xref: /freebsd/lib/libjail/jail.c (revision 4f1f4356f3012928b463f9ef1710fb908e48b1e2)
1 /*-
2  * Copyright (c) 2009 James Gritton.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  */
26 
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29 
30 #include <sys/param.h>
31 #include <sys/types.h>
32 #include <sys/jail.h>
33 #include <sys/socket.h>
34 #include <sys/sysctl.h>
35 
36 #include <arpa/inet.h>
37 #include <netinet/in.h>
38 
39 #include <errno.h>
40 #include <inttypes.h>
41 #include <stdio.h>
42 #include <stdarg.h>
43 #include <stdlib.h>
44 #include <string.h>
45 
46 #include "jail.h"
47 
48 #define	SJPARAM		"security.jail.param"
49 
50 #define JPS_IN_ADDR	1
51 #define JPS_IN6_ADDR	2
52 
53 #define ARRAY_SANITY	5
54 #define ARRAY_SLOP	5
55 
56 
57 static int jailparam_import_enum(const char **values, int nvalues,
58     const char *valstr, size_t valsize, int *value);
59 static int jailparam_type(struct jailparam *jp);
60 static char *noname(const char *name);
61 static char *nononame(const char *name);
62 
63 char jail_errmsg[JAIL_ERRMSGLEN];
64 
65 static const char *bool_values[] = { "false", "true" };
66 static const char *jailsys_values[] = { "disable", "new", "inherit" };
67 
68 
69 /*
70  * Import a null-terminated parameter list and set a jail with the flags
71  * and parameters.
72  */
73 int
74 jail_setv(int flags, ...)
75 {
76 	va_list ap, tap;
77 	struct jailparam *jp;
78 	const char *name, *value;
79 	int njp, jid;
80 
81 	/* Create the parameter list and import the parameters. */
82 	va_start(ap, flags);
83 	va_copy(tap, ap);
84 	for (njp = 0; va_arg(tap, char *) != NULL; njp++)
85 		(void)va_arg(tap, char *);
86 	va_end(tap);
87 	jp = alloca(njp * sizeof(struct jailparam));
88 	for (njp = 0; (name = va_arg(ap, char *)) != NULL; njp++) {
89 		value = va_arg(ap, char *);
90 		if (jailparam_init(jp + njp, name) < 0 ||
91 		    jailparam_import(jp + njp, value) < 0) {
92 			jailparam_free(jp, njp);
93 			va_end(ap);
94 			return (-1);
95 		}
96 	}
97 	va_end(ap);
98 	jid = jailparam_set(jp, njp, flags);
99 	jailparam_free(jp, njp);
100 	return (jid);
101 }
102 
103 /*
104  * Read a null-terminated parameter list, get the referenced jail, and export
105  * the parameters to the list.
106  */
107 int
108 jail_getv(int flags, ...)
109 {
110 	va_list ap, tap;
111 	struct jailparam *jp, *jp_lastjid, *jp_jid, *jp_name, *jp_key;
112 	char *valarg, *value;
113 	const char *name, *key_value, *lastjid_value, *jid_value, *name_value;
114 	int njp, i, jid;
115 
116 	/* Create the parameter list and find the key. */
117 	va_start(ap, flags);
118 	va_copy(tap, ap);
119 	for (njp = 0; va_arg(tap, char *) != NULL; njp++)
120 		(void)va_arg(tap, char *);
121 	va_end(tap);
122 
123 	jp = alloca(njp * sizeof(struct jailparam));
124 	va_copy(tap, ap);
125 	jp_lastjid = jp_jid = jp_name = NULL;
126 	lastjid_value = jid_value = name_value = NULL;
127 	for (njp = 0; (name = va_arg(tap, char *)) != NULL; njp++) {
128 		value = va_arg(tap, char *);
129 		if (jailparam_init(jp + njp, name) < 0) {
130 			va_end(tap);
131 			goto error;
132 		}
133 		if (!strcmp(jp[njp].jp_name, "lastjid")) {
134 			jp_lastjid = jp + njp;
135 			lastjid_value = value;
136 		} else if (!strcmp(jp[njp].jp_name, "jid")) {
137 			jp_jid = jp + njp;
138 			jid_value = value;
139 		} if (!strcmp(jp[njp].jp_name, "name")) {
140 			jp_name = jp + njp;
141 			name_value = value;
142 		}
143 	}
144 	va_end(tap);
145 	/* Import the key parameter. */
146 	if (jp_lastjid != NULL) {
147 		jp_key = jp_lastjid;
148 		key_value = lastjid_value;
149 	} else if (jp_jid != NULL && strtol(jid_value, NULL, 10) != 0) {
150 		jp_key = jp_jid;
151 		key_value = jid_value;
152 	} else if (jp_name != NULL) {
153 		jp_key = jp_name;
154 		key_value = name_value;
155 	} else {
156 		strlcpy(jail_errmsg, "no jail specified", JAIL_ERRMSGLEN);
157 		errno = ENOENT;
158 		goto error;
159 	}
160 	if (jailparam_import(jp_key, key_value) < 0)
161 		goto error;
162 	/* Get the jail and export the parameters. */
163 	jid = jailparam_get(jp, njp, flags);
164 	if (jid < 0)
165 		goto error;
166 	for (i = 0; i < njp; i++) {
167 		(void)va_arg(ap, char *);
168 		valarg = va_arg(ap, char *);
169 		if (jp + i != jp_key) {
170 			/* It's up to the caller to ensure there's room. */
171 			if ((jp[i].jp_ctltype & CTLTYPE) == CTLTYPE_STRING)
172 				strcpy(valarg, jp[i].jp_value);
173 			else {
174 				value = jailparam_export(jp + i);
175 				if (value == NULL)
176 					goto error;
177 				strcpy(valarg, value);
178 				free(value);
179 			}
180 		}
181 	}
182 	jailparam_free(jp, njp);
183 	va_end(ap);
184 	return (jid);
185 
186  error:
187 	jailparam_free(jp, njp);
188 	va_end(ap);
189 	return (-1);
190 }
191 
192 /*
193  * Return a list of all known parameters.
