jail revision 240336
183364Sdfr#!/bin/sh 283364Sdfr# 383364Sdfr# $FreeBSD: head/etc/rc.d/jail 240336 2012-09-11 05:04:59Z obrien $ 483364Sdfr# 583364Sdfr 683364Sdfr# PROVIDE: jail 783364Sdfr# REQUIRE: LOGIN FILESYSTEMS 883364Sdfr# BEFORE: securelevel 983364Sdfr# KEYWORD: nojail shutdown 1083364Sdfr 1183364Sdfr# WARNING: This script deals with untrusted data (the data and 1283364Sdfr# processes inside the jails) and care must be taken when changing the 1383364Sdfr# code related to this! If you have any doubt whether a change is 1483364Sdfr# correct and have security impact, please get the patch reviewed by 1583364Sdfr# the FreeBSD Security Team prior to commit. 1683364Sdfr 1783364Sdfr. /etc/rc.subr 1883364Sdfr 1983364Sdfrname="jail" 2083364Sdfrrcvar="jail_enable" 2183364Sdfr 2283364Sdfrstart_precmd="jail_prestart" 2383364Sdfrstart_cmd="jail_start" 2483364Sdfrstop_cmd="jail_stop" 2583364Sdfr 2683364Sdfr# init_variables _j 2783364Sdfr# Initialize the various jail variables for jail _j. 2883364Sdfr# 2983364Sdfrinit_variables() 3083364Sdfr{ 3183364Sdfr _j="$1" 3283364Sdfr 3383364Sdfr if [ -z "$_j" ]; then 3483364Sdfr warn "init_variables: you must specify a jail" 3583364Sdfr return 3683364Sdfr fi 3783364Sdfr 3883364Sdfr eval _rootdir=\"\$jail_${_j}_rootdir\" 3983364Sdfr _devdir="${_rootdir}/dev" 4083364Sdfr _fdescdir="${_devdir}/fd" 4183364Sdfr _procdir="${_rootdir}/proc" 4283364Sdfr eval _hostname=\"\$jail_${_j}_hostname\" 4383364Sdfr eval _ip=\"\$jail_${_j}_ip\" 4483364Sdfr eval _interface=\"\${jail_${_j}_interface:-${jail_interface}}\" 4583364Sdfr eval _exec=\"\$jail_${_j}_exec\" 4683364Sdfr 4783364Sdfr i=0 4883364Sdfr while : ; do 4983364Sdfr eval _exec_prestart${i}=\"\${jail_${_j}_exec_prestart${i}:-\${jail_exec_prestart${i}}}\" 5083364Sdfr [ -z "$(eval echo \"\$_exec_prestart${i}\")" ] && break 5183364Sdfr i=$((i + 1)) 5283364Sdfr done 5383364Sdfr 5483364Sdfr eval _exec_start=\"\${jail_${_j}_exec_start:-${jail_exec_start}}\" 5583364Sdfr 5683364Sdfr i=1 5783364Sdfr while : ; do 5883364Sdfr eval _exec_afterstart${i}=\"\${jail_${_j}_exec_afterstart${i}:-\${jail_exec_afterstart${i}}}\" 5983364Sdfr [ -z "$(eval echo \"\$_exec_afterstart${i}\")" ] && break 6083364Sdfr i=$((i + 1)) 6183364Sdfr done 6283364Sdfr 6383364Sdfr i=0 6483364Sdfr while : ; do 6583364Sdfr eval _exec_poststart${i}=\"\${jail_${_j}_exec_poststart${i}:-\${jail_exec_poststart${i}}}\" 6683364Sdfr [ -z "$(eval echo \"\$_exec_poststart${i}\")" ] && break 6783364Sdfr i=$((i + 1)) 6883364Sdfr done 6983364Sdfr 7083364Sdfr i=0 7183364Sdfr while : ; do 7283364Sdfr eval _exec_prestop${i}=\"\${jail_${_j}_exec_prestop${i}:-\${jail_exec_prestop${i}}}\" 7383364Sdfr [ -z "$(eval echo \"\$_exec_prestop${i}\")" ] && break 7483364Sdfr i=$((i + 1)) 7583364Sdfr done 7683364Sdfr 7783408Sdfr eval _exec_stop=\"\${jail_${_j}_exec_stop:-${jail_exec_stop}}\" 7883408Sdfr 7983408Sdfr i=0 8083408Sdfr while : ; do 8183364Sdfr eval _exec_poststop${i}=\"\${jail_${_j}_exec_poststop${i}:-\${jail_exec_poststop${i}}}\" 8283364Sdfr [ -z "$(eval echo \"\$_exec_poststop${i}\")" ] && break 8383364Sdfr i=$((i + 1)) 8483364Sdfr done 8583364Sdfr 8683364Sdfr if [ -n "${_exec}" ]; then 8783364Sdfr # simple/backward-compatible execution 8883364Sdfr _exec_start="${_exec}" 8983364Sdfr _exec_stop="" 9083364Sdfr else 9183364Sdfr # flexible execution 9283364Sdfr if [ -z "${_exec_start}" ]; then 9383364Sdfr _exec_start="/bin/sh /etc/rc" 9483364Sdfr if [ -z "${_exec_stop}" ]; then 95 _exec_stop="/bin/sh /etc/rc.shutdown" 96 fi 97 fi 98 fi 99 100 # The default jail ruleset will be used by rc.subr if none is specified. 