Merge pull request freebsd#9 from criecm/linsysfs

allow_mount_linsysfs support

doc/source/debian.rst

@@ -17,6 +17,21 @@ NAME!
 .. code-block:: none
 
  # iocage create -e -n debjail exec_start="/bin/true" exec_stop="/bin/true"
+   allow_mount_linprocfs=1 allow_mount_devfs=1 allow_raw_sockets=1
+   allow_socket_af=1 allow_mount_linsysfs=1 allow_mount=1
+
+**Install devfs rules for vnet:**
+
+In `/etc/devfs.rules`:
+
+.. code-block:: none
+
+ [devfsrules_jail_linux=6] add include $devfsrules_hide_all
+ add include $devfsrules_unhide_basic
+ add include $devfsrules_unhide_login
+ add path 'tun*' unhide
+ add path 'bpf*' unhide
+ add path zfs unhide
 
 **Install debootstrap on the host:**
 
@@ -33,7 +48,7 @@ NAME!
 
 :samp:`# iocage get mountpoint debjail`
 
-:samp:`# debootstrap buster /iocage/jails/debjail/root/`
+:samp:`# debootstrap bookworm /iocage/jails/debjail/root/`
 
 Apart from Debian releases, like *buster* or *testing*, you can
 also use Ubuntu releases, eg *bionic*.

iocage.8

@@ -1698,6 +1698,16 @@ Default: 0
 .Pp
 Source:
 .Xr jail 8
+.It Pf allow_mount_linsysfs= Op 1 | 0
+Privileged users inside the jail will be able to mount and
+unmount the linsysfs file system. This permission is effective
+only together with allow.mount and only when enforce_statfs is
+set to a value lower than 2.
+.Pp
+Default: 0
+.Pp
+Source:
+.Xr jail 8
 .It Pf allow_mount_tmpfs= Op 1 | 0
 Allow privileged users inside the jail to mount and unmount the tmpfs
 file system.

iocage_lib/ioc_json.py

@@ -434,7 +434,7 @@ def __init__(self, location, checking_datasets, silent, callback):
     @staticmethod
     def get_version():
         """Sets the iocage configuration version."""
-        version = '31'
+        version = '32'
 
         return version
 
@@ -920,6 +920,10 @@ def check_config(self, conf, default=False):
         if not conf.get('allow_nfsd'):
             conf['allow_nfsd'] = 0
 
+        # Version 32 key
+        if not conf.get('allow_mount_linsysfs'):
+            conf['allow_mount_linsysfs'] = 0
+
         if not default:
             conf.update(jail_conf)
 
@@ -1181,6 +1185,7 @@ def retrieve_default_props():
             'allow_mount_nullfs': 0,
             'allow_mount_procfs': 0,
             'allow_mount_linprocfs': 0,
+            'allow_mount_linsysfs': 0,
             'allow_mount_tmpfs': 0,
             'allow_mount_zfs': 0,
             'allow_quotas': 0,
@@ -1353,6 +1358,7 @@ class IOCJson(IOCConfiguration):
         'allow_mount_devfs',
         'allow_mount_fdescfs',
         'allow_mount_linprocfs',
+        'allow_mount_linsysfs',
         'allow_mount',
         'allow_mlock',
         'allow_chflags',
@@ -2106,6 +2112,7 @@ def json_check_prop(self, key, value, conf, default=False):
             "allow_mount_nullfs": truth_variations,
             "allow_mount_procfs": truth_variations,
             "allow_mount_linprocfs": truth_variations,
+            "allow_mount_linsysfs": truth_variations,
             "allow_mount_tmpfs": truth_variations,
             "allow_mount_zfs": truth_variations,
             "allow_quotas": truth_variations,

iocage_lib/ioc_start.py

@@ -143,6 +143,7 @@ def __start_jail__(self):
         allow_mount_nullfs = self.conf["allow_mount_nullfs"]
         allow_mount_procfs = self.conf["allow_mount_procfs"]
         allow_mount_linprocfs = self.conf["allow_mount_linprocfs"]
+        allow_mount_linsysfs = self.conf["allow_mount_linsysfs"]
         allow_mount_tmpfs = self.conf["allow_mount_tmpfs"]
         allow_mount_zfs = self.conf["allow_mount_zfs"]
         allow_quotas = self.conf["allow_quotas"]
@@ -565,6 +566,7 @@ def __start_jail__(self):
             f"allow.mount.nullfs={allow_mount_nullfs}",
             f"allow.mount.procfs={allow_mount_procfs}",
             f"allow.mount.linprocfs={allow_mount_linprocfs}",
+            f"allow.mount.linsysfs={allow_mount_linsysfs}",
             f"allow.mount.zfs={allow_mount_zfs}"
         ]