Page MenuHomeFreeBSD
Paste P562

rc.d/jail by antranigv
ActivePublic
Actions

Authored by antranigv_freebsd.am on Feb 28 2023, 5:42 PM.
Project Tags
None
Referenced Files
F57147944: rc.d/jail by antranigv
Feb 28 2023, 5:42 PM
Subscribers
None
#!/bin/sh
#
# $FreeBSD$
#
# PROVIDE: jail
# REQUIRE: LOGIN FILESYSTEMS
# BEFORE: securelevel
# KEYWORD: shutdown
. /etc/rc.subr
## Note from antranigv
#
#### Terminology
# jail.conf means the config format of jail.conf
# /etc/jail.conf is the file itself
# /etc/jail.*.conf is any file that matches that pattern
# /etc/jail.conf.d/*.conf is any file that matches that pattern
# "something" parameters means a parameters named "something" in jail.conf
# "something=" is a parameter inside rc.conf
# I know, I'm mostly repeating myself, but some people are new to this :)
#
#### Regarding jail file management ->
# If you are reading this, then I've sent you this file for testing. Currently,
# we need to test the following scenarios.
# 1. a jail exists in /etc/jail.conf
# 2. #1 + a jail in /etc/jail.anotherjail.conf
# 3. #2 + a jail in /etc/jail.conf.d/yetanother.conf
# 4. #3 + a jail at one of the jail.conf locations, that depends on another jail
# using the "depend" parameter. Read more in jail(8), jail parameters.
# 5. The above, used with/without "jail_parallel_start=" and/or "jail_reverse_stop="
#
# Technically, this rc.d/jail should be able to "merge" global configs from
# /etc/jail.conf. Meaning, you can have your global vars in /etc/jail.conf and
# the rest should be in their own files, without any global configs.
#
#### Regarding jail_list, "depend" parameter and start order ->
# Before this patch, only the jails in /etc/jail.conf start
# automatically if no jail is defined in "jail_list=".
#
# With this patch, all jails in /etc/jail.conf, /etc/jail.*.conf and
# /etc/jail.conf.d/*.conf start automatically.
#
# Again, if "jail_list=" is defined, then only those jails would start.
#
# That being said, the best practice would be to define global variables in
# /etc/jail.conf, and have a config file of each jail in
# /etc/jail.conf.d/somejail.conf; this will give you the ability to do
# mv /etc/jail.conf.d/somejail.conf /etc/jail.conf.d/somejail.conf.dis
# which will disable the jail.
#
# ==> CAREFUL! always disable/edit the jail when it's NOT running, otherwise your
# cleanup commands might not work.
#
#
# You may file this script in patch/diff format at https://reviews.freebsd.org/P561
#
# Thank you for testing, if you have any more feedback, please email me at
# jailtest@freebsd.am ; suggestions and bug reports are very welcome.
# -- antranigv
name="jail"
desc="Manage system jails"
rcvar="jail_enable"
start_cmd="jail_start"
start_postcmd="jail_warn"
stop_cmd="jail_stop"
config_cmd="jail_config"
console_cmd="jail_console"
status_cmd="jail_status"
extra_commands="config console status"
