VNET Jails

[fabianfreyer]

Roadmap:

• fix current saving non-VNET jails (vnet: special-case vnet="inherit" when in save #34)
• add check whether VIMAGE is enabled, by checking whether kern.features.vimage sysctl exists and is set to 1 (c163a6a)
  • When errors: more specific error if sysctl not found johalun/sysctl-rs#21 is merged, use that.
• add support for E,jailsys tri-state parameters, and add handling for vnet parameter
  • Add type to enums (0bda407)
  • wait for publish CtlInfo struct johalun/sysctl-rs#19 to be merged or Extracting CtlInfo / fmt johalun/sysctl-rs#18 to be fixed some other way
  • Set a sane default (probably disable) & verify it works with VIMAGE disabled
  • verify no IP restrictions are set when vnet is not disable.
• Handle adding epairs / vnets to the jail
  • Add support for vnet to lib(private)ifconfig

[fabianfreyer]

The CI for #33 failed on 12.0-RELEASE fails with the following error message:

failures:

---- src/running.rs - running::RunningJail::restart (line 356) stdout ----
thread 'src/running.rs - running::RunningJail::restart (line 356)' panicked at 'test executable failed:

thread 'main' panicked at 'failed to restart jail: JailSetError("vnet jails cannot have IP address restrictions")', libcore/result.rs:1009:5
note: Run with `RUST_BACKTRACE=1` for a backtrace.

', librustdoc/test.rs:367:17
note: Run with `RUST_BACKTRACE=1` for a backtrace.


failures:
    src/running.rs - running::RunningJail::restart (line 356)

test result: FAILED. 44 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out

error: test failed, to rerun pass '--doc'

Exit status: 101

Probably this is related to VIMAGE being enabled by default on 12.0-RELEASE.

[akhramov]

The error has been addressed in #79.

Regarding

Handle adding epairs / vnets to the jail

Not only you need a programmatic way to create / manipulate interfaces, but also need to replicate some functionality from route(8).

The latter can be tricky, because the code in route(8) makes heavy use of functional C macros.

That said, I recently tackled both problems. Please see akhramov/knast@4b46b13 for reference.

[fabianfreyer]

@akhramov thanks, this looks great! I'll go take a look at #79!