jail revision 287739 
1#!/bin/sh
2#
3# $FreeBSD: stable/10/etc/rc.d/jail 287739 2015-09-13 04:05:27Z hrs $
4#
5
6# PROVIDE: jail
7# REQUIRE: LOGIN FILESYSTEMS
8# BEFORE: securelevel
9# KEYWORD: nojail shutdown
10
11. /etc/rc.subr
12
13name="jail"
14rcvar="jail_enable"
15
16start_cmd="jail_start"
17start_postcmd="jail_warn"
18stop_cmd="jail_stop"
19config_cmd="jail_config"
20console_cmd="jail_console"
21status_cmd="jail_status"
22extra_commands="config console status"
23: ${jail_conf:=/etc/jail.conf}
24: ${jail_program:=/usr/sbin/jail}
25: ${jail_consolecmd:=/usr/bin/login -f root}
26: ${jail_jexec:=/usr/sbin/jexec}
27: ${jail_jls:=/usr/sbin/jls}
28
29need_dad_wait=
30
31# extract_var jail name param num defval
32#	Extract value from ${jail_$jail_$name} or ${jail_$name} and
33#	set it to $param.  If not defined, $defval is used.
34#	When $num is [0-9]*, ${jail_$jail_$name$num} are looked up and
35#	$param is set by using +=.
36#	When $num is YN or NY, the value is interpret as boolean.
37extract_var()
38{
39	local i _j _name _param _num _def _name1 _name2
40	_j=$1
41	_name=$2
42	_param=$3
43	_num=$4
44	_def=$5
45
46	case $_num in
47	YN)
48		_name1=jail_${_j}_${_name}
49		_name2=jail_${_name}
50		eval $_name1=\"\${$_name1:-\${$_name2:-$_def}}\"
51		if checkyesno $_name1; then
52			echo "	$_param = 1;"
53		else
54			echo "	$_param = 0;"
55		fi
56	;;
57	NY)
58		_name1=jail_${_j}_${_name}
59		_name2=jail_${_name}
60		eval $_name1=\"\${$_name1:-\${$_name2:-$_def}}\"
61		if checkyesno $_name1; then
62			echo "	$_param = 0;"
63		else
64			echo "	$_param = 1;"
65		fi
66	;;
67	[0-9]*)
68		i=$_num
69		while : ; do
70			_name1=jail_${_j}_${_name}${i}
71			_name2=jail_${_name}${i}
72			eval _tmpargs=\"\${$_name1:-\${$_name2:-$_def}}\"
73			if [ -n "$_tmpargs" ]; then 
74				echo "	$_param += \"$_tmpargs\";"
75			else
76				break;
77			fi
78			i=$(($i + 1))
79		done
80	;;
81	*)
82		_name1=jail_${_j}_${_name}
83		_name2=jail_${_name}
84		eval _tmpargs=\"\${$_name1:-\${$_name2:-$_def}}\"
85		if [ -n "$_tmpargs" ]; then
86			echo "	$_param = \"$_tmpargs\";"
87		fi
88	;;
89	esac
90}
91
92# parse_options _j
93#	Parse options and create a temporary configuration file if necessary.
94#
95parse_options()
96{
97	local _j _p
98	_j=$1
99
100	_confwarn=0
101	if [ -z "$_j" ]; then
102		warn "parse_options: you must specify a jail"
103		return
104	fi
105	eval _jconf=\"\${jail_${_j}_conf:-/etc/jail.${_j}.conf}\"
106	eval _rootdir=\"\$jail_${_j}_rootdir\"
107	eval _hostname=\"\$jail_${_j}_hostname\"
108	if [ -z "$_rootdir" -o \
109	     -z "$_hostname" ]; then
110		if [ -r "$_jconf" ]; then
111			_conf="$_jconf"
112			return 0
113		elif [ -r "$jail_conf" ]; then
114			_conf="$jail_conf"
115			return 0
116		else
117			warn "Invalid configuration for $_j " \
118			    "(no jail.conf, no hostname, or no path).  " \
119			    "Jail $_j was ignored."
120		fi
121		return 1
122	fi
123	eval _ip=\"\$jail_${_j}_ip\"
124	if [ -z "$_ip" ] && ! check_kern_features vimage; then
125		warn "no ipaddress specified and no vimage support.  " \
126		    "Jail $_j was ignored."
127		return 1
128	fi
129	_conf=/var/run/jail.${_j}.conf
130	#
131	# To relieve confusion, show a warning message.
132	#
133	_confwarn=1
134	if [ -r "$jail_conf" -o -r "$_jconf" ]; then
135		if ! checkyesno jail_parallel_start; then
136			warn "$_conf is created and used for jail $_j."
137		fi
138	fi
139	/usr/bin/install -m 0644 -o root -g wheel /dev/null $_conf || return 1
140
141	eval : \${jail_${_j}_flags:=${jail_flags}}
142	eval _exec=\"\$jail_${_j}_exec\"
143	eval _exec_start=\"\$jail_${_j}_exec_start\"
144	eval _exec_stop=\"\$jail_${_j}_exec_stop\"
145	if [ -n "${_exec}" ]; then
146		#   simple/backward-compatible execution
147		_exec_start="${_exec}"
148		_exec_stop=""
149	else
150		#   flexible execution
151		if [ -z "${_exec_start}" ]; then
152			_exec_start="/bin/sh /etc/rc"
153			if [ -z "${_exec_stop}" ]; then
154				_exec_stop="/bin/sh /etc/rc.shutdown"
155			fi
156		fi
157	fi
158	eval _interface=\"\${jail_${_j}_interface:-${jail_interface}}\"
159	eval _parameters=\"\${jail_${_j}_parameters:-${jail_parameters}}\"
160	eval _fstab=\"\${jail_${_j}_fstab:-${jail_fstab:-/etc/fstab.$_j}}\"
161	(
162		date +"# Generated by rc.d/jail at %Y-%m-%d %H:%M:%S"
163		echo "$_j {"
164		extract_var $_j hostname host.hostname - ""
165		extract_var $_j rootdir path - ""
166		if [ -n "$_ip" ]; then
167			extract_var $_j interface interface - ""
168			jail_handle_ips_option $_ip $_interface
169			alias=0
170			while : ; do
171				eval _x=\"\$jail_${_j}_ip_multi${alias}\"
172				[ -z "$_x" ] && break
173
174				jail_handle_ips_option $_x $_interface
175				alias=$(($alias + 1))
176			done
177			case $need_dad_wait in
178			1)
179				# Sleep to let DAD complete before
180				# starting services.
181				echo "	exec.start += \"sleep " \
182				$(($(${SYSCTL_N} net.inet6.ip6.dad_count) + 1)) \
183				"\";"
184			;;
185			esac
186			# These are applicable only to non-vimage jails. 
187			extract_var $_j fib exec.fib - ""
188			extract_var $_j socket_unixiproute_only \
189			    allow.raw_sockets NY YES
190		else
191			echo "	vnet;"
192			extract_var $_j vnet_interface vnet.interface - ""
193		fi
194
195		echo "	exec.clean;"
196		echo "	exec.system_user = \"root\";"
197		echo "	exec.jail_user = \"root\";"
198		extract_var $_j exec_prestart exec.prestart 0 ""
199		extract_var $_j exec_poststart exec.poststart 0 ""
200		extract_var $_j exec_prestop exec.prestop 0 ""
201		extract_var $_j exec_poststop exec.poststop 0 ""
202
203		echo "	exec.start += \"$_exec_start\";"
204		extract_var $_j exec_afterstart exec.start 1 ""
205		echo "	exec.stop = \"$_exec_stop\";"
206
207		extract_var $_j consolelog exec.consolelog - \
208		    /var/log/jail_${_j}_console.log
209
210		if [ -r $_fstab ]; then
211			echo "	mount.fstab = \"$_fstab\";"
212		fi
213
214		eval : \${jail_${_j}_devfs_enable:=${jail_devfs_enable:-NO}}
215		if checkyesno jail_${_j}_devfs_enable; then
216			echo "	mount.devfs;"
217			eval _ruleset=\${jail_${_j}_devfs_ruleset:-${jail_devfs_ruleset}}
218			case $_ruleset in
219			"")	;;
220			[0-9]*) echo "	devfs_ruleset = \"$_ruleset\";" ;;
221			devfsrules_jail)
222				# XXX: This is the default value,
223				# Let jail(8) to use the default because
224				# mount(8) only accepts an integer. 
225				# This should accept a ruleset name.
226			;;
227			*)	warn "devfs_ruleset must be an integer." ;;
228			esac
229		fi
230		eval : \${jail_${_j}_fdescfs_enable:=${jail_fdescfs_enable:-NO}}
231		if checkyesno jail_${_j}_fdescfs_enable; then
232			echo "	mount.fdescfs;"
233		fi
234		eval : \${jail_${_j}_procfs_enable:=${jail_procfs_enable:-NO}}
235		if checkyesno jail_${_j}_procfs_enable; then
236			echo "	mount.procfs;"
237		fi
238
239		eval : \${jail_${_j}_mount_enable:=${jail_mount_enable:-NO}}
240		if checkyesno jail_${_j}_mount_enable; then
241			echo "	allow.mount;" >> $_conf
242		fi
243
244		extract_var $_j set_hostname_allow allow.set_hostname YN NO
245		extract_var $_j sysvipc_allow allow.sysvipc YN NO
246		for _p in $_parameters; do
247			echo "	${_p%\;};"
248		done
249		echo "}"
250	) >> $_conf
251
252	return 0
253}
254
255# jail_extract_address argument iface
256#	The second argument is the string from one of the _ip
257#	or the _multi variables. In case of a comma separated list
258#	only one argument must be passed in at a time.
