Re: SHM objects cannot be isolated in jails, any evolution in future FreeBSD versions?

2016-03-14 Thread Mark Felder
How about filing a bug report for it? You've > already got a good write-up of the situation. > Both this and SYSV IPC jail support[1] are badly needed. [1] https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=48471 -- Mark Felder ports-secteam member f...@freebsd.org ___ freebsd-jail@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-jail To unsubscribe, send any mail to "freebsd-jail-unsubscr...@freebsd.org"

Re: Jail management

2016-02-24 Thread Mark Felder
gt; management? > > I don't use ezjail. It doesn't upgrade well, and changes to the base jail require you stop all your jails. FreeBSD fat jails are so small (300MB?) it's not worth it in my opinion. I simply wrote a shell script to create fat jails and another script to handle upda

Re: preferred jail management tool

2015-01-27 Thread Mark Felder
On Tue, Jan 27, 2015, at 08:17, Mark Felder wrote: On Tue, Jan 27, 2015, at 07:41, Ernie Luzar wrote: Vimage has to be compiled into the kernel and its kernel compile option has comment that it is highly experimental. No it doesn't. # Network stack virtualization. #options

Re: preferred jail management tool

2015-01-27 Thread Mark Felder
On Tue, Jan 27, 2015, at 10:12, Alejandro Imass wrote: On Tue, Jan 27, 2015 at 8:41 AM, Ernie Luzar luzar...@gmail.com wrote: Ian Smith wrote: In my opinion any port that does not include complete documentation in its man pages is next to useless and many people agree. Ezjail man

Re: preferred jail management tool

2015-01-27 Thread Mark Felder
On Tue, Jan 27, 2015, at 11:03, Dirk Engling wrote: On 27.01.15 17:57, Mark Felder wrote: I'll admit that last time I used ezjail I found it frustratingly difficult to locate concise documentation on exactly how flavours worked, and how to use scripts to do things to the new jails

Future of jail(8) [WAS: preferred jail management tool]

2015-01-27 Thread Mark Felder
On Tue, Jan 27, 2015, at 11:17, Dirk Engling wrote: On 27.01.15 14:41, Ernie Luzar wrote: I hope the ezjail author takes this thread as incentive to keep his utility up to date and not let it die due to changing software in Freebsd base code. All I am doing is pointing out the facts

Re: preferred jail management tool

2015-01-26 Thread Mark Felder
On Sat, Jan 24, 2015, at 09:16, Ian Smith wrote: Excuse top-post, but the gmail header on this message was (surprisingly) insufficiently anonymised to disguise its origin: That could very well be Joe Barbish. It could also be someone in the same city who uses FreeBSD and likes qjails.

Re: only lo0 interface inside jail, no default gw

2014-12-22 Thread Mark Felder
On Thu, Dec 18, 2014, at 00:18, Alexander Lunev wrote: As i said in message to Jamie Gritton, i found why jails couldn't ping internet - i forget to add jail's address to table which permitted to NAT. Why subnet mask should be /32? What harm could be done if subnet mask of an alias is

Re: new jail framework with vnet, zfs and jail.conf support

2014-05-13 Thread Mark Felder
On 2014-05-13 07:11, fb...@a1poweruser.com wrote: I think you have made some poor basic design choices. Let him scratch his itch. Maybe it solves a problem you haven't encountered yet? 1. Requiring python as a dependent. Thats a lot of overhead just for a script. Not a show stopper, but

Re: Advice/guidance requested.

2014-01-11 Thread Mark Felder
I would also recommend ezjails. Using fat jails is often completely unnecessary. ___ freebsd-jail@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-jail To unsubscribe, send any mail to freebsd-jail-unsubscr...@freebsd.org

Re: ZFS-FreeBSD + postgresql performance

2013-10-23 Thread Mark Felder
On Wed, Oct 23, 2013, at 11:25, Albert Shih wrote: Hi I would like to known if someone here have in production a FreeBSD server with postgresql and the FS for the data of postgresql is a ZFS pool. I'm going to buy some server with 96Go of Ram and a jbod of 12 disks (4To each) The

Re: ezjail and UPDATING20131010

2013-10-11 Thread Mark Felder
On Fri, Oct 11, 2013, at 12:03, Kenta Suzumoto wrote: Hi there. I updated to 10-STABLE after it was branched and suddenly none of my [ez]jails will start. Does it have anything to do with the entry in UPDATING? What's the best way to solve it? This is being discussed. I don't know a

Re: ezjail and UPDATING20131010

2013-10-11 Thread Mark Felder
On Fri, Oct 11, 2013, at 14:30, Dirk Engling wrote: On 11.10.13 21:27, wishmaster wrote: Yeah!? But do you think updating python in each jail this is the right solution? Freebsd-update in each jail?? What about when number of jails is 10 or about. My server is very high loaded and I

