Date: Mon, 21 Apr 2003 20:20:34 -0500 (CDT) From: "Scot W. Hetzel" <hetzels@westbend.net> To: FreeBSD-Current <freebsd-current@freebsd.org>, Mike Makonnen <mtm@identd.net>, Dima Dorfman <dd@freebsd.org> Subject: RE: Enhancements to the new rc.d/jail script Message-ID: <200304220120.h3M1KXJ4008698@WBIw009.westbend.net>
next in thread | raw e-mail | index | archive | help
From: "Mike Makonnen" <mtm@identd.net>
> "Scot W. Hetzel" <hetzels@westbend.net> wrote:
> > Currently rc.d/devfs starts after rc.d/jail, we need devfs rulesets
> > defined before the jail is started (devfs added to rc.d/jail REQUIRE).
>
> This should be doable. But, please get the devfs maintainer to signoff on it
> first (dd@freebsd.org).
>
Are these changes to devfs ok with you (dd)?
> > Added a standard jail ruleset to rc.d/devfs.
>
> I agree with Doug, this should be behind an rc.conf knob.
>
> I don't know if examples belong in defaults/rc.conf. The rc.conf(5) man page
> already explains what additional knobs need to be set. However, if they do
> belong here, then they should be commented out.
>
Attached is the updated patch. The Standard Jail devfs ruleset now needs to
be enabled with devfs_jail_ruleset_enable.
I commented out the jail_example* variables. An alternative to having these
jail_example variables in defaults/rc.conf is to replace them with the following
comment:
# create an entry for each jail named in jail_list, see man rc.conf(5)
I also updated rc.conf(5) man page.
Scot
Index: etc/defaults/rc.conf
===================================================================
RCS file: /home/ncvs/src/etc/defaults/rc.conf,v
retrieving revision 1.172
diff -u -r1.172 rc.conf
--- etc/defaults/rc.conf 16 Apr 2003 16:29:51 -0000 1.172
+++ etc/defaults/rc.conf 21 Apr 2003 23:48:01 -0000
@@ -426,11 +426,32 @@
harvest_ethernet="YES" # Entropy device harvests ethernet randomness
harvest_p_to_p="YES" # Entropy device harvests point-to-point randomness
dmesg_enable="YES" # Save dmesg(8) to /var/run/dmesg.boot
+
+##############################################################
+### Jail Configuration #######################################
+##############################################################
+devfs_jail_ruleset_enable="NO" # Enable Standard Jail devfs ruleset in rc.d/devfs
+devfs_jail_ruleset_num="666" # Standard Jail ruleset number
+ # (change if it conflicts with your devfs rulesets)
+
jail_enable="NO" # Set to NO to disable starting of any jails
jail_list="" # Space separated list of names of jails
jail_set_hostname_allow="YES" # Allow root user in a jail to change its hostname
jail_socket_unixiproute_only="YES" # Route only TCP/IP within a jail
-jail_sysvipc_allow="NO" # Allow SystemV IPC use from within a jail
+jail_sysvipc_allow="NO" # Allow SystemV IPC use from within a jail
+jail_default_ruleset="666" # Default jail devfs ruleset to apply
+
+# create an entry for each jail named in jail_list, with these variables
+#
+#jail_example_rootdir="/usr/jail/default" # Jails root directory
+#jail_example_hostname="default.domain.com" # Jails hostname
