Author: jamie
Date: Sun May 19 04:10:34 2013
New Revision: 250804
URL: http://svnweb.freebsd.org/changeset/base/250804
Log:
Refine the "nojail" rc keyword, adding "nojailvnet" for files that don't
apply to most jails but do apply to vnet jails. This includes adding
a new sysctl "security.jail.vnet" to identify vnet jails.
PR: conf/149050
Submitted by: mdodd
MFC after: 3 days
Modified:
head/etc/rc
head/etc/rc.d/ipfw
head/etc/rc.d/netif
head/etc/rc.d/routing
head/etc/rc.shutdown
head/sys/kern/kern_jail.c
Modified: head/etc/rc
==============================================================================
--- head/etc/rc Sun May 19 03:04:34 2013 (r250803)
+++ head/etc/rc Sun May 19 04:10:34 2013 (r250804)
@@ -77,6 +77,9 @@ if [ `/sbin/sysctl -n security.jail.jail
if [ "$early_late_divider" = "FILESYSTEMS" ]; then
early_late_divider=NETWORKING
fi
+ if [ `/sbin/sysctl -n security.jail.vnet` -ne 1 ]; then
+ skip="$skip -s nojailvnet"
+ fi
fi
# Do a first pass to get everything up to $early_late_divider so that
Modified: head/etc/rc.d/ipfw
==============================================================================
--- head/etc/rc.d/ipfw Sun May 19 03:04:34 2013 (r250803)
+++ head/etc/rc.d/ipfw Sun May 19 04:10:34 2013 (r250804)
@@ -5,7 +5,7 @@
# PROVIDE: ipfw
# REQUIRE: ppp
-# KEYWORD: nojail
+# KEYWORD: nojailvnet
. /etc/rc.subr
. /etc/network.subr
Modified: head/etc/rc.d/netif
==============================================================================
--- head/etc/rc.d/netif Sun May 19 03:04:34 2013 (r250803)
+++ head/etc/rc.d/netif Sun May 19 04:10:34 2013 (r250804)
@@ -28,7 +28,7 @@
# PROVIDE: netif
# REQUIRE: atm1 FILESYSTEMS serial sppp sysctl
# REQUIRE: ipfilter ipfs
-# KEYWORD: nojail
+# KEYWORD: nojailvnet
. /etc/rc.subr
. /etc/network.subr
Modified: head/etc/rc.d/routing
==============================================================================
--- head/etc/rc.d/routing Sun May 19 03:04:34 2013 (r250803)
+++ head/etc/rc.d/routing Sun May 19 04:10:34 2013 (r250804)
@@ -7,7 +7,7 @@
# PROVIDE: routing
# REQUIRE: faith netif ppp stf
-# KEYWORD: nojail
+# KEYWORD: nojailvnet
. /etc/rc.subr
. /etc/network.subr
Modified: head/etc/rc.shutdown
==============================================================================
--- head/etc/rc.shutdown Sun May 19 03:04:34 2013 (r250803)
+++ head/etc/rc.shutdown Sun May 19 04:10:34 2013 (r250804)
@@ -81,7 +81,12 @@ fi
# and perform the operation
#
rcorder_opts="-k shutdown"
-[ `/sbin/sysctl -n security.jail.jailed` -eq 1 ] &&
rcorder_opts="$rcorder_opts -s nojail"
+if [ `/sbin/sysctl -n security.jail.jailed` -eq 1 ]; then
+ rcorder_opts="$rcorder_opts -s nojail"
+ if [ `/sbin/sysctl -n security.jail.vnet` -ne 1 ]; then
+ rcorder_opts="$rcorder_opts -s nojailvnet"
+ fi
+fi
case ${local_startup} in
[Nn][Oo] | '') ;;
Modified: head/sys/kern/kern_jail.c
==============================================================================
--- head/sys/kern/kern_jail.c Sun May 19 03:04:34 2013 (r250803)
+++ head/sys/kern/kern_jail.c Sun May 19 04:10:34 2013 (r250804)
@@ -4132,6 +4132,26 @@ SYSCTL_PROC(_security_jail, OID_AUTO, ja
CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
sysctl_jail_jailed, "I", "Process in jail?");
+static int
+sysctl_jail_vnet(SYSCTL_HANDLER_ARGS)
+{
+ int error, havevnet;
+#ifdef VIMAGE
+ struct ucred *cred = req->td->td_ucred;
+
+ havevnet = jailed(cred) && prison_owns_vnet(cred);
+#else
+ havevnet = 0;
+#endif
+ error = SYSCTL_OUT(req, &havevnet, sizeof(havevnet));
+
+ return (error);
+}
+
+SYSCTL_PROC(_security_jail, OID_AUTO, vnet,
+ CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
+ sysctl_jail_vnet, "I", "Jail owns VNET?");
+
#if defined(INET) || defined(INET6)
SYSCTL_UINT(_security_jail, OID_AUTO, jail_max_af_ips, CTLFLAG_RW,
&jail_max_af_ips, 0,
_______________________________________________
svn-src-head@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
