On 11/16/2013 2:41 PM, Jan Demter wrote:
> is it intentional that rc.d/jail does not load the default devfs
rulesets on current and 10.0? It used to work like this on 9.x and
earlier, now you have to explicitly load them (e.g. with
devfs_load_rulesets in rc.conf).
> If you do not do this, ruleset 4 (devfsrules_jail) will just be
created and left empty on mount of the in-jail /dev, making the normal
set of device nodes available. That is quite an easy escape path :)
> This does not seem to be documented anywhere and is somewhat
surprising, so I suspect it is an oversight? Apart from that I really
like the work on jail.conf, thanks a lot!
Yes, that's an oversight. The current rc.d/jail script needs work,
and this is part of the work it needs. It might be as simple as
changing the rc script's dependencies.
- Jamie
_______________________________________________
freebsd-jail@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-jail
To unsubscribe, send any mail to "freebsd-jail-unsubscr...@freebsd.org"
