From nobody Fri Aug 29 23:06:58 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4cDDRk5wlqz65PQW; Fri, 29 Aug 2025 23:06:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4cDDRk59Ypz42LD; Fri, 29 Aug 2025 23:06:58 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1756508818; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=1efdOSxSUHSqMNYyQurySsk1EP+BtbefsEWmiBTXRCk=; b=WkAI92rY9CWm/ydmxZsdGI+E4OdGBQiWcLMCh5E/PaCXxjDNWgFw4N4dBS0X2WwWlErOaA RgTG+DbTUMG4/6LygQvNL/SeFhLUW1UNt/DaK0MO3hkHMzSnzeimZgcog48lpCyOP5DEMy VPi+TG2Z/vaZUzTLiM9s/vg2yVHvHbhJiKLBMGAA5QDthlHmKUSUJyDRavtxW2aLdhHoHw o6+dKr/v+VPzX6UYPkBWzR1EzxfFrInnXHbvUMSaWal33a3k67JaKq1GwTxR8YrTumBvVU pE1BMODd7DLWeFZVQ1PBi6Vq+qehpEA39iCfta+0vntiwkoLMv36eyoq0945dw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1756508818; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=1efdOSxSUHSqMNYyQurySsk1EP+BtbefsEWmiBTXRCk=; b=LOYETdxHP8WffbBW+6S1HfMm7lQSRkSFFpoHniTckS+0357mZwGncM0XbggIqPo01LGjTd CJh9th0tyNu2dhu21XSxuC9vupsg4sEGMz2WhUjRiY7P7XHZc9VqScumO/zLVR+EvGNA6h YxF1jGA+xpuHg9zBnnBj3TpYtukA70Z8ubqpp8JHYDicg2ieKyNcUIWFktJfwkyAw0qDz4 UyjSM4nEy6bz6oNNsTIBY2NhN24t4XzvNsfgYwehIYjylcpJxccW2ExchrbM2dAAxm8qt3 UVnz1ZdVM3bHibybvLL6EkKGy8qX6wwBvN/LvH4QRtg5kKXeNiEsTo3iCJhDyA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1756508818; a=rsa-sha256; cv=none; b=iiXfA6jBvvOcb5Veep6kqdBZG2CJK6Sho0U7X/pE3pTwqxwJFfzLOURnZ8BvOHmnkq+Q6V +W/U9rai+NJlzGnoGFUHvbo7mj8SaI7jRCbdyLKQn4GncgGnYyKYRItzUKajBJwmyPCRmV EecyXpMfuUbayEfe6sd568oKd81hlcoM6hWU1+PC5w6rgZbc79gG+OLAPBhey7YyFldm7K G8Q69QCAcGFF5heZauW1v84B+/JG3xTbDxgjgeACCG1TefjO2mYw92Vyrf7xJU2YHQXQla WS6LJLC2WJZKgNkpVSEhuZ71L0cLUYI9dEczTdKVJELk7YKmyjqhva8eiqxq+A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4cDDRk4N9qz10xW; Fri, 29 Aug 2025 23:06:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 57TN6wCq087498; Fri, 29 Aug 2025 23:06:58 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 57TN6wnO087495; Fri, 29 Aug 2025 23:06:58 GMT (envelope-from git) Date: Fri, 29 Aug 2025 23:06:58 GMT Message-Id: <202508292306.57TN6wnO087495@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Jamie Gritton Subject: git: 72d01e62b082 - main - netgraph: teach ngctl to attach and run itself in a jail List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jamie X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 72d01e62b082de39ecf1ff3ced67dcf7259e5084 Auto-Submitted: auto-generated The branch main has been updated by jamie: URL: https://cgit.FreeBSD.org/src/commit/?id=72d01e62b082de39ecf1ff3ced67dcf7259e5084 commit 72d01e62b082de39ecf1ff3ced67dcf7259e5084 Author: Jamie Gritton AuthorDate: 2025-08-29 23:02:14 +0000 Commit: Jamie Gritton CommitDate: 2025-08-29 23:02:14 +0000 netgraph: teach ngctl to attach and run itself in a jail Add -j flag to ngctl to allow ngctl to attach and run inside a jail. This allow parent to manipulate netgraph nodes in the jail even if ngctl is not available. Submitted by: David Marker Reviewed by: kevans, zlei, jamie Relnotes: yes Differential Revision: https://reviews.freebsd.org/D50241 --- usr.sbin/ngctl/Makefile | 5 +++++ usr.sbin/ngctl/main.c | 41 +++++++++++++++++++++++++++++++++++------ usr.sbin/ngctl/ngctl.8 | 25 +++++++++++++++++++++++-- 3 files changed, 63 insertions(+), 8 deletions(-) diff --git a/usr.sbin/ngctl/Makefile b/usr.sbin/ngctl/Makefile index 72a5ccaa96d7..997841272376 100644 --- a/usr.sbin/ngctl/Makefile +++ b/usr.sbin/ngctl/Makefile @@ -13,4 +13,9 @@ LIBADD= netgraph CFLAGS+= -DEDITLINE LIBADD+= edit pthread +.if ${MK_JAIL} != "no" +CFLAGS+= -DJAIL +LIBADD+= jail +.endif + .include diff --git a/usr.sbin/ngctl/main.c b/usr.sbin/ngctl/main.c index 7c79e67d8275..b32e4f878b6e 100644 --- a/usr.sbin/ngctl/main.c +++ b/usr.sbin/ngctl/main.c @@ -55,6 +55,10 @@ #include #include #endif +#ifdef JAIL +#include +#include +#endif #include @@ -137,16 +141,17 @@ int csock, dsock; int main(int ac, char *av[]) { - char name[NG_NODESIZ]; - int interactive = isatty(0) && isatty(1); - FILE *fp = NULL; - int ch, rtn = 0; + char name[NG_NODESIZ]; + int interactive = isatty(0) && isatty(1); + FILE *fp = NULL; + const char *jail_name = NULL; + int ch, rtn = 0; /* Set default node name */ snprintf(name, sizeof(name), "ngctl%d", getpid()); /* Parse command line */ - while ((ch = getopt(ac, av, "df:n:")) != -1) { + while ((ch = getopt(ac, av, "df:j:n:")) != -1) { switch (ch) { case 'd': NgSetDebug(NgSetDebug(-1) + 1); @@ -157,6 +162,13 @@ main(int ac, char *av[]) else if ((fp = fopen(optarg, "r")) == NULL) err(EX_NOINPUT, "%s", optarg); break; + case 'j': +#ifdef JAIL + jail_name = optarg; +#else + errx(EX_UNAVAILABLE, "not built with jail support"); +#endif + break; case 'n': snprintf(name, sizeof(name), "%s", optarg); break; @@ -169,6 +181,22 @@ main(int ac, char *av[]) ac -= optind; av += optind; + if (jail_name != NULL) { + int jid; + + if (jail_name[0] == '\0') + Usage("invalid jail name"); + + jid = jail_getid(jail_name); + + if (jid == -1) + errx((errno == EPERM) ? EX_NOPERM : EX_NOHOST, + "%s", jail_errmsg); + if (jail_attach(jid) != 0) + errx((errno == EPERM) ? EX_NOPERM : EX_OSERR, + "cannot attach to jail"); + } + /* Create a new socket node */ if (NgMkSockNode(name, &csock, &dsock) < 0) err(EX_OSERR, "can't create node"); @@ -657,6 +685,7 @@ Usage(const char *msg) if (msg) warnx("%s", msg); fprintf(stderr, - "usage: ngctl [-d] [-f file] [-n name] [command ...]\n"); + "usage: ngctl [-j jail] [-d] [-f filename] [-n nodename] " + "[command [argument ...]]\n"); exit(EX_USAGE); } diff --git a/usr.sbin/ngctl/ngctl.8 b/usr.sbin/ngctl/ngctl.8 index 2225c836674a..63b8f58ed3df 100644 --- a/usr.sbin/ngctl/ngctl.8 +++ b/usr.sbin/ngctl/ngctl.8 @@ -31,7 +31,7 @@ .\" OF SUCH DAMAGE. .\" $Whistle: ngctl.8,v 1.6 1999/01/20 03:19:44 archie Exp $ .\" -.Dd January 19, 1999 +.Dd August 29, 2025 .Dt NGCTL 8 .Os .Sh NAME @@ -39,9 +39,11 @@ .Nd netgraph control utility .Sh SYNOPSIS .Nm +.Op Fl j Ar jail .Op Fl d .Op Fl f Ar filename .Op Fl n Ar nodename +.Op Ar command Op Ns Ar argument ... .Op Ar command ... .Sh DESCRIPTION The @@ -73,12 +75,31 @@ form if the originating node supports conversion. .Pp The options are as follows: .Bl -tag -width indent -.It Fl f Ar nodeinfo +.It Fl f Ar filename Read commands from the named file. A single dash represents the standard input. Blank lines and lines starting with a .Dq # are ignored. +Note that when the +.Fl j Ar jail +option is specified, the file will be opened before attaching to the jail and +then be processed inside the jail. +.It Fl j Ar jail +Perform the actions inside the +.Ar jail . +.Pp +.Nm +will first attach to the +.Ar jail +(by jail id or jail name) before performing the effects. +.Pp +This allows netgraph nodes of +.Ar jail +to be created, modified, and destroyed even if the +.Nm +binary is not available in +.Ar jail . .It Fl n Ar nodename Assign .Em nodename