On 08/12/2016 17:11, Miroslav Lachman wrote:
What are jails properties? Do you have something like this?
enforce_statfs=1 allow.mount=1 allow.mount.zfs=1 allow.mount.procfs=1
allow.mount.devfs=1
Then you need to run
zfs jail $JID tank/jail/testJail (put the real UID of running jail
and path to dedicated dataset)
Miroslav Lachman
Dear Miroslav, Alexander
@Alexander : I checked out your link. It is interesting, but you are
using ezjail which I am trying to avoid. I have nothing against it, but
I think making it working without too many additional layer of
obfuscation will help me learn it better. So, thanks again, and sorry I
cannot use that solution right now.
@Miroslav : as I mentioned earlier, I did have those parameters but that
didn't seem to do any good on the main system since I was using nullfs
for mounting jails. However, on the new system I used purely zfs and
things have improved slightly.
Current status
the main system (host) has gT as the pool/dataset, where the root is
mounted. I have created two more datasets
# zfs list
NAME USED AVAIL REFER MOUNTPOINT
gT 10.3G 199G 9.51G legacy
gT/JailS 832M 199G 20K /JailS
gT/JailS/testJail 546K 199G 827M /JailS/testJail
Initially they were not visible from within the jail, but as I ran
zfs jail testJail gT/JailS/testJail
they were visible from inside.
HOWEVER, I am unable to do any manipulation whatsoever from within the jail.
root@testJail:/ # zfs list
NAME USED AVAIL REFER MOUNTPOINT
gT 10.3G 199G 9.51G legacy
gT/JailS 832M 199G 20K /JailS
gT/JailS/testJail 546K 199G 827M /JailS/testJail
root@testJail:/ # zfs snapshot gT/JailS/testJail@test
*cannot create snapshots : permission denied*
root@testJail:/ # zfs create gT/JailS/testJail/test
*cannot create 'gT/JailS/testJail/test': permission denied*
root@testJail:/ # exit
Even after the jail was able to see the dataset, the following sysctl
was still zero
security.jail.mount_zfs_allowed: 0
I changed it to one, but that didn't seem to have the desired effect
(should have I restarted?)
below are some of the relevant settings. If you require any other
information, I'll try to send them as soon as I can.
# cat /etc/jail.conf
==============
### common items
host.hostname = "${name}";
path = "/JailS/${name}";
exec.start += "ifconfig ${ePairIF}b vnet ${name}" ;
exec.clean;
exec.system_user = "root";
exec.jail_user = "root";
exec.consolelog = "/var/log/jail_${name}_console.log";
command = "/sbin/ifconfig ${ePairIF}b inet ${jailIP} netmask
255.255.255.240" ;
command += "route add -inet default ${gWay}" ;
mount.fstab = "/etc/fstab.${name}";
devfs_ruleset = "4";
mount.devfs;
mount.fdescfs;
mount.procfs;
allow.mount;
allow.set_hostname = 0;
allow.sysvipc = 1;
allow.raw_sockets = 1;
vnet;
vnet="new";
$bridegIF = "bridge1" ;
$gWay = "10.7.3.1" ;
testJail {
enforce_statfs = 1 ;
allow.mount = 1;
allow.mount.zfs = 1;
allow.mount.procfs = 1 ;
allow.mount.devfs = 1 ;
$ePairIF = "epair0" ;
$jailIP = "10.7.3.4" ;
vnet.interface = ${ePairIF}b ;
exec.start = "/bin/sh /etc/rc" ;
exec.stop = "/bin/sh /etc/rc.shutdown" ;
persist ;
}
##################
# cat /etc/devfs.rules
=============
[devfsrules_jail=4]
add include $devfsrules_hide_all
add include $devfsrules_unhide_basic
add include $devfsrules_unhide_login
add path zfs unhide
# zfs status at the moment
root@testJail:/ # zfs list
NAME USED AVAIL REFER MOUNTPOINT
gT 10.3G 199G 9.51G legacy
gT/JailS 832M 199G 20K /JailS
gT/JailS/testJail 546K 199G 827M /JailS/testJail
root@testJail:/ # zfs snapshot gT/JailS/testJail@test
cannot create snapshots : permission denied
root@testJail:/ # zfs create gT/JailS/testJail/test
cannot create 'gT/JailS/testJail/test': permission denied
root@testJail:/ # exit
exit
Thanks and regards
SK
_______________________________________________
freebsd-jail@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-jail
To unsubscribe, send any mail to "freebsd-jail-unsubscr...@freebsd.org"
