aboutsummaryrefslogtreecommitdiff
path: root/usr.sbin/jail
Commit message (Collapse)AuthorAgeFilesLines
* jail: introduce per jail suser_enabled settingMariusz Zaborski2020-11-181-1/+9
| | | | | | | | | | | | | | The suser_enable sysctl allows to remove a privileged rights from uid 0. This change introduce per jail setting which allow to make root a normal user. Reviewed by: jamie Previous version reviewed by: kevans, emaste, markj, me_igalic.co Discussed with: pjd Differential Revision: https://reviews.freebsd.org/D27128 Notes: svn path=/head/; revision=367819
* Disregard jails in jail.conf that have bad parameters (parameter/variableJamie Gritton2020-08-271-0/+3
| | | | | | | | | clash, or redefining name/jid). The current behvaior, of merely warning and moving on, can lead to unexpected behavior when a jail is created without the offending parameter defined at all. Notes: svn path=/head/; revision=364874
* Don't allow jail.conf variables to have the same names as jail parameters.Jamie Gritton2020-08-271-1/+14
| | | | | | | | | | It was already not allowed in many cases, but crashed instead of giving an error. PR: 248444 Notes: svn path=/head/; revision=364850
* Back out r364791 to unbreak jails. Lesson learned: "compile and test" meansJamie Gritton2020-08-261-2/+1
| | | | | | | | | | running the test on the same executable that you just compiled. PR: 248444 Pointy hat to: jamie Notes: svn path=/head/; revision=364828
* Handle jail.conf variables that have the same names as parameters.Jamie Gritton2020-08-261-1/+2
| | | | | | | | | PR: 248444 Submitted by: Akos Somfai Reported by: Markus Stoff Notes: svn path=/head/; revision=364791
* jail: Add exec.prepare and exec.release command hooksRyan Moeller2020-05-145-2/+19
| | | | | | | | | | | | | | | | | | | | | | | | This change introduces new jail command hooks that run before and after any other actions. The exec.prepare hook can be used for example to invoke a script that checks if the jail's root exists, creating it if it does not. Since arbitrary variables in jail.conf can be passed to the command, it can be pretty useful for templating jails. An example use case for exec.release would be to remove the filesystem of an ephemeral jail. The names "prepare" and "release" are borrowed from the names of similar hooks in libvirt. Reviewed by: jamie, manpages, mmacy Approved by: mmacy (mentor) MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D24829 Notes: svn path=/head/; revision=361066
* jail(8): improve manual and usage information with more clearEugene Grosbein2020-04-172-4/+8
| | | | | | | | | | | description for "jail -e" mode to show that it does not take additional jail name argument. Reported by: David Marec <david.marec@davenulle.org> MFC after: 3 days Notes: svn path=/head/; revision=360040
* Use memmove to copy within a bufferAndrew Turner2020-04-011-2/+2
| | | | | | | | | | | | | | | | jail(8) would try to use strcpy to remove the interface from the start of an IP address. This is undefined, and on arm64 will result in unexpected IPv6 addresses. Fix this by using memmove top move the string. PR: 245102 Reported by: sbruno MFC after: 2 weeks Sponsored by: Innovate UK Notes: svn path=/head/; revision=359505
* revert r354935 and apply fix for cleandir failureEd Maste2019-11-211-0/+7
| | | | | | | | | | | | | | | This reapplies the RISC-V GNU ld workaround from r354896, r354899, and 354900, along with a fix for the build failure during cleandir. LINKER_TYPE was not being set during cleandir, resulting in Malformed conditional (${LINKER_TYPE} == "bfd" && ${MACHINE} == "riscv") from Cirrus-CI. PR: 242109 Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=354950
* Revert r354896, r354899, r354900:Glen Barber2019-11-211-7/+0
| | | | | | | | | Fix build. Sponsored by: Rubicon Communications, LLC (netgate.com) Notes: svn path=/head/; revision=354935
