19454b2d8SWarner Losh /*- 28a36da99SPedro F. Giffuni * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 38a36da99SPedro F. Giffuni * 4413628a7SBjoern A. Zeeb * Copyright (c) 1999 Poul-Henning Kamp. 5413628a7SBjoern A. Zeeb * Copyright (c) 2008 Bjoern A. Zeeb. 6b38ff370SJamie Gritton * Copyright (c) 2009 James Gritton. 7413628a7SBjoern A. Zeeb * All rights reserved. 8b9f0b66cSBjoern A. Zeeb * 9b9f0b66cSBjoern A. Zeeb * Redistribution and use in source and binary forms, with or without 10b9f0b66cSBjoern A. Zeeb * modification, are permitted provided that the following conditions 11b9f0b66cSBjoern A. Zeeb * are met: 12b9f0b66cSBjoern A. Zeeb * 1. Redistributions of source code must retain the above copyright 13b9f0b66cSBjoern A. Zeeb * notice, this list of conditions and the following disclaimer. 14b9f0b66cSBjoern A. Zeeb * 2. Redistributions in binary form must reproduce the above copyright 15b9f0b66cSBjoern A. Zeeb * notice, this list of conditions and the following disclaimer in the 16b9f0b66cSBjoern A. Zeeb * documentation and/or other materials provided with the distribution. 17b9f0b66cSBjoern A. Zeeb * 18b9f0b66cSBjoern A. Zeeb * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 19b9f0b66cSBjoern A. Zeeb * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20b9f0b66cSBjoern A. Zeeb * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21b9f0b66cSBjoern A. Zeeb * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 22b9f0b66cSBjoern A. Zeeb * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23b9f0b66cSBjoern A. Zeeb * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24b9f0b66cSBjoern A. Zeeb * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25b9f0b66cSBjoern A. Zeeb * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26b9f0b66cSBjoern A. Zeeb * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27b9f0b66cSBjoern A. Zeeb * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28b9f0b66cSBjoern A. Zeeb * SUCH DAMAGE. 2907901f22SPoul-Henning Kamp */ 3075c13541SPoul-Henning Kamp 31677b542eSDavid E. O'Brien #include <sys/cdefs.h> 32677b542eSDavid E. O'Brien __FBSDID("$FreeBSD$"); 33677b542eSDavid E. O'Brien 34413628a7SBjoern A. Zeeb #include "opt_ddb.h" 35413628a7SBjoern A. Zeeb #include "opt_inet.h" 36413628a7SBjoern A. Zeeb #include "opt_inet6.h" 3746e3b1cbSPawel Jakub Dawidek 3875c13541SPoul-Henning Kamp #include <sys/param.h> 3975c13541SPoul-Henning Kamp #include <sys/types.h> 4075c13541SPoul-Henning Kamp #include <sys/kernel.h> 4175c13541SPoul-Henning Kamp #include <sys/systm.h> 4275c13541SPoul-Henning Kamp #include <sys/errno.h> 4375c13541SPoul-Henning Kamp #include <sys/sysproto.h> 4475c13541SPoul-Henning Kamp #include <sys/malloc.h> 450304c731SJamie Gritton #include <sys/osd.h> 46800c9408SRobert Watson #include <sys/priv.h> 4775c13541SPoul-Henning Kamp #include <sys/proc.h> 48b3059e09SRobert Watson #include <sys/taskqueue.h> 4957b4252eSKonstantin Belousov #include <sys/fcntl.h> 5075c13541SPoul-Henning Kamp #include <sys/jail.h> 51c3188289SKyle Evans #include <sys/linker.h> 5201137630SRobert Watson #include <sys/lock.h> 5301137630SRobert Watson #include <sys/mutex.h> 54097055e2SEdward Tomasz Napierala #include <sys/racct.h> 55f87beb93SAndriy Gapon #include <sys/rctl.h> 56a7ad07bfSEdward Tomasz Napierala #include <sys/refcount.h> 57dc68a633SPawel Jakub Dawidek #include <sys/sx.h> 5876ca6f88SJamie Gritton #include <sys/sysent.h> 59fd7a8150SMike Barcroft #include <sys/namei.h> 60820a0de9SPawel Jakub Dawidek #include <sys/mount.h> 61fd7a8150SMike Barcroft #include <sys/queue.h> 6275c13541SPoul-Henning Kamp #include <sys/socket.h> 63fd7a8150SMike Barcroft #include <sys/syscallsubr.h> 6483f1e257SRobert Watson #include <sys/sysctl.h> 65c3188289SKyle Evans #include <sys/uuid.h> 66fd7a8150SMike Barcroft #include <sys/vnode.h> 67530c0060SRobert Watson 6875c13541SPoul-Henning Kamp #include <net/if.h> 69530c0060SRobert Watson #include <net/vnet.h> 70530c0060SRobert Watson 7175c13541SPoul-Henning Kamp #include <netinet/in.h> 72530c0060SRobert Watson 73413628a7SBjoern A. Zeeb #ifdef DDB 74413628a7SBjoern A. Zeeb #include <ddb/ddb.h> 75413628a7SBjoern A. Zeeb #endif /* DDB */ 7675c13541SPoul-Henning Kamp 77aed55708SRobert Watson #include <security/mac/mac_framework.h> 78aed55708SRobert Watson 798986e3a0SJamie Gritton #define DEFAULT_HOSTUUID "00000000-0000-0000-0000-000000000000" 80c3188289SKyle Evans #define PRISON0_HOSTUUID_MODULE "hostuuid" 818986e3a0SJamie Gritton 8275c13541SPoul-Henning Kamp MALLOC_DEFINE(M_PRISON, "prison", "Prison structures"); 83d745c852SEd Schouten static MALLOC_DEFINE(M_PRISON_RACCT, "prison_racct", "Prison racct structures"); 8475c13541SPoul-Henning Kamp 85592bcae8SBjoern A. Zeeb /* Keep struct prison prison0 and some code in kern_jail_set() readable. */ 86592bcae8SBjoern A. Zeeb #ifdef INET 87592bcae8SBjoern A. Zeeb #ifdef INET6 88592bcae8SBjoern A. Zeeb #define _PR_IP_SADDRSEL PR_IP4_SADDRSEL|PR_IP6_SADDRSEL 89592bcae8SBjoern A. Zeeb #else 90592bcae8SBjoern A. Zeeb #define _PR_IP_SADDRSEL PR_IP4_SADDRSEL 91592bcae8SBjoern A. Zeeb #endif 92592bcae8SBjoern A. Zeeb #else /* !INET */ 93592bcae8SBjoern A. Zeeb #ifdef INET6 94592bcae8SBjoern A. Zeeb #define _PR_IP_SADDRSEL PR_IP6_SADDRSEL 95592bcae8SBjoern A. Zeeb #else 96592bcae8SBjoern A. Zeeb #define _PR_IP_SADDRSEL 0 97592bcae8SBjoern A. Zeeb #endif 98592bcae8SBjoern A. Zeeb #endif 99592bcae8SBjoern A. Zeeb 1000304c731SJamie Gritton /* prison0 describes what is "real" about the system. */ 1010304c731SJamie Gritton struct prison prison0 = { 1020304c731SJamie Gritton .pr_id = 0, 1030304c731SJamie Gritton .pr_name = "0", 1040304c731SJamie Gritton .pr_ref = 1, 1050304c731SJamie Gritton .pr_uref = 1, 1060304c731SJamie Gritton .pr_path = "/", 1070304c731SJamie Gritton .pr_securelevel = -1, 1080cc207a6SMartin Matuska .pr_devfs_rsnum = 0, 109*1158508aSJamie Gritton .pr_state = PRISON_STATE_ALIVE, 110b97457e2SJamie Gritton .pr_childmax = JAIL_MAX, 1118986e3a0SJamie Gritton .pr_hostuuid = DEFAULT_HOSTUUID, 11213e403fdSAntoine Brodin .pr_children = LIST_HEAD_INITIALIZER(prison0.pr_children), 113eb79e1c7SBjoern A. Zeeb #ifdef VIMAGE 114592bcae8SBjoern A. Zeeb .pr_flags = PR_HOST|PR_VNET|_PR_IP_SADDRSEL, 115eb79e1c7SBjoern A. Zeeb #else 116592bcae8SBjoern A. Zeeb .pr_flags = PR_HOST|_PR_IP_SADDRSEL, 117eb79e1c7SBjoern A. Zeeb #endif 1180e5c6bd4SJamie Gritton .pr_allow = PR_ALLOW_ALL_STATIC, 1190304c731SJamie Gritton }; 1200304c731SJamie Gritton MTX_SYSINIT(prison0, &prison0.pr_mtx, "jail mutex", MTX_DEF); 12183f1e257SRobert Watson 122672756aaSJamie Gritton struct bool_flags { 123672756aaSJamie Gritton const char *name; 124672756aaSJamie Gritton const char *noname; 1255d58f959SJamie Gritton volatile u_int flag; 126672756aaSJamie Gritton }; 127672756aaSJamie Gritton struct jailsys_flags { 128672756aaSJamie Gritton const char *name; 129672756aaSJamie Gritton unsigned disable; 130672756aaSJamie Gritton unsigned new; 131672756aaSJamie Gritton }; 132672756aaSJamie Gritton 133a7ad07bfSEdward Tomasz Napierala /* allprison, allprison_racct and lastprid are protected by allprison_lock. */ 134dc68a633SPawel Jakub Dawidek struct sx allprison_lock; 135b38ff370SJamie Gritton SX_SYSINIT(allprison_lock, &allprison_lock, "allprison"); 136b38ff370SJamie Gritton struct prisonlist allprison = TAILQ_HEAD_INITIALIZER(allprison); 137a7ad07bfSEdward Tomasz Napierala LIST_HEAD(, prison_racct) allprison_racct; 1382110d913SXin LI int lastprid = 0; 139fd7a8150SMike Barcroft 1407de883c8SJamie Gritton static int get_next_prid(struct prison **insprp); 141f7496dcaSJamie Gritton static int do_jail_attach(struct thread *td, struct prison *pr, int drflags); 142b3059e09SRobert Watson static void prison_complete(void *context, int pending); 143b38ff370SJamie Gritton static void prison_deref(struct prison *pr, int flags); 144f7496dcaSJamie Gritton static int prison_lock_xlock(struct prison *pr, int flags); 145f7496dcaSJamie Gritton static void prison_free_not_last(struct prison *pr); 1460fe74ae6SJamie Gritton static void prison_set_allow_locked(struct prison *pr, unsigned flag, 1470fe74ae6SJamie Gritton int enable); 1480304c731SJamie Gritton static char *prison_path(struct prison *pr1, struct prison *pr2); 1490304c731SJamie Gritton static void prison_remove_one(struct prison *pr); 150a7ad07bfSEdward Tomasz Napierala #ifdef RACCT 151a7ad07bfSEdward Tomasz Napierala static void prison_racct_attach(struct prison *pr); 152c34bbd2aSEdward Tomasz Napierala static void prison_racct_modify(struct prison *pr); 153a7ad07bfSEdward Tomasz Napierala static void prison_racct_detach(struct prison *pr); 154a7ad07bfSEdward Tomasz Napierala #endif 155fd7a8150SMike Barcroft 156b38ff370SJamie Gritton /* Flags for prison_deref */ 1572a4b2251SJamie Gritton #define PD_DEREF 0x01 /* Decrement pr_ref */ 1582a4b2251SJamie Gritton #define PD_DEUREF 0x02 /* Decrement pr_uref */ 1592a4b2251SJamie Gritton #define PD_LOCKED 0x04 /* pr_mtx is held */ 1602a4b2251SJamie Gritton #define PD_LIST_SLOCKED 0x08 /* allprison_lock is held shared */ 1612a4b2251SJamie Gritton #define PD_LIST_XLOCKED 0x10 /* allprison_lock is held exclusive */ 162fd7a8150SMike Barcroft 1630304c731SJamie Gritton /* 1645cc70397SBjoern A. Zeeb * Parameter names corresponding to PR_* flag values. Size values are for kvm 1655cc70397SBjoern A. Zeeb * as we cannot figure out the size of a sparse array, or an array without a 1665cc70397SBjoern A. Zeeb * terminating entry. 