Commit Graph

26 Commits

Author SHA1 Message Date
jamie
b5bdd5a3db security.jail.enforce_statfs is handled by jail_set(2), so handling it in
userspace jail(8) is redundant.

Differential Revision:	D14791
2018-08-16 18:30:49 +00:00
netchild
42ccecb54b - Add exec hook "exec.created". This is called when the jail is
created and before exec.start is called.			[1]
- Bump __FreeBSD_version.

This allows to attach ZFS datasets and various other things to be
done before any command/service/rc-script is started in the new
jail.

PR:			228066					[1]
Reviewed by:		jamie					[1]
Submitted by:		Stefan Grönke <stefan@gronke.net>	[1]
Differential Revision:	https://reviews.freebsd.org/D15330	[1]
2018-08-15 18:35:42 +00:00
pfg
7551d83c35 various: general adoption of SPDX licensing ID tags.
Mainly focus on files that use BSD 2-Clause license, however the tool I
was using misidentified many licenses so this was mostly a manual - error
prone - task.

The Software Package Data Exchange (SPDX) group provides a specification
to make it easier for automated tools to detect and summarize well known
opensource licenses. We are gradually adopting the specification, noting
that the tags are considered only advisory and do not, in any way,
superceed or replace the license texts.

No functional change intended.
2017-11-27 15:37:16 +00:00
jamie
2595beb23e Don't bother checking an ip[46].addr netmask/prefixlen. This is already
handled by ifconfig, and it was doing it wrong when the paramater included
extra ifconfig options.

PR:		205926
MFC after:	5 days
2016-01-16 22:32:57 +00:00
hrs
6a6f4266c7 Implement PF_IMMUTABLE flag and apply it to "name" and "jid" in
jail.conf parameters.  This flag disallows redefinition of the parameter.

"name" and/or "jid" are automatically defined in jail.conf by using
the jail names at the front of jail parameter definitions.  However,
one could override them by using a variable with the same name like
$name = "foo".  This confused the parser and could end up with SIGSEGV.

Note that this change also affects a case when all of parameters are
defined in the command line arguments, not in jail.conf.  Specifically,
"jail -c name=j1 name=j2" no longer works.  This should be harmless.

PR:		196574
Reviewed by:	jamie
Differential Revision:	https://reviews.freebsd.org/D3017
2015-07-08 16:37:48 +00:00
hrs
3c6c216f16 Fix offset calculation in variable substitution
in jail.conf.  The following did not work correctly:

 A="A_${B}_C_${D}"
 B="BBBBB"
 D="DDDD_${E}_FFFFF"
 E="EEEEE"

PR:		189139
Reviewed by:	jamie
Differential Revision:	https://reviews.freebsd.org/D3018
2015-07-08 00:51:53 +00:00
jamie
6064614ca5 Add mount.procfs jail parameter, so procfs can be mounted when a prison's
root is in its fstab.

Also fix a typo while I'm at it.

PR:		197237 197066
MFC after:	3 days
2015-02-06 17:54:53 +00:00
smh
1aebfbbf08 Added support for extra ifconfig args to jail ip4.addr & ip6.addr params
This allows for CARP interfaces to be  used in jails e.g.
ip4.addr = "em0|10.10.1.20/32 vhid 1 pass MyPass advskew 100"

Before this change using exec.prestart to configure a CARP address
would result in the wrong MAC being broadcast on startup as jail creates
IP aliases to support ip[4|6].addr before exec.prestart is executed.

PR:		191832
Reviewed by:	jamie
MFC after:	1 week
X-MFC-With:	r269340
Phabric:	D528
Sponsored by:	Multiplay
2014-08-04 16:32:08 +00:00
hrs
513bdd96d7 - Add mount.fdescfs parameter to jail(8). This is similar to
mount.devfs but mounts fdescfs.  The mount happens just after
  mount.devfs.

- rc.d/jail now displays whole error message from jail(8) when a jail
  fails to start.

