We are trying to setup a jailed procd service. Setting up the procd works well, while the ujail part fails miserably.
From the log below It would seem that it is unable to create the jailed file system area. Anyone have any idea what we are doing wrong here? Where could one find logs to help debug it?
The service definition looks like the following:
ALLOWED_EXECUTABLES="/bin/sleep /usr/bin/logger"
ALLOWED_WRITABLES=""
SECURITY_TYPE=jail
COMMON_MOUNTS="/zzzz"
procd_open_instance
procd_set_param respawn
procd_set_param file "/etc/config/${CONFIGURATION}"
procd_set_param command "/zzzz/zzzz-saas/zzzz-saas.sh"
procd_set_param user "${COMPONENT_USER}"
procd_set_param group "${COMPONENT_GROUP}"
procd_set_param facility "${COMPONENT_NAME}"
procd_set_param stdout 1
procd_set_param stderr 1
procd_set_param no_new_privs 1
# TODO: Check for other security types and yell if unknown.
[ "${SECURITY_TYPE}" = "jail" ] && {
logger "Setting up a jail for ${COMPONENT_NAME}"
procd_add_jail "${COMPONENT_NAME}" log requirejail
# We actually do want to expand the lists
# shellcheck disable=SC2086
procd_add_jail_mount ${COMMON_MOUNTS} ${ALLOWED_EXECUTABLES}
# shellcheck disable=SC2086
[ "${ALLOWED_WRITABLES}" != "" ] && procd_add_jail_mount_rw ${ALLOWED_WRITABLES}
}
procd_close_instance
Wed Nov 9 09:28:37 2022 user.err : jail: creat(/tmp/ujail-ngBpdn/zzzz/zzzz-saas/zzzz-saas.sh) failed: Read-only file system
Wed Nov 9 09:28:37 2022 daemon.err zzzz-saas.sh[2526]: jail: creat(/tmp/ujail-ngBpdn/zzzz/zzzz-saas/zzzz-saas.sh) failed: Read-only file system
Wed Nov 9 09:28:37 2022 daemon.err zzzz-saas.sh[2526]: jail: mount_all() failed
Wed Nov 9 09:28:37 2022 daemon.err zzzz-saas.sh[2526]: jail: failed to build jail fs
Wed Nov 9 09:28:37 2022 daemon.info zzzz-saas.sh[2526]: jail: jail (2529) exited with exit: 1