* Use the correct variable, also limit the scope to bfdLi-Wen Hsu2019-11-201-1/+1
| | | | | | | | | PR: 242109 Reported by: jhb Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=354900
* Limit the workaround to riscv onlyLi-Wen Hsu2019-11-201-0/+2
| | | | | | | | PR: 242109 Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=354899
* Workaround riscv64 build when using binutils 2.33.1Li-Wen Hsu2019-11-201-0/+5
| | | | | | | | | | PR: 242109 Reviewed by: bapt Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D22457 Notes: svn path=/head/; revision=354896
* add ability to set watchdog timeout for a shutdownAndriy Gapon2019-10-032-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change allows to specify a watchdog(9) timeout for a system shutdown. The timeout is activated when the watchdogd daemon is stopped. The idea is to a prevent any indefinite hang during late stages of the shutdown. The feature is implemented in rc.d/watchdogd, it builds upon watchdogd -x option. Note that the shutdown timeout is not actiavted when the watchdogd service is individually stopped by an operator. It is also not activated for the 'shutdown' to the single-user mode. In those cases it is assumed that the operator knows what they are doing and they have means to recover the system should it hang. Significant subchanges and implementation details: - the argument to rc.shutdown, completely unused before, is assigned to rc_shutdown variable that can be inspected by rc scripts - init(8) passes "single" or "reboot" as the argument, this is not changed - the argument is not mandatory and if it is not set then rc_shutdown is set to "unspecified" - however, the default jail management scripts and jail configuration examples have been updated to pass "jail" to rc.shutdown, just in case - the new timeout can be set via watchdogd_shutdown_timeout rc option - for consistency, the regular timeout can now be set via watchdogd_timeout rc option - watchdogd_shutdown_timeout and watchdogd_timeout override timeout specifications in watchdogd_flags - existing configurations, where the new rc options are not set, should keep working as before I am not particularly wed to any of the implementation specifics. I am open to changing or removing any of them as long as the provided functionality is the same (or very close) to the proposed one. For example, I think it can be implemented without using watchdogd -x, by means of watchdog(1) alone. In that case there would be a small window between stopping watchdogd and running watchdog, but I think that that is acceptable. Reviewed by: bcr (man page changes) MFC after: 5 weeks Relnotes: yes Differential Revision: https://reviews.freebsd.org/D21221 Notes: svn path=/head/; revision=353039
* [jail] removal by jid doesn't trigger pre/post stop scriptsMichael Zhilin2019-09-125-23/+194
| | | | | | | | | | | | | This commit fixes bug: command "jail -r" didn't trigger pre/post stop commands (and others) defined in config file if jid is specified insted of name. Also it adds basic tests for usr.sbin/jail to avoid regression. Reviewed by: jamie, kevans, ray MFC after: 5 days Differential Revision: https://reviews.freebsd.org/D21328 Notes: svn path=/head/; revision=352263
* Stop linking to libl by specifying we do not need yywrapBaptiste Daroussin2019-09-102-1/+2
| | | | | | | MFC after: 3 days Notes: svn path=/head/; revision=352122
* Change ed(4), ep(4), and fxp(4) examples to em(4).Brooks Davis2019-05-181-2/+2
| | | | | | | | | | | | ed(4) and ep(4) have been removed. fxp(4) remains popular in older systems, but isn't as future proof as em(4). Reviewed by: bz, jhb MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D20311 Notes: svn path=/head/; revision=347963
* Clarify error messages a bit.Dmitry Morozovsky2019-01-181-3/+3
