ZFS and Jail :: nullfs mount :: nothing visible from host

[Miroslav Lachman]

SK wrote on 2016/12/08 20:13:

> Initially they were not visible from within the jail, but as I ran
> zfs jail testJail gT/JailS/testJail
> they were visible from inside.

You can add zfs jail testJail gT/JailS/testJail to your jail.conf post 
exec so it will be executed automatically.

> HOWEVER, I am unable to do any manipulation whatsoever from within the jail.
> root at testJail:/ # zfs list
> NAME                USED  AVAIL  REFER  MOUNTPOINT
> gT                 10.3G   199G  9.51G  legacy
> gT/JailS            832M   199G    20K  /JailS
> gT/JailS/testJail   546K   199G   827M  /JailS/testJail
> root at testJail:/ # zfs snapshot gT/JailS/testJail at test
> *cannot create snapshots : permission denied*
> root at testJail:/ # zfs create gT/JailS/testJail/test
> *cannot create 'gT/JailS/testJail/test': permission denied*
> root at testJail:/ # exit

zfs list is good start. I never used zfs from within jail so I cannot 
comment on permission denied. I don't know what more must be done.

> Even after the jail was able to see the dataset, the following sysctl
> was still zero
> security.jail.mount_zfs_allowed: 0

I think you don't need this sysctl, you just need to set proper jail 
options like  allow.mount allow.mount.zfs and enforce_statfs (per jail)

> I changed it to one, but that didn't seem to have the desired effect
> (should have I restarted?)

No restart needed. Sysctls are runtime configurable. If you need to 
preserve some sysctl settings after reboot you must put them in to 
/etc/sysctl.conf

> below are some of the relevant settings. If you require any other
> information, I'll try to send them as soon as I can.

Send us `sysctl security.jail` from host and from jail too.