Page MenuHomeFreeBSD

Infrastructure for automatic jailing of rc.d-services
ClosedPublic

Authored by netchild on Jun 1 2023, 8:53 AM.
Referenced Files
Unknown Object (File)
Sat, Jul 13, 11:31 PM
Unknown Object (File)
Mon, Jul 8, 6:20 AM
Unknown Object (File)
Mon, Jun 24, 3:18 PM
Unknown Object (File)
Mon, Jun 24, 7:34 AM
Unknown Object (File)
Mon, Jun 24, 2:51 AM
Unknown Object (File)
Sat, Jun 22, 4:08 AM
Unknown Object (File)
Sat, Jun 22, 3:46 AM
Unknown Object (File)
Fri, Jun 21, 11:23 PM

Details

Summary

The man-page contains a reference to behavior of auto-jailing of sshd which requires a change which is not in this patch (but is in another review).

---This implementation depends upon a change for /usr/bin/service which is in https://reviews.freebsd.org/D40369--- committed

This takes a rc.d-service and starts it in a jail which shares the same root-path as the host (or parent jail) and may inherit the network from the host (or parent jail). Per service there is the possibility to specify some arguments which gives more permissions (e.g. netv4, netv6, sysvipc...).

See the included man page update for more info about the functionality.

Do we want to print "Starting svcj-name." instead of "Starting name." when starting services as a svcj, and similar for stop?

Test Plan

I did very light testing of hierarchic jails (auto-jailing inside a jail). For hierarchic jails you need to specify the children.max parameter for the non-automatic jails, as the default doesn't allow it.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

netchild created this revision.
libexec/rc/rc.subr
1333

This is not indended correctly as I had this as some kind of debugging info initially. My question here would be if we want to have it as some kind of information (with some other wording, as the execution is not skipped, but done on the host and not inside the service-jail), or if I shall write in the man-page that non-standard commands (e.g. configtest for apache/nginx/postfic/...) will be executed outside of the service-jail and remove this information here?

libexec/rc/rc.subr
532

Note to myself: typo "svj-jail"

Two fixes for the man page.

share/man/man5/rc.conf.5
409

s/explicitely/explicitly/

4965

You need to do a line break after a sentence stop.

netchild set the repository for this revision to rG FreeBSD src repository.

Change what was noticed in comments. Add a feature to enable the execution of extra commands inside the service jail.

netchild edited the summary of this revision. (Show Details)

Add support for nfs. Sort the options.

OK for the man page change. Make sure to bump the .Dd when you commit it for this content change.
Thanks for working on this, it's appreciated!

This revision is now accepted and ready to land.Jan 11 2024, 1:20 PM
This revision was automatically updated to reflect the committed changes.