mount_nullfs inside a jail

[Pawel Jakub Dawidek]

On Wed, Jul 25, 2007 at 06:46:22PM +0400, Boris Samorodov wrote:
> On Tue, 24 Jul 2007 16:45:49 +0200 Pawel Jakub Dawidek wrote:
> > On Tue, Jul 24, 2007 at 06:03:47PM +0400, Boris Samorodov wrote:
> > > On Mon, 23 Jul 2007 15:33:33 +0200 Pawel Jakub Dawidek wrote:
> 
> > > > As you can see, nullfs doesn't have 'jail' flag. The only jail-friendly
> > > > file system currently is ZFS. Nullfs is a good candidate for a
> > > > jail-friendly file system, but is not marked as such yet.
> > > 
> > > Does somebody know if only a flag is missing or not?
> 
> > You may try changing the line in /sys/fs/nullfs/null_vfsops.c from:
> 
> > VFS_SET(null_vfsops, nullfs, VFCF_LOOPBACK);
> 
> > to:
> 
> > VFS_SET(null_vfsops, nullfs, VFCF_LOOPBACK | VFCF_JAIL);
> 
> This didn't help:
> -----
> btest# sysctl security.jail
> security.jail.jailed: 1
> security.jail.mount_allowed: 1
> security.jail.chflags_allowed: 1
> security.jail.allow_raw_sockets: 0
> security.jail.enforce_statfs: 2
> security.jail.sysvipc_allowed: 1
> security.jail.socket_unixiproute_only: 1
> security.jail.set_hostname_allowed: 1
> btest# lsvfs
> Filesystem                        Refs Flags
> -------------------------------- ----- ---------------
> ufs                                  6 
> nfs                                  0 network
> procfs                               0 synthetic
> devfs                                3 synthetic
> ntfs                                 0 
> msdosfs                              0 
> nfs4                                 0 network
> nullfs                               1 loopback, jail
> cd9660                               0 read-only
> btest# df
> Filesystem  1K-blocks     Used     Avail Capacity  Mounted on
> /dev/da0s1d 945804208 22136782 848003090     3%    /
> btest# mount /usr/ports/distfiles /mnt
> mount: /usr/ports/distfiles : Operation not permitted

mount_nullfs?

-- 
Pawel Jakub Dawidek                       http://www.wheel.pl
pjd at FreeBSD.org                           http://www.FreeBSD.org
FreeBSD committer                         Am I Evil? Yes, I Am!
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-current/attachments/20070725/81b8fe52/attachment.pgp