summaryrefslogtreecommitdiffstats
path: root/usr.sbin/jail
Commit message (Collapse)AuthorAgeFilesLines
* MFH: 285685araujo2016-02-241-1/+19
| | | | | | | | | | | Add support to the jail framework to be able to mount linsysfs(5) and linprocfs(5). PR: 207179 Requested by: thomas@gibfest.dk Reviewed by: jamie, bapt Approved by: re (gjb) Sponsored by: gandi.net Differential Revision: https://reviews.freebsd.org/D5390
* MFC r294183:jamie2016-01-212-18/+4
| | | | | | | | | | | | Clear errno before calling getpw*. MFC r294196: Don't bother checking an ip[46].addr netmask/prefixlen. This is already handled by ifconfig, and it was doing it wrong when the paramater included extra ifconfig options. PR: 205926
* MFC r289677:bdrewery2016-01-073-3/+3
| | | | Fix a ton of speelling errors
* MFC r285869.dru2015-08-031-1/+1
| | | | | | | Fix transposed words in man page. PR: 201752 Reviewed by: gjb
* MFC r285261, r285279:hrs2015-07-232-10/+16
| | | | | | | | | | | | | | | | | | | | | | | | - Fix offset calculation in variable substitution in jail.conf. The following did not work correctly: A="A_${B}_C_${D}" B="BBBBB" D="DDDD_${E}_FFFFF" E="EEEEE" - Implement PF_IMMUTABLE flag and apply it to "name" and "jid" in jail.conf parameters. This flag disallows redefinition of the parameter. "name" and/or "jid" are automatically defined in jail.conf by using the jail names at the front of jail parameter definitions. However, one could override them by using a variable with the same name like $name = "foo". This confused the parser and could end up with SIGSEGV. Note that this change also affects a case when all of parameters are defined in the command line arguments, not in jail.conf. Specifically, "jail -c name=j1 name=j2" no longer works. This should be harmless. Approved by: re (gjb)
* MFC r279361, r279395, r279396:ian2015-03-251-2/+10
| | | | | | | | | | | Allow the kern.osrelease and kern.osreldate sysctl values to be set in a jail's creation parameters. This allows the kernel version to be reliably spoofed within the jail whether examined directly with sysctl or indirectly with the uname -r and -K options. Export the new osreldate and osrelease jail parms in jail_get(2). Fix line wrap.
* MFC r278323:jamie2015-02-105-1/+44
| | | | | | | | | Add mount.procfs jail parameter, so procfs can be mounted when a prison's root is in its fstab. Also fix a typo while I'm at it. PR: 197237 197066
* MFC r277855:jamie2015-01-311-2/+10
| | | | | | | Add allow.mount.fdescfs jail flag. PR: 192951 Submitted by: ruben@verweg.com
* MFC r275906:jamie2014-12-271-0/+5
| | | | | | | | Setgid before running a command as a specified user. Previously only initgroups(3) was called, what isn't quite enough. This brings jail(8) in line with jexec(8), which was already doing the right thing. PR: 195984
* Merge r266206 from head (by bjk):gavin2014-08-141-98/+101
| | | | | | | | | | | | | | | | | | | | Review pass through jail.8 Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: 176832 [1]
* Merge r268488 from head:gavin2014-08-131-2/+3
| | | | | | | Reword an awkward option description PR: 191726 Submitted by: yaneurabeya gmail.com
* MFC r269522smh2014-08-113-17/+80
| | | | | | | | | | | | Added support for extra ifconfig args to jail ip4.addr & ip6.addr params This allows for CARP interfaces to be used in jails e.g. ip4.addr = "em0|10.10.1.20/32 vhid 1 pass MyPass advskew 100" r269340 will not be MFC'ed as mentioned due to the slim window and the amount of additional commits required to support it. Sponsored by: Multiplay
* MFC r261832-261834:zeising2014-03-061-3/+4
| | | | | | | | | | | | r261832: Add cross references between rc.conf(5) and jail.conf(5). r261833: Add commas (,) to the list in the SEE ALSO section, to match most other manuals. r261834: Bump .Dd forgotten in r261832.
