From nobody Mon Feb 2 17:24:43 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4f4YQM3xFnz6Qm68 for ; Mon, 02 Feb 2026 17:24:43 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4f4YQM0yrRz3ZQS for ; Mon, 02 Feb 2026 17:24:43 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1770053083; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Teg8XiGqWpuEdfP8Y/+H6Ww6gAxVX1qs5K4s7CSWRmU=; b=LYaxYTjh6USyNrBP1XNJvoOQtZZRpPYHZjc1jrvwDKXX42EAhVq7jiGnZgHwrJ5iT/xHj3 3ti7aI8U8l8lpwuyoG1JhuBl6LFXrzhi7D9FWcWm0mvLxUzOx1Iq4l3QhKYAtvvfbqKGXv 9CgRk9SYLOctEAWDtDCi/lWjPhIqo+YKd7Vsy4tLDR51KGpGJGjgkYjEeqOdGJlBYiAB2u YnNFrACQ25IuhTFDVIkbFI+ARoavvpIb89v89McUMguPMEhYtALL+eOf+keBsEHKrKCMu3 OTdPqz+BmaZHX1AeRFwawGIJoEZlXVAm71elFDi6M5gvuCBJu3YfifOjUYcR8Q== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1770053083; a=rsa-sha256; cv=none; b=URmQPZmfbUarwwQwdVXawU9NpOH2eBM4NV4Kpwmjva/oBO/QVN3qpIECNlHzKFfxI/h8DO St36XTpiIPx1c8g6NyGNoCZ130UdfaKrHZ9Zxsd38PU97xI6P1cP/0CCb4JQN5UkJvhc+V sxGs1NwoH4i99uosqQ7FpLNKlJvTW2n1cEwMAJ+uyyx5tLdoMp/0nscLPj69IRbx9xwLq+ ZCE3uTn6wFh3et15ieNP5miBQNNm7FRG4roTlq3l0gL7pV5CPDt0T9H59s4YyoUSaaFLzB S+P1ZA1caS61e4rRcafM6MiL6suuViMjuRt0CFlfGcBic8+ye2b6YTz+T1vvlA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1770053083; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Teg8XiGqWpuEdfP8Y/+H6Ww6gAxVX1qs5K4s7CSWRmU=; b=gU9RIcVfehgfBVmBc4A+OETkmiNcYWMiSyYTX1xZFnBR6vO8sHwl+zY493BFtFqhALbgpa m//C7aL2sFSGHb0wupjVRGwe+3E63X+Jhg3BmWfXPaVGDnavmjOoSE9BjEgBoCfqwiroqr 9/wVYpBu+F8isVJ9GB6tguokMLj/0tTthj7+493aAF398obQCX2C7oYwCZfjBDRZrgMnZ2 s3Clwcozh6Sk1V/BHligg9pe3pc3XchH9pMjL3IHGWEeXwgPJUVrnbgDnIrnNVzUVdSpil Xldu6kdkVMd+CgZRjUMk7vwevWrI4v4UP7IdVqTzCF3o2MPDwHhZDkZMWwfJ6A== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4f4YQM0DVLzcBF for ; Mon, 02 Feb 2026 17:24:43 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1fce0 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 02 Feb 2026 17:24:43 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Jamie Gritton From: Zhenlei Huang Subject: git: 04911babef1b - stable/14 - netgraph: teach ngctl to attach and run itself in a jail List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: zlei X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 04911babef1b22cb4ff9cff08a34ec1e6bf80d45 Auto-Submitted: auto-generated Date: Mon, 02 Feb 2026 17:24:43 +0000 Message-Id: <6980dddb.1fce0.31933cf2@gitrepo.freebsd.org> The branch stable/14 has been updated by zlei: URL: https://cgit.FreeBSD.org/src/commit/?id=04911babef1b22cb4ff9cff08a34ec1e6bf80d45 commit 04911babef1b22cb4ff9cff08a34ec1e6bf80d45 Author: Jamie Gritton AuthorDate: 2025-08-29 23:02:14 +0000 Commit: Zhenlei Huang CommitDate: 2026-02-02 17:19:16 +0000 netgraph: teach ngctl to attach and run itself in a jail Add -j flag to ngctl to allow ngctl to attach and run inside a jail. This allow parent to manipulate netgraph nodes in the jail even if ngctl is not available. Submitted by: David Marker Reviewed by: kevans, zlei, jamie Relnotes: yes Differential Revision: https://reviews.freebsd.org/D50241 (cherry picked from commit 72d01e62b082de39ecf1ff3ced67dcf7259e5084) ngctl: Fix build without JAIL Reported by: Michael Dexter Fixes: 72d01e62b082 netgraph: teach ngctl to attach and run itself in a jail MFC after: 1 day (cherry picked from commit 685e60e860d61f6e1bcf981f5c30647e0c025702) (cherry picked from commit ab7858d90eba6d8b5829ad974da91ee30dcf92f4) --- usr.sbin/ngctl/Makefile | 5 +++++ usr.sbin/ngctl/main.c | 45 +++++++++++++++++++++++++++++++++++++++------ usr.sbin/ngctl/ngctl.8 | 25 +++++++++++++++++++++++-- 3 files changed, 67 insertions(+), 8 deletions(-) diff --git a/usr.sbin/ngctl/Makefile b/usr.sbin/ngctl/Makefile index 72a5ccaa96d7..997841272376 100644 --- a/usr.sbin/ngctl/Makefile +++ b/usr.sbin/ngctl/Makefile @@ -13,4 +13,9 @@ LIBADD= netgraph CFLAGS+= -DEDITLINE LIBADD+= edit pthread +.if ${MK_JAIL} != "no" +CFLAGS+= -DJAIL +LIBADD+= jail +.endif + .include diff --git a/usr.sbin/ngctl/main.c b/usr.sbin/ngctl/main.c index b9e88681d593..bdc6e0d10af0 100644 --- a/usr.sbin/ngctl/main.c +++ b/usr.sbin/ngctl/main.c @@ -56,6 +56,10 @@ #include #include #endif +#ifdef JAIL +#include +#include +#endif #include @@ -138,16 +142,19 @@ int csock, dsock; int main(int ac, char *av[]) { - char name[NG_NODESIZ]; - int interactive = isatty(0) && isatty(1); - FILE *fp = NULL; - int ch, rtn = 0; + char name[NG_NODESIZ]; + int interactive = isatty(0) && isatty(1); + FILE *fp = NULL; +#ifdef JAIL + const char *jail_name = NULL; +#endif + int ch, rtn = 0; /* Set default node name */ snprintf(name, sizeof(name), "ngctl%d", getpid()); /* Parse command line */ - while ((ch = getopt(ac, av, "df:n:")) != -1) { + while ((ch = getopt(ac, av, "df:j:n:")) != -1) { switch (ch) { case 'd': NgSetDebug(NgSetDebug(-1) + 1); @@ -158,6 +165,13 @@ main(int ac, char *av[]) else if ((fp = fopen(optarg, "r")) == NULL) err(EX_NOINPUT, "%s", optarg); break; + case 'j': +#ifdef JAIL + jail_name = optarg; +#else + errx(EX_UNAVAILABLE, "not built with jail support"); +#endif + break; case 'n': snprintf(name, sizeof(name), "%s", optarg); break; @@ -170,6 +184,24 @@ main(int ac, char *av[]) ac -= optind; av += optind; +#ifdef JAIL + if (jail_name != NULL) { + int jid; + + if (jail_name[0] == '\0') + Usage("invalid jail name"); + + jid = jail_getid(jail_name); + + if (jid == -1) + errx((errno == EPERM) ? EX_NOPERM : EX_NOHOST, + "%s", jail_errmsg); + if (jail_attach(jid) != 0) + errx((errno == EPERM) ? EX_NOPERM : EX_OSERR, + "cannot attach to jail"); + } +#endif + /* Create a new socket node */ if (NgMkSockNode(name, &csock, &dsock) < 0) err(EX_OSERR, "can't create node"); @@ -658,6 +690,7 @@ Usage(const char *msg) if (msg) warnx("%s", msg); fprintf(stderr, - "usage: ngctl [-d] [-f file] [-n name] [command ...]\n"); + "usage: ngctl [-j jail] [-d] [-f filename] [-n nodename] " + "[command [argument ...]]\n"); exit(EX_USAGE); } diff --git a/usr.sbin/ngctl/ngctl.8 b/usr.sbin/ngctl/ngctl.8 index 2225c836674a..63b8f58ed3df 100644 --- a/usr.sbin/ngctl/ngctl.8 +++ b/usr.sbin/ngctl/ngctl.8 @@ -31,7 +31,7 @@ .\" OF SUCH DAMAGE. .\" $Whistle: ngctl.8,v 1.6 1999/01/20 03:19:44 archie Exp $ .\" -.Dd January 19, 1999 +.Dd August 29, 2025 .Dt NGCTL 8 .Os .Sh NAME @@ -39,9 +39,11 @@ .Nd netgraph control utility .Sh SYNOPSIS .Nm +.Op Fl j Ar jail .Op Fl d .Op Fl f Ar filename .Op Fl n Ar nodename +.Op Ar command Op Ns Ar argument ... .Op Ar command ... .Sh DESCRIPTION The @@ -73,12 +75,31 @@ form if the originating node supports conversion. .Pp The options are as follows: .Bl -tag -width indent -.It Fl f Ar nodeinfo +.It Fl f Ar filename Read commands from the named file. A single dash represents the standard input. Blank lines and lines starting with a .Dq # are ignored. +Note that when the +.Fl j Ar jail +option is specified, the file will be opened before attaching to the jail and +then be processed inside the jail. +.It Fl j Ar jail +Perform the actions inside the +.Ar jail . +.Pp +.Nm +will first attach to the +.Ar jail +(by jail id or jail name) before performing the effects. +.Pp +This allows netgraph nodes of +.Ar jail +to be created, modified, and destroyed even if the +.Nm +binary is not available in +.Ar jail . .It Fl n Ar nodename Assign .Em nodename