sysctl: Teach sysctl to attach and run itself in a jail

[zlei]

Summary

This allows the parent jail to retrieve or set kernel state when child
does not have sysctl installed (e.g. OCI containers or slim jails ).

This is especially useful when manipulating jail prison or vnet sysctls.
For example, sysctl -j foo -Ja or sysctl -j foo net.fibs=2.

MFC after: 1 week
Relnotes: yes

Test Plan

# jail -c -n foo host.hostname=foo.example.org vnet persist
# sysctl -j foo -J kern.hostname
kern.hostname: foo.example.org
# sysctl -j foo net.fibs=2
net.fibs: 1 -> 2
# echo "net.fibs=3" > /tmp/sysctl.conf
# sysctl -j foo -f /tmp/sysctl.conf
net.fibs: 2 -> 3

[dfr]

Looks good to me. It would also be nice to have something similar for ip6addrctl to make it easier to have different address selection policies in vnet jails (e.g. host is dual stack and prefers IPv6 but jail only has IPv4 and should prefer IPv4 replies to DNS lookups).

[markj]

sbin/sysctl/sysctl.c

252

When -j is used, I guess conffile is interpreted relative to the jail root. Is that what we want?

I'm not sure what the right default is. The patch gives the same behaviour as jexec foo sysctl ..., but then what's the point of having -j?

[zlei]

sbin/sysctl/sysctl.c

252

When -j is used, I guess conffile is interpreted relative to the jail root. Is that what we want?

Good question.

I'm not sure what the right default is. The patch gives the same behaviour as jexec foo sysctl ..., but then what's the point of having -j?

Given the man doc says:

-f filename
        Specify a file which contains a pair of name and value in each
        line.  sysctl reads and processes the specified file first and
        then processes the name and value pairs in the command line
        argument.

I think we should processes the file first, and then attach to the desired jail. This would ease the configuration of jails, say share sysctl.conf between jails.

How about this, let the order of -j jail and -f filename matters, i.e.,
sysctl -j foo -f sysctl.conf attach to jail first, but sysctl -f sysctl.conf -j foo process the file first ?

That is somewhat complex and a little confusing, so should be documented highlight and explicitly.

[markj]

sbin/sysctl/sysctl.c

252

How about this, let the order of -j jail and -f filename matters

IMO this is too subtle and unusual for a unix command-line utility. Options should be order-independent.

I suspect we should process the file, then attach to the jail.

[zlei]

Attach to jail after opening the config file.

[zlei]

Update the man page, add note about how the -f filename will be processed when -j jail option is provided.

[zlei]

sbin/sysctl/sysctl.8

107

I guess read -> opened is more clear.

[zlei]

@markj Does the latest revision look good to you ?

[markj]

sbin/sysctl/sysctl.c

603

IMO it would be cleaner to refactor this function first: have the caller open the file and pass in the file handle. Then the caller can do:

if (conffile)
     f = fopen(...)
attach_jail();
if (conffile)
    parsefile(f);

so we don't need multiple attach_jail() calls.

This version is okay though, I don't insist on changing anything.

[zlei]

sbin/sysctl/sysctl.c

603

Good idea !

[zlei]

sbin/sysctl/sysctl.c

603

IMO it would be cleaner to refactor this function first:

The refactoring is committed separated as 6193855fc76c .

Thanks for the reviewing !