X.org in a jail, testers wanted

[Alexander Leidinger]

Hi,

at http://www.Leidinger.net/FreeBSD/current-patches/jail.diff I have  
some changes which should apply to RELENG_7(_0) and HEAD which allow  
access to /dev/io (if configured appropriately, see the included  
man-page change). This is needed to run a X server in a jail. You may  
also need to load manually (or via the loader) the kernel module which  
is normally loaded by the X server (in my case (a Radeon card) this  
means to have radeon_load="YES" in loader.conf). AFAIR the X server  
works without this, but probably without some acceleration. I haven't  
tested any 3D stuff.

You also need to setup /etc/devfs.rules (this is a copy of my one, it  
contains more than is needed to run the X server, so you can trim this  
if you want):
---snip---
[devfsrules_unhide_audio=5]
add path 'audio*' unhide
add path 'dsp*' unhide
add path midistat unhide
add path 'mixer*' unhide
add path 'music*' unhide
add path 'sequencer*' unhide
add path sndstat unhide
add path speaker unhide

[devfsrules_unhide_printers=6]
add path 'lpt*' unhide
add path 'ulpt*' unhide
add path 'unlpt*' unhide

[devfsrules_unhide_input=7]
add path 'atkbd*' unhide
add path 'kbd*' unhide
add path 'joy*' unhide
add path 'psm*' unhide
add path sysmouse unhide
add path 'ukbd*' unhide
add path 'ums*' unhide

[devfsrules_unhide_xorg=8]
add path agpgart unhide
#add path console unhide
add path dri unhide
add path 'dri*' unhide
add path io unhide
add path mem unhide
#add path pci unhide
add path tty unhide
add path ttyv0 unhide
add path ttyv1 unhide
add path ttyv8 unhide

[devfsrules_unhide_cam=9]
add path 'da*' unhide
add path 'cd*' unhide

[devfsrules_unhide_kmem=10]
add path kmem unhide

#
# This allows to run a desktop system in a jail.  Think about what you want to
# achieve before you use this, it opens up the entire machine to access from
# this jail to any sophisticated program.
#
[devfsrules_jail_desktop=11]
add include $devfsrules_hide_all
add include $devfsrules_unhide_basic
add include $devfsrules_unhide_login
add include $devfsrules_unhide_audio
add include $devfsrules_unhide_input
add include $devfsrules_unhide_xorg
add include $devfsrules_unhide_cam
add include $devfsrules_unhide_kmem
---snip---

You also need to make sure those rules are applied to your jail  
(jail_<jailname>_devfs_ruleset="devfsrules_jail_desktop").

I'm running with security.jail.dev_io_access_allowed=1 since several  
months. Today I took the time to add  
security.jail.dev_io_access_allowed_hostname (WARNING: only  
compile-tested!) and the man-page.

I would like to get some reviews of the patch and some success/failure  
reports for the security.jail.dev_io_access_allowed_hostname sysctl.

Bye,
Alexander.

-- 
Too cool to calypso,
Too tough to tango,
Too weird to watusi
		-- The Only Ones

http://www.Leidinger.net    Alexander @ Leidinger.net: PGP ID = B0063FE7
http://www.FreeBSD.org       netchild @ FreeBSD.org  : PGP ID = 72077137