7 # REQUIRE: LOGIN FILESYSTEMS
9 # KEYWORD: nojail shutdown
11 # WARNING: This script deals with untrusted data (the data and
12 # processes inside the jails) and care must be taken when changing the
13 # code related to this! If you have any doubt whether a change is
14 # correct and have security impact, please get the patch reviewed by
15 # the FreeBSD Security Team prior to commit.
22 start_precmd="jail_prestart"
23 start_cmd="jail_start"
27 # Initialize the various jail variables for jail _j.
34 warn "init_variables: you must specify a jail"
38 eval _rootdir=\"\$jail_${_j}_rootdir\"
39 _devdir="${_rootdir}/dev"
40 _fdescdir="${_devdir}/fd"
41 _procdir="${_rootdir}/proc"
42 eval _hostname=\"\$jail_${_j}_hostname\"
43 eval _ip=\"\$jail_${_j}_ip\"
44 eval _interface=\"\${jail_${_j}_interface:-${jail_interface}}\"
45 eval _exec=\"\$jail_${_j}_exec\"
49 eval _exec_prestart${i}=\"\${jail_${_j}_exec_prestart${i}:-\${jail_exec_prestart${i}}}\"
50 [ -z "$(eval echo \"\$_exec_prestart${i}\")" ] && break
54 eval _exec_start=\"\${jail_${_j}_exec_start:-${jail_exec_start}}\"
58 eval _exec_afterstart${i}=\"\${jail_${_j}_exec_afterstart${i}:-\${jail_exec_afterstart${i}}}\"
59 [ -z "$(eval echo \"\$_exec_afterstart${i}\")" ] && break
65 eval _exec_poststart${i}=\"\${jail_${_j}_exec_poststart${i}:-\${jail_exec_poststart${i}}}\"
66 [ -z "$(eval echo \"\$_exec_poststart${i}\")" ] && break
72 eval _exec_prestop${i}=\"\${jail_${_j}_exec_prestop${i}:-\${jail_exec_prestop${i}}}\"
73 [ -z "$(eval echo \"\$_exec_prestop${i}\")" ] && break
77 eval _exec_stop=\"\${jail_${_j}_exec_stop:-${jail_exec_stop}}\"
81 eval _exec_poststop${i}=\"\${jail_${_j}_exec_poststop${i}:-\${jail_exec_poststop${i}}}\"
82 [ -z "$(eval echo \"\$_exec_poststop${i}\")" ] && break
86 if [ -n "${_exec}" ]; then
87 # simple/backward-compatible execution
88 _exec_start="${_exec}"
92 if [ -z "${_exec_start}" ]; then
93 _exec_start="/bin/sh /etc/rc"
94 if [ -z "${_exec_stop}" ]; then
95 _exec_stop="/bin/sh /etc/rc.shutdown"
100 # The default jail ruleset will be used by rc.subr if none is specified.
101 eval _ruleset=\"\${jail_${_j}_devfs_ruleset:-${jail_devfs_ruleset}}\"
102 eval _devfs=\"\${jail_${_j}_devfs_enable:-${jail_devfs_enable}}\"
103 [ -z "${_devfs}" ] && _devfs="NO"
104 eval _fdescfs=\"\${jail_${_j}_fdescfs_enable:-${jail_fdescfs_enable}}\"
105 [ -z "${_fdescfs}" ] && _fdescfs="NO"
106 eval _procfs=\"\${jail_${_j}_procfs_enable:-${jail_procfs_enable}}\"
107 [ -z "${_procfs}" ] && _procfs="NO"
109 eval _mount=\"\${jail_${_j}_mount_enable:-${jail_mount_enable}}\"
110 [ -z "${_mount}" ] && _mount="NO"
111 # "/etc/fstab.${_j}" will be used for {,u}mount(8) if none is specified.
