Index: libexec/rc/rc.subr
===================================================================
--- libexec/rc/rc.subr	(revision 358732)
+++ libexec/rc/rc.subr	(working copy)
@@ -51,6 +51,9 @@
 ID="/usr/bin/id"
 IDCMD="if [ -x $ID ]; then $ID -un; fi"
 PS="/bin/ps -ww"
+JAIL_CMD="/usr/sbin/jail"
+JEXEC_CMD="/usr/sbin/jexec"
+_svcj_generic_params="path=/ mount.nodevfs host=inherit"
 JID=0
 # rc_service provides the path to the service script that we are executing.
 # This is not being set here in an execution context, necessarily, so it's
@@ -368,6 +371,9 @@
 		    $_procname|$_procnamebn|${_procnamebn}:|"(${_procnamebn})"|"[${_procnamebn}]")'
 	fi
 
+	if checkyesno ${name}_svcj; then
+		JID=$(/usr/sbin/jls -j svcj-${name} jid)
+	fi
 	_proccheck="\
 		$PS 2>/dev/null -o pid= -o jid= -o command= $_psargs"' |
 		while read _npid _jid '"$_fp_args"'; do
@@ -928,6 +934,11 @@
 			eval ${rcvar}=YES
 		fi
 		;;
+	jail*)				# "jail" prefix: signal that a service jail is created
+		_rc_prefix=jail
+		rc_arg=${rc_arg#${_rc_prefix}}
+		rc_quiet=yes
+		;;
 	one*)				# "one" prefix; set ${rcvar}=yes
 		_rc_prefix=one
 		rc_arg=${rc_arg#${_rc_prefix}}
@@ -950,6 +961,11 @@
 	_pidcmd=
 	_procname=${procname:-${command}}
 
+	eval _svcj=\$${name}_svcj
+	if [ -z "$_svcj" ]; then
+		eval ${name}_svcj=NO
+	fi
+
 					# setup pid check command
 	if [ -n "$_procname" ]; then
 		if [ -n "$pidfile" ]; then
@@ -980,7 +996,7 @@
 	    _fib=\$${name}_fib		_env=\$${name}_env \
 	    _prepend=\$${name}_prepend	_login_class=\${${name}_login_class:-daemon} \
 	    _limits=\$${name}_limits    _oomprotect=\$${name}_oomprotect \
-	    _env_file=\$${name}_env_file
+	    _env_file=\$${name}_env_file _svcj_options=\$${name}_svcj_options
 
 	if [ -n "$_env_file" ] && [ -r "${_env_file}" ]; then	# load env from file
 		set -a
@@ -994,6 +1010,42 @@
 		fi
 	fi
 
+	if [ -n "$_svcj_options" ]; then	# translate service jail options
+		_svcj_cmd_options=""
+
+		for _svcj_option in $_svcj_options; do
+			case "$_svcj_option" in
+				netv4)
+					_svcj_cmd_options="ip4=inherit allow.reserved_ports ${_svcj_cmd_options}"
+					;;
+				netv6)
+					_svcj_cmd_options="ip6=inherit allow.reserved_ports ${_svcj_cmd_options}"
+					;;
+				net_basic)
+					_svcj_cmd_options="ip4=inherit ip6=inherit allow.reserved_ports ${_svcj_cmd_options}"
+					;;
+				net_raw)
+					_svcj_cmd_options="allow.raw_sockets ${_svcj_cmd_options}"
+					;;
+				net_all)
+					_svcj_cmd_options="allow.socket_af allow.raw_sockets allow.reserved_ports ip4=inherit ip6=inherit ${_svcj_cmd_options}"
+					;;
+				sysvipc)
+					_svcj_cmd_options="sysvmsg=inherit sysvsem=inherit sysvshm=inherit  ${_svcj_cmd_options}"
+					;;
+				mlock)
+					_svcj_cmd_options="allow.mlock ${_svcj_cmd_options}"
+					;;
+				vmm)
+					_svcj_cmd_options="allow.vmm ${_svcj_cmd_options}"
+					;;
+				*)
+					echo ${name}: unknown service jail option: $_svcj_option
+					;;
+			esac
+		done
+	fi
+
 	[ -z "$autoboot" ] && eval $_pidcmd	# determine the pid if necessary
 
