Date: Fri, 22 Mar 2013 01:20:41 +0100 From: Miroslav Lachman <000.fbsd@quip.cz> To: Jamie Gritton <jamie@FreeBSD.org> Cc: Harald Schmalzbauer <h.schmalzbauer@omnilan.de>, freebsd-jail@FreeBSD.org, freebsd-stable@FreeBSD.org Subject: Re: new jail(8) ignoring devfs_ruleset? Message-ID: <514BA3D9.5010901@quip.cz> In-Reply-To: <514BA14F.3090609@FreeBSD.org> References: <511E61F5.1000805@omnilan.de> <511EC759.4060704@FreeBSD.org> <5121EC52.5040502@omnilan.de> <20130219212430.GA92116@felucia.tataz.chchile.org> <514B9EF6.3000607@quip.cz> <514BA14F.3090609@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Jamie Gritton wrote: > On 03/21/13 17:59, Miroslav Lachman wrote: >> Jeremie Le Hen wrote: >>> On Mon, Feb 18, 2013 at 09:54:42AM +0100, Harald Schmalzbauer wrote: >>>> schrieb Jamie Gritton am 16.02.2013 00:40 (localtime): >>>>> On 02/15/13 09:27, Harald Schmalzbauer wrote: >>>>>> Hello, >>>>>> >>>>>> like already posted, on 9.1-R, I highly appreciate the new jail(8) >>>>>> and >>>>>> jail.conf capabilities. Thanks for that extension! >>>>>> >>>>>> Accidentally I saw that "devfs_ruleset" seems to be ignored. >>>>>> If I list /dev/ I see all the hosts disk devices etc. >>>>>> I set "devfs_ruleset = 4;" and "enforce_statfs = 1;" in jail.conf. >>>>>> Inside the jail, >>>>>> sysctl security.jail.devfs_ruleset returnes "1". >>>>>> But like mentioned, I can access all devices... [...] >> I can confirm mentioned problem on my FreeBSD 9.1-RELEASE amd64 GENERIC >> >> I am now testing new jail.conf possibilities and I am seeing all devices >> in /dev in jail. >> >> Even if I set all this in my jail.conf >> >> exec.start = "/bin/sh /etc/rc"; >> exec.stop = "/bin/sh /etc/rc.shutdown"; >> exec.clean; >> mount.devfs; >> devfs_ruleset = 4; >> allow.set_hostname = false; >> >> path = "/vol0/jail/$name"; >> exec.consolelog = "/var/log/jail/$name.console"; >> mount.fstab = "/etc/fstab.$name"; >> >> ## Jail bali >> bali { >> host.hostname = "bali.XXXXXXX.YY; >> ip4.addr = xx.xx.xx.xx; >> devfs_ruleset = 4; >> } [...] >> Is it a problem in my understanding of manpage / configuration, or is it >> a bug in jail command on 9.1-RELEASE? >> >> Miroslav Lachman > > It's a bug (deficiency) in the jail command. Is there a workaround or is it impossible to use jails with devfs on FreeBSD 9.1? Shouldn't it be mentioned in 9.1 errata? Is it fixed in stable/9? Thank you for your reply and your great work on new jails! Miroslav Lachman
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?514BA3D9.5010901>