194  */
195 int
196 jailparam_all(struct jailparam **jpp)
197 {
198 	struct jailparam *jp;
199 	size_t mlen1, mlen2, buflen;
200 	int njp, nlist;
201 	int mib1[CTL_MAXNAME], mib2[CTL_MAXNAME - 2];
202 	char buf[MAXPATHLEN];
203 
204 	njp = 0;
205 	nlist = 32;
206 	jp = malloc(nlist * sizeof(*jp));
207 	if (jp == NULL) {
208 		strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
209 		return (-1);
210 	}
211 	mib1[0] = 0;
212 	mib1[1] = 2;
213 	mlen1 = CTL_MAXNAME - 2;
214 	if (sysctlnametomib(SJPARAM, mib1 + 2, &mlen1) < 0) {
215 		snprintf(jail_errmsg, JAIL_ERRMSGLEN,
216 		    "sysctlnametomib(" SJPARAM "): %s", strerror(errno));
217 		goto error;
218 	}
219 	for (;; njp++) {
220 		/* Get the next parameter. */
221 		mlen2 = sizeof(mib2);
222 		if (sysctl(mib1, mlen1 + 2, mib2, &mlen2, NULL, 0) < 0) {
223 			snprintf(jail_errmsg, JAIL_ERRMSGLEN,
224 			    "sysctl(0.2): %s", strerror(errno));
225 			goto error;
226 		}
227 		if (mib2[0] != mib1[2] || mib2[1] != mib1[3] ||
228 		    mib2[2] != mib1[4])
229 			break;
230 		/* Convert it to an ascii name. */
231 		memcpy(mib1 + 2, mib2, mlen2);
232 		mlen1 = mlen2 / sizeof(int);
233 		mib1[1] = 1;
234 		buflen = sizeof(buf);
235 		if (sysctl(mib1, mlen1 + 2, buf, &buflen, NULL, 0) < 0) {
236 			snprintf(jail_errmsg, JAIL_ERRMSGLEN,
237 			    "sysctl(0.1): %s", strerror(errno));
238 			goto error;
239 		}
240 		if (buf[buflen - 2] == '.')
241 			buf[buflen - 2] = '\0';
242 		/* Add the parameter to the list */
243 		if (njp >= nlist) {
244 			nlist *= 2;
245 			jp = realloc(jp, nlist * sizeof(*jp));
246 			if (jp == NULL) {
247 				jailparam_free(jp, njp);
248 				return (-1);
249 			}
250 		}
251 		if (jailparam_init(jp + njp, buf + sizeof(SJPARAM)) < 0)
252 			goto error;
253 		if (jailparam_type(jp + njp) < 0) {
254 			njp++;
255 			goto error;
256 		}
257 		mib1[1] = 2;
258 	}
259 	jp = realloc(jp, njp * sizeof(*jp));
260 	*jpp = jp;
261 	return (njp);
262 
263  error:
264 	jailparam_free(jp, njp);
265 	free(jp);
266 	return (-1);
267 }
268 
269 /*
270  * Clear a jail parameter and copy in its name.
271  */
272 int
273 jailparam_init(struct jailparam *jp, const char *name)
274 {
275 
276 	memset(jp, 0, sizeof(*jp));
277 	jp->jp_name = strdup(name);
278 	if (jp->jp_name == NULL) {
279 		strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
280 		return (-1);
281 	}
282 	return (0);
283 }
284 
285 /*
286  * Put a name and value into a jail parameter element, converting the value
287  * to internal form.
