPv6:2a00:1450:400c:c03::235]) by mx1.freebsd.org (Postfix) with ESMTP id 02D2A5EE for ; Tue, 14 May 2013 06:50:33 +0000 (UTC) Received: by mail-we0-f181.google.com with SMTP id q55so121851wes.26 for ; Mon, 13 May 2013 23:50:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:in-reply-to:references:date:message-id :subject:from:to:cc:content-type:content-transfer-encoding; bh=BfJT1hrqTQjEb5N0pzeRUVVzO/ysQIdBx2FUxo1N6YM=; b=knQYa+Yw8fDYAlcjM2OOKpS0GdtUrVwB98+pvYqtDQ4HBsR6mnlyo1nwWlAWNlVpYl 5PTmkSXKvb0hRsZlN8APqHiVz+RlKOfQDolDa6V2+XHIOYJ+nx8JQICslwIUef2wwxzb hsHF7TeOc/rrP0DdE2NJYv4zGPdOcfHwrPao6SqN5yiX6WBHAA3LF7hy1969sgN1XVdb xizcvZceO9Qu5XPnpmu/Hmf3XINb4ncc0Yjm53LFRg7rAciyukcBHqskp2yRMC4v8OpB Ezx5IZq40CaaaaLQ/E3U33LzUxNAJ520bJ/T1d5n7AnFkxiQvD1h0TlgBCLawRbXtl18 2g5w== MIME-Version: 1.0 X-Received: by 10.180.14.129 with SMTP id p1mr3369331wic.6.1368514233148; Mon, 13 May 2013 23:50:33 -0700 (PDT) Received: by 10.194.165.67 with HTTP; Mon, 13 May 2013 23:50:33 -0700 (PDT) In-Reply-To: <519188FD.7010900@a1poweruser.com> References: <11698066.Kggl9cS1ZD@melon> <51914DC1.1050207@a1poweruser.com> <1990818.dWVxsxnVR3@melon> <519188FD.7010900@a1poweruser.com> Date: Tue, 14 May 2013 08:50:33 +0200 Message-ID: Subject: Re: /etc/jail.conf for automatically started jails listed in /etc/rc.conf From: David Demelier To: Joe Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Cc: freebsd-questions@freebsd.org X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 May 2013 06:50:34 -0000 2013/5/14 Joe : > David Demelier wrote: >> >> Le lundi 13 mai 2013 16:32:01 Joe a =C3=A9crit : >>> >>> David Demelier wrote: >>>> >>>> Hello dear, >>>> >>>> Does jail.conf(5) does not work for jails listed in the rc.conf ? >>>> >>>> I've added in /etc/jail.conf: >>>> >>>> foo { >>>> >>>> hostname=3DFoo; >>>> path=3D/jails/foo; >>>> allow.sysvipc=3D1; >>>> >>>> } >>>> >>>> And in /etc/rc.conf only foo in the jail_list parameter, but when I tr= y >>>> to >>>> start the jail it still complain about missing hostname. >>>> >>>> Regards, >>> >>> There are 2 methods for configuring jails. >>> >>> The legacy method which you put the jail config statements in the hosts >>> /etc/rc.conf file and start and stop control is done by the hosts >>> /etc/rc.d/jail script at boot time. >>> >>> The jail(8) method which has it's own jail config statements in the >>> hosts /etc/jail.conf file and uses the jail(8) program for starting and >>> stopping. You can create a jail.conf file for each jail(8) and start it >>> using jail -c -f "/etc/jailname.jail.conf" and stop by issuing >>> jail -f "/etc/jailname.jail.conf" -r jailname >>> >>> You can not mix the 2 methods. >> >> >> My real problem is that I wanted to add allow.sysvipc only for *one* jai= l >> and I can't find a real solution by jail_* flags in /etc/rc.conf >> >> There is jail_allow_sysvipc but it enable it for all jails. >> >> > > > The jail(8) method does have a allow_sysvipc on a per jail basis. To use = it > you have to use the jail(8) method. The 9.1-RELEASE legacy method is a wo= rk > in process to incorporate the jail(8) parameters into the rc.conf config > statements. > > About the allow_sysvipc parameter, this breaks the security the jail is > designed to provide and should NOT be used on any jails having public > internet access. > > What are you trying to do that you think you need to use the allow_sysvip= c > parameter? > PostgreSQL, usually I install it on the host instead of jails, but I needed a second instance on a different port for a public access.. Regards, -- Demelier David