Solved Enabling pfpfctl: DIOCADDRULE: Operation not permitted

[Ferocious1881]

Following instructions from the handbook on jail vnet firewall I created a jail with the configuration:

acme {
exec.start = "/bin/sh /etc/rc";
exec.stop = "/bin/sh /etc/rc.shutdown jail";
exec.consolelog = "/var/log/jail_console_${name}.log";

allow.mount;
allow.raw_sockets;
exec.clean;
mount.devfs;
securelevel = 2;
enforce_statfs = 2;
devfs_ruleset = 5;

path = "/jails/${name}";
host.hostname = "${name}";

$ip = "10.0.0.10/24";
$gateway = "192.168.1.1";
$bridge = "bridge0";
$epair = "epair10";

vnet;
vnet.interface = "${epair}b";

exec.prestart  = "/sbin/ifconfig ${epair} create up";
exec.prestart += "/sbin/ifconfig ${epair}a up descr jail:${name}";
exec.prestart += "/sbin/ifconfig ${bridge} addm ${epair}a up";
exec.prestart += "/sbin/ifconfig ${epair}a ether something:0a";
exec.prestart += "/sbin/ifconfig ${epair}b ether something:0b";
exec.start    += "/sbin/ifconfig ${epair}b ${ip} up";
exec.start    += "/sbin/route add default ${gateway}";

exec.poststop = "/sbin/ifconfig ${bridge} deletem ${epair}a";
exec.poststop += "/sbin/ifconfig ${epair}a destroy";
}

but when running the jail, as follows:

jail -crm -f jail.conf
sysrc -j acme pf_enable=yes
service -j acme pf start

I goth the error

Enabling pfpfctl: DIOCADDRULE: Operation not permitted
/etc/rc.d/pf: WARNING: Unable to load /etc/pf.conf.
pfctl: DIOCSTART: Operation not permitted

and with jexec acme ps aux, I can confirm that the firewall is not running.

 

[T-Daemon]

securelevel = 2;

Lower the securelevel to "1".

Test setup: VNET jail "acme", created with sysutils/bastille, changed securelevel from "2" to "1"

jail.conf

acme {
  enforce_statfs = 2;
  devfs_ruleset = 5;
  exec.clean;
  exec.consolelog = /var/log/bastille/acme_console.log;
  exec.start = '/bin/sh /etc/rc';
  exec.stop = '/bin/sh /etc/rc.shutdown';
  host.hostname = acme;
  mount.devfs;
  mount.fstab = /usr/local/bastille/jails/acme/fstab;
  path = /usr/local/bastille/jails/acme/root;
  securelevel = 1;
  osrelease = 15.1-RELEASE;

  vnet;
  vnet.interface = e0b_acme;
  exec.prestart += "jib addm acme vtnet0";
  exec.prestart += "ifconfig e0a_acme description \"vnet0 host interface for Bastille jail acme\"";
  exec.poststop += "ifconfig e0a_acme destroy";
}

"acme" jail:

/etc/rc.conf

pf_enable="YES"

/etc/pf.conf

block in all
pass out all keep state

"acme" jail console:

root@acme:~ # service pf status
Status: Enabled for 0 days 00:07:02           Debug: Urgent

State Table                          Total             Rate
  current entries                        0           
  searches                               0            0.0/s
  inserts                                0            0.0/s
  removals                               0            0.0/s
Counters
  match                                  0            0.0/s
  bad-offset                             0            0.0/s
  fragment                               0            0.0/s
  short                                  0            0.0/s
  normalize                              0            0.0/s
  memory                                 0            0.0/s
  bad-timestamp                          0            0.0/s
  congestion                             0            0.0/s
  ip-option                              0            0.0/s
  proto-cksum                            0            0.0/s
  state-mismatch                         0            0.0/s
  state-insert                           0            0.0/s
  state-limit                            0            0.0/s
  src-limit                              0            0.0/s
  synproxy                               0            0.0/s
  map-failed                             0            0.0/s
  translate                              0            0.0/s