summaryrefslogtreecommitdiffstats
path: root/usr.sbin/jail
Commit message (Collapse)AuthorAgeFilesLines
* Update dependencies after r291406 added libelf to libkvm.bdrewery2015-12-011-0/+1
| | | | | | | | Unfortunately filemon/meta mode tracks all indirect dependencies here since ld(1) is reading libelf when linking in libkvm. Churn would be reduced if this was able to be limited to direct dependencies. Sponsored by: EMC / Isilon Storage Division
* Fix a ton of speelling errorseadler2015-10-213-3/+3
| | | | | | | arc lint is helpful Reviewed By: allanjude, wblock, #manpages, chris@bsdjunk.com Differential Revision: https://reviews.freebsd.org/D3337
* Fix transposed words in man page.dru2015-07-251-1/+1
| | | | | | | PR: 201752 Reviewed by: bcr MFC after: 3 days Sponsored by: Essen FreeBSD Hackathon
* Add support to the jail framework to be able to mount linsysfs(5) andaraujo2015-07-191-1/+19
| | | | | | | | linprocfs(5). Differential Revision: D2846 Submitted by: Nikolai Lifanov <lifanov@mail.lifanov.com> Reviewed by: jamie
* Implement PF_IMMUTABLE flag and apply it to "name" and "jid" inhrs2015-07-082-2/+8
| | | | | | | | | | | | | | | | | jail.conf parameters. This flag disallows redefinition of the parameter. "name" and/or "jid" are automatically defined in jail.conf by using the jail names at the front of jail parameter definitions. However, one could override them by using a variable with the same name like $name = "foo". This confused the parser and could end up with SIGSEGV. Note that this change also affects a case when all of parameters are defined in the command line arguments, not in jail.conf. Specifically, "jail -c name=j1 name=j2" no longer works. This should be harmless. PR: 196574 Reviewed by: jamie Differential Revision: https://reviews.freebsd.org/D3017
* Fix offset calculation in variable substitutionhrs2015-07-081-8/+8
| | | | | | | | | | | | | in jail.conf. The following did not work correctly: A="A_${B}_C_${D}" B="BBBBB" D="DDDD_${E}_FFFFF" E="EEEEE" PR: 189139 Reviewed by: jamie Differential Revision: https://reviews.freebsd.org/D3018
* Add META_MODE support.sjg2015-06-131-0/+30
|\ | | | | | | | | | | | | | | | | | | | | Off by default, build behaves normally. WITH_META_MODE we get auto objdir creation, the ability to start build from anywhere in the tree. Still need to add real targets under targets/ to build packages. Differential Revision: D2796 Reviewed by: brooks imp
| * dirdeps.mk now sets DEP_RELDIRsjg2015-06-081-2/+0
| |
| * Merge sync of headsjg2015-05-278-74/+135
| |\ | |/ |/|
| * Merge from head@274682sjg2014-11-193-17/+80
| |\
| * \ Merge head from 7/28sjg2014-08-191-102/+106
| |\ \
| * | | Updated dependenciessjg2014-05-161-1/+0
| | | |
| * | | Updated dependenciessjg2014-05-101-0/+2
| | | |
| * | | Merge from headsjg2014-05-081-1/+1
| |\ \ \
| * \ \ \ Merge headsjg2014-04-286-11/+58
| |\ \ \ \
| * \ \ \ \ Merge head@256284sjg2013-10-131-4/+6
| |\ \ \ \ \
| * \ \ \ \ \ Merge from headsjg2013-09-053-4/+16
| |\ \ \ \ \ \
| * \ \ \ \ \ \ sync from headsjg2013-04-123-13/+20
| |\ \ \ \ \ \ \
| * | | | | | | | Updated dependenciessjg2013-03-111-0/+2
| | | | | | | | |
| * | | | | | | | Updated dependenciessjg2013-02-161-2/+0
| | | | | | | | |
| | | | | | | | |
| | \ \ \ \ \ \ \
| | \ \ \ \ \ \ \
| | \ \ \ \ \ \ \
| *---. \ \ \ \ \ \ \ Sync from headsjg2012-11-044-13/+45
| |\ \ \ \ \ \ \ \ \ \
| * | | | | | | | | | | Sync FreeBSD's bmake branch with Juniper's internal bmake branch.marcel2012-08-221-0/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Requested by: Simon Gerraty <sjg@juniper.net>
* | | | | | | | | | | | Fix minor mdoc issues.joel2015-04-241-1/+0
| | | | | | | | | | | |
* | | | | | | | | | | | Fix typo in jail(8) man pageallanjude2015-03-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | PR: 198790 Differential Revision: https://reviews.freebsd.org/D2111 Submitted by: Jimmy Olgeni Approved by: wblock (mentor) Sponsored by: ScaleEngine Inc.