: ${jail_program:=/usr/sbin/jail}
: ${jail_consolecmd:=/usr/bin/login -f root}
: ${jail_jexec:=/usr/sbin/jexec}
: ${jail_jls:=/usr/sbin/jls}
need_dad_wait=
# extract_var jv name param num defval
# Extract value from ${jail_$jv_$name} or ${jail_$name} and
# set it to $param. If not defined, $defval is used.
# When $num is [0-9]*, ${jail_$jv_$name$num} are looked up and
# $param is set by using +=. $num=0 is optional (params may start at 1).
# When $num is YN or NY, the value is interpreted as boolean.
# When $num is @, the value is interpreted as an array separted by IFS.
extract_var()
{
local i _jv _name _param _num _def _name1 _name2
_jv=$1
_name=$2
_param=$3
_num=$4
_def=$5
case $_num in
YN)
_name1=jail_${_jv}_${_name}
_name2=jail_${_name}
eval $_name1=\"\${$_name1:-\${$_name2:-$_def}}\"
if checkyesno $_name1; then
echo " $_param = 1;"
else
echo " $_param = 0;"
fi
;;
NY)
_name1=jail_${_jv}_${_name}
_name2=jail_${_name}
eval $_name1=\"\${$_name1:-\${$_name2:-$_def}}\"
if checkyesno $_name1; then
echo " $_param = 0;"
else
echo " $_param = 1;"
fi
;;
[0-9]*)
i=$_num
while : ; do
_name1=jail_${_jv}_${_name}${i}
_name2=jail_${_name}${i}
eval _tmpargs=\"\${$_name1:-\${$_name2:-$_def}}\"
if [ -n "$_tmpargs" ]; then
echo " $_param += \"$_tmpargs\";"
elif [ $i != 0 ]; then
break;
fi
i=$(($i + 1))
done
;;
@)
_name1=jail_${_jv}_${_name}
_name2=jail_${_name}
eval _tmpargs=\"\${$_name1:-\${$_name2:-$_def}}\"
set -- $_tmpargs
if [ $# -gt 0 ]; then
echo -n " $_param = "
while [ $# -gt 1 ]; do
echo -n "\"$1\", "
shift
done
echo "\"$1\";"
fi
;;
*)
_name1=jail_${_jv}_${_name}
_name2=jail_${_name}
eval _tmpargs=\"\${$_name1:-\${$_name2:-$_def}}\"
if [ -n "$_tmpargs" ]; then
echo " $_param = \"$_tmpargs\";"
fi
;;
esac
}
# parse_options _j _jv
# Parse options and create a temporary configuration file if necessary.
#
parse_options()
{
local _j _jv _p
_j=$1
_jv=$2
_confwarn=0
if [ -z "$_j" ]; then
warn "parse_options: you must specify a jail"
return
fi
eval _jconf=\"\${jail_${_jv}_conf:-/etc/jail.${_j}.conf}\"
eval _rootdir=\"\$jail_${_jv}_rootdir\"
eval _jconfdir=\"/etc/jail.conf.d/${_j}.conf\"
eval _hostname=\"\$jail_${_jv}_hostname\"
if [ -z "$_rootdir" -o \
-z "$_hostname" ]; then
if [ -r "$_jconf" ]; then
_conf="$_jconf"
return 0
elif [ -r "$_jconfdir" ]; then
_conf="$_jconfdir"
return 0
elif [ -r "$jail_conf" ]; then
_conf="$jail_conf"
return 0
else
warn "Invalid configuration for $_j " \
"(no jail.conf, no hostname, or no path). " \
"Jail $_j was ignored."
fi
return 1
fi
eval _ip=\"\$jail_${_jv}_ip\"
if [ -z "$_ip" ] && ! check_kern_features vimage; then
warn "no ipaddress specified and no vimage support. " \
"Jail $_j was ignored."
return 1
fi
_conf=/var/run/jail.${_j}.conf
#
# To relieve confusion, show a warning message.
#
: ${jail_confwarn:=YES}
checkyesno jail_confwarn && _confwarn=1
if [ -r "$jail_conf" -o -r "$_jconf" ]; then
if ! checkyesno jail_parallel_start; then
warn "$_conf is created and used for jail $_j."
fi
fi
/usr/bin/install -m 0644 -o root -g wheel /dev/null $_conf || return 1
eval : \${jail_${_jv}_flags:=${jail_flags}}
eval _exec=\"\$jail_${_jv}_exec\"
eval _exec_start=\"\$jail_${_jv}_exec_start\"
eval _exec_stop=\"\$jail_${_jv}_exec_stop\"
if [ -n "${_exec}" ]; then
# simple/backward-compatible execution
_exec_start="${_exec}"
_exec_stop=""
else
# flexible execution
if [ -z "${_exec_start}" ]; then
_exec_start="/bin/sh /etc/rc"
if [ -z "${_exec_stop}" ]; then
_exec_stop="/bin/sh /etc/rc.shutdown jail"
fi
fi
fi
eval _interface=\"\${jail_${_jv}_interface:-${jail_interface}}\"
eval _parameters=\"\${jail_${_jv}_parameters:-${jail_parameters}}\"
eval _fstab=\"\${jail_${_jv}_fstab:-${jail_fstab:-/etc/fstab.$_j}}\"
(
date +"# Generated by rc.d/jail at %Y-%m-%d %H:%M:%S"
echo "$_j {"
extract_var $_jv hostname host.hostname - ""
extract_var $_jv rootdir path - ""
if [ -n "$_ip" ]; then
extract_var $_jv interface interface - ""
jail_handle_ips_option $_ip $_interface
alias=0
while : ; do
eval _x=\"\$jail_${_jv}_ip_multi${alias}\"
[ -z "$_x" ] && break
jail_handle_ips_option $_x $_interface
alias=$(($alias + 1))
done
case $need_dad_wait in
1)
