Index: etc/defaults/rc.conf =================================================================== RCS file: /home/ncvs/src/etc/defaults/rc.conf,v retrieving revision 1.182 diff -u -r1.182 rc.conf --- etc/defaults/rc.conf 28 Jul 2003 13:09:00 -0000 1.182 +++ etc/defaults/rc.conf 1 Aug 2003 23:28:22 -0000 @@ -426,12 +426,35 @@ harvest_ethernet="YES" # Entropy device harvests ethernet randomness harvest_p_to_p="YES" # Entropy device harvests point-to-point randomness dmesg_enable="YES" # Save dmesg(8) to /var/run/dmesg.boot -jail_enable="NO" # Set to NO to disable starting of any jails -jail_list="" # Space separated list of names of jails -jail_set_hostname_allow="YES" # Allow root user in a jail to change its hostname -jail_socket_unixiproute_only="YES" # Route only TCP/IP within a jail -jail_sysvipc_allow="NO" # Allow SystemV IPC use from within a jail watchdogd_enable="NO" # Start the software watchdog daemon +devfs_ruleset_hide="1" # The number of the default hide ruleset (rc.subr(8)) +devfs_ruleset_basic="2" # The number of the default basic ruleset (rc.subr(8)) +devfs_ruleset_login="3" # The number of the default login ruleset (rc.subr(8)) +devfs_ruleset_jail="123" # The number of the default jail ruleset (rc.subr(8)) + +############################################################## +### Jail Configuration ####################################### +############################################################## +jail_enable="NO" # Set to NO to disable starting of any jails +jail_list="" # Space separated list of names of jails +jail_set_hostname_allow="YES" # Allow the root user in a jail to change its + # hostname +jail_socket_unixiproute_only="YES" # Route only TCP/IP within a jail +jail_sysvipc_allow="NO" # Allow SystemV IPC use from within a jail +jail_stop_jailer="NO" # Only stop jailer. Requires jail_*_exec be set + # to use sysutils/jailer port to start the jail. + +# +# To use rc's built-in jail infrastructure create entries for +# each jail, specified in jail_list, with the following variables. +# NOTE: replace 'example' with the jail's name. +# +#jail_example_rootdir="/usr/jail/default" # Jail's root directory +#jail_example_hostname="default.domain.com" # Jail's hostname +#jail_example_ip="192.168.0.10" # Jail's IP number +#jail_example_exec="/bin/sh /etc/rc" # command to execute in jail +#jail_example_devfs_enable="NO" # mount devfs in the jail +#jail_example_procfs_enable="NO" # mount procfs in jail ############################################################## ### Define source_rc_confs, the mechanism used by /etc/rc.* ## Index: etc/rc.d/jail =================================================================== RCS file: /home/ncvs/src/etc/rc.d/jail,v retrieving revision 1.4 diff -u -r1.4 jail --- etc/rc.d/jail 5 May 2003 15:38:41 -0000 1.4 +++ etc/rc.d/jail 1 Aug 2003 23:11:36 -0000 @@ -6,7 +6,7 @@ # PROVIDE: jail # REQUIRE: LOGIN # BEFORE: securelevel -# KEYWORD: FreeBSD +# KEYWORD: FreeBSD shutdown . /etc/rc.subr @@ -50,18 +50,77 @@ for _jail in ${jail_list} do eval jail_rootdir=\"\$jail_${_jail}_rootdir\" + jail_devdir="${jail_rootdir}/dev" + jail_procdir="${jail_rootdir}/proc" + eval jail_hostname=\"\$jail_${_jail}_hostname\" eval jail_ip=\"\$jail_${_jail}_ip\" eval jail_exec=\"\$jail_${_jail}_exec\" [ -z ${jail_exec} ] && jail_exec="/bin/sh /etc/rc" - + + eval jail_devfs=\"\$jail_${_jail}_devfs_enable\" + [ -z ${jail_devfs} ] && jail_devfs="NO" + + eval jail_procfs=\"\$jail_${_jail}_procfs_enable\" + [ -z ${jail_procfs} ] && jail_procfs="NO" + + if checkyesno jail_devfs; then + info "Mounting devfs on ${jail_devdir}" + devfs_mount_jail "${jail_devdir}" + + # Transitional symlink for old binaries + if [ ! -L ${jail_devdir}/log ]; then + devfs_link ${jail_devdir} ../var/run/log log + fi + + # Jail console output + devfs_link ${jail_devdir} ../var/log/console console + fi + + if checkyesno jail_procfs; then + info "Mounting procfs onto ${jail_procdir}" + if [ -d ${jail_procdir} ] ; then + mount -t procfs proc ${jail_procdir} + fi + fi + jail ${jail_rootdir} ${jail_hostname} ${jail_ip} ${jail_exec} done } jail_stop() { - kill -TERM $(ps aux | awk '$8 ~ /.*J/ {print $2};') + if checkyesno jail_stop_jailer; then + rc_pid=$(ps aux | grep "jailer" | awk '$8 ~ /.*J/ {print $2};') + else + rc_pid=$(ps aux | awk '$8 ~ /.*J/ {print $2};') + fi + if [ -n "${rc_pid}" ]; then + kill -TERM $rc_pid + wait_for_pids $rc_pid + fi + for _jail in ${jail_list} + do + eval jail_rootdir=\"\$jail_${_jail}_rootdir\" + jail_devdir="${jail_rootdir}/dev" + jail_procdir="${jail_rootdir}/proc" + eval jail_devfs=\"\$jail_${_jail}_devfs_enable\" + [ -z ${jail_devfs} ] && jail_devfs="NO" + eval jail_procfs=\"\$jail_${_jail}_procfs_enable\" + [ -z ${jail_procfs} ] && jail_procfs="NO" + + if checkyesno jail_devfs; then + if [ -d ${jail_devdir} ] ; then + umount -f ${jail_devdir} >/dev/null 2>&1 + fi + fi + + if checkyesno jail_procfs; then + if [ -d ${jail_procdir} ] ; then + umount -f ${jail_procdir} >/dev/null 2>&1 + fi + fi + done }