On the use of jails in FreeBSD and the various patches and extensions for them.

FreeBSD bugmaster | 6 Aug 2012 13:07

Picon

freebsd-jail@...

Note: to view an individual PR, use:
  http://www.freebsd.org/cgi/query-pr.cgi?pr=(number).

The following is a listing of current problems submitted by FreeBSD users.
These represent problem reports covering all versions including
experimental development code and obsolete releases.

S Tracker      Resp.      Description
--------------------------------------------------------------------------------
o kern/169751  jail       [jail] reading routing information does not work in ja
o bin/167911   jail       new jail(8) problem with removal, ifconfg -alias and k
o kern/159918  jail       [jail] inter-jail communication failure
o docs/156853  jail       [patch] Update docs: jail(8) security issues with worl
o kern/156111  jail       [jail] procstat -b not supported in jail
o misc/155765  jail       [patch] `buildworld' does not honors WITHOUT_JAIL
o conf/154246  jail       [jail] [patch] Bad symlink created if devfs mount poin
o conf/149050  jail       [jail] rcorder ``nojail'' too coarse for Jail+VNET
s conf/142972  jail       [jail] [patch] Support JAILv2 and vnet in rc.d/jail
o conf/141317  jail       [patch] uncorrect jail stop in /etc/rc.d/jail
o kern/133265  jail       [jail] is there a solution how to run nfs client in ja
o kern/119842  jail       [smbfs] [jail] "Bad address" with smbfs inside a jail
o bin/99566    jail       [jail] [patch] fstat(1) according to specified jid
o bin/32828    jail       [jail] w(1) incorrectly handles stale utmp slots with 

14 problems total.

FreeBSD bugmaster | 13 Aug 2012 13:07

Picon

freebsd-jail@...

Note: to view an individual PR, use:
  http://www.freebsd.org/cgi/query-pr.cgi?pr=(number).

The following is a listing of current problems submitted by FreeBSD users.
These represent problem reports covering all versions including
experimental development code and obsolete releases.

S Tracker      Resp.      Description
--------------------------------------------------------------------------------
o kern/169751  jail       [jail] reading routing information does not work in ja
o bin/167911   jail       new jail(8) problem with removal, ifconfg -alias and k
o kern/159918  jail       [jail] inter-jail communication failure
o docs/156853  jail       [patch] Update docs: jail(8) security issues with worl
o kern/156111  jail       [jail] procstat -b not supported in jail
o misc/155765  jail       [patch] `buildworld' does not honors WITHOUT_JAIL
o conf/154246  jail       [jail] [patch] Bad symlink created if devfs mount poin
o conf/149050  jail       [jail] rcorder ``nojail'' too coarse for Jail+VNET
s conf/142972  jail       [jail] [patch] Support JAILv2 and vnet in rc.d/jail
o conf/141317  jail       [patch] uncorrect jail stop in /etc/rc.d/jail
o kern/133265  jail       [jail] is there a solution how to run nfs client in ja
o kern/119842  jail       [smbfs] [jail] "Bad address" with smbfs inside a jail
o bin/99566    jail       [jail] [patch] fstat(1) according to specified jid
o bin/32828    jail       [jail] w(1) incorrectly handles stale utmp slots with 

14 problems total.

Jun Kuriyama | 16 Aug 2012 03:19

Picon

[patch] etc/rc.d/jail: allow extra parameters for each jails


Hi,

Here is a patch which I'm using for years in my production
environment.

I usually changes parameters documented in jail(8) for each jails, but
current rc.d/jail has no feature to pass extra parameters at starting
jails.

I hope this patch will not prevent jamie's recent/next work for
rc.d/jail.  I'll commit this if there is no objection.

