jail revision 145694 
1#!/bin/sh
2#
3# $FreeBSD: head/etc/rc.d/jail 145694 2005-04-30 00:16:00Z csjp $
4#
5
6# PROVIDE: jail
7# REQUIRE: LOGIN cleanvar
8# BEFORE: securelevel
9# KEYWORD: nojail shutdown
10
11. /etc/rc.subr
12
13name="jail"
14rcvar=`set_rcvar`
15start_cmd="jail_start"
16stop_cmd="jail_stop"
17
18# init_variables _j
19#	Initialize the various jail variables for jail _j.
20#
21init_variables()
22{
23	_j="$1"
24
25	if [ -z "$_j" ]; then
26		warn "init_variables: you must specify a jail"
27		return
28	fi
29
30	eval jail_rootdir=\"\$jail_${_j}_rootdir\"
31	jail_devdir="${jail_rootdir}/dev"
32	jail_fdescdir="${jail_devdir}/fd"
33	jail_procdir="${jail_rootdir}/proc"
34	eval jail_hostname=\"\$jail_${_j}_hostname\"
35	eval jail_ip=\"\$jail_${_j}_ip\"
36	eval jail_exec=\"\$jail_${_j}_exec\"
37	eval jail_exec_start=\"\$jail_${_j}_exec_start\"
38	eval jail_exec_stop=\"\$jail_${_j}_exec_stop\"
39	if [ -n "${jail_exec}" ]; then
40		#   simple/backward-compatible execution
41		jail_exec_start="${jail_exec}"
42		jail_exec_stop=""
43	else
44		#   flexible execution
45		if [ -z "${jail_exec_start}" ]; then
46			jail_exec_start="/bin/sh /etc/rc"
47			if [ -z "${jail_exec_stop}" ]; then
48				jail_exec_stop="/bin/sh /etc/rc.shutdown"
49			fi
50		fi
51	fi
52
53	# The default jail ruleset will be used by rc.subr if none is specified.
54	eval jail_ruleset=\"\$jail_${_j}_devfs_ruleset\"
55	eval jail_devfs=\"\$jail_${_j}_devfs_enable\"
56	[ -z "${jail_devfs}" ] && jail_devfs="NO"
57	eval jail_fdescfs=\"\$jail_${_j}_fdescfs_enable\"
58	[ -z "${jail_fdescfs}" ] && jail_fdescfs="NO"
59	eval jail_procfs=\"\$jail_${_j}_procfs_enable\"
60	[ -z "${jail_procfs}" ] && jail_procfs="NO"
61
62	eval jail_mount=\"\$jail_${_j}_mount_enable\"
63	[ -z "${jail_mount}" ] && jail_mount="NO"
64	# "/etc/fstab.${_j}" will be used for {,u}mount(8) if none is specified.
65	eval jail_fstab=\"\$jail_${_j}_fstab\"
66	[ -z "${jail_fstab}" ] && jail_fstab="/etc/fstab.${_j}"
67
68	# Debugging aid
69	#
70	debug "$_j devfs enable: $jail_devfs"
71	debug "$_j fdescfs enable: $jail_fdescfs"
72	debug "$_j procfs enable: $jail_procfs"
73	debug "$_j mount enable: $jail_mount"
74	debug "$_j hostname: $jail_hostname"
75	debug "$_j ip: $jail_ip"
76	debug "$_j root: $jail_rootdir"
77	debug "$_j devdir: $jail_devdir"
78	debug "$_j fdescdir: $jail_fdescdir"
79	debug "$_j procdir: $jail_procdir"
80	debug "$_j ruleset: $jail_ruleset"
81	debug "$_j fstab: $jail_fstab"
82	debug "$_j exec start: $jail_exec_start"
83	debug "$_j exec stop: $jail_exec_stop"
84}
85
86# set_sysctl rc_knob mib msg
87#	If the mib sysctl is set according to what rc_knob
88#	specifies, this function does nothing. However if
89#	rc_knob is set differently than mib, then the mib
90#	is set accordingly and msg is displayed followed by
91#	an '=" sign and the word 'YES' or 'NO'.
92#
93set_sysctl()
94{
95	_knob="$1"
96	_mib="$2"
97	_msg="$3"
98
99	_current=`${SYSCTL} -n $_mib 2>/dev/null`
100	if checkyesno $_knob ; then
101		if [ "$_current" -ne 1 ]; then
102			echo -n " ${_msg}=YES"
103			${SYSCTL_W} 1>/dev/null ${_mib}=1
104		fi
105	else
106		if [ "$_current" -ne 0 ]; then
107			echo -n " ${_msg}=NO"
108			${SYSCTL_W} 1>/dev/null ${_mib}=0
109		fi
110	fi
111}
112
113# jail_umount_fs
114#	This function unmounts certain special filesystems in the
115#	currently selected jail. The caller must call the init_variables()
116#	routine before calling this one.
