xref: /freebsd/lib/libjail/jail.c (revision 5e3190f700637fcfc1a52daeaa4a031fdd2557c7)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2009 James Gritton.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  */
28 
29 #include <sys/cdefs.h>
30 #include <sys/param.h>
31 #include <sys/jail.h>
32 #include <sys/linker.h>
33 #include <sys/socket.h>
34 #include <sys/sysctl.h>
35 
36 #include <arpa/inet.h>
37 #include <netinet/in.h>
38 
39 #include <errno.h>
40 #include <inttypes.h>
41 #include <stdio.h>
42 #include <stdarg.h>
43 #include <stdlib.h>
44 #include <string.h>
45 
46 #include "jail.h"
47 
48 #define	SJPARAM		"security.jail.param"
49 
50 #define JPS_IN_ADDR	1
51 #define JPS_IN6_ADDR	2
52 
53 #define ARRAY_SANITY	5
54 #define ARRAY_SLOP	5
55 
56 
57 static int jailparam_import_enum(const char **values, int nvalues,
58     const char *valstr, size_t valsize, int *value);
59 static int jailparam_type(struct jailparam *jp);
60 static int kldload_param(const char *name);
61 static char *noname(const char *name);
62 static char *nononame(const char *name);
63 
64 char jail_errmsg[JAIL_ERRMSGLEN];
65 
66 static const char *bool_values[] = { "false", "true" };
67 static const char *jailsys_values[] = { "disable", "new", "inherit" };
68 
69 
70 /*
71  * Import a null-terminated parameter list and set a jail with the flags
72  * and parameters.
73  */
74 int
75 jail_setv(int flags, ...)
76 {
77 	va_list ap, tap;
78 	struct jailparam *jp;
79 	const char *name, *value;
80 	int njp, jid;
81 
82 	/* Create the parameter list and import the parameters. */
83 	va_start(ap, flags);
84 	va_copy(tap, ap);
85 	for (njp = 0; va_arg(tap, char *) != NULL; njp++)
86 		(void)va_arg(tap, char *);
87 	va_end(tap);
88 	jp = alloca(njp * sizeof(struct jailparam));
89 	for (njp = 0; (name = va_arg(ap, char *)) != NULL;) {
90 		value = va_arg(ap, char *);
91 		if (jailparam_init(jp + njp, name) < 0)
92 			goto error;
93 		if (jailparam_import(jp + njp++, value) < 0)
94 			goto error;
95 	}
96 	va_end(ap);
97 	jid = jailparam_set(jp, njp, flags);
98 	jailparam_free(jp, njp);
99 	return (jid);
100 
101  error:
102 	jailparam_free(jp, njp);
103 	va_end(ap);
104 	return (-1);
105 }
106 
107 /*
108  * Read a null-terminated parameter list, get the referenced jail, and export
109  * the parameters to the list.
110  */
111 int
112 jail_getv(int flags, ...)
113 {
114 	va_list ap, tap;
115 	struct jailparam *jp, *jp_lastjid, *jp_jid, *jp_name, *jp_key;
116 	char *valarg, *value;
117 	const char *name, *key_value, *lastjid_value, *jid_value, *name_value;
118 	int njp, i, jid;
119 
120 	/* Create the parameter list and find the key. */
121 	va_start(ap, flags);
122 	va_copy(tap, ap);
123 	for (njp = 0; va_arg(tap, char *) != NULL; njp++)
124 		(void)va_arg(tap, char *);
125 	va_end(tap);
126 
127 	jp = alloca(njp * sizeof(struct jailparam));
128 	va_copy(tap, ap);
129 	jp_lastjid = jp_jid = jp_name = NULL;
130 	lastjid_value = jid_value = name_value = NULL;
131 	for (njp = 0; (name = va_arg(tap, char *)) != NULL; njp++) {
132 		value = va_arg(tap, char *);
133 		if (jailparam_init(jp + njp, name) < 0) {
134 			va_end(tap);
135 			goto error;
136 		}
137 		if (!strcmp(jp[njp].jp_name, "lastjid")) {
138 			jp_lastjid = jp + njp;
139 			lastjid_value = value;
140 		} else if (!strcmp(jp[njp].jp_name, "jid")) {
141 			jp_jid = jp + njp;
142 			jid_value = value;
143 		} if (!strcmp(jp[njp].jp_name, "name")) {
144 			jp_name = jp + njp;
145 			name_value = value;
146 		}
147 	}
148 	va_end(tap);
149 	/* Import the key parameter. */
150 	if (jp_lastjid != NULL) {
151 		jp_key = jp_lastjid;
152 		key_value = lastjid_value;
153 	} else if (jp_jid != NULL && strtol(jid_value, NULL, 10) != 0) {
154 		jp_key = jp_jid;
155 		key_value = jid_value;
156 	} else if (jp_name != NULL) {
157 		jp_key = jp_name;
158 		key_value = name_value;
159 	} else {
160 		strlcpy(jail_errmsg, "no jail specified", JAIL_ERRMSGLEN);
161 		errno = ENOENT;
162 		goto error;
163 	}
164 	if (jailparam_import(jp_key, key_value) < 0)
165 		goto error;
166 	/* Get the jail and export the parameters. */
167 	jid = jailparam_get(jp, njp, flags);
168 	if (jid < 0)
169 		goto error;
170 	for (i = 0; i < njp; i++) {
171 		(void)va_arg(ap, char *);
172 		valarg = va_arg(ap, char *);
173 		if (jp + i != jp_key) {
174 			/* It's up to the caller to ensure there's room. */
175 			if ((jp[i].jp_ctltype & CTLTYPE) == CTLTYPE_STRING)
176 				strcpy(valarg, jp[i].jp_value);
177 			else {
178 				value = jailparam_export(jp + i);
179 				if (value == NULL)
180 					goto error;
181 				strcpy(valarg, value);
182 				free(value);
183 			}
184 		}
185 	}
186 	jailparam_free(jp, njp);
187 	va_end(ap);
188 	return (jid);
189 
190  error:
191 	jailparam_free(jp, njp);
192 	va_end(ap);
193 	return (-1);
194 }
195 
196 /*
197  * Return a list of all known parameters.
