Re: visudo non-functional in 7.0-RELEASE jail

2008-07-30 Thread Randy Schultz
On Wed, 30 Jul 2008, Edwin Groothuis spaketh thusly:

-}Since lock_file() consists of three different functions depending
-}on your capabilities, could you pastebin the output of your config.log
-}somwwhere to figure out which was is used?

http://www.pastebin.be/13079

-}
-}I have visudo (and sudo) here working without any problems, inside
-}and outside jails.

For fbsd 7.0?  I have it for 6.x.  If yours is 7.0 then I must have missed
something.  Did you set your jails up the long way or with ezjail?

--
 Randy([EMAIL PROTECTED])  765.983.1283 *

Love with your heart, think with your head;  not the other way around.

___
freebsd-jail@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-jail
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: visudo non-functional in 7.0-RELEASE jail

2008-07-30 Thread Boris Samorodov
On Wed, 30 Jul 2008 12:04:16 -0400 (EDT) Randy Schultz wrote:
 On Wed, 30 Jul 2008, Edwin Groothuis spaketh thusly:

 -}Since lock_file() consists of three different functions depending
 -}on your capabilities, could you pastebin the output of your config.log
 -}somwwhere to figure out which was is used?

 http://www.pastebin.be/13079

 -}
 -}I have visudo (and sudo) here working without any problems, inside
 -}and outside jails.

 For fbsd 7.0?  I have it for 6.x.  If yours is 7.0 then I must have missed
 something.  Did you set your jails up the long way or with ezjail?

I have 7-STABLE here and some ezjail jails. The sudo ezjail update -i
command gives me:
-
% ls -l /space/jails/basejail/usr/bin/su 
-r-xr-xr-x  1 root  wheel  16904 30 июл 20:34 /space/jails/basejail/usr/bin/su
-

...while before updating it has been:
-
-r-sr-xr-x  1 root  wheel  16904 23 июл 19:09 /space/jails/basejail/usr/bin/su
-

Note the bit s for the owner of the file. Sure the command
sudo chmod u+s /space/jails/basejail/usr/bin/su helps here.


HTH and WBR
-- 
bsam
___
freebsd-jail@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-jail
To unsubscribe, send any mail to [EMAIL PROTECTED]


visudo non-functional in 7.0-RELEASE jail

2008-07-29 Thread Randy Schultz

Heya,

Been using jails for a while with 6.2 and 6.3.  Today I'm working my first lab
box with 7.0-RELEASE.  Set everything up with ezjail, e.g. ezjail-admin
create...  Everything builds/installs fine, no barks.  Sudo installed via make
install in /usr/ports/security/sudo on both parent and jail after a portsnap
update.  The version of sudo works fine in the parent.  In the jail however I
always get:

   zincite# /usr/local/sbin/visudo
   visudo: /usr/local/etc/sudoers busy, try again later

Sudoers is not busy.  This is on a fresh jail that only I have access to,
doing a visudo right after the make install finishes.

My first thought was the jail dev/fs perms were somehow messed up but I can
write to /usr/local/etc.  In fact I can vi /usr/local/etc/sudoers and write it
back out.

I've checked the sysctl flags.  They are the same as on a working 6.x
parent(but I've included them here FWIW):
   Root Dude ? sysctl -a|egrep jail
   security.jail.jailed: 0
   security.jail.mount_allowed: 0
   security.jail.chflags_allowed: 0
   security.jail.allow_raw_sockets: 0
   security.jail.enforce_statfs: 2
   security.jail.sysvipc_allowed: 0
   security.jail.socket_unixiproute_only: 1
   security.jail.set_hostname_allowed: 1


Rc.conf has:
   ezjail_enable=YES
   jail_list=zincite

   jail_zincite_rootdir=/usr/local/jails/zincite
   jail_zincite_hostname=zincite.earlham.edu
   jail_zincite_ip=159.28.83.137
   jail_zincite_interface=bge0
   #jail_zincite_fstab=/etc/zincite.fstab
   jail_zincite_mount_enable=YES
   jail_zincite_devfs_enable=YES