288  */
289 int
290 jailparam_import(struct jailparam *jp, const char *value)
291 {
292 	char *p, *ep, *tvalue;
293 	const char *avalue;
294 	int i, nval, fw;
295 
296 	if (!jp->jp_ctltype && jailparam_type(jp) < 0)
297 		return (-1);
298 	if (value == NULL)
299 		return (0);
300 	if ((jp->jp_ctltype & CTLTYPE) == CTLTYPE_STRING) {
301 		jp->jp_value = strdup(value);
302 		if (jp->jp_value == NULL) {
303 			strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
304 			return (-1);
305 		}
306 		return (0);
307 	}
308 	nval = 1;
309 	if (jp->jp_elemlen) {
310 		if (value[0] == '\0' || (value[0] == '-' && value[1] == '\0')) {
311 			jp->jp_value = strdup("");
312 			if (jp->jp_value == NULL) {
313 				strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
314 				return (-1);
315 			}
316 			jp->jp_valuelen = 0;
317 			return (0);
318 		}
319 		for (p = strchr(value, ','); p; p = strchr(p + 1, ','))
320 			nval++;
321 		jp->jp_valuelen = jp->jp_elemlen * nval;
322 	}
323 	jp->jp_value = malloc(jp->jp_valuelen);
324 	if (jp->jp_value == NULL) {
325 		strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
326 		return (-1);
327 	}
328 	avalue = value;
329 	for (i = 0; i < nval; i++) {
330 		fw = nval == 1 ? strlen(avalue) : strcspn(avalue, ",");
331 		switch (jp->jp_ctltype & CTLTYPE) {
332 		case CTLTYPE_INT:
333 			if (jp->jp_flags & (JP_BOOL | JP_NOBOOL)) {
334 				if (!jailparam_import_enum(bool_values, 2,
335 				    avalue, fw, &((int *)jp->jp_value)[i])) {
336 					snprintf(jail_errmsg,
337 					    JAIL_ERRMSGLEN, "%s: "
338 					    "unknown boolean value \"%.*s\"",
339 					    jp->jp_name, fw, avalue);
340 					errno = EINVAL;
341 					goto error;
342 				}
343 				break;
344 			}
345 			if (jp->jp_flags & JP_JAILSYS) {
346 				/*
347 				 * Allow setting a jailsys parameter to "new"
348 				 * in a booleanesque fashion.
349 				 */
350 				if (value[0] == '\0')
351 					((int *)jp->jp_value)[i] = JAIL_SYS_NEW;
352 				else if (!jailparam_import_enum(jailsys_values,
353 				    sizeof(jailsys_values) /
354 				    sizeof(jailsys_values[0]), avalue, fw,
355 				    &((int *)jp->jp_value)[i])) {
356 					snprintf(jail_errmsg,
357 					    JAIL_ERRMSGLEN, "%s: "
358 					    "unknown jailsys value \"%.*s\"",
359 					    jp->jp_name, fw, avalue);
360 					errno = EINVAL;
361 					goto error;
362 				}
363 				break;
364 			}
365 			((int *)jp->jp_value)[i] = strtol(avalue, &ep, 10);
366 		integer_test:
367 			if (ep != avalue + fw) {
368 				snprintf(jail_errmsg, JAIL_ERRMSGLEN,
369 				    "%s: non-integer value \"%.*s\"",
370 				    jp->jp_name, fw, avalue);
371 				errno = EINVAL;
372 				goto error;
373 			}
374 			break;
375 		case CTLTYPE_UINT:
376 			((unsigned *)jp->jp_value)[i] =
377 			    strtoul(avalue, &ep, 10);
378 			goto integer_test;
379 		case CTLTYPE_LONG:
380 			((long *)jp->jp_value)[i] = strtol(avalue, &ep, 10);
381 			goto integer_test;
382 		case CTLTYPE_ULONG:
383 			((unsigned long *)jp->jp_value)[i] =
384 			    strtoul(avalue, &ep, 10);
385 			goto integer_test;
386 		case CTLTYPE_QUAD:
387 			((int64_t *)jp->jp_value)[i] =
388 			    strtoimax(avalue, &ep, 10);
389 			goto integer_test;
390 		case CTLTYPE_STRUCT:
391 			tvalue = alloca(fw + 1);
392 			strlcpy(tvalue, avalue, fw + 1);
393 			switch (jp->jp_structtype) {
394 			case JPS_IN_ADDR:
395 				if (inet_pton(AF_INET, tvalue,
396 				    &((struct in_addr *)jp->jp_value)[i]) != 1)
397 				{
398 					snprintf(jail_errmsg,
399 					    JAIL_ERRMSGLEN,
400 					    "%s: not an IPv4 address: %s",
401 					    jp->jp_name, tvalue);
402 					errno = EINVAL;
403 					goto error;
404 				}
405 				break;
406 			case JPS_IN6_ADDR:
407 				if (inet_pton(AF_INET6, tvalue,
408 				    &((struct in6_addr *)jp->jp_value)[i]) != 1)
409 				{
410 					snprintf(jail_errmsg,
411 					    JAIL_ERRMSGLEN,
412 					    "%s: not an IPv6 address: %s",
413 					    jp->jp_name, tvalue);
414 					errno = EINVAL;
415 					goto error;
416 				}
417 				break;
418 			default:
419 				goto unknown_type;
420 			}
421 			break;
422 		default:
423 		unknown_type:
424 			snprintf(jail_errmsg, JAIL_ERRMSGLEN,
425 			    "unknown type for %s", jp->jp_name);
426 			errno = ENOENT;
427 			goto error;
428 		}
429 		avalue += fw + 1;
430 	}
431 	return (0);
432 
433  error:
434 	free(jp->jp_value);
435 	jp->jp_value = NULL;
436 	return (-1);
437 }
438 
439 static int
440 jailparam_import_enum(const char **values, int nvalues, const char *valstr,
441     size_t valsize, int *value)
442 {
443 	char *ep;
444 	int i;
445 
446 	for (i = 0; i < nvalues; i++)
447 		if (valsize == strlen(values[i]) &&
448 		    !strncasecmp(valstr, values[i], valsize)) {
449 			*value = i;
450 			return 1;
451 		}
452 	*value = strtol(valstr, &ep, 10);
453 	return (ep == valstr + valsize);
454 }
455 
456 /*
457  * Put a name and value into a jail parameter element, copying the value
458  * but not altering it.
