From owner-freebsd-current@freebsd.org  Sun Dec 17 20:46:26 2017
Return-Path: <owner-freebsd-current@freebsd.org>
Delivered-To: freebsd-current@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id C56FDE955A3
 for <freebsd-current@mailman.ysv.freebsd.org>;
 Sun, 17 Dec 2017 20:46:26 +0000 (UTC)
 (envelope-from dan@langille.org)
Received: from clavin1.langille.org (clavin.langille.org [162.208.116.86])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client CN "clavin.langille.org",
 Issuer "BSD Cabal Headquarters" (not verified))
 by mx1.freebsd.org (Postfix) with ESMTPS id A06857DC67
 for <freebsd-current@freebsd.org>; Sun, 17 Dec 2017 20:46:25 +0000 (UTC)
 (envelope-from dan@langille.org)
Received: from (clavin1.int.langille.org (clavin1.int.unixathome.org
 [10.4.7.7]) (Authenticated sender: hidden) with ESMTPSA id 34BF231BD ; 
 Sun, 17 Dec 2017 20:46:11 +0000 (UTC)
Content-Type: text/plain;
	charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 11.2 \(3445.5.20\))
Subject: Re: cannot access pass device from within jail
From: Dan Langille <dan@langille.org>
In-Reply-To: <CA8846F6-23AA-448F-B35C-A7FE1D5A0C53@lists.zabbadoz.net>
Date: Sun, 17 Dec 2017 15:45:45 -0500
Cc: freebsd-current@freebsd.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <A587A926-7DD7-4BB6-A02A-BD7542F7C2E3@langille.org>
References: <E1314554-C8D0-4E8F-B8DB-E0B4D9DE325F@langille.org>
 <CA8846F6-23AA-448F-B35C-A7FE1D5A0C53@lists.zabbadoz.net>
To: "Bjoern A. Zeeb" <bzeeb-lists@lists.zabbadoz.net>
X-Mailer: Apple Mail (2.3445.5.20)
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.25
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
 <freebsd-current.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-current>, 
 <mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current/>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-current>, 
 <mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 17 Dec 2017 20:46:26 -0000

> On Dec 17, 2017, at 3:37 PM, Bjoern A. Zeeb =
<bzeeb-lists@lists.zabbadoz.net> wrote:
>=20
> On 17 Dec 2017, at 19:52, Dan Langille wrote:
>=20
>> Hello,
>>=20
>> What suggestions do you have for where I should look next? I'm happy =
to start installing various builds of FreeBSD in order to track down =
which commit caused this.
>>=20
>> I'm trying to access a tape library from within a jail running on a =
FreeBSD 11.1 host.  sa(4) devices are working (e.g. I can rewind nsa0).
>>=20
>> pass(4) devices (i.e. the tape changer ch0) are not working.  This =
morning I posted to -scsi@: =
https://lists.freebsd.org/pipermail/freebsd-scsi/2017-December/007608.html=

>>=20
>> The device appears in the jail and has appropriate permissions.  This =
access was granted
>> via /etc/devfs.rules using the same approach I used for FreeBSD 10.3
>>=20
>> The permissions in the jail:
>>=20
>> [root@bacula-sd-02 ~]# ls -l /dev/pass7
>> crw-------  1 root  operator  0x74 Dec 16 21:52 /dev/pass7
>>=20
>> The command in the jail:
>>=20
>> [root@bacula-sd-02 ~]# mtx -f /dev/pass7 status
>> cannot open SCSI device '/dev/pass7' - Operation not permitted
>>=20
>> Here is the truss output of the command in question: =
https://gist.github.com/dlangille/b80ee804b8080e1cbf5b5ab67f0bdabe
>=20
>=20
> You don=E2=80=99t by any chance have a securelevel > 1 set for that =
jail?


On the host:=20

$ sysctl kern.securelevel
kern.securelevel: -1


On the jail:

$ sysctl kern.securelevel
kern.securelevel: -1

Thank you
--=20
Dan Langille - BSDCan / PGCon
dan@langille.org