1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 1999 Poul-Henning Kamp. 5 * Copyright (c) 2008 Bjoern A. Zeeb. 6 * Copyright (c) 2009 James Gritton. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28 * SUCH DAMAGE. 29 */ 30 31 #include <sys/cdefs.h> 32 #include "opt_ddb.h" 33 #include "opt_inet.h" 34 #include "opt_inet6.h" 35 #include "opt_nfs.h" 36 37 #include <sys/param.h> 38 #include <sys/types.h> 39 #include <sys/ctype.h> 40 #include <sys/kernel.h> 41 #include <sys/systm.h> 42 #include <sys/errno.h> 43 #include <sys/file.h> 44 #include <sys/sysproto.h> 45 #include <sys/malloc.h> 46 #include <sys/osd.h> 47 #include <sys/priv.h> 48 #include <sys/proc.h> 49 #include <sys/epoch.h> 50 #include <sys/event.h> 51 #include <sys/taskqueue.h> 52 #include <sys/fcntl.h> 53 #include <sys/jail.h> 54 #include <sys/jaildesc.h> 55 #include <sys/linker.h> 56 #include <sys/lock.h> 57 #include <sys/mman.h> 58 #include <sys/mutex.h> 59 #include <sys/racct.h> 60 #include <sys/rctl.h> 61 #include <sys/refcount.h> 62 #include <sys/sx.h> 63 #include <sys/sysent.h> 64 #include <sys/namei.h> 65 #include <sys/mount.h> 66 #include <sys/queue.h> 67 #include <sys/socket.h> 68 #include <sys/syscallsubr.h> 69 #include <sys/sysctl.h> 70 #include <sys/uuid.h> 71 #include <sys/vnode.h> 72 73 #include <net/if.h> 74 #include <net/vnet.h> 75 76 #include <netinet/in.h> 77 78 #ifdef DDB 79 #include <ddb/ddb.h> 80 #endif /* DDB */ 81 82 #include <security/mac/mac_framework.h> 83 #include <security/mac/mac_policy.h> 84 #include <security/mac/mac_syscalls.h> 85 86 #define PRISON0_HOSTUUID_MODULE "hostuuid" 87 88 MALLOC_DEFINE(M_PRISON, "prison", "Prison structures"); 89 #ifdef RACCT 90 static MALLOC_DEFINE(M_PRISON_RACCT, "prison_racct", "Prison racct structures"); 91 #endif 92 93 /* Keep struct prison prison0 and some code in kern_jail_set() readable. */ 94 #ifdef INET 95 #ifdef INET6 96 #define _PR_IP_SADDRSEL PR_IP4_SADDRSEL|PR_IP6_SADDRSEL 97 #else 98 #define _PR_IP_SADDRSEL PR_IP4_SADDRSEL 99 #endif 100 #else /* !INET */ 101 #ifdef INET6 102 #define _PR_IP_SADDRSEL PR_IP6_SADDRSEL 103 #else 104 #define _PR_IP_SADDRSEL 0 105 #endif 106 #endif 107 108 /* prison0 describes what is "real" about the system. */ 109 struct prison prison0 = { 110 .pr_id = 0, 111 .pr_name = "0", 112 .pr_ref = 1, 113 .pr_uref = 1, 114 .pr_path = "/", 115 .pr_securelevel = -1, 116 .pr_devfs_rsnum = 0, 117 .pr_state = PRISON_STATE_ALIVE, 118 .pr_childmax = JAIL_MAX, 119 .pr_hostuuid = DEFAULT_HOSTUUID, 120 .pr_children = LIST_HEAD_INITIALIZER(prison0.pr_children), 121 #ifdef VIMAGE 122 .pr_flags = PR_HOST|PR_VNET|_PR_IP_SADDRSEL, 123 #else 124 .pr_flags = PR_HOST|_PR_IP_SADDRSEL, 125 #endif 126 .pr_allow = PR_ALLOW_PRISON0, 127 }; 128 _Static_assert((PR_ALLOW_PRISON0 & ~PR_ALLOW_ALL_STATIC) == 0, 129 "Bits enabled in PR_ALLOW_PRISON0 that are not statically reserved"); 130 131 MTX_SYSINIT(prison0, &prison0.pr_mtx, "jail mutex", MTX_DEF); 132 133 struct bool_flags { 134 const char *name; 135 const char *noname; 136 volatile u_int flag; 137 }; 138 struct jailsys_flags { 139 const char *name; 140 unsigned disable; 141 unsigned new; 142 }; 143 144 /* 145 * Handle jail teardown in a dedicated thread to avoid deadlocks from 146 * vnet_destroy(). 147 */ 148 TASKQUEUE_DEFINE_THREAD(jail_remove); 149 150 /* allprison, allprison_racct and lastprid are protected by allprison_lock. */ 151 struct sx allprison_lock; 152 SX_SYSINIT(allprison_lock, &allprison_lock, "allprison"); 153 struct prisonlist allprison = TAILQ_HEAD_INITIALIZER(allprison); 154 LIST_HEAD(, prison_racct) allprison_racct; 155 int lastprid = 0; 156 int lastdeadid = 0; 157 158 static int get_next_prid(struct prison **insprp); 159 static int get_next_deadid(struct prison **insprp); 160 static int do_jail_attach(struct thread *td, struct prison *pr, int *drflagsp); 161 static int prison_attach_thread_single(struct thread *td); 162 static void prison_attach_thread_single_end(struct thread *td); 163 static void prison_complete(void *context, int pending); 164 static void prison_deref(struct prison *pr, int flags); 165 static void prison_deref_kill(struct prison *pr, struct prisonlist *freeprison); 166 static int prison_lock_xlock(struct prison *pr, int flags); 167 static void prison_cleanup_locked(struct prison *pr); 168 static void prison_cleanup_unlocked(struct prison *pr); 169 static void prison_free_not_last(struct prison *pr); 170 static void prison_proc_free_not_last(struct prison *pr); 171 static void prison_proc_relink(struct prison *opr, struct prison *npr, 172 struct proc *p); 173 static void prison_set_allow_locked(struct prison *pr, unsigned flag, 174 int enable); 175 static char *prison_path(struct prison *pr1, struct prison *pr2); 176 #ifdef RACCT 177 static void prison_racct_attach(struct prison *pr); 178 static void prison_racct_modify(struct prison *pr); 179 static void prison_racct_detach(struct prison *pr); 180 #endif 181 static void prison_knote(struct prison *pr, long hint); 182 183 /* Flags for prison_deref */ 184 #define PD_DEREF 0x01 /* Decrement pr_ref */ 185 #define PD_DEUREF 0x02 /* Decrement pr_uref */ 186 #define PD_KILL 0x04 /* Remove jail, kill processes, etc */ 187 #define PD_LOCKED 0x10 /* pr_mtx is held */ 188 #define PD_LIST_SLOCKED 0x20 /* allprison_lock is held shared */ 189 #define PD_LIST_XLOCKED 0x40 /* allprison_lock is held exclusive */ 190 #define PD_OP_FLAGS 0x07 /* Operation flags */ 191 #define PD_LOCK_FLAGS 0x70 /* Lock status flags */ 192 193 /* 194 * Parameter names corresponding to PR_* flag values. Size values are for kvm 195 * as we cannot figure out the size of a sparse array, or an array without a 196 * terminating entry. 197 */ 198 static struct bool_flags pr_flag_bool[] = { 199 {JAIL_PARAM_PERSIST, JAIL_PARAM_NOPERSIST, PR_PERSIST}, 200 #ifdef INET 201 {JAIL_PARAM_IP4_SADDRSEL, JAIL_PARAM_IP4_NOSADDRSEL, PR_IP4_SADDRSEL}, 202 #endif 203 #ifdef INET6 204 {JAIL_PARAM_IP6_SADDRSEL, JAIL_PARAM_IP6_NOSADDRSEL, PR_IP6_SADDRSEL}, 205 #endif 206 }; 207 const size_t pr_flag_bool_size = sizeof(pr_flag_bool); 208 209 static struct jailsys_flags pr_flag_jailsys[] = { 210 {JAIL_PARAM_HOST, 0, PR_HOST}, 211 #ifdef VIMAGE 212 {JAIL_PARAM_VNET, 0, PR_VNET}, 213 #endif 214 #ifdef INET 215 {JAIL_PARAM_IP4, PR_IP4_USER, PR_IP4_USER}, 216 #endif 217 #ifdef INET6 218 {JAIL_PARAM_IP6, PR_IP6_USER, PR_IP6_USER}, 219 #endif 220 }; 221 const size_t pr_flag_jailsys_size = sizeof(pr_flag_jailsys); 222 223 /* 224 * Make this array full-size so dynamic parameters can be added. 225 * It is protected by prison0.mtx, but lockless reading is allowed 226 * with an atomic check of the flag values. 227 */ 228 static struct bool_flags pr_flag_allow[NBBY * NBPW] = { 229 {JAIL_PARAM_ALLOW_SET_HOSTNAME, JAIL_PARAM_ALLOW_NOSET_HOSTNAME, 230 PR_ALLOW_SET_HOSTNAME}, 231 {JAIL_PARAM_ALLOW_SYSVIPC, JAIL_PARAM_ALLOW_NOSYSVIPC, 232 PR_ALLOW_SYSVIPC}, 233 {JAIL_PARAM_ALLOW_RAW_SOCKETS, JAIL_PARAM_ALLOW_NORAW_SOCKETS, 234 PR_ALLOW_RAW_SOCKETS}, 235 {JAIL_PARAM_ALLOW_CHFLAGS, JAIL_PARAM_ALLOW_NOCHFLAGS, 236 PR_ALLOW_CHFLAGS}, 237 {JAIL_PARAM_ALLOW_MOUNT, JAIL_PARAM_ALLOW_NOMOUNT, PR_ALLOW_MOUNT}, 238 {JAIL_PARAM_ALLOW_QUOTAS, JAIL_PARAM_ALLOW_NOQUOTAS, PR_ALLOW_QUOTAS}, 239 {JAIL_PARAM_ALLOW_SOCKET_AF, JAIL_PARAM_ALLOW_NOSOCKET_AF, 240 PR_ALLOW_SOCKET_AF}, 241 {JAIL_PARAM_ALLOW_MLOCK, JAIL_PARAM_ALLOW_NOMLOCK, PR_ALLOW_MLOCK}, 242 {JAIL_PARAM_ALLOW_RESERVED_PORTS, JAIL_PARAM_ALLOW_NORESERVED_PORTS, 243 PR_ALLOW_RESERVED_PORTS}, 244 {JAIL_PARAM_ALLOW_READ_MSGBUF, JAIL_PARAM_ALLOW_NOREAD_MSGBUF, 245 PR_ALLOW_READ_MSGBUF}, 246 {JAIL_PARAM_ALLOW_UNPRIV_DEBUG, JAIL_PARAM_ALLOW_NOUNPRIV_DEBUG, 247 PR_ALLOW_UNPRIV_DEBUG}, 248 {JAIL_PARAM_ALLOW_SUSER, JAIL_PARAM_ALLOW_NOSUSER, PR_ALLOW_SUSER}, 249 #ifdef VIMAGE 250 {JAIL_PARAM_ALLOW_NFSD, JAIL_PARAM_ALLOW_NONFSD, PR_ALLOW_NFSD}, 251 #endif 252 {JAIL_PARAM_ALLOW_EXTATTR, JAIL_PARAM_ALLOW_NOEXTATTR, 253 PR_ALLOW_EXTATTR}, 254 {JAIL_PARAM_ALLOW_ADJTIME, JAIL_PARAM_ALLOW_NOADJTIME, 255 PR_ALLOW_ADJTIME}, 256 {JAIL_PARAM_ALLOW_SETTIME, JAIL_PARAM_ALLOW_NOSETTIME, 257 PR_ALLOW_SETTIME}, 258 {JAIL_PARAM_ALLOW_ROUTING, JAIL_PARAM_ALLOW_NOROUTING, 259 PR_ALLOW_ROUTING}, 260 {JAIL_PARAM_ALLOW_UNPRIV_PARENT_TAMPER, 261 JAIL_PARAM_ALLOW_NOUNPRIV_PARENT_TAMPER, 262 PR_ALLOW_UNPRIV_PARENT_TAMPER}, 263 #ifdef AUDIT 264 {JAIL_PARAM_ALLOW_SETAUDIT, JAIL_PARAM_ALLOW_NOSETAUDIT, 265 PR_ALLOW_SETAUDIT}, 266 #endif 267 }; 268 static unsigned pr_allow_all = PR_ALLOW_ALL_STATIC; 269 const size_t pr_flag_allow_size = sizeof(pr_flag_allow); 270 271 #define JAIL_DEFAULT_ALLOW (PR_ALLOW_SET_HOSTNAME | \ 272 PR_ALLOW_RESERVED_PORTS | \ 273 PR_ALLOW_UNPRIV_DEBUG | \ 274 PR_ALLOW_SUSER) 275 #define JAIL_DEFAULT_ENFORCE_STATFS 2 276 #define JAIL_DEFAULT_DEVFS_RSNUM 0 277 static unsigned jail_default_allow = JAIL_DEFAULT_ALLOW; 278 static int jail_default_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS; 279 static int jail_default_devfs_rsnum = JAIL_DEFAULT_DEVFS_RSNUM; 280 #if defined(INET) || defined(INET6) 281 static unsigned jail_max_af_ips = 255; 282 #endif 283 284 /* 285 * Initialize the parts of prison0 that can't be static-initialized with 286 * constants. This is called from proc0_init() after creating thread0 cpuset. 287 */ 288 void 289 prison0_init(void) 290 { 291 uint8_t *file, *data; 292 size_t size; 293 char buf[sizeof(prison0.pr_hostuuid)]; 294 #ifdef MAC 295 int error __diagused; 296 #endif 297 bool valid; 298 299 #ifdef MAC 300 error = mac_prison_init(&prison0, M_WAITOK); 301 MPASS(error == 0); 302 303 mtx_unlock(&prison0.pr_mtx); 304 #endif 305 prison0.pr_cpuset = cpuset_ref(thread0.td_cpuset); 306 prison0.pr_osreldate = osreldate; 307 strlcpy(prison0.pr_osrelease, osrelease, sizeof(prison0.pr_osrelease)); 308 309 /* If we have a preloaded hostuuid, use it. */ 310 file = preload_search_by_type(PRISON0_HOSTUUID_MODULE); 311 if (file != NULL) { 312 data = preload_fetch_addr(file); 313 size = preload_fetch_size(file); 314 if (data != NULL) { 315 /* 316 * The preloaded data may include trailing whitespace, almost 317 * certainly a newline; skip over any whitespace or 318 * non-printable characters to be safe. 319 */ 320 while (size > 0 && data[size - 1] <= 0x20) { 321 size--; 322 } 323 324 valid = false; 325 326 /* 327 * Not NUL-terminated when passed from loader, but 328 * validate_uuid requires that due to using sscanf (as 329 * does the subsequent strlcpy, since it still reads 330 * past the given size to return the true length); 331 * bounce to a temporary buffer to fix. 332 */ 333 if (size >= sizeof(buf)) 334 goto done; 335 336 memcpy(buf, data, size); 337 buf[size] = '\0'; 338 339 if (validate_uuid(buf, size, NULL, 0) != 0) 340 goto done; 341 342 valid = true; 343 (void)strlcpy(prison0.pr_hostuuid, buf, 344 sizeof(prison0.pr_hostuuid)); 345 346 done: 347 if (bootverbose && !valid) { 348 printf("hostuuid: preload data malformed: '%.*s'\n", 349 (int)size, data); 350 } 351 } 352 } 353 if (bootverbose) 354 printf("hostuuid: using %s\n", prison0.pr_hostuuid); 355 } 356 357 /* 358 * struct jail_args { 359 * struct jail *jail; 360 * }; 361 */ 362 int 363 sys_jail(struct thread *td, struct jail_args *uap) 364 { 365 uint32_t version; 366 int error; 367 struct jail j; 368 369 error = copyin(uap->jail, &version, sizeof(uint32_t)); 370 if (error) 371 return (error); 372 373 switch (version) { 374 case 0: 375 { 376 struct jail_v0 j0; 377 378 /* FreeBSD single IPv4 jails. */ 379 bzero(&j, sizeof(struct jail)); 380 error = copyin(uap->jail, &j0, sizeof(struct jail_v0)); 381 if (error) 382 return (error); 383 j.version = j0.version; 384 j.path = j0.path; 385 j.hostname = j0.hostname; 386 j.ip4s = htonl(j0.ip_number); /* jail_v0 is host order */ 387 break; 388 } 389 390 case 1: 391 /* 392 * Version 1 was used by multi-IPv4 jail implementations 393 * that never made it into the official kernel. 394 */ 395 return (EINVAL); 396 397 case 2: /* JAIL_API_VERSION */ 398 /* FreeBSD multi-IPv4/IPv6,noIP jails. */ 399 error = copyin(uap->jail, &j, sizeof(struct jail)); 400 if (error) 401 return (error); 402 break; 403 404 default: 405 /* Sci-Fi jails are not supported, sorry. */ 406 return (EINVAL); 407 } 408 return (kern_jail(td, &j)); 409 } 410 411 int 412 kern_jail(struct thread *td, struct jail *j) 413 { 414 struct iovec optiov[2 * (4 + nitems(pr_flag_allow) 415 #ifdef INET 416 + 1 417 #endif 418 #ifdef INET6 419 + 1 420 #endif 421 )]; 422 struct uio opt; 423 char *u_path, *u_hostname, *u_name; 424 struct bool_flags *bf; 425 #ifdef INET 426 uint32_t ip4s; 427 struct in_addr *u_ip4; 428 #endif 429 #ifdef INET6 430 struct in6_addr *u_ip6; 431 #endif 432 size_t tmplen; 433 int error, enforce_statfs; 434 435 bzero(&optiov, sizeof(optiov)); 436 opt.uio_iov = optiov; 437 opt.uio_iovcnt = 0; 438 opt.uio_offset = -1; 439 opt.uio_resid = -1; 440 opt.uio_segflg = UIO_SYSSPACE; 441 opt.uio_rw = UIO_READ; 442 opt.uio_td = td; 443 444 /* Set permissions for top-level jails from sysctls. */ 445 if (!jailed(td->td_ucred)) { 446 for (bf = pr_flag_allow; 447 bf < pr_flag_allow + nitems(pr_flag_allow) && 448 atomic_load_int(&bf->flag) != 0; 449 bf++) { 450 optiov[opt.uio_iovcnt].iov_base = __DECONST(char *, 451 (jail_default_allow & bf->flag) 452 ? bf->name : bf->noname); 453 optiov[opt.uio_iovcnt].iov_len = 454 strlen(optiov[opt.uio_iovcnt].iov_base) + 1; 455 opt.uio_iovcnt += 2; 456 } 457 optiov[opt.uio_iovcnt].iov_base = JAIL_PARAM_ENFORCE_STATFS; 458 optiov[opt.uio_iovcnt].iov_len = sizeof(JAIL_PARAM_ENFORCE_STATFS); 459 opt.uio_iovcnt++; 460 enforce_statfs = jail_default_enforce_statfs; 461 optiov[opt.uio_iovcnt].iov_base = &enforce_statfs; 462 optiov[opt.uio_iovcnt].iov_len = sizeof(enforce_statfs); 463 opt.uio_iovcnt++; 464 } 465 466 tmplen = MAXPATHLEN + MAXHOSTNAMELEN + MAXHOSTNAMELEN; 467 #ifdef INET 468 ip4s = (j->version == 0) ? 1 : j->ip4s; 469 if (ip4s > jail_max_af_ips) 470 return (EINVAL); 471 tmplen += ip4s * sizeof(struct in_addr); 472 #else 473 if (j->ip4s > 0) 474 return (EINVAL); 475 #endif 476 #ifdef INET6 477 if (j->ip6s > jail_max_af_ips) 478 return (EINVAL); 479 tmplen += j->ip6s * sizeof(struct in6_addr); 480 #else 481 if (j->ip6s > 0) 482 return (EINVAL); 483 #endif 484 u_path = malloc(tmplen, M_TEMP, M_WAITOK); 485 u_hostname = u_path + MAXPATHLEN; 486 u_name = u_hostname + MAXHOSTNAMELEN; 487 #ifdef INET 488 u_ip4 = (struct in_addr *)(u_name + MAXHOSTNAMELEN); 489 #endif 490 #ifdef INET6 491 #ifdef INET 492 u_ip6 = (struct in6_addr *)(u_ip4 + ip4s); 493 #else 494 u_ip6 = (struct in6_addr *)(u_name + MAXHOSTNAMELEN); 495 #endif 496 #endif 497 optiov[opt.uio_iovcnt].iov_base = JAIL_PARAM_PATH; 498 optiov[opt.uio_iovcnt].iov_len = sizeof(JAIL_PARAM_PATH); 499 opt.uio_iovcnt++; 500 optiov[opt.uio_iovcnt].iov_base = u_path; 501 error = copyinstr(j->path, u_path, MAXPATHLEN, 502 &optiov[opt.uio_iovcnt].iov_len); 503 if (error) { 504 free(u_path, M_TEMP); 505 return (error); 506 } 507 opt.uio_iovcnt++; 508 optiov[opt.uio_iovcnt].iov_base = JAIL_PARAM_HOST_HOSTNAME; 509 optiov[opt.uio_iovcnt].iov_len = sizeof(JAIL_PARAM_HOST_HOSTNAME); 510 opt.uio_iovcnt++; 511 optiov[opt.uio_iovcnt].iov_base = u_hostname; 512 error = copyinstr(j->hostname, u_hostname, MAXHOSTNAMELEN, 513 &optiov[opt.uio_iovcnt].iov_len); 514 if (error) { 515 free(u_path, M_TEMP); 516 return (error); 517 } 518 opt.uio_iovcnt++; 519 if (j->jailname != NULL) { 520 optiov[opt.uio_iovcnt].iov_base = JAIL_PARAM_NAME; 521 optiov[opt.uio_iovcnt].iov_len = sizeof(JAIL_PARAM_NAME); 522 opt.uio_iovcnt++; 523 optiov[opt.uio_iovcnt].iov_base = u_name; 524 error = copyinstr(j->jailname, u_name, MAXHOSTNAMELEN, 525 &optiov[opt.uio_iovcnt].iov_len); 526 if (error) { 527 free(u_path, M_TEMP); 528 return (error); 529 } 530 opt.uio_iovcnt++; 531 } 532 #ifdef INET 533 optiov[opt.uio_iovcnt].iov_base = JAIL_PARAM_IP4_ADDR; 534 optiov[opt.uio_iovcnt].iov_len = sizeof(JAIL_PARAM_IP4_ADDR); 535 opt.uio_iovcnt++; 536 optiov[opt.uio_iovcnt].iov_base = u_ip4; 537 optiov[opt.uio_iovcnt].iov_len = ip4s * sizeof(struct in_addr); 538 if (j->version == 0) 539 u_ip4->s_addr = j->ip4s; 540 else { 541 error = copyin(j->ip4, u_ip4, optiov[opt.uio_iovcnt].iov_len); 542 if (error) { 543 free(u_path, M_TEMP); 544 return (error); 545 } 546 } 547 opt.uio_iovcnt++; 548 #endif 549 #ifdef INET6 550 optiov[opt.uio_iovcnt].iov_base = JAIL_PARAM_IP6_ADDR; 551 optiov[opt.uio_iovcnt].iov_len = sizeof(JAIL_PARAM_IP6_ADDR); 552 opt.uio_iovcnt++; 553 optiov[opt.uio_iovcnt].iov_base = u_ip6; 554 optiov[opt.uio_iovcnt].iov_len = j->ip6s * sizeof(struct in6_addr); 555 error = copyin(j->ip6, u_ip6, optiov[opt.uio_iovcnt].iov_len); 556 if (error) { 557 free(u_path, M_TEMP); 558 return (error); 559 } 560 opt.uio_iovcnt++; 561 #endif 562 KASSERT(opt.uio_iovcnt <= nitems(optiov), 563 ("kern_jail: too many iovecs (%d)", opt.uio_iovcnt)); 564 error = kern_jail_set(td, &opt, JAIL_CREATE | JAIL_ATTACH); 565 free(u_path, M_TEMP); 566 return (error); 567 } 568 569 /* 570 * struct jail_set_args { 571 * struct iovec *iovp; 572 * unsigned int iovcnt; 573 * int flags; 574 * }; 575 */ 576 int 577 sys_jail_set(struct thread *td, struct jail_set_args *uap) 578 { 579 struct uio *auio; 580 int error; 581 582 /* Check that we have an even number of iovecs. */ 583 if (uap->iovcnt & 1) 584 return (EINVAL); 585 586 error = copyinuio(uap->iovp, uap->iovcnt, &auio); 587 if (error) 588 return (error); 589 error = kern_jail_set(td, auio, uap->flags); 590 freeuio(auio); 591 return (error); 592 } 593 594 #if defined(INET) || defined(INET6) 595 typedef int prison_addr_cmp_t(const void *, const void *); 596 typedef bool prison_addr_valid_t(const void *); 597 static const struct pr_family { 598 size_t size; 599 prison_addr_cmp_t *cmp; 600 prison_addr_valid_t *valid; 601 int ip_flag; 602 } pr_families[PR_FAMILY_MAX] = { 603 #ifdef INET 604 [PR_INET] = { 605 .size = sizeof(struct in_addr), 606 .cmp = prison_qcmp_v4, 607 .valid = prison_valid_v4, 608 .ip_flag = PR_IP4_USER, 609 }, 610 #endif 611 #ifdef INET6 612 [PR_INET6] = { 613 .size = sizeof(struct in6_addr), 614 .cmp = prison_qcmp_v6, 615 .valid = prison_valid_v6, 616 .ip_flag = PR_IP6_USER, 617 }, 618 #endif 619 }; 620 621 /* 622 * Network address lists (pr_addrs) allocation for jails. The addresses 623 * are accessed locklessly by the network stack, thus need to be protected by 624 * the network epoch. 625 */ 626 struct prison_ip { 627 struct epoch_context ctx; 628 uint32_t ips; 629 #ifdef FUTURE_C 630 /* 631 * XXX Variable-length automatic arrays in union may be 632 * supported in future C. 633 */ 634 union { 635 char pr_ip[]; 636 struct in_addr pr_ip4[]; 637 struct in6_addr pr_ip6[]; 638 }; 639 #else /* No future C :( */ 640 char pr_ip[]; 641 #endif 642 }; 643 644 static char * 645 PR_IP(struct prison_ip *pip, const pr_family_t af, int idx) 646 { 647 MPASS(pip); 648 MPASS(af < PR_FAMILY_MAX); 649 MPASS(idx >= 0 && idx < pip->ips); 650 651 return (pip->pr_ip + pr_families[af].size * idx); 652 } 653 654 static struct prison_ip * 655 prison_ip_alloc(const pr_family_t af, uint32_t cnt, int flags) 656 { 657 struct prison_ip *pip; 658 659 pip = malloc(sizeof(struct prison_ip) + cnt * pr_families[af].size, 660 M_PRISON, flags); 661 if (pip != NULL) 662 pip->ips = cnt; 663 return (pip); 664 } 665 666 /* 667 * Allocate and copyin user supplied address list, sorting and validating. 668 * kern_jail_set() helper. 669 */ 670 static struct prison_ip * 671 prison_ip_copyin(const pr_family_t af, void *op, uint32_t cnt) 672 { 673 prison_addr_cmp_t *const cmp = pr_families[af].cmp; 674 const size_t size = pr_families[af].size; 675 struct prison_ip *pip; 676 677 pip = prison_ip_alloc(af, cnt, M_WAITOK); 678 bcopy(op, pip->pr_ip, cnt * size); 679 /* 680 * IP addresses are all sorted but ip[0] to preserve 681 * the primary IP address as given from userland. 682 * This special IP is used for unbound outgoing 683 * connections as well for "loopback" traffic in case 684 * source address selection cannot find any more fitting 685 * address to connect from. 686 */ 687 if (cnt > 1) 688 qsort(PR_IP(pip, af, 1), cnt - 1, size, cmp); 689 /* 690 * Check for duplicate addresses and do some simple 691 * zero and broadcast checks. If users give other bogus 692 * addresses it is their problem. 693 */ 694 for (int i = 0; i < cnt; i++) { 695 if (!pr_families[af].valid(PR_IP(pip, af, i))) { 696 free(pip, M_PRISON); 697 return (NULL); 698 } 699 if (i + 1 < cnt && 700 (cmp(PR_IP(pip, af, 0), PR_IP(pip, af, i + 1)) == 0 || 701 cmp(PR_IP(pip, af, i), PR_IP(pip, af, i + 1)) == 0)) { 702 free(pip, M_PRISON); 703 return (NULL); 704 } 705 } 706 707 return (pip); 708 } 709 710 /* 711 * Allocate and dup parent prison address list. 712 * kern_jail_set() helper. 