Fstab is pretty standard:
Root Dude ? cat /etc/fstab.zincite
/usr/local/jails/basejail /usr/local/jails/zincite/basejail nullfs ro 0 0


The /usr/local/jails/zincite/etc/devfs.conf is non-tweaked
   zincite# ls -l /dev
   total 0
   dr-xr-xr-x  2 root  wheel   512 Jul 29 16:23 fd
   lrwxr-xr-x  1 root  wheel14 Jul 29 16:23 log - ../var/run/log
   crw-rw-rw-  1 root  wheel0,   6 Jul 29 17:33 null
   crw-rw-rw-  1 root  wheel0, 121 Jul 29 17:26 ptyp0
   crw-rw-rw-  1 root  wheel0, 123 Jul 29 17:38 ptyp1
   crw-rw-rw-  1 root  wheel0,  10 Jul 29 12:23 random
   lrwxr-xr-x  1 root  wheel 4 Jul 29 16:23 stderr - fd/2
   lrwxr-xr-x  1 root  wheel 4 Jul 29 16:23 stdin - fd/0
   lrwxr-xr-x  1 root  wheel 4 Jul 29 16:23 stdout - fd/1
   crw-rw-rw-  1 root  wheel0, 122 Jul 29 17:26 ttyp0
   crw--w  1 rjtty  0, 124 Jul 29 17:38 ttyp1
   lrwxr-xr-x  1 root  wheel 6 Jul 29 16:23 urandom - random
   crw-rw-rw-  1 root  wheel0,   7 Jul 29 16:23 zero

and /usr/local/etc/ezjail/zincite contains:
   export jail_zincite_hostname=zincite
   export jail_zincite_ip=159.28.83.137
   export jail_zincite_rootdir=/usr/local/jails/zincite
   export jail_zincite_exec=/bin/sh /etc/rc
   export jail_zincite_mount_enable=YES
   export jail_zincite_devfs_enable=YES
   export jail_zincite_devfs_ruleset=devfsrules_jail
   export jail_zincite_procfs_enable=YES
   export jail_zincite_fdescfs_enable=YES
   export jail_zincite_image=
   export jail_zincite_imagetype=
   export jail_zincite_attachparams=
   export jail_zincite_attachblocking=
   export jail_zincite_forceblocking=


I tried tracing visudo but that didn't give me much:
   ...
   1293: open(/usr/local/etc/sudoers,O_RDWR|O_CREAT,0440) = 3 (0x3)
   1293: fcntl(3,F_SETLK,0x7fffe390)   ERR#22 'Invalid argument'
   visudo:  1293: write(2,visudo: ,8) = 8 (0x8)
  /usr/local/etc/sudoers busy, try again later 1293:
  write(2,/usr/local/etc/sudoers busy, try...,44) = 44 (0x2c)

   1293: write(2,\n,1)   = 1 (0x1)
   1293: process exit, rval = 1

I noted the invalid argument, thought busted port, but same thing works great
on the parent.

I'm running out of places to poke.

--
 Randy([EMAIL PROTECTED])  765.983.1283 *

Love with your heart, think with your head;  not the other way around.

___
freebsd-jail@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-jail
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: visudo non-functional in 7.0-RELEASE jail

2008-07-29 Thread Edwin Groothuis
Since lock_file() consists of three different functions depending
on your capabilities, could you pastebin the output of your config.log
somwwhere to figure out which was is used?

I have visudo (and sudo) here working without any problems, inside
and outside jails.

Edwin

-- 
Edwin Groothuis  |Personal website: http://www.mavetju.org
[EMAIL PROTECTED]|  Weblog: http://www.mavetju.org/weblog/
___
freebsd-jail@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-jail
To unsubscribe, send any mail to [EMAIL PROTECTED]