Lines Matching +full:cs +full:- +full:0
1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
65 int paralimit = -1;
92 if (error == 0 && setid == CPUSET_INVALID) in root_cpuset_id()
93 error = cpuset_getid(CPU_LEVEL_ROOT, CPU_WHICH_PID, -1, &setid); in root_cpuset_id()
94 if (error != 0) in root_cpuset_id()
108 if (paralimit == 0) { in next_command()
109 if (j->flags & JF_FROM_RUNQ) in next_command()
115 j->flags &= ~JF_FROM_RUNQ; in next_command()
116 create_failed = (j->flags & (JF_STOP | JF_FAILED)) == JF_FAILED; in next_command()
117 stopping = (j->flags & JF_STOP) != 0; in next_command()
118 comparam = *j->comparam; in next_command()
120 if (j->comstring == NULL) { in next_command()
121 j->comparam += create_failed ? -1 : 1; in next_command()
122 switch ((comparam = *j->comparam)) { in next_command()
124 return 0; in next_command()
126 if (!bool_param(j->intparams[IP_MOUNT_DEVFS])) in next_command()
128 j->comstring = &dummystring; in next_command()
131 if (!bool_param(j->intparams[IP_MOUNT_FDESCFS])) in next_command()
133 j->comstring = &dummystring; in next_command()
136 if (!bool_param(j->intparams[IP_MOUNT_PROCFS])) in next_command()
138 j->comstring = &dummystring; in next_command()
142 j->comstring = &dummystring; in next_command()
145 if (j->intparams[comparam] == NULL) in next_command()
147 j->comstring = create_failed || (stopping && in next_command()
148 (j->intparams[comparam]->flags & PF_REV)) in next_command()
149 ? TAILQ_LAST(&j->intparams[comparam]->val, in next_command()
151 : TAILQ_FIRST(&j->intparams[comparam]->val); in next_command()
154 j->comstring = j->comstring == &dummystring ? NULL : in next_command()
156 (j->intparams[comparam]->flags & PF_REV)) in next_command()
157 ? TAILQ_PREV(j->comstring, cfstrings, tq) in next_command()
158 : TAILQ_NEXT(j->comstring, tq); in next_command()
160 if (j->comstring == NULL || j->comstring->len == 0 || in next_command()
167 case -1: in next_command()
185 if (!(j->flags & JF_SLEEPQ)) in finish_command()
186 return 0; in finish_command()
187 j->flags &= ~JF_SLEEPQ; in finish_command()
188 if (*j->comparam == IP_STOP_TIMEOUT) { in finish_command()
189 j->flags &= ~JF_TIMEOUT; in finish_command()
190 j->pstatus = 0; in finish_command()
191 return 0; in finish_command()
196 rj->flags |= JF_FROM_RUNQ; in finish_command()
199 error = 0; in finish_command()
200 if (j->flags & JF_TIMEOUT) { in finish_command()
201 j->flags &= ~JF_TIMEOUT; in finish_command()
202 if (*j->comparam != IP_STOP_TIMEOUT) { in finish_command()
203 jail_warnx(j, "%s: timed out", j->comline); in finish_command()
205 error = -1; in finish_command()
206 } else if (verbose > 0) in finish_command()
208 } else if (j->pstatus != 0) { in finish_command()
209 if (WIFSIGNALED(j->pstatus)) in finish_command()
211 j->comline, WTERMSIG(j->pstatus)); in finish_command()
213 jail_warnx(j, "%s: failed", j->comline); in finish_command()
214 j->pstatus = 0; in finish_command()
216 error = -1; in finish_command()
218 free(j->comline); in finish_command()
219 j->comline = NULL; in finish_command()
237 if ((j = TAILQ_FIRST(&sleeping)) && j->timeout.tv_sec) { in next_proc()
239 ts.tv_sec = j->timeout.tv_sec - ts.tv_sec; in next_proc()
240 ts.tv_nsec = j->timeout.tv_nsec - ts.tv_nsec; in next_proc()
241 if (ts.tv_nsec < 0) { in next_proc()
242 ts.tv_sec--; in next_proc()
245 if (ts.tv_sec < 0 || in next_proc()