# Sleep to let DAD complete before
# starting services.
echo " exec.start += \"sleep " \
$(($(${SYSCTL_N} net.inet6.ip6.dad_count) + 1)) \
"\";"
;;
esac
# These are applicable only to non-vimage jails.
extract_var $_jv fib exec.fib - ""
extract_var $_jv socket_unixiproute_only \
allow.raw_sockets NY YES
else
echo " vnet;"
extract_var $_jv vnet_interface vnet.interface @ ""
fi
echo " exec.clean;"
echo " exec.system_user = \"root\";"
echo " exec.jail_user = \"root\";"
extract_var $_jv exec_prestart exec.prestart 0 ""
extract_var $_jv exec_poststart exec.poststart 0 ""
extract_var $_jv exec_prestop exec.prestop 0 ""
extract_var $_jv exec_poststop exec.poststop 0 ""
echo " exec.start += \"$_exec_start\";"
extract_var $_jv exec_afterstart exec.start 0 ""
echo " exec.stop = \"$_exec_stop\";"
extract_var $_jv consolelog exec.consolelog - \
/var/log/jail_${_j}_console.log
if [ -r $_fstab ]; then
echo " mount.fstab = \"$_fstab\";"
fi
eval : \${jail_${_jv}_devfs_enable:=${jail_devfs_enable:-NO}}
if checkyesno jail_${_jv}_devfs_enable; then
echo " mount.devfs;"
eval _ruleset=\${jail_${_jv}_devfs_ruleset:-${jail_devfs_ruleset}}
case $_ruleset in
"") ;;
[0-9]*) echo " devfs_ruleset = \"$_ruleset\";" ;;
devfsrules_jail)
# XXX: This is the default value,
# Let jail(8) to use the default because
# mount(8) only accepts an integer.
# This should accept a ruleset name.
;;
*) warn "devfs_ruleset must be an integer." ;;
esac
fi
eval : \${jail_${_jv}_fdescfs_enable:=${jail_fdescfs_enable:-NO}}
if checkyesno jail_${_jv}_fdescfs_enable; then
echo " mount.fdescfs;"
fi
eval : \${jail_${_jv}_procfs_enable:=${jail_procfs_enable:-NO}}
if checkyesno jail_${_jv}_procfs_enable; then
echo " mount.procfs;"
fi
eval : \${jail_${_jv}_mount_enable:=${jail_mount_enable:-NO}}
if checkyesno jail_${_jv}_mount_enable; then
echo " allow.mount;"
fi
extract_var $_jv set_hostname_allow allow.set_hostname YN NO
extract_var $_jv sysvipc_allow allow.sysvipc YN NO
extract_var $_jv enforce_statfs enforce_statfs - 2
extract_var $_jv osreldate osreldate
extract_var $_jv osrelease osrelease
for _p in $_parameters; do
echo " ${_p%\;};"
done
echo "}"
) >> $_conf
return 0
}
# jail_extract_address argument iface
# The second argument is the string from one of the _ip
# or the _multi variables. In case of a comma separated list
# only one argument must be passed in at a time.
# The function alters the _type, _iface, _addr and _mask variables.
#
jail_extract_address()
{
local _i _interface
_i=$1
_interface=$2
if [ -z "${_i}" ]; then
warn "jail_extract_address: called without input"
return
fi
# Check if we have an interface prefix given and split into
# iFace and rest.
case "${_i}" in
*\|*) # ifN|.. prefix there
_iface=${_i%%|*}
_r=${_i##*|}
;;
*) _iface=""
_r=${_i}
;;