101 eval _ruleset=\"\${jail_${_j}_devfs_ruleset:-${jail_devfs_ruleset}}\" 102 eval _devfs=\"\${jail_${_j}_devfs_enable:-${jail_devfs_enable}}\" 103 [ -z "${_devfs}" ] && _devfs="NO" 104 eval _fdescfs=\"\${jail_${_j}_fdescfs_enable:-${jail_fdescfs_enable}}\" 105 [ -z "${_fdescfs}" ] && _fdescfs="NO" 106 eval _procfs=\"\${jail_${_j}_procfs_enable:-${jail_procfs_enable}}\" 107 [ -z "${_procfs}" ] && _procfs="NO" 108 109 eval _mount=\"\${jail_${_j}_mount_enable:-${jail_mount_enable}}\" 110 [ -z "${_mount}" ] && _mount="NO" 111 # "/etc/fstab.${_j}" will be used for {,u}mount(8) if none is specified. 112 eval _fstab=\"\${jail_${_j}_fstab:-${jail_fstab}}\" 113 [ -z "${_fstab}" ] && _fstab="/etc/fstab.${_j}" 114 eval _flags=\"\${jail_${_j}_flags:-${jail_flags}}\" 115 [ -z "${_flags}" ] && _flags="-l -U root" 116 eval _consolelog=\"\${jail_${_j}_consolelog:-${jail_consolelog}}\" 117 [ -z "${_consolelog}" ] && _consolelog="/var/log/jail_${_j}_console.log" 118 eval _parameters=\"\${jail_${_j}_parameters:-${jail_parameters}}\" 119 [ -z "${_parameters}" ] && _parameters="" 120 eval _fib=\"\${jail_${_j}_fib:-${jail_fib}}\" 121 122 # Debugging aid 123 # 124 debug "$_j devfs enable: $_devfs" 125 debug "$_j fdescfs enable: $_fdescfs" 126 debug "$_j procfs enable: $_procfs" 127 debug "$_j mount enable: $_mount" 128 debug "$_j hostname: $_hostname" 129 debug "$_j ip: $_ip" 130 jail_show_addresses ${_j} 131 debug "$_j interface: $_interface" 132 debug "$_j fib: $_fib" 133 debug "$_j root: $_rootdir" 134 debug "$_j devdir: $_devdir" 135 debug "$_j fdescdir: $_fdescdir" 136 debug "$_j procdir: $_procdir" 137 debug "$_j ruleset: $_ruleset" 138 debug "$_j fstab: $_fstab" 139 140 i=0 141 while : ; do 142 eval out=\"\${_exec_prestart${i}:-''}\" 143 if [ -z "$out" ]; then 144 break 145 fi 146 debug "$_j exec pre-start #${i}: ${out}" 147 i=$((i + 1)) 148 done 149 150 debug "$_j exec start: $_exec_start" 151 152 i=1 153 while : ; do 154 eval out=\"\${_exec_afterstart${i}:-''}\" 155 156 if [ -z "$out" ]; then 157 break; 158 fi 159 160 debug "$_j exec after start #${i}: ${out}" 161 i=$((i + 1)) 162 done 163 164 i=0 165 while : ; do 166 eval out=\"\${_exec_poststart${i}:-''}\" 167 if [ -z "$out" ]; then 168 break 169 fi 170 debug "$_j exec post-start #${i}: ${out}" 171 i=$((i + 1)) 172 done 173 174 i=0 175 while : ; do 176 eval out=\"\${_exec_prestop${i}:-''}\" 177 if [ -z "$out" ]; then 178 break 179 fi 180 debug "$_j exec pre-stop #${i}: ${out}" 181 i=$((i + 1)) 182 done 183 184 debug "$_j exec stop: $_exec_stop" 185 186 i=0 187 while : ; do 188 eval out=\"\${_exec_poststop${i}:-''}\" 189 if [ -z "$out" ]; then 190 break 191 fi 192 debug "$_j exec post-stop #${i}: ${out}" 193 i=$((i + 1)) 194 done 195 196 debug "$_j flags: $_flags" 197 debug "$_j consolelog: $_consolelog" 198 debug "$_j parameters: $_parameters" 199 200 if [ -z "${_hostname}" ]; then 201 err 3 "$name: No hostname has been defined for ${_j}" 202 fi 203 if [ -z "${_rootdir}" ]; then 204 err 3 "$name: No root directory has been defined for ${_j}" 205 fi 206} 207 208# set_sysctl rc_knob mib msg 209# If the mib sysctl is set according to what rc_knob 210# specifies, this function does nothing. However if 211# rc_knob is set differently than mib, then the mib 212# is set accordingly and msg is displayed followed by 213# an '=" sign and the word 'YES' or 'NO'. 