postgresql FreeBSD：jail 不能设置 security.jail.sysvipc_allowed

FreeBSD: jail can not set security.jail.sysvipc_allowed

提问by randomness2077

There is a problem when I init a PostgreSQL database in a FreeBSD jail.

当我在 FreeBSD jail 中初始化 PostgreSQL 数据库时出现问题。

I found an article about the problem. I tried its advice but I didn't have any luck and I don't know why. There is the link: PostgreSQL in jail.

我找到了一篇关于这个问题的文章。我尝试了它的建议，但我没有任何运气，我不知道为什么。有链接：PostgreSQL in jail。

I also read the PostgreSQL documentation on kernel resources:

我还阅读了有关内核资源的 PostgreSQL 文档：

If running in FreeBSD jails by enabling sysctl's security.jail.sysvipc_allowed, postmasters running in different jails should be run by different operating system users. This improves security because it prevents non-root users from interfering with shared memory or semaphores in different jails, and it allows the PostgreSQL IPC cleanup code to function properly. (In FreeBSD 6.0 and later the IPC cleanup code does not properly detect processes in other jails, preventing the running of postmasters on the same port in different jails.)

如果通过启用sysctl's 在 FreeBSD jails 中security.jail.sysvipc_allowed运行，则运行在不同 jails 中的 postmasters 应该由不同的操作系统用户运行。这提高了安全性，因为它可以防止非 root 用户干扰不同监狱中的共享内存或信号量，并且它允许 PostgreSQL IPC 清理代码正常运行。（在 FreeBSD 6.0 和更高版本中，IPC 清理代码无法正确检测其他 jail 中的进程，从而阻止了 postmaster 在不同 jail 的同一端口上运行。）

What I've done:

我所做的：

• I edited /etc/rc.conf(on the host machine) and added the line jail_sysvipc_allow="YES"
• In the jail machine's /etc/sysctl.conf, I add line security.jail.sysvipc_allowed=1

• 我编辑/etc/rc.conf（在主机上）并添加了该行jail_sysvipc_allow="YES"
• 在监狱机器的 中/etc/sysctl.conf，我添加了一行security.jail.sysvipc_allowed=1

I restarted the jail machine multiple times. I haven't restarted the host machine and don't want to.

我多次重新启动监狱机器。我还没有重新启动主机，也不想。

Hope someone can give me a solution or some advice. Thanks so much.

希望有人能给我一个解决方案或一些建议。非常感谢。

This is the message when I restart the jail:

这是我重新启动监狱时的消息：

 /etc/rc.d/sysctl: WARNING: unable to set security.jail.sysvipc_allowed=1

Or when I run sysctl manually: (on jail)

或者当我手动运行 sysctl 时：（在监狱中）

 root@xxxxx:/home/xxxx# sysctl security.jail.sysvipc_allowed=1
 security.jail.sysvipc_allowed: 0
 sysctl: security.jail.sysvipc_allowed: Operation not permitted

---

---

Freebsd version: FreeBSD xxxxxxx 9.1-PRERELEASE FreeBSD 9.1-PRERELEASE

Freebsd 版本：FreeBSD xxxxxxx 9.1-PRERELEASE FreeBSD 9.1-PRERELEASE

postgreSQL version: postgresql-server-9.1.4

postgreSQL 版本：postgresql-server-9.1.4

Error Message:

错误信息：

 root@xxxxxx:/home/xxx # /usr/local/etc/rc.d/postgresql initdb
 The files belonging to this database system will be owned by user "pgsql".
 This user must also own the server process.

