Date: Sat, 03 Jul 2010 10:10:13 +0200 From: Harald Schmalzbauer <h.schmalzbauer@omnilan.de> To: freebsd-stable <freebsd-stable@freebsd.org> Subject: Re: selective jail restriction controlling in rc.conf Message-ID: <4C2EF065.2020208@omnilan.de> In-Reply-To: <4C2EEF3E.2010008@omnilan.de> References: <4C2EEF3E.2010008@omnilan.de>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig8E59990CE9C8552FBBC6ACE4
Content-Type: multipart/mixed; boundary="------------010100070009070004040306"
This is a multi-part message in MIME format.
--------------010100070009070004040306
Content-Type: text/plain; charset=ISO-8859-15; format=flowed
Content-Transfer-Encoding: quoted-printable
Harald Schmalzbauer schrieb am 03.07.2010 10:05 (localtime):
=2E..
> One have to seperatly define ip4 and ip6 addresses. The can be with or =
> without mask, single oder comma seperated list, doesn't matter, thanks =
> to the jail_handle_ips_option() coder, it just works :)
I forgot to change that in defults/rc.conf.
Please find attached the corrected version.
-Harry
--------------010100070009070004040306
Content-Type: text/plain;
name="jail-allow-selectables.patch"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline;
filename="jail-allow-selectables.patch"
--- src/etc/defaults/rc.conf 2010-06-28 19:22:08.000000000 +0200
+++ src/etc/defaults/rc.conf 2010-07-03 10:08:31.000000000 +0200
@@ -642,8 +642,13 @@
jail_enable=3D"NO" # Set to NO to disable starting of any jails
jail_list=3D"" # Space separated list of names of jails
jail_set_hostname_allow=3D"YES" # Allow root user in a jail to change it=
s hostname
-jail_socket_unixiproute_only=3D"YES" # Route only TCP/IP within a jail
jail_sysvipc_allow=3D"NO" # Allow SystemV IPC use from within a jail
+jail_socket_unixiproute_only=3D"YES" # Route only TCP/IP within a jail
+jail_raw_sockets_allow=3D"NO" # Prison root can create raw sockets
+jail_chflags_allow=3D"NO" # Processes in jail can alter system file flag=
s
+jail_mount_allow=3D"NO" # Processes in jail can mount/unmount jail-frien=
dly file systems
+jail_quotas_allow=3D"NO" # The prison root may administer quotas on the =
jail's filesystem(s)
+socket_af_allow=3D"NO" # Sockets within a jail are normally restricted t=
o IPv4, IPv6, local (UNIX), and route.
=20
#
# To use rc's built-in jail infrastructure create entries for
@@ -658,8 +663,8 @@
#jail_example_hostname=3D"default.domain.com" # Jail's hostname
#jail_example_interface=3D"" # Jail's interface variable to create IP =
aliases on
#jail_example_fib=3D"0" # Routing table for setfib(1)
-#jail_example_ip=3D"192.0.2.10,2001:db8::17" # Jail's primary IPv4 and I=
Pv6 address
-#jail_example_ip_multi0=3D"2001:db8::10" # and another IPv6 address
+#jail_example_ip4=3D"192.0.2.10/24,10.1.2.3" # Jail's IPv4 address(es)
+#jail_example_ip6=3D"2001:db8::10,fec0::0:1:2:3" # Jail's IPv6 address(=
es)
#jail_example_exec_start=3D"/bin/sh /etc/rc" # command to execute in ja=
il for starting
#jail_example_exec_afterstart0=3D"/bin/sh command" # command to execute =
after the one for
# starting the jail. More than one can be
@@ -672,6 +677,14 @@
#jail_example_procfs_enable=3D"NO" # mount procfs in jail
#jail_example_mount_enable=3D"NO" # mount/umount jail's fs
#jail_example_fstab=3D"" # fstab(5) for mount/umount
+#jail_example_allow_set_hostname=3D"NO" # This jail can set hostname
+#jail_example_allow_sysvipc=3D"NO" # This jail can use SystemV IPC
+#jail_example_allow_raw_sockets=3D"NO" # This jail can create raw socke=
ts (ping)
+#jail_example_allow_chflags=3D"NO" # This jail can alter it's filesyste=
m flags
+#jail_example_allow_mount=3D"NO" # This jail can mount jail friendly f=
ilesystems
+#jail_example_allow_quotas=3D"NO" # This jail can modify quotas on it'=
s filesystems
+#jail_example_allow_socket_af=3D"NO" # This jail can use other protocol=
stacks than IP4, IP6 and local
+
#jail_example_flags=3D"-l -U root" # flags for jail(8)
=20
##############################################################
--- src/etc/rc.d/jail 2010-06-28 19:22:11.000000000 +0200
+++ src/etc/rc.d/jail 2010-07-03 10:02:34.000000000 +0200
@@ -21,6 +21,8 @@
start_cmd=3D"jail_start"
stop_cmd=3D"jail_stop"
=20
+jail_restrictions=3D"set_hostname sysvipc raw_sockets chflags mount quot=
as socket_af"