259#	The function alters the _type, _iface, _addr and _mask variables.
260#
261jail_extract_address()
262{
263	local _i _interface
264	_i=$1
265	_interface=$2
266
267	if [ -z "${_i}" ]; then
268		warn "jail_extract_address: called without input"
269		return
270	fi
271
272	# Check if we have an interface prefix given and split into
273	# iFace and rest.
274	case "${_i}" in
275	*\|*)	# ifN|.. prefix there
276		_iface=${_i%%|*}
277		_r=${_i##*|}
278		;;
279	*)	_iface=""
280		_r=${_i}
281		;;
282	esac
283
284	# In case the IP has no interface given, check if we have a global one.
285	_iface=${_iface:-${_interface}}
286
287	# Set address, cut off any prefix/netmask/prefixlen.
288	_addr=${_r}
289	_addr=${_addr%%[/ ]*}
290
291	# Theoretically we can return here if interface is not set,
292	# as we only care about the _mask if we call ifconfig.
293	# This is not done because we may want to santize IP addresses
294	# based on _type later, and optionally change the type as well.
295
296	# Extract the prefix/netmask/prefixlen part by cutting off the address.
297	_mask=${_r}
298	_mask=`expr "${_mask}" : "${_addr}\(.*\)"`
299
300	# Identify type {inet,inet6}.
301	case "${_addr}" in
302	*\.*\.*\.*)	_type="inet" ;;
303	*:*)		_type="inet6" ;;
304	*)		warn "jail_extract_address: type not identified"
305			;;
306	esac
307
308	# Handle the special /netmask instead of /prefix or
309	# "netmask xxx" case for legacy IP.
310	# We do NOT support shortend class-full netmasks.
311	if [ "${_type}" = "inet" ]; then
312		case "${_mask}" in
313		/*\.*\.*\.*)	_mask=" netmask ${_mask#/}" ;;
314		*)		;;
315		esac
316
317		# In case _mask is still not set use /32.
318		_mask=${_mask:-/32}
319
320	elif [ "${_type}" = "inet6" ]; then
321		# In case _mask is not set for IPv6, use /128.
322		_mask=${_mask:-/128}
323	fi
324}
325
326# jail_handle_ips_option input iface
327#	Handle a single argument imput which can be a comma separated
328#	list of addresses (theoretically with an option interface and
329#	prefix/netmask/prefixlen).
330#
331jail_handle_ips_option()
332{
333	local _x _type _i _defif
334	_x=$1
335	_defif=$2
336
337	if [ -z "${_x}" ]; then
338		# No IP given. This can happen for the primary address
339		# of each address family.
340		return
341	fi
342
343	# Loop, in case we find a comma separated list, we need to handle
344	# each argument on its own.
345	while [ ${#_x} -gt 0 ]; do
346		case "${_x}" in
347		*,*)	# Extract the first argument and strip it off the list.
348			_i=`expr "${_x}" : '^\([^,]*\)'`
349			_x=`expr "${_x}" : "^[^,]*,\(.*\)"`
350		;;
351		*)	_i=${_x}
352			_x=""
353		;;
354		esac
355
356		_type=""
357		_addr=""
358		_mask=""
359		_iface=""
360		jail_extract_address $_i $_defif
361
362		# make sure we got an address.
363		case $_addr in
364		"")	continue ;;
365		*)	;;
366		esac
367
368		# Append address to list of addresses for the jail command.
369		case $_type in
370		inet)
371			echo "	ip4.addr += \"${_iface:+${_iface}|}${_addr}${_mask}\";"
372		;;
373		inet6)
374			echo "	ip6.addr += \"${_iface:+${_iface}|}${_addr}${_mask}\";"
375			need_dad_wait=1
376		;;
377		esac
378	done
379}
380
381jail_config()
382{
383	local _j
384
385	case $1 in
386	_ALL)	return ;;
387	esac
388	for _j in $@; do
389		_j=$(echo $_j | tr /. _)
390		if parse_options $_j; then 
391			echo "$_j: parameters are in $_conf."
392		fi
393	done
394}
395
396jail_console()
397{
398	local _j _cmd
399
400	# One argument that is not _ALL.