246 (ts.tv_sec == 0 && ts.tv_nsec == 0)) { in next_proc()
247 j->flags |= JF_TIMEOUT; in next_proc()
254 ts.tv_sec = 0; in next_proc()
255 ts.tv_nsec = 0; in next_proc()
258 switch (kevent(kq, NULL, 0, &ke, 1, tsp)) { in next_proc()
259 case -1: in next_proc()
263 case 0: in next_proc()
266 j->flags |= JF_TIMEOUT; in next_proc()
274 j->pstatus = ke.data; in next_proc()
293 char *acs, *cs, *comcs, *devpath; in run_command() local
307 comparam = *j->comparam; in run_command()
308 down = j->flags & (JF_STOP | JF_FAILED); in run_command()
315 if (jail_remove(j->jid) < 0 && errno == EPERM) { in run_command()
318 return -1; in run_command()
320 if (verbose > 0 || (verbose == 0 && (j->flags & JF_STOP in run_command()
321 ? note_remove : j->name != NULL))) in run_command()
323 j->jid = -1; in run_command()
324 if (j->flags & JF_STOP) in run_command()
327 j->flags &= ~JF_PERSIST; in run_command()
329 if (create_jail(j) < 0) in run_command()
330 return -1; in run_command()
332 printf("%d\n", j->jid); in run_command()
333 if (verbose >= 0 && (j->name || verbose > 0)) in run_command()
337 return 0; in run_command()
345 comstring = j->comstring; in run_command()
346 bg = 0; in run_command()
350 argc = 0; in run_command()
351 val = alloca(strlen(comstring->s) + 1); in run_command()
352 strcpy(val, comstring->s); in run_command()
353 cs = val; in run_command()
355 while ((p = strchr(cs, ' ')) != NULL && strlen(p) > 1) { in run_command()
357 *p = '\0'; in run_command()
360 cs = p + 1; in run_command()
365 argv[0] = _PATH_IFCONFIG; in run_command()
366 if ((cs = strchr(val, '|'))) { in run_command()
367 argv[1] = acs = alloca(cs - val + 1); in run_command()
368 strlcpy(acs, val, cs - val + 1); in run_command()
369 addr = cs + 1; in run_command()
371 argv[1] = string_param(j->intparams[IP_INTERFACE]); in run_command()
375 if (!(cs = strchr(addr, '/'))) { in run_command()
380 } else if (strchr(cs + 1, '.')) { in run_command()
381 argv[3] = acs = alloca(cs - addr + 1); in run_command()
382 strlcpy(acs, addr, cs - addr + 1); in run_command()
384 argv[5] = cs + 1; in run_command()
392 for (cs = strtok(extrap, " "); cs; in run_command()
393 cs = strtok(NULL, " ")) { in run_command()
394 size_t len = strlen(cs) + 1; in run_command()
396 strlcpy(acs, cs, len); in run_command()
400 argv[argc] = down ? "-alias" : "alias"; in run_command()
407 argc = 0; in run_command()
408 val = alloca(strlen(comstring->s) + 1); in run_command()
409 strcpy(val, comstring->s); in run_command()
410 cs = val; in run_command()
412 while ((p = strchr(cs, ' ')) != NULL && strlen(p) > 1) { in run_command()
414 *p = '\0'; in run_command()
417 cs = p + 1; in run_command()
422 argv[0] = _PATH_IFCONFIG; in run_command()
423 if ((cs = strchr(val, '|'))) { in run_command()
424 argv[1] = acs = alloca(cs - val + 1); in run_command()
425 strlcpy(acs, val, cs - val + 1); in run_command()
426 addr = cs + 1; in run_command()
428 argv[1] = string_param(j->intparams[IP_INTERFACE]); in run_command()
433 if (!(cs = strchr(addr, '/'))) { in run_command()
441 for (cs = strtok(extrap, " "); cs; in run_command()
442 cs = strtok(NULL, " ")) { in run_command()
443 size_t len = strlen(cs) + 1; in run_command()
445 strlcpy(acs, cs, len); in run_command()
449 argv[argc] = down ? "-alias" : "alias"; in run_command()
456 argv[0] = _PATH_IFCONFIG; in run_command()
