jails Allowing raw sockets in jails

[balanga]

According to https://docs.freebsd.org/en/books/handbook/jails/#jails-tuning

you can allow raw sockets in jails by setting the appropriate sysctl(8) variables.

Can anyone show an example about how to do this?

 

[SirDice]

Those are actually deprecated in favor of per jail settings in jail.conf. See jail(8) (look under allow.*).

dice@molly:~ % sysctl -d security.jail.allow_raw_sockets
security.jail.allow_raw_sockets: Prison root can create raw sockets (deprecated)

The 'problem' with these sysctl(8) is that they apply to all your jails.

 

[balanga]

Many thanks. I can ping now, but how to automatically set up a resolver when creating a jail?

 

[SirDice]

Copy /etc/resolv.conf from the host to the jail?