gluon-wan-dnsmasq: add ujail configuration

Use ujail to restrict dnsmasq privileges, similar to the regular OpenWrt
dnsmasq initscript.

package/gluon-wan-dnsmasq/files/etc/init.d/gluon-wan-dnsmasq

@@ -8,6 +8,7 @@ RESOLV_CONF_DIR=/var/gluon/wan-dnsmasq
 RESOLV_CONF=$RESOLV_CONF_DIR/resolv.conf
 
 start_service() {
+	mkdir -p /var/run/dnsmasq/
 	mkdir -p $RESOLV_CONF_DIR
 	touch "$RESOLV_CONF"
 
@@ -19,9 +20,17 @@ start_service() {
 		--port=54 \
 		--no-hosts \
 		--keep-in-foreground \
+		--pid-file=/var/run/dnsmasq/gluon-wan-dnsmasq.pid \
 		--cache-size=0 \
 		--resolv-file=$RESOLV_CONF
 	procd_set_param env LD_PRELOAD=libpacketmark.so LIBPACKETMARK_MARK=1
 	procd_set_param respawn 60 5 5
+
+	procd_add_jail dnsmasq log
+	procd_add_jail_mount $RESOLV_CONF_DIR
+	procd_add_jail_mount /usr/lib/libpacketmark.so
+	procd_add_jail_mount /etc/passwd /etc/group /etc/TZ
+	procd_add_jail_mount_rw /var/run/dnsmasq/
+
 	procd_close_instance
 }