kern/93423: Applying devfs rulset fails

[Andrew Hacking]

>Number:         93423
>Category:       kern
>Synopsis:       Applying devfs rulset fails
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Feb 16 11:20:09 GMT 2006
>Closed-Date:
>Last-Modified:
>Originator:     Andrew Hacking
>Release:        6.0-RELEASE-p4
>Organization:
>Environment:
FreeBSD home.inet 6.0-RELEASE-p4 FreeBSD 6.0-RELEASE-p4 #1: Wed Feb 15 10:50:20 EST 2006     root at home.inet:/usr/obj/usr/src/sys/DELL4100  i386
>Description:
It is currently not possible (for me at least) to setup a secure jail by adding devfs rules. Also devfs commands can leave the system in a state where it is not possible to shutdown cleanly.

On attempting to setup devfs for a jail, the following devfs command fails:

# mount_devfs devfs /jail/foo/dev
# devfs -m /jail/foo/dev rule -s 4 applyset
devfs rule: ioctl DEVFSIO_SAPPLY: No such process

[Note: rule-set doesn't get applied]

Also, trying to apply rules manually hangs and never returns, leaving the process blocked in disk (D) wait state.

Shutting down the system also never completes and requires a power cycle and (at least for me) required manual fsck of most file-systems on reboot.

This could potentially be related to the problem described in:
    http://lists.freebsd.org/pipermail/freebsd-hackers/2006-January/015009.html

My revision of /usr/src/sys/fs/devfs_rule.c is:
  $FreeBSD: src/sys/fs/devfs/devfs_rule.c,v 1.14.2.2 2005/09/26 14:36:52 phk Exp $

I will try revision listed in above email and report back....

>How-To-Repeat:
# mkdir /tmp/foodev
# mount_devfs devfs /tmp/foodev
# devfs -m /tmp/foodev rule -s4 applyset
devfs rule: ioctl DEVFSIO_SAPPLY: No such process

[Note: rule-set doesn't get applied]

Now try adding rules manually to trigger process hang:
# devfs -m /tmp/foodev rule add hide
# devfs -m /tmp/foodev rule add path null unhide
.. etc ...
>Fix:
              
>Release-Note:
>Audit-Trail:
>Unformatted: