xref: /freebsd/sys/kern/kern_jail.c (revision 1158508a8086a1a93492c1a2e22b61cd7fee4ec7)
19454b2d8SWarner Losh /*-
28a36da99SPedro F. Giffuni  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
38a36da99SPedro F. Giffuni  *
4413628a7SBjoern A. Zeeb  * Copyright (c) 1999 Poul-Henning Kamp.
5413628a7SBjoern A. Zeeb  * Copyright (c) 2008 Bjoern A. Zeeb.
6b38ff370SJamie Gritton  * Copyright (c) 2009 James Gritton.
7413628a7SBjoern A. Zeeb  * All rights reserved.
8b9f0b66cSBjoern A. Zeeb  *
9b9f0b66cSBjoern A. Zeeb  * Redistribution and use in source and binary forms, with or without
10b9f0b66cSBjoern A. Zeeb  * modification, are permitted provided that the following conditions
11b9f0b66cSBjoern A. Zeeb  * are met:
12b9f0b66cSBjoern A. Zeeb  * 1. Redistributions of source code must retain the above copyright
13b9f0b66cSBjoern A. Zeeb  *    notice, this list of conditions and the following disclaimer.
14b9f0b66cSBjoern A. Zeeb  * 2. Redistributions in binary form must reproduce the above copyright
15b9f0b66cSBjoern A. Zeeb  *    notice, this list of conditions and the following disclaimer in the
16b9f0b66cSBjoern A. Zeeb  *    documentation and/or other materials provided with the distribution.
17b9f0b66cSBjoern A. Zeeb  *
18b9f0b66cSBjoern A. Zeeb  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19b9f0b66cSBjoern A. Zeeb  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20b9f0b66cSBjoern A. Zeeb  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21b9f0b66cSBjoern A. Zeeb  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22b9f0b66cSBjoern A. Zeeb  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23b9f0b66cSBjoern A. Zeeb  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24b9f0b66cSBjoern A. Zeeb  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25b9f0b66cSBjoern A. Zeeb  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26b9f0b66cSBjoern A. Zeeb  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27b9f0b66cSBjoern A. Zeeb  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28b9f0b66cSBjoern A. Zeeb  * SUCH DAMAGE.
2907901f22SPoul-Henning Kamp  */
3075c13541SPoul-Henning Kamp 
31677b542eSDavid E. O'Brien #include <sys/cdefs.h>
32677b542eSDavid E. O'Brien __FBSDID("$FreeBSD$");
33677b542eSDavid E. O'Brien 
34413628a7SBjoern A. Zeeb #include "opt_ddb.h"
35413628a7SBjoern A. Zeeb #include "opt_inet.h"
36413628a7SBjoern A. Zeeb #include "opt_inet6.h"
3746e3b1cbSPawel Jakub Dawidek 
3875c13541SPoul-Henning Kamp #include <sys/param.h>
3975c13541SPoul-Henning Kamp #include <sys/types.h>
4075c13541SPoul-Henning Kamp #include <sys/kernel.h>
4175c13541SPoul-Henning Kamp #include <sys/systm.h>
4275c13541SPoul-Henning Kamp #include <sys/errno.h>
4375c13541SPoul-Henning Kamp #include <sys/sysproto.h>
4475c13541SPoul-Henning Kamp #include <sys/malloc.h>
450304c731SJamie Gritton #include <sys/osd.h>
46800c9408SRobert Watson #include <sys/priv.h>
4775c13541SPoul-Henning Kamp #include <sys/proc.h>
48b3059e09SRobert Watson #include <sys/taskqueue.h>
4957b4252eSKonstantin Belousov #include <sys/fcntl.h>
5075c13541SPoul-Henning Kamp #include <sys/jail.h>
51c3188289SKyle Evans #include <sys/linker.h>
5201137630SRobert Watson #include <sys/lock.h>
5301137630SRobert Watson #include <sys/mutex.h>
54097055e2SEdward Tomasz Napierala #include <sys/racct.h>
55f87beb93SAndriy Gapon #include <sys/rctl.h>
56a7ad07bfSEdward Tomasz Napierala #include <sys/refcount.h>
57dc68a633SPawel Jakub Dawidek #include <sys/sx.h>
5876ca6f88SJamie Gritton #include <sys/sysent.h>
59fd7a8150SMike Barcroft #include <sys/namei.h>
60820a0de9SPawel Jakub Dawidek #include <sys/mount.h>
61fd7a8150SMike Barcroft #include <sys/queue.h>
6275c13541SPoul-Henning Kamp #include <sys/socket.h>
63fd7a8150SMike Barcroft #include <sys/syscallsubr.h>
6483f1e257SRobert Watson #include <sys/sysctl.h>
65c3188289SKyle Evans #include <sys/uuid.h>
66fd7a8150SMike Barcroft #include <sys/vnode.h>
67530c0060SRobert Watson 
6875c13541SPoul-Henning Kamp #include <net/if.h>
69530c0060SRobert Watson #include <net/vnet.h>
70530c0060SRobert Watson 
7175c13541SPoul-Henning Kamp #include <netinet/in.h>
72530c0060SRobert Watson 
73413628a7SBjoern A. Zeeb #ifdef DDB
74413628a7SBjoern A. Zeeb #include <ddb/ddb.h>
75413628a7SBjoern A. Zeeb #endif /* DDB */
7675c13541SPoul-Henning Kamp 
77aed55708SRobert Watson #include <security/mac/mac_framework.h>
78aed55708SRobert Watson 
798986e3a0SJamie Gritton #define	DEFAULT_HOSTUUID	"00000000-0000-0000-0000-000000000000"
80c3188289SKyle Evans #define	PRISON0_HOSTUUID_MODULE	"hostuuid"
818986e3a0SJamie Gritton 
8275c13541SPoul-Henning Kamp MALLOC_DEFINE(M_PRISON, "prison", "Prison structures");
83d745c852SEd Schouten static MALLOC_DEFINE(M_PRISON_RACCT, "prison_racct", "Prison racct structures");
8475c13541SPoul-Henning Kamp 
85592bcae8SBjoern A. Zeeb /* Keep struct prison prison0 and some code in kern_jail_set() readable. */
86592bcae8SBjoern A. Zeeb #ifdef INET
87592bcae8SBjoern A. Zeeb #ifdef INET6
88592bcae8SBjoern A. Zeeb #define	_PR_IP_SADDRSEL	PR_IP4_SADDRSEL|PR_IP6_SADDRSEL
89592bcae8SBjoern A. Zeeb #else
90592bcae8SBjoern A. Zeeb #define	_PR_IP_SADDRSEL	PR_IP4_SADDRSEL
91592bcae8SBjoern A. Zeeb #endif
92592bcae8SBjoern A. Zeeb #else /* !INET */
93592bcae8SBjoern A. Zeeb #ifdef INET6
94592bcae8SBjoern A. Zeeb #define	_PR_IP_SADDRSEL	PR_IP6_SADDRSEL
95592bcae8SBjoern A. Zeeb #else
96592bcae8SBjoern A. Zeeb #define	_PR_IP_SADDRSEL	0
97592bcae8SBjoern A. Zeeb #endif
98592bcae8SBjoern A. Zeeb #endif
99592bcae8SBjoern A. Zeeb 
1000304c731SJamie Gritton /* prison0 describes what is "real" about the system. */
1010304c731SJamie Gritton struct prison prison0 = {
1020304c731SJamie Gritton 	.pr_id		= 0,
1030304c731SJamie Gritton 	.pr_name	= "0",
1040304c731SJamie Gritton 	.pr_ref		= 1,
1050304c731SJamie Gritton 	.pr_uref	= 1,
1060304c731SJamie Gritton 	.pr_path	= "/",
1070304c731SJamie Gritton 	.pr_securelevel	= -1,
1080cc207a6SMartin Matuska 	.pr_devfs_rsnum = 0,
109*1158508aSJamie Gritton 	.pr_state	= PRISON_STATE_ALIVE,
110b97457e2SJamie Gritton 	.pr_childmax	= JAIL_MAX,
1118986e3a0SJamie Gritton 	.pr_hostuuid	= DEFAULT_HOSTUUID,
11213e403fdSAntoine Brodin 	.pr_children	= LIST_HEAD_INITIALIZER(prison0.pr_children),
113eb79e1c7SBjoern A. Zeeb #ifdef VIMAGE
114592bcae8SBjoern A. Zeeb 	.pr_flags	= PR_HOST|PR_VNET|_PR_IP_SADDRSEL,
115eb79e1c7SBjoern A. Zeeb #else
116592bcae8SBjoern A. Zeeb 	.pr_flags	= PR_HOST|_PR_IP_SADDRSEL,
117eb79e1c7SBjoern A. Zeeb #endif
1180e5c6bd4SJamie Gritton 	.pr_allow	= PR_ALLOW_ALL_STATIC,
1190304c731SJamie Gritton };
1200304c731SJamie Gritton MTX_SYSINIT(prison0, &prison0.pr_mtx, "jail mutex", MTX_DEF);
12183f1e257SRobert Watson 
122672756aaSJamie Gritton struct bool_flags {
123672756aaSJamie Gritton 	const char	*name;
124672756aaSJamie Gritton 	const char	*noname;
1255d58f959SJamie Gritton 	volatile u_int	 flag;
126672756aaSJamie Gritton };
127672756aaSJamie Gritton struct jailsys_flags {
128672756aaSJamie Gritton 	const char	*name;
129672756aaSJamie Gritton 	unsigned	 disable;
130672756aaSJamie Gritton 	unsigned	 new;
131672756aaSJamie Gritton };
132672756aaSJamie Gritton 
133a7ad07bfSEdward Tomasz Napierala /* allprison, allprison_racct and lastprid are protected by allprison_lock. */
134dc68a633SPawel Jakub Dawidek struct	sx allprison_lock;
135b38ff370SJamie Gritton SX_SYSINIT(allprison_lock, &allprison_lock, "allprison");
136b38ff370SJamie Gritton struct	prisonlist allprison = TAILQ_HEAD_INITIALIZER(allprison);
137a7ad07bfSEdward Tomasz Napierala LIST_HEAD(, prison_racct) allprison_racct;
1382110d913SXin LI int	lastprid = 0;
139fd7a8150SMike Barcroft 
1407de883c8SJamie Gritton static int get_next_prid(struct prison **insprp);
141f7496dcaSJamie Gritton static int do_jail_attach(struct thread *td, struct prison *pr, int drflags);
142b3059e09SRobert Watson static void prison_complete(void *context, int pending);
143b38ff370SJamie Gritton static void prison_deref(struct prison *pr, int flags);
144f7496dcaSJamie Gritton static int prison_lock_xlock(struct prison *pr, int flags);
145f7496dcaSJamie Gritton static void prison_free_not_last(struct prison *pr);
1460fe74ae6SJamie Gritton static void prison_set_allow_locked(struct prison *pr, unsigned flag,
1470fe74ae6SJamie Gritton     int enable);
1480304c731SJamie Gritton static char *prison_path(struct prison *pr1, struct prison *pr2);
1490304c731SJamie Gritton static void prison_remove_one(struct prison *pr);
150a7ad07bfSEdward Tomasz Napierala #ifdef RACCT
151a7ad07bfSEdward Tomasz Napierala static void prison_racct_attach(struct prison *pr);
152c34bbd2aSEdward Tomasz Napierala static void prison_racct_modify(struct prison *pr);
153a7ad07bfSEdward Tomasz Napierala static void prison_racct_detach(struct prison *pr);
154a7ad07bfSEdward Tomasz Napierala #endif
155fd7a8150SMike Barcroft 
156b38ff370SJamie Gritton /* Flags for prison_deref */
1572a4b2251SJamie Gritton #define	PD_DEREF	0x01	/* Decrement pr_ref */
1582a4b2251SJamie Gritton #define	PD_DEUREF	0x02	/* Decrement pr_uref */
1592a4b2251SJamie Gritton #define	PD_LOCKED	0x04	/* pr_mtx is held */
1602a4b2251SJamie Gritton #define	PD_LIST_SLOCKED	0x08	/* allprison_lock is held shared */
1612a4b2251SJamie Gritton #define	PD_LIST_XLOCKED	0x10	/* allprison_lock is held exclusive */
162fd7a8150SMike Barcroft 
1630304c731SJamie Gritton /*
1645cc70397SBjoern A. Zeeb  * Parameter names corresponding to PR_* flag values.  Size values are for kvm
1655cc70397SBjoern A. Zeeb  * as we cannot figure out the size of a sparse array, or an array without a
1665cc70397SBjoern A. Zeeb  * terminating entry.
1670304c731SJamie Gritton  */
168672756aaSJamie Gritton static struct bool_flags pr_flag_bool[] = {
169672756aaSJamie Gritton 	{"persist", "nopersist", PR_PERSIST},
170592bcae8SBjoern A. Zeeb #ifdef INET
171672756aaSJamie Gritton 	{"ip4.saddrsel", "ip4.nosaddrsel", PR_IP4_SADDRSEL},
172592bcae8SBjoern A. Zeeb #endif
173592bcae8SBjoern A. Zeeb #ifdef INET6
174672756aaSJamie Gritton 	{"ip6.saddrsel", "ip6.nosaddrsel", PR_IP6_SADDRSEL},
175592bcae8SBjoern A. Zeeb #endif
1760304c731SJamie Gritton };
177672756aaSJamie Gritton const size_t pr_flag_bool_size = sizeof(pr_flag_bool);
1780304c731SJamie Gritton 
179672756aaSJamie Gritton static struct jailsys_flags pr_flag_jailsys[] = {
1807cbf7213SJamie Gritton 	{"host", 0, PR_HOST},
1817cbf7213SJamie Gritton #ifdef VIMAGE
1827cbf7213SJamie Gritton 	{"vnet", 0, PR_VNET},
1837cbf7213SJamie Gritton #endif
1840304c731SJamie Gritton #ifdef INET
1856a3f2779SJamie Gritton 	{"ip4", PR_IP4_USER, PR_IP4_USER},
1860304c731SJamie Gritton #endif
1870304c731SJamie Gritton #ifdef INET6
1886a3f2779SJamie Gritton 	{"ip6", PR_IP6_USER, PR_IP6_USER},
189679e1390SJamie Gritton #endif
1900304c731SJamie Gritton };
1915cc70397SBjoern A. Zeeb const size_t pr_flag_jailsys_size = sizeof(pr_flag_jailsys);
1920304c731SJamie Gritton 
1935d58f959SJamie Gritton /*
1945d58f959SJamie Gritton  * Make this array full-size so dynamic parameters can be added.
1955d58f959SJamie Gritton  * It is protected by prison0.mtx, but lockless reading is allowed
1965d58f959SJamie Gritton  * with an atomic check of the flag values.
1975d58f959SJamie Gritton  */
1980e5c6bd4SJamie Gritton static struct bool_flags pr_flag_allow[NBBY * NBPW] = {
199672756aaSJamie Gritton 	{"allow.set_hostname", "allow.noset_hostname", PR_ALLOW_SET_HOSTNAME},
200672756aaSJamie Gritton 	{"allow.sysvipc", "allow.nosysvipc", PR_ALLOW_SYSVIPC},
201672756aaSJamie Gritton 	{"allow.raw_sockets", "allow.noraw_sockets", PR_ALLOW_RAW_SOCKETS},
202672756aaSJamie Gritton 	{"allow.chflags", "allow.nochflags", PR_ALLOW_CHFLAGS},
203672756aaSJamie Gritton 	{"allow.mount", "allow.nomount", PR_ALLOW_MOUNT},
204672756aaSJamie Gritton 	{"allow.quotas", "allow.noquotas", PR_ALLOW_QUOTAS},
205672756aaSJamie Gritton 	{"allow.socket_af", "allow.nosocket_af", PR_ALLOW_SOCKET_AF},
206ccd6ac9fSAntoine Brodin 	{"allow.mlock", "allow.nomlock", PR_ALLOW_MLOCK},
207672756aaSJamie Gritton 	{"allow.reserved_ports", "allow.noreserved_ports",
208672756aaSJamie Gritton 	 PR_ALLOW_RESERVED_PORTS},
209b19d66fdSJamie Gritton 	{"allow.read_msgbuf", "allow.noread_msgbuf", PR_ALLOW_READ_MSGBUF},
210b3079544SJamie Gritton 	{"allow.unprivileged_proc_debug", "allow.nounprivileged_proc_debug",
211b3079544SJamie Gritton 	 PR_ALLOW_UNPRIV_DEBUG},
21205e1e482SMariusz Zaborski 	{"allow.suser", "allow.nosuser", PR_ALLOW_SUSER},
2130304c731SJamie Gritton };
2145d58f959SJamie Gritton static unsigned pr_allow_all = PR_ALLOW_ALL_STATIC;
215672756aaSJamie Gritton const size_t pr_flag_allow_size = sizeof(pr_flag_allow);
2160304c731SJamie Gritton 
217b3079544SJamie Gritton #define	JAIL_DEFAULT_ALLOW		(PR_ALLOW_SET_HOSTNAME | \
218b3079544SJamie Gritton 					 PR_ALLOW_RESERVED_PORTS | \
21905e1e482SMariusz Zaborski 					 PR_ALLOW_UNPRIV_DEBUG | \
22005e1e482SMariusz Zaborski 					 PR_ALLOW_SUSER)
22142bebd82SJamie Gritton #define	JAIL_DEFAULT_ENFORCE_STATFS	2
222bf3db8aaSMartin Matuska #define	JAIL_DEFAULT_DEVFS_RSNUM	0
2230304c731SJamie Gritton static unsigned jail_default_allow = JAIL_DEFAULT_ALLOW;
22442bebd82SJamie Gritton static int jail_default_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS;
2250cc207a6SMartin Matuska static int jail_default_devfs_rsnum = JAIL_DEFAULT_DEVFS_RSNUM;
2260304c731SJamie Gritton #if defined(INET) || defined(INET6)
227e92e0574SJamie Gritton static unsigned jail_max_af_ips = 255;
2280304c731SJamie Gritton #endif
2290304c731SJamie Gritton 
230b96bd95bSIan Lepore /*
231b96bd95bSIan Lepore  * Initialize the parts of prison0 that can't be static-initialized with
232b96bd95bSIan Lepore  * constants.  This is called from proc0_init() after creating thread0 cpuset.
233b96bd95bSIan Lepore  */
234b96bd95bSIan Lepore void
235b96bd95bSIan Lepore prison0_init(void)
236b96bd95bSIan Lepore {
237c3188289SKyle Evans 	uint8_t *file, *data;
238c3188289SKyle Evans 	size_t size;
239b96bd95bSIan Lepore 
240b96bd95bSIan Lepore 	prison0.pr_cpuset = cpuset_ref(thread0.td_cpuset);
241b96bd95bSIan Lepore 	prison0.pr_osreldate = osreldate;
242b96bd95bSIan Lepore 	strlcpy(prison0.pr_osrelease, osrelease, sizeof(prison0.pr_osrelease));
243c3188289SKyle Evans 
244c3188289SKyle Evans 	/* If we have a preloaded hostuuid, use it. */
245c3188289SKyle Evans 	file = preload_search_by_type(PRISON0_HOSTUUID_MODULE);
246c3188289SKyle Evans 	if (file != NULL) {
247c3188289SKyle Evans 		data = preload_fetch_addr(file);
248c3188289SKyle Evans 		size = preload_fetch_size(file);
249c3188289SKyle Evans 		if (data != NULL) {
250c3188289SKyle Evans 			/*
251c3188289SKyle Evans 			 * The preloaded data may include trailing whitespace, almost
252c3188289SKyle Evans 			 * certainly a newline; skip over any whitespace or
253c3188289SKyle Evans 			 * non-printable characters to be safe.
254c3188289SKyle Evans 			 */
255c3188289SKyle Evans 			while (size > 0 && data[size - 1] <= 0x20) {
256c3188289SKyle Evans 				data[size--] = '\0';
257c3188289SKyle Evans 			}
258c3188289SKyle Evans 			if (validate_uuid(data, size, NULL, 0) == 0) {
259c3188289SKyle Evans 				(void)strlcpy(prison0.pr_hostuuid, data,
260c3188289SKyle Evans 				    size + 1);
261c3188289SKyle Evans 			} else if (bootverbose) {
262c3188289SKyle Evans 				printf("hostuuid: preload data malformed: '%s'",
263c3188289SKyle Evans 				    data);
264c3188289SKyle Evans 			}
265c3188289SKyle Evans 		}
266c3188289SKyle Evans 	}
267c3188289SKyle Evans 	if (bootverbose)
268c3188289SKyle Evans 		printf("hostuuid: using %s\n", prison0.pr_hostuuid);
269b96bd95bSIan Lepore }
270b96bd95bSIan Lepore 
271116734c4SMatthew Dillon /*
2729ddb7954SMike Barcroft  * struct jail_args {
2739ddb7954SMike Barcroft  *	struct jail *jail;
2749ddb7954SMike Barcroft  * };
275116734c4SMatthew Dillon  */
27675c13541SPoul-Henning Kamp int
277c542c43eSJamie Gritton sys_jail(struct thread *td, struct jail_args *uap)
27875c13541SPoul-Henning Kamp {
279413628a7SBjoern A. Zeeb 	uint32_t version;
280413628a7SBjoern A. Zeeb 	int error;
2810304c731SJamie Gritton 	struct jail j;
282413628a7SBjoern A. Zeeb 
283413628a7SBjoern A. Zeeb 	error = copyin(uap->jail, &version, sizeof(uint32_t));
284413628a7SBjoern A. Zeeb 	if (error)
285413628a7SBjoern A. Zeeb 		return (error);
286413628a7SBjoern A. Zeeb 
287413628a7SBjoern A. Zeeb 	switch (version) {
288413628a7SBjoern A. Zeeb 	case 0:
289413628a7SBjoern A. Zeeb 	{
290413628a7SBjoern A. Zeeb 		struct jail_v0 j0;
291413628a7SBjoern A. Zeeb 
2920304c731SJamie Gritton 		/* FreeBSD single IPv4 jails. */
2930304c731SJamie Gritton 		bzero(&j, sizeof(struct jail));
294413628a7SBjoern A. Zeeb 		error = copyin(uap->jail, &j0, sizeof(struct jail_v0));
295413628a7SBjoern A. Zeeb 		if (error)
296413628a7SBjoern A. Zeeb 			return (error);
2970304c731SJamie Gritton 		j.version = j0.version;
2980304c731SJamie Gritton 		j.path = j0.path;
2990304c731SJamie Gritton 		j.hostname = j0.hostname;
300b5019bc4SPeter Wemm 		j.ip4s = htonl(j0.ip_number);	/* jail_v0 is host order */
301413628a7SBjoern A. Zeeb 		break;
302413628a7SBjoern A. Zeeb 	}
303413628a7SBjoern A. Zeeb 
304413628a7SBjoern A. Zeeb 	case 1:
305413628a7SBjoern A. Zeeb 		/*
306413628a7SBjoern A. Zeeb 		 * Version 1 was used by multi-IPv4 jail implementations
307413628a7SBjoern A. Zeeb 		 * that never made it into the official kernel.
308413628a7SBjoern A. Zeeb 		 */
309413628a7SBjoern A. Zeeb 		return (EINVAL);
310413628a7SBjoern A. Zeeb 
311413628a7SBjoern A. Zeeb 	case 2:	/* JAIL_API_VERSION */
312413628a7SBjoern A. Zeeb 		/* FreeBSD multi-IPv4/IPv6,noIP jails. */
313413628a7SBjoern A. Zeeb 		error = copyin(uap->jail, &j, sizeof(struct jail));
314413628a7SBjoern A. Zeeb 		if (error)
315413628a7SBjoern A. Zeeb 			return (error);
3160304c731SJamie Gritton 		break;
3170304c731SJamie Gritton 
3180304c731SJamie Gritton 	default:
3190304c731SJamie Gritton 		/* Sci-Fi jails are not supported, sorry. */
3200304c731SJamie Gritton 		return (EINVAL);
3210304c731SJamie Gritton 	}
322c542c43eSJamie Gritton 	return (kern_jail(td, &j));
3230304c731SJamie Gritton }
3240304c731SJamie Gritton 
3250304c731SJamie Gritton int
326c542c43eSJamie Gritton kern_jail(struct thread *td, struct jail *j)
3270304c731SJamie Gritton {
328c542c43eSJamie Gritton 	struct iovec optiov[2 * (4 + nitems(pr_flag_allow)
329e92e0574SJamie Gritton #ifdef INET
330e92e0574SJamie Gritton 			    + 1
331e92e0574SJamie Gritton #endif
332e92e0574SJamie Gritton #ifdef INET6
333e92e0574SJamie Gritton 			    + 1
334e92e0574SJamie Gritton #endif
335e92e0574SJamie Gritton 			    )];
3360304c731SJamie Gritton 	struct uio opt;
3370304c731SJamie Gritton 	char *u_path, *u_hostname, *u_name;
338672756aaSJamie Gritton 	struct bool_flags *bf;
3390304c731SJamie Gritton #ifdef INET
340e92e0574SJamie Gritton 	uint32_t ip4s;
3410304c731SJamie Gritton 	struct in_addr *u_ip4;
3420304c731SJamie Gritton #endif
3430304c731SJamie Gritton #ifdef INET6
3440304c731SJamie Gritton 	struct in6_addr *u_ip6;
3450304c731SJamie Gritton #endif
3460304c731SJamie Gritton 	size_t tmplen;
347c542c43eSJamie Gritton 	int error, enforce_statfs;
3480304c731SJamie Gritton 
3490304c731SJamie Gritton 	bzero(&optiov, sizeof(optiov));
3500304c731SJamie Gritton 	opt.uio_iov = optiov;
3510304c731SJamie Gritton 	opt.uio_iovcnt = 0;
3520304c731SJamie Gritton 	opt.uio_offset = -1;
3530304c731SJamie Gritton 	opt.uio_resid = -1;
3540304c731SJamie Gritton 	opt.uio_segflg = UIO_SYSSPACE;
3550304c731SJamie Gritton 	opt.uio_rw = UIO_READ;
3560304c731SJamie Gritton 	opt.uio_td = td;
3570304c731SJamie Gritton 
3580304c731SJamie Gritton 	/* Set permissions for top-level jails from sysctls. */
3590304c731SJamie Gritton 	if (!jailed(td->td_ucred)) {
360672756aaSJamie Gritton 		for (bf = pr_flag_allow;
3610e5c6bd4SJamie Gritton 		     bf < pr_flag_allow + nitems(pr_flag_allow) &&
3625d58f959SJamie Gritton 			atomic_load_int(&bf->flag) != 0;
363672756aaSJamie Gritton 		     bf++) {
364672756aaSJamie Gritton 			optiov[opt.uio_iovcnt].iov_base = __DECONST(char *,
365672756aaSJamie Gritton 			    (jail_default_allow & bf->flag)
366672756aaSJamie Gritton 			    ? bf->name : bf->noname);
3670304c731SJamie Gritton 			optiov[opt.uio_iovcnt].iov_len =
3680304c731SJamie Gritton 			    strlen(optiov[opt.uio_iovcnt].iov_base) + 1;
3690304c731SJamie Gritton 			opt.uio_iovcnt += 2;
3700304c731SJamie Gritton 		}
3710304c731SJamie Gritton 		optiov[opt.uio_iovcnt].iov_base = "enforce_statfs";
3720304c731SJamie Gritton 		optiov[opt.uio_iovcnt].iov_len = sizeof("enforce_statfs");
3730304c731SJamie Gritton 		opt.uio_iovcnt++;
3740304c731SJamie Gritton 		enforce_statfs = jail_default_enforce_statfs;
3750304c731SJamie Gritton 		optiov[opt.uio_iovcnt].iov_base = &enforce_statfs;
3760304c731SJamie Gritton 		optiov[opt.uio_iovcnt].iov_len = sizeof(enforce_statfs);
3770304c731SJamie Gritton 		opt.uio_iovcnt++;
3780304c731SJamie Gritton 	}
3790304c731SJamie Gritton 
380b38ff370SJamie Gritton 	tmplen = MAXPATHLEN + MAXHOSTNAMELEN + MAXHOSTNAMELEN;
381b38ff370SJamie Gritton #ifdef INET
3820304c731SJamie Gritton 	ip4s = (j->version == 0) ? 1 : j->ip4s;
3830304c731SJamie Gritton 	if (ip4s > jail_max_af_ips)
384b38ff370SJamie Gritton 		return (EINVAL);
3850304c731SJamie Gritton 	tmplen += ip4s * sizeof(struct in_addr);
386b38ff370SJamie Gritton #else
3870304c731SJamie Gritton 	if (j->ip4s > 0)
388b38ff370SJamie Gritton 		return (EINVAL);
389b38ff370SJamie Gritton #endif
390b38ff370SJamie Gritton #ifdef INET6
3910304c731SJamie Gritton 	if (j->ip6s > jail_max_af_ips)
392b38ff370SJamie Gritton 		return (EINVAL);
3930304c731SJamie Gritton 	tmplen += j->ip6s * sizeof(struct in6_addr);
394b38ff370SJamie Gritton #else
3950304c731SJamie Gritton 	if (j->ip6s > 0)
396b38ff370SJamie Gritton 		return (EINVAL);
397b38ff370SJamie Gritton #endif
398b38ff370SJamie Gritton 	u_path = malloc(tmplen, M_TEMP, M_WAITOK);
399b38ff370SJamie Gritton 	u_hostname = u_path + MAXPATHLEN;
400b38ff370SJamie Gritton 	u_name = u_hostname + MAXHOSTNAMELEN;
401b38ff370SJamie Gritton #ifdef INET
402b38ff370SJamie Gritton 	u_ip4 = (struct in_addr *)(u_name + MAXHOSTNAMELEN);
403b38ff370SJamie Gritton #endif
404b38ff370SJamie Gritton #ifdef INET6
405b38ff370SJamie Gritton #ifdef INET
4060304c731SJamie Gritton 	u_ip6 = (struct in6_addr *)(u_ip4 + ip4s);
407b38ff370SJamie Gritton #else
408b38ff370SJamie Gritton 	u_ip6 = (struct in6_addr *)(u_name + MAXHOSTNAMELEN);
409b38ff370SJamie Gritton #endif
410b38ff370SJamie Gritton #endif
4110304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = "path";
4120304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = sizeof("path");
4130304c731SJamie Gritton 	opt.uio_iovcnt++;
4140304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = u_path;
4150304c731SJamie Gritton 	error = copyinstr(j->path, u_path, MAXPATHLEN,
4160304c731SJamie Gritton 	    &optiov[opt.uio_iovcnt].iov_len);
417b38ff370SJamie Gritton 	if (error) {
418b38ff370SJamie Gritton 		free(u_path, M_TEMP);
419b38ff370SJamie Gritton 		return (error);
420b38ff370SJamie Gritton 	}
4210304c731SJamie Gritton 	opt.uio_iovcnt++;
4220304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = "host.hostname";
4230304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = sizeof("host.hostname");
4240304c731SJamie Gritton 	opt.uio_iovcnt++;
4250304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = u_hostname;
4260304c731SJamie Gritton 	error = copyinstr(j->hostname, u_hostname, MAXHOSTNAMELEN,
4270304c731SJamie Gritton 	    &optiov[opt.uio_iovcnt].iov_len);
428b38ff370SJamie Gritton 	if (error) {
429b38ff370SJamie Gritton 		free(u_path, M_TEMP);
430b38ff370SJamie Gritton 		return (error);
431b38ff370SJamie Gritton 	}
4320304c731SJamie Gritton 	opt.uio_iovcnt++;
4330304c731SJamie Gritton 	if (j->jailname != NULL) {
434b38ff370SJamie Gritton 		optiov[opt.uio_iovcnt].iov_base = "name";
435b38ff370SJamie Gritton 		optiov[opt.uio_iovcnt].iov_len = sizeof("name");
436b38ff370SJamie Gritton 		opt.uio_iovcnt++;
437b38ff370SJamie Gritton 		optiov[opt.uio_iovcnt].iov_base = u_name;
4380304c731SJamie Gritton 		error = copyinstr(j->jailname, u_name, MAXHOSTNAMELEN,
439b38ff370SJamie Gritton 		    &optiov[opt.uio_iovcnt].iov_len);
440b38ff370SJamie Gritton 		if (error) {
441b38ff370SJamie Gritton 			free(u_path, M_TEMP);
442b38ff370SJamie Gritton 			return (error);
443b38ff370SJamie Gritton 		}
444b38ff370SJamie Gritton 		opt.uio_iovcnt++;
445b38ff370SJamie Gritton 	}
446b38ff370SJamie Gritton #ifdef INET
447b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = "ip4.addr";
448b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = sizeof("ip4.addr");
449b38ff370SJamie Gritton 	opt.uio_iovcnt++;
450b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = u_ip4;
4510304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = ip4s * sizeof(struct in_addr);
4520304c731SJamie Gritton 	if (j->version == 0)
4530304c731SJamie Gritton 		u_ip4->s_addr = j->ip4s;
4540304c731SJamie Gritton 	else {
4550304c731SJamie Gritton 		error = copyin(j->ip4, u_ip4, optiov[opt.uio_iovcnt].iov_len);
456b38ff370SJamie Gritton 		if (error) {
457b38ff370SJamie Gritton 			free(u_path, M_TEMP);
458b38ff370SJamie Gritton 			return (error);
459b38ff370SJamie Gritton 		}
4600304c731SJamie Gritton 	}
461b38ff370SJamie Gritton 	opt.uio_iovcnt++;
462b38ff370SJamie Gritton #endif
463b38ff370SJamie Gritton #ifdef INET6
464b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = "ip6.addr";
465b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = sizeof("ip6.addr");
466b38ff370SJamie Gritton 	opt.uio_iovcnt++;
467b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = u_ip6;
4680304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = j->ip6s * sizeof(struct in6_addr);
4690304c731SJamie Gritton 	error = copyin(j->ip6, u_ip6, optiov[opt.uio_iovcnt].iov_len);
470b38ff370SJamie Gritton 	if (error) {
471b38ff370SJamie Gritton 		free(u_path, M_TEMP);
472b38ff370SJamie Gritton 		return (error);
473b38ff370SJamie Gritton 	}
474b38ff370SJamie Gritton 	opt.uio_iovcnt++;
475b38ff370SJamie Gritton #endif
47602abd400SPedro F. Giffuni 	KASSERT(opt.uio_iovcnt <= nitems(optiov),
4770304c731SJamie Gritton 		("kern_jail: too many iovecs (%d)", opt.uio_iovcnt));
478b38ff370SJamie Gritton 	error = kern_jail_set(td, &opt, JAIL_CREATE | JAIL_ATTACH);
479b38ff370SJamie Gritton 	free(u_path, M_TEMP);
480b38ff370SJamie Gritton 	return (error);
481b38ff370SJamie Gritton }
482b38ff370SJamie Gritton 
483b38ff370SJamie Gritton /*
484b38ff370SJamie Gritton  * struct jail_set_args {
485b38ff370SJamie Gritton  *	struct iovec *iovp;
486b38ff370SJamie Gritton  *	unsigned int iovcnt;
487b38ff370SJamie Gritton  *	int flags;
488b38ff370SJamie Gritton  * };
489b38ff370SJamie Gritton  */
490b38ff370SJamie Gritton int
4918451d0ddSKip Macy sys_jail_set(struct thread *td, struct jail_set_args *uap)
492b38ff370SJamie Gritton {
493b38ff370SJamie Gritton 	struct uio *auio;
494b38ff370SJamie Gritton 	int error;
495b38ff370SJamie Gritton 
496b38ff370SJamie Gritton 	/* Check that we have an even number of iovecs. */
497b38ff370SJamie Gritton 	if (uap->iovcnt & 1)
498b38ff370SJamie Gritton 		return (EINVAL);
499b38ff370SJamie Gritton 
500b38ff370SJamie Gritton 	error = copyinuio(uap->iovp, uap->iovcnt, &auio);
501b38ff370SJamie Gritton 	if (error)
502b38ff370SJamie Gritton 		return (error);
503b38ff370SJamie Gritton 	error = kern_jail_set(td, auio, uap->flags);
504b38ff370SJamie Gritton 	free(auio, M_IOV);
505b38ff370SJamie Gritton 	return (error);
506413628a7SBjoern A. Zeeb }
507413628a7SBjoern A. Zeeb 
508413628a7SBjoern A. Zeeb int
509b38ff370SJamie Gritton kern_jail_set(struct thread *td, struct uio *optuio, int flags)
510413628a7SBjoern A. Zeeb {
511fd7a8150SMike Barcroft 	struct nameidata nd;
512b38ff370SJamie Gritton #ifdef INET
513b38ff370SJamie Gritton 	struct in_addr *ip4;
514413628a7SBjoern A. Zeeb #endif
515b38ff370SJamie Gritton #ifdef INET6
516b38ff370SJamie Gritton 	struct in6_addr *ip6;
517b38ff370SJamie Gritton #endif
518b38ff370SJamie Gritton 	struct vfsopt *opt;
519b38ff370SJamie Gritton 	struct vfsoptlist *opts;
5207de883c8SJamie Gritton 	struct prison *pr, *deadpr, *inspr, *mypr, *ppr, *tpr;
521b38ff370SJamie Gritton 	struct vnode *root;
522babbbb9cSJamie Gritton 	char *domain, *errmsg, *host, *name, *namelc, *p, *path, *uuid;
523b96bd95bSIan Lepore 	char *g_path, *osrelstr;
524672756aaSJamie Gritton 	struct bool_flags *bf;
525672756aaSJamie Gritton 	struct jailsys_flags *jsf;
5260304c731SJamie Gritton #if defined(INET) || defined(INET6)
52757aea6dfSBjoern A. Zeeb 	struct prison *tppr;
528b38ff370SJamie Gritton 	void *op;
5290304c731SJamie Gritton #endif
53076ca6f88SJamie Gritton 	unsigned long hid;
531b6f47c23SJamie Gritton 	size_t namelen, onamelen, pnamelen;
5322a4b2251SJamie Gritton 	int born, created, cuflags, descend, drflags, enforce;
533cc5fd8c7SJamie Gritton 	int error, errmsg_len, errmsg_pos;
5340cc207a6SMartin Matuska 	int gotchildmax, gotenforce, gothid, gotrsnum, gotslevel;
535672756aaSJamie Gritton 	int jid, jsys, len, level;
536b96bd95bSIan Lepore 	int childmax, osreldt, rsnum, slevel;
537d465a41dSBjoern A. Zeeb #if defined(INET) || defined(INET6)
5380304c731SJamie Gritton 	int ii, ij;
539413628a7SBjoern A. Zeeb #endif
540413628a7SBjoern A. Zeeb #ifdef INET
5412b0d6f81SJamie Gritton 	int ip4s, redo_ip4;
542413628a7SBjoern A. Zeeb #endif
543b38ff370SJamie Gritton #ifdef INET6
5442b0d6f81SJamie Gritton 	int ip6s, redo_ip6;
545b38ff370SJamie Gritton #endif
5466beb3bb4SKirk McKusick 	uint64_t pr_allow, ch_allow, pr_flags, ch_flags;
547b3079544SJamie Gritton 	uint64_t pr_allow_diff;
5486beb3bb4SKirk McKusick 	unsigned tallow;
549b38ff370SJamie Gritton 	char numbuf[12];
550b38ff370SJamie Gritton 
551b38ff370SJamie Gritton 	error = priv_check(td, PRIV_JAIL_SET);
552b38ff370SJamie Gritton 	if (!error && (flags & JAIL_ATTACH))
553b38ff370SJamie Gritton 		error = priv_check(td, PRIV_JAIL_ATTACH);
554b38ff370SJamie Gritton 	if (error)
55575c13541SPoul-Henning Kamp 		return (error);
556b6f47c23SJamie Gritton 	mypr = td->td_ucred->cr_prison;
557b97457e2SJamie Gritton 	if ((flags & JAIL_CREATE) && mypr->pr_childmax == 0)
5580304c731SJamie Gritton 		return (EPERM);
559b38ff370SJamie Gritton 	if (flags & ~JAIL_SET_MASK)
560b38ff370SJamie Gritton 		return (EINVAL);
561b38ff370SJamie Gritton 
562b38ff370SJamie Gritton 	/*
563b38ff370SJamie Gritton 	 * Check all the parameters before committing to anything.  Not all
564b38ff370SJamie Gritton 	 * errors can be caught early, but we may as well try.  Also, this
565b38ff370SJamie Gritton 	 * takes care of some expensive stuff (path lookup) before getting
566b38ff370SJamie Gritton 	 * the allprison lock.