esac
# In case the IP has no interface given, check if we have a global one.
_iface=${_iface:-${_interface}}
# Set address, cut off any prefix/netmask/prefixlen.
_addr=${_r}
_addr=${_addr%%[/ ]*}
# Theoretically we can return here if interface is not set,
# as we only care about the _mask if we call ifconfig.
# This is not done because we may want to santize IP addresses
# based on _type later, and optionally change the type as well.
# Extract the prefix/netmask/prefixlen part by cutting off the address.
_mask=${_r}
_mask=`expr -- "${_mask}" : "${_addr}\(.*\)"`
# Identify type {inet,inet6}.
case "${_addr}" in
*\.*\.*\.*) _type="inet" ;;
*:*) _type="inet6" ;;
*) warn "jail_extract_address: type not identified"
;;
esac
# Handle the special /netmask instead of /prefix or
# "netmask xxx" case for legacy IP.
# We do NOT support shortend class-full netmasks.
if [ "${_type}" = "inet" ]; then
case "${_mask}" in
/*\.*\.*\.*) _mask=" netmask ${_mask#/}" ;;
*) ;;
esac
# In case _mask is still not set use /32.
_mask=${_mask:-/32}
elif [ "${_type}" = "inet6" ]; then
# In case _mask is not set for IPv6, use /128.
_mask=${_mask:-/128}
fi
}
# jail_handle_ips_option input iface
# Handle a single argument imput which can be a comma separated
# list of addresses (theoretically with an option interface and
# prefix/netmask/prefixlen).
#
jail_handle_ips_option()
{
local _x _type _i _defif
_x=$1
_defif=$2
if [ -z "${_x}" ]; then
# No IP given. This can happen for the primary address
# of each address family.
return
fi
# Loop, in case we find a comma separated list, we need to handle
# each argument on its own.
while [ ${#_x} -gt 0 ]; do
case "${_x}" in
*,*) # Extract the first argument and strip it off the list.
_i=`expr -- "${_x}" : '^\([^,]*\)'`
_x=`expr -- "${_x}" : "^[^,]*,\(.*\)"`
;;
*) _i=${_x}
_x=""
;;
esac
_type=""
_addr=""
_mask=""
_iface=""
jail_extract_address $_i $_defif
# make sure we got an address.
case $_addr in
"") continue ;;
*) ;;
esac
# Append address to list of addresses for the jail command.
case $_type in
inet)
echo " ip4.addr += \"${_iface:+${_iface}|}${_addr}${_mask}\";"
;;
inet6)
echo " ip6.addr += \"${_iface:+${_iface}|}${_addr}${_mask}\";"
need_dad_wait=1
;;
esac
done
}
jail_config()
{
local _j _jv
case $1 in
_ALL) return ;;
esac
for _j in $@; do
_j=$(echo $_j | tr /. _)
_jv=$(echo -n $_j | tr -c '[:alnum:]' _)
if parse_options $_j $_jv; then
echo "$_j: parameters are in $_conf."
fi
done
}
jail_console()
{
local _j _jv _cmd
# One argument that is not _ALL.
case $#:$1 in
0:*|1:_ALL) err 3 "Specify a jail name." ;;
1:*) ;;
esac
_j=$(echo $1 | tr /. _)
_jv=$(echo -n $1 | tr -c '[:alnum:]' _)
shift
case $# in
0) eval _cmd=\${jail_${_jv}_consolecmd:-$jail_consolecmd} ;;
*) _cmd=$@ ;;
esac
$jail_jexec $_j $_cmd
}
jail_status()
{
$jail_jls -N
}
jail_start()
{
local _j _jv _jid _id _name
if [ $# = 0 ]; then
return
fi
startmsg -n 'Starting jails:'
case $1 in
_ALL)
command=$jail_program
rc_flags=$jail_flags
command_args='-f - -c'
if ! checkyesno jail_parallel_start; then
command_args="$command_args -p1"
fi
_tmp=`mktemp -t jail` || exit 3
if cat $jail_conf $jail_conf_dir/*.conf \
/etc/jail.*.conf 2>/dev/null | \
$command $rc_flags $command_args >> $_tmp 2>&1; then
$jail_jls jid name | while read _id _name; do
startmsg -n " $_name"
echo $_id > /var/run/jail_${_name}.id
done
else
cat $_tmp
fi
rm -f $_tmp
startmsg '.'
