VNET Jails

[fabianfreyer]

Roadmap:

• [X] fix current saving non-VNET jails (#34)
• [X] add check whether VIMAGE is enabled, by checking whether kern.features.vimage sysctl exists and is set to 1 (https://github.com/fubarnetes/libjail-rs/commit/c163a6af385f43bea85dc9d87709a1b1ebaa227f)
  • [ ] When https://github.com/johalun/sysctl-rs/pull/21 is merged, use that.
• [ ] add support for E,jailsys tri-state parameters, and add handling for vnet parameter
  • [X] Add type to enums (https://github.com/fubarnetes/libjail-rs/commit/0bda407be558511a585536ffa649745f02151a5f)
  • [x] wait for https://github.com/johalun/sysctl-rs/issues/19 to be merged or https://github.com/johalun/sysctl-rs/issues/18 to be fixed some other way
  • [ ] Set a sane default (probably disable) & verify it works with VIMAGE disabled
  • [ ] verify no IP restrictions are set when vnet is not disable.
• [ ] Handle adding epairs / vnets to the jail
  • [ ] Add support for vnet to lib(private)ifconfig

[fabianfreyer]

The CI for #33 failed on 12.0-RELEASE fails with the following error message:

failures:

---- src/running.rs - running::RunningJail::restart (line 356) stdout ----
thread 'src/running.rs - running::RunningJail::restart (line 356)' panicked at 'test executable failed:

thread 'main' panicked at 'failed to restart jail: JailSetError("vnet jails cannot have IP address restrictions")', libcore/result.rs:1009:5
note: Run with `RUST_BACKTRACE=1` for a backtrace.

', librustdoc/test.rs:367:17
note: Run with `RUST_BACKTRACE=1` for a backtrace.

failures:
    src/running.rs - running::RunningJail::restart (line 356)

test result: FAILED. 44 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out

error: test failed, to rerun pass '--doc'

Exit status: 101

Probably this is related to VIMAGE being enabled by default on 12.0-RELEASE.

[akhramov]

The error has been addressed in #79.

Regarding

Handle adding epairs / vnets to the jail

Not only you need a programmatic way to create / manipulate interfaces, but also need to replicate some functionality from route(8).

The latter can be tricky, because the code in route(8) makes heavy use of functional C macros.

That said, I recently tackled both problems. Please see https://github.com/akhramov/werft/commit/4b46b1333f34e8d101951407dfcc6f48b6696989 for reference.

[fabianfreyer]

@akhramov thanks, this looks great! I'll go take a look at #79!