567b38ff370SJamie Gritton 	 *
568b38ff370SJamie Gritton 	 * XXX Jails are not filesystems, and jail parameters are not mount
569b38ff370SJamie Gritton 	 *     options.  But it makes more sense to re-use the vfsopt code
570b38ff370SJamie Gritton 	 *     than duplicate it under a different name.
571b38ff370SJamie Gritton 	 */
572b38ff370SJamie Gritton 	error = vfs_buildopts(optuio, &opts);
573b38ff370SJamie Gritton 	if (error)
574b38ff370SJamie Gritton 		return (error);
575b38ff370SJamie Gritton #ifdef INET
576b38ff370SJamie Gritton 	ip4 = NULL;
577b38ff370SJamie Gritton #endif
578b38ff370SJamie Gritton #ifdef INET6
579b38ff370SJamie Gritton 	ip6 = NULL;
580b38ff370SJamie Gritton #endif
5816dfe0a3dSMartin Matuska 	g_path = NULL;
582b38ff370SJamie Gritton 
583b6f47c23SJamie Gritton 	cuflags = flags & (JAIL_CREATE | JAIL_UPDATE);
584b6f47c23SJamie Gritton 	if (!cuflags) {
585b6f47c23SJamie Gritton 		error = EINVAL;
586b6f47c23SJamie Gritton 		vfs_opterror(opts, "no valid operation (create or update)");
587b6f47c23SJamie Gritton 		goto done_errmsg;
588b6f47c23SJamie Gritton 	}
589b6f47c23SJamie Gritton 
590b38ff370SJamie Gritton 	error = vfs_copyopt(opts, "jid", &jid, sizeof(jid));
591b38ff370SJamie Gritton 	if (error == ENOENT)
592b38ff370SJamie Gritton 		jid = 0;
593b38ff370SJamie Gritton 	else if (error != 0)
594b38ff370SJamie Gritton 		goto done_free;
595b38ff370SJamie Gritton 
596b38ff370SJamie Gritton 	error = vfs_copyopt(opts, "securelevel", &slevel, sizeof(slevel));
597b38ff370SJamie Gritton 	if (error == ENOENT)
598b38ff370SJamie Gritton 		gotslevel = 0;
599b38ff370SJamie Gritton 	else if (error != 0)
600b38ff370SJamie Gritton 		goto done_free;
601b38ff370SJamie Gritton 	else
602b38ff370SJamie Gritton 		gotslevel = 1;
603b38ff370SJamie Gritton 
604b97457e2SJamie Gritton 	error =
605b97457e2SJamie Gritton 	    vfs_copyopt(opts, "children.max", &childmax, sizeof(childmax));
606b97457e2SJamie Gritton 	if (error == ENOENT)
607b97457e2SJamie Gritton 		gotchildmax = 0;
608b97457e2SJamie Gritton 	else if (error != 0)
609b97457e2SJamie Gritton 		goto done_free;
610b97457e2SJamie Gritton 	else
611b97457e2SJamie Gritton 		gotchildmax = 1;
612b97457e2SJamie Gritton 
6130304c731SJamie Gritton 	error = vfs_copyopt(opts, "enforce_statfs", &enforce, sizeof(enforce));
614f337198dSJamie Gritton 	if (error == ENOENT)
615f337198dSJamie Gritton 		gotenforce = 0;
616f337198dSJamie Gritton 	else if (error != 0)
6170304c731SJamie Gritton 		goto done_free;
618f337198dSJamie Gritton 	else if (enforce < 0 || enforce > 2) {
619f337198dSJamie Gritton 		error = EINVAL;
620f337198dSJamie Gritton 		goto done_free;
621f337198dSJamie Gritton 	} else
622f337198dSJamie Gritton 		gotenforce = 1;
6230304c731SJamie Gritton 
6240cc207a6SMartin Matuska 	error = vfs_copyopt(opts, "devfs_ruleset", &rsnum, sizeof(rsnum));
6250cc207a6SMartin Matuska 	if (error == ENOENT)
6260cc207a6SMartin Matuska 		gotrsnum = 0;
6270cc207a6SMartin Matuska 	else if (error != 0)
6280cc207a6SMartin Matuska 		goto done_free;
6290cc207a6SMartin Matuska 	else
6300cc207a6SMartin Matuska 		gotrsnum = 1;
6310cc207a6SMartin Matuska 
632b38ff370SJamie Gritton 	pr_flags = ch_flags = 0;
633672756aaSJamie Gritton 	for (bf = pr_flag_bool;
634672756aaSJamie Gritton 	     bf < pr_flag_bool + nitems(pr_flag_bool);
635672756aaSJamie Gritton 	     bf++) {
636672756aaSJamie Gritton 		vfs_flagopt(opts, bf->name, &pr_flags, bf->flag);
637672756aaSJamie Gritton 		vfs_flagopt(opts, bf->noname, &ch_flags, bf->flag);
6380304c731SJamie Gritton 	}
639b38ff370SJamie Gritton 	ch_flags |= pr_flags;
640672756aaSJamie Gritton 	for (jsf = pr_flag_jailsys;
641672756aaSJamie Gritton 	     jsf < pr_flag_jailsys + nitems(pr_flag_jailsys);
642672756aaSJamie Gritton 	     jsf++) {
643672756aaSJamie Gritton 		error = vfs_copyopt(opts, jsf->name, &jsys, sizeof(jsys));
6447cbf7213SJamie Gritton 		if (error == ENOENT)
6457cbf7213SJamie Gritton 			continue;
6467cbf7213SJamie Gritton 		if (error != 0)
6477cbf7213SJamie Gritton 			goto done_free;
6487cbf7213SJamie Gritton 		switch (jsys) {
6497cbf7213SJamie Gritton 		case JAIL_SYS_DISABLE:
650672756aaSJamie Gritton 			if (!jsf->disable) {
6517cbf7213SJamie Gritton 				error = EINVAL;
6527cbf7213SJamie Gritton 				goto done_free;
6537cbf7213SJamie Gritton 			}
654672756aaSJamie Gritton 			pr_flags |= jsf->disable;
6557cbf7213SJamie Gritton 			break;
6567cbf7213SJamie Gritton 		case JAIL_SYS_NEW:
657672756aaSJamie Gritton 			pr_flags |= jsf->new;
6587cbf7213SJamie Gritton 			break;
6597cbf7213SJamie Gritton 		case JAIL_SYS_INHERIT:
6607cbf7213SJamie Gritton 			break;
6617cbf7213SJamie Gritton 		default:
6627cbf7213SJamie Gritton 			error = EINVAL;
6637cbf7213SJamie Gritton 			goto done_free;
6647cbf7213SJamie Gritton 		}
665672756aaSJamie Gritton 		ch_flags |= jsf->new | jsf->disable;
6667cbf7213SJamie Gritton 	}
667*1158508aSJamie Gritton 	if ((flags & (JAIL_CREATE | JAIL_ATTACH)) == JAIL_CREATE
6684affa14cSJamie Gritton 	    && !(pr_flags & PR_PERSIST)) {
6694affa14cSJamie Gritton 		error = EINVAL;
6704affa14cSJamie Gritton 		vfs_opterror(opts, "new jail must persist or attach");
6714affa14cSJamie Gritton 		goto done_errmsg;
6724affa14cSJamie Gritton 	}
673679e1390SJamie Gritton #ifdef VIMAGE
674679e1390SJamie Gritton 	if ((flags & JAIL_UPDATE) && (ch_flags & PR_VNET)) {
675679e1390SJamie Gritton 		error = EINVAL;
676679e1390SJamie Gritton 		vfs_opterror(opts, "vnet cannot be changed after creation");
677679e1390SJamie Gritton 		goto done_errmsg;
678679e1390SJamie Gritton 	}
679679e1390SJamie Gritton #endif
6802b0d6f81SJamie Gritton #ifdef INET
6812b0d6f81SJamie Gritton 	if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP4_USER)) {
6822b0d6f81SJamie Gritton 		error = EINVAL;
6832b0d6f81SJamie Gritton 		vfs_opterror(opts, "ip4 cannot be changed after creation");
6842b0d6f81SJamie Gritton 		goto done_errmsg;
6852b0d6f81SJamie Gritton 	}
6862b0d6f81SJamie Gritton #endif
6872b0d6f81SJamie Gritton #ifdef INET6
6882b0d6f81SJamie Gritton 	if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP6_USER)) {
6892b0d6f81SJamie Gritton 		error = EINVAL;
6902b0d6f81SJamie Gritton 		vfs_opterror(opts, "ip6 cannot be changed after creation");
6912b0d6f81SJamie Gritton 		goto done_errmsg;
6922b0d6f81SJamie Gritton 	}
6932b0d6f81SJamie Gritton #endif
694b38ff370SJamie Gritton 
6950304c731SJamie Gritton 	pr_allow = ch_allow = 0;
696672756aaSJamie Gritton 	for (bf = pr_flag_allow;
6975d58f959SJamie Gritton 	     bf < pr_flag_allow + nitems(pr_flag_allow) &&
6985d58f959SJamie Gritton 		atomic_load_int(&bf->flag) != 0;
699672756aaSJamie Gritton 	     bf++) {
700672756aaSJamie Gritton 		vfs_flagopt(opts, bf->name, &pr_allow, bf->flag);
701672756aaSJamie Gritton 		vfs_flagopt(opts, bf->noname, &ch_allow, bf->flag);
7020304c731SJamie Gritton 	}
7030304c731SJamie Gritton 	ch_allow |= pr_allow;
7040304c731SJamie Gritton 
705b38ff370SJamie Gritton 	error = vfs_getopt(opts, "name", (void **)&name, &len);
706b38ff370SJamie Gritton 	if (error == ENOENT)
707b38ff370SJamie Gritton 		name = NULL;
708b38ff370SJamie Gritton 	else if (error != 0)
709b38ff370SJamie Gritton 		goto done_free;
710b38ff370SJamie Gritton 	else {
711b38ff370SJamie Gritton 		if (len == 0 || name[len - 1] != '\0') {
712b38ff370SJamie Gritton 			error = EINVAL;
713b38ff370SJamie Gritton 			goto done_free;
714b38ff370SJamie Gritton 		}
715b38ff370SJamie Gritton 		if (len > MAXHOSTNAMELEN) {
716b38ff370SJamie Gritton 			error = ENAMETOOLONG;
717b38ff370SJamie Gritton 			goto done_free;
718b38ff370SJamie Gritton 		}
719b38ff370SJamie Gritton 	}
720b38ff370SJamie Gritton 
721b38ff370SJamie Gritton 	error = vfs_getopt(opts, "host.hostname", (void **)&host, &len);
722b38ff370SJamie Gritton 	if (error == ENOENT)
723b38ff370SJamie Gritton 		host = NULL;
724b38ff370SJamie Gritton 	else if (error != 0)
725b38ff370SJamie Gritton 		goto done_free;
726b38ff370SJamie Gritton 	else {
72776ca6f88SJamie Gritton 		ch_flags |= PR_HOST;
72876ca6f88SJamie Gritton 		pr_flags |= PR_HOST;
729b38ff370SJamie Gritton 		if (len == 0 || host[len - 1] != '\0') {
730b38ff370SJamie Gritton 			error = EINVAL;
731b38ff370SJamie Gritton 			goto done_free;
732b38ff370SJamie Gritton 		}
733b38ff370SJamie Gritton 		if (len > MAXHOSTNAMELEN) {
734b38ff370SJamie Gritton 			error = ENAMETOOLONG;
735b38ff370SJamie Gritton 			goto done_free;
736b38ff370SJamie Gritton 		}
737b38ff370SJamie Gritton 	}
738b38ff370SJamie Gritton 
73976ca6f88SJamie Gritton 	error = vfs_getopt(opts, "host.domainname", (void **)&domain, &len);
74076ca6f88SJamie Gritton 	if (error == ENOENT)
74176ca6f88SJamie Gritton 		domain = NULL;
74276ca6f88SJamie Gritton 	else if (error != 0)
74376ca6f88SJamie Gritton 		goto done_free;
74476ca6f88SJamie Gritton 	else {
74576ca6f88SJamie Gritton 		ch_flags |= PR_HOST;
74676ca6f88SJamie Gritton 		pr_flags |= PR_HOST;
74776ca6f88SJamie Gritton 		if (len == 0 || domain[len - 1] != '\0') {
74876ca6f88SJamie Gritton 			error = EINVAL;
74976ca6f88SJamie Gritton 			goto done_free;
75076ca6f88SJamie Gritton 		}
75176ca6f88SJamie Gritton 		if (len > MAXHOSTNAMELEN) {
75276ca6f88SJamie Gritton 			error = ENAMETOOLONG;
75376ca6f88SJamie Gritton 			goto done_free;
75476ca6f88SJamie Gritton 		}
75576ca6f88SJamie Gritton 	}
75676ca6f88SJamie Gritton 
75776ca6f88SJamie Gritton 	error = vfs_getopt(opts, "host.hostuuid", (void **)&uuid, &len);
75876ca6f88SJamie Gritton 	if (error == ENOENT)
75976ca6f88SJamie Gritton 		uuid = NULL;
76076ca6f88SJamie Gritton 	else if (error != 0)
76176ca6f88SJamie Gritton 		goto done_free;
76276ca6f88SJamie Gritton 	else {
76376ca6f88SJamie Gritton 		ch_flags |= PR_HOST;
76476ca6f88SJamie Gritton 		pr_flags |= PR_HOST;
76576ca6f88SJamie Gritton 		if (len == 0 || uuid[len - 1] != '\0') {
76676ca6f88SJamie Gritton 			error = EINVAL;
76776ca6f88SJamie Gritton 			goto done_free;
76876ca6f88SJamie Gritton 		}
76976ca6f88SJamie Gritton 		if (len > HOSTUUIDLEN) {
77076ca6f88SJamie Gritton 			error = ENAMETOOLONG;
77176ca6f88SJamie Gritton 			goto done_free;
77276ca6f88SJamie Gritton 		}
77376ca6f88SJamie Gritton 	}
77476ca6f88SJamie Gritton 
775841c0c7eSNathan Whitehorn #ifdef COMPAT_FREEBSD32
776a5c1afadSDmitry Chagin 	if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) {
77776ca6f88SJamie Gritton 		uint32_t hid32;
77876ca6f88SJamie Gritton 
77976ca6f88SJamie Gritton 		error = vfs_copyopt(opts, "host.hostid", &hid32, sizeof(hid32));
78076ca6f88SJamie Gritton 		hid = hid32;
78176ca6f88SJamie Gritton 	} else
78276ca6f88SJamie Gritton #endif
78376ca6f88SJamie Gritton 		error = vfs_copyopt(opts, "host.hostid", &hid, sizeof(hid));
78476ca6f88SJamie Gritton 	if (error == ENOENT)
78576ca6f88SJamie Gritton 		gothid = 0;
78676ca6f88SJamie Gritton 	else if (error != 0)
78776ca6f88SJamie Gritton 		goto done_free;
78876ca6f88SJamie Gritton 	else {
78976ca6f88SJamie Gritton 		gothid = 1;
79076ca6f88SJamie Gritton 		ch_flags |= PR_HOST;
79176ca6f88SJamie Gritton 		pr_flags |= PR_HOST;
79276ca6f88SJamie Gritton 	}
79376ca6f88SJamie Gritton 
794b38ff370SJamie Gritton #ifdef INET
795b38ff370SJamie Gritton 	error = vfs_getopt(opts, "ip4.addr", &op, &ip4s);
796b38ff370SJamie Gritton 	if (error == ENOENT)
7970e5e396eSJamie Gritton 		ip4s = 0;
798b38ff370SJamie Gritton 	else if (error != 0)
799b38ff370SJamie Gritton 		goto done_free;
800b38ff370SJamie Gritton 	else if (ip4s & (sizeof(*ip4) - 1)) {
801b38ff370SJamie Gritton 		error = EINVAL;
802b38ff370SJamie Gritton 		goto done_free;
8030304c731SJamie Gritton 	} else {
8046a3f2779SJamie Gritton 		ch_flags |= PR_IP4_USER;
8056a3f2779SJamie Gritton 		pr_flags |= PR_IP4_USER;
8066a3f2779SJamie Gritton 		if (ip4s > 0) {
807b38ff370SJamie Gritton 			ip4s /= sizeof(*ip4);
808b38ff370SJamie Gritton 			if (ip4s > jail_max_af_ips) {
809b38ff370SJamie Gritton 				error = EINVAL;
810b38ff370SJamie Gritton 				vfs_opterror(opts, "too many IPv4 addresses");
811b38ff370SJamie Gritton 				goto done_errmsg;
812b38ff370SJamie Gritton 			}
8132b0d6f81SJamie Gritton 			ip4 = malloc(ip4s * sizeof(*ip4), M_PRISON, M_WAITOK);
814b38ff370SJamie Gritton 			bcopy(op, ip4, ip4s * sizeof(*ip4));
815b38ff370SJamie Gritton 			/*
8160304c731SJamie Gritton 			 * IP addresses are all sorted but ip[0] to preserve
8170304c731SJamie Gritton 			 * the primary IP address as given from userland.
8180304c731SJamie Gritton 			 * This special IP is used for unbound outgoing
819bef916f9SBjoern A. Zeeb 			 * connections as well for "loopback" traffic in case
820bef916f9SBjoern A. Zeeb 			 * source address selection cannot find any more fitting
821bef916f9SBjoern A. Zeeb 			 * address to connect from.
822b38ff370SJamie Gritton 			 */
823b38ff370SJamie Gritton 			if (ip4s > 1)
8240ce1624dSStephen J. Kiernan 				qsort(ip4 + 1, ip4s - 1, sizeof(*ip4),
8250ce1624dSStephen J. Kiernan 				    prison_qcmp_v4);
826b38ff370SJamie Gritton 			/*
8270304c731SJamie Gritton 			 * Check for duplicate addresses and do some simple
8280304c731SJamie Gritton 			 * zero and broadcast checks. If users give other bogus
8290304c731SJamie Gritton 			 * addresses it is their problem.
830b38ff370SJamie Gritton 			 *
8310304c731SJamie Gritton 			 * We do not have to care about byte order for these
8320304c731SJamie Gritton 			 * checks so we will do them in NBO.
833b38ff370SJamie Gritton 			 */
834b38ff370SJamie Gritton 			for (ii = 0; ii < ip4s; ii++) {
835b38ff370SJamie Gritton 				if (ip4[ii].s_addr == INADDR_ANY ||
836b38ff370SJamie Gritton 				    ip4[ii].s_addr == INADDR_BROADCAST) {
837b38ff370SJamie Gritton 					error = EINVAL;
838b38ff370SJamie Gritton 					goto done_free;
839b38ff370SJamie Gritton 				}
840b38ff370SJamie Gritton 				if ((ii+1) < ip4s &&
841b38ff370SJamie Gritton 				    (ip4[0].s_addr == ip4[ii+1].s_addr ||
842b38ff370SJamie Gritton 				     ip4[ii].s_addr == ip4[ii+1].s_addr)) {
843b38ff370SJamie Gritton 					error = EINVAL;
844b38ff370SJamie Gritton 					goto done_free;
845b38ff370SJamie Gritton 				}
846b38ff370SJamie Gritton 			}
847b38ff370SJamie Gritton 		}
8480304c731SJamie Gritton 	}
849b38ff370SJamie Gritton #endif
850b38ff370SJamie Gritton 
851b38ff370SJamie Gritton #ifdef INET6
852b38ff370SJamie Gritton 	error = vfs_getopt(opts, "ip6.addr", &op, &ip6s);
853b38ff370SJamie Gritton 	if (error == ENOENT)
8540e5e396eSJamie Gritton 		ip6s = 0;
855b38ff370SJamie Gritton 	else if (error != 0)
856b38ff370SJamie Gritton 		goto done_free;
857b38ff370SJamie Gritton 	else if (ip6s & (sizeof(*ip6) - 1)) {
858b38ff370SJamie Gritton 		error = EINVAL;
859b38ff370SJamie Gritton 		goto done_free;
8600304c731SJamie Gritton 	} else {
8616a3f2779SJamie Gritton 		ch_flags |= PR_IP6_USER;
8626a3f2779SJamie Gritton 		pr_flags |= PR_IP6_USER;
8636a3f2779SJamie Gritton 		if (ip6s > 0) {
864b38ff370SJamie Gritton 			ip6s /= sizeof(*ip6);
865b38ff370SJamie Gritton 			if (ip6s > jail_max_af_ips) {
866b38ff370SJamie Gritton 				error = EINVAL;
867b38ff370SJamie Gritton 				vfs_opterror(opts, "too many IPv6 addresses");
868b38ff370SJamie Gritton 				goto done_errmsg;
869b38ff370SJamie Gritton 			}
8702b0d6f81SJamie Gritton 			ip6 = malloc(ip6s * sizeof(*ip6), M_PRISON, M_WAITOK);
871b38ff370SJamie Gritton 			bcopy(op, ip6, ip6s * sizeof(*ip6));
872b38ff370SJamie Gritton 			if (ip6s > 1)
8730ce1624dSStephen J. Kiernan 				qsort(ip6 + 1, ip6s - 1, sizeof(*ip6),
8740ce1624dSStephen J. Kiernan 				    prison_qcmp_v6);
875b38ff370SJamie Gritton 			for (ii = 0; ii < ip6s; ii++) {
8760304c731SJamie Gritton 				if (IN6_IS_ADDR_UNSPECIFIED(&ip6[ii])) {
877b38ff370SJamie Gritton 					error = EINVAL;
878b38ff370SJamie Gritton 					goto done_free;
879b38ff370SJamie Gritton 				}
880b38ff370SJamie Gritton 				if ((ii+1) < ip6s &&
881b38ff370SJamie Gritton 				    (IN6_ARE_ADDR_EQUAL(&ip6[0], &ip6[ii+1]) ||
882b38ff370SJamie Gritton 				     IN6_ARE_ADDR_EQUAL(&ip6[ii], &ip6[ii+1])))
883b38ff370SJamie Gritton 				{
884b38ff370SJamie Gritton 					error = EINVAL;
885b38ff370SJamie Gritton 					goto done_free;
886b38ff370SJamie Gritton 				}
887b38ff370SJamie Gritton 			}
888b38ff370SJamie Gritton 		}
8890304c731SJamie Gritton 	}
890b38ff370SJamie Gritton #endif
891b38ff370SJamie Gritton 
892bdfc8cc4SJamie Gritton #if defined(VIMAGE) && (defined(INET) || defined(INET6))
893bdfc8cc4SJamie Gritton 	if ((ch_flags & PR_VNET) && (ch_flags & (PR_IP4_USER | PR_IP6_USER))) {
894bdfc8cc4SJamie Gritton 		error = EINVAL;
895bdfc8cc4SJamie Gritton 		vfs_opterror(opts,
896bdfc8cc4SJamie Gritton 		    "vnet jails cannot have IP address restrictions");
897bdfc8cc4SJamie Gritton 		goto done_errmsg;
898bdfc8cc4SJamie Gritton 	}
899bdfc8cc4SJamie Gritton #endif
900bdfc8cc4SJamie Gritton 
901cf0313c6SJamie Gritton 	error = vfs_getopt(opts, "osrelease", (void **)&osrelstr, &len);
902cf0313c6SJamie Gritton 	if (error == ENOENT)
903cf0313c6SJamie Gritton 		osrelstr = NULL;
904cf0313c6SJamie Gritton 	else if (error != 0)
905cf0313c6SJamie Gritton 		goto done_free;
906cf0313c6SJamie Gritton 	else {
907cf0313c6SJamie Gritton 		if (flags & JAIL_UPDATE) {
908cf0313c6SJamie Gritton 			error = EINVAL;
909cf0313c6SJamie Gritton 			vfs_opterror(opts,
910cf0313c6SJamie Gritton 			    "osrelease cannot be changed after creation");
911cf0313c6SJamie Gritton 			goto done_errmsg;
912cf0313c6SJamie Gritton 		}
9131b786d01SBjoern A. Zeeb 		if (len == 0 || osrelstr[len - 1] != '\0') {
914cf0313c6SJamie Gritton 			error = EINVAL;
9151b786d01SBjoern A. Zeeb 			goto done_free;
9161b786d01SBjoern A. Zeeb 		}
9171b786d01SBjoern A. Zeeb 		if (len >= OSRELEASELEN) {
9181b786d01SBjoern A. Zeeb 			error = ENAMETOOLONG;
919cf0313c6SJamie Gritton 			vfs_opterror(opts,
920cf0313c6SJamie Gritton 			    "osrelease string must be 1-%d bytes long",
921cf0313c6SJamie Gritton 			    OSRELEASELEN - 1);
922cf0313c6SJamie Gritton 			goto done_errmsg;
923cf0313c6SJamie Gritton 		}
924cf0313c6SJamie Gritton 	}
925cf0313c6SJamie Gritton 
926cf0313c6SJamie Gritton 	error = vfs_copyopt(opts, "osreldate", &osreldt, sizeof(osreldt));
927cf0313c6SJamie Gritton 	if (error == ENOENT)
928cf0313c6SJamie Gritton 		osreldt = 0;
929cf0313c6SJamie Gritton 	else if (error != 0)
930cf0313c6SJamie Gritton 		goto done_free;
931cf0313c6SJamie Gritton 	else {
932cf0313c6SJamie Gritton 		if (flags & JAIL_UPDATE) {
933cf0313c6SJamie Gritton 			error = EINVAL;
934cf0313c6SJamie Gritton 			vfs_opterror(opts,
935cf0313c6SJamie Gritton 			    "osreldate cannot be changed after creation");
936cf0313c6SJamie Gritton 			goto done_errmsg;
937cf0313c6SJamie Gritton 		}
938cf0313c6SJamie Gritton 		if (osreldt == 0) {
939cf0313c6SJamie Gritton 			error = EINVAL;
940cf0313c6SJamie Gritton 			vfs_opterror(opts, "osreldate cannot be 0");
941cf0313c6SJamie Gritton 			goto done_errmsg;
942cf0313c6SJamie Gritton 		}
943cf0313c6SJamie Gritton 	}
944cf0313c6SJamie Gritton 
945b38ff370SJamie Gritton 	root = NULL;
946b38ff370SJamie Gritton 	error = vfs_getopt(opts, "path", (void **)&path, &len);
947b38ff370SJamie Gritton 	if (error == ENOENT)
948b38ff370SJamie Gritton 		path = NULL;
949b38ff370SJamie Gritton 	else if (error != 0)
950b38ff370SJamie Gritton 		goto done_free;
951b38ff370SJamie Gritton 	else {
952b38ff370SJamie Gritton 		if (flags & JAIL_UPDATE) {
953b38ff370SJamie Gritton 			error = EINVAL;
954b38ff370SJamie Gritton 			vfs_opterror(opts,
955b38ff370SJamie Gritton 			    "path cannot be changed after creation");
956b38ff370SJamie Gritton 			goto done_errmsg;
957b38ff370SJamie Gritton 		}
958b38ff370SJamie Gritton 		if (len == 0 || path[len - 1] != '\0') {
959b38ff370SJamie Gritton 			error = EINVAL;
960b38ff370SJamie Gritton 			goto done_free;
961b38ff370SJamie Gritton 		}
9625050aa86SKonstantin Belousov 		NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE,
963b38ff370SJamie Gritton 		    path, td);
964b38ff370SJamie Gritton 		error = namei(&nd);
965b38ff370SJamie Gritton 		if (error)
966b38ff370SJamie Gritton 			goto done_free;
967b38ff370SJamie Gritton 		root = nd.ni_vp;
968b38ff370SJamie Gritton 		NDFREE(&nd, NDF_ONLY_PNBUF);
9696dfe0a3dSMartin Matuska 		g_path = malloc(MAXPATHLEN, M_TEMP, M_WAITOK);
9706dfe0a3dSMartin Matuska 		strlcpy(g_path, path, MAXPATHLEN);
9716dfe0a3dSMartin Matuska 		error = vn_path_to_global_path(td, root, g_path, MAXPATHLEN);
9723eb6b656SMateusz Guzik 		if (error == 0) {
9736dfe0a3dSMartin Matuska 			path = g_path;
9746dfe0a3dSMartin Matuska 		} else {
975f6e633a9SMartin Matuska 			/* exit on other errors */
976b38ff370SJamie Gritton 			goto done_free;
977b38ff370SJamie Gritton 		}
978f6e633a9SMartin Matuska 		if (root->v_type != VDIR) {
979f6e633a9SMartin Matuska 			error = ENOTDIR;
980f6e633a9SMartin Matuska 			vput(root);
981f6e633a9SMartin Matuska 			goto done_free;
982f6e633a9SMartin Matuska 		}
983b249ce48SMateusz Guzik 		VOP_UNLOCK(root);
984b38ff370SJamie Gritton 	}
985b38ff370SJamie Gritton 
986b38ff370SJamie Gritton 	/*
987b6f47c23SJamie Gritton 	 * Find the specified jail, or at least its parent.
988b38ff370SJamie Gritton 	 * This abuses the file error codes ENOENT and EEXIST.
989b38ff370SJamie Gritton 	 */
990b38ff370SJamie Gritton 	pr = NULL;
991b6f47c23SJamie Gritton 	ppr = mypr;
9927de883c8SJamie Gritton 	inspr = NULL;
993babbbb9cSJamie Gritton 	if (cuflags == JAIL_CREATE && jid == 0 && name != NULL) {
994babbbb9cSJamie Gritton 		namelc = strrchr(name, '.');
995babbbb9cSJamie Gritton 		jid = strtoul(namelc != NULL ? namelc + 1 : name, &p, 10);
996babbbb9cSJamie Gritton 		if (*p != '\0')
997babbbb9cSJamie Gritton 			jid = 0;
998babbbb9cSJamie Gritton 	}
999b6f47c23SJamie Gritton 	sx_xlock(&allprison_lock);
10002a4b2251SJamie Gritton 	drflags = PD_LIST_XLOCKED;
1001b38ff370SJamie Gritton 	if (jid != 0) {
1002b38ff370SJamie Gritton 		if (jid < 0) {
1003b38ff370SJamie Gritton 			error = EINVAL;
1004b38ff370SJamie Gritton 			vfs_opterror(opts, "negative jid");
10052a4b2251SJamie Gritton 			goto done_deref;
1006b38ff370SJamie Gritton 		}
10077de883c8SJamie Gritton 		/*
10087de883c8SJamie Gritton 		 * See if a requested jid already exists.  Keep track of
10097de883c8SJamie Gritton 		 * where it can be inserted later.
10107de883c8SJamie Gritton 		 */
10117de883c8SJamie Gritton 		TAILQ_FOREACH(inspr, &allprison, pr_list) {
1012f7496dcaSJamie Gritton 			if (inspr->pr_id < jid)
1013f7496dcaSJamie Gritton 				continue;
1014f7496dcaSJamie Gritton 			if (inspr->pr_id > jid)
1015f7496dcaSJamie Gritton 				break;
10167de883c8SJamie Gritton 			pr = inspr;
1017f7496dcaSJamie Gritton 			mtx_lock(&pr->pr_mtx);
10182a4b2251SJamie Gritton 			drflags |= PD_LOCKED;
10197de883c8SJamie Gritton 			inspr = NULL;
10207de883c8SJamie Gritton 			break;
10217de883c8SJamie Gritton 		}
1022b38ff370SJamie Gritton 		if (pr != NULL) {
10230304c731SJamie Gritton 			ppr = pr->pr_parent;
1024b38ff370SJamie Gritton 			/* Create: jid must not exist. */
1025b38ff370SJamie Gritton 			if (cuflags == JAIL_CREATE) {
10267de883c8SJamie Gritton 				/*
10277de883c8SJamie Gritton 				 * Even creators that cannot see the jail will
10287de883c8SJamie Gritton 				 * get EEXIST.
10297de883c8SJamie Gritton 				 */
1030b38ff370SJamie Gritton 				error = EEXIST;
1031b38ff370SJamie Gritton 				vfs_opterror(opts, "jail %d already exists",
1032b38ff370SJamie Gritton 				    jid);
10332a4b2251SJamie Gritton 				goto done_deref;
1034b38ff370SJamie Gritton 			}
10350304c731SJamie Gritton 			if (!prison_ischild(mypr, pr)) {
10367de883c8SJamie Gritton 				/*
10377de883c8SJamie Gritton 				 * Updaters get ENOENT if they cannot see the
10387de883c8SJamie Gritton 				 * jail.  This is true even for CREATE | UPDATE,
10397de883c8SJamie Gritton 				 * which normally cannot give this error.
10407de883c8SJamie Gritton 				 */
10412a4b2251SJamie Gritton 				error = ENOENT;
10422a4b2251SJamie Gritton 				vfs_opterror(opts, "jail %d not found", jid);
10432a4b2251SJamie Gritton 				goto done_deref;
1044f7496dcaSJamie Gritton 			}
1045f7496dcaSJamie Gritton 			if (!prison_isalive(pr)) {
1046b38ff370SJamie Gritton 				if (!(flags & JAIL_DYING)) {
1047b38ff370SJamie Gritton 					error = ENOENT;
1048b38ff370SJamie Gritton 					vfs_opterror(opts, "jail %d is dying",
1049b38ff370SJamie Gritton 					    jid);
10502a4b2251SJamie Gritton 					goto done_deref;
1051f7496dcaSJamie Gritton 				}
1052f7496dcaSJamie Gritton 				if ((flags & JAIL_ATTACH) ||
1053b38ff370SJamie Gritton 				    (pr_flags & PR_PERSIST)) {
1054b38ff370SJamie Gritton 					/*
1055b38ff370SJamie Gritton 					 * A dying jail might be resurrected
1056b38ff370SJamie Gritton 					 * (via attach or persist), but first
1057b38ff370SJamie Gritton 					 * it must determine if another jail
1058b38ff370SJamie Gritton 					 * has claimed its name.  Accomplish
1059b38ff370SJamie Gritton 					 * this by implicitly re-setting the
1060b38ff370SJamie Gritton 					 * name.
1061b38ff370SJamie Gritton 					 */
1062b38ff370SJamie Gritton 					if (name == NULL)
10630304c731SJamie Gritton 						name = prison_name(mypr, pr);
1064b38ff370SJamie Gritton 				}
1065b38ff370SJamie Gritton 			}
10662a4b2251SJamie Gritton 		} else {
1067b38ff370SJamie Gritton 			/* Update: jid must exist. */
1068b38ff370SJamie Gritton 			if (cuflags == JAIL_UPDATE) {
1069b38ff370SJamie Gritton 				error = ENOENT;
1070b38ff370SJamie Gritton 				vfs_opterror(opts, "jail %d not found", jid);
10712a4b2251SJamie Gritton 				goto done_deref;
1072b38ff370SJamie Gritton 			}
1073b38ff370SJamie Gritton 		}
1074b38ff370SJamie Gritton 	}
1075b38ff370SJamie Gritton 	/*
1076b38ff370SJamie Gritton 	 * If the caller provided a name, look for a jail by that name.
1077b38ff370SJamie Gritton 	 * This has different semantics for creates and updates keyed by jid
1078b38ff370SJamie Gritton 	 * (where the name must not already exist in a different jail),
1079b38ff370SJamie Gritton 	 * and updates keyed by the name itself (where the name must exist
1080b38ff370SJamie Gritton 	 * because that is the jail being updated).
1081b38ff370SJamie Gritton 	 */
1082b6f47c23SJamie Gritton 	namelc = NULL;
1083b38ff370SJamie Gritton 	if (name != NULL) {
1084babbbb9cSJamie Gritton 		namelc = strrchr(name, '.');
1085babbbb9cSJamie Gritton 		if (namelc == NULL)
1086babbbb9cSJamie Gritton 			namelc = name;
1087babbbb9cSJamie Gritton 		else {
10880304c731SJamie Gritton 			/*
10890304c731SJamie Gritton 			 * This is a hierarchical name.  Split it into the
10900304c731SJamie Gritton 			 * parent and child names, and make sure the parent
10910304c731SJamie Gritton 			 * exists or matches an already found jail.
10920304c731SJamie Gritton 			 */
10930304c731SJamie Gritton 			if (pr != NULL) {
1094babbbb9cSJamie Gritton 				if (strncmp(name, ppr->pr_name, namelc - name)
1095babbbb9cSJamie Gritton 				    || ppr->pr_name[namelc - name] != '\0') {
10960304c731SJamie Gritton 					error = EINVAL;
10970304c731SJamie Gritton 					vfs_opterror(opts,
10980304c731SJamie Gritton 					    "cannot change jail's parent");
10992a4b2251SJamie Gritton 					goto done_deref;
11000304c731SJamie Gritton 				}
11010304c731SJamie Gritton 			} else {
1102b6f47c23SJamie Gritton 				*namelc = '\0';
11030304c731SJamie Gritton 				ppr = prison_find_name(mypr, name);
11040304c731SJamie Gritton 				if (ppr == NULL) {
11050304c731SJamie Gritton 					error = ENOENT;
11060304c731SJamie Gritton 					vfs_opterror(opts,
11070304c731SJamie Gritton 					    "jail \"%s\" not found", name);
11082a4b2251SJamie Gritton 					goto done_deref;
11090304c731SJamie Gritton 				}
1110c050ea80SJamie Gritton 				if (!(flags & JAIL_DYING) &&
1111c050ea80SJamie Gritton 				    !prison_isalive(ppr)) {
1112c050ea80SJamie Gritton 					mtx_unlock(&ppr->pr_mtx);
1113c050ea80SJamie Gritton 					error = ENOENT;
1114c050ea80SJamie Gritton 					vfs_opterror(opts,
1115c050ea80SJamie Gritton 					    "jail \"%s\" is dying", name);
1116c050ea80SJamie Gritton 					goto done_deref;
1117c050ea80SJamie Gritton 				}
11180304c731SJamie Gritton 				mtx_unlock(&ppr->pr_mtx);
1119b6f47c23SJamie Gritton 				*namelc = '.';
11200304c731SJamie Gritton 			}
1121b6f47c23SJamie Gritton 			namelc++;
11220304c731SJamie Gritton 		}
1123b6f47c23SJamie Gritton 		if (namelc[0] != '\0') {
1124b6f47c23SJamie Gritton 			pnamelen =
11250304c731SJamie Gritton 			    (ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1;
11260304c731SJamie Gritton 			deadpr = NULL;
11270304c731SJamie Gritton 			FOREACH_PRISON_CHILD(ppr, tpr) {
11286754ae25SJamie Gritton 				if (tpr != pr &&
1129b6f47c23SJamie Gritton 				    !strcmp(tpr->pr_name + pnamelen, namelc)) {
113076ad42abSJamie Gritton 					if (prison_isalive(tpr)) {
1131b38ff370SJamie Gritton 						if (pr == NULL &&
1132b38ff370SJamie Gritton 						    cuflags != JAIL_CREATE) {
1133b38ff370SJamie Gritton 							/*
1134b38ff370SJamie Gritton 							 * Use this jail
1135b38ff370SJamie Gritton 							 * for updates.
1136b38ff370SJamie Gritton 							 */
1137b38ff370SJamie Gritton 							pr = tpr;
1138f7496dcaSJamie Gritton 							mtx_lock(&pr->pr_mtx);
113983bc72a0SJamie Gritton 							drflags |= PD_LOCKED;
1140b38ff370SJamie Gritton 							break;
1141b38ff370SJamie Gritton 						}
1142b38ff370SJamie Gritton 						/*
1143b38ff370SJamie Gritton 						 * Create, or update(jid):
1144b38ff370SJamie Gritton 						 * name must not exist in an
11450304c731SJamie Gritton 						 * active sibling jail.
1146b38ff370SJamie Gritton 						 */
1147b38ff370SJamie Gritton 						error = EEXIST;
1148b38ff370SJamie Gritton 						vfs_opterror(opts,
1149b38ff370SJamie Gritton 						   "jail \"%s\" already exists",
1150b38ff370SJamie Gritton 						   name);
11512a4b2251SJamie Gritton 						goto done_deref;
1152b38ff370SJamie Gritton 					}
115376ad42abSJamie Gritton 					if (pr == NULL &&
1154f7496dcaSJamie Gritton 					    cuflags != JAIL_CREATE) {
115576ad42abSJamie Gritton 						deadpr = tpr;
1156f7496dcaSJamie Gritton 					}
1157b38ff370SJamie Gritton 				}
1158b38ff370SJamie Gritton 			}
1159b38ff370SJamie Gritton 			/* If no active jail is found, use a dying one. */
1160b38ff370SJamie Gritton 			if (deadpr != NULL && pr == NULL) {
1161b38ff370SJamie Gritton 				if (flags & JAIL_DYING) {
1162b38ff370SJamie Gritton 					pr = deadpr;
1163f7496dcaSJamie Gritton 					mtx_lock(&pr->pr_mtx);
11642a4b2251SJamie Gritton 					drflags |= PD_LOCKED;
1165b38ff370SJamie Gritton 				} else if (cuflags == JAIL_UPDATE) {
1166b38ff370SJamie Gritton 					error = ENOENT;
1167b38ff370SJamie Gritton 					vfs_opterror(opts,
1168b38ff370SJamie Gritton 					    "jail \"%s\" is dying", name);
11692a4b2251SJamie Gritton 					goto done_deref;
1170b38ff370SJamie Gritton 				}
1171b38ff370SJamie Gritton 			}
1172b38ff370SJamie Gritton 			/* Update: name must exist if no jid. */
1173b38ff370SJamie Gritton 			else if (cuflags == JAIL_UPDATE && pr == NULL) {
1174b38ff370SJamie Gritton 				error = ENOENT;
1175b38ff370SJamie Gritton 				vfs_opterror(opts, "jail \"%s\" not found",
1176b38ff370SJamie Gritton 				    name);
11772a4b2251SJamie Gritton 				goto done_deref;
1178b38ff370SJamie Gritton 			}
1179b38ff370SJamie Gritton 		}
1180b38ff370SJamie Gritton 	}
1181b38ff370SJamie Gritton 	/* Update: must provide a jid or name. */
1182b38ff370SJamie Gritton 	else if (cuflags == JAIL_UPDATE && pr == NULL) {
1183b38ff370SJamie Gritton 		error = ENOENT;
1184b38ff370SJamie Gritton 		vfs_opterror(opts, "update specified no jail");
11852a4b2251SJamie Gritton 		goto done_deref;
1186b38ff370SJamie Gritton 	}
1187b38ff370SJamie Gritton 
1188b38ff370SJamie Gritton 	/* If there's no prison to update, create a new one and link it in. */
11892a4b2251SJamie Gritton 	created = pr == NULL;
11902a4b2251SJamie Gritton 	if (created) {
1191b97457e2SJamie Gritton 		for (tpr = mypr; tpr != NULL; tpr = tpr->pr_parent)
1192b97457e2SJamie Gritton 			if (tpr->pr_childcount >= tpr->pr_childmax) {
1193b97457e2SJamie Gritton 				error = EPERM;
1194b97457e2SJamie Gritton 				vfs_opterror(opts, "prison limit exceeded");
11952a4b2251SJamie Gritton 				goto done_deref;
1196b97457e2SJamie Gritton 			}
11976754ae25SJamie Gritton 		prison_hold(ppr);
1198f7496dcaSJamie Gritton 		if (!refcount_acquire_if_not_zero(&ppr->pr_uref)) {
1199c050ea80SJamie Gritton 			/* This brings the parent back to life. */
1200f7496dcaSJamie Gritton 			mtx_lock(&ppr->pr_mtx);
1201f7496dcaSJamie Gritton 			refcount_acquire(&ppr->pr_uref);
1202*1158508aSJamie Gritton 			ppr->pr_state = PRISON_STATE_ALIVE;
1203c050ea80SJamie Gritton 			mtx_unlock(&ppr->pr_mtx);
1204c050ea80SJamie Gritton 			error = osd_jail_call(ppr, PR_METHOD_CREATE, opts);
1205c050ea80SJamie Gritton 			if (error) {
1206c050ea80SJamie Gritton 				pr = ppr;
1207c050ea80SJamie Gritton 				drflags |= PD_DEREF | PD_DEUREF;
1208c050ea80SJamie Gritton 				goto done_deref;
1209c050ea80SJamie Gritton 			}
1210c050ea80SJamie Gritton 		}
12117de883c8SJamie Gritton 
12127de883c8SJamie Gritton 		if (jid == 0 && (jid = get_next_prid(&inspr)) == 0) {
1213b38ff370SJamie Gritton 			error = EAGAIN;
12147de883c8SJamie Gritton 			vfs_opterror(opts, "no available jail IDs");
12152a4b2251SJamie Gritton 			pr = ppr;
12162a4b2251SJamie Gritton 			drflags |= PD_DEREF | PD_DEUREF;
12172a4b2251SJamie Gritton 			goto done_deref;
1218b38ff370SJamie Gritton 		}
12192a4b2251SJamie Gritton 
12202a4b2251SJamie Gritton 		pr = malloc(sizeof(*pr), M_PRISON, M_WAITOK | M_ZERO);
1221*1158508aSJamie Gritton 		pr->pr_state = PRISON_STATE_INVALID;
1222*1158508aSJamie Gritton 		refcount_init(&pr->pr_ref, 1);
1223f7496dcaSJamie Gritton 		refcount_init(&pr->pr_uref, 0);
1224*1158508aSJamie Gritton 		drflags |= PD_DEREF;
12252a4b2251SJamie Gritton 		LIST_INIT(&pr->pr_children);
12262a4b2251SJamie Gritton 		mtx_init(&pr->pr_mtx, "jail mutex", NULL, MTX_DEF | MTX_DUPOK);
12272a4b2251SJamie Gritton 		TASK_INIT(&pr->pr_task, 0, prison_complete, pr);
12282a4b2251SJamie Gritton 
12297de883c8SJamie Gritton 		pr->pr_id = jid;
12307de883c8SJamie Gritton 		if (inspr != NULL)
12317de883c8SJamie Gritton 			TAILQ_INSERT_BEFORE(inspr, pr, pr_list);
12327de883c8SJamie Gritton 		else
1233b38ff370SJamie Gritton 			TAILQ_INSERT_TAIL(&allprison, pr, pr_list);
12347de883c8SJamie Gritton 
12357de883c8SJamie Gritton 		pr->pr_parent = ppr;
12360304c731SJamie Gritton 		LIST_INSERT_HEAD(&ppr->pr_children, pr, pr_sibling);
12370304c731SJamie Gritton 		for (tpr = ppr; tpr != NULL; tpr = tpr->pr_parent)
1238b97457e2SJamie Gritton 			tpr->pr_childcount++;
1239b38ff370SJamie Gritton 
12400304c731SJamie Gritton 		/* Set some default values, and inherit some from the parent. */
1241b6f47c23SJamie Gritton 		if (namelc == NULL)
1242b6f47c23SJamie Gritton 			namelc = "";
1243b38ff370SJamie Gritton 		if (path == NULL) {
1244b38ff370SJamie Gritton 			path = "/";
12450304c731SJamie Gritton 			root = mypr->pr_root;
1246b38ff370SJamie Gritton 			vref(root);
1247b38ff370SJamie Gritton 		}
12488986e3a0SJamie Gritton 		strlcpy(pr->pr_hostuuid, DEFAULT_HOSTUUID, HOSTUUIDLEN);
12498986e3a0SJamie Gritton 		pr->pr_flags |= PR_HOST;
1250bdfc8cc4SJamie Gritton #if defined(INET) || defined(INET6)
1251bdfc8cc4SJamie Gritton #ifdef VIMAGE
1252bdfc8cc4SJamie Gritton 		if (!(pr_flags & PR_VNET))
1253bdfc8cc4SJamie Gritton #endif
1254bdfc8cc4SJamie Gritton 		{
12550304c731SJamie Gritton #ifdef INET
12562b0d6f81SJamie Gritton 			if (!(ch_flags & PR_IP4_USER))
12576a3f2779SJamie Gritton 				pr->pr_flags |= PR_IP4 | PR_IP4_USER;
12582b0d6f81SJamie Gritton 			else if (!(pr_flags & PR_IP4_USER)) {
12592b0d6f81SJamie Gritton 				pr->pr_flags |= ppr->pr_flags & PR_IP4;
12602b0d6f81SJamie Gritton 				if (ppr->pr_ip4 != NULL) {
12612b0d6f81SJamie Gritton 					pr->pr_ip4s = ppr->pr_ip4s;
12622b0d6f81SJamie Gritton 					pr->pr_ip4 = malloc(pr->pr_ip4s *
12632b0d6f81SJamie Gritton 					    sizeof(struct in_addr), M_PRISON,
12642b0d6f81SJamie Gritton 					    M_WAITOK);
12652b0d6f81SJamie Gritton 					bcopy(ppr->pr_ip4, pr->pr_ip4,
12662b0d6f81SJamie Gritton 					    pr->pr_ip4s * sizeof(*pr->pr_ip4));
12672b0d6f81SJamie Gritton 				}
12682b0d6f81SJamie Gritton 			}
12690304c731SJamie Gritton #endif
12700304c731SJamie Gritton #ifdef INET6
12712b0d6f81SJamie Gritton 			if (!(ch_flags & PR_IP6_USER))
12726a3f2779SJamie Gritton 				pr->pr_flags |= PR_IP6 | PR_IP6_USER;
12732b0d6f81SJamie Gritton 			else if (!(pr_flags & PR_IP6_USER)) {
12742b0d6f81SJamie Gritton 				pr->pr_flags |= ppr->pr_flags & PR_IP6;
12752b0d6f81SJamie Gritton 				if (ppr->pr_ip6 != NULL) {
12762b0d6f81SJamie Gritton 					pr->pr_ip6s = ppr->pr_ip6s;
12772b0d6f81SJamie Gritton 					pr->pr_ip6 = malloc(pr->pr_ip6s *
12782b0d6f81SJamie Gritton 					    sizeof(struct in6_addr), M_PRISON,
12792b0d6f81SJamie Gritton 					    M_WAITOK);
12802b0d6f81SJamie Gritton 					bcopy(ppr->pr_ip6, pr->pr_ip6,
12812b0d6f81SJamie Gritton 					    pr->pr_ip6s * sizeof(*pr->pr_ip6));
12822b0d6f81SJamie Gritton 				}
12832b0d6f81SJamie Gritton 			}
12840304c731SJamie Gritton #endif
1285bdfc8cc4SJamie Gritton 		}
1286bdfc8cc4SJamie Gritton #endif
1287592bcae8SBjoern A. Zeeb 		/* Source address selection is always on by default. */
1288592bcae8SBjoern A. Zeeb 		pr->pr_flags |= _PR_IP_SADDRSEL;
1289592bcae8SBjoern A. Zeeb 
12900304c731SJamie Gritton 		pr->pr_securelevel = ppr->pr_securelevel;
12910304c731SJamie Gritton 		pr->pr_allow = JAIL_DEFAULT_ALLOW & ppr->pr_allow;
1292af10bf05SBjoern A. Zeeb 		pr->pr_enforce_statfs = jail_default_enforce_statfs;
1293bf3db8aaSMartin Matuska 		pr->pr_devfs_rsnum = ppr->pr_devfs_rsnum;
1294b38ff370SJamie Gritton 
1295b96bd95bSIan Lepore 		pr->pr_osreldate = osreldt ? osreldt : ppr->pr_osreldate;
1296b96bd95bSIan Lepore 		if (osrelstr == NULL)
12971b786d01SBjoern A. Zeeb 			strlcpy(pr->pr_osrelease, ppr->pr_osrelease,
12981b786d01SBjoern A. Zeeb 			    sizeof(pr->pr_osrelease));
1299b96bd95bSIan Lepore 		else
13001b786d01SBjoern A. Zeeb 			strlcpy(pr->pr_osrelease, osrelstr,
13011b786d01SBjoern A. Zeeb 			    sizeof(pr->pr_osrelease));
1302b96bd95bSIan Lepore 
1303679e1390SJamie Gritton #ifdef VIMAGE
1304679e1390SJamie Gritton 		/* Allocate a new vnet if specified. */
1305679e1390SJamie Gritton 		pr->pr_vnet = (pr_flags & PR_VNET)
1306679e1390SJamie Gritton 		    ? vnet_alloc() : ppr->pr_vnet;
1307679e1390SJamie Gritton #endif
1308b38ff370SJamie Gritton 		/*
1309b38ff370SJamie Gritton 		 * Allocate a dedicated cpuset for each jail.
1310b38ff370SJamie Gritton 		 * Unlike other initial settings, this may return an erorr.
1311b38ff370SJamie Gritton 		 */
13120304c731SJamie Gritton 		error = cpuset_create_root(ppr, &pr->pr_cpuset);
13132a4b2251SJamie Gritton 		if (error)
13142a4b2251SJamie Gritton 			goto done_deref;
1315b38ff370SJamie Gritton 
1316b38ff370SJamie Gritton 		mtx_lock(&pr->pr_mtx);
13172a4b2251SJamie Gritton 		drflags |= PD_LOCKED;
1318b38ff370SJamie Gritton 	} else {
13192b0d6f81SJamie Gritton 		/*
13202b0d6f81SJamie Gritton 		 * Grab a reference for existing prisons, to ensure they
13212b0d6f81SJamie Gritton 		 * continue to exist for the duration of the call.
13222b0d6f81SJamie Gritton 		 */
13236754ae25SJamie Gritton 		prison_hold(pr);
13242a4b2251SJamie Gritton 		drflags |= PD_DEREF;
1325bdfc8cc4SJamie Gritton #if defined(VIMAGE) && (defined(INET) || defined(INET6))
1326bdfc8cc4SJamie Gritton 		if ((pr->pr_flags & PR_VNET) &&
1327bdfc8cc4SJamie Gritton 		    (ch_flags & (PR_IP4_USER | PR_IP6_USER))) {
1328bdfc8cc4SJamie Gritton 			error = EINVAL;
1329bdfc8cc4SJamie Gritton 			vfs_opterror(opts,
1330bdfc8cc4SJamie Gritton 			    "vnet jails cannot have IP address restrictions");
13312a4b2251SJamie Gritton 			goto done_deref;
1332bdfc8cc4SJamie Gritton 		}
1333bdfc8cc4SJamie Gritton #endif
13342b0d6f81SJamie Gritton #ifdef INET
13352b0d6f81SJamie Gritton 		if (PR_IP4_USER & ch_flags & (pr_flags ^ pr->pr_flags)) {
13362b0d6f81SJamie Gritton 			error = EINVAL;
13372b0d6f81SJamie Gritton 			vfs_opterror(opts,
13382b0d6f81SJamie Gritton 			    "ip4 cannot be changed after creation");
13392a4b2251SJamie Gritton 			goto done_deref;
13402b0d6f81SJamie Gritton 		}
13412b0d6f81SJamie Gritton #endif
13422b0d6f81SJamie Gritton #ifdef INET6
13432b0d6f81SJamie Gritton 		if (PR_IP6_USER & ch_flags & (pr_flags ^ pr->pr_flags)) {
13442b0d6f81SJamie Gritton 			error = EINVAL;
13452b0d6f81SJamie Gritton 			vfs_opterror(opts,
13462b0d6f81SJamie Gritton 			    "ip6 cannot be changed after creation");
13472a4b2251SJamie Gritton 			goto done_deref;
13482b0d6f81SJamie Gritton 		}
13492b0d6f81SJamie Gritton #endif
1350b38ff370SJamie Gritton 	}
1351b38ff370SJamie Gritton 
1352b38ff370SJamie Gritton 	/* Do final error checking before setting anything. */
13530304c731SJamie Gritton 	if (gotslevel) {
13540304c731SJamie Gritton 		if (slevel < ppr->pr_securelevel) {
13550304c731SJamie Gritton 			error = EPERM;
13562a4b2251SJamie Gritton 			goto done_deref;
13570304c731SJamie Gritton 		}
13580304c731SJamie Gritton 	}
1359b97457e2SJamie Gritton 	if (gotchildmax) {
1360b97457e2SJamie Gritton 		if (childmax >= ppr->pr_childmax) {
1361b97457e2SJamie Gritton 			error = EPERM;
13622a4b2251SJamie Gritton 			goto done_deref;
1363b97457e2SJamie Gritton 		}
1364b97457e2SJamie Gritton 	}
13650304c731SJamie Gritton 	if (gotenforce) {
13660304c731SJamie Gritton 		if (enforce < ppr->pr_enforce_statfs) {
13670304c731SJamie Gritton 			error = EPERM;
13682a4b2251SJamie Gritton 			goto done_deref;
13690304c731SJamie Gritton 		}
13700304c731SJamie Gritton 	}
13710cc207a6SMartin Matuska 	if (gotrsnum) {
13720cc207a6SMartin Matuska 		/*
13730cc207a6SMartin Matuska 		 * devfs_rsnum is a uint16_t
13740cc207a6SMartin Matuska 		 */
1375bf3db8aaSMartin Matuska 		if (rsnum < 0 || rsnum > 65535) {
13760cc207a6SMartin Matuska 			error = EINVAL;
13772a4b2251SJamie Gritton 			goto done_deref;
13780cc207a6SMartin Matuska 		}
13790cc207a6SMartin Matuska 		/*
1380bf3db8aaSMartin Matuska 		 * Nested jails always inherit parent's devfs ruleset
13810cc207a6SMartin Matuska 		 */
13820cc207a6SMartin Matuska 		if (jailed(td->td_ucred)) {
13830cc207a6SMartin Matuska 			if (rsnum > 0 && rsnum != ppr->pr_devfs_rsnum) {
13840cc207a6SMartin Matuska 				error = EPERM;
13852a4b2251SJamie Gritton 				goto done_deref;
1386bf3db8aaSMartin Matuska 			} else
13870cc207a6SMartin Matuska 				rsnum = ppr->pr_devfs_rsnum;
13880cc207a6SMartin Matuska 		}
13890cc207a6SMartin Matuska 	}
1390b38ff370SJamie Gritton #ifdef INET
13912b0d6f81SJamie Gritton 	if (ip4s > 0) {
13920304c731SJamie Gritton 		if (ppr->pr_flags & PR_IP4) {
13930304c731SJamie Gritton 			/*
13940304c731SJamie Gritton 			 * Make sure the new set of IP addresses is a
13950304c731SJamie Gritton 			 * subset of the parent's list.  Don't worry
13960304c731SJamie Gritton 			 * about the parent being unlocked, as any
13970304c731SJamie Gritton 			 * setting is done with allprison_lock held.
13980304c731SJamie Gritton 			 */
13990304c731SJamie Gritton 			for (ij = 0; ij < ppr->pr_ip4s; ij++)
14002b0d6f81SJamie Gritton 				if (ip4[0].s_addr == ppr->pr_ip4[ij].s_addr)
14010304c731SJamie Gritton 					break;
14020304c731SJamie Gritton 			if (ij == ppr->pr_ip4s) {
14030304c731SJamie Gritton 				error = EPERM;
14042a4b2251SJamie Gritton 				goto done_deref;
14050304c731SJamie Gritton 			}
14060304c731SJamie Gritton 			if (ip4s > 1) {
14070304c731SJamie Gritton 				for (ii = ij = 1; ii < ip4s; ii++) {
14080304c731SJamie Gritton 					if (ip4[ii].s_addr ==
14090304c731SJamie Gritton 					    ppr->pr_ip4[0].s_addr)
1410b38ff370SJamie Gritton 						continue;
14110304c731SJamie Gritton 					for (; ij < ppr->pr_ip4s; ij++)
14120304c731SJamie Gritton 						if (ip4[ii].s_addr ==
14130304c731SJamie Gritton 						    ppr->pr_ip4[ij].s_addr)
14140304c731SJamie Gritton 							break;
14150304c731SJamie Gritton 					if (ij == ppr->pr_ip4s)
14160304c731SJamie Gritton 						break;
14170304c731SJamie Gritton 				}
14180304c731SJamie Gritton 				if (ij == ppr->pr_ip4s) {
14190304c731SJamie Gritton 					error = EPERM;
14202a4b2251SJamie Gritton 					goto done_deref;
14210304c731SJamie Gritton 				}
14220304c731SJamie Gritton 			}
14230304c731SJamie Gritton 		}
14240304c731SJamie Gritton 		/*
14250304c731SJamie Gritton 		 * Check for conflicting IP addresses.  We permit them
14260304c731SJamie Gritton 		 * if there is no more than one IP on each jail.  If
14270304c731SJamie Gritton 		 * there is a duplicate on a jail with more than one
14280304c731SJamie Gritton 		 * IP stop checking and return error.
14290304c731SJamie Gritton 		 */
1430bdfc8cc4SJamie Gritton #ifdef VIMAGE
143108b43333SJamie Gritton 		for (tppr = ppr; tppr != &prison0; tppr = tppr->pr_parent)
1432bdfc8cc4SJamie Gritton 			if (tppr->pr_flags & PR_VNET)
1433bdfc8cc4SJamie Gritton 				break;
143408b43333SJamie Gritton #else
143508b43333SJamie Gritton 		tppr = &prison0;
1436bdfc8cc4SJamie Gritton #endif
1437bdfc8cc4SJamie Gritton 		FOREACH_PRISON_DESCENDANT(tppr, tpr, descend) {
1438bdfc8cc4SJamie Gritton 			if (tpr == pr ||
1439bdfc8cc4SJamie Gritton #ifdef VIMAGE
14402b0d6f81SJamie Gritton 			    (tpr != tppr && (tpr->pr_flags & PR_VNET)) ||
1441bdfc8cc4SJamie Gritton #endif
1442f7496dcaSJamie Gritton 			    !prison_isalive(tpr)) {
14430304c731SJamie Gritton 				descend = 0;
14440304c731SJamie Gritton 				continue;
14450304c731SJamie Gritton 			}
14460304c731SJamie Gritton 			if (!(tpr->pr_flags & PR_IP4_USER))
14470304c731SJamie Gritton 				continue;
14480304c731SJamie Gritton 			descend = 0;
14490304c731SJamie Gritton 			if (tpr->pr_ip4 == NULL ||
14500304c731SJamie Gritton 			    (ip4s == 1 && tpr->pr_ip4s == 1))
14510304c731SJamie Gritton 				continue;
14520304c731SJamie Gritton 			for (ii = 0; ii < ip4s; ii++) {
14530ce1624dSStephen J. Kiernan 				if (prison_check_ip4_locked(tpr, &ip4[ii]) ==
14540ce1624dSStephen J. Kiernan 				    0) {
14550304c731SJamie Gritton 					error = EADDRINUSE;
1456b38ff370SJamie Gritton 					vfs_opterror(opts,
1457b38ff370SJamie Gritton 					    "IPv4 addresses clash");
14582a4b2251SJamie Gritton 					goto done_deref;
1459b38ff370SJamie Gritton 				}
14600304c731SJamie Gritton 			}
14610304c731SJamie Gritton 		}
14620304c731SJamie Gritton 	}
1463b38ff370SJamie Gritton #endif
1464b38ff370SJamie Gritton #ifdef INET6
14652b0d6f81SJamie Gritton 	if (ip6s > 0) {
14660304c731SJamie Gritton 		if (ppr->pr_flags & PR_IP6) {
14670304c731SJamie Gritton 			/*
14680304c731SJamie Gritton 			 * Make sure the new set of IP addresses is a
14690304c731SJamie Gritton 			 * subset of the parent's list.
14700304c731SJamie Gritton 			 */
14710304c731SJamie Gritton 			for (ij = 0; ij < ppr->pr_ip6s; ij++)
14720304c731SJamie Gritton 				if (IN6_ARE_ADDR_EQUAL(&ip6[0],
14730304c731SJamie Gritton 				    &ppr->pr_ip6[ij]))
14740304c731SJamie Gritton 					break;
14750304c731SJamie Gritton 			if (ij == ppr->pr_ip6s) {
14760304c731SJamie Gritton 				error = EPERM;
14772a4b2251SJamie Gritton 				goto done_deref;
14780304c731SJamie Gritton 			}
14790304c731SJamie Gritton 			if (ip6s > 1) {
14800304c731SJamie Gritton 				for (ii = ij = 1; ii < ip6s; ii++) {
14810304c731SJamie Gritton 					if (IN6_ARE_ADDR_EQUAL(&ip6[ii],
14820304c731SJamie Gritton 					     &ppr->pr_ip6[0]))
14830304c731SJamie Gritton 						continue;
14840304c731SJamie Gritton 					for (; ij < ppr->pr_ip6s; ij++)
14850304c731SJamie Gritton 						if (IN6_ARE_ADDR_EQUAL(
14862b0d6f81SJamie Gritton 						    &ip6[ii], &ppr->pr_ip6[ij]))
14870304c731SJamie Gritton 							break;
14880304c731SJamie Gritton 					if (ij == ppr->pr_ip6s)
14890304c731SJamie Gritton 						break;
14900304c731SJamie Gritton 				}
14910304c731SJamie Gritton 				if (ij == ppr->pr_ip6s) {
14920304c731SJamie Gritton 					error = EPERM;
14932a4b2251SJamie Gritton 					goto done_deref;
14940304c731SJamie Gritton 				}
14950304c731SJamie Gritton 			}
14960304c731SJamie Gritton 		}
14970304c731SJamie Gritton 		/* Check for conflicting IP addresses. */
1498bdfc8cc4SJamie Gritton #ifdef VIMAGE
149908b43333SJamie Gritton 		for (tppr = ppr; tppr != &prison0; tppr = tppr->pr_parent)
1500bdfc8cc4SJamie Gritton 			if (tppr->pr_flags & PR_VNET)
1501bdfc8cc4SJamie Gritton 				break;
150208b43333SJamie Gritton #else
150308b43333SJamie Gritton 		tppr = &prison0;
1504bdfc8cc4SJamie Gritton #endif
1505bdfc8cc4SJamie Gritton 		FOREACH_PRISON_DESCENDANT(tppr, tpr, descend) {
1506bdfc8cc4SJamie Gritton 			if (tpr == pr ||
1507bdfc8cc4SJamie Gritton #ifdef VIMAGE
15082b0d6f81SJamie Gritton 			    (tpr != tppr && (tpr->pr_flags & PR_VNET)) ||
1509bdfc8cc4SJamie Gritton #endif
1510f7496dcaSJamie Gritton 			    !prison_isalive(tpr)) {
15110304c731SJamie Gritton 				descend = 0;
15120304c731SJamie Gritton 				continue;
15130304c731SJamie Gritton 			}
15140304c731SJamie Gritton 			if (!(tpr->pr_flags & PR_IP6_USER))
15150304c731SJamie Gritton 				continue;
15160304c731SJamie Gritton 			descend = 0;
15170304c731SJamie Gritton 			if (tpr->pr_ip6 == NULL ||
15180304c731SJamie Gritton 			    (ip6s == 1 && tpr->pr_ip6s == 1))
15190304c731SJamie Gritton 				continue;
15200304c731SJamie Gritton 			for (ii = 0; ii < ip6s; ii++) {
15210ce1624dSStephen J. Kiernan 				if (prison_check_ip6_locked(tpr, &ip6[ii]) ==
15220ce1624dSStephen J. Kiernan 				    0) {
15230304c731SJamie Gritton 					error = EADDRINUSE;
1524b38ff370SJamie Gritton 					vfs_opterror(opts,
1525b38ff370SJamie Gritton 					    "IPv6 addresses clash");
15262a4b2251SJamie Gritton 					goto done_deref;
1527b38ff370SJamie Gritton 				}
15280304c731SJamie Gritton 			}
15290304c731SJamie Gritton 		}
15300304c731SJamie Gritton 	}
1531b38ff370SJamie Gritton #endif
15320304c731SJamie Gritton 	onamelen = namelen = 0;
1533b6f47c23SJamie Gritton 	if (namelc != NULL) {
15346ab6058eSJamie Gritton 		/* Give a default name of the jid.  Also allow the name to be
15356ab6058eSJamie Gritton 		 * explicitly the jid - but not any other number, and only in
15366ab6058eSJamie Gritton 		 * normal form (no leading zero/etc).
15376ab6058eSJamie Gritton 		 */
1538b6f47c23SJamie Gritton 		if (namelc[0] == '\0')
1539b6f47c23SJamie Gritton 			snprintf(namelc = numbuf, sizeof(numbuf), "%d", jid);
15406ab6058eSJamie Gritton 		else if ((strtoul(namelc, &p, 10) != jid ||
15416ab6058eSJamie Gritton 			  namelc[0] < '1' || namelc[0] > '9') && *p == '\0') {
1542b38ff370SJamie Gritton 			error = EINVAL;
1543babbbb9cSJamie Gritton 			vfs_opterror(opts,
1544babbbb9cSJamie Gritton 			    "name cannot be numeric (unless it is the jid)");
15452a4b2251SJamie Gritton 			goto done_deref;
1546b38ff370SJamie Gritton 		}
1547b38ff370SJamie Gritton 		/*
15480304c731SJamie Gritton 		 * Make sure the name isn't too long for the prison or its
15490304c731SJamie Gritton 		 * children.
1550b38ff370SJamie Gritton 		 */
1551b6f47c23SJamie Gritton 		pnamelen = (ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1;
1552b6f47c23SJamie Gritton 		onamelen = strlen(pr->pr_name + pnamelen);
1553b6f47c23SJamie Gritton 		namelen = strlen(namelc);
1554b6f47c23SJamie Gritton 		if (pnamelen + namelen + 1 > sizeof(pr->pr_name)) {
15550304c731SJamie Gritton 			error = ENAMETOOLONG;
15562a4b2251SJamie Gritton 			goto done_deref;
15570304c731SJamie Gritton 		}
15580304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT(pr, tpr, descend) {
15590304c731SJamie Gritton 			if (strlen(tpr->pr_name) + (namelen - onamelen) >=
15600304c731SJamie Gritton 			    sizeof(pr->pr_name)) {
15610304c731SJamie Gritton 				error = ENAMETOOLONG;
15622a4b2251SJamie Gritton 				goto done_deref;
15630304c731SJamie Gritton 			}
15640304c731SJamie Gritton 		}
15650304c731SJamie Gritton 	}
1566b3079544SJamie Gritton 	pr_allow_diff = pr_allow & ~ppr->pr_allow;
1567b3079544SJamie Gritton 	if (pr_allow_diff & ~PR_ALLOW_DIFFERENCES) {
15680304c731SJamie Gritton 		error = EPERM;
15692a4b2251SJamie Gritton 		goto done_deref;
1570b38ff370SJamie Gritton 	}
1571b38ff370SJamie Gritton 
1572b6f47c23SJamie Gritton 	/*
1573b6f47c23SJamie Gritton 	 * Let modules check their parameters.  This requires unlocking and
1574b6f47c23SJamie Gritton 	 * then re-locking the prison, but this is still a valid state as long
1575b6f47c23SJamie Gritton 	 * as allprison_lock remains xlocked.
1576b6f47c23SJamie Gritton 	 */
1577b6f47c23SJamie Gritton 	mtx_unlock(&pr->pr_mtx);
15782a4b2251SJamie Gritton 	drflags &= ~PD_LOCKED;
1579b6f47c23SJamie Gritton 	error = osd_jail_call(pr, PR_METHOD_CHECK, opts);
15802a4b2251SJamie Gritton 	if (error != 0)
15812a4b2251SJamie Gritton 		goto done_deref;
1582b6f47c23SJamie Gritton 	mtx_lock(&pr->pr_mtx);
15832a4b2251SJamie Gritton 	drflags |= PD_LOCKED;
1584b6f47c23SJamie Gritton 
1585b6f47c23SJamie Gritton 	/* At this point, all valid parameters should have been noted. */
1586b6f47c23SJamie Gritton 	TAILQ_FOREACH(opt, opts, link) {
1587b6f47c23SJamie Gritton 		if (!opt->seen && strcmp(opt->name, "errmsg")) {
1588b6f47c23SJamie Gritton 			error = EINVAL;
1589b6f47c23SJamie Gritton 			vfs_opterror(opts, "unknown parameter: %s", opt->name);
15902a4b2251SJamie Gritton 			goto done_deref;
1591b6f47c23SJamie Gritton 		}
1592b6f47c23SJamie Gritton 	}
1593b6f47c23SJamie Gritton 
1594b38ff370SJamie Gritton 	/* Set the parameters of the prison. */
1595b38ff370SJamie Gritton #ifdef INET
15960304c731SJamie Gritton 	redo_ip4 = 0;
15970304c731SJamie Gritton 	if (pr_flags & PR_IP4_USER) {
15980304c731SJamie Gritton 		pr->pr_flags |= PR_IP4;
1599b38ff370SJamie Gritton 		free(pr->pr_ip4, M_PRISON);
16000304c731SJamie Gritton 		pr->pr_ip4s = ip4s;
1601b38ff370SJamie Gritton 		pr->pr_ip4 = ip4;
1602b38ff370SJamie Gritton 		ip4 = NULL;
16030304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1604bdfc8cc4SJamie Gritton #ifdef VIMAGE
1605bdfc8cc4SJamie Gritton 			if (tpr->pr_flags & PR_VNET) {
1606bdfc8cc4SJamie Gritton 				descend = 0;
1607bdfc8cc4SJamie Gritton 				continue;
1608bdfc8cc4SJamie Gritton 			}
1609bdfc8cc4SJamie Gritton #endif
16100304c731SJamie Gritton 			if (prison_restrict_ip4(tpr, NULL)) {
16110304c731SJamie Gritton 				redo_ip4 = 1;
16120304c731SJamie Gritton 				descend = 0;
16130304c731SJamie Gritton 			}
16140304c731SJamie Gritton 		}
16150304c731SJamie Gritton 	}
1616b38ff370SJamie Gritton #endif
1617b38ff370SJamie Gritton #ifdef INET6
16180304c731SJamie Gritton 	redo_ip6 = 0;
16190304c731SJamie Gritton 	if (pr_flags & PR_IP6_USER) {
16200304c731SJamie Gritton 		pr->pr_flags |= PR_IP6;
1621b38ff370SJamie Gritton 		free(pr->pr_ip6, M_PRISON);
16220304c731SJamie Gritton 		pr->pr_ip6s = ip6s;
1623b38ff370SJamie Gritton 		pr->pr_ip6 = ip6;
1624b38ff370SJamie Gritton 		ip6 = NULL;
16250304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1626bdfc8cc4SJamie Gritton #ifdef VIMAGE
1627bdfc8cc4SJamie Gritton 			if (tpr->pr_flags & PR_VNET) {
1628bdfc8cc4SJamie Gritton 				descend = 0;
1629bdfc8cc4SJamie Gritton 				continue;
1630bdfc8cc4SJamie Gritton 			}
1631bdfc8cc4SJamie Gritton #endif
16320304c731SJamie Gritton 			if (prison_restrict_ip6(tpr, NULL)) {
16330304c731SJamie Gritton 				redo_ip6 = 1;
16340304c731SJamie Gritton 				descend = 0;
16350304c731SJamie Gritton 			}
16360304c731SJamie Gritton 		}
16370304c731SJamie Gritton 	}
1638b38ff370SJamie Gritton #endif
16390304c731SJamie Gritton 	if (gotslevel) {
1640b38ff370SJamie Gritton 		pr->pr_securelevel = slevel;
16410304c731SJamie Gritton 		/* Set all child jails to be at least this level. */
16420304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
16430304c731SJamie Gritton 			if (tpr->pr_securelevel < slevel)
16440304c731SJamie Gritton 				tpr->pr_securelevel = slevel;
16450304c731SJamie Gritton 	}
1646b97457e2SJamie Gritton 	if (gotchildmax) {
1647b97457e2SJamie Gritton 		pr->pr_childmax = childmax;
1648b97457e2SJamie Gritton 		/* Set all child jails to under this limit. */
1649b97457e2SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED_LEVEL(pr, tpr, descend, level)
1650b97457e2SJamie Gritton 			if (tpr->pr_childmax > childmax - level)
1651b97457e2SJamie Gritton 				tpr->pr_childmax = childmax > level
1652b97457e2SJamie Gritton 				    ? childmax - level : 0;
1653b97457e2SJamie Gritton 	}
16540304c731SJamie Gritton 	if (gotenforce) {
16550304c731SJamie Gritton 		pr->pr_enforce_statfs = enforce;
16560304c731SJamie Gritton 		/* Pass this restriction on to the children. */
16570304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
16580304c731SJamie Gritton 			if (tpr->pr_enforce_statfs < enforce)
16590304c731SJamie Gritton 				tpr->pr_enforce_statfs = enforce;
16600304c731SJamie Gritton 	}
16610cc207a6SMartin Matuska 	if (gotrsnum) {
16620cc207a6SMartin Matuska 		pr->pr_devfs_rsnum = rsnum;
16630cc207a6SMartin Matuska 		/* Pass this restriction on to the children. */
16640cc207a6SMartin Matuska 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
16650cc207a6SMartin Matuska 			tpr->pr_devfs_rsnum = rsnum;
16660cc207a6SMartin Matuska 	}
1667b6f47c23SJamie Gritton 	if (namelc != NULL) {
16680304c731SJamie Gritton 		if (ppr == &prison0)
1669b6f47c23SJamie Gritton 			strlcpy(pr->pr_name, namelc, sizeof(pr->pr_name));
16700304c731SJamie Gritton 		else
16710304c731SJamie Gritton 			snprintf(pr->pr_name, sizeof(pr->pr_name), "%s.%s",
1672b6f47c23SJamie Gritton 			    ppr->pr_name, namelc);
16730304c731SJamie Gritton 		/* Change this component of child names. */
16740304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
16750304c731SJamie Gritton 			bcopy(tpr->pr_name + onamelen, tpr->pr_name + namelen,
16760304c731SJamie Gritton 			    strlen(tpr->pr_name + onamelen) + 1);
16770304c731SJamie Gritton 			bcopy(pr->pr_name, tpr->pr_name, namelen);
16780304c731SJamie Gritton 		}
16790304c731SJamie Gritton 	}
1680b38ff370SJamie Gritton 	if (path != NULL) {
16810304c731SJamie Gritton 		/* Try to keep a real-rooted full pathname. */
1682b38ff370SJamie Gritton 		strlcpy(pr->pr_path, path, sizeof(pr->pr_path));
1683b38ff370SJamie Gritton 		pr->pr_root = root;
16842a4b2251SJamie Gritton 		root = NULL;
1685b38ff370SJamie Gritton 	}
168676ca6f88SJamie Gritton 	if (PR_HOST & ch_flags & ~pr_flags) {
168776ca6f88SJamie Gritton 		if (pr->pr_flags & PR_HOST) {
168876ca6f88SJamie Gritton 			/*
168976ca6f88SJamie Gritton 			 * Copy the parent's host info.  As with pr_ip4 above,
169076ca6f88SJamie Gritton 			 * the lack of a lock on the parent is not a problem;
169176ca6f88SJamie Gritton 			 * it is always set with allprison_lock at least
169276ca6f88SJamie Gritton 			 * shared, and is held exclusively here.