112 eval _fstab=\"\${jail_${_j}_fstab:-${jail_fstab}}\"
113 [ -z "${_fstab}" ] && _fstab="/etc/fstab.${_j}"
114 eval _flags=\"\${jail_${_j}_flags:-${jail_flags}}\"
115 [ -z "${_flags}" ] && _flags="-l -U root"
116 eval _consolelog=\"\${jail_${_j}_consolelog:-${jail_consolelog}}\"
117 [ -z "${_consolelog}" ] && _consolelog="/var/log/jail_${_j}_console.log"
118 eval _parameters=\"\${jail_${_j}_parameters:-${jail_parameters}}\"
119 [ -z "${_parameters}" ] && _parameters=""
120 eval _fib=\"\${jail_${_j}_fib:-${jail_fib}}\"
124 debug "$_j devfs enable: $_devfs"
125 debug "$_j fdescfs enable: $_fdescfs"
126 debug "$_j procfs enable: $_procfs"
127 debug "$_j mount enable: $_mount"
128 debug "$_j hostname: $_hostname"
130 jail_show_addresses ${_j}
131 debug "$_j interface: $_interface"
132 debug "$_j fib: $_fib"
133 debug "$_j root: $_rootdir"
134 debug "$_j devdir: $_devdir"
135 debug "$_j fdescdir: $_fdescdir"
136 debug "$_j procdir: $_procdir"
137 debug "$_j ruleset: $_ruleset"
138 debug "$_j fstab: $_fstab"
142 eval out=\"\${_exec_prestart${i}:-''}\"
143 if [ -z "$out" ]; then
146 debug "$_j exec pre-start #${i}: ${out}"
150 debug "$_j exec start: $_exec_start"
154 eval out=\"\${_exec_afterstart${i}:-''}\"
156 if [ -z "$out" ]; then
160 debug "$_j exec after start #${i}: ${out}"
166 eval out=\"\${_exec_poststart${i}:-''}\"
167 if [ -z "$out" ]; then
170 debug "$_j exec post-start #${i}: ${out}"
176 eval out=\"\${_exec_prestop${i}:-''}\"
177 if [ -z "$out" ]; then
180 debug "$_j exec pre-stop #${i}: ${out}"
184 debug "$_j exec stop: $_exec_stop"
188 eval out=\"\${_exec_poststop${i}:-''}\"
189 if [ -z "$out" ]; then
192 debug "$_j exec post-stop #${i}: ${out}"
196 debug "$_j flags: $_flags"
197 debug "$_j consolelog: $_consolelog"
198 debug "$_j parameters: $_parameters"
200 if [ -z "${_hostname}" ]; then
201 err 3 "$name: No hostname has been defined for ${_j}"
203 if [ -z "${_rootdir}" ]; then
204 err 3 "$name: No root directory has been defined for ${_j}"
208 # set_sysctl rc_knob mib msg
209 # If the mib sysctl is set according to what rc_knob
210 # specifies, this function does nothing. However if
211 # rc_knob is set differently than mib, then the mib
212 # is set accordingly and msg is displayed followed by
213 # an '=" sign and the word 'YES' or 'NO'.
221 _current=`${SYSCTL} -n $_mib 2>/dev/null`
222 if checkyesno $_knob ; then
223 if [ "$_current" -ne 1 ]; then
224 echo -n " ${_msg}=YES"
225 ${SYSCTL} 1>/dev/null ${_mib}=1
228 if [ "$_current" -ne 0 ]; then
229 echo -n " ${_msg}=NO"
230 ${SYSCTL} 1>/dev/null ${_mib}=0
235 # is_current_mountpoint()
236 # Is the directory mount point for a currently mounted file
239 is_current_mountpoint()
245 _dir=`echo $_dir | sed -Ee 's#//+#/#g' -e 's#/$##'`
246 [ ! -d "${_dir}" ] && return 1
247 _dir2=`df ${_dir} | tail +2 | awk '{ print $6 }'`
248 [ "${_dir}" = "${_dir2}" ]
252 # is_symlinked_mountpoint()
253 # Is a mount point, or any of its parent directories, a symlink?
255 is_symlinked_mountpoint()
261 [ -L "$_dir" ] && return 0
262 [ "$_dir" = "/" ] && return 1
263 is_symlinked_mountpoint `dirname $_dir`
268 # Try to unmount a mount point without being vulnerable to
277 if is_current_mountpoint ${_dir}; then
278 umount -f ${_dir} >/dev/null 2>&1
280 debug "Nothing mounted on ${_dir} - not unmounting"
286 # This function unmounts certain special filesystems in the
287 # currently selected jail. The caller must call the init_variables()
288 # routine before calling this one.
292 local _device _mountpt _rest
294 if checkyesno _fdescfs; then
295 if [ -d "${_fdescdir}" ] ; then
296 secure_umount ${_fdescdir}
299 if checkyesno _devfs; then
300 if [ -d "${_devdir}" ] ; then
301 secure_umount ${_devdir}
304 if checkyesno _procfs; then
305 if [ -d "${_procdir}" ] ; then
306 secure_umount ${_procdir}
309 if checkyesno _mount; then
310 [ -f "${_fstab}" ] || warn "${_fstab} does not exist"
311 tail -r ${_fstab} | while read _device _mountpt _rest; do
312 case ":${_device}" in
317 secure_umount ${_mountpt}
323 # Mount file systems from a per jail fstab while trying to
324 # secure against symlink attacks at the mount points.
326 # If we are certain we cannot secure against symlink attacks we
327 # do not mount all of the file systems (since we cannot just not
328 # mount the file system with the problematic mount point).