+
# init_variables _j
# Initialize the various jail variables for jail _j.
#
@@ -38,7 +40,8 @@
_fdescdir=3D"${_devdir}/fd"
_procdir=3D"${_rootdir}/proc"
eval _hostname=3D\"\$jail_${_j}_hostname\"
- eval _ip=3D\"\$jail_${_j}_ip\"
+ eval _ip4=3D\"\$jail_${_j}_ip4\"
+ eval _ip6=3D\"\$jail_${_j}_ip6\"
eval _interface=3D\"\${jail_${_j}_interface:-${jail_interface}}\"
eval _exec=3D\"\$jail_${_j}_exec\"
=20
@@ -122,8 +125,9 @@
debug "$_j procfs enable: $_procfs"
debug "$_j mount enable: $_mount"
debug "$_j hostname: $_hostname"
- debug "$_j ip: $_ip"
- jail_show_addresses ${_j}
+ debug "$_j ip4: $_ip4"
+ debug "$_j ip6: $_ip6"
+# jail_show_addresses ${_j}
debug "$_j interface: $_interface"
debug "$_j fib: $_fib"
debug "$_j root: $_rootdir"
@@ -347,27 +351,27 @@
# Debug print the input for the given _multi aliases
# for a jail for init_variables().
#
-jail_show_addresses()
-{
- local _j _type alias
- _j=3D"$1"
- alias=3D0
-
- if [ -z "${_j}" ]; then
- warn "jail_show_addresses: you must specify a jail"
- return
- fi
-
- while : ; do
- eval _addr=3D\"\$jail_${_j}_ip_multi${alias}\"
- if [ -n "${_addr}" ]; then
- debug "${_j} ip_multi${alias}: $_addr"
- alias=3D$((${alias} + 1))
- else
- break
- fi
- done
-}
+#jail_show_addresses()
+#{
+# local _j _type alias
+# _j=3D"$1"
+# alias=3D0
+#
+# if [ -z "${_j}" ]; then
+# warn "jail_show_addresses: you must specify a jail"
+# return
+# fi
+#
+# while : ; do
+# eval _addr=3D\"\$jail_${_j}_ip_multi${alias}\"
+# if [ -n "${_addr}" ]; then
+# debug "${_j} ip_multi${alias}: $_addr"
+# alias=3D$((${alias} + 1))
+# else
+# break
+# fi
+# done
+#}
=20
# jail_extract_address argument
# The second argument is the string from one of the _ip
@@ -481,20 +485,26 @@
*) ;;
esac
=20
- # Append address to list of addresses for the jail command.
- case "${_addrl}" in
- "") _addrl=3D"${_addr}" ;;
- *) _addrl=3D"${_addrl},${_addr}" ;;
- esac
-
# Configure interface alias if requested by a given interface
# and if we could correctly parse everything.
case "${_iface}" in
"") continue ;;
esac
case "${_type}" in
- inet) ;;
- inet6) ;;
+ inet) {=09
+ # Append address to list of addresses for the jail command.
