From owner-svn-src-head@FreeBSD.ORG Sat Sep 13 18:54:16 2014 Return-Path: Delivered-To: svn-src-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id EB85742F; Sat, 13 Sep 2014 18:54:16 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 127AAC3E; Sat, 13 Sep 2014 18:54:16 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id s8DIsFgv084147; Sat, 13 Sep 2014 18:54:15 GMT (envelope-from hrs@FreeBSD.org) Received: (from hrs@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id s8DIsF8W084145; Sat, 13 Sep 2014 18:54:15 GMT (envelope-from hrs@FreeBSD.org) Message-Id: <201409131854.s8DIsF8W084145@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: hrs set sender to hrs@FreeBSD.org using -f From: Hiroki Sato Date: Sat, 13 Sep 2014 18:54:15 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r271545 - in head/etc: . rc.d X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 13 Sep 2014 18:54:17 -0000 Author: hrs Date: Sat Sep 13 18:54:15 2014 New Revision: 271545 URL: http://svnweb.freebsd.org/changeset/base/271545 Log: Do not set net.inet.ip.{sourceroute,accept_sourceroute} in a vnet jail. The following warnings were displayed: sysctl: net.inet.ip.sourceroute=0: Operation not permitted sysctl: net.inet.ip.accept_sourceroute=0: Operation not permitted Modified: head/etc/rc.d/routing head/etc/rc.subr Modified: head/etc/rc.d/routing ============================================================================== --- head/etc/rc.d/routing Sat Sep 13 18:41:24 2014 (r271544) +++ head/etc/rc.d/routing Sat Sep 13 18:54:15 2014 (r271545) @@ -326,20 +326,22 @@ options_inet() ${SYSCTL} net.inet.ip.forwarding=0 > /dev/null fi - if checkyesno forward_sourceroute; then - ropts_init inet - echo -n ' do source routing=YES' - ${SYSCTL} net.inet.ip.sourceroute=1 > /dev/null - else - ${SYSCTL} net.inet.ip.sourceroute=0 > /dev/null - fi - - if checkyesno accept_sourceroute; then - ropts_init inet - echo -n ' accept source routing=YES' - ${SYSCTL} net.inet.ip.accept_sourceroute=1 > /dev/null - else - ${SYSCTL} net.inet.ip.accept_sourceroute=0 > /dev/null + if ! check_jail vnet; then + if checkyesno forward_sourceroute; then + ropts_init inet + echo -n ' do source routing=YES' + ${SYSCTL} net.inet.ip.sourceroute=1 > /dev/null + else + ${SYSCTL} net.inet.ip.sourceroute=0 > /dev/null + fi + + if checkyesno accept_sourceroute; then + ropts_init inet + echo -n ' accept source routing=YES' + ${SYSCTL} net.inet.ip.accept_sourceroute=1 > /dev/null + else + ${SYSCTL} net.inet.ip.accept_sourceroute=0 > /dev/null + fi fi if checkyesno arpproxy_all; then Modified: head/etc/rc.subr ============================================================================== --- head/etc/rc.subr Sat Sep 13 18:41:24 2014 (r271544) +++ head/etc/rc.subr Sat Sep 13 18:54:15 2014 (r271545) @@ -1966,6 +1966,22 @@ check_required_after() return 0 } +# check_jail mib +# Return true if security.jail.$mib exists and set to 1. + +check_jail() +{ + local _mib _v + + _mib=$1 + if _v=$(${SYSCTL_N} "security.jail.$_mib" 2> /dev/null); then + case $_v in + 1) return 0;; + esac + fi + return 1 +} + # check_kern_features mib # Return existence of kern.features.* sysctl MIB as true or # false. The result will be cached in $_rc_cache_kern_features_