etc/rc.d/jail

   1 #!/bin/sh
   2 #
   3 # $FreeBSD$
   4 #
   5
   6 # PROVIDE: jail
   7 # REQUIRE: LOGIN cleanvar
   8 # BEFORE: securelevel
   9 # KEYWORD: nojail shutdown
  10
  11 # WARNING: This script deals with untrusted data (the data and
  12 # processes inside the jails) and care must be taken when changing the
  13 # code related to this!  If you have any doubt whether a change is
  14 # correct and have security impact, please get the patch reviewed by
  15 # the FreeBSD Security Team prior to commit.
  16
  17 . /etc/rc.subr
  18
  19 name="jail"
  20 rcvar=`set_rcvar`
  21 start_cmd="jail_start"
  22 stop_cmd="jail_stop"
  23
  24 # init_variables _j
  25 #       Initialize the various jail variables for jail _j.
  26 #
  27 init_variables()
  28 {
  29         _j="$1"
  30
  31         if [ -z "$_j" ]; then
  32                 warn "init_variables: you must specify a jail"
  33                 return
  34         fi
  35
  36         eval _rootdir=\"\$jail_${_j}_rootdir\"
  37         _devdir="${_rootdir}/dev"
  38         _fdescdir="${_devdir}/fd"
  39         _procdir="${_rootdir}/proc"
  40         eval _hostname=\"\$jail_${_j}_hostname\"
  41         eval _ip=\"\$jail_${_j}_ip\"
  42         eval _interface=\"\${jail_${_j}_interface:-${jail_interface}}\"
  43         eval _exec=\"\$jail_${_j}_exec\"
  44
  45         i=0
  46         while : ; do
  47                 eval _exec_prestart${i}=\"\${jail_${_j}_exec_prestart${i}:-\${jail_exec_prestart${i}}}\"
  48                 [ -z "$(eval echo \"\$_exec_prestart${i}\")" ] && break
  49                 i=$((i + 1))
  50         done
  51
  52         eval _exec_start=\"\${jail_${_j}_exec_start:-${jail_exec_start}}\"
  53
  54         i=1
  55         while : ; do
  56                 eval _exec_afterstart${i}=\"\${jail_${_j}_exec_afterstart${i}:-\${jail_exec_afterstart${i}}}\"
  57                 [ -z "$(eval echo \"\$_exec_afterstart${i}\")" ] &&  break
  58                 i=$((i + 1))
  59         done
  60
  61         i=0
  62         while : ; do
  63                 eval _exec_poststart${i}=\"\${jail_${_j}_exec_poststart${i}:-\${jail_exec_poststart${i}}}\"
  64                 [ -z "$(eval echo \"\$_exec_poststart${i}\")" ] && break
  65                 i=$((i + 1))
  66         done
  67
  68         i=0
  69         while : ; do
  70                 eval _exec_prestop${i}=\"\${jail_${_j}_exec_prestop${i}:-\${jail_exec_prestop${i}}}\"
  71                 [ -z "$(eval echo \"\$_exec_prestop${i}\")" ] && break
  72                 i=$((i + 1))
  73         done
  74
  75         eval _exec_stop=\"\${jail_${_j}_exec_stop:-${jail_exec_stop}}\"
  76
  77         i=0
  78         while : ; do
  79                 eval _exec_poststop${i}=\"\${jail_${_j}_exec_poststop${i}:-\${jail_exec_poststop${i}}}\"
  80                 [ -z "$(eval echo \"\$_exec_poststop${i}\")" ] && break
  81                 i=$((i + 1))
  82         done
  83
  84         if [ -n "${_exec}" ]; then
  85                 #   simple/backward-compatible execution
  86                 _exec_start="${_exec}"
  87                 _exec_stop=""
  88         else
  89                 #   flexible execution
  90                 if [ -z "${_exec_start}" ]; then
  91                         _exec_start="/bin/sh /etc/rc"
  92                         if [ -z "${_exec_stop}" ]; then
  93                                 _exec_stop="/bin/sh /etc/rc.shutdown"
  94                         fi
  95                 fi
  96         fi
  97
  98         # The default jail ruleset will be used by rc.subr if none is specified.