457 argv[1] = comstring->s; in run_command()
458 argv[2] = down ? "-vnet" : "vnet"; in run_command()
459 jidstr = string_param(j->intparams[KP_JID]); in run_command()
460 argv[3] = jidstr ? jidstr : string_param(j->intparams[KP_NAME]); in run_command()
467 comcs = alloca(comstring->len + 1); in run_command()
468 strcpy(comcs, comstring->s); in run_command()
469 argc = 0; in run_command()
470 for (cs = strtok(comcs, " \t\f\v\r\n"); cs && argc < 4; in run_command()
471 cs = strtok(NULL, " \t\f\v\r\n")) { in run_command()
472 if (argc <= 1 && strunvis(cs, cs) < 0) { in run_command()
474 j->intparams[comparam]->name, comstring->s); in run_command()
475 return -1; in run_command()
477 argv[argc++] = cs; in run_command()
479 if (argc == 0) in run_command()
480 return 0; in run_command()
483 j->intparams[comparam]->name, comstring->s); in run_command()
484 return -1; in run_command()
486 if (check_path(j, j->intparams[comparam]->name, argv[1], 0, in run_command()
487 down ? argv[2] : NULL) < 0) in run_command()
488 return -1; in run_command()
492 argv[0] = "/sbin/umount"; in run_command()
497 argv[5] = argv[0]; in run_command()
499 argv[3] = "-o"; in run_command()
503 argv[3] = argv[0]; in run_command()
505 argv[0] = _PATH_MOUNT; in run_command()
507 argv[1] = "-t"; in run_command()
512 path = string_param(j->intparams[KP_PATH]); in run_command()
515 return -1; in run_command()
519 if (check_path(j, "mount.devfs", devpath, 0, in run_command()
520 down ? "devfs" : NULL) < 0) in run_command()
521 return -1; in run_command()
523 argv[0] = "/sbin/umount"; in run_command()
527 argv[0] = _PATH_MOUNT; in run_command()
528 argv[1] = "-t"; in run_command()
530 ruleset = string_param(j->intparams[KP_DEVFS_RULESET]); in run_command()
534 sprintf(acs, "-oruleset=%s", ruleset); in run_command()
543 path = string_param(j->intparams[KP_PATH]); in run_command()
546 return -1; in run_command()
550 if (check_path(j, "mount.fdescfs", devpath, 0, in run_command()
551 down ? "fdescfs" : NULL) < 0) in run_command()
552 return -1; in run_command()
554 argv[0] = "/sbin/umount"; in run_command()
558 argv[0] = _PATH_MOUNT; in run_command()
559 argv[1] = "-t"; in run_command()
569 path = string_param(j->intparams[KP_PATH]); in run_command()
572 return -1; in run_command()
576 if (check_path(j, "mount.procfs", devpath, 0, in run_command()
577 down ? "procfs" : NULL) < 0) in run_command()
578 return -1; in run_command()
580 argv[0] = "/sbin/umount"; in run_command()
584 argv[0] = _PATH_MOUNT; in run_command()
585 argv[1] = "-t"; in run_command()
595 jidstr = string_param(j->intparams[KP_JID]) ? in run_command()
596 string_param(j->intparams[KP_JID]) : in run_command()
597 string_param(j->intparams[KP_NAME]); in run_command()
598 …fmt = "if [ $(/sbin/zfs get -H -o value jailed %s) = on ]; then /sbin/zfs jail %s %s || echo error… in run_command()
601 + 4 * comstring->len in run_command()
602 - 6 * 2 /* 6 * "%s" */ in run_command()
605 ret = snprintf(comcs, comlen, fmt, comstring->s, in run_command()
606 jidstr, comstring->s, comstring->s, jidstr, in run_command()
607 comstring->s); in run_command()
612 argv[0] = _PATH_BSHELL; in run_command()
613 argv[1] = "-c"; in run_command()
619 if (j->name != NULL) in run_command()
621 argc = 0; in run_command()
622 TAILQ_FOREACH(s, &j->intparams[IP_COMMAND]->val, tq) in run_command()
625 argc = 0; in run_command()
