Date: Tue, 29 Jul 2003 16:51:54 -0500 From: "Scot W. Hetzel" <hetzels@westbend.net> To: "Mike Makonnen" <mtm@identd.net>, "Jens Rehsack" <rehsack@liwing.de> Cc: FreeBSD-Current List <current@freebsd.org> Subject: Re: [PATCH] jail NG schript patch for mounting devfs and procfsautomatically Message-ID: <200307292316.h6TNGBJx045796@WBIw009.westbend.net> References: <Pine.NEB.3.96L.1030729124628.75304H-100000@fledge.watson.org><3F26AA16.5030007@liwing.de> <20030729172122.GA5005@kokeb.ambesa.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Below is my current patch to devfs and jail to support the mounting of devfs
and procfs in jails. This patch also allows a jail to specify what devfs
rule to apply to the jail. As well as defining a default jail devfs rule
in /etc/rc.d/devfs.
Scot
Index: etc/defaults/rc.conf
===================================================================
RCS file: /home/ncvs/src/etc/defaults/rc.conf,v
retrieving revision 1.182
diff -u -r1.182 rc.conf
--- etc/defaults/rc.conf 28 Jul 2003 13:09:00 -0000 1.182
+++ etc/defaults/rc.conf 29 Jul 2003 22:06:08 -0000
@@ -426,12 +426,35 @@
harvest_ethernet="YES" # Entropy device harvests ethernet randomness
harvest_p_to_p="YES" # Entropy device harvests point-to-point randomness
dmesg_enable="YES" # Save dmesg(8) to /var/run/dmesg.boot
-jail_enable="NO" # Set to NO to disable starting of any jails
-jail_list="" # Space separated list of names of jails
-jail_set_hostname_allow="YES" # Allow root user in a jail to change its hostname
-jail_socket_unixiproute_only="YES" # Route only TCP/IP within a jail
-jail_sysvipc_allow="NO" # Allow SystemV IPC use from within a jail
watchdogd_enable="NO" # Start the software watchdog daemon
+
+##############################################################
+### Jail Configuration #######################################
+##############################################################
+devfs_jail_ruleset_enable="NO" # Enable Standard Jail devfs ruleset in rc.d/devfs
+devfs_jail_ruleset_num="666" # Standard Jail ruleset number
+ # (change if it conflicts with your rulesets)
+
+jail_enable="NO" # Set to NO to disable starting of any jails
+jail_list="" # Space separated list of names of jails
+jail_set_hostname_allow="YES" # Allow root user in a jail to change its hostname
+jail_socket_unixiproute_only="YES" # Route only TCP/IP within a jail
+jail_sysvipc_allow="NO" # Allow SystemV IPC use from within a jail
+jail_default_ruleset="666" # Default jail devfs ruleset to apply
+jail_stop_jailer="NO" # Only stop jailer. Requires jail_*_exec be set
+ # to use sysutils/jailer port to start the jail.