  99         eval _ruleset=\"\${jail_${_j}_devfs_ruleset:-${jail_devfs_ruleset}}\"
 100         eval _devfs=\"\${jail_${_j}_devfs_enable:-${jail_devfs_enable}}\"
 101         [ -z "${_devfs}" ] && _devfs="NO"
 102         eval _fdescfs=\"\${jail_${_j}_fdescfs_enable:-${jail_fdescfs_enable}}\"
 103         [ -z "${_fdescfs}" ] && _fdescfs="NO"
 104         eval _procfs=\"\${jail_${_j}_procfs_enable:-${jail_procfs_enable}}\"
 105         [ -z "${_procfs}" ] && _procfs="NO"
 106
 107         eval _mount=\"\${jail_${_j}_mount_enable:-${jail_mount_enable}}\"
 108         [ -z "${_mount}" ] && _mount="NO"
 109         # "/etc/fstab.${_j}" will be used for {,u}mount(8) if none is specified.
 110         eval _fstab=\"\${jail_${_j}_fstab:-${jail_fstab}}\"
 111         [ -z "${_fstab}" ] && _fstab="/etc/fstab.${_j}"
 112         eval _flags=\"\${jail_${_j}_flags:-${jail_flags}}\"
 113         [ -z "${_flags}" ] && _flags="-l -U root"
 114         eval _consolelog=\"\${jail_${_j}_consolelog:-${jail_consolelog}}\"
 115         [ -z "${_consolelog}" ] && _consolelog="/var/log/jail_${_j}_console.log"
 116         eval _fib=\"\${jail_${_j}_fib:-${jail_fib}}\"
 117
 118         # Debugging aid
 119         #
 120         debug "$_j devfs enable: $_devfs"
 121         debug "$_j fdescfs enable: $_fdescfs"
 122         debug "$_j procfs enable: $_procfs"
 123         debug "$_j mount enable: $_mount"
 124         debug "$_j hostname: $_hostname"
 125         debug "$_j ip: $_ip"
 126         jail_show_addresses ${_j}
 127         debug "$_j interface: $_interface"
 128         debug "$_j fib: $_fib"
 129         debug "$_j root: $_rootdir"
 130         debug "$_j devdir: $_devdir"
 131         debug "$_j fdescdir: $_fdescdir"
 132         debug "$_j procdir: $_procdir"
 133         debug "$_j ruleset: $_ruleset"
 134         debug "$_j fstab: $_fstab"
 135
 136         i=0
 137         while : ; do
 138                 eval out=\"\${_exec_prestart${i}:-''}\"
 139                 if [ -z "$out" ]; then
 140                         break
 141                 fi
 142                 debug "$_j exec pre-start #${i}: ${out}"
 143                 i=$((i + 1))
 144         done
 145
 146         debug "$_j exec start: $_exec_start"
 147
 148         i=1
 149         while : ; do
 150                 eval out=\"\${_exec_afterstart${i}:-''}\"
 151
 152                 if [ -z "$out" ]; then
 153                         break;
 154                 fi
 155
 156                 debug "$_j exec after start #${i}: ${out}"
 157                 i=$((i + 1))
 158         done
 159
 160         i=0
 161         while : ; do
 162                 eval out=\"\${_exec_poststart${i}:-''}\"
 163                 if [ -z "$out" ]; then
 164                         break
 165                 fi
 166                 debug "$_j exec post-start #${i}: ${out}"
 167                 i=$((i + 1))
 168         done
 169
 170         i=0
 171         while : ; do
 172                 eval out=\"\${_exec_prestop${i}:-''}\"
 173                 if [ -z "$out" ]; then
 174                         break
 175                 fi
 176                 debug "$_j exec pre-stop #${i}: ${out}"
 177                 i=$((i + 1))
 178         done
 179
 180         debug "$_j exec stop: $_exec_stop"
 181
 182         i=0
 183         while : ; do
 184                 eval out=\"\${_exec_poststop${i}:-''}\"
 185                 if [ -z "$out" ]; then
 186                         break
 187                 fi
 188                 debug "$_j exec post-stop #${i}: ${out}"
 189                 i=$((i + 1))
 190         done
 191
 192         debug "$_j flags: $_flags"
 193         debug "$_j consolelog: $_consolelog"
 194
 195         if [ -z "${_hostname}" ]; then
 196                 err 3 "$name: No hostname has been defined for ${_j}"
 197         fi
 198         if [ -z "${_rootdir}" ]; then
 199                 err 3 "$name: No root directory has been defined for ${_j}"
 200         fi
 201 }
 202
 203 # set_sysctl rc_knob mib msg
 204 #       If the mib sysctl is set according to what rc_knob
 205 #       specifies, this function does nothing. However if
 206 #       rc_knob is set differently than mib, then the mib
 207 #       is set accordingly and msg is displayed followed by
 208 #       an '=" sign and the word 'YES' or 'NO'.