| | | | | | | | X-Found-With: r343112 MFC after: 1 month Notes: svn path=/head/; revision=343164
* jail(8): stop crashing with SIGSEGV inside run_command() functionEugene Grosbein2019-01-171-1/+1
| | | | | | | | | | | | while processing not entirely correct jail.conf(5) file having something like "ip4.addr = 127.0.0.1;" and no "ip4 = ...;" so extrap variable stays NULL. Reported by: marck MFC after: 1 month Notes: svn path=/head/; revision=343112
* In hardened systems, where the security.bsd.unprivileged_proc_debug sysctlJamie Gritton2018-11-271-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | node is set, allow setting security.bsd.unprivileged_proc_debug per-jail. In part, this is needed to create jails in which the Address Sanitizer (ASAN) fully works as ASAN utilizes libkvm to inspect the virtual address space. Instead of having to allow unprivileged process debugging for the entire system, allow setting it on a per-jail basis. The sysctl node is still security.bsd.unprivileged_proc_debug and the jail(8) param is allow.unprivileged_proc_debug. The sysctl code is now a sysctl proc rather than a sysctl int. This allows us to determine setting the flag for the corresponding jail (or prison0). As part of the change, the dynamic allow.* API needed to be modified to take into account pr_allow flags which may now be disabled in prison0. This prevents conflicts with new pr_allow flags (like that of vmm(4)) that are added (and removed) dynamically. Also teach the jail creation KPI to allow differences for certain pr_allow flags between the parent and child jail. This can happen when unprivileged process debugging is disabled in the parent prison, but enabled in the child. Submitted by: Shawn Webb <lattera at gmail.com> Obtained from: HardenedBSD (45b3625edba0f73b3e3890b1ec3d0d1e95fd47e1, deba0b5078cef0faae43cbdafed3035b16587afc, ab21eeb3b4c72f2500987c96ff603ccf3b6e7de8) Relnotes: yes Sponsored by: HardenedBSD and G2, Inc Differential Revision: https://reviews.freebsd.org/D18319 Notes: svn path=/head/; revision=341084
* jail(8): introduce new command option -e to exhibitEugene Grosbein2018-11-103-13/+59
| | | | | | | | | | | | | | | a list of configured non-wildcard jails with their parameters, no matter running or not. The option -e takes separator argument that is used to separate printed parameters. It will be used with following additions to system periodic scripts to differentiate parts of directory tree belonging jails as opposed to host's. MFC after: 1 month Notes: svn path=/head/; revision=340319
* Fix typos from r339409.Jamie Gritton2018-10-181-1/+1
| | | | | | | | Reported by: maxim Approved by: re (gjb) Notes: svn path=/head/; revision=339420
* Add a new jail permission, allow.read_msgbuf. When true, jailed processesJamie Gritton2018-10-171-1/+6
| | | | | | | | | | | | | | | | | can see the dmesg buffer (this is the current behavior). When false (the new default), dmesg will be unavailable to jailed users, whether root or not. The security.bsd.unprivileged_read_msgbuf sysctl still works as before, controlling system-wide whether non-root users can see the buffer. PR: 211580 Submitted by: bz Approved by: re@ (kib@) MFC after: 3 days Notes: svn path=/head/; revision=339409
* In r324732 sysinstall was replaced by bsdinstall.Bjoern Heidotting2018-08-201-2/+3
| | | | | | | | | | | | However, for post-install configuration, bsdinstall is not of much use. Point the user to bsdconfig instead. Reviewed by: 0mp, bcr Approved by: 0mp, bcr Differential Revision: https://reviews.freebsd.org/D16751 Notes: svn path=/head/; revision=338110
* security.jail.enforce_statfs is handled by jail_set(2), so handling it inJamie Gritton2018-08-163-11/+0
| | | | | | | | | userspace jail(8) is redundant. Differential Revision: D14791 Notes: svn path=/head/; revision=337919
