Date: Sat, 27 Aug 2011 10:05:15 -0700 From: Devin Teske <devin.teske@fisglobal.com> To: FreeBSD Jail <freebsd-jail@freebsd.org> Cc: Dave Robison <daver@vicor.com> Subject: VIMAGE versus Jail w/respect to SYSCTL security_jail OIDs Message-ID: <CA69BD33-3231-4833-8C2F-5EA368614E08@fisglobal.com>
next in thread | raw e-mail | index | archive | help
I'm finding a systemic problem with VIMAGE jails in comparison to regular j= ails in FreeBSD-8.1. All of the following sysctl's appear to correctly affect regular jails (eit= her created via /etc/rc.d/jail or manually via jail(8)): security.jail.mount_allowed security.jail.chflags_allowed security.jail.allow_raw_sockets security.jail.sysvipc_allowed security.jail.socket_unixiproute_only security.jail.set_hostname_allowed security.jail.jail_max_af_ips Indeed, when interrogated within the jail, they show the value that was inh= erited from the underlying host at jail startup. However, none of the above sysctl's appear to be inherited by vnet jails. These would be jails that are created with the "jail -c vnet ..." syntax of= jail(8) with VIMAGE enabled in the kernel. Interrogating any of the above sysctl's from within a vnet jail always prod= uces the following default values, regardless of what you set the host valu= es to and regardless of how many times you bounce the vimage: vnettest# sysctl security.jail | grep -v param security.jail.enforce_statfs: 1 security.jail.mount_allowed: 1 security.jail.chflags_allowed: 0 security.jail.allow_raw_sockets: 0 security.jail.sysvipc_allowed: 0 security.jail.socket_unixiproute_only: 1 security.jail.set_hostname_allowed: 1 security.jail.jail_max_af_ips: 255 security.jail.jailed: 1 Any ideas are welcome. I think I'm going to go delve into the jail(8) code now, because I've slogg= ed all through the kernel and can't find anything in the kernel that passes= these values from host to jail (it must be jail(8) that's doing this funct= ionality). --=20 Devin NOTE: This comes on the back of trying to get nfsd running within a vimage = jail. I suspect that the lack of ability to change one or more of the above= sysctl's to be the reason why we can't get nfsd to fire-up. Firing up nfsd= within a vimage jail produces no results (no error status, no error text, = no log entries, nada, zip, zilch, nothing). rpcbind runs, mountd runs, but = nfsd refuses for some reason. _____________ The information contained in this message is proprietary and/or confidentia= l. If you are not the intended recipient, please: (i) delete the message an= d all copies; (ii) do not disclose, distribute or use the message in any ma= nner; and (iii) notify the sender immediately. In addition, please be aware= that any message addressed to our domain is subject to archiving and revie= w by persons other than the intended recipient. Thank you. _____________
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CA69BD33-3231-4833-8C2F-5EA368614E08>