Index: etc/defaults/rc.conf
===================================================================
--- etc/defaults/rc.conf	(revision 239314)
+++ etc/defaults/rc.conf	(working copy)
 <at>  <at>  -705,6 +705,7  <at>  <at> 
 #jail_example_mount_enable="NO"			# mount/umount jail's fs
 #jail_example_fstab=""				# fstab(5) for mount/umount
 #jail_example_flags="-l -U root"		# flags for jail(8)
+#jail_example_parameters="allow.raw_sockets=1"	# extra parameters for this jail

 ##############################################################
 ### Define source_rc_confs, the mechanism used by /etc/rc.* ##
Index: etc/rc.d/jail
===================================================================
--- etc/rc.d/jail	(revision 239314)
+++ etc/rc.d/jail	(working copy)
 <at>  <at>  -115,6 +115,8  <at>  <at>

(Continue reading)

Doug Barton | 16 Aug 2012 05:14

Picon

Re: [patch] etc/rc.d/jail: allow extra parameters for each jails

On 08/15/2012 03:19 PM, Jun Kuriyama wrote:
> 
> Hi,
> 
> Here is a patch which I'm using for years in my production
> environment.
> 
> I usually changes parameters documented in jail(8) for each jails, but
> current rc.d/jail has no feature to pass extra parameters at starting
> jails.
> 
> I hope this patch will not prevent jamie's recent/next work for
> rc.d/jail.  I'll commit this if there is no objection.
> 
> 
> Index: etc/defaults/rc.conf
> ===================================================================
> --- etc/defaults/rc.conf	(revision 239314)
> +++ etc/defaults/rc.conf	(working copy)
>  <at>  <at>  -705,6 +705,7  <at>  <at> 
>  #jail_example_mount_enable="NO"			# mount/umount jail's fs
>  #jail_example_fstab=""				# fstab(5) for mount/umount
>  #jail_example_flags="-l -U root"		# flags for jail(8)
> +#jail_example_parameters="allow.raw_sockets=1"	# extra parameters for this jail

Why not just use _flags for this?

Jun Kuriyama | 16 Aug 2012 05:24

Picon

Re: [patch] etc/rc.d/jail: allow extra parameters for each jails

2012/8/16 Doug Barton <dougb@...>:
> On 08/15/2012 03:19 PM, Jun Kuriyama wrote:
>>  #jail_example_flags="-l -U root"             # flags for jail(8)
>> +#jail_example_parameters="allow.raw_sockets=1"       # extra parameters for this jail
>
> Why not just use _flags for this?

Current implementation of rc.d/jail uses old command line syntax which
cannot pass parameters to jail(8), so main modifications of my patch
is changing this to use new command line style to use with "-c" flag
and named parameters.

Then, you are right, these named parameters can be passed via _flags
after my patch.  I just want separate command line option flags and
named parameters.  I don't have strong argument to add _parameters
variables.  I just think adding _parameters may be easy to
configure/understand.

--

-- 
Jun Kuriyama <kuriyama@...> // FreeBSD Project
         <kuriyama@...> // S2 Factory, Inc.

Doug Barton | 16 Aug 2012 05:32

Picon

Re: [patch] etc/rc.d/jail: allow extra parameters for each jails

On 08/15/2012 05:24 PM, Jun Kuriyama wrote:
> 2012/8/16 Doug Barton <dougb@...>:
>> On 08/15/2012 03:19 PM, Jun Kuriyama wrote:
>>>  #jail_example_flags="-l -U root"             # flags for jail(8)
>>> +#jail_example_parameters="allow.raw_sockets=1"       # extra parameters for this jail
>>
>> Why not just use _flags for this?
> 
> Current implementation of rc.d/jail uses old command line syntax which
> cannot pass parameters to jail(8), so main modifications of my patch
> is changing this to use new command line style to use with "-c" flag
> and named parameters.
> 
> Then, you are right, these named parameters can be passed via _flags
> after my patch.  I just want separate command line option flags and
> named parameters.  I don't have strong argument to add _parameters
> variables.  I just think adding _parameters may be easy to
> configure/understand.

Thank you for the explanation. FWIW, this sounds reasonable to me.