* Don't let clobber jailparam values when checking for modification ofJamie Gritton2018-08-151-3/+8
| | | | | | | | | | | | | init-only parameters. Compare string parameter values with strncmp, not memcmp. PR: 230487 Reported by: Jason Mader MFC after: 3 days Notes: svn path=/head/; revision=337867
* - Add exec hook "exec.created". This is called when the jail isAlexander Leidinger2018-08-155-2/+8
| | | | | | | | | | | | | | | | | created and before exec.start is called. [1] - Bump __FreeBSD_version. This allows to attach ZFS datasets and various other things to be done before any command/service/rc-script is started in the new jail. PR: 228066 [1] Reviewed by: jamie [1] Submitted by: Stefan Grönke <stefan@gronke.net> [1] Differential Revision: https://reviews.freebsd.org/D15330 [1] Notes: svn path=/head/; revision=337863
* - Add the ability to run bhyve(8) within a jail(8).Marcelo Araujo2018-08-011-1/+8
| | | | | | | | | | | | | | This patch adds a new sysctl(8) knob "security.jail.vmm_allowed", by default this option is disable. Submitted by: Shawn Webb <shawn.webb____hardenedbsd.org> Reviewed by: jamie@ and myself. Relnotes: Yes. Sponsored by: HardenedBSD and G2, Inc. Differential Revision: https://reviews.freebsd.org/D16057 Notes: svn path=/head/; revision=337023
* Add allow.mlock to jail parametersAntoine Brodin2018-07-291-1/+11
| | | | | | | | | | | | It allows locking or unlocking physical pages in memory within a jail This allows running elasticsearch with "bootstrap.memory_lock" inside a jail Reviewed by: jamie@ Differential Revision: https://reviews.freebsd.org/D16342 Notes: svn path=/head/; revision=336868
* Allow mounting FUSE filesystems in jailsAlan Somers2018-07-201-1/+9
| | | | | | | | | | Reviewed by: jamie MFC after: 2 weeks Relnotes: yes Differential Revision: https://reviews.freebsd.org/D16371 Notes: svn path=/head/; revision=336565
* Make it easier for filesystems to count themselves as jail-enabled,Jamie Gritton2018-05-041-28/+28
| | | | | | | | | | | | | | | by doing most of the work in a new function prison_add_vfs in kern_jail.c Now a jail-enabled filesystem need only mark itself with VFCF_JAIL, and the rest is taken care of. This includes adding a jail parameter like allow.mount.foofs, and a sysctl like security.jail.mount_foofs_allowed. Both of these used to be a static list of known filesystems, with predefined permission bits. Reviewed by: kib Differential Revision: D14681 Notes: svn path=/head/; revision=333263
* various: general adoption of SPDX licensing ID tags.Pedro F. Giffuni2017-11-277-0/+14
| | | | | | | | | | | | | | | | | Mainly focus on files that use BSD 2-Clause license, however the tool I was using misidentified many licenses so this was mostly a manual - error prone - task. The Software Package Data Exchange (SPDX) group provides a specification to make it easier for automated tools to detect and summarize well known opensource licenses. We are gradually adopting the specification, noting that the tags are considered only advisory and do not, in any way, superceed or replace the license texts. No functional change intended. Notes: svn path=/head/; revision=326276
* Strip EOL whitespace in usr.sbin/{jail,jexec}Ed Maste2017-11-103-7/+7
| | | | Notes: svn path=/head/; revision=325664
* DIRDEPS_BUILD: Update dependencies.Bryan Drewery2017-10-311-1/+0
| | | | | | | Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=325188
* Adopt jail.8 to our brave new bsdinstall worldBenjamin Kaduk2017-10-181-1/+1
| | | | | | | | Submitted by: Steve Kargl MFC after: 3 days Notes: svn path=/head/; revision=324732
* Jails: Optionally prevent jailed root from binding to privileged portsAllan Jude2017-06-061-2/+6