Re: /lib/libc.so.7 unsupported file format

2013-10-10 Thread Mark Felder
On Wed, Oct 9, 2013, at 23:22, Sami Halabi wrote: Hi, i have a box with FreeBSD-9.1-Release-amd64. I did freebsd-update to the host and to the jails in, one of them is 32bit and since then i get: root@6:/root # jexec 1 /bin/csh /lib/libc.so.7: unsupported file layout root@6:/root #

Re: /lib/libc.so.7 unsupported file format

2013-10-10 Thread Mark Felder
On Thu, Oct 10, 2013, at 6:48, Sami Halabi wrote: Hi, is there a simple way to interpret the data in /var/db/freebsd-update that sits inside a jail, from HOST and install the updates that already fetched somehow ? freebsd-update uses binary patches. They are not entire files you could

Re: /lib/libc.so.7 unsupported file format

2013-10-10 Thread Mark Felder
On Thu, Oct 10, 2013, at 7:03, Sami Halabi wrote: Hi, thanks for replying me so fast. what i ment is: 1. in the jail (32 bit) to do: freebsd-update fetch # ls /var/db/freebsd-update/ ./ ../ f465c3739385890c221dff1a05e578c6cae0d0430e46996d319db7439f884336-install@ filelist files/

Re: Panic Freebsd 9.1 using export jail_plex_geek_lan_zfs_datasets

2013-10-09 Thread Mark Felder
On Wed, Oct 9, 2013, at 2:29, Thomas Steen Rasmussen wrote: On 08-10-2013 15:16, Mark Felder wrote: On Tue, Oct 8, 2013, at 8:10, Miguel C. wrote: Yeah I'm doing the same and works fine but the panic should be investigated I guess. If there's not a PR open for this scenario please

Re: Panic Freebsd 9.1 using export jail_plex_geek_lan_zfs_datasets

2013-10-08 Thread Mark Felder
On Sun, Sep 29, 2013, at 22:29, Miguel Clara wrote: I'm also not sure whats the best way to make zfs datasets visible inside a jail... should simply use mount_nullfs? I just use nullfs for my plex jail. Keeping it simple seems to work just fine.

Re: Panic Freebsd 9.1 using export jail_plex_geek_lan_zfs_datasets

2013-10-08 Thread Mark Felder
On Tue, Oct 8, 2013, at 8:10, Miguel C. wrote: Yeah I'm doing the same and works fine but the panic should be investigated I guess. If there's not a PR open for this scenario please submit what you've found. ___ freebsd-jail@freebsd.org mailing

Re: Starting jail breaks routing / multi-network jail

2013-08-01 Thread Mark Felder
On Wed, Jul 31, 2013, at 20:55, Josh Beard wrote: Starting a jail with a LAN and public address changes the host's routing table and will not talk over the public network. Cycling the netif and routing services resolves it. I'm not aware of the routing issue you're describing. I had a

Re: Loopback and jail.conf

2013-06-26 Thread Mark Felder
On Wed, Jun 26, 2013, at 7:12, Ivailo Tanusheff wrote: I need all jails to use the 127.0.0.1 address, not different hosts in 127.0.0 network. Jails cannot all share the same loopback. The networking in a jail is a bit odd if you're new to it. If you really want each jail to act like its own

Re: vnet jail with ipfw having logging problem

2013-05-02 Thread Mark Felder
On Thu, 02 May 2013 08:49:43 -0500, Joe fb...@a1poweruser.com wrote: I tested doing a kldload ipfw and fall into the default deny problem. Is there a sysctl to flip the default deny to default accept? options IPFIREWALL_DEFAULT_TO_ACCEPT when you build the kernel is the only way AFAIK

Re: IPv4 addresses clash / jails not working after reboot…

2013-03-07 Thread Mark Felder
On Thu, 07 Mar 2013 17:22:01 -0600, Jamie Gritton ja...@freebsd.org wrote: You're allowed to have the same address in multiple jails, but only in the case of jails that have one address (i.e. one IPv4 address in this case). Whoa, really? Why did I not know of those? I always thought each

Re: jail still broken on 9-STABLE

2012-05-15 Thread Mark Felder
On Tue, 15 May 2012 09:23:38 -0500, Christer Solskogen christer.solsko...@gmail.com wrote: I don't quite understand what you mean about that. Does it mean that you have fixed it or that you will fix it sometime in the future? It's not scheduled to be pushed into 9-STABLE (MFC'd) for quite

Re: Jail source address selection broken, patch for ping

2012-04-10 Thread Mark Felder
On Tue, 10 Apr 2012 04:03:22 -0500, Anders Hagman anders.hag...@netplex.se wrote: I have used vnet jail to get your own IP stack. One strange thing is that tcpdump on the host can not see the packets. Yes, vnet avoids this issue. You shouldn't be able to tcpdump on the host to see the

Re: Jail source address selection broken, patch for ping

2012-04-09 Thread Mark Felder
On Mon, 09 Apr 2012 14:16:47 -0500, Juan F. Díaz y Díaz j...@mrecic.gov.ar wrote: Mark, you can just run a jail with the setfib utility so you don't need to modify all your scripts. I don't think anyone here is understanding the issue and forcing a routing table will not help.