198  */
199 int
200 jailparam_all(struct jailparam **jpp)
201 {
202 	struct jailparam *jp, *tjp;
203 	size_t mlen1, mlen2, buflen;
204 	unsigned njp, nlist;
205 	int mib1[CTL_MAXNAME], mib2[CTL_MAXNAME - 2];
206 	char buf[MAXPATHLEN];
207 
208 	njp = 0;
209 	nlist = 32;
210 	jp = malloc(nlist * sizeof(*jp));
211 	if (jp == NULL) {
212 		strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
213 		return (-1);
214 	}
215 	mib1[0] = 0;
216 	mib1[1] = 2;
217 	mlen1 = CTL_MAXNAME - 2;
218 	if (sysctlnametomib(SJPARAM, mib1 + 2, &mlen1) < 0) {
219 		snprintf(jail_errmsg, JAIL_ERRMSGLEN,
220 		    "sysctlnametomib(" SJPARAM "): %s", strerror(errno));
221 		goto error;
222 	}
223 	for (;; njp++) {
224 		/* Get the next parameter. */
225 		mlen2 = sizeof(mib2);
226 		if (sysctl(mib1, mlen1 + 2, mib2, &mlen2, NULL, 0) < 0) {
227 			if (errno == ENOENT) {
228 				/* No more entries. */
229 				break;
230 			}
231 			snprintf(jail_errmsg, JAIL_ERRMSGLEN,
232 			    "sysctl(0.2): %s", strerror(errno));
233 			goto error;
234 		}
235 		if (mib2[0] != mib1[2] ||
236 		    mib2[1] != mib1[3] ||
237 		    mib2[2] != mib1[4])
238 			break;
239 		/* Convert it to an ascii name. */
240 		memcpy(mib1 + 2, mib2, mlen2);
241 		mlen1 = mlen2 / sizeof(int);
242 		mib1[1] = 1;
243 		buflen = sizeof(buf);
244 		if (sysctl(mib1, mlen1 + 2, buf, &buflen, NULL, 0) < 0) {
245 			snprintf(jail_errmsg, JAIL_ERRMSGLEN,
246 			    "sysctl(0.1): %s", strerror(errno));
247 			goto error;
248 		}
249 		if (buf[buflen - 2] == '.')
250 			buf[buflen - 2] = '\0';
251 		/* Add the parameter to the list */
252 		if (njp >= nlist) {
253 			nlist *= 2;
254 			tjp = reallocarray(jp, nlist, sizeof(*jp));
255 			if (tjp == NULL)
256 				goto error;
257 			jp = tjp;
258 		}
259 		if (jailparam_init(jp + njp, buf + sizeof(SJPARAM)) < 0)
260 			goto error;
261 		mib1[1] = 2;
262 	}
263 	/* Just return the untrimmed buffer if reallocarray() somehow fails. */
264 	tjp = reallocarray(jp, njp, sizeof(*jp));
265 	if (tjp != NULL)
266 		jp = tjp;
267 	*jpp = jp;
268 	return (njp);
269 
270  error:
271 	jailparam_free(jp, njp);
272 	free(jp);
273 	return (-1);
274 }
275 
276 /*
277  * Clear a jail parameter and copy in its name.
278  */
279 int
280 jailparam_init(struct jailparam *jp, const char *name)
281 {
282 
283 	memset(jp, 0, sizeof(*jp));
284 	jp->jp_name = strdup(name);
285 	if (jp->jp_name == NULL) {
286 		strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
287 		return (-1);
288 	}
289 	if (jailparam_type(jp) < 0) {
290 		jailparam_free(jp, 1);
291 		jp->jp_name = NULL;
292 		jp->jp_value = NULL;
293 		return (-1);
294 	}
295 	return (0);
296 }
297 
298 /*
299  * Put a name and value into a jail parameter element, converting the value
300  * to internal form.
301  */
302 int
303 jailparam_import(struct jailparam *jp, const char *value)
304 {
305 	char *p, *ep, *tvalue;
306 	const char *avalue;
307 	int i, nval, fw;
308 
309 	if (value == NULL)
310 		return (0);
311 	if ((jp->jp_ctltype & CTLTYPE) == CTLTYPE_STRING) {
312 		jp->jp_value = strdup(value);
313 		if (jp->jp_value == NULL) {
314 			strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
315 			return (-1);
316 		}
317 		return (0);
318 	}
319 	nval = 1;
320 	if (jp->jp_elemlen) {
321 		if (value[0] == '\0' || (value[0] == '-' && value[1] == '\0')) {
322 			jp->jp_value = strdup("");
323 			if (jp->jp_value == NULL) {
324 				strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
325 				return (-1);
326 			}
327 			jp->jp_valuelen = 0;
328 			return (0);
329 		}
330 		for (p = strchr(value, ','); p; p = strchr(p + 1, ','))
331 			nval++;
332 		jp->jp_valuelen = jp->jp_elemlen * nval;
333 	}
334 	jp->jp_value = malloc(jp->jp_valuelen);
335 	if (jp->jp_value == NULL) {
336 		strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
337 		return (-1);
338 	}
339 	avalue = value;
340 	for (i = 0; i < nval; i++) {
341 		fw = nval == 1 ? strlen(avalue) : strcspn(avalue, ",");
342 		switch (jp->jp_ctltype & CTLTYPE) {
343 		case CTLTYPE_INT:
344 			if (jp->jp_flags & (JP_BOOL | JP_NOBOOL)) {
345 				if (!jailparam_import_enum(bool_values, 2,
346 				    avalue, fw, &((int *)jp->jp_value)[i])) {
347 					snprintf(jail_errmsg,
348 					    JAIL_ERRMSGLEN, "%s: "
349 					    "unknown boolean value \"%.*s\"",
350 					    jp->jp_name, fw, avalue);
351 					errno = EINVAL;
352 					goto error;
353 				}
354 				break;
355 			}
356 			if (jp->jp_flags & JP_JAILSYS) {
357 				/*
358 				 * Allow setting a jailsys parameter to "new"
359 				 * in a booleanesque fashion.
360 				 */
361 				if (value[0] == '\0')
362 					((int *)jp->jp_value)[i] = JAIL_SYS_NEW;
363 				else if (!jailparam_import_enum(jailsys_values,
364 				    sizeof(jailsys_values) /
365 				    sizeof(jailsys_values[0]), avalue, fw,
366 				    &((int *)jp->jp_value)[i])) {
367 					snprintf(jail_errmsg,
368 					    JAIL_ERRMSGLEN, "%s: "
369 					    "unknown jailsys value \"%.*s\"",
370 					    jp->jp_name, fw, avalue);
371 					errno = EINVAL;
372 					goto error;
373 				}
374 				break;
375 			}
376 			((int *)jp->jp_value)[i] = strtol(avalue, &ep, 10);
377 		integer_test:
378 			if (ep != avalue + fw) {
379 				snprintf(jail_errmsg, JAIL_ERRMSGLEN,
380 				    "%s: non-integer value \"%.*s\"",
381 				    jp->jp_name, fw, avalue);
382 				errno = EINVAL;
383 				goto error;
384 			}
385 			break;
386 		case CTLTYPE_UINT:
387 			((unsigned *)jp->jp_value)[i] =
388 			    strtoul(avalue, &ep, 10);
389 			goto integer_test;
390 		case CTLTYPE_LONG:
391 			((long *)jp->jp_value)[i] = strtol(avalue, &ep, 10);
392 			goto integer_test;
393 		case CTLTYPE_ULONG:
394 			((unsigned long *)jp->jp_value)[i] =
395 			    strtoul(avalue, &ep, 10);
396 			goto integer_test;
397 		case CTLTYPE_S64:
398 			((int64_t *)jp->jp_value)[i] =
399 			    strtoimax(avalue, &ep, 10);
400 			goto integer_test;
401 		case CTLTYPE_U64:
402 			((uint64_t *)jp->jp_value)[i] =
403 			    strtoumax(avalue, &ep, 10);
404 			goto integer_test;
405 		case CTLTYPE_STRUCT:
406 			tvalue = alloca(fw + 1);
407 			strlcpy(tvalue, avalue, fw + 1);
408 			switch (jp->jp_structtype) {
409 			case JPS_IN_ADDR:
410 				if (inet_pton(AF_INET, tvalue,
411 				    &((struct in_addr *)jp->jp_value)[i]) != 1)
412 				{
413 					snprintf(jail_errmsg,
414 					    JAIL_ERRMSGLEN,
415 					    "%s: not an IPv4 address: %s",
416 					    jp->jp_name, tvalue);
417 					errno = EINVAL;
418 					goto error;
419 				}
420 				break;
421 			case JPS_IN6_ADDR:
422 				if (inet_pton(AF_INET6, tvalue,
423 				    &((struct in6_addr *)jp->jp_value)[i]) != 1)
424 				{
425 					snprintf(jail_errmsg,
426 					    JAIL_ERRMSGLEN,
427 					    "%s: not an IPv6 address: %s",
428 					    jp->jp_name, tvalue);
429 					errno = EINVAL;
430 					goto error;
431 				}
432 				break;
433 			default:
434 				goto unknown_type;
435 			}
436 			break;
437 		default:
438 		unknown_type:
439 			snprintf(jail_errmsg, JAIL_ERRMSGLEN,
440 			    "unknown type for %s", jp->jp_name);
441 			errno = ENOENT;
442 			goto error;
443 		}
444 		avalue += fw + 1;
445 	}
446 	return (0);
447 
448  error:
449 	free(jp->jp_value);
450 	jp->jp_value = NULL;
451 	return (-1);
452 }
453 
454 static int
455 jailparam_import_enum(const char **values, int nvalues, const char *valstr,
456     size_t valsize, int *value)
457 {
458 	char *ep;
459 	int i;
460 
461 	for (i = 0; i < nvalues; i++)
462 		if (valsize == strlen(values[i]) &&
463 		    !strncasecmp(valstr, values[i], valsize)) {
464 			*value = i;
465 			return 1;
466 		}
467 	*value = strtol(valstr, &ep, 10);
468 	return (ep == valstr + valsize);
469 }
470 
471 /*
472  * Put a name and value into a jail parameter element, copying the value
473  * but not altering it.
