From 7fd24086946f90347adc59a61beec621b555bdd7 Mon Sep 17 00:00:00 2001
From: cryx <cryx@h3q.com>
Date: Mon, 28 Dec 2009 22:09:17 +0000
Subject: Support for setting and using jail-bound ZFS datasets, cpuset(1) and
 setfib(1).

Jail-bound ZFS datasets still need the usual zfs+jail stuff like security.jail.mount_allowed=1 and security.jail.enforce_statfs=0 as well as "add path zfs unhide" in the devfs.rules for the jail.

The setfib utility requires FIBs to be enabled via kernel-config.

All features need at least FreeBSD 7.1-RELEASE.
---
 ezjail.sh | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

(limited to 'ezjail.sh')

diff --git a/ezjail.sh b/ezjail.sh
index 6df6358..eb5e251 100755
--- a/ezjail.sh
+++ b/ezjail.sh
@@ -65,6 +65,8 @@ do_cmd()
     eval ezjail_attachparams=\"\$jail_${ezjail}_attachparams\"
     eval ezjail_attachblocking=\"\$jail_${ezjail}_attachblocking\"
     eval ezjail_forceblocking=\"\$jail_${ezjail}_forceblocking\"
+    eval ezjail_zfs_datasets=\"\$jail_${ezjail}_zfs_datasets\"
+    eval ezjail_cpuset=\"\$jail_${ezjail}_cpuset\"
 
     # Do we still have a root to run in?
     [ ! -d "${ezjail_rootdir}" ] && echo " Warning: root directory ${ezjail_rootdir} of ${ezjail} does not exist." && continue
@@ -88,6 +90,20 @@ do_cmd()
   # Pass control to jail script which does the actual work
   [ "${ezjail_pass}" ] && sh /etc/rc.d/jail one${action%crypto} ${ezjail_pass}
 
+  if [ "${action}" = "start" ]; then
+    ezjail_safename=`echo -n "${ezjail}" | tr -c '[:alnum:]' _`
+    # Get the JID of the jail
+    [ -f "/var/run/jail_${ezjail_safename}.id" ] && ezjail_id=`cat /var/run/jail_${ezjail_safename}.id` || return
+
+    # Attach ZFS-datasets to the jail
+    for zfs in ${ezjail_zfs_datasets}; do
+      /sbin/zfs jail ${ezjail_id} ${zfs} ||Êecho -n "Error: ${zfs} could not be configured"
+    done
+
+    # Configure processor sets for the jail via cpuset(1)
+    [ "${ezjail_cpuset}" ] && /usr/bin/cpuset -l ${ezjail_cpuset} -j ${ezjail_id} || echo -n "Error: The defined cpuset is malformed"
+  fi
+
   # Can only detach after unmounting (from fstab.JAILNAME in /etc/rc.d/jail)
   attach_detach_post
 }
-- 
cgit v1.2.3