+#jail_example_ip="192.168.0.10" # Jails IP number
+#jail_example_exec="/bin/sh /etc/rc" # command to execute in jail
+#jail_example_devfs="NO" # mount devfs in jail
+#jail_example_devfs_ruleset="666" # devfs ruleset to apply to jail
+#jail_example_procfs="NO" # mount procfs in jail
+#
+# NOTE: replace 'example' with the jail's name from jail_list
##############################################################
### Define source_rc_confs, the mechanism used by /etc/rc.* ##
Index: etc/rc.d/devfs
===================================================================
RCS file: /home/ncvs/src/etc/rc.d/devfs,v
retrieving revision 1.2
diff -u -r1.2 devfs
--- etc/rc.d/devfs 15 Dec 2002 21:56:53 -0000 1.2
+++ etc/rc.d/devfs 21 Apr 2003 23:48:42 -0000
@@ -13,6 +13,24 @@
load_rc_config $name
+# Standard Jail ruleset
+if checkyesno devfs_jail_ruleset_enable ; then
+ /sbin/devfs rule -s ${devfs_jail_ruleset_num} delset
+ /sbin/devfs rule -s ${devfs_jail_ruleset_num} add 100 hide
+ /sbin/devfs rule -s ${devfs_jail_ruleset_num} add 200 path ptyp* unhide
+ /sbin/devfs rule -s ${devfs_jail_ruleset_num} add 300 path ttyp* unhide
+ /sbin/devfs rule -s ${devfs_jail_ruleset_num} add 400 path null unhide
+ /sbin/devfs rule -s ${devfs_jail_ruleset_num} add 500 path zero unhide
+ /sbin/devfs rule -s ${devfs_jail_ruleset_num} add 600 path random unhide
+ /sbin/devfs rule -s ${devfs_jail_ruleset_num} add 610 path urandom unhide
+ /sbin/devfs rule -s ${devfs_jail_ruleset_num} add 700 path fd unhide
+ /sbin/devfs rule -s ${devfs_jail_ruleset_num} add 800 path fd/* unhide
+ /sbin/devfs rule -s ${devfs_jail_ruleset_num} add 810 path mdctl unhide
+ /sbin/devfs rule -s ${devfs_jail_ruleset_num} add 900 path stdin unhide
+ /sbin/devfs rule -s ${devfs_jail_ruleset_num} add 910 path stdout unhide
+ /sbin/devfs rule -s ${devfs_jail_ruleset_num} add 920 path stderr unhide
+fi
+
# Setup DEVFS, ie permissions, links etc.
#
if [ -r /etc/rc.devfs ]; then
Index: etc/rc.d/jail
===================================================================
RCS file: /home/ncvs/src/etc/rc.d/jail,v
retrieving revision 1.3
diff -u -r1.3 jail
--- etc/rc.d/jail 19 Apr 2003 07:50:32 -0000 1.3
+++ etc/rc.d/jail 21 Apr 2003 23:50:22 -0000
@@ -4,8 +4,8 @@
#
# PROVIDE: jail
-# REQUIRE: LOGIN
-# KEYWORD: FreeBSD
+# REQUIRE: LOGIN devfs
+# KEYWORD: FreeBSD shutdown
. /etc/rc.subr
@@ -14,6 +14,15 @@
start_cmd="jail_start"
stop_cmd="jail_stop"
+create_dev_links()
+{
+ local devdir=$1
+ local source=$2
+ local target=$3
+
+ (cd ${devdir} && ln -sf ${source} ${target})
+}
+
jail_start()
{
echo -n 'Configuring jails:'
@@ -49,11 +58,54 @@
for _jail in ${jail_list}
do
eval jail_rootdir=\"\$jail_${_jail}_rootdir\"
+ jail_devdir="${jail_rootdir}/dev"
+ jail_procdir="${jail_rootdir}/proc"
+
eval jail_hostname=\"\$jail_${_jail}_hostname\"
eval jail_ip=\"\$jail_${_jail}_ip\"
eval jail_exec=\"\$jail_${_jail}_exec\"
[ -z ${jail_exec} ] && jail_exec="/bin/sh /etc/rc"
-
+
+ eval jail_devfs=\"\$jail_${_jail}_devfs\"
+ [ -z ${jail_devfs} ] && jail_devfs="NO"
+
+ eval jail_ruleset=\"\$jail_${_jail}_devfs_ruleset\"