169376ca6f88SJamie Gritton 			 */
1694c1f19219SJamie Gritton 			strlcpy(pr->pr_hostname, pr->pr_parent->pr_hostname,
1695c1f19219SJamie Gritton 			    sizeof(pr->pr_hostname));
1696c1f19219SJamie Gritton 			strlcpy(pr->pr_domainname, pr->pr_parent->pr_domainname,
1697c1f19219SJamie Gritton 			    sizeof(pr->pr_domainname));
1698c1f19219SJamie Gritton 			strlcpy(pr->pr_hostuuid, pr->pr_parent->pr_hostuuid,
1699c1f19219SJamie Gritton 			    sizeof(pr->pr_hostuuid));
170076ca6f88SJamie Gritton 			pr->pr_hostid = pr->pr_parent->pr_hostid;
170176ca6f88SJamie Gritton 		}
170276ca6f88SJamie Gritton 	} else if (host != NULL || domain != NULL || uuid != NULL || gothid) {
170376ca6f88SJamie Gritton 		/* Set this prison, and any descendants without PR_HOST. */
1704b38ff370SJamie Gritton 		if (host != NULL)
1705c1f19219SJamie Gritton 			strlcpy(pr->pr_hostname, host, sizeof(pr->pr_hostname));
170676ca6f88SJamie Gritton 		if (domain != NULL)
1707c1f19219SJamie Gritton 			strlcpy(pr->pr_domainname, domain,
1708c1f19219SJamie Gritton 			    sizeof(pr->pr_domainname));
170976ca6f88SJamie Gritton 		if (uuid != NULL)
1710c1f19219SJamie Gritton 			strlcpy(pr->pr_hostuuid, uuid, sizeof(pr->pr_hostuuid));
171176ca6f88SJamie Gritton 		if (gothid)
171276ca6f88SJamie Gritton 			pr->pr_hostid = hid;
171376ca6f88SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
171476ca6f88SJamie Gritton 			if (tpr->pr_flags & PR_HOST)
171576ca6f88SJamie Gritton 				descend = 0;
171676ca6f88SJamie Gritton 			else {
171776ca6f88SJamie Gritton 				if (host != NULL)
1718c1f19219SJamie Gritton 					strlcpy(tpr->pr_hostname,
1719c1f19219SJamie Gritton 					    pr->pr_hostname,
1720c1f19219SJamie Gritton 					    sizeof(tpr->pr_hostname));
172176ca6f88SJamie Gritton 				if (domain != NULL)
1722c1f19219SJamie Gritton 					strlcpy(tpr->pr_domainname,
1723c1f19219SJamie Gritton 					    pr->pr_domainname,
1724c1f19219SJamie Gritton 					    sizeof(tpr->pr_domainname));
172576ca6f88SJamie Gritton 				if (uuid != NULL)
1726c1f19219SJamie Gritton 					strlcpy(tpr->pr_hostuuid,
1727c1f19219SJamie Gritton 					    pr->pr_hostuuid,
1728c1f19219SJamie Gritton 					    sizeof(tpr->pr_hostuuid));
172976ca6f88SJamie Gritton 				if (gothid)
173076ca6f88SJamie Gritton 					tpr->pr_hostid = hid;
173176ca6f88SJamie Gritton 			}
173276ca6f88SJamie Gritton 		}
173376ca6f88SJamie Gritton 	}
17340304c731SJamie Gritton 	pr->pr_allow = (pr->pr_allow & ~ch_allow) | pr_allow;
17350fe74ae6SJamie Gritton 	if ((tallow = ch_allow & ~pr_allow))
17360fe74ae6SJamie Gritton 		prison_set_allow_locked(pr, tallow, 0);
1737b38ff370SJamie Gritton 	/*
1738b38ff370SJamie Gritton 	 * Persistent prisons get an extra reference, and prisons losing their
1739*1158508aSJamie Gritton 	 * persist flag lose that reference.
1740b38ff370SJamie Gritton 	 */
174176ad42abSJamie Gritton 	born = !prison_isalive(pr);
1742*1158508aSJamie Gritton 	if (ch_flags & PR_PERSIST & (pr_flags ^ pr->pr_flags)) {
1743b38ff370SJamie Gritton 		if (pr_flags & PR_PERSIST) {
17446754ae25SJamie Gritton 			prison_hold(pr);
1745*1158508aSJamie Gritton 			/*
1746*1158508aSJamie Gritton 			 * This may make a dead prison alive again, but wait
1747*1158508aSJamie Gritton 			 * to label it as such until after OSD calls have had
1748*1158508aSJamie Gritton 			 * a chance to run (and perhaps to fail).
1749*1158508aSJamie Gritton 			 */
17506754ae25SJamie Gritton 			refcount_acquire(&pr->pr_uref);
1751b38ff370SJamie Gritton 		} else {
175239c8ef90SJamie Gritton 			drflags |= PD_DEUREF;
1753f7496dcaSJamie Gritton 			prison_free_not_last(pr);
1754b38ff370SJamie Gritton 		}
1755b38ff370SJamie Gritton 	}
1756b38ff370SJamie Gritton 	pr->pr_flags = (pr->pr_flags & ~ch_flags) | pr_flags;
1757b38ff370SJamie Gritton 	mtx_unlock(&pr->pr_mtx);
17582a4b2251SJamie Gritton 	drflags &= ~PD_LOCKED;
1759b38ff370SJamie Gritton 
1760a7ad07bfSEdward Tomasz Napierala #ifdef RACCT
17614b5c9cf6SEdward Tomasz Napierala 	if (racct_enable && created)
1762a7ad07bfSEdward Tomasz Napierala 		prison_racct_attach(pr);
1763a7ad07bfSEdward Tomasz Napierala #endif
1764a7ad07bfSEdward Tomasz Napierala 
17650304c731SJamie Gritton 	/* Locks may have prevented a complete restriction of child IP
17660304c731SJamie Gritton 	 * addresses.  If so, allocate some more memory and try again.
17670304c731SJamie Gritton 	 */
17680304c731SJamie Gritton #ifdef INET
17690304c731SJamie Gritton 	while (redo_ip4) {
17700304c731SJamie Gritton 		ip4s = pr->pr_ip4s;
17710304c731SJamie Gritton 		ip4 = malloc(ip4s * sizeof(*ip4), M_PRISON, M_WAITOK);
17720304c731SJamie Gritton 		mtx_lock(&pr->pr_mtx);
17730304c731SJamie Gritton 		redo_ip4 = 0;
17740304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1775bdfc8cc4SJamie Gritton #ifdef VIMAGE
1776bdfc8cc4SJamie Gritton 			if (tpr->pr_flags & PR_VNET) {
1777bdfc8cc4SJamie Gritton 				descend = 0;
1778bdfc8cc4SJamie Gritton 				continue;
1779bdfc8cc4SJamie Gritton 			}
1780bdfc8cc4SJamie Gritton #endif
17810304c731SJamie Gritton 			if (prison_restrict_ip4(tpr, ip4)) {
17820304c731SJamie Gritton 				if (ip4 != NULL)
17830304c731SJamie Gritton 					ip4 = NULL;
17840304c731SJamie Gritton 				else
17850304c731SJamie Gritton 					redo_ip4 = 1;
17860304c731SJamie Gritton 			}
17870304c731SJamie Gritton 		}
17880304c731SJamie Gritton 		mtx_unlock(&pr->pr_mtx);
17890304c731SJamie Gritton 	}
17900304c731SJamie Gritton #endif
17910304c731SJamie Gritton #ifdef INET6
17920304c731SJamie Gritton 	while (redo_ip6) {
17930304c731SJamie Gritton 		ip6s = pr->pr_ip6s;
17940304c731SJamie Gritton 		ip6 = malloc(ip6s * sizeof(*ip6), M_PRISON, M_WAITOK);
17950304c731SJamie Gritton 		mtx_lock(&pr->pr_mtx);
17960304c731SJamie Gritton 		redo_ip6 = 0;
17970304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1798bdfc8cc4SJamie Gritton #ifdef VIMAGE
1799bdfc8cc4SJamie Gritton 			if (tpr->pr_flags & PR_VNET) {
1800bdfc8cc4SJamie Gritton 				descend = 0;
1801bdfc8cc4SJamie Gritton 				continue;
1802bdfc8cc4SJamie Gritton 			}
1803bdfc8cc4SJamie Gritton #endif
18040304c731SJamie Gritton 			if (prison_restrict_ip6(tpr, ip6)) {
18050304c731SJamie Gritton 				if (ip6 != NULL)
18060304c731SJamie Gritton 					ip6 = NULL;
18070304c731SJamie Gritton 				else
18080304c731SJamie Gritton 					redo_ip6 = 1;
18090304c731SJamie Gritton 			}
18100304c731SJamie Gritton 		}
18110304c731SJamie Gritton 		mtx_unlock(&pr->pr_mtx);
18120304c731SJamie Gritton 	}
18130304c731SJamie Gritton #endif
18140304c731SJamie Gritton 
1815b38ff370SJamie Gritton 	/* Let the modules do their work. */
1816cc5fd8c7SJamie Gritton 	if (born) {
1817b38ff370SJamie Gritton 		error = osd_jail_call(pr, PR_METHOD_CREATE, opts);
1818b38ff370SJamie Gritton 		if (error) {
1819cc5fd8c7SJamie Gritton 			(void)osd_jail_call(pr, PR_METHOD_REMOVE, NULL);
18202a4b2251SJamie Gritton 			goto done_deref;
1821b38ff370SJamie Gritton 		}
1822b38ff370SJamie Gritton 	}
1823b38ff370SJamie Gritton 	error = osd_jail_call(pr, PR_METHOD_SET, opts);
1824b38ff370SJamie Gritton 	if (error) {
1825cc5fd8c7SJamie Gritton 		if (born)
1826cc5fd8c7SJamie Gritton 			(void)osd_jail_call(pr, PR_METHOD_REMOVE, NULL);
18272a4b2251SJamie Gritton 		goto done_deref;
1828b38ff370SJamie Gritton 	}
1829b38ff370SJamie Gritton 
1830*1158508aSJamie Gritton 	/*
1831*1158508aSJamie Gritton 	 * A new prison is now ready to be seen; either it has gained a user
1832*1158508aSJamie Gritton 	 * reference via persistence, or is about to gain one via attachment.
1833*1158508aSJamie Gritton 	 */
1834*1158508aSJamie Gritton 	if (born) {
1835*1158508aSJamie Gritton 		drflags = prison_lock_xlock(pr, drflags);
1836*1158508aSJamie Gritton 		pr->pr_state = PRISON_STATE_ALIVE;
1837*1158508aSJamie Gritton 	}
1838*1158508aSJamie Gritton 
1839b38ff370SJamie Gritton 	/* Attach this process to the prison if requested. */
1840b38ff370SJamie Gritton 	if (flags & JAIL_ATTACH) {
1841f7496dcaSJamie Gritton 		error = do_jail_attach(td, pr, prison_lock_xlock(pr, drflags));
1842f7496dcaSJamie Gritton 		drflags &= ~(PD_LOCKED | PD_LIST_XLOCKED);
1843b38ff370SJamie Gritton 		if (error) {
1844b38ff370SJamie Gritton 			vfs_opterror(opts, "attach failed");
18452a4b2251SJamie Gritton 			goto done_deref;
1846b38ff370SJamie Gritton 		}
1847b38ff370SJamie Gritton 	}
1848b38ff370SJamie Gritton 
18491fb24974SEdward Tomasz Napierala #ifdef RACCT
18504b5c9cf6SEdward Tomasz Napierala 	if (racct_enable && !created) {
1851f7496dcaSJamie Gritton 		if (drflags & PD_LIST_XLOCKED) {
1852f7496dcaSJamie Gritton 			sx_xunlock(&allprison_lock);
1853f7496dcaSJamie Gritton 			drflags &= ~PD_LIST_XLOCKED;
1854b4e87a63SJamie Gritton 		}
18551fb24974SEdward Tomasz Napierala 		prison_racct_modify(pr);
18561fb24974SEdward Tomasz Napierala 	}
18571fb24974SEdward Tomasz Napierala #endif
18581fb24974SEdward Tomasz Napierala 
18591fb24974SEdward Tomasz Napierala 	td->td_retval[0] = pr->pr_id;
18601fb24974SEdward Tomasz Napierala 
18612a4b2251SJamie Gritton  done_deref:
18622a4b2251SJamie Gritton 	/* Release any temporary prison holds and/or locks. */
18632a4b2251SJamie Gritton 	if (pr != NULL)
18642a4b2251SJamie Gritton 		prison_deref(pr, drflags);
18652a4b2251SJamie Gritton 	else if (drflags & PD_LIST_SLOCKED)
1866b38ff370SJamie Gritton 		sx_sunlock(&allprison_lock);
18672a4b2251SJamie Gritton 	else if (drflags & PD_LIST_XLOCKED)
1868b38ff370SJamie Gritton 		sx_xunlock(&allprison_lock);
18695050aa86SKonstantin Belousov 	if (root != NULL)
1870b38ff370SJamie Gritton 		vrele(root);
1871b38ff370SJamie Gritton  done_errmsg:
1872b38ff370SJamie Gritton 	if (error) {
18732a4b2251SJamie Gritton 		/* Write the error message back to userspace. */
1874176ff3a0SJamie Gritton 		if (vfs_getopt(opts, "errmsg", (void **)&errmsg,
1875176ff3a0SJamie Gritton 		    &errmsg_len) == 0 && errmsg_len > 0) {
1876b38ff370SJamie Gritton 			errmsg_pos = 2 * vfs_getopt_pos(opts, "errmsg") + 1;
1877b38ff370SJamie Gritton 			if (optuio->uio_segflg == UIO_SYSSPACE)
1878b38ff370SJamie Gritton 				bcopy(errmsg,
1879b38ff370SJamie Gritton 				    optuio->uio_iov[errmsg_pos].iov_base,
1880b38ff370SJamie Gritton 				    errmsg_len);
1881b38ff370SJamie Gritton 			else
1882b38ff370SJamie Gritton 				copyout(errmsg,
1883b38ff370SJamie Gritton 				    optuio->uio_iov[errmsg_pos].iov_base,
1884b38ff370SJamie Gritton 				    errmsg_len);
1885b38ff370SJamie Gritton 		}
1886b38ff370SJamie Gritton 	}
1887b38ff370SJamie Gritton  done_free:
1888b38ff370SJamie Gritton #ifdef INET
1889b38ff370SJamie Gritton 	free(ip4, M_PRISON);
1890b38ff370SJamie Gritton #endif
1891b38ff370SJamie Gritton #ifdef INET6
1892b38ff370SJamie Gritton 	free(ip6, M_PRISON);
1893b38ff370SJamie Gritton #endif
18946dfe0a3dSMartin Matuska 	if (g_path != NULL)
18956dfe0a3dSMartin Matuska 		free(g_path, M_TEMP);
1896b38ff370SJamie Gritton 	vfs_freeopts(opts);
1897b38ff370SJamie Gritton 	return (error);
1898b38ff370SJamie Gritton }
1899b38ff370SJamie Gritton 
1900b38ff370SJamie Gritton /*
19017de883c8SJamie Gritton  * Find the next available prison ID.  Return the ID on success, or zero
19027de883c8SJamie Gritton  * on failure.  Also set a pointer to the allprison list entry the prison
19037de883c8SJamie Gritton  * should be inserted before.
19047de883c8SJamie Gritton  */
19057de883c8SJamie Gritton static int
19067de883c8SJamie Gritton get_next_prid(struct prison **insprp)
19077de883c8SJamie Gritton {
19087de883c8SJamie Gritton 	struct prison *inspr;
19097de883c8SJamie Gritton 	int jid, maxid;
19107de883c8SJamie Gritton 
19117de883c8SJamie Gritton 	jid = lastprid % JAIL_MAX + 1;
19127de883c8SJamie Gritton 	if (TAILQ_EMPTY(&allprison) ||
19137de883c8SJamie Gritton 	    TAILQ_LAST(&allprison, prisonlist)->pr_id < jid) {
19147de883c8SJamie Gritton 		/*
19157de883c8SJamie Gritton 		 * A common case is for all jails to be implicitly numbered,
19167de883c8SJamie Gritton 		 * which means they'll go on the end of the list, at least
19177de883c8SJamie Gritton 		 * for the first JAIL_MAX times.
19187de883c8SJamie Gritton 		 */
19197de883c8SJamie Gritton 		inspr = NULL;
19207de883c8SJamie Gritton 	} else {
19217de883c8SJamie Gritton 		/*
19227de883c8SJamie Gritton 		 * Take two passes through the allprison list: first starting
19237de883c8SJamie Gritton 		 * with the proposed jid, then ending with it.
19247de883c8SJamie Gritton 		 */
19257de883c8SJamie Gritton 		for (maxid = JAIL_MAX; maxid != 0; ) {
19267de883c8SJamie Gritton 			TAILQ_FOREACH(inspr, &allprison, pr_list) {
19277de883c8SJamie Gritton 				if (inspr->pr_id < jid)
19287de883c8SJamie Gritton 					continue;
1929f7496dcaSJamie Gritton 				if (inspr->pr_id > jid) {
1930f7496dcaSJamie Gritton 					/* Found an opening. */
19317de883c8SJamie Gritton 					maxid = 0;
19327de883c8SJamie Gritton 					break;
19337de883c8SJamie Gritton 				}
19347de883c8SJamie Gritton 				if (++jid > maxid) {
19357de883c8SJamie Gritton 					if (lastprid == maxid || lastprid == 0)
19367de883c8SJamie Gritton 					{
19377de883c8SJamie Gritton 						/*
19387de883c8SJamie Gritton 						 * The entire legal range
19397de883c8SJamie Gritton 						 * has been traversed
19407de883c8SJamie Gritton 						 */
19417de883c8SJamie Gritton 						return 0;
19427de883c8SJamie Gritton 					}
19437de883c8SJamie Gritton 					/* Try again from the start. */
19447de883c8SJamie Gritton 					jid = 1;
19457de883c8SJamie Gritton 					maxid = lastprid;
19467de883c8SJamie Gritton 					break;
19477de883c8SJamie Gritton 				}
19487de883c8SJamie Gritton 			}
19497de883c8SJamie Gritton 			if (inspr == NULL) {
19507de883c8SJamie Gritton 				/* Found room at the end of the list. */
19517de883c8SJamie Gritton 				break;
19527de883c8SJamie Gritton 			}
19537de883c8SJamie Gritton 		}
19547de883c8SJamie Gritton 	}
19557de883c8SJamie Gritton 	*insprp = inspr;
19567de883c8SJamie Gritton 	lastprid = jid;
19577de883c8SJamie Gritton 	return (jid);
19587de883c8SJamie Gritton }
19597de883c8SJamie Gritton 
19607de883c8SJamie Gritton /*
1961b38ff370SJamie Gritton  * struct jail_get_args {
1962b38ff370SJamie Gritton  *	struct iovec *iovp;
1963b38ff370SJamie Gritton  *	unsigned int iovcnt;
1964b38ff370SJamie Gritton  *	int flags;
1965b38ff370SJamie Gritton  * };
1966b38ff370SJamie Gritton  */
1967b38ff370SJamie Gritton int
19688451d0ddSKip Macy sys_jail_get(struct thread *td, struct jail_get_args *uap)
1969b38ff370SJamie Gritton {
1970b38ff370SJamie Gritton 	struct uio *auio;
1971b38ff370SJamie Gritton 	int error;
1972b38ff370SJamie Gritton 
1973b38ff370SJamie Gritton 	/* Check that we have an even number of iovecs. */
1974b38ff370SJamie Gritton 	if (uap->iovcnt & 1)
1975b38ff370SJamie Gritton 		return (EINVAL);
1976b38ff370SJamie Gritton 
1977b38ff370SJamie Gritton 	error = copyinuio(uap->iovp, uap->iovcnt, &auio);
1978b38ff370SJamie Gritton 	if (error)
1979b38ff370SJamie Gritton 		return (error);
1980b38ff370SJamie Gritton 	error = kern_jail_get(td, auio, uap->flags);
1981b38ff370SJamie Gritton 	if (error == 0)
1982b38ff370SJamie Gritton 		error = copyout(auio->uio_iov, uap->iovp,
1983b38ff370SJamie Gritton 		    uap->iovcnt * sizeof (struct iovec));
1984b38ff370SJamie Gritton 	free(auio, M_IOV);
1985b38ff370SJamie Gritton 	return (error);
1986b38ff370SJamie Gritton }
1987b38ff370SJamie Gritton 
1988b38ff370SJamie Gritton int
1989b38ff370SJamie Gritton kern_jail_get(struct thread *td, struct uio *optuio, int flags)
1990b38ff370SJamie Gritton {
1991672756aaSJamie Gritton 	struct bool_flags *bf;
1992672756aaSJamie Gritton 	struct jailsys_flags *jsf;
19930304c731SJamie Gritton 	struct prison *pr, *mypr;
1994b38ff370SJamie Gritton 	struct vfsopt *opt;
1995b38ff370SJamie Gritton 	struct vfsoptlist *opts;
1996b38ff370SJamie Gritton 	char *errmsg, *name;
19972a4b2251SJamie Gritton 	int drflags, error, errmsg_len, errmsg_pos, i, jid, len, pos;
1998672756aaSJamie Gritton 	unsigned f;
1999b38ff370SJamie Gritton 
2000b38ff370SJamie Gritton 	if (flags & ~JAIL_GET_MASK)
2001b38ff370SJamie Gritton 		return (EINVAL);
2002b38ff370SJamie Gritton 
2003b38ff370SJamie Gritton 	/* Get the parameter list. */
2004b38ff370SJamie Gritton 	error = vfs_buildopts(optuio, &opts);
2005b38ff370SJamie Gritton 	if (error)
2006b38ff370SJamie Gritton 		return (error);
2007b38ff370SJamie Gritton 	errmsg_pos = vfs_getopt_pos(opts, "errmsg");
20080304c731SJamie Gritton 	mypr = td->td_ucred->cr_prison;
20092a4b2251SJamie Gritton 	pr = NULL;
20101e2a13e6SJamie Gritton 
2011b38ff370SJamie Gritton 	/*
2012b38ff370SJamie Gritton 	 * Find the prison specified by one of: lastjid, jid, name.
2013b38ff370SJamie Gritton 	 */
2014b38ff370SJamie Gritton 	sx_slock(&allprison_lock);
20152a4b2251SJamie Gritton 	drflags = PD_LIST_SLOCKED;
2016b38ff370SJamie Gritton 	error = vfs_copyopt(opts, "lastjid", &jid, sizeof(jid));
2017b38ff370SJamie Gritton 	if (error == 0) {
2018b38ff370SJamie Gritton 		TAILQ_FOREACH(pr, &allprison, pr_list) {
2019f7496dcaSJamie Gritton 			if (pr->pr_id > jid &&
2020f7496dcaSJamie Gritton 			    ((flags & JAIL_DYING) || prison_isalive(pr)) &&
2021f7496dcaSJamie Gritton 			    prison_ischild(mypr, pr)) {
2022b38ff370SJamie Gritton 				mtx_lock(&pr->pr_mtx);
20232a4b2251SJamie Gritton 				drflags |= PD_LOCKED;
2024b38ff370SJamie Gritton 				goto found_prison;
20252a4b2251SJamie Gritton 			}
2026f7496dcaSJamie Gritton 		}
2027b38ff370SJamie Gritton 		error = ENOENT;
2028b38ff370SJamie Gritton 		vfs_opterror(opts, "no jail after %d", jid);
20292a4b2251SJamie Gritton 		goto done;
2030b38ff370SJamie Gritton 	} else if (error != ENOENT)
20312a4b2251SJamie Gritton 		goto done;
2032b38ff370SJamie Gritton 
2033b38ff370SJamie Gritton 	error = vfs_copyopt(opts, "jid", &jid, sizeof(jid));
2034b38ff370SJamie Gritton 	if (error == 0) {
2035b38ff370SJamie Gritton 		if (jid != 0) {
20360304c731SJamie Gritton 			pr = prison_find_child(mypr, jid);
2037b38ff370SJamie Gritton 			if (pr != NULL) {
20382a4b2251SJamie Gritton 				drflags |= PD_LOCKED;
203976ad42abSJamie Gritton 				if (!(prison_isalive(pr) ||
204076ad42abSJamie Gritton 				    (flags & JAIL_DYING))) {
2041b38ff370SJamie Gritton 					error = ENOENT;
2042b38ff370SJamie Gritton 					vfs_opterror(opts, "jail %d is dying",
2043b38ff370SJamie Gritton 					    jid);
20442a4b2251SJamie Gritton 					goto done;
2045b38ff370SJamie Gritton 				}
2046b38ff370SJamie Gritton 				goto found_prison;
2047b38ff370SJamie Gritton 			}
2048b38ff370SJamie Gritton 			error = ENOENT;
2049b38ff370SJamie Gritton 			vfs_opterror(opts, "jail %d not found", jid);
20502a4b2251SJamie Gritton 			goto done;
2051b38ff370SJamie Gritton 		}
2052b38ff370SJamie Gritton 	} else if (error != ENOENT)
20532a4b2251SJamie Gritton 		goto done;
2054b38ff370SJamie Gritton 
2055b38ff370SJamie Gritton 	error = vfs_getopt(opts, "name", (void **)&name, &len);
2056b38ff370SJamie Gritton 	if (error == 0) {
2057b38ff370SJamie Gritton 		if (len == 0 || name[len - 1] != '\0') {
2058b38ff370SJamie Gritton 			error = EINVAL;
20592a4b2251SJamie Gritton 			goto done;
2060b38ff370SJamie Gritton 		}
20610304c731SJamie Gritton 		pr = prison_find_name(mypr, name);
2062b38ff370SJamie Gritton 		if (pr != NULL) {
20632a4b2251SJamie Gritton 			drflags |= PD_LOCKED;
206476ad42abSJamie Gritton 			if (!(prison_isalive(pr) || (flags & JAIL_DYING))) {
2065b38ff370SJamie Gritton 				error = ENOENT;
2066b38ff370SJamie Gritton 				vfs_opterror(opts, "jail \"%s\" is dying",
2067b38ff370SJamie Gritton 				    name);
20682a4b2251SJamie Gritton 				goto done;
2069b38ff370SJamie Gritton 			}
2070b38ff370SJamie Gritton 			goto found_prison;
2071b38ff370SJamie Gritton 		}
2072b38ff370SJamie Gritton 		error = ENOENT;
2073b38ff370SJamie Gritton 		vfs_opterror(opts, "jail \"%s\" not found", name);
20742a4b2251SJamie Gritton 		goto done;
2075b38ff370SJamie Gritton 	} else if (error != ENOENT)
20762a4b2251SJamie Gritton 		goto done;
2077b38ff370SJamie Gritton 
2078b38ff370SJamie Gritton 	vfs_opterror(opts, "no jail specified");
2079b38ff370SJamie Gritton 	error = ENOENT;
20802a4b2251SJamie Gritton 	goto done;
2081b38ff370SJamie Gritton 
2082b38ff370SJamie Gritton  found_prison:
2083b38ff370SJamie Gritton 	/* Get the parameters of the prison. */
20846754ae25SJamie Gritton 	prison_hold(pr);
20852a4b2251SJamie Gritton 	drflags |= PD_DEREF;
2086b38ff370SJamie Gritton 	td->td_retval[0] = pr->pr_id;
2087b38ff370SJamie Gritton 	error = vfs_setopt(opts, "jid", &pr->pr_id, sizeof(pr->pr_id));
2088b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
20892a4b2251SJamie Gritton 		goto done;
20900304c731SJamie Gritton 	i = (pr->pr_parent == mypr) ? 0 : pr->pr_parent->pr_id;
20910304c731SJamie Gritton 	error = vfs_setopt(opts, "parent", &i, sizeof(i));
2092b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
20932a4b2251SJamie Gritton 		goto done;
20940304c731SJamie Gritton 	error = vfs_setopts(opts, "name", prison_name(mypr, pr));
20950304c731SJamie Gritton 	if (error != 0 && error != ENOENT)
20962a4b2251SJamie Gritton 		goto done;
20970304c731SJamie Gritton 	error = vfs_setopt(opts, "cpuset.id", &pr->pr_cpuset->cs_id,
2098b38ff370SJamie Gritton 	    sizeof(pr->pr_cpuset->cs_id));
2099b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
21002a4b2251SJamie Gritton 		goto done;
21010304c731SJamie Gritton 	error = vfs_setopts(opts, "path", prison_path(mypr, pr));
2102b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
21032a4b2251SJamie Gritton 		goto done;
2104b38ff370SJamie Gritton #ifdef INET
2105b38ff370SJamie Gritton 	error = vfs_setopt_part(opts, "ip4.addr", pr->pr_ip4,
2106b38ff370SJamie Gritton 	    pr->pr_ip4s * sizeof(*pr->pr_ip4));
2107b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
21082a4b2251SJamie Gritton 		goto done;
2109b38ff370SJamie Gritton #endif
2110b38ff370SJamie Gritton #ifdef INET6
2111b38ff370SJamie Gritton 	error = vfs_setopt_part(opts, "ip6.addr", pr->pr_ip6,
2112b38ff370SJamie Gritton 	    pr->pr_ip6s * sizeof(*pr->pr_ip6));
2113b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
21142a4b2251SJamie Gritton 		goto done;
2115b38ff370SJamie Gritton #endif
2116b38ff370SJamie Gritton 	error = vfs_setopt(opts, "securelevel", &pr->pr_securelevel,
2117b38ff370SJamie Gritton 	    sizeof(pr->pr_securelevel));
2118b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
21192a4b2251SJamie Gritton 		goto done;
2120b97457e2SJamie Gritton 	error = vfs_setopt(opts, "children.cur", &pr->pr_childcount,
2121b97457e2SJamie Gritton 	    sizeof(pr->pr_childcount));
2122b97457e2SJamie Gritton 	if (error != 0 && error != ENOENT)
21232a4b2251SJamie Gritton 		goto done;
2124b97457e2SJamie Gritton 	error = vfs_setopt(opts, "children.max", &pr->pr_childmax,
2125b97457e2SJamie Gritton 	    sizeof(pr->pr_childmax));
2126b97457e2SJamie Gritton 	if (error != 0 && error != ENOENT)
21272a4b2251SJamie Gritton 		goto done;
2128c1f19219SJamie Gritton 	error = vfs_setopts(opts, "host.hostname", pr->pr_hostname);
2129b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
21302a4b2251SJamie Gritton 		goto done;
2131c1f19219SJamie Gritton 	error = vfs_setopts(opts, "host.domainname", pr->pr_domainname);
213276ca6f88SJamie Gritton 	if (error != 0 && error != ENOENT)
21332a4b2251SJamie Gritton 		goto done;
2134c1f19219SJamie Gritton 	error = vfs_setopts(opts, "host.hostuuid", pr->pr_hostuuid);
213576ca6f88SJamie Gritton 	if (error != 0 && error != ENOENT)
21362a4b2251SJamie Gritton 		goto done;
2137841c0c7eSNathan Whitehorn #ifdef COMPAT_FREEBSD32
2138a5c1afadSDmitry Chagin 	if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) {
213976ca6f88SJamie Gritton 		uint32_t hid32 = pr->pr_hostid;
214076ca6f88SJamie Gritton 
214176ca6f88SJamie Gritton 		error = vfs_setopt(opts, "host.hostid", &hid32, sizeof(hid32));
214276ca6f88SJamie Gritton 	} else
214376ca6f88SJamie Gritton #endif
214476ca6f88SJamie Gritton 	error = vfs_setopt(opts, "host.hostid", &pr->pr_hostid,
214576ca6f88SJamie Gritton 	    sizeof(pr->pr_hostid));
214676ca6f88SJamie Gritton 	if (error != 0 && error != ENOENT)
21472a4b2251SJamie Gritton 		goto done;
21480304c731SJamie Gritton 	error = vfs_setopt(opts, "enforce_statfs", &pr->pr_enforce_statfs,
21490304c731SJamie Gritton 	    sizeof(pr->pr_enforce_statfs));
21500304c731SJamie Gritton 	if (error != 0 && error != ENOENT)
21512a4b2251SJamie Gritton 		goto done;
21520cc207a6SMartin Matuska 	error = vfs_setopt(opts, "devfs_ruleset", &pr->pr_devfs_rsnum,
21530cc207a6SMartin Matuska 	    sizeof(pr->pr_devfs_rsnum));
21540cc207a6SMartin Matuska 	if (error != 0 && error != ENOENT)
21552a4b2251SJamie Gritton 		goto done;
2156672756aaSJamie Gritton 	for (bf = pr_flag_bool;
2157672756aaSJamie Gritton 	     bf < pr_flag_bool + nitems(pr_flag_bool);
2158672756aaSJamie Gritton 	     bf++) {
2159672756aaSJamie Gritton 		i = (pr->pr_flags & bf->flag) ? 1 : 0;
2160672756aaSJamie Gritton 		error = vfs_setopt(opts, bf->name, &i, sizeof(i));
2161b38ff370SJamie Gritton 		if (error != 0 && error != ENOENT)
21622a4b2251SJamie Gritton 			goto done;
2163b38ff370SJamie Gritton 		i = !i;
2164672756aaSJamie Gritton 		error = vfs_setopt(opts, bf->noname, &i, sizeof(i));
2165b38ff370SJamie Gritton 		if (error != 0 && error != ENOENT)
21662a4b2251SJamie Gritton 			goto done;
21670304c731SJamie Gritton 	}
2168672756aaSJamie Gritton 	for (jsf = pr_flag_jailsys;
2169672756aaSJamie Gritton 	     jsf < pr_flag_jailsys + nitems(pr_flag_jailsys);
2170672756aaSJamie Gritton 	     jsf++) {
2171672756aaSJamie Gritton 		f = pr->pr_flags & (jsf->disable | jsf->new);
2172672756aaSJamie Gritton 		i = (f != 0 && f == jsf->disable) ? JAIL_SYS_DISABLE
2173672756aaSJamie Gritton 		    : (f == jsf->new) ? JAIL_SYS_NEW
21747cbf7213SJamie Gritton 		    : JAIL_SYS_INHERIT;
2175672756aaSJamie Gritton 		error = vfs_setopt(opts, jsf->name, &i, sizeof(i));
21767cbf7213SJamie Gritton 		if (error != 0 && error != ENOENT)
21772a4b2251SJamie Gritton 			goto done;
21787cbf7213SJamie Gritton 	}
2179672756aaSJamie Gritton 	for (bf = pr_flag_allow;
21805d58f959SJamie Gritton 	     bf < pr_flag_allow + nitems(pr_flag_allow) &&
21815d58f959SJamie Gritton 		atomic_load_int(&bf->flag) != 0;
2182672756aaSJamie Gritton 	     bf++) {
2183672756aaSJamie Gritton 		i = (pr->pr_allow & bf->flag) ? 1 : 0;
2184672756aaSJamie Gritton 		error = vfs_setopt(opts, bf->name, &i, sizeof(i));
21850304c731SJamie Gritton 		if (error != 0 && error != ENOENT)
21862a4b2251SJamie Gritton 			goto done;
21870304c731SJamie Gritton 		i = !i;
2188672756aaSJamie Gritton 		error = vfs_setopt(opts, bf->noname, &i, sizeof(i));
21890304c731SJamie Gritton 		if (error != 0 && error != ENOENT)
21902a4b2251SJamie Gritton 			goto done;
21910304c731SJamie Gritton 	}
219276ad42abSJamie Gritton 	i = !prison_isalive(pr);
2193b38ff370SJamie Gritton 	error = vfs_setopt(opts, "dying", &i, sizeof(i));
2194b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
21952a4b2251SJamie Gritton 		goto done;
2196b38ff370SJamie Gritton 	i = !i;
2197b38ff370SJamie Gritton 	error = vfs_setopt(opts, "nodying", &i, sizeof(i));
2198b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
21992a4b2251SJamie Gritton 		goto done;
2200bd96bd15SIan Lepore 	error = vfs_setopt(opts, "osreldate", &pr->pr_osreldate,
2201bd96bd15SIan Lepore 	    sizeof(pr->pr_osreldate));
2202a1a4c1b0SIan Lepore 	if (error != 0 && error != ENOENT)
22032a4b2251SJamie Gritton 		goto done;
2204a1a4c1b0SIan Lepore 	error = vfs_setopts(opts, "osrelease", pr->pr_osrelease);
2205a1a4c1b0SIan Lepore 	if (error != 0 && error != ENOENT)
22062a4b2251SJamie Gritton 		goto done;
2207b38ff370SJamie Gritton 
2208b38ff370SJamie Gritton 	/* Get the module parameters. */
2209b38ff370SJamie Gritton 	mtx_unlock(&pr->pr_mtx);
22102a4b2251SJamie Gritton 	drflags &= ~PD_LOCKED;
2211b38ff370SJamie Gritton 	error = osd_jail_call(pr, PR_METHOD_GET, opts);
2212b38ff370SJamie Gritton 	if (error)
22132a4b2251SJamie Gritton 		goto done;
22142a4b2251SJamie Gritton 	prison_deref(pr, drflags);
22152a4b2251SJamie Gritton 	pr = NULL;
22162a4b2251SJamie Gritton 	drflags = 0;
2217b38ff370SJamie Gritton 
2218b38ff370SJamie Gritton 	/* By now, all parameters should have been noted. */
2219b38ff370SJamie Gritton 	TAILQ_FOREACH(opt, opts, link) {
2220b38ff370SJamie Gritton 		if (!opt->seen && strcmp(opt->name, "errmsg")) {
2221b38ff370SJamie Gritton 			error = EINVAL;
2222b38ff370SJamie Gritton 			vfs_opterror(opts, "unknown parameter: %s", opt->name);
22232a4b2251SJamie Gritton 			goto done;
2224b38ff370SJamie Gritton 		}
2225b38ff370SJamie Gritton 	}
2226b38ff370SJamie Gritton 
2227b38ff370SJamie Gritton 	/* Write the fetched parameters back to userspace. */
2228b38ff370SJamie Gritton 	error = 0;
2229b38ff370SJamie Gritton 	TAILQ_FOREACH(opt, opts, link) {
2230b38ff370SJamie Gritton 		if (opt->pos >= 0 && opt->pos != errmsg_pos) {
2231b38ff370SJamie Gritton 			pos = 2 * opt->pos + 1;
2232b38ff370SJamie Gritton 			optuio->uio_iov[pos].iov_len = opt->len;
2233b38ff370SJamie Gritton 			if (opt->value != NULL) {
2234b38ff370SJamie Gritton 				if (optuio->uio_segflg == UIO_SYSSPACE) {
2235b38ff370SJamie Gritton 					bcopy(opt->value,
2236b38ff370SJamie Gritton 					    optuio->uio_iov[pos].iov_base,
2237b38ff370SJamie Gritton 					    opt->len);
2238b38ff370SJamie Gritton 				} else {
2239b38ff370SJamie Gritton 					error = copyout(opt->value,
2240b38ff370SJamie Gritton 					    optuio->uio_iov[pos].iov_base,
2241b38ff370SJamie Gritton 					    opt->len);
2242b38ff370SJamie Gritton 					if (error)
2243b38ff370SJamie Gritton 						break;
2244b38ff370SJamie Gritton 				}
2245b38ff370SJamie Gritton 			}
2246b38ff370SJamie Gritton 		}
2247b38ff370SJamie Gritton 	}
2248b38ff370SJamie Gritton 
22492a4b2251SJamie Gritton  done:
22502a4b2251SJamie Gritton 	/* Release any temporary prison holds and/or locks. */
22512a4b2251SJamie Gritton 	if (pr != NULL)
22522a4b2251SJamie Gritton 		prison_deref(pr, drflags);
22532a4b2251SJamie Gritton 	else if (drflags & PD_LIST_SLOCKED)
2254b38ff370SJamie Gritton 		sx_sunlock(&allprison_lock);
2255b38ff370SJamie Gritton 	if (error && errmsg_pos >= 0) {
22562a4b2251SJamie Gritton 		/* Write the error message back to userspace. */
2257b38ff370SJamie Gritton 		vfs_getopt(opts, "errmsg", (void **)&errmsg, &errmsg_len);
2258b38ff370SJamie Gritton 		errmsg_pos = 2 * errmsg_pos + 1;
2259b38ff370SJamie Gritton 		if (errmsg_len > 0) {
2260b38ff370SJamie Gritton 			if (optuio->uio_segflg == UIO_SYSSPACE)
2261b38ff370SJamie Gritton 				bcopy(errmsg,
2262b38ff370SJamie Gritton 				    optuio->uio_iov[errmsg_pos].iov_base,
2263b38ff370SJamie Gritton 				    errmsg_len);
2264b38ff370SJamie Gritton 			else
2265b38ff370SJamie Gritton 				copyout(errmsg,
2266b38ff370SJamie Gritton 				    optuio->uio_iov[errmsg_pos].iov_base,
2267b38ff370SJamie Gritton 				    errmsg_len);
2268b38ff370SJamie Gritton 		}
2269b38ff370SJamie Gritton 	}
2270b38ff370SJamie Gritton 	vfs_freeopts(opts);
2271b38ff370SJamie Gritton 	return (error);
2272b38ff370SJamie Gritton }
2273b38ff370SJamie Gritton 
2274b38ff370SJamie Gritton /*
2275b38ff370SJamie Gritton  * struct jail_remove_args {
2276b38ff370SJamie Gritton  *	int jid;
2277b38ff370SJamie Gritton  * };
2278b38ff370SJamie Gritton  */
2279b38ff370SJamie Gritton int
22808451d0ddSKip Macy sys_jail_remove(struct thread *td, struct jail_remove_args *uap)
2281b38ff370SJamie Gritton {
2282f7496dcaSJamie Gritton 	struct prison *pr, *cpr, *lpr;
22830304c731SJamie Gritton 	int descend, error;
2284b38ff370SJamie Gritton 
2285b38ff370SJamie Gritton 	error = priv_check(td, PRIV_JAIL_REMOVE);
2286b38ff370SJamie Gritton 	if (error)
2287b38ff370SJamie Gritton 		return (error);
2288b38ff370SJamie Gritton 
2289b38ff370SJamie Gritton 	sx_xlock(&allprison_lock);
22900304c731SJamie Gritton 	pr = prison_find_child(td->td_ucred->cr_prison, uap->jid);
2291b38ff370SJamie Gritton 	if (pr == NULL) {
2292b38ff370SJamie Gritton 		sx_xunlock(&allprison_lock);
2293b38ff370SJamie Gritton 		return (EINVAL);
2294b38ff370SJamie Gritton 	}
2295b38ff370SJamie Gritton 
22960304c731SJamie Gritton 	/* Remove all descendants of this prison, then remove this prison. */
22976754ae25SJamie Gritton 	prison_hold(pr);
22980304c731SJamie Gritton 	if (!LIST_EMPTY(&pr->pr_children)) {
22990304c731SJamie Gritton 		mtx_unlock(&pr->pr_mtx);
23000304c731SJamie Gritton 		lpr = NULL;
23010304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT(pr, cpr, descend) {
23026754ae25SJamie Gritton 			prison_hold(cpr);
23030304c731SJamie Gritton 			if (lpr != NULL) {
23040304c731SJamie Gritton 				mtx_lock(&lpr->pr_mtx);
23050304c731SJamie Gritton 				prison_remove_one(lpr);
23060304c731SJamie Gritton 				sx_xlock(&allprison_lock);
23070304c731SJamie Gritton 			}
2308f7496dcaSJamie Gritton 			lpr = cpr;
23090304c731SJamie Gritton 		}
23100304c731SJamie Gritton 		if (lpr != NULL) {
23110304c731SJamie Gritton 			mtx_lock(&lpr->pr_mtx);
23120304c731SJamie Gritton 			prison_remove_one(lpr);
23130304c731SJamie Gritton 			sx_xlock(&allprison_lock);
23140304c731SJamie Gritton 		}
23150304c731SJamie Gritton 		mtx_lock(&pr->pr_mtx);
23160304c731SJamie Gritton 	}
23170304c731SJamie Gritton 	prison_remove_one(pr);
23180304c731SJamie Gritton 	return (0);
23190304c731SJamie Gritton }
23200304c731SJamie Gritton 
23210304c731SJamie Gritton static void
23220304c731SJamie Gritton prison_remove_one(struct prison *pr)
23230304c731SJamie Gritton {
23240304c731SJamie Gritton 	struct proc *p;
2325*1158508aSJamie Gritton 	int was_alive, drflags;
23262a4b2251SJamie Gritton 
23272a4b2251SJamie Gritton 	drflags = PD_DEREF | PD_LOCKED | PD_LIST_XLOCKED;
23280304c731SJamie Gritton 
2329cc7b7306SJamie Gritton 	/*
2330cc7b7306SJamie Gritton 	 * Mark the prison as doomed, so it doesn't accidentally come back
2331cc7b7306SJamie Gritton 	 * to life.  It may still be explicitly brought back by jail_set(2).
