Difference Between Sysctl and Jail.conf

[STREBLO]

I was looking to make a jail for a repo using synth and he mentions in the readme putting the folloing in a jail.conf

Code:

enforce_statfs=0
allow.mount
allow.mount.nullfs
allow.mount.tmpfs
allow.mount.devfs

I haven't heard of a jail.conf before. Can these just be added to the sysctl settings in the gui? Or are jail.confs completely different?

 

[dlavigne]

From https://therub.org/2014/08/11/convert-freebsd-jails-from-rc.conf-to-jail.conf/:

FreeBSD jails used to be defined in /etc/rc.conf using rc-style syntax. During FreeBSD 9.x, a new convention was introduced, using /etc/jail.conf. FreeBSD 10.x defaults to the new style but still supports the rc.conf style. FreeBSD 11 will probably drop support for the old style.

 

[STREBLO]

Sysctls in the gui just change the rc.conf though right? In FreeNAS there's no jail.conf, right?

 

[dlavigne]

Correct that there is no jail.conf being used by FreeNAS.

 

[STREBLO]

Correct that there is no jail.conf being used by FreeNAS.

So can I just add this to the sysctls then?

Code:

enforce_statfs=0
allow.mount
allow.mount.nullfs
allow.mount.tmpfs
allow.mount.devfs

 

[dlavigne]

Yes, but note that the sysctl names are different:

sysctl -a|grep statfs
security.jail.param.enforce_statfs: 0
security.jail.enforce_statfs: 2

sysctl -a | grep allow.mount
security.jail.param.allow.mount.zfs: 0
security.jail.param.allow.mount.tmpfs: 0
security.jail.param.allow.mount.procfs: 0
security.jail.param.allow.mount.nullfs: 0
security.jail.param.allow.mount.fdescfs: 0
security.jail.param.allow.mount.devfs: 0
security.jail.param.allow.mount.: 0

 

[STREBLO]

Yes, but note that the sysctl names are different:

sysctl -a|grep statfs
security.jail.param.enforce_statfs: 0
security.jail.enforce_statfs: 2

sysctl -a | grep allow.mount
security.jail.param.allow.mount.zfs: 0
security.jail.param.allow.mount.tmpfs: 0
security.jail.param.allow.mount.procfs: 0
security.jail.param.allow.mount.nullfs: 0
security.jail.param.allow.mount.fdescfs: 0
security.jail.param.allow.mount.devfs: 0
security.jail.param.allow.mount.: 0

Thanks!