713 */ 714 static void 715 prison_ip_dup(struct prison *ppr, struct prison *pr, const pr_family_t af) 716 { 717 const struct prison_ip *ppip = ppr->pr_addrs[af]; 718 struct prison_ip *pip; 719 720 if (ppip != NULL) { 721 pip = prison_ip_alloc(af, ppip->ips, M_WAITOK); 722 bcopy(ppip->pr_ip, pip->pr_ip, pip->ips * pr_families[af].size); 723 pr->pr_addrs[af] = pip; 724 } 725 } 726 727 /* 728 * Make sure the new set of IP addresses is a subset of the parent's list. 729 * Don't worry about the parent being unlocked, as any setting is done with 730 * allprison_lock held. 731 * kern_jail_set() helper. 732 */ 733 static bool 734 prison_ip_parent_match(struct prison_ip *ppip, struct prison_ip *pip, 735 const pr_family_t af) 736 { 737 prison_addr_cmp_t *const cmp = pr_families[af].cmp; 738 int i, j; 739 740 if (ppip == NULL) 741 return (false); 742 743 for (i = 0; i < ppip->ips; i++) 744 if (cmp(PR_IP(pip, af, 0), PR_IP(ppip, af, i)) == 0) 745 break; 746 747 if (i == ppip->ips) 748 /* Main address not present in parent. */ 749 return (false); 750 751 if (pip->ips > 1) { 752 for (i = j = 1; i < pip->ips; i++) { 753 if (cmp(PR_IP(pip, af, i), PR_IP(ppip, af, 0)) == 0) 754 /* Equals to parent primary address. */ 755 continue; 756 for (; j < ppip->ips; j++) 757 if (cmp(PR_IP(pip, af, i), 758 PR_IP(ppip, af, j)) == 0) 759 break; 760 if (j == ppip->ips) 761 break; 762 } 763 if (j == ppip->ips) 764 /* Address not present in parent. */ 765 return (false); 766 } 767 return (true); 768 } 769 770 /* 771 * Check for conflicting IP addresses. We permit them if there is no more 772 * than one IP on each jail. If there is a duplicate on a jail with more 773 * than one IP stop checking and return error. 774 * kern_jail_set() helper. 775 */ 776 static bool 777 prison_ip_conflict_check(const struct prison *ppr, const struct prison *pr, 778 struct prison_ip *pip, pr_family_t af) 779 { 780 const struct prison *tppr, *tpr; 781 int descend; 782 783 #ifdef VIMAGE 784 for (tppr = ppr; tppr != &prison0; tppr = tppr->pr_parent) 785 if (tppr->pr_flags & PR_VNET) 786 break; 787 #else 788 tppr = &prison0; 789 #endif 790 FOREACH_PRISON_DESCENDANT(tppr, tpr, descend) { 791 if (tpr == pr || 792 #ifdef VIMAGE 793 (tpr != tppr && (tpr->pr_flags & PR_VNET)) || 794 #endif 795 !prison_isalive(tpr)) { 796 descend = 0; 797 continue; 798 } 799 if (!(tpr->pr_flags & pr_families[af].ip_flag)) 800 continue; 801 descend = 0; 802 if (tpr->pr_addrs[af] == NULL || 803 (pip->ips == 1 && tpr->pr_addrs[af]->ips == 1)) 804 continue; 805 for (int i = 0; i < pip->ips; i++) 806 if (prison_ip_check(tpr, af, PR_IP(pip, af, i)) == 0) 807 return (false); 808 } 809 810 return (true); 811 } 812 813 _Static_assert(offsetof(struct prison_ip, ctx) == 0, 814 "prison must start with epoch context"); 815 static void 816 prison_ip_free_deferred(epoch_context_t ctx) 817 { 818 819 free(ctx, M_PRISON); 820 } 821 822 static void 823 prison_ip_free(struct prison_ip *pip) 824 { 825 826 if (pip != NULL) 827 NET_EPOCH_CALL(prison_ip_free_deferred, &pip->ctx); 828 } 829 830 static void 831 prison_ip_set(struct prison *pr, const pr_family_t af, struct prison_ip *new) 832 { 833 struct prison_ip **mem, *old; 834 835 mtx_assert(&pr->pr_mtx, MA_OWNED); 836 837 mem = &pr->pr_addrs[af]; 838 839 old = *mem; 840 atomic_store_ptr(mem, new); 841 prison_ip_free(old); 842 } 843 844 /* 845 * Restrict a prison's IP address list with its parent's, possibly replacing 846 * it. Return true if succeed, otherwise should redo. 847 * kern_jail_set() helper. 848 */ 849 static bool 850 prison_ip_restrict(struct prison *pr, const pr_family_t af, 851 struct prison_ip **newp) 852 { 853 struct prison_ip *ppip = pr->pr_parent->pr_addrs[af]; 854 struct prison_ip *pip = pr->pr_addrs[af]; 855 int (*const cmp)(const void *, const void *) = pr_families[af].cmp; 856 const size_t size = pr_families[af].size; 857 struct prison_ip *new = newp != NULL ? *newp : NULL; 858 uint32_t ips; 859 860 mtx_assert(&pr->pr_mtx, MA_OWNED); 861 862 /* 863 * Due to epoch-synchronized access to the IP address lists we always 864 * allocate a new list even if the old one has enough space. We could 865 * atomically update an IPv4 address inside a list, but that would 866 * screw up sorting, and in case of IPv6 we can't even atomically write 867 * one. 868 */ 869 if (ppip == NULL) { 870 if (pip != NULL) 871 prison_ip_set(pr, af, NULL); 872 return (true); 873 } 874 875 if (!(pr->pr_flags & pr_families[af].ip_flag)) { 876 if (new == NULL) { 877 new = prison_ip_alloc(af, ppip->ips, M_NOWAIT); 878 if (new == NULL) 879 return (false); /* Redo */ 880 } 881 /* This has no user settings, so just copy the parent's list. */ 882 MPASS(new->ips == ppip->ips); 883 bcopy(ppip->pr_ip, new->pr_ip, ppip->ips * size); 884 prison_ip_set(pr, af, new); 885 if (newp != NULL) 886 *newp = NULL; /* Used */ 887 } else if (pip != NULL) { 888 /* Remove addresses that aren't in the parent. */ 889 int i; 890 891 i = 0; /* index in pip */ 892 ips = 0; /* index in new */ 893 894 if (new == NULL) { 895 new = prison_ip_alloc(af, pip->ips, M_NOWAIT); 896 if (new == NULL) 897 return (false); /* Redo */ 898 } 899 900 for (int pi = 0; pi < ppip->ips; pi++) 901 if (cmp(PR_IP(pip, af, 0), PR_IP(ppip, af, pi)) == 0) { 902 /* Found our primary address in parent. */ 903 bcopy(PR_IP(pip, af, i), PR_IP(new, af, ips), 904 size); 905 i++; 906 ips++; 907 break; 908 } 909 for (int pi = 1; i < pip->ips; ) { 910 /* Check against primary, which is unsorted. */ 911 if (cmp(PR_IP(pip, af, i), PR_IP(ppip, af, 0)) == 0) { 912 /* Matches parent's primary address. */ 913 bcopy(PR_IP(pip, af, i), PR_IP(new, af, ips), 914 size); 915 i++; 916 ips++; 917 continue; 918 } 919 /* The rest are sorted. */ 920 switch (pi >= ppip->ips ? -1 : 921 cmp(PR_IP(pip, af, i), PR_IP(ppip, af, pi))) { 922 case -1: 923 i++; 924 break; 925 case 0: 926 bcopy(PR_IP(pip, af, i), PR_IP(new, af, ips), 927 size); 928 i++; 929 pi++; 930 ips++; 931 break; 932 case 1: 933 pi++; 934 break; 935 } 936 } 937 if (ips == 0) { 938 if (newp == NULL || *newp == NULL) 939 prison_ip_free(new); 940 new = NULL; 941 } else { 942 /* Shrink to real size */ 943 KASSERT((new->ips >= ips), 944 ("Out-of-bounds write to prison_ip %p", new)); 945 new->ips = ips; 946 } 947 prison_ip_set(pr, af, new); 948 if (newp != NULL) 949 *newp = NULL; /* Used */ 950 } 951 return (true); 952 } 953 954 /* 955 * Fast-path check if an address belongs to a prison. 956 */ 957 int 958 prison_ip_check(const struct prison *pr, const pr_family_t af, 959 const void *addr) 960 { 961 int (*const cmp)(const void *, const void *) = pr_families[af].cmp; 962 struct prison_ip *pip; 963 int i, a, z, d; 964 965 MPASS(mtx_owned(&pr->pr_mtx) || 966 in_epoch(net_epoch_preempt) || 967 sx_xlocked(&allprison_lock)); 968 969 pip = atomic_load_ptr(&pr->pr_addrs[af]); 970 if (__predict_false(pip == NULL)) 971 return (EAFNOSUPPORT); 972 973 /* Check the primary IP. */ 974 if (cmp(PR_IP(pip, af, 0), addr) == 0) 975 return (0); 976 977 /* 978 * All the other IPs are sorted so we can do a binary search. 979 */ 980 a = 0; 981 z = pip->ips - 2; 982 while (a <= z) { 983 i = (a + z) / 2; 984 d = cmp(PR_IP(pip, af, i + 1), addr); 985 if (d > 0) 986 z = i - 1; 987 else if (d < 0) 988 a = i + 1; 989 else 990 return (0); 991 } 992 993 return (EADDRNOTAVAIL); 994 } 995 996 /* 997 * Grab primary IP. Historically required mutex, but nothing prevents 998 * us to support epoch-protected access. Is it used in fast path? 999 * in{6}_jail.c helper 1000 */ 1001 const void * 1002 prison_ip_get0(const struct prison *pr, const pr_family_t af) 1003 { 1004 const struct prison_ip *pip = pr->pr_addrs[af]; 1005 1006 mtx_assert(&pr->pr_mtx, MA_OWNED); 1007 MPASS(pip); 1008 1009 return (pip->pr_ip); 1010 } 1011 1012 u_int 1013 prison_ip_cnt(const struct prison *pr, const pr_family_t af) 1014 { 1015 1016 return (pr->pr_addrs[af]->ips); 1017 } 1018 #endif /* defined(INET) || defined(INET6) */ 1019 1020 int 1021 kern_jail_set(struct thread *td, struct uio *optuio, int flags) 1022 { 1023 struct file *jfp_out; 1024 struct nameidata nd; 1025 #ifdef INET 1026 struct prison_ip *ip4; 1027 #endif 1028 #ifdef INET6 1029 struct prison_ip *ip6; 1030 #endif 1031 struct vfsopt *opt; 1032 struct vfsoptlist *opts; 1033 struct prison *pr, *deadpr, *dinspr, *inspr, *mypr, *ppr, *tpr; 1034 struct ucred *jdcred; 1035 struct vnode *root; 1036 char *domain, *errmsg, *host, *name, *namelc, *p, *path, *uuid; 1037 char *g_path, *osrelstr; 1038 struct bool_flags *bf; 1039 struct jailsys_flags *jsf; 1040 #if defined(INET) || defined(INET6) 1041 void *op; 1042 #endif 1043 unsigned long hid; 1044 size_t namelen, onamelen, pnamelen; 1045 #ifdef MAC 1046 void *mac_set_prison_data = NULL; 1047 int gotmaclabel; 1048 #endif 1049 int created, cuflags, descend, drflags, enforce; 1050 int error, errmsg_len, errmsg_pos; 1051 int gotchildmax, gotenforce, gothid, gotrsnum, gotslevel; 1052 int deadid, jfd_in, jfd_out, jfd_pos, jid, jsys, len, level; 1053 int childmax, osreldt, rsnum, slevel; 1054 #ifdef INET 1055 int ip4s; 1056 bool redo_ip4; 1057 #endif 1058 #ifdef INET6 1059 int ip6s; 1060 bool redo_ip6; 1061 #endif 1062 bool maybe_changed; 1063 uint64_t pr_allow, ch_allow, pr_flags, ch_flags; 1064 uint64_t pr_allow_diff; 1065 unsigned tallow; 1066 char numbuf[12]; 1067 1068 mypr = td->td_ucred->cr_prison; 1069 if (((flags & (JAIL_CREATE | JAIL_AT_DESC)) == JAIL_CREATE) && 1070 mypr->pr_childmax == 0) 1071 return (EPERM); 1072 if (flags & ~JAIL_SET_MASK) 1073 return (EINVAL); 1074 if ((flags & (JAIL_USE_DESC | JAIL_AT_DESC)) == 1075 (JAIL_USE_DESC | JAIL_AT_DESC)) 1076 return (EINVAL); 1077 1078 /* Only let a single thread in the process try to attach at a time. */ 1079 if (flags & JAIL_ATTACH) { 1080 error = prison_attach_thread_single(td); 1081 if (error != 0) 1082 return (error); 1083 } 1084 1085 #ifdef INET 1086 ip4 = NULL; 1087 #endif 1088 #ifdef INET6 1089 ip6 = NULL; 1090 #endif 1091 g_path = NULL; 1092 jfp_out = NULL; 1093 jfd_out = -1; 1094 prison_hold(mypr); 1095 /* 1096 * Check all the parameters before committing to anything. Not all 1097 * errors can be caught early, but we may as well try. Also, this 1098 * takes care of some expensive stuff (path lookup) before getting 1099 * the allprison lock. 1100 * 1101 * XXX Jails are not filesystems, and jail parameters are not mount 1102 * options. But it makes more sense to re-use the vfsopt code 1103 * than duplicate it under a different name. 1104 */ 1105 error = vfs_buildopts(optuio, &opts); 1106 if (error) { 1107 opts = NULL; 1108 goto done_free; 1109 } 1110 1111 cuflags = flags & (JAIL_CREATE | JAIL_UPDATE); 1112 if (!cuflags) { 1113 error = EINVAL; 1114 vfs_opterror(opts, "no valid operation (create or update)"); 1115 goto done_errmsg; 1116 } 1117 1118 error = vfs_copyopt(opts, JAIL_PARAM_DESC, &jfd_in, sizeof(jfd_in)); 1119 if (error == ENOENT) { 1120 if (flags & (JAIL_USE_DESC | JAIL_AT_DESC | JAIL_GET_DESC | 1121 JAIL_OWN_DESC)) { 1122 vfs_opterror(opts, "missing desc"); 1123 goto done_errmsg; 1124 } 1125 jfd_in = -1; 1126 } else if (error != 0) 1127 goto done_free; 1128 else { 1129 if (!(flags & (JAIL_USE_DESC | JAIL_AT_DESC | JAIL_GET_DESC | 1130 JAIL_OWN_DESC))) { 1131 error = EINVAL; 1132 vfs_opterror(opts, "unexpected desc"); 1133 goto done_errmsg; 1134 } 1135 if (flags & JAIL_AT_DESC) { 1136 /* 1137 * Look up and create jails based on the 1138 * descriptor's prison. 1139 */ 1140 struct prison *jdpr; 1141 1142 error = jaildesc_find(td, jfd_in, &jdpr, NULL); 1143 if (error != 0) { 1144 vfs_opterror(opts, error == ENOENT ? 1145 "descriptor to dead jail" : 1146 "not a jail descriptor"); 1147 goto done_errmsg; 1148 } 1149 prison_free(mypr); 1150 mypr = jdpr; 1151 if ((flags & JAIL_CREATE) && mypr->pr_childmax == 0) { 1152 error = EPERM; 1153 goto done_free; 1154 } 1155 } 1156 if (flags & (JAIL_GET_DESC | JAIL_OWN_DESC)) { 1157 /* Allocate a jail descriptor to return later. */ 1158 error = jaildesc_alloc(td, &jfp_out, &jfd_out, 1159 flags & JAIL_OWN_DESC); 1160 if (error) 1161 goto done_free; 1162 } 1163 } 1164 1165 /* 1166 * Delay the permission check if using a jail descriptor, 1167 * until we get the descriptor's credentials. 1168 */ 1169 if (!(flags & JAIL_USE_DESC)) { 1170 error = priv_check(td, PRIV_JAIL_SET); 1171 if (error == 0 && (flags & JAIL_ATTACH)) 1172 error = priv_check(td, PRIV_JAIL_ATTACH); 1173 if (error) 1174 goto done_free; 1175 } 1176 1177 error = vfs_copyopt(opts, JAIL_PARAM_JID, &jid, sizeof(jid)); 1178 if (error == ENOENT) 1179 jid = 0; 1180 else if (error != 0) 1181 goto done_free; 1182 1183 error = vfs_copyopt(opts, JAIL_PARAM_SECURELEVEL, &slevel, sizeof(slevel)); 1184 if (error == ENOENT) 1185 gotslevel = 0; 1186 else if (error != 0) 1187 goto done_free; 1188 else 1189 gotslevel = 1; 1190 1191 error = 1192 vfs_copyopt(opts, JAIL_PARAM_CHILDREN_MAX, &childmax, sizeof(childmax)); 1193 if (error == ENOENT) 1194 gotchildmax = 0; 1195 else if (error != 0) 1196 goto done_free; 1197 else 1198 gotchildmax = 1; 1199 1200 error = vfs_copyopt(opts, JAIL_PARAM_ENFORCE_STATFS, &enforce, 1201 sizeof(enforce)); 1202 if (error == ENOENT) 1203 gotenforce = 0; 1204 else if (error != 0) 1205 goto done_free; 1206 else if (enforce < 0 || enforce > 2) { 1207 error = EINVAL; 1208 goto done_free; 1209 } else 1210 gotenforce = 1; 1211 1212 error = vfs_copyopt(opts, JAIL_PARAM_DEVFS_RULESET, &rsnum, sizeof(rsnum)); 1213 if (error == ENOENT) 1214 gotrsnum = 0; 1215 else if (error != 0) 1216 goto done_free; 1217 else 1218 gotrsnum = 1; 1219 1220 pr_flags = ch_flags = 0; 1221 for (bf = pr_flag_bool; 1222 bf < pr_flag_bool + nitems(pr_flag_bool); 1223 bf++) { 1224 vfs_flagopt(opts, bf->name, &pr_flags, bf->flag); 1225 vfs_flagopt(opts, bf->noname, &ch_flags, bf->flag); 1226 } 1227 ch_flags |= pr_flags; 1228 for (jsf = pr_flag_jailsys; 1229 jsf < pr_flag_jailsys + nitems(pr_flag_jailsys); 1230 jsf++) { 1231 error = vfs_copyopt(opts, jsf->name, &jsys, sizeof(jsys)); 1232 if (error == ENOENT) 1233 continue; 1234 if (error != 0) 1235 goto done_free; 1236 switch (jsys) { 1237 case JAIL_SYS_DISABLE: 1238 if (!jsf->disable) { 1239 error = EINVAL; 1240 goto done_free; 1241 } 1242 pr_flags |= jsf->disable; 1243 break; 1244 case JAIL_SYS_NEW: 1245 pr_flags |= jsf->new; 1246 break; 1247 case JAIL_SYS_INHERIT: 1248 break; 1249 default: 1250 error = EINVAL; 1251 goto done_free; 1252 } 1253 ch_flags |= jsf->new | jsf->disable; 1254 } 1255 if ((flags & (JAIL_CREATE | JAIL_ATTACH)) == JAIL_CREATE 1256 && !(pr_flags & PR_PERSIST)) { 1257 error = EINVAL; 1258 vfs_opterror(opts, "new jail must persist or attach"); 1259 goto done_errmsg; 1260 } 1261 #ifdef VIMAGE 1262 if ((flags & JAIL_UPDATE) && (ch_flags & PR_VNET)) { 1263 error = EINVAL; 1264 vfs_opterror(opts, "vnet cannot be changed after creation"); 1265 goto done_errmsg; 1266 } 1267 #endif 1268 #ifdef INET 1269 if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP4_USER)) { 1270 error = EINVAL; 1271 vfs_opterror(opts, "ip4 cannot be changed after creation"); 1272 goto done_errmsg; 1273 } 1274 #endif 1275 #ifdef INET6 1276 if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP6_USER)) { 1277 error = EINVAL; 1278 vfs_opterror(opts, "ip6 cannot be changed after creation"); 1279 goto done_errmsg; 1280 } 1281 #endif 1282 1283 pr_allow = ch_allow = 0; 1284 for (bf = pr_flag_allow; 1285 bf < pr_flag_allow + nitems(pr_flag_allow) && 1286 atomic_load_int(&bf->flag) != 0; 1287 bf++) { 1288 vfs_flagopt(opts, bf->name, &pr_allow, bf->flag); 1289 vfs_flagopt(opts, bf->noname, &ch_allow, bf->flag); 1290 } 1291 ch_allow |= pr_allow; 1292 1293 error = vfs_getopt(opts, JAIL_PARAM_NAME, (void **)&name, &len); 1294 if (error == ENOENT) 1295 name = NULL; 1296 else if (error != 0) 1297 goto done_free; 1298 else { 1299 if (len == 0 || name[len - 1] != '\0') { 1300 error = EINVAL; 1301 goto done_free; 1302 } 1303 if (len > MAXHOSTNAMELEN) { 1304 error = ENAMETOOLONG; 1305 goto done_free; 1306 } 1307 } 1308 1309 error = vfs_getopt(opts, JAIL_PARAM_HOST_HOSTNAME, (void **)&host, &len); 1310 if (error == ENOENT) 1311 host = NULL; 1312 else if (error != 0) 1313 goto done_free; 1314 else { 1315 ch_flags |= PR_HOST; 1316 pr_flags |= PR_HOST; 1317 if (len == 0 || host[len - 1] != '\0') { 1318 error = EINVAL; 1319 goto done_free; 1320 } 1321 if (len > MAXHOSTNAMELEN) { 1322 error = ENAMETOOLONG; 1323 goto done_free; 1324 } 1325 } 1326 1327 error = vfs_getopt(opts, JAIL_PARAM_HOST_DOMAINNAME, (void **)&domain, &len); 1328 if (error == ENOENT) 1329 domain = NULL; 1330 else if (error != 0) 1331 goto done_free; 1332 else { 1333 ch_flags |= PR_HOST; 1334 pr_flags |= PR_HOST; 1335 if (len == 0 || domain[len - 1] != '\0') { 1336 error = EINVAL; 1337 goto done_free; 1338 } 1339 if (len > MAXHOSTNAMELEN) { 1340 error = ENAMETOOLONG; 1341 goto done_free; 1342 } 1343 } 1344 1345 error = vfs_getopt(opts, JAIL_PARAM_HOST_HOSTUUID, (void **)&uuid, &len); 1346 if (error == ENOENT) 1347 uuid = NULL; 1348 else if (error != 0) 1349 goto done_free; 1350 else { 1351 ch_flags |= PR_HOST; 1352 pr_flags |= PR_HOST; 1353 if (len == 0 || uuid[len - 1] != '\0') { 1354 error = EINVAL; 1355 goto done_free; 1356 } 1357 if (len > HOSTUUIDLEN) { 1358 error = ENAMETOOLONG; 1359 goto done_free; 1360 } 1361 } 1362 1363 #ifdef COMPAT_FREEBSD32 1364 if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) { 1365 uint32_t hid32; 1366 1367 error = vfs_copyopt(opts, JAIL_PARAM_HOST_HOSTID, &hid32, sizeof(hid32)); 1368 hid = hid32; 1369 } else 1370 #endif 1371 error = vfs_copyopt(opts, JAIL_PARAM_HOST_HOSTID, &hid, sizeof(hid)); 1372 if (error == ENOENT) 1373 gothid = 0; 1374 else if (error != 0) 1375 goto done_free; 1376 else { 1377 gothid = 1; 1378 ch_flags |= PR_HOST; 1379 pr_flags |= PR_HOST; 1380 } 1381 1382 #ifdef MAC 1383 /* Process the mac.label vfsopt */ 1384 error = mac_set_prison_prepare(td, opts, &mac_set_prison_data); 1385 if (error == ENOENT) 1386 gotmaclabel = 0; 1387 else if (error != 0) 1388 goto done_errmsg; 1389 else 1390 gotmaclabel = 1; 1391 #endif 1392 1393 #ifdef INET 1394 error = vfs_getopt(opts, JAIL_PARAM_IP4_ADDR, &op, &ip4s); 1395 if (error == ENOENT) 1396 ip4s = 0; 1397 else if (error != 0) 1398 goto done_free; 1399 else if (ip4s & (sizeof(struct in_addr) - 1)) { 1400 error = EINVAL; 1401 goto done_free; 1402 } else { 1403 ch_flags |= PR_IP4_USER; 1404 pr_flags |= PR_IP4_USER; 1405 if (ip4s > 0) { 1406 ip4s /= sizeof(struct in_addr); 1407 if (ip4s > jail_max_af_ips) { 1408 error = EINVAL; 1409 vfs_opterror(opts, "too many IPv4 addresses"); 1410 goto done_errmsg; 1411 } 1412 ip4 = prison_ip_copyin(PR_INET, op, ip4s); 1413 if (ip4 == NULL) { 1414 error = EINVAL; 1415 goto done_free; 1416 } 1417 } 1418 } 1419 #endif 1420 1421 #ifdef INET6 1422 error = vfs_getopt(opts, JAIL_PARAM_IP6_ADDR, &op, &ip6s); 1423 if (error == ENOENT) 1424 ip6s = 0; 1425 else if (error != 0) 1426 goto done_free; 1427 else if (ip6s & (sizeof(struct in6_addr) - 1)) { 1428 error = EINVAL; 1429 goto done_free; 1430 } else { 1431 ch_flags |= PR_IP6_USER; 1432 pr_flags |= PR_IP6_USER; 1433 if (ip6s > 0) { 1434 ip6s /= sizeof(struct in6_addr); 1435 if (ip6s > jail_max_af_ips) { 1436 error = EINVAL; 1437 vfs_opterror(opts, "too many IPv6 addresses"); 1438 goto done_errmsg; 1439 } 1440 ip6 = prison_ip_copyin(PR_INET6, op, ip6s); 1441 if (ip6 == NULL) { 1442 error = EINVAL; 1443 goto done_free; 1444 } 1445 } 1446 } 1447 #endif 1448 1449 #if defined(VIMAGE) && (defined(INET) || defined(INET6)) 1450 if ((ch_flags & PR_VNET) && (ch_flags & (PR_IP4_USER | PR_IP6_USER))) { 1451 error = EINVAL; 1452 vfs_opterror(opts, 1453 "vnet jails cannot have IP address restrictions"); 1454 goto done_errmsg; 1455 } 1456 #endif 1457 1458 error = vfs_getopt(opts, JAIL_PARAM_OSRELEASE, (void **)&osrelstr, &len); 1459 if (error == ENOENT) 1460 osrelstr = NULL; 1461 else if (error != 0) 1462 goto done_free; 1463 else { 1464 if (flags & JAIL_UPDATE) { 1465 error = EINVAL; 1466 vfs_opterror(opts, 1467 "osrelease cannot be changed after creation"); 1468 goto done_errmsg; 1469 } 1470 if (len == 0 || osrelstr[len - 1] != '\0') { 1471 error = EINVAL; 1472 goto done_free; 1473 } 1474 if (len >= OSRELEASELEN) { 1475 error = ENAMETOOLONG; 1476 vfs_opterror(opts, 1477 "osrelease string must be 1-%d bytes long", 1478 OSRELEASELEN - 1); 1479 goto done_errmsg; 1480 } 1481 } 1482 1483 error = vfs_copyopt(opts, JAIL_PARAM_OSRELDATE, &osreldt, sizeof(osreldt)); 1484 if (error == ENOENT) 1485 osreldt = 0; 1486 else if (error != 0) 1487 goto done_free; 1488 else { 1489 if (flags & JAIL_UPDATE) { 1490 error = EINVAL; 1491 vfs_opterror(opts, 1492 "osreldate cannot be changed after creation"); 1493 goto done_errmsg; 1494 } 1495 if (osreldt == 0) { 1496 error = EINVAL; 1497 vfs_opterror(opts, "osreldate cannot be 0"); 1498 goto done_errmsg; 1499 } 1500 } 1501 1502 root = NULL; 1503 error = vfs_getopt(opts, JAIL_PARAM_PATH, (void **)&path, &len); 1504 if (error == ENOENT) 1505 path = NULL; 1506 else if (error != 0) 1507 goto done_free; 1508 else { 1509 if (flags & JAIL_UPDATE) { 1510 error = EINVAL; 1511 vfs_opterror(opts, 1512 "path cannot be changed after creation"); 1513 goto done_errmsg; 1514 } 1515 if (len == 0 || path[len - 1] != '\0') { 1516 error = EINVAL; 1517 goto done_free; 1518 } 1519 NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE, path); 1520 error = namei(&nd); 1521 if (error) 1522 goto done_free; 1523 root = nd.ni_vp; 1524 NDFREE_PNBUF(&nd); 1525 g_path = malloc(MAXPATHLEN, M_TEMP, M_WAITOK); 1526 strlcpy(g_path, path, MAXPATHLEN); 1527 error = vn_path_to_global_path(td, root, g_path, MAXPATHLEN); 1528 if (error == 0) { 1529 path = g_path; 1530 } else { 1531 /* exit on other errors */ 1532 goto done_free; 1533 } 1534 if (root->v_type != VDIR) { 1535 error = ENOTDIR; 1536 vput(root); 1537 goto done_free; 1538 } 1539 VOP_UNLOCK(root); 1540 } 1541 1542 /* 1543 * Find the specified jail, or at least its parent. 