2332cc7b7306SJamie Gritton 	 */
2333*1158508aSJamie Gritton 	was_alive = pr->pr_state == PRISON_STATE_ALIVE;
2334*1158508aSJamie Gritton 	pr->pr_state = PRISON_STATE_DYING;
2335cc7b7306SJamie Gritton 
2336b38ff370SJamie Gritton 	/* If the prison was persistent, it is not anymore. */
2337b38ff370SJamie Gritton 	if (pr->pr_flags & PR_PERSIST) {
23382a4b2251SJamie Gritton 		drflags |= PD_DEUREF;
2339f7496dcaSJamie Gritton 		prison_free_not_last(pr);
2340b38ff370SJamie Gritton 		pr->pr_flags &= ~PR_PERSIST;
2341b38ff370SJamie Gritton 	}
2342b38ff370SJamie Gritton 
23430304c731SJamie Gritton 	/*
23440304c731SJamie Gritton 	 * jail_remove added a reference.  If that's the only one, remove
23456754ae25SJamie Gritton 	 * the prison now.  refcount(9) doesn't guarantee the cache coherence
23466754ae25SJamie Gritton 	 * of non-zero counters, so force it here.
23470304c731SJamie Gritton 	 */
23486754ae25SJamie Gritton 	KASSERT(refcount_load(&pr->pr_ref) > 0,
23490304c731SJamie Gritton 	    ("prison_remove_one removing a dead prison (jid=%d)", pr->pr_id));
23506754ae25SJamie Gritton 	if (atomic_load_acq_int(&pr->pr_ref) == 1) {
23512a4b2251SJamie Gritton 		prison_deref(pr, drflags);
23520304c731SJamie Gritton 		return;
2353b38ff370SJamie Gritton 	}
2354b38ff370SJamie Gritton 
2355*1158508aSJamie Gritton 	/* Tell modules this prison has died. */
2356b38ff370SJamie Gritton 	mtx_unlock(&pr->pr_mtx);
2357*1158508aSJamie Gritton 	drflags &= ~PD_LOCKED;
2358*1158508aSJamie Gritton 	if (was_alive)
2359*1158508aSJamie Gritton 		(void)osd_jail_call(pr, PR_METHOD_REMOVE, NULL);
2360*1158508aSJamie Gritton 
2361b38ff370SJamie Gritton 	sx_xunlock(&allprison_lock);
2362*1158508aSJamie Gritton 	drflags &= ~PD_LIST_XLOCKED;
2363b38ff370SJamie Gritton 	/*
2364b38ff370SJamie Gritton 	 * Kill all processes unfortunate enough to be attached to this prison.
2365b38ff370SJamie Gritton 	 */
2366b38ff370SJamie Gritton 	sx_slock(&allproc_lock);
23677938a442SBjoern A. Zeeb 	FOREACH_PROC_IN_SYSTEM(p) {
2368b38ff370SJamie Gritton 		PROC_LOCK(p);
2369b38ff370SJamie Gritton 		if (p->p_state != PRS_NEW && p->p_ucred &&
2370b38ff370SJamie Gritton 		    p->p_ucred->cr_prison == pr)
23718451d0ddSKip Macy 			kern_psignal(p, SIGKILL);
2372b38ff370SJamie Gritton 		PROC_UNLOCK(p);
2373b38ff370SJamie Gritton 	}
2374b38ff370SJamie Gritton 	sx_sunlock(&allproc_lock);
23750304c731SJamie Gritton 	/* Remove the temporary reference added by jail_remove. */
23762a4b2251SJamie Gritton 	prison_deref(pr, drflags);
237775c13541SPoul-Henning Kamp }
237875c13541SPoul-Henning Kamp 
2379fd7a8150SMike Barcroft /*
23809ddb7954SMike Barcroft  * struct jail_attach_args {
23819ddb7954SMike Barcroft  *	int jid;
23829ddb7954SMike Barcroft  * };
2383fd7a8150SMike Barcroft  */
2384fd7a8150SMike Barcroft int
23858451d0ddSKip Macy sys_jail_attach(struct thread *td, struct jail_attach_args *uap)
2386fd7a8150SMike Barcroft {
2387b38ff370SJamie Gritton 	struct prison *pr;
2388b38ff370SJamie Gritton 	int error;
2389b38ff370SJamie Gritton 
2390b38ff370SJamie Gritton 	error = priv_check(td, PRIV_JAIL_ATTACH);
2391b38ff370SJamie Gritton 	if (error)
2392b38ff370SJamie Gritton 		return (error);
2393b38ff370SJamie Gritton 
2394f7496dcaSJamie Gritton 	sx_slock(&allprison_lock);
23950304c731SJamie Gritton 	pr = prison_find_child(td->td_ucred->cr_prison, uap->jid);
2396b38ff370SJamie Gritton 	if (pr == NULL) {
2397b38ff370SJamie Gritton 		sx_sunlock(&allprison_lock);
2398b38ff370SJamie Gritton 		return (EINVAL);
2399b38ff370SJamie Gritton 	}
2400b38ff370SJamie Gritton 
240176ad42abSJamie Gritton 	/* Do not allow a process to attach to a prison that is not alive. */
240276ad42abSJamie Gritton 	if (!prison_isalive(pr)) {
2403b38ff370SJamie Gritton 		mtx_unlock(&pr->pr_mtx);
2404b38ff370SJamie Gritton 		sx_sunlock(&allprison_lock);
2405b38ff370SJamie Gritton 		return (EINVAL);
2406b38ff370SJamie Gritton 	}
2407b38ff370SJamie Gritton 
2408f7496dcaSJamie Gritton 	return (do_jail_attach(td, pr, PD_LOCKED | PD_LIST_SLOCKED));
2409b38ff370SJamie Gritton }
2410b38ff370SJamie Gritton 
2411b38ff370SJamie Gritton static int
2412f7496dcaSJamie Gritton do_jail_attach(struct thread *td, struct prison *pr, int drflags)
2413b38ff370SJamie Gritton {
2414fd7a8150SMike Barcroft 	struct proc *p;
2415fd7a8150SMike Barcroft 	struct ucred *newcred, *oldcred;
24165050aa86SKonstantin Belousov 	int error;
2417fd7a8150SMike Barcroft 
2418f7496dcaSJamie Gritton 	mtx_assert(&pr->pr_mtx, MA_OWNED);
2419f7496dcaSJamie Gritton 	sx_assert(&allprison_lock, SX_LOCKED);
242057f22bd4SJacques Vidrine 	/*
242157f22bd4SJacques Vidrine 	 * XXX: Note that there is a slight race here if two threads
242257f22bd4SJacques Vidrine 	 * in the same privileged process attempt to attach to two
242357f22bd4SJacques Vidrine 	 * different jails at the same time.  It is important for
242457f22bd4SJacques Vidrine 	 * user processes not to do this, or they might end up with
242557f22bd4SJacques Vidrine 	 * a process root from one prison, but attached to the jail
242657f22bd4SJacques Vidrine 	 * of another.
242757f22bd4SJacques Vidrine 	 */
2428*1158508aSJamie Gritton 	prison_hold(pr);
24296754ae25SJamie Gritton 	refcount_acquire(&pr->pr_uref);
2430f7496dcaSJamie Gritton 	drflags |= PD_DEREF | PD_DEUREF;
2431fd7a8150SMike Barcroft 	mtx_unlock(&pr->pr_mtx);
2432f7496dcaSJamie Gritton 	drflags &= ~PD_LOCKED;
2433b38ff370SJamie Gritton 
2434b38ff370SJamie Gritton 	/* Let modules do whatever they need to prepare for attaching. */
2435b38ff370SJamie Gritton 	error = osd_jail_call(pr, PR_METHOD_ATTACH, td);
2436b38ff370SJamie Gritton 	if (error) {
2437f7496dcaSJamie Gritton 		prison_deref(pr, drflags);
2438b38ff370SJamie Gritton 		return (error);
2439b38ff370SJamie Gritton 	}
2440f7496dcaSJamie Gritton 	sx_unlock(&allprison_lock);
2441f7496dcaSJamie Gritton 	drflags &= ~(PD_LIST_SLOCKED | PD_LIST_XLOCKED);
2442fd7a8150SMike Barcroft 
2443413628a7SBjoern A. Zeeb 	/*
2444413628a7SBjoern A. Zeeb 	 * Reparent the newly attached process to this jail.
2445413628a7SBjoern A. Zeeb 	 */
2446b38ff370SJamie Gritton 	p = td->td_proc;
2447413628a7SBjoern A. Zeeb 	error = cpuset_setproc_update_set(p, pr->pr_cpuset);
2448413628a7SBjoern A. Zeeb 	if (error)
2449b38ff370SJamie Gritton 		goto e_revert_osd;
2450413628a7SBjoern A. Zeeb 
2451cb05b60aSAttilio Rao 	vn_lock(pr->pr_root, LK_EXCLUSIVE | LK_RETRY);
2452fd7a8150SMike Barcroft 	if ((error = change_dir(pr->pr_root, td)) != 0)
2453fd7a8150SMike Barcroft 		goto e_unlock;
2454fd7a8150SMike Barcroft #ifdef MAC
245530d239bcSRobert Watson 	if ((error = mac_vnode_check_chroot(td->td_ucred, pr->pr_root)))
2456fd7a8150SMike Barcroft 		goto e_unlock;
2457fd7a8150SMike Barcroft #endif
2458b249ce48SMateusz Guzik 	VOP_UNLOCK(pr->pr_root);
2459d4380c0cSJamie Gritton 	if ((error = pwd_chroot_chdir(td, pr->pr_root)))
24605050aa86SKonstantin Belousov 		goto e_revert_osd;
2461fd7a8150SMike Barcroft 
2462fd7a8150SMike Barcroft 	newcred = crget();
2463fd7a8150SMike Barcroft 	PROC_LOCK(p);
24641fb6767dSJamie Gritton 	oldcred = crcopysafe(p, newcred);
246569c4ee54SJohn Baldwin 	newcred->cr_prison = pr;
2466daf63fd2SMateusz Guzik 	proc_set_cred(p, newcred);
24671fb6767dSJamie Gritton 	setsugid(p);
2468097055e2SEdward Tomasz Napierala #ifdef RACCT
2469097055e2SEdward Tomasz Napierala 	racct_proc_ucred_changed(p, oldcred, newcred);
2470f87beb93SAndriy Gapon 	crhold(newcred);
2471f87beb93SAndriy Gapon #endif
2472f87beb93SAndriy Gapon 	PROC_UNLOCK(p);
2473f87beb93SAndriy Gapon #ifdef RCTL
2474f87beb93SAndriy Gapon 	rctl_proc_ucred_changed(p, newcred);
2475f87beb93SAndriy Gapon 	crfree(newcred);
2476097055e2SEdward Tomasz Napierala #endif
2477f7496dcaSJamie Gritton 	prison_deref(oldcred->cr_prison, drflags);
2478fd7a8150SMike Barcroft 	crfree(oldcred);
2479cc7b7306SJamie Gritton 
2480cc7b7306SJamie Gritton 	/*
2481cc7b7306SJamie Gritton 	 * If the prison was killed while changing credentials, die along
2482cc7b7306SJamie Gritton 	 * with it.
2483cc7b7306SJamie Gritton 	 */
2484cc7b7306SJamie Gritton 	if (!prison_isalive(pr)) {
2485cc7b7306SJamie Gritton 		PROC_LOCK(p);
2486cc7b7306SJamie Gritton 		kern_psignal(p, SIGKILL);
2487cc7b7306SJamie Gritton 		PROC_UNLOCK(p);
2488cc7b7306SJamie Gritton 	}
2489cc7b7306SJamie Gritton 
2490fd7a8150SMike Barcroft 	return (0);
24911fb6767dSJamie Gritton 
2492fd7a8150SMike Barcroft  e_unlock:
2493b249ce48SMateusz Guzik 	VOP_UNLOCK(pr->pr_root);
2494b38ff370SJamie Gritton  e_revert_osd:
2495b38ff370SJamie Gritton 	/* Tell modules this thread is still in its old jail after all. */
24967f4e7248SJamie Gritton 	sx_slock(&allprison_lock);
2497f7496dcaSJamie Gritton 	drflags |= PD_LIST_SLOCKED;
24981fb6767dSJamie Gritton 	(void)osd_jail_call(td->td_ucred->cr_prison, PR_METHOD_ATTACH, td);
2499f7496dcaSJamie Gritton 	prison_deref(pr, drflags);
2500fd7a8150SMike Barcroft 	return (error);
2501fd7a8150SMike Barcroft }
2502fd7a8150SMike Barcroft 
2503fd7a8150SMike Barcroft /*
2504fd7a8150SMike Barcroft  * Returns a locked prison instance, or NULL on failure.
2505fd7a8150SMike Barcroft  */
250654b369c1SPawel Jakub Dawidek struct prison *
2507fd7a8150SMike Barcroft prison_find(int prid)
2508fd7a8150SMike Barcroft {
2509fd7a8150SMike Barcroft 	struct prison *pr;
2510fd7a8150SMike Barcroft 
2511dc68a633SPawel Jakub Dawidek 	sx_assert(&allprison_lock, SX_LOCKED);
2512b38ff370SJamie Gritton 	TAILQ_FOREACH(pr, &allprison, pr_list) {
2513f7496dcaSJamie Gritton 		if (pr->pr_id < prid)
2514f7496dcaSJamie Gritton 			continue;
25157de883c8SJamie Gritton 		if (pr->pr_id > prid)
25167de883c8SJamie Gritton 			break;
2517f7496dcaSJamie Gritton 		KASSERT(prison_isvalid(pr), ("Found invalid prison %p", pr));
2518f7496dcaSJamie Gritton 		mtx_lock(&pr->pr_mtx);
2519f7496dcaSJamie Gritton 		return (pr);
2520fd7a8150SMike Barcroft 	}
2521fd7a8150SMike Barcroft 	return (NULL);
2522fd7a8150SMike Barcroft }
2523fd7a8150SMike Barcroft 
2524b38ff370SJamie Gritton /*
25250304c731SJamie Gritton  * Find a prison that is a descendant of mypr.  Returns a locked prison or NULL.
2526b38ff370SJamie Gritton  */
2527b38ff370SJamie Gritton struct prison *
25280304c731SJamie Gritton prison_find_child(struct prison *mypr, int prid)
2529b38ff370SJamie Gritton {
25300304c731SJamie Gritton 	struct prison *pr;
25310304c731SJamie Gritton 	int descend;
2532b38ff370SJamie Gritton 
2533b38ff370SJamie Gritton 	sx_assert(&allprison_lock, SX_LOCKED);
25340304c731SJamie Gritton 	FOREACH_PRISON_DESCENDANT(mypr, pr, descend) {
25350304c731SJamie Gritton 		if (pr->pr_id == prid) {
2536f7496dcaSJamie Gritton 			KASSERT(prison_isvalid(pr),
2537f7496dcaSJamie Gritton 			    ("Found invalid prison %p", pr));
25380304c731SJamie Gritton 			mtx_lock(&pr->pr_mtx);
25390304c731SJamie Gritton 			return (pr);
25400304c731SJamie Gritton 		}
25410304c731SJamie Gritton 	}
25420304c731SJamie Gritton 	return (NULL);
25430304c731SJamie Gritton }
25440304c731SJamie Gritton 
25450304c731SJamie Gritton /*
25460304c731SJamie Gritton  * Look for the name relative to mypr.  Returns a locked prison or NULL.
25470304c731SJamie Gritton  */
25480304c731SJamie Gritton struct prison *
25490304c731SJamie Gritton prison_find_name(struct prison *mypr, const char *name)
25500304c731SJamie Gritton {
25510304c731SJamie Gritton 	struct prison *pr, *deadpr;
25520304c731SJamie Gritton 	size_t mylen;
25530304c731SJamie Gritton 	int descend;
25540304c731SJamie Gritton 
25550304c731SJamie Gritton 	sx_assert(&allprison_lock, SX_LOCKED);
25560304c731SJamie Gritton 	mylen = (mypr == &prison0) ? 0 : strlen(mypr->pr_name) + 1;
2557b38ff370SJamie Gritton 	deadpr = NULL;
25580304c731SJamie Gritton 	FOREACH_PRISON_DESCENDANT(mypr, pr, descend) {
25590304c731SJamie Gritton 		if (!strcmp(pr->pr_name + mylen, name)) {
2560f7496dcaSJamie Gritton 			KASSERT(prison_isvalid(pr),
2561f7496dcaSJamie Gritton 			    ("Found invalid prison %p", pr));
2562f7496dcaSJamie Gritton 			if (prison_isalive(pr)) {
2563b38ff370SJamie Gritton 				mtx_lock(&pr->pr_mtx);
2564b38ff370SJamie Gritton 				return (pr);
2565f7496dcaSJamie Gritton 			}
2566b38ff370SJamie Gritton 			deadpr = pr;
2567b38ff370SJamie Gritton 		}
2568b38ff370SJamie Gritton 	}
25690304c731SJamie Gritton 	/* There was no valid prison - perhaps there was a dying one. */
2570f7496dcaSJamie Gritton 	if (deadpr != NULL)
2571b38ff370SJamie Gritton 		mtx_lock(&deadpr->pr_mtx);
2572b38ff370SJamie Gritton 	return (deadpr);
2573b38ff370SJamie Gritton }
2574b38ff370SJamie Gritton 
2575b38ff370SJamie Gritton /*
25760fe74ae6SJamie Gritton  * See if a prison has the specific flag set.  The prison should be locked,
25770fe74ae6SJamie Gritton  * unless checking for flags that are only set at jail creation (such as
25780fe74ae6SJamie Gritton  * PR_IP4 and PR_IP6), or only the single bit is examined, without regard
25790fe74ae6SJamie Gritton  * to any other prison data.
25800304c731SJamie Gritton  */
25810304c731SJamie Gritton int
25820304c731SJamie Gritton prison_flag(struct ucred *cred, unsigned flag)
25830304c731SJamie Gritton {
25840304c731SJamie Gritton 
25850304c731SJamie Gritton 	return (cred->cr_prison->pr_flags & flag);
25860304c731SJamie Gritton }
25870304c731SJamie Gritton 
25880304c731SJamie Gritton int
25890304c731SJamie Gritton prison_allow(struct ucred *cred, unsigned flag)
25900304c731SJamie Gritton {
25910304c731SJamie Gritton 
25920fe74ae6SJamie Gritton 	return ((cred->cr_prison->pr_allow & flag) != 0);
25930304c731SJamie Gritton }
25940304c731SJamie Gritton 
25950304c731SJamie Gritton /*
2596effad35eSJamie Gritton  * Hold a prison reference, by incrementing pr_ref.  It is generally
2597effad35eSJamie Gritton  * an error to hold a prison that does not already have a reference.
2598effad35eSJamie Gritton  * A prison record will remain valid as long as it has at least one
2599effad35eSJamie Gritton  * reference, and will not be removed as long as either the prison
2600effad35eSJamie Gritton  * mutex or the allprison lock is held (allprison_lock may be shared).
2601effad35eSJamie Gritton  */
2602effad35eSJamie Gritton void
2603effad35eSJamie Gritton prison_hold_locked(struct prison *pr)
2604effad35eSJamie Gritton {
2605effad35eSJamie Gritton 
26066754ae25SJamie Gritton 	/* Locking is no longer required. */
26076754ae25SJamie Gritton 	prison_hold(pr);
2608effad35eSJamie Gritton }
2609effad35eSJamie Gritton 
2610effad35eSJamie Gritton void
2611effad35eSJamie Gritton prison_hold(struct prison *pr)
2612effad35eSJamie Gritton {
26136754ae25SJamie Gritton #ifdef INVARIANTS
26146754ae25SJamie Gritton 	int was_valid = refcount_acquire_if_not_zero(&pr->pr_ref);
2615effad35eSJamie Gritton 
26166754ae25SJamie Gritton 	KASSERT(was_valid,
26176754ae25SJamie Gritton 	    ("Trying to hold dead prison %p (jid=%d).", pr, pr->pr_id));
26186754ae25SJamie Gritton #else
26196754ae25SJamie Gritton 	refcount_acquire(&pr->pr_ref);
26206754ae25SJamie Gritton #endif
2621effad35eSJamie Gritton }
2622effad35eSJamie Gritton 
2623effad35eSJamie Gritton /*
2624effad35eSJamie Gritton  * Remove a prison reference.  If that was the last reference, the
2625f7496dcaSJamie Gritton  * prison will be removed (at a later time).
2626b38ff370SJamie Gritton  */
262791421ba2SRobert Watson void
26281ba4a712SPawel Jakub Dawidek prison_free_locked(struct prison *pr)
262991421ba2SRobert Watson {
263091421ba2SRobert Watson 
26311ba4a712SPawel Jakub Dawidek 	mtx_assert(&pr->pr_mtx, MA_OWNED);
2632effad35eSJamie Gritton 	/*
2633f7496dcaSJamie Gritton 	 * Locking is no longer required, but unlock because the caller
2634f7496dcaSJamie Gritton 	 * expects it.
2635effad35eSJamie Gritton 	 */
2636f7496dcaSJamie Gritton 	mtx_unlock(&pr->pr_mtx);
2637f7496dcaSJamie Gritton 	prison_free(pr);
2638effad35eSJamie Gritton }
2639c2cda609SPawel Jakub Dawidek 
26401ba4a712SPawel Jakub Dawidek void
26411ba4a712SPawel Jakub Dawidek prison_free(struct prison *pr)
26421ba4a712SPawel Jakub Dawidek {
26431ba4a712SPawel Jakub Dawidek 
26446754ae25SJamie Gritton 	KASSERT(refcount_load(&pr->pr_ref) > 0,
26456754ae25SJamie Gritton 	    ("Trying to free dead prison %p (jid=%d).",
26466754ae25SJamie Gritton 	     pr, pr->pr_id));
2647f7496dcaSJamie Gritton 	if (!refcount_release_if_not_last(&pr->pr_ref)) {
2648f7496dcaSJamie Gritton 		/*
2649f7496dcaSJamie Gritton 		 * Don't remove the last reference in this context,
2650f7496dcaSJamie Gritton 		 * in case there are locks held.
2651f7496dcaSJamie Gritton 		 */
2652f7496dcaSJamie Gritton 		taskqueue_enqueue(taskqueue_thread, &pr->pr_task);
2653f7496dcaSJamie Gritton 	}
2654f7496dcaSJamie Gritton }
2655f7496dcaSJamie Gritton 
2656f7496dcaSJamie Gritton static void
2657f7496dcaSJamie Gritton prison_free_not_last(struct prison *pr)
2658f7496dcaSJamie Gritton {
2659f7496dcaSJamie Gritton #ifdef INVARIANTS
2660f7496dcaSJamie Gritton 	int lastref;
2661f7496dcaSJamie Gritton 
2662f7496dcaSJamie Gritton 	KASSERT(refcount_load(&pr->pr_ref) > 0,
2663f7496dcaSJamie Gritton 	    ("Trying to free dead prison %p (jid=%d).",
2664f7496dcaSJamie Gritton 	     pr, pr->pr_id));
2665f7496dcaSJamie Gritton 	lastref = refcount_release(&pr->pr_ref);
2666f7496dcaSJamie Gritton 	KASSERT(!lastref,
2667f7496dcaSJamie Gritton 	    ("prison_free_not_last freed last ref on prison %p (jid=%d).",
2668f7496dcaSJamie Gritton 	     pr, pr->pr_id));
2669f7496dcaSJamie Gritton #else
2670ee9b37aeSMateusz Guzik 	refcount_release(&pr->pr_ref);
2671f7496dcaSJamie Gritton #endif
26721ba4a712SPawel Jakub Dawidek }
26731ba4a712SPawel Jakub Dawidek 
267473d9e52dSJamie Gritton /*
2675effad35eSJamie Gritton  * Hold a a prison for user visibility, by incrementing pr_uref.
2676effad35eSJamie Gritton  * It is generally an error to hold a prison that isn't already
2677effad35eSJamie Gritton  * user-visible, except through the the jail system calls.  It is also
2678effad35eSJamie Gritton  * an error to hold an invalid prison.  A prison record will remain
2679effad35eSJamie Gritton  * alive as long as it has at least one user reference, and will not
2680f7496dcaSJamie Gritton  * be set to the dying state until the prison mutex and allprison_lock
2681f7496dcaSJamie Gritton  * are both freed.
2682effad35eSJamie Gritton  */
2683effad35eSJamie Gritton void
2684effad35eSJamie Gritton prison_proc_hold(struct prison *pr)
2685effad35eSJamie Gritton {
26866754ae25SJamie Gritton #ifdef INVARIANTS
26876754ae25SJamie Gritton 	int was_alive = refcount_acquire_if_not_zero(&pr->pr_uref);
2688effad35eSJamie Gritton 
26896754ae25SJamie Gritton 	KASSERT(was_alive,
2690effad35eSJamie Gritton 	    ("Cannot add a process to a non-alive prison (jid=%d)", pr->pr_id));
26916754ae25SJamie Gritton #else
26926754ae25SJamie Gritton 	refcount_acquire(&pr->pr_uref);
26936754ae25SJamie Gritton #endif
2694effad35eSJamie Gritton }
2695effad35eSJamie Gritton 
2696effad35eSJamie Gritton /*
2697effad35eSJamie Gritton  * Remove a prison user reference.  If it was the last reference, the
2698effad35eSJamie Gritton  * prison will be considered "dying", and may be removed once all of
2699effad35eSJamie Gritton  * its references are dropped.
2700effad35eSJamie Gritton  */
2701effad35eSJamie Gritton void
2702effad35eSJamie Gritton prison_proc_free(struct prison *pr)
2703effad35eSJamie Gritton {
2704effad35eSJamie Gritton 
27056754ae25SJamie Gritton 	/*
27066754ae25SJamie Gritton 	 * Locking is only required when releasing the last reference.
27076754ae25SJamie Gritton 	 * This allows assurance that a locked prison will remain alive
27086754ae25SJamie Gritton 	 * until it is unlocked.
27096754ae25SJamie Gritton 	 */
27106754ae25SJamie Gritton 	KASSERT(refcount_load(&pr->pr_uref) > 0,
2711effad35eSJamie Gritton 	    ("Trying to kill a process in a dead prison (jid=%d)", pr->pr_id));
2712195cd6aeSJamie Gritton 	if (!refcount_release_if_not_last(&pr->pr_uref)) {
2713effad35eSJamie Gritton 		/*
2714effad35eSJamie Gritton 		 * Don't remove the last user reference in this context,
2715effad35eSJamie Gritton 		 * which is expected to be a process that is not only locked,
2716effad35eSJamie Gritton 		 * but also half dead.  Add a reference so any calls to
2717effad35eSJamie Gritton 		 * prison_free() won't re-submit the task.
2718effad35eSJamie Gritton 		 */
2719f7496dcaSJamie Gritton 		prison_hold(pr);
2720*1158508aSJamie Gritton 		mtx_lock(&pr->pr_mtx);
2721*1158508aSJamie Gritton 		KASSERT(!(pr->pr_flags & PR_COMPLETE_PROC),
2722*1158508aSJamie Gritton 		    ("Redundant last reference in prison_proc_free (jid=%d)",
2723*1158508aSJamie Gritton 		     pr->pr_id));
2724*1158508aSJamie Gritton 		pr->pr_flags |= PR_COMPLETE_PROC;
2725*1158508aSJamie Gritton 		mtx_unlock(&pr->pr_mtx);
2726effad35eSJamie Gritton 		taskqueue_enqueue(taskqueue_thread, &pr->pr_task);
2727effad35eSJamie Gritton 	}
2728effad35eSJamie Gritton }
2729effad35eSJamie Gritton 
2730effad35eSJamie Gritton /*
273173d9e52dSJamie Gritton  * Complete a call to either prison_free or prison_proc_free.
273273d9e52dSJamie Gritton  */
2733c2cda609SPawel Jakub Dawidek static void
2734c2cda609SPawel Jakub Dawidek prison_complete(void *context, int pending)
2735c2cda609SPawel Jakub Dawidek {
273673d9e52dSJamie Gritton 	struct prison *pr = context;
2737f7496dcaSJamie Gritton 	int drflags;
2738b38ff370SJamie Gritton 
2739effad35eSJamie Gritton 	/*
2740*1158508aSJamie Gritton 	 * This could be called to release the last reference, or the last
2741*1158508aSJamie Gritton 	 * user reference (plus the reference held in prison_proc_free).
2742effad35eSJamie Gritton 	 */
2743f7496dcaSJamie Gritton 	drflags = prison_lock_xlock(pr, PD_DEREF);
2744*1158508aSJamie Gritton 	if (pr->pr_flags & PR_COMPLETE_PROC) {
2745*1158508aSJamie Gritton 		pr->pr_flags &= ~PR_COMPLETE_PROC;
2746f7496dcaSJamie Gritton 		drflags |= PD_DEUREF;
2747*1158508aSJamie Gritton 	}
2748f7496dcaSJamie Gritton 	prison_deref(pr, drflags);
2749b38ff370SJamie Gritton }
2750b38ff370SJamie Gritton 
2751b38ff370SJamie Gritton /*
2752effad35eSJamie Gritton  * Remove a prison reference and/or user reference (usually).
2753effad35eSJamie Gritton  * This assumes context that allows sleeping (for allprison_lock),
2754effad35eSJamie Gritton  * with no non-sleeping locks held, except perhaps the prison itself.
2755effad35eSJamie Gritton  * If there are no more references, release and delist the prison.
2756effad35eSJamie Gritton  * On completion, the prison lock and the allprison lock are both
2757effad35eSJamie Gritton  * unlocked.
2758b38ff370SJamie Gritton  */
2759b38ff370SJamie Gritton static void
2760b38ff370SJamie Gritton prison_deref(struct prison *pr, int flags)
2761b38ff370SJamie Gritton {
27626e1d1bfcSJamie Gritton 	struct prisonlist freeprison;
2763f7496dcaSJamie Gritton 	struct prison *rpr, *ppr, *tpr;
2764c2cda609SPawel Jakub Dawidek 
27656e1d1bfcSJamie Gritton 	TAILQ_INIT(&freeprison);
27666e1d1bfcSJamie Gritton 	/*
27676e1d1bfcSJamie Gritton 	 * Release this prison as requested, which may cause its parent
27686e1d1bfcSJamie Gritton 	 * to be released, and then maybe its grandparent, etc.
27696e1d1bfcSJamie Gritton 	 */
27700304c731SJamie Gritton 	for (;;) {
2771e6d5cb63SJamie Gritton 		if (flags & PD_DEUREF) {
2772f7496dcaSJamie Gritton 			/* Drop a user reference. */
27736754ae25SJamie Gritton 			KASSERT(refcount_load(&pr->pr_uref) > 0,
277473d9e52dSJamie Gritton 			    ("prison_deref PD_DEUREF on a dead prison (jid=%d)",
277573d9e52dSJamie Gritton 			     pr->pr_id));
2776f7496dcaSJamie Gritton 			if (!refcount_release_if_not_last(&pr->pr_uref)) {
2777f7496dcaSJamie Gritton 				if (!(flags & PD_DEREF)) {
2778f7496dcaSJamie Gritton 					prison_hold(pr);
2779f7496dcaSJamie Gritton 					flags |= PD_DEREF;
2780f7496dcaSJamie Gritton 				}
2781f7496dcaSJamie Gritton 				flags = prison_lock_xlock(pr, flags);
2782*1158508aSJamie Gritton 				if (refcount_release(&pr->pr_uref) &&
2783*1158508aSJamie Gritton 				    pr->pr_state == PRISON_STATE_ALIVE) {
2784f7496dcaSJamie Gritton 					/*
2785f7496dcaSJamie Gritton 					 * When the last user references goes,
2786f7496dcaSJamie Gritton 					 * this becomes a dying prison.
2787f7496dcaSJamie Gritton 					 */
2788f7496dcaSJamie Gritton 					KASSERT(
2789f7496dcaSJamie Gritton 					    refcount_load(&prison0.pr_uref) > 0,
27906754ae25SJamie Gritton 					    ("prison0 pr_uref=0"));
2791*1158508aSJamie Gritton 					pr->pr_state = PRISON_STATE_DYING;
2792f7496dcaSJamie Gritton 					mtx_unlock(&pr->pr_mtx);
2793f7496dcaSJamie Gritton 					flags &= ~PD_LOCKED;
2794f7496dcaSJamie Gritton 					(void)osd_jail_call(pr,
2795f7496dcaSJamie Gritton 					    PR_METHOD_REMOVE, NULL);
2796f7496dcaSJamie Gritton 				}
2797f7496dcaSJamie Gritton 			}
2798f7496dcaSJamie Gritton 		}
279973d9e52dSJamie Gritton 		if (flags & PD_DEREF) {
2800f7496dcaSJamie Gritton 			/* Drop a reference. */
28016754ae25SJamie Gritton 			KASSERT(refcount_load(&pr->pr_ref) > 0,
280273d9e52dSJamie Gritton 			    ("prison_deref PD_DEREF on a dead prison (jid=%d)",
280373d9e52dSJamie Gritton 			     pr->pr_id));
2804f7496dcaSJamie Gritton 			if (!refcount_release_if_not_last(&pr->pr_ref)) {
2805f7496dcaSJamie Gritton 				flags = prison_lock_xlock(pr, flags);
2806f7496dcaSJamie Gritton 				if (refcount_release(&pr->pr_ref)) {
2807cc5fd8c7SJamie Gritton 					/*
2808f7496dcaSJamie Gritton 					 * When the last reference goes,
2809f7496dcaSJamie Gritton 					 * unlink the prison and set it aside.
2810cc5fd8c7SJamie Gritton 					 */
2811f7496dcaSJamie Gritton 					KASSERT(
2812f7496dcaSJamie Gritton 					    refcount_load(&pr->pr_uref) == 0,
2813f7496dcaSJamie Gritton 					    ("prison_deref: last ref, "
2814f7496dcaSJamie Gritton 					     "but still has %d urefs (jid=%d)",
2815f7496dcaSJamie Gritton 					     pr->pr_uref, pr->pr_id));
2816f7496dcaSJamie Gritton 					KASSERT(
2817f7496dcaSJamie Gritton 					    refcount_load(&prison0.pr_ref) != 0,
2818f7496dcaSJamie Gritton 					    ("prison0 pr_ref=0"));
2819*1158508aSJamie Gritton 					pr->pr_state = PRISON_STATE_INVALID;
2820b38ff370SJamie Gritton 					TAILQ_REMOVE(&allprison, pr, pr_list);
28210304c731SJamie Gritton 					LIST_REMOVE(pr, pr_sibling);
2822f7496dcaSJamie Gritton 					TAILQ_INSERT_TAIL(&freeprison, pr,
2823f7496dcaSJamie Gritton 					    pr_list);
2824f7496dcaSJamie Gritton 					for (ppr = pr->pr_parent;
2825f7496dcaSJamie Gritton 					     ppr != NULL;
2826f7496dcaSJamie Gritton 					     ppr = ppr->pr_parent)
2827f7496dcaSJamie Gritton 						ppr->pr_childcount--;
2828f7496dcaSJamie Gritton 					/*
2829f7496dcaSJamie Gritton 					 * Removing a prison frees references
2830f7496dcaSJamie Gritton 					 * from its parent.
2831f7496dcaSJamie Gritton 					 */
2832f7496dcaSJamie Gritton 					mtx_unlock(&pr->pr_mtx);
2833f7496dcaSJamie Gritton 					flags &= ~PD_LOCKED;
28346e1d1bfcSJamie Gritton 					pr = pr->pr_parent;
28356e1d1bfcSJamie Gritton 					flags |= PD_DEREF | PD_DEUREF;
2836f7496dcaSJamie Gritton 					continue;
2837f7496dcaSJamie Gritton 				}
2838f7496dcaSJamie Gritton 			}
2839f7496dcaSJamie Gritton 		}
2840f7496dcaSJamie Gritton 		break;
28416e1d1bfcSJamie Gritton 	}
28426e1d1bfcSJamie Gritton 
28436e1d1bfcSJamie Gritton 	/* Release all the prison locks. */
2844f7496dcaSJamie Gritton 	if (flags & PD_LOCKED)
2845f7496dcaSJamie Gritton 		mtx_unlock(&pr->pr_mtx);
28466e1d1bfcSJamie Gritton 	if (flags & PD_LIST_SLOCKED)
28476e1d1bfcSJamie Gritton 		sx_sunlock(&allprison_lock);
28486e1d1bfcSJamie Gritton 	else if (flags & PD_LIST_XLOCKED)
28496e1d1bfcSJamie Gritton 		sx_xunlock(&allprison_lock);
28506e1d1bfcSJamie Gritton 
28516e1d1bfcSJamie Gritton 	/*
28526e1d1bfcSJamie Gritton 	 * Finish removing any unreferenced prisons, which couldn't happen
28536e1d1bfcSJamie Gritton 	 * while allprison_lock was held (to avoid a LOR on vrele).
