Solved FreeBSD jail with ezjail fails to log in with non root users

L

LordGordon

Hi there,

I just installed a fresh new FreeBSD 10.1 (FreeBSD 10.1-RELEASE-p9) and set up a jail with ezjail (ezjail-admin v3.3).

Inside the jail I created a new user (with adduser):

Code: 
 Login: test
  Password: *
  Uid [#]: 1001
  Gid [# or name]: 1001
  Change [month day year]:
  Expire [month day year]:
  Class:
  Home directory: /home/test
  Shell: /bin/sh

Yet, as soon I try to change the user I have this error:

Code: 
  root@myjail:~ # su -l test
  su: /bin/sh: Permission denied

To clarify, /etc/shells contains sh (and others too).

Is the first time I see this behavior. I searched for similar issues but I didn't found nothing similar. And I have no ideas on how to fix this.

Please, someone has hints on how fix this? It's blocking the setup of some software inside the jail.

Thanks a lot for your support.

Regards,

Nicholas
 
It would be strange if it isn't but double-check to see if /bin/sh is executable and readable by the user. Also check the start scripts, perhaps it's something in the user's ~/.profile. I'd also verify the permissions on the user's home directory. It's also possible the user wasn't created correctly, I've had that happen a couple of times. You get an error but it's quickly overlooked. The account would appear to be there but it's not. A vipw(8) with a save and exit usually fixes that.
 
Thanks a lot for your suggestion. Actually the permission of /bin/sh are fine, what is wrong are
the permissions at filesystem root. Don't know why ezjail created this by default:

Code: 
root@myjail:/ # ll
total 49
-rw-r--r--  2 root  wheel  966 May  5 11:06 .cshrc
-rw-r--r--  2 root  wheel  254 May  5 11:06 .profile
-r--r--r--  1 root  wheel  6198 May  5 11:06 COPYRIGHT
drwxr-x---  9 root  wheel  512 May  3 00:31 basejail/
lrwxr-x---  1 root  wheel  13 May  5 11:06 bin@ -> /basejail/bin
lrwxr-x---  1 root  wheel  14 May  5 11:06 boot@ -> /basejail/boot
dr-xr-xr-x  7 root  wheel  512 May  7 07:40 dev/
drwxr-xr-x  23 root  wheel  2048 May  6 10:37 etc/
lrwxr-xr-x  1 root  wheel  8 May  6 09:47 home@ -> usr/home
lrwxr-x---  1 root  wheel  13 May  5 11:06 lib@ -> /basejail/lib
lrwxr-x---  1 root  wheel  17 May  5 11:06 libexec@ -> /basejail/libexec
drwxr-xr-x  2 root  wheel  512 May  5 11:06 media/
drwxr-xr-x  2 root  wheel  512 May  5 11:06 mnt/
dr-xr-xr-x  1 root  wheel  0 May  7 07:42 proc/
lrwxr-x---  1 root  wheel  16 May  5 11:06 rescue@ -> /basejail/rescue
drwxr-xr-x  2 root  wheel  512 May  5 11:15 root/
lrwxr-x---  1 root  wheel  14 May  5 11:06 sbin@ -> /basejail/sbin
lrwxr-xr-x  1 root  wheel  11 May  5 11:06 sys@ -> usr/src/sys
drwxrwxrwt  6 root  wheel  512 May  7 07:40 tmp/
drwxr-xr-x  6 root  wheel  512 May  6 09:47 usr/
drwxr-xr-x  25 root  wheel  512 May  7 07:40 var/

So, here the steps I did to fix the issue:
  1. stop the jail;
  2. change the jail's filesystem to "rw" in /etc/fstab.myjail;
  3. start the jail;
  4. set proper permissions at the root: chmod -h o+rx basejail bin lib libexec sbin;
  5. stop the jail and change back the jail's fstab to "ro";
  6. start the jail.
Furthermore, to avoid the very same issue on new jails, in the host:

Code: 
cd /usr/jails/
sudo chmod o+rx basejail/
cd basejail
sudo chmod o+rx usr/
cd /usr/jails/newjail
sudo chmod -h o+rx basejail bin lib libexec sbin

Thanks a lot for pointing me at the right way!

Regards,

Nicholas
 
It doesn't look like the ezjail-admin specifies permissions when it creates the sym links. By any chance are you using a non-default umask in /etc/login.conf or setting it elsewhere?
 
I guess it could be the problem.

I didn't touch /etc/profile.

I changed ~/.cshrc for my normal user (sudo enabled):
Code: 
umask 027

In root's .cshrc:
Code: 
umask 022
 
Yes, umask really is the problem here. Thanks for this hint.

Just an addition to that: If you have existing jails with the "Permission denied" error. Please also check that / has 0755 permissions, otherwise you won't be able to su to another user, too.
You can fix for all your existing jails with e.g.:
Code: 
find /usr/jails -type d -maxdepth 1 -exec chmod 0755 {} \;
 
You must log in or register to reply here.
Back
Top