626 TAILQ_FOREACH(s, &j->intparams[IP_COMMAND]->val, tq) in run_command()
627 argv[argc++] = s->s; in run_command()
629 j->comstring = &dummystring; in run_command()
634 if ((cs = strpbrk(comstring->s, "!\"$&'()*;<>?[\\]`{|}~")) && in run_command()
635 !(cs[0] == '&' && cs[1] == '\0')) { in run_command()
637 argv[0] = _PATH_BSHELL; in run_command()
638 argv[1] = "-c"; in run_command()
639 argv[2] = comstring->s; in run_command()
642 if (cs) { in run_command()
643 *cs = 0; in run_command()
646 comcs = alloca(comstring->len + 1); in run_command()
647 strcpy(comcs, comstring->s); in run_command()
648 argc = 0; in run_command()
649 for (cs = strtok(comcs, " \t\f\v\r\n"); cs; in run_command()
650 cs = strtok(NULL, " \t\f\v\r\n")) in run_command()
653 strcpy(comcs, comstring->s); in run_command()
654 argc = 0; in run_command()
655 for (cs = strtok(comcs, " \t\f\v\r\n"); cs; in run_command()
656 cs = strtok(NULL, " \t\f\v\r\n")) in run_command()
657 argv[argc++] = cs; in run_command()
661 if (argv[0] == NULL) in run_command()
662 return 0; in run_command()
664 if (int_param(j->intparams[IP_EXEC_TIMEOUT], &timeout) && in run_command()
665 timeout != 0) { in run_command()
666 clock_gettime(CLOCK_REALTIME, &j->timeout); in run_command()
667 j->timeout.tv_sec += timeout; in run_command()
669 j->timeout.tv_sec = 0; in run_command()
677 clean = bool_param(j->intparams[IP_EXEC_CLEAN]); in run_command()
678 username = string_param(j->intparams[injail in run_command()
680 sjuser = bool_param(j->intparams[IP_EXEC_SYSTEM_JAIL_USER]); in run_command()
682 consfd = 0; in run_command()
684 (conslog = string_param(j->intparams[IP_EXEC_CONSOLELOG]))) { in run_command()
685 if (check_path(j, "exec.consolelog", conslog, 1, NULL) < 0) in run_command()
686 return -1; in run_command()
689 if (consfd < 0) { in run_command()
691 return -1; in run_command()
695 comlen = 0; in run_command()
696 for (i = 0; argv[i]; i++) in run_command()
698 j->comline = cs = emalloc(comlen); in run_command()
699 for (i = 0; argv[i]; i++) { in run_command()
700 strcpy(cs, argv[i]); in run_command()
702 cs += strlen(argv[i]) + 1; in run_command()
703 cs[-1] = ' '; in run_command()
706 if (verbose > 0) in run_command()
709 username ? username : "", j->comline); in run_command()
712 if (pid < 0) in run_command()
714 if (pid > 0) { in run_command()
716 free(j->comline); in run_command()
717 j->comline = NULL; in run_command()
718 return 0; in run_command()
720 paralimit--; in run_command()
731 get_user_info(j, username, &pwd, &lcap) < 0) in run_command()
735 path = string_param(j->intparams[KP_PATH]); in run_command()
736 if (path && chdir(path) < 0) { in run_command()
740 if (int_param(j->intparams[IP_EXEC_FIB], &fib) && in run_command()
741 setfib(fib) < 0) { in run_command()
752 * This is just a best-effort to use as wide of mask as in run_command()
756 (void)cpuset_setid(CPU_WHICH_PID, -1, setid); in run_command()
758 if (jail_attach(j->jid) < 0) { in run_command()
765 get_user_info(j, username, &pwd, &lcap) < 0) in run_command()
770 setenv("PATH", "/bin:/usr/bin", 0); in run_command()
774 if (setgid(pwd->pw_gid) < 0) { in run_command()
775 jail_warnx(j, "setgid %d: %s", pwd->pw_gid, in run_command()
779 if (setusercontext(lcap, pwd, pwd->pw_uid, username in run_command()
781 : LOGIN_SETPATH | LOGIN_SETENV) < 0) { in run_command()
