Date: Mon, 23 Jul 2007 15:33:33 +0200 From: Pawel Jakub Dawidek <pjd@FreeBSD.org> To: Boris Samorodov <bsam@ipt.ru> Cc: freebsd-current@FreeBSD.org Subject: Re: mount_nullfs inside a jail Message-ID: <20070723133333.GF5456@garage.freebsd.pl> In-Reply-To: <97732929@srv.sem.ipt.ru> References: <97732929@srv.sem.ipt.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --]
On Sun, Jul 22, 2007 at 04:18:06AM +0400, Boris Samorodov wrote:
> Hi!
>
>
> Is it possible to use mount_nullfs inside a jail?
>
> With amd64-current:
> -----
> # sysctl security.jail
> security.jail.jailed: 1
> security.jail.mount_allowed: 1
> security.jail.chflags_allowed: 1
> security.jail.allow_raw_sockets: 0
> security.jail.enforce_statfs: 2
> security.jail.sysvipc_allowed: 1
> security.jail.socket_unixiproute_only: 1
> security.jail.set_hostname_allowed: 1
> # mount_nullfs /usr/ports /mnt
> mount_nullfs: Operation not permitted
> -----
It is not possible. From jail(8):
security.jail.mount_allowed
This MIB entry determines if a privileged user inside a jail will be
able to mount and unmount file system types marked as jail-friendly.
The lsvfs(1) command can be used to find file system types available
for mount from within a jail. This functionality is disabled by
default, but can be enabled by setting this MIB entry to 1.
# lsvfs
Filesystem Refs Flags
-------------------------------- ----- ---------------
zfs 0 jail
nullfs 0 loopback
As you can see, nullfs doesn't have 'jail' flag. The only jail-friendly
file system currently is ZFS. Nullfs is a good candidate for a
jail-friendly file system, but is not marked as such yet.
--
Pawel Jakub Dawidek http://www.wheel.pl
pjd@FreeBSD.org http://www.FreeBSD.org
FreeBSD committer Am I Evil? Yes, I Am!
[-- Attachment #2 --]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.4 (FreeBSD)
iD8DBQFGpK4tForvXbEpPzQRAsV8AKCKuubOZb4vfPsrE7p4FJLvMUwjowCgzr3l
DpQTCqLmxHi90ft3rzemxLM=
=DHp2
-----END PGP SIGNATURE-----
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20070723133333.GF5456>