Re: SYSVIPC and jails

On 2026-04-29 14:49, Milan Obuch wrote:
> On Wed, 29 Apr 2026 12:56:53 -0700
> James Gritton <[email protected]> wrote:
>> allow.sysvipc was only on or off, an on meant that jails could see
>> each others' SYSV IPC objects, but kept their own key spaces (so you
>> see zero as the key when you example other jails' objects).
> 
> It did not work that way in old 'just on and off' time... when
> allow.sysvipc is on, both id and key are the same in base and jail, no
> difference. Actually, I see no rationale why should key space be
> separated in case of mutual visibility. Do you? I'd like to know more.
> 
>> You could interact beytween jails, but only if you had some way of
>> communicating the id apart from the normal method of using the key.

Interesting - I was looking through the commits, and saw where that
code was added, but it's likely that was replacing older code.  Even
though I'm the one who checked that code in, it was based on a user
submission and I don't know what the reasoning was there.  Looking
back, I can't think of a reason why that should be the case but it was
probably something that made sense to someone where there wasn't the
inherit/new distinction available.

I can't think of a reason it would be considered the right thing to
have IPC objects vidible to other jails by id but not by key.  I
suppose someone is depending on this behavior, and that might require
some workaround, but the default behavior should be what's documented.

- Jamie