Commit Graph

15 Commits

Author SHA1 Message Date
Kyle Evans
b8f71f9750 bectl: simplify the tail end of the jail cmd
This has already confused me once (and I'm pretty sure I wrote it), so let's
clarify: unjailing after the command has completed will only happen if we're
interactive and -U has not been specified.

This just folds two conditionals together to make it obvious how -b/-U
interact with each other.

MFC after:	3 days
2020-12-06 15:58:50 +00:00
Kyle Evans
7c08a497ba bectl(8): Don't accept jid=0 from jail_getid
This will trivially exist, but we don't want it - none of our jailed BEs
will have jid=0.

MFC after:	3 days
2019-06-02 14:05:51 +00:00
Kyle Evans
515fa27bb0 bectl(8): Address Coverity complaints
CID 1400451: case 0 is missing a break/return and falling through to the
default case.  waitpid(0, ...) makes little sense in the child, we likely
wanted to terminate immediately.

CID 1400453: size argument uses sizeof(char **) instead of sizeof(char *)
and is assigned to a char **; sizeof's match but "this isn't a portable
assumption".

CID:	1400451, 1400453
MFC after:	3 days
2019-05-28 16:12:16 +00:00
Kyle Evans
938b7a44d9 bectl(8): change jail command to execute jail(8)
The jail(8) command provides a variety of jail pseudo-parameters that are
useful to consumers of bectl, mount.devfs being the most-often-requested
paramater by bectl users.

command, exec.start, nopersist, and persist may not be specified via -o to
bectl. The command/exec.start remains passed as it always has at the end of
bectl, and persistence is dictated by -b/-U bectl jail arguments.

Submitted by:	Wes Maag <jwmaag gmail com>
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D19282
2019-03-19 17:38:54 +00:00
Kyle Evans
0a603a6ece libbe(3): Change be_mount to mount/unmount child datasets
This set of changes is geared towards making bectl respect deep boot
environments when they exist and are mounted. The deep BE composition
functionality (`bectl add`) remains disabled for the time being. This set of
changes has no effect for the average user. but allows deep BE users to
upgrade properly with their current setup.

libbe(3): Open the target boot environment and get a zfs handle, then pass
that with the target mountpoint to be_mount_iter; If the BE_MNT_DEEP flag is
set call zfs_iter_filesystems and mount the child datasets.

Similar logic is employed when unmounting the datasets, save for children
are unmounted first.

bectl(8): Change bectl_cmd_jail to pass the BE_MNT_DEEP flag when
calling be_mount as well as call be_unmount when cleaning up after the
jail has exited instead of umount(2) directly.

PR:		234795
Submitted by:	Wes Maag <jwmaag_gmail.com> (test additions by kevans)
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D18796
2019-01-10 03:27:20 +00:00
Kyle Evans
7ce09314b2 bectl: use jail id as the default jail name for a boot environment
By default, bectl is setting the jail 'name' parameter to the boot
environment name, which causes an error when the boot environment name is
not a valid jail name. With the attached fix, when no name is supplied, the
default jail name will be the jail id - this is is the same behavior as the
jail command.

Additionally, this commit addresses two other bugs that prevented unjailing
in scenarios where the jail name does not match the boot environment name:

1. In 'bectl_locate_jail', 'mountpoint' is used to resolve the boot
  environment path, but really 'mounted' should be used. 'mountpoint' is the
  path where the zfs dataset will be mounted. 'mounted' is the path where
  the dataset is actually mounted.

2. in 'bectl_search_jail_paths', 'jail_getv' would fail after the first
  call. Which is fine, if the boot environment you're unjailing is the next
  one up. According to 'man jail_getv', it's expecting name and value
  strings. 'jail_getv' is being passed an integer for the lastjid, so amend
  that to use a string instead.

Test cases have been amended to reflect the bugs found.

PR:		233637
Submitted by:	Rob <rob.fx907_gmail.com>
MFC after:	3 days
Differential Revision:	https://reviews.freebsd.org/D18607
2018-12-25 15:18:41 +00:00
Kyle Evans
db9db0e790 bectl(8): jail: Tear down jail by default after command exits
Add a -U flag to get back the old behavior. The new behavior is a little
more friendly to the common use cases, jail the BE and execute a script.
Having the jail torn down automatically when the script is finished, or when
you exit the shell, is a little more friendly than having to remember to
`bectl ujail`.

Batch mode (-b) will continue to leave the jail up, as it's assumed the
caller has other intentions.

Submitted by:	Shawn Webb (partially)
2018-08-23 01:45:18 +00:00
Kyle Evans
cd816834d4 bectl(8): Allow running a custom command in the 'jail' subcommand
Instead of always running /bin/sh, allow the user to specify the command
to run. The jail is not removed when the command finishes. Meaning,
`bectl unjail` will still need to be run.

For example:

```
bectl jail newBE pkg upgrade
bectl ujail newBE
```

Submitted by:	Shawn Webb
Obtained from:	HardenedBSD (8b451014ab)
2018-08-18 01:12:44 +00:00
Kyle Evans
b509cad4fe bectl(8): Add batch mode to jail subcommand
Adding batch mode to the jail `bectl(8)` subcommand enables jailing of
ZFS Boot Environments in a scriptable fashion.

Submitted by:	Shawn Webb
Obtained from:	HardenedBSD (9e72d1c59a and ef7b6d9e1c with minor edit)
2018-08-17 01:59:19 +00:00
Kyle Evans
9491dcf564 bectl(8): Appease clang-scan
Use strlcpy instead of a plain strcpy
2018-08-16 17:59:49 +00:00
Kyle Evans
55b0e92b89 libbe(3)/bectl(8): Hit rewind on a bunch of off-by-ones
While here, use sizeof() in some places that it makes sense to reduce room
for error and prefer strlcpy to strncpy
2018-08-16 17:56:03 +00:00
Kyle Evans
4c5d19fda4 bectl(8): Check jailparam_* return values
Previous iteration of this assumed that these won't fail because we've
already setup the jail param to this point, but the allocations could still
fail in pretty bad conditions.

Admit that it's possible and return (ENOENT, EINVAL, ENOMEM, or 0) when
deleting arguments. EINVAL shouldn't happen since we're passing optarg;
which may satisfy *optarg == '\0' but never optarg == NULL.

CID:		1394885, 1394901
2018-08-14 18:35:33 +00:00
Kyle Evans
b6e7c421b7 libbe(3)/bectl(8): Standardize $FreeBSD$ IDs 2018-08-07 14:02:41 +00:00
Kyle Evans
2a0b8dc2cb bectl(8): Provide -u option to unset jail parameters
All but name, host.hostname, and path may be completely unset.
2018-08-06 15:21:46 +00:00
Kyle Evans
d694059f1e bectl(8): bectl jail improvements
- Support passing arbitrary jail arguments via -o
- Split the related (and rewritten since the GSoC) jail bits out into a new
  bectl_jail.c file, to reduce clutter in bectl.c
- Don't use RFC 1918 IP space [0]; we'll instead set no default IPv4 and let
  the user pass in any address options they wish via -o

Reported by:	rgrimes [0], Shawn Webb [0]
2018-08-06 03:32:25 +00:00