SK wrote on 2016/12/08 20:13:
Initially they were not visible from within the jail, but as I ran zfs jail testJail gT/JailS/testJail they were visible from inside.
You can add zfs jail testJail gT/JailS/testJail to your jail.conf post exec so it will be executed automatically.
HOWEVER, I am unable to do any manipulation whatsoever from within the jail. root@testJail:/ # zfs list NAME USED AVAIL REFER MOUNTPOINT gT 10.3G 199G 9.51G legacy gT/JailS 832M 199G 20K /JailS gT/JailS/testJail 546K 199G 827M /JailS/testJail root@testJail:/ # zfs snapshot gT/JailS/testJail@test *cannot create snapshots : permission denied* root@testJail:/ # zfs create gT/JailS/testJail/test *cannot create 'gT/JailS/testJail/test': permission denied* root@testJail:/ # exit
zfs list is good start. I never used zfs from within jail so I cannot comment on permission denied. I don't know what more must be done.
Even after the jail was able to see the dataset, the following sysctl was still zero security.jail.mount_zfs_allowed: 0
I think you don't need this sysctl, you just need to set proper jail options like allow.mount allow.mount.zfs and enforce_statfs (per jail)
I changed it to one, but that didn't seem to have the desired effect (should have I restarted?)
No restart needed. Sysctls are runtime configurable. If you need to preserve some sysctl settings after reboot you must put them in to /etc/sysctl.conf
below are some of the relevant settings. If you require any other information, I'll try to send them as soon as I can.
Send us `sysctl security.jail` from host and from jail too. _______________________________________________ freebsd-jail@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-jail To unsubscribe, send any mail to "freebsd-jail-unsubscr...@freebsd.org"
