Skip to content

Commit 95b4dd3

Browse files
author
olevole
committed
jail: add a couple of missing allow_XX parameters:
allow_suser allow_extattr allow_adjtime allow_settime
1 parent 8b3c1ff commit 95b4dd3

File tree

10 files changed

+198
-26
lines changed

10 files changed

+198
-26
lines changed

‎etc/defaults/jail-freebsd-default.conf

Lines changed: 28 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -135,9 +135,6 @@ allow_read_msgbuf="0"
135135
# Jail may access vmm(4)
136136
allow_vmm="0"
137137

138-
# Unprivileged processes in the jail may use debugging facilities
139-
allow_unprivileged_proc_debug="1"
140-
141138
# default nice
142139
rctl_nice="1"
143140

@@ -183,6 +180,34 @@ allow_mlock="0"
183180
# the rc.conf(5) file outside of the jails.
184181
allow_nfsd="0"
185182

183+
# The jail root may bind to ports lower than 1024.
184+
allow_reserved_ports=1
185+
186+
# Unprivileged processes in the jail may use debugging
187+
# facilities.
188+
allow_unprivileged_proc_debug=1
189+
190+
# The value of the jail's security.bsd.suser_enabled
191+
# sysctl. The super-user will be disabled automatically if
192+
# its parent system has it disabled. The super-user is
193+
# enabled by default.
194+
allow_suser=1
195+
196+
# Allow privileged process in the jail to manipulate
197+
# filesystem extended attributes in the system namespace.
198+
allow_extattr=1
199+
200+
# Allow privileged process in the jail to slowly adjusting
201+
# global operating system time. For example through
202+
# utilities like ntpd(8).
203+
allow_adjtime=0
204+
205+
# Allow privileged process in the jail to set global
206+
# operating system data and time. For example through
207+
# utilities like date(1). This permission includes also
208+
# allow_adjtime.
209+
allow_settime=0
210+
186211
# enable etcupdate_bootstrap ?
187212
etcupdate_init="1"
188213
# Global cloud-init helper params for vm

‎jailctl/jconfig

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -74,10 +74,10 @@ if [ -z "${cmd}" ]; then
7474
myargs="allow_devfs allow_dying allow_fusefs allow_linprocfs allow_linsysfs allow_kmem allow_mount allow_nullfs allow_procfs allow_raw_sockets allow_reserved_ports \
7575
allow_tmpfs allow_zfs allow_mlock allow_nfsd applytpl arch astart basename baserw childrenmax cpuset devfs_ruleset enforce_statfs exec_consolelog exec_fib exec_start exec_stop \
7676
exec_timeout floatresolv hidden host_hostname interface ip4_addr jdomain mkhostsfile mount_devfs mount_fdescfs mount_procfs mount_linprocfs mount_linsysfs mount_kernel \
77-
mount_ports mount_src persist protected stop_timeout sysvmsg sysvsem sysvshm ver vnet ci_gw4 mnt_start mnt_stop boot_delay jnameserver"
77+
mount_ports mount_src persist protected stop_timeout sysvmsg sysvsem sysvshm ver vnet ci_gw4 mnt_start mnt_stop boot_delay jnameserver allow_read_msgbuf allow_vmm allow_unprivileged_proc_debug"
7878

79-
# allow_read_msgbuf for FreeBSD 12.0+
80-
[ ${freebsdhostversion} -gt 1200085 ] && myargs="${myargs} allow_read_msgbuf allow_vmm allow_unprivileged_proc_debug"
79+
# FreeBSD 14.2+
80+
[ ${freebsdhostversion} -ge 1402000 ] && myargs="${myargs} allow_suser allow_extattr allow_adjtime allow_settime"
8181

8282
sorted_myargs=$( for i in ${myargs}; do
8383
echo ${i}

‎jailctl/jset

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -451,6 +451,49 @@ modify_allow_nfsd()
451451
${ECHO} "${argpart}: ${N1_COLOR}${allow_nfsd}${N0_COLOR}"
452452
}
453453

