summaryrefslogtreecommitdiffstats
path: root/etc/rc.d/jail
Commit message (Collapse)AuthorAgeFilesLines
* Allow osreldate and osrelease to be set per jailphk2015-10-201-0/+2
|
* Use read to parse a line instead of set.hrs2015-09-101-5/+4
| | | | MFC after: 3 days
* Fix a conversion error in rc.d/jailpeter2015-08-271-1/+1
|
* Un-revert the r278323 again - whatever Jenkins/kyua is up it, it hasjamie2015-02-101-2/+1
| | | | nothing to do with this.
* Revert the rc part of r278323 until I can figure out what Jenkins is doing.jamie2015-02-071-1/+2
|
* Add mount.procfs jail parameter, so procfs can be mounted when a prison'sjamie2015-02-061-3/+2
| | | | | | | | | root is in its fstab. Also fix a typo while I'm at it. PR: 197237 197066 MFC after: 3 days
* Temporarily remove the warning added r270781 - it prints the warningpeter2014-09-081-2/+0
| | | | | regardless of whether the usage is correct or not and this generates a LOT of noise, even when you have specified a mask.
* Fix a bug which prevented mount.fstab parameter from being convertedhrs2014-09-041-4/+4
| | | | | | when jail_JID_devfs_enable=NO. Spotted by: peter
* Fix typo: s/_maske/_mask/gjb2014-09-041-1/+1
| | | | | MFC after: 3 days Sponsored by: The FreeBSD Foundation
* - Add a warning message when an IPv6 address is specified with no prefixlen.hrs2014-08-291-21/+17
| | | | - Use a parameter argument in jls(8) instead of doing grep.
* Rev 256256 had an undocumented side effect of breaking existing behaviorpeter2013-12-081-2/+2
| | | | | | | | for ipv6 jails. Among the harmful side effects included putting a route to an entire /64 onto an interface even if you were in a smaller network - eg: /80. This broke the freebsd.org cluster hosted at ISC which has /80 networks.
* - Fix jail_parallel_start="YES".hrs2013-10-211-26/+60
| | | | | | - Fix ip[46].addr when interface parameter is not defined. Spotted by: rpaulo
* - Fix a bug which prevented jails from starting when $jail_conf was used andhrs2013-10-181-15/+26
| | | | | | | no jail name was specified. - Display error messages when start/stop fails. Reported by: swills
* - Fix "ifname|addr" syntax support in jail_{jname}_ip.hrs2013-10-151-17/+44
| | | | - Create /var/run/jail_{jname}.id because ezjail-admin depends on it.
* - Normalize jailname. "example.com" is converted to "example_com".hrs2013-10-141-20/+34
| | | | | | | | | - Fix a bug that some $jail_{jname}_foo variables did not work. - Fix a bug which prevented $jail_devfs_ruleset from working[1]. - Move $jail_parameters to the last of the configuraiton lines[1]. Reported by: Jase Thew[1] Approved by: re (glebius)
* - Add mount.fdescfs parameter to jail(8). This is similar tohrs2013-10-121-3/+2
| | | | | | | | | | mount.devfs but mounts fdescfs. The mount happens just after mount.devfs. - rc.d/jail now displays whole error message from jail(8) when a jail fails to start. Approved by: re (gjb)
* - Update rc.d/jail to use a jail(8) configuration file instead ofhrs2013-10-101-570/+299
| | | | | | | | | | | | command line options. The "jail_<jname>_*" rc.conf(5) variables for per-jail configuration are automatically converted to /var/run/jail.<jname>.conf before the jail(8) utility is invoked. This is transparently backward compatible. - Fix a minor bug in jail(8) which prevented it from returning false when jail -r failed. Approved by: re (glebius)
* Add a conditional sleep 1 in case we add any IPv6 addresses to interfaces.bz2013-01-171-1/+8
| | | | | | | | | Do this per jail started, not per address. This will allow DAD to complete and services to properly start. Before we have seen problems with services trying to start before the IPv6 address was available to use and thus erroring and failing to start. MFC after: 3 days
* Only pass ip[46].addr when _addrl contains a valueeadler2012-11-151-1/+2
| | | | | | | Submitted by: crees Reviewed by: Mike Jakubik <mike.jakubik@intertainservices.com> Approved by: cperciva MFC after: 2 weeks
* Simply things so that "#REQUIRE: FILESYSTEMS" means the fileobrien2012-09-111-1/+1
| | | | | | | | | | | systems are fully "ready to go". 'FILESYSTEMS' states: "This is a dummy dependency, for services which require file systems to be mounted before starting." However, we have 'var' which is was run after 'FILESYSTEMS' and can mount /var if it already isn't mounted. Furthermore, several scripts cannot use /var until 'cleanvar' has done its thing. Thus "FILESYSTEMS" hasn't really meant all critical file systems are fully usable.