1670304c731SJamie Gritton */ 168672756aaSJamie Gritton static struct bool_flags pr_flag_bool[] = { 169672756aaSJamie Gritton {"persist", "nopersist", PR_PERSIST}, 170592bcae8SBjoern A. Zeeb #ifdef INET 171672756aaSJamie Gritton {"ip4.saddrsel", "ip4.nosaddrsel", PR_IP4_SADDRSEL}, 172592bcae8SBjoern A. Zeeb #endif 173592bcae8SBjoern A. Zeeb #ifdef INET6 174672756aaSJamie Gritton {"ip6.saddrsel", "ip6.nosaddrsel", PR_IP6_SADDRSEL}, 175592bcae8SBjoern A. Zeeb #endif 1760304c731SJamie Gritton }; 177672756aaSJamie Gritton const size_t pr_flag_bool_size = sizeof(pr_flag_bool); 1780304c731SJamie Gritton 179672756aaSJamie Gritton static struct jailsys_flags pr_flag_jailsys[] = { 1807cbf7213SJamie Gritton {"host", 0, PR_HOST}, 1817cbf7213SJamie Gritton #ifdef VIMAGE 1827cbf7213SJamie Gritton {"vnet", 0, PR_VNET}, 1837cbf7213SJamie Gritton #endif 1840304c731SJamie Gritton #ifdef INET 1856a3f2779SJamie Gritton {"ip4", PR_IP4_USER, PR_IP4_USER}, 1860304c731SJamie Gritton #endif 1870304c731SJamie Gritton #ifdef INET6 1886a3f2779SJamie Gritton {"ip6", PR_IP6_USER, PR_IP6_USER}, 189679e1390SJamie Gritton #endif 1900304c731SJamie Gritton }; 1915cc70397SBjoern A. Zeeb const size_t pr_flag_jailsys_size = sizeof(pr_flag_jailsys); 1920304c731SJamie Gritton 1935d58f959SJamie Gritton /* 1945d58f959SJamie Gritton * Make this array full-size so dynamic parameters can be added. 1955d58f959SJamie Gritton * It is protected by prison0.mtx, but lockless reading is allowed 1965d58f959SJamie Gritton * with an atomic check of the flag values. 1975d58f959SJamie Gritton */ 1980e5c6bd4SJamie Gritton static struct bool_flags pr_flag_allow[NBBY * NBPW] = { 199672756aaSJamie Gritton {"allow.set_hostname", "allow.noset_hostname", PR_ALLOW_SET_HOSTNAME}, 200672756aaSJamie Gritton {"allow.sysvipc", "allow.nosysvipc", PR_ALLOW_SYSVIPC}, 201672756aaSJamie Gritton {"allow.raw_sockets", "allow.noraw_sockets", PR_ALLOW_RAW_SOCKETS}, 202672756aaSJamie Gritton {"allow.chflags", "allow.nochflags", PR_ALLOW_CHFLAGS}, 203672756aaSJamie Gritton {"allow.mount", "allow.nomount", PR_ALLOW_MOUNT}, 204672756aaSJamie Gritton {"allow.quotas", "allow.noquotas", PR_ALLOW_QUOTAS}, 205672756aaSJamie Gritton {"allow.socket_af", "allow.nosocket_af", PR_ALLOW_SOCKET_AF}, 206ccd6ac9fSAntoine Brodin {"allow.mlock", "allow.nomlock", PR_ALLOW_MLOCK}, 207672756aaSJamie Gritton {"allow.reserved_ports", "allow.noreserved_ports", 208672756aaSJamie Gritton PR_ALLOW_RESERVED_PORTS}, 209b19d66fdSJamie Gritton {"allow.read_msgbuf", "allow.noread_msgbuf", PR_ALLOW_READ_MSGBUF}, 210b3079544SJamie Gritton {"allow.unprivileged_proc_debug", "allow.nounprivileged_proc_debug", 211b3079544SJamie Gritton PR_ALLOW_UNPRIV_DEBUG}, 21205e1e482SMariusz Zaborski {"allow.suser", "allow.nosuser", PR_ALLOW_SUSER}, 2130304c731SJamie Gritton }; 2145d58f959SJamie Gritton static unsigned pr_allow_all = PR_ALLOW_ALL_STATIC; 215672756aaSJamie Gritton const size_t pr_flag_allow_size = sizeof(pr_flag_allow); 2160304c731SJamie Gritton 217b3079544SJamie Gritton #define JAIL_DEFAULT_ALLOW (PR_ALLOW_SET_HOSTNAME | \ 218b3079544SJamie Gritton PR_ALLOW_RESERVED_PORTS | \ 21905e1e482SMariusz Zaborski PR_ALLOW_UNPRIV_DEBUG | \ 22005e1e482SMariusz Zaborski PR_ALLOW_SUSER) 22142bebd82SJamie Gritton #define JAIL_DEFAULT_ENFORCE_STATFS 2 222bf3db8aaSMartin Matuska #define JAIL_DEFAULT_DEVFS_RSNUM 0 2230304c731SJamie Gritton static unsigned jail_default_allow = JAIL_DEFAULT_ALLOW; 22442bebd82SJamie Gritton static int jail_default_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS; 2250cc207a6SMartin Matuska static int jail_default_devfs_rsnum = JAIL_DEFAULT_DEVFS_RSNUM; 2260304c731SJamie Gritton #if defined(INET) || defined(INET6) 227e92e0574SJamie Gritton static unsigned jail_max_af_ips = 255; 2280304c731SJamie Gritton #endif 2290304c731SJamie Gritton 230b96bd95bSIan Lepore /* 231b96bd95bSIan Lepore * Initialize the parts of prison0 that can't be static-initialized with 232b96bd95bSIan Lepore * constants. This is called from proc0_init() after creating thread0 cpuset. 233b96bd95bSIan Lepore */ 234b96bd95bSIan Lepore void 235b96bd95bSIan Lepore prison0_init(void) 236b96bd95bSIan Lepore { 237c3188289SKyle Evans uint8_t *file, *data; 238c3188289SKyle Evans size_t size; 239b96bd95bSIan Lepore 240b96bd95bSIan Lepore prison0.pr_cpuset = cpuset_ref(thread0.td_cpuset); 241b96bd95bSIan Lepore prison0.pr_osreldate = osreldate; 242b96bd95bSIan Lepore strlcpy(prison0.pr_osrelease, osrelease, sizeof(prison0.pr_osrelease)); 243c3188289SKyle Evans 244c3188289SKyle Evans /* If we have a preloaded hostuuid, use it. */ 245c3188289SKyle Evans file = preload_search_by_type(PRISON0_HOSTUUID_MODULE); 246c3188289SKyle Evans if (file != NULL) { 247c3188289SKyle Evans data = preload_fetch_addr(file); 248c3188289SKyle Evans size = preload_fetch_size(file); 249c3188289SKyle Evans if (data != NULL) { 250c3188289SKyle Evans /* 251c3188289SKyle Evans * The preloaded data may include trailing whitespace, almost 252c3188289SKyle Evans * certainly a newline; skip over any whitespace or 253c3188289SKyle Evans * non-printable characters to be safe. 254c3188289SKyle Evans */ 255c3188289SKyle Evans while (size > 0 && data[size - 1] <= 0x20) { 256c3188289SKyle Evans data[size--] = '\0'; 257c3188289SKyle Evans } 258c3188289SKyle Evans if (validate_uuid(data, size, NULL, 0) == 0) { 259c3188289SKyle Evans (void)strlcpy(prison0.pr_hostuuid, data, 260c3188289SKyle Evans size + 1); 261c3188289SKyle Evans } else if (bootverbose) { 262c3188289SKyle Evans printf("hostuuid: preload data malformed: '%s'", 263c3188289SKyle Evans data); 264c3188289SKyle Evans } 265c3188289SKyle Evans } 266c3188289SKyle Evans } 267c3188289SKyle Evans if (bootverbose) 268c3188289SKyle Evans printf("hostuuid: using %s\n", prison0.pr_hostuuid); 269b96bd95bSIan Lepore } 270b96bd95bSIan Lepore 271116734c4SMatthew Dillon /* 2729ddb7954SMike Barcroft * struct jail_args { 2739ddb7954SMike Barcroft * struct jail *jail; 2749ddb7954SMike Barcroft * }; 275116734c4SMatthew Dillon */ 27675c13541SPoul-Henning Kamp int 277c542c43eSJamie Gritton sys_jail(struct thread *td, struct jail_args *uap) 27875c13541SPoul-Henning Kamp { 279413628a7SBjoern A. Zeeb uint32_t version; 280413628a7SBjoern A. Zeeb int error; 2810304c731SJamie Gritton struct jail j; 282413628a7SBjoern A. Zeeb 283413628a7SBjoern A. Zeeb error = copyin(uap->jail, &version, sizeof(uint32_t)); 284413628a7SBjoern A. Zeeb if (error) 285413628a7SBjoern A. Zeeb return (error); 286413628a7SBjoern A. Zeeb 287413628a7SBjoern A. Zeeb switch (version) { 288413628a7SBjoern A. Zeeb case 0: 289413628a7SBjoern A. Zeeb { 290413628a7SBjoern A. Zeeb struct jail_v0 j0; 291413628a7SBjoern A. Zeeb 2920304c731SJamie Gritton /* FreeBSD single IPv4 jails. */ 2930304c731SJamie Gritton bzero(&j, sizeof(struct jail)); 294413628a7SBjoern A. Zeeb error = copyin(uap->jail, &j0, sizeof(struct jail_v0)); 295413628a7SBjoern A. Zeeb if (error) 296413628a7SBjoern A. Zeeb return (error); 2970304c731SJamie Gritton j.version = j0.version; 2980304c731SJamie Gritton j.path = j0.path; 2990304c731SJamie Gritton j.hostname = j0.hostname; 300b5019bc4SPeter Wemm j.ip4s = htonl(j0.ip_number); /* jail_v0 is host order */ 301413628a7SBjoern A. Zeeb break; 302413628a7SBjoern A. Zeeb } 303413628a7SBjoern A. Zeeb 304413628a7SBjoern A. Zeeb case 1: 305413628a7SBjoern A. Zeeb /* 306413628a7SBjoern A. Zeeb * Version 1 was used by multi-IPv4 jail implementations 307413628a7SBjoern A. Zeeb * that never made it into the official kernel. 308413628a7SBjoern A. Zeeb */ 309413628a7SBjoern A. Zeeb return (EINVAL); 310413628a7SBjoern A. Zeeb 311413628a7SBjoern A. Zeeb case 2: /* JAIL_API_VERSION */ 312413628a7SBjoern A. Zeeb /* FreeBSD multi-IPv4/IPv6,noIP jails. */ 313413628a7SBjoern A. Zeeb error = copyin(uap->jail, &j, sizeof(struct jail)); 314413628a7SBjoern A. Zeeb if (error) 315413628a7SBjoern A. Zeeb return (error); 3160304c731SJamie Gritton break; 3170304c731SJamie Gritton 3180304c731SJamie Gritton default: 3190304c731SJamie Gritton /* Sci-Fi jails are not supported, sorry. */ 3200304c731SJamie Gritton return (EINVAL); 3210304c731SJamie Gritton } 322c542c43eSJamie Gritton return (kern_jail(td, &j)); 3230304c731SJamie Gritton } 3240304c731SJamie Gritton 3250304c731SJamie Gritton int 326c542c43eSJamie Gritton kern_jail(struct thread *td, struct jail *j) 3270304c731SJamie Gritton { 328c542c43eSJamie Gritton struct iovec optiov[2 * (4 + nitems(pr_flag_allow) 329e92e0574SJamie Gritton #ifdef INET 330e92e0574SJamie Gritton + 1 331e92e0574SJamie Gritton #endif 332e92e0574SJamie Gritton #ifdef INET6 333e92e0574SJamie Gritton + 1 334e92e0574SJamie Gritton #endif 335e92e0574SJamie Gritton )]; 3360304c731SJamie Gritton struct uio opt; 3370304c731SJamie Gritton char *u_path, *u_hostname, *u_name; 338672756aaSJamie Gritton struct bool_flags *bf; 3390304c731SJamie Gritton #ifdef INET 340e92e0574SJamie Gritton uint32_t ip4s; 3410304c731SJamie Gritton struct in_addr *u_ip4; 3420304c731SJamie Gritton #endif 3430304c731SJamie Gritton #ifdef INET6 3440304c731SJamie Gritton struct in6_addr *u_ip6; 3450304c731SJamie Gritton #endif 3460304c731SJamie Gritton size_t tmplen; 347c542c43eSJamie Gritton int error, enforce_statfs; 3480304c731SJamie Gritton 3490304c731SJamie Gritton bzero(&optiov, sizeof(optiov)); 3500304c731SJamie Gritton opt.uio_iov = optiov; 3510304c731SJamie Gritton opt.uio_iovcnt = 0; 3520304c731SJamie Gritton opt.uio_offset = -1; 3530304c731SJamie Gritton opt.uio_resid = -1; 3540304c731SJamie Gritton opt.uio_segflg = UIO_SYSSPACE; 3550304c731SJamie Gritton opt.uio_rw = UIO_READ; 3560304c731SJamie Gritton opt.uio_td = td; 3570304c731SJamie Gritton 3580304c731SJamie Gritton /* Set permissions for top-level jails from sysctls. */ 3590304c731SJamie Gritton if (!jailed(td->td_ucred)) { 360672756aaSJamie Gritton for (bf = pr_flag_allow; 3610e5c6bd4SJamie Gritton bf < pr_flag_allow + nitems(pr_flag_allow) && 3625d58f959SJamie Gritton atomic_load_int(&bf->flag) != 0; 363672756aaSJamie Gritton bf++) { 364672756aaSJamie Gritton optiov[opt.uio_iovcnt].iov_base = __DECONST(char *, 365672756aaSJamie Gritton (jail_default_allow & bf->flag) 366672756aaSJamie Gritton ? bf->name : bf->noname); 3670304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = 3680304c731SJamie Gritton strlen(optiov[opt.uio_iovcnt].iov_base) + 1; 3690304c731SJamie Gritton opt.uio_iovcnt += 2; 3700304c731SJamie Gritton } 3710304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "enforce_statfs"; 3720304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("enforce_statfs"); 3730304c731SJamie Gritton opt.uio_iovcnt++; 3740304c731SJamie Gritton enforce_statfs = jail_default_enforce_statfs; 3750304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = &enforce_statfs; 3760304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof(enforce_statfs); 3770304c731SJamie Gritton opt.uio_iovcnt++; 3780304c731SJamie Gritton } 3790304c731SJamie Gritton 380b38ff370SJamie Gritton tmplen = MAXPATHLEN + MAXHOSTNAMELEN + MAXHOSTNAMELEN; 381b38ff370SJamie Gritton #ifdef INET 3820304c731SJamie Gritton ip4s = (j->version == 0) ? 