Nejprve na zacatek obecny dotaz:
Mam-li nejaky svazek primountovany s noexec, nosuid, pak z neho nelze
nic spoustet. Pokud si na tomto svazku vyberu nejaky adresar a pres
nullfs ho primountuju s exec a suid, pak z toho adresare lze spoustet
jako z bezneho oddilu.
Je to ocekavane a spravne chovani?
Tak a ted konkretne...
/vol0 je uloziste, kde jsou "jen" veci, co se nemaji spoustet (data
ruznych webu, mailboxy atd.)
/dev/mirror/gm0s2d on /vol0 (ufs, local, noexec, nosuid, soft-updates)
Dodatecne je potreba na ten system nasadit Jail v roli plne instalace
systemu. Jelikoz na jinem svazku neni dostatek mista, tak jsem na /vol0
udelal nejaky adresar a ten pres nullfs primountoval, do neho jeste
primountoval ports tree a devfs. Bezproblemu nainstaloval base system a
spustil jail:
/vol0/jail/.nullfs/rain on /vol0/jail/rain_new (nullfs, local)
/usr/ports on /vol0/jail/rain_new/usr/ports (nullfs, local)
devfs on /vol0/jail/rain_new/dev (devfs, local)
Potud je vsechno v poradku a vse se chova "normalne" (dle mych ocekavani)
Kdyz uz z toho nullfs mountu jde spustit jail, neocekaval bych dalsi
problemy se spoustenim cehokoliv v tom jailu, ale opak je pravdou a pri
kompilaci nekterych portu se vyskytuji nasledujici chybove hlasky:
LD_LIBRARY_PATH=/usr/ports/lang/perl5.8/work/perl-5.8.9 cc -Wl,-E
-L/usr/local/lib -o miniperl `echo malloc.o gv.o toke.o perly.o op.o
pad.o regcomp.o dump.o util.o mg.o reentr.o hv.o av.o perl.o run.o
pp_hot.o sv.o pp.o scope.o pp_ctl.o pp_sys.o doop.o doio.o regexec.o
utf8.o taint.o deb.o universal.o xsutils.o globals.o perlio.o perlapi.o
numeric.o mathoms.o locale.o pp_pack.o pp_sort.o | sed 's/ op.o / /'`
miniperlmain.o opmini.o -lm -lcrypt -lutil
LD_LIBRARY_PATH=/usr/ports/lang/perl5.8/work/perl-5.8.9 ./miniperl -w
-Ilib -MExporter -e '<?>' || /usr/bin/make minitest
/libexec/ld-elf.so.1: Cannot execute objects on /
cp ext/re/re.pm lib/re.pm
LD_LIBRARY_PATH=/usr/ports/lang/perl5.8/work/perl-5.8.9 ./miniperl
-Ilib configpm
/libexec/ld-elf.so.1: Cannot execute objects on /
*** Error code 1
Stop in /usr/ports/lang/perl5.8/work/perl-5.8.9.
*** Error code 1 (ignored)
[...]
cd t && (rm -f perl; /bin/ln -s ../miniperl perl) &&
LD_LIBRARY_PATH=/usr/ports/lang/perl5.8/work/perl-5.8.9 ./perl TEST
-minitest base/*.t comp/*.t cmd/*.t run/*.t io/*.t op/*.t uni/*.t </dev/tty
cannot open /dev/tty: Device busy
*** Error code 2 (ignored)
LD_LIBRARY_PATH=/usr/ports/lang/perl5.8/work/perl-5.8.9 ./miniperl
-Ilib configpm
/libexec/ld-elf.so.1: Cannot execute objects on /
*** Error code 1
Stop in /usr/ports/lang/perl5.8/work/perl-5.8.9.
*** Error code 1
Stop in /usr/ports/lang/perl5.8.
*** Error code 1
Stop in /usr/ports/lang/perl5.8.
===>>> make failed for lang/perl5.8
===>>> Aborting update
===>>> Update for lang/perl5.8 failed
===>>> Aborting update
===>>> Update for databases/mytop failed
===>>> Aborting update
Terminated
Pomoci pkg_add jsem Perl nainstaloval normalne.
Kompilace Apache probehla normalne, ale napriklad kompilace PHP ne:
/libexec/ld-elf.so.1: Cannot execute objects on /
apxs:Error: Sorry, no shared object support for Apache.
apxs:Error: available under your platform. Make sure.
apxs:Error: the Apache module mod_so is compiled into.
apxs:Error: your server binary '/usr/local/sbin/httpd'..
"/usr/ports/Mk/bsd.apache.mk", line 288: warning: "/usr/local/sbin/apxs
-q MPM_NAME" returned non-zero status
===> php5-5.2.12 : Your apache does not support DSO modules.
*** Error code 1
Stop in /usr/ports/lang/php5.
===>>> make failed for lang/php5
===>>> Aborting update
===>>> Update for lang/php5 failed
===>>> Aborting update
===>>> Update for graphics/php5-gd failed
===>>> Aborting update
Terminated
Z meho laickeho pohledu to ma cosi spolecneho prave s tim noexec, nosuid
a nullfs, ale netusim co presne, pokud normalni spousteni jailu probiha
OK, nektere veci jdou take zkompilovat normalne.
Tudiz by me zajimalo, od nekoho, kdo tomuhle vidi vic pod sukni nez ja,
jestli je tohle nejaky "muj problem" zpusobeny tim, ze "takhle se nullfs
pouzivat nesmi", nebo je to nejaky bug ve FreeBSD 6.4 (na jine verzi
jsem to nezkousel) a teoreticky by to cele melo fungovat.
Mirek
--
FreeBSD mailing list ([email protected])
http://www.freebsd.cz/listserv/listinfo/users-l
