NAME

SYNOPSIS

DESCRIPTION

This is useful to allow scripts or users in a jail(8) environment to trigger some predefined actions in the host system, like rebooting a jailed host, manipulating devices or taking file system snapshots.

The options are as follows:

-D

Start the jaildaemon in daemon mode. It will check for other instances of jaildaemon by sending a test command to the ipc socket.

-p pidfile

When run in daemon mode, write the ID of the daemon process into the pidfile using the pidfile(3) functionality. Ignored in utility mode.

-f ipcsockpath

jaildaemon in utility mode passes commands to the jaildaemon daemon via unix domain socket, which defaults to /var/run/jaildaemon.pipe. You can pass an alternative with this option.

-c command

Start the jaildaemon in utility mode and pass the command, together with the jid and an optional proctitle to the jaildaemon daemon. When the utility detects no running jaildaemon daemon, an error is reported.

-j jid

The jail id of the jail jaildaemon daemon shall attach the probe process to.

-t proctitle

Setting a proctitle on the probe process is useful to provide some information to scripts or users in the jail, what action sending the HUP signal triggers. The proctitle is visible via the ps(1) utility and signals can be sent to all processes matching the string with the pkill(1) utility when invoked with the -f option. (See EXAMPLES for more details.)

-r

Tell the jaildaemon daemon to respawn the probe process once the triggered command in the host system has completed.

By default all commands start single shot processes; to avoid race conditions and multiple invocations of possibly non-reentrant scripts, probe processes kill themselves after receiving the HUP signal. Respawning is meant as an option for commands that do not shut down the jail.

-R

Just like the -r option, only the jaildaemon daemon does not wait for the command to complete before re-spawning the probe process.

Use this option only if you know, what you're doing. Most shell scripts are not re-entrant, even if their authors think so and most programs that run long enough should not be started twice with identical parameters.

-u uid

Probes normally run as user root and thus can only be signalled by root inside the jail. For some use cases it is desirable to allow non-privileged processes inside the jail to signal the probe. You can use this switch to tell jaildaemon what uid to drop to after being jailed away. (Note that uids inside and outside the jail are never guaranteed to match.)

Use this option only if you know, what you're doing. For most occasions it is a good idea to restrict signalling probes to the root user.

-g gid

Set the group ID of the probe process. Useful together with the -u switch on hosts where security.bsd.see_other_gids=0.

Exactly one of the -D or -c options must be specified, in daemon mode all options for the utility mode are ignored. In utility mode the -j parameter is mandatory.

EXAMPLES

FILES

SEE ALSO

AUTHOR