 209 #
 210 set_sysctl()
 211 {
 212         _knob="$1"
 213         _mib="$2"
 214         _msg="$3"
 215
 216         _current=`${SYSCTL} -n $_mib 2>/dev/null`
 217         if checkyesno $_knob ; then
 218                 if [ "$_current" -ne 1 ]; then
 219                         echo -n " ${_msg}=YES"
 220                         ${SYSCTL_W} 1>/dev/null ${_mib}=1
 221                 fi
 222         else
 223                 if [ "$_current" -ne 0 ]; then
 224                         echo -n " ${_msg}=NO"
 225                         ${SYSCTL_W} 1>/dev/null ${_mib}=0
 226                 fi
 227         fi
 228 }
 229
 230 # is_current_mountpoint()
 231 #       Is the directory mount point for a currently mounted file
 232 #       system?
 233 #
 234 is_current_mountpoint()
 235 {
 236         local _dir _dir2
 237
 238         _dir=$1
 239
 240         _dir=`echo $_dir | sed -Ee 's#//+#/#g' -e 's#/$##'`
 241         [ ! -d "${_dir}" ] && return 1
 242         _dir2=`df ${_dir} | tail +2 | awk '{ print $6 }'`
 243         [ "${_dir}" = "${_dir2}" ]
 244         return $?
 245 }
 246
 247 # is_symlinked_mountpoint()
 248 #       Is a mount point, or any of its parent directories, a symlink?
 249 #
 250 is_symlinked_mountpoint()
 251 {
 252         local _dir
 253
 254         _dir=$1
 255
 256         [ -L "$_dir" ] && return 0
 257         [ "$_dir" = "/" ] && return 1
 258         is_symlinked_mountpoint `dirname $_dir`
 259         return $?
 260 }
 261
 262 # secure_umount
 263 #       Try to unmount a mount point without being vulnerable to
 264 #       symlink attacks.
 265 #
 266 secure_umount()
 267 {
 268         local _dir
 269
 270         _dir=$1
 271
 272         if is_current_mountpoint ${_dir}; then
 273                 umount -f ${_dir} >/dev/null 2>&1
 274         else
 275                 debug "Nothing mounted on ${_dir} - not unmounting"
 276         fi
 277 }
 278
 279
 280 # jail_umount_fs
 281 #       This function unmounts certain special filesystems in the
 282 #       currently selected jail. The caller must call the init_variables()
 283 #       routine before calling this one.