* MFC 256385:hrs2013-10-125-6/+51
| | | | | | | | | | | - Add mount.fdescfs parameter to jail(8). This is similar to mount.devfs but mounts fdescfs. The mount happens just after mount.devfs. - rc.d/jail now displays whole error message from jail(8) when a jail fails to start. Approved by: re (gjb)
* - Update rc.d/jail to use a jail(8) configuration file instead ofhrs2013-10-101-4/+6
| | | | | | | | | | | | command line options. The "jail_<jname>_*" rc.conf(5) variables for per-jail configuration are automatically converted to /var/run/jail.<jname>.conf before the jail(8) utility is invoked. This is transparently backward compatible. - Fix a minor bug in jail(8) which prevented it from returning false when jail -r failed. Approved by: re (glebius)
* Allow tmpfs be mounted inside jail.delphij2013-08-231-1/+9
|
* Work around build breakages with GCC 4.2.jkim2013-05-231-0/+2
| | | | Reported by: tinderbox
* Improve compatibility with recent flex from flex.sourceforge.net.jkim2013-05-031-3/+3
|
* Add the Clang specific -Wmissing-variable-declarations to WARNS=6.ed2013-04-191-0/+2
| | | | | | | | | | | | | This compiler flag enforces that that people either mark variables static or use an external declarations for the variable, similar to how -Wmissing-prototypes works for functions. Due to the fact that Yacc/Lex generate code that cannot trivially be changed to not warn because of this (lots of yy* variables), add a NO_WMISSING_VARIABLE_DECLARATIONS that can be used to turn off this specific compiler warning. Announced on: toolchain@
* Reverse the order of some implicit commands (FS mounts and ifconfigs)jamie2013-03-283-7/+11
| | | | | | | | | when stopping jails. This matters particularly for nested filesystem mounts. PR: kern/177325 Submitted by: Harald Schmalzbauer MFC after: 3 days
* Handle (ignore) when a process disappears before it can be tracked.jamie2013-02-141-6/+9
|
* Move properly to the next parameter when jailparam_init failsjamie2012-10-041-0/+1
| | | | (i.e. on an unknown parameter), to avoid freeing bogus pointers.
* Warn about filesystem-based attacks.des2012-09-161-1/+9
|
* Partially roll back r239601 - keep parameter strings both length-delimitedjamie2012-08-231-4/+5
| | | | | | | | and null-terminated at the same time, because they're later passed to libjail as null-terminated. That means I also need to add a nul byte when comma-combining array parameters. MFC after: 6 days
* Pre-separate IP addresses passed on the command line, so they can bejamie2012-08-231-2/+26
| | | | | | | | properly parsed for interface prefixes and netmask suffixes. This was already done for the old-style (fixed) command line, but missed for the new-style. MFC after: 1 week
* Remember that I'm using length-defined strings in parameters:jamie2012-08-231-5/+3
| | | | | | | | | | | Remove a bogus null terminator when stripping the netmask from IP addresses. This was causing later addresses in a comma-separated string to disappear. Use memcpy instead of strcpy. This could just cause Bad Things. PR: 170832 MFC after: 1 week
* o Restore -u <username> getopt(3) flag somehow killed in r234712.maxim2012-06-281-1/+1
| | | | | | PR: bin/169490 Submitted by: amdmi3 MFC after: 2 weeks
* Minor spelling fixes.joel2012-06-032-2/+2
|
* When writing the jid via the -i flag, do it right when the jail is created,jamie2012-05-283-5/+7
| | | | before any commands run. /etc/rc.d/jail depends on this.