Doug

Bjoern A. Zeeb | 17 Aug 2012 12:28

Re: [patch] etc/rc.d/jail: allow extra parameters for each jails

On Thu, 16 Aug 2012, Jun Kuriyama wrote:

>
> Hi,
>
> Here is a patch which I'm using for years in my production
> environment.
>
> I usually changes parameters documented in jail(8) for each jails, but
> current rc.d/jail has no feature to pass extra parameters at starting
> jails.
>
> I hope this patch will not prevent jamie's recent/next work for
> rc.d/jail.  I'll commit this if there is no objection.

Why not just use his work?

--

-- 
Bjoern A. Zeeb                                 You have to have visions!
          Stop bit received. Insert coin for new address family.

Jamie Gritton | 17 Aug 2012 20:47

Picon

Re: [patch] etc/rc.d/jail: allow extra parameters for each jails

On 08/17/12 04:28, Bjoern A. Zeeb wrote:
> On Thu, 16 Aug 2012, Jun Kuriyama wrote:
>
>>
>> Hi,
>>
>> Here is a patch which I'm using for years in my production
>> environment.
>>
>> I usually changes parameters documented in jail(8) for each jails, but
>> current rc.d/jail has no feature to pass extra parameters at starting
>> jails.
>>
>> I hope this patch will not prevent jamie's recent/next work for
>> rc.d/jail. I'll commit this if there is no objection.
>
> Why not just use his work?

Probably because it's a lot more "next" than "recent".
Soon ... real soon now.

- Jamie

Curtis Villamizar | 19 Aug 2012 19:35

IPv6 multicast sent to jail


I'm trying to run isc-dhcpd using dhcpd -6 in a jail.  No luck.

The following code is run in the jail and doesn't fail.

        if (inet_pton(AF_INET6, All_DHCP_Relay_Agents_and_Servers,
                      &mreq.ipv6mr_multiaddr) <= 0) {
                log_fatal("inet_pton: unable to convert '%s'",
                          All_DHCP_Relay_Agents_and_Servers);
        }
        mreq.ipv6mr_interface = if_nametoindex(info->name);
        if (setsockopt(sock, IPPROTO_IPV6, IPV6_JOIN_GROUP,
                       &mreq, sizeof(mreq)) < 0) {
                log_fatal("setsockopt: IPV6_JOIN_GROUP: %m");
        }

where All_DHCP_Relay_Agents_and_Servers is defined as "FF02::1:2".

Later dhcpd binds to *.517 which can be seen in netstat -an.

Packets to ff02::1:2.517 are seen on the jailer (as opposed to the
jailee) using tcpdump, but no packets are received by the jailee.

When the same command from the jailer using a chroot to the jailee
directory, the multicast packets are received.

Is there a solution to this other than changing the jail from an
implied "ip6=new" with a specific address to "ip6=inherit".  What I'd
really like is a yet to be invented "ip6=new+multicast".

(Continue reading)

FreeBSD bugmaster | 20 Aug 2012 13:07

Picon

freebsd-jail@...

Note: to view an individual PR, use:
  http://www.freebsd.org/cgi/query-pr.cgi?pr=(number).

The following is a listing of current problems submitted by FreeBSD users.
These represent problem reports covering all versions including
experimental development code and obsolete releases.

S Tracker      Resp.      Description
--------------------------------------------------------------------------------
o kern/169751  jail       [jail] reading routing information does not work in ja
o bin/167911   jail       new jail(8) problem with removal, ifconfg -alias and k
o kern/159918  jail       [jail] inter-jail communication failure
o docs/156853  jail       [patch] Update docs: jail(8) security issues with worl
o kern/156111  jail       [jail] procstat -b not supported in jail
o misc/155765  jail       [patch] `buildworld' does not honors WITHOUT_JAIL
o conf/154246  jail       [jail] [patch] Bad symlink created if devfs mount poin
o conf/149050  jail       [jail] rcorder ``nojail'' too coarse for Jail+VNET
s conf/142972  jail       [jail] [patch] Support JAILv2 and vnet in rc.d/jail
o conf/141317  jail       [patch] uncorrect jail stop in /etc/rc.d/jail
o kern/133265  jail       [jail] is there a solution how to run nfs client in ja
o kern/119842  jail       [smbfs] [jail] "Bad address" with smbfs inside a jail
o bin/99566    jail       [jail] [patch] fstat(1) according to specified jid
o bin/32828    jail       [jail] w(1) incorrectly handles stale utmp slots with 

14 problems total.