+
+# create an entry for each jail named in jail_list, with these variables
+#
+#jail_example_rootdir="/usr/jail/default" # Jails root directory
+#jail_example_hostname="default.domain.com" # Jails hostname
+#jail_example_ip="192.168.0.10" # Jails IP number
+#jail_example_exec="/bin/sh /etc/rc" # command to execute in jail
+#jail_example_devfs="NO" # mount devfs in jail
+#jail_example_devfs_ruleset="666" # devfs ruleset to apply to jail
+#jail_example_procfs="NO" # mount procfs in jail
+#
+# NOTE: replace 'example' with the jail's name from jail_list
##############################################################
### Define source_rc_confs, the mechanism used by /etc/rc.* ##
Index: etc/rc.d/devfs
===================================================================
RCS file: /home/ncvs/src/etc/rc.d/devfs,v
retrieving revision 1.5
diff -u -r1.5 devfs
--- etc/rc.d/devfs 6 May 2003 01:10:33 -0000 1.5
+++ etc/rc.d/devfs 6 May 2003 16:24:39 -0000
@@ -39,3 +39,21 @@
load_rc_config $name
run_rc_command "$1"
+
+# Standard Jail ruleset
+if checkyesno devfs_jail_ruleset_enable ; then
+ /sbin/devfs rule -s ${devfs_jail_ruleset_num} delset
+ /sbin/devfs rule -s ${devfs_jail_ruleset_num} add 100 hide
+ /sbin/devfs rule -s ${devfs_jail_ruleset_num} add 200 path ptyp* unhide
+ /sbin/devfs rule -s ${devfs_jail_ruleset_num} add 300 path ttyp* unhide
+ /sbin/devfs rule -s ${devfs_jail_ruleset_num} add 400 path null unhide
+ /sbin/devfs rule -s ${devfs_jail_ruleset_num} add 500 path zero unhide
+ /sbin/devfs rule -s ${devfs_jail_ruleset_num} add 600 path random unhide
+ /sbin/devfs rule -s ${devfs_jail_ruleset_num} add 610 path urandom unhide
+ /sbin/devfs rule -s ${devfs_jail_ruleset_num} add 700 path fd unhide
+ /sbin/devfs rule -s ${devfs_jail_ruleset_num} add 800 path fd/* unhide
+ /sbin/devfs rule -s ${devfs_jail_ruleset_num} add 810 path mdctl unhide
+ /sbin/devfs rule -s ${devfs_jail_ruleset_num} add 900 path stdin unhide
+ /sbin/devfs rule -s ${devfs_jail_ruleset_num} add 910 path stdout unhide
+ /sbin/devfs rule -s ${devfs_jail_ruleset_num} add 920 path stderr unhide
+fi
Index: etc/rc.d/jail
===================================================================
RCS file: /home/ncvs/src/etc/rc.d/jail,v
retrieving revision 1.4
diff -u -r1.4 jail
--- etc/rc.d/jail 5 May 2003 15:38:41 -0000 1.4
+++ etc/rc.d/jail 21 Jun 2003 20:22:44 -0000
@@ -6,7 +6,7 @@
# PROVIDE: jail
# REQUIRE: LOGIN
# BEFORE: securelevel
-# KEYWORD: FreeBSD
+# KEYWORD: FreeBSD shutdown
. /etc/rc.subr
@@ -15,6 +15,15 @@
start_cmd="jail_start"
stop_cmd="jail_stop"
+create_dev_links()
+{
+ local devdir=$1
+ local source=$2
+ local target=$3
+
+ (cd ${devdir} && ln -sf ${source} ${target})
+}
+
jail_start()
{
echo -n 'Configuring jails:'
@@ -50,18 +59,91 @@
for _jail in ${jail_list}
do
eval jail_rootdir=\"\$jail_${_jail}_rootdir\"
+ jail_devdir="${jail_rootdir}/dev"
+ jail_procdir="${jail_rootdir}/proc"
+
eval jail_hostname=\"\$jail_${_jail}_hostname\"
eval jail_ip=\"\$jail_${_jail}_ip\"
eval jail_exec=\"\$jail_${_jail}_exec\"
[ -z ${jail_exec} ] && jail_exec="/bin/sh /etc/rc"
-
+
+ eval jail_devfs=\"\$jail_${_jail}_devfs\"
+ [ -z ${jail_devfs} ] && jail_devfs="NO"
+
+ eval jail_ruleset=\"\$jail_${_jail}_devfs_ruleset\"
