Re: FreeBSD 8.1 prerelease "security.jail.mount_allowed" is broken?

--0QFb0wBpEddLcDHQ
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue, May 25, 2010 at 12:35:19PM +0400, Eugene Mitrofanov wrote:
> Hello
>=20
> I try to do mount from a jail but it failed. Could you advise me where is=
 my=20
> mistake?
>=20
> root@ftp:eugene# uname -mrs
> FreeBSD 8.1-PRERELEASE amd64
> root@ftp:eugene# sysctl -a | grep -E '(jailed|mount)'
> vfs.usermount: 1
> vfs.ffs.compute_summary_at_mount: 0
> security.jail.mount_allowed: 1
> security.jail.jailed: 1
> root@ftp:eugene# mount /dev/da2s2a /var/t
> mount: /dev/da2s2a : Operation not permitted
> root@ftp:eugene# mount /dev/md1 /var/t
> mount: /dev/md1 : Operation not permitted
> root@ftp:eugene# mount /dev/zvol/tank/ftp.journal /var/t
> mount: /dev/zvol/tank/ftp.journal : Operation not permitted

You can only mount jail-friendly file systems - those with 'jail'
keyword in lsvfs(1) output.

What you tried can't be safe. Imagine creating corrupted file system on
da2s2a and mounting it. It will panic entire system, not only your jail.

--=20
Pawel Jakub Dawidek                       http://www.wheelsystems.com
[e-mail]                           http://www.FreeBSD.org
FreeBSD committer                         Am I Evil? Yes, I Am!

--0QFb0wBpEddLcDHQ
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (FreeBSD)

iEYEARECAAYFAkv8IHYACgkQForvXbEpPzSHpACeKp6iYeGd6h/zkpoZJTIx5j9I
8S8AniB9XxU4Sr3aT8NZHdii/CFLB+0N
=cdSt
-----END PGP SIGNATURE-----

--0QFb0wBpEddLcDHQ--