upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-09 00:32:25 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

svcj: add "routing" option

Browse source 
"routing" enables the jail allow.routing permission, which allows the jail to
modify the system routing table.  this can be used to run routing daemons
(e.g., BIRD) in a service jail.

Reviewed by:	jamie, des
Approved by:	des (mentor)
Differential Revision:	https://reviews.freebsd.org/D49844
This commit is contained in:
Lexi Winter 2025-05-11 03:01:10 +01:00
parent 3a53fe2cc4
commit 0268d03ba1
2 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
libexec/rc/rc.subr
View file

@ -1259,6 +1259,9 @@ run_rc_command()
nfsd)
_svcj_cmd_options="allow.nfsd enforce_statfs=1 ${_svcj_cmd_options}"
;;
routing)
_svcj_cmd_options="allow.routing ${_svcj_cmd_options}"
;;
settime)
_svcj_cmd_options="allow.settime ${_svcj_cmd_options}"
;;

4
share/man/man5/rc.conf.5
View file

@ -22,7 +22,7 @@
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
.Dd May 6, 2025
.Dd May 11, 2025
.Dt RC.CONF 5
.Os
.Sh NAME
@ -5019,6 +5019,8 @@ allows to open raw sockets, and allows to open sockets of protocol stacks that
have not had jail functionality added to them.
.It nfsd
Allows to run nfsd and affiliated daemons.
.It routing
Allows to modify the system routing table.
.It settime
Allows to set and slew the system time.
.It sysvipc