Details

Reviewers

Commits

rG2efbd480f1d3: rc: add service jails framework

Summary

The man-page contains a reference to behavior of auto-jailing of sshd which requires a change which is not in this patch (but is in another review).

---This implementation depends upon a change for /usr/bin/service which is in https://reviews.freebsd.org/D40369--- committed

This takes a rc.d-service and starts it in a jail which shares the same root-path as the host (or parent jail) and may inherit the network from the host (or parent jail). Per service there is the possibility to specify some arguments which gives more permissions (e.g. netv4, netv6, sysvipc...).

See the included man page update for more info about the functionality.

Do we want to print "Starting svcj-name." instead of "Starting name." when starting services as a svcj, and similar for stop?

Test Plan

I did very light testing of hierarchic jails (auto-jailing inside a jail). For hierarchic jails you need to specify the children.max parameter for the non-automatic jails, as the default doesn't allow it.

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

netchild requested review of this revision.Jun 1 2023, 8:53 AM

netchild created this revision.

netchild mentioned this in D40371: automatic service jails: some setup for full functionality of the services in automatic service jails.Jun 1 2023, 9:00 AM

mateusz_serveraptor.com added a subscriber: mateusz_serveraptor.com.Jun 1 2023, 11:19 AM

ihor_antonovs.family added a project: Jails.Jun 5 2023, 2:55 PM

netchild added a project: rc.Jun 6 2023, 8:30 AM

netchild added inline comments.Jun 9 2023, 8:25 AM

libexec/rc/rc.subr
1333	This is not indended correctly as I had this as some kind of debugging info initially. My question here would be if we want to have it as some kind of information (with some other wording, as the execution is not skipped, but done on the host and not inside the service-jail), or if I shall write in the man-page that non-standard commands (e.g. configtest for apache/nginx/postfic/...) will be executed outside of the service-jail and remove this information here?