117#
118jail_umount_fs()
119{
120	if checkyesno jail_fdescfs; then
121		if [ -d "${jail_fdescdir}" ] ; then
122			umount -f ${jail_fdescdir} >/dev/null 2>&1
123		fi
124	fi
125	if checkyesno jail_devfs; then
126		if [ -d "${jail_devdir}" ] ; then
127			umount -f ${jail_devdir} >/dev/null 2>&1
128		fi
129	fi
130	if checkyesno jail_procfs; then
131		if [ -d "${jail_procdir}" ] ; then
132			umount -f ${jail_procdir} >/dev/null 2>&1
133		fi
134	fi
135	if checkyesno jail_mount; then
136		[ -f "${jail_fstab}" ] || warn "${jail_fstab} does not exist"
137		umount -a -F "${jail_fstab}" >/dev/null 2>&1
138	fi
139}
140
141jail_start()
142{
143	echo -n 'Configuring jails:'
144	set_sysctl jail_set_hostname_allow security.jail.set_hostname_allowed \
145	    set_hostname_allow
146	set_sysctl jail_socket_unixiproute_only \
147	    security.jail.socket_unixiproute_only unixiproute_only
148	set_sysctl jail_sysvipc_allow security.jail.sysvipc_allowed \
149	    sysvipc_allow
150	echo '.'
151
152	echo -n 'Starting jails:'
153	_tmp_dir=`mktemp -d /tmp/jail.XXXXXXXX` || \
154	    err 3 "$name: Can't create temp dir, exiting..."
155	for _jail in ${jail_list}
156	do
157		init_variables $_jail
158		if checkyesno jail_mount; then
159			info "Mounting fstab for jail ${_jail} (${jail_fstab})"
160			if [ ! -f "${jail_fstab}" ]; then
161				err 3 "$name: ${jail_fstab} does not exist"
162			fi
163			mount -a -F "${jail_fstab}"
164		fi
165		if checkyesno jail_devfs; then
166			# If devfs is already mounted here, skip it.
167			df -t devfs "${jail_devdir}" >/dev/null
168			if [ $? -ne 0 ]; then
169				info "Mounting devfs on ${jail_devdir}"
170				devfs_mount_jail "${jail_devdir}" ${jail_ruleset}
171				# Transitional symlink for old binaries
172				if [ ! -L "${jail_devdir}/log" ]; then
173					__pwd="`pwd`"
174					cd "${jail_devdir}"
175					ln -sf ../var/run/log log
176					cd "$__pwd"
177				fi
178			fi
179
180			# XXX - It seems symlinks don't work when there
181			#	is a devfs(5) device of the same name.
182			# Jail console output
183			#	__pwd="`pwd`"
184			#	cd "${jail_devdir}"
185			#	ln -sf ../var/log/console console
186			#	cd "$__pwd"
187		fi
188		if checkyesno jail_fdescfs; then
189			info "Mounting fdescfs on ${jail_fdescdir}"
190			mount -t fdescfs fdesc "${jail_fdescdir}"
191		fi
192		if checkyesno jail_procfs; then
193			info "Mounting procfs onto ${jail_procdir}"
194			if [ -d "${jail_procdir}" ] ; then
195				mount -t procfs proc "${jail_procdir}"
196			fi
197		fi
198		_tmp_jail=${_tmp_dir}/jail.$$
199		eval jail -l -U root -i ${jail_rootdir} ${jail_hostname} \
200			${jail_ip} ${jail_exec_start} > ${_tmp_jail} 2>&1
201		[ "$?" -eq 0 ] && echo -n " $jail_hostname"
202		_jail_id=$(head -1 ${_tmp_jail})
203		tail +2 ${_tmp_jail} >${jail_rootdir}/var/log/console.log
204		rm -f ${_tmp_jail}
205		echo ${_jail_id} > /var/run/jail_${_jail}.id
206	done
207	rmdir ${_tmp_dir}
208	echo '.'
209}
210
211jail_stop()
212{
213	echo -n 'Stopping jails:'
214	for _jail in ${jail_list}
215	do
216		if [ -f "/var/run/jail_${_jail}.id" ]; then
217			_jail_id=$(cat /var/run/jail_${_jail}.id)
218			if [ ! -z "${_jail_id}" ]; then
219				init_variables $_jail
220				if [ -n "${jail_exec_stop}" ]; then
221					eval env -i /usr/sbin/jexec ${_jail_id} ${jail_exec_stop} \
222						>> ${jail_rootdir}/var/log/console.log 2>&1
223				fi
224				killall -j ${_jail_id} -TERM > /dev/null 2>&1
225				sleep 1
226				killall -j ${_jail_id} -KILL > /dev/null 2>&1
227				jail_umount_fs
228				echo -n " $jail_hostname"
229			fi
230			rm /var/run/jail_${_jail}.id
231		else
232			echo "cannot stop jail ${_jail}. No jail id in /var/run"
233		fi
234	done
235	echo '.'
236}
237
238load_rc_config $name
239[ -n "$2" ] && jail_list="$2"
240run_rc_command "$1"
241