1544 * This abuses the file error codes ENOENT and EEXIST. 1545 */ 1546 pr = NULL; 1547 inspr = NULL; 1548 deadpr = NULL; 1549 maybe_changed = false; 1550 if (cuflags == JAIL_CREATE && jid == 0 && name != NULL) { 1551 namelc = strrchr(name, '.'); 1552 jid = strtoul(namelc != NULL ? namelc + 1 : name, &p, 10); 1553 if (*p != '\0') 1554 jid = 0; 1555 } 1556 sx_xlock(&allprison_lock); 1557 drflags = PD_LIST_XLOCKED; 1558 ppr = mypr; 1559 if (!prison_isalive(ppr)) { 1560 /* This jail is dying. This process will surely follow. */ 1561 error = EAGAIN; 1562 goto done_deref; 1563 } 1564 if (flags & JAIL_USE_DESC) { 1565 /* Get the jail from its descriptor. */ 1566 error = jaildesc_find(td, jfd_in, &pr, &jdcred); 1567 if (error) { 1568 vfs_opterror(opts, error == ENOENT ? 1569 "descriptor to dead jail" : 1570 "not a jail descriptor"); 1571 goto done_deref; 1572 } 1573 drflags |= PD_DEREF; 1574 error = priv_check_cred(jdcred, PRIV_JAIL_SET); 1575 if (error == 0 && (flags & JAIL_ATTACH)) 1576 error = priv_check_cred(jdcred, PRIV_JAIL_ATTACH); 1577 crfree(jdcred); 1578 if (error) 1579 goto done_deref; 1580 mtx_lock(&pr->pr_mtx); 1581 drflags |= PD_LOCKED; 1582 if (cuflags == JAIL_CREATE) { 1583 error = EEXIST; 1584 vfs_opterror(opts, "jail %d already exists", 1585 pr->pr_id); 1586 goto done_deref; 1587 } 1588 if (!prison_isalive(pr)) { 1589 /* While a jid can be resurrected, the prison 1590 * itself cannot. 1591 */ 1592 error = ENOENT; 1593 vfs_opterror(opts, "jail %d is dying", pr->pr_id); 1594 goto done_deref; 1595 } 1596 if (jid != 0 && jid != pr->pr_id) { 1597 error = EINVAL; 1598 vfs_opterror(opts, "cannot change jid"); 1599 goto done_deref; 1600 } 1601 jid = pr->pr_id; 1602 } else if (jid != 0) { 1603 if (jid < 0) { 1604 error = EINVAL; 1605 vfs_opterror(opts, "negative jid"); 1606 goto done_deref; 1607 } 1608 /* 1609 * See if a requested jid already exists. Keep track of 1610 * where it can be inserted later. 1611 */ 1612 TAILQ_FOREACH(inspr, &allprison, pr_list) { 1613 if (inspr->pr_id < jid) 1614 continue; 1615 if (inspr->pr_id > jid) 1616 break; 1617 if (prison_isalive(inspr)) { 1618 pr = inspr; 1619 mtx_lock(&pr->pr_mtx); 1620 drflags |= PD_LOCKED; 1621 } else { 1622 /* Note a dying jail to handle later. */ 1623 deadpr = inspr; 1624 } 1625 inspr = NULL; 1626 break; 1627 } 1628 if (cuflags == JAIL_CREATE && pr != NULL) { 1629 /* 1630 * Even creators that cannot see the jail will 1631 * get EEXIST. 1632 */ 1633 error = EEXIST; 1634 vfs_opterror(opts, "jail %d already exists", jid); 1635 goto done_deref; 1636 } 1637 if ((pr == NULL) 1638 ? cuflags == JAIL_UPDATE 1639 : !prison_ischild(mypr, pr)) { 1640 /* 1641 * Updaters get ENOENT for nonexistent jails, 1642 * or for jails they cannot see. The latter 1643 * case is true even for CREATE | UPDATE, 1644 * which normally cannot give this error. 1645 */ 1646 error = ENOENT; 1647 vfs_opterror(opts, "jail %d not found", jid); 1648 goto done_deref; 1649 } 1650 } 1651 /* 1652 * If the caller provided a name, look for a jail by that name. 1653 * This has different semantics for creates and updates keyed by jid 1654 * (where the name must not already exist in a different jail), 1655 * and updates keyed by the name itself (where the name must exist 1656 * because that is the jail being updated). 1657 */ 1658 namelc = NULL; 1659 if (name != NULL) { 1660 namelc = strrchr(name, '.'); 1661 if (namelc == NULL) 1662 namelc = name; 1663 else { 1664 /* 1665 * This is a hierarchical name. Split it into the 1666 * parent and child names, and make sure the parent 1667 * exists or matches an already found jail. 1668 */ 1669 if (pr != NULL) { 1670 if (strncmp(name, ppr->pr_name, namelc - name) 1671 || ppr->pr_name[namelc - name] != '\0') { 1672 error = EINVAL; 1673 vfs_opterror(opts, 1674 "cannot change jail's parent"); 1675 goto done_deref; 1676 } 1677 } else { 1678 *namelc = '\0'; 1679 ppr = prison_find_name(mypr, name); 1680 if (ppr == NULL) { 1681 error = ENOENT; 1682 vfs_opterror(opts, 1683 "jail \"%s\" not found", name); 1684 goto done_deref; 1685 } 1686 mtx_unlock(&ppr->pr_mtx); 1687 if (!prison_isalive(ppr)) { 1688 error = ENOENT; 1689 vfs_opterror(opts, 1690 "jail \"%s\" is dying", name); 1691 goto done_deref; 1692 } 1693 *namelc = '.'; 1694 } 1695 namelc++; 1696 } 1697 if (namelc[0] != '\0') { 1698 pnamelen = 1699 (ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1; 1700 FOREACH_PRISON_CHILD(ppr, tpr) { 1701 if (tpr == pr || !prison_isalive(tpr) || 1702 strcmp(tpr->pr_name + pnamelen, namelc)) 1703 continue; 1704 if (cuflags == JAIL_CREATE || pr != NULL) { 1705 /* 1706 * Create, or update(jid): name must 1707 * not exist in an active sibling jail. 1708 */ 1709 error = EEXIST; 1710 vfs_opterror(opts, 1711 "jail \"%s\" already exists", name); 1712 goto done_deref; 1713 } 1714 /* Use this jail for updates. */ 1715 pr = tpr; 1716 mtx_lock(&pr->pr_mtx); 1717 drflags |= PD_LOCKED; 1718 break; 1719 } 1720 /* 1721 * Update: name must exist if no jid is specified. 1722 * As with the jid case, the jail must be currently 1723 * visible, or else even CREATE | UPDATE will get 1724 * an error. 1725 */ 1726 if ((pr == NULL) 1727 ? cuflags == JAIL_UPDATE 1728 : !prison_isalive(pr)) { 1729 error = ENOENT; 1730 vfs_opterror(opts, "jail \"%s\" not found", 1731 name); 1732 goto done_deref; 1733 } 1734 } 1735 } 1736 /* Update: must provide a desc, jid, or name. */ 1737 else if (cuflags == JAIL_UPDATE && pr == NULL) { 1738 error = ENOENT; 1739 vfs_opterror(opts, "update specified no jail"); 1740 goto done_deref; 1741 } 1742 1743 /* If there's no prison to update, create a new one and link it in. */ 1744 created = pr == NULL; 1745 if (created) { 1746 #ifdef MAC 1747 error = mac_prison_check_create(td->td_ucred, opts, flags); 1748 if (error != 0) 1749 goto done_deref; 1750 #endif 1751 for (tpr = mypr; tpr != NULL; tpr = tpr->pr_parent) 1752 if (tpr->pr_childcount >= tpr->pr_childmax) { 1753 error = EPERM; 1754 vfs_opterror(opts, "prison limit exceeded"); 1755 goto done_deref; 1756 } 1757 1758 if (deadpr != NULL) { 1759 /* 1760 * The prison being created has the same ID as a dying 1761 * one. Handle this by giving the dying jail a new ID. 1762 * This may cause some confusion to user space, but 1763 * only to those listing dying jails. 1764 */ 1765 deadid = get_next_deadid(&dinspr); 1766 if (deadid == 0) { 1767 error = EAGAIN; 1768 vfs_opterror(opts, "no available jail IDs"); 1769 goto done_deref; 1770 } 1771 mtx_lock(&deadpr->pr_mtx); 1772 deadpr->pr_id = deadid; 1773 mtx_unlock(&deadpr->pr_mtx); 1774 if (dinspr == deadpr) 1775 inspr = deadpr; 1776 else { 1777 inspr = TAILQ_NEXT(deadpr, pr_list); 1778 TAILQ_REMOVE(&allprison, deadpr, pr_list); 1779 if (dinspr != NULL) 1780 TAILQ_INSERT_AFTER(&allprison, dinspr, 1781 deadpr, pr_list); 1782 else 1783 TAILQ_INSERT_HEAD(&allprison, deadpr, 1784 pr_list); 1785 } 1786 } 1787 if (jid == 0 && (jid = get_next_prid(&inspr)) == 0) { 1788 error = EAGAIN; 1789 vfs_opterror(opts, "no available jail IDs"); 1790 goto done_deref; 1791 } 1792 1793 pr = malloc(sizeof(*pr), M_PRISON, M_WAITOK | M_ZERO); 1794 pr->pr_state = PRISON_STATE_INVALID; 1795 refcount_init(&pr->pr_ref, 1); 1796 refcount_init(&pr->pr_uref, 0); 1797 drflags |= PD_DEREF; 1798 LIST_INIT(&pr->pr_children); 1799 mtx_init(&pr->pr_mtx, "jail mutex", NULL, MTX_DEF | MTX_DUPOK); 1800 TASK_INIT(&pr->pr_task, 0, prison_complete, pr); 1801 1802 pr->pr_id = jid; 1803 if (inspr != NULL) 1804 TAILQ_INSERT_BEFORE(inspr, pr, pr_list); 1805 else 1806 TAILQ_INSERT_TAIL(&allprison, pr, pr_list); 1807 1808 pr->pr_parent = ppr; 1809 prison_hold(ppr); 1810 prison_proc_hold(ppr); 1811 LIST_INSERT_HEAD(&ppr->pr_children, pr, pr_sibling); 1812 for (tpr = ppr; tpr != NULL; tpr = tpr->pr_parent) 1813 tpr->pr_childcount++; 1814 pr->pr_klist = knlist_alloc(&pr->pr_mtx); 1815 1816 /* Set some default values, and inherit some from the parent. */ 1817 if (namelc == NULL) 1818 namelc = ""; 1819 if (path == NULL) { 1820 path = "/"; 1821 root = ppr->pr_root; 1822 vref(root); 1823 } 1824 strlcpy(pr->pr_hostuuid, DEFAULT_HOSTUUID, HOSTUUIDLEN); 1825 pr->pr_flags |= PR_HOST; 1826 #if defined(INET) || defined(INET6) 1827 #ifdef VIMAGE 1828 if (!(pr_flags & PR_VNET)) 1829 #endif 1830 { 1831 #ifdef INET 1832 if (!(ch_flags & PR_IP4_USER)) 1833 pr->pr_flags |= PR_IP4 | PR_IP4_USER; 1834 else if (!(pr_flags & PR_IP4_USER)) { 1835 pr->pr_flags |= ppr->pr_flags & PR_IP4; 1836 prison_ip_dup(ppr, pr, PR_INET); 1837 } 1838 #endif 1839 #ifdef INET6 1840 if (!(ch_flags & PR_IP6_USER)) 1841 pr->pr_flags |= PR_IP6 | PR_IP6_USER; 1842 else if (!(pr_flags & PR_IP6_USER)) { 1843 pr->pr_flags |= ppr->pr_flags & PR_IP6; 1844 prison_ip_dup(ppr, pr, PR_INET6); 1845 } 1846 #endif 1847 } 1848 #endif 1849 /* Source address selection is always on by default. */ 1850 pr->pr_flags |= _PR_IP_SADDRSEL; 1851 1852 pr->pr_securelevel = ppr->pr_securelevel; 1853 pr->pr_allow = JAIL_DEFAULT_ALLOW & ppr->pr_allow; 1854 pr->pr_enforce_statfs = jail_default_enforce_statfs; 1855 pr->pr_devfs_rsnum = ppr->pr_devfs_rsnum; 1856 1857 pr->pr_osreldate = osreldt ? osreldt : ppr->pr_osreldate; 1858 if (osrelstr == NULL) 1859 strlcpy(pr->pr_osrelease, ppr->pr_osrelease, 1860 sizeof(pr->pr_osrelease)); 1861 else 1862 strlcpy(pr->pr_osrelease, osrelstr, 1863 sizeof(pr->pr_osrelease)); 1864 1865 #ifdef VIMAGE 1866 /* 1867 * Allocate a new vnet if specified. 1868 * 1869 * Set PR_VNET now if so, so that the vnet is disposed of 1870 * properly when the jail is destroyed. 1871 */ 1872 if (pr_flags & PR_VNET) { 1873 pr->pr_flags |= PR_VNET; 1874 pr->pr_vnet = vnet_alloc(); 1875 } else { 1876 pr->pr_vnet = ppr->pr_vnet; 1877 } 1878 #endif 1879 /* 1880 * Allocate a dedicated cpuset for each jail. 1881 * Unlike other initial settings, this may return an error. 1882 */ 1883 error = cpuset_create_root(ppr, &pr->pr_cpuset); 1884 if (error) 1885 goto done_deref; 1886 1887 #ifdef MAC 1888 error = mac_prison_init(pr, M_WAITOK); 1889 MPASS(error == 0); 1890 1891 mtx_assert(&pr->pr_mtx, MA_OWNED); 1892 #else 1893 mtx_lock(&pr->pr_mtx); 1894 #endif 1895 drflags |= PD_LOCKED; 1896 } else { 1897 /* 1898 * Grab a reference for existing prisons, to ensure they 1899 * continue to exist for the duration of the call. 1900 */ 1901 if (!(drflags & PD_DEREF)) { 1902 prison_hold(pr); 1903 drflags |= PD_DEREF; 1904 } 1905 #ifdef MAC 1906 error = mac_prison_check_set(td->td_ucred, pr, opts, flags); 1907 if (error != 0) 1908 goto done_deref; 1909 #endif 1910 #if defined(VIMAGE) && (defined(INET) || defined(INET6)) 1911 if ((pr->pr_flags & PR_VNET) && 1912 (ch_flags & (PR_IP4_USER | PR_IP6_USER))) { 1913 error = EINVAL; 1914 vfs_opterror(opts, 1915 "vnet jails cannot have IP address restrictions"); 1916 goto done_deref; 1917 } 1918 #endif 1919 #ifdef INET 1920 if (PR_IP4_USER & ch_flags & (pr_flags ^ pr->pr_flags)) { 1921 error = EINVAL; 1922 vfs_opterror(opts, 1923 "ip4 cannot be changed after creation"); 1924 goto done_deref; 1925 } 1926 #endif 1927 #ifdef INET6 1928 if (PR_IP6_USER & ch_flags & (pr_flags ^ pr->pr_flags)) { 1929 error = EINVAL; 1930 vfs_opterror(opts, 1931 "ip6 cannot be changed after creation"); 1932 goto done_deref; 1933 } 1934 #endif 1935 } 1936 1937 /* Do final error checking before setting anything. */ 1938 if (gotslevel) { 1939 if (slevel < ppr->pr_securelevel) { 1940 error = EPERM; 1941 goto done_deref; 1942 } 1943 } 1944 if (gotchildmax) { 1945 if (childmax >= ppr->pr_childmax) { 1946 error = EPERM; 1947 goto done_deref; 1948 } 1949 } 1950 if (gotenforce) { 1951 if (enforce < ppr->pr_enforce_statfs) { 1952 error = EPERM; 1953 goto done_deref; 1954 } 1955 } 1956 if (gotrsnum) { 1957 /* 1958 * devfs_rsnum is a uint16_t 1959 */ 1960 if (rsnum < 0 || rsnum > 65535) { 1961 error = EINVAL; 1962 goto done_deref; 1963 } 1964 /* 1965 * Nested jails always inherit parent's devfs ruleset 1966 */ 1967 if (jailed(td->td_ucred)) { 1968 if (rsnum > 0 && rsnum != ppr->pr_devfs_rsnum) { 1969 error = EPERM; 1970 goto done_deref; 1971 } else 1972 rsnum = ppr->pr_devfs_rsnum; 1973 } 1974 } 1975 #ifdef INET 1976 if (ip4s > 0) { 1977 if ((ppr->pr_flags & PR_IP4) && 1978 !prison_ip_parent_match(ppr->pr_addrs[PR_INET], ip4, 1979 PR_INET)) { 1980 error = EPERM; 1981 goto done_deref; 1982 } 1983 if (!prison_ip_conflict_check(ppr, pr, ip4, PR_INET)) { 1984 error = EADDRINUSE; 1985 vfs_opterror(opts, "IPv4 addresses clash"); 1986 goto done_deref; 1987 } 1988 } 1989 #endif 1990 #ifdef INET6 1991 if (ip6s > 0) { 1992 if ((ppr->pr_flags & PR_IP6) && 1993 !prison_ip_parent_match(ppr->pr_addrs[PR_INET6], ip6, 1994 PR_INET6)) { 1995 error = EPERM; 1996 goto done_deref; 1997 } 1998 if (!prison_ip_conflict_check(ppr, pr, ip6, PR_INET6)) { 1999 error = EADDRINUSE; 2000 vfs_opterror(opts, "IPv6 addresses clash"); 2001 goto done_deref; 2002 } 2003 } 2004 #endif 2005 onamelen = namelen = 0; 2006 if (namelc != NULL) { 2007 /* Give a default name of the jid. Also allow the name to be 2008 * explicitly the jid - but not any other number, and only in 2009 * normal form (no leading zero/etc). 2010 */ 2011 if (namelc[0] == '\0') 2012 snprintf(namelc = numbuf, sizeof(numbuf), "%d", jid); 2013 else if ((strtoul(namelc, &p, 10) != jid || 2014 namelc[0] < '1' || namelc[0] > '9') && *p == '\0') { 2015 error = EINVAL; 2016 vfs_opterror(opts, 2017 "name cannot be numeric (unless it is the jid)"); 2018 goto done_deref; 2019 } 2020 /* 2021 * Make sure the name isn't too long for the prison or its 2022 * children. 2023 */ 2024 pnamelen = (ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1; 2025 onamelen = strlen(pr->pr_name + pnamelen); 2026 namelen = strlen(namelc); 2027 if (pnamelen + namelen + 1 > sizeof(pr->pr_name)) { 2028 error = ENAMETOOLONG; 2029 goto done_deref; 2030 } 2031 FOREACH_PRISON_DESCENDANT(pr, tpr, descend) { 2032 if (strlen(tpr->pr_name) + (namelen - onamelen) >= 2033 sizeof(pr->pr_name)) { 2034 error = ENAMETOOLONG; 2035 goto done_deref; 2036 } 2037 } 2038 } 2039 pr_allow_diff = pr_allow & ~ppr->pr_allow; 2040 if (pr_allow_diff & ~PR_ALLOW_DIFFERENCES) { 2041 error = EPERM; 2042 goto done_deref; 2043 } 2044 2045 /* 2046 * Let modules check their parameters. This requires unlocking and 2047 * then re-locking the prison, but this is still a valid state as long 2048 * as allprison_lock remains xlocked. 2049 */ 2050 mtx_unlock(&pr->pr_mtx); 2051 drflags &= ~PD_LOCKED; 2052 error = osd_jail_call(pr, PR_METHOD_CHECK, opts); 2053 if (error != 0) 2054 goto done_deref; 2055 mtx_lock(&pr->pr_mtx); 2056 drflags |= PD_LOCKED; 2057 2058 /* At this point, all valid parameters should have been noted. */ 2059 TAILQ_FOREACH(opt, opts, link) { 2060 if (!opt->seen && strcmp(opt->name, "errmsg")) { 2061 error = EINVAL; 2062 vfs_opterror(opts, "unknown parameter: %s", opt->name); 2063 goto done_deref; 2064 } 2065 } 2066 maybe_changed = true; 2067 2068 /* Set the parameters of the prison. */ 2069 #ifdef INET 2070 redo_ip4 = false; 2071 if (pr_flags & PR_IP4_USER) { 2072 pr->pr_flags |= PR_IP4; 2073 prison_ip_set(pr, PR_INET, ip4); 2074 ip4 = NULL; 2075 FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 2076 #ifdef VIMAGE 2077 if (tpr->pr_flags & PR_VNET) { 2078 descend = 0; 2079 continue; 2080 } 2081 #endif 2082 if (!prison_ip_restrict(tpr, PR_INET, NULL)) { 2083 redo_ip4 = true; 2084 descend = 0; 2085 } 2086 } 2087 } 2088 #endif 2089 #ifdef INET6 2090 redo_ip6 = false; 2091 if (pr_flags & PR_IP6_USER) { 2092 pr->pr_flags |= PR_IP6; 2093 prison_ip_set(pr, PR_INET6, ip6); 2094 ip6 = NULL; 2095 FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 2096 #ifdef VIMAGE 2097 if (tpr->pr_flags & PR_VNET) { 2098 descend = 0; 2099 continue; 2100 } 2101 #endif 2102 if (!prison_ip_restrict(tpr, PR_INET6, NULL)) { 2103 redo_ip6 = true; 2104 descend = 0; 2105 } 2106 } 2107 } 2108 #endif 2109 if (gotslevel) { 2110 pr->pr_securelevel = slevel; 2111 /* Set all child jails to be at least this level. */ 2112 FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) 2113 if (tpr->pr_securelevel < slevel) 2114 tpr->pr_securelevel = slevel; 2115 } 2116 if (gotchildmax) { 2117 pr->pr_childmax = childmax; 2118 /* Set all child jails to under this limit. */ 2119 FOREACH_PRISON_DESCENDANT_LOCKED_LEVEL(pr, tpr, descend, level) 2120 if (tpr->pr_childmax > childmax - level) 2121 tpr->pr_childmax = childmax > level 2122 ? childmax - level : 0; 2123 } 2124 if (gotenforce) { 2125 pr->pr_enforce_statfs = enforce; 2126 /* Pass this restriction on to the children. */ 2127 FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) 2128 if (tpr->pr_enforce_statfs < enforce) 2129 tpr->pr_enforce_statfs = enforce; 2130 } 2131 if (gotrsnum) { 2132 pr->pr_devfs_rsnum = rsnum; 2133 /* Pass this restriction on to the children. */ 2134 FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) 2135 tpr->pr_devfs_rsnum = rsnum; 2136 } 2137 if (namelc != NULL) { 2138 if (ppr == &prison0) 2139 strlcpy(pr->pr_name, namelc, sizeof(pr->pr_name)); 2140 else 2141 snprintf(pr->pr_name, sizeof(pr->pr_name), "%s.%s", 2142 ppr->pr_name, namelc); 2143 /* Change this component of child names. */ 2144 FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 2145 bcopy(tpr->pr_name + onamelen, tpr->pr_name + namelen, 2146 strlen(tpr->pr_name + onamelen) + 1); 2147 bcopy(pr->pr_name, tpr->pr_name, namelen); 2148 } 2149 } 2150 if (path != NULL) { 2151 /* Try to keep a real-rooted full pathname. */ 2152 strlcpy(pr->pr_path, path, sizeof(pr->pr_path)); 2153 pr->pr_root = root; 2154 root = NULL; 2155 } 2156 if (PR_HOST & ch_flags & ~pr_flags) { 2157 if (pr->pr_flags & PR_HOST) { 2158 /* 2159 * Copy the parent's host info. As with pr_ip4 above, 2160 * the lack of a lock on the parent is not a problem; 2161 * it is always set with allprison_lock at least 2162 * shared, and is held exclusively here. 2163 */ 2164 strlcpy(pr->pr_hostname, pr->pr_parent->pr_hostname, 2165 sizeof(pr->pr_hostname)); 2166 strlcpy(pr->pr_domainname, pr->pr_parent->pr_domainname, 2167 sizeof(pr->pr_domainname)); 2168 strlcpy(pr->pr_hostuuid, pr->pr_parent->pr_hostuuid, 2169 sizeof(pr->pr_hostuuid)); 2170 pr->pr_hostid = pr->pr_parent->pr_hostid; 2171 } 2172 } else if (host != NULL || domain != NULL || uuid != NULL || gothid) { 2173 /* Set this prison, and any descendants without PR_HOST. */ 2174 if (host != NULL) 2175 strlcpy(pr->pr_hostname, host, sizeof(pr->pr_hostname)); 2176 if (domain != NULL) 2177 strlcpy(pr->pr_domainname, domain, 2178 sizeof(pr->pr_domainname)); 2179 if (uuid != NULL) 2180 strlcpy(pr->pr_hostuuid, uuid, sizeof(pr->pr_hostuuid)); 2181 if (gothid) 2182 pr->pr_hostid = hid; 2183 FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 2184 if (tpr->pr_flags & PR_HOST) 2185 descend = 0; 2186 else { 2187 if (host != NULL) 2188 strlcpy(tpr->pr_hostname, 2189 pr->pr_hostname, 2190 sizeof(tpr->pr_hostname)); 2191 if (domain != NULL) 2192 strlcpy(tpr->pr_domainname, 2193 pr->pr_domainname, 2194 sizeof(tpr->pr_domainname)); 2195 if (uuid != NULL) 2196 strlcpy(tpr->pr_hostuuid, 2197 pr->pr_hostuuid, 2198 sizeof(tpr->pr_hostuuid)); 2199 if (gothid) 2200 tpr->pr_hostid = hid; 2201 } 2202 } 2203 } 2204 pr->pr_allow = (pr->pr_allow & ~ch_allow) | pr_allow; 2205 if ((tallow = ch_allow & ~pr_allow)) 2206 prison_set_allow_locked(pr, tallow, 0); 2207 /* 2208 * Persistent prisons get an extra reference, and prisons losing their 2209 * persist flag lose that reference. 2210 */ 2211 if (ch_flags & PR_PERSIST & (pr_flags ^ pr->pr_flags)) { 2212 if (pr_flags & PR_PERSIST) { 2213 prison_hold(pr); 2214 /* 2215 * This may be a new prison's first user reference, 2216 * but wait to call it alive until after OSD calls 2217 * have had a chance to run (and perhaps to fail). 2218 */ 2219 refcount_acquire(&pr->pr_uref); 2220 } else { 2221 drflags |= PD_DEUREF; 2222 prison_free_not_last(pr); 2223 } 2224 } 2225 pr->pr_flags = (pr->pr_flags & ~ch_flags) | pr_flags; 2226 2227 #ifdef MAC 2228 /* Apply any request MAC label before we let modules do their work. */ 2229 if (gotmaclabel) { 2230 error = mac_set_prison_core(td, pr, mac_set_prison_data); 2231 if (error) { 2232 vfs_opterror(opts, "mac relabel denied"); 2233 goto done_deref; 2234 } 2235 } 2236 #endif 2237 mtx_unlock(&pr->pr_mtx); 2238 drflags &= ~PD_LOCKED; 2239 /* 2240 * Any errors past this point will need to de-persist newly created 2241 * prisons, as well as call remove methods. 2242 */ 2243 if (created) 2244 drflags |= PD_KILL; 2245 2246 #ifdef RACCT 2247 if (racct_enable && created) 2248 prison_racct_attach(pr); 2249 #endif 2250 2251 /* Locks may have prevented a complete restriction of child IP 2252 * addresses. If so, allocate some more memory and try again. 2253 */ 2254 #ifdef INET 2255 while (redo_ip4) { 2256 ip4s = pr->pr_addrs[PR_INET]->ips; 2257 MPASS(ip4 == NULL); 2258 ip4 = prison_ip_alloc(PR_INET, ip4s, M_WAITOK); 2259 mtx_lock(&pr->pr_mtx); 2260 redo_ip4 = false; 2261 FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 2262 #ifdef VIMAGE 2263 if (tpr->pr_flags & PR_VNET) { 2264 descend = 0; 2265 continue; 2266 } 2267 #endif 2268 if (!prison_ip_restrict(tpr, PR_INET, &ip4)) 2269 redo_ip4 = true; 2270 } 2271 mtx_unlock(&pr->pr_mtx); 2272 } 2273 #endif 2274 #ifdef INET6 2275 while (redo_ip6) { 2276 ip6s = pr->pr_addrs[PR_INET6]->ips; 2277 MPASS(ip6 == NULL); 2278 ip6 = prison_ip_alloc(PR_INET6, ip6s, M_WAITOK); 2279 mtx_lock(&pr->pr_mtx); 2280 redo_ip6 = false; 2281 FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 2282 #ifdef VIMAGE 2283 if (tpr->pr_flags & PR_VNET) { 2284 descend = 0; 2285 continue; 2286 } 2287 #endif 2288 if (!prison_ip_restrict(tpr, PR_INET6, &ip6)) 2289 redo_ip6 = true; 2290 } 2291 mtx_unlock(&pr->pr_mtx); 2292 } 2293 #endif 2294 2295 /* Let the modules do their work. */ 2296 if (created) { 2297 error = osd_jail_call(pr, PR_METHOD_CREATE, opts); 2298 if (error) 2299 goto done_deref; 2300 } 2301 error = osd_jail_call(pr, PR_METHOD_SET, opts); 2302 if (error) 2303 goto done_deref; 2304 2305 /* 2306 * A new prison is now ready to be seen; either it has gained a user 2307 * reference via persistence, or is about to gain one via attachment. 2308 */ 2309 if (created) { 2310 sx_assert(&allprison_lock, SX_XLOCKED); 2311 prison_knote(ppr, NOTE_JAIL_CHILD | pr->pr_id); 2312 #ifdef MAC 2313 /* 2314 * Note that mac_prison_created() assumes that it's called in a 2315 * sleepable context. 2316 */ 2317 mac_prison_created(td->td_ucred, pr); 2318 #endif 2319 mtx_lock(&pr->pr_mtx); 2320 drflags |= PD_LOCKED; 2321 pr->pr_state = PRISON_STATE_ALIVE; 2322 } 2323 2324 /* 2325 * Attach this process to the prison if requested. This will 2326 * unlock allprison_lock, meaning changes are now user-visible. 2327 */ 2328 if (flags & JAIL_ATTACH) { 2329 #ifdef MAC 2330 error = mac_prison_check_attach(td->td_ucred, pr); 2331 if (error != 0) { 2332 vfs_opterror(opts, 2333 "attach operation denied by MAC policy"); 2334 goto done_deref; 2335 } 2336 #endif 2337 error = do_jail_attach(td, pr, &drflags); 2338 if (error) { 2339 vfs_opterror(opts, "attach failed"); 2340 goto done_deref; 2341 } 2342 } 2343 2344 #ifdef RACCT 2345 if (racct_enable && !created) { 2346 if (drflags & PD_LOCKED) { 2347 mtx_unlock(&pr->pr_mtx); 2348 drflags &= ~PD_LOCKED; 2349 } 2350 if (drflags & PD_LIST_XLOCKED) { 2351 sx_xunlock(&allprison_lock); 2352 drflags &= ~PD_LIST_XLOCKED; 2353 } 2354 prison_racct_modify(pr); 2355 } 2356 #endif 2357 2358 if (created && pr != &prison0 && (pr->pr_allow & PR_ALLOW_NFSD) != 0 && 2359 (pr->pr_root->v_vflag & VV_ROOT) == 0) 2360 printf("Warning jail jid=%d: mountd/nfsd requires a separate" 2361 " file system\n", pr->pr_id); 2362 2363 /* 2364 * Now that the prison is fully created without error, set the 2365 * jail descriptor if one was requested. This is the only 2366 * parameter that is returned to the caller (except the error 2367 * message). 2368 */ 2369 if (jfd_out >= 0) { 2370 if (!(drflags & PD_LOCKED)) { 2371 mtx_lock(&pr->pr_mtx); 2372 drflags |= PD_LOCKED; 2373 } 2374 jfd_pos = 2 * vfs_getopt_pos(opts, JAIL_PARAM_DESC) + 1; 2375 if (optuio->uio_segflg == UIO_SYSSPACE) 2376 *(int*)optuio->uio_iov[jfd_pos].iov_base = jfd_out; 2377 else 2378 (void)copyout(&jfd_out, 2379 optuio->uio_iov[jfd_pos].iov_base, sizeof(jfd_out)); 2380 jaildesc_set_prison(jfp_out, pr); 2381 } 2382 2383 drflags &= ~PD_KILL; 2384 td->td_retval[0] = pr->pr_id; 2385 2386 done_deref: 2387 /* 2388 * Report changes to kevent. This can happen even if the 2389 * system call fails, as changes might have been made before 2390 * the failure. 2391 */ 2392 if (maybe_changed && !created) 2393 prison_knote(pr, NOTE_JAIL_SET); 2394 /* Release any temporary prison holds and/or locks. */ 2395 if (pr != NULL) 2396 prison_deref(pr, drflags); 2397 else if (drflags & PD_LIST_SLOCKED) 2398 sx_sunlock(&allprison_lock); 2399 else if (drflags & PD_LIST_XLOCKED) 2400 sx_xunlock(&allprison_lock); 2401 if (root != NULL) 2402 vrele(root); 2403 done_errmsg: 2404 if (error) { 2405 /* Write the error message back to userspace. */ 2406 if (vfs_getopt(opts, JAIL_PARAM_ERRMSG, (void **)&errmsg, 2407 &errmsg_len) == 0 && errmsg_len > 0) { 2408 errmsg_pos = 2 * vfs_getopt_pos(opts, JAIL_PARAM_ERRMSG) + 1; 2409 if (optuio->uio_segflg == UIO_SYSSPACE) 2410 bcopy(errmsg, 2411 optuio->uio_iov[errmsg_pos].iov_base, 2412 errmsg_len); 2413 else 2414 (void)copyout(errmsg, 2415 optuio->uio_iov[errmsg_pos].iov_base, 2416 errmsg_len); 2417 } 2418 } 2419 done_free: 2420 /* Clean up other resources. */ 2421 #ifdef INET 2422 prison_ip_free(ip4); 2423 #endif 2424 #ifdef INET6 2425 prison_ip_free(ip6); 2426 #endif 2427 #ifdef MAC 2428 if (mac_set_prison_data != NULL) 2429 mac_set_prison_finish(td, error == 0, mac_set_prison_data); 2430 #endif 2431 if (jfp_out != NULL) 2432 fdrop(jfp_out, td); 2433 if (error && jfd_out >= 0) 2434 (void)kern_close(td, jfd_out); 2435 if (g_path != NULL) 2436 free(g_path, M_TEMP); 2437 if (opts != NULL) 2438 vfs_freeopts(opts); 2439 prison_free(mypr); 2440 if (flags & JAIL_ATTACH) 2441 prison_attach_thread_single_end(td); 2442 return (error); 2443 } 2444 2445 /* 2446 * Find the next available prison ID. Return the ID on success, or zero 2447 * on failure. Also set a pointer to the allprison list entry the prison 2448 * should be inserted before. 2449 */ 2450 static int 2451 get_next_prid(struct prison **insprp) 2452 { 2453 struct prison *inspr; 2454 int jid, maxid; 2455 2456 jid = lastprid % JAIL_MAX + 1; 2457 if (TAILQ_EMPTY(&allprison) || 2458 TAILQ_LAST(&allprison, prisonlist)->pr_id < jid) { 2459 /* 2460 * A common case is for all jails to be implicitly numbered, 2461 * which means they'll go on the end of the list, at least 2462 * for the first JAIL_MAX times. 2463 */ 2464 inspr = NULL; 2465 } else { 2466 /* 2467 * Take two passes through the allprison list: first starting 2468 * with the proposed jid, then ending with it. 2469 */ 2470 for (maxid = JAIL_MAX; maxid != 0; ) { 2471 TAILQ_FOREACH(inspr, &allprison, pr_list) { 2472 if (inspr->pr_id < jid) 2473 continue; 2474 if (inspr->pr_id > jid) { 2475 /* Found an opening. */ 2476 maxid = 0; 2477 break; 2478 } 2479 if (++jid > maxid) { 2480 if (lastprid == maxid || lastprid == 0) 2481 { 2482 /* 2483 * The entire legal range 2484 * has been traversed 2485 */ 2486 return 0; 2487 } 2488 /* Try again from the start. */ 2489 jid = 1; 2490 maxid = lastprid; 2491 break; 2492 } 2493 } 2494 if (inspr == NULL) { 2495 /* Found room at the end of the list. */ 2496 break; 2497 } 2498 } 2499 } 2500 *insprp = inspr; 2501 lastprid = jid; 2502 return (jid); 2503 } 2504 2505 /* 2506 * Find the next available ID for a renumbered dead prison. This is the same 2507 * as get_next_prid, but counting backward from the end of the range. 2508 */ 2509 static int 2510 get_next_deadid(struct prison **dinsprp) 2511 { 2512 struct prison *dinspr; 2513 int deadid, minid; 2514 2515 deadid = lastdeadid ? lastdeadid - 1 : JAIL_MAX; 2516 /* 2517 * Take two reverse passes through the allprison list: first 2518 * starting with the proposed deadid, then ending with it. 2519 */ 2520 for (minid = 1; minid != 0; ) { 2521 TAILQ_FOREACH_REVERSE(dinspr, &allprison, prisonlist, pr_list) { 2522 if (dinspr->pr_id > deadid) 2523 continue; 2524 if (dinspr->pr_id < deadid) { 2525 /* Found an opening. */ 2526 minid = 0; 2527 break; 2528 } 2529 if (--deadid < minid) { 2530 if (lastdeadid == minid || lastdeadid == 0) 2531 { 2532 /* 2533 * The entire legal range 2534 * has been traversed 2535 */ 2536 return 0; 2537 } 2538 /* Try again from the end. */ 2539 deadid = JAIL_MAX; 2540 minid = lastdeadid; 2541 break; 2542 } 2543 } 2544 if (dinspr == NULL) { 2545 /* Found room at the beginning of the list. */ 2546 break; 2547 } 2548 } 2549 *dinsprp = dinspr; 2550 lastdeadid = deadid; 2551 return (deadid); 2552 } 2553 2554 /* 2555 * struct jail_get_args { 2556 * struct iovec *iovp; 2557 * unsigned int iovcnt; 2558 * int flags; 2559 * }; 2560 */ 2561 int 2562 sys_jail_get(struct thread *td, struct jail_get_args *uap) 2563 { 2564 struct uio *auio; 2565 int error; 2566 2567 /* Check that we have an even number of iovecs. */ 2568 if (uap->iovcnt & 1) 2569 return (EINVAL); 2570 2571 error = copyinuio(uap->iovp, uap->iovcnt, &auio); 2572 if (error) 2573 return (error); 2574 error = kern_jail_get(td, auio, uap->flags); 2575 if (error == 0) 2576 error = copyout(auio->uio_iov, uap->iovp, 2577 uap->iovcnt * sizeof(struct iovec)); 2578 freeuio(auio); 2579 return (error); 2580 } 2581 2582 int 2583 kern_jail_get(struct thread *td, struct uio *optuio, int flags) 2584 { 2585 struct bool_flags *bf; 2586 struct file *jfp_out; 2587 struct jailsys_flags *jsf; 2588 struct prison *pr, *mypr; 2589 struct vfsopt *opt; 2590 struct vfsoptlist *opts; 2591 char *errmsg, *name; 2592 int drflags, error, errmsg_len, errmsg_pos, i, jid, len, pos; 2593 int jfd_in, jfd_out; 2594 unsigned f; 2595 2596 if (flags & ~JAIL_GET_MASK) 2597 return (EINVAL); 2598 if ((flags & (JAIL_USE_DESC | JAIL_AT_DESC)) == 2599 (JAIL_USE_DESC | JAIL_AT_DESC)) 2600 return (EINVAL); 2601 2602 /* Get the parameter list. */ 2603 error = vfs_buildopts(optuio, &opts); 2604 if (error) 2605 return (error); 2606 errmsg_pos = vfs_getopt_pos(opts, JAIL_PARAM_ERRMSG); 2607 mypr = td->td_ucred->cr_prison; 2608 prison_hold(mypr); 2609 pr = NULL; 2610 jfp_out = NULL; 2611 jfd_out = -1; 2612 2613 /* 2614 * Find the prison specified by one of: desc, lastjid, jid, name. 2615 */ 2616 sx_slock(&allprison_lock); 2617 drflags = PD_LIST_SLOCKED; 2618 2619 error = vfs_copyopt(opts, JAIL_PARAM_DESC, &jfd_in, sizeof(jfd_in)); 2620 if (error == ENOENT) { 2621 if (flags & (JAIL_AT_DESC | JAIL_GET_DESC | JAIL_OWN_DESC)) { 2622 vfs_opterror(opts, "missing desc"); 2623 goto done; 2624 } 2625 } else if (error == 0) { 2626 if (!(flags & (JAIL_USE_DESC | JAIL_AT_DESC | JAIL_GET_DESC | 2627 JAIL_OWN_DESC))) { 2628 error = EINVAL; 2629 vfs_opterror(opts, "unexpected desc"); 2630 goto done; 2631 } 2632 if (flags & JAIL_USE_DESC) { 2633 /* Get the jail from its descriptor. */ 2634 error = jaildesc_find(td, jfd_in, &pr, NULL); 2635 if (error) { 2636 vfs_opterror(opts, error == ENOENT ? 2637 "descriptor to dead jail" : 2638 "not a jail descriptor"); 2639 goto done; 2640 } 2641 drflags |= PD_DEREF; 2642 mtx_lock(&pr->pr_mtx); 2643 drflags |= PD_LOCKED; 2644 goto found_prison; 2645 } 2646 if (flags & JAIL_AT_DESC) { 2647 /* Look up jails based on the descriptor's prison. */ 2648 struct prison *jdpr; 2649 2650 error = jaildesc_find(td, jfd_in, &jdpr, NULL); 2651 if (error != 0) { 2652 vfs_opterror(opts, error == ENOENT ? 2653 "descriptor to dead jail" : 2654 "not a jail descriptor"); 2655 goto done; 2656 } 2657 prison_free(mypr); 2658 mypr = jdpr; 2659 } 2660 if (flags & (JAIL_GET_DESC | JAIL_OWN_DESC)) { 2661 /* Allocate a jail descriptor to return later. */ 2662 error = jaildesc_alloc(td, &jfp_out, &jfd_out, 2663 flags & JAIL_OWN_DESC); 2664 if (error) 2665 goto done; 2666 } 2667 } else 2668 goto done; 2669 2670 error = vfs_copyopt(opts, JAIL_PARAM_LASTJID, &jid, sizeof(jid)); 2671 if (error == 0) { 2672 TAILQ_FOREACH(pr, &allprison, pr_list) { 2673 if (pr->pr_id > jid && 2674 ((flags & JAIL_DYING) || prison_isalive(pr)) && 2675 prison_ischild(mypr, pr)) { 2676 mtx_lock(&pr->pr_mtx); 2677 drflags |= PD_LOCKED; 2678 #ifdef MAC 2679 /* 2680 * We special-case this one check because we 2681 * don't want MAC to break jail enumeration. We 2682 * need to just move on to the next accessible 2683 * and alive prison. 2684 */ 2685 error = mac_prison_check_get(td->td_ucred, pr, 2686 opts, flags); 2687 if (error != 0) { 2688 mtx_unlock(&pr->pr_mtx); 2689 drflags &= ~PD_LOCKED; 2690 continue; 2691 } 2692 2693 /* 2694 * Avoid potentially expensive trip back into 2695 * the MAC framework. 2696 */ 2697 goto found_prison_nomac_alive; 2698 #else 2699 goto found_prison; 2700 #endif 2701 } 2702 } 2703 error = ENOENT; 2704 vfs_opterror(opts, "no jail after %d", jid); 2705 goto done; 2706 } else if (error != ENOENT) 2707 goto done; 2708 2709 error = vfs_copyopt(opts, JAIL_PARAM_JID, &jid, sizeof(jid)); 2710 if (error == 0) { 2711 if (jid != 0) { 2712 pr = prison_find_child(mypr, jid); 2713 if (pr != NULL) { 2714 drflags |= PD_LOCKED; 2715 goto found_prison; 2716 } 2717 error = ENOENT; 2718 vfs_opterror(opts, "jail %d not found", jid); 2719 goto done; 2720 } 2721 } else if (error != ENOENT) 2722 goto done; 2723 2724 error = vfs_getopt(opts, JAIL_PARAM_NAME, (void **)&name, &len); 2725 if (error == 0) { 2726 if (len == 0 || name[len - 1] != '\0') { 2727 error = EINVAL; 2728 goto done; 2729 } 2730 pr = prison_find_name(mypr, name); 2731 if (pr != NULL) { 2732 drflags |= PD_LOCKED; 2733 goto found_prison; 2734 } 2735 error = ENOENT; 2736 vfs_opterror(opts, "jail \"%s\" not found", name); 2737 goto done; 2738 } else if (error != ENOENT) 2739 goto done; 2740 2741 vfs_opterror(opts, "no jail specified"); 2742 error = ENOENT; 2743 goto done; 2744 2745 found_prison: 2746 #ifdef MAC 2747 error = mac_prison_check_get(td->td_ucred, pr, opts, flags); 2748 if (error != 0) 2749 goto done; 2750 #endif 2751 if (!(prison_isalive(pr) || (flags & JAIL_DYING))) { 2752 error = ENOENT; 2753 if (pr->pr_name[0] != '0' && isdigit(pr->pr_name[0])) { 2754 vfs_opterror(opts, "jail %d is dying", 2755 pr->pr_id); 2756 } else { 2757 vfs_opterror(opts, "jail \"%s\" (%d) is dying", 2758 pr->pr_name, pr->pr_id); 2759 } 2760 goto done; 2761 } 2762 #ifdef MAC 2763 found_prison_nomac_alive: 2764 #endif 2765 /* Get the parameters of the prison. */ 2766 if (!(drflags & PD_DEREF)) { 2767 prison_hold(pr); 2768 drflags |= PD_DEREF; 2769 } 2770 td->td_retval[0] = pr->pr_id; 2771 if (jfd_out >= 0) { 2772 error = vfs_setopt(opts, JAIL_PARAM_DESC, &jfd_out, sizeof(jfd_out)); 2773 if (error != 0 && error != ENOENT) 2774 goto done; 2775 jaildesc_set_prison(jfp_out, pr); 2776 } 2777 error = vfs_setopt(opts, JAIL_PARAM_JID, &pr->pr_id, sizeof(pr->pr_id)); 2778 if (error != 0 && error != ENOENT) 2779 goto done; 2780 i = (pr->pr_parent == mypr) ? 0 : pr->pr_parent->pr_id; 2781 error = vfs_setopt(opts, JAIL_PARAM_PARENT, &i, sizeof(i)); 2782 if (error != 0 && error != ENOENT) 2783 goto done; 2784 error = vfs_setopts(opts, JAIL_PARAM_NAME, prison_name(mypr, pr)); 2785 if (error != 0 && error != ENOENT) 2786 goto done; 2787 error = vfs_setopt(opts, JAIL_PARAM_CPUSET_ID, &pr->pr_cpuset->cs_id, 2788 sizeof(pr->pr_cpuset->cs_id)); 2789 if (error != 0 && error != ENOENT) 2790 goto done; 2791 error = vfs_setopts(opts, JAIL_PARAM_PATH, prison_path(mypr, pr)); 2792 if (error != 0 && error != ENOENT) 2793 goto done; 2794 #ifdef INET 2795 error = vfs_setopt_part(opts, JAIL_PARAM_IP4_ADDR, 2796 pr->pr_addrs[PR_INET]->pr_ip, 2797 pr->pr_addrs[PR_INET] ? pr->pr_addrs[PR_INET]->ips * 2798 pr_families[PR_INET].size : 0 ); 2799 if (error != 0 && error != ENOENT) 2800 goto done; 2801 #endif 2802 #ifdef INET6 2803 error = vfs_setopt_part(opts, JAIL_PARAM_IP6_ADDR, 2804 pr->pr_addrs[PR_INET6]->pr_ip, 2805 pr->pr_addrs[PR_INET6] ? pr->pr_addrs[PR_INET6]->ips * 2806 pr_families[PR_INET6].size : 0 ); 2807 if (error != 0 && error != ENOENT) 2808 goto done; 2809 #endif 2810 error = vfs_setopt(opts, JAIL_PARAM_SECURELEVEL, &pr->pr_securelevel, 2811 sizeof(pr->pr_securelevel)); 2812 if (error != 0 && error != ENOENT) 2813 goto done; 2814 error = vfs_setopt(opts, JAIL_PARAM_CHILDREN_CUR, &pr->pr_childcount, 2815 sizeof(pr->pr_childcount)); 2816 if (error != 0 && error != ENOENT) 2817 goto done; 2818 error = vfs_setopt(opts, JAIL_PARAM_CHILDREN_MAX, &pr->pr_childmax, 2819 sizeof(pr->pr_childmax)); 2820 if (error != 0 && error != ENOENT) 2821 goto done; 2822 error = vfs_setopts(opts, JAIL_PARAM_HOST_HOSTNAME, pr->pr_hostname); 2823 if (error != 0 && error != ENOENT) 2824 goto done; 2825 error = vfs_setopts(opts, JAIL_PARAM_HOST_DOMAINNAME, pr->pr_domainname); 2826 if (error != 0 && error != ENOENT) 2827 goto done; 2828 error = vfs_setopts(opts, JAIL_PARAM_HOST_HOSTUUID, pr->pr_hostuuid); 2829 if (error != 0 && error != ENOENT) 2830 goto done; 2831 #ifdef COMPAT_FREEBSD32 2832 if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) { 2833 uint32_t hid32 = pr->pr_hostid; 2834 2835 error = vfs_setopt(opts, JAIL_PARAM_HOST_HOSTID, &hid32, sizeof(hid32)); 2836 } else 2837 #endif 2838 error = vfs_setopt(opts, JAIL_PARAM_HOST_HOSTID, &pr->pr_hostid, 2839 sizeof(pr->pr_hostid)); 2840 if (error != 0 && error != ENOENT) 2841 goto done; 2842 error = vfs_setopt(opts, JAIL_PARAM_ENFORCE_STATFS, &pr->pr_enforce_statfs, 2843 sizeof(pr->pr_enforce_statfs)); 2844 if (error != 0 && error != ENOENT) 2845 goto done; 2846 error = vfs_setopt(opts, JAIL_PARAM_DEVFS_RULESET, &pr->pr_devfs_rsnum, 2847 sizeof(pr->pr_devfs_rsnum)); 2848 if (error != 0 && error != ENOENT) 2849 goto done; 2850 for (bf = pr_flag_bool; 2851 bf < pr_flag_bool + nitems(pr_flag_bool); 2852 bf++) { 2853 i = (pr->pr_flags & bf->flag) ? 1 : 0; 2854 error = vfs_setopt(opts, bf->name, &i, sizeof(i)); 2855 if (error != 0 && error != ENOENT) 2856 goto done; 2857 i = !i; 2858 error = vfs_setopt(opts, bf->noname, &i, sizeof(i)); 2859 if (error != 0 && error != ENOENT) 2860 goto done; 2861 } 2862 for (jsf = pr_flag_jailsys; 2863 jsf < pr_flag_jailsys + nitems(pr_flag_jailsys); 2864 jsf++) { 2865 f = pr->pr_flags & (jsf->disable | jsf->new); 2866 i = (f != 0 && f == jsf->disable) ? JAIL_SYS_DISABLE 2867 : (f == jsf->new) ? JAIL_SYS_NEW 2868 : JAIL_SYS_INHERIT; 2869 error = vfs_setopt(opts, jsf->name, &i, sizeof(i)); 2870 if (error != 0 && error != ENOENT) 2871 goto done; 2872 } 2873 for (bf = pr_flag_allow; 2874 bf < pr_flag_allow + nitems(pr_flag_allow) && 2875 atomic_load_int(&bf->flag) != 0; 2876 bf++) { 2877 i = (pr->pr_allow & bf->flag) ? 1 : 0; 2878 error = vfs_setopt(opts, bf->name, &i, sizeof(i)); 2879 if (error != 0 && error != ENOENT) 2880 goto done; 2881 i = !i; 2882 error = vfs_setopt(opts, bf->noname, &i, sizeof(i)); 2883 if (error != 0 && error != ENOENT) 2884 goto done; 2885 } 2886 i = !prison_isalive(pr); 2887 error = vfs_setopt(opts, JAIL_PARAM_DYING, &i, sizeof(i)); 2888 if (error != 0 && error != ENOENT) 2889 goto done; 2890 i = !i; 2891 error = vfs_setopt(opts, JAIL_PARAM_NODYING, &i, sizeof(i)); 2892 if (error != 0 && error != ENOENT) 2893 goto done; 2894 error = vfs_setopt(opts, JAIL_PARAM_OSRELDATE, &pr->pr_osreldate, 2895 sizeof(pr->pr_osreldate)); 2896 if (error != 0 && error != ENOENT) 2897 goto done; 2898 error = vfs_setopts(opts, JAIL_PARAM_OSRELEASE, pr->pr_osrelease); 2899 if (error != 0 && error != ENOENT) 2900 goto done; 2901 2902 #ifdef MAC 2903 /* 2904 * We get the MAC label last because we'll let the MAC framework drop 2905 * pr_mtx to externalize the label. 