 284 #
 285 jail_umount_fs()
 286 {
 287         local _device _mountpt _rest
 288
 289         if checkyesno _fdescfs; then
 290                 if [ -d "${_fdescdir}" ] ; then
 291                         secure_umount ${_fdescdir}
 292                 fi
 293         fi
 294         if checkyesno _devfs; then
 295                 if [ -d "${_devdir}" ] ; then
 296                         secure_umount ${_devdir}
 297                 fi
 298         fi
 299         if checkyesno _procfs; then
 300                 if [ -d "${_procdir}" ] ; then
 301                         secure_umount ${_procdir}
 302                 fi
 303         fi
 304         if checkyesno _mount; then
 305                 [ -f "${_fstab}" ] || warn "${_fstab} does not exist"
 306                 tail -r ${_fstab} | while read _device _mountpt _rest; do
 307                         case ":${_device}" in
 308                         :#* | :)
 309                                 continue
 310                                 ;;
 311                         esac
 312                         secure_umount ${_mountpt}
 313                 done
 314         fi
 315 }
 316
 317 # jail_mount_fstab()
 318 #       Mount file systems from a per jail fstab while trying to
 319 #       secure against symlink attacks at the mount points.
 320 #
 321 #       If we are certain we cannot secure against symlink attacks we
 322 #       do not mount all of the file systems (since we cannot just not
 323 #       mount the file system with the problematic mount point).
 324 #
 325 #       The caller must call the init_variables() routine before
 326 #       calling this one.
 327 #
 328 jail_mount_fstab()
 329 {
 330         local _device _mountpt _rest
 331
 332         while read _device _mountpt _rest; do
 333                 case ":${_device}" in
 334                 :#* | :)
 335                         continue
 336                         ;;
 337                 esac
 338                 if is_symlinked_mountpoint ${_mountpt}; then
 339                         warn "${_mountpt} has symlink as parent - not mounting from ${_fstab}"
 340                         return
 341                 fi
 342         done <${_fstab}
 343         mount -a -F "${_fstab}"
 344 }
 345
 346 # jail_show_addresses jail
 347 #       Debug print the input for the given _multi aliases
 348 #       for a jail for init_variables().
 349 #
 350 jail_show_addresses()
 351 {
 352         local _j _type alias
 353         _j="$1"
 354         alias=0
 355
 356         if [ -z "${_j}" ]; then
 357                 warn "jail_show_addresses: you must specify a jail"
 358                 return
 359         fi
 360
 361         while : ; do
 362                 eval _addr=\"\$jail_${_j}_ip_multi${alias}\"
 363                 if [ -n "${_addr}" ]; then
 364                         debug "${_j} ip_multi${alias}: $_addr"
 365                         alias=$((${alias} + 1))
 366                 else
 367                         break
 368                 fi
 369         done
 370 }
 371
 372 # jail_extract_address argument
 373 #       The second argument is the string from one of the _ip
 374 #       or the _multi variables. In case of a comma separated list
 375 #       only one argument must be passed in at a time.
 376 #       The function alters the _type, _iface, _addr and _mask variables.
 377 #
 378 jail_extract_address()
 379 {
 380         local _i
 381         _i=$1
 382
 383         if [ -z "${_i}" ]; then
 384                 warn "jail_extract_address: called without input"
 385                 return
 386         fi
 387
 388         # Check if we have an interface prefix given and split into
 389         # iFace and rest.
 390         case "${_i}" in
 391         *\|*)   # ifN|.. prefix there
 392                 _iface=${_i%%|*}
 393                 _r=${_i##*|}
 394                 ;;
 395         *)      _iface=""
 396                 _r=${_i}
 397                 ;;
 398         esac
 399
 400         # In case the IP has no interface given, check if we have a global one.
 401         _iface=${_iface:-${_interface}}
 402
 403         # Set address, cut off any prefix/netmask/prefixlen.
 404         _addr=${_r}
 405         _addr=${_addr%%[/ ]*}
 406
 407         # Theoretically we can return here if interface is not set,
 408         # as we only care about the _mask if we call ifconfig.
 409         # This is not done because we may want to santize IP addresses
 410         # based on _type later, and optionally change the type as well.
 411
 412         # Extract the prefix/netmask/prefixlen part by cutting off the address.