454+
# jid must be set
455+
modify_allow_reserved_ports()
456+
{
457+
cbsdsqlrw local "UPDATE jails SET ${i}=\"${allow_reserved_ports}\" WHERE jname=\"${jname}\""
458+
${JAIL_CMD} -m allow_reserved_ports=${allow_reserved_ports} jid=${jid}
459+
${ECHO} "${argpart}: ${N1_COLOR}${allow_reserved_ports}${N0_COLOR}"
460+
}
461+
# jid must be set
462+
modify_allow_unprivileged_proc_debug()
463+
{
464+
cbsdsqlrw local "UPDATE jails SET ${i}='${allow_unprivileged_proc_debug}' WHERE jname=\"${jname}\""
465+
${JAIL_CMD} -m allow_unprivileged_proc_debug=${allow_unprivileged_proc_debug} jid=${jid}
466+
${ECHO} "${argpart}: ${N1_COLOR}${allow_unprivileged_proc_debug}${N0_COLOR}"
467+
}
468+
# jid must be set
469+
modify_allow_suser()
470+
{
471+
cbsdsqlrw local "UPDATE jails SET ${i}='${allow_suser}' WHERE jname=\"${jname}\""
472+
${JAIL_CMD} -m allow_suser=${allow_suser} jid=${jid}
473+
${ECHO} "${argpart}: ${N1_COLOR}${allow_suser}${N0_COLOR}"
474+
}
475+
# jid must be set
476+
modify_allow_extattr()
477+
{
478+
cbsdsqlrw local "UPDATE jails SET ${i}='${allow_extattr}' WHERE jname=\"${jname}\""
479+
${JAIL_CMD} -m allow_extattr=${allow_extattr} jid=${jid}
480+
${ECHO} "${argpart}: ${N1_COLOR}${allow_extattr}${N0_COLOR}"
481+
}
482+
# jid must be set
483+
modify_allow_adjtime()
484+
{
485+
cbsdsqlrw local "UPDATE jails SET ${i}='${allow_adjtime}' WHERE jname=\"${jname}\""
486+
${JAIL_CMD} -m allow_adjtime=${allow_adjtime} jid=${jid}
487+
${ECHO} "${argpart}: ${N1_COLOR}${allow_adjtime}${N0_COLOR}"
488+
}
489+
# jid must be set
490+
modify_allow_settime()
491+
{
492+
cbsdsqlrw local "UPDATE jails SET ${i}='${allow_settime}' WHERE jname=\"${jname}\""
493+
${JAIL_CMD} -m allow_settime=${allow_settime} jid=${jid}
494+
${ECHO} "${argpart}: ${N1_COLOR}${allow_settime}${N0_COLOR}"
495+
}
496+
454497
# jid must be set
455498
modify_host_hostname()
456499
{
@@ -1131,6 +1174,30 @@ for n in ${my_arg}; do
11311174
cbsdlogger NOTICE ${CBSD_APP}: modify_nfsd for ${jname}
11321175
modify_allow_nfsd
11331176
;;
1177+
allow_reserved_ports)
1178+
cbsdlogger NOTICE ${CBSD_APP}: allow_reserved_ports for ${jname}
1179+
modify_allow_reserved_ports
1180+
;;
1181+
allow_unprivileged_proc_debug)
1182+
cbsdlogger NOTICE ${CBSD_APP}: allow_unprivileged_proc_debug for ${jname}
1183+
modify_allow_unprivileged_proc_debug
1184+
;;
1185+
allow_suser)
1186+
cbsdlogger NOTICE ${CBSD_APP}: allow_suser for ${jname}
1187+
modify_allow_suser
1188+
;;
1189+
allow_extattr)
1190+
cbsdlogger NOTICE ${CBSD_APP}: allow_extattr for ${jname}
1191+
modify_allow_extattr
1192+
;;
1193+
allow_adjtime)
1194+
cbsdlogger NOTICE ${CBSD_APP}: allow_adjtime for ${jname}
1195+
modify_allow_adjtime
1196+
;;
1197+
allow_settime)
1198+
cbsdlogger NOTICE ${CBSD_APP}: allow_settime for ${jname}
1199+
modify_allow_settime
1200+
;;
11341201
allow_procfs)
11351202
cbsdlogger NOTICE ${CBSD_APP}: modify_allow_procfs
11361203
modify_allow_procfs

