Page MenuHomeFreeBSD

Fix jail examples in jib, jng, README
ClosedPublic

Authored by ryan_freqlabs.com on Oct 25 2018, 4:58 AM.

Details

Summary

The provided example jail configs in the jng and jib scripts do not work. Multiple interfaces need to be specified as a comma separated list or using multiple += lines in jail.conf, In the given example, the whole string is used as an interface name, which doesn't work with multiple interfaces listed.

Also added a note to the README about VIMAGE being built in by default on amd64 in FreeBSD 12, with appropriate instructions for loading the necessary netgraph modules, since they are not built in and ng_ether does not autoload.

Diff Detail

Repository
rS FreeBSD src repository
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

dteske requested changes to this revision.Oct 26 2018, 11:10 PM
dteske added inline comments.
share/examples/jails/README
15 ↗(On Diff #49602)

Upon reboot, a jail that requires these modules will find that they are no longer loaded. Further, ng_bridge and ng_eiface will be loaded automatically when performing a "mkpeer" via ngctl.

I think we should instead document that one needs to put:

ng_ether_load="YES"

In to /boot/loader.conf as well as perhaps "kldload ng_ether" if a reboot is to be avoided.

This revision now requires changes to proceed.Oct 26 2018, 11:10 PM

Addressed feedback by adding instructions for persistent loading of netgraph modules at boot.
(It's documented in rc.conf(5) that kld_list in rc.conf is preferable to loading with *_load in loader.conf because the kernel can load modules faster than loader.)

ryan_freqlabs.com marked an inline comment as done.Oct 27 2018, 12:31 AM

I missed the part about bridge and eiface autoloading, whoops!

Addressed feedback that only ng_ether must be manually loaded.

dteske added inline comments.Oct 27 2018, 2:32 AM
share/examples/jails/README
16–19 ↗(On Diff #49675)

Perhaps better wording (for your consideration):

# OPTIONAL: Load ng_ether module at boot:
$ sysrc kld_list+=ng_ether
# Load ng_ether at-once:
$ kldload ng_ether

The rest of the examples in the README describe the steps for a persistent configuration and how to immediately bring the system to that state, without calling out the latter part as optional. However this does make me realize that it should be mentioned these steps are only for the jng examples and are not necessary for use of jib.

ryan_freqlabs.com edited the summary of this revision. (Show Details)

Reworded text to point out that netgraph modules are only needed for jng.

dteske accepted this revision.Oct 27 2018, 12:25 PM

Looks good.

This revision is now accepted and ready to land.Oct 27 2018, 12:25 PM

Do you have a commit bit or do you need me to ferry this in?

I do not. Please take it from here. Thanks!

This revision was automatically updated to reflect the committed changes.