 	for _elem in $_keywords; do
@@ -1039,9 +1091,50 @@
 			if [ -n "$_env" ]; then
 				eval "export -- $_env"
 			fi
-			_run_rc_precmd || return 1
-			_run_rc_doit "$_cmd $rc_extra_args" || return 1
-			_run_rc_postcmd
+
+			if [ "${_rc_prefix}" != jail ]; then
+				_run_rc_precmd || return 1
+			fi
+			if ! checkyesno ${name}_svcj; then
+				_run_rc_doit "$_cmd $rc_extra_args" || return 1
+			else
+				case "$rc_arg" in
+				start)
+					if [ "${_rc_prefix}" != jail ]; then
+						_return=1
+						$JAIL_CMD -c $_svcj_generic_params $_svcj_cmd_options \
+						    exec.start="/usr/sbin/service ${name} jailstart $rc_extra_args" \
+						    exec.stop="/usr/sbin/service ${name} jailstop $rc_extra_args" \
+						    exec.consolelog="/var/log/svcj_${name}_console.log" \
+						    name=svcj-${name} && _return=0
+					else
+						_run_rc_doit "$_cmd $rc_extra_args" || _return=1
+					fi
+					;;
+				stop)
+					if [ "${_rc_prefix}" != jail ]; then
+						$JEXEC_CMD svcj-${name} /usr/sbin/service ${name} jailstop $rc_extra_args || _return=1
+						$JAIL_CMD -r svcj-${name} 2>/dev/null
+					else
+						_run_rc_doit "$_cmd $rc_extra_args" || _return=1
+					fi
+					;;
+				restart|status) ;; # no special case needed for svcj or handled somewhere else
+				*)
+if checkyesno ${name}_svcj; then
+echo XXX: check if \"$rc_arg\" needs to be executed in the jail or outside
+fi
+#					if [ "${_rc_prefix}" != jail ]; then
+#						$JEXEC_CMD svcj-${name} /usr/sbin/service ${name} jail${rc_arg} $rc_extra_args || _return=1
+#					else
+						_run_rc_doit "$_cmd $rc_extra_args" || _return=1
+#					fi
+					;;
+				esac
+			fi
+			if [ "${_rc_prefix}" != jail ]; then
+				_run_rc_postcmd
+			fi
 			return $_return
 		fi
 
@@ -1099,11 +1192,23 @@
 				return 1
 			fi
 
-			if ! _run_rc_precmd; then
-				warn "failed precmd routine for ${name}"
-				return 1
+			if [ "${_rc_prefix}" != jail ]; then
+				if ! _run_rc_precmd; then
+					warn "failed precmd routine for ${name}"
+					return 1
+				fi
 			fi
 
+			if checkyesno ${name}_svcj; then
+				if [ "${_rc_prefix}" != jail ]; then
+					$JAIL_CMD -c $_svcj_generic_params $_svcj_cmd_options\
+					    exec.start="/usr/sbin/service ${name} jailstart $rc_extra_args " \
+					    exec.stop="/usr/sbin/service ${name} jailstop $rc_extra_args " \
+					    exec.consolelog="/var/log/svcj_${name}_console.log" \
+					    name=svcj-${name} || return 1
+				fi
+			fi
+
 					# setup the full command to run
 					#
 			check_startmsgs && echo "Starting ${name}."
@@ -1138,16 +1243,28 @@
 					# Prepend default limits
 			_doit="$_cd limits -C $_login_class $_limits $_doit"
 
+
+			local _really_run_it=true
+			if checkyesno ${name}_svcj; then
+				if [ "${_rc_prefix}" != jail ]; then
+					_really_run_it=false
+				fi
+			fi
+
+			if [ "$_really_run_it" = true ]; then
 					# run the full command
 					#
-			if ! _run_rc_doit "$_doit"; then
-				warn "failed to start ${name}"
-				return 1
+				if ! _run_rc_doit "$_doit"; then
+					warn "failed to start ${name}"
+					return 1
+				fi
 			fi
 
+			if [ "${_rc_prefix}" != jail ]; then
 					# finally, run postcmd
 					#
-			_run_rc_postcmd
+				_run_rc_postcmd
+			fi
 			;;
 
 		stop)
@@ -1169,6 +1286,11 @@
 					# and run postcmd.
 			wait_for_pids $rc_pid
 
+			if checkyesno ${name}_svcj; then
+				# remove service jail
+				$JAIL_CMD -r svcj-${name} 2>/dev/null
+			fi
+
 			_run_rc_postcmd
 			;;
 
@@ -1197,6 +1319,7 @@
 
 			_run_rc_precmd || return 1
 
+
 			# run those in a subshell to keep global variables
 			( run_rc_command ${_rc_prefix}stop $rc_extra_args )
 			( run_rc_command ${_rc_prefix}start $rc_extra_args )
