Re: mount_nullfs inside a jail

On Mon, 23 Jul 2007 15:33:33 +0200 Pawel Jakub Dawidek wrote:
> On Sun, Jul 22, 2007 at 04:18:06AM +0400, Boris Samorodov wrote:

> > Is it possible to use mount_nullfs inside a jail?
> > 
> > With amd64-current:
> > -----
> > # sysctl security.jail
> > security.jail.jailed: 1
> > security.jail.mount_allowed: 1
> > security.jail.chflags_allowed: 1
> > security.jail.allow_raw_sockets: 0
> > security.jail.enforce_statfs: 2
> > security.jail.sysvipc_allowed: 1
> > security.jail.socket_unixiproute_only: 1
> > security.jail.set_hostname_allowed: 1
> > # mount_nullfs /usr/ports /mnt
> > mount_nullfs: Operation not permitted
> > -----

> It is not possible. From jail(8):

>      security.jail.mount_allowed
>           This MIB entry determines if a privileged user inside a jail will be
>           able to mount and unmount file system types marked as jail-friendly.
>           The lsvfs(1) command can be used to find file system types available
>           for mount from within a jail.  This functionality is disabled by
>           default, but can be enabled by setting this MIB entry to 1.

> 	# lsvfs
> 	Filesystem                        Refs Flags
> 	-------------------------------- ----- ---------------
> 	zfs                                  0 jail
> 	nullfs                               0 loopback

Thanks, Pavel. Somehow I failed to do RTFM.

> As you can see, nullfs doesn't have 'jail' flag. The only jail-friendly
> file system currently is ZFS. Nullfs is a good candidate for a
> jail-friendly file system, but is not marked as such yet.

Does somebody know if only a flag is missing or not?


WBR
-- 
Boris Samorodov (bsam)
Research Engineer, http://www.ipt.ru Telephone & Internet SP
FreeBSD committer, http://www.FreeBSD.org The Power To Serve