459  */
460 int
461 jailparam_import_raw(struct jailparam *jp, void *value, size_t valuelen)
462 {
463 
464 	jp->jp_value = value;
465 	jp->jp_valuelen = valuelen;
466 	jp->jp_flags |= JP_RAWVALUE;
467 	return (0);
468 }
469 
470 /*
471  * Run the jail_set and jail_get system calls on a parameter list.
472  */
473 int
474 jailparam_set(struct jailparam *jp, unsigned njp, int flags)
475 {
476 	struct iovec *jiov;
477 	char *nname;
478 	int i, jid, bool0;
479 	unsigned j;
480 
481 	jiov = alloca(sizeof(struct iovec) * 2 * (njp + 1));
482 	bool0 = 0;
483 	for (i = j = 0; j < njp; j++) {
484 		jiov[i].iov_base = jp[j].jp_name;
485 		jiov[i].iov_len = strlen(jp[j].jp_name) + 1;
486 		i++;
487 		if (jp[j].jp_flags & (JP_BOOL | JP_NOBOOL)) {
488 			/*
489 			 * Set booleans without values.  If one has a value of
490 			 * zero, change it to (or from) its "no" counterpart.
491 			 */
492 			jiov[i].iov_base = NULL;
493 			jiov[i].iov_len = 0;
494 			if (jp[j].jp_value != NULL &&
495 			    jp[j].jp_valuelen == sizeof(int) &&
496 			    !*(int *)jp[j].jp_value) {
497 				bool0 = 1;
498 				nname = jp[j].jp_flags & JP_BOOL
499 				    ? noname(jp[j].jp_name)
500 				    : nononame(jp[j].jp_name);
501 				if (nname == NULL) {
502 					njp = j;
503 					jid = -1;
504 					goto done;
505 				}
506 				jiov[i - 1].iov_base = nname;
507 				jiov[i - 1].iov_len = strlen(nname) + 1;
508 
509 			}
510 		} else {
511 			/*
512 			 * Try to fill in missing values with an empty string.
513 			 */
514 			if (jp[j].jp_value == NULL && jp[j].jp_valuelen > 0 &&
515 			    jailparam_import(jp + j, "") < 0) {
516 				njp = j;
517 				jid = -1;
518 				goto done;
519 			}
520 			jiov[i].iov_base = jp[j].jp_value;
521 			jiov[i].iov_len =
522 			    (jp[j].jp_ctltype & CTLTYPE) == CTLTYPE_STRING
523 			    ? strlen(jp[j].jp_value) + 1
524 			    : jp[j].jp_valuelen;
525 		}
526 		i++;
527 	}
528 	*(const void **)&jiov[i].iov_base = "errmsg";
529 	jiov[i].iov_len = sizeof("errmsg");
530 	i++;
531 	jiov[i].iov_base = jail_errmsg;
532 	jiov[i].iov_len = JAIL_ERRMSGLEN;
533 	i++;
534 	jail_errmsg[0] = 0;
535 	jid = jail_set(jiov, i, flags);
536 	if (jid < 0 && !jail_errmsg[0])
537 		snprintf(jail_errmsg, sizeof(jail_errmsg), "jail_set: %s",
538 		    strerror(errno));
539  done:
540 	if (bool0)
541 		for (j = 0; j < njp; j++)
542 			if ((jp[j].jp_flags & (JP_BOOL | JP_NOBOOL)) &&
543 			    jp[j].jp_value != NULL &&
544 			    jp[j].jp_valuelen == sizeof(int) &&
545 			    !*(int *)jp[j].jp_value)
546 				free(jiov[j * 2].iov_base);
547 	return (jid);
548 }
549 
550 int
551 jailparam_get(struct jailparam *jp, unsigned njp, int flags)
552 {
553 	struct iovec *jiov;
554 	struct jailparam *jp_lastjid, *jp_jid, *jp_name, *jp_key;
555 	int i, ai, ki, jid, arrays, sanity;
556 	unsigned j;
557 
558 	/*
559 	 * Get the types for all parameters.
560 	 * Find the key and any array parameters.