1 : j->ip4s; 3830304c731SJamie Gritton if (ip4s > jail_max_af_ips) 384b38ff370SJamie Gritton return (EINVAL); 3850304c731SJamie Gritton tmplen += ip4s * sizeof(struct in_addr); 386b38ff370SJamie Gritton #else 3870304c731SJamie Gritton if (j->ip4s > 0) 388b38ff370SJamie Gritton return (EINVAL); 389b38ff370SJamie Gritton #endif 390b38ff370SJamie Gritton #ifdef INET6 3910304c731SJamie Gritton if (j->ip6s > jail_max_af_ips) 392b38ff370SJamie Gritton return (EINVAL); 3930304c731SJamie Gritton tmplen += j->ip6s * sizeof(struct in6_addr); 394b38ff370SJamie Gritton #else 3950304c731SJamie Gritton if (j->ip6s > 0) 396b38ff370SJamie Gritton return (EINVAL); 397b38ff370SJamie Gritton #endif 398b38ff370SJamie Gritton u_path = malloc(tmplen, M_TEMP, M_WAITOK); 399b38ff370SJamie Gritton u_hostname = u_path + MAXPATHLEN; 400b38ff370SJamie Gritton u_name = u_hostname + MAXHOSTNAMELEN; 401b38ff370SJamie Gritton #ifdef INET 402b38ff370SJamie Gritton u_ip4 = (struct in_addr *)(u_name + MAXHOSTNAMELEN); 403b38ff370SJamie Gritton #endif 404b38ff370SJamie Gritton #ifdef INET6 405b38ff370SJamie Gritton #ifdef INET 4060304c731SJamie Gritton u_ip6 = (struct in6_addr *)(u_ip4 + ip4s); 407b38ff370SJamie Gritton #else 408b38ff370SJamie Gritton u_ip6 = (struct in6_addr *)(u_name + MAXHOSTNAMELEN); 409b38ff370SJamie Gritton #endif 410b38ff370SJamie Gritton #endif 4110304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "path"; 4120304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("path"); 4130304c731SJamie Gritton opt.uio_iovcnt++; 4140304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = u_path; 4150304c731SJamie Gritton error = copyinstr(j->path, u_path, MAXPATHLEN, 4160304c731SJamie Gritton &optiov[opt.uio_iovcnt].iov_len); 417b38ff370SJamie Gritton if (error) { 418b38ff370SJamie Gritton free(u_path, M_TEMP); 419b38ff370SJamie Gritton return (error); 420b38ff370SJamie Gritton } 4210304c731SJamie Gritton opt.uio_iovcnt++; 4220304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "host.hostname"; 4230304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("host.hostname"); 4240304c731SJamie Gritton opt.uio_iovcnt++; 4250304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = u_hostname; 4260304c731SJamie Gritton error = copyinstr(j->hostname, u_hostname, MAXHOSTNAMELEN, 4270304c731SJamie Gritton &optiov[opt.uio_iovcnt].iov_len); 428b38ff370SJamie Gritton if (error) { 429b38ff370SJamie Gritton free(u_path, M_TEMP); 430b38ff370SJamie Gritton return (error); 431b38ff370SJamie Gritton } 4320304c731SJamie Gritton opt.uio_iovcnt++; 4330304c731SJamie Gritton if (j->jailname != NULL) { 434b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "name"; 435b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("name"); 436b38ff370SJamie Gritton opt.uio_iovcnt++; 437b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = u_name; 4380304c731SJamie Gritton error = copyinstr(j->jailname, u_name, MAXHOSTNAMELEN, 439b38ff370SJamie Gritton &optiov[opt.uio_iovcnt].iov_len); 440b38ff370SJamie Gritton if (error) { 441b38ff370SJamie Gritton free(u_path, M_TEMP); 442b38ff370SJamie Gritton return (error); 443b38ff370SJamie Gritton } 444b38ff370SJamie Gritton opt.uio_iovcnt++; 445b38ff370SJamie Gritton } 446b38ff370SJamie Gritton #ifdef INET 447b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "ip4.addr"; 448b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("ip4.addr"); 449b38ff370SJamie Gritton opt.uio_iovcnt++; 450b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = u_ip4; 4510304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = ip4s * sizeof(struct in_addr); 4520304c731SJamie Gritton if (j->version == 0) 4530304c731SJamie Gritton u_ip4->s_addr = j->ip4s; 4540304c731SJamie Gritton else { 4550304c731SJamie Gritton error = copyin(j->ip4, u_ip4, optiov[opt.uio_iovcnt].iov_len); 456b38ff370SJamie Gritton if (error) { 457b38ff370SJamie Gritton free(u_path, M_TEMP); 458b38ff370SJamie Gritton return (error); 459b38ff370SJamie Gritton } 4600304c731SJamie Gritton } 461b38ff370SJamie Gritton opt.uio_iovcnt++; 462b38ff370SJamie Gritton #endif 463b38ff370SJamie Gritton #ifdef INET6 464b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "ip6.addr"; 465b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("ip6.addr"); 466b38ff370SJamie Gritton opt.uio_iovcnt++; 467b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = u_ip6; 4680304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = j->ip6s * sizeof(struct in6_addr); 4690304c731SJamie Gritton error = copyin(j->ip6, u_ip6, optiov[opt.uio_iovcnt].iov_len); 470b38ff370SJamie Gritton if (error) { 471b38ff370SJamie Gritton free(u_path, M_TEMP); 472b38ff370SJamie Gritton return (error); 473b38ff370SJamie Gritton } 474b38ff370SJamie Gritton opt.uio_iovcnt++; 475b38ff370SJamie Gritton #endif 47602abd400SPedro F. Giffuni KASSERT(opt.uio_iovcnt <= nitems(optiov), 4770304c731SJamie Gritton ("kern_jail: too many iovecs (%d)", opt.uio_iovcnt)); 478b38ff370SJamie Gritton error = kern_jail_set(td, &opt, JAIL_CREATE | JAIL_ATTACH); 479b38ff370SJamie Gritton free(u_path, M_TEMP); 480b38ff370SJamie Gritton return (error); 481b38ff370SJamie Gritton } 482b38ff370SJamie Gritton 483b38ff370SJamie Gritton /* 484b38ff370SJamie Gritton * struct jail_set_args { 485b38ff370SJamie Gritton * struct iovec *iovp; 486b38ff370SJamie Gritton * unsigned int iovcnt; 487b38ff370SJamie Gritton * int flags; 488b38ff370SJamie Gritton * }; 489b38ff370SJamie Gritton */ 490b38ff370SJamie Gritton int 4918451d0ddSKip Macy sys_jail_set(struct thread *td, struct jail_set_args *uap) 492b38ff370SJamie Gritton { 493b38ff370SJamie Gritton struct uio *auio; 494b38ff370SJamie Gritton int error; 495b38ff370SJamie Gritton 496b38ff370SJamie Gritton /* Check that we have an even number of iovecs. */ 497b38ff370SJamie Gritton if (uap->iovcnt & 1) 498b38ff370SJamie Gritton return (EINVAL); 499b38ff370SJamie Gritton 500b38ff370SJamie Gritton error = copyinuio(uap->iovp, uap->iovcnt, &auio); 501b38ff370SJamie Gritton if (error) 502b38ff370SJamie Gritton return (error); 503b38ff370SJamie Gritton error = kern_jail_set(td, auio, uap->flags); 504b38ff370SJamie Gritton free(auio, M_IOV); 505b38ff370SJamie Gritton return (error); 506413628a7SBjoern A. Zeeb } 507413628a7SBjoern A. Zeeb 508413628a7SBjoern A. Zeeb int 509b38ff370SJamie Gritton kern_jail_set(struct thread *td, struct uio *optuio, int flags) 510413628a7SBjoern A. Zeeb { 511fd7a8150SMike Barcroft struct nameidata nd; 512b38ff370SJamie Gritton #ifdef INET 513b38ff370SJamie Gritton struct in_addr *ip4; 514413628a7SBjoern A. Zeeb #endif 515b38ff370SJamie Gritton #ifdef INET6 516b38ff370SJamie Gritton struct in6_addr *ip6; 517b38ff370SJamie Gritton #endif 518b38ff370SJamie Gritton struct vfsopt *opt; 519b38ff370SJamie Gritton struct vfsoptlist *opts; 5207de883c8SJamie Gritton struct prison *pr, *deadpr, *inspr, *mypr, *ppr, *tpr; 521b38ff370SJamie Gritton struct vnode *root; 522babbbb9cSJamie Gritton char *domain, *errmsg, *host, *name, *namelc, *p, *path, *uuid; 523b96bd95bSIan Lepore char *g_path, *osrelstr; 524672756aaSJamie Gritton struct bool_flags *bf; 525672756aaSJamie Gritton struct jailsys_flags *jsf; 5260304c731SJamie Gritton #if defined(INET) || defined(INET6) 52757aea6dfSBjoern A. Zeeb struct prison *tppr; 528b38ff370SJamie Gritton void *op; 5290304c731SJamie Gritton #endif 53076ca6f88SJamie Gritton unsigned long hid; 531b6f47c23SJamie Gritton size_t namelen, onamelen, pnamelen; 5322a4b2251SJamie Gritton int born, created, cuflags, descend, drflags, enforce; 533cc5fd8c7SJamie Gritton int error, errmsg_len, errmsg_pos; 5340cc207a6SMartin Matuska int gotchildmax, gotenforce, gothid, gotrsnum, gotslevel; 535672756aaSJamie Gritton int jid, jsys, len, level; 536b96bd95bSIan Lepore int childmax, osreldt, rsnum, slevel; 537d465a41dSBjoern A. Zeeb #if defined(INET) || defined(INET6) 5380304c731SJamie Gritton int ii, ij; 539413628a7SBjoern A. Zeeb #endif 540413628a7SBjoern A. Zeeb #ifdef INET 5412b0d6f81SJamie Gritton int ip4s, redo_ip4; 542413628a7SBjoern A. Zeeb #endif 543b38ff370SJamie Gritton #ifdef INET6 5442b0d6f81SJamie Gritton int ip6s, redo_ip6; 545b38ff370SJamie Gritton #endif 5466beb3bb4SKirk McKusick uint64_t pr_allow, ch_allow, pr_flags, ch_flags; 547b3079544SJamie Gritton uint64_t pr_allow_diff; 5486beb3bb4SKirk McKusick unsigned tallow; 549b38ff370SJamie Gritton char numbuf[12]; 550b38ff370SJamie Gritton 551b38ff370SJamie Gritton error = priv_check(td, PRIV_JAIL_SET); 552b38ff370SJamie Gritton if (!error && (flags & JAIL_ATTACH)) 553b38ff370SJamie Gritton error = priv_check(td, PRIV_JAIL_ATTACH); 554b38ff370SJamie Gritton if (error) 55575c13541SPoul-Henning Kamp return (error); 556b6f47c23SJamie Gritton mypr = td->td_ucred->cr_prison; 557b97457e2SJamie Gritton if ((flags & JAIL_CREATE) && mypr->pr_childmax == 0) 5580304c731SJamie Gritton return (EPERM); 559b38ff370SJamie Gritton if (flags & ~JAIL_SET_MASK) 560b38ff370SJamie Gritton return (EINVAL); 561b38ff370SJamie Gritton 562b38ff370SJamie Gritton /* 563b38ff370SJamie Gritton * Check all the parameters before committing to anything. Not all 564b38ff370SJamie Gritton * errors can be caught early, but we may as well try. Also, this 565b38ff370SJamie Gritton * takes care