* - Allow to pass extra parameters for each jails.kuriyama2012-08-191-5/+19
| | | | | | | - To achieve above, convert jail(8) invocation to use new style command line "-c" flag. Reviewed at: freebsd-jail@
* Move -n ${_jail} before ${_flags} so that any -n options in ${_flags}des2012-07-181-1/+1
| | | | will override ours instead of the other way around.
* Name jails automatically.des2012-07-041-1/+1
| | | | MFC after: 1 week
* When creating the jails /dev/log symlink, do it by full path to avoidbrooks2012-01-201-4/+1
| | | | | | | | | | creating stray "log" symlinks if the mount fails. That apparently happens in some ezjail configs. PR: conf/143084 Submitted by: Dirk Engling <erdgeist at erdgeist.org> Reviewed by: simon MFC after: 2 weeks
* Prepare for the removal of set_rcvar() by changing the rcvar=dougb2012-01-141-1/+1
| | | | | | | | | | | | | | | assignments to the literal values it would have returned. The concept of set_rcvar() was nice in theory, but the forks it creates are a drag on the startup process, which is especially noticeable on slower systems, such as embedded ones. During the discussion on freebsd-rc@ a preference was expressed for using ${name}_enable instead of the literal values. However the code portability concept doesn't really apply since there are so many other places where the literal name has to be searched for and replaced. Also, using the literal value is also a tiny bit faster than dereferencing the variables, and every little bit helps.
* Replace ${SYSCTL_W} with ${SYSCTL} in rc.d scripts, as they are identical.emaste2011-03-301-2/+2
| | | | | | This is a further clean up after r202988. SYSCTL_W is still initialized in rc.subr as some ports may still use it.
* Implement the idea of parallel-only-at-start-time in a cleaner, moredougb2010-03-071-15/+10
| | | | | | rc.d'ish way. Not objected to by: netchild
* Redirect stdin from /dev/null when starting a jail:netchild2010-03-051-2/+18
| | | | | | | | | | | | | | | | | | | | At least in RELENG_7 this fixes some start problems for some programs from the ports. It is also more correct, as a jail shall not expect input (interactivity) from the jail-host. Revert the current behavior of starting jails in the background and make it optional only for the start of jails (jail_parallell_start=YES in rc.conf): - The stop can not be done in the background, the system needs to wait until everything is stopped correctly before it can reboot or power down. - The start should not be done in parallel by default, this not only breaks POLA for people comming from RELENG_x, it may also break a dependency chain with other scripts in the jail-host, which need to do some stuff after the jails are up and running (e.g. hardlinking a mysql socket from one jail into another one). Discussed on: freebsd-jails@
* Execute the start/stop process of a jail in the background.remko2009-11-021-1/+1
| | | | | | | | | | | This will prevent that the script hangs during startup, which could cause annoying effects after rebooting for example. PR: kern/139422 Submitted by: Andrey Groshev <greenx at yartv dot ru> Approved by: imp (mentor, implicit) MFC after: 3 days Facilitated by: Snow B.V.