330 # The caller must call the init_variables() routine before
335 local _device _mountpt _rest
337 while read _device _mountpt _rest; do
338 case ":${_device}" in
343 if is_symlinked_mountpoint ${_mountpt}; then
344 warn "${_mountpt} has symlink as parent - not mounting from ${_fstab}"
348 mount -a -F "${_fstab}"
351 # jail_show_addresses jail
352 # Debug print the input for the given _multi aliases
353 # for a jail for init_variables().
355 jail_show_addresses()
361 if [ -z "${_j}" ]; then
362 warn "jail_show_addresses: you must specify a jail"
367 eval _addr=\"\$jail_${_j}_ip_multi${alias}\"
368 if [ -n "${_addr}" ]; then
369 debug "${_j} ip_multi${alias}: $_addr"
370 alias=$((${alias} + 1))
377 # jail_extract_address argument
378 # The second argument is the string from one of the _ip
379 # or the _multi variables. In case of a comma separated list
380 # only one argument must be passed in at a time.
381 # The function alters the _type, _iface, _addr and _mask variables.
383 jail_extract_address()
388 if [ -z "${_i}" ]; then
389 warn "jail_extract_address: called without input"
393 # Check if we have an interface prefix given and split into
396 *\|*) # ifN|.. prefix there
405 # In case the IP has no interface given, check if we have a global one.
406 _iface=${_iface:-${_interface}}
408 # Set address, cut off any prefix/netmask/prefixlen.
410 _addr=${_addr%%[/ ]*}
412 # Theoretically we can return here if interface is not set,
413 # as we only care about the _mask if we call ifconfig.
414 # This is not done because we may want to santize IP addresses
415 # based on _type later, and optionally change the type as well.
417 # Extract the prefix/netmask/prefixlen part by cutting off the address.
419 _mask=`expr "${_mask}" : "${_addr}\(.*\)"`
421 # Identify type {inet,inet6}.
423 *\.*\.*\.*) _type="inet" ;;
424 *:*) _type="inet6" ;;
425 *) warn "jail_extract_address: type not identified"
429 # Handle the special /netmask instead of /prefix or
430 # "netmask xxx" case for legacy IP.
431 # We do NOT support shortend class-full netmasks.
432 if [ "${_type}" = "inet" ]; then
434 /*\.*\.*\.*) _mask=" netmask ${_mask#/}" ;;
438 # In case _mask is still not set use /32.
441 elif [ "${_type}" = "inet6" ]; then
442 # In case _mask is not set for IPv6, use /128.
447 # jail_handle_ips_option {add,del} input
448 # Handle a single argument imput which can be a comma separated
449 # list of addresses (theoretically with an option interface and
450 # prefix/netmask/prefixlen).
452 jail_handle_ips_option()
454 local _x _action _type _i
458 if [ -z "${_x}" ]; then
459 # No IP given. This can happen for the primary address
460 # of each address family.
464 # Loop, in case we find a comma separated list, we need to handle
465 # each argument on its own.
466 while [ ${#_x} -gt 0 ]; do
468 *,*) # Extract the first argument and strip it off the list.
469 _i=`expr "${_x}" : '^\([^,]*\)'`
470 _x=`expr "${_x}" : "^[^,]*,\(.*\)"`
481 jail_extract_address "${_i}"
483 # make sure we got an address.
489 # Append address to list of addresses for the jail command.
493 "") _addrl="${_addr}" ;;
494 *) _addrl="${_addrl},${_addr}" ;;
499 "") _addr6l="${_addr}" ;;
500 *) _addr6l="${_addr6l},${_addr}" ;;
505 # Configure interface alias if requested by a given interface
506 # and if we could correctly parse everything.
512 inet6) ipv6_address_count=$((ipv6_address_count + 1)) ;;
513 *) warn "Could not determine address family. Not going" \
514 "to ${_action} address '${_addr}' for ${_jail}."
519 add) ifconfig ${_iface} ${_type} ${_addr}${_mask} alias
521 del) # When removing the IP, ignore the _mask.
522 ifconfig ${_iface} ${_type} ${_addr} -alias
529 # Extract the comma separated list of addresses and return them
530 # for the jail command.
531 # Handle more than one address via the _multi option as well.
532 # If an interface is given also add/remove an alias for the
533 # address with an optional netmask.
543 *) warn "jail_ips: invalid action '${_action}'"
550 jail_handle_ips_option ${_action} "${_ip}"
551 # Handle jail_xxx_ip_multi<N>
554 eval _x=\"\$jail_${_jail}_ip_multi${alias}\"
557 *) jail_handle_ips_option ${_action} "${_x}"
558 alias=$((${alias} + 1))
562 case ${ipv6_address_count} in
564 *) # Sleep 1 second to let DAD complete before starting services.
