Databases
StackOverflow2013
Postsdbo
POFreeBSD: jail can not set security.jail.sysvipc_allowed
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POFreeBSD: jail can not set security.jail.sysvipc_allowed
    primarykey
    data
    text
    <p>There is a problem when I init a PostgreSQL database in a FreeBSD jail. </p> <p>I found an article about the problem. I tried its advice but I didn't have any luck and I don't know why. There is the link: <a href="http://www.freebsddiary.org/jail-multiple.php" rel="noreferrer">PostgreSQL in jail</a> . </p> <p>I also read the PostgreSQL documentation on <a href="http://www.postgresql.org/docs/9.1/static/kernel-resources.html" rel="noreferrer">kernel resources</a>:</p> <blockquote> <p>If running in FreeBSD jails by enabling <code>sysctl</code>'s <code>security.jail.sysvipc_allowed</code>, postmasters running in different jails should be run by different operating system users. This improves security because it prevents non-root users from interfering with shared memory or semaphores in different jails, and it allows the PostgreSQL IPC cleanup code to function properly. (In FreeBSD 6.0 and later the IPC cleanup code does not properly detect processes in other jails, preventing the running of postmasters on the same port in different jails.)</p> </blockquote> <p>What I've done:</p> <ul> <li>I edited <code>/etc/rc.conf</code> (on the host machine) and added the line <code>jail_sysvipc_allow="YES"</code> </li> <li>In the jail machine's <code>/etc/sysctl.conf</code>, I add line <code>security.jail.sysvipc_allowed=1</code></li> </ul> <p>I restarted the jail machine multiple times. I haven't restarted the host machine and don't want to.</p> <p>Hope someone can give me a solution or some advice. Thanks so much. </p> <p>This is the message when I restart the jail:</p> <pre><code> /etc/rc.d/sysctl: WARNING: unable to set security.jail.sysvipc_allowed=1 </code></pre> <p>Or when I run sysctl manually: (on jail) </p> <pre><code> root@xxxxx:/home/xxxx# sysctl security.jail.sysvipc_allowed=1 security.jail.sysvipc_allowed: 0 sysctl: security.jail.sysvipc_allowed: Operation not permitted </code></pre> <hr> <p>Freebsd version: FreeBSD xxxxxxx 9.1-PRERELEASE FreeBSD 9.1-PRERELEASE</p> <p>postgreSQL version: postgresql-server-9.1.4 </p> <p>Error Message:</p> <pre><code> root@xxxxxx:/home/xxx # /usr/local/etc/rc.d/postgresql initdb The files belonging to this database system will be owned by user "pgsql". This user must also own the server process. The database cluster will be initialized with locale C. The default text search configuration will be set to "english". creating directory /usr/local/pgsql/data ... ok creating subdirectories ... ok selecting default max_connections ... 10 selecting default shared_buffers ... 400kB creating configuration files ... ok creating template1 database in /usr/local/pgsql/data/base/1 ... FATAL: could not create shared memory segment: Function not implemented DETAIL: Failed system call was shmget(key=1, size=2146304, 03600). child process exited with exit code 1 initdb: removing data directory "/usr/local/pgsql/data" </code></pre> <hr> <p>Update:</p> <p>in host machine, /etc/sysctl.conf: security.jail.sysvipc_allowed=1 /etc/rc.conf : jail_sysvipc_allow="YES"</p> <p>In Jail server, there is no extra jail_sysvipc configuration. </p> <p>sysctl value in host machine:</p> <pre><code> root@xxxxx:/home/xxxx# sysctl -a | grep 'sysvipc' security.jail.param.allow.sysvipc: 0 security.jail.sysvipc_allowed: 1 </code></pre> <p>I still get the same error message as I got before. </p> <p>In additional, I am wondering if there is anything with security.jail.param.allow.sysvipc? Because, in host machine, I was not allowed to set it. (security.jail.param.allow.sysvipc 0-> 0)</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. USkaiserhl
    1. USkaiserhl
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    3. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POFreeBSD: jail can not set security.jail.sysvipc_allowed
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POFreeBSD: jail can not set security.jail.sysvipc_allowed
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. POFreeBSD: jail can not set security.jail.sysvipc_allowed
      1. This table or related slice is empty.
      1. VTUpMod
    1. COWhich FreeBSD version are you using? Which PostgreSQL version?
      singulars
      1. POFreeBSD: jail can not set security.jail.sysvipc_allowed
      1. USCraig Ringer
    2. COAlso, is this causing you a specific problem? Do you just want to improve inter-jail isolation? Are you having issues starting Pg up in a jail? What's the background? Include the commands you run and the errors they produce, just like you have for the attempted solution you've written about. Please update your question.
      singulars
      1. POFreeBSD: jail can not set security.jail.sysvipc_allowed
      1. USCraig Ringer
    3. COSame problem here, with FreeBSD-9.1, compiled two days ago..
      singulars
      1. POFreeBSD: jail can not set security.jail.sysvipc_allowed
      1. USdrumfire
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload