Date: Tue, 5 Jun 2001 14:25:40 +0200 (CEST) From: Oliver Fromme <olli@secnetix.de> To: freebsd-stable@FreeBSD.ORG Subject: Re: /usr/bin/host doesn't work in jail ...? Message-ID: <200106051225.OAA74361@lurza.secnetix.de> In-Reply-To: <20010604224217.A253@speedy.gsinet>
next in thread | previous in thread | raw e-mail | index | archive | help
Gerhard Sittig <Gerhard.Sittig@gmx.net> wrote: > Is this 4.3-RELEASE? Almost ... It's 4.3-RC2. > Since nslookup(1) doesn't work either I assume the problem spot > is somewhere else. Things I would check: > - do you have a NIC in this machine? Yes. > - do you use an ifconfig alias for the jail? No, there's only one IP. As far as I know, I can use that IP for jails, too (the jails don't have to have their own IPs). I've tried a second IP (alias) for the jail, but the problem is exactly the same. > - does *any* UDP communication work from inside the jail (to > itself and outside)? Can you play with /usr/ports/net/netcat? > jail$ echo OHYES | nc -l -u -p 8080 > jail$ echo HELLO | nc -w 1 -u $IP 8080 > host$ echo HELLO | nc -w 1 -u $IP 8080 Fails the same inside the jail: 86229 nc CALL connect(0x3,0x12005e060,0x10) 86229 nc RET connect -1 errno 22 Invalid argument You're right, it semms to affect all UDP datagram sockets. > - do you have a packet filter in the way? No. > Can you dump the calling parameters? Does ktrace(1) provide this > information? Unfortunately, it doesn't. > BTW: Wasn't there a bug in the gnats database about processes > failing (forgetting) to bind(2) their sockets to an address? > Search the PRs for "jail" to see if it's been fixed since. Oh, hm, that might be it. host and nslookup don't use bind(). I'll dig into the source, add a bind() and see if that changes anything. *sigh* There should be a sysctl or something so that it binds automatically inside jails if necessary. I guess host/nslookup are not the only programs which have problems ... :-( Maybe I find a possibility when looking at the kernel sources involved. > Oh, and check you sysctl's -- especially those to influence > jail's behaviour: > [...] Mine are the same as yours. > You did configure your jail's /etc area, didn't you? I'm using / as jail root (for testing), so the resolv.conf is the same as the host environment's ones. And no, it doesn't contain 127.0.0.1, but the DNS server's IP. (There is no BIND running on my box yet, so 127.0.0.1 wouldn't work anyway.) > > Oh by the way: When I enter the jail, the configuration of > > the lo0 interface gets deleted (and I can't bring it back > > within the jail): > > That's one of the design goals of a jail: to provide resources > for manipulation only when they are available for the jailed > process group exclusively I'm aware that it's perfectly OK that I can't manipulate lo0 inside the jail. I'm just worried that it gets deleted as soon as I enter the jail, because some things might need a correctly configured lo0. Regards Oliver -- Oliver Fromme, secnetix GmbH & Co KG, Oettingenstr. 2, 80538 München Any opinions expressed in this message may be personal to the author and may not necessarily reflect the opinions of secnetix in any way. "All that we see or seem is just a dream within a dream" (E. A. Poe) To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200106051225.OAA74361>