Starting and stopping the jail works fine when I stick to console apps. I can also successfully launch and use graphical jailed apps on the host display using e.g., jailme 1 firefox, but I cannot cleanly stop the jail after closing jailed graphical apps from my host X display.
Here is my /etc/jail.conf for reference:
Output of stopping the jail with
It seems the first line of my /usr/local/jails/browser.fstab is not getting unmounted by the /etc/rc.shutdown script:
The output of
The main problem is that as the /usr/local/jails/browser.fstab mounts do not get unmounted on jail shutdown, restarting the jail with
Manually unmounting with
Surprisingly, after a while, manually unmounting works, and I can restart the jail fine. This suggests that process(es) still temporarily keep access to the nullfs filesystem, but I'm unsure how I can trace the process(es). I tried
If it is any help, here is the jails section of my /etc/rc.conf:
And my pf rules too:
/etc/pf.conf:
Here is my /etc/jail.conf for reference:
Code:
# Global settings applied to all jails
interface = "lo1";
host.hostname = "$name.domain.local";
path = "/usr/local/jails/$name";
ip4.addr = 10.0.0.$ip;
mount.fstab = "/usr/local/jails/$name.fstab";
exec.start = "/bin/sh /etc/rc";
exec.stop = "/bin/sh /etc/rc.shutdown";
exec.clean;
mount.devfs;
devfs_ruleset = 5; # apply a sound ruleset setup from /etc/devfs.rules
# The jail definition for browser
browser {
$ip = 17;
}Output of stopping the jail with
jail -r -v browser:
Code:
browser: run command in jail: /bin/sh /etc/rc.shutdown
Stopping cron.
Waiting for PIDS: 1058.
.
Terminated
browser: sent SIGTERM to: 1054 1051 992
browser: removed
browser: run command: /sbin/umount /usr/local/jails/browser/dev
browser: run command: /sbin/umount -t nullfs /usr/local/jails/browser/skeleton
browser: run command: /sbin/umount -t nullfs /usr/local/jails/browser/
umount: unmount of /usr/local/jails/browser failed: Device busy
jail: browser: /sbin/umount -t nullfs /usr/local/jails/browser/: failed
browser: run command: /sbin/ifconfig lo1 inet 10.0.0.17 netmask 255.255.255.255 -aliasIt seems the first line of my /usr/local/jails/browser.fstab is not getting unmounted by the /etc/rc.shutdown script:
Code:
/usr/local/jails/templates/base-10.3-RELEASE /usr/local/jails/browser/ nullfs ro 0 0
/usr/local/jails/thinjails/browser /usr/local/jails/browser/skeleton nullfs rw 0 0The output of
jls shows that the jail did shutdown, though:
Code:
JID IP Address Hostname PathThe main problem is that as the /usr/local/jails/browser.fstab mounts do not get unmounted on jail shutdown, restarting the jail with
service jail start browser now causes an error:
Code:
Starting jails: cannot start jail "browser":
mount_nullfs: /usr/local/jails/browser: Resource deadlock avoided
jail: browser: /sbin/mount -t nullfs -o ro /usr/local/jails/templates/base-10.3-RELEASE /usr/local/jails/browser/: failed
.Manually unmounting with
umount /usr/local/jails/browser from the host results in:
Code:
umount: unmount of /usr/local/jails/browser failed: Device busySurprisingly, after a while, manually unmounting works, and I can restart the jail fine. This suggests that process(es) still temporarily keep access to the nullfs filesystem, but I'm unsure how I can trace the process(es). I tried
fstat -f /usr/local/jails/browser and lsof +D /usr/local/jails/browser, and the same commands on the other jail mounts, but they do not list any open files once the jail is closed. I'm unfamiliar with how to use these tools effectively, however.If it is any help, here is the jails section of my /etc/rc.conf:
Code:
# Jails
cloned_interfaces="lo1"
pf_enable="YES"
jail_enable="YES"
jail_list="browser"And my pf rules too:
/etc/pf.conf:
Code:
ext_if="wlan0"
int_if="lo1"
localnet=$int_if:network
scrub in all fragment reassemble
set skip on lo0
set skip on lo1
#nat for jails
nat on $ext_if inet from ($localnet) to any -> ($ext_if)