[FreeBSD 6] semctl broken compared to 4-STABLE ...

[Kris Kennaway]

On Sun, Apr 02, 2006 at 04:54:32PM -0300, Marc G. Fournier wrote:
> On Sun, 2 Apr 2006, Kris Kennaway wrote:
> 
> >On Sun, Apr 02, 2006 at 04:32:31PM -0300, Marc G. Fournier wrote:
> >>On Sun, 2 Apr 2006, Kris Kennaway wrote:
> >>
> >>>On Sun, Apr 02, 2006 at 02:55:39PM -0300, Marc G. Fournier wrote:
> >>>>
> >>>>Back in April '05, someone posted a thread about PostgreSQL within 
> >>>>FreeBSD
> >>>>jails:
> >>>>
> >>>>http://unix.derkeiler.com/Mailing-Lists/FreeBSD/stable/2005-04/0837.html
> >>>>
> >>>>At the time (and to date) I reported that I was running several 
> >>>>PostgreSQL
> >>>>daemons, all on the same port, using FreeBSD 4.x, and all within a jail
> >>>>each ... and I continue to do this without any problems ...
> >>>>
> >>>>Today, on our new FreeBSD 6.x machine, I am now experiencing the same
> >>>>problem that Alexander originally reported ...
> >>>>
> >>>>Its not PostgreSQL related ... I'm running 4x7.4 servers on a FreeBSD 
> >>>>4.x
> >>>>box, all on the same port ... here, I'm trying to run 2x7.4 servers on a
> >>>>FreeBSD RELENG_6 box ...
> >>>>
> >>>>So, something has changed with FreeBSD 6's (and, according to the above
> >>>>thread, 5's) use of shared memory and semaphores that is breaking the
> >>>>ability to do this ... something that did work as hoped in FreeBSD 4 ...
> >>>
> >>>See jail(8)?
> >>
> >>If you are referring to:
> >>
> >>     security.jail.sysvipc_allowed
> >>          This MIB entry determines whether or not processes within a jail
> >>          have access to System V IPC primitives.  In the current jail
> >>          imple-
> >>          mentation, System V primitives share a single namespace across 
> >>          the
> >>          host and jail environments, meaning that processes within a jail
> >>          would be able to communicate with (and potentially interfere 
> >>          with)
> >>          processes outside of the jail, and in other jails.  As such, 
> >>          this
> >>          functionality is disabled by default, but can be enabled by
> >>          setting
> >>          this MIB entry to 1.
> >>
> >>That wording hasn't changed since FreeBSD4.x, so you are saying that
> >>FreeBSD6.x has become *less* stable/secure in this regard then FreeBSD 4.x
> >>was?  Seems an odd direction to go ...
> >
> >No, as you say the wording hasn't changed: "meaning that processes
> >within a jail would be able to communicate with (and potentially
> >interfere with) processes outside of the jail, and in other jails.".
> >It looks like your postgresql's are doing this.
> 
> Right, but why are they doing it *consistently* in FreeBSD 6.x, when they 
> never did it in FreeBSD 4.x?  I have postmaster processes running on the 
> FreeBSD box as far back as November 27th, 2005 ... and have *never* 
> experienced this problem ... so it isn't PostgreSQL that has changed, 
> something in FreeBSD has changed :(

You'll need to do some debugging to find out which of the two causes
of EINVAL are true here (or some undocumented cause).

Kris
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-stable/attachments/20060402/86d421e5/attachment.pgp