of some expensive stuff (path lookup) before getting 566b38ff370SJamie Gritton * the allprison lock. 567b38ff370SJamie Gritton * 568b38ff370SJamie Gritton * XXX Jails are not filesystems, and jail parameters are not mount 569b38ff370SJamie Gritton * options. But it makes more sense to re-use the vfsopt code 570b38ff370SJamie Gritton * than duplicate it under a different name. 571b38ff370SJamie Gritton */ 572b38ff370SJamie Gritton error = vfs_buildopts(optuio, &opts); 573b38ff370SJamie Gritton if (error) 574b38ff370SJamie Gritton return (error); 575b38ff370SJamie Gritton #ifdef INET 576b38ff370SJamie Gritton ip4 = NULL; 577b38ff370SJamie Gritton #endif 578b38ff370SJamie Gritton #ifdef INET6 579b38ff370SJamie Gritton ip6 = NULL; 580b38ff370SJamie Gritton #endif 5816dfe0a3dSMartin Matuska g_path = NULL; 582b38ff370SJamie Gritton 583b6f47c23SJamie Gritton cuflags = flags & (JAIL_CREATE | JAIL_UPDATE); 584b6f47c23SJamie Gritton if (!cuflags) { 585b6f47c23SJamie Gritton error = EINVAL; 586b6f47c23SJamie Gritton vfs_opterror(opts, "no valid operation (create or update)"); 587b6f47c23SJamie Gritton goto done_errmsg; 588b6f47c23SJamie Gritton } 589b6f47c23SJamie Gritton 590b38ff370SJamie Gritton error = vfs_copyopt(opts, "jid", &jid, sizeof(jid)); 591b38ff370SJamie Gritton if (error == ENOENT) 592b38ff370SJamie Gritton jid = 0; 593b38ff370SJamie Gritton else if (error != 0) 594b38ff370SJamie Gritton goto done_free; 595b38ff370SJamie Gritton 596b38ff370SJamie Gritton error = vfs_copyopt(opts, "securelevel", &slevel, sizeof(slevel)); 597b38ff370SJamie Gritton if (error == ENOENT) 598b38ff370SJamie Gritton gotslevel = 0; 599b38ff370SJamie Gritton else if (error != 0) 600b38ff370SJamie Gritton goto done_free; 601b38ff370SJamie Gritton else 602b38ff370SJamie Gritton gotslevel = 1; 603b38ff370SJamie Gritton 604b97457e2SJamie Gritton error = 605b97457e2SJamie Gritton vfs_copyopt(opts, "children.max", &childmax, sizeof(childmax)); 606b97457e2SJamie Gritton if (error == ENOENT) 607b97457e2SJamie Gritton gotchildmax = 0; 608b97457e2SJamie Gritton else if (error != 0) 609b97457e2SJamie Gritton goto done_free; 610b97457e2SJamie Gritton else 611b97457e2SJamie Gritton gotchildmax = 1; 612b97457e2SJamie Gritton 6130304c731SJamie Gritton error = vfs_copyopt(opts, "enforce_statfs", &enforce, sizeof(enforce)); 614f337198dSJamie Gritton if (error == ENOENT) 615f337198dSJamie Gritton gotenforce = 0; 616f337198dSJamie Gritton else if (error != 0) 6170304c731SJamie Gritton goto done_free; 618f337198dSJamie Gritton else if (enforce < 0 || enforce > 2) { 619f337198dSJamie Gritton error = EINVAL; 620f337198dSJamie Gritton goto done_free; 621f337198dSJamie Gritton } else 622f337198dSJamie Gritton gotenforce = 1; 6230304c731SJamie Gritton 6240cc207a6SMartin Matuska error = vfs_copyopt(opts, "devfs_ruleset", &rsnum, sizeof(rsnum)); 6250cc207a6SMartin Matuska if (error == ENOENT) 6260cc207a6SMartin Matuska gotrsnum = 0; 6270cc207a6SMartin Matuska else if (error != 0) 6280cc207a6SMartin Matuska goto done_free; 6290cc207a6SMartin Matuska else 6300cc207a6SMartin Matuska gotrsnum = 1; 6310cc207a6SMartin Matuska 632b38ff370SJamie Gritton pr_flags = ch_flags = 0; 633672756aaSJamie Gritton for (bf = pr_flag_bool; 634672756aaSJamie Gritton bf < pr_flag_bool + nitems(pr_flag_bool); 635672756aaSJamie Gritton bf++) { 636672756aaSJamie Gritton vfs_flagopt(opts, bf->name, &pr_flags, bf->flag); 637672756aaSJamie Gritton vfs_flagopt(opts, bf->noname, &ch_flags, bf->flag); 6380304c731SJamie Gritton } 639b38ff370SJamie Gritton ch_flags |= pr_flags; 640672756aaSJamie Gritton for (jsf = pr_flag_jailsys; 641672756aaSJamie Gritton jsf < pr_flag_jailsys + nitems(pr_flag_jailsys); 642672756aaSJamie Gritton jsf++) { 643672756aaSJamie Gritton error = vfs_copyopt(opts, jsf->name, &jsys, sizeof(jsys)); 6447cbf7213SJamie Gritton if (error == ENOENT) 6457cbf7213SJamie Gritton continue; 6467cbf7213SJamie Gritton if (error != 0) 6477cbf7213SJamie Gritton goto done_free; 6487cbf7213SJamie Gritton switch (jsys) { 6497cbf7213SJamie Gritton case JAIL_SYS_DISABLE: 650672756aaSJamie Gritton if (!jsf->disable) { 6517cbf7213SJamie Gritton error = EINVAL; 6527cbf7213SJamie Gritton goto done_free; 6537cbf7213SJamie Gritton } 654672756aaSJamie Gritton pr_flags |= jsf->disable; 6557cbf7213SJamie Gritton break; 6567cbf7213SJamie Gritton case JAIL_SYS_NEW: 657672756aaSJamie Gritton pr_flags |= jsf->new; 6587cbf7213SJamie Gritton break; 6597cbf7213SJamie Gritton case JAIL_SYS_INHERIT: 6607cbf7213SJamie Gritton break; 6617cbf7213SJamie Gritton default: 6627cbf7213SJamie Gritton error = EINVAL; 6637cbf7213SJamie Gritton goto done_free; 6647cbf7213SJamie Gritton } 665672756aaSJamie Gritton ch_flags |= jsf->new | jsf->disable; 6667cbf7213SJamie Gritton } 667*1158508aSJamie Gritton if ((flags & (JAIL_CREATE | JAIL_ATTACH)) == JAIL_CREATE 6684affa14cSJamie Gritton && !(pr_flags & PR_PERSIST)) { 6694affa14cSJamie Gritton error = EINVAL; 6704affa14cSJamie Gritton vfs_opterror(opts, "new jail must persist or attach"); 6714affa14cSJamie Gritton goto done_errmsg; 6724affa14cSJamie Gritton } 673679e1390SJamie Gritton #ifdef VIMAGE 674679e1390SJamie Gritton if ((flags & JAIL_UPDATE) && (ch_flags & PR_VNET)) { 675679e1390SJamie Gritton error = EINVAL; 676679e1390SJamie Gritton vfs_opterror(opts, "vnet cannot be changed after creation"); 677679e1390SJamie Gritton goto done_errmsg; 678679e1390SJamie Gritton } 679679e1390SJamie Gritton #endif 6802b0d6f81SJamie Gritton #ifdef INET 6812b0d6f81SJamie Gritton if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP4_USER)) { 6822b0d6f81SJamie Gritton error = EINVAL; 6832b0d6f81SJamie Gritton vfs_opterror(opts, "ip4 cannot be changed after creation"); 6842b0d6f81SJamie Gritton goto done_errmsg; 6852b0d6f81SJamie Gritton } 6862b0d6f81SJamie Gritton #endif 6872b0d6f81SJamie Gritton #ifdef INET6 6882b0d6f81SJamie Gritton if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP6_USER)) { 6892b0d6f81SJamie Gritton error = EINVAL; 6902b0d6f81SJamie Gritton vfs_opterror(opts, "ip6 cannot be changed after creation"); 6912b0d6f81SJamie Gritton goto done_errmsg; 6922b0d6f81SJamie Gritton } 6932b0d6f81SJamie Gritton #endif 694b38ff370SJamie Gritton 6950304c731SJamie Gritton pr_allow = ch_allow = 0; 696672756aaSJamie Gritton for (bf = pr_flag_allow; 6975d58f959SJamie Gritton bf < pr_flag_allow + nitems(pr_flag_allow) && 6985d58f959SJamie Gritton atomic_load_int(&bf->flag) != 0; 699672756aaSJamie Gritton bf++) { 700672756aaSJamie Gritton vfs_flagopt(opts, bf->name, &pr_allow, bf->flag); 701672756aaSJamie Gritton vfs_flagopt(opts, bf->noname, &ch_allow, bf->flag); 7020304c731SJamie Gritton } 7030304c731SJamie Gritton ch_allow |= pr_allow; 7040304c731SJamie Gritton 705b38ff370SJamie Gritton error = vfs_getopt(opts, "name", (void **)&name, &len); 706b38ff370SJamie Gritton if (error == ENOENT) 707b38ff370SJamie Gritton name = NULL; 708b38ff370SJamie Gritton else if (error != 0) 709b38ff370SJamie Gritton goto done_free; 710b38ff370SJamie Gritton else { 711b38ff370SJamie Gritton if (len == 0 || name[len - 1] != '\0') { 712b38ff370SJamie Gritton error = EINVAL; 713b38ff370SJamie Gritton goto done_free; 714b38ff370SJamie Gritton } 715b38ff370SJamie Gritton if (len > MAXHOSTNAMELEN) { 716b38ff370SJamie Gritton error = ENAMETOOLONG; 717b38ff370SJamie Gritton goto done_free; 718b38ff370SJamie Gritton } 719b38ff370SJamie Gritton } 720b38ff370SJamie Gritton 721b38ff370SJamie Gritton error = vfs_getopt(opts, "host.hostname", (void **)&host, &len); 722b38ff370SJamie Gritton if (error == ENOENT) 723b38ff370SJamie Gritton host = NULL; 724b38ff370SJamie Gritton else if (error != 0) 725b38ff370SJamie Gritton goto done_free; 726b38ff370SJamie Gritton else { 72776ca6f88SJamie Gritton ch_flags |= PR_HOST; 72876ca6f88SJamie Gritton pr_flags |= PR_HOST; 729b38ff370SJamie Gritton if (len == 0 || host[len - 1] != '\0') { 730b38ff370SJamie Gritton error = EINVAL; 731b38ff370SJamie Gritton goto done_free; 732b38ff370SJamie Gritton } 733b38ff370SJamie Gritton if (len > MAXHOSTNAMELEN) { 734b38ff370SJamie Gritton error = ENAMETOOLONG; 735b38ff370SJamie Gritton goto done_free; 736b38ff370SJamie Gritton } 737b38ff370SJamie Gritton } 738b38ff370SJamie Gritton 73976ca6f88SJamie Gritton error = vfs_getopt(opts, "host.domainname", (void **)&domain, &len); 74076ca6f88SJamie Gritton if (error == ENOENT) 74176ca6f88SJamie Gritton domain = NULL; 74276ca6f88SJamie Gritton else if (error != 0) 74376ca6f88SJamie Gritton goto done_free; 74476ca6f88SJamie Gritton else { 74576ca6f88SJamie Gritton ch_flags |= PR_HOST; 74676ca6f88SJamie Gritton pr_flags |= PR_HOST; 74776ca6f88SJamie Gritton if (len == 0 || domain[len - 1] != '\0') { 74876ca6f88SJamie Gritton error = EINVAL; 74976ca6f88SJamie Gritton goto done_free; 75076ca6f88SJamie Gritton } 75176ca6f88SJamie Gritton if (len > MAXHOSTNAMELEN) { 75276ca6f88SJamie Gritton error = ENAMETOOLONG; 75376ca6f88SJamie Gritton goto done_free; 75476ca6f88SJamie Gritton } 75576ca6f88SJamie Gritton } 75676ca6f88SJamie Gritton 75776ca6f88SJamie Gritton error = vfs_getopt(opts, "host.hostuuid", (void **)&uuid, &len); 75876ca6f88SJamie Gritton if (error == ENOENT) 75976ca6f88SJamie Gritton uuid = NULL; 76076ca6f88SJamie Gritton else if (error != 0) 76176ca6f88SJamie Gritton goto done_free; 76276ca6f88SJamie Gritton else { 76376ca6f88SJamie Gritton ch_flags |= PR_HOST; 76476ca6f88SJamie Gritton pr_flags |= PR_HOST; 76576ca6f88SJamie Gritton if (len == 0 || uuid[len - 1] != '\0') { 76676ca6f88SJamie Gritton error = EINVAL; 76776ca6f88SJamie Gritton goto done_free; 76876ca6f88SJamie Gritton } 76976ca6f88SJamie Gritton if (len > HOSTUUIDLEN) { 77076ca6f88SJamie Gritton error = ENAMETOOLONG; 77176ca6f88SJamie Gritton goto done_free; 77276ca6f88SJamie Gritton } 77376ca6f88SJamie Gritton } 77476ca6f88SJamie Gritton 775841c0c7eSNathan Whitehorn #ifdef COMPAT_FREEBSD32 776a5c1afadSDmitry Chagin