* Small cleanups to the jail script:ed2009-06-101-4/+3
| | | | | | | | | - Remove redundant debugging of consolelog. - Use `while :', instead of `while [ true ]'. This is done in other places as well. Submitted by: Jille Timmermans <jille quis cx> (not jilles) Reviewed by: jilles
* Added (pre|post)(start|stop) jail hooks. These can be used to runru2009-04-281-2/+108
| | | | | | | | arbitrary commands (outside the jail) associated with said events, e.g. to bring up/down CARP interfaces representing services run in jails. Reviewed by: simon
* Update jail startup script for multi-IPv4/v6/no-IP jails.bz2009-01-261-16/+208
| | | | | | | | | | | | | | | | | | | | | | | Note: this is only really necessary because of the ifconfig logic to add/remove the jail IPs upon start/stop. Consensus among simon and I is that the logic should really be factored out from the startup script and put into a proper management solution. - We now support starting of no-IP jails. - Remove the global jail_<jname>_netmask option as it is only helpful to set netmasks/prefixes for the right address family and per address. - Implement jail_<jname>_ip options to support both address familes with regard to ifconfig logic. - Implement _multi<n> support suffix to the jail_<jname>_ip option to configure additional addresses to avoid overlong, unreadbale jail_<jname>_ip lines with lots of addresses. Submitted by: initial work from Ruben van Staveren Discussed on: freebsd-jail in Nov 2008. Reviewed by: simon, ru (partial, older version) MFC after: 1 week
* Allow a jail's IP alias to be created with an arbitrary netmask.ru2008-09-241-1/+3
| | | | MFC after: 3 days
* Allow a jail to be started with a specific route fib.thompsa2008-09-161-1/+8
| | | | | Reviewed by: secteam (simon) Reviewed by: brooks, bz
* As previously discussed, add the svn:executable property to all scriptsdougb2008-07-161-0/+0
|
* Add warning about this script dealing with untrusted data.simon2008-01-131-0/+6
| | | | MFC after: 1 week
* Fix indentation.rse2007-05-241-1/+1
|
* Fix jail rc.d script privilege escalation via symlink attack againstsimon2007-01-111-12/+116
| | | | | | /var/log/console.log and mount points. Security: FreeBSD-SA-07:01.jail
* Jail_ip and jail_interface local variables were renamed to _ip and _interfaceflz2007-01-021-2/+2
| | | | | | | | in a previous commit to avoid namespace collisions, unfortunately I missed two of them. This leads to the ip alias being incorrectly removed in some cases when using the stop command. Reported by: Philipp Wuensche <cryx-freebsd@h3q.com>
* Add jail_<jname>_exec_afterstart<N> rc.conf variable, where <N> ismatteo2006-05-301-1/+35
| | | | | | | | | | 1,2 and so on. It specifies the command to be run as Nth after jail startup. sh(1)-fu by: Dario Freni PR: conf/97697 MFC after: 2 weeks Reviewed by: ru@ (man page)
* style(9)matteo2006-05-301-12/+12
|
* - Change the "jail_" prefix for internal script variables. This fixes anflz2006-05-111-93/+93
| | | | | | | | | | | | | issue where some global jail_* variables were overriden in the script. [1] - Change "jid" to "jname" in rc.conf(5), since it's more a jail name than a jail id. [1] - Update examples and comments in defaults/rc.conf to advertise new variables and the fact that some of the jail-specific variables may be made jail-global. [2] Reported by: pjd [1], clsung [2] Approved by: cperciva X-MFC after: i got sufficient testing from people using rc.d/jail
* if we fail to start a jail and jail_foobar_*fs_enable or ↵matteo2006-05-111-0/+4
| | | | | | jail_foobar_mount_enable were set, umount those filesystem before exiting. If we set up an alias for jail's IP, remove that alias before exiting. MFC after: 2 weeks
* if a jail fails to start, don't add its jid to /var/run and print a message ↵matteo2006-05-091-5/+10
| | | | | | | with the error. PR: conf/97024 MFC after: 1 week
* - Fix quoting.flz2006-05-081-2/+2
| | | | | Reported by: Dirk Engling <erdgeist@erdgeist.org> Pointyhat to: self
* - Check for some mandatory variables.flz2006-05-071-0/+11
| | | | | Approved by: cperciva (mentor) MFC after: 1 week
* - Add following global jail options, used if no jail-specific options areflz2006-04-081-9/+17
| | | | | | | | | | | | | | | | | | set: * jail_mount_enable * jail_devfs_ruleset * jail_devfs_enable * jail_fdescfs_enable * jail_procfs_enable * jail_fstab * jail_flags - Add a jail_interface / jail_<jid>_interface option. An ip alias will be created (jail_<jid>_ip) on jail_interface or jail_<jid>_interface if set. This is not a mandatory option. - Document all missing jail_* options in rc.conf(5). Approved by: cperciva (mentor) MFC after: 2 weeks
* Fix overriding jail_list from command line.fjoe2006-03-081-1/+3
| | | | MFC after: 3 days
* Skip jails which are already running and inform why.pjd2005-08-071-0/+4
| | | | | | | | | | | We're checking for /var/run/jail_<name>.id file and if it exists, we don't start the jail. It should be also safe in case of reboot(8), because rc.d/cleanvar script is going to remove /var/run/jail_* files. It helps to avoid potential mess when the same jail is started twice, because of an administrator mistake (been there, done that). MFC after: 1 week
* Allow to give more than one jail's name, eg.:pjd2005-08-071-2/+6
| | | | | | # /etc/rc.d/jail start www mail MFC after: 3 days
OpenPOWER on IntegriCloud