572 if checkyesno jail_parallel_start; then
579 echo -n 'Configuring jails:'
580 set_sysctl jail_set_hostname_allow security.jail.set_hostname_allowed \
582 set_sysctl jail_socket_unixiproute_only \
583 security.jail.socket_unixiproute_only unixiproute_only
584 set_sysctl jail_sysvipc_allow security.jail.sysvipc_allowed \
588 echo -n 'Starting jails:'
589 _tmp_dir=`mktemp -d /tmp/jail.XXXXXXXX` || \
590 err 3 "$name: Can't create temp dir, exiting..."
591 for _jail in ${jail_list}
593 init_variables $_jail
594 if [ -f /var/run/jail_${_jail}.id ]; then
595 echo -n " [${_hostname} already running (/var/run/jail_${_jail}.id exists)]"
601 if [ -n "${_fib}" ]; then
602 _setfib="setfib -F '${_fib}'"
606 if checkyesno _mount; then
607 info "Mounting fstab for jail ${_jail} (${_fstab})"
608 if [ ! -f "${_fstab}" ]; then
609 err 3 "$name: ${_fstab} does not exist"
613 if checkyesno _devfs; then
614 # If devfs is already mounted here, skip it.
615 df -t devfs "${_devdir}" >/dev/null
616 if [ $? -ne 0 ]; then
617 if is_symlinked_mountpoint ${_devdir}; then
618 warn "${_devdir} has symlink as parent - not starting jail ${_jail}"
621 info "Mounting devfs on ${_devdir}"
622 devfs_mount_jail "${_devdir}" ${_ruleset}
623 # Transitional symlink for old binaries
624 if [ ! -L "${_devdir}/log" ]; then
625 ln -sf ../var/run/log "${_devdir}/log"
629 # XXX - It seems symlinks don't work when there
630 # is a devfs(5) device of the same name.
631 # Jail console output
634 # ln -sf ../var/log/console console
637 if checkyesno _fdescfs; then
638 if is_symlinked_mountpoint ${_fdescdir}; then
639 warn "${_fdescdir} has symlink as parent, not mounting"
641 info "Mounting fdescfs on ${_fdescdir}"
642 mount -t fdescfs fdesc "${_fdescdir}"
645 if checkyesno _procfs; then
646 if is_symlinked_mountpoint ${_procdir}; then
647 warn "${_procdir} has symlink as parent, not mounting"
649 info "Mounting procfs onto ${_procdir}"
650 if [ -d "${_procdir}" ] ; then
651 mount -t procfs proc "${_procdir}"
655 _tmp_jail=${_tmp_dir}/jail.$$
659 eval out=\"\${_exec_prestart${i}:-''}\"
660 [ -z "$out" ] && break
665 eval ${_setfib} jail -n ${_jail} ${_flags} -i -c path=${_rootdir} host.hostname=${_hostname} \
666 ${_addrl:+ip4.addr=\"${_addrl}\"} ${_addr6l:+ip6.addr=\"${_addr6l}\"} \
667 ${_parameters} command=${_exec_start} > ${_tmp_jail} 2>&1 \
670 if [ "$?" -eq 0 ] ; then
671 _jail_id=$(head -1 ${_tmp_jail})
674 eval out=\"\${_exec_afterstart${i}:-''}\"
676 if [ -z "$out" ]; then
680 jexec "${_jail_id}" ${out}
684 echo -n " $_hostname"
685 tail +2 ${_tmp_jail} >${_consolelog}
686 echo ${_jail_id} > /var/run/jail_${_jail}.id
690 eval out=\"\${_exec_poststart${i}:-''}\"
691 [ -z "$out" ] && break
698 echo " cannot start jail \"${_jail}\": "
709 echo -n 'Stopping jails:'
710 for _jail in ${jail_list}
712 if [ -f "/var/run/jail_${_jail}.id" ]; then
713 _jail_id=$(cat /var/run/jail_${_jail}.id)
714 if [ ! -z "${_jail_id}" ]; then
715 init_variables $_jail
719 eval out=\"\${_exec_prestop${i}:-''}\"
720 [ -z "$out" ] && break
725 if [ -n "${_exec_stop}" ]; then
726 eval env -i /usr/sbin/jexec ${_jail_id} ${_exec_stop} \
727 >> ${_consolelog} 2>&1
729 killall -j ${_jail_id} -TERM > /dev/null 2>&1
731 killall -j ${_jail_id} -KILL > /dev/null 2>&1
733 echo -n " $_hostname"
737 eval out=\"\${_exec_poststop${i}:-''}\"
738 [ -z "$out" ] && break
744 rm /var/run/jail_${_jail}.id
746 echo " cannot stop jail ${_jail}. No jail id in /var/run"
754 if [ $# -gt 0 ]; then
761 run_rc_command "${cmd}"