Attached are patches for the new rc.d/jail script. I moved the jail variables out of the "Miscellaneous administrative options" section and placed them into their own section ("Jail Configuration") in /etc/defaults/rc.conf. I also added definitions for the jail_*_[rootdir,hostname,ip,exec] variables found in /etc/rc.d/jail. I also made a change to rc.d/jail. I added the ability to mount the devfs and procfs on the jail, and to apply a devfs ruleset to the jails dev directory (see the jail_*_[devfs,devfs_ruleset,procfs] variables). Currently rc.d/devfs starts after rc.d/jail, we need devfs rulesets defined before the jail is started (devfs added to rc.d/jail REQUIRE). Added a standard jail ruleset to rc.d/devfs. Scot Index: defaults/rc.conf =================================================================== RCS file: /home/ncvs/src/etc/defaults/rc.conf,v retrieving revision 1.172 diff -u -r1.172 rc.conf --- defaults/rc.conf 16 Apr 2003 16:29:51 -0000 1.172 +++ defaults/rc.conf 20 Apr 2003 00:07:06 -0000 _at__at_ -426,11 +426,28 _at__at_ harvest_ethernet="YES" # Entropy device harvests ethernet randomness harvest_p_to_p="YES" # Entropy device harvests point-to-point randomness dmesg_enable="YES" # Save dmesg(8) to /var/run/dmesg.boot + +############################################################## +### Jail Configuration ####################################### +############################################################## + jail_enable="NO" # Set to NO to disable starting of any jails jail_list="" # Space separated list of names of jails jail_set_hostname_allow="YES" # Allow root user in a jail to change its hostname jail_socket_unixiproute_only="YES" # Route only TCP/IP within a jail -jail_sysvipc_allow="NO" # Allow SystemV IPC use from within a jail +jail_sysvipc_allow="NO" # Allow SystemV IPC use from within a jail +jail_default_rulset="10" # Default jail devfs ruleset to apply + +# create an entry for each jail named in jail_list, with these variables +# NOTE: replace 'example' with the jail's name from jail_list +# +jail_example_rootdir="/usr/jail/default" # Jails root directory +jail_example_hostname="default.domain.com" # Jails hostname +jail_example_ip="192.168.0.10" # Jails IP number +jail_example_exec="/bin/sh /etc/rc" # command to execute in jail +jail_example_devfs="NO" # mount devfs in jail +jail_example_devfs_rulset="10" # devfs ruleset to apply to jail +jail_example_procfs="NO" # mount procfs in jail ############################################################## ### Define source_rc_confs, the mechanism used by /etc/rc.* ## Index: rc.d/devfs =================================================================== RCS file: /home/ncvs/src/etc/rc.d/devfs,v retrieving revision 1.2 diff -u -r1.2 devfs --- rc.d/devfs 15 Dec 2002 21:56:53 -0000 1.2 +++ rc.d/devfs 20 Apr 2003 00:10:02 -0000 _at__at_ -13,6 +13,22 _at__at_ load_rc_config $name +# Standard Jail ruleset +/sbin/devfs rule -s 10 delset +/sbin/devfs rule -s 10 add 100 hide +/sbin/devfs rule -s 10 add 200 path ptyp* unhide +/sbin/devfs rule -s 10 add 300 path ttyp* unhide +/sbin/devfs rule -s 10 add 400 path null unhide +/sbin/devfs rule -s 10 add 500 path zero unhide +/sbin/devfs rule -s 10 add 600 path random unhide +/sbin/devfs rule -s 10 add 610 path urandom unhide +/sbin/devfs rule -s 10 add 700 path fd unhide +/sbin/devfs rule -s 10 add 800 path fd/* unhide +/sbin/devfs rule -s 10 add 810 path mdctl unhide +/sbin/devfs rule -s 10 add 900 path stdin unhide +/sbin/devfs rule -s 10 add 910 path stdout unhide +/sbin/devfs rule -s 10 add 920 path stderr unhide + # Setup DEVFS, ie permissions, links etc. # if [ -r /etc/rc.devfs ]; then Index: rc.d/jail =================================================================== RCS file: /home/ncvs/src/etc/rc.d/jail,v retrieving revision 1.3 diff -u -r1.3 jail --- rc.d/jail 19 Apr 2003 07:50:32 -0000 1.3 +++ rc.d/jail 20 Apr 2003 00:26:51 -0000 _at__at_ -4,8 +4,8 _at__at_ # # PROVIDE: jail -# REQUIRE: LOGIN -# KEYWORD: FreeBSD +# REQUIRE: LOGIN devfs +# KEYWORD: FreeBSD shutdown . /etc/rc.subr _at__at_ -14,6 +14,15 _at__at_ start_cmd="jail_start" stop_cmd="jail_stop" +create_dev_links() +{ + local devdir=$1 + local source=$2 + local target=$3 + + (cd ${devdir} && ln -sf ${source} ${target}) +} + jail_start() { echo -n 'Configuring jails:' _at__at_ -49,11 +58,54 _at__at_ for _jail in ${jail_list} do eval jail_rootdir=\"\$jail_${_jail}_rootdir\" + jail_devdir="${jail_rootdir}/dev" + jail_procdir="${jail_rootdir}/proc" + eval jail_hostname=\"\$jail_${_jail}_hostname\" eval jail_ip=\"\$jail_${_jail}_ip\" eval jail_exec=\"\$jail_${_jail}_exec\" [ -z ${jail_exec} ] && jail_exec="/bin/sh /etc/rc" - + + eval jail_devfs=\"\$jail_${_jail}_devfs\" + [ -z ${jail_devfs} ] && jail_devfs="NO" + + eval jail_rulset=\"\$jail_${_jail}_devfs_ruleset\" + [ -z ${jail_rulset} ] && jail_rulset="${jail_default_rulset}" + + eval jail_procfs=\"\$jail_${_jail}_procfs\" + [ -z ${jail_procfs} ] && jail_procfs="NO" + + if checkyesno jail_devfs; then + if [ -d ${jail_devdir} ] ; then + mount -t devfs dev ${jail_devdir} + + if [ -n "${jail_rulset}" ]; then + # Apply devfs rulset + devfs -m ${jail_devdir} ruleset ${jail_rulset} + + # for libkvm (ab)users + create_dev_links ${jail_devdir} null mem + create_dev_links ${jail_devdir} null kmem + + # create_dev_links ${jail_devdir} null console + fi + + # Transitional symlink for old binaries + if [ ! -L ${jail_devdir}/log ]; then + create_dev_links ${jail_devdir} ../var/run/log log + fi + + # Jail console output + create_dev_links ${jail_devdir} ../var/log/console console + fi + fi + + if checkyesno jail_procfs; then + if [ -d ${jail_procdir} ] ; then + mount -t procfs proc ${jail_procdir} + fi + fi + jail ${jail_rootdir} ${jail_hostname} ${jail_ip} ${jail_exec} done } _at__at_ -61,6 +113,28 _at__at_ jail_stop() { kill -TERM $(ps aux | awk '$8 ~ /.*J/ {print $2};') + for _jail in ${jail_list} + do + eval jail_rootdir=\"\$jail_${_jail}_rootdir\" + jail_devdir="${jail_rootdir}/dev" + jail_procdir="${jail_rootdir}/proc" + eval jail_devfs=\"\$jail_${_jail}_devfs\" + [ -z ${jail_devfs} ] && jail_devfs="NO" + eval jail_procfs=\"\$jail_${_jail}_procfs\" + [ -z ${jail_procfs} ] && jail_procfs="NO" + + if checkyesno jail_devfs; then + if [ -d ${jail_devdir} ] ; then + umount -f ${jail_devdir} >/dev/null 2>&1 + fi + fi + + if checkyesno jail_procfs; then + if [ -d ${jail_procdir} ] ; then + umount -f ${jail_procdir} >/dev/null 2>&1 + fi + fi + done }Received on Sat Apr 19 2003 - 15:55:22 UTC
This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:37:04 UTC