Quoting SK <fbsta...@cps-intl.org> (from Mon, 12 Dec 2016 17:13:27 +0000):
b) Alexander, I am still not able to do snapshot or any other action from within my jail. My understanding is that you are using ezjail, which might be doing something that my regular jail creation is ommitting. If you do not mind sharing your configuration steps, I can try to reproduce it at this end. If it is exactly as it is on the site you pointed to earlier, please let me know, I will follow that verbatim (even though I do not remember seeing anything there that I have not tried already, but I might be mistaken).
Do you use quotas on the datasets you want to add to the jail? If yes, try without. The man-page of zfs tells that this value can not be changed (but from the wording I would expect hat an already set value should work).
ezjail is just a shell script which simplifies some things with jails. For a particular jail where I can manage the datasets which are handed over to the jail I have those settings in ezjail which correspond to the settings you can specify in jail.conf:
---snip--- export jail_xyz_leidinger_net_devfs_ruleset="17" export jail_xyz_leidinger_net_zfs_datasets="space/something"export jail_xyz_leidinger_net_parameters="allow.mount allow.mount.zfs enforce_statfs=1"
---snip--- Check if you have allow.mount and allow.mount.zfs for the jails in question.Note, "space/something" is not the root of the jail, it's a seperate dataset. Do not add the root of the jail as a dataset. Example bellow.
devfs.rules part: ---snip--- [devfsrules_unhide_zfs=12] add path zfs unhide [devfsrules_jail_withzfs=17] add include $devfsrules_hide_all add include $devfsrules_unhide_basic add include $devfsrules_unhide_login add include $devfsrules_unhide_zfs ---snip--- The rc.conf inside this jail: ---snip--- zfs_enable="YES" ---snip---For one of the filesystems I have set "zfs allow" permissions, but just that a specific user in the jail can do something on those FS without the need to switch to root. So as long as you try to do a zfs create/snapshot with an user with UID 0 inside the jail, the "zfs allow" part doesn't come into play.
So assume space/jails/xyz.leidinger.net/ to be the dataset which contains the root of the jail but is not attached/attributed to the jail itself. space/jails/xyz.leidinger.net/data with mountpoint=none to be attributed ("zfs jail xyz space/jails/xyz.leidinger.net/data") to the jail (similar to the "space/something" in the ezjail config above, I have some iocage-managed jails were this works). In this case you should be able to do from inside the jail "zfs create -o mpuntpoint=/mnt space/jails/xyz.leidinger.net/data/test".
And now to everyone, I am still confused about zfs set jailed=on. As I mentioned on my previous emails, as soon as I do that, the dataset vanishes from the host system (as I understand, that is expected behaviour). Then the jail fails as it is unable to mount /dev, /proc
From the zfs man page:
---snip---
After a dataset is attached to a jail and the jailed property is set, a
jailed file system cannot be mounted outside the jail, since the jail
administrator might have set the mount point to an unacceptable value.
---snip---
So yes, it is expected that it "vanishes", but it should be visible
from the parent host at the place inside the jail FS subtree were it
is mounted there (after setting the mountpoint of the dataset).
and so on. I have to change jail.conf and comment out mount.devfs and mount.procfs -- but than in turn makes /dev/zfs unavaulable and I cannot do anything from inside the jail.
Could it be that you try to attribute the root of the jail as a dataset into the jail?
Bye, Alexander. -- http://www.Leidinger.net alexan...@leidinger.net: PGP 0x8F31830F9F2772BF http://www.FreeBSD.org netch...@freebsd.org : PGP 0x8F31830F9F2772BF
pgpKf5FcRiE1l.pgp
Description: Digitale PGP-Signatur