if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) { 77776ca6f88SJamie Gritton uint32_t hid32; 77876ca6f88SJamie Gritton 77976ca6f88SJamie Gritton error = vfs_copyopt(opts, "host.hostid", &hid32, sizeof(hid32)); 78076ca6f88SJamie Gritton hid = hid32; 78176ca6f88SJamie Gritton } else 78276ca6f88SJamie Gritton #endif 78376ca6f88SJamie Gritton error = vfs_copyopt(opts, "host.hostid", &hid, sizeof(hid)); 78476ca6f88SJamie Gritton if (error == ENOENT) 78576ca6f88SJamie Gritton gothid = 0; 78676ca6f88SJamie Gritton else if (error != 0) 78776ca6f88SJamie Gritton goto done_free; 78876ca6f88SJamie Gritton else { 78976ca6f88SJamie Gritton gothid = 1; 79076ca6f88SJamie Gritton ch_flags |= PR_HOST; 79176ca6f88SJamie Gritton pr_flags |= PR_HOST; 79276ca6f88SJamie Gritton } 79376ca6f88SJamie Gritton 794b38ff370SJamie Gritton #ifdef INET 795b38ff370SJamie Gritton error = vfs_getopt(opts, "ip4.addr", &op, &ip4s); 796b38ff370SJamie Gritton if (error == ENOENT) 7970e5e396eSJamie Gritton ip4s = 0; 798b38ff370SJamie Gritton else if (error != 0) 799b38ff370SJamie Gritton goto done_free; 800b38ff370SJamie Gritton else if (ip4s & (sizeof(*ip4) - 1)) { 801b38ff370SJamie Gritton error = EINVAL; 802b38ff370SJamie Gritton goto done_free; 8030304c731SJamie Gritton } else { 8046a3f2779SJamie Gritton ch_flags |= PR_IP4_USER; 8056a3f2779SJamie Gritton pr_flags |= PR_IP4_USER; 8066a3f2779SJamie Gritton if (ip4s > 0) { 807b38ff370SJamie Gritton ip4s /= sizeof(*ip4); 808b38ff370SJamie Gritton if (ip4s > jail_max_af_ips) { 809b38ff370SJamie Gritton error = EINVAL; 810b38ff370SJamie Gritton vfs_opterror(opts, "too many IPv4 addresses"); 811b38ff370SJamie Gritton goto done_errmsg; 812b38ff370SJamie Gritton } 8132b0d6f81SJamie Gritton ip4 = malloc(ip4s * sizeof(*ip4), M_PRISON, M_WAITOK); 814b38ff370SJamie Gritton bcopy(op, ip4, ip4s * sizeof(*ip4)); 815b38ff370SJamie Gritton /* 8160304c731SJamie Gritton * IP addresses are all sorted but ip[0] to preserve 8170304c731SJamie Gritton * the primary IP address as given from userland. 8180304c731SJamie Gritton * This special IP is used for unbound outgoing 819bef916f9SBjoern A. Zeeb * connections as well for "loopback" traffic in case 820bef916f9SBjoern A. Zeeb * source address selection cannot find any more fitting 821bef916f9SBjoern A. Zeeb * address to connect from. 822b38ff370SJamie Gritton */ 823b38ff370SJamie Gritton if (ip4s > 1) 8240ce1624dSStephen J. Kiernan qsort(ip4 + 1, ip4s - 1, sizeof(*ip4), 8250ce1624dSStephen J. Kiernan prison_qcmp_v4); 826b38ff370SJamie Gritton /* 8270304c731SJamie Gritton * Check for duplicate addresses and do some simple 8280304c731SJamie Gritton * zero and broadcast checks. If users give other bogus 8290304c731SJamie Gritton * addresses it is their problem. 830b38ff370SJamie Gritton * 8310304c731SJamie Gritton * We do not have to care about byte order for these 8320304c731SJamie Gritton * checks so we will do them in NBO. 833b38ff370SJamie Gritton */ 834b38ff370SJamie Gritton for (ii = 0; ii < ip4s; ii++) { 835b38ff370SJamie Gritton if (ip4[ii].s_addr == INADDR_ANY || 836b38ff370SJamie Gritton ip4[ii].s_addr == INADDR_BROADCAST) { 837b38ff370SJamie Gritton error = EINVAL; 838b38ff370SJamie Gritton goto done_free; 839b38ff370SJamie Gritton } 840b38ff370SJamie Gritton if ((ii+1) < ip4s && 841b38ff370SJamie Gritton (ip4[0].s_addr == ip4[ii+1].s_addr || 842b38ff370SJamie Gritton ip4[ii].s_addr == ip4[ii+1].s_addr)) { 843b38ff370SJamie Gritton error = EINVAL; 844b38ff370SJamie Gritton goto done_free; 845b38ff370SJamie Gritton } 846b38ff370SJamie Gritton } 847b38ff370SJamie Gritton } 8480304c731SJamie Gritton } 849b38ff370SJamie Gritton #endif 850b38ff370SJamie Gritton 851b38ff370SJamie Gritton #ifdef INET6 852b38ff370SJamie Gritton error = vfs_getopt(opts, "ip6.addr", &op, &ip6s); 853b38ff370SJamie Gritton if (error == ENOENT) 8540e5e396eSJamie Gritton ip6s = 0; 855b38ff370SJamie Gritton else if (error != 0) 856b38ff370SJamie Gritton goto done_free; 857b38ff370SJamie Gritton else if (ip6s & (sizeof(*ip6) - 1)) { 858b38ff370SJamie Gritton error = EINVAL; 859b38ff370SJamie Gritton goto done_free; 8600304c731SJamie Gritton } else { 8616a3f2779SJamie Gritton ch_flags |= PR_IP6_USER; 8626a3f2779SJamie Gritton pr_flags |= PR_IP6_USER; 8636a3f2779SJamie Gritton if (ip6s > 0) { 864b38ff370SJamie Gritton ip6s /= sizeof(*ip6); 865b38ff370SJamie Gritton if (ip6s > jail_max_af_ips) { 866b38ff370SJamie Gritton error = EINVAL; 867b38ff370SJamie Gritton vfs_opterror(opts, "too many IPv6 addresses"); 868b38ff370SJamie Gritton goto done_errmsg; 869b38ff370SJamie Gritton } 8702b0d6f81SJamie Gritton ip6 = malloc(ip6s * sizeof(*ip6), M_PRISON, M_WAITOK); 871b38ff370SJamie Gritton bcopy(op, ip6, ip6s * sizeof(*ip6)); 872b38ff370SJamie Gritton if (ip6s > 1) 8730ce1624dSStephen J. Kiernan qsort(ip6 + 1, ip6s - 1, sizeof(*ip6), 8740ce1624dSStephen J. Kiernan prison_qcmp_v6); 875b38ff370SJamie Gritton for (ii = 0; ii < ip6s; ii++) { 8760304c731SJamie Gritton if (IN6_IS_ADDR_UNSPECIFIED(&ip6[ii])) { 877b38ff370SJamie Gritton error = EINVAL; 878b38ff370SJamie Gritton goto done_free; 879b38ff370SJamie Gritton } 880b38ff370SJamie Gritton if ((ii+1) < ip6s && 881b38ff370SJamie Gritton (IN6_ARE_ADDR_EQUAL(&ip6[0], &ip6[ii+1]) || 882b38ff370SJamie Gritton IN6_ARE_ADDR_EQUAL(&ip6[ii], &ip6[ii+1]))) 883b38ff370SJamie Gritton { 884b38ff370SJamie Gritton error = EINVAL; 885b38ff370SJamie Gritton goto done_free; 886b38ff370SJamie Gritton } 887b38ff370SJamie Gritton } 888b38ff370SJamie Gritton } 8890304c731SJamie Gritton } 890b38ff370SJamie Gritton #endif 891b38ff370SJamie Gritton 892bdfc8cc4SJamie Gritton #if defined(VIMAGE) && (defined(INET) || defined(INET6)) 893bdfc8cc4SJamie Gritton if ((ch_flags & PR_VNET) && (ch_flags & (PR_IP4_USER | PR_IP6_USER))) { 894bdfc8cc4SJamie Gritton error = EINVAL; 895bdfc8cc4SJamie Gritton vfs_opterror(opts, 896bdfc8cc4SJamie Gritton "vnet jails cannot have IP address restrictions"); 897bdfc8cc4SJamie Gritton goto done_errmsg; 898bdfc8cc4SJamie Gritton } 899bdfc8cc4SJamie Gritton #endif 900bdfc8cc4SJamie Gritton 901cf0313c6SJamie Gritton error = vfs_getopt(opts, "osrelease", (void **)&osrelstr, &len); 902cf0313c6SJamie Gritton if (error == ENOENT) 903cf0313c6SJamie Gritton osrelstr = NULL; 904cf0313c6SJamie Gritton else if (error != 0) 905cf0313c6SJamie Gritton goto done_free; 906cf0313c6SJamie Gritton else { 907cf0313c6SJamie Gritton if (flags & JAIL_UPDATE) { 908cf0313c6SJamie Gritton error = EINVAL; 909cf0313c6SJamie Gritton vfs_opterror(opts, 910cf0313c6SJamie Gritton "osrelease cannot be changed after creation"); 911cf0313c6SJamie Gritton goto done_errmsg; 912cf0313c6SJamie Gritton } 9131b786d01SBjoern A. Zeeb if (len == 0 || osrelstr[len - 1] != '\0') { 914cf0313c6SJamie Gritton error = EINVAL; 9151b786d01SBjoern A. Zeeb goto done_free; 9161b786d01SBjoern A. Zeeb } 9171b786d01SBjoern A. Zeeb if (len >= OSRELEASELEN) { 9181b786d01SBjoern A. Zeeb error = ENAMETOOLONG; 919cf0313c6SJamie Gritton vfs_opterror(opts, 920cf0313c6SJamie Gritton "osrelease string must be 1-%d bytes long", 921cf0313c6SJamie Gritton OSRELEASELEN - 1); 922cf0313c6SJamie Gritton goto done_errmsg; 923cf0313c6SJamie Gritton } 924cf0313c6SJamie Gritton } 925cf0313c6SJamie Gritton 926cf0313c6SJamie Gritton error = vfs_copyopt(opts, "osreldate", &osreldt, sizeof(osreldt)); 927cf0313c6SJamie Gritton if (error == ENOENT) 928cf0313c6SJamie Gritton osreldt = 0; 929cf0313c6SJamie Gritton else if (error != 0) 930cf0313c6SJamie Gritton goto done_free; 931cf0313c6SJamie Gritton else { 932cf0313c6SJamie Gritton if (flags & JAIL_UPDATE) { 933cf0313c6SJamie Gritton error = EINVAL; 934cf0313c6SJamie Gritton vfs_opterror(opts, 935cf0313c6SJamie Gritton "osreldate cannot be changed after creation"); 936cf0313c6SJamie Gritton goto done_errmsg; 937cf0313c6SJamie Gritton } 938cf0313c6SJamie Gritton if (osreldt == 0) { 939cf0313c6SJamie Gritton error = EINVAL; 940cf0313c6SJamie Gritton vfs_opterror(opts, "osreldate cannot be 0"); 941cf0313c6SJamie Gritton goto done_errmsg; 942cf0313c6SJamie Gritton } 943cf0313c6SJamie Gritton } 944cf0313c6SJamie Gritton 945b38ff370SJamie Gritton root = NULL; 946b38ff370SJamie Gritton error = vfs_getopt(opts, "path", (void **)&path, &len); 947b38ff370SJamie Gritton if (error == ENOENT) 948b38ff370SJamie Gritton path = NULL; 949b38ff370SJamie Gritton else if (error != 0) 950b38ff370SJamie Gritton goto done_free; 951b38ff370SJamie Gritton else { 952b38ff370SJamie Gritton if (flags & JAIL_UPDATE) { 953b38ff370SJamie Gritton error = EINVAL; 954b38ff370SJamie Gritton vfs_opterror(opts, 955b38ff370SJamie Gritton "path cannot be changed after creation"); 956b38ff370SJamie Gritton goto done_errmsg; 957b38ff370SJamie Gritton } 958b38ff370SJamie Gritton if (len == 0 || path[len - 1] != '\0') { 959b38ff370SJamie Gritton error = EINVAL; 960b38ff370SJamie Gritton goto done_free; 961b38ff370SJamie Gritton } 9625050aa86SKonstantin Belousov NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE, 963b38ff370SJamie Gritton path, td); 964b38ff370SJamie Gritton error = namei(&nd); 965b38ff370SJamie Gritton if (error) 966b38ff370SJamie Gritton goto done_free; 967b38ff370SJamie Gritton root = nd.ni_vp; 968b38ff370SJamie Gritton NDFREE(&nd, NDF_ONLY_PNBUF); 9696dfe0a3dSMartin Matuska g_path = malloc(MAXPATHLEN, M_TEMP, M_WAITOK); 9706dfe0a3dSMartin Matuska strlcpy(g_path, path, MAXPATHLEN); 9716dfe0a3dSMartin Matuska error = vn_path_to_global_path(td, root, g_path, MAXPATHLEN); 9723eb6b656SMateusz Guzik if (error == 0) { 9736dfe0a3dSMartin Matuska path = g_path; 9746dfe0a3dSMartin Matuska } else { 975f6e633a9SMartin Matuska /* exit on other errors */ 976b38ff370SJamie Gritton goto done_free; 977b38ff370SJamie Gritton } 978f6e633a9SMartin Matuska if (root->v_type != VDIR) { 979f6e633a9SMartin Matuska error = ENOTDIR; 980f6e633a9SMartin Matuska vput(root); 981f6e633a9SMartin Matuska goto done_free; 982f6e633a9SMartin Matuska } 983b249ce48SMateusz Guzik VOP_UNLOCK(root); 984b38ff370SJamie Gritton } 985b38ff370SJamie Gritton 986b38ff370SJamie Gritton /* 987b6f47c23SJamie Gritton * Find the specified jail, or at least its parent. 