kern_jail: add security.jail.children.max and .cur sysctl

[igor.ostapenko_pm.me]

Test Plan

kyua test -k /usr/tests/sys/kern/Kyuafile sysctl_security_jail_children

[igor.ostapenko_pm.me]

The purpose reasoning and initial discussion was in https://reviews.freebsd.org/D43476.

[jamie]

You'll want to add CTLFLAG_PRISON to the sysctl flags.

[igor.ostapenko_pm.me]

In D43565#993561, @jamie wrote:

You'll want to add CTLFLAG_PRISON to the sysctl flags.

The leafs are meant to be read-only (flagged with CTLFLAG_RD), i.e. it looks like we do not need CTLFLAG_PRISON here.

a) Do you mean to add it for possible future upgrades when some leafs could be changed to read-write?
b) Probably, it was meant to add CTLFLAG_PRISON to the children branch node which is marked with CTLFLAG_RW? As I understand it would not make much sense for a branch node.
c) Or something else what I have not spotted yet :)

[jamie]

c) Or something else what I have not spotted yet :)

c) Jamie wasn't thinking and of course you don't need it for read-only.

[igor.ostapenko_pm.me]

A little test improvement with additional comment about the magic numbers.

[igor.ostapenko_pm.me]

In D43565#994045, @jamie wrote:

c) Or something else what I have not spotted yet :)

c) Jamie wasn't thinking and of course you don't need it for read-only.

No problem, a usual thing for us, non-robots. Thanks for the confirmation.

I've tested it for AArch64 and AMD64 on my side. Do we need anything else for the patch? Or it's ready to hit the main?

[jamie]

Looks good to me!

[kevans]

Is the plan still to use JAIL_MAX in the test work, or to switch to this since tests can be executed started in non-prison0?

[igor.ostapenko_pm.me]

In D43565#994366, @kevans wrote:

Is the plan still to use JAIL_MAX in the test work, or to switch to this since tests can be executed started in non-prison0?

Yes, the idea is to use this approach introduced by this patch.

[igor.ostapenko_pm.me]

May I ask for the help? To land the commit itself.

[igor.ostapenko_pm.me]

@jamie, thanks for the commit.