‎jailctl/jsetup-tui

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ shift #skip for jname
6969

7070
if [ ${jid} -ne 0 ]; then
7171
# Command for modifying on-the fly here:
72-
JARG="ip4_addr cpuset astart exec_consolelog mount_src mount_ports mount_kernel allow_mount allow_nullfs allow_fusefs allow_linsysfs allow_linprocfs allow_tmpfs allow_mlock allow_nfsd allow_procfs devfs_ruleset jdomain b_order applytpl protected hidden allow_raw_sockets allow_read_msgbuf allow_vmm sysvsem sysvshm sysvmsg boot_delay jnameserver"
72+
JARG="ip4_addr cpuset astart exec_consolelog mount_src mount_ports mount_kernel allow_mount allow_nullfs allow_fusefs allow_linsysfs allow_linprocfs allow_tmpfs allow_mlock allow_nfsd allow_procfs devfs_ruleset jdomain b_order applytpl protected hidden allow_raw_sockets allow_read_msgbuf allow_vmm sysvsem sysvshm sysvmsg boot_delay jnameserver allow_reserved_ports allow_unprivileged_proc_debug allow_suser allow_extattr allow_adjtime allow_settime"
7373
else
7474
JARG="$*"
7575
fi
@@ -124,7 +124,7 @@ while true; do
124124
invert_checkbox ${mychoice}
125125
continue
126126
;;
127-
allow_tmpfs|allow_zfs|allow_kmem|mount_kernel|mount_obj|allow_read_msgbuf|allow_vmm|allow_mlock|allow_nfsd)
127+
allow_tmpfs|allow_zfs|allow_kmem|mount_kernel|mount_obj|allow_read_msgbuf|allow_vmm|allow_mlock|allow_nfsd|allow_suser|allow_extattr|allow_adjtime|allow_settime)
128128
invert_checkbox ${mychoice}
129129
continue
130130
;;

‎share/jail-arg

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,10 @@ gid \
8888
tags \
8989
zfs_encryption \
9090
boot_delay \
91+
allow_suser \
92+
allow_extattr \
93+
allow_adjtime \
94+
allow_settime \
9195
"
9296

9397
###

‎share/local-jails.schema

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ exec_master_prestop status exec_timeout exec_fib stop_timeout mount_fdescfs allo
77
emulator_flags allow_kmem exec_consolelog jdomain b_order allow_fdescfs allow_sysvipc protected hidden maintenance name allow_reserved_ports \
88
childrenmax persist enforce_statfs state_time allow_raw_sockets allow_fusefs allow_linprocfs allow_linsysfs allow_read_msgbuf allow_vmm \
99
allow_unprivileged_proc_debug sysvsem sysvshm sysvmsg mnt_start mnt_stop allow_mlock mount_procfs mount_linprocfs mount_linsysfs gid tags \
10-
ci_gw4 zfs_encryption boot_delay allow_nfsd jnameserver"
10+
ci_gw4 zfs_encryption boot_delay allow_nfsd jnameserver allow_suser allow_extattr allow_adjtime allow_settime"
1111

1212
jname="text default 0 unique PRIMARY KEY"
1313
jid="integer default 0"
@@ -107,6 +107,11 @@ mnt_stop="text default 0"
107107
allow_mlock="integer default 0"
108108
allow_nfsd="integer default 0"
109109

110+
allow_suser="boolean default 1"
111+
allow_extattr="boolean default 1"
112+
allow_adjtime="boolean default 0"
113+
allow_settime="boolean default 0"
114+
110115
# global identifier in the cluster,
111116
# reserved for top-level management
112117
gid="UNSIGNED INTEGER DEFAULT 0"

‎subr/jsetup-tui.subr

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ dialog_menu_main()
6262
allow_nullfs allow_fdescfs allow_procfs allow_raw_sockets allow_read_msgbuf allow_reserved_ports allow_sysvipc \
6363
allow_tmpfs allow_unprivileged_proc_debug allow_vmm allow_zfs applytpl astart floatresolv hidden mkhostsfile \
6464
mount_devfs mount_fdescfs mount_procfs mount_linprocfs mount_linsysfs mount_fstab mount_kernel mount_obj \
65-
mount_ports mount_src persist protected vnet allow_mlock allow_nfsd baserw"
65+
mount_ports mount_src persist protected vnet allow_mlock allow_nfsd baserw allow_suser allow_extattr allow_adjtime allow_settime"
6666