561 	 */
562 	jiov = alloca(sizeof(struct iovec) * 2 * (njp + 1));
563 	jp_lastjid = jp_jid = jp_name = NULL;
564 	arrays = 0;
565 	for (ai = j = 0; j < njp; j++) {
566 		if (!jp[j].jp_ctltype && jailparam_type(jp + j) < 0)
567 			return (-1);
568 		if (!strcmp(jp[j].jp_name, "lastjid"))
569 			jp_lastjid = jp + j;
570 		else if (!strcmp(jp[j].jp_name, "jid"))
571 			jp_jid = jp + j;
572 		else if (!strcmp(jp[j].jp_name, "name"))
573 			jp_name = jp + j;
574 		else if (jp[j].jp_elemlen && !(jp[j].jp_flags & JP_RAWVALUE)) {
575 			arrays = 1;
576 			jiov[ai].iov_base = jp[j].jp_name;
577 			jiov[ai].iov_len = strlen(jp[j].jp_name) + 1;
578 			ai++;
579 			jiov[ai].iov_base = NULL;
580 			jiov[ai].iov_len = 0;
581 			ai++;
582 		}
583 	}
584 	jp_key = jp_lastjid ? jp_lastjid :
585 	    jp_jid && jp_jid->jp_valuelen == sizeof(int) &&
586 	    jp_jid->jp_value && *(int *)jp_jid->jp_value ? jp_jid : jp_name;
587 	if (jp_key == NULL || jp_key->jp_value == NULL) {
588 		strlcpy(jail_errmsg, "no jail specified", JAIL_ERRMSGLEN);
589 		errno = ENOENT;
590 		return (-1);
591 	}
592 	ki = ai;
593 	jiov[ki].iov_base = jp_key->jp_name;
594 	jiov[ki].iov_len = strlen(jp_key->jp_name) + 1;
595 	ki++;
596 	jiov[ki].iov_base = jp_key->jp_value;
597 	jiov[ki].iov_len = (jp_key->jp_ctltype & CTLTYPE) == CTLTYPE_STRING
598 	    ? strlen(jp_key->jp_value) + 1 : jp_key->jp_valuelen;
599 	ki++;
600 	*(const void **)&jiov[ki].iov_base = "errmsg";
601 	jiov[ki].iov_len = sizeof("errmsg");
602 	ki++;
603 	jiov[ki].iov_base = jail_errmsg;
604 	jiov[ki].iov_len = JAIL_ERRMSGLEN;
605 	ki++;
606 	jail_errmsg[0] = 0;
607 	if (arrays && jail_get(jiov, ki, flags) < 0) {
608 		if (!jail_errmsg[0])
609 			snprintf(jail_errmsg, sizeof(jail_errmsg),
610 			    "jail_get: %s", strerror(errno));
611 		return (-1);
612 	}
613 	/* Allocate storage for all parameters. */
614 	for (ai = j = 0, i = ki; j < njp; j++) {
615 		if (jp[j].jp_elemlen && !(jp[j].jp_flags & JP_RAWVALUE)) {
616 			ai++;
617 			jiov[ai].iov_len += jp[j].jp_elemlen * ARRAY_SLOP;
618 			if (jp[j].jp_valuelen >= jiov[ai].iov_len)
619 				jiov[ai].iov_len = jp[j].jp_valuelen;
620 			else {
621 				jp[j].jp_valuelen = jiov[ai].iov_len;
622 				if (jp[j].jp_value != NULL)
623 					free(jp[j].jp_value);
624 				jp[j].jp_value = malloc(jp[j].jp_valuelen);
625 				if (jp[j].jp_value == NULL) {
626 					strerror_r(errno, jail_errmsg,
627 					    JAIL_ERRMSGLEN);
628 					return (-1);
629 				}
630 			}
631 			jiov[ai].iov_base = jp[j].jp_value;
632 			memset(jiov[ai].iov_base, 0, jiov[ai].iov_len);
633 			ai++;
634 		} else if (jp + j != jp_key) {
635 			jiov[i].iov_base = jp[j].jp_name;
636 			jiov[i].iov_len = strlen(jp[j].jp_name) + 1;
637 			i++;
638 			if (jp[j].jp_value == NULL &&
639 			    !(jp[j].jp_flags & JP_RAWVALUE)) {
640 				jp[j].jp_value = malloc(jp[j].jp_valuelen);
641 				if (jp[j].jp_value == NULL) {
642 					strerror_r(errno, jail_errmsg,
643 					    JAIL_ERRMSGLEN);
644 					return (-1);
645 				}
646 			}
647 			jiov[i].iov_base = jp[j].jp_value;
648 			jiov[i].iov_len = jp[j].jp_valuelen;
649 			memset(jiov[i].iov_base, 0, jiov[i].iov_len);
650 			i++;
651 		}
652 	}
653 	/*
654 	 * Get the prison.  If there are array elements, retry a few times
655 	 * in case their sizes changed from under us.