214# 215set_sysctl() 216{ 217 _knob="$1" 218 _mib="$2" 219 _msg="$3" 220 221 _current=`${SYSCTL} -n $_mib 2>/dev/null` 222 if checkyesno $_knob ; then 223 if [ "$_current" -ne 1 ]; then 224 echo -n " ${_msg}=YES" 225 ${SYSCTL} 1>/dev/null ${_mib}=1 226 fi 227 else 228 if [ "$_current" -ne 0 ]; then 229 echo -n " ${_msg}=NO" 230 ${SYSCTL} 1>/dev/null ${_mib}=0 231 fi 232 fi 233} 234 235# is_current_mountpoint() 236# Is the directory mount point for a currently mounted file 237# system? 238# 239is_current_mountpoint() 240{ 241 local _dir _dir2 242 243 _dir=$1 244 245 _dir=`echo $_dir | sed -Ee 's#//+#/#g' -e 's#/$##'` 246 [ ! -d "${_dir}" ] && return 1 247 _dir2=`df ${_dir} | tail +2 | awk '{ print $6 }'` 248 [ "${_dir}" = "${_dir2}" ] 249 return $? 250} 251 252# is_symlinked_mountpoint() 253# Is a mount point, or any of its parent directories, a symlink? 254# 255is_symlinked_mountpoint() 256{ 257 local _dir 258 259 _dir=$1 260 261 [ -L "$_dir" ] && return 0 262 [ "$_dir" = "/" ] && return 1 263 is_symlinked_mountpoint `dirname $_dir` 264 return $? 265} 266 267# secure_umount 268# Try to unmount a mount point without being vulnerable to 269# symlink attacks. 270# 271secure_umount() 272{ 273 local _dir 274 275 _dir=$1 276 277 if is_current_mountpoint ${_dir}; then 278 umount -f ${_dir} >/dev/null 2>&1 279 else 280 debug "Nothing mounted on ${_dir} - not unmounting" 281 fi 282} 283 284 285# jail_umount_fs 286# This function unmounts certain special filesystems in the 287# currently selected jail. The caller must call the init_variables() 288# routine before calling this one. 289# 290jail_umount_fs() 291{ 292 local _device _mountpt _rest 293 294 if checkyesno _fdescfs; then 295 if [ -d "${_fdescdir}" ] ; then 296 secure_umount ${_fdescdir} 297 fi 298 fi 299 if checkyesno _devfs; then 300 if [ -d "${_devdir}" ] ; then 301 secure_umount ${_devdir} 302 fi 303 fi 304 if checkyesno _procfs; then 305 if [ -d "${_procdir}" ] ; then 306 secure_umount ${_procdir} 307 fi 308 fi 309 if checkyesno _mount; then 310 [ -f "${_fstab}" ] || warn "${_fstab} does not exist" 311 tail -r ${_fstab} | while read _device _mountpt _rest; do 312 case ":${_device}" in 313 :#* | :) 314 continue 315 ;; 316 esac 317 secure_umount ${_mountpt} 318 done 319 fi 320} 321 322# jail_mount_fstab() 323# Mount file systems from a per jail fstab while trying to 324# secure against symlink attacks at the mount points. 325# 326# If we are certain we cannot secure against symlink attacks we 327# do not mount all of the file systems (since we cannot just not 328# mount the file system with the problematic mount point). 329# 330# The caller must call the init_variables() routine before 331# calling this one. 332# 333jail_mount_fstab() 334{ 335 local _device _mountpt _rest 336 337 while read _device _mountpt _rest; do 338 case ":${_device}" in 339 :#* | :) 340 continue 341 ;; 342 esac 343 if is_symlinked_mountpoint ${_mountpt}; then 344 warn "${_mountpt} has symlink as parent - not mounting from ${_fstab}" 345 return 346 fi 347 done <${_fstab} 348 mount -a -F "${_fstab}" 349} 350 351# jail_show_addresses jail 352# Debug print the input for the given _multi aliases 353# for a jail for init_variables(). 