 413         _mask=${_r}
 414         _mask=`expr "${_mask}" : "${_addr}\(.*\)"`
 415
 416         # Identify type {inet,inet6}.
 417         case "${_addr}" in
 418         *\.*\.*\.*)     _type="inet" ;;
 419         *:*)            _type="inet6" ;;
 420         *)              warn "jail_extract_address: type not identified"
 421                         ;;
 422         esac
 423
 424         # Handle the special /netmask instead of /prefix or
 425         # "netmask xxx" case for legacy IP.
 426         # We do NOT support shortend class-full netmasks.
 427         if [ "${_type}" = "inet" ]; then
 428                 case "${_mask}" in
 429                 /*\.*\.*\.*)    _mask=" netmask ${_mask#/}" ;;
 430                 *)              ;;
 431                 esac
 432
 433                 # In case _mask is still not set use /32.
 434                 _mask=${_mask:-/32}
 435
 436         elif [ "${_type}" = "inet6" ]; then
 437                 # In case _maske is not set for IPv6, use /128.
 438                 _mask=${_mask:-/128}
 439         fi
 440 }
 441
 442 # jail_handle_ips_option {add,del} input
 443 #       Handle a single argument imput which can be a comma separated
 444 #       list of addresses (theoretically with an option interface and
 445 #       prefix/netmask/prefixlen).
 446 #
 447 jail_handle_ips_option()
 448 {
 449         local _x _action _type _i
 450         _action=$1
 451         _x=$2
 452
 453         if [ -z "${_x}" ]; then
 454                 # No IP given. This can happen for the primary address
 455                 # of each address family.
 456                 return
 457         fi
 458
 459         # Loop, in case we find a comma separated list, we need to handle
 460         # each argument on its own.
 461         while [ ${#_x} -gt 0 ]; do
 462                 case "${_x}" in
 463                 *,*)    # Extract the first argument and strip it off the list.
 464                         _i=`expr "${_x}" : '^\([^,]*\)'`
 465                         _x=`expr "${_x}" : "^[^,]*,\(.*\)"`
 466                         ;;
 467                 *)      _i=${_x}
 468                         _x=""
 469                         ;;
 470                 esac
 471
 472                 _type=""
 473                 _iface=""
 474                 _addr=""
 475                 _mask=""
 476                 jail_extract_address "${_i}"
 477
 478                 # make sure we got an address.
 479                 case "${_addr}" in
 480                 "")     continue ;;
 481                 *)      ;;
 482                 esac
 483
 484                 # Append address to list of addresses for the jail command.
 485                 case "${_addrl}" in
 486                 "")     _addrl="${_addr}" ;;
 487                 *)      _addrl="${_addrl},${_addr}" ;;
 488                 esac
 489
 490                 # Configure interface alias if requested by a given interface
 491                 # and if we could correctly parse everything.
 492                 case "${_iface}" in
 493                 "")     continue ;;
 494                 esac
 495                 case "${_type}" in
 496                 inet)   ;;
 497                 inet6)  ;;
 498                 *)      warn "Could not determine address family.  Not going" \
 499                             "to ${_action} address '${_addr}' for ${_jail}."
 500                         continue
 501                         ;;
 502                 esac
 503                 case "${_action}" in
 504                 add)    ifconfig ${_iface} ${_type} ${_addr}${_mask} alias
 505                         ;;
 506                 del)    # When removing the IP, ignore the _mask.
 507                         ifconfig ${_iface} ${_type} ${_addr} -alias
 508                         ;;
 509                 esac
 510         done
 511 }
 512
 513 # jail_ips {add,del}
 514 #       Extract the comma separated list of addresses and return them
 515 #       for the jail command.
 516 #       Handle more than one address via the _multi option as well.
 517 #       If an interface is given also add/remove an alias for the
 518 #       address with an optional netmask.
 519 #
 520 jail_ips()
 521 {
 522         local _action
 523         _action=$1
 524
 525         case "${_action}" in
 526         add)    ;;
 527         del)    ;;
 528         *)      warn "jail_ips: invalid action '${_action}'"
 529                 return
 530                 ;;
 531         esac
 532
 533         # Handle addresses.