988b38ff370SJamie Gritton * This abuses the file error codes ENOENT and EEXIST. 989b38ff370SJamie Gritton */ 990b38ff370SJamie Gritton pr = NULL; 991b6f47c23SJamie Gritton ppr = mypr; 9927de883c8SJamie Gritton inspr = NULL; 993babbbb9cSJamie Gritton if (cuflags == JAIL_CREATE && jid == 0 && name != NULL) { 994babbbb9cSJamie Gritton namelc = strrchr(name, '.'); 995babbbb9cSJamie Gritton jid = strtoul(namelc != NULL ? namelc + 1 : name, &p, 10); 996babbbb9cSJamie Gritton if (*p != '\0') 997babbbb9cSJamie Gritton jid = 0; 998babbbb9cSJamie Gritton } 999b6f47c23SJamie Gritton sx_xlock(&allprison_lock); 10002a4b2251SJamie Gritton drflags = PD_LIST_XLOCKED; 1001b38ff370SJamie Gritton if (jid != 0) { 1002b38ff370SJamie Gritton if (jid < 0) { 1003b38ff370SJamie Gritton error = EINVAL; 1004b38ff370SJamie Gritton vfs_opterror(opts, "negative jid"); 10052a4b2251SJamie Gritton goto done_deref; 1006b38ff370SJamie Gritton } 10077de883c8SJamie Gritton /* 10087de883c8SJamie Gritton * See if a requested jid already exists. Keep track of 10097de883c8SJamie Gritton * where it can be inserted later. 10107de883c8SJamie Gritton */ 10117de883c8SJamie Gritton TAILQ_FOREACH(inspr, &allprison, pr_list) { 1012f7496dcaSJamie Gritton if (inspr->pr_id < jid) 1013f7496dcaSJamie Gritton continue; 1014f7496dcaSJamie Gritton if (inspr->pr_id > jid) 1015f7496dcaSJamie Gritton break; 10167de883c8SJamie Gritton pr = inspr; 1017f7496dcaSJamie Gritton mtx_lock(&pr->pr_mtx); 10182a4b2251SJamie Gritton drflags |= PD_LOCKED; 10197de883c8SJamie Gritton inspr = NULL; 10207de883c8SJamie Gritton break; 10217de883c8SJamie Gritton } 1022b38ff370SJamie Gritton if (pr != NULL) { 10230304c731SJamie Gritton ppr = pr->pr_parent; 1024b38ff370SJamie Gritton /* Create: jid must not exist. */ 1025b38ff370SJamie Gritton if (cuflags == JAIL_CREATE) { 10267de883c8SJamie Gritton /* 10277de883c8SJamie Gritton * Even creators that cannot see the jail will 10287de883c8SJamie Gritton * get EEXIST. 10297de883c8SJamie Gritton */ 1030b38ff370SJamie Gritton error = EEXIST; 1031b38ff370SJamie Gritton vfs_opterror(opts, "jail %d already exists", 1032b38ff370SJamie Gritton jid); 10332a4b2251SJamie Gritton goto done_deref; 1034b38ff370SJamie Gritton } 10350304c731SJamie Gritton if (!prison_ischild(mypr, pr)) { 10367de883c8SJamie Gritton /* 10377de883c8SJamie Gritton * Updaters get ENOENT if they cannot see the 10387de883c8SJamie Gritton * jail. This is true even for CREATE | UPDATE, 10397de883c8SJamie Gritton * which normally cannot give this error. 10407de883c8SJamie Gritton */ 10412a4b2251SJamie Gritton error = ENOENT; 10422a4b2251SJamie Gritton vfs_opterror(opts, "jail %d not found", jid); 10432a4b2251SJamie Gritton goto done_deref; 1044f7496dcaSJamie Gritton } 1045f7496dcaSJamie Gritton if (!prison_isalive(pr)) { 1046b38ff370SJamie Gritton if (!(flags & JAIL_DYING)) { 1047b38ff370SJamie Gritton error = ENOENT; 1048b38ff370SJamie Gritton vfs_opterror(opts, "jail %d is dying", 1049b38ff370SJamie Gritton jid); 10502a4b2251SJamie Gritton goto done_deref; 1051f7496dcaSJamie Gritton } 1052f7496dcaSJamie Gritton if ((flags & JAIL_ATTACH) || 1053b38ff370SJamie Gritton (pr_flags & PR_PERSIST)) { 1054b38ff370SJamie Gritton /* 1055b38ff370SJamie Gritton * A dying jail might be resurrected 1056b38ff370SJamie Gritton * (via attach or persist), but first 1057b38ff370SJamie Gritton * it must determine if another jail 1058b38ff370SJamie Gritton * has claimed its name. Accomplish 1059b38ff370SJamie Gritton * this by implicitly re-setting the 1060b38ff370SJamie Gritton * name. 1061b38ff370SJamie Gritton */ 1062b38ff370SJamie Gritton if (name == NULL) 10630304c731SJamie Gritton name = prison_name(mypr, pr); 1064b38ff370SJamie Gritton } 1065b38ff370SJamie Gritton } 10662a4b2251SJamie Gritton } else { 1067b38ff370SJamie Gritton /* Update: jid must exist. */ 1068b38ff370SJamie Gritton if (cuflags == JAIL_UPDATE) { 1069b38ff370SJamie Gritton error = ENOENT; 1070b38ff370SJamie Gritton vfs_opterror(opts, "jail %d not found", jid); 10712a4b2251SJamie Gritton goto done_deref; 1072b38ff370SJamie Gritton } 1073b38ff370SJamie Gritton } 1074b38ff370SJamie Gritton } 1075b38ff370SJamie Gritton /* 1076b38ff370SJamie Gritton * If the caller provided a name, look for a jail by that name. 1077b38ff370SJamie Gritton * This has different semantics for creates and updates keyed by jid 1078b38ff370SJamie Gritton * (where the name must not already exist in a different jail), 1079b38ff370SJamie Gritton * and updates keyed by the name itself (where the name must exist 1080b38ff370SJamie Gritton * because that is the jail being updated). 1081b38ff370SJamie Gritton */ 1082b6f47c23SJamie Gritton namelc = NULL; 1083b38ff370SJamie Gritton if (name != NULL) { 1084babbbb9cSJamie Gritton namelc = strrchr(name, '.'); 1085babbbb9cSJamie Gritton if (namelc == NULL) 1086babbbb9cSJamie Gritton namelc = name; 1087babbbb9cSJamie Gritton else { 10880304c731SJamie Gritton /* 10890304c731SJamie Gritton * This is a hierarchical name. Split it into the 10900304c731SJamie Gritton * parent and child names, and make sure the parent 10910304c731SJamie Gritton * exists or matches an already found jail. 10920304c731SJamie Gritton */ 10930304c731SJamie Gritton if (pr != NULL) { 1094babbbb9cSJamie Gritton if (strncmp(name, ppr->pr_name, namelc - name) 1095babbbb9cSJamie Gritton || ppr->pr_name[namelc - name] != '\0') { 10960304c731SJamie Gritton error = EINVAL; 10970304c731SJamie Gritton vfs_opterror(opts, 10980304c731SJamie Gritton "cannot change jail's parent"); 10992a4b2251SJamie Gritton goto done_deref; 11000304c731SJamie Gritton } 11010304c731SJamie Gritton } else { 1102b6f47c23SJamie Gritton *namelc = '\0'; 11030304c731SJamie Gritton ppr = prison_find_name(mypr, name); 11040304c731SJamie Gritton if (ppr == NULL) { 11050304c731SJamie Gritton error = ENOENT; 11060304c731SJamie Gritton vfs_opterror(opts, 11070304c731SJamie Gritton "jail \"%s\" not found", name); 11082a4b2251SJamie Gritton goto done_deref; 11090304c731SJamie Gritton } 1110c050ea80SJamie Gritton if (!(flags & JAIL_DYING) && 1111c050ea80SJamie Gritton !prison_isalive(ppr)) { 1112c050ea80SJamie Gritton mtx_unlock(&ppr->pr_mtx); 1113c050ea80SJamie Gritton error = ENOENT; 1114c050ea80SJamie Gritton vfs_opterror(opts, 1115c050ea80SJamie Gritton "jail \"%s\" is dying", name); 1116c050ea80SJamie Gritton goto done_deref; 1117c050ea80SJamie Gritton } 11180304c731SJamie Gritton mtx_unlock(&ppr->pr_mtx); 1119b6f47c23SJamie Gritton *namelc = '.'; 11200304c731SJamie Gritton } 1121b6f47c23SJamie Gritton namelc++; 11220304c731SJamie Gritton } 1123b6f47c23SJamie Gritton if (namelc[0] != '\0') { 1124b6f47c23SJamie Gritton pnamelen = 11250304c731SJamie Gritton (ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1; 11260304c731SJamie Gritton deadpr = NULL; 11270304c731SJamie Gritton FOREACH_PRISON_CHILD(ppr, tpr) { 11286754ae25SJamie Gritton if (tpr != pr && 1129b6f47c23SJamie Gritton !strcmp(tpr->pr_name + pnamelen, namelc)) { 113076ad42abSJamie Gritton if (prison_isalive(tpr)) { 1131b38ff370SJamie Gritton if (pr == NULL && 1132b38ff370SJamie Gritton cuflags != JAIL_CREATE) { 1133b38ff370SJamie Gritton /* 1134b38ff370SJamie Gritton * Use this jail 1135b38ff370SJamie Gritton * for updates. 1136b38ff370SJamie Gritton */ 1137b38ff370SJamie Gritton pr = tpr; 1138f7496dcaSJamie Gritton mtx_lock(&pr->pr_mtx); 113983bc72a0SJamie Gritton drflags |= PD_LOCKED; 1140b38ff370SJamie Gritton break; 1141b38ff370SJamie Gritton } 1142b38ff370SJamie Gritton /* 1143b38ff370SJamie Gritton * Create, or update(jid): 1144b38ff370SJamie Gritton * name must not exist in an 11450304c731SJamie Gritton * active sibling jail. 1146b38ff370SJamie Gritton */ 1147b38ff370SJamie Gritton error = EEXIST; 1148b38ff370SJamie Gritton vfs_opterror(opts, 1149b38ff370SJamie Gritton "jail \"%s\" already exists", 1150b38ff370SJamie Gritton name); 11512a4b2251SJamie Gritton goto done_deref; 1152b38ff370SJamie Gritton } 115376ad42abSJamie Gritton if (pr == NULL && 1154f7496dcaSJamie Gritton cuflags != JAIL_CREATE) { 115576ad42abSJamie Gritton deadpr = tpr; 1156f7496dcaSJamie Gritton } 1157b38ff370SJamie Gritton } 1158b38ff370SJamie Gritton } 1159b38ff370SJamie Gritton /* If no active jail is found, use a dying one. */ 1160b38ff370SJamie Gritton if (deadpr != NULL && pr == NULL) { 1161b38ff370SJamie Gritton if (flags & JAIL_DYING) { 1162b38ff370SJamie Gritton pr = deadpr; 1163f7496dcaSJamie Gritton mtx_lock(&pr->pr_mtx); 11642a4b2251SJamie Gritton drflags |= PD_LOCKED; 1165b38ff370SJamie Gritton } else if (cuflags == JAIL_UPDATE) { 1166b38ff370SJamie Gritton error = ENOENT; 1167b38ff370SJamie Gritton vfs_opterror(opts, 1168b38ff370SJamie Gritton "jail \"%s\" is dying", name); 11692a4b2251SJamie Gritton goto done_deref; 1170b38ff370SJamie Gritton } 1171b38ff370SJamie Gritton } 1172b38ff370SJamie Gritton /* Update: name must exist if no jid. */ 1173b38ff370SJamie Gritton else if (cuflags == JAIL_UPDATE && pr == NULL) { 1174b38ff370SJamie Gritton error = ENOENT; 1175b38ff370SJamie Gritton vfs_opterror(opts, "jail \"%s\" not found", 1176b38ff370SJamie Gritton name); 11772a4b2251SJamie Gritton goto done_deref; 1178b38ff370SJamie Gritton } 1179b38ff370SJamie Gritton } 1180b38ff370SJamie Gritton } 1181b38ff370SJamie Gritton /* Update: must provide a jid or name. */ 1182b38ff370SJamie Gritton else if (cuflags == JAIL_UPDATE && pr == NULL) { 1183b38ff370SJamie Gritton error = ENOENT; 1184b38ff370SJamie Gritton vfs_opterror(opts, "update specified no jail"); 11852a4b2251SJamie Gritton goto done_deref; 1186b38ff370SJamie Gritton } 1187b38ff370SJamie Gritton 1188b38ff370SJamie Gritton /* If there's no prison to update, create a new one and link it in. */ 11892a4b2251SJamie Gritton