2906 */ 2907 error = mac_get_prison(td, pr, opts); 2908 mtx_assert(&pr->pr_mtx, MA_NOTOWNED); 2909 drflags &= ~PD_LOCKED; 2910 if (error != 0 && error != ENOENT) 2911 goto done; 2912 #else 2913 mtx_unlock(&pr->pr_mtx); 2914 drflags &= ~PD_LOCKED; 2915 #endif 2916 2917 /* Get the module parameters. */ 2918 error = osd_jail_call(pr, PR_METHOD_GET, opts); 2919 if (error) 2920 goto done; 2921 prison_deref(pr, drflags); 2922 pr = NULL; 2923 drflags = 0; 2924 2925 /* By now, all parameters should have been noted. */ 2926 TAILQ_FOREACH(opt, opts, link) { 2927 if (!opt->seen && 2928 (strstr(opt->name, JAIL_META_PRIVATE ".") == opt->name || 2929 strstr(opt->name, JAIL_META_SHARED ".") == opt->name)) { 2930 /* Communicate back a missing key. */ 2931 free(opt->value, M_MOUNT); 2932 opt->value = NULL; 2933 opt->len = 0; 2934 continue; 2935 } 2936 if (!opt->seen && strcmp(opt->name, "errmsg")) { 2937 error = EINVAL; 2938 vfs_opterror(opts, "unknown parameter: %s", opt->name); 2939 goto done; 2940 } 2941 } 2942 2943 /* Write the fetched parameters back to userspace. */ 2944 error = 0; 2945 TAILQ_FOREACH(opt, opts, link) { 2946 if (opt->pos >= 0 && opt->pos != errmsg_pos) { 2947 pos = 2 * opt->pos + 1; 2948 optuio->uio_iov[pos].iov_len = opt->len; 2949 if (opt->value != NULL) { 2950 if (optuio->uio_segflg == UIO_SYSSPACE) { 2951 bcopy(opt->value, 2952 optuio->uio_iov[pos].iov_base, 2953 opt->len); 2954 } else { 2955 error = copyout(opt->value, 2956 optuio->uio_iov[pos].iov_base, 2957 opt->len); 2958 if (error) 2959 break; 2960 } 2961 } 2962 } 2963 } 2964 2965 done: 2966 /* Release any temporary prison holds and/or locks. */ 2967 if (pr != NULL) 2968 prison_deref(pr, drflags); 2969 else if (drflags & PD_LIST_SLOCKED) 2970 sx_sunlock(&allprison_lock); 2971 else if (drflags & PD_LIST_XLOCKED) 2972 sx_xunlock(&allprison_lock); 2973 /* Clean up other resources. */ 2974 if (jfp_out != NULL) 2975 (void)fdrop(jfp_out, td); 2976 if (error && jfd_out >= 0) 2977 (void)kern_close(td, jfd_out); 2978 if (error && errmsg_pos >= 0) { 2979 /* Write the error message back to userspace. */ 2980 vfs_getopt(opts, JAIL_PARAM_ERRMSG, (void **)&errmsg, &errmsg_len); 2981 errmsg_pos = 2 * errmsg_pos + 1; 2982 if (errmsg_len > 0) { 2983 if (optuio->uio_segflg == UIO_SYSSPACE) 2984 bcopy(errmsg, 2985 optuio->uio_iov[errmsg_pos].iov_base, 2986 errmsg_len); 2987 else 2988 (void)copyout(errmsg, 2989 optuio->uio_iov[errmsg_pos].iov_base, 2990 errmsg_len); 2991 } 2992 } 2993 vfs_freeopts(opts); 2994 prison_free(mypr); 2995 return (error); 2996 } 2997 2998 /* 2999 * struct jail_remove_args { 3000 * int jid; 3001 * }; 3002 */ 3003 int 3004 sys_jail_remove(struct thread *td, struct jail_remove_args *uap) 3005 { 3006 struct prison *pr; 3007 int error; 3008 3009 error = priv_check(td, PRIV_JAIL_REMOVE); 3010 if (error) 3011 return (error); 3012 3013 sx_xlock(&allprison_lock); 3014 pr = prison_find_child(td->td_ucred->cr_prison, uap->jid); 3015 if (pr == NULL) { 3016 sx_xunlock(&allprison_lock); 3017 return (EINVAL); 3018 } 3019 #ifdef MAC 3020 error = mac_prison_check_remove(td->td_ucred, pr); 3021 if (error != 0) { 3022 mtx_unlock(&pr->pr_mtx); 3023 sx_xunlock(&allprison_lock); 3024 return (error); 3025 } 3026 #endif 3027 prison_hold(pr); 3028 prison_remove(pr); 3029 return (0); 3030 } 3031 3032 /* 3033 * struct jail_remove_jd_args { 3034 * int fd; 3035 * }; 3036 */ 3037 int 3038 sys_jail_remove_jd(struct thread *td, struct jail_remove_jd_args *uap) 3039 { 3040 struct prison *pr; 3041 struct ucred *jdcred; 3042 int error; 3043 3044 error = jaildesc_find(td, uap->fd, &pr, &jdcred); 3045 if (error) 3046 return (error); 3047 error = priv_check_cred(jdcred, PRIV_JAIL_REMOVE); 3048 crfree(jdcred); 3049 #ifdef MAC 3050 if (error == 0) 3051 error = mac_prison_check_remove(td->td_ucred, pr); 3052 #endif 3053 if (error) { 3054 prison_free(pr); 3055 return (error); 3056 } 3057 sx_xlock(&allprison_lock); 3058 mtx_lock(&pr->pr_mtx); 3059 prison_remove(pr); 3060 return (0); 3061 } 3062 3063 /* 3064 * Begin the removal process for a prison. The allprison lock should 3065 * be held exclusively, and the prison should be both locked and held. 3066 */ 3067 void 3068 prison_remove(struct prison *pr) 3069 { 3070 sx_assert(&allprison_lock, SA_XLOCKED); 3071 mtx_assert(&pr->pr_mtx, MA_OWNED); 3072 prison_deref(pr, PD_KILL | PD_DEREF | PD_LOCKED | PD_LIST_XLOCKED); 3073 } 3074 3075 /* 3076 * struct jail_attach_args { 3077 * int jid; 3078 * }; 3079 */ 3080 int 3081 sys_jail_attach(struct thread *td, struct jail_attach_args *uap) 3082 { 3083 struct prison *pr; 3084 int drflags, error; 3085 3086 error = priv_check(td, PRIV_JAIL_ATTACH); 3087 if (error) 3088 return (error); 3089 /* Only let a single thread in the process try to attach at a time. */ 3090 error = prison_attach_thread_single(td); 3091 if (error != 0) 3092 return (error); 3093 3094 sx_slock(&allprison_lock); 3095 drflags = PD_LIST_SLOCKED; 3096 pr = prison_find_child(td->td_ucred->cr_prison, uap->jid); 3097 if (pr == NULL) { 3098 error = EINVAL; 3099 goto done; 3100 } 3101 drflags |= PD_LOCKED; 3102 3103 #ifdef MAC 3104 error = mac_prison_check_attach(td->td_ucred, pr); 3105 if (error != 0) 3106 goto done; 3107 #endif 3108 3109 /* Do not allow a process to attach to a prison that is not alive. */ 3110 if (!prison_isalive(pr)) { 3111 error = EINVAL; 3112 goto done; 3113 } 3114 3115 error = do_jail_attach(td, pr, &drflags); 3116 3117 done: 3118 prison_deref(pr, drflags); 3119 prison_attach_thread_single_end(td); 3120 return (error); 3121 } 3122 3123 /* 3124 * struct jail_attach_jd_args { 3125 * int fd; 3126 * }; 3127 */ 3128 int 3129 sys_jail_attach_jd(struct thread *td, struct jail_attach_jd_args *uap) 3130 { 3131 struct prison *pr; 3132 struct ucred *jdcred; 3133 int drflags, error; 3134 3135 /* Only let a single thread in the process try to attach at a time. */ 3136 error = prison_attach_thread_single(td); 3137 if (error != 0) 3138 return (error); 3139 3140 sx_slock(&allprison_lock); 3141 drflags = PD_LIST_SLOCKED; 3142 pr = NULL; 3143 error = jaildesc_find(td, uap->fd, &pr, &jdcred); 3144 if (error) 3145 goto done; 3146 drflags |= PD_DEREF; 3147 error = priv_check_cred(jdcred, PRIV_JAIL_ATTACH); 3148 #ifdef MAC 3149 if (error == 0) 3150 error = mac_prison_check_attach(td->td_ucred, pr); 3151 #endif 3152 crfree(jdcred); 3153 if (error) 3154 goto done; 3155 3156 /* Do not allow a process to attach to a prison that is not alive. */ 3157 if (!prison_isalive(pr)) { 3158 error = EINVAL; 3159 goto done; 3160 } 3161 3162 error = do_jail_attach(td, pr, &drflags); 3163 3164 done: 3165 prison_deref(pr, drflags); 3166 prison_attach_thread_single_end(td); 3167 return (error); 3168 } 3169 3170 /* 3171 * Attach the current process to a prison. On entry, the allprison 3172 * lock should be at least shared. On exit, both it and the prison 3173 * itself will be unlocked, which will be refelected in *drflagsp. 3174 */ 3175 static int 3176 do_jail_attach(struct thread *td, struct prison *pr, int *drflagsp) 3177 { 3178 struct proc *p; 3179 struct ucred *newcred, *oldcred; 3180 int drflags, error; 3181 3182 sx_assert(&allprison_lock, SX_LOCKED); 3183 KASSERT(prison_isvalid(pr), ("Attaching to invalid prison %p", pr)); 3184 /* 3185 * Note the caller's locking state, but gain and track our own 3186 * references. The caller will see that locks have been 3187 * dropped (which isn't true now, but will be after OSD calls). 3188 */ 3189 prison_hold(pr); 3190 refcount_acquire(&pr->pr_uref); 3191 drflags = PD_DEREF | PD_DEUREF | (*drflagsp & PD_LOCK_FLAGS); 3192 *drflagsp &= PD_OP_FLAGS; 3193 3194 /* Let modules do whatever they need to prepare for attaching. */ 3195 if (drflags & PD_LOCKED) { 3196 mtx_unlock(&pr->pr_mtx); 3197 drflags &= ~PD_LOCKED; 3198 } 3199 error = osd_jail_call(pr, PR_METHOD_ATTACH, td); 3200 if (error) 3201 goto e_revert_osd; 3202 sx_unlock(&allprison_lock); 3203 drflags &= ~(PD_LIST_SLOCKED | PD_LIST_XLOCKED); 3204 3205 /* 3206 * Reparent the newly attached process to this jail. 3207 */ 3208 p = td->td_proc; 3209 error = cpuset_setproc_update_set(p, pr->pr_cpuset); 3210 if (error) 3211 goto e_revert_osd; 3212 3213 vn_lock(pr->pr_root, LK_EXCLUSIVE | LK_RETRY); 3214 if ((error = change_dir(pr->pr_root, td)) != 0) 3215 goto e_unlock; 3216 #ifdef MAC 3217 if ((error = mac_vnode_check_chroot(td->td_ucred, pr->pr_root))) 3218 goto e_unlock; 3219 #endif 3220 VOP_UNLOCK(pr->pr_root); 3221 if ((error = pwd_chroot_chdir(td, pr->pr_root))) 3222 goto e_revert_osd; 3223 3224 newcred = crget(); 3225 PROC_LOCK(p); 3226 oldcred = crcopysafe(p, newcred); 3227 newcred->cr_prison = pr; 3228 #ifdef RACCT 3229 racct_proc_ucred_changed(p, oldcred, newcred); 3230 #endif 3231 #ifdef RCTL 3232 crhold(newcred); 3233 #endif 3234 /* 3235 * Takes over 'newcred''s reference, so 'newcred' must not be used 3236 * besides this point except on RCTL where we took an additional 3237 * reference above. 3238 */ 3239 proc_set_cred(p, newcred); 3240 setsugid(p); 3241 PROC_UNLOCK(p); 3242 #ifdef RCTL 3243 rctl_proc_ucred_changed(p, newcred); 3244 crfree(newcred); 3245 #endif 3246 prison_proc_relink(oldcred->cr_prison, pr, p); 3247 prison_deref(oldcred->cr_prison, drflags); 3248 crfree(oldcred); 3249 prison_knote(pr, NOTE_JAIL_ATTACH | td->td_proc->p_pid); 3250 #ifdef MAC 3251 /* 3252 * Note that mac_prison_attached() assumes that it's called in a 3253 * sleepable context. 3254 */ 3255 mac_prison_attached(td->td_ucred, pr, td->td_proc); 3256 #endif 3257 3258 /* 3259 * If the prison was killed while changing credentials, die along 3260 * with it. 3261 */ 3262 if (!prison_isalive(pr)) { 3263 PROC_LOCK(p); 3264 kern_psignal(p, SIGKILL); 3265 PROC_UNLOCK(p); 3266 } 3267 3268 return (0); 3269 3270 e_unlock: 3271 VOP_UNLOCK(pr->pr_root); 3272 e_revert_osd: 3273 /* Tell modules this process is still in its old jail after all. */ 3274 if (!(drflags & (PD_LIST_SLOCKED | PD_LIST_XLOCKED))) { 3275 sx_slock(&allprison_lock); 3276 drflags |= PD_LIST_SLOCKED; 3277 } 3278 (void)osd_jail_call(td->td_ucred->cr_prison, PR_METHOD_ATTACH, td); 3279 prison_deref(pr, drflags); 3280 return (error); 3281 } 3282 3283 /* 3284 * Only one thread in a process should try to attach to a jail, or 3285 * they might end up with a process root from one prison, but attached 3286 * to the jail of another. Enforce this by making the process run in 3287 * single-threaded mode for the duration of the system call, which 3288 * also prevents other related calls such as chroot. 3289 */ 3290 static int 3291 prison_attach_thread_single(struct thread *td) 3292 { 3293 struct proc *p; 3294 int error; 3295 3296 error = 0; 3297 p = td->td_proc; 3298 if ((atomic_load_int(&p->p_flag) & P_HADTHREADS) != 0) { 3299 PROC_LOCK(p); 3300 if (thread_single(p, SINGLE_BOUNDARY)) 3301 error = ERESTART; 3302 PROC_UNLOCK(p); 3303 } 3304 return (error); 3305 } 3306 3307 static void 3308 prison_attach_thread_single_end(struct thread *td) 3309 { 3310 struct proc *p; 3311 3312 p = td->td_proc; 3313 if ((atomic_load_int(&p->p_flag) & P_HADTHREADS) != 0) { 3314 PROC_LOCK(p); 3315 thread_single_end(p, SINGLE_BOUNDARY); 3316 PROC_UNLOCK(p); 3317 } 3318 } 3319 3320 /* 3321 * Returns a locked prison instance, or NULL on failure. 3322 */ 3323 struct prison * 3324 prison_find(int prid) 3325 { 3326 struct prison *pr; 3327 3328 sx_assert(&allprison_lock, SX_LOCKED); 3329 TAILQ_FOREACH(pr, &allprison, pr_list) { 3330 if (pr->pr_id < prid) 3331 continue; 3332 if (pr->pr_id > prid) 3333 break; 3334 KASSERT(prison_isvalid(pr), ("Found invalid prison %p", pr)); 3335 mtx_lock(&pr->pr_mtx); 3336 return (pr); 3337 } 3338 return (NULL); 3339 } 3340 3341 /* 3342 * Find a prison that is a descendant of mypr. Returns a locked prison or NULL. 3343 */ 3344 struct prison * 3345 prison_find_child(struct prison *mypr, int prid) 3346 { 3347 struct prison *pr; 3348 int descend; 3349 3350 sx_assert(&allprison_lock, SX_LOCKED); 3351 FOREACH_PRISON_DESCENDANT(mypr, pr, descend) { 3352 if (pr->pr_id == prid) { 3353 KASSERT(prison_isvalid(pr), 3354 ("Found invalid prison %p", pr)); 3355 mtx_lock(&pr->pr_mtx); 3356 return (pr); 3357 } 3358 } 3359 return (NULL); 3360 } 3361 3362 /* 3363 * Look for the name relative to mypr. Returns a locked prison or NULL. 3364 */ 3365 struct prison * 3366 prison_find_name(struct prison *mypr, const char *name) 3367 { 3368 struct prison *pr, *deadpr; 3369 size_t mylen; 3370 int descend; 3371 3372 sx_assert(&allprison_lock, SX_LOCKED); 3373 mylen = (mypr == &prison0) ? 0 : strlen(mypr->pr_name) + 1; 3374 deadpr = NULL; 3375 FOREACH_PRISON_DESCENDANT(mypr, pr, descend) { 3376 if (!strcmp(pr->pr_name + mylen, name)) { 3377 KASSERT(prison_isvalid(pr), 3378 ("Found invalid prison %p", pr)); 3379 if (prison_isalive(pr)) { 3380 mtx_lock(&pr->pr_mtx); 3381 return (pr); 3382 } 3383 deadpr = pr; 3384 } 3385 } 3386 /* There was no valid prison - perhaps there was a dying one. */ 3387 if (deadpr != NULL) 3388 mtx_lock(&deadpr->pr_mtx); 3389 return (deadpr); 3390 } 3391 3392 /* 3393 * See if a prison has the specific flag set. The prison should be locked, 3394 * unless checking for flags that are only set at jail creation (such as 3395 * PR_IP4 and PR_IP6), or only the single bit is examined, without regard 3396 * to any other prison data. 3397 */ 3398 bool 3399 prison_flag(struct ucred *cred, unsigned flag) 3400 { 3401 3402 return ((cred->cr_prison->pr_flags & flag) != 0); 3403 } 3404 3405 /* 3406 * See if a prison has the specific allow flag set. 3407 * The prison *should* be locked, or only a single bit is examined, without 3408 * regard to any other prison data. 3409 */ 3410 bool 3411 prison_allow(struct ucred *cred, unsigned flag) 3412 { 3413 3414 return ((cred->cr_prison->pr_allow & flag) != 0); 3415 } 3416 3417 /* 3418 * Hold a prison reference, by incrementing pr_ref. It is generally 3419 * an error to hold a prison that does not already have a reference. 3420 * A prison record will remain valid as long as it has at least one 3421 * reference, and will not be removed as long as either the prison 3422 * mutex or the allprison lock is held (allprison_lock may be shared). 3423 */ 3424 void 3425 prison_hold_locked(struct prison *pr) 3426 { 3427 3428 /* Locking is no longer required. */ 3429 prison_hold(pr); 3430 } 3431 3432 void 3433 prison_hold(struct prison *pr) 3434 { 3435 #ifdef INVARIANTS 3436 int was_valid = refcount_acquire_if_not_zero(&pr->pr_ref); 3437 3438 KASSERT(was_valid, 3439 ("Trying to hold dead prison %p (jid=%d).", pr, pr->pr_id)); 3440 #else 3441 refcount_acquire(&pr->pr_ref); 3442 #endif 3443 } 3444 3445 /* 3446 * Remove a prison reference. If that was the last reference, the 3447 * prison will be removed (at a later time). 3448 */ 3449 void 3450 prison_free_locked(struct prison *pr) 3451 { 3452 3453 mtx_assert(&pr->pr_mtx, MA_OWNED); 3454 /* 3455 * Locking is no longer required, but unlock because the caller 3456 * expects it. 3457 */ 3458 mtx_unlock(&pr->pr_mtx); 3459 prison_free(pr); 3460 } 3461 3462 void 3463 prison_free(struct prison *pr) 3464 { 3465 3466 KASSERT(refcount_load(&pr->pr_ref) > 0, 3467 ("Trying to free dead prison %p (jid=%d).", 3468 pr, pr->pr_id)); 3469 if (!refcount_release_if_not_last(&pr->pr_ref)) { 3470 /* 3471 * Don't remove the last reference in this context, 3472 * in case there are locks held. 3473 */ 3474 taskqueue_enqueue(taskqueue_jail_remove, &pr->pr_task); 3475 } 3476 } 3477 3478 static void 3479 prison_free_not_last(struct prison *pr) 3480 { 3481 #ifdef INVARIANTS 3482 int lastref; 3483 3484 KASSERT(refcount_load(&pr->pr_ref) > 0, 3485 ("Trying to free dead prison %p (jid=%d).", 3486 pr, pr->pr_id)); 3487 lastref = refcount_release(&pr->pr_ref); 3488 KASSERT(!lastref, 3489 ("prison_free_not_last freed last ref on prison %p (jid=%d).", 3490 pr, pr->pr_id)); 3491 #else 3492 refcount_release(&pr->pr_ref); 3493 #endif 3494 } 3495 3496 /* 3497 * Hold a prison for user visibility, by incrementing pr_uref. 3498 * It is generally an error to hold a prison that isn't already 3499 * user-visible, except through the jail system calls. It is also 3500 * an error to hold an invalid prison. A prison record will remain 3501 * alive as long as it has at least one user reference, and will not 3502 * be set to the dying state until the prison mutex and allprison_lock 3503 * are both freed. 3504 */ 3505 void 3506 prison_proc_hold(struct prison *pr) 3507 { 3508 #ifdef INVARIANTS 3509 int was_alive = refcount_acquire_if_not_zero(&pr->pr_uref); 3510 3511 KASSERT(was_alive, 3512 ("Cannot add a process to a non-alive prison (jid=%d)", pr->pr_id)); 3513 #else 3514 refcount_acquire(&pr->pr_uref); 3515 #endif 3516 } 3517 3518 /* 3519 * Remove a prison user reference. If it was the last reference, the 3520 * prison will be considered "dying", and may be removed once all of 3521 * its references are dropped. 3522 */ 3523 void 3524 prison_proc_free(struct prison *pr) 3525 { 3526 3527 /* 3528 * Locking is only required when releasing the last reference. 3529 * This allows assurance that a locked prison will remain alive 3530 * until it is unlocked. 3531 */ 3532 KASSERT(refcount_load(&pr->pr_uref) > 0, 3533 ("Trying to kill a process in a dead prison (jid=%d)", pr->pr_id)); 3534 if (!refcount_release_if_not_last(&pr->pr_uref)) { 3535 /* 3536 * Don't remove the last user reference in this context, 3537 * which is expected to be a process that is not only locked, 3538 * but also half dead. Add a reference so any calls to 3539 * prison_free() won't re-submit the task. 3540 */ 3541 prison_hold(pr); 3542 mtx_lock(&pr->pr_mtx); 3543 KASSERT(!(pr->pr_flags & PR_COMPLETE_PROC), 3544 ("Redundant last reference in prison_proc_free (jid=%d)", 3545 pr->pr_id)); 3546 pr->pr_flags |= PR_COMPLETE_PROC; 3547 mtx_unlock(&pr->pr_mtx); 3548 taskqueue_enqueue(taskqueue_jail_remove, &pr->pr_task); 3549 } 3550 } 3551 3552 static void 3553 prison_proc_free_not_last(struct prison *pr) 3554 { 3555 #ifdef INVARIANTS 3556 int lastref; 3557 3558 KASSERT(refcount_load(&pr->pr_uref) > 0, 3559 ("Trying to free dead prison %p (jid=%d).", 3560 pr, pr->pr_id)); 3561 lastref = refcount_release(&pr->pr_uref); 3562 KASSERT(!lastref, 3563 ("prison_proc_free_not_last freed last uref on prison %p (jid=%d).", 3564 pr, pr->pr_id)); 3565 #else 3566 refcount_release(&pr->pr_uref); 3567 #endif 3568 } 3569 3570 void 3571 prison_proc_link(struct prison *pr, struct proc *p) 3572 { 3573 3574 sx_assert(&allproc_lock, SA_XLOCKED); 3575 LIST_INSERT_HEAD(&pr->pr_proclist, p, p_jaillist); 3576 } 3577 3578 void 3579 prison_proc_unlink(struct prison *pr, struct proc *p) 3580 { 3581 3582 sx_assert(&allproc_lock, SA_XLOCKED); 3583 LIST_REMOVE(p, p_jaillist); 3584 } 3585 3586 static void 3587 prison_proc_relink(struct prison *opr, struct prison *npr, struct proc *p) 3588 { 3589 3590 sx_xlock(&allproc_lock); 3591 prison_proc_unlink(opr, p); 3592 prison_proc_link(npr, p); 3593 sx_xunlock(&allproc_lock); 3594 } 3595 3596 /* 3597 * Complete a call to either prison_free or prison_proc_free. 3598 */ 3599 static void 3600 prison_complete(void *context, int pending) 3601 { 3602 struct prison *pr = context; 3603 int drflags; 3604 3605 /* 3606 * This could be called to release the last reference, or the last 3607 * user reference (plus the reference held in prison_proc_free). 3608 */ 3609 drflags = prison_lock_xlock(pr, PD_DEREF); 3610 if (pr->pr_flags & PR_COMPLETE_PROC) { 3611 pr->pr_flags &= ~PR_COMPLETE_PROC; 3612 drflags |= PD_DEUREF; 3613 } 3614 prison_deref(pr, drflags); 3615 } 3616 3617 static void 3618 prison_kill_processes_cb(struct proc *p, void *arg __unused) 3619 { 3620 3621 kern_psignal(p, SIGKILL); 3622 } 3623 3624 /* 3625 * Note the iteration does not guarantee acting on all processes. 3626 * Most notably there may be fork or jail_attach in progress. 3627 */ 3628 void 3629 prison_proc_iterate(struct prison *pr, void (*cb)(struct proc *, void *), 3630 void *cbarg) 3631 { 3632 struct prison *ppr; 3633 struct proc *p; 3634 3635 if (atomic_load_int(&pr->pr_childcount) == 0) { 3636 sx_slock(&allproc_lock); 3637 LIST_FOREACH(p, &pr->pr_proclist, p_jaillist) { 3638 if (p->p_state == PRS_NEW) 3639 continue; 3640 PROC_LOCK(p); 3641 cb(p, cbarg); 3642 PROC_UNLOCK(p); 3643 } 3644 sx_sunlock(&allproc_lock); 3645 if (atomic_load_int(&pr->pr_childcount) == 0) 3646 return; 3647 /* 3648 * Some jails popped up during the iteration, fall through to a 3649 * system-wide search. 3650 */ 3651 } 3652 3653 sx_slock(&allproc_lock); 3654 FOREACH_PROC_IN_SYSTEM(p) { 3655 PROC_LOCK(p); 3656 if (p->p_state != PRS_NEW && p->p_ucred != NULL) { 3657 for (ppr = p->p_ucred->cr_prison; ppr != NULL; 3658 ppr = ppr->pr_parent) { 3659 if (ppr == pr) { 3660 cb(p, cbarg); 3661 break; 3662 } 3663 } 3664 } 3665 PROC_UNLOCK(p); 3666 } 3667 sx_sunlock(&allproc_lock); 3668 } 3669 3670 /* 3671 * Remove a prison reference and/or user reference (usually). 3672 * This assumes context that allows sleeping (for allprison_lock), 3673 * with no non-sleeping locks held, except perhaps the prison itself. 3674 * If there are no more references, release and delist the prison. 