354# 355jail_show_addresses() 356{ 357 local _j _type alias 358 _j="$1" 359 alias=0 360 361 if [ -z "${_j}" ]; then 362 warn "jail_show_addresses: you must specify a jail" 363 return 364 fi 365 366 while : ; do 367 eval _addr=\"\$jail_${_j}_ip_multi${alias}\" 368 if [ -n "${_addr}" ]; then 369 debug "${_j} ip_multi${alias}: $_addr" 370 alias=$((${alias} + 1)) 371 else 372 break 373 fi 374 done 375} 376 377# jail_extract_address argument 378# The second argument is the string from one of the _ip 379# or the _multi variables. In case of a comma separated list 380# only one argument must be passed in at a time. 381# The function alters the _type, _iface, _addr and _mask variables. 382# 383jail_extract_address() 384{ 385 local _i 386 _i=$1 387 388 if [ -z "${_i}" ]; then 389 warn "jail_extract_address: called without input" 390 return 391 fi 392 393 # Check if we have an interface prefix given and split into 394 # iFace and rest. 395 case "${_i}" in 396 *\|*) # ifN|.. prefix there 397 _iface=${_i%%|*} 398 _r=${_i##*|} 399 ;; 400 *) _iface="" 401 _r=${_i} 402 ;; 403 esac 404 405 # In case the IP has no interface given, check if we have a global one. 406 _iface=${_iface:-${_interface}} 407 408 # Set address, cut off any prefix/netmask/prefixlen. 409 _addr=${_r} 410 _addr=${_addr%%[/ ]*} 411 412 # Theoretically we can return here if interface is not set, 413 # as we only care about the _mask if we call ifconfig. 414 # This is not done because we may want to santize IP addresses 415 # based on _type later, and optionally change the type as well. 416 417 # Extract the prefix/netmask/prefixlen part by cutting off the address. 418 _mask=${_r} 419 _mask=`expr "${_mask}" : "${_addr}\(.*\)"` 420 421 # Identify type {inet,inet6}. 422 case "${_addr}" in 423 *\.*\.*\.*) _type="inet" ;; 424 *:*) _type="inet6" ;; 425 *) warn "jail_extract_address: type not identified" 426 ;; 427 esac 428 429 # Handle the special /netmask instead of /prefix or 430 # "netmask xxx" case for legacy IP. 431 # We do NOT support shortend class-full netmasks. 432 if [ "${_type}" = "inet" ]; then 433 case "${_mask}" in 434 /*\.*\.*\.*) _mask=" netmask ${_mask#/}" ;; 435 *) ;; 436 esac 437 438 # In case _mask is still not set use /32. 439 _mask=${_mask:-/32} 440 441 elif [ "${_type}" = "inet6" ]; then 442 # In case _maske is not set for IPv6, use /128. 443 _mask=${_mask:-/128} 444 fi 445} 446 447# jail_handle_ips_option {add,del} input 448# Handle a single argument imput which can be a comma separated 449# list of addresses (theoretically with an option interface and 450# prefix/netmask/prefixlen). 451# 452jail_handle_ips_option() 453{ 454 local _x _action _type _i 455 _action=$1 456 _x=$2 457 458 if [ -z "${_x}" ]; then 459 # No IP given. This can happen for the primary address 460 # of each address family. 461 return 462 fi 463 464 # Loop, in case we find a comma separated list, we need to handle 465 # each argument on its own. 466 while [ ${#_x} -gt 0 ]; do 467 case "${_x}" in 468 *,*) # Extract the first argument and strip it off the list. 469 _i=`expr "${_x}" : '^\([^,]*\)'` 470 _x=`expr "${_x}" : "^[^,]*,\(.