* | | | | | | | | | | | Allow the kern.osrelease and kern.osreldate sysctl values to be set in aian2015-02-271-2/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | jail's creation parameters. This allows the kernel version to be reliably spoofed within the jail whether examined directly with sysctl or indirectly with the uname -r and -K options. The values can only be set at jail creation time, to eliminate the need for any locking when accessing the values via sysctl. The overridden values are inherited by nested jails (unless the config for the nested jails also overrides the values). There is no sanity or range checking, other than disallowing an empty release string or a zero release date, by design. The system administrator is trusted to set sane values. Setting values that are newer than the actual running kernel will likely cause compatibility problems. Differential Revision: https://reviews.freebsd.org/D1948 Relnotes: yes
* | | | | | | | | | | | Add mount.procfs jail parameter, so procfs can be mounted when a prison'sjamie2015-02-065-1/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | root is in its fstab. Also fix a typo while I'm at it. PR: 197237 197066 MFC after: 3 days
* | | | | | | | | | | | Add allow.mount.fdescfs jail flag.jamie2015-01-281-2/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | PR: 192951 Submitted by: ruben@verweg.com MFC after: 3 days
* | | | | | | | | | | | mdoc: sort SEE ALSO.joel2014-12-261-1/+1
| | | | | | | | | | | |
* | | | | | | | | | | | Setgid before running a command as a specified user. Previously onlyjamie2014-12-181-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | initgroups(3) was called, what isn't quite enough. This brings jail(8) in line with jexec(8), which was already doing the right thing. PR: 195984 MFC after: 1 week
* | | | | | | | | | | | In preparation for using clang's -Wcast-qual:jamie2014-11-253-67/+65
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use __DECONST (instead of my own attempted re-invention) for the iov parameters to jail_get/set(2). Similarly remove the decost-ish hack from execvp's argv, except the __DECONST is only added at very end. While I'm at it, remove an unused variable and fix a comment typo.
* | | | | | | | | | | | Convert usr.sbin to LIBADDbapt2014-11-251-2/+1
| |_|_|_|_|_|_|_|_|_|/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Reduce overlinking
* | | | | | | | | | | Added support for extra ifconfig args to jail ip4.addr & ip6.addr paramssmh2014-08-043-17/+80
| |_|_|_|_|_|_|_|_|/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This allows for CARP interfaces to be used in jails e.g. ip4.addr = "em0|10.10.1.20/32 vhid 1 pass MyPass advskew 100" Before this change using exec.prestart to configure a CARP address would result in the wrong MAC being broadcast on startup as jail creates IP aliases to support ip[4|6].addr before exec.prestart is executed. PR: 191832 Reviewed by: jamie MFC after: 1 week X-MFC-With: r269340 Phabric: D528 Sponsored by: Multiplay
* | | | | | | | | | The month's name shall not be abbreviated.gavin2014-07-111-1/+1
| | | | | | | | | |
* | | | | | | | | | Reword an awkward option descriptiongavin2014-07-101-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | PR: 191726 Reported by: yaneurabeya gmail.com MFC after: 3 days
* | | | | | | | | | Bump .Dd, missed in r266206bjk2014-05-171-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Approved by: hrs (mentor, implicit)
* | | | | | | | | | Review pass through jail.8bjk2014-05-161-99/+102
| |_|_|_|_|_|_|_|/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Replace usage of "prison" with "jail", since that term has mostly dropped out of use. Note once at the beginning that the "prison" term is equivalent, but do not use it otherwise. [1] Some grammar issues. Some mdoc formatting fixes. Consistently use \(em for em dashes, with spaces around it. Avoid contractions. Prefer ssh to telnet. PR: docs/176832 [1] Approved by: hrs (mentor)
* | | | | | | | | Use src.opts.mk in preference to bsd.own.mk except where we need stuffimp2014-05-061-1/+1
| |_|_|_|_|_|_|/ |/| | | | | | | | | | | | | | | | | | | | | | | from the latter.
