From owner-freebsd-stable@FreeBSD.ORG Thu Aug 8 16:11:54 2013 Return-Path: Delivered-To: freebsd-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTP id 2D96D7E0; Thu, 8 Aug 2013 16:11:54 +0000 (UTC) (envelope-from gkontos.mail@gmail.com) Received: from mail-ob0-x234.google.com (mail-ob0-x234.google.com [IPv6:2607:f8b0:4003:c01::234]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id DE2FD2070; Thu, 8 Aug 2013 16:11:53 +0000 (UTC) Received: by mail-ob0-f180.google.com with SMTP id up14so5366365obb.11 for ; Thu, 08 Aug 2013 09:11:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=pn/IZNIoInHbvaexkxgkRskp0aMA69ze414qE/K7Cbk=; b=JYE7YMGS4ocE/Mdk6OCywLNOKzuxH+8V4ct67hRD+Cv0G1S2jLqCkYUx5YJRNV1XzK YeXgttl4xixHR8+FOuJ2iB0BiCwqM1f/UfG5GkOzH6OGcamgB/boeA4jXNIMz6qQoWNh mma4V9eWwY7vQE3ZWT5y7k1tTOo11VuWfLCEvDAQm5FLd2YwLyf/BWwxBYbwN+Pkvf0S 41+GMpRtXZgt8kf1/FMAUHoyKdMJv4nyC7hPDPM1Lyt9kd08D7O0jTJzi17qFFRYwEIj fzpErZEeX86yU00OaTucRoH/U9AW7bQjo2B2ZOSGpGIFtgORmyLiV7mMJC1EDJeg0i11 eg6Q== MIME-Version: 1.0 X-Received: by 10.182.215.133 with SMTP id oi5mr6819865obc.83.1375978313088; Thu, 08 Aug 2013 09:11:53 -0700 (PDT) Received: by 10.76.35.67 with HTTP; Thu, 8 Aug 2013 09:11:53 -0700 (PDT) In-Reply-To: <520397E0.1090209@freebsd.org> References: <1375963526.32115.7488635.39B9BAB2@webmail.messagingengine.com> <520397E0.1090209@freebsd.org> Date: Thu, 8 Aug 2013 19:11:53 +0300 Message-ID: Subject: Re: ZFS in jails 9.2-RC1 permission denied From: George Kontostanos To: Matthew Seaman Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable X-Content-Filtered-By: Mailman/MimeDel 2.1.14 Cc: freebsd-stable@freebsd.org X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2013 16:11:54 -0000 On Thu, Aug 8, 2013 at 4:06 PM, Matthew Seaman wrote: > On 08/08/2013 13:05, Mark Felder wrote: > > On Thu, Aug 8, 2013, at 6:59, Trond Endrest=F8l wrote: > >> > >> I'm just guessing, but I doubt a jail would be able to create new ZFS > >> filesystems outside its own structure, if at all able. A jail would > >> however be allowed to (un)mount already existing filesystems within > >> its own structure, i.e. Pool/test1. > >> > > > > When I first reviewed his post I clearly confused "mounting" with > > "creating a new zfs filesystem". Is that even supposed to be permitted > > in a jail? I almost feel a sysctl disabling that by default would be > > nice... DoS by zfs filesystem creation/deletion, anyone? > > There's a 'zfs jail' command and a 'jailed' property you can set on a > ZFS which I believes allow you to manage that ZFS from within the jail. > I think that extends to creating other ZFSes beneath that one (which > would inherit the 'jailed' property), BICBW. > > Mostly I find it easier to just manage the ZFSes from the host system > but then again, I'm not really making very extensive use of jails. > > Cheers, > > Matthew > > _______________________________________________ > freebsd-stable@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-stable > To unsubscribe, send any mail to "freebsd-stable-unsubscribe@freebsd.org" > Yes, it is easier to manage ZFS datasets from the host system but in this case we are assigning a different jail to each customer. That jail should be able to receive snapshots. It was working fine so far with 9.1. --=20 George Kontostanos --- http://www.aisecure.net