401	case $#:$1 in
402	0:*|1:_ALL)	err 3 "Specify a jail name." ;;
403	1:*)		;;
404	esac
405	_j=$(echo $1 | tr /. _)
406	shift
407	case $# in
408	0)	eval _cmd=\${jail_${_j}_consolecmd:-$jail_consolecmd} ;;
409	*)	_cmd=$@ ;;
410	esac
411	$jail_jexec $_j $_cmd
412}
413
414jail_status()
415{
416
417	$jail_jls -N
418}
419
420jail_start()
421{
422	local _j _jid _jl _id _name
423
424	if [ $# = 0 ]; then
425		return
426	fi
427	echo -n 'Starting jails:'
428	case $1 in
429	_ALL)
430		command=$jail_program
431		rc_flags=$jail_flags
432		command_args="-f $jail_conf -c"
433		_tmp=`mktemp -t jail` || exit 3
434		if $command $rc_flags $command_args >> $_tmp 2>&1; then
435			$jail_jls jid name | while read _id _name; do
436				echo -n " $_name"
437				echo $_id > /var/run/jail_${_name}.id
438			done
439		else
440			tail -1 $_tmp
441		fi
442		rm -f $_tmp
443		echo '.'
444		return
445	;;
446	esac
447	if checkyesno jail_parallel_start; then
448		#
449		# Start jails in parallel and then check jail id when
450		# jail_parallel_start is YES.
451		#
452		_jl=
453		for _j in $@; do
454			_j=$(echo $_j | tr /. _)
455			parse_options $_j || continue
456
457			_jl="$_jl $_j"
458			eval rc_flags=\${jail_${_j}_flags:-$jail_flags}
459			eval command=\${jail_${_j}_program:-$jail_program}
460			command_args="-i -f $_conf -c $_j"
461			$command $rc_flags $command_args \
462			    >/dev/null 2>&1 </dev/null &
463		done
464		sleep 1
465		for _j in $_jl; do
466			echo -n " ${_hostname:-${_j}}"
467			if _jid=$($jail_jls -j $_j jid); then
468				echo "$_jid" > /var/run/jail_${_j}.id
469			else
470				rm -f /var/run/jail_${_j}.id
471				echo " cannot start jail " \
472				    "\"${_hostname:-${_j}}\": "
473			fi
474		done
475	else
476		#
477		# Start jails one-by-one when jail_parallel_start is NO.
478		#
479		for _j in $@; do
480			_j=$(echo $_j | tr /. _)
481			parse_options $_j || continue
482
483			eval rc_flags=\${jail_${_j}_flags:-$jail_flags}
484			eval command=\${jail_${_j}_program:-$jail_program}
485			command_args="-i -f $_conf -c $_j"
486			_tmp=`mktemp -t jail` || exit 3
487			if $command $rc_flags $command_args \
488			    >> $_tmp 2>&1 </dev/null; then
489				echo -n " ${_hostname:-${_j}}"
490				_jid=$($jail_jls -j $_j jid)
491				echo $_jid > /var/run/jail_${_j}.id
492			else
493				rm -f /var/run/jail_${_j}.id
494				echo " cannot start jail " \
495				    "\"${_hostname:-${_j}}\": "
496				cat $_tmp
497			fi
498			rm -f $_tmp
499		done
500	fi
501	echo '.'
502}
503
504jail_stop()
505{
506	local _j
507
508	if [ $# = 0 ]; then
509		return
510	fi
511	echo -n 'Stopping jails:'
512	case $1 in
513	_ALL)
514		command=$jail_program
515		rc_flags=$jail_flags
516		command_args="-f $jail_conf -r"
517		$jail_jls name | while read _j; do
518			echo -n " $_j"
519			_tmp=`mktemp -t jail` || exit 3
520			$command $rc_flags $command_args $_j >> $_tmp 2>&1
521			if $jail_jls -j $_j > /dev/null 2>&1; then
522				tail -1 $_tmp
523			else
524				rm -f /var/run/jail_${_j}.id
525			fi
526			rm -f $_tmp
527		done
528		echo '.'
529		return
530	;;
531	esac
532	for _j in $@; do
533		_j=$(echo $_j | tr /. _)
534		parse_options $_j || continue
535		if ! $jail_jls -j $_j > /dev/null 2>&1; then
536			continue
537		fi
538		eval command=\${jail_${_j}_program:-$jail_program}
539		echo -n " ${_hostname:-${_j}}"
540		_tmp=`mktemp -t jail` || exit 3
541		$command -q -f $_conf -r $_j >> $_tmp 2>&1
542		if $jail_jls -j $_j > /dev/null 2>&1; then
543			tail -1 $_tmp
544		else
545			rm -f /var/run/jail_${_j}.id
546		fi
547		rm -f $_tmp
548	done
549	echo '.'
550}
551
552jail_warn()
553{
554
555	# To relieve confusion, show a warning message.
556	case $_confwarn in
557	1)	warn "Per-jail configuration via jail_* variables " \
558		    "is obsolete.  Please consider to migrate to $jail_conf."
559	;;
560	esac
561}
562
563load_rc_config $name
564case $# in
5651)	run_rc_command $@ ${jail_list:-_ALL} ;;
566*)	run_rc_command $@ ;;
567esac
568