Teach ifconfig to attach and run itself in a jail.

[nyan_myuji.xyz]

Summary

Add -j <jail> flag to ifconfig to allow ifconfig to attach and run inside a
jail. This allow parent to configure network interfaces of its children
even if ifconfig is not available in child's tree (e.g. Linux Jails)

Event: Kitchener-Waterloo Hackathon 202305

[nyan_myuji.xyz]

• fix rescue build

[khng]

sbin/ifconfig/ifconfig.c

471

The following sounds more idiomatic to me:

jid = jail_getid(optarg);
if (jid == -1)

Perror("1");

if (jail_attach(jid) != 0)

Perror("2");

[nyan_myuji.xyz]

sbin/ifconfig/ifconfig.c

471

Great! I prefer that too just worry about breaking style.

[nyan_myuji.xyz]

• improve readability

[khng]

LGTM. You may want to add a manual page changes as well.

[emaste]

yes let's add the man page in here too

sbin/ifconfig/ifconfig.c

476

Do we want

#else
    Perror("not built with jail support")

or leave j out of options when not #ifdef JAIL?

[nyan_myuji.xyz]

• modify man page to refactor the new -j flag

[lwhsu]

sbin/ifconfig/ifconfig.8

31

Bump the date. :-)

[lwhsu]

sbin/ifconfig/ifconfig.c

476

Maybe perror() is easier since going the other way, we also need to have usage() #ifdef'd

[lwhsu]

If would be perfect if you want to add a simple test under tests/

[nyan_myuji.xyz]

• print error and exit if -j specified but ifconfig isn't built with jail support
• bump manpage date

[lwhsu]

BTW, I'm not sure if doing jail_attach() in args_parse() is a common or good practice.

[nyan_myuji.xyz]

Move jail_attach away from args_parse

[nyan_myuji.xyz]

cleanup

[nyan_myuji.xyz]

including the correct range

[melifaro]

sbin/ifconfig/ifconfig.c

443

Nit: this is not needed, args is zeroed by default.

[nyan_myuji.xyz]

• remove explicit initialization

[dfr]

It would be nice to have something similar for route. Setting up network state for containers with external connectivity also needs some way of setting a default route. For podman, I ended up nesting the container jail inside another jail where I can safely run ifconfig and route without requiring their presence inside the container (or trusting the container's binaries if they are present).

[nyan_myuji.xyz]

@dfr A patch for route is available at D40377

[dfr]

Would there be any objection to me merging this change and the related change in D40377 to stable/13? It would make setting up container networking for containerd and nerdctl much simpler. For podman, it could also make networking more efficient - we currently use two jails per container with one solely used to own the container vnet while also allowing access to host networking tools.

[melifaro]

In D40213#943667, @dfr wrote:

Would there be any objection to me merging this change and the related change in D40377 to stable/13? It would make setting up container networking for containerd and nerdctl much simpler. For podman, it could also make networking more efficient - we currently use two jails per container with one solely used to own the container vnet while also allowing access to host networking tools.

No objection, the only note is that ifconfig(8) code is different in stable/13, so likely it would require some changes.