mount_nullfs inside a jail
Boris Samorodov
bsam at ipt.ru
Tue Jul 24 14:03:24 UTC 2007
On Mon, 23 Jul 2007 15:33:33 +0200 Pawel Jakub Dawidek wrote:
> On Sun, Jul 22, 2007 at 04:18:06AM +0400, Boris Samorodov wrote:
> > Is it possible to use mount_nullfs inside a jail?
> >
> > With amd64-current:
> > -----
> > # sysctl security.jail
> > security.jail.jailed: 1
> > security.jail.mount_allowed: 1
> > security.jail.chflags_allowed: 1
> > security.jail.allow_raw_sockets: 0
> > security.jail.enforce_statfs: 2
> > security.jail.sysvipc_allowed: 1
> > security.jail.socket_unixiproute_only: 1
> > security.jail.set_hostname_allowed: 1
> > # mount_nullfs /usr/ports /mnt
> > mount_nullfs: Operation not permitted
> > -----
> It is not possible. From jail(8):
> security.jail.mount_allowed
> This MIB entry determines if a privileged user inside a jail will be
> able to mount and unmount file system types marked as jail-friendly.
> The lsvfs(1) command can be used to find file system types available
> for mount from within a jail. This functionality is disabled by
> default, but can be enabled by setting this MIB entry to 1.
> # lsvfs
> Filesystem Refs Flags
> -------------------------------- ----- ---------------
> zfs 0 jail
> nullfs 0 loopback
Thanks, Pavel. Somehow I failed to do RTFM.
> As you can see, nullfs doesn't have 'jail' flag. The only jail-friendly
> file system currently is ZFS. Nullfs is a good candidate for a
> jail-friendly file system, but is not marked as such yet.
Does somebody know if only a flag is missing or not?
WBR
--
Boris Samorodov (bsam)
Research Engineer, http://www.ipt.ru Telephone & Internet SP
FreeBSD committer, http://www.FreeBSD.org The Power To Serve
More information about the freebsd-current
mailing list