*\)"` 471 ;; 472 *) _i=${_x} 473 _x="" 474 ;; 475 esac 476 477 _type="" 478 _iface="" 479 _addr="" 480 _mask="" 481 jail_extract_address "${_i}" 482 483 # make sure we got an address. 484 case "${_addr}" in 485 "") continue ;; 486 *) ;; 487 esac 488 489 # Append address to list of addresses for the jail command. 490 case "${_type}" in 491 inet) 492 case "${_addrl}" in 493 "") _addrl="${_addr}" ;; 494 *) _addrl="${_addrl},${_addr}" ;; 495 esac 496 ;; 497 inet6) 498 case "${_addr6l}" in 499 "") _addr6l="${_addr}" ;; 500 *) _addr6l="${_addr6l},${_addr}" ;; 501 esac 502 ;; 503 esac 504 505 # Configure interface alias if requested by a given interface 506 # and if we could correctly parse everything. 507 case "${_iface}" in 508 "") continue ;; 509 esac 510 case "${_type}" in 511 inet) ;; 512 inet6) ;; 513 *) warn "Could not determine address family. Not going" \ 514 "to ${_action} address '${_addr}' for ${_jail}." 515 continue 516 ;; 517 esac 518 case "${_action}" in 519 add) ifconfig ${_iface} ${_type} ${_addr}${_mask} alias 520 ;; 521 del) # When removing the IP, ignore the _mask. 522 ifconfig ${_iface} ${_type} ${_addr} -alias 523 ;; 524 esac 525 done 526} 527 528# jail_ips {add,del} 529# Extract the comma separated list of addresses and return them 530# for the jail command. 531# Handle more than one address via the _multi option as well. 532# If an interface is given also add/remove an alias for the 533# address with an optional netmask. 534# 535jail_ips() 536{ 537 local _action 538 _action=$1 539 540 case "${_action}" in 541 add) ;; 542 del) ;; 543 *) warn "jail_ips: invalid action '${_action}'" 544 return 545 ;; 546 esac 547 548 # Handle addresses. 549 jail_handle_ips_option ${_action} "${_ip}" 550 # Handle jail_xxx_ip_multi<N> 551 alias=0 552 while : ; do 553 eval _x=\"\$jail_${_jail}_ip_multi${alias}\" 554 case "${_x}" in 555 "") break ;; 556 *) jail_handle_ips_option ${_action} "${_x}" 557 alias=$((${alias} + 1)) 558 ;; 559 esac 560 done 561} 562 563jail_prestart() 564{ 565 if checkyesno jail_parallel_start; then 566 command_args='&' 567 fi 568} 569 570jail_start() 571{ 572 echo -n 'Configuring jails:' 573 set_sysctl jail_set_hostname_allow security.jail.set_hostname_allowed \ 574 set_hostname_allow 575 set_sysctl jail_socket_unixiproute_only \ 576 security.jail.socket_unixiproute_only unixiproute_only 577 set_sysctl jail_sysvipc_allow security.jail.sysvipc_allowed \ 578 sysvipc_allow 579 echo '.' 580 581 echo -n 'Starting jails:' 582 _tmp_dir=`mktemp -d /tmp/jail.XXXXXXXX` || \ 583 err 3 "$name: Can't create temp dir, exiting..." 584 for _jail in ${jail_list} 585 do 586 init_variables $_jail 587 if [ -f /var/run/jail_${_jail}.id ]; then 588 echo -n " [${_hostname} already running (/var/run/jail_${_jail}.id exists)]" 589 continue; 590 fi 591 _addrl="" 592 _addr6l="" 593 jail_ips "add" 594 if [ -n "${_fib}" ]; then 595 _setfib="setfib -F '${_fib}'" 596 else 597 _setfib="" 598 fi 599 if checkyesno _mount; then 600 info "Mounting fstab for jail ${_jail} (${_fstab})" 601 if [ ! -f "${_fstab}" ]; then 602 err 3 "$name: ${_fstab} does not exist" 603 fi 604 jail_mount_fstab 605 fi 606 if checkyesno _devfs; then 607 # If devfs is already mounted here, skip it. 608 df -t devfs "${_devdir}" >/dev/null 609 if [ $? -ne 0 ]; then 610 if is_symlinked_mountpoint ${_devdir}; then 611 warn "${_devdir} has symlink as parent - not starting jail ${_jail}" 612 continue 613 fi 614 info "Mounting devfs on ${_devdir}" 615 devfs_mount_jail "${_devdir}" ${_ruleset} 616 # Transitional symlink for old binaries 617 if [ ! -L "${_devdir}/log" ]; then 618 ln -sf ../var/run/log "${_devdir}/log" 619 fi 620 fi 621 622 # XXX - It seems symlinks don't work when there 623 # is a devfs(5) device of the same name. 624 # Jail console output 625 # __pwd="`pwd`" 626 # cd "${_devdir}" 627 # ln -sf ../var/log/console console 628 # cd "$__pwd" 629 fi 630 if checkyesno _fdescfs; then 631 if is_symlinked_mountpoint ${_fdescdir}; then 632 warn "${_fdescdir} has symlink as parent, not mounting" 633 else 634 info "Mounting fdescfs on ${_fdescdir}" 635 mount -t fdescfs fdesc "${_fdescdir}" 636 fi 637 fi 638 if checkyesno _procfs; then 639 if is_symlinked_mountpoint ${_procdir}; then 640 warn "${_procdir} has symlink as parent, not mounting" 641 else 642 info "Mounting procfs onto ${_procdir}" 643 if [ -d "${_procdir}" ] ; then 644 mount -t procfs proc "${_procdir}" 645 fi 646 fi 647 fi 648 _tmp_jail=${_tmp_dir}/jail.$$ 649 650 i=0 651 while : ; do 652 eval out=\"\${_exec_prestart${i}:-''}\" 653 [ -z "$out" ] && break 654 ${out} 655 i=$((i + 1)) 656 done 657 658 eval ${_setfib} jail -n ${_jail} ${_flags} -i -c path=${_rootdir} host.hostname=${_hostname} \ 659 ip4.addr=\"${_addrl}\" ip6.addr=\"${_addr6l}\" ${_parameters} command=${_exec_start} > ${_tmp_jail} 2>&1 \ 660 </dev/null 661 662 if [ "$?" -eq 0 ] ; then 663 _jail_id=$(head -1 ${_tmp_jail}) 664 i=1 665 while : ; do 666 eval out=\"\${_exec_afterstart${i}:-''}\" 667 668 if [ -z "$out" ]; then 669 break; 670 fi 671 672 jexec "${_jail_id}" ${out} 673 i=$((i + 1)) 674 done 675 676 echo -n " $_hostname" 677 tail +2 ${_tmp_jail} >${_consolelog} 678 echo ${_jail_id} > /var/run/jail_${_jail}.id 679 680 i=0 681 while : ; do 682 eval out=\"\${_exec_poststart${i}:-''}\" 683 [ -z "$out" ] && break 684 ${out} 685 i=$((i + 1)) 686 done 687 else 688 jail_umount_fs 689 jail_ips "del" 690 echo " cannot start jail \"${_jail}\": " 691 tail +2 ${_tmp_jail} 692 fi 693 rm -f ${_tmp_jail} 694 done 695 rmdir ${_tmp_dir} 696 echo '.' 697} 698 699jail_stop() 700{ 701 echo -n 'Stopping jails:' 702 for _jail in ${jail_list} 703 do 704 if [ -f "/var/run/jail_${_jail}.id" ]; then 705 _jail_id=$(cat /var/run/jail_${_jail}.id) 706 if [ ! -z "${_jail_id}" ]; then 707 init_variables $_jail 708 709 i=0 710 while : ; do 711 eval out=\"\${_exec_prestop${i}:-''}\" 712 [ -z "$out" ] && break 713 ${out} 714 i=$((i + 1)) 715 done 716 717 if [ -n "${_exec_stop}" ]; then 718 eval env -i /usr/sbin/jexec ${_jail_id} ${_exec_stop} \ 719 >> ${_consolelog} 2>&1 720 fi 721 killall -j ${_jail_id} -TERM > /dev/null 2>&1 722 sleep 1 723 killall -j ${_jail_id} -KILL > /dev/null 2>&1 724 jail_umount_fs 725 echo -n " $_hostname" 726 727 i=0 728 while : ; do 729 eval out=\"\${_exec_poststop${i}:-''}\" 730 [ -z "$out" ] && break 731 ${out} 732 i=$((i + 1)) 733 done 734 fi 735 jail_ips "del" 736 rm /var/run/jail_${_jail}.id 737 else 738 echo " cannot stop jail ${_jail}. No jail id in /var/run" 739 fi 740 done 741 echo '.' 742} 743 744load_rc_config $name 745cmd="$1" 746if [ $# -gt 0 ]; then 747 shift 748fi 749if [ -n "$*" ]; then 750 jail_list="$*" 751fi 752 753run_rc_command "${cmd}" 754