0.9.28 — rootless: set/clear_loginclass_rctl verbs (umbrella primitives)

[click0]

Summary

Twenty-ninth 0.9.x release. Two new privops verbs that apply RCTL rules at the loginclass scope (umbrella) instead of per-jail. The 0.9.11 crate-<uid> loginclass infrastructure is now addressable end-to-end.

What lands

• set_loginclass_rctl — wraps rctl -a loginclass:<name>:<key>:deny=<value>. Fields: loginclass, key, value. Validates loginclass via PerUserRctlPure::validateLoginclassName (must be crate-<uid> shape); key/value via the existing RetunePure whitelist (same gate as set_rctl from 0.9.0).
• clear_loginclass_rctl — symmetric remove.

Use case

# Pre-0.9.28: alice spawns 3 jails, each at 2G memoryuse.
# Total = 6G. Per-jail set_rctl can't catch this.

# 0.9.28: at provisioning time, set the umbrella once:
POST /api/v1/privops/set_loginclass_rctl
{"loginclass":"crate-1000","key":"memoryuse","value":"4G"}

# Now: alice spawns 3 jails. Kernel enforces 4G total
# regardless of how many jails she has.

Per-jail and umbrella rules apply simultaneously — kernel takes the more restrictive of the two.

Wire-up

Same files as previous verb-expansion releases. privops_pure.cpp gains #include "per_user_rctl_pure.h" to reuse validateLoginclassName.

CLI wiring (intentionally none)

The verbs are primitives — no automatic invocation from crate run. Operators call them directly (e.g., from a startup script) or wait for 0.9.29 which auto-applies from crated.conf at jail-create time. This split keeps 0.9.28 small; auto-application needs a config-schema decision worth its own PR.

Test plan

• 2 new ATF tests (set_loginclass_rctl_validates, clear_loginclass_rctl_validates) — happy path + bad loginclass + bad key + out-of-range value
• verb_token_roundtrips_for_every_verb updated
• Suite: 1301 → 1303
• FreeBSD CI must pass

Series state

12+ CLI call-sites wired. All host-side verbs needed for crate run exist. RCTL umbrella primitives now exist; auto-application coming in 0.9.29.

Remaining:

• 0.9.29 — auto-apply umbrella from crated.conf at jail-create
• 0.9.30 — default flip (rootless_per_user: true)
• 1.0.0 — setuid bit removed

---

Generated by Claude Code