* Don't try to set a null TERM environment.jamie2012-05-251-1/+2
| | | | Submitted by: Mateusz Guzik <mjguzik gmail.com>
* Fixes to man8 groff mandoc style, usage mistakes, or typos.wblock2012-05-241-4/+5
| | | | | | | PR: 168016 Submitted by: Nobuyuki Koganemaru Approved by: gjb MFC after: 3 days
* Note that the new jail(8) will be appearing in 9.1.jamie2012-05-232-4/+4
|
* Fix world after byacc import:bapt2012-05-222-1/+2
| | | | | | | | - old yacc(1) use to magicially append stdlib.h, while new one don't - new yacc(1) do declare yyparse by itself, fix redundant declaration of 'yyparse' Approved by: des (mentor)
* Remove end of line whitespace.joel2012-05-121-3/+3
|
* General mdoc(7) and typo fixes.gjb2012-05-121-5/+5
| | | | | | PR: 167804 Submitted by: Nobuyuki Koganemaru (kogane!jp.freebsd.org) MFC after: 3 days
* mdoc: remove redundant Pp and end a display block with Ed.joel2012-05-121-1/+1
|
* Fix .Pp macro.joel2012-05-111-1/+1
|
* Add a meta-parameter IP__NULL to enum intparam, instead of mixingjamie2012-05-034-10/+11
| | | | | | enum values and zeroes. This keeps clang happy (and is just good form). Submitted by: dim
* Add YY_NO_INPUT so clang doesn't complain about "input" not being used.jamie2012-05-021-0/+1
|
* Fix the dates and history as of the move to HEAD.jamie2012-04-271-3/+3
|
* A new jail(8) with a configuration file, ultimately to replace the workjamie2012-04-2610-635/+4377
|\ | | | | | | | | | | currently done by /etc/rc.d/jail. MFC after: 3 months
| * Use the defvs_ruleset paramater when mounting a jail's /dev,jamie2012-02-274-22/+17
| | | | | | | | instead of a mount.devfs.ruleset pseudo-parameter.
| * From r224286:jamie2012-02-271-3/+57
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Document the potential for jail escape. From r224615: Always disable mount and unmount for jails with enforce_statfs==2. From r231267: A new jail(8) option "devfs_ruleset" defines the ruleset enforcement for mounting devfs inside jails. A value of -1 disables mounting devfs in jails, a value of zero means no restrictions. Nested jails can only have mounting devfs disabled or inherit parent's enforcement as jails are not allowed to view or manipulate devfs(8) rules. From r232059: To improve control over the use of mount(8) inside a jail(8), introduce a new jail parameter node with the following parameters: allow.mount.devfs: allow mounting the devfs filesystem inside a jail allow.mount.nullfs: allow mounting the nullfs filesystem inside a jail From r232186: allow.mount.zfs: allow mounting the zfs filesystem inside a jail
| * Improvements in error messages:jamie2012-02-084-18/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Some errors printed the jail name for unnamed (command line) jails. Attempting to create an already-existing jail from the command line returned with no error (even for non-root) due to bad logic in start_state. Ignore kvm_proc errors, which are typically caused by permission problems. Instead, stop ignoring permission errors when removing a jail (but continue to silently ignore other errors, i.e. the jail no longer existing). This makes non-root attempts at removing a jail give a clearer error message.
| * Allow relative pathnames for jails generated on the command linejamie2012-02-071-1/+1
| | | | | | | | (but continue to flag when from a config file).
| * Better communicate the purpose of "-r *".jamie2012-01-311-2/+4
| |
| * Don't report errors for the exit status of processes that are killedjamie2011-07-061-6/+10
| | | | | | | | | | | | | | | | as part of jail removal (IP_STOP_TIMEOUT). Note a jail as "removed" even if it wasn't jail_remove() that did the deed, e.g. if it already went away because all its processes were killed.
| * Advance to the next command before running anything, so errors found injamie2011-06-222-48/+40
| | | | | | | | | | | | | | | | finish_command can be processed properly. Call failed() once in next_command() instead of multiple times in run_command(). Continue processing commands when a no-wait operation (IP__OP or background command) succeeds.
| * Fix a couple of NULL dereferences.jamie2011-06-211-4/+4
| |
| * Following r222465:jamie2011-06-205-64/+119
| | | | | | | | | | | | Check for IPv4 or IPv6 to be available by the kernel to not provoke errors trying to query options not available. Make it possible to compile out INET or INET6 only parts.
OpenPOWER on IntegriCloud