[patch] allow testing VIMAGE with pf in base system only

Julian Elischer julian at elischer.org
Thu Sep 9 21:15:03 UTC 2010

On 9/9/10 12:22 PM, Luiz Gustavo S. Costa wrote:
> Hi Bjoern,
> I just perform tests with your patch and it worked very well! thanks
> for the patch ...
> But I found something that may be unsafe within the jail environment,
> I'm allowed to change /dev/pf, so that if I run a "pfctl-f
> /etc/pf.conf" inside the jail to do with that the rules are read
> again, killing pf.conf on the main environment

there is a version of pf in the wings that actually knows about jails.
This change is not to be confused with that.

> FreeBSD gugabsd.xxxx.com.br 8.1-STABLE FreeBSD 8.1-STABLE #1: Thu Sep
> 9 14:31:43 BRT 2010
> root at gugabsd.xxxx.com.br:/usr/obj/usr/src/sys/GENERIC  i386
> Thanks
> 2010/9/7 Bjoern A. Zeeb<bzeeb-lists at lists.zabbadoz.net>:
>> Hey,
>> in a way to work on something I needed to be able to at least load pf
>> on my VIMAGE development machine.  So I quickly hacked together a
>> patch that does exactly that.  I hope it'll apply to HEAD or stable/8
>> but I didn't test on either.
>> This will NOT allow you to use pf with jails+vnet but should allow
>> using pf in the base system even if VIMAGE is enabled.  In case it
>> still panics for you, let me know and include a backtrace in your
>> report.
>> http://people.freebsd.org/~bz/20100907-01-pf-vnet0.diff
>> /bz
>> --
>> Bjoern A. Zeeb                              Welcome a new stage of life.
>> _______________________________________________
>> freebsd-virtualization at freebsd.org mailing list
>> http://lists.freebsd.org/mailman/listinfo/freebsd-virtualization
>> To unsubscribe, send any mail to
>> "freebsd-virtualization-unsubscribe at freebsd.org"

More information about the freebsd-virtualization mailing list