FreeBSD 8.1 prerelease "security.jail.mount_allowed" is broken?

Eugene Mitrofanov eugene at imedia.ru
Wed May 26 06:23:25 UTC 2010


On Tuesday 25 May 2010, Pawel Jakub Dawidek wrote:
> On Tue, May 25, 2010 at 12:35:19PM +0400, Eugene Mitrofanov wrote:
> > Hello
> > 
> > I try to do mount from a jail but it failed. Could you advise me where is 
my 
> > mistake?
> > 
> > root at ftp:eugene# uname -mrs
> > FreeBSD 8.1-PRERELEASE amd64
> > root at ftp:eugene# sysctl -a | grep -E '(jailed|mount)'
> > vfs.usermount: 1
> > vfs.ffs.compute_summary_at_mount: 0
> > security.jail.mount_allowed: 1
> > security.jail.jailed: 1
> > root at ftp:eugene# mount /dev/da2s2a /var/t
> > mount: /dev/da2s2a : Operation not permitted
> > root at ftp:eugene# mount /dev/md1 /var/t
> > mount: /dev/md1 : Operation not permitted
> > root at ftp:eugene# mount /dev/zvol/tank/ftp.journal /var/t
> > mount: /dev/zvol/tank/ftp.journal : Operation not permitted
> 
> You can only mount jail-friendly file systems - those with 'jail'
> keyword in lsvfs(1) output.

Unfortunately, it seems for me that 'zfs mount' is also broken in 8.1PRE 
(zpool ver 14). "zfs jail 4 tank" is executing successfully but the 
word 'jail' does not meet in the 'man zfs' anymore and 'zfs set jailed=on 
tank' is failed with the error "property 'jailed' not supported on FreeBSD: 
permission denied". "zfs mount" from jail also failed:

root at ftp:eugene# sysctl security.jail.jailed
security.jail.jailed: 1
root at ftp:eugene# zfs mount tank/test
cannot mount 'tank/test': permission denied


> What you tried can't be safe. Imagine creating corrupted file system on
> da2s2a and mounting it. It will panic entire system, not only your jail.
 



-- 
EMIT-RIPN, EVM7-RIPE


More information about the freebsd-fs mailing list