6767
f_dialog_info "scan and build menu entry..."
6868

‎subr/settings-tui-jail.subr

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,11 @@ allow_nullfs_msg="Allow privileged users inside the jail mount and unmount NULLF
1717
allow_procfs_msg="Allow privileged users inside the jail mount and unmount PROCFS file system"
1818
allow_raw_sockets_msg="The jail root is allowed to create raw sockets"
1919
allow_read_msgbuf_msg="Allow an unprivileged user to read the kernel message buffer"
20-
allow_reserved_ports_msg="Allow the jail root may bind to ports lower than 1024. For FreeBSD 11.1+"
20+
allow_reserved_ports_msg="The jail root may bind to ports lower than 1024"
21+
allow_suser_msg="The value of the jail's security.bsd.suser_enabled sysctl. The super-user will be disabled automatically if its parent system has it disabled. The super-user is enabled by default"
22+
allow_extattr_msg="Allow privileged process in the jail to manipulate filesystem extended attributes in the system namespace"
23+
allow_adjtime_msg="Allow privileged process in the jail to slowly adjusting global operating system time. For example through utilities like ntpd(8)"
24+
allow_settime_msg="Allow privileged process in the jail to set global operating system data and time. For example through utilities like date(1). This permission includes also allow.adjtime"
2125
sysvsem_msg="Controls access to SYSV semaphores"
2226
sysvshm_msg="Controls access to shared memory"
2327
sysvmsg_msg="Controls access to SYSV message queues"
@@ -778,10 +782,10 @@ get_construct_jail_options_menu()
778782
_checkbox="${get_construct_jail_options_menu_checkbox}"
779783
else
780784
# default checkbox list
781-
_checkbox="allow_devfs allow_dying allow_fusefs allow_linprocfs allow_linsysfs allow_kmem allow_mount \
782-
allow_nullfs allow_fdescfs allow_procfs allow_raw_sockets allow_read_msgbuf allow_reserved_ports allow_sysvipc \
783-
allow_tmpfs allow_unprivileged_proc_debug allow_vmm allow_zfs mount_devfs mount_fdescfs mount_procfs mount_linprocfs \
784-
mount_linsysfs mount_fstab mount_kernel mount_obj mount_ports mount_src persist allow_mlock allow_nfsd"
785+
_checkbox="allow_devfs allow_dying allow_fusefs allow_linprocfs allow_linsysfs allow_kmem allow_mount allow_nullfs allow_fdescfs \
786+
allow_procfs allow_raw_sockets allow_read_msgbuf allow_reserved_ports allow_sysvipc allow_tmpfs allow_unprivileged_proc_debug allow_vmm \
787+
allow_zfs mount_devfs mount_fdescfs mount_procfs mount_linprocfs mount_linsysfs mount_fstab mount_kernel mount_obj mount_ports \
788+
mount_src persist allow_mlock allow_nfsd allow_suser allow_extattr allow_adjtime allow_settime"
785789
fi
786790
fi
787791

@@ -999,6 +1003,11 @@ with_img_helpers="";
9991003
allow_reserved_ports="${allow_reserved_ports}";
10001004
allow_unprivileged_proc_debug="${allow_unprivileged_proc_debug}";
10011005

1006+
allow_suser="${allow_suser}";
1007+
allow_extattr="${allow_extattr}";
1008+
allow_adjtime="${allow_adjtime}";
1009+
allow_settime="${allow_settime}";
1010+
10021011
persist="${persist}";
10031012
childrenmax="${childrenmax}";
10041013
enforce_statfs="${enforce_statfs}";

‎tools/makejconf

Lines changed: 33 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -339,24 +339,46 @@ if [ "${allow_mount}" = "1" ]; then
339339
fi
340340
fi
341341

342-
# this feature available for FreeBSD 12.0+
343-
if [ ${freebsdhostversion} -gt 1200043 ]; then
344-
if [ "${allow_reserved_ports}" = "1" ]; then
345-
echo "allow.reserved_ports = \"true\";" >> ${out}
342+
# this feature available for FreeBSD 14.2+
343+
if [ ${freebsdhostversion} -gt 1402000 ]; then
344+
if [ "${allow_suser}" = "1" ]; then
345+
echo "allow.suser = \"1\";" >> ${out}
346346
else
347-
echo "allow.reserved_ports = \"false\";" >> ${out}
347+
echo "allow.suser = \"0\";" >> ${out}
348+
fi
349+
350+
if [ "${allow_extattr}" = "1" ]; then
351+
echo "allow.extattr = \"1\";" >> ${out}
352+
else
353+
echo "allow.extattr = \"0\";" >> ${out}
354+
fi
355+
356+
if [ "${allow_adjtime}" = "1" ]; then
357+
echo "allow.adjtime = \"1\";" >> ${out}
358+
else
359+
echo "allow.adjtime = \"0\";" >> ${out}
348360
fi
349-
fi
350361