return
;;
esac
if checkyesno jail_parallel_start; then
#
# Start jails in parallel and then check jail id when
# jail_parallel_start is YES.
#
for _j in $@; do
_j=$(echo $_j | tr /. _)
_jv=$(echo -n $_j | tr -c '[:alnum:]' _)
parse_options $_j $_jv || continue
eval rc_flags=\${jail_${_jv}_flags:-$jail_flags}
eval command=\${jail_${_jv}_program:-$jail_program}
command_args="-i -f - -c $_j"
(
_tmp=`mktemp -t jail_${_j}` || exit 3
if cat $jail_conf $_conf $jail_conf_dir/*.conf \
/etc/jail.*.conf 2>/dev/null | \
$command $rc_flags $command_args \
>> $_tmp 2>&1 </dev/null; then
startmsg -n " ${_hostname:-${_j}}"
_jid=$($jail_jls -j $_j jid)
echo $_jid > /var/run/jail_${_j}.id
else
startmsg " cannot start jail " \
"\"${_hostname:-${_j}}\": "
cat $_tmp
fi
rm -f $_tmp
) &
done
wait
else
#
# Start jails one-by-one when jail_parallel_start is NO.
#
for _j in $@; do
_j=$(echo $_j | tr /. _)
_jv=$(echo -n $_j | tr -c '[:alnum:]' _)
parse_options $_j $_jv || continue
eval rc_flags=\${jail_${_jv}_flags:-$jail_flags}
eval command=\${jail_${_jv}_program:-$jail_program}
command_args="-i -f - -c"
_tmp=`mktemp -t jail` || exit 3
if (cat $_conf $jail_conf $jail_conf_dir/*.conf \
/etc/jail.*.conf 2>/dev/null | \
$command $rc_flags $command_args $_j) \
>> $_tmp 2>&1 </dev/null; then
startmsg -n " ${_hostname:-${_j}}"
_jid=$($jail_jls -j $_j jid)
echo $_jid > /var/run/jail_${_j}.id
else
startmsg " cannot start jail " \
"\"${_hostname:-${_j}}\": "
cat $_tmp
fi
rm -f $_tmp
done
fi
startmsg '.'
}
jail_stop()
{
local _j _jv
if [ $# = 0 ]; then
return
fi
echo -n 'Stopping jails:'
case $1 in
_ALL)
command=$jail_program
rc_flags=$jail_flags
command_args='-f - -r'
if checkyesno jail_reverse_stop; then
$jail_jls name | tail -r
else
$jail_jls name
fi | while read _j; do
echo -n " $_j"
_tmp=`mktemp -t jail` || exit 3
cat $jail_conf $jail_conf_dir/*.conf \
/etc/jail.*.conf 2>/dev/null | \
$command $rc_flags $command_args $_j >> $_tmp 2>&1
if $jail_jls -j $_j > /dev/null 2>&1; then
cat $_tmp
else
rm -f /var/run/jail_${_j}.id
fi
rm -f $_tmp
done
echo '.'
return
;;
esac
checkyesno jail_reverse_stop && set -- $(reverse_list $@)
for _j in $@; do
_j=$(echo $_j | tr /. _)
_jv=$(echo -n $_j | tr -c '[:alnum:]' _)
parse_options $_j $_jv || continue
if ! $jail_jls -j $_j > /dev/null 2>&1; then
continue
fi
eval command=\${jail_${_jv}_program:-$jail_program}
echo -n " ${_hostname:-${_j}}"
_tmp=`mktemp -t jail` || exit 3
cat $_conf $jail_conf $jail_conf_dir/*.conf \
/etc/jail.*.conf 2>/dev/null | \
$command -q -f - -r $_j >> $_tmp 2>&1
if $jail_jls -j $_j > /dev/null 2>&1; then
cat $_tmp
else
rm -f /var/run/jail_${_j}.id
fi
rm -f $_tmp
done
echo '.'
}
jail_warn()
{
# To relieve confusion, show a warning message.
case $_confwarn in
1) warn "Per-jail configuration via jail_* variables " \
"is obsolete. Please consider migrating to $jail_conf."
;;
esac
}
load_rc_config $name
case $# in
1) run_rc_command $@ ${jail_list:-_ALL} ;;
*) jail_reverse_stop="no"
run_rc_command $@ ;;
esac