From owner-freebsd-jail@FreeBSD.ORG  Sun Nov 25 20:28:52 2012
Return-Path: <owner-freebsd-jail@FreeBSD.ORG>
Delivered-To: freebsd-jail@FreeBSD.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
 by hub.freebsd.org (Postfix) with ESMTP id 2288EE07
 for <freebsd-jail@FreeBSD.org>; Sun, 25 Nov 2012 20:28:52 +0000 (UTC)
 (envelope-from jamie@FreeBSD.org)
Received: from m2.gritton.org (gritton.org [199.192.164.235])
 by mx1.freebsd.org (Postfix) with ESMTP id DDA4D8FC12
 for <freebsd-jail@FreeBSD.org>; Sun, 25 Nov 2012 20:28:51 +0000 (UTC)
Received: from glorfindel.gritton.org (c-174-52-130-157.hsd1.ut.comcast.net
 [174.52.130.157]) (authenticated bits=0)
 by m2.gritton.org (8.14.5/8.14.5) with ESMTP id qAPK1SIa006809;
 Sun, 25 Nov 2012 13:01:28 -0700 (MST)
 (envelope-from jamie@FreeBSD.org)
Message-ID: <50B27916.9010002@FreeBSD.org>
Date: Sun, 25 Nov 2012 13:01:26 -0700
From: Jamie Gritton <jamie@FreeBSD.org>
User-Agent: Mozilla/5.0 (X11; U; FreeBSD amd64; en-US;
 rv:1.9.2.24) Gecko/20120129 Thunderbird/3.1.16
MIME-Version: 1.0
To: Beeblebrox <zaphod@berentweb.com>
Subject: Re: Recent jail problems [was: ICMP RAW socket error]
References: <1352457514352-5759501.post@n5.nabble.com>
 <50A51022.5000801@FreeBSD.org> <1353228642821-5761961.post@n5.nabble.com>
 <1353836793676-5763946.post@n5.nabble.com>
In-Reply-To: <1353836793676-5763946.post@n5.nabble.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: freebsd-jail@FreeBSD.org
X-BeenThere: freebsd-jail@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: "Discussion about FreeBSD jail\(8\)" <freebsd-jail.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-jail>,
 <mailto:freebsd-jail-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-jail>
List-Post: <mailto:freebsd-jail@freebsd.org>
List-Help: <mailto:freebsd-jail-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-jail>,
 <mailto:freebsd-jail-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 25 Nov 2012 20:28:52 -0000

On 11/25/12 02:46, Beeblebrox wrote:
> I'm probably overlooking certain things with this question, but there seems
> to be a number of places to make jail-specific adjustments / settings. The
> options available are:
>
> host /etc/rc.conf
> host /etc/sysctl.conf
> host /etc/devfs.rules
> host /etc/jail.conf
>
> Q1: With regards to getting around this problem
> (jail_xyz_parameters="allow.raw_sockets"), I tried placing this in
> /etc/rc.conf but I also had in /etc/sysctl.conf:
> security.jail.allow_raw_sockets=1
> security.jail.socket_unixiproute_only=1
> Maybe the 2 settings are in conflict?
>
> Q2: As far as I understand, jail related things in rc.conf, sysctl.conf and
> devfs.rules should now be migrated to jail.conf - Is that correct?
> Thanks.

Jail.conf will replace the jail settings in rc.conf and sysctl.conf, but
it doesn't yet. The rc system still uses the jail program in its old
command-line mode, and not with the conf files. devfs.rules will keep
its jail-related rules though.

- Jamie