28546e1d1bfcSJamie Gritton 	 */
28556e1d1bfcSJamie Gritton 	TAILQ_FOREACH_SAFE(rpr, &freeprison, pr_list, tpr) {
28566e1d1bfcSJamie Gritton #ifdef VIMAGE
28576e1d1bfcSJamie Gritton 		if (rpr->pr_vnet != rpr->pr_parent->pr_vnet)
28586e1d1bfcSJamie Gritton 			vnet_destroy(rpr->pr_vnet);
28596e1d1bfcSJamie Gritton #endif
28606e1d1bfcSJamie Gritton 		if (rpr->pr_root != NULL)
28616e1d1bfcSJamie Gritton 			vrele(rpr->pr_root);
28626e1d1bfcSJamie Gritton 		mtx_destroy(&rpr->pr_mtx);
28636e1d1bfcSJamie Gritton #ifdef INET
28646e1d1bfcSJamie Gritton 		free(rpr->pr_ip4, M_PRISON);
28656e1d1bfcSJamie Gritton #endif
28666e1d1bfcSJamie Gritton #ifdef INET6
28676e1d1bfcSJamie Gritton 		free(rpr->pr_ip6, M_PRISON);
28686e1d1bfcSJamie Gritton #endif
28696e1d1bfcSJamie Gritton 		if (rpr->pr_cpuset != NULL)
28706e1d1bfcSJamie Gritton 			cpuset_rel(rpr->pr_cpuset);
28716e1d1bfcSJamie Gritton 		osd_jail_exit(rpr);
28726e1d1bfcSJamie Gritton #ifdef RACCT
28736e1d1bfcSJamie Gritton 		if (racct_enable)
28746e1d1bfcSJamie Gritton 			prison_racct_detach(rpr);
28756e1d1bfcSJamie Gritton #endif
2876f7496dcaSJamie Gritton 		TAILQ_REMOVE(&freeprison, rpr, pr_list);
28776e1d1bfcSJamie Gritton 		free(rpr, M_PRISON);
28780304c731SJamie Gritton 	}
2879b3059e09SRobert Watson }
2880b3059e09SRobert Watson 
2881413628a7SBjoern A. Zeeb /*
2882f7496dcaSJamie Gritton  * Given the current locking state in the flags, make sure allprison_lock
2883f7496dcaSJamie Gritton  * is held exclusive, and the prison is locked.  Return flags indicating
2884f7496dcaSJamie Gritton  * the new state.
2885f7496dcaSJamie Gritton  */
2886f7496dcaSJamie Gritton static int
2887f7496dcaSJamie Gritton prison_lock_xlock(struct prison *pr, int flags)
2888f7496dcaSJamie Gritton {
2889f7496dcaSJamie Gritton 
2890f7496dcaSJamie Gritton 	if (!(flags & PD_LIST_XLOCKED)) {
2891f7496dcaSJamie Gritton 		/*
2892f7496dcaSJamie Gritton 		 * Get allprison_lock, which may be an upgrade,
2893f7496dcaSJamie Gritton 		 * and may require unlocking the prison.
2894f7496dcaSJamie Gritton 		 */
2895f7496dcaSJamie Gritton 		if (flags & PD_LOCKED) {
2896f7496dcaSJamie Gritton 			mtx_unlock(&pr->pr_mtx);
2897f7496dcaSJamie Gritton 			flags &= ~PD_LOCKED;
2898f7496dcaSJamie Gritton 		}
2899f7496dcaSJamie Gritton 		if (flags & PD_LIST_SLOCKED) {
2900f7496dcaSJamie Gritton 			if (!sx_try_upgrade(&allprison_lock)) {
2901f7496dcaSJamie Gritton 				sx_sunlock(&allprison_lock);
2902f7496dcaSJamie Gritton 				sx_xlock(&allprison_lock);
2903f7496dcaSJamie Gritton 			}
2904f7496dcaSJamie Gritton 			flags &= ~PD_LIST_SLOCKED;
2905f7496dcaSJamie Gritton 		} else
2906f7496dcaSJamie Gritton 			sx_xlock(&allprison_lock);
2907f7496dcaSJamie Gritton 		flags |= PD_LIST_XLOCKED;
2908f7496dcaSJamie Gritton 	}
2909f7496dcaSJamie Gritton 	if (!(flags & PD_LOCKED)) {
2910f7496dcaSJamie Gritton 		/* Lock the prison mutex. */
2911f7496dcaSJamie Gritton 		mtx_lock(&pr->pr_mtx);
2912f7496dcaSJamie Gritton 		flags |= PD_LOCKED;
2913f7496dcaSJamie Gritton 	}
2914f7496dcaSJamie Gritton 	return flags;
2915f7496dcaSJamie Gritton }
2916f7496dcaSJamie Gritton 
2917f7496dcaSJamie Gritton /*
29180fe74ae6SJamie Gritton  * Set or clear a permission bit in the pr_allow field, passing restrictions
29190fe74ae6SJamie Gritton  * (cleared permission) down to child jails.
29200fe74ae6SJamie Gritton  */
29210fe74ae6SJamie Gritton void
29220fe74ae6SJamie Gritton prison_set_allow(struct ucred *cred, unsigned flag, int enable)
29230fe74ae6SJamie Gritton {
29240fe74ae6SJamie Gritton 	struct prison *pr;
29250fe74ae6SJamie Gritton 
29260fe74ae6SJamie Gritton 	pr = cred->cr_prison;
29270fe74ae6SJamie Gritton 	sx_slock(&allprison_lock);
29280fe74ae6SJamie Gritton 	mtx_lock(&pr->pr_mtx);
29290fe74ae6SJamie Gritton 	prison_set_allow_locked(pr, flag, enable);
29300fe74ae6SJamie Gritton 	mtx_unlock(&pr->pr_mtx);
29310fe74ae6SJamie Gritton 	sx_sunlock(&allprison_lock);
29320fe74ae6SJamie Gritton }
29330fe74ae6SJamie Gritton 
29340fe74ae6SJamie Gritton static void
29350fe74ae6SJamie Gritton prison_set_allow_locked(struct prison *pr, unsigned flag, int enable)
29360fe74ae6SJamie Gritton {
29370fe74ae6SJamie Gritton 	struct prison *cpr;
29380fe74ae6SJamie Gritton 	int descend;
29390fe74ae6SJamie Gritton 
29400fe74ae6SJamie Gritton 	if (enable != 0)
29410fe74ae6SJamie Gritton 		pr->pr_allow |= flag;
29420fe74ae6SJamie Gritton 	else {
29430fe74ae6SJamie Gritton 		pr->pr_allow &= ~flag;
29440fe74ae6SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, cpr, descend)
29450fe74ae6SJamie Gritton 			cpr->pr_allow &= ~flag;
29460fe74ae6SJamie Gritton 	}
29470fe74ae6SJamie Gritton }
29480fe74ae6SJamie Gritton 
29490fe74ae6SJamie Gritton /*
2950ca04ba64SJamie Gritton  * Check if a jail supports the given address family.
2951ca04ba64SJamie Gritton  *
2952ca04ba64SJamie Gritton  * Returns 0 if not jailed or the address family is supported, EAFNOSUPPORT
2953ca04ba64SJamie Gritton  * if not.
2954ca04ba64SJamie Gritton  */
2955ca04ba64SJamie Gritton int
2956ca04ba64SJamie Gritton prison_check_af(struct ucred *cred, int af)
2957ca04ba64SJamie Gritton {
29580304c731SJamie Gritton 	struct prison *pr;
2959ca04ba64SJamie Gritton 	int error;
2960ca04ba64SJamie Gritton 
2961ca04ba64SJamie Gritton 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
2962ca04ba64SJamie Gritton 
29630304c731SJamie Gritton 	pr = cred->cr_prison;
2964499650a0SJamie Gritton #ifdef VIMAGE
29656bb79563SJamie Gritton 	/* Prisons with their own network stack are not limited. */
2966de0bd6f7SBjoern A. Zeeb 	if (prison_owns_vnet(cred))
29676bb79563SJamie Gritton 		return (0);
2968499650a0SJamie Gritton #endif
29696bb79563SJamie Gritton 
2970ca04ba64SJamie Gritton 	error = 0;
2971ca04ba64SJamie Gritton 	switch (af)
2972ca04ba64SJamie Gritton 	{
2973ca04ba64SJamie Gritton #ifdef INET
2974ca04ba64SJamie Gritton 	case AF_INET:
29750304c731SJamie Gritton 		if (pr->pr_flags & PR_IP4)
29760304c731SJamie Gritton 		{
29770304c731SJamie Gritton 			mtx_lock(&pr->pr_mtx);
29780304c731SJamie Gritton 			if ((pr->pr_flags & PR_IP4) && pr->pr_ip4 == NULL)
2979ca04ba64SJamie Gritton 				error = EAFNOSUPPORT;
29800304c731SJamie Gritton 			mtx_unlock(&pr->pr_mtx);
29810304c731SJamie Gritton 		}
2982ca04ba64SJamie Gritton 		break;
2983ca04ba64SJamie Gritton #endif
2984ca04ba64SJamie Gritton #ifdef INET6
2985ca04ba64SJamie Gritton 	case AF_INET6:
29860304c731SJamie Gritton 		if (pr->pr_flags & PR_IP6)
29870304c731SJamie Gritton 		{
29880304c731SJamie Gritton 			mtx_lock(&pr->pr_mtx);
29890304c731SJamie Gritton 			if ((pr->pr_flags & PR_IP6) && pr->pr_ip6 == NULL)
2990ca04ba64SJamie Gritton 				error = EAFNOSUPPORT;
29910304c731SJamie Gritton 			mtx_unlock(&pr->pr_mtx);
29920304c731SJamie Gritton 		}
2993ca04ba64SJamie Gritton 		break;
2994ca04ba64SJamie Gritton #endif
2995ca04ba64SJamie Gritton 	case AF_LOCAL:
2996ca04ba64SJamie Gritton 	case AF_ROUTE:
2997ca04ba64SJamie Gritton 		break;
2998ca04ba64SJamie Gritton 	default:
29990304c731SJamie Gritton 		if (!(pr->pr_allow & PR_ALLOW_SOCKET_AF))
3000ca04ba64SJamie Gritton 			error = EAFNOSUPPORT;
3001ca04ba64SJamie Gritton 	}
3002ca04ba64SJamie Gritton 	return (error);
3003ca04ba64SJamie Gritton }
3004ca04ba64SJamie Gritton 
3005ca04ba64SJamie Gritton /*
3006413628a7SBjoern A. Zeeb  * Check if given address belongs to the jail referenced by cred (wrapper to
3007413628a7SBjoern A. Zeeb  * prison_check_ip[46]).
3008413628a7SBjoern A. Zeeb  *
30090304c731SJamie Gritton  * Returns 0 if jail doesn't restrict the address family or if address belongs
30100304c731SJamie Gritton  * to jail, EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if
30110304c731SJamie Gritton  * the jail doesn't allow the address family.  IPv4 Address passed in in NBO.
3012413628a7SBjoern A. Zeeb  */
3013413628a7SBjoern A. Zeeb int
3014c83dda36SAlexander V. Chernikov prison_if(struct ucred *cred, const struct sockaddr *sa)
301575c13541SPoul-Henning Kamp {
3016413628a7SBjoern A. Zeeb #ifdef INET
3017c83dda36SAlexander V. Chernikov 	const struct sockaddr_in *sai;
3018413628a7SBjoern A. Zeeb #endif
3019413628a7SBjoern A. Zeeb #ifdef INET6
3020c83dda36SAlexander V. Chernikov 	const struct sockaddr_in6 *sai6;
3021413628a7SBjoern A. Zeeb #endif
3022b89e82ddSJamie Gritton 	int error;
302375c13541SPoul-Henning Kamp 
3024413628a7SBjoern A. Zeeb 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
3025413628a7SBjoern A. Zeeb 	KASSERT(sa != NULL, ("%s: sa is NULL", __func__));
3026413628a7SBjoern A. Zeeb 
3027de0bd6f7SBjoern A. Zeeb #ifdef VIMAGE
3028de0bd6f7SBjoern A. Zeeb 	if (prison_owns_vnet(cred))
3029de0bd6f7SBjoern A. Zeeb 		return (0);
3030de0bd6f7SBjoern A. Zeeb #endif
3031de0bd6f7SBjoern A. Zeeb 
3032b89e82ddSJamie Gritton 	error = 0;
3033413628a7SBjoern A. Zeeb 	switch (sa->sa_family)
3034413628a7SBjoern A. Zeeb 	{
3035413628a7SBjoern A. Zeeb #ifdef INET
3036413628a7SBjoern A. Zeeb 	case AF_INET:
3037c83dda36SAlexander V. Chernikov 		sai = (const struct sockaddr_in *)sa;
3038b89e82ddSJamie Gritton 		error = prison_check_ip4(cred, &sai->sin_addr);
3039413628a7SBjoern A. Zeeb 		break;
3040413628a7SBjoern A. Zeeb #endif
3041413628a7SBjoern A. Zeeb #ifdef INET6
3042413628a7SBjoern A. Zeeb 	case AF_INET6:
3043c83dda36SAlexander V. Chernikov 		sai6 = (const struct sockaddr_in6 *)sa;
3044b89e82ddSJamie Gritton 		error = prison_check_ip6(cred, &sai6->sin6_addr);
3045413628a7SBjoern A. Zeeb 		break;
3046413628a7SBjoern A. Zeeb #endif
3047413628a7SBjoern A. Zeeb 	default:
30480304c731SJamie Gritton 		if (!(cred->cr_prison->pr_allow & PR_ALLOW_SOCKET_AF))
3049b89e82ddSJamie Gritton 			error = EAFNOSUPPORT;
3050413628a7SBjoern A. Zeeb 	}
3051b89e82ddSJamie Gritton 	return (error);
305275c13541SPoul-Henning Kamp }
305391421ba2SRobert Watson 
305491421ba2SRobert Watson /*
305591421ba2SRobert Watson  * Return 0 if jails permit p1 to frob p2, otherwise ESRCH.
305691421ba2SRobert Watson  */
305791421ba2SRobert Watson int
30589ddb7954SMike Barcroft prison_check(struct ucred *cred1, struct ucred *cred2)
305991421ba2SRobert Watson {
306091421ba2SRobert Watson 
30610304c731SJamie Gritton 	return ((cred1->cr_prison == cred2->cr_prison ||
30620304c731SJamie Gritton 	    prison_ischild(cred1->cr_prison, cred2->cr_prison)) ? 0 : ESRCH);
30630304c731SJamie Gritton }
306491421ba2SRobert Watson 
30650304c731SJamie Gritton /*
30660304c731SJamie Gritton  * Return 1 if p2 is a child of p1, otherwise 0.
30670304c731SJamie Gritton  */
30680304c731SJamie Gritton int
30690304c731SJamie Gritton prison_ischild(struct prison *pr1, struct prison *pr2)
30700304c731SJamie Gritton {
30710304c731SJamie Gritton 
30720304c731SJamie Gritton 	for (pr2 = pr2->pr_parent; pr2 != NULL; pr2 = pr2->pr_parent)
30730304c731SJamie Gritton 		if (pr1 == pr2)
30740304c731SJamie Gritton 			return (1);
307591421ba2SRobert Watson 	return (0);
307691421ba2SRobert Watson }
307791421ba2SRobert Watson 
307891421ba2SRobert Watson /*
3079f7496dcaSJamie Gritton  * Return true if the prison is currently alive.  A prison is alive if it
3080f7496dcaSJamie Gritton  * holds user references and it isn't being removed.
308176ad42abSJamie Gritton  */
308276ad42abSJamie Gritton bool
308376ad42abSJamie Gritton prison_isalive(struct prison *pr)
308476ad42abSJamie Gritton {
308576ad42abSJamie Gritton 
3086*1158508aSJamie Gritton 	if (__predict_false(pr->pr_state != PRISON_STATE_ALIVE))
3087cc7b7306SJamie Gritton 		return (false);
308876ad42abSJamie Gritton 	return (true);
308976ad42abSJamie Gritton }
309076ad42abSJamie Gritton 
309176ad42abSJamie Gritton /*
309276ad42abSJamie Gritton  * Return true if the prison is currently valid.  A prison is valid if it has
309376ad42abSJamie Gritton  * been fully created, and is not being destroyed.  Note that dying prisons
3094f7496dcaSJamie Gritton  * are still considered valid.  Invalid prisons won't be found under normal
3095f7496dcaSJamie Gritton  * circumstances, as they're only put in that state by functions that have
3096f7496dcaSJamie Gritton  * an exclusive hold on allprison_lock.
309776ad42abSJamie Gritton  */
309876ad42abSJamie Gritton bool
309976ad42abSJamie Gritton prison_isvalid(struct prison *pr)
310076ad42abSJamie Gritton {
310176ad42abSJamie Gritton 
3102*1158508aSJamie Gritton 	if (__predict_false(pr->pr_state == PRISON_STATE_INVALID))
3103*1158508aSJamie Gritton 		return (false);
31046754ae25SJamie Gritton 	if (__predict_false(refcount_load(&pr->pr_ref) == 0))
310576ad42abSJamie Gritton 		return (false);
310676ad42abSJamie Gritton 	return (true);
310776ad42abSJamie Gritton }
310876ad42abSJamie Gritton 
310976ad42abSJamie Gritton /*
3110de0bd6f7SBjoern A. Zeeb  * Return 1 if the passed credential is in a jail and that jail does not
3111de0bd6f7SBjoern A. Zeeb  * have its own virtual network stack, otherwise 0.
3112de0bd6f7SBjoern A. Zeeb  */
3113de0bd6f7SBjoern A. Zeeb int
3114de0bd6f7SBjoern A. Zeeb jailed_without_vnet(struct ucred *cred)
3115de0bd6f7SBjoern A. Zeeb {
3116de0bd6f7SBjoern A. Zeeb 
3117de0bd6f7SBjoern A. Zeeb 	if (!jailed(cred))
3118de0bd6f7SBjoern A. Zeeb 		return (0);
3119de0bd6f7SBjoern A. Zeeb #ifdef VIMAGE
3120de0bd6f7SBjoern A. Zeeb 	if (prison_owns_vnet(cred))
3121de0bd6f7SBjoern A. Zeeb 		return (0);
3122de0bd6f7SBjoern A. Zeeb #endif
3123de0bd6f7SBjoern A. Zeeb 
3124de0bd6f7SBjoern A. Zeeb 	return (1);
3125de0bd6f7SBjoern A. Zeeb }
3126de0bd6f7SBjoern A. Zeeb 
3127de0bd6f7SBjoern A. Zeeb /*
31287455b100SJamie Gritton  * Return the correct hostname (domainname, et al) for the passed credential.
31299484d0c0SRobert Drehmel  */
3130ad1ff099SRobert Drehmel void
31319ddb7954SMike Barcroft getcredhostname(struct ucred *cred, char *buf, size_t size)
31329484d0c0SRobert Drehmel {
313376ca6f88SJamie Gritton 	struct prison *pr;
31349484d0c0SRobert Drehmel 
31357455b100SJamie Gritton 	/*
31367455b100SJamie Gritton 	 * A NULL credential can be used to shortcut to the physical
31377455b100SJamie Gritton 	 * system's hostname.
31387455b100SJamie Gritton 	 */
313976ca6f88SJamie Gritton 	pr = (cred != NULL) ? cred->cr_prison : &prison0;
314076ca6f88SJamie Gritton 	mtx_lock(&pr->pr_mtx);
3141c1f19219SJamie Gritton 	strlcpy(buf, pr->pr_hostname, size);
314276ca6f88SJamie Gritton 	mtx_unlock(&pr->pr_mtx);
31439484d0c0SRobert Drehmel }
3144fd7a8150SMike Barcroft 
31457455b100SJamie Gritton void
31467455b100SJamie Gritton getcreddomainname(struct ucred *cred, char *buf, size_t size)
31477455b100SJamie Gritton {
31487455b100SJamie Gritton 
31497455b100SJamie Gritton 	mtx_lock(&cred->cr_prison->pr_mtx);
3150c1f19219SJamie Gritton 	strlcpy(buf, cred->cr_prison->pr_domainname, size);
31517455b100SJamie Gritton 	mtx_unlock(&cred->cr_prison->pr_mtx);
31527455b100SJamie Gritton }
31537455b100SJamie Gritton 
31547455b100SJamie Gritton void
31557455b100SJamie Gritton getcredhostuuid(struct ucred *cred, char *buf, size_t size)
31567455b100SJamie Gritton {
31577455b100SJamie Gritton 
31587455b100SJamie Gritton 	mtx_lock(&cred->cr_prison->pr_mtx);
3159c1f19219SJamie Gritton 	strlcpy(buf, cred->cr_prison->pr_hostuuid, size);
31607455b100SJamie Gritton 	mtx_unlock(&cred->cr_prison->pr_mtx);
31617455b100SJamie Gritton }
31627455b100SJamie Gritton 
31637455b100SJamie Gritton void
31647455b100SJamie Gritton getcredhostid(struct ucred *cred, unsigned long *hostid)
31657455b100SJamie Gritton {
31667455b100SJamie Gritton 
31677455b100SJamie Gritton 	mtx_lock(&cred->cr_prison->pr_mtx);
31687455b100SJamie Gritton 	*hostid = cred->cr_prison->pr_hostid;
31697455b100SJamie Gritton 	mtx_unlock(&cred->cr_prison->pr_mtx);
31707455b100SJamie Gritton }
31717455b100SJamie Gritton 
31723f8bc99cSKristof Provost void
31733f8bc99cSKristof Provost getjailname(struct ucred *cred, char *name, size_t len)
31743f8bc99cSKristof Provost {
31753f8bc99cSKristof Provost 
31763f8bc99cSKristof Provost 	mtx_lock(&cred->cr_prison->pr_mtx);
31773f8bc99cSKristof Provost 	strlcpy(name, cred->cr_prison->pr_name, len);
31783f8bc99cSKristof Provost 	mtx_unlock(&cred->cr_prison->pr_mtx);
31793f8bc99cSKristof Provost }
31803f8bc99cSKristof Provost 
3181eb79e1c7SBjoern A. Zeeb #ifdef VIMAGE
3182eb79e1c7SBjoern A. Zeeb /*
3183eb79e1c7SBjoern A. Zeeb  * Determine whether the prison represented by cred owns
3184eb79e1c7SBjoern A. Zeeb  * its vnet rather than having it inherited.
3185eb79e1c7SBjoern A. Zeeb  *
3186eb79e1c7SBjoern A. Zeeb  * Returns 1 in case the prison owns the vnet, 0 otherwise.
3187eb79e1c7SBjoern A. Zeeb  */
3188eb79e1c7SBjoern A. Zeeb int
3189eb79e1c7SBjoern A. Zeeb prison_owns_vnet(struct ucred *cred)
3190eb79e1c7SBjoern A. Zeeb {
3191eb79e1c7SBjoern A. Zeeb 
3192eb79e1c7SBjoern A. Zeeb 	/*
3193eb79e1c7SBjoern A. Zeeb 	 * vnets cannot be added/removed after jail creation,
3194eb79e1c7SBjoern A. Zeeb 	 * so no need to lock here.
3195eb79e1c7SBjoern A. Zeeb 	 */
3196eb79e1c7SBjoern A. Zeeb 	return (cred->cr_prison->pr_flags & PR_VNET ? 1 : 0);
3197eb79e1c7SBjoern A. Zeeb }
3198eb79e1c7SBjoern A. Zeeb #endif
3199eb79e1c7SBjoern A. Zeeb 
3200f08df373SRobert Watson /*
3201820a0de9SPawel Jakub Dawidek  * Determine whether the subject represented by cred can "see"
3202820a0de9SPawel Jakub Dawidek  * status of a mount point.
3203820a0de9SPawel Jakub Dawidek  * Returns: 0 for permitted, ENOENT otherwise.
3204820a0de9SPawel Jakub Dawidek  * XXX: This function should be called cr_canseemount() and should be
3205820a0de9SPawel Jakub Dawidek  *      placed in kern_prot.c.
3206f08df373SRobert Watson  */
3207f08df373SRobert Watson int
3208820a0de9SPawel Jakub Dawidek prison_canseemount(struct ucred *cred, struct mount *mp)
3209f08df373SRobert Watson {
3210820a0de9SPawel Jakub Dawidek 	struct prison *pr;
3211820a0de9SPawel Jakub Dawidek 	struct statfs *sp;
3212820a0de9SPawel Jakub Dawidek 	size_t len;
3213f08df373SRobert Watson 
3214820a0de9SPawel Jakub Dawidek 	pr = cred->cr_prison;
32150304c731SJamie Gritton 	if (pr->pr_enforce_statfs == 0)
32160304c731SJamie Gritton 		return (0);
3217820a0de9SPawel Jakub Dawidek 	if (pr->pr_root->v_mount == mp)
3218820a0de9SPawel Jakub Dawidek 		return (0);
32190304c731SJamie Gritton 	if (pr->pr_enforce_statfs == 2)
3220820a0de9SPawel Jakub Dawidek 		return (ENOENT);
3221820a0de9SPawel Jakub Dawidek 	/*
3222820a0de9SPawel Jakub Dawidek 	 * If jail's chroot directory is set to "/" we should be able to see
3223820a0de9SPawel Jakub Dawidek 	 * all mount-points from inside a jail.
3224820a0de9SPawel Jakub Dawidek 	 * This is ugly check, but this is the only situation when jail's
3225820a0de9SPawel Jakub Dawidek 	 * directory ends with '/'.
3226820a0de9SPawel Jakub Dawidek 	 */
3227820a0de9SPawel Jakub Dawidek 	if (strcmp(pr->pr_path, "/") == 0)
3228820a0de9SPawel Jakub Dawidek 		return (0);
3229820a0de9SPawel Jakub Dawidek 	len = strlen(pr->pr_path);
3230820a0de9SPawel Jakub Dawidek 	sp = &mp->mnt_stat;
3231820a0de9SPawel Jakub Dawidek 	if (strncmp(pr->pr_path, sp->f_mntonname, len) != 0)
3232820a0de9SPawel Jakub Dawidek 		return (ENOENT);
3233820a0de9SPawel Jakub Dawidek 	/*
3234820a0de9SPawel Jakub Dawidek 	 * Be sure that we don't have situation where jail's root directory
3235820a0de9SPawel Jakub Dawidek 	 * is "/some/path" and mount point is "/some/pathpath".
3236820a0de9SPawel Jakub Dawidek 	 */
3237820a0de9SPawel Jakub Dawidek 	if (sp->f_mntonname[len] != '\0' && sp->f_mntonname[len] != '/')
3238820a0de9SPawel Jakub Dawidek 		return (ENOENT);
3239f08df373SRobert Watson 	return (0);
3240f08df373SRobert Watson }
3241820a0de9SPawel Jakub Dawidek 
3242820a0de9SPawel Jakub Dawidek void
3243820a0de9SPawel Jakub Dawidek prison_enforce_statfs(struct ucred *cred, struct mount *mp, struct statfs *sp)
3244820a0de9SPawel Jakub Dawidek {
3245820a0de9SPawel Jakub Dawidek 	char jpath[MAXPATHLEN];
3246820a0de9SPawel Jakub Dawidek 	struct prison *pr;
3247820a0de9SPawel Jakub Dawidek 	size_t len;
3248820a0de9SPawel Jakub Dawidek 
3249820a0de9SPawel Jakub Dawidek 	pr = cred->cr_prison;
32500304c731SJamie Gritton 	if (pr->pr_enforce_statfs == 0)
32510304c731SJamie Gritton 		return;
3252820a0de9SPawel Jakub Dawidek 	if (prison_canseemount(cred, mp) != 0) {
3253820a0de9SPawel Jakub Dawidek 		bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
3254820a0de9SPawel Jakub Dawidek 		strlcpy(sp->f_mntonname, "[restricted]",
3255820a0de9SPawel Jakub Dawidek 		    sizeof(sp->f_mntonname));
3256820a0de9SPawel Jakub Dawidek 		return;
3257820a0de9SPawel Jakub Dawidek 	}
3258820a0de9SPawel Jakub Dawidek 	if (pr->pr_root->v_mount == mp) {
3259820a0de9SPawel Jakub Dawidek 		/*
3260820a0de9SPawel Jakub Dawidek 		 * Clear current buffer data, so we are sure nothing from
3261820a0de9SPawel Jakub Dawidek 		 * the valid path left there.
3262820a0de9SPawel Jakub Dawidek 		 */
3263820a0de9SPawel Jakub Dawidek 		bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
3264820a0de9SPawel Jakub Dawidek 		*sp->f_mntonname = '/';
3265820a0de9SPawel Jakub Dawidek 		return;
3266820a0de9SPawel Jakub Dawidek 	}
3267820a0de9SPawel Jakub Dawidek 	/*
3268820a0de9SPawel Jakub Dawidek 	 * If jail's chroot directory is set to "/" we should be able to see
3269820a0de9SPawel Jakub Dawidek 	 * all mount-points from inside a jail.
3270820a0de9SPawel Jakub Dawidek 	 */
3271820a0de9SPawel Jakub Dawidek 	if (strcmp(pr->pr_path, "/") == 0)
3272820a0de9SPawel Jakub Dawidek 		return;
3273820a0de9SPawel Jakub Dawidek 	len = strlen(pr->pr_path);
3274820a0de9SPawel Jakub Dawidek 	strlcpy(jpath, sp->f_mntonname + len, sizeof(jpath));
3275820a0de9SPawel Jakub Dawidek 	/*
3276820a0de9SPawel Jakub Dawidek 	 * Clear current buffer data, so we are sure nothing from
3277820a0de9SPawel Jakub Dawidek 	 * the valid path left there.
3278820a0de9SPawel Jakub Dawidek 	 */
3279820a0de9SPawel Jakub Dawidek 	bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
3280820a0de9SPawel Jakub Dawidek 	if (*jpath == '\0') {
3281820a0de9SPawel Jakub Dawidek 		/* Should never happen. */
3282820a0de9SPawel Jakub Dawidek 		*sp->f_mntonname = '/';
3283820a0de9SPawel Jakub Dawidek 	} else {
3284820a0de9SPawel Jakub Dawidek 		strlcpy(sp->f_mntonname, jpath, sizeof(sp->f_mntonname));
3285820a0de9SPawel Jakub Dawidek 	}
3286f08df373SRobert Watson }
3287f08df373SRobert Watson 
3288800c9408SRobert Watson /*
3289800c9408SRobert Watson  * Check with permission for a specific privilege is granted within jail.  We
3290800c9408SRobert Watson  * have a specific list of accepted privileges; the rest are denied.
3291800c9408SRobert Watson  */
3292800c9408SRobert Watson int
3293800c9408SRobert Watson prison_priv_check(struct ucred *cred, int priv)
3294800c9408SRobert Watson {
32950fe74ae6SJamie Gritton 	struct prison *pr;
32960fe74ae6SJamie Gritton 	int error;
3297800c9408SRobert Watson 
32987b2ff0dcSMateusz Guzik 	/*
32997b2ff0dcSMateusz Guzik 	 * Some policies have custom handlers. This routine should not be
33007b2ff0dcSMateusz Guzik 	 * called for them. See priv_check_cred().
33017b2ff0dcSMateusz Guzik 	 */
33027b2ff0dcSMateusz Guzik 	switch (priv) {
3303a459a6cfSMateusz Guzik 	case PRIV_VFS_LOOKUP:
33047b2ff0dcSMateusz Guzik 	case PRIV_VFS_GENERATION:
33057b2ff0dcSMateusz Guzik 		KASSERT(0, ("prison_priv_check instead of a custom handler "
33067b2ff0dcSMateusz Guzik 		    "called for %d\n", priv));
33077b2ff0dcSMateusz Guzik 	}
33087b2ff0dcSMateusz Guzik 
3309800c9408SRobert Watson 	if (!jailed(cred))
3310800c9408SRobert Watson 		return (0);
3311800c9408SRobert Watson 
33126bb79563SJamie Gritton #ifdef VIMAGE
33136bb79563SJamie Gritton 	/*
33146bb79563SJamie Gritton 	 * Privileges specific to prisons with a virtual network stack.
33156bb79563SJamie Gritton 	 * There might be a duplicate entry here in case the privilege
33166bb79563SJamie Gritton 	 * is only granted conditionally in the legacy jail case.
33176bb79563SJamie Gritton 	 */
33186bb79563SJamie Gritton 	switch (priv) {
33196bb79563SJamie Gritton #ifdef notyet
33206bb79563SJamie Gritton 		/*
33216bb79563SJamie Gritton 		 * NFS-specific privileges.
33226bb79563SJamie Gritton 		 */
33236bb79563SJamie Gritton 	case PRIV_NFS_DAEMON:
33246bb79563SJamie Gritton 	case PRIV_NFS_LOCKD:
33256bb79563SJamie Gritton #endif
33266bb79563SJamie Gritton 		/*
33276bb79563SJamie Gritton 		 * Network stack privileges.
33286bb79563SJamie Gritton 		 */
33296bb79563SJamie Gritton 	case PRIV_NET_BRIDGE:
33306bb79563SJamie Gritton 	case PRIV_NET_GRE:
33316bb79563SJamie Gritton 	case PRIV_NET_BPF:
33326bb79563SJamie Gritton 	case PRIV_NET_RAW:		/* Dup, cond. in legacy jail case. */
33336bb79563SJamie Gritton 	case PRIV_NET_ROUTE:
33346bb79563SJamie Gritton 	case PRIV_NET_TAP:
33356bb79563SJamie Gritton 	case PRIV_NET_SETIFMTU:
33366bb79563SJamie Gritton 	case PRIV_NET_SETIFFLAGS:
33376bb79563SJamie Gritton 	case PRIV_NET_SETIFCAP:
3338215940b3SXin LI 	case PRIV_NET_SETIFDESCR:
33396bb79563SJamie Gritton 	case PRIV_NET_SETIFNAME	:
33406bb79563SJamie Gritton 	case PRIV_NET_SETIFMETRIC:
33416bb79563SJamie Gritton 	case PRIV_NET_SETIFPHYS:
33426bb79563SJamie Gritton 	case PRIV_NET_SETIFMAC:
3343389474c1SKonstantin Belousov 	case PRIV_NET_SETLANPCP:
33446bb79563SJamie Gritton 	case PRIV_NET_ADDMULTI:
33456bb79563SJamie Gritton 	case PRIV_NET_DELMULTI:
33466bb79563SJamie Gritton 	case PRIV_NET_HWIOCTL:
33476bb79563SJamie Gritton 	case PRIV_NET_SETLLADDR:
33486bb79563SJamie Gritton 	case PRIV_NET_ADDIFGROUP:
33496bb79563SJamie Gritton 	case PRIV_NET_DELIFGROUP:
33506bb79563SJamie Gritton 	case PRIV_NET_IFCREATE:
33516bb79563SJamie Gritton 	case PRIV_NET_IFDESTROY:
33526bb79563SJamie Gritton 	case PRIV_NET_ADDIFADDR:
33536bb79563SJamie Gritton 	case PRIV_NET_DELIFADDR:
33546bb79563SJamie Gritton 	case PRIV_NET_LAGG:
33556bb79563SJamie Gritton 	case PRIV_NET_GIF:
33566bb79563SJamie Gritton 	case PRIV_NET_SETIFVNET:
335735fd7bc0SBjoern A. Zeeb 	case PRIV_NET_SETIFFIB:
33586bb79563SJamie Gritton 
33596bb79563SJamie Gritton 		/*
33606bb79563SJamie Gritton 		 * 802.11-related privileges.
33616bb79563SJamie Gritton 		 */
3362f7d38a13SAdrian Chadd 	case PRIV_NET80211_VAP_GETKEY:
3363f7d38a13SAdrian Chadd 	case PRIV_NET80211_VAP_MANAGE:
33646bb79563SJamie Gritton 
33656bb79563SJamie Gritton #ifdef notyet
33666bb79563SJamie Gritton 		/*
33676bb79563SJamie Gritton 		 * ATM privileges.
33686bb79563SJamie Gritton 		 */
33696bb79563SJamie Gritton 	case PRIV_NETATM_CFG:
33706bb79563SJamie Gritton 	case PRIV_NETATM_ADD:
33716bb79563SJamie Gritton 	case PRIV_NETATM_DEL:
33726bb79563SJamie Gritton 	case PRIV_NETATM_SET:
33736bb79563SJamie Gritton 
33746bb79563SJamie Gritton 		/*
33756bb79563SJamie Gritton 		 * Bluetooth privileges.
33766bb79563SJamie Gritton 		 */
33776bb79563SJamie Gritton 	case PRIV_NETBLUETOOTH_RAW:
33786bb79563SJamie Gritton #endif
33796bb79563SJamie Gritton 
33806bb79563SJamie Gritton 		/*
33816bb79563SJamie Gritton 		 * Netgraph and netgraph module privileges.
33826bb79563SJamie Gritton 		 */
33836bb79563SJamie Gritton 	case PRIV_NETGRAPH_CONTROL:
33846bb79563SJamie Gritton #ifdef notyet
33856bb79563SJamie Gritton 	case PRIV_NETGRAPH_TTY:
33866bb79563SJamie Gritton #endif
33876bb79563SJamie Gritton 
33886bb79563SJamie Gritton 		/*
33896bb79563SJamie Gritton 		 * IPv4 and IPv6 privileges.
33906bb79563SJamie Gritton 		 */
33916bb79563SJamie Gritton 	case PRIV_NETINET_IPFW:
33926bb79563SJamie Gritton 	case PRIV_NETINET_DIVERT:
33936bb79563SJamie Gritton 	case PRIV_NETINET_PF:
33946bb79563SJamie Gritton 	case PRIV_NETINET_DUMMYNET:
33956bb79563SJamie Gritton 	case PRIV_NETINET_CARP:
33966bb79563SJamie Gritton 	case PRIV_NETINET_MROUTE:
33976bb79563SJamie Gritton 	case PRIV_NETINET_RAW:
33986bb79563SJamie Gritton 	case PRIV_NETINET_ADDRCTRL6:
33996bb79563SJamie Gritton 	case PRIV_NETINET_ND6:
34006bb79563SJamie Gritton 	case PRIV_NETINET_SCOPE6:
34016bb79563SJamie Gritton 	case PRIV_NETINET_ALIFETIME6:
34026bb79563SJamie Gritton 	case PRIV_NETINET_IPSEC:
34036bb79563SJamie Gritton 	case PRIV_NETINET_BINDANY:
34046bb79563SJamie Gritton 
34056bb79563SJamie Gritton #ifdef notyet
34066bb79563SJamie Gritton 		/*
34076bb79563SJamie Gritton 		 * NCP privileges.
34086bb79563SJamie Gritton 		 */
34096bb79563SJamie Gritton 	case PRIV_NETNCP:
34106bb79563SJamie Gritton 
34116bb79563SJamie Gritton 		/*
34126bb79563SJamie Gritton 		 * SMB privileges.
34136bb79563SJamie Gritton 		 */
34146bb79563SJamie Gritton 	case PRIV_NETSMB:
34156bb79563SJamie Gritton #endif
34166bb79563SJamie Gritton 
34176bb79563SJamie Gritton 	/*
34186bb79563SJamie Gritton 	 * No default: or deny here.
34196bb79563SJamie Gritton 	 * In case of no permit fall through to next switch().
34206bb79563SJamie Gritton 	 */
34216bb79563SJamie Gritton 		if (cred->cr_prison->pr_flags & PR_VNET)
34226bb79563SJamie Gritton 			return (0);
34236bb79563SJamie Gritton 	}
34246bb79563SJamie Gritton #endif /* VIMAGE */
34256bb79563SJamie Gritton 
3426800c9408SRobert Watson 	switch (priv) {
3427800c9408SRobert Watson 		/*
3428800c9408SRobert Watson 		 * Allow ktrace privileges for root in jail.