+ case "${_addrl4}" in
+ "") _addrl4=3D"${_addr}" ;;
+ *) _addrl4=3D"${_addrl4},${_addr}" ;;
+ esac
+ };;
+ inet6) {
+ # Append address to list of addresses for the jail command.
+ case "${_addrl6}" in
+ "") _addrl6=3D"${_addr}" ;;
+ *) _addrl6=3D"${_addrl6},${_addr}" ;;
+ esac
+ };;
*) warn "Could not determine address family. Not going" \
"to ${_action} address '${_addr}' for ${_jail}."
continue
@@ -531,18 +541,18 @@
esac
=20
# Handle addresses.
- jail_handle_ips_option ${_action} "${_ip}"
+ jail_handle_ips_option ${_action} "${_ip4},${_ip6}"
# Handle jail_xxx_ip_multi<N>
- alias=3D0
- while : ; do
- eval _x=3D\"\$jail_${_jail}_ip_multi${alias}\"
- case "${_x}" in
- "") break ;;
- *) jail_handle_ips_option ${_action} "${_x}"
- alias=3D$((${alias} + 1))
- ;;
- esac
- done
+# alias=3D0
+# while : ; do
+# eval _x=3D\"\$jail_${_jail}_ip4_multi${alias}\"
+# case "${_x}" in
+# "") break ;;
+# *) jail_handle_ips_option ${_action} "${_x}"
+# alias=3D$((${alias} + 1))
+# ;;
+# esac
+# done
}
=20
jail_start()
@@ -566,7 +576,8 @@
echo -n " [${_hostname} already running (/var/run/jail_${_jail}.id ex=
ists)]"
continue;
fi
- _addrl=3D""
+ _addrl4=3D""
+ _addrl6=3D""
jail_ips "add"
if [ -n "${_fib}" ]; then
_setfib=3D"setfib -F '${_fib}'"
@@ -625,6 +636,15 @@
fi
fi
fi
+ _j_allow_parms=3D""
+ for relax in ${jail_restrictions}; do
+ eval _param_allow=3D\"\${jail_${_jail}_allow_${relax}:-\${jail_allow_=
$relax}}\"
+ [ -z "${_param_allow}" ] && _param_allow=3D"NO"
+ checkyesno _param_allow && \
+ _j_allow_parms=3D"${_j_allow_parms}allow.${relax}=3D1 "=20
+ debug "$_jail _allow_${relax}: $_param_allow"
+ done
+ debug "$_jail selectiv relaxation: $_j_allow_parms"
_tmp_jail=3D${_tmp_dir}/jail.$$
=20
i=3D0
@@ -634,9 +654,10 @@
${out}
i=3D$((i + 1))
done
-
- eval ${_setfib} jail ${_flags} -i ${_rootdir} ${_hostname} \
- \"${_addrl}\" ${_exec_start} > ${_tmp_jail} 2>&1
+ =09
+ eval ${_setfib} jail ${_flags} -i -c name=3D${_jail}\
+ path=3D${_rootdir} host.hostname=3D${_hostname} \
+ ip4.addr=3D${_addrl4} ip6.addr=3D${_addrl6} ${_j_allow_parms} command=
=3D${_exec_start} > ${_tmp_jail} 2>&1
=20
if [ "$?" -eq 0 ] ; then
_jail_id=3D$(head -1 ${_tmp_jail})
--------------010100070009070004040306--
--------------enig8E59990CE9C8552FBBC6ACE4
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.13 (FreeBSD)
iEYEARECAAYFAkwu8GUACgkQLDqVQ9VXb8jVQQCgnncGnjHvT7MnbZ5iis4QrX8G
YKQAn0NxIVxGAldo9jwgulIK0WiHXPT2
=dig7
-----END PGP SIGNATURE-----
--------------enig8E59990CE9C8552FBBC6ACE4--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4C2EF065.2020208>