 534         jail_handle_ips_option ${_action} "${_ip}"
 535         # Handle jail_xxx_ip_multi<N>
 536         alias=0
 537         while : ; do
 538                 eval _x=\"\$jail_${_jail}_ip_multi${alias}\"
 539                 case "${_x}" in
 540                 "")     break ;;
 541                 *)      jail_handle_ips_option ${_action} "${_x}"
 542                         alias=$((${alias} + 1))
 543                         ;;
 544                 esac
 545         done
 546 }
 547
 548 jail_start()
 549 {
 550         echo -n 'Configuring jails:'
 551         set_sysctl jail_set_hostname_allow security.jail.set_hostname_allowed \
 552             set_hostname_allow
 553         set_sysctl jail_socket_unixiproute_only \
 554             security.jail.socket_unixiproute_only unixiproute_only
 555         set_sysctl jail_sysvipc_allow security.jail.sysvipc_allowed \
 556             sysvipc_allow
 557         echo '.'
 558
 559         echo -n 'Starting jails:'
 560         _tmp_dir=`mktemp -d /tmp/jail.XXXXXXXX` || \
 561             err 3 "$name: Can't create temp dir, exiting..."
 562         for _jail in ${jail_list}
 563         do
 564                 init_variables $_jail
 565                 if [ -f /var/run/jail_${_jail}.id ]; then
 566                         echo -n " [${_hostname} already running (/var/run/jail_${_jail}.id exists)]"
 567                         continue;
 568                 fi
 569                 _addrl=""
 570                 jail_ips "add"
 571                 if [ -n "${_fib}" ]; then
 572                         _setfib="setfib -F '${_fib}'"
 573                 else
 574                         _setfib=""
 575                 fi
 576                 if checkyesno _mount; then
 577                         info "Mounting fstab for jail ${_jail} (${_fstab})"
 578                         if [ ! -f "${_fstab}" ]; then
 579                                 err 3 "$name: ${_fstab} does not exist"
 580                         fi
 581                         jail_mount_fstab
 582                 fi
 583                 if checkyesno _devfs; then
 584                         # If devfs is already mounted here, skip it.
 585                         df -t devfs "${_devdir}" >/dev/null
 586                         if [ $? -ne 0 ]; then
 587                                 if is_symlinked_mountpoint ${_devdir}; then
 588                                         warn "${_devdir} has symlink as parent - not starting jail ${_jail}"
 589                                         continue
 590                                 fi
 591                                 info "Mounting devfs on ${_devdir}"
 592                                 devfs_mount_jail "${_devdir}" ${_ruleset}
 593                                 # Transitional symlink for old binaries
 594                                 if [ ! -L "${_devdir}/log" ]; then
 595                                         __pwd="`pwd`"
 596                                         cd "${_devdir}"
 597                                         ln -sf ../var/run/log log
 598                                         cd "$__pwd"
 599                                 fi
 600                         fi
 601
 602                         # XXX - It seems symlinks don't work when there
 603                         #       is a devfs(5) device of the same name.