3675 * On completion, the prison lock and the allprison lock are both 3676 * unlocked. 3677 */ 3678 static void 3679 prison_deref(struct prison *pr, int flags) 3680 { 3681 struct prisonlist freeprison; 3682 struct prison *killpr, *rpr, *ppr, *tpr; 3683 3684 killpr = NULL; 3685 TAILQ_INIT(&freeprison); 3686 /* 3687 * Release this prison as requested, which may cause its parent 3688 * to be released, and then maybe its grandparent, etc. 3689 */ 3690 for (;;) { 3691 if (flags & PD_KILL) { 3692 /* Kill the prison and its descendents. */ 3693 KASSERT(pr != &prison0, 3694 ("prison_deref trying to kill prison0")); 3695 if (!prison_isalive(pr)) { 3696 /* Silently ignore already-dying prisons. */ 3697 flags &= ~PD_KILL; 3698 } else { 3699 if (!(flags & PD_DEREF)) { 3700 prison_hold(pr); 3701 flags |= PD_DEREF; 3702 } 3703 flags = prison_lock_xlock(pr, flags); 3704 prison_deref_kill(pr, &freeprison); 3705 } 3706 } 3707 if (flags & PD_DEUREF) { 3708 /* Drop a user reference. */ 3709 KASSERT(refcount_load(&pr->pr_uref) > 0, 3710 ("prison_deref PD_DEUREF on a dead prison (jid=%d)", 3711 pr->pr_id)); 3712 if (!refcount_release_if_not_last(&pr->pr_uref)) { 3713 if (!(flags & PD_DEREF)) { 3714 prison_hold(pr); 3715 flags |= PD_DEREF; 3716 } 3717 flags = prison_lock_xlock(pr, flags); 3718 if (refcount_release(&pr->pr_uref) && 3719 pr->pr_state == PRISON_STATE_ALIVE) { 3720 /* 3721 * When the last user references goes, 3722 * this becomes a dying prison. 3723 */ 3724 KASSERT( 3725 refcount_load(&prison0.pr_uref) > 0, 3726 ("prison0 pr_uref=0")); 3727 pr->pr_state = PRISON_STATE_DYING; 3728 prison_cleanup_locked(pr); 3729 mtx_unlock(&pr->pr_mtx); 3730 flags &= ~PD_LOCKED; 3731 prison_cleanup_unlocked(pr); 3732 } 3733 } 3734 } 3735 if (flags & PD_KILL) { 3736 /* 3737 * Any remaining user references are probably processes 3738 * that need to be killed, either in this prison or its 3739 * descendants. 3740 */ 3741 if (refcount_load(&pr->pr_uref) > 0) 3742 killpr = pr; 3743 /* Make sure the parent prison doesn't get killed. */ 3744 flags &= ~PD_KILL; 3745 } 3746 if (flags & PD_DEREF) { 3747 /* Drop a reference. */ 3748 KASSERT(refcount_load(&pr->pr_ref) > 0, 3749 ("prison_deref PD_DEREF on a dead prison (jid=%d)", 3750 pr->pr_id)); 3751 if (!refcount_release_if_not_last(&pr->pr_ref)) { 3752 flags = prison_lock_xlock(pr, flags); 3753 if (refcount_release(&pr->pr_ref)) { 3754 /* 3755 * When the last reference goes, 3756 * unlink the prison and set it aside. 3757 */ 3758 KASSERT( 3759 refcount_load(&pr->pr_uref) == 0, 3760 ("prison_deref: last ref, " 3761 "but still has %d urefs (jid=%d)", 3762 pr->pr_uref, pr->pr_id)); 3763 KASSERT( 3764 refcount_load(&prison0.pr_ref) != 0, 3765 ("prison0 pr_ref=0")); 3766 #ifdef MAC 3767 /* 3768 * The MAC framework will call into any 3769 * policies that want to hook 3770 * prison_destroy_label, so ideally we 3771 * call this prior to any final state 3772 * invalidation to be safe. 3773 */ 3774 mac_prison_destroy(pr); 3775 #endif 3776 pr->pr_state = PRISON_STATE_INVALID; 3777 TAILQ_REMOVE(&allprison, pr, pr_list); 3778 LIST_REMOVE(pr, pr_sibling); 3779 TAILQ_INSERT_TAIL(&freeprison, pr, 3780 pr_list); 3781 for (ppr = pr->pr_parent; 3782 ppr != NULL; 3783 ppr = ppr->pr_parent) 3784 ppr->pr_childcount--; 3785 /* 3786 * Removing a prison frees references 3787 * from its parent. 3788 */ 3789 ppr = pr->pr_parent; 3790 pr->pr_parent = NULL; 3791 mtx_unlock(&pr->pr_mtx); 3792 3793 pr = ppr; 3794 flags &= ~PD_LOCKED; 3795 flags |= PD_DEREF | PD_DEUREF; 3796 continue; 3797 } 3798 } 3799 } 3800 break; 3801 } 3802 3803 /* Release all the prison locks. */ 3804 if (flags & PD_LOCKED) 3805 mtx_unlock(&pr->pr_mtx); 3806 if (flags & PD_LIST_SLOCKED) 3807 sx_sunlock(&allprison_lock); 3808 else if (flags & PD_LIST_XLOCKED) 3809 sx_xunlock(&allprison_lock); 3810 3811 /* Kill any processes attached to a killed prison. */ 3812 if (killpr != NULL) 3813 prison_proc_iterate(killpr, prison_kill_processes_cb, NULL); 3814 3815 /* 3816 * Finish removing any unreferenced prisons, which couldn't happen 3817 * while allprison_lock was held (to avoid a LOR on vrele). 3818 */ 3819 TAILQ_FOREACH_SAFE(rpr, &freeprison, pr_list, tpr) { 3820 #ifdef VIMAGE 3821 if (rpr->pr_flags & PR_VNET) 3822 vnet_destroy(rpr->pr_vnet); 3823 #endif 3824 if (rpr->pr_root != NULL) 3825 vrele(rpr->pr_root); 3826 mtx_destroy(&rpr->pr_mtx); 3827 #ifdef INET 3828 prison_ip_free(rpr->pr_addrs[PR_INET]); 3829 #endif 3830 #ifdef INET6 3831 prison_ip_free(rpr->pr_addrs[PR_INET6]); 3832 #endif 3833 if (rpr->pr_cpuset != NULL) 3834 cpuset_rel(rpr->pr_cpuset); 3835 osd_jail_exit(rpr); 3836 #ifdef RACCT 3837 if (racct_enable) 3838 prison_racct_detach(rpr); 3839 #endif 3840 TAILQ_REMOVE(&freeprison, rpr, pr_list); 3841 free(rpr, M_PRISON); 3842 } 3843 } 3844 3845 /* 3846 * Kill the prison and its descendants. Mark them as dying, clear the 3847 * persist flag, and call module remove methods. 3848 */ 3849 static void 3850 prison_deref_kill(struct prison *pr, struct prisonlist *freeprison) 3851 { 3852 struct prison *cpr, *ppr, *rpr; 3853 bool descend; 3854 3855 /* 3856 * Unlike the descendants, the target prison can be killed 3857 * even if it is currently dying. This is useful for failed 3858 * creation in jail_set(2). 3859 */ 3860 KASSERT(refcount_load(&pr->pr_ref) > 0, 3861 ("Trying to kill dead prison %p (jid=%d).", 3862 pr, pr->pr_id)); 3863 refcount_acquire(&pr->pr_uref); 3864 pr->pr_state = PRISON_STATE_DYING; 3865 mtx_unlock(&pr->pr_mtx); 3866 3867 rpr = NULL; 3868 FOREACH_PRISON_DESCENDANT_PRE_POST(pr, cpr, descend) { 3869 if (descend) { 3870 if (!prison_isalive(cpr)) { 3871 descend = false; 3872 continue; 3873 } 3874 prison_hold(cpr); 3875 prison_proc_hold(cpr); 3876 mtx_lock(&cpr->pr_mtx); 3877 cpr->pr_state = PRISON_STATE_DYING; 3878 cpr->pr_flags |= PR_REMOVE; 3879 mtx_unlock(&cpr->pr_mtx); 3880 continue; 3881 } 3882 if (!(cpr->pr_flags & PR_REMOVE)) 3883 continue; 3884 prison_cleanup_unlocked(cpr); 3885 mtx_lock(&cpr->pr_mtx); 3886 prison_cleanup_locked(cpr); 3887 cpr->pr_flags &= ~PR_REMOVE; 3888 if (cpr->pr_flags & PR_PERSIST) { 3889 cpr->pr_flags &= ~PR_PERSIST; 3890 prison_proc_free_not_last(cpr); 3891 prison_free_not_last(cpr); 3892 } 3893 (void)refcount_release(&cpr->pr_uref); 3894 if (refcount_release(&cpr->pr_ref)) { 3895 /* 3896 * When the last reference goes, unlink the prison 3897 * and set it aside for prison_deref() to handle. 3898 * Delay unlinking the sibling list to keep the loop 3899 * safe. 3900 */ 3901 if (rpr != NULL) 3902 LIST_REMOVE(rpr, pr_sibling); 3903 rpr = cpr; 3904 rpr->pr_state = PRISON_STATE_INVALID; 3905 TAILQ_REMOVE(&allprison, rpr, pr_list); 3906 TAILQ_INSERT_TAIL(freeprison, rpr, pr_list); 3907 /* 3908 * Removing a prison frees references from its parent. 3909 */ 3910 ppr = rpr->pr_parent; 3911 prison_proc_free_not_last(ppr); 3912 prison_free_not_last(ppr); 3913 for (; ppr != NULL; ppr = ppr->pr_parent) 3914 ppr->pr_childcount--; 3915 } 3916 mtx_unlock(&cpr->pr_mtx); 3917 } 3918 if (rpr != NULL) 3919 LIST_REMOVE(rpr, pr_sibling); 3920 3921 prison_cleanup_unlocked(pr); 3922 mtx_lock(&pr->pr_mtx); 3923 prison_cleanup_locked(pr); 3924 if (pr->pr_flags & PR_PERSIST) { 3925 pr->pr_flags &= ~PR_PERSIST; 3926 prison_proc_free_not_last(pr); 3927 prison_free_not_last(pr); 3928 } 3929 (void)refcount_release(&pr->pr_uref); 3930 } 3931 3932 /* 3933 * Given the current locking state in the flags, make sure allprison_lock 3934 * is held exclusive, and the prison is locked. Return flags indicating 3935 * the new state. 3936 */ 3937 static int 3938 prison_lock_xlock(struct prison *pr, int flags) 3939 { 3940 3941 if (!(flags & PD_LIST_XLOCKED)) { 3942 /* 3943 * Get allprison_lock, which may be an upgrade, 3944 * and may require unlocking the prison. 3945 */ 3946 if (flags & PD_LOCKED) { 3947 mtx_unlock(&pr->pr_mtx); 3948 flags &= ~PD_LOCKED; 3949 } 3950 if (flags & PD_LIST_SLOCKED) { 3951 if (!sx_try_upgrade(&allprison_lock)) { 3952 sx_sunlock(&allprison_lock); 3953 sx_xlock(&allprison_lock); 3954 } 3955 flags &= ~PD_LIST_SLOCKED; 3956 } else 3957 sx_xlock(&allprison_lock); 3958 flags |= PD_LIST_XLOCKED; 3959 } 3960 if (!(flags & PD_LOCKED)) { 3961 /* Lock the prison mutex. */ 3962 mtx_lock(&pr->pr_mtx); 3963 flags |= PD_LOCKED; 3964 } 3965 return flags; 3966 } 3967 3968 /* 3969 * Release a prison's resources when it starts dying (when the last user 3970 * reference is dropped, or when it is killed). Two functions are called, 3971 * for work that requires a locked prison or an unlocked one. 3972 */ 3973 static void 3974 prison_cleanup_locked(struct prison *pr) 3975 { 3976 sx_assert(&allprison_lock, SA_XLOCKED); 3977 mtx_assert(&pr->pr_mtx, MA_OWNED); 3978 prison_knote(pr, NOTE_JAIL_REMOVE); 3979 knlist_detach(pr->pr_klist); 3980 jaildesc_prison_cleanup(pr); 3981 pr->pr_klist = NULL; 3982 } 3983 3984 static void 3985 prison_cleanup_unlocked(struct prison *pr) 3986 { 3987 sx_assert(&allprison_lock, SA_XLOCKED); 3988 mtx_assert(&pr->pr_mtx, MA_NOTOWNED); 3989 vfs_exjail_delete(pr); 3990 shm_remove_prison(pr); 3991 (void)osd_jail_call(pr, PR_METHOD_REMOVE, NULL); 3992 } 3993 3994 /* 3995 * Set or clear a permission bit in the pr_allow field, passing restrictions 3996 * (cleared permission) down to child jails. 3997 */ 3998 void 3999 prison_set_allow(struct ucred *cred, unsigned flag, int enable) 4000 { 4001 struct prison *pr; 4002 4003 pr = cred->cr_prison; 4004 sx_slock(&allprison_lock); 4005 mtx_lock(&pr->pr_mtx); 4006 prison_set_allow_locked(pr, flag, enable); 4007 mtx_unlock(&pr->pr_mtx); 4008 sx_sunlock(&allprison_lock); 4009 } 4010 4011 static void 4012 prison_set_allow_locked(struct prison *pr, unsigned flag, int enable) 4013 { 4014 struct prison *cpr; 4015 int descend; 4016 4017 if (enable != 0) 4018 pr->pr_allow |= flag; 4019 else { 4020 pr->pr_allow &= ~flag; 4021 FOREACH_PRISON_DESCENDANT_LOCKED(pr, cpr, descend) 4022 cpr->pr_allow &= ~flag; 4023 } 4024 } 4025 4026 /* 4027 * Check if a jail supports the given address family. 4028 * 4029 * Returns 0 if not jailed or the address family is supported, EAFNOSUPPORT 4030 * if not. 4031 */ 4032 int 4033 prison_check_af(struct ucred *cred, int af) 4034 { 4035 struct prison *pr; 4036 int error; 4037 4038 KASSERT(cred != NULL, ("%s: cred is NULL", __func__)); 4039 4040 pr = cred->cr_prison; 4041 #ifdef VIMAGE 4042 /* Prisons with their own network stack are not limited. */ 4043 if (prison_owns_vnet(pr)) 4044 return (0); 4045 #endif 4046 4047 error = 0; 4048 switch (af) 4049 { 4050 #ifdef INET 4051 case AF_INET: 4052 if (pr->pr_flags & PR_IP4) 4053 { 4054 mtx_lock(&pr->pr_mtx); 4055 if ((pr->pr_flags & PR_IP4) && 4056 pr->pr_addrs[PR_INET] == NULL) 4057 error = EAFNOSUPPORT; 4058 mtx_unlock(&pr->pr_mtx); 4059 } 4060 break; 4061 #endif 4062 #ifdef INET6 4063 case AF_INET6: 4064 if (pr->pr_flags & PR_IP6) 4065 { 4066 mtx_lock(&pr->pr_mtx); 4067 if ((pr->pr_flags & PR_IP6) && 4068 pr->pr_addrs[PR_INET6] == NULL) 4069 error = EAFNOSUPPORT; 4070 mtx_unlock(&pr->pr_mtx); 4071 } 4072 break; 4073 #endif 4074 case AF_LOCAL: 4075 case AF_ROUTE: 4076 case AF_NETLINK: 4077 break; 4078 default: 4079 if (!(pr->pr_allow & PR_ALLOW_SOCKET_AF)) 4080 error = EAFNOSUPPORT; 4081 } 4082 return (error); 4083 } 4084 4085 /* 4086 * Check if given address belongs to the jail referenced by cred (wrapper to 4087 * prison_check_ip[46]). 4088 * 4089 * Returns 0 if jail doesn't restrict the address family or if address belongs 4090 * to jail, EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if 4091 * the jail doesn't allow the address family. IPv4 Address passed in in NBO. 4092 */ 4093 int 4094 prison_if(struct ucred *cred, const struct sockaddr *sa) 4095 { 4096 #ifdef INET 4097 const struct sockaddr_in *sai; 4098 #endif 4099 #ifdef INET6 4100 const struct sockaddr_in6 *sai6; 4101 #endif 4102 int error; 4103 4104 KASSERT(cred != NULL, ("%s: cred is NULL", __func__)); 4105 KASSERT(sa != NULL, ("%s: sa is NULL", __func__)); 4106 4107 #ifdef VIMAGE 4108 if (prison_owns_vnet(cred->cr_prison)) 4109 return (0); 4110 #endif 4111 4112 error = 0; 4113 switch (sa->sa_family) 4114 { 4115 #ifdef INET 4116 case AF_INET: 4117 sai = (const struct sockaddr_in *)sa; 4118 error = prison_check_ip4(cred, &sai->sin_addr); 4119 break; 4120 #endif 4121 #ifdef INET6 4122 case AF_INET6: 4123 sai6 = (const struct sockaddr_in6 *)sa; 4124 error = prison_check_ip6(cred, &sai6->sin6_addr); 4125 break; 4126 #endif 4127 default: 4128 if (!(cred->cr_prison->pr_allow & PR_ALLOW_SOCKET_AF)) 4129 error = EAFNOSUPPORT; 4130 } 4131 return (error); 4132 } 4133 4134 /* 4135 * Return 0 if jails permit p1 to frob p2, otherwise ESRCH. 4136 */ 4137 int 4138 prison_check(struct ucred *cred1, struct ucred *cred2) 4139 { 4140 4141 return ((cred1->cr_prison == cred2->cr_prison || 4142 prison_ischild(cred1->cr_prison, cred2->cr_prison)) ? 0 : ESRCH); 4143 } 4144 4145 /* 4146 * For mountd/nfsd to run within a prison, it must be: 4147 * - A vnet prison. 4148 * - PR_ALLOW_NFSD must be set on it. 4149 * - The root directory (pr_root) of the prison must be 4150 * a file system mount point, so the mountd can hang 4151 * export information on it. 4152 * - The prison's enforce_statfs cannot be 0, so that 4153 * mountd(8) can do exports. 4154 */ 4155 bool 4156 prison_check_nfsd(struct ucred *cred) 4157 { 4158 4159 if (jailed_without_vnet(cred)) 4160 return (false); 4161 if (!prison_allow(cred, PR_ALLOW_NFSD)) 4162 return (false); 4163 if ((cred->cr_prison->pr_root->v_vflag & VV_ROOT) == 0) 4164 return (false); 4165 if (cred->cr_prison->pr_enforce_statfs == 0) 4166 return (false); 4167 return (true); 4168 } 4169 4170 /* 4171 * Return true if p2 is a child of p1, otherwise false. 4172 */ 4173 bool 4174 prison_ischild(struct prison *pr1, struct prison *pr2) 4175 { 4176 4177 for (pr2 = pr2->pr_parent; pr2 != NULL; pr2 = pr2->pr_parent) 4178 if (pr1 == pr2) 4179 return (true); 4180 return (false); 4181 } 4182 4183 /* 4184 * Return true if the prison is currently alive. A prison is alive if it 4185 * holds user references and it isn't being removed. 4186 */ 4187 bool 4188 prison_isalive(const struct prison *pr) 4189 { 4190 4191 if (__predict_false(pr->pr_state != PRISON_STATE_ALIVE)) 4192 return (false); 4193 return (true); 4194 } 4195 4196 /* 4197 * Return true if the prison is currently valid. A prison is valid if it has 4198 * been fully created, and is not being destroyed. Note that dying prisons 4199 * are still considered valid. Invalid prisons won't be found under normal 4200 * circumstances, as they're only put in that state by functions that have 4201 * an exclusive hold on allprison_lock. 4202 */ 4203 bool 4204 prison_isvalid(struct prison *pr) 4205 { 4206 4207 if (__predict_false(pr->pr_state == PRISON_STATE_INVALID)) 4208 return (false); 4209 if (__predict_false(refcount_load(&pr->pr_ref) == 0)) 4210 return (false); 4211 return (true); 4212 } 4213 4214 /* 4215 * Return true if the passed credential is in a jail and that jail does not 4216 * have its own virtual network stack, otherwise false. 4217 */ 4218 bool 4219 jailed_without_vnet(struct ucred *cred) 4220 { 4221 4222 if (!jailed(cred)) 4223 return (false); 4224 #ifdef VIMAGE 4225 if (prison_owns_vnet(cred->cr_prison)) 4226 return (false); 4227 #endif 4228 4229 return (true); 4230 } 4231 4232 /* 4233 * Return the correct hostname (domainname, et al) for the passed credential. 4234 */ 4235 void 4236 getcredhostname(struct ucred *cred, char *buf, size_t size) 4237 { 4238 struct prison *pr; 4239 4240 /* 4241 * A NULL credential can be used to shortcut to the physical 4242 * system's hostname. 4243 */ 4244 pr = (cred != NULL) ? cred->cr_prison : &prison0; 4245 mtx_lock(&pr->pr_mtx); 4246 strlcpy(buf, pr->pr_hostname, size); 4247 mtx_unlock(&pr->pr_mtx); 4248 } 4249 4250 void 4251 getcreddomainname(struct ucred *cred, char *buf, size_t size) 4252 { 4253 4254 mtx_lock(&cred->cr_prison->pr_mtx); 4255 strlcpy(buf, cred->cr_prison->pr_domainname, size); 4256 mtx_unlock(&cred->cr_prison->pr_mtx); 4257 } 4258 4259 void 4260 getcredhostuuid(struct ucred *cred, char *buf, size_t size) 4261 { 4262 4263 mtx_lock(&cred->cr_prison->pr_mtx); 4264 strlcpy(buf, cred->cr_prison->pr_hostuuid, size); 4265 mtx_unlock(&cred->cr_prison->pr_mtx); 4266 } 4267 4268 void 4269 getcredhostid(struct ucred *cred, unsigned long *hostid) 4270 { 4271 4272 mtx_lock(&cred->cr_prison->pr_mtx); 4273 *hostid = cred->cr_prison->pr_hostid; 4274 mtx_unlock(&cred->cr_prison->pr_mtx); 4275 } 4276 4277 void 4278 getjailname(struct ucred *cred, char *name, size_t len) 4279 { 4280 4281 mtx_lock(&cred->cr_prison->pr_mtx); 4282 strlcpy(name, cred->cr_prison->pr_name, len); 4283 mtx_unlock(&cred->cr_prison->pr_mtx); 4284 } 4285 4286 #ifdef VIMAGE 4287 /* 4288 * Determine whether the prison owns its VNET. 4289 */ 4290 bool 4291 prison_owns_vnet(struct prison *pr) 4292 { 4293 4294 /* 4295 * vnets cannot be added/removed after jail creation, 4296 * so no need to lock here. 4297 */ 4298 return ((pr->pr_flags & PR_VNET) != 0); 4299 } 4300 #endif 4301 4302 /* 4303 * Determine whether the subject represented by cred can "see" 4304 * status of a mount point. 4305 * Returns: 0 for permitted, ENOENT otherwise. 4306 * XXX: This function should be called cr_canseemount() and should be 4307 * placed in kern_prot.c. 4308 */ 4309 int 4310 prison_canseemount(struct ucred *cred, struct mount *mp) 4311 { 4312 struct prison *pr; 4313 struct statfs *sp; 4314 size_t len; 4315 4316 pr = cred->cr_prison; 4317 if (pr->pr_enforce_statfs == 0) 4318 return (0); 4319 if (pr->pr_root->v_mount == mp) 4320 return (0); 4321 if (pr->pr_enforce_statfs == 2) 4322 return (ENOENT); 4323 /* 4324 * If jail's chroot directory is set to "/" we should be able to see 4325 * all mount-points from inside a jail. 4326 * This is ugly check, but this is the only situation when jail's 4327 * directory ends with '/'. 4328 */ 4329 if (strcmp(pr->pr_path, "/") == 0) 4330 return (0); 4331 len = strlen(pr->pr_path); 4332 sp = &mp->mnt_stat; 4333 if (strncmp(pr->pr_path, sp->f_mntonname, len) != 0) 4334 return (ENOENT); 4335 /* 4336 * Be sure that we don't have situation where jail's root directory 4337 * is "/some/path" and mount point is "/some/pathpath". 4338 */ 4339 if (sp->f_mntonname[len] != '\0' && sp->f_mntonname[len] != '/') 4340 return (ENOENT); 4341 return (0); 4342 } 4343 4344 void 4345 prison_enforce_statfs(struct ucred *cred, struct mount *mp, struct statfs *sp) 4346 { 4347 char jpath[MAXPATHLEN]; 4348 struct prison *pr; 4349 size_t len; 4350 4351 pr = cred->cr_prison; 4352 if (pr->pr_enforce_statfs == 0) 4353 return; 4354 if (prison_canseemount(cred, mp) != 0) { 4355 bzero(&sp->f_fsid, sizeof(sp->f_fsid)); 4356 bzero(sp->f_mntonname, sizeof(sp->f_mntonname)); 4357 strlcpy(sp->f_mntonname, "[restricted]", 4358 sizeof(sp->f_mntonname)); 4359 return; 4360 } 4361 if (pr->pr_enforce_statfs > 1) 4362 bzero(&sp->f_fsid, sizeof(sp->f_fsid)); 4363 if (pr->pr_root->v_mount == mp) { 4364 /* 4365 * Clear current buffer data, so we are sure nothing from 4366 * the valid path left there. 4367 */ 4368 bzero(sp->f_mntonname, sizeof(sp->f_mntonname)); 4369 *sp->f_mntonname = '/'; 4370 return; 4371 } 4372 /* 4373 * If jail's chroot directory is set to "/" we should be able to see 4374 * all mount-points from inside a jail. 4375 */ 4376 if (strcmp(pr->pr_path, "/") == 0) 4377 return; 4378 len = strlen(pr->pr_path); 4379 strlcpy(jpath, sp->f_mntonname + len, sizeof(jpath)); 4380 /* 4381 * Clear current buffer data, so we are sure nothing from 4382 * the valid path left there. 4383 */ 4384 bzero(sp->f_mntonname, sizeof(sp->f_mntonname)); 4385 if (*jpath == '\0') { 4386 /* Should never happen. */ 4387 *sp->f_mntonname = '/'; 4388 } else { 4389 strlcpy(sp->f_mntonname, jpath, sizeof(sp->f_mntonname)); 4390 } 4391 } 4392 4393 /* 4394 * Check with permission for a specific privilege is granted within jail. We 4395 * have a specific list of accepted privileges; the rest are denied. 4396 */ 4397 int 4398 prison_priv_check(struct ucred *cred, int priv) 4399 { 4400 struct prison *pr; 4401 int error; 4402 4403 /* 4404 * Some policies have custom handlers. This routine should not be 4405 * called for them. See priv_check_cred(). 4406 */ 4407 switch (priv) { 4408 case PRIV_VFS_LOOKUP: 4409 case PRIV_VFS_GENERATION: 4410 KASSERT(0, ("prison_priv_check instead of a custom handler " 4411 "called for %d\n", priv)); 4412 } 4413 4414 if (!jailed(cred)) 4415 return (0); 4416 4417 #ifdef VIMAGE 4418 /* 4419 * Privileges specific to prisons with a virtual network stack. 