devel/electron{42,43}: Install electron.d.ts
Some applications (e.g. VSCode) requires the file to be present while
building. Although it can be downloaded from Electron's releases page,
include here for convenience.
rc.subr tests: service jail behaviour of run_rc_command
Twenty cases over where each rc option and each method executes for a
jailed service, the jail's lifetime, and the svcj option handling. Each
case drives the service inside a chroot built in its ATF work directory.
MFC after: 1 week
MFC to: stable/15
Assisted-by: Claude Code (Opus 5)
(cherry picked from commit b5dcd8f9d6ae702adbc1627839b5235a28839370)
rc.subr: svcj - add a setaudit option
setaudit(8) is prefixed to the command inside the jail when
${name}_audit_user is set, and needs allow.setaudit.
This is not added automatically when ${name}_audit_user is set, this
needs an administrative setting of the options on purpose.
MFC after: 1 week
MFC to: stable/15
(cherry picked from commit 9125bc0727dbbf82b1c6a5f7c380f7b8c27b74dd)
rc.conf.5: note that a negative nice value does not reach a service jail
Raising a process' priority is not permitted inside a jail, and nice(1)
warns and executes the command anyway, so the service comes up at its login
class priority.
Not changing the date, as a commit a moment before this, one changed it
already.
MFC after: 1 week
MFC to: stable/15
(cherry picked from commit be834d62e990b58eb2e67ce9b48b635b645dcea1)
rc.subr: svcj - run a service's own restart and status methods in its jail
A script that defines non-default restart_cmd or status_cmd should
execute them in the service jail. Where there is no jail to enter,
restart starts the service instead of failing.
Fixes: 2efbd480f1d3 rc: add service jails framework
MFC after: 1 week
MFC to: stable/15
Assisted-by: Claude Code (Opus 5)
(cherry picked from commit 327dae5081059eb97af0cf319a444b3937ff4db2)
rc.subr: svcj - remove the service jail when the service is not running
A service whose tracked process had died while another process of its own
kept the jail alive, therefore left svcj-${name} behind, and the next start
would fail.
Fixes: 2efbd480f1d3 rc: add service jails framework
MFC after: 1 week
MFC to: stable/15
Assisted-by: Claude Code (Opus 5)
(cherry picked from commit a70ca1ebd8add7ea99b5674de715ae5fbf389dce)
rc.subr: svcj - let svcj_all_enable enable service jails
Fix the logic for svcj_all_enable.
Fixes: 2efbd480f1d3 rc: add service jails framework
MFC after: 1 week
MFC to: stable/15
(cherry picked from commit 21e53eeaffcac0be3427b7edb3b8739344a65174)
rc.subr: svcj - send the stop signal from inside the service jail
A service running under ${name}_user was signalled from the host as that
user, which the parent of a jail may no longer do: since 8a5ceebece03 an
unprivileged process would need allow.unprivileged_parent_tampering.
Stop and reload therefore failed and left both the service and its jail
running.
MFC after: 1 week
MFC to: stable/15
(cherry picked from commit 6155e17019f6ae08c74913b7ffb9312434f33a9f)
net/freeipa-server: Fix client enrollment paths
ipa-join used the upstream default /etc/ipa/ca.crt, so it could not
build a
TLS context and enrollment stopped at "Unable to determine root DN". The
client port already patches this constant; the server port ships the
same
ipaclient tree and needs it too.
configure_krb5_snippet() copied its snippet into a krb5.conf.d that
nothing
creates, which aborted the install with FileNotFoundError. It now
creates
the directory, which is where FreeIPA points krb5.conf's includedir
anyway.
Reported by: usenix17
https://github.com/joneum/FreeBSD-freeipa-server/issues/3
Sponsored by: Netzkommune GmbH
