freebsd-dev/etc/rc.d/jail

#!/bin/sh
#
# $FreeBSD$
#

# PROVIDE: jail
# REQUIRE: LOGIN
# BEFORE: securelevel
# KEYWORD: FreeBSD shutdown

. /etc/rc.subr

name="jail"
rcvar=`set_rcvar`
start_cmd="jail_start"
stop_cmd="jail_stop"

# init_variables _j
#	Initialize the various jail variables for jail _j.
#
init_variables()
{
	_j="$1"

	if [ -z "$_j" ]; then
		warn "init_variables: you must specify a jail"
		return
	fi

	eval jail_rootdir=\"\$jail_${_j}_rootdir\"
	jail_devdir="${jail_rootdir}/dev"
	jail_fdescdir="${jail_devdir}/fd"
	jail_procdir="${jail_rootdir}/proc"
	eval jail_hostname=\"\$jail_${_j}_hostname\"
	eval jail_ip=\"\$jail_${_j}_ip\"
	eval jail_exec=\"\$jail_${_j}_exec\"
	[ -z "${jail_exec}" ] && jail_exec="/bin/sh /etc/rc"

	# The default jail ruleset will be used by rc.subr if none is specified.
	eval jail_ruleset=\"\$jail_${_j}_devfs_ruleset\"
	eval jail_devfs=\"\$jail_${_j}_devfs_enable\"
	[ -z "${jail_devfs}" ] && jail_devfs="NO"
	eval jail_fdescfs=\"\$jail_${_j}_fdescfs_enable\"
	[ -z "${jail_fdescfs}" ] && jail_fdescfs="NO"
	eval jail_procfs=\"\$jail_${_j}_procfs_enable\"
	[ -z "${jail_procfs}" ] && jail_procfs="NO"

	# Debuggin aid
	#
	debug "$_j devfs enable: $jail_devfs"
	debug "$_j fdescfs enable: $jail_fdescfs"
	debug "$_j procfs enable: $jail_procfs"
	debug "$_j hostname: $jail_hostname"
	debug "$_j ip: $jail_ip"
	debug "$_j root: $jail_rootdir"
	debug "$_j devdir: $jail_devdir"
	debug "$_j fdescdir: $jail_fdescdir"
	debug "$_j procdir: $jail_procdir"
	debug "$_j ruleset: $jail_ruleset"
}

jail_start()
{
	echo -n 'Configuring jails:'
	echo -n ' set_hostname_allowed='
	if checkyesno jail_set_hostname_allow ; then
		echo -n 'YES'
		${SYSCTL_W} 1>/dev/null security.jail.set_hostname_allowed=1
	else
		echo -n 'NO'
		${SYSCTL_W} 1>/dev/null security.jail.set_hostname_allowed=0
	fi

	echo -n ' unixiproute_only='
	if checkyesno jail_socket_unixiproute_only ; then
		echo -n 'YES'
		${SYSCTL_W} 1>/dev/null security.jail.socket_unixiproute_only=1
	else
		echo -n 'NO'
		${SYSCTL_W} 1>/dev/null security.jail.socket_unixiproute_only=0
	fi

	echo -n ' sysvipc_allow='
	if checkyesno jail_sysvipc_allow ; then
		echo -n 'YES'
		${SYSCTL_W} 1>/dev/null security.jail.sysvipc_allowed=1
	else
		echo -n 'NO'
		${SYSCTL_W} 1>/dev/null security.jail.sysvipc_allowed=0
	fi
	echo '.'

	echo -n 'Starting Jails:'
	for _jail in ${jail_list}
	do
		init_variables $_jail
		if checkyesno jail_devfs; then
			info "Mounting devfs on ${jail_devdir}"
			devfs_mount_jail "${jail_devdir}" ${jail_ruleset}

			# Transitional symlink for old binaries
			if [ ! -L ${jail_devdir}/log ]; then
				__pwd="`pwd`"
				cd "${jail_devdir}"
				ln -sf ../var/run/log log
				cd "$__pwd"
			fi

			# XXX - It seems symlinks don't work when there
			#	is a devfs(5) device of the same name.
			# Jail console output
			#	__pwd="`pwd`"
			#	cd "${jail_devdir}"
			#	ln -sf ../var/log/console console
			#	cd "$__pwd"
		fi
		if checkyesno jail_fdescfs; then
			info "Mounting fdescfs on ${jail_fdescdir}"
			mount -t fdescfs fdesc "${jail_fdescdir}"
		fi
		if checkyesno jail_procfs; then
			info "Mounting procfs onto ${jail_procdir}"
			if [ -d ${jail_procdir} ] ; then
				mount -t procfs proc "${jail_procdir}"
			fi
		fi
		_tmp_jail=/tmp/jail.$$
		jail -i ${jail_rootdir} ${jail_hostname} \
			${jail_ip} ${jail_exec} > ${_tmp_jail} 2>&1
		[ "$?" -eq 0 ] && echo -n " $jail_hostname"
		_jail_id=$(head -1 ${_tmp_jail})
		tail +2 ${_tmp_jail} >${jail_rootdir}/var/log/console.log
		rm -f ${_tmp_jail}
		echo ${_jail_id} > /var/run/jail_${_jail}.id
	done
	echo '.'
}

jail_stop()
{
	echo 'Stopping jails.'
	for _jail in ${jail_list}
	do
		if [ -f /var/run/jail_${_jail}.id ]; then
			_jail_id=$(cat /var/run/jail_${_jail}.id)
			if [ ! -z ${_jail_id} ]; then
				killall -j ${_jail_id} -TERM > /dev/null 2>&1
			fi
			rm /var/run/jail_${_jail}.id
		else
			echo "cannot stop jail ${_jail}. no jail id saved in /var/run"
			jail_list=$(echo ${jail_list} | \
				tr ' ' '\n' | \
				grep -v "^${_jail}$" | \
				tr '\n' ' ')
		fi
	done
	for _jail in ${jail_list}
	do
		init_variables $_jail
		if checkyesno jail_fdescfs; then
			if [ -d ${jail_fdescdir} ] ; then
				umount -f ${jail_fdescdir} >/dev/null 2>&1
			fi
		fi
		if checkyesno jail_devfs; then
			if [ -d ${jail_devdir} ] ; then
				umount -f ${jail_devdir} >/dev/null 2>&1
			fi
		fi
		if checkyesno jail_procfs; then
			if [ -d ${jail_procdir} ] ; then
				umount -f ${jail_procdir} >/dev/null 2>&1
			fi
		fi
	done
}


[ -n "$2" ] && jail_list="$2"
load_rc_config $name
run_rc_command "$1"