4420 * There might be a duplicate entry here in case the privilege 4421 * is only granted conditionally in the legacy jail case. 4422 */ 4423 switch (priv) { 4424 /* 4425 * NFS-specific privileges. 4426 */ 4427 case PRIV_NFS_DAEMON: 4428 case PRIV_VFS_GETFH: 4429 case PRIV_VFS_MOUNT_EXPORTED: 4430 if (!prison_check_nfsd(cred)) 4431 return (EPERM); 4432 #ifdef notyet 4433 case PRIV_NFS_LOCKD: 4434 #endif 4435 /* 4436 * Network stack privileges. 4437 */ 4438 case PRIV_NET_BRIDGE: 4439 case PRIV_NET_GRE: 4440 case PRIV_NET_BPF: 4441 case PRIV_NET_RAW: /* Dup, cond. in legacy jail case. */ 4442 case PRIV_NET_ROUTE: 4443 case PRIV_NET_TAP: 4444 case PRIV_NET_SETIFMTU: 4445 case PRIV_NET_SETIFFLAGS: 4446 case PRIV_NET_SETIFCAP: 4447 case PRIV_NET_SETIFDESCR: 4448 case PRIV_NET_SETIFNAME : 4449 case PRIV_NET_SETIFMETRIC: 4450 case PRIV_NET_SETIFPHYS: 4451 case PRIV_NET_SETIFMAC: 4452 case PRIV_NET_SETLANPCP: 4453 case PRIV_NET_ADDMULTI: 4454 case PRIV_NET_DELMULTI: 4455 case PRIV_NET_HWIOCTL: 4456 case PRIV_NET_SETLLADDR: 4457 case PRIV_NET_ADDIFGROUP: 4458 case PRIV_NET_DELIFGROUP: 4459 case PRIV_NET_IFCREATE: 4460 case PRIV_NET_IFDESTROY: 4461 case PRIV_NET_ADDIFADDR: 4462 case PRIV_NET_DELIFADDR: 4463 case PRIV_NET_LAGG: 4464 case PRIV_NET_GIF: 4465 case PRIV_NET_SETIFVNET: 4466 case PRIV_NET_SETIFFIB: 4467 case PRIV_NET_OVPN: 4468 case PRIV_NET_GENEVE: 4469 case PRIV_NET_ME: 4470 case PRIV_NET_WG: 4471 4472 /* 4473 * 802.11-related privileges. 4474 */ 4475 case PRIV_NET80211_VAP_GETKEY: 4476 case PRIV_NET80211_VAP_MANAGE: 4477 4478 #ifdef notyet 4479 /* 4480 * ATM privileges. 4481 */ 4482 case PRIV_NETATM_CFG: 4483 case PRIV_NETATM_ADD: 4484 case PRIV_NETATM_DEL: 4485 case PRIV_NETATM_SET: 4486 4487 /* 4488 * Bluetooth privileges. 4489 */ 4490 case PRIV_NETBLUETOOTH_RAW: 4491 #endif 4492 4493 /* 4494 * Netgraph and netgraph module privileges. 4495 */ 4496 case PRIV_NETGRAPH_CONTROL: 4497 #ifdef notyet 4498 case PRIV_NETGRAPH_TTY: 4499 #endif 4500 4501 /* 4502 * IPv4 and IPv6 privileges. 4503 */ 4504 case PRIV_NETINET_IPFW: 4505 case PRIV_NETINET_DIVERT: 4506 case PRIV_NETINET_PF: 4507 case PRIV_NETINET_DUMMYNET: 4508 case PRIV_NETINET_CARP: 4509 case PRIV_NETINET_MROUTE: 4510 case PRIV_NETINET_RAW: 4511 case PRIV_NETINET_ADDRCTRL6: 4512 case PRIV_NETINET_ND6: 4513 case PRIV_NETINET_SCOPE6: 4514 case PRIV_NETINET_ALIFETIME6: 4515 case PRIV_NETINET_IPSEC: 4516 case PRIV_NETINET_BINDANY: 4517 4518 #ifdef notyet 4519 /* 4520 * NCP privileges. 4521 */ 4522 case PRIV_NETNCP: 4523 4524 /* 4525 * SMB privileges. 4526 */ 4527 case PRIV_NETSMB: 4528 #endif 4529 4530 /* 4531 * No default: or deny here. 4532 * In case of no permit fall through to next switch(). 4533 */ 4534 if (cred->cr_prison->pr_flags & PR_VNET) 4535 return (0); 4536 } 4537 #endif /* VIMAGE */ 4538 4539 switch (priv) { 4540 /* 4541 * Allow ktrace privileges for root in jail. 4542 */ 4543 case PRIV_KTRACE: 4544 return (0); 4545 4546 /* 4547 * Allow jailed processes to configure audit identity and 4548 * submit audit records (login, etc). In the future we may 4549 * want to further refine the relationship between audit and 4550 * jail. 4551 */ 4552 case PRIV_AUDIT_GETAUDIT: 4553 case PRIV_AUDIT_SETAUDIT: 4554 if (cred->cr_prison->pr_allow & PR_ALLOW_SETAUDIT) 4555 return (0); 4556 else 4557 return (EPERM); 4558 #if 0 4559 case PRIV_AUDIT_SUBMIT: 4560 #endif 4561 4562 /* 4563 * Allow jailed processes to manipulate process UNIX 4564 * credentials in any way they see fit. 4565 */ 4566 case PRIV_CRED_SETCRED: 4567 case PRIV_CRED_SETUID: 4568 case PRIV_CRED_SETEUID: 4569 case PRIV_CRED_SETGID: 4570 case PRIV_CRED_SETEGID: 4571 case PRIV_CRED_SETGROUPS: 4572 case PRIV_CRED_SETREUID: 4573 case PRIV_CRED_SETREGID: 4574 case PRIV_CRED_SETRESUID: 4575 case PRIV_CRED_SETRESGID: 4576 4577 /* 4578 * Jail implements visibility constraints already, so allow 4579 * jailed root to override uid/gid-based constraints. 4580 */ 4581 case PRIV_SEEOTHERGIDS: 4582 case PRIV_SEEOTHERUIDS: 4583 case PRIV_SEEJAILPROC: 4584 4585 /* 4586 * Jail implements inter-process debugging limits already, so 4587 * allow jailed root various debugging privileges. 4588 */ 4589 case PRIV_DEBUG_DIFFCRED: 4590 case PRIV_DEBUG_SUGID: 4591 case PRIV_DEBUG_UNPRIV: 4592 case PRIV_DEBUG_DIFFJAIL: 4593 4594 /* 4595 * Allow jail to set various resource limits and login 4596 * properties, and for now, exceed process resource limits. 4597 */ 4598 case PRIV_PROC_LIMIT: 4599 case PRIV_PROC_SETLOGIN: 4600 case PRIV_PROC_SETRLIMIT: 4601 4602 /* 4603 * Debuggers should work in jails. 4604 */ 4605 case PRIV_PROC_MEM_WRITE: 4606 4607 /* 4608 * System V and POSIX IPC privileges are granted in jail. 4609 */ 4610 case PRIV_IPC_READ: 4611 case PRIV_IPC_WRITE: 4612 case PRIV_IPC_ADMIN: 4613 case PRIV_IPC_MSGSIZE: 4614 case PRIV_MQ_ADMIN: 4615 4616 /* 4617 * Jail operations within a jail work on child jails. 4618 */ 4619 case PRIV_JAIL_ATTACH: 4620 case PRIV_JAIL_SET: 4621 case PRIV_JAIL_REMOVE: 4622 4623 /* 4624 * Jail implements its own inter-process limits, so allow 4625 * root processes in jail to change scheduling on other 4626 * processes in the same jail. Likewise for signalling. 4627 */ 4628 case PRIV_SCHED_DIFFCRED: 4629 case PRIV_SCHED_CPUSET: 4630 case PRIV_SCHED_DIFFJAIL: 4631 case PRIV_SIGNAL_DIFFCRED: 4632 case PRIV_SIGNAL_SUGID: 4633 case PRIV_SIGNAL_DIFFJAIL: 4634 4635 /* 4636 * Allow jailed processes to write to sysctls marked as jail 4637 * writable. 4638 */ 4639 case PRIV_SYSCTL_WRITEJAIL: 4640 4641 /* 4642 * Allow root in jail to manage a variety of quota 4643 * properties. These should likely be conditional on a 4644 * configuration option. 4645 */ 4646 case PRIV_VFS_GETQUOTA: 4647 case PRIV_VFS_SETQUOTA: 4648 4649 /* 4650 * Since Jail relies on chroot() to implement file system 4651 * protections, grant many VFS privileges to root in jail. 4652 * Be careful to exclude mount-related and NFS-related 4653 * privileges. 4654 */ 4655 case PRIV_VFS_READ: 4656 case PRIV_VFS_WRITE: 4657 case PRIV_VFS_ADMIN: 4658 case PRIV_VFS_EXEC: 4659 case PRIV_VFS_BLOCKRESERVE: /* XXXRW: Slightly surprising. */ 4660 case PRIV_VFS_CHFLAGS_DEV: 4661 case PRIV_VFS_CHOWN: 4662 case PRIV_VFS_CHROOT: 4663 case PRIV_VFS_RETAINSUGID: 4664 case PRIV_VFS_FCHROOT: 4665 case PRIV_VFS_LINK: 4666 case PRIV_VFS_SETGID: 4667 case PRIV_VFS_STAT: 4668 case PRIV_VFS_STICKYFILE: 4669 4670 /* 4671 * As in the non-jail case, non-root users are expected to be 4672 * able to read kernel/physical memory (provided /dev/[k]mem 4673 * exists in the jail and they have permission to access it). 4674 */ 4675 case PRIV_KMEM_READ: 4676 return (0); 4677 4678 /* 4679 * Depending on the global setting, allow privilege of 4680 * setting system flags. 4681 */ 4682 case PRIV_VFS_SYSFLAGS: 4683 if (cred->cr_prison->pr_allow & PR_ALLOW_CHFLAGS) 4684 return (0); 4685 else 4686 return (EPERM); 4687 4688 /* 4689 * Depending on the global setting, allow privilege of 4690 * mounting/unmounting file systems. 4691 */ 4692 case PRIV_VFS_MOUNT: 4693 case PRIV_VFS_UNMOUNT: 4694 case PRIV_VFS_MOUNT_NONUSER: 4695 case PRIV_VFS_MOUNT_OWNER: 4696 pr = cred->cr_prison; 4697 prison_lock(pr); 4698 if (pr->pr_allow & PR_ALLOW_MOUNT && pr->pr_enforce_statfs < 2) 4699 error = 0; 4700 else 4701 error = EPERM; 4702 prison_unlock(pr); 4703 return (error); 4704 4705 /* 4706 * Jails should hold no disposition on the PRIV_VFS_READ_DIR 4707 * policy. priv_check_cred will not specifically allow it, and 4708 * we may want a MAC policy to allow it. 4709 */ 4710 case PRIV_VFS_READ_DIR: 4711 return (0); 4712 4713 /* 4714 * Conditionally allow privileged process in the jail to 4715 * manipulate filesystem extended attributes in the system 4716 * namespace. 4717 */ 4718 case PRIV_VFS_EXTATTR_SYSTEM: 4719 if ((cred->cr_prison->pr_allow & PR_ALLOW_EXTATTR) != 0) 4720 return (0); 4721 else 4722 return (EPERM); 4723 4724 /* 4725 * Conditionnaly allow locking (unlocking) physical pages 4726 * in memory. 4727 */ 4728 case PRIV_VM_MLOCK: 4729 case PRIV_VM_MUNLOCK: 4730 if (cred->cr_prison->pr_allow & PR_ALLOW_MLOCK) 4731 return (0); 4732 else 4733 return (EPERM); 4734 4735 /* 4736 * Conditionally allow jailed root to bind reserved ports. 4737 */ 4738 case PRIV_NETINET_RESERVEDPORT: 4739 if (cred->cr_prison->pr_allow & PR_ALLOW_RESERVED_PORTS) 4740 return (0); 4741 else 4742 return (EPERM); 4743 4744 /* 4745 * Allow jailed root to reuse in-use ports. 4746 */ 4747 case PRIV_NETINET_REUSEPORT: 4748 return (0); 4749 4750 /* 4751 * Allow jailed root to set certain IPv4/6 (option) headers. 4752 */ 4753 case PRIV_NETINET_SETHDROPTS: 4754 return (0); 4755 4756 /* 4757 * Conditionally allow creating raw sockets in jail. 4758 */ 4759 case PRIV_NETINET_RAW: 4760 if (cred->cr_prison->pr_allow & PR_ALLOW_RAW_SOCKETS) 4761 return (0); 4762 else 4763 return (EPERM); 4764 4765 /* 4766 * Since jail implements its own visibility limits on netstat 4767 * sysctls, allow getcred. This allows identd to work in 4768 * jail. 4769 */ 4770 case PRIV_NETINET_GETCRED: 4771 return (0); 4772 4773 /* 4774 * Allow jailed root to set loginclass. 4775 */ 4776 case PRIV_PROC_SETLOGINCLASS: 4777 return (0); 4778 4779 /* 4780 * Do not allow a process inside a jail to read the kernel 4781 * message buffer unless explicitly permitted. 4782 */ 4783 case PRIV_MSGBUF: 4784 if (cred->cr_prison->pr_allow & PR_ALLOW_READ_MSGBUF) 4785 return (0); 4786 return (EPERM); 4787 4788 /* 4789 * Conditionally allow privileged process in the jail adjust 4790 * machine time. 4791 */ 4792 case PRIV_ADJTIME: 4793 case PRIV_NTP_ADJTIME: 4794 if (cred->cr_prison->pr_allow & 4795 (PR_ALLOW_ADJTIME | PR_ALLOW_SETTIME)) { 4796 return (0); 4797 } 4798 return (EPERM); 4799 4800 /* 4801 * Conditionally allow privileged process in the jail set 4802 * machine time. 4803 */ 4804 case PRIV_SETTIMEOFDAY: 4805 case PRIV_CLOCK_SETTIME: 4806 if (cred->cr_prison->pr_allow & PR_ALLOW_SETTIME) 4807 return (0); 4808 else 4809 return (EPERM); 4810 4811 /* 4812 * Conditionally allow privileged process in the jail to modify 4813 * the routing table. 4814 */ 4815 case PRIV_NET_ROUTE: 4816 if (cred->cr_prison->pr_allow & PR_ALLOW_ROUTING) 4817 return (0); 4818 else 4819 return (EPERM); 4820 4821 case PRIV_VMM_CREATE: 4822 case PRIV_VMM_DESTROY: 4823 /* 4824 * Jailed root can create and destroy VMs; the vmm module 4825 * additionally checks for the allow.vmm flag. 4826 */ 4827 return (0); 4828 4829 case PRIV_VMM_PPTDEV: 4830 /* 4831 * Allow jailed root to manage passthrough devices. vmm(4) also 4832 * checks for the dynamically added allow.vmm_ppt. 4833 */ 4834 return (0); 4835 4836 default: 4837 /* 4838 * In all remaining cases, deny the privilege request. This 4839 * includes almost all network privileges, many system 4840 * configuration privileges. 4841 */ 4842 return (EPERM); 4843 } 4844 } 4845 4846 /* 4847 * Return the part of pr2's name that is relative to pr1, or the whole name 4848 * if it does not directly follow. 4849 */ 4850 4851 char * 4852 prison_name(struct prison *pr1, struct prison *pr2) 4853 { 4854 char *name; 4855 4856 /* Jails see themselves as "0" (if they see themselves at all). */ 4857 if (pr1 == pr2) 4858 return "0"; 4859 name = pr2->pr_name; 4860 if (prison_ischild(pr1, pr2)) { 4861 /* 4862 * pr1 isn't locked (and allprison_lock may not be either) 4863 * so its length can't be counted on. But the number of dots 4864 * can be counted on - and counted. 4865 */ 4866 for (; pr1 != &prison0; pr1 = pr1->pr_parent) 4867 name = strchr(name, '.') + 1; 4868 } 4869 return (name); 4870 } 4871 4872 /* 4873 * Return the part of pr2's path that is relative to pr1, or the whole path 4874 * if it does not directly follow. 4875 */ 4876 static char * 4877 prison_path(struct prison *pr1, struct prison *pr2) 4878 { 4879 char *path1, *path2; 4880 int len1; 4881 4882 path1 = pr1->pr_path; 4883 path2 = pr2->pr_path; 4884 if (!strcmp(path1, "/")) 4885 return (path2); 4886 len1 = strlen(path1); 4887 if (strncmp(path1, path2, len1)) 4888 return (path2); 4889 if (path2[len1] == '\0') 4890 return "/"; 4891 if (path2[len1] == '/') 4892 return (path2 + len1); 4893 return (path2); 4894 } 4895 4896 /* 4897 * Jail-related sysctls. 4898 */ 4899 SYSCTL_NODE(_security, OID_AUTO, jail, CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 4900 "Jails"); 4901 4902 #if defined(INET) || defined(INET6) 4903 /* 4904 * Copy address array to memory that would be then SYSCTL_OUT-ed. 4905 * sysctl_jail_list() helper. 4906 */ 4907 static void 4908 prison_ip_copyout(struct prison *pr, const pr_family_t af, void **out, int *len) 4909 { 4910 const struct prison_ip *pip; 4911 const size_t size = pr_families[af].size; 4912 4913 again: 4914 mtx_assert(&pr->pr_mtx, MA_OWNED); 4915 if ((pip = pr->pr_addrs[af]) != NULL) { 4916 if (*len < pip->ips) { 4917 *len = pip->ips; 4918 mtx_unlock(&pr->pr_mtx); 4919 *out = realloc(*out, *len * size, M_TEMP, M_WAITOK); 4920 mtx_lock(&pr->pr_mtx); 4921 goto again; 4922 } 4923 bcopy(pip->pr_ip, *out, pip->ips * size); 4924 } 4925 } 4926 #endif 4927 4928 static int 4929 sysctl_jail_list(SYSCTL_HANDLER_ARGS) 4930 { 4931 struct xprison *xp; 4932 struct prison *pr, *cpr; 4933 #ifdef INET 4934 struct in_addr *ip4 = NULL; 4935 int ip4s = 0; 4936 #endif 4937 #ifdef INET6 4938 struct in6_addr *ip6 = NULL; 4939 int ip6s = 0; 4940 #endif 4941 int descend, error; 4942 4943 xp = malloc(sizeof(*xp), M_TEMP, M_WAITOK); 4944 pr = req->td->td_ucred->cr_prison; 4945 error = 0; 4946 sx_slock(&allprison_lock); 4947 FOREACH_PRISON_DESCENDANT(pr, cpr, descend) { 4948 mtx_lock(&cpr->pr_mtx); 4949 #ifdef INET 4950 prison_ip_copyout(cpr, PR_INET, (void **)&ip4, &ip4s); 4951 #endif 4952 #ifdef INET6 4953 prison_ip_copyout(cpr, PR_INET6, (void **)&ip6, &ip6s); 4954 #endif 4955 bzero(xp, sizeof(*xp)); 4956 xp->pr_version = XPRISON_VERSION; 4957 xp->pr_id = cpr->pr_id; 4958 xp->pr_state = cpr->pr_state; 4959 strlcpy(xp->pr_path, prison_path(pr, cpr), sizeof(xp->pr_path)); 4960 strlcpy(xp->pr_host, cpr->pr_hostname, sizeof(xp->pr_host)); 4961 strlcpy(xp->pr_name, prison_name(pr, cpr), sizeof(xp->pr_name)); 4962 #ifdef INET 4963 xp->pr_ip4s = ip4s; 4964 #endif 4965 #ifdef INET6 4966 xp->pr_ip6s = ip6s; 4967 #endif 4968 mtx_unlock(&cpr->pr_mtx); 4969 error = SYSCTL_OUT(req, xp, sizeof(*xp)); 4970 if (error) 4971 break; 4972 #ifdef INET 4973 if (xp->pr_ip4s > 0) { 4974 error = SYSCTL_OUT(req, ip4, 4975 xp->pr_ip4s * sizeof(struct in_addr)); 4976 if (error) 4977 break; 4978 } 4979 #endif 4980 #ifdef INET6 4981 if (xp->pr_ip6s > 0) { 4982 error = SYSCTL_OUT(req, ip6, 4983 xp->pr_ip6s * sizeof(struct in6_addr)); 4984 if (error) 4985 break; 4986 } 4987 #endif 4988 } 4989 sx_sunlock(&allprison_lock); 4990 free(xp, M_TEMP); 4991 #ifdef INET 4992 free(ip4, M_TEMP); 4993 #endif 4994 #ifdef INET6 4995 free(ip6, M_TEMP); 4996 #endif 4997 return (error); 4998 } 4999 5000 SYSCTL_OID(_security_jail, OID_AUTO, list, 5001 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0, 5002 sysctl_jail_list, "S", "List of active jails"); 5003 5004 static int 5005 sysctl_jail_jailed(SYSCTL_HANDLER_ARGS) 5006 { 5007 int error, injail; 5008 5009 injail = jailed(req->td->td_ucred); 5010 error = SYSCTL_OUT(req, &injail, sizeof(injail)); 5011 5012 return (error); 5013 } 5014 5015 SYSCTL_PROC(_security_jail, OID_AUTO, jailed, 5016 CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0, 5017 sysctl_jail_jailed, "I", "Process in jail?"); 5018 5019 static int 5020 sysctl_jail_vnet(SYSCTL_HANDLER_ARGS) 5021 { 5022 int error, havevnet; 5023 #ifdef VIMAGE 5024 struct ucred *cred = req->td->td_ucred; 5025 5026 havevnet = jailed(cred) && prison_owns_vnet(cred->cr_prison); 5027 #else 5028 havevnet = 0; 5029 #endif 5030 error = SYSCTL_OUT(req, &havevnet, sizeof(havevnet)); 5031 5032 return (error); 5033 } 5034 5035 SYSCTL_PROC(_security_jail, OID_AUTO, vnet, 5036 CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0, 5037 sysctl_jail_vnet, "I", "Jail owns vnet?"); 5038 5039 #if defined(INET) || defined(INET6) 5040 SYSCTL_UINT(_security_jail, OID_AUTO, jail_max_af_ips, CTLFLAG_RW, 5041 &jail_max_af_ips, 0, 5042 "Number of IP addresses a jail may have at most per address family (deprecated)"); 5043 #endif 5044 5045 /* 5046 * Default parameters for jail(2) compatibility. For historical reasons, 5047 * the sysctl names have varying similarity to the parameter names. Prisons 5048 * just see their own parameters, and can't change them. 5049 */ 5050 static int 5051 sysctl_jail_default_allow(SYSCTL_HANDLER_ARGS) 5052 { 5053 int error, i; 5054 5055 /* Get the current flag value, and convert it to a boolean. */ 5056 if (req->td->td_ucred->cr_prison == &prison0) { 5057 mtx_lock(&prison0.pr_mtx); 5058 i = (jail_default_allow & arg2) != 0; 5059 mtx_unlock(&prison0.pr_mtx); 5060 } else 5061 i = prison_allow(req->td->td_ucred, arg2); 5062 5063 if (arg1 != NULL) 5064 i = !i; 5065 error = sysctl_handle_int(oidp, &i, 0, req); 5066 if (error || !req->newptr) 5067 return (error); 5068 i = i ? arg2 : 0; 5069 if (arg1 != NULL) 5070 i ^= arg2; 5071 /* 5072 * The sysctls don't have CTLFLAGS_PRISON, so assume prison0 5073 * for writing. 5074 */ 5075 mtx_lock(&prison0.pr_mtx); 5076 jail_default_allow = (jail_default_allow & ~arg2) | i; 5077 mtx_unlock(&prison0.pr_mtx); 5078 return (0); 5079 } 5080 5081 /* 5082 * Do not add more here. Use SYSCTL_JAIL_PARAM (allow flags for jails) 5083 * instead. 5084 */ 5085 SYSCTL_PROC(_security_jail, OID_AUTO, set_hostname_allowed, 5086 CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 5087 NULL, PR_ALLOW_SET_HOSTNAME, sysctl_jail_default_allow, "I", 5088 "Processes in jail can set their hostnames (deprecated)"); 5089 SYSCTL_PROC(_security_jail, OID_AUTO, socket_unixiproute_only, 5090 CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 5091 (void *)1, PR_ALLOW_SOCKET_AF, sysctl_jail_default_allow, "I", 5092 "Processes in jail are limited to creating UNIX/IP/route sockets only (deprecated)"); 5093 SYSCTL_PROC(_security_jail, OID_AUTO, sysvipc_allowed, 5094 CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 5095 NULL, PR_ALLOW_SYSVIPC, sysctl_jail_default_allow, "I", 5096 "Processes in jail can use System V IPC primitives (deprecated)"); 5097 SYSCTL_PROC(_security_jail, OID_AUTO, allow_raw_sockets, 5098 CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 5099 NULL, PR_ALLOW_RAW_SOCKETS, sysctl_jail_default_allow, "I", 5100 "Prison root can create raw sockets (deprecated)"); 5101 SYSCTL_PROC(_security_jail, OID_AUTO, chflags_allowed, 5102 CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 5103 NULL, PR_ALLOW_CHFLAGS, sysctl_jail_default_allow, "I", 5104 "Processes in jail can alter system file flags (deprecated)"); 5105 SYSCTL_PROC(_security_jail, OID_AUTO, mount_allowed, 5106 CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 5107 NULL, PR_ALLOW_MOUNT, sysctl_jail_default_allow, "I", 5108 "Processes in jail can mount/unmount jail-friendly file systems (deprecated)"); 5109 SYSCTL_PROC(_security_jail, OID_AUTO, mlock_allowed, 5110 CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 5111 NULL, PR_ALLOW_MLOCK, sysctl_jail_default_allow, "I", 5112 "Processes in jail can lock/unlock physical pages in memory (deprecated)"); 5113 5114 static int 5115 sysctl_jail_default_level(SYSCTL_HANDLER_ARGS) 5116 { 5117 struct prison *pr; 5118 int level, error; 5119 5120 pr = req->td->td_ucred->cr_prison; 5121 level = (pr == &prison0) ? *(int *)arg1 : *(int *)((char *)pr + arg2); 5122 error = sysctl_handle_int(oidp, &level, 0, req); 5123 if (error || !req->newptr) 5124 return (error); 5125 *(int *)arg1 = level; 5126 return (0); 5127 } 5128 5129 SYSCTL_PROC(_security_jail, OID_AUTO, enforce_statfs, 5130 CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 5131 &jail_default_enforce_statfs, offsetof(struct prison, pr_enforce_statfs), 5132 sysctl_jail_default_level, "I", 5133 "Processes in jail cannot see all mounted file systems (deprecated)"); 5134 5135 SYSCTL_PROC(_security_jail, OID_AUTO, devfs_ruleset, 5136 CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, 5137 &jail_default_devfs_rsnum, offsetof(struct prison, pr_devfs_rsnum), 5138 sysctl_jail_default_level, "I", 5139 "Ruleset for the devfs filesystem in jail (deprecated)"); 5140 5141 SYSCTL_NODE(_security_jail, OID_AUTO, children, CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 5142 "Limits and stats of child jails"); 5143 5144 static int 5145 sysctl_jail_children(SYSCTL_HANDLER_ARGS) 5146 { 5147 struct prison *pr; 5148 int i; 5149 5150 pr = req->td->td_ucred->cr_prison; 5151 5152 switch (oidp->oid_kind & CTLTYPE) { 5153 case CTLTYPE_INT: 5154 i = *(int *)((char *)pr + arg2); 5155 return (SYSCTL_OUT(req, &i, sizeof(i))); 5156 } 5157 5158 return (0); 5159 } 5160 5161 SYSCTL_PROC(_security_jail_children, OID_AUTO, max, 5162 CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, 5163 NULL, offsetof(struct prison, pr_childmax), sysctl_jail_children, 5164 "I", "Maximum number of child jails"); 5165 SYSCTL_PROC(_security_jail_children, OID_AUTO, cur, 5166 CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, 5167 NULL, offsetof(struct prison, pr_childcount), sysctl_jail_children, 5168 "I", "Current number of child jails"); 5169 5170 /* 5171 * Nodes to describe jail parameters. Maximum length of string parameters 5172 * is returned in the string itself, and the other parameters exist merely 5173 * to make themselves and their types known. 