setting MIBs on a per jail bases

[Harald Schmalzbauer]

 schrieb Fbsd8 am 06.02.2013 17:57 (localtime):
> Fleuriot Damien wrote:
>> Running 8.3 here and the answer is no.
>>
>>
>> On Feb 6, 2013, at 5:39 PM, Fbsd8 <fbsd8 at a1poweruser.com> wrote:
>>
>>> Is there a way to set these MIBs
>>> on a per jail bases?
>>>
>>> allow.mount.nullfs
>>> allow.raw_sockets
>>> cpuset.id
>>> securelevel
>>
>>
>>
>
> Rereading the  "man jail" for 9.1 talks about securelevel as a jail
> parammeter. So correct me if I an wrong. All the security.jail.param.*
> MIBs are set in rc.conf or /etc/jail.conf file on a per jail bases by
> changing the word "parm" to the jailname?
>

This applies to jail.conf(5).
That's a entirely new way to handle jails in FreeBSD 9.1. Very nice, but
not included in rc.d.

If you want to keep the traditional way running jails, I made a patch
some time ago to control more per-jail tunables.
Here you can donwload it for -9:
ftp://ftp.omnilan.de/pub/FreeBSD/OmniLAN/deploy-tools/local-patches/src/jail-allow-selectables.patch_9
That also irons some ip configuration cosmetics, see defaults/rc.conf.

If you want to give the new jail(8) and jail.conf capabilities a try,
here's like I use it with vnet (vimage, virtual per-jail-network stack):
Compile a kernel with "options VIMAGE"
remove "# keyword nojail" in jail's etc/rc.d/netif and routing (if you
want to set IP addresses inside the jail)

And here's the corresponding jail.conf:
###
exec.start = "/bin/sh /etc/rc";
exec.stop = "/bin/sh /etc/rc.shutdown && sleep 2";
exec.clean;
allow.mount;
allow.mount.devfs;
allow.set_hostname;
mount.devfs;
devfs_ruleset=4;

# Dynamic wildcard parameter:
# Base the path off the jail name.
path = "/.jail.$name";
mount.fstab="/etc/fstab.$name";

yourname {
        mount;
        name = "inno";
#       host.hostname = .your hostname.net"; but also set inside the
jail along with network setup
        vnet = "new";
        vnet.interface = "jbb$name";
}
###

You can add "allow.raw_sockets" anywhere.
But with vnet, you don't need that any more.
Just to point you into the right direction.

-Harry

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 196 bytes
Desc: OpenPGP digital signature
URL: <http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20130214/ab7c1e3d/attachment.sig>