Approved by:	re (gjb)
2013-10-12 17:27:59 +00:00
jamie
82d5811488 Reverse the order of some implicit commands (FS mounts and ifconfigs)
when stopping jails.  This matters particularly for nested filesystem
mounts.

PR:		kern/177325
Submitted by:	Harald Schmalzbauer
MFC after:	3 days
2013-03-28 21:02:49 +00:00
jamie
1b32102bdf Move properly to the next parameter when jailparam_init fails
(i.e. on an unknown parameter), to avoid freeing bogus pointers.
2012-10-04 18:59:46 +00:00
jamie
44f6adcfe5 Partially roll back r239601 - keep parameter strings both length-delimited
and null-terminated at the same time, because they're later passed to
libjail as null-terminated.  That means I also need to add a nul byte when
comma-combining array parameters.

MFC after:	6 days
2012-08-23 19:39:23 +00:00
jamie
2c0fa14240 Remember that I'm using length-defined strings in parameters:
Remove a bogus null terminator when stripping the netmask from
 IP addresses.  This was causing later addresses in a comma-separated
 string to disappear.

 Use memcpy instead of strcpy.  This could just cause Bad Things.

PR:		170832
MFC after:	1 week
2012-08-23 01:43:01 +00:00
bapt
310ab6d7ff Fix world after byacc import:
- old yacc(1) use to magicially append stdlib.h, while new one don't
- new yacc(1) do declare yyparse by itself, fix redundant declaration of
  'yyparse'

Approved by:	des (mentor)
2012-05-22 16:33:10 +00:00
jamie
18b00ce052 Add a meta-parameter IP__NULL to enum intparam, instead of mixing
enum values and zeroes.  This keeps clang happy (and is just good form).

Submitted by:	dim
2012-05-03 21:39:23 +00:00
jamie
6fe59c6c06 Use the defvs_ruleset paramater when mounting a jail's /dev,
instead of a mount.devfs.ruleset pseudo-parameter.
2012-02-27 22:37:35 +00:00
jamie
6811668a5f Following r222465:
Check for IPv4 or IPv6 to be available by the kernel to not
  provoke errors trying to query options not available.
  Make it possible to compile out INET or INET6 only parts.
2011-06-20 23:04:13 +00:00
jamie
6a72e94c30 Linty stuff. 2011-06-20 07:58:44 +00:00
jamie
8d425bfde2 Update copyright dates and other whitespacey stuff. 2011-06-17 16:21:03 +00:00
jamie
bf5da8413e Split run_command up into an outer function (next_command) that chooses
a single command string to run, and an inner function (run_command) that
 runs that single string.
Move the list of start/stop commands to run from a switch statement into
 an array, with a new placeholder parameter IP__OP for actually creating
 or removing the jail.
When jail creation fails, revert all non-exec commands in reverse order.
2011-06-17 16:18:44 +00:00
jamie
0e5ec9dce0 Change cfstrings from an STAILQ into a TAILQ to allow commands to be
traversed in reverse order.
2011-06-17 16:06:13 +00:00
jamie
85767896da Reads the mount.fstab file, and put its lines separately into the
IP__MOUNT_FROM_FSTAB internal parameter.
2010-11-04 17:01:21 +00:00
jamie
94aa5f7221 Combine check_intparams() and ip_params(), JF_CHECKINT and JF_IPPARAMS. 2010-11-01 21:37:28 +00:00
jamie
0cc1eb5836 Use a little more "ifdef INET6". 2010-10-27 20:25:55 +00:00
jamie
235aefe219 Keep all internal/known parameter names in one place, and use
enum constants everywhere else.
2010-10-27 16:22:54 +00:00
jamie
3b31921eb1 Initial work on the new jail(8). There are more features to add, and some
cleaning up to do on existing features, but this is pretty much what the
final product will look like.
2010-10-20 20:42:33 +00:00