 604                         # Jail console output
 605                         #       __pwd="`pwd`"
 606                         #       cd "${_devdir}"
 607                         #       ln -sf ../var/log/console console
 608                         #       cd "$__pwd"
 609                 fi
 610                 if checkyesno _fdescfs; then
 611                         if is_symlinked_mountpoint ${_fdescdir}; then
 612                                 warn "${_fdescdir} has symlink as parent, not mounting"
 613                         else
 614                                 info "Mounting fdescfs on ${_fdescdir}"
 615                                 mount -t fdescfs fdesc "${_fdescdir}"
 616                         fi
 617                 fi
 618                 if checkyesno _procfs; then
 619                         if is_symlinked_mountpoint ${_procdir}; then
 620                                 warn "${_procdir} has symlink as parent, not mounting"
 621                         else
 622                                 info "Mounting procfs onto ${_procdir}"
 623                                 if [ -d "${_procdir}" ] ; then
 624                                         mount -t procfs proc "${_procdir}"
 625                                 fi
 626                         fi
 627                 fi
 628                 _tmp_jail=${_tmp_dir}/jail.$$
 629
 630                 i=0
 631                 while : ; do
 632                         eval out=\"\${_exec_prestart${i}:-''}\"
 633                         [ -z "$out" ] && break
 634                         ${out}
 635                         i=$((i + 1))
 636                 done
 637
 638                 eval ${_setfib} jail ${_flags} -i ${_rootdir} ${_hostname} \
 639                         \"${_addrl}\" ${_exec_start} > ${_tmp_jail} 2>&1
 640
 641                 if [ "$?" -eq 0 ] ; then
 642                         _jail_id=$(head -1 ${_tmp_jail})
 643                         i=1
 644                         while : ; do
 645                                 eval out=\"\${_exec_afterstart${i}:-''}\"
 646
 647                                 if [ -z "$out" ]; then
 648                                         break;
 649                                 fi
 650
 651                                 jexec "${_jail_id}" ${out}
 652                                 i=$((i + 1))
 653                         done
 654
 655                         echo -n " $_hostname"
 656                         tail +2 ${_tmp_jail} >${_consolelog}
 657                         echo ${_jail_id} > /var/run/jail_${_jail}.id
 658
 659                         i=0
 660                         while : ; do
 661                                 eval out=\"\${_exec_poststart${i}:-''}\"
 662                                 [ -z "$out" ] && break
 663                                 ${out}
 664                                 i=$((i + 1))
 665                         done
 666                 else
 667                         jail_umount_fs
 668                         jail_ips "del"
 669                         echo " cannot start jail \"${_jail}\": "
 670                         tail +2 ${_tmp_jail}
 671                 fi
 672                 rm -f ${_tmp_jail}
 673         done
 674         rmdir ${_tmp_dir}
 675         echo '.'
 676 }
 677
 678 jail_stop()
 679 {
 680         echo -n 'Stopping jails:'
 681         for _jail in ${jail_list}
 682         do
 683                 if [ -f "/var/run/jail_${_jail}.id" ]; then
 684                         _jail_id=$(cat /var/run/jail_${_jail}.id)
 685                         if [ ! -z "${_jail_id}" ]; then
 686                                 init_variables $_jail
 687
 688                                 i=0
 689                                 while : ; do
 690                                         eval out=\"\${_exec_prestop${i}:-''}\"
 691                                         [ -z "$out" ] && break
 692                                         ${out}
 693                                         i=$((i + 1))
 694                                 done
 695
 696                                 if [ -n "${_exec_stop}" ]; then
 697                                         eval env -i /usr/sbin/jexec ${_jail_id} ${_exec_stop} \
 698                                                 >> ${_consolelog} 2>&1
 699                                 fi
 700                                 killall -j ${_jail_id} -TERM > /dev/null 2>&1
 701                                 sleep 1
 702                                 killall -j ${_jail_id} -KILL > /dev/null 2>&1
 703                                 jail_umount_fs
 704                                 echo -n " $_hostname"
 705
 706                                 i=0
 707                                 while : ; do
 708                                         eval out=\"\${_exec_poststop${i}:-''}\"
 709                                         [ -z "$out" ] && break
 710                                         ${out}
 711                                         i=$((i + 1))
 712                                 done
 713                         fi
 714                         jail_ips "del"
 715                         rm /var/run/jail_${_jail}.id
 716                 else
 717                         echo " cannot stop jail ${_jail}. No jail id in /var/run"
 718                 fi
 719         done
 720         echo '.'
 721 }
 722
 723 load_rc_config $name
 724 cmd="$1"
 725 if [ $# -gt 0 ]; then
 726         shift
 727 fi
 728 if [ -n "$*" ]; then
 729         jail_list="$*"
 730 fi
 731 run_rc_command "${cmd}"