3429800c9408SRobert Watson 		 */
3430800c9408SRobert Watson 	case PRIV_KTRACE:
3431800c9408SRobert Watson 
3432c3c1b5e6SRobert Watson #if 0
3433800c9408SRobert Watson 		/*
3434800c9408SRobert Watson 		 * Allow jailed processes to configure audit identity and
3435800c9408SRobert Watson 		 * submit audit records (login, etc).  In the future we may
3436800c9408SRobert Watson 		 * want to further refine the relationship between audit and
3437800c9408SRobert Watson 		 * jail.
3438800c9408SRobert Watson 		 */
3439800c9408SRobert Watson 	case PRIV_AUDIT_GETAUDIT:
3440800c9408SRobert Watson 	case PRIV_AUDIT_SETAUDIT:
3441800c9408SRobert Watson 	case PRIV_AUDIT_SUBMIT:
3442c3c1b5e6SRobert Watson #endif
3443800c9408SRobert Watson 
3444800c9408SRobert Watson 		/*
3445800c9408SRobert Watson 		 * Allow jailed processes to manipulate process UNIX
3446800c9408SRobert Watson 		 * credentials in any way they see fit.
3447800c9408SRobert Watson 		 */
3448800c9408SRobert Watson 	case PRIV_CRED_SETUID:
3449800c9408SRobert Watson 	case PRIV_CRED_SETEUID:
3450800c9408SRobert Watson 	case PRIV_CRED_SETGID:
3451800c9408SRobert Watson 	case PRIV_CRED_SETEGID:
3452800c9408SRobert Watson 	case PRIV_CRED_SETGROUPS:
3453800c9408SRobert Watson 	case PRIV_CRED_SETREUID:
3454800c9408SRobert Watson 	case PRIV_CRED_SETREGID:
3455800c9408SRobert Watson 	case PRIV_CRED_SETRESUID:
3456800c9408SRobert Watson 	case PRIV_CRED_SETRESGID:
3457800c9408SRobert Watson 
3458800c9408SRobert Watson 		/*
3459800c9408SRobert Watson 		 * Jail implements visibility constraints already, so allow
3460800c9408SRobert Watson 		 * jailed root to override uid/gid-based constraints.
3461800c9408SRobert Watson 		 */
3462800c9408SRobert Watson 	case PRIV_SEEOTHERGIDS:
3463800c9408SRobert Watson 	case PRIV_SEEOTHERUIDS:
3464800c9408SRobert Watson 
3465800c9408SRobert Watson 		/*
3466800c9408SRobert Watson 		 * Jail implements inter-process debugging limits already, so
3467800c9408SRobert Watson 		 * allow jailed root various debugging privileges.
3468800c9408SRobert Watson 		 */
3469800c9408SRobert Watson 	case PRIV_DEBUG_DIFFCRED:
3470800c9408SRobert Watson 	case PRIV_DEBUG_SUGID:
3471800c9408SRobert Watson 	case PRIV_DEBUG_UNPRIV:
3472800c9408SRobert Watson 
3473800c9408SRobert Watson 		/*
3474800c9408SRobert Watson 		 * Allow jail to set various resource limits and login
3475800c9408SRobert Watson 		 * properties, and for now, exceed process resource limits.
3476800c9408SRobert Watson 		 */
3477800c9408SRobert Watson 	case PRIV_PROC_LIMIT:
3478800c9408SRobert Watson 	case PRIV_PROC_SETLOGIN:
3479800c9408SRobert Watson 	case PRIV_PROC_SETRLIMIT:
3480800c9408SRobert Watson 
3481800c9408SRobert Watson 		/*
3482800c9408SRobert Watson 		 * System V and POSIX IPC privileges are granted in jail.
3483800c9408SRobert Watson 		 */
3484800c9408SRobert Watson 	case PRIV_IPC_READ:
3485800c9408SRobert Watson 	case PRIV_IPC_WRITE:
3486800c9408SRobert Watson 	case PRIV_IPC_ADMIN:
3487800c9408SRobert Watson 	case PRIV_IPC_MSGSIZE:
3488800c9408SRobert Watson 	case PRIV_MQ_ADMIN:
3489800c9408SRobert Watson 
3490800c9408SRobert Watson 		/*
34910304c731SJamie Gritton 		 * Jail operations within a jail work on child jails.
34920304c731SJamie Gritton 		 */
34930304c731SJamie Gritton 	case PRIV_JAIL_ATTACH:
34940304c731SJamie Gritton 	case PRIV_JAIL_SET:
34950304c731SJamie Gritton 	case PRIV_JAIL_REMOVE:
34960304c731SJamie Gritton 
34970304c731SJamie Gritton 		/*
3498800c9408SRobert Watson 		 * Jail implements its own inter-process limits, so allow
3499800c9408SRobert Watson 		 * root processes in jail to change scheduling on other
3500800c9408SRobert Watson 		 * processes in the same jail.  Likewise for signalling.
3501800c9408SRobert Watson 		 */
3502800c9408SRobert Watson 	case PRIV_SCHED_DIFFCRED:
3503413628a7SBjoern A. Zeeb 	case PRIV_SCHED_CPUSET:
3504800c9408SRobert Watson 	case PRIV_SIGNAL_DIFFCRED:
3505800c9408SRobert Watson 	case PRIV_SIGNAL_SUGID:
3506800c9408SRobert Watson 
3507800c9408SRobert Watson 		/*
3508800c9408SRobert Watson 		 * Allow jailed processes to write to sysctls marked as jail
3509800c9408SRobert Watson 		 * writable.
3510800c9408SRobert Watson 		 */
3511800c9408SRobert Watson 	case PRIV_SYSCTL_WRITEJAIL:
3512800c9408SRobert Watson 
3513800c9408SRobert Watson 		/*
3514800c9408SRobert Watson 		 * Allow root in jail to manage a variety of quota
3515e82d0201SRobert Watson 		 * properties.  These should likely be conditional on a
3516e82d0201SRobert Watson 		 * configuration option.
3517800c9408SRobert Watson 		 */
351895b091d2SRobert Watson 	case PRIV_VFS_GETQUOTA:
351995b091d2SRobert Watson 	case PRIV_VFS_SETQUOTA:
3520800c9408SRobert Watson 
3521800c9408SRobert Watson 		/*
3522800c9408SRobert Watson 		 * Since Jail relies on chroot() to implement file system
3523800c9408SRobert Watson 		 * protections, grant many VFS privileges to root in jail.
3524800c9408SRobert Watson 		 * Be careful to exclude mount-related and NFS-related
3525800c9408SRobert Watson 		 * privileges.
3526800c9408SRobert Watson 		 */
3527800c9408SRobert Watson 	case PRIV_VFS_READ:
3528800c9408SRobert Watson 	case PRIV_VFS_WRITE:
3529800c9408SRobert Watson 	case PRIV_VFS_ADMIN:
3530800c9408SRobert Watson 	case PRIV_VFS_EXEC:
3531800c9408SRobert Watson 	case PRIV_VFS_BLOCKRESERVE:	/* XXXRW: Slightly surprising. */
3532800c9408SRobert Watson 	case PRIV_VFS_CHFLAGS_DEV:
3533800c9408SRobert Watson 	case PRIV_VFS_CHOWN:
3534800c9408SRobert Watson 	case PRIV_VFS_CHROOT:
3535bb531912SPawel Jakub Dawidek 	case PRIV_VFS_RETAINSUGID:
3536800c9408SRobert Watson 	case PRIV_VFS_FCHROOT:
3537800c9408SRobert Watson 	case PRIV_VFS_LINK:
3538800c9408SRobert Watson 	case PRIV_VFS_SETGID:
3539e41966dcSRobert Watson 	case PRIV_VFS_STAT:
3540800c9408SRobert Watson 	case PRIV_VFS_STICKYFILE:
3541bb56d716SJamie Gritton 
3542bb56d716SJamie Gritton 		/*
3543bb56d716SJamie Gritton 		 * As in the non-jail case, non-root users are expected to be
3544bb56d716SJamie Gritton 		 * able to read kernel/phyiscal memory (provided /dev/[k]mem
3545bb56d716SJamie Gritton 		 * exists in the jail and they have permission to access it).
3546bb56d716SJamie Gritton 		 */
3547bb56d716SJamie Gritton 	case PRIV_KMEM_READ:
3548800c9408SRobert Watson 		return (0);
3549800c9408SRobert Watson 
3550800c9408SRobert Watson 		/*
3551800c9408SRobert Watson 		 * Depending on the global setting, allow privilege of
3552800c9408SRobert Watson 		 * setting system flags.
3553800c9408SRobert Watson 		 */
3554800c9408SRobert Watson 	case PRIV_VFS_SYSFLAGS:
35550304c731SJamie Gritton 		if (cred->cr_prison->pr_allow & PR_ALLOW_CHFLAGS)
3556800c9408SRobert Watson 			return (0);
3557800c9408SRobert Watson 		else
3558800c9408SRobert Watson 			return (EPERM);
3559800c9408SRobert Watson 
3560800c9408SRobert Watson 		/*
3561f3a8d2f9SPawel Jakub Dawidek 		 * Depending on the global setting, allow privilege of
3562f3a8d2f9SPawel Jakub Dawidek 		 * mounting/unmounting file systems.
3563f3a8d2f9SPawel Jakub Dawidek 		 */
3564f3a8d2f9SPawel Jakub Dawidek 	case PRIV_VFS_MOUNT:
3565f3a8d2f9SPawel Jakub Dawidek 	case PRIV_VFS_UNMOUNT:
3566f3a8d2f9SPawel Jakub Dawidek 	case PRIV_VFS_MOUNT_NONUSER:
356724b0502eSPawel Jakub Dawidek 	case PRIV_VFS_MOUNT_OWNER:
35680fe74ae6SJamie Gritton 		pr = cred->cr_prison;
35690fe74ae6SJamie Gritton 		prison_lock(pr);
35700fe74ae6SJamie Gritton 		if (pr->pr_allow & PR_ALLOW_MOUNT && pr->pr_enforce_statfs < 2)
35710fe74ae6SJamie Gritton 			error = 0;
3572f3a8d2f9SPawel Jakub Dawidek 		else
35730fe74ae6SJamie Gritton 			error = EPERM;
35740fe74ae6SJamie Gritton 		prison_unlock(pr);
35750fe74ae6SJamie Gritton 		return (error);
3576f3a8d2f9SPawel Jakub Dawidek 
3577f3a8d2f9SPawel Jakub Dawidek 		/*
357863619b6dSKyle Evans 		 * Jails should hold no disposition on the PRIV_VFS_READ_DIR
357963619b6dSKyle Evans 		 * policy.  priv_check_cred will not specifically allow it, and
358063619b6dSKyle Evans 		 * we may want a MAC policy to allow it.
358163619b6dSKyle Evans 		 */
358263619b6dSKyle Evans 	case PRIV_VFS_READ_DIR:
358363619b6dSKyle Evans 		return (0);
358463619b6dSKyle Evans 
358563619b6dSKyle Evans 		/*
3586ccd6ac9fSAntoine Brodin 		 * Conditionnaly allow locking (unlocking) physical pages
3587ccd6ac9fSAntoine Brodin 		 * in memory.
3588ccd6ac9fSAntoine Brodin 		 */
3589ccd6ac9fSAntoine Brodin 	case PRIV_VM_MLOCK:
3590ccd6ac9fSAntoine Brodin 	case PRIV_VM_MUNLOCK:
3591ccd6ac9fSAntoine Brodin 		if (cred->cr_prison->pr_allow & PR_ALLOW_MLOCK)
3592ccd6ac9fSAntoine Brodin 			return (0);
3593ccd6ac9fSAntoine Brodin 		else
3594ccd6ac9fSAntoine Brodin 			return (EPERM);
3595ccd6ac9fSAntoine Brodin 
3596ccd6ac9fSAntoine Brodin 		/*
3597e28f9b7dSAllan Jude 		 * Conditionally allow jailed root to bind reserved ports.
3598800c9408SRobert Watson 		 */
3599800c9408SRobert Watson 	case PRIV_NETINET_RESERVEDPORT:
3600e28f9b7dSAllan Jude 		if (cred->cr_prison->pr_allow & PR_ALLOW_RESERVED_PORTS)
3601e28f9b7dSAllan Jude 			return (0);
3602e28f9b7dSAllan Jude 		else
3603e28f9b7dSAllan Jude 			return (EPERM);
3604e28f9b7dSAllan Jude 
3605e28f9b7dSAllan Jude 		/*
3606e28f9b7dSAllan Jude 		 * Allow jailed root to reuse in-use ports.
3607e28f9b7dSAllan Jude 		 */
36084b084056SRobert Watson 	case PRIV_NETINET_REUSEPORT:
3609800c9408SRobert Watson 		return (0);
3610800c9408SRobert Watson 
3611800c9408SRobert Watson 		/*
3612e3043798SPedro F. Giffuni 		 * Allow jailed root to set certain IPv4/6 (option) headers.
361379ba3952SBjoern A. Zeeb 		 */
361479ba3952SBjoern A. Zeeb 	case PRIV_NETINET_SETHDROPTS:
361579ba3952SBjoern A. Zeeb 		return (0);
361679ba3952SBjoern A. Zeeb 
361779ba3952SBjoern A. Zeeb 		/*
3618800c9408SRobert Watson 		 * Conditionally allow creating raw sockets in jail.
3619800c9408SRobert Watson 		 */
3620800c9408SRobert Watson 	case PRIV_NETINET_RAW:
36210304c731SJamie Gritton 		if (cred->cr_prison->pr_allow & PR_ALLOW_RAW_SOCKETS)
3622800c9408SRobert Watson 			return (0);
3623800c9408SRobert Watson 		else
3624800c9408SRobert Watson 			return (EPERM);
3625800c9408SRobert Watson 
3626800c9408SRobert Watson 		/*
3627800c9408SRobert Watson 		 * Since jail implements its own visibility limits on netstat
3628800c9408SRobert Watson 		 * sysctls, allow getcred.  This allows identd to work in
3629800c9408SRobert Watson 		 * jail.
3630800c9408SRobert Watson 		 */
3631800c9408SRobert Watson 	case PRIV_NETINET_GETCRED:
3632800c9408SRobert Watson 		return (0);
3633800c9408SRobert Watson 
36342bfc50bcSEdward Tomasz Napierala 		/*
36352bfc50bcSEdward Tomasz Napierala 		 * Allow jailed root to set loginclass.
36362bfc50bcSEdward Tomasz Napierala 		 */
36372bfc50bcSEdward Tomasz Napierala 	case PRIV_PROC_SETLOGINCLASS:
36382bfc50bcSEdward Tomasz Napierala 		return (0);
36392bfc50bcSEdward Tomasz Napierala 
3640b19d66fdSJamie Gritton 		/*
36414520f617SJamie Gritton 		 * Do not allow a process inside a jail to read the kernel
3642b19d66fdSJamie Gritton 		 * message buffer unless explicitly permitted.
3643b19d66fdSJamie Gritton 		 */
3644b19d66fdSJamie Gritton 	case PRIV_MSGBUF:
3645b19d66fdSJamie Gritton 		if (cred->cr_prison->pr_allow & PR_ALLOW_READ_MSGBUF)
3646b19d66fdSJamie Gritton 			return (0);
3647b19d66fdSJamie Gritton 		return (EPERM);
3648b19d66fdSJamie Gritton 
3649800c9408SRobert Watson 	default:
3650800c9408SRobert Watson 		/*
3651800c9408SRobert Watson 		 * In all remaining cases, deny the privilege request.  This
3652800c9408SRobert Watson 		 * includes almost all network privileges, many system
3653800c9408SRobert Watson 		 * configuration privileges.
3654800c9408SRobert Watson 		 */
3655800c9408SRobert Watson 		return (EPERM);
3656800c9408SRobert Watson 	}
3657800c9408SRobert Watson }
3658800c9408SRobert Watson 
36590304c731SJamie Gritton /*
36600304c731SJamie Gritton  * Return the part of pr2's name that is relative to pr1, or the whole name
36610304c731SJamie Gritton  * if it does not directly follow.
36620304c731SJamie Gritton  */
36630304c731SJamie Gritton 
36640304c731SJamie Gritton char *
36650304c731SJamie Gritton prison_name(struct prison *pr1, struct prison *pr2)
36660304c731SJamie Gritton {
36670304c731SJamie Gritton 	char *name;
36680304c731SJamie Gritton 
36690304c731SJamie Gritton 	/* Jails see themselves as "0" (if they see themselves at all). */
36700304c731SJamie Gritton 	if (pr1 == pr2)
36710304c731SJamie Gritton 		return "0";
36720304c731SJamie Gritton 	name = pr2->pr_name;
36730304c731SJamie Gritton 	if (prison_ischild(pr1, pr2)) {
36740304c731SJamie Gritton 		/*
36750304c731SJamie Gritton 		 * pr1 isn't locked (and allprison_lock may not be either)
36760304c731SJamie Gritton 		 * so its length can't be counted on.  But the number of dots
36770304c731SJamie Gritton 		 * can be counted on - and counted.
36780304c731SJamie Gritton 		 */
36790304c731SJamie Gritton 		for (; pr1 != &prison0; pr1 = pr1->pr_parent)
36800304c731SJamie Gritton 			name = strchr(name, '.') + 1;
36810304c731SJamie Gritton 	}
36820304c731SJamie Gritton 	return (name);
36830304c731SJamie Gritton }
36840304c731SJamie Gritton 
36850304c731SJamie Gritton /*
36860304c731SJamie Gritton  * Return the part of pr2's path that is relative to pr1, or the whole path
36870304c731SJamie Gritton  * if it does not directly follow.
36880304c731SJamie Gritton  */
36890304c731SJamie Gritton static char *
36900304c731SJamie Gritton prison_path(struct prison *pr1, struct prison *pr2)
36910304c731SJamie Gritton {
36920304c731SJamie Gritton 	char *path1, *path2;
36930304c731SJamie Gritton 	int len1;
36940304c731SJamie Gritton 
36950304c731SJamie Gritton 	path1 = pr1->pr_path;
36960304c731SJamie Gritton 	path2 = pr2->pr_path;
36970304c731SJamie Gritton 	if (!strcmp(path1, "/"))
36980304c731SJamie Gritton 		return (path2);
36990304c731SJamie Gritton 	len1 = strlen(path1);
37000304c731SJamie Gritton 	if (strncmp(path1, path2, len1))
37010304c731SJamie Gritton 		return (path2);
37020304c731SJamie Gritton 	if (path2[len1] == '\0')
37030304c731SJamie Gritton 		return "/";
37040304c731SJamie Gritton 	if (path2[len1] == '/')
37050304c731SJamie Gritton 		return (path2 + len1);
37060304c731SJamie Gritton 	return (path2);
37070304c731SJamie Gritton }
37080304c731SJamie Gritton 
37090304c731SJamie Gritton /*
37100304c731SJamie Gritton  * Jail-related sysctls.
37110304c731SJamie Gritton  */
37127029da5cSPawel Biernacki static SYSCTL_NODE(_security, OID_AUTO, jail, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
37130304c731SJamie Gritton     "Jails");
37140304c731SJamie Gritton 
3715fd7a8150SMike Barcroft static int
3716fd7a8150SMike Barcroft sysctl_jail_list(SYSCTL_HANDLER_ARGS)
3717fd7a8150SMike Barcroft {
3718b38ff370SJamie Gritton 	struct xprison *xp;
37190304c731SJamie Gritton 	struct prison *pr, *cpr;
3720b38ff370SJamie Gritton #ifdef INET
3721b38ff370SJamie Gritton 	struct in_addr *ip4 = NULL;
3722b38ff370SJamie Gritton 	int ip4s = 0;
3723b38ff370SJamie Gritton #endif
3724b38ff370SJamie Gritton #ifdef INET6
37253beefaedSColin Percival 	struct in6_addr *ip6 = NULL;
3726b38ff370SJamie Gritton 	int ip6s = 0;
3727b38ff370SJamie Gritton #endif
37280304c731SJamie Gritton 	int descend, error;
3729fd7a8150SMike Barcroft 
3730b38ff370SJamie Gritton 	xp = malloc(sizeof(*xp), M_TEMP, M_WAITOK);
37310304c731SJamie Gritton 	pr = req->td->td_ucred->cr_prison;
3732b38ff370SJamie Gritton 	error = 0;
3733dc68a633SPawel Jakub Dawidek 	sx_slock(&allprison_lock);
37340304c731SJamie Gritton 	FOREACH_PRISON_DESCENDANT(pr, cpr, descend) {
37350304c731SJamie Gritton #if defined(INET) || defined(INET6)
3736b38ff370SJamie Gritton  again:
37370304c731SJamie Gritton #endif
37380304c731SJamie Gritton 		mtx_lock(&cpr->pr_mtx);
3739413628a7SBjoern A. Zeeb #ifdef INET
37400304c731SJamie Gritton 		if (cpr->pr_ip4s > 0) {
37410304c731SJamie Gritton 			if (ip4s < cpr->pr_ip4s) {
37420304c731SJamie Gritton 				ip4s = cpr->pr_ip4s;
37430304c731SJamie Gritton 				mtx_unlock(&cpr->pr_mtx);
3744b38ff370SJamie Gritton 				ip4 = realloc(ip4, ip4s *
3745b38ff370SJamie Gritton 				    sizeof(struct in_addr), M_TEMP, M_WAITOK);
3746b38ff370SJamie Gritton 				goto again;
3747b38ff370SJamie Gritton 			}
37480304c731SJamie Gritton 			bcopy(cpr->pr_ip4, ip4,
37490304c731SJamie Gritton 			    cpr->pr_ip4s * sizeof(struct in_addr));
3750b38ff370SJamie Gritton 		}
3751413628a7SBjoern A. Zeeb #endif
3752413628a7SBjoern A. Zeeb #ifdef INET6
37530304c731SJamie Gritton 		if (cpr->pr_ip6s > 0) {
37540304c731SJamie Gritton 			if (ip6s < cpr->pr_ip6s) {
37550304c731SJamie Gritton 				ip6s = cpr->pr_ip6s;
37560304c731SJamie Gritton 				mtx_unlock(&cpr->pr_mtx);
3757b38ff370SJamie Gritton 				ip6 = realloc(ip6, ip6s *
3758b38ff370SJamie Gritton 				    sizeof(struct in6_addr), M_TEMP, M_WAITOK);
3759b38ff370SJamie Gritton 				goto again;
3760413628a7SBjoern A. Zeeb 			}
37610304c731SJamie Gritton 			bcopy(cpr->pr_ip6, ip6,
37620304c731SJamie Gritton 			    cpr->pr_ip6s * sizeof(struct in6_addr));
3763b38ff370SJamie Gritton 		}
3764b38ff370SJamie Gritton #endif
3765b38ff370SJamie Gritton 		bzero(xp, sizeof(*xp));
3766fd7a8150SMike Barcroft 		xp->pr_version = XPRISON_VERSION;
37670304c731SJamie Gritton 		xp->pr_id = cpr->pr_id;
3768*1158508aSJamie Gritton 		xp->pr_state = cpr->pr_state;
37690304c731SJamie Gritton 		strlcpy(xp->pr_path, prison_path(pr, cpr), sizeof(xp->pr_path));
3770c1f19219SJamie Gritton 		strlcpy(xp->pr_host, cpr->pr_hostname, sizeof(xp->pr_host));
37710304c731SJamie Gritton 		strlcpy(xp->pr_name, prison_name(pr, cpr), sizeof(xp->pr_name));
3772413628a7SBjoern A. Zeeb #ifdef INET
37730304c731SJamie Gritton 		xp->pr_ip4s = cpr->pr_ip4s;
3774413628a7SBjoern A. Zeeb #endif
3775413628a7SBjoern A. Zeeb #ifdef INET6
37760304c731SJamie Gritton 		xp->pr_ip6s = cpr->pr_ip6s;
3777413628a7SBjoern A. Zeeb #endif
37780304c731SJamie Gritton 		mtx_unlock(&cpr->pr_mtx);
3779b38ff370SJamie Gritton 		error = SYSCTL_OUT(req, xp, sizeof(*xp));
3780b38ff370SJamie Gritton 		if (error)
3781b38ff370SJamie Gritton 			break;
3782413628a7SBjoern A. Zeeb #ifdef INET
3783b38ff370SJamie Gritton 		if (xp->pr_ip4s > 0) {
3784b38ff370SJamie Gritton 			error = SYSCTL_OUT(req, ip4,
3785b38ff370SJamie Gritton 			    xp->pr_ip4s * sizeof(struct in_addr));
3786b38ff370SJamie Gritton 			if (error)
3787b38ff370SJamie Gritton 				break;
3788413628a7SBjoern A. Zeeb 		}
3789413628a7SBjoern A. Zeeb #endif
3790413628a7SBjoern A. Zeeb #ifdef INET6
3791b38ff370SJamie Gritton 		if (xp->pr_ip6s > 0) {
3792b38ff370SJamie Gritton 			error = SYSCTL_OUT(req, ip6,
3793b38ff370SJamie Gritton 			    xp->pr_ip6s * sizeof(struct in6_addr));
3794b38ff370SJamie Gritton 			if (error)
3795b38ff370SJamie Gritton 				break;
3796413628a7SBjoern A. Zeeb 		}
3797413628a7SBjoern A. Zeeb #endif
3798fd7a8150SMike Barcroft 	}
3799dc68a633SPawel Jakub Dawidek 	sx_sunlock(&allprison_lock);
3800b38ff370SJamie Gritton 	free(xp, M_TEMP);
3801b38ff370SJamie Gritton #ifdef INET
3802b38ff370SJamie Gritton 	free(ip4, M_TEMP);
3803b38ff370SJamie Gritton #endif
3804b38ff370SJamie Gritton #ifdef INET6
3805b38ff370SJamie Gritton 	free(ip6, M_TEMP);
3806b38ff370SJamie Gritton #endif
3807fd7a8150SMike Barcroft 	return (error);
3808fd7a8150SMike Barcroft }
3809fd7a8150SMike Barcroft 
3810f3b86a5fSEd Schouten SYSCTL_OID(_security_jail, OID_AUTO, list,
3811f3b86a5fSEd Schouten     CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
3812f3b86a5fSEd Schouten     sysctl_jail_list, "S", "List of active jails");
3813461167c2SPawel Jakub Dawidek 
3814461167c2SPawel Jakub Dawidek static int
3815461167c2SPawel Jakub Dawidek sysctl_jail_jailed(SYSCTL_HANDLER_ARGS)
3816461167c2SPawel Jakub Dawidek {
3817461167c2SPawel Jakub Dawidek 	int error, injail;
3818461167c2SPawel Jakub Dawidek 
3819461167c2SPawel Jakub Dawidek 	injail = jailed(req->td->td_ucred);
3820461167c2SPawel Jakub Dawidek 	error = SYSCTL_OUT(req, &injail, sizeof(injail));
3821461167c2SPawel Jakub Dawidek 
3822461167c2SPawel Jakub Dawidek 	return (error);
3823461167c2SPawel Jakub Dawidek }
38240304c731SJamie Gritton 
3825f3b86a5fSEd Schouten SYSCTL_PROC(_security_jail, OID_AUTO, jailed,
3826f3b86a5fSEd Schouten     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
3827f3b86a5fSEd Schouten     sysctl_jail_jailed, "I", "Process in jail?");
3828413628a7SBjoern A. Zeeb 
3829761d2bb5SJamie Gritton static int
3830761d2bb5SJamie Gritton sysctl_jail_vnet(SYSCTL_HANDLER_ARGS)
3831761d2bb5SJamie Gritton {
3832761d2bb5SJamie Gritton 	int error, havevnet;
3833761d2bb5SJamie Gritton #ifdef VIMAGE
3834761d2bb5SJamie Gritton 	struct ucred *cred = req->td->td_ucred;
3835761d2bb5SJamie Gritton 
3836761d2bb5SJamie Gritton 	havevnet = jailed(cred) && prison_owns_vnet(cred);
3837761d2bb5SJamie Gritton #else
3838761d2bb5SJamie Gritton 	havevnet = 0;
3839761d2bb5SJamie Gritton #endif
3840761d2bb5SJamie Gritton 	error = SYSCTL_OUT(req, &havevnet, sizeof(havevnet));
3841761d2bb5SJamie Gritton 
3842761d2bb5SJamie Gritton 	return (error);
3843761d2bb5SJamie Gritton }
3844761d2bb5SJamie Gritton 
3845761d2bb5SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, vnet,
3846761d2bb5SJamie Gritton     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
3847bb8f1623SBjoern A. Zeeb     sysctl_jail_vnet, "I", "Jail owns vnet?");
3848761d2bb5SJamie Gritton 
38490304c731SJamie Gritton #if defined(INET) || defined(INET6)
3850e92e0574SJamie Gritton SYSCTL_UINT(_security_jail, OID_AUTO, jail_max_af_ips, CTLFLAG_RW,
38510304c731SJamie Gritton     &jail_max_af_ips, 0,
3852c542c43eSJamie Gritton     "Number of IP addresses a jail may have at most per address family (deprecated)");
38530304c731SJamie Gritton #endif
38540304c731SJamie Gritton 
38550304c731SJamie Gritton /*
3856c542c43eSJamie Gritton  * Default parameters for jail(2) compatibility.  For historical reasons,
3857c542c43eSJamie Gritton  * the sysctl names have varying similarity to the parameter names.  Prisons
3858c542c43eSJamie Gritton  * just see their own parameters, and can't change them.
38590304c731SJamie Gritton  */
38600304c731SJamie Gritton static int
38610304c731SJamie Gritton sysctl_jail_default_allow(SYSCTL_HANDLER_ARGS)
38620304c731SJamie Gritton {
38630fe74ae6SJamie Gritton 	int error, i;
38640304c731SJamie Gritton 
38650304c731SJamie Gritton 	/* Get the current flag value, and convert it to a boolean. */
38660fe74ae6SJamie Gritton 	if (req->td->td_ucred->cr_prison == &prison0) {
38670fe74ae6SJamie Gritton 		mtx_lock(&prison0.pr_mtx);
38680fe74ae6SJamie Gritton 		i = (jail_default_allow & arg2) != 0;
38690fe74ae6SJamie Gritton 		mtx_unlock(&prison0.pr_mtx);
38700fe74ae6SJamie Gritton 	} else
38710fe74ae6SJamie Gritton 		i = prison_allow(req->td->td_ucred, arg2);
38720fe74ae6SJamie Gritton 
38730304c731SJamie Gritton 	if (arg1 != NULL)
38740304c731SJamie Gritton 		i = !i;
38750304c731SJamie Gritton 	error = sysctl_handle_int(oidp, &i, 0, req);
3876c542c43eSJamie Gritton 	if (error || !req->newptr)
38770304c731SJamie Gritton 		return (error);
38780304c731SJamie Gritton 	i = i ? arg2 : 0;
38790304c731SJamie Gritton 	if (arg1 != NULL)
38800304c731SJamie Gritton 		i ^= arg2;
38810304c731SJamie Gritton 	/*
38820304c731SJamie Gritton 	 * The sysctls don't have CTLFLAGS_PRISON, so assume prison0
38830304c731SJamie Gritton 	 * for writing.
38840304c731SJamie Gritton 	 */
38850304c731SJamie Gritton 	mtx_lock(&prison0.pr_mtx);
38860304c731SJamie Gritton 	jail_default_allow = (jail_default_allow & ~arg2) | i;
38870304c731SJamie Gritton 	mtx_unlock(&prison0.pr_mtx);
38880304c731SJamie Gritton 	return (0);
38890304c731SJamie Gritton }
38900304c731SJamie Gritton 
38910304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, set_hostname_allowed,
3892c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
38930304c731SJamie Gritton     NULL, PR_ALLOW_SET_HOSTNAME, sysctl_jail_default_allow, "I",
3894c542c43eSJamie Gritton     "Processes in jail can set their hostnames (deprecated)");
38950304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, socket_unixiproute_only,
3896c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
38970304c731SJamie Gritton     (void *)1, PR_ALLOW_SOCKET_AF, sysctl_jail_default_allow, "I",
3898c542c43eSJamie Gritton     "Processes in jail are limited to creating UNIX/IP/route sockets only (deprecated)");
38990304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, sysvipc_allowed,
3900c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
39010304c731SJamie Gritton     NULL, PR_ALLOW_SYSVIPC, sysctl_jail_default_allow, "I",
3902c542c43eSJamie Gritton     "Processes in jail can use System V IPC primitives (deprecated)");
39030304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, allow_raw_sockets,
3904c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
39050304c731SJamie Gritton     NULL, PR_ALLOW_RAW_SOCKETS, sysctl_jail_default_allow, "I",
3906c542c43eSJamie Gritton     "Prison root can create raw sockets (deprecated)");
39070304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, chflags_allowed,
3908c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
39090304c731SJamie Gritton     NULL, PR_ALLOW_CHFLAGS, sysctl_jail_default_allow, "I",
3910c542c43eSJamie Gritton     "Processes in jail can alter system file flags (deprecated)");
39110304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, mount_allowed,
3912c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
39130304c731SJamie Gritton     NULL, PR_ALLOW_MOUNT, sysctl_jail_default_allow, "I",
3914c542c43eSJamie Gritton     "Processes in jail can mount/unmount jail-friendly file systems (deprecated)");
39150304c731SJamie Gritton 
39160304c731SJamie Gritton static int
39170304c731SJamie Gritton sysctl_jail_default_level(SYSCTL_HANDLER_ARGS)
39180304c731SJamie Gritton {
39190304c731SJamie Gritton 	struct prison *pr;
39200304c731SJamie Gritton 	int level, error;
39210304c731SJamie Gritton 
39220304c731SJamie Gritton 	pr = req->td->td_ucred->cr_prison;
39230304c731SJamie Gritton 	level = (pr == &prison0) ? *(int *)arg1 : *(int *)((char *)pr + arg2);
39240304c731SJamie Gritton 	error = sysctl_handle_int(oidp, &level, 0, req);
3925c542c43eSJamie Gritton 	if (error || !req->newptr)
39260304c731SJamie Gritton 		return (error);
39270304c731SJamie Gritton 	*(int *)arg1 = level;
39280304c731SJamie Gritton 	return (0);
39290304c731SJamie Gritton }
39300304c731SJamie Gritton 
39310304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, enforce_statfs,
3932c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
3933c542c43eSJamie Gritton     &jail_default_enforce_statfs, offsetof(struct prison, pr_enforce_statfs),
39340304c731SJamie Gritton     sysctl_jail_default_level, "I",
3935c542c43eSJamie Gritton     "Processes in jail cannot see all mounted file systems (deprecated)");
3936c542c43eSJamie Gritton 
39370cc207a6SMartin Matuska SYSCTL_PROC(_security_jail, OID_AUTO, devfs_ruleset,
3938c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE,
3939c542c43eSJamie Gritton     &jail_default_devfs_rsnum, offsetof(struct prison, pr_devfs_rsnum),
39400cc207a6SMartin Matuska     sysctl_jail_default_level, "I",
3941c542c43eSJamie Gritton     "Ruleset for the devfs filesystem in jail (deprecated)");
39420cc207a6SMartin Matuska 
39430304c731SJamie Gritton /*
39440304c731SJamie Gritton  * Nodes to describe jail parameters.  Maximum length of string parameters
39450304c731SJamie Gritton  * is returned in the string itself, and the other parameters exist merely
39460304c731SJamie Gritton  * to make themselves and their types known.
39470304c731SJamie Gritton  */
39487029da5cSPawel Biernacki SYSCTL_NODE(_security_jail, OID_AUTO, param, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
39490304c731SJamie Gritton     "Jail parameters");
39500304c731SJamie Gritton 
39510304c731SJamie Gritton int
39520304c731SJamie Gritton sysctl_jail_param(SYSCTL_HANDLER_ARGS)
39530304c731SJamie Gritton {
39540304c731SJamie Gritton 	int i;
39550304c731SJamie Gritton 	long l;
39560304c731SJamie Gritton 	size_t s;
39570304c731SJamie Gritton 	char numbuf[12];
39580304c731SJamie Gritton 
39590304c731SJamie Gritton 	switch (oidp->oid_kind & CTLTYPE)
39600304c731SJamie Gritton 	{
39610304c731SJamie Gritton 	case CTLTYPE_LONG:
39620304c731SJamie Gritton 	case CTLTYPE_ULONG:
39630304c731SJamie Gritton 		l = 0;
39640304c731SJamie Gritton #ifdef SCTL_MASK32
39650304c731SJamie Gritton 		if (!(req->flags & SCTL_MASK32))
39660304c731SJamie Gritton #endif
39670304c731SJamie Gritton 			return (SYSCTL_OUT(req, &l, sizeof(l)));
39680304c731SJamie Gritton 	case CTLTYPE_INT:
39690304c731SJamie Gritton 	case CTLTYPE_UINT:
39700304c731SJamie Gritton 		i = 0;
39710304c731SJamie Gritton 		return (SYSCTL_OUT(req, &i, sizeof(i)));
39720304c731SJamie Gritton 	case CTLTYPE_STRING:
3973e4cd31ddSJeff Roberson 		snprintf(numbuf, sizeof(numbuf), "%jd", (intmax_t)arg2);
39740304c731SJamie Gritton 		return
39750304c731SJamie Gritton 		    (sysctl_handle_string(oidp, numbuf, sizeof(numbuf), req));
39760304c731SJamie Gritton 	case CTLTYPE_STRUCT:
39770304c731SJamie Gritton 		s = (size_t)arg2;
39780304c731SJamie Gritton 		return (SYSCTL_OUT(req, &s, sizeof(s)));
39790304c731SJamie Gritton 	}
39800304c731SJamie Gritton 	return (0);
39810304c731SJamie Gritton }
39820304c731SJamie Gritton 
3983b96bd95bSIan Lepore /*
3984b96bd95bSIan Lepore  * CTLFLAG_RDTUN in the following indicates jail parameters that can be set at
3985b96bd95bSIan Lepore  * jail creation time but cannot be changed in an existing jail.
