procd/jail, branch master

jail: make /dev/tty accessible by others

2026-05-04T11:29:42Z

Required for e.g. `scp`, which fails otherwise: debug1: read_passphrase: can't open /dev/tty: Permission denied Signed-off-by: Andre Heider

jail: fix reading the oci device gid value

2026-05-04T11:29:02Z

Fix the typo to properly set the device group in the container namespace. Signed-off-by: Andre Heider

jail: mount tools used by dhcp.sh in the netifd jail

2026-05-04T11:28:59Z

./dhcp.sh: eval: line 33: md5sum: not found ./dhcp.sh: eval: line 33: cut: not found ./dhcp.sh: eval: line 107: /sbin/uci: not found Signed-off-by: Andre Heider

jail: mount ucode related bits into netifd jail

2026-05-04T11:28:32Z

netifd gained ucode support, mount the required pieces to fix the errors: daemon.crit netifd: Error loading ucode script: Syntax error: Unable to resolve path for module 'uci' In line 1, byte 27: `import * as uci from "uci";` Near here ----------------^ Syntax error: Unable to resolve path for module 'uloop' In line 2, byte 31: `import * as uloop from "uloop";` Near here --------------------^ Syntax error: Unable to resolve path for module 'ubus' In line 3, byte 32: `import * as libubus from "ubus";` Near here ---------------------^ Syntax error: Unable to resolve path for module 'fs' In line 4, byte 37: `import { access, dirname } from "fs";` Near here --------------------------^ Signed-off-by: Andre Heider

jail: mount /lib/config into netifd jail

2026-03-24T23:48:23Z

The DHCP and DHCPv6 protocol scripts in netifd source /lib/config/uci.sh during initialization. Without /lib/config/uci.sh bind-mounted into the jail, the netifd instance running inside a container's network namespace fails to start the DHCP client: ./dhcp.sh: .: line 8: can't open '/lib/config/uci.sh' ./dhcpv6.sh: .: line 5: can't open '/lib/config/uci.sh' Add /lib/config/uci.sh to the jail netifd mount list alongside the existing /lib/functions and /lib/functions.sh entries. Signed-off-by: Paul Spooren Signed-off-by: Daniel Golle

cgroups: fix syntax error

2026-02-10T18:15:42Z

An initializer in static const struct blobmsg_policy oci_linux_cgroups_memory_policy lacks an equals '=' sign. Add it. Fixes: 16159bb ("jail: parse OCI cgroups resources") Signed-off-by: @xiaobaishu1

procd: jail/cgroups: fix OOB write in cgroups_apply()

2026-02-09T11:37:13Z

Check if any cgroups have been selected and string subtree_control has a length greater than 0 before reducing its length by 1, preventing to write outside of the bounds of the array in case no cgroups are selected. Fixes: ID: TOB-OWRT-6 Fixes: 16159bb ("jail: parse OCI cgroups resources") Reported-by: Trail of Bits Signed-off-by: Daniel Golle

jail: make udebug socket optional

2025-05-31T14:20:31Z

Do not fail the jail mount if it does not exist, since udebugd is optional. Signed-off-by: Felix Fietkau

jail: add /dev/shm unconditionally

2025-05-28T14:24:55Z

It is used by udebug, but might be used for other purposes as well Signed-off-by: Felix Fietkau

jail: add flag for passing the udebug socket

2025-05-28T11:08:27Z

Signed-off-by: Felix Fietkau