created = pr == NULL; 11902a4b2251SJamie Gritton if (created) { 1191b97457e2SJamie Gritton for (tpr = mypr; tpr != NULL; tpr = tpr->pr_parent) 1192b97457e2SJamie Gritton if (tpr->pr_childcount >= tpr->pr_childmax) { 1193b97457e2SJamie Gritton error = EPERM; 1194b97457e2SJamie Gritton vfs_opterror(opts, "prison limit exceeded"); 11952a4b2251SJamie Gritton goto done_deref; 1196b97457e2SJamie Gritton } 11976754ae25SJamie Gritton prison_hold(ppr); 1198f7496dcaSJamie Gritton if (!refcount_acquire_if_not_zero(&ppr->pr_uref)) { 1199c050ea80SJamie Gritton /* This brings the parent back to life. */ 1200f7496dcaSJamie Gritton mtx_lock(&ppr->pr_mtx); 1201f7496dcaSJamie Gritton refcount_acquire(&ppr->pr_uref); 1202*1158508aSJamie Gritton ppr->pr_state = PRISON_STATE_ALIVE; 1203c050ea80SJamie Gritton mtx_unlock(&ppr->pr_mtx); 1204c050ea80SJamie Gritton error = osd_jail_call(ppr, PR_METHOD_CREATE, opts); 1205c050ea80SJamie Gritton if (error) { 1206c050ea80SJamie Gritton pr = ppr; 1207c050ea80SJamie Gritton drflags |= PD_DEREF | PD_DEUREF; 1208c050ea80SJamie Gritton goto done_deref; 1209c050ea80SJamie Gritton } 1210c050ea80SJamie Gritton } 12117de883c8SJamie Gritton 12127de883c8SJamie Gritton if (jid == 0 && (jid = get_next_prid(&inspr)) == 0) { 1213b38ff370SJamie Gritton error = EAGAIN; 12147de883c8SJamie Gritton vfs_opterror(opts, "no available jail IDs"); 12152a4b2251SJamie Gritton pr = ppr; 12162a4b2251SJamie Gritton drflags |= PD_DEREF | PD_DEUREF; 12172a4b2251SJamie Gritton goto done_deref; 1218b38ff370SJamie Gritton } 12192a4b2251SJamie Gritton 12202a4b2251SJamie Gritton pr = malloc(sizeof(*pr), M_PRISON, M_WAITOK | M_ZERO); 1221*1158508aSJamie Gritton pr->pr_state = PRISON_STATE_INVALID; 1222*1158508aSJamie Gritton refcount_init(&pr->pr_ref, 1); 1223f7496dcaSJamie Gritton refcount_init(&pr->pr_uref, 0); 1224*1158508aSJamie Gritton drflags |= PD_DEREF; 12252a4b2251SJamie Gritton LIST_INIT(&pr->pr_children); 12262a4b2251SJamie Gritton mtx_init(&pr->pr_mtx, "jail mutex", NULL, MTX_DEF | MTX_DUPOK); 12272a4b2251SJamie Gritton TASK_INIT(&pr->pr_task, 0, prison_complete, pr); 12282a4b2251SJamie Gritton 12297de883c8SJamie Gritton pr->pr_id = jid; 12307de883c8SJamie Gritton if (inspr != NULL) 12317de883c8SJamie Gritton TAILQ_INSERT_BEFORE(inspr, pr, pr_list); 12327de883c8SJamie Gritton else 1233b38ff370SJamie Gritton TAILQ_INSERT_TAIL(&allprison, pr, pr_list); 12347de883c8SJamie Gritton 12357de883c8SJamie Gritton pr->pr_parent = ppr; 12360304c731SJamie Gritton LIST_INSERT_HEAD(&ppr->pr_children, pr, pr_sibling); 12370304c731SJamie Gritton for (tpr = ppr; tpr != NULL; tpr = tpr->pr_parent) 1238b97457e2SJamie Gritton tpr->pr_childcount++; 1239b38ff370SJamie Gritton 12400304c731SJamie Gritton /* Set some default values, and inherit some from the parent. */ 1241b6f47c23SJamie Gritton if (namelc == NULL) 1242b6f47c23SJamie Gritton namelc = ""; 1243b38ff370SJamie Gritton if (path == NULL) { 1244b38ff370SJamie Gritton path = "/"; 12450304c731SJamie Gritton root = mypr->pr_root; 1246b38ff370SJamie Gritton vref(root); 1247b38ff370SJamie Gritton } 12488986e3a0SJamie Gritton strlcpy(pr->pr_hostuuid, DEFAULT_HOSTUUID, HOSTUUIDLEN); 12498986e3a0SJamie Gritton pr->pr_flags |= PR_HOST; 1250bdfc8cc4SJamie Gritton #if defined(INET) || defined(INET6) 1251bdfc8cc4SJamie Gritton #ifdef VIMAGE 1252bdfc8cc4SJamie Gritton if (!(pr_flags & PR_VNET)) 1253bdfc8cc4SJamie Gritton #endif 1254bdfc8cc4SJamie Gritton { 12550304c731SJamie Gritton #ifdef INET 12562b0d6f81SJamie Gritton if (!(ch_flags & PR_IP4_USER)) 12576a3f2779SJamie Gritton pr->pr_flags |= PR_IP4 | PR_IP4_USER; 12582b0d6f81SJamie Gritton else if (!(pr_flags & PR_IP4_USER)) { 12592b0d6f81SJamie Gritton pr->pr_flags |= ppr->pr_flags & PR_IP4; 12602b0d6f81SJamie Gritton if (ppr->pr_ip4 != NULL) { 12612b0d6f81SJamie Gritton pr->pr_ip4s = ppr->pr_ip4s; 12622b0d6f81SJamie Gritton pr->pr_ip4 = malloc(pr->pr_ip4s * 12632b0d6f81SJamie Gritton sizeof(struct in_addr), M_PRISON, 12642b0d6f81SJamie Gritton M_WAITOK); 12652b0d6f81SJamie Gritton bcopy(ppr->pr_ip4, pr->pr_ip4, 12662b0d6f81SJamie Gritton pr->pr_ip4s * sizeof(*pr->pr_ip4)); 12672b0d6f81SJamie Gritton } 12682b0d6f81SJamie Gritton } 12690304c731SJamie Gritton #endif 12700304c731SJamie Gritton #ifdef INET6 12712b0d6f81SJamie Gritton if (!(ch_flags & PR_IP6_USER)) 12726a3f2779SJamie Gritton pr->pr_flags |= PR_IP6 | PR_IP6_USER; 12732b0d6f81SJamie Gritton else if (!(pr_flags & PR_IP6_USER)) { 12742b0d6f81SJamie Gritton pr->pr_flags |= ppr->pr_flags & PR_IP6; 12752b0d6f81SJamie Gritton if (ppr->pr_ip6 != NULL) { 12762b0d6f81SJamie Gritton pr->pr_ip6s = ppr->pr_ip6s; 12772b0d6f81SJamie Gritton pr->pr_ip6 = malloc(pr->pr_ip6s * 12782b0d6f81SJamie Gritton sizeof(struct in6_addr), M_PRISON, 12792b0d6f81SJamie Gritton M_WAITOK); 12802b0d6f81SJamie Gritton bcopy(ppr->pr_ip6, pr->pr_ip6, 12812b0d6f81SJamie Gritton pr->pr_ip6s * sizeof(*pr->pr_ip6)); 12822b0d6f81SJamie Gritton } 12832b0d6f81SJamie Gritton } 12840304c731SJamie Gritton #endif 1285bdfc8cc4SJamie Gritton } 1286bdfc8cc4SJamie Gritton #endif 1287592bcae8SBjoern A. Zeeb /* Source address selection is always on by default. */ 1288592bcae8SBjoern A. Zeeb pr->pr_flags |= _PR_IP_SADDRSEL; 1289592bcae8SBjoern A. Zeeb 12900304c731SJamie Gritton pr->pr_securelevel = ppr->pr_securelevel; 12910304c731SJamie Gritton pr->pr_allow = JAIL_DEFAULT_ALLOW & ppr->pr_allow; 1292af10bf05SBjoern A. Zeeb pr->pr_enforce_statfs = jail_default_enforce_statfs; 1293bf3db8aaSMartin Matuska pr->pr_devfs_rsnum = ppr->pr_devfs_rsnum; 1294b38ff370SJamie Gritton 1295b96bd95bSIan Lepore pr->pr_osreldate = osreldt ? osreldt : ppr->pr_osreldate; 1296b96bd95bSIan Lepore if (osrelstr == NULL) 12971b786d01SBjoern A. Zeeb strlcpy(pr->pr_osrelease, ppr->pr_osrelease, 12981b786d01SBjoern A. Zeeb sizeof(pr->pr_osrelease)); 1299b96bd95bSIan Lepore else 13001b786d01SBjoern A. Zeeb strlcpy(pr->pr_osrelease, osrelstr, 13011b786d01SBjoern A. Zeeb sizeof(pr->pr_osrelease)); 1302b96bd95bSIan Lepore 1303679e1390SJamie Gritton #ifdef VIMAGE 1304679e1390SJamie Gritton /* Allocate a new vnet if specified. */ 1305679e1390SJamie Gritton pr->pr_vnet = (pr_flags & PR_VNET) 1306679e1390SJamie Gritton ? vnet_alloc() : ppr->pr_vnet; 1307679e1390SJamie Gritton #endif 1308b38ff370SJamie Gritton /* 1309b38ff370SJamie Gritton * Allocate a dedicated cpuset for each jail. 1310b38ff370SJamie Gritton * Unlike other initial settings, this may return an erorr. 1311b38ff370SJamie Gritton */ 13120304c731SJamie Gritton error = cpuset_create_root(ppr, &pr->pr_cpuset); 13132a4b2251SJamie Gritton if (error) 13142a4b2251SJamie Gritton goto done_deref; 1315b38ff370SJamie Gritton 1316b38ff370SJamie Gritton mtx_lock(&pr->pr_mtx); 13172a4b2251SJamie Gritton drflags |= PD_LOCKED; 1318b38ff370SJamie Gritton } else { 13192b0d6f81SJamie Gritton /* 13202b0d6f81SJamie Gritton * Grab a reference for existing prisons, to ensure they 13212b0d6f81SJamie Gritton * continue to exist for the duration of the call. 13222b0d6f81SJamie Gritton */ 13236754ae25SJamie Gritton prison_hold(pr); 13242a4b2251SJamie Gritton drflags |= PD_DEREF; 1325bdfc8cc4SJamie Gritton #if defined(VIMAGE) && (defined(INET) || defined(INET6)) 1326bdfc8cc4SJamie Gritton if ((pr->pr_flags & PR_VNET) && 1327bdfc8cc4SJamie Gritton (ch_flags & (PR_IP4_USER | PR_IP6_USER))) { 1328bdfc8cc4SJamie Gritton error = EINVAL; 1329bdfc8cc4SJamie Gritton vfs_opterror(opts, 1330bdfc8cc4SJamie Gritton "vnet jails cannot have IP address restrictions"); 13312a4b2251SJamie Gritton goto done_deref; 1332bdfc8cc4SJamie Gritton } 1333bdfc8cc4SJamie Gritton #endif 13342b0d6f81SJamie Gritton #ifdef INET 13352b0d6f81SJamie Gritton if (PR_IP4_USER & ch_flags & (pr_flags ^ pr->pr_flags)) { 13362b0d6f81SJamie Gritton error = EINVAL; 13372b0d6f81SJamie Gritton vfs_opterror(opts, 13382b0d6f81SJamie Gritton "ip4 cannot be changed after creation"); 13392a4b2251SJamie Gritton goto done_deref; 13402b0d6f81SJamie Gritton } 13412b0d6f81SJamie Gritton #endif 13422b0d6f81SJamie Gritton #ifdef INET6 13432b0d6f81SJamie Gritton if (PR_IP6_USER & ch_flags & (pr_flags ^ pr->pr_flags)) { 13442b0d6f81SJamie Gritton error = EINVAL; 13452b0d6f81SJamie Gritton vfs_opterror(opts, 13462b0d6f81SJamie Gritton "ip6 cannot be changed after creation"); 13472a4b2251SJamie Gritton goto done_deref; 13482b0d6f81SJamie Gritton } 13492b0d6f81SJamie Gritton #endif 1350b38ff370SJamie Gritton } 1351b38ff370SJamie Gritton 1352b38ff370SJamie Gritton /* Do final error checking before setting anything. */ 13530304c731SJamie Gritton if (gotslevel) { 13540304c731SJamie Gritton if (slevel < ppr->pr_securelevel) { 13550304c731SJamie Gritton error = EPERM; 13562a4b2251SJamie Gritton goto done_deref; 13570304c731SJamie Gritton } 13580304c731SJamie Gritton } 1359b97457e2SJamie Gritton if (gotchildmax) { 1360b97457e2SJamie Gritton if (childmax >= ppr->pr_childmax) { 1361b97457e2SJamie Gritton error = EPERM; 13622a4b2251SJamie Gritton goto done_deref; 1363b97457e2SJamie Gritton } 1364b97457e2SJamie Gritton } 13650304c731SJamie Gritton if (gotenforce) { 13660304c731SJamie Gritton if (enforce < ppr->pr_enforce_statfs) { 13670304c731SJamie Gritton error = EPERM; 13682a4b2251SJamie Gritton goto done_deref; 13690304c731SJamie Gritton } 13700304c731SJamie Gritton } 13710cc207a6SMartin Matuska if (gotrsnum) { 13720cc207a6SMartin Matuska /* 13730cc207a6SMartin Matuska * devfs_rsnum is a uint16_t 13740cc207a6SMartin Matuska */ 1375bf3db8aaSMartin Matuska if (rsnum < 0 || rsnum > 65535) { 13760cc207a6SMartin Matuska error = EINVAL; 13772a4b2251SJamie Gritton goto done_deref; 13780cc207a6SMartin Matuska } 13790cc207a6SMartin Matuska /* 1380bf3db8aaSMartin Matuska * Nested jails always inherit parent's devfs ruleset 13810cc207a6SMartin Matuska */ 13820cc207a6SMartin Matuska if (jailed(td->td_ucred)) { 13830cc207a6SMartin Matuska if (rsnum > 0 && rsnum != ppr->pr_devfs_rsnum) { 13840cc207a6SMartin Matuska error = EPERM; 