Infrastructure for automatic jailing of rc.d-services

[netchild]

Summary

The man-page contains a reference to behavior of auto-jailing of sshd which requires a change which is not in this patch (but is in another review).

---This implementation depends upon a change for /usr/bin/service which is in https://reviews.freebsd.org/D40369--- committed

This takes a rc.d-service and starts it in a jail which shares the same root-path as the host (or parent jail) and may inherit the network from the host (or parent jail). Per service there is the possibility to specify some arguments which gives more permissions (e.g. netv4, netv6, sysvipc...).

See the included man page update for more info about the functionality.

Do we want to print "Starting svcj-name." instead of "Starting name." when starting services as a svcj, and similar for stop?

Test Plan

I did very light testing of hierarchic jails (auto-jailing inside a jail). For hierarchic jails you need to specify the children.max parameter for the non-automatic jails, as the default doesn't allow it.

[netchild]

libexec/rc/rc.subr

1153

This is not indended correctly as I had this as some kind of debugging info initially. My question here would be if we want to have it as some kind of information (with some other wording, as the execution is not skipped, but done on the host and not inside the service-jail), or if I shall write in the man-page that non-standard commands (e.g. configtest for apache/nginx/postfic/...) will be executed outside of the service-jail and remove this information here?

[netchild]

libexec/rc/rc.subr

379

Note to myself: typo "svj-jail"

[bcr]

Two fixes for the man page.

share/man/man5/rc.conf.5

402 ↗

(On Diff #122693)

s/explicitely/explicitly/

4960 ↗

(On Diff #122693)

You need to do a line break after a sentence stop.

[netchild]

Change what was noticed in comments. Add a feature to enable the execution of extra commands inside the service jail.

[netchild]

Add support for nfs. Sort the options.

[netchild]

Make jls quiet.

[bcr]

OK for the man page change. Make sure to bump the .Dd when you commit it for this content change.
Thanks for working on this, it's appreciated!