+ [ -z ${jail_ruleset} ] && jail_ruleset="${jail_default_ruleset}"
+
+ eval jail_procfs=\"\$jail_${_jail}_procfs\"
+ [ -z ${jail_procfs} ] && jail_procfs="NO"
+
+ if checkyesno jail_devfs; then
+ if [ -d ${jail_devdir} ] ; then
+ mount -t devfs dev ${jail_devdir}
+
+ if [ -n "${jail_ruleset}" ]; then
+ # Apply devfs ruleset
+ devfs -m ${jail_devdir} ruleset ${jail_ruleset}
+
+ # for libkvm (ab)users
+ create_dev_links ${jail_devdir} null mem
+ create_dev_links ${jail_devdir} null kmem
+
+ # create_dev_links ${jail_devdir} null console
+ fi
+
+ # Transitional symlink for old binaries
+ if [ ! -L ${jail_devdir}/log ]; then
+ create_dev_links ${jail_devdir} ../var/run/log log
+ fi
+
+ # Jail console output
+ create_dev_links ${jail_devdir} ../var/log/console console
+ fi
+ fi
+
+ if checkyesno jail_procfs; then
+ if [ -d ${jail_procdir} ] ; then
+ mount -t procfs proc ${jail_procdir}
+ fi
+ fi
+
jail ${jail_rootdir} ${jail_hostname} ${jail_ip} ${jail_exec}
done
}
@@ -61,6 +113,28 @@
jail_stop()
{
kill -TERM $(ps aux | awk '$8 ~ /.*J/ {print $2};')
+ for _jail in ${jail_list}
+ do
+ eval jail_rootdir=\"\$jail_${_jail}_rootdir\"
+ jail_devdir="${jail_rootdir}/dev"
+ jail_procdir="${jail_rootdir}/proc"
+ eval jail_devfs=\"\$jail_${_jail}_devfs\"
+ [ -z ${jail_devfs} ] && jail_devfs="NO"
+ eval jail_procfs=\"\$jail_${_jail}_procfs\"
+ [ -z ${jail_procfs} ] && jail_procfs="NO"
+
+ if checkyesno jail_devfs; then
+ if [ -d ${jail_devdir} ] ; then
+ umount -f ${jail_devdir} >/dev/null 2>&1
+ fi
+ fi
+
+ if checkyesno jail_procfs; then
+ if [ -d ${jail_procdir} ] ; then
+ umount -f ${jail_procdir} >/dev/null 2>&1
+ fi
+ fi
+ done
}
Index: share/man/man5/rc.conf.5
===================================================================
RCS file: /home/ncvs/src/share/man/man5/rc.conf.5,v
retrieving revision 1.182
diff -u -r1.182 rc.conf.5
--- share/man/man5/rc.conf.5 16 Apr 2003 16:29:51 -0000 1.182
+++ share/man/man5/rc.conf.5 21 Apr 2003 23:44:24 -0000
@@ -2398,11 +2398,25 @@
jail_vjail_ip="192.168.1.100"
jail_vjail_rootdir="/var/jails/vjail/root"
jail_vjail_exec="/bin/sh /etc/rc"
+jail_vjail_devfs="YES"
+jail_vjail_devfs_ruleset="666"
+jail_vjail_procfs="NO"
.Ed
.Pp
-The last one is optional. It defaults to
+The last four are optional. jail_<jailname>_exec defaults to
.Pa /etc/rc
if it is not set.
+jail_<jailname>_devfs and jail_<jailname>_procfs default to NO.
+This results in the devfs/procfs to not be mounted on the jail.
+jail_<jailname>_devfs_ruleset defaults to using devfs ruleset 666.
+.It Va jail_default_ruleset
+.Pq Vt int
+The default ruleset to apply to a jail that has devfs enabled, but
+no jail_<jailname>_devfs_ruleset defined. By default it is set to
+666. A Standard Jail rule set is provided in rc.d/devfs to enable
+it set devfs_jail_ruleset_enable to YES. If this ruleset conflicts
+with your rulesets change devfs_jail_ruleset_num from 666 to another
+value.
.It Va jail_set_hostname_allow
.Pq Vt bool
If set to NO,
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200304220120.h3M1KXJ4008698>