Group

gmane.os.freebsd.jail.

Project Web Page

On the use of jails in FreeBSD and the various patches and extensions for them.

Search Archive

Page

1 | 2 | 3

Articles in period: 22

August 2012

Language

Change language

Options

Current view: Threads only / Showing only 20 lines / Not hiding cited text.
Change to All messages, whole messages, or hide cited text.

Post a message
NNTP Newsgroup
Classic Gmane web interface
XML

XML

RSS Feed
List Information

About Gmane

Recent entries

Current problem reports assigned to freebsd-jail-HZy0K5TPuP5AfugRpC6u6 (20 May 2013)
conf/149050: [jail] rcorder ``nojail'' too coarse for Jail+VNET (19 May 2013)
kern/176112: [jail] [panic] kernel panic when starting jails (15 May 2013)
Current problem reports assigned to freebsd-jail-HZy0K5TPuP5AfugRpC6u6 (13 May 2013)
Absence du bureau : Returned mail: Data format error (8 May 2013)
Current problem reports assigned to freebsd-jail-HZy0K5TPuP5AfugRpC6u6 (6 May 2013)
bin/178302: jail(8): unknown parameter: ip6.addr when kernel compiled (4 May 2013)
vnet jail with ipfw having logging problem (1 May 2013)
Current problem reports assigned to freebsd-jail-HZy0K5TPuP5AfugRpC6u6 (29 Apr 2013)
How to start a firewall in a vimage jail (24 Apr 2013)
state of the art ? (24 Apr 2013)
jail(8) vimage epair bridge (23 Apr 2013)
Current problem reports assigned to freebsd-jail-HZy0K5TPuP5AfugRpC6u6 (22 Apr 2013)
automatic garbage collection of stuff mounted (etc.) by jailed root (22 Apr 2013)
routing in VIMAGE jails with different versions (16 Apr 2013)
jail -r leads to a panic (16 Apr 2013)
Current problem reports assigned to freebsd-jail-HZy0K5TPuP5AfugRpC6u6 (15 Apr 2013)
jail(8) vs. rc.d/jail features - fstab, zfs, vnet (11 Apr 2013)
Can't find free bpf: No such file or directory (9 Apr 2013)
Current problem reports assigned to freebsd-jail-HZy0K5TPuP5AfugRpC6u6 (8 Apr 2013)
Problems with network on host with jail. (6 Apr 2013)

Archives

26	May 2013
70	April 2013
80	March 2013
34	February 2013
29	January 2013
18	December 2012
31	November 2012
9	October 2012
33	September 2012
22	August 2012
12	July 2012
12	June 2012
35	May 2012
38	April 2012
27	March 2012
35	February 2012
49	January 2012
4	December 2011
5	November 2011
6	October 2011
28	September 2011
31	August 2011
25	July 2011
25	June 2011
22	May 2011
15	April 2011
11	March 2011
11	February 2011
19	January 2011
36	December 2010
22	November 2010
16	October 2010
20	September 2010
14	August 2010
24	July 2010
37	June 2010
20	May 2010
21	April 2010
30	March 2010
34	February 2010
45	January 2010
45	December 2009
27	November 2009
37	October 2009
24	September 2009
33	August 2009
28	July 2009
42	June 2009
30	May 2009
46	April 2009
48	March 2009
35	February 2009
39	January 2009
41	December 2008
52	November 2008
101	October 2008
35	September 2008
50	August 2008
40	July 2008
58	June 2008
34	May 2008
31	April 2008
13	March 2008
22	February 2008
53	January 2008
10	December 2007
27	October 2007
19	September 2007
28	August 2007
9	July 2007
21	June 2007
11	May 2007

Design

Zawodny | Right Menu | Left Menu

Your Own Design

Paste the URL of your CSS below. Download CSS template