+ [ -z ${jail_ruleset} ] && jail_ruleset="${jail_default_ruleset}"
+
+ eval jail_procfs=\"\$jail_${_jail}_procfs\"
+ [ -z ${jail_procfs} ] && jail_procfs="NO"
+
+ if checkyesno jail_devfs; then
+ if [ -d ${jail_devdir} ] ; then
+ mount -t devfs dev ${jail_devdir}
+
+ if [ -n "${jail_ruleset}" ]; then
+ # Apply devfs ruleset
+ devfs -m ${jail_devdir} ruleset ${jail_ruleset}
+
+ # for libkvm (ab)users
+ create_dev_links ${jail_devdir} null mem
+ create_dev_links ${jail_devdir} null kmem
+
+ # create_dev_links ${jail_devdir} null console
+ fi
+
+ # Transitional symlink for old binaries
+ if [ ! -L ${jail_devdir}/log ]; then
+ create_dev_links ${jail_devdir} ../var/run/log log
+ fi
+
+ # Jail console output
+ create_dev_links ${jail_devdir} ../var/log/console console
+ fi
+ fi
+
+ if checkyesno jail_procfs; then
+ if [ -d ${jail_procdir} ] ; then
+ mount -t procfs proc ${jail_procdir}
+ fi
+ fi
+
jail ${jail_rootdir} ${jail_hostname} ${jail_ip} ${jail_exec}
done
}
jail_stop()
{
- kill -TERM $(ps aux | awk '$8 ~ /.*J/ {print $2};')
+ if checkyesno jail_stop_jailer; then
+ rc_pid=$(ps aux | grep "jailer" | awk '$8 ~ /.*J/ {print $2};')
+ else
+ rc_pid=$(ps aux | awk '$8 ~ /.*J/ {print $2};')
+ fi
+ if [ -n "${rc_pid}" ]; then
+ kill -TERM $rc_pid
+ wait_for_pids $rc_pid
+ fi
+ for _jail in ${jail_list}
+ do
+ eval jail_rootdir=\"\$jail_${_jail}_rootdir\"
+ jail_devdir="${jail_rootdir}/dev"
+ jail_procdir="${jail_rootdir}/proc"
+ eval jail_devfs=\"\$jail_${_jail}_devfs\"
+ [ -z ${jail_devfs} ] && jail_devfs="NO"
+ eval jail_procfs=\"\$jail_${_jail}_procfs\"
+ [ -z ${jail_procfs} ] && jail_procfs="NO"
+
+ if checkyesno jail_devfs; then
+ if [ -d ${jail_devdir} ] ; then
+ umount -f ${jail_devdir} >/dev/null 2>&1
+ fi
+ fi
+
+ if checkyesno jail_procfs; then
+ if [ -d ${jail_procdir} ] ; then
+ umount -f ${jail_procdir} >/dev/null 2>&1
+ fi
+ fi
+ done
}
Index: share/man/man5/rc.conf.5
===================================================================
RCS file: /home/ncvs/src/share/man/man5/rc.conf.5,v
retrieving revision 1.197
diff -u -r1.197 rc.conf.5
--- share/man/man5/rc.conf.5 28 Jul 2003 13:56:00 -0000 1.197
+++ share/man/man5/rc.conf.5 29 Jul 2003 22:12:05 -0000
@@ -2431,12 +2431,25 @@
jail_vjail_ip="192.168.1.100"
jail_vjail_rootdir="/var/jails/vjail/root"
jail_vjail_exec="/bin/sh /etc/rc"
+jail_vjail_devfs="YES"
+jail_vjail_devfs_ruleset="666"
+jail_vjail_procfs="NO"
.Ed
.Pp
-The last one is optional.
-It defaults to
+The last four are optional. jail_<jailname>_exec defaults to
.Pa /etc/rc
if it is not set.
+jail_<jailname>_devfs and jail_<jailname>_procfs default to
+not mounting the devfs/procfs on the jail.
+jail_<jailname>_devfs_ruleset defaults to using devfs ruleset 666.
+.It Va jail_default_ruleset
+.Pq Vt int
+The default ruleset to apply to a jail that has devfs enabled, but
+no jail_<jailname>_devfs_ruleset defined. By default it is set to
+666. A Standard Jail rule set is provided in rc.d/devfs to enable
+it set devfs_jail_ruleset_enable to YES. If this ruleset conflicts
+with your rulesets change devfs_jail_ruleset_num from 666 to another
+value.
.It Va jail_set_hostname_allow
.Pq Vt bool
If set to
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200307292316.h6TNGBJx045796>