v5.5.0

Changes between 5.4.0 and 5.5.0

• Fixed: appjail-jail(1)'s rename in ZFS-based systems.
• Fixed: typo ocurred -> occurred.
• Added: load-kld hook:
  • This hook has been implemented to facilitate the deployment of Sylve using the OCI image.
• Resolves location of fs_spec and fs_file in appjail-fstab(1) when fs_vfstype is {nullfs,<pseudofs>,<volumefs>,<secretsfs>}:
  • umount(8) may encounter issues when unmounting fs_file if the user has specified its location with a leading slash, but we will resolve both fs_spec and fs_file to avoid any side effects.
• Create a unix(4) socket in appjail-fstab(1)

  • mount_nullfs(8)/nullfs(4) [1] now includes the ability to mount a unix(4) socket on top of another unix(4) socket. Just as appjail-fstab(1) creates an empty file or directory, it now creates a dummy unix(4) socket. To do this, I needed to create a small utility called mksock, since there is none in the base system designed for this purpose.

    [1] https://reviews.freebsd.org/D59158

• Compare APPJAIL_PREPEND_ENTRYPOINT_FORCE instead of executing true/false in appjail-oci(1).
• Implemented: AppJail Secrets
  • Add pseudo-filesystem <secretsfs> to appjail-fstab(1).
  • Add secret option in appjail-quick(1).
  • Add appjail-secrets(1).
  • Add missing -q flag to grep(1) in share/appjail/lib/check_func:lib_check_ispath().
  • In share/appjail/lib/check_func:
    • Added: lib_check_secret().
    • Added: lib_check_secretname().
    • Added: lib_check_emptydir().
  • Added: a new dataset for secrets in share/appjail/lib/zfs.
  • In appjail.conf(5):
    • Added: SECRETSDIR.
    • Added: SECRETS_BACKENDSDIR.
    • Added: SECRETS_BACKEND.
    • Added: SECRETS_MDMFS_SIZE.
  • Added: Secrets to "Features" in README.
• libexec/appjail-config/cmd_edit.c: Don't fork(2), just execlp(3).
• Restrict the jail's root directory by default:
  • As an additional security measure, AppJail now changes the file mode of the jail's root directory to 0700. Do not confuse the jail's root directory with the jail directory itself. The jail's root directory is where AppJail stores the data for each jail, including the jail directory itself. This is primarily because some OCI images may create a file or directory with an insecure file mode, since there is only one or a few processes in the jail. Therefore, restricting the jail's root directory protects the data created by those processes from malicious users on the host.
  • DEPRECATED: appjail-config-user:

    • Since the jail's root directory is restricted, appjail-config needs permissions to read the files in the jail, which requires the use of appjail-config-user. The solution (which also improves the user experience) is to allow appjail-config to detect whether the user is root or a non-root user. In the latter case, all we need to do is elevate privileges, just as appjail runs automatically when a non-root user attempts to run it.

      This makes appjail-config-user unnecessary, so it is now deprecated and will be removed in future versions.

Full Changelog: v5.4.0...v5.5.0