main/openrc: add vrf support

main/openrc/0011-vrf.patch

+From e9fa602a76693ff508dd498bcae8b27ce73e8294 Mon Sep 17 00:00:00 2001
+From: Ariadne Conill <ariadne@dereferenced.org>
+Date: Fri, 14 Feb 2020 16:02:43 +0000
+Subject: [PATCH] Add support for starting services in a specified VRF.
+
+The venerable iproute2 utility has recently introduced support
+for executing programs in specific VRFs which are virtualized
+routing tables.  These are typically used to isolate different
+networking planes from each other, for security or flexibility
+reasons.
+
+Services which use the normal supervisor/start-stop-daemon
+pattern can be configured by setting the vrf variable in the
+/etc/conf.d tree for the service.
+
+This allows for things like configuring the sshd service to
+run in a management VRF, which is useful for high assurance
+environments where the management plane is intended to be
+isolated.
+
+Signed-off-by: Ariadne Conill <ariadne@dereferenced.org>
+---
+ sh/openrc-run.sh.in     | 6 ++++++
+ sh/runit.sh             | 2 +-
+ sh/s6.sh                | 2 +-
+ sh/start-stop-daemon.sh | 2 +-
+ sh/supervise-daemon.sh  | 2 +-
+ 5 files changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/sh/openrc-run.sh.in b/sh/openrc-run.sh.in
+index 7e9064c2..0401423e 100644
+--- a/sh/openrc-run.sh.in
++++ b/sh/openrc-run.sh.in
+@@ -236,6 +236,12 @@ if ! sourcex -e "$_conf_d/$RC_SVCNAME.$RC_RUNLEVEL"; then
+ fi
+ unset _conf_d
+ 
++# If we are configured to run in a VRF, provide a hint for that
++RC_VRF_EXEC=""
++if [ -n "$vrf" ]; then
++	RC_VRF_EXEC="/sbin/ip vrf exec $vrf"
++fi
++
+ # load service supervisor functions
+ sourcex "@LIBEXECDIR@/sh/runit.sh"
+ sourcex "@LIBEXECDIR@/sh/s6.sh"
+diff --git a/sh/runit.sh b/sh/runit.sh
+index 3cef0f3a..ab729292 100644
+--- a/sh/runit.sh
++++ b/sh/runit.sh
+@@ -20,7 +20,7 @@ runit_start()
+ 	service_link="${RC_SVCDIR}/sv/${service_path##*/}"
+ 	ebegin "Starting ${name:-$RC_SVCNAME}"
+ 	ln -snf "${service_path}" "${service_link}"
+-	sv start "${service_link}" > /dev/null 2>&1
++	${RC_VRF_EXEC} sv start "${service_link}" > /dev/null 2>&1
+ 	eend $? "Failed to start ${name:-$RC_SVCNAME}"
+ }
+ 
+diff --git a/sh/s6.sh b/sh/s6.sh
+index acbe965b..1f339703 100644
+--- a/sh/s6.sh
++++ b/sh/s6.sh
+@@ -37,7 +37,7 @@ s6_start()
+ 	ln -sf "${s6_service_path}" "${s6_service_link}"
+ 	s6-svscanctl -na "${RC_SVCDIR}"/s6-scan
+ 	sleep 1.5
+-	s6-svc -u "${s6_service_link}"
++	${RC_VRF_EXEC} s6-svc -u "${s6_service_link}"
+ 	if [ -n "$s6_svwait_options_start" ]; then
+ 		s6-svwait ${s6_svwait_options_start} "${s6_service_link}"
+ 	fi
+diff --git a/sh/start-stop-daemon.sh b/sh/start-stop-daemon.sh
+index 2e549ae1..5e7a1b88 100644
+--- a/sh/start-stop-daemon.sh
++++ b/sh/start-stop-daemon.sh
+@@ -45,7 +45,7 @@ ssd_start()
+ 	#the eval call is necessary for cases like:
+ 	# command_args="this \"is a\" test"
+ 	# to work properly.
+-	eval start-stop-daemon --start \
++	eval ${RC_VRF_EXEC} start-stop-daemon --start \
+ 		--exec $command \
+ 		${chroot:+--chroot} $chroot \
+ 		${directory:+--chdir} $directory \
+diff --git a/sh/supervise-daemon.sh b/sh/supervise-daemon.sh
+index e403a789..259b8166 100644
+--- a/sh/supervise-daemon.sh
++++ b/sh/supervise-daemon.sh
+@@ -24,7 +24,7 @@ supervise_start()
+ 	# The eval call is necessary for cases like:
+ 	# command_args="this \"is a\" test"
+ 	# to work properly.
+-	eval supervise-daemon "${RC_SVCNAME}" --start \
++	eval ${RC_VRF_EXEC} supervise-daemon "${RC_SVCNAME}" --start \
+ 		${retry:+--retry} $retry \
+ 		${directory:+--chdir} $directory  \
+ 		${chroot:+--chroot} $chroot \