mount_nullfs inside a jail

[Boris Samorodov]

On Wed, 25 Jul 2007 17:12:35 +0200 Pawel Jakub Dawidek wrote:
> On Wed, Jul 25, 2007 at 07:03:37PM +0400, Boris Samorodov wrote:
> > > > This didn't help:
> > > > -----
> > > > btest# sysctl security.jail
> > > > security.jail.jailed: 1
> > > > security.jail.mount_allowed: 1
> > > > security.jail.chflags_allowed: 1
> > > > security.jail.allow_raw_sockets: 0
> > > > security.jail.enforce_statfs: 2
> > > > security.jail.sysvipc_allowed: 1
> > > > security.jail.socket_unixiproute_only: 1
> > > > security.jail.set_hostname_allowed: 1
> > > > btest# lsvfs
> > > > Filesystem                        Refs Flags
> > > > -------------------------------- ----- ---------------
> > > > ufs                                  6 
> > > > nfs                                  0 network
> > > > procfs                               0 synthetic
> > > > devfs                                3 synthetic
> > > > ntfs                                 0 
> > > > msdosfs                              0 
> > > > nfs4                                 0 network
> > > > nullfs                               1 loopback, jail
> > > > cd9660                               0 read-only
> > > > btest# df
> > > > Filesystem  1K-blocks     Used     Avail Capacity  Mounted on
> > > > /dev/da0s1d 945804208 22136782 848003090     3%    /
> > > > btest# mount /usr/ports/distfiles /mnt
> > > > mount: /usr/ports/distfiles : Operation not permitted
> > 
> > > mount_nullfs?
> > 
> > Ops!!! (i need some coffee)  My bad... Mounting works good but:
> > -----
> > btest# umount /mnt
> > umount: unmount of [restricted] failed: Invalid argument
> > -----

> I overlooked. You need to set security.jail.enforce_statfs to 0. See if
> that helps.

Yep, that helps. But now "df" now shows a host file system, which is a
little bit confusing. ;-) Well, but I guess there should be a
consensus somewhere between features and wishes...

Pawel, thanks for your help.


WBR
-- 
Boris Samorodov (bsam)
Research Engineer, http://www.ipt.ru Telephone & Internet SP
FreeBSD committer, http://www.FreeBSD.org The Power To Serve