656 	 */
657 	for (sanity = 0;; sanity++) {
658 		jid = jail_get(jiov, i, flags);
659 		if (jid >= 0 || !arrays || sanity == ARRAY_SANITY ||
660 		    errno != EINVAL || jail_errmsg[0])
661 			break;
662 		for (ai = j = 0; j < njp; j++) {
663 			if (jp[j].jp_elemlen &&
664 			    !(jp[j].jp_flags & JP_RAWVALUE)) {
665 				ai++;
666 				jiov[ai].iov_base = NULL;
667 				jiov[ai].iov_len = 0;
668 				ai++;
669 			}
670 		}
671 		if (jail_get(jiov, ki, flags) < 0)
672 			break;
673 		for (ai = j = 0; j < njp; j++) {
674 			if (jp[j].jp_elemlen &&
675 			    !(jp[j].jp_flags & JP_RAWVALUE)) {
676 				ai++;
677 				jiov[ai].iov_len +=
678 				    jp[j].jp_elemlen * ARRAY_SLOP;
679 				if (jp[j].jp_valuelen >= jiov[ai].iov_len)
680 					jiov[ai].iov_len = jp[j].jp_valuelen;
681 				else {
682 					jp[j].jp_valuelen = jiov[ai].iov_len;
683 					if (jp[j].jp_value != NULL)
684 						free(jp[j].jp_value);
685 					jp[j].jp_value =
686 					    malloc(jiov[ai].iov_len);
687 					if (jp[j].jp_value == NULL) {
688 						strerror_r(errno, jail_errmsg,
689 						    JAIL_ERRMSGLEN);
690 						return (-1);
691 					}
692 				}
693 				jiov[ai].iov_base = jp[j].jp_value;
694 				memset(jiov[ai].iov_base, 0, jiov[ai].iov_len);
695 				ai++;
696 			}
697 		}
698 	}
699 	if (jid < 0 && !jail_errmsg[0])
700 		snprintf(jail_errmsg, sizeof(jail_errmsg),
701 		    "jail_get: %s", strerror(errno));
702 	for (ai = j = 0, i = ki; j < njp; j++) {
703 		if (jp[j].jp_elemlen && !(jp[j].jp_flags & JP_RAWVALUE)) {
704 			ai++;
705 			jp[j].jp_valuelen = jiov[ai].iov_len;
706 			ai++;
707 		} else if (jp + j != jp_key) {
708 			i++;
709 			jp[j].jp_valuelen = jiov[i].iov_len;
710 			i++;
711 		}
712 	}
713 	return (jid);
714 }
715 
716 /*
717  * Convert a jail parameter's value to external form.
718  */
719 char *
720 jailparam_export(struct jailparam *jp)
721 {
722 	char *value, *tvalue, **values;
723 	size_t valuelen;
724 	int i, nval, ival;
725 	char valbuf[INET6_ADDRSTRLEN];
726 
727 	if (!jp->jp_ctltype && jailparam_type(jp) < 0)
728 		return (NULL);
729 	if ((jp->jp_ctltype & CTLTYPE) == CTLTYPE_STRING) {
730 		value = strdup(jp->jp_value);
731 		if (value == NULL)
732 			strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
733 		return (value);
734 	}
735 	nval = jp->jp_elemlen ? jp->jp_valuelen / jp->jp_elemlen : 1;
736 	if (nval == 0) {
737 		value = strdup("");
738 		if (value == NULL)
739 			strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
740 		return (value);
741 	}
742 	values = alloca(nval * sizeof(char *));
743 	valuelen = 0;
744 	for (i = 0; i < nval; i++) {
745 		switch (jp->jp_ctltype & CTLTYPE) {
746 		case CTLTYPE_INT:
747 			ival = ((int *)jp->jp_value)[i];
748 			if ((jp->jp_flags & (JP_BOOL | JP_NOBOOL)) &&
749 			    (unsigned)ival < 2) {
750 				strlcpy(valbuf, bool_values[ival],
751 				    sizeof(valbuf));
752 				break;
753 			}
754 			if ((jp->jp_flags & JP_JAILSYS) &&
755 			    (unsigned)ival < sizeof(jailsys_values) /
756 			    sizeof(jailsys_values[0])) {
757 				strlcpy(valbuf, jailsys_values[ival],
758 				    sizeof(valbuf));
759 				break;
760 			}
761 			snprintf(valbuf, sizeof(valbuf), "%d", ival);
762 			break;
763 		case CTLTYPE_UINT:
764 			snprintf(valbuf, sizeof(valbuf), "%u",
765 			    ((unsigned *)jp->jp_value)[i]);
766 			break;
767 		case CTLTYPE_LONG:
768 			snprintf(valbuf, sizeof(valbuf), "%ld",
769 			    ((long *)jp->jp_value)[i]);
770 			break;
771 		case CTLTYPE_ULONG:
772 			snprintf(valbuf, sizeof(valbuf), "%lu",
773 			    ((unsigned long *)jp->jp_value)[i]);
774 			break;
775 		case CTLTYPE_QUAD:
776 			snprintf(valbuf, sizeof(valbuf), "%jd",
777 			    (intmax_t)((int64_t *)jp->jp_value)[i]);
778 			break;
779 		case CTLTYPE_STRUCT:
780 			switch (jp->jp_structtype) {
781 			case JPS_IN_ADDR:
782 				if (inet_ntop(AF_INET,
783 				    &((struct in_addr *)jp->jp_value)[i],
784 				    valbuf, sizeof(valbuf)) == NULL) {
785 					strerror_r(errno, jail_errmsg,
786 					    JAIL_ERRMSGLEN);
787 
788 					return (NULL);
789 				}
790 				break;
791 			case JPS_IN6_ADDR:
792 				if (inet_ntop(AF_INET6,
793 				    &((struct in6_addr *)jp->jp_value)[i],
794 				    valbuf, sizeof(valbuf)) == NULL) {
795 					strerror_r(errno, jail_errmsg,
796 					    JAIL_ERRMSGLEN);
797 
798 					return (NULL);
799 				}
800 				break;
801 			default:
802 				goto unknown_type;
803 			}
804 			break;
805 		default:
806 		unknown_type:
807 			snprintf(jail_errmsg, JAIL_ERRMSGLEN,
808 			    "unknown type for %s", jp->jp_name);
809 			errno = ENOENT;
810 			return (NULL);
811 		}
812 		valuelen += strlen(valbuf) + 1;
813 		values[i] = alloca(valuelen);
814 		strcpy(values[i], valbuf);
815 	}
816 	value = malloc(valuelen + 1);
817 	if (value == NULL)
818 		strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
819 	else {
820 		tvalue = value;
821 		for (i = 0; i < nval; i++) {
822 			strcpy(tvalue, values[i]);
823 			if (i < nval - 1) {
824 				tvalue += strlen(values[i]);
825 				*tvalue++ = ',';
826 			}
827 		}
828 	}
829 	return (value);
830 }
831 
832 /*
833  * Free the contents of a jail parameter list (but not thst list itself).
