MFC r308443, r308459, r308462, r308478, r308786

r308443:
Add -d flag that prints domain only.

PR:		212875
Submitted by:	Ben RUBSON <ben.rubson@gmail.com>
Reviewed by:	pi

r308459:
Fix missing '-' for the flags -s and -d on both manpage and usage.

Reported by:	garga, bde

r308462:
Add flag -B which does the same like batch mode but without exiting after
print. Also add a new flag -s that add blocks size to statistics.

PR:		198347, 212726
Submitted by:	Ben RUBSON <ben.rubson@gmail.com>
Tested by:	pi
MFC After:	2 weeks.

r308478:
We can't use protect(1) inside a jail(8)!
To avoid have warning for services that are using oomprotect, oomprotect
will only be applied on services that won't run inside jails.

Reported by:	allanjude
MFC after:	2 weeks.

r308786:
rc.subr: Swap checks so we only fork sysctl if *_oomprotect is set.

1 files changed, 12 insertions, 12 deletions

diff --git a/etc/rc.subr b/etc/rc.subr
index 8da111a..4b8cbaa 100644
--- a/etc/rc.subr
+++ b/etc/rc.subr
@@ -1205,18 +1205,18 @@ $command $rc_flags $command_args"
 		# Apply protect(1) to the PID if ${name}_oomprotect is set.
 		case "$rc_arg" in
 		start)
-			if [ -n "$_oomprotect" ]; then
-				if [ -f "${PROTECT}" ]; then
-					pid=$(check_process $command)
-					case $_oomprotect in
-					[Aa][Ll][Ll])
-						${PROTECT} -i -p ${pid}
-						;;
-					[Yy][Ee][Ss])
-						${PROTECT} -p ${pid}
-						;;
-					esac
-				fi
+			# We cannot use protect(1) inside jails.
+			if [ -n "$_oomprotect" ] && [ -f "${PROTECT}" ] &&
+			    [ "$(sysctl -n security.jail.jailed)" -eq 0 ]; then
+				pid=$(check_process $command)
+				case $_oomprotect in
+				[Aa][Ll][Ll])
+					${PROTECT} -i -p ${pid}
+					;;
+				[Yy][Ee][Ss])
+					${PROTECT} -p ${pid}
+					;;
+				esac
 			fi	
 		;;
 		esac