13852a4b2251SJamie Gritton goto done_deref; 1386bf3db8aaSMartin Matuska } else 13870cc207a6SMartin Matuska rsnum = ppr->pr_devfs_rsnum; 13880cc207a6SMartin Matuska } 13890cc207a6SMartin Matuska } 1390b38ff370SJamie Gritton #ifdef INET 13912b0d6f81SJamie Gritton if (ip4s > 0) { 13920304c731SJamie Gritton if (ppr->pr_flags & PR_IP4) { 13930304c731SJamie Gritton /* 13940304c731SJamie Gritton * Make sure the new set of IP addresses is a 13950304c731SJamie Gritton * subset of the parent's list. Don't worry 13960304c731SJamie Gritton * about the parent being unlocked, as any 13970304c731SJamie Gritton * setting is done with allprison_lock held. 13980304c731SJamie Gritton */ 13990304c731SJamie Gritton for (ij = 0; ij < ppr->pr_ip4s; ij++) 14002b0d6f81SJamie Gritton if (ip4[0].s_addr == ppr->pr_ip4[ij].s_addr) 14010304c731SJamie Gritton break; 14020304c731SJamie Gritton if (ij == ppr->pr_ip4s) { 14030304c731SJamie Gritton error = EPERM; 14042a4b2251SJamie Gritton goto done_deref; 14050304c731SJamie Gritton } 14060304c731SJamie Gritton if (ip4s > 1) { 14070304c731SJamie Gritton for (ii = ij = 1; ii < ip4s; ii++) { 14080304c731SJamie Gritton if (ip4[ii].s_addr == 14090304c731SJamie Gritton ppr->pr_ip4[0].s_addr) 1410b38ff370SJamie Gritton continue; 14110304c731SJamie Gritton for (; ij < ppr->pr_ip4s; ij++) 14120304c731SJamie Gritton if (ip4[ii].s_addr == 14130304c731SJamie Gritton ppr->pr_ip4[ij].s_addr) 14140304c731SJamie Gritton break; 14150304c731SJamie Gritton if (ij == ppr->pr_ip4s) 14160304c731SJamie Gritton break; 14170304c731SJamie Gritton } 14180304c731SJamie Gritton if (ij == ppr->pr_ip4s) { 14190304c731SJamie Gritton error = EPERM; 14202a4b2251SJamie Gritton goto done_deref; 14210304c731SJamie Gritton } 14220304c731SJamie Gritton } 14230304c731SJamie Gritton } 14240304c731SJamie Gritton /* 14250304c731SJamie Gritton * Check for conflicting IP addresses. We permit them 14260304c731SJamie Gritton * if there is no more than one IP on each jail. If 14270304c731SJamie Gritton * there is a duplicate on a jail with more than one 14280304c731SJamie Gritton * IP stop checking and return error. 14290304c731SJamie Gritton */ 1430bdfc8cc4SJamie Gritton #ifdef VIMAGE 143108b43333SJamie Gritton for (tppr = ppr; tppr != &prison0; tppr = tppr->pr_parent) 1432bdfc8cc4SJamie Gritton if (tppr->pr_flags & PR_VNET) 1433bdfc8cc4SJamie Gritton break; 143408b43333SJamie Gritton #else 143508b43333SJamie Gritton tppr = &prison0; 1436bdfc8cc4SJamie Gritton #endif 1437bdfc8cc4SJamie Gritton FOREACH_PRISON_DESCENDANT(tppr, tpr, descend) { 1438bdfc8cc4SJamie Gritton if (tpr == pr || 1439bdfc8cc4SJamie Gritton #ifdef VIMAGE 14402b0d6f81SJamie Gritton (tpr != tppr && (tpr->pr_flags & PR_VNET)) || 1441bdfc8cc4SJamie Gritton #endif 1442f7496dcaSJamie Gritton !prison_isalive(tpr)) { 14430304c731SJamie Gritton descend = 0; 14440304c731SJamie Gritton continue; 14450304c731SJamie Gritton } 14460304c731SJamie Gritton if (!(tpr->pr_flags & PR_IP4_USER)) 14470304c731SJamie Gritton continue; 14480304c731SJamie Gritton descend = 0; 14490304c731SJamie Gritton if (tpr->pr_ip4 == NULL || 14500304c731SJamie Gritton (ip4s == 1 && tpr->pr_ip4s == 1)) 14510304c731SJamie Gritton continue; 14520304c731SJamie Gritton for (ii = 0; ii < ip4s; ii++) { 14530ce1624dSStephen J. Kiernan if (prison_check_ip4_locked(tpr, &ip4[ii]) == 14540ce1624dSStephen J. Kiernan 0) { 14550304c731SJamie Gritton error = EADDRINUSE; 1456b38ff370SJamie Gritton vfs_opterror(opts, 1457b38ff370SJamie Gritton "IPv4 addresses clash"); 14582a4b2251SJamie Gritton goto done_deref; 1459b38ff370SJamie Gritton } 14600304c731SJamie Gritton } 14610304c731SJamie Gritton } 14620304c731SJamie Gritton } 1463b38ff370SJamie Gritton #endif 1464b38ff370SJamie Gritton #ifdef INET6 14652b0d6f81SJamie Gritton if (ip6s > 0) { 14660304c731SJamie Gritton if (ppr->pr_flags & PR_IP6) { 14670304c731SJamie Gritton /* 14680304c731SJamie Gritton * Make sure the new set of IP addresses is a 14690304c731SJamie Gritton * subset of the parent's list. 14700304c731SJamie Gritton */ 14710304c731SJamie Gritton for (ij = 0; ij < ppr->pr_ip6s; ij++) 14720304c731SJamie Gritton if (IN6_ARE_ADDR_EQUAL(&ip6[0], 14730304c731SJamie Gritton &ppr->pr_ip6[ij])) 14740304c731SJamie Gritton break; 14750304c731SJamie Gritton if (ij == ppr->pr_ip6s) { 14760304c731SJamie Gritton error = EPERM; 14772a4b2251SJamie Gritton goto done_deref; 14780304c731SJamie Gritton } 14790304c731SJamie Gritton if (ip6s > 1) { 14800304c731SJamie Gritton for (ii = ij = 1; ii < ip6s; ii++) { 14810304c731SJamie Gritton if (IN6_ARE_ADDR_EQUAL(&ip6[ii], 14820304c731SJamie Gritton &ppr->pr_ip6[0])) 14830304c731SJamie Gritton continue; 14840304c731SJamie Gritton for (; ij < ppr->pr_ip6s; ij++) 14850304c731SJamie Gritton if (IN6_ARE_ADDR_EQUAL( 14862b0d6f81SJamie Gritton &ip6[ii], &ppr->pr_ip6[ij])) 14870304c731SJamie Gritton break; 14880304c731SJamie Gritton if (ij == ppr->pr_ip6s) 14890304c731SJamie Gritton break; 14900304c731SJamie Gritton } 14910304c731SJamie Gritton if (ij == ppr->pr_ip6s) { 14920304c731SJamie Gritton error = EPERM; 14932a4b2251SJamie Gritton goto done_deref; 14940304c731SJamie Gritton } 14950304c731SJamie Gritton } 14960304c731SJamie Gritton } 14970304c731SJamie Gritton /* Check for conflicting IP addresses. */ 1498bdfc8cc4SJamie Gritton #ifdef VIMAGE 149908b43333SJamie Gritton for (tppr = ppr; tppr != &prison0; tppr = tppr->pr_parent) 1500bdfc8cc4SJamie Gritton if (tppr->pr_flags & PR_VNET) 1501bdfc8cc4SJamie Gritton break; 150208b43333SJamie Gritton #else 150308b43333SJamie Gritton tppr = &prison0; 1504bdfc8cc4SJamie Gritton #endif 1505bdfc8cc4SJamie Gritton FOREACH_PRISON_DESCENDANT(tppr, tpr, descend) { 1506bdfc8cc4SJamie Gritton if (tpr == pr || 1507bdfc8cc4SJamie Gritton #ifdef VIMAGE 15082b0d6f81SJamie Gritton (tpr != tppr && (tpr->pr_flags & PR_VNET)) || 1509bdfc8cc4SJamie Gritton #endif 1510f7496dcaSJamie Gritton !prison_isalive(tpr)) { 15110304c731SJamie Gritton descend = 0; 15120304c731SJamie Gritton continue; 15130304c731SJamie Gritton } 15140304c731SJamie Gritton if (!(tpr->pr_flags & PR_IP6_USER)) 15150304c731SJamie Gritton continue; 15160304c731SJamie Gritton descend = 0; 15170304c731SJamie Gritton if (tpr->pr_ip6 == NULL || 15180304c731SJamie Gritton (ip6s == 1 && tpr->pr_ip6s == 1)) 15190304c731SJamie Gritton continue; 15200304c731SJamie Gritton for (ii = 0; ii < ip6s; ii++) { 15210ce1624dSStephen J. Kiernan if (prison_check_ip6_locked(tpr, &ip6[ii]) == 15220ce1624dSStephen J. Kiernan 0) { 15230304c731SJamie Gritton error = EADDRINUSE; 1524b38ff370SJamie Gritton vfs_opterror(opts, 1525b38ff370SJamie Gritton "IPv6 addresses clash"); 15262a4b2251SJamie Gritton goto done_deref; 1527b38ff370SJamie Gritton } 15280304c731SJamie Gritton } 15290304c731SJamie Gritton } 15300304c731SJamie Gritton } 1531b38ff370SJamie Gritton #endif 15320304c731SJamie Gritton onamelen = namelen = 0; 1533b6f47c23SJamie Gritton if (namelc != NULL) { 15346ab6058eSJamie Gritton /* Give a default name of the jid. Also allow the name to be 15356ab6058eSJamie Gritton * explicitly the jid - but not any other number, and only in 15366ab6058eSJamie Gritton * normal form (no leading zero/etc). 15376ab6058eSJamie Gritton */ 1538b6f47c23SJamie Gritton if (namelc[0] == '\0') 1539b6f47c23SJamie Gritton snprintf(namelc = numbuf, sizeof(numbuf), "%d", jid); 15406ab6058eSJamie Gritton else if ((strtoul(namelc, &p, 10) != jid || 15416ab6058eSJamie Gritton namelc[0] < '1' || namelc[0] > '9') && *p == '\0') { 1542b38ff370SJamie Gritton error = EINVAL; 1543babbbb9cSJamie Gritton vfs_opterror(opts, 1544babbbb9cSJamie Gritton "name cannot be numeric (unless it is the jid)"); 15452a4b2251SJamie Gritton goto done_deref; 1546b38ff370SJamie Gritton } 1547b38ff370SJamie Gritton /* 15480304c731SJamie Gritton * Make sure the name isn't too long for the prison or its 15490304c731SJamie Gritton * children. 1550b38ff370SJamie Gritton */ 1551b6f47c23SJamie Gritton pnamelen = (ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1; 1552b6f47c23SJamie Gritton onamelen = strlen(pr->pr_name + pnamelen); 1553b6f47c23SJamie Gritton namelen = strlen(namelc); 1554b6f47c23SJamie Gritton if (pnamelen + namelen + 1 > sizeof(pr->pr_name)) { 15550304c731SJamie Gritton error = ENAMETOOLONG; 15562a4b2251SJamie Gritton goto done_deref; 15570304c731SJamie Gritton } 15580304c731SJamie Gritton FOREACH_PRISON_DESCENDANT(pr, tpr, descend) { 15590304c731SJamie Gritton if (strlen(tpr->pr_name) + (namelen - onamelen) >= 15600304c731SJamie Gritton sizeof(pr->pr_name)) { 15610304c731SJamie Gritton error = ENAMETOOLONG; 15622a4b2251SJamie Gritton goto done_deref; 15630304c731SJamie Gritton } 15640304c731SJamie Gritton } 15650304c731SJamie Gritton } 1566b3079544SJamie Gritton pr_allow_diff = pr_allow & ~ppr->pr_allow; 1567b3079544SJamie Gritton if (pr_allow_diff & ~PR_ALLOW_DIFFERENCES) { 15680304c731SJamie Gritton error = EPERM; 15692a4b2251SJamie Gritton goto done_deref; 1570b38ff370SJamie Gritton } 1571b38ff370SJamie Gritton 1572b6f47c23SJamie Gritton /* 1573b6f47c23SJamie Gritton * Let modules check their parameters. This requires unlocking and 1574b6f47c23SJamie Gritton * then re-locking the prison, but this is still a valid state as long 1575b6f47c23SJamie Gritton * as allprison_lock remains xlocked. 1576b6f47c23SJamie Gritton */ 1577b6f47c23SJamie Gritton mtx_unlock(&pr->pr_mtx); 15782a4b2251SJamie Gritton drflags &= ~PD_LOCKED; 1579b6f47c23SJamie Gritton error = osd_jail_call(pr, PR_METHOD_CHECK, opts); 15802a4b2251SJamie Gritton if (error != 0) 15812a4b2251SJamie Gritton goto done_deref; 1582b6f47c23SJamie Gritton mtx_lock(&pr->pr_mtx); 15832a4b2251SJamie Gritton drflags |= PD_LOCKED; 1584b6f47c23SJamie Gritton 1585b6f47c23SJamie Gritton /* At this point, all valid parameters should have been noted. */ 1586b6f47c23SJamie Gritton TAILQ_FOREACH(opt, opts, link) { 1587b6f47c23SJamie Gritton if (!opt->seen && strcmp(opt->name, "errmