Date: Thu, 8 Dec 2016 19:13:15 +0000 From: SK <fbstable@cps-intl.org> To: Miroslav Lachman <000.fbsd@quip.cz>, freebsd-jail <freebsd-jail@freebsd.org> Subject: Re: ZFS and Jail :: nullfs mount :: nothing visible from host Message-ID: <eed9efad-9bac-9d36-b75e-c41f9ea72a8b@cps-intl.org> In-Reply-To: <58499446.3050403@quip.cz> References: <aa078173-e9f1-3f09-41d4-6613014b1119@cps-intl.org> <584986D0.3040109@quip.cz> <2b6346f8-ed02-0e6d-bd89-106098e7eb2d@cps-intl.org> <58499446.3050403@quip.cz>
next in thread | previous in thread | raw e-mail | index | archive | help
On 08/12/2016 17:11, Miroslav Lachman wrote:
>
> What are jails properties? Do you have something like this?
>
> enforce_statfs=1 allow.mount=1 allow.mount.zfs=1 allow.mount.procfs=1
> allow.mount.devfs=1
>
> Then you need to run
> zfs jail $JID tank/jail/testJail (put the real UID of running jail
> and path to dedicated dataset)
>
> Miroslav Lachman
>
Dear Miroslav, Alexander
@Alexander : I checked out your link. It is interesting, but you are
using ezjail which I am trying to avoid. I have nothing against it, but
I think making it working without too many additional layer of
obfuscation will help me learn it better. So, thanks again, and sorry I
cannot use that solution right now.
@Miroslav : as I mentioned earlier, I did have those parameters but that
didn't seem to do any good on the main system since I was using nullfs
for mounting jails. However, on the new system I used purely zfs and
things have improved slightly.
Current status
the main system (host) has gT as the pool/dataset, where the root is
mounted. I have created two more datasets
# zfs list
NAME USED AVAIL REFER MOUNTPOINT
gT 10.3G 199G 9.51G legacy
gT/JailS 832M 199G 20K /JailS
gT/JailS/testJail 546K 199G 827M /JailS/testJail
Initially they were not visible from within the jail, but as I ran
zfs jail testJail gT/JailS/testJail
they were visible from inside.
HOWEVER, I am unable to do any manipulation whatsoever from within the jail.
root@testJail:/ # zfs list
NAME USED AVAIL REFER MOUNTPOINT
gT 10.3G 199G 9.51G legacy
gT/JailS 832M 199G 20K /JailS
gT/JailS/testJail 546K 199G 827M /JailS/testJail
root@testJail:/ # zfs snapshot gT/JailS/testJail@test
*cannot create snapshots : permission denied*
root@testJail:/ # zfs create gT/JailS/testJail/test
*cannot create 'gT/JailS/testJail/test': permission denied*
root@testJail:/ # exit
Even after the jail was able to see the dataset, the following sysctl
was still zero
security.jail.mount_zfs_allowed: 0
I changed it to one, but that didn't seem to have the desired effect
(should have I restarted?)
below are some of the relevant settings. If you require any other
information, I'll try to send them as soon as I can.
# cat /etc/jail.conf
==============
### common items
host.hostname = "${name}";
path = "/JailS/${name}";
exec.start += "ifconfig ${ePairIF}b vnet ${name}" ;
exec.clean;
exec.system_user = "root";
exec.jail_user = "root";
exec.consolelog = "/var/log/jail_${name}_console.log";
command = "/sbin/ifconfig ${ePairIF}b inet ${jailIP} netmask
255.255.255.240" ;
command += "route add -inet default ${gWay}" ;
mount.fstab = "/etc/fstab.${name}";
devfs_ruleset = "4";
mount.devfs;
mount.fdescfs;
mount.procfs;
allow.mount;
allow.set_hostname = 0;
allow.sysvipc = 1;
allow.raw_sockets = 1;
vnet;
vnet="new";
$bridegIF = "bridge1" ;
$gWay = "10.7.3.1" ;
testJail {
enforce_statfs = 1 ;
allow.mount = 1;
allow.mount.zfs = 1;
allow.mount.procfs = 1 ;
allow.mount.devfs = 1 ;
$ePairIF = "epair0" ;
$jailIP = "10.7.3.4" ;
vnet.interface = ${ePairIF}b ;
exec.start = "/bin/sh /etc/rc" ;
exec.stop = "/bin/sh /etc/rc.shutdown" ;
persist ;
}
##################
# cat /etc/devfs.rules
=============
[devfsrules_jail=4]
add include $devfsrules_hide_all
add include $devfsrules_unhide_basic
add include $devfsrules_unhide_login
add path zfs unhide
# zfs status at the moment
root@testJail:/ # zfs list
NAME USED AVAIL REFER MOUNTPOINT
gT 10.3G 199G 9.51G legacy
gT/JailS 832M 199G 20K /JailS
gT/JailS/testJail 546K 199G 827M /JailS/testJail
root@testJail:/ # zfs snapshot gT/JailS/testJail@test
cannot create snapshots : permission denied
root@testJail:/ # zfs create gT/JailS/testJail/test
cannot create 'gT/JailS/testJail/test': permission denied
root@testJail:/ # exit
exit
Thanks and regards
SK
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?eed9efad-9bac-9d36-b75e-c41f9ea72a8b>