5174 */ 5175 SYSCTL_NODE(_security_jail, OID_AUTO, param, CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 5176 "Jail parameters"); 5177 5178 int 5179 sysctl_jail_param(SYSCTL_HANDLER_ARGS) 5180 { 5181 int i; 5182 long l; 5183 size_t s; 5184 char numbuf[12]; 5185 5186 switch (oidp->oid_kind & CTLTYPE) 5187 { 5188 case CTLTYPE_LONG: 5189 case CTLTYPE_ULONG: 5190 l = 0; 5191 #ifdef SCTL_MASK32 5192 if (!(req->flags & SCTL_MASK32)) 5193 #endif 5194 return (SYSCTL_OUT(req, &l, sizeof(l))); 5195 case CTLTYPE_INT: 5196 case CTLTYPE_UINT: 5197 i = 0; 5198 return (SYSCTL_OUT(req, &i, sizeof(i))); 5199 case CTLTYPE_STRING: 5200 snprintf(numbuf, sizeof(numbuf), "%jd", (intmax_t)arg2); 5201 return 5202 (sysctl_handle_string(oidp, numbuf, sizeof(numbuf), req)); 5203 case CTLTYPE_STRUCT: 5204 s = (size_t)arg2; 5205 return (SYSCTL_OUT(req, &s, sizeof(s))); 5206 } 5207 return (0); 5208 } 5209 5210 /* 5211 * CTLFLAG_RDTUN in the following indicates jail parameters that can be set at 5212 * jail creation time but cannot be changed in an existing jail. 5213 */ 5214 SYSCTL_JAIL_PARAM(, jid, CTLTYPE_INT | CTLFLAG_RDTUN, "I", "Jail ID"); 5215 SYSCTL_JAIL_PARAM(, parent, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail parent ID"); 5216 SYSCTL_JAIL_PARAM_STRING(, name, CTLFLAG_RW, MAXHOSTNAMELEN, "Jail name"); 5217 SYSCTL_JAIL_PARAM_STRING(, path, CTLFLAG_RDTUN, MAXPATHLEN, "Jail root path"); 5218 SYSCTL_JAIL_PARAM(, securelevel, CTLTYPE_INT | CTLFLAG_RW, 5219 "I", "Jail secure level"); 5220 SYSCTL_JAIL_PARAM(, osreldate, CTLTYPE_INT | CTLFLAG_RDTUN, "I", 5221 "Jail value for kern.osreldate and uname -K"); 5222 SYSCTL_JAIL_PARAM_STRING(, osrelease, CTLFLAG_RDTUN, OSRELEASELEN, 5223 "Jail value for kern.osrelease and uname -r"); 5224 SYSCTL_JAIL_PARAM(, enforce_statfs, CTLTYPE_INT | CTLFLAG_RW, 5225 "I", "Jail cannot see all mounted file systems"); 5226 SYSCTL_JAIL_PARAM(, devfs_ruleset, CTLTYPE_INT | CTLFLAG_RW, 5227 "I", "Ruleset for in-jail devfs mounts"); 5228 SYSCTL_JAIL_PARAM(, persist, CTLTYPE_INT | CTLFLAG_RW, 5229 "B", "Jail persistence"); 5230 #ifdef VIMAGE 5231 SYSCTL_JAIL_PARAM(, vnet, CTLTYPE_INT | CTLFLAG_RDTUN, 5232 "E,jailsys", "Virtual network stack"); 5233 #endif 5234 SYSCTL_JAIL_PARAM(, dying, CTLTYPE_INT | CTLFLAG_RD, 5235 "B", "Jail is in the process of shutting down"); 5236 5237 SYSCTL_JAIL_PARAM_NODE(children, "Number of child jails"); 5238 SYSCTL_JAIL_PARAM(_children, cur, CTLTYPE_INT | CTLFLAG_RD, 5239 "I", "Current number of child jails"); 5240 SYSCTL_JAIL_PARAM(_children, max, CTLTYPE_INT | CTLFLAG_RW, 5241 "I", "Maximum number of child jails"); 5242 5243 SYSCTL_JAIL_PARAM_SYS_NODE(host, CTLFLAG_RW, "Jail host info"); 5244 SYSCTL_JAIL_PARAM_STRING(_host, hostname, CTLFLAG_RW, MAXHOSTNAMELEN, 5245 "Jail hostname"); 5246 SYSCTL_JAIL_PARAM_STRING(_host, domainname, CTLFLAG_RW, MAXHOSTNAMELEN, 5247 "Jail NIS domainname"); 5248 SYSCTL_JAIL_PARAM_STRING(_host, hostuuid, CTLFLAG_RW, HOSTUUIDLEN, 5249 "Jail host UUID"); 5250 SYSCTL_JAIL_PARAM(_host, hostid, CTLTYPE_ULONG | CTLFLAG_RW, 5251 "LU", "Jail host ID"); 5252 5253 SYSCTL_JAIL_PARAM_NODE(cpuset, "Jail cpuset"); 5254 SYSCTL_JAIL_PARAM(_cpuset, id, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail cpuset ID"); 5255 5256 #ifdef MAC 5257 SYSCTL_JAIL_PARAM_STRUCT(_mac, label, CTLFLAG_RW, sizeof(struct mac), 5258 "S,mac", "Jail MAC label"); 5259 #endif 5260 5261 #ifdef INET 5262 SYSCTL_JAIL_PARAM_SYS_NODE(ip4, CTLFLAG_RDTUN, 5263 "Jail IPv4 address virtualization"); 5264 SYSCTL_JAIL_PARAM_STRUCT(_ip4, addr, CTLFLAG_RW, sizeof(struct in_addr), 5265 "S,in_addr,a", "Jail IPv4 addresses"); 5266 SYSCTL_JAIL_PARAM(_ip4, saddrsel, CTLTYPE_INT | CTLFLAG_RW, 5267 "B", "Do (not) use IPv4 source address selection rather than the " 5268 "primary jail IPv4 address."); 5269 #endif 5270 #ifdef INET6 5271 SYSCTL_JAIL_PARAM_SYS_NODE(ip6, CTLFLAG_RDTUN, 5272 "Jail IPv6 address virtualization"); 5273 SYSCTL_JAIL_PARAM_STRUCT(_ip6, addr, CTLFLAG_RW, sizeof(struct in6_addr), 5274 "S,in6_addr,a", "Jail IPv6 addresses"); 5275 SYSCTL_JAIL_PARAM(_ip6, saddrsel, CTLTYPE_INT | CTLFLAG_RW, 5276 "B", "Do (not) use IPv6 source address selection rather than the " 5277 "primary jail IPv6 address."); 5278 #endif 5279 5280 SYSCTL_JAIL_PARAM_NODE(allow, "Jail permission flags"); 5281 SYSCTL_JAIL_PARAM(_allow, set_hostname, CTLTYPE_INT | CTLFLAG_RW, 5282 "B", "Jail may set hostname"); 5283 SYSCTL_JAIL_PARAM(_allow, sysvipc, CTLTYPE_INT | CTLFLAG_RW, 5284 "B", "Jail may use SYSV IPC"); 5285 SYSCTL_JAIL_PARAM(_allow, raw_sockets, CTLTYPE_INT | CTLFLAG_RW, 5286 "B", "Jail may create raw sockets"); 5287 SYSCTL_JAIL_PARAM(_allow, chflags, CTLTYPE_INT | CTLFLAG_RW, 5288 "B", "Jail may alter system file flags"); 5289 SYSCTL_JAIL_PARAM(_allow, quotas, CTLTYPE_INT | CTLFLAG_RW, 5290 "B", "Jail may set file quotas"); 5291 SYSCTL_JAIL_PARAM(_allow, socket_af, CTLTYPE_INT | CTLFLAG_RW, 5292 "B", "Jail may create sockets other than just UNIX/IPv4/IPv6/route"); 5293 SYSCTL_JAIL_PARAM(_allow, mlock, CTLTYPE_INT | CTLFLAG_RW, 5294 "B", "Jail may lock (unlock) physical pages in memory"); 5295 SYSCTL_JAIL_PARAM(_allow, reserved_ports, CTLTYPE_INT | CTLFLAG_RW, 5296 "B", "Jail may bind sockets to reserved ports"); 5297 SYSCTL_JAIL_PARAM(_allow, read_msgbuf, CTLTYPE_INT | CTLFLAG_RW, 5298 "B", "Jail may read the kernel message buffer"); 5299 SYSCTL_JAIL_PARAM(_allow, unprivileged_proc_debug, CTLTYPE_INT | CTLFLAG_RW, 5300 "B", "Unprivileged processes may use process debugging facilities"); 5301 SYSCTL_JAIL_PARAM(_allow, unprivileged_parent_tampering, 5302 CTLTYPE_INT | CTLFLAG_RW, "B", 5303 "Unprivileged parent jail processes may tamper with same-uid processes" 5304 " (signal/debug/cpuset)"); 5305 SYSCTL_JAIL_PARAM(_allow, suser, CTLTYPE_INT | CTLFLAG_RW, 5306 "B", "Processes in jail with uid 0 have privilege"); 5307 #ifdef VIMAGE 5308 SYSCTL_JAIL_PARAM(_allow, nfsd, CTLTYPE_INT | CTLFLAG_RW, 5309 "B", "Mountd/nfsd may run in the jail"); 5310 #endif 5311 SYSCTL_JAIL_PARAM(_allow, extattr, CTLTYPE_INT | CTLFLAG_RW, 5312 "B", "Jail may set system-level filesystem extended attributes"); 5313 SYSCTL_JAIL_PARAM(_allow, adjtime, CTLTYPE_INT | CTLFLAG_RW, 5314 "B", "Jail may adjust system time"); 5315 SYSCTL_JAIL_PARAM(_allow, settime, CTLTYPE_INT | CTLFLAG_RW, 5316 "B", "Jail may set system time"); 5317 SYSCTL_JAIL_PARAM(_allow, routing, CTLTYPE_INT | CTLFLAG_RW, 5318 "B", "Jail may modify routing table"); 5319 #ifdef AUDIT 5320 SYSCTL_JAIL_PARAM(_allow, setaudit, CTLTYPE_INT | CTLFLAG_RW, 5321 "B", "Jail may set and get audit session state"); 5322 #endif 5323 5324 SYSCTL_JAIL_PARAM_SUBNODE(allow, mount, "Jail mount/unmount permission flags"); 5325 SYSCTL_JAIL_PARAM(_allow_mount, , CTLTYPE_INT | CTLFLAG_RW, 5326 "B", "Jail may mount/unmount jail-friendly file systems in general"); 5327 5328 /* 5329 * Add a dynamic parameter allow.<name>, or allow.<prefix>.<name>. Return 5330 * its associated bit in the pr_allow bitmask, or zero if the parameter was 5331 * not created. 5332 */ 5333 unsigned 5334 prison_add_allow(const char *prefix, const char *name, const char *prefix_descr, 5335 const char *descr) 5336 { 5337 struct bool_flags *bf; 5338 struct sysctl_oid *parent; 5339 char *allow_name, *allow_noname, *allowed; 5340 #ifndef NO_SYSCTL_DESCR 5341 char *descr_deprecated; 5342 #endif 5343 u_int allow_flag; 5344 5345 if (prefix 5346 ? asprintf(&allow_name, M_PRISON, "allow.%s.%s", prefix, name) 5347 < 0 || 5348 asprintf(&allow_noname, M_PRISON, "allow.%s.no%s", prefix, name) 5349 < 0 5350 : asprintf(&allow_name, M_PRISON, "allow.%s", name) < 0 || 5351 asprintf(&allow_noname, M_PRISON, "allow.no%s", name) < 0) { 5352 free(allow_name, M_PRISON); 5353 return 0; 5354 } 5355 5356 /* 5357 * See if this parameter has already beed added, i.e. a module was 5358 * previously loaded/unloaded. 5359 */ 5360 mtx_lock(&prison0.pr_mtx); 5361 for (bf = pr_flag_allow; 5362 bf < pr_flag_allow + nitems(pr_flag_allow) && 5363 atomic_load_int(&bf->flag) != 0; 5364 bf++) { 5365 if (strcmp(bf->name, allow_name) == 0) { 5366 allow_flag = bf->flag; 5367 goto no_add; 5368 } 5369 } 5370 5371 /* 5372 * Find a free bit in pr_allow_all, failing if there are none 5373 * (which shouldn't happen as long as we keep track of how many 5374 * potential dynamic flags exist). 5375 */ 5376 for (allow_flag = 1;; allow_flag <<= 1) { 5377 if (allow_flag == 0) 5378 goto no_add; 5379 if ((pr_allow_all & allow_flag) == 0) 5380 break; 5381 } 5382 5383 /* Note the parameter in the next open slot in pr_flag_allow. */ 5384 for (bf = pr_flag_allow; ; bf++) { 5385 if (bf == pr_flag_allow + nitems(pr_flag_allow)) { 5386 /* This should never happen, but is not fatal. */ 5387 allow_flag = 0; 5388 goto no_add; 5389 } 5390 if (atomic_load_int(&bf->flag) == 0) 5391 break; 5392 } 5393 bf->name = allow_name; 5394 bf->noname = allow_noname; 5395 pr_allow_all |= allow_flag; 5396 /* 5397 * prison0 always has permission for the new parameter. 5398 * Other jails must have it granted to them. 5399 */ 5400 prison0.pr_allow |= allow_flag; 5401 /* The flag indicates a valid entry, so make sure it is set last. */ 5402 atomic_store_rel_int(&bf->flag, allow_flag); 5403 mtx_unlock(&prison0.pr_mtx); 5404 5405 /* 5406 * Create sysctls for the parameter, and the back-compat global 5407 * permission. 5408 */ 5409 parent = prefix 5410 ? SYSCTL_ADD_NODE(NULL, 5411 SYSCTL_CHILDREN(&sysctl___security_jail_param_allow), 5412 OID_AUTO, prefix, CTLFLAG_MPSAFE, 0, prefix_descr) 5413 : &sysctl___security_jail_param_allow; 5414 (void)SYSCTL_ADD_PROC(NULL, SYSCTL_CHILDREN(parent), OID_AUTO, 5415 name, CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 5416 NULL, 0, sysctl_jail_param, "B", descr); 5417 if ((prefix 5418 ? asprintf(&allowed, M_TEMP, "%s_%s_allowed", prefix, name) 5419 : asprintf(&allowed, M_TEMP, "%s_allowed", name)) >= 0) { 5420 #ifndef NO_SYSCTL_DESCR 5421 (void)asprintf(&descr_deprecated, M_TEMP, "%s (deprecated)", 5422 descr); 5423 #endif 5424 (void)SYSCTL_ADD_PROC(NULL, 5425 SYSCTL_CHILDREN(&sysctl___security_jail), OID_AUTO, allowed, 5426 CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, allow_flag, 5427 sysctl_jail_default_allow, "I", descr_deprecated); 5428 #ifndef NO_SYSCTL_DESCR 5429 free(descr_deprecated, M_TEMP); 5430 #endif 5431 free(allowed, M_TEMP); 5432 } 5433 return allow_flag; 5434 5435 no_add: 5436 mtx_unlock(&prison0.pr_mtx); 5437 free(allow_name, M_PRISON); 5438 free(allow_noname, M_PRISON); 5439 return allow_flag; 5440 } 5441 5442 /* 5443 * The VFS system will register jail-aware filesystems here. They each get 5444 * a parameter allow.mount.xxxfs and a flag to check when a jailed user 5445 * attempts to mount. 5446 */ 5447 void 5448 prison_add_vfs(struct vfsconf *vfsp) 5449 { 5450 #ifdef NO_SYSCTL_DESCR 5451 5452 vfsp->vfc_prison_flag = prison_add_allow("mount", vfsp->vfc_name, 5453 NULL, NULL); 5454 #else 5455 char *descr; 5456 5457 (void)asprintf(&descr, M_TEMP, "Jail may mount the %s file system", 5458 vfsp->vfc_name); 5459 vfsp->vfc_prison_flag = prison_add_allow("mount", vfsp->vfc_name, 5460 NULL, descr); 5461 free(descr, M_TEMP); 5462 #endif 5463 } 5464 5465 #ifdef RACCT 5466 void 5467 prison_racct_foreach(void (*callback)(struct racct *racct, 5468 void *arg2, void *arg3), void (*pre)(void), void (*post)(void), 5469 void *arg2, void *arg3) 5470 { 5471 struct prison_racct *prr; 5472 5473 ASSERT_RACCT_ENABLED(); 5474 5475 sx_slock(&allprison_lock); 5476 if (pre != NULL) 5477 (pre)(); 5478 LIST_FOREACH(prr, &allprison_racct, prr_next) 5479 (callback)(prr->prr_racct, arg2, arg3); 5480 if (post != NULL) 5481 (post)(); 5482 sx_sunlock(&allprison_lock); 5483 } 5484 5485 static struct prison_racct * 5486 prison_racct_find_locked(const char *name) 5487 { 5488 struct prison_racct *prr; 5489 5490 ASSERT_RACCT_ENABLED(); 5491 sx_assert(&allprison_lock, SA_XLOCKED); 5492 5493 if (name[0] == '\0' || strlen(name) >= MAXHOSTNAMELEN) 5494 return (NULL); 5495 5496 LIST_FOREACH(prr, &allprison_racct, prr_next) { 5497 if (strcmp(name, prr->prr_name) != 0) 5498 continue; 5499 5500 /* Found prison_racct with a matching name? */ 5501 prison_racct_hold(prr); 5502 return (prr); 5503 } 5504 5505 /* Add new prison_racct. */ 5506 prr = malloc(sizeof(*prr), M_PRISON_RACCT, M_ZERO | M_WAITOK); 5507 racct_create(&prr->prr_racct); 5508 5509 strcpy(prr->prr_name, name); 5510 refcount_init(&prr->prr_refcount, 1); 5511 LIST_INSERT_HEAD(&allprison_racct, prr, prr_next); 5512 5513 return (prr); 5514 } 5515 5516 struct prison_racct * 5517 prison_racct_find(const char *name) 5518 { 5519 struct prison_racct *prr; 5520 5521 ASSERT_RACCT_ENABLED(); 5522 5523 sx_xlock(&allprison_lock); 5524 prr = prison_racct_find_locked(name); 5525 sx_xunlock(&allprison_lock); 5526 return (prr); 5527 } 5528 5529 void 5530 prison_racct_hold(struct prison_racct *prr) 5531 { 5532 5533 ASSERT_RACCT_ENABLED(); 5534 5535 refcount_acquire(&prr->prr_refcount); 5536 } 5537 5538 static void 5539 prison_racct_free_locked(struct prison_racct *prr) 5540 { 5541 5542 ASSERT_RACCT_ENABLED(); 5543 sx_assert(&allprison_lock, SA_XLOCKED); 5544 5545 if (refcount_release(&prr->prr_refcount)) { 5546 racct_destroy(&prr->prr_racct); 5547 LIST_REMOVE(prr, prr_next); 5548 free(prr, M_PRISON_RACCT); 5549 } 5550 } 5551 5552 void 5553 prison_racct_free(struct prison_racct *prr) 5554 { 5555 5556 ASSERT_RACCT_ENABLED(); 5557 sx_assert(&allprison_lock, SA_UNLOCKED); 5558 5559 if (refcount_release_if_not_last(&prr->prr_refcount)) 5560 return; 5561 5562 sx_xlock(&allprison_lock); 5563 prison_racct_free_locked(prr); 5564 sx_xunlock(&allprison_lock); 5565 } 5566 5567 static void 5568 prison_racct_attach(struct prison *pr) 5569 { 5570 struct prison_racct *prr; 5571 5572 ASSERT_RACCT_ENABLED(); 5573 sx_assert(&allprison_lock, SA_XLOCKED); 5574 5575 prr = prison_racct_find_locked(pr->pr_name); 5576 KASSERT(prr != NULL, ("cannot find prison_racct")); 5577 5578 pr->pr_prison_racct = prr; 5579 } 5580 5581 /* 5582 * Handle jail renaming. From the racct point of view, renaming means 5583 * moving from one prison_racct to another. 5584 */ 5585 static void 5586 prison_racct_modify(struct prison *pr) 5587 { 5588 #ifdef RCTL 5589 struct proc *p; 5590 struct ucred *cred; 5591 #endif 5592 struct prison_racct *oldprr; 5593 5594 ASSERT_RACCT_ENABLED(); 5595 5596 sx_slock(&allproc_lock); 5597 sx_xlock(&allprison_lock); 5598 5599 if (strcmp(pr->pr_name, pr->pr_prison_racct->prr_name) == 0) { 5600 sx_xunlock(&allprison_lock); 5601 sx_sunlock(&allproc_lock); 5602 return; 5603 } 5604 5605 oldprr = pr->pr_prison_racct; 5606 pr->pr_prison_racct = NULL; 5607 5608 prison_racct_attach(pr); 5609 5610 /* 5611 * Move resource utilisation records. 5612 */ 5613 racct_move(pr->pr_prison_racct->prr_racct, oldprr->prr_racct); 5614 5615 #ifdef RCTL 5616 /* 5617 * Force rctl to reattach rules to processes. 5618 */ 5619 FOREACH_PROC_IN_SYSTEM(p) { 5620 PROC_LOCK(p); 5621 cred = crhold(p->p_ucred); 5622 PROC_UNLOCK(p); 5623 rctl_proc_ucred_changed(p, cred); 5624 crfree(cred); 5625 } 5626 #endif 5627 5628 sx_sunlock(&allproc_lock); 5629 prison_racct_free_locked(oldprr); 5630 sx_xunlock(&allprison_lock); 5631 } 5632 5633 static void 5634 prison_racct_detach(struct prison *pr) 5635 { 5636 5637 ASSERT_RACCT_ENABLED(); 5638 sx_assert(&allprison_lock, SA_UNLOCKED); 5639 5640 if (pr->pr_prison_racct == NULL) 5641 return; 5642 prison_racct_free(pr->pr_prison_racct); 5643 pr->pr_prison_racct = NULL; 5644 } 5645 #endif /* RACCT */ 5646 5647 /* 5648 * Submit a knote for a prison, locking if necessary. 5649 */ 5650 static void 5651 prison_knote(struct prison *pr, long hint) 5652 { 5653 int locked; 5654 5655 locked = mtx_owned(&pr->pr_mtx); 5656 if (!locked) 5657 mtx_lock(&pr->pr_mtx); 5658 KNOTE_LOCKED(pr->pr_klist, hint); 5659 jaildesc_knote(pr, hint); 5660 if (!locked) 5661 mtx_unlock(&pr->pr_mtx); 5662 } 5663 5664 #ifdef DDB 5665 5666 static void 5667 db_show_prison(struct prison *pr) 5668 { 5669 struct bool_flags *bf; 5670 struct jailsys_flags *jsf; 5671 #if defined(INET) || defined(INET6) 5672 int ii; 5673 struct prison_ip *pip; 5674 #endif 5675 unsigned f; 5676 #ifdef INET 5677 char ip4buf[INET_ADDRSTRLEN]; 5678 #endif 5679 #ifdef INET6 5680 char ip6buf[INET6_ADDRSTRLEN]; 5681 #endif 5682 5683 db_printf("prison %p:\n", pr); 5684 db_printf(" jid = %d\n", pr->pr_id); 5685 db_printf(" name = %s\n", pr->pr_name); 5686 db_printf(" parent = %p\n", pr->pr_parent); 5687 db_printf(" ref = %d\n", pr->pr_ref); 5688 db_printf(" uref = %d\n", pr->pr_uref); 5689 db_printf(" state = %s\n", 5690 pr->pr_state == PRISON_STATE_ALIVE ? "alive" : 5691 pr->pr_state == PRISON_STATE_DYING ? "dying" : 5692 "invalid"); 5693 db_printf(" path = %s\n", pr->pr_path); 5694 db_printf(" cpuset = %d\n", pr->pr_cpuset 5695 ? pr->pr_cpuset->cs_id : -1); 5696 #ifdef VIMAGE 5697 db_printf(" vnet = %p\n", pr->pr_vnet); 5698 #endif 5699 db_printf(" root = %p\n", pr->pr_root); 5700 db_printf(" securelevel = %d\n", pr->pr_securelevel); 5701 db_printf(" devfs_rsnum = %d\n", pr->pr_devfs_rsnum); 5702 db_printf(" children.max = %d\n", pr->pr_childmax); 5703 db_printf(" children.cur = %d\n", pr->pr_childcount); 5704 db_printf(" child = %p\n", LIST_FIRST(&pr->pr_children)); 5705 db_printf(" sibling = %p\n", LIST_NEXT(pr, pr_sibling)); 5706 db_printf(" flags = 0x%x", pr->pr_flags); 5707 for (bf = pr_flag_bool; bf < pr_flag_bool + nitems(pr_flag_bool); bf++) 5708 if (pr->pr_flags & bf->flag) 5709 db_printf(" %s", bf->name); 5710 for (jsf = pr_flag_jailsys; 5711 jsf < pr_flag_jailsys + nitems(pr_flag_jailsys); 5712 jsf++) { 5713 f = pr->pr_flags & (jsf->disable | jsf->new); 5714 db_printf(" %-16s= %s\n", jsf->name, 5715 (f != 0 && f == jsf->disable) ? "disable" 5716 : (f == jsf->new) ? "new" 5717 : "inherit"); 5718 } 5719 db_printf(" allow = 0x%x", pr->pr_allow); 5720 for (bf = pr_flag_allow; 5721 bf < pr_flag_allow + nitems(pr_flag_allow) && 5722 atomic_load_int(&bf->flag) != 0; 5723 bf++) 5724 if (pr->pr_allow & bf->flag) 5725 db_printf(" %s", bf->name); 5726 db_printf("\n"); 5727 db_printf(" enforce_statfs = %d\n", pr->pr_enforce_statfs); 5728 db_printf(" host.hostname = %s\n", pr->pr_hostname); 5729 db_printf(" host.domainname = %s\n", pr->pr_domainname); 5730 db_printf(" host.hostuuid = %s\n", pr->pr_hostuuid); 5731 db_printf(" host.hostid = %lu\n", pr->pr_hostid); 5732 #ifdef INET 5733 if ((pip = pr->pr_addrs[PR_INET]) != NULL) { 5734 db_printf(" ip4s = %d\n", pip->ips); 5735 for (ii = 0; ii < pip->ips; ii++) 5736 db_printf(" %s %s\n", 5737 ii == 0 ? "ip4.addr =" : " ", 5738 inet_ntoa_r( 5739 *(const struct in_addr *)PR_IP(pip, PR_INET, ii), 5740 ip4buf)); 5741 } 5742 #endif 5743 #ifdef INET6 5744 if ((pip = pr->pr_addrs[PR_INET6]) != NULL) { 5745 db_printf(" ip6s = %d\n", pip->ips); 5746 for (ii = 0; ii < pip->ips; ii++) 5747 db_printf(" %s %s\n", 5748 ii == 0 ? "ip6.addr =" : " ", 5749 ip6_sprintf(ip6buf, 5750 (const struct in6_addr *)PR_IP(pip, PR_INET6, ii))); 5751 } 5752 #endif 5753 } 5754 5755 DB_SHOW_COMMAND(prison, db_show_prison_command) 5756 { 5757 struct prison *pr; 5758 5759 if (!have_addr) { 5760 /* 5761 * Show all prisons in the list, and prison0 which is not 5762 * listed. 5763 */ 5764 db_show_prison(&prison0); 5765 if (!db_pager_quit) { 5766 TAILQ_FOREACH(pr, &allprison, pr_list) { 5767 db_show_prison(pr); 5768 if (db_pager_quit) 5769 break; 5770 } 5771 } 5772 return; 5773 } 5774 5775 if (addr == 0) 5776 pr = &prison0; 5777 else { 5778 /* Look for a prison with the ID and with references. */ 5779 TAILQ_FOREACH(pr, &allprison, pr_list) 5780 if (pr->pr_id == addr && pr->pr_ref > 0) 5781 break; 5782 if (pr == NULL) 5783 /* Look again, without requiring a reference. */ 5784 TAILQ_FOREACH(pr, &allprison, pr_list) 5785 if (pr->pr_id == addr) 5786 break; 5787 if (pr == NULL) 5788 /* Assume address points to a valid prison. */ 5789 pr = (struct prison *)addr; 5790 } 5791 db_show_prison(pr); 5792 } 5793 5794 #endif /* DDB */ 5795