Date: Fri, 12 Nov 2021 14:16:24 +0000 From: bugzilla-noreply@freebsd.org To: jail@FreeBSD.org Subject: [Bug 259770] ggate: jail(2) failure error: Unable to jail process in directory /var/empty after stable/12 src ca9ab8ea1774 Message-ID: <bug-259770-29815-5PI2Q1gYGT@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-259770-29815@https.bugs.freebsd.org/bugzilla/> References: <bug-259770-29815@https.bugs.freebsd.org/bugzilla/>
next in thread | previous in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D259770 --- Comment #5 from Fabian Keil <fk@fabiankeil.de> --- Thanks a lot for your thoughts. Actually only the forked connection handler(s) go to jail and change the ui= d: [fk@elektrobier ps waux | grep [g]gated root 13676 0.0 0.1 12232 2296 - Ss 14:55 0:00.00 ggated -a 127.0.1.6 ggated 13743 0.0 0.1 17600 3068 - SCJ 14:55 0:00.02 ggated -a 127.0.1.6 [fk@elektrobier ~]$ sudo procstat -f $(pgrep ggated) PID COMM FD T V FLAGS REF OFFSET PRO NAME=20=20=20=20= =20=20=20=20 13743 ggated text v r r------- - - - /sbin/ggated=20= =20=20=20=20=20 13743 ggated cwd v d r------- - - - /var/empty=20=20= =20=20=20=20=20=20 13743 ggated root v d r------- - - - /var/empty=20=20= =20=20=20=20=20=20 13743 ggated jail v d r------- - - - /var/empty=20=20= =20=20=20=20=20=20 13743 ggated 0 v c rw------ 6 0 - /dev/null=20=20= =20=20=20=20=20=20=20 13743 ggated 1 v c rw------ 6 0 - /dev/null=20=20= =20=20=20=20=20=20=20 13743 ggated 2 v c rw------ 6 0 - /dev/null=20=20= =20=20=20=20=20=20=20 13743 ggated 3 v d r----n-- 2 0 - /var/run=20=20=20= =20=20=20=20=20=20=20 13743 ggated 4 s - rw------ 2 0 UDD /var/run/logpriv 13743 ggated 5 v r -w---n-l 2 0 - /var/run/ggated.p= id 13743 ggated 6 s - rw------ 3 0 TCP 0 0 127.0.1.6:3080 0.0.0.0:0 13743 ggated 7 s - rw------ 1 0 TCP 0 0 127.0.1.6:3080 127.0.1.6:37026 13743 ggated 8 v c rw------ 1 0 -=20=20 /dev/zvol/dpool/ggated/t520.eli 13743 ggated 9 s - rw------ 2 0 TCP 0 0 127.0.1.6:3080 127.0.1.6:40360 13676 ggated text v r r------- - - - /sbin/ggated=20= =20=20=20=20=20 13676 ggated cwd v d r------- - - - /=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20 13676 ggated root v d r------- - - - /=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20 13676 ggated 0 v c rw------ 6 0 - /dev/null=20=20= =20=20=20=20=20=20=20 13676 ggated 1 v c rw------ 6 0 - /dev/null=20=20= =20=20=20=20=20=20=20 13676 ggated 2 v c rw------ 6 0 - /dev/null=20=20= =20=20=20=20=20=20=20 13676 ggated 3 v d r----n-- 2 0 - /var/run=20=20=20= =20=20=20=20=20=20=20 13676 ggated 4 s - rw------ 2 0 UDD /var/run/logpriv 13676 ggated 5 v r -w---n-l 2 0 - /var/run/ggated.p= id 13676 ggated 6 s - rw------ 3 0 TCP 0 0 127.0.1.6:3080 0.0.0.0:0 13676 ggated 7 ? - -------- 2 0 - -=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20 I wrote the code years ago and did not remember this. Looking at the procstat output more closely I realize that there is no reason why the forked process has to keep the pid file open at all. It contains the pid of the parent and the forked process does not actually have to unlink it either. Without the pid file open, jail(2) should succeed. The forked process probably does not need access to fd 6 either. Oops .... While I still think it could be useful to be able to jail a process with a pid file located outside of the jail I guess it's not required in this case and I should simply fix/improve my code. I'll look into this over the next couple of days and get back to you. --=20 You are receiving this mail because: You are on the CC list for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-259770-29815-5PI2Q1gYGT>