 The database cluster will be initialized with locale C.
 The default text search configuration will be set to "english".

 creating directory /usr/local/pgsql/data ... ok
 creating subdirectories ... ok
 selecting default max_connections ... 10
 selecting default shared_buffers ... 400kB
 creating configuration files ... ok
 creating template1 database in /usr/local/pgsql/data/base/1 ... FATAL:  could not create      
 shared memory segment: Function not implemented
 DETAIL:  Failed system call was shmget(key=1, size=2146304, 03600).
 child process exited with exit code 1
 initdb: removing data directory "/usr/local/pgsql/data"

---

---

Update:

更新：

in host machine, /etc/sysctl.conf: security.jail.sysvipc_allowed=1 /etc/rc.conf : jail_sysvipc_allow="YES"

在主机中， /etc/sysctl.conf: security.jail.sysvipc_allowed=1 /etc/rc.conf : jail_sysvipc_allow="YES"

In Jail server, there is no extra jail_sysvipc configuration.

在 Jail 服务器中，没有额外的 jail_sysvipc 配置。

sysctl value in host machine:

主机中的 sysctl 值：

   root@xxxxx:/home/xxxx# sysctl -a | grep 'sysvipc'
   security.jail.param.allow.sysvipc: 0
   security.jail.sysvipc_allowed: 1

I still get the same error message as I got before.

我仍然收到与之前相同的错误消息。

In additional, I am wondering if there is anything with security.jail.param.allow.sysvipc? Because, in host machine, I was not allowed to set it. (security.jail.param.allow.sysvipc 0-> 0)

另外，我想知道security.jail.param.allow.sysvipc 是否有任何内容？因为，在主机中，我不允许设置它。(security.jail.param.allow.sysvipc 0-> 0)

采纳答案by randomness2077

I found the problem after my teammate's help.

在队友的帮助下我发现了问题。

Because I use /etc/jail.conf, I have to add a line "allow.sysvipc" to enable system share memory.

因为我使用/etc/jail.conf，所以我必须添加一行“allow.sysvipc”来启用系统共享内存。

in host machine,

在主机中，

  /etc/sysctl.conf
  security.jail.sysvipc_allowed=1

  /etc/rc.conf 
  jail_sysvipc_allow="YES" (DO NOT have to do this, remove it) 

回答by drumfire

Solution found. The following does work for me. On the host, do:

找到解决方案。以下对我有用。在主机上，执行：

root@host# jls
   JID  IP Address      Hostname                      Path
     3  -               some.jail                     /usr/jails/somejail

Find the correct JID, 3 in my example. Then, on the host, issue:

找到正确的 JID，在我的示例中为 3。然后，在主机上，发出：

jail -m jid=3 allow.sysvipc=1

jail -m jid=3 allow.sysvipc=1

回答by Paulo Fragoso

There are some new features for jail in special granularity, we need allow change sysvipc_allowed for each jail put this in /etc/rc.conf:

有一些特殊粒度的 jail 新功能，我们需要为每个 jail 更改 sysvipc_allowed 将其放在 /etc/rc.conf 中：

jail_example_parameters="allow.sysvipc=1"

回答by Roland Smith

The sysctl security.jail.sysvipc_allowedhas to be set on the host, not in the jail. But if you set jail_sysvipc_allow="YES"in the host's rc.conf, that should set it for you, see /etc/rc.d/jail.

sysctlsecurity.jail.sysvipc_allowed必须在主机上设置，而不是在监狱中。但是，如果您jail_sysvipc_allow="YES"在主机的rc.conf中设置，则应该为您设置，请参阅/etc/rc.d/jail。

You should check on the host if the value of security.jail.sysvipc_allowedchanges to 1 if you start the jail. If not, there is probably something wrong in your rc.conf. Try setting security.jail.sysvipc_allowedmanually on the host.

security.jail.sysvipc_allowed如果您启动jail，您应该检查主机的值是否更改为1。如果没有，您的 rc.conf 中可能有问题。尝试security.jail.sysvipc_allowed在主机上手动设置。

回答by user2201234

My system required modding /etc/rc.conf before restarting the jail, otherwise it would set both host and jail to 0. I did notneed to set security.jail.sysvipc_allowed=1 in /etc/sysctl.conf.

我的系统需要重新启动前监狱在/etc/rc.conf改装，否则会使主机和监狱设置为0。我也没有需要在/etc/sysctl.conf中security.jail.sysvipc_allowed = 1套。

/etc/rc.conf:
jail_sysvipc_allow="YES"