351-
# this feature available for FreeBSD 12.0+
352-
if [ ${freebsdhostversion} -gt 1200043 ]; then
353-
if [ "${allow_mlock}" = "1" ]; then
354-
echo "allow.mlock = \"1\";" >> ${out}
362+
if [ "${allow_settime}" = "1" ]; then
363+
echo "allow.settime = \"1\";" >> ${out}
355364
else
356-
echo "allow.mlock = \"0\";" >> ${out}
365+
echo "allow.settime = \"0\";" >> ${out}
357366
fi
358367
fi
359368

369+
370+
if [ "${allow_reserved_ports}" = "1" ]; then
371+
echo "allow.reserved_ports = \"true\";" >> ${out}
372+
else
373+
echo "allow.reserved_ports = \"false\";" >> ${out}
374+
fi
375+
376+
if [ "${allow_mlock}" = "1" ]; then
377+
echo "allow.mlock = \"1\";" >> ${out}
378+
else
379+
echo "allow.mlock = \"0\";" >> ${out}
380+
fi
381+
360382
# allow.nfsd
361383
nfs_feat=$( ${SYSCTL_CMD} -qn kern.features.nfsd 2>/dev/null )
362384
if [ "${nfs_feat}" = "1" ]; then

‎upgrade/pre-patch-14.2.6.0

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
#!/bin/sh
2+
#v12.1.3
3+
# Update jails for allow_suser, allow_extattr, allow_adjtime, allow_settime
4+
: ${distdir="/usr/local/cbsd"}
5+
[ ! -r "${distdir}/subr/cbsdbootstrap.subr" ] && exit 1
6+
. ${distdir}/subr/cbsdbootstrap.subr || exit 1
7+
test_sql_stuff
8+
9+
[ ! -h "${dbdir}/local.sqlite" ] && exit 0
10+
11+
mydb="${dbdir}/local.sqlite"
12+
13+
unset _test _count
14+
_count=$( ${miscdir}/sqlcli ${mydb} 'SELECT COUNT(jname) FROM jails WHERE emulator="jail"' )
15+
[ "${_count}" = "0" ] && exit 0 # no jails here
16+
_test=$( ${miscdir}/sqlcli ${mydb} "SELECT allow_suser FROM jails LIMIT 1" )
17+
if [ -z "${_test}" ]; then
18+
${ECHO} " * ${N1_COLOR}Update jails tables: add allow_suser${N0_COLOR}"
19+
${miscdir}/sqlcli ${mydb} "ALTER TABLE jails ADD COLUMN allow_suser integer default '1'"
20+
fi
21+
22+
_test=$( ${miscdir}/sqlcli ${mydb} "SELECT allow_extattr FROM jails LIMIT 1" )
23+
if [ -z "${_test}" ]; then
24+
${ECHO} " * ${N1_COLOR}Update jails tables: add allow_extattr${N0_COLOR}"
25+
${miscdir}/sqlcli ${mydb} "ALTER TABLE jails ADD COLUMN allow_extattr integer default '1'"
26+
fi
27+
28+
_test=$( ${miscdir}/sqlcli ${mydb} "SELECT allow_adjtime FROM jails LIMIT 1" )
29+
if [ -z "${_test}" ]; then
30+
${ECHO} " * ${N1_COLOR}Update jails tables: add allow_adjtime${N0_COLOR}"
31+
${miscdir}/sqlcli ${mydb} "ALTER TABLE jails ADD COLUMN allow_adjtime integer default '0'"
32+
fi
33+
34+
_test=$( ${miscdir}/sqlcli ${mydb} "SELECT allow_settime FROM jails LIMIT 1" )
35+
if [ -z "${_test}" ]; then
36+
${ECHO} " * ${N1_COLOR}Update jails tables: add allow_settime${N0_COLOR}"
37+
${miscdir}/sqlcli ${mydb} "ALTER TABLE jails ADD COLUMN allow_settime integer default '0'"
38+
fi
39+
40+
exit 0

0 commit comments

Comments
 (0)