Teach ifconfig to attach and run itself in a jail.

[nyan_myuji.xyz]

Summary

Add -j <jail> flag to ifconfig to allow ifconfig to attach and run inside a
jail. This allow parent to configure network interfaces of its children
even if ifconfig is not available in child's tree (e.g. Linux Jails)

Event: Kitchener-Waterloo Hackathon 202305

[nyan_myuji.xyz]

• fix rescue build

[khng]

sbin/ifconfig/ifconfig.c

468

The following sounds more idiomatic to me:

jid = jail_getid(optarg);
if (jid == -1)

Perror("1");

if (jail_attach(jid) != 0)

Perror("2");

[nyan_myuji.xyz]

sbin/ifconfig/ifconfig.c

468

Great! I prefer that too just worry about breaking style.

[nyan_myuji.xyz]

• improve readability

[khng]

LGTM. You may want to add a manual page changes as well.

[emaste]

yes let's add the man page in here too

sbin/ifconfig/ifconfig.c

473

Do we want

#else
    Perror("not built with jail support")

or leave j out of options when not #ifdef JAIL?

[nyan_myuji.xyz]

• modify man page to refactor the new -j flag

[lwhsu]

sbin/ifconfig/ifconfig.8

31

Bump the date. :-)

[lwhsu]

sbin/ifconfig/ifconfig.c

473

Maybe perror() is easier since going the other way, we also need to have usage() #ifdef'd

[lwhsu]

If would be perfect if you want to add a simple test under tests/

[nyan_myuji.xyz]

• print error and exit if -j specified but ifconfig isn't built with jail support
• bump manpage date

[lwhsu]

BTW, I'm not sure if doing jail_attach() in args_parse() is a common or good practice.

[nyan_myuji.xyz]

Move jail_attach away from args_parse

[nyan_myuji.xyz]

cleanup

[nyan_myuji.xyz]

including the correct range

[melifaro]

sbin/ifconfig/ifconfig.c

443

Nit: this is not needed, args is zeroed by default.

[nyan_myuji.xyz]

• remove explicit initialization

[dfr]

It would be nice to have something similar for route. Setting up network state for containers with external connectivity also needs some way of setting a default route. For podman, I ended up nesting the container jail inside another jail where I can safely run ifconfig and route without requiring their presence inside the container (or trusting the container's binaries if they are present).

[nyan_myuji.xyz]

@dfr A patch for route is available at D40377