From 6fbd1bed6e7bf880a6cc579b06bdc6476983613a Mon Sep 17 00:00:00 2001
From: Lexi Winter <lexi@hemlock.eden.le-fay.org>
Date: Sun, 23 Mar 2025 06:00:50 +0000
Subject: rc.subr: add ${svc}_svcj_ipaddrs option

setting ${svc}_svcj_ipaddrs to a list of IP addresses causes rc.subr to
set ip6.addr and/or ip4.addr when starting the jail, restricting it to
those IP addresses rather than inheriting all IP addresses.

for example:

inetd_enable=YES
inetd_svcj=YES
inetd_svcj_options="net_basic"
inetd_svcj_ipaddrs="::1 127.0.0.1 2001:db8::1"

if not specified, the default value is unchanged (inherit all addresses
if networking is enabled).

Reviewed by:	netchild
---
 libexec/rc/rc.subr | 36 +++++++++++++++++++++++++++++-------
 1 file changed, 29 insertions(+), 7 deletions(-)

(limited to 'libexec')

diff --git a/libexec/rc/rc.subr b/libexec/rc/rc.subr
index b7f8953012d7..29ed0eb05824 100644
--- a/libexec/rc/rc.subr
+++ b/libexec/rc/rc.subr
@@ -1196,7 +1196,8 @@ run_rc_command()
 	    _prepend=\$${name}_prepend	_login_class=\${${name}_login_class:-daemon} \
 	    _limits=\$${name}_limits	_oomprotect=\$${name}_oomprotect \
 	    _setup=\$${name}_setup	_env_file=\$${name}_env_file \
-	    _umask=\$${name}_umask	_svcj_options=\$${name}_svcj_options
+	    _umask=\$${name}_umask	_svcj_options=\$${name}_svcj_options \
+	    _svcj_ipaddrs=\$${name}_svcj_ipaddrs
 
 	if [ -n "$_env_file" ] && [ -r "${_env_file}" ]; then	# load env from file
 		set -a
@@ -1210,9 +1211,30 @@ run_rc_command()
 		fi
 	fi
 
-	if [ -n "$_svcj_options" ]; then	# translate service jail options
-		_svcj_cmd_options=""
+	_svcj_ip="inherit"
+	_svcj_ip4_addrs=""
+	_svcj_ip6_addrs=""
+
+	for addr in $_svcj_ipaddrs; do
+		case $addr in
+			*:*) _svcj_ip6_addrs="$addr,${_svcj_ip6_addrs}" ;;
+			*) _svcj_ip4_addrs="$addr,${_svcj_ip4_addrs}" ;;
+		esac
+	done
+
+	_svcj_cmd_options=""
 
+	if [ -n "$_svcj_ip4_addrs" ]; then
+		_svcj_cmd_options="ip4.addr=${_svcj_ip4_addrs%*,} ${_svcj_cmd_options}"
+		_svcj_ip="new"
+	fi
+
+	if [ -n "$_svcj_ip6_addrs" ]; then
+		_svcj_cmd_options="ip6.addr=${_svcj_ip6_addrs%*,} ${_svcj_cmd_options}"
+		_svcj_ip="new"
+	fi
+
+	if [ -n "$_svcj_options" ]; then	# translate service jail options
 		_svcj_sysvipc_x=0
 		for _svcj_option in $_svcj_options; do
 			case "$_svcj_option" in
@@ -1220,19 +1242,19 @@ run_rc_command()
 					_svcj_cmd_options="allow.mlock ${_svcj_cmd_options}"
 					;;
 				netv4)
-					_svcj_cmd_options="ip4=inherit allow.reserved_ports ${_svcj_cmd_options}"
+					_svcj_cmd_options="ip4=${_svcj_ip} allow.reserved_ports ${_svcj_cmd_options}"
 					;;
 				netv6)
-					_svcj_cmd_options="ip6=inherit allow.reserved_ports ${_svcj_cmd_options}"
+					_svcj_cmd_options="ip6=${_svcj_ip} allow.reserved_ports ${_svcj_cmd_options}"
 					;;
 				net_basic)
-					_svcj_cmd_options="ip4=inherit ip6=inherit allow.reserved_ports ${_svcj_cmd_options}"
+					_svcj_cmd_options="ip4=${_svcj_ip} ip6=${_svcj_ip} allow.reserved_ports ${_svcj_cmd_options}"
 					;;
 				net_raw)
 					_svcj_cmd_options="allow.raw_sockets ${_svcj_cmd_options}"
 					;;
 				net_all)
-					_svcj_cmd_options="allow.socket_af allow.raw_sockets allow.reserved_ports ip4=inherit ip6=inherit ${_svcj_cmd_options}"
+					_svcj_cmd_options="allow.socket_af allow.raw_sockets allow.reserved_ports ip4=${_svcj_ip} ip6=${_svcj_ip} ${_svcj_cmd_options}"
 					;;
 				nfsd)
 					_svcj_cmd_options="allow.nfsd enforce_statfs=1 ${_svcj_cmd_options}"
-- 
cgit v1.3