| | | | | | | | | | | | | | You may now optionally specify allow.noreserved_ports to prevent root inside a jail from using privileged ports (less than 1024) PR: 217728 Submitted by: Matt Miller <mattm916@pulsar.neomailbox.ch> Reviewed by: jamie, cem, smh Relnotes: yes Differential Revision: https://reviews.freebsd.org/D10202 Notes: svn path=/head/; revision=319611
* Same as r316022 (Fix hexadecimal escape codes in jail.conf(5)),Jamie Gritton2017-03-271-1/+1
| | | | | | | | | | but do it right this time. Reported by: Kyle Evans <Kyle Evans> MFC after: 3 days Notes: svn path=/head/; revision=316023
* Fix hexadecimal escape codes in jail.conf(5).Jamie Gritton2017-03-271-2/+2
| | | | | | | | | PR: 218154 Submitted by: Masahiro Konishi <mkonishi@sea.plala.or.jp> MFC after: 3 days Notes: svn path=/head/; revision=316022
* Don't assign rtjp twice.Xin LI2016-12-261-2/+1
| | | | | | | | Reported by: clang static analyzer MFC after: 2 weeks Notes: svn path=/head/; revision=310614
* Fix up the order in which jail creation processes are run, to preserveJamie Gritton2016-07-143-6/+23
| | | | | | | | | | the config file's order in the non-parallel-start case. PR: 209112 MFC after: 3 days Notes: svn path=/head/; revision=302856
* typoJamie Gritton2016-05-011-1/+1
| | | | | | | Submitted by: Jimmy Olgeni Notes: svn path=/head/; revision=298888
* usr.sbin: minor spelling fixes on comments.Pedro F. Giffuni2016-05-011-1/+1
| | | | | | | No functional change. Notes: svn path=/head/; revision=298886
* Clarify when happens when there is a "depend" parameter in jail.conf,Jamie Gritton2016-04-301-4/+5
| | | | | | | and how this affects the "jail_list" option in rc.conf. Notes: svn path=/head/; revision=298863
* Encapsulate SYSV IPC objects in jails. Define per-module parametersJamie Gritton2016-04-251-4/+27
| | | | | | | | | | | | | | | | | | | | | | | sysvmsg, sysvsem, and sysvshm, with the following bahavior: inherit: allow full access to the IPC primitives. This is the same as the current setup with allow.sysvipc is on. Jails and the base system can see (and moduly) each other's objects, which is generally considered a bad thing (though may be useful in some circumstances). disable: all no access, same as the current setup with allow.sysvipc off. new: A jail may see use the IPC objects that it has created. It also gets its own IPC key namespace, so different jails may have their own objects using the same key value. The parent jail (or base system) can see the jail's IPC objects, but not its keys. PR: 48471 Submitted by: based on work by kikuchan98@gmail.com MFC after: 5 days Notes: svn path=/head/; revision=298585
* Note the existence of module-specific jail paramters, starting with theJamie Gritton2016-04-251-1/+27
| | | | | | | | | linux.* parameters when linux emulation is loaded. MFC after: 5 days Notes: svn path=/head/; revision=298584
* Make jail(8) interpret escape codes in fstab the same as getfsent(3).Jamie Gritton2016-04-251-1/+8
| | | | | | | | PR: 208663 MFC after: 3 days Notes: svn path=/head/; revision=298562
* MFHGlen Barber2016-03-021-6/+0
|\ | | | | | | | | | | | | Sponsored by: The FreeBSD Foundation Notes: svn path=/projects/release-pkg/; revision=296318
| * DIRDEPS_BUILD: Regenerate without local dependencies.Bryan Drewery2016-02-241-6/+0
| | | | | | | | | | | | | | | | | | | | | | These are no longer needed after the recent 'beforebuild: depend' changes and hooking DIRDEPS_BUILD into a subset of FAST_DEPEND which supports skipping 'make depend'. Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=295989
* | MFHGlen Barber2016-02-152-2/+0
|\| | | | | | | | | | | | | Sponsored by: The FreeBSD Foundation Notes: svn path=/projects/release-pkg/; revision=295639
| * Remove man page references to rndassociates.com, which has been taken overJamie Gritton2016-02-102-2/+0
| | | | | | | | | | | | | | by a domain squatter. Notes: svn path=/head/; revision=295468
generated by cgit v1.3 (git 2.53.0) at 2026-04-17 21:27:34 +0000