Veracrypt in FreeNAS Jail

[RosePeach]

I need to run veracrypt in a jail to decrypt and access a veracrypt file container that is located on a storage pool. Veracrypt seems to need the fuse kernel module to be loaded. Is there anyway to do this on FreeNAS?

 

[Samuel Tai]

No, FreeNAS 11.x jails don't support FUSE filesystems. You'll need to upgrade to TrueNAS Core 12.0-U1.1 to run jails with FUSE support.

 

[RosePeach]

No, FreeNAS 11.x jails don't support FUSE filesystems. You'll need to upgrade to TrueNAS Core 12.0-U1.1 to run jails with FUSE support.

Ok, I have upgraded to TrueNAS-12.0-U1.1 Core. I have a new jail that has release 12.1-RELEASE-p13. How can I get the fuse kernel module working inside the jail? I was able to add

Code:

fuse_load="YES"

to my hosts

Code:

/boot/loader.conf

file. But, when I try to run veracrypt in the jail it still says

Code:

Error: fuse: failed to open fuse device: No such file or directory

. Also, if I try to run

Code:

kldload fuse

in the jail I get this error message

Code:

kldload: can't load fuse: Operation not permitted

.

 

[Samuel Tai]

You have to run FUSE on the host, not inside the jail.

1. In System->Tunables, set loader tunable fuse_load="YES", which will load the FUSE module on the next boot.
2. Run kldload fuse if you don't want to wait until the next reboot.
3. In System->Tunables, set sysctl tunables security.jail.mount_allowed=1 and security.jail.mount_fusefs_allowed=1 to enable the security flags in the host to allow jails to use FUSE mounts.
4. In System->Tunables, set sysctl tunables security.jail.enforce_statfs=0, security.jail.mount_devfs_allowed=1, and vfs.usermount=1 to enable the security flags in the host to allow /dev/fuse to appear in the jail.
5. Set the following properties in iocage for the jail:
   
   Code:

   allow_mount:1
   allow_mount_devfs:1
   allow_mount_fusefs:1
   devfs_ruleset:0
   mount_devfs:1
   securelevel:0
   

 

[RosePeach]

Thank you! I think I've done what you've said except that I'm missing the mount_devfs option in my jail's properties.