3986b96bd95bSIan Lepore  */
39870304c731SJamie Gritton SYSCTL_JAIL_PARAM(, jid, CTLTYPE_INT | CTLFLAG_RDTUN, "I", "Jail ID");
39880304c731SJamie Gritton SYSCTL_JAIL_PARAM(, parent, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail parent ID");
39890304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(, name, CTLFLAG_RW, MAXHOSTNAMELEN, "Jail name");
39900304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(, path, CTLFLAG_RDTUN, MAXPATHLEN, "Jail root path");
39910304c731SJamie Gritton SYSCTL_JAIL_PARAM(, securelevel, CTLTYPE_INT | CTLFLAG_RW,
39920304c731SJamie Gritton     "I", "Jail secure level");
3993b96bd95bSIan Lepore SYSCTL_JAIL_PARAM(, osreldate, CTLTYPE_INT | CTLFLAG_RDTUN, "I",
3994b96bd95bSIan Lepore     "Jail value for kern.osreldate and uname -K");
3995b96bd95bSIan Lepore SYSCTL_JAIL_PARAM_STRING(, osrelease, CTLFLAG_RDTUN, OSRELEASELEN,
3996b96bd95bSIan Lepore     "Jail value for kern.osrelease and uname -r");
39970304c731SJamie Gritton SYSCTL_JAIL_PARAM(, enforce_statfs, CTLTYPE_INT | CTLFLAG_RW,
39980304c731SJamie Gritton     "I", "Jail cannot see all mounted file systems");
39990cc207a6SMartin Matuska SYSCTL_JAIL_PARAM(, devfs_ruleset, CTLTYPE_INT | CTLFLAG_RW,
40000cc207a6SMartin Matuska     "I", "Ruleset for in-jail devfs mounts");
40010304c731SJamie Gritton SYSCTL_JAIL_PARAM(, persist, CTLTYPE_INT | CTLFLAG_RW,
40020304c731SJamie Gritton     "B", "Jail persistence");
4003679e1390SJamie Gritton #ifdef VIMAGE
4004679e1390SJamie Gritton SYSCTL_JAIL_PARAM(, vnet, CTLTYPE_INT | CTLFLAG_RDTUN,
40057cbf7213SJamie Gritton     "E,jailsys", "Virtual network stack");
4006679e1390SJamie Gritton #endif
40070304c731SJamie Gritton SYSCTL_JAIL_PARAM(, dying, CTLTYPE_INT | CTLFLAG_RD,
40080304c731SJamie Gritton     "B", "Jail is in the process of shutting down");
40090304c731SJamie Gritton 
4010b97457e2SJamie Gritton SYSCTL_JAIL_PARAM_NODE(children, "Number of child jails");
4011b97457e2SJamie Gritton SYSCTL_JAIL_PARAM(_children, cur, CTLTYPE_INT | CTLFLAG_RD,
4012b97457e2SJamie Gritton     "I", "Current number of child jails");
4013b97457e2SJamie Gritton SYSCTL_JAIL_PARAM(_children, max, CTLTYPE_INT | CTLFLAG_RW,
4014b97457e2SJamie Gritton     "I", "Maximum number of child jails");
4015b97457e2SJamie Gritton 
40167cbf7213SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(host, CTLFLAG_RW, "Jail host info");
40170304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, hostname, CTLFLAG_RW, MAXHOSTNAMELEN,
40180304c731SJamie Gritton     "Jail hostname");
401976ca6f88SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, domainname, CTLFLAG_RW, MAXHOSTNAMELEN,
402076ca6f88SJamie Gritton     "Jail NIS domainname");
402176ca6f88SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, hostuuid, CTLFLAG_RW, HOSTUUIDLEN,
402276ca6f88SJamie Gritton     "Jail host UUID");
402376ca6f88SJamie Gritton SYSCTL_JAIL_PARAM(_host, hostid, CTLTYPE_ULONG | CTLFLAG_RW,
402476ca6f88SJamie Gritton     "LU", "Jail host ID");
40250304c731SJamie Gritton 
40260304c731SJamie Gritton SYSCTL_JAIL_PARAM_NODE(cpuset, "Jail cpuset");
40270304c731SJamie Gritton SYSCTL_JAIL_PARAM(_cpuset, id, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail cpuset ID");
40280304c731SJamie Gritton 
40290304c731SJamie Gritton #ifdef INET
40302b0d6f81SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(ip4, CTLFLAG_RDTUN,
40312b0d6f81SJamie Gritton     "Jail IPv4 address virtualization");
40320304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRUCT(_ip4, addr, CTLFLAG_RW, sizeof(struct in_addr),
40330304c731SJamie Gritton     "S,in_addr,a", "Jail IPv4 addresses");
4034592bcae8SBjoern A. Zeeb SYSCTL_JAIL_PARAM(_ip4, saddrsel, CTLTYPE_INT | CTLFLAG_RW,
4035592bcae8SBjoern A. Zeeb     "B", "Do (not) use IPv4 source address selection rather than the "
4036592bcae8SBjoern A. Zeeb     "primary jail IPv4 address.");
40370304c731SJamie Gritton #endif
40380304c731SJamie Gritton #ifdef INET6
40392b0d6f81SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(ip6, CTLFLAG_RDTUN,
40402b0d6f81SJamie Gritton     "Jail IPv6 address virtualization");
40410304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRUCT(_ip6, addr, CTLFLAG_RW, sizeof(struct in6_addr),
40420304c731SJamie Gritton     "S,in6_addr,a", "Jail IPv6 addresses");
4043592bcae8SBjoern A. Zeeb SYSCTL_JAIL_PARAM(_ip6, saddrsel, CTLTYPE_INT | CTLFLAG_RW,
4044592bcae8SBjoern A. Zeeb     "B", "Do (not) use IPv6 source address selection rather than the "
4045592bcae8SBjoern A. Zeeb     "primary jail IPv6 address.");
40460304c731SJamie Gritton #endif
40470304c731SJamie Gritton 
40480304c731SJamie Gritton SYSCTL_JAIL_PARAM_NODE(allow, "Jail permission flags");
40490304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, set_hostname, CTLTYPE_INT | CTLFLAG_RW,
40500304c731SJamie Gritton     "B", "Jail may set hostname");
40510304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, sysvipc, CTLTYPE_INT | CTLFLAG_RW,
40520304c731SJamie Gritton     "B", "Jail may use SYSV IPC");
40530304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, raw_sockets, CTLTYPE_INT | CTLFLAG_RW,
40540304c731SJamie Gritton     "B", "Jail may create raw sockets");
40550304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, chflags, CTLTYPE_INT | CTLFLAG_RW,
40560304c731SJamie Gritton     "B", "Jail may alter system file flags");
40570304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, quotas, CTLTYPE_INT | CTLFLAG_RW,
40580304c731SJamie Gritton     "B", "Jail may set file quotas");
40590304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, socket_af, CTLTYPE_INT | CTLFLAG_RW,
40600304c731SJamie Gritton     "B", "Jail may create sockets other than just UNIX/IPv4/IPv6/route");
4061ccd6ac9fSAntoine Brodin SYSCTL_JAIL_PARAM(_allow, mlock, CTLTYPE_INT | CTLFLAG_RW,
4062ccd6ac9fSAntoine Brodin     "B", "Jail may lock (unlock) physical pages in memory");
4063e28f9b7dSAllan Jude SYSCTL_JAIL_PARAM(_allow, reserved_ports, CTLTYPE_INT | CTLFLAG_RW,
4064e28f9b7dSAllan Jude     "B", "Jail may bind sockets to reserved ports");
4065b19d66fdSJamie Gritton SYSCTL_JAIL_PARAM(_allow, read_msgbuf, CTLTYPE_INT | CTLFLAG_RW,
4066b19d66fdSJamie Gritton     "B", "Jail may read the kernel message buffer");
4067b3079544SJamie Gritton SYSCTL_JAIL_PARAM(_allow, unprivileged_proc_debug, CTLTYPE_INT | CTLFLAG_RW,
4068b3079544SJamie Gritton     "B", "Unprivileged processes may use process debugging facilities");
406905e1e482SMariusz Zaborski SYSCTL_JAIL_PARAM(_allow, suser, CTLTYPE_INT | CTLFLAG_RW,
407005e1e482SMariusz Zaborski     "B", "Processes in jail with uid 0 have privilege");
40710304c731SJamie Gritton 
4072bf3db8aaSMartin Matuska SYSCTL_JAIL_PARAM_SUBNODE(allow, mount, "Jail mount/unmount permission flags");
4073bf3db8aaSMartin Matuska SYSCTL_JAIL_PARAM(_allow_mount, , CTLTYPE_INT | CTLFLAG_RW,
4074bf3db8aaSMartin Matuska     "B", "Jail may mount/unmount jail-friendly file systems in general");
40750e5c6bd4SJamie Gritton 
40760e5c6bd4SJamie Gritton /*
40770a172404SJamie Gritton  * Add a dynamic parameter allow.<name>, or allow.<prefix>.<name>.  Return
40780a172404SJamie Gritton  * its associated bit in the pr_allow bitmask, or zero if the parameter was
40790a172404SJamie Gritton  * not created.
40800e5c6bd4SJamie Gritton  */
40810a172404SJamie Gritton unsigned
40820a172404SJamie Gritton prison_add_allow(const char *prefix, const char *name, const char *prefix_descr,
40830a172404SJamie Gritton     const char *descr)
40840e5c6bd4SJamie Gritton {
40850e5c6bd4SJamie Gritton 	struct bool_flags *bf;
40860a172404SJamie Gritton 	struct sysctl_oid *parent;
40870a172404SJamie Gritton 	char *allow_name, *allow_noname, *allowed;
4088c542c43eSJamie Gritton #ifndef NO_SYSCTL_DESCR
4089c542c43eSJamie Gritton 	char *descr_deprecated;
4090c542c43eSJamie Gritton #endif
40915d58f959SJamie Gritton 	u_int allow_flag;
40920e5c6bd4SJamie Gritton 
40930a172404SJamie Gritton 	if (prefix
40940a172404SJamie Gritton 	    ? asprintf(&allow_name, M_PRISON, "allow.%s.%s", prefix, name)
40950a172404SJamie Gritton 		< 0 ||
40960a172404SJamie Gritton 	      asprintf(&allow_noname, M_PRISON, "allow.%s.no%s", prefix, name)
40970a172404SJamie Gritton 		< 0
40980a172404SJamie Gritton 	    : asprintf(&allow_name, M_PRISON, "allow.%s", name) < 0 ||
40990a172404SJamie Gritton 	      asprintf(&allow_noname, M_PRISON, "allow.no%s", name) < 0) {
41000e5c6bd4SJamie Gritton 		free(allow_name, M_PRISON);
41010a172404SJamie Gritton 		return 0;
41020e5c6bd4SJamie Gritton 	}
41030e5c6bd4SJamie Gritton 
41040e5c6bd4SJamie Gritton 	/*
41050a172404SJamie Gritton 	 * See if this parameter has already beed added, i.e. a module was
41060a172404SJamie Gritton 	 * previously loaded/unloaded.
41070e5c6bd4SJamie Gritton 	 */
41080e5c6bd4SJamie Gritton 	mtx_lock(&prison0.pr_mtx);
41090e5c6bd4SJamie Gritton 	for (bf = pr_flag_allow;
41105d58f959SJamie Gritton 	     bf < pr_flag_allow + nitems(pr_flag_allow) &&
41115d58f959SJamie Gritton 		atomic_load_int(&bf->flag) != 0;
41120e5c6bd4SJamie Gritton 	     bf++) {
41130e5c6bd4SJamie Gritton 		if (strcmp(bf->name, allow_name) == 0) {
41140a172404SJamie Gritton 			allow_flag = bf->flag;
41150e5c6bd4SJamie Gritton 			goto no_add;
41160e5c6bd4SJamie Gritton 		}
41170e5c6bd4SJamie Gritton 	}
41180e5c6bd4SJamie Gritton 
41190e5c6bd4SJamie Gritton 	/*
41205d58f959SJamie Gritton 	 * Find a free bit in pr_allow_all, failing if there are none
41210e5c6bd4SJamie Gritton 	 * (which shouldn't happen as long as we keep track of how many
41220a172404SJamie Gritton 	 * potential dynamic flags exist).
41230e5c6bd4SJamie Gritton 	 */
41240e5c6bd4SJamie Gritton 	for (allow_flag = 1;; allow_flag <<= 1) {
41250e5c6bd4SJamie Gritton 		if (allow_flag == 0)
41260e5c6bd4SJamie Gritton 			goto no_add;
41275d58f959SJamie Gritton 		if ((pr_allow_all & allow_flag) == 0)
41280e5c6bd4SJamie Gritton 			break;
41290e5c6bd4SJamie Gritton 	}
41300e5c6bd4SJamie Gritton 
41315d58f959SJamie Gritton 	/* Note the parameter in the next open slot in pr_flag_allow. */
41325d58f959SJamie Gritton 	for (bf = pr_flag_allow; ; bf++) {
41330e5c6bd4SJamie Gritton 		if (bf == pr_flag_allow + nitems(pr_flag_allow)) {
41340e5c6bd4SJamie Gritton 			/* This should never happen, but is not fatal. */
41350a172404SJamie Gritton 			allow_flag = 0;
41360e5c6bd4SJamie Gritton 			goto no_add;
41370e5c6bd4SJamie Gritton 		}
41385d58f959SJamie Gritton 		if (atomic_load_int(&bf->flag) == 0)
41395d58f959SJamie Gritton 			break;
41405d58f959SJamie Gritton 	}
41410e5c6bd4SJamie Gritton 	bf->name = allow_name;
41420e5c6bd4SJamie Gritton 	bf->noname = allow_noname;
41435d58f959SJamie Gritton 	pr_allow_all |= allow_flag;
41445d58f959SJamie Gritton 	/*
41455d58f959SJamie Gritton 	 * prison0 always has permission for the new parameter.
41465d58f959SJamie Gritton 	 * Other jails must have it granted to them.
41475d58f959SJamie Gritton 	 */
41485d58f959SJamie Gritton 	prison0.pr_allow |= allow_flag;
41495d58f959SJamie Gritton 	/* The flag indicates a valid entry, so make sure it is set last. */
41505d58f959SJamie Gritton 	atomic_store_rel_int(&bf->flag, allow_flag);
41510e5c6bd4SJamie Gritton 	mtx_unlock(&prison0.pr_mtx);
41520e5c6bd4SJamie Gritton 
4153c542c43eSJamie Gritton 	/*
4154c542c43eSJamie Gritton 	 * Create sysctls for the paramter, and the back-compat global
4155c542c43eSJamie Gritton 	 * permission.
4156c542c43eSJamie Gritton 	 */
41570a172404SJamie Gritton 	parent = prefix
41580a172404SJamie Gritton 	    ? SYSCTL_ADD_NODE(NULL,
41590a172404SJamie Gritton 		  SYSCTL_CHILDREN(&sysctl___security_jail_param_allow),
41607029da5cSPawel Biernacki 		  OID_AUTO, prefix, CTLFLAG_MPSAFE, 0, prefix_descr)
41610a172404SJamie Gritton 	    : &sysctl___security_jail_param_allow;
41620a172404SJamie Gritton 	(void)SYSCTL_ADD_PROC(NULL, SYSCTL_CHILDREN(parent), OID_AUTO,
41630a172404SJamie Gritton 	    name, CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
41640e5c6bd4SJamie Gritton 	    NULL, 0, sysctl_jail_param, "B", descr);
41650a172404SJamie Gritton 	if ((prefix
41660a172404SJamie Gritton 	     ? asprintf(&allowed, M_TEMP, "%s_%s_allowed", prefix, name)
41670a172404SJamie Gritton 	     : asprintf(&allowed, M_TEMP, "%s_allowed", name)) >= 0) {
4168c542c43eSJamie Gritton #ifndef NO_SYSCTL_DESCR
4169c542c43eSJamie Gritton 		(void)asprintf(&descr_deprecated, M_TEMP, "%s (deprecated)",
4170c542c43eSJamie Gritton 		    descr);
4171c542c43eSJamie Gritton #endif
41720e5c6bd4SJamie Gritton 		(void)SYSCTL_ADD_PROC(NULL,
41730a172404SJamie Gritton 		    SYSCTL_CHILDREN(&sysctl___security_jail), OID_AUTO, allowed,
4174c542c43eSJamie Gritton 		    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, allow_flag,
4175c542c43eSJamie Gritton 		    sysctl_jail_default_allow, "I", descr_deprecated);
4176c542c43eSJamie Gritton #ifndef NO_SYSCTL_DESCR
4177c542c43eSJamie Gritton 		free(descr_deprecated, M_TEMP);
4178c542c43eSJamie Gritton #endif
41790a172404SJamie Gritton 		free(allowed, M_TEMP);
41800e5c6bd4SJamie Gritton 	}
41810a172404SJamie Gritton 	return allow_flag;
41820e5c6bd4SJamie Gritton 
41830e5c6bd4SJamie Gritton  no_add:
41840e5c6bd4SJamie Gritton 	mtx_unlock(&prison0.pr_mtx);
41850e5c6bd4SJamie Gritton 	free(allow_name, M_PRISON);
41860e5c6bd4SJamie Gritton 	free(allow_noname, M_PRISON);
41870a172404SJamie Gritton 	return allow_flag;
41880a172404SJamie Gritton }
41890a172404SJamie Gritton 
41900a172404SJamie Gritton /*
41910a172404SJamie Gritton  * The VFS system will register jail-aware filesystems here.  They each get
41920a172404SJamie Gritton  * a parameter allow.mount.xxxfs and a flag to check when a jailed user
41930a172404SJamie Gritton  * attempts to mount.
41940a172404SJamie Gritton  */
41950a172404SJamie Gritton void
41960a172404SJamie Gritton prison_add_vfs(struct vfsconf *vfsp)
41970a172404SJamie Gritton {
41980a172404SJamie Gritton #ifdef NO_SYSCTL_DESCR
41990a172404SJamie Gritton 
42000a172404SJamie Gritton 	vfsp->vfc_prison_flag = prison_add_allow("mount", vfsp->vfc_name,
42010a172404SJamie Gritton 	    NULL, NULL);
42020a172404SJamie Gritton #else
42030a172404SJamie Gritton 	char *descr;
42040a172404SJamie Gritton 
42050a172404SJamie Gritton 	(void)asprintf(&descr, M_TEMP, "Jail may mount the %s file system",
42060a172404SJamie Gritton 	    vfsp->vfc_name);
42070a172404SJamie Gritton 	vfsp->vfc_prison_flag = prison_add_allow("mount", vfsp->vfc_name,
42080a172404SJamie Gritton 	    NULL, descr);
42090a172404SJamie Gritton 	free(descr, M_TEMP);
42100a172404SJamie Gritton #endif
42110e5c6bd4SJamie Gritton }
4212bf3db8aaSMartin Matuska 
42134b5c9cf6SEdward Tomasz Napierala #ifdef RACCT
4214097055e2SEdward Tomasz Napierala void
4215097055e2SEdward Tomasz Napierala prison_racct_foreach(void (*callback)(struct racct *racct,
421615db3c07SEdward Tomasz Napierala     void *arg2, void *arg3), void (*pre)(void), void (*post)(void),
421715db3c07SEdward Tomasz Napierala     void *arg2, void *arg3)
4218097055e2SEdward Tomasz Napierala {
4219a7ad07bfSEdward Tomasz Napierala 	struct prison_racct *prr;
4220097055e2SEdward Tomasz Napierala 
42214b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
42224b5c9cf6SEdward Tomasz Napierala 
4223097055e2SEdward Tomasz Napierala 	sx_slock(&allprison_lock);
422415db3c07SEdward Tomasz Napierala 	if (pre != NULL)
422515db3c07SEdward Tomasz Napierala 		(pre)();
4226a7ad07bfSEdward Tomasz Napierala 	LIST_FOREACH(prr, &allprison_racct, prr_next)
4227a7ad07bfSEdward Tomasz Napierala 		(callback)(prr->prr_racct, arg2, arg3);
422815db3c07SEdward Tomasz Napierala 	if (post != NULL)
422915db3c07SEdward Tomasz Napierala 		(post)();
4230097055e2SEdward Tomasz Napierala 	sx_sunlock(&allprison_lock);
4231097055e2SEdward Tomasz Napierala }
42320304c731SJamie Gritton 
4233a7ad07bfSEdward Tomasz Napierala static struct prison_racct *
4234a7ad07bfSEdward Tomasz Napierala prison_racct_find_locked(const char *name)
4235a7ad07bfSEdward Tomasz Napierala {
4236a7ad07bfSEdward Tomasz Napierala 	struct prison_racct *prr;
4237a7ad07bfSEdward Tomasz Napierala 
42384b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
4239a7ad07bfSEdward Tomasz Napierala 	sx_assert(&allprison_lock, SA_XLOCKED);
4240a7ad07bfSEdward Tomasz Napierala 
4241a7ad07bfSEdward Tomasz Napierala 	if (name[0] == '\0' || strlen(name) >= MAXHOSTNAMELEN)
4242a7ad07bfSEdward Tomasz Napierala 		return (NULL);
4243a7ad07bfSEdward Tomasz Napierala 
4244a7ad07bfSEdward Tomasz Napierala 	LIST_FOREACH(prr, &allprison_racct, prr_next) {
4245a7ad07bfSEdward Tomasz Napierala 		if (strcmp(name, prr->prr_name) != 0)
4246a7ad07bfSEdward Tomasz Napierala 			continue;
4247a7ad07bfSEdward Tomasz Napierala 
4248a7ad07bfSEdward Tomasz Napierala 		/* Found prison_racct with a matching name? */
4249a7ad07bfSEdward Tomasz Napierala 		prison_racct_hold(prr);
4250a7ad07bfSEdward Tomasz Napierala 		return (prr);
4251a7ad07bfSEdward Tomasz Napierala 	}
4252a7ad07bfSEdward Tomasz Napierala 
4253a7ad07bfSEdward Tomasz Napierala 	/* Add new prison_racct. */
4254a7ad07bfSEdward Tomasz Napierala 	prr = malloc(sizeof(*prr), M_PRISON_RACCT, M_ZERO | M_WAITOK);
4255a7ad07bfSEdward Tomasz Napierala 	racct_create(&prr->prr_racct);
4256a7ad07bfSEdward Tomasz Napierala 
4257a7ad07bfSEdward Tomasz Napierala 	strcpy(prr->prr_name, name);
4258a7ad07bfSEdward Tomasz Napierala 	refcount_init(&prr->prr_refcount, 1);
4259a7ad07bfSEdward Tomasz Napierala 	LIST_INSERT_HEAD(&allprison_racct, prr, prr_next);
4260a7ad07bfSEdward Tomasz Napierala 
4261a7ad07bfSEdward Tomasz Napierala 	return (prr);
4262a7ad07bfSEdward Tomasz Napierala }
4263a7ad07bfSEdward Tomasz Napierala 
4264a7ad07bfSEdward Tomasz Napierala struct prison_racct *
4265a7ad07bfSEdward Tomasz Napierala prison_racct_find(const char *name)
4266a7ad07bfSEdward Tomasz Napierala {
4267a7ad07bfSEdward Tomasz Napierala 	struct prison_racct *prr;
4268a7ad07bfSEdward Tomasz Napierala 
42694b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
42704b5c9cf6SEdward Tomasz Napierala 
4271a7ad07bfSEdward Tomasz Napierala 	sx_xlock(&allprison_lock);
4272a7ad07bfSEdward Tomasz Napierala 	prr = prison_racct_find_locked(name);
4273a7ad07bfSEdward Tomasz Napierala 	sx_xunlock(&allprison_lock);
4274a7ad07bfSEdward Tomasz Napierala 	return (prr);
4275a7ad07bfSEdward Tomasz Napierala }
4276a7ad07bfSEdward Tomasz Napierala 
4277a7ad07bfSEdward Tomasz Napierala void
4278a7ad07bfSEdward Tomasz Napierala prison_racct_hold(struct prison_racct *prr)
4279a7ad07bfSEdward Tomasz Napierala {
4280a7ad07bfSEdward Tomasz Napierala 
42814b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
42824b5c9cf6SEdward Tomasz Napierala 
4283a7ad07bfSEdward Tomasz Napierala 	refcount_acquire(&prr->prr_refcount);
4284a7ad07bfSEdward Tomasz Napierala }
4285a7ad07bfSEdward Tomasz Napierala 
4286c34bbd2aSEdward Tomasz Napierala static void
4287c34bbd2aSEdward Tomasz Napierala prison_racct_free_locked(struct prison_racct *prr)
4288c34bbd2aSEdward Tomasz Napierala {
4289c34bbd2aSEdward Tomasz Napierala 
42904b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
4291c34bbd2aSEdward Tomasz Napierala 	sx_assert(&allprison_lock, SA_XLOCKED);
4292c34bbd2aSEdward Tomasz Napierala 
4293c34bbd2aSEdward Tomasz Napierala 	if (refcount_release(&prr->prr_refcount)) {
4294c34bbd2aSEdward Tomasz Napierala 		racct_destroy(&prr->prr_racct);
4295c34bbd2aSEdward Tomasz Napierala 		LIST_REMOVE(prr, prr_next);
4296c34bbd2aSEdward Tomasz Napierala 		free(prr, M_PRISON_RACCT);
4297c34bbd2aSEdward Tomasz Napierala 	}
4298c34bbd2aSEdward Tomasz Napierala }
4299c34bbd2aSEdward Tomasz Napierala 
4300a7ad07bfSEdward Tomasz Napierala void
4301a7ad07bfSEdward Tomasz Napierala prison_racct_free(struct prison_racct *prr)
4302a7ad07bfSEdward Tomasz Napierala {
4303a7ad07bfSEdward Tomasz Napierala 
43044b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
4305c34bbd2aSEdward Tomasz Napierala 	sx_assert(&allprison_lock, SA_UNLOCKED);
4306c34bbd2aSEdward Tomasz Napierala 
43076ff4688bSMateusz Guzik 	if (refcount_release_if_not_last(&prr->prr_refcount))
4308a7ad07bfSEdward Tomasz Napierala 		return;
4309a7ad07bfSEdward Tomasz Napierala 
4310a7ad07bfSEdward Tomasz Napierala 	sx_xlock(&allprison_lock);
4311c34bbd2aSEdward Tomasz Napierala 	prison_racct_free_locked(prr);
4312a7ad07bfSEdward Tomasz Napierala 	sx_xunlock(&allprison_lock);
4313a7ad07bfSEdward Tomasz Napierala }
4314a7ad07bfSEdward Tomasz Napierala 
4315a7ad07bfSEdward Tomasz Napierala static void
4316a7ad07bfSEdward Tomasz Napierala prison_racct_attach(struct prison *pr)
4317a7ad07bfSEdward Tomasz Napierala {
4318a7ad07bfSEdward Tomasz Napierala 	struct prison_racct *prr;
4319a7ad07bfSEdward Tomasz Napierala 
43204b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
4321c34bbd2aSEdward Tomasz Napierala 	sx_assert(&allprison_lock, SA_XLOCKED);
4322c34bbd2aSEdward Tomasz Napierala 
4323a7ad07bfSEdward Tomasz Napierala 	prr = prison_racct_find_locked(pr->pr_name);
4324a7ad07bfSEdward Tomasz Napierala 	KASSERT(prr != NULL, ("cannot find prison_racct"));
4325a7ad07bfSEdward Tomasz Napierala 
4326a7ad07bfSEdward Tomasz Napierala 	pr->pr_prison_racct = prr;
4327a7ad07bfSEdward Tomasz Napierala }
4328a7ad07bfSEdward Tomasz Napierala 
4329c34bbd2aSEdward Tomasz Napierala /*
4330c34bbd2aSEdward Tomasz Napierala  * Handle jail renaming.  From the racct point of view, renaming means
4331c34bbd2aSEdward Tomasz Napierala  * moving from one prison_racct to another.
4332c34bbd2aSEdward Tomasz Napierala  */
4333c34bbd2aSEdward Tomasz Napierala static void
4334c34bbd2aSEdward Tomasz Napierala prison_racct_modify(struct prison *pr)
4335c34bbd2aSEdward Tomasz Napierala {
4336dbadb015SKonstantin Belousov #ifdef RCTL
4337c34bbd2aSEdward Tomasz Napierala 	struct proc *p;
4338c34bbd2aSEdward Tomasz Napierala 	struct ucred *cred;
4339dbadb015SKonstantin Belousov #endif
4340c34bbd2aSEdward Tomasz Napierala 	struct prison_racct *oldprr;
4341c34bbd2aSEdward Tomasz Napierala 
43424b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
43434b5c9cf6SEdward Tomasz Napierala 
4344c34bbd2aSEdward Tomasz Napierala 	sx_slock(&allproc_lock);
4345c34bbd2aSEdward Tomasz Napierala 	sx_xlock(&allprison_lock);
4346c34bbd2aSEdward Tomasz Napierala 
4347e30345e7SEdward Tomasz Napierala 	if (strcmp(pr->pr_name, pr->pr_prison_racct->prr_name) == 0) {
4348e30345e7SEdward Tomasz Napierala 		sx_xunlock(&allprison_lock);
4349e30345e7SEdward Tomasz Napierala 		sx_sunlock(&allproc_lock);
4350c34bbd2aSEdward Tomasz Napierala 		return;
4351e30345e7SEdward Tomasz Napierala 	}
4352c34bbd2aSEdward Tomasz Napierala 
4353c34bbd2aSEdward Tomasz Napierala 	oldprr = pr->pr_prison_racct;
4354c34bbd2aSEdward Tomasz Napierala 	pr->pr_prison_racct = NULL;
4355c34bbd2aSEdward Tomasz Napierala 
4356c34bbd2aSEdward Tomasz Napierala 	prison_racct_attach(pr);
4357c34bbd2aSEdward Tomasz Napierala 
4358c34bbd2aSEdward Tomasz Napierala 	/*
4359c34bbd2aSEdward Tomasz Napierala 	 * Move resource utilisation records.
4360c34bbd2aSEdward Tomasz Napierala 	 */
4361c34bbd2aSEdward Tomasz Napierala 	racct_move(pr->pr_prison_racct->prr_racct, oldprr->prr_racct);
4362c34bbd2aSEdward Tomasz Napierala 
4363f87beb93SAndriy Gapon #ifdef RCTL
4364c34bbd2aSEdward Tomasz Napierala 	/*
4365c34bbd2aSEdward Tomasz Napierala 	 * Force rctl to reattach rules to processes.
4366c34bbd2aSEdward Tomasz Napierala 	 */
4367c34bbd2aSEdward Tomasz Napierala 	FOREACH_PROC_IN_SYSTEM(p) {
4368c34bbd2aSEdward Tomasz Napierala 		PROC_LOCK(p);
4369c34bbd2aSEdward Tomasz Napierala 		cred = crhold(p->p_ucred);
4370c34bbd2aSEdward Tomasz Napierala 		PROC_UNLOCK(p);
4371f87beb93SAndriy Gapon 		rctl_proc_ucred_changed(p, cred);
4372c34bbd2aSEdward Tomasz Napierala 		crfree(cred);
4373c34bbd2aSEdward Tomasz Napierala 	}
4374f87beb93SAndriy Gapon #endif
4375c34bbd2aSEdward Tomasz Napierala 
4376c34bbd2aSEdward Tomasz Napierala 	sx_sunlock(&allproc_lock);
4377c34bbd2aSEdward Tomasz Napierala 	prison_racct_free_locked(oldprr);
4378c34bbd2aSEdward Tomasz Napierala 	sx_xunlock(&allprison_lock);
4379c34bbd2aSEdward Tomasz Napierala }
4380c34bbd2aSEdward Tomasz Napierala 
4381a7ad07bfSEdward Tomasz Napierala static void
4382a7ad07bfSEdward Tomasz Napierala prison_racct_detach(struct prison *pr)
4383a7ad07bfSEdward Tomasz Napierala {
4384c34bbd2aSEdward Tomasz Napierala 
43854b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
4386c34bbd2aSEdward Tomasz Napierala 	sx_assert(&allprison_lock, SA_UNLOCKED);
4387c34bbd2aSEdward Tomasz Napierala 
4388af3c786cSMateusz Guzik 	if (pr->pr_prison_racct == NULL)
4389af3c786cSMateusz Guzik 		return;
4390a7ad07bfSEdward Tomasz Napierala 	prison_racct_free(pr->pr_prison_racct);
4391a7ad07bfSEdward Tomasz Napierala 	pr->pr_prison_racct = NULL;
4392a7ad07bfSEdward Tomasz Napierala }
4393a7ad07bfSEdward Tomasz Napierala #endif /* RACCT */
4394a7ad07bfSEdward Tomasz Napierala 
4395413628a7SBjoern A. Zeeb #ifdef DDB
4396b38ff370SJamie Gritton 
4397b38ff370SJamie Gritton static void
4398b38ff370SJamie Gritton db_show_prison(struct prison *pr)
4399413628a7SBjoern A. Zeeb {
4400672756aaSJamie Gritton 	struct bool_flags *bf;
4401672756aaSJamie Gritton 	struct jailsys_flags *jsf;
4402b38ff370SJamie Gritton #if defined(INET) || defined(INET6)
4403b38ff370SJamie Gritton 	int ii;
4404413628a7SBjoern A. Zeeb #endif
4405672756aaSJamie Gritton 	unsigned f;
44068144690aSEric van Gyzen #ifdef INET
44078144690aSEric van Gyzen 	char ip4buf[INET_ADDRSTRLEN];
44088144690aSEric van Gyzen #endif
4409413628a7SBjoern A. Zeeb #ifdef INET6
4410413628a7SBjoern A. Zeeb 	char ip6buf[INET6_ADDRSTRLEN];
4411413628a7SBjoern A. Zeeb #endif
4412413628a7SBjoern A. Zeeb 
4413b38ff370SJamie Gritton 	db_printf("prison %p:\n", pr);
4414b38ff370SJamie Gritton 	db_printf(" jid             = %d\n", pr->pr_id);
4415b38ff370SJamie Gritton 	db_printf(" name            = %s\n", pr->pr_name);
44160304c731SJamie Gritton 	db_printf(" parent          = %p\n", pr->pr_parent);
4417b38ff370SJamie Gritton 	db_printf(" ref             = %d\n", pr->pr_ref);
4418b38ff370SJamie Gritton 	db_printf(" uref            = %d\n", pr->pr_uref);
4419*1158508aSJamie Gritton 	db_printf(" state           = %s\n",
4420*1158508aSJamie Gritton 	    pr->pr_state == PRISON_STATE_ALIVE ? "alive" :
4421*1158508aSJamie Gritton 	    pr->pr_state == PRISON_STATE_DYING ? "dying" :
4422*1158508aSJamie Gritton 	    "invalid");
4423b38ff370SJamie Gritton 	db_printf(" path            = %s\n", pr->pr_path);
4424b38ff370SJamie Gritton 	db_printf(" cpuset          = %d\n", pr->pr_cpuset
4425b38ff370SJamie Gritton 	    ? pr->pr_cpuset->cs_id : -1);
4426679e1390SJamie Gritton #ifdef VIMAGE
4427679e1390SJamie Gritton 	db_printf(" vnet            = %p\n", pr->pr_vnet);
4428679e1390SJamie Gritton #endif
4429b38ff370SJamie Gritton 	db_printf(" root            = %p\n", pr->pr_root);
4430b38ff370SJamie Gritton 	db_printf(" securelevel     = %d\n", pr->pr_securelevel);
44310cc207a6SMartin Matuska 	db_printf(" devfs_rsnum     = %d\n", pr->pr_devfs_rsnum);
4432fe0518e9SBjoern A. Zeeb 	db_printf(" children.max    = %d\n", pr->pr_childmax);
4433fe0518e9SBjoern A. Zeeb 	db_printf(" children.cur    = %d\n", pr->pr_childcount);
44340304c731SJamie Gritton 	db_printf(" child           = %p\n", LIST_FIRST(&pr->pr_children));
44350304c731SJamie Gritton 	db_printf(" sibling         = %p\n", LIST_NEXT(pr, pr_sibling));
4436fe0518e9SBjoern A. Zeeb 	db_printf(" flags           = 0x%x", pr->pr_flags);
4437672756aaSJamie Gritton 	for (bf = pr_flag_bool; bf < pr_flag_bool + nitems(pr_flag_bool); bf++)
4438672756aaSJamie Gritton 		if (pr->pr_flags & bf->flag)
4439672756aaSJamie Gritton 			db_printf(" %s", bf->name);
4440672756aaSJamie Gritton 	for (jsf = pr_flag_jailsys;
4441672756aaSJamie Gritton 	     jsf < pr_flag_jailsys + nitems(pr_flag_jailsys);
4442672756aaSJamie Gritton 	     jsf++) {
4443672756aaSJamie Gritton 		f = pr->pr_flags & (jsf->disable | jsf->new);
4444672756aaSJamie Gritton 		db_printf(" %-16s= %s\n", jsf->name,
4445672756aaSJamie Gritton 		    (f != 0 && f == jsf->disable) ? "disable"
4446672756aaSJamie Gritton 		    : (f == jsf->new) ? "new"
44477cbf7213SJamie Gritton 		    : "inherit");
44487cbf7213SJamie Gritton 	}
4449fe0518e9SBjoern A. Zeeb 	db_printf(" allow           = 0x%x", pr->pr_allow);
4450672756aaSJamie Gritton 	for (bf = pr_flag_allow;
44515d58f959SJamie Gritton 	     bf < pr_flag_allow + nitems(pr_flag_allow) &&
44525d58f959SJamie Gritton 		atomic_load_int(&bf->flag) != 0;
4453672756aaSJamie Gritton 	     bf++)
4454672756aaSJamie Gritton 		if (pr->pr_allow & bf->flag)
4455672756aaSJamie Gritton 			db_printf(" %s", bf->name);
4456b38ff370SJamie Gritton 	db_printf("\n");
44570304c731SJamie Gritton 	db_printf(" enforce_statfs  = %d\n", pr->pr_enforce_statfs);
4458c1f19219SJamie Gritton 	db_printf(" host.hostname   = %s\n", pr->pr_hostname);
4459c1f19219SJamie Gritton 	db_printf(" host.domainname = %s\n", pr->pr_domainname);
4460c1f19219SJamie Gritton 	db_printf(" host.hostuuid   = %s\n", pr->pr_hostuuid);
446176ca6f88SJamie Gritton 	db_printf(" host.hostid     = %lu\n", pr->pr_hostid);
4462413628a7SBjoern A. Zeeb #ifdef INET
4463b38ff370SJamie Gritton 	db_printf(" ip4s            = %d\n", pr->pr_ip4s);
4464b38ff370SJamie Gritton 	for (ii = 0; ii < pr->pr_ip4s; ii++)
4465b38ff370SJamie Gritton 		db_printf(" %s %s\n",
4466fe0518e9SBjoern A. Zeeb 		    ii == 0 ? "ip4.addr        =" : "                 ",
44678144690aSEric van Gyzen 		    inet_ntoa_r(pr->pr_ip4[ii], ip4buf));
4468413628a7SBjoern A. Zeeb #endif
4469413628a7SBjoern A. Zeeb #ifdef INET6
4470b38ff370SJamie Gritton 	db_printf(" ip6s            = %d\n", pr->pr_ip6s);
4471b38ff370SJamie Gritton 	for (ii = 0; ii < pr->pr_ip6s; ii++)
4472b38ff370SJamie Gritton 		db_printf(" %s %s\n",
4473fe0518e9SBjoern A. Zeeb 		    ii == 0 ? "ip6.addr        =" : "                 ",
4474b38ff370SJamie Gritton 		    ip6_sprintf(ip6buf, &pr->pr_ip6[ii]));
4475b38ff370SJamie Gritton #endif
4476b38ff370SJamie Gritton }
4477b38ff370SJamie Gritton 
4478b38ff370SJamie Gritton DB_SHOW_COMMAND(prison, db_show_prison_command)
4479b38ff370SJamie Gritton {
4480b38ff370SJamie Gritton 	struct prison *pr;
4481b38ff370SJamie Gritton 
4482b38ff370SJamie Gritton 	if (!have_addr) {
44830304c731SJamie Gritton 		/*
44840304c731SJamie Gritton 		 * Show all prisons in the list, and prison0 which is not
44850304c731SJamie Gritton 		 * listed.
44860304c731SJamie Gritton 		 */
44870304c731SJamie Gritton 		db_show_prison(&prison0);
44880304c731SJamie Gritton 		if (!db_pager_quit) {
4489b38ff370SJamie Gritton 			TAILQ_FOREACH(pr, &allprison, pr_list) {
4490b38ff370SJamie Gritton 				db_show_prison(pr);
4491413628a7SBjoern A. Zeeb 				if (db_pager_quit)
4492413628a7SBjoern A. Zeeb 					break;
4493413628a7SBjoern A. Zeeb 			}
44940304c731SJamie Gritton 		}
4495b38ff370SJamie Gritton 		return;
4496413628a7SBjoern A. Zeeb 	}
4497b38ff370SJamie Gritton 
44980304c731SJamie Gritton 	if (addr == 0)
44990304c731SJamie Gritton 		pr = &prison0;
45000304c731SJamie Gritton 	else {
4501b38ff370SJamie Gritton 		/* Look for a prison with the ID and with references. */
4502b38ff370SJamie Gritton 		TAILQ_FOREACH(pr, &allprison, pr_list)
4503b38ff370SJamie Gritton 			if (pr->pr_id == addr && pr->pr_ref > 0)
4504b38ff370SJamie Gritton 				break;
4505b38ff370SJamie Gritton 		if (pr == NULL)
4506b38ff370SJamie Gritton 			/* Look again, without requiring a reference. */
4507b38ff370SJamie Gritton 			TAILQ_FOREACH(pr, &allprison, pr_list)
4508b38ff370SJamie Gritton 				if (pr->pr_id == addr)
4509b38ff370SJamie Gritton 					break;
4510b38ff370SJamie Gritton 		if (pr == NULL)
4511b38ff370SJamie Gritton 			/* Assume address points to a valid prison. */
4512b38ff370SJamie Gritton 			pr = (struct prison *)addr;
45130304c731SJamie Gritton 	}
4514b38ff370SJamie Gritton 	db_show_prison(pr);
4515b38ff370SJamie Gritton }
4516b38ff370SJamie Gritton 
4517413628a7SBjoern A. Zeeb #endif /* DDB */
4518