782 jail_warnx(j, "setusercontext %s: %s", pwd->pw_name, in run_command()
787 setenv("USER", pwd->pw_name, 1); in run_command()
788 setenv("HOME", pwd->pw_dir, 1); in run_command()
790 *pwd->pw_shell ? pwd->pw_shell : _PATH_BSHELL, 1); in run_command()
791 if (clean && username && chdir(pwd->pw_dir) < 0) { in run_command()
793 pwd->pw_dir, strerror(errno)); in run_command()
799 if (consfd != 0 && (dup2(consfd, 1) < 0 || dup2(consfd, 2) < 0)) { in run_command()
804 execvp(argv[0], __DECONST(char *const*, argv)); in run_command()
805 jail_warnx(j, "exec %s: %s", argv[0], strerror(errno)); in run_command()
819 if (!kq && (kq = kqueue()) < 0) in add_proc()
821 EV_SET(&ke, pid, EVFILT_PROC, EV_ADD, NOTE_EXIT, 0, NULL); in add_proc()
822 if (kevent(kq, &ke, 1, NULL, 0, NULL) < 0) { in add_proc()
824 return 0; in add_proc()
828 ph->j = j; in add_proc()
829 ph->pid = pid; in add_proc()
831 j->nprocs++; in add_proc()
832 j->flags |= JF_SLEEPQ; in add_proc()
833 if (j->timeout.tv_sec == 0) in add_proc()
837 TAILQ_REMOVE(j->queue, j, tq); in add_proc()
839 if (!tj->timeout.tv_sec || in add_proc()
840 j->timeout.tv_sec < tj->timeout.tv_sec || in add_proc()
841 (j->timeout.tv_sec == tj->timeout.tv_sec && in add_proc()
842 j->timeout.tv_nsec <= tj->timeout.tv_nsec)) { in add_proc()
849 j->queue = &sleeping; in add_proc()
864 j->nprocs = 0; in clear_procs()
865 for (i = 0; i < PHASH_SIZE; i++) in clear_procs()
867 if (ph->j == j) { in clear_procs()
868 EV_SET(&ke, ph->pid, EVFILT_PROC, EV_DELETE, in clear_procs()
869 NOTE_EXIT, 0, NULL); in clear_procs()
870 (void)kevent(kq, &ke, 1, NULL, 0, NULL); in clear_procs()
886 if (ph->pid == pid) { in find_proc()
887 j = ph->j; in find_proc()
890 return --j->nprocs ? NULL : j; in find_proc()
906 if (!int_param(j->intparams[IP_STOP_TIMEOUT], &timeout)) in term_procs()
908 else if (timeout == 0) in term_procs()
909 return 0; in term_procs()
914 return 0; in term_procs()
917 ki = kvm_getprocs(kd, KERN_PROC_PROC, 0, &pcnt); in term_procs()
919 return 0; in term_procs()
920 noted = 0; in term_procs()
921 for (i = 0; i < pcnt; i++) in term_procs()
922 if (ki[i].ki_jid == j->jid && in term_procs()
923 kill(ki[i].ki_pid, SIGTERM) == 0) { in term_procs()
925 if (verbose > 0) { in term_procs()
935 if (j->nprocs > 0) { in term_procs()
936 clock_gettime(CLOCK_REALTIME, &j->timeout); in term_procs()
937 j->timeout.tv_sec += timeout; in term_procs()
940 return 0; in term_procs()
952 errno = 0; in get_user_info()
962 return -1; in get_user_info()
966 jail_warnx(j, "getpwclass %s: %s", pwd->pw_name, in get_user_info()
968 return -1; in get_user_info()
971 if (initgroups(pwd->pw_name, pwd->pw_gid) < 0) { in get_user_info()
972 jail_warnx(j, "initgroups %s: %s", pwd->pw_name, in get_user_info()
974 return -1; in get_user_info()
976 return 0; in get_user_info()
993 if (path[0] != '/') { in check_path()
996 return -1; in check_path()
1002 jailpath = string_param(j->intparams[KP_PATH]); in check_path()
1012 *p = '\0'; in check_path()
1013 if (lstat(tpath, &st) < 0) { in check_path()
1018 return -1; in check_path()
1023 return -1; in check_path()
1030 if (stat(path, &st) < 0 || statfs(path, &stfs) < 0) { in check_path()
1033 return -1; in check_path()
1035 if (stat(stfs.f_mntonname, &mpst) < 0) { in check_path()
1038 return -1; in check_path()
1043 return -1; in check_path()
1048 return -1; in check_path()
1051 return 0; in check_path()