834  */
835 void
836 jailparam_free(struct jailparam *jp, unsigned njp)
837 {
838 	unsigned j;
839 
840 	for (j = 0; j < njp; j++) {
841 		free(jp[j].jp_name);
842 		if (!(jp[j].jp_flags & JP_RAWVALUE))
843 			free(jp[j].jp_value);
844 	}
845 }
846 
847 /*
848  * Find a parameter's type and size from its MIB.
849  */
850 static int
851 jailparam_type(struct jailparam *jp)
852 {
853 	char *p, *nname;
854 	size_t miblen, desclen;
855 	int isarray;
856 	struct {
857 	    int i;
858 	    char s[MAXPATHLEN];
859 	} desc;
860 	int mib[CTL_MAXNAME];
861 
862 	/* The "lastjid" parameter isn't real. */
863 	if (!strcmp(jp->jp_name, "lastjid")) {
864 		jp->jp_valuelen = sizeof(int);
865 		jp->jp_ctltype = CTLTYPE_INT | CTLFLAG_WR;
866 		return (0);
867 	}
868 
869 	/* Find the sysctl that describes the parameter. */
870 	mib[0] = 0;
871 	mib[1] = 3;
872 	snprintf(desc.s, sizeof(desc.s), SJPARAM ".%s", jp->jp_name);
873 	miblen = sizeof(mib) - 2 * sizeof(int);
874 	if (sysctl(mib, 2, mib + 2, &miblen, desc.s, strlen(desc.s)) < 0) {
875 		if (errno != ENOENT) {
876 			snprintf(jail_errmsg, JAIL_ERRMSGLEN,
877 			    "sysctl(0.3.%s): %s", jp->jp_name, strerror(errno));
878 			return (-1);
879 		}
880 		/*
881 		 * The parameter probably doesn't exist.  But it might be
882 		 * the "no" counterpart to a boolean.
883 		 */
884 		nname = nononame(jp->jp_name);
885 		if (nname != NULL) {
886 			snprintf(desc.s, sizeof(desc.s), SJPARAM ".%s", nname);
887 			free(nname);
888 			miblen = sizeof(mib) - 2 * sizeof(int);
889 			if (sysctl(mib, 2, mib + 2, &miblen, desc.s,
890 			    strlen(desc.s)) >= 0) {
891 				mib[1] = 4;
892 				desclen = sizeof(desc);
893 				if (sysctl(mib, (miblen / sizeof(int)) + 2,
894 					   &desc, &desclen, NULL, 0) < 0) {
895 					snprintf(jail_errmsg,
896 					    JAIL_ERRMSGLEN,
897 					    "sysctl(0.4.%s): %s", desc.s,
898 					    strerror(errno));
899 					return (-1);
900 				}
901 				if ((desc.i & CTLTYPE) == CTLTYPE_INT &&
902 				    desc.s[0] == 'B') {
903 					jp->jp_ctltype = desc.i;
904 					jp->jp_flags |= JP_NOBOOL;
905 					jp->jp_valuelen = sizeof(int);
906 					return (0);
907 				}
908 			}
909 		}
910 	unknown_parameter:
911 		snprintf(jail_errmsg, JAIL_ERRMSGLEN,
912 		    "unknown parameter: %s", jp->jp_name);
913 		errno = ENOENT;
914 		return (-1);
915 	}
916  mib_desc:
917 	mib[1] = 4;
918 	desclen = sizeof(desc);
919 	if (sysctl(mib, (miblen / sizeof(int)) + 2, &desc, &desclen,
920 	    NULL, 0) < 0) {
921 		snprintf(jail_errmsg, JAIL_ERRMSGLEN,
922 		    "sysctl(0.4.%s): %s", jp->jp_name, strerror(errno));
923 		return (-1);
924 	}
925 	/* See if this is an array type. */
926 	p = strchr(desc.s, '\0');
927 	isarray  = 0;
928 	if (p - 2 < desc.s || strcmp(p - 2, ",a"))
929 		isarray = 0;
930 	else {
931 		isarray = 1;
932 		p[-2] = 0;
933 	}
934 	/* Look for types we understand */
935 	jp->jp_ctltype = desc.i;
936 	switch (desc.i & CTLTYPE) {
937 	case CTLTYPE_INT:
938 		if (desc.s[0] == 'B')
939 			jp->jp_flags |= JP_BOOL;
940 		else if (!strcmp(desc.s, "E,jailsys"))
941 			jp->jp_flags |= JP_JAILSYS;
942 	case CTLTYPE_UINT:
943 		jp->jp_valuelen = sizeof(int);
944 		break;
945 	case CTLTYPE_LONG:
