HardenedBSD/libexec/rc/rc.d/pfsync
Alexander Leidinger f99f0ee14e rc.d: add a service jails config to all base system services
This gives more permissions to services (e.g. network access to
services which require this) when they are started as an automatic
service jail.

The sshd patch is important for the sshd-related functionality as
described in the man-page in the service jails part.

The location of the added env vars is supposed to allow overriding them
in rc.conf, and to hard-disable the use of svcj for some parts where it
doesn't make sense or will not work.

Only a subset of all of the services are fully tested (I'm running this
since more than a year with various services started as service jails).
The untested parts should be most of the time ok, in some edge-cases
more permissions are needed inside the service jail.
Differential Revision:	https://reviews.freebsd.org/D40371
2024-05-22 15:41:49 +02:00

53 lines
848 B
Bash
Executable File

#!/bin/sh
#
#
# PROVIDE: pfsync
# REQUIRE: FILESYSTEMS netif
# KEYWORD: nojailvnet
. /etc/rc.subr
name="pfsync"
desc="Packet filter state table sychronisation interface"
rcvar="pfsync_enable"
start_precmd="pfsync_prestart"
start_cmd="pfsync_start"
stop_cmd="pfsync_stop"
required_modules="pf pfsync"
pfsync_prestart()
{
case "$pfsync_syncdev" in
'')
warn "pfsync_syncdev is not set."
return 1
;;
esac
return 0
}
pfsync_start()
{
local _syncpeer
echo "Enabling pfsync."
if [ -n "${pfsync_syncpeer}" ]; then
_syncpeer="syncpeer ${pfsync_syncpeer}"
fi
ifconfig pfsync0 $_syncpeer syncdev $pfsync_syncdev $pfsync_ifconfig up
}
pfsync_stop()
{
echo "Disabling pfsync."
ifconfig pfsync0 -syncdev -syncpeer down
}
load_rc_config $name
# doesn't make sense to run in a svcj: config setting
pfsync_svcj="NO"
run_rc_command "$1"