* | | | | | | | Line-wrapping tweak: make the sample jail command line fit in 80 characters.rwatson2014-03-171-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | MFC after: 3 days
* | | | | | | | Bump .Dd forgotten in r261832.zeising2014-02-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | MFC after: 2 weeks
* | | | | | | | Add commas (,) to the list in the SEE ALSO section, to match most otherzeising2014-02-131-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | manuals. MFC after: 2 weeks
* | | | | | | | Add cross references between rc.conf(5) and jail.conf(5).zeising2014-02-131-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | MFC after: 2 weeks
* | | | | | | | Back out r261266 pending security buy-in.jamie2014-01-311-11/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | r261266: Add a jail parameter, allow.kmem, which lets jailed processes access /dev/kmem and related devices (i.e. grants PRIV_IO and PRIV_KMEM_WRITE). This in conjunction with changing the drm driver's permission check from PRIV_DRIVER to PRIV_KMEM_WRITE will allow a jailed Xorg server.
* | | | | | | | Add a jail parameter, allow.kmem, which lets jailed processes accessjamie2014-01-291-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | /dev/kmem and related devices (i.e. grants PRIV_IO and PRIV_KMEM_WRITE). This in conjunction with changing the drm driver's permission check from PRIV_DRIVER to PRIV_KMEM_WRITE will allow a jailed Xorg server. Submitted by: netchild MFC after: 1 week
* | | | | | | | - Add mount.fdescfs parameter to jail(8). This is similar tohrs2013-10-125-6/+51
| |_|_|_|_|_|/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | mount.devfs but mounts fdescfs. The mount happens just after mount.devfs. - rc.d/jail now displays whole error message from jail(8) when a jail fails to start. Approved by: re (gjb)
* | | | | | | - Update rc.d/jail to use a jail(8) configuration file instead ofhrs2013-10-101-4/+6
| |_|_|_|_|/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | command line options. The "jail_<jname>_*" rc.conf(5) variables for per-jail configuration are automatically converted to /var/run/jail.<jname>.conf before the jail(8) utility is invoked. This is transparently backward compatible. - Fix a minor bug in jail(8) which prevented it from returning false when jail -r failed. Approved by: re (glebius)
* | | | | | Allow tmpfs be mounted inside jail.delphij2013-08-231-1/+9
| | | | | |
* | | | | | Work around build breakages with GCC 4.2.jkim2013-05-231-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | Reported by: tinderbox
* | | | | | Improve compatibility with recent flex from flex.sourceforge.net.jkim2013-05-031-3/+3
| | | | | |
* | | | | | Add the Clang specific -Wmissing-variable-declarations to WARNS=6.ed2013-04-191-0/+2
| |_|_|_|/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This compiler flag enforces that that people either mark variables static or use an external declarations for the variable, similar to how -Wmissing-prototypes works for functions. Due to the fact that Yacc/Lex generate code that cannot trivially be changed to not warn because of this (lots of yy* variables), add a NO_WMISSING_VARIABLE_DECLARATIONS that can be used to turn off this specific compiler warning. Announced on: toolchain@
* | | | | Reverse the order of some implicit commands (FS mounts and ifconfigs)jamie2013-03-283-7/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | when stopping jails. This matters particularly for nested filesystem mounts. PR: kern/177325 Submitted by: Harald Schmalzbauer MFC after: 3 days
OpenPOWER on IntegriCloud