946 	case CTLTYPE_ULONG:
947 		jp->jp_valuelen = sizeof(long);
948 		break;
949 	case CTLTYPE_QUAD:
950 		jp->jp_valuelen = sizeof(int64_t);
951 		break;
952 	case CTLTYPE_STRING:
953 		desc.s[0] = 0;
954 		desclen = sizeof(desc.s);
955 		if (sysctl(mib + 2, miblen / sizeof(int), desc.s, &desclen,
956 		    NULL, 0) < 0) {
957 			snprintf(jail_errmsg, JAIL_ERRMSGLEN,
958 			    "sysctl(" SJPARAM ".%s): %s", jp->jp_name,
959 			    strerror(errno));
960 			return (-1);
961 		}
962 		jp->jp_valuelen = strtoul(desc.s, NULL, 10);
963 		break;
964 	case CTLTYPE_STRUCT:
965 		if (!strcmp(desc.s, "S,in_addr")) {
966 			jp->jp_structtype = JPS_IN_ADDR;
967 			jp->jp_valuelen = sizeof(struct in_addr);
968 		} else if (!strcmp(desc.s, "S,in6_addr")) {
969 			jp->jp_structtype = JPS_IN6_ADDR;
970 			jp->jp_valuelen = sizeof(struct in6_addr);
971 		} else {
972 			desclen = 0;
973 			if (sysctl(mib + 2, miblen / sizeof(int),
974 			    NULL, &jp->jp_valuelen, NULL, 0) < 0) {
975 				snprintf(jail_errmsg, JAIL_ERRMSGLEN,
976 				    "sysctl(" SJPARAM ".%s): %s", jp->jp_name,
977 				    strerror(errno));
978 				return (-1);
979 			}
980 		}
981 		break;
982 	case CTLTYPE_NODE:
983 		/* A node might be described by an empty-named child. */
984 		mib[1] = 1;
985 		mib[(miblen / sizeof(int)) + 2] =
986 		    mib[(miblen / sizeof(int)) + 1] - 1;
987 		miblen += sizeof(int);
988 		desclen = sizeof(desc.s);
989 		if (sysctl(mib, (miblen / sizeof(int)) + 2, desc.s, &desclen,
990 		    NULL, 0) < 0) {
991 			snprintf(jail_errmsg, JAIL_ERRMSGLEN,
992 			    "sysctl(0.1): %s", strerror(errno));
993 			return (-1);
994 		}
995 		if (desc.s[desclen - 2] != '.')
996 			goto unknown_parameter;
997 		goto mib_desc;
998 	default:
999 		snprintf(jail_errmsg, JAIL_ERRMSGLEN,
1000 		    "unknown type for %s", jp->jp_name);
1001 		errno = ENOENT;
1002 		return (-1);
1003 	}
1004 	if (isarray) {
1005 		jp->jp_elemlen = jp->jp_valuelen;
1006 		jp->jp_valuelen = 0;
1007 	}
1008 	return (0);
1009 }
1010 
1011 /*
1012  * Change a boolean parameter name into its "no" counterpart or vice versa.
1013  */
1014 static char *
1015 noname(const char *name)
1016 {
1017 	char *nname, *p;
1018 
1019 	nname = malloc(strlen(name) + 3);
1020 	if (nname == NULL) {
1021 		strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
1022 		return (NULL);
1023 	}
1024 	p = strrchr(name, '.');
1025 	if (p != NULL)
1026 		sprintf(nname, "%.*s.no%s", (int)(p - name), name, p + 1);
1027 	else
1028 		sprintf(nname, "no%s", name);
1029 	return (nname);
1030 }
1031 
1032 static char *
1033 nononame(const char *name)
1034 {
1035 	char *p, *nname;
1036 
1037 	p = strrchr(name, '.');
1038 	if (strncmp(p ? p + 1 : name, "no", 2)) {
1039 		snprintf(jail_errmsg, sizeof(jail_errmsg),
1040 		    "mismatched boolean: %s", name);
1041 		errno = EINVAL;
1042 		return (NULL);
1043 	}
1044 	nname = malloc(strlen(name) - 1);
1045 	if (nname == NULL) {
1046 		strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
1047 		return (NULL);
1048 	}
1049 	if (p != NULL)
1050 		sprintf(nname, "%.*s.%s", (int)(p - name), name, p + 3);
1051 	else
1052 		strcpy(nname, name + 2);
1053 	return (nname);
1054 }
1055