Visual inspection: looks functionally equivalent, all options match their intend.
Test run: OK with 31 service jails (at least net_basic works ok).

The umask part looks fine.
About the dmesg_file part: from a technical point of view it is ok.,From a feature point of view, if it is not necessary, don't change it (I can't remember to have seen someone to have asked in the last 20 years about having it in another location).

I can confirm that this fixes the crash I've seen. Instead of crashing after a few minutes, it now is still humming happily with 16 minutes of uptime.

Just from reading I do not see an obvious issue now. Revision accepted (fixing the minor nit doesn't need another review IMO).

In D49976#1139747, @des wrote:

Wouldn't it be better to check at point of use rather than at point of initialization?

In D49843#1138774, @zec wrote:

In D49843#1138772, @netchild wrote:

In D49843#1138771, @zec wrote:

...

No, the host is gone as well, since the attacker has control over network connectivity.

You go to the keyboard of the host, delete the jail, and the attacker is gone.

Sounds pretty much as a very deep redefinition of the jail contract to me.

In D49843#1138771, @zec wrote:

In D49843#1138763, @ivy wrote:

In D49843#1138751, @zec wrote:

Consider an exploit in BIRD which would allow routing tables to be manipulated

consider an exploit in BIRD which would allow an attacker to run code as root.

running BIRD in a jail -> only the jail is compromised.

No, the host is gone as well, since the attacker has control over network connectivity.

In D49843#1138751, @zec wrote:

Repeating that someone might have his mind set on running BIRD in a swiss-cheese-jail is far from providing arguments on what real security benefit would this provide compared to running it in a plain system (or in a chrooted tree).

Consider an exploit in BIRD which would allow routing tables to be manipulated so that only the attacker would retain connectivity to the compromised host, while to the others the whole system would appear to be dead. What exactly does running BIRD in a service jail bring us, compared to running it in the base system?

In D49843#1137302, @lexi_le-fay.org wrote:

i have been mulling over how we can add more restrictions to svcj. i don't think "just use nullfs" is the answer here because that makes everything more complicated, but i don't yet have another proposal. i don't think this is impossible to fix in principle though.

In D49843#1137227, @markj wrote:

The svcj documentation in rc.conf.5 doesn't say anything about why one might want to run a service in a service jail, and what benefits that confers. I think that's a bug, especially given that the feature uses the term "jail" and not "container", and the former has specific connotations relating to security, at least in FreeBSD. And frankly I'm not sure what added security is obtained from having a privileged daemon run in a jail with path=/.

The kernel side (PRIV) of this patch is missing (compared to to the github pull request).
The svcj part is OK.

In my case I got
panic: invalid local group size 16 and count 16

Man page changed as suggested.

Committed

Separate review for SSP, add man page info for FORTIFY.