474  */
475 int
476 jailparam_import_raw(struct jailparam *jp, void *value, size_t valuelen)
477 {
478 
479 	jp->jp_value = value;
480 	jp->jp_valuelen = valuelen;
481 	jp->jp_flags |= JP_RAWVALUE;
482 	return (0);
483 }
484 
485 /*
486  * Run the jail_set and jail_get system calls on a parameter list.
487  */
488 int
489 jailparam_set(struct jailparam *jp, unsigned njp, int flags)
490 {
491 	struct iovec *jiov;
492 	char *nname;
493 	int i, jid, bool0;
494 	unsigned j;
495 
496 	jiov = alloca(sizeof(struct iovec) * 2 * (njp + 1));
497 	bool0 = 0;
498 	for (i = j = 0; j < njp; j++) {
499 		jiov[i].iov_base = jp[j].jp_name;
500 		jiov[i].iov_len = strlen(jp[j].jp_name) + 1;
501 		i++;
502 		if (jp[j].jp_flags & (JP_BOOL | JP_NOBOOL)) {
503 			/*
504 			 * Set booleans without values.  If one has a value of
505 			 * zero, change it to (or from) its "no" counterpart.
506 			 */
507 			jiov[i].iov_base = NULL;
508 			jiov[i].iov_len = 0;
509 			if (jp[j].jp_value != NULL &&
510 			    jp[j].jp_valuelen == sizeof(int) &&
511 			    !*(int *)jp[j].jp_value) {
512 				bool0 = 1;
513 				nname = jp[j].jp_flags & JP_BOOL
514 				    ? noname(jp[j].jp_name)
515 				    : nononame(jp[j].jp_name);
516 				if (nname == NULL) {
517 					njp = j;
518 					jid = -1;
519 					goto done;
520 				}
521 				jiov[i - 1].iov_base = nname;
522 				jiov[i - 1].iov_len = strlen(nname) + 1;
523 
524 			}
525 		} else {
526 			/*
527 			 * Try to fill in missing values with an empty string.
528 			 */
529 			if (jp[j].jp_value == NULL && jp[j].jp_valuelen > 0 &&
530 			    jailparam_import(jp + j, "") < 0) {
531 				njp = j;
532 				jid = -1;
533 				goto done;
534 			}
535 			jiov[i].iov_base = jp[j].jp_value;
536 			jiov[i].iov_len =
537 			    (jp[j].jp_ctltype & CTLTYPE) == CTLTYPE_STRING
538 			    ? strlen(jp[j].jp_value) + 1
539 			    : jp[j].jp_valuelen;
540 		}
541 		i++;
542 	}
543 	jiov[i].iov_base = __DECONST(char *, "errmsg");
544 	jiov[i].iov_len = sizeof("errmsg");
545 	i++;
546 	jiov[i].iov_base = jail_errmsg;
547 	jiov[i].iov_len = JAIL_ERRMSGLEN;
548 	i++;
549 	jail_errmsg[0] = 0;
550 	jid = jail_set(jiov, i, flags);
551 	if (jid < 0 && !jail_errmsg[0])
552 		snprintf(jail_errmsg, sizeof(jail_errmsg), "jail_set: %s",
553 		    strerror(errno));
554  done:
555 	if (bool0)
556 		for (j = 0; j < njp; j++)
557 			if ((jp[j].jp_flags & (JP_BOOL | JP_NOBOOL)) &&
558 			    jp[j].jp_value != NULL &&
559 			    jp[j].jp_valuelen == sizeof(int) &&
560 			    !*(int *)jp[j].jp_value)
561 				free(jiov[j * 2].iov_base);
562 	return (jid);
563 }
564 
565 int
566 jailparam_get(struct jailparam *jp, unsigned njp, int flags)
567 {
568 	struct iovec *jiov;
569 	struct jailparam *jp_lastjid, *jp_jid, *jp_name, *jp_key;
570 	int i, ai, ki, jid, arrays, sanity;
571 	unsigned j;
572 
573 	/*
574 	 * Get the types for all parameters.
575 	 * Find the key and any array parameters.
