I have tried to upgrade a few 11.3 base jails to 11.4 on my FreeNAS server running FreeBSD 11.3. I used:

iocage upgrade -r 11.4-RELEASE my-jail-name

Some of the jails were failing with etcupdate failed! Rolling back snapshot message. When I tried running etcupdate manually, both inside the jail, and from the outside using iocage exec I got a further message: Failed to build new tree. What is wrong?


It turns out the reason the /usr/local/sbin/etcupdate script was failing was because it was protecting some files from being deleted by setting a chflags schg system immutable flag, see line 213 of that script:

chflags -R noschg $1 >&3 2>&1 || return 1

Unfortunately, it was unable to clear that flag further on, and lines 265-266 were erring with Operation not permitted:

chflags -R noschg $1 >&3 2>&1
rm -rf $1 >&3 2>&1

This is because even though the jail had the necessary allow_chflags setting on, its securelevel was at the default value of 2 which allows for schg to be set, but it does not allow for it to be unset.

To fix this, I needed to change the jail's securelevel to 0 temporarily, making sure allow_chflags is on, then the iocage upgrade worked. After the upgrade I changed back the securelevel to the more secure, default value of 2.

I am posting this here in case it helps somebody else.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.