From owner-freebsd-jail@FreeBSD.ORG  Mon Apr  1 02:24:29 2013
Return-Path: <owner-freebsd-jail@FreeBSD.ORG>
Delivered-To: freebsd-jail@FreeBSD.org
Received: from mx1.freebsd.org (mx1.FreeBSD.org [8.8.178.115])
 by hub.freebsd.org (Postfix) with ESMTP id 32C1DBFA
 for <freebsd-jail@FreeBSD.org>; Mon,  1 Apr 2013 02:24:29 +0000 (UTC)
 (envelope-from jamie@FreeBSD.org)
Received: from m2.gritton.org (gritton.org [199.192.164.235])
 by mx1.freebsd.org (Postfix) with ESMTP id 10F79E42
 for <freebsd-jail@FreeBSD.org>; Mon,  1 Apr 2013 02:24:28 +0000 (UTC)
Received: from glorfindel.gritton.org (c-174-52-130-157.hsd1.ut.comcast.net
 [174.52.130.157]) (authenticated bits=0)
 by m2.gritton.org (8.14.5/8.14.5) with ESMTP id r312ORHS067851;
 Sun, 31 Mar 2013 20:24:27 -0600 (MDT)
 (envelope-from jamie@FreeBSD.org)
Message-ID: <5158EFDA.7060406@FreeBSD.org>
Date: Sun, 31 Mar 2013 20:24:26 -0600
From: Jamie Gritton <jamie@FreeBSD.org>
User-Agent: Mozilla/5.0 (X11; U; FreeBSD amd64; en-US;
 rv:1.9.2.24) Gecko/20120129 Thunderbird/3.1.16
MIME-Version: 1.0
To: Paul Schenkeveld <freebsd@psconsult.nl>
Subject: Re: rc.d/jail and jail.conf
References: <AA7CA531-5197-4BBC-B260-A3EC8B7A1024@inbox.im>
 <alpine.BSF.2.00.1303302157010.85469@erdgeist.org>
 <515847AF.8070808@FreeBSD.org> <5158526A.4020400@quip.cz>
 <51586419.5090207@FreeBSD.org> <51586DC8.7030500@quip.cz>
 <515880F3.1050300@FreeBSD.org> <5158874C.2060701@erdgeist.org>
 <515888BA.8060804@FreeBSD.org>
 <alpine.BSF.2.00.1303312112370.85469@erdgeist.org>
 <20130401020158.GA5500@psconsult.nl>
In-Reply-To: <20130401020158.GA5500@psconsult.nl>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: freebsd-jail@FreeBSD.org
X-BeenThere: freebsd-jail@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: "Discussion about FreeBSD jail\(8\)" <freebsd-jail.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-jail>,
 <mailto:freebsd-jail-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-jail>
List-Post: <mailto:freebsd-jail@freebsd.org>
List-Help: <mailto:freebsd-jail-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-jail>,
 <mailto:freebsd-jail-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 01 Apr 2013 02:24:29 -0000

On 03/31/13 20:01, Paul Schenkeveld wrote:
> On Sun, Mar 31, 2013 at 09:14:23PM +0200, Dirk Engling wrote:
>>
>> On Sun, 31 Mar 2013, Jamie Gritton wrote:
>>
>>> If you don't mind some slightly difficult error messages, you can always
>>> "disable" a jail with exec.prestart="false". jail(8) requires all
>>> commands to succeed, and in particular won't even create a jail when one
>>> of the prestart commands fails.
>>
>> This violates POLA, but failing with
>>
>> exec.prestart="echo skipping jail; exit 1"
>>
>> might work. Even though this is not a good marker from a scripting
>> perspective.
>
> Will this prevent all preparations from happening, i.e. will filesystems
> be mounted for jails disabled this way?

It will unroll anything that's been done, or at least try to. So
filesystems will be mounted, and then unmounted.

> Although this may work, I think that this looks dirty.  I'd really prefer
> a "disabled" or "noauto" keyword instead.

Oh it's definitely dirty - just something I threw out there as a hack.

- Jamie