576 	 */
577 	jiov = alloca(sizeof(struct iovec) * 2 * (njp + 1));
578 	jp_lastjid = jp_jid = jp_name = NULL;
579 	arrays = 0;
580 	for (ai = j = 0; j < njp; j++) {
581 		if (!strcmp(jp[j].jp_name, "lastjid"))
582 			jp_lastjid = jp + j;
583 		else if (!strcmp(jp[j].jp_name, "jid"))
584 			jp_jid = jp + j;
585 		else if (!strcmp(jp[j].jp_name, "name"))
586 			jp_name = jp + j;
587 		else if (jp[j].jp_elemlen && !(jp[j].jp_flags & JP_RAWVALUE)) {
588 			arrays = 1;
589 			jiov[ai].iov_base = jp[j].jp_name;
590 			jiov[ai].iov_len = strlen(jp[j].jp_name) + 1;
591 			ai++;
592 			jiov[ai].iov_base = NULL;
593 			jiov[ai].iov_len = 0;
594 			ai++;
595 		}
596 	}
597 	jp_key = jp_lastjid ? jp_lastjid :
598 	    jp_jid && jp_jid->jp_valuelen == sizeof(int) &&
599 	    jp_jid->jp_value && *(int *)jp_jid->jp_value ? jp_jid : jp_name;
600 	if (jp_key == NULL || jp_key->jp_value == NULL) {
601 		strlcpy(jail_errmsg, "no jail specified", JAIL_ERRMSGLEN);
602 		errno = ENOENT;
603 		return (-1);
604 	}
605 	ki = ai;
606 	jiov[ki].iov_base = jp_key->jp_name;
607 	jiov[ki].iov_len = strlen(jp_key->jp_name) + 1;
608 	ki++;
609 	jiov[ki].iov_base = jp_key->jp_value;
610 	jiov[ki].iov_len = (jp_key->jp_ctltype & CTLTYPE) == CTLTYPE_STRING
611 	    ? strlen(jp_key->jp_value) + 1 : jp_key->jp_valuelen;
612 	ki++;
613 	jiov[ki].iov_base = __DECONST(char *, "errmsg");
614 	jiov[ki].iov_len = sizeof("errmsg");
615 	ki++;
616 	jiov[ki].iov_base = jail_errmsg;
617 	jiov[ki].iov_len = JAIL_ERRMSGLEN;
618 	ki++;
619 	jail_errmsg[0] = 0;
620 	if (arrays && jail_get(jiov, ki, flags) < 0) {
621 		if (!jail_errmsg[0])
622 			snprintf(jail_errmsg, sizeof(jail_errmsg),
623 			    "jail_get: %s", strerror(errno));
624 		return (-1);
625 	}
626 	/* Allocate storage for all parameters. */
627 	for (ai = j = 0, i = ki; j < njp; j++) {
628 		if (jp[j].jp_elemlen && !(jp[j].jp_flags & JP_RAWVALUE)) {
629 			ai++;
630 			jiov[ai].iov_len += jp[j].jp_elemlen * ARRAY_SLOP;
631 			if (jp[j].jp_valuelen >= jiov[ai].iov_len)
632 				jiov[ai].iov_len = jp[j].jp_valuelen;
633 			else {
634 				jp[j].jp_valuelen = jiov[ai].iov_len;
635 				if (jp[j].jp_value != NULL)
636 					free(jp[j].jp_value);
637 				jp[j].jp_value = malloc(jp[j].jp_valuelen);
638 				if (jp[j].jp_value == NULL) {
639 					strerror_r(errno, jail_errmsg,
640 					    JAIL_ERRMSGLEN);
641 					return (-1);
642 				}
643 			}
644 			jiov[ai].iov_base = jp[j].jp_value;
645 			memset(jiov[ai].iov_base, 0, jiov[ai].iov_len);
646 			ai++;
647 		} else if (jp + j != jp_key) {
648 			jiov[i].iov_base = jp[j].jp_name;
649 			jiov[i].iov_len = strlen(jp[j].jp_name) + 1;
650 			i++;
651 			if (jp[j].jp_value == NULL &&
652 			    !(jp[j].jp_flags & JP_RAWVALUE)) {
653 				jp[j].jp_value = malloc(jp[j].jp_valuelen);
654 				if (jp[j].jp_value == NULL) {
655 					strerror_r(errno, jail_errmsg,
656 					    JAIL_ERRMSGLEN);
657 					return (-1);
658 				}
659 			}
660 			jiov[i].iov_base = jp[j].jp_value;
661 			jiov[i].iov_len = jp[j].jp_valuelen;
662 			memset(jiov[i].iov_base, 0, jiov[i].iov_len);
663 			i++;
664 		}
665 	}
666 	/*
667 	 * Get the prison.  If there are array elements, retry a few times
668 	 * in case their sizes changed from under us.
669 	 */
670 	for (sanity = 0;; sanity++) {
671 		jid = jail_get(jiov, i, flags);
672 		if (jid >= 0 || !arrays || sanity == ARRAY_SANITY ||
673 		    errno != EINVAL || jail_errmsg[0])
674 			break;
675 		for (ai = j = 0; j < njp; j++) {
676 			if (jp[j].jp_elemlen &&
677 			    !(jp[j].jp_flags & JP_RAWVALUE)) {
678 				ai++;
679 				jiov[ai].iov_base = NULL;
680 				jiov[ai].iov_len = 0;
681 				ai++;
682 			}
683 		}
684 		if (jail_get(jiov, ki, flags) < 0)
685 			break;
686 		for (ai = j = 0; j < njp; j++) {
687 			if (jp[j].jp_elemlen &&
688 			    !(jp[j].jp_flags & JP_RAWVALUE)) {
689 				ai++;
690 				jiov[ai].iov_len +=
691 				    jp[j].jp_elemlen * ARRAY_SLOP;
692 				if (jp[j].jp_valuelen >= jiov[ai].iov_len)
693 					jiov[ai].iov_len = jp[j].jp_valuelen;
694 				else {
695 					jp[j].jp_valuelen = jiov[ai].iov_len;
696 					if (jp[j].jp_value != NULL)
697 						free(jp[j].jp_value);
698 					jp[j].jp_value =
699 					    malloc(jiov[ai].iov_len);
700 					if (jp[j].jp_value == NULL) {
701 						strerror_r(errno, jail_errmsg,
702 						    JAIL_ERRMSGLEN);
703 						return (-1);
704 					}
705 				}
706 				jiov[ai].iov_base = jp[j].jp_value;
707 				memset(jiov[ai].iov_base, 0, jiov[ai].iov_len);
708 				ai++;
709 			}
710 		}
711 	}
712 	if (jid < 0 && !jail_errmsg[0])
713 		snprintf(jail_errmsg, sizeof(jail_errmsg),
714 		    "jail_get: %s", strerror(errno));
715 	for (ai = j = 0, i = ki; j < njp; j++) {
716 		if (jp[j].jp_elemlen && !(jp[j].jp_flags & JP_RAWVALUE)) {
717 			ai++;
718 			jp[j].jp_valuelen = jiov[ai].iov_len;
719 			ai++;
720 		} else if (jp + j != jp_key) {
721 			i++;
722 			jp[j].jp_valuelen = jiov[i].iov_len;
723 			i++;
724 		}
725 	}
726 	return (jid);
727 }
728 
729 /*
730  * Convert a jail parameter's value to external form.
731  */
732 char *
733 jailparam_export(struct jailparam *jp)
734 {
735 	size_t *valuelens;
736 	char *value, *tvalue, **values;
737 	size_t valuelen;
738 	int i, nval, ival;
739 	char valbuf[INET6_ADDRSTRLEN];
740 
741 	if ((jp->jp_ctltype & CTLTYPE) == CTLTYPE_STRING) {
742 		value = strdup(jp->jp_value);
743 		if (value == NULL)
744 			strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
745 		return (value);
746 	}
747 	nval = jp->jp_elemlen ? jp->jp_valuelen / jp->jp_elemlen : 1;
748 	if (nval == 0) {
749 		value = strdup("");
750 		if (value == NULL)
751 			strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
752 		return (value);
753 	}
754 	values = alloca(nval * sizeof(char *));
755 	valuelens = alloca(nval * sizeof(size_t));
756 	valuelen = 0;
757 	for (i = 0; i < nval; i++) {
758 		switch (jp->jp_ctltype & CTLTYPE) {
759 		case CTLTYPE_INT:
760 			ival = ((int *)jp->jp_value)[i];
761 			if ((jp->jp_flags & (JP_BOOL | JP_NOBOOL)) &&
762 			    (unsigned)ival < 2) {
763 				strlcpy(valbuf, bool_values[ival],
764 				    sizeof(valbuf));
765 				break;
766 			}
767 			if ((jp->jp_flags & JP_JAILSYS) &&
768 			    (unsigned)ival < sizeof(jailsys_values) /
769 			    sizeof(jailsys_values[0])) {
770 				strlcpy(valbuf, jailsys_values[ival],
771 				    sizeof(valbuf));
772 				break;
773 			}
774 			snprintf(valbuf, sizeof(valbuf), "%d", ival);
775 			break;
776 		case CTLTYPE_UINT:
777 			snprintf(valbuf, sizeof(valbuf), "%u",
778 			    ((unsigned *)jp->jp_value)[i]);
779 			break;
780 		case CTLTYPE_LONG:
781 			snprintf(valbuf, sizeof(valbuf), "%ld",
782 			    ((long *)jp->jp_value)[i]);
783 			break;
784 		case CTLTYPE_ULONG:
785 			snprintf(valbuf, sizeof(valbuf), "%lu",
786 			    ((unsigned long *)jp->jp_value)[i]);
787 			break;
788 		case CTLTYPE_S64:
789 			snprintf(valbuf, sizeof(valbuf), "%jd",
790 			    (intmax_t)((int64_t *)jp->jp_value)[i]);
791 			break;
792 		case CTLTYPE_U64:
793 			snprintf(valbuf, sizeof(valbuf), "%ju",
794 			    (uintmax_t)((uint64_t *)jp->jp_value)[i]);
795 			break;
796 		case CTLTYPE_STRUCT:
797 			switch (jp->jp_structtype) {
798 			case JPS_IN_ADDR:
799 				if (inet_ntop(AF_INET,
800 				    &((struct in_addr *)jp->jp_value)[i],
801 				    valbuf, sizeof(valbuf)) == NULL) {
802 					strerror_r(errno, jail_errmsg,
803 					    JAIL_ERRMSGLEN);
804 					return (NULL);
805 				}
806 				break;
807 			case JPS_IN6_ADDR:
808 				if (inet_ntop(AF_INET6,
809 				    &((struct in6_addr *)jp->jp_value)[i],
810 				    valbuf, sizeof(valbuf)) == NULL) {
811 					strerror_r(errno, jail_errmsg,
812 					    JAIL_ERRMSGLEN);
813 					return (NULL);
814 				}
815 				break;
816 			default:
817 				goto unknown_type;
818 			}
819 			break;
820 		default:
821 		unknown_type:
822 			snprintf(jail_errmsg, JAIL_ERRMSGLEN,
823 			    "unknown type for %s", jp->jp_name);
824 			errno = ENOENT;
825 			return (NULL);
826 		}
827 		valuelens[i] = strlen(valbuf) + 1;
828 		valuelen += valuelens[i];
829 		values[i] = alloca(valuelens[i]);
830 		strcpy(values[i], valbuf);
831 	}
832 	value = malloc(valuelen);
833 	if (value == NULL)
834 		strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
835 	else {
836 		tvalue = value;
837 		for (i = 0; i < nval; i++) {
838 			strcpy(tvalue, values[i]);
839 			if (i < nval - 1) {
840 				tvalue += valuelens[i];
841 				tvalue[-1] = ',';
842 			}
843 		}
844 	}
845 	return (value);
846 }
847 
848 /*
849  * Free the contents of a jail parameter list (but not the list itself).
850  */
851 void
852 jailparam_free(struct jailparam *jp, unsigned njp)
853 {
854 	unsigned j;
855 
856 	for (j = 0; j < njp; j++) {
857 		free(jp[j].jp_name);
858 		if (!(jp[j].jp_flags & JP_RAWVALUE))
859 			free(jp[j].jp_value);
860 	}
861 }
862 
863 /*
864  * Find a parameter's type and size from its MIB.
865  */
866 static int
867 jailparam_type(struct jailparam *jp)
868 {
869 	char *p, *name, *nname;
870 	size_t miblen, desclen;
871 	int i, isarray;
872 	struct {
873 	    int i;
874 	    char s[MAXPATHLEN];
875 	} desc;
876 	int mib[CTL_MAXNAME];
877 
878 	/* The "lastjid" parameter isn't real. */
879 	name = jp->jp_name;
880 	if (!strcmp(name, "lastjid")) {
881 		jp->jp_valuelen = sizeof(int);
882 		jp->jp_ctltype = CTLTYPE_INT | CTLFLAG_WR;
883 		return (0);
884 	}
885 
886 	/* Find the sysctl that describes the parameter. */
887 	mib[0] = 0;
888 	mib[1] = 3;
889 	snprintf(desc.s, sizeof(desc.s), SJPARAM ".%s", name);
890 	miblen = sizeof(mib) - 2 * sizeof(int);
891 	if (sysctl(mib, 2, mib + 2, &miblen, desc.s, strlen(desc.s)) < 0) {
892 		if (errno != ENOENT) {
893 			snprintf(jail_errmsg, JAIL_ERRMSGLEN,
894 			    "sysctl(0.3.%s): %s", name, strerror(errno));
895 			return (-1);
896 		}
897 		if (kldload_param(name) >= 0 && sysctl(mib, 2, mib + 2, &miblen,
898 		    desc.s, strlen(desc.s)) >= 0)
899 			goto mib_desc;
900 		/*
901 		 * The parameter probably doesn't exist.  But it might be
902 		 * the "no" counterpart to a boolean.
903 		 */
904 		nname = nononame(name);
905 		if (nname == NULL) {
906 		unknown_parameter:
907 			snprintf(jail_errmsg, JAIL_ERRMSGLEN,
908 			    "unknown parameter: %s", jp->jp_name);
909 			errno = ENOENT;
910 			return (-1);
911 		}
912 		name = alloca(strlen(nname) + 1);
913 		strcpy(name, nname);
914 		free(nname);
915 		snprintf(desc.s, sizeof(desc.s), SJPARAM ".%s", name);
916 		miblen = sizeof(mib) - 2 * sizeof(int);
917 		if (sysctl(mib, 2, mib + 2, &miblen, desc.s,
918 		    strlen(desc.s)) < 0)
919 			goto unknown_parameter;
920 		jp->jp_flags |= JP_NOBOOL;
921 	}
922  mib_desc:
923 	mib[1] = 4;
924 	desclen = sizeof(desc);
925 	if (sysctl(mib, (miblen / sizeof(int)) + 2, &desc, &desclen,
926 	    NULL, 0) < 0) {
927 		snprintf(jail_errmsg, JAIL_ERRMSGLEN,
928 		    "sysctl(0.4.%s): %s", name, strerror(errno));
929 		return (-1);
930 	}
931 	jp->jp_ctltype = desc.i;
932 	/* If this came from removing a "no", it better be a boolean. */
933 	if (jp->jp_flags & JP_NOBOOL) {
934 		if ((desc.i & CTLTYPE) == CTLTYPE_INT && desc.s[0] == 'B') {
935 			jp->jp_valuelen = sizeof(int);
936 			return (0);
937 		}
938 		else if ((desc.i & CTLTYPE) != CTLTYPE_NODE)
939 			goto unknown_parameter;
940 	}
941 	/* See if this is an array type. */
942 	p = strchr(desc.s, '\0');
943 	isarray  = 0;
944 	if (p - 2 < desc.s || strcmp(p - 2, ",a"))
945 		isarray = 0;
946 	else {
947 		isarray = 1;
948 		p[-2] = 0;
949 	}
950 	/* Look for types we understand. */
951 	switch (desc.i & CTLTYPE) {
952 	case CTLTYPE_INT:
953 		if (desc.s[0] == 'B')
954 			jp->jp_flags |= JP_BOOL;
955 		else if (!strcmp(desc.s, "E,jailsys"))
956 			jp->jp_flags |= JP_JAILSYS;
957 	case CTLTYPE_UINT:
958 		jp->jp_valuelen = sizeof(int);
959 		break;
960 	case CTLTYPE_LONG:
961 	case CTLTYPE_ULONG:
962 		jp->jp_valuelen = sizeof(long);
963 		break;
964 	case CTLTYPE_S64:
965 	case CTLTYPE_U64:
966 		jp->jp_valuelen = sizeof(int64_t);
967 		break;
968 	case CTLTYPE_STRING:
969 		desc.s[0] = 0;
970 		desclen = sizeof(desc.s);
971 		if (sysctl(mib + 2, miblen / sizeof(int), desc.s, &desclen,
972 		    NULL, 0) < 0) {
973 			snprintf(jail_errmsg, JAIL_ERRMSGLEN,
974 			    "sysctl(" SJPARAM ".%s): %s", name,
975 			    strerror(errno));
976 			return (-1);
977 		}
978 		jp->jp_valuelen = strtoul(desc.s, NULL, 10);
979 		break;
980 	case CTLTYPE_STRUCT:
981 		if (!strcmp(desc.s, "S,in_addr")) {
982 			jp->jp_structtype = JPS_IN_ADDR;
983 			jp->jp_valuelen = sizeof(struct in_addr);
984 		} else if (!strcmp(desc.s, "S,in6_addr")) {
985 			jp->jp_structtype = JPS_IN6_ADDR;
986 			jp->jp_valuelen = sizeof(struct in6_addr);
987 		} else {
988 			desclen = 0;
989 			if (sysctl(mib + 2, miblen / sizeof(int),
990 			    NULL, &jp->jp_valuelen, NULL, 0) < 0) {
991 				snprintf(jail_errmsg, JAIL_ERRMSGLEN,
992 				    "sysctl(" SJPARAM ".%s): %s", name,
993 				    strerror(errno));
994 				return (-1);
995 			}
996 		}
997 		break;
998 	case CTLTYPE_NODE:
999 		/*
1000 		 * A node might be described by an empty-named child,
1001 		 * which would be immediately before or after the node itself.
1002 		 */
1003 		mib[1] = 1;
1004 		miblen += sizeof(int);
1005 		for (i = -1; i <= 1; i += 2) {
1006 			mib[(miblen / sizeof(int)) + 1] =
1007 			    mib[(miblen / sizeof(int))] + i;
1008 			desclen = sizeof(desc.s);
1009 			if (sysctl(mib, (miblen / sizeof(int)) + 2, desc.s,
1010 			    &desclen, NULL, 0) < 0) {
1011 				if (errno == ENOENT)
1012 					continue;
1013 				snprintf(jail_errmsg, JAIL_ERRMSGLEN,
1014 				    "sysctl(0.1): %s", strerror(errno));
1015 				return (-1);
1016 			}
1017 			if (desclen == sizeof(SJPARAM) + strlen(name) + 2 &&
1018 			    memcmp(SJPARAM ".", desc.s, sizeof(SJPARAM)) == 0 &&
1019 			    memcmp(name, desc.s + sizeof(SJPARAM),
1020 			    desclen - sizeof(SJPARAM) - 2) == 0 &&
1021 			    desc.s[desclen - 2] == '.')
1022 				goto mib_desc;
1023 		}
1024 		goto unknown_parameter;
1025 	default:
1026 		snprintf(jail_errmsg, JAIL_ERRMSGLEN,
1027 		    "unknown type for %s", jp->jp_name);
1028 		errno = ENOENT;
1029 		return (-1);
1030 	}
1031 	if (isarray) {
1032 		jp->jp_elemlen = jp->jp_valuelen;
1033 		jp->jp_valuelen = 0;
1034 	}
1035 	return (0);
1036 }
1037 
1038 /*
1039  * Attempt to load a kernel module matching an otherwise nonexistent parameter.
1040  */
1041 static int
1042 kldload_param(const char *name)
1043 {
1044 	int kl;
1045 
1046 	if (strcmp(name, "linux") == 0 || strncmp(name, "linux.", 6) == 0)
1047 		kl = kldload("linux");
1048 	else if (strcmp(name, "sysvmsg") == 0 || strcmp(name, "sysvsem") == 0 ||
1049 	    strcmp(name, "sysvshm") == 0)
1050 		kl = kldload(name);
1051 	else if (strncmp(name, "allow.mount.", 12) == 0) {
1052 		/* Load the matching filesystem */
1053 		const char *modname = name + 12;
1054 
1055 		kl = kldload(modname);
1056 		if (kl < 0 && errno == ENOENT &&
1057 		    strncmp(modname, "no", 2) == 0)
1058 			kl = kldload(modname + 2);
1059 	} else {
1060 		errno = ENOENT;
1061 		return (-1);
1062 	}
1063 	if (kl < 0 && errno == EEXIST) {
1064 		/*
1065 		 * In the module is already loaded, then it must not contain
1066 		 * the parameter.
1067 		 */
1068 		errno = ENOENT;
1069 	}
1070 	return kl;
1071 }
1072 
1073 /*
1074  * Change a boolean parameter name into its "no" counterpart or vice versa.
1075  */
1076 static char *
1077 noname(const char *name)
1078 {
1079 	char *nname, *p;
1080 
1081 	nname = malloc(strlen(name) + 3);
1082 	if (nname == NULL) {
1083 		strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
1084 		return (NULL);
1085 	}
1086 	p = strrchr(name, '.');
1087 	if (p != NULL)
1088 		sprintf(nname, "%.*s.no%s", (int)(p - name), name, p + 1);
1089 	else
1090 		sprintf(nname, "no%s", name);
1091 	return (nname);
1092 }
1093 
1094 static char *
1095 nononame(const char *name)
1096 {
1097 	char *p, *nname;
1098 
1099 	p = strrchr(name, '.');
1100 	if (strncmp(p ? p + 1 : name, "no", 2)) {
1101 		snprintf(jail_errmsg, sizeof(jail_errmsg),
1102 		    "mismatched boolean: %s", name);
1103 		errno = EINVAL;
1104 		return (NULL);
1105 	}
1106 	nname = malloc(strlen(name) - 1);
1107 	if (nname == NULL) {
1108 		strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
1109 		return (NULL);
1110 	}
1111 	if (p != NULL)
1112 		sprintf(nname, "%.*s.%s", (int)(p - name), name, p + 3);
1113 	else
1114 		strcpy(nname, name + 2);
1115 	return (nname);
1116 }
1117