From owner-freebsd-stable@FreeBSD.ORG Thu Aug 8 13:06:50 2013 Return-Path: Delivered-To: freebsd-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTP id 594CD5F5 for ; Thu, 8 Aug 2013 13:06:50 +0000 (UTC) (envelope-from matthew@freebsd.org) Received: from smtp.infracaninophile.co.uk (smtp6.infracaninophile.co.uk [IPv6:2001:8b0:151:1:3cd3:cd67:fafa:3d78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id CA43720E6 for ; Thu, 8 Aug 2013 13:06:49 +0000 (UTC) Received: from rufus.webfusion.com (mail.heartinternet.co.uk [79.170.40.31]) (authenticated bits=0) by smtp.infracaninophile.co.uk (8.14.7/8.14.7) with ESMTP id r78D6e5v093091 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO) for ; Thu, 8 Aug 2013 14:06:41 +0100 (BST) (envelope-from matthew@freebsd.org) DKIM-Filter: OpenDKIM Filter v2.8.3 smtp.infracaninophile.co.uk r78D6e5v093091 Authentication-Results: smtp.infracaninophile.co.uk/r78D6e5v093091; dkim=none reason="no signature"; dkim-adsp=none (unprotected policy) X-Authentication-Warning: lucid-nonsense.infracaninophile.co.uk: Host mail.heartinternet.co.uk [79.170.40.31] claimed to be rufus.webfusion.com Message-ID: <520397E0.1090209@freebsd.org> Date: Thu, 08 Aug 2013 14:06:40 +0100 From: Matthew Seaman User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:17.0) Gecko/20130801 Thunderbird/17.0.7 MIME-Version: 1.0 To: freebsd-stable@freebsd.org Subject: Re: ZFS in jails 9.2-RC1 permission denied References: <1375963526.32115.7488635.39B9BAB2@webmail.messagingengine.com> In-Reply-To: <1375963526.32115.7488635.39B9BAB2@webmail.messagingengine.com> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-Virus-Scanned: clamav-milter 0.97.8 at lucid-nonsense.infracaninophile.co.uk X-Virus-Status: Clean X-Spam-Status: No, score=-1.7 required=5.0 tests=AWL,BAYES_00, RCVD_IN_DNSWL_NONE,SPF_SOFTFAIL autolearn=no version=3.3.2 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on lucid-nonsense.infracaninophile.co.uk X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2013 13:06:50 -0000 On 08/08/2013 13:05, Mark Felder wrote: > On Thu, Aug 8, 2013, at 6:59, Trond Endrestøl wrote: >> >> I'm just guessing, but I doubt a jail would be able to create new ZFS >> filesystems outside its own structure, if at all able. A jail would >> however be allowed to (un)mount already existing filesystems within >> its own structure, i.e. Pool/test1. >> > > When I first reviewed his post I clearly confused "mounting" with > "creating a new zfs filesystem". Is that even supposed to be permitted > in a jail? I almost feel a sysctl disabling that by default would be > nice... DoS by zfs filesystem creation/deletion, anyone? There's a 'zfs jail' command and a 'jailed' property you can set on a ZFS which I believes allow you to manage that ZFS from within the jail. I think that extends to creating other ZFSes beneath that one (which would inherit the 'jailed' property), BICBW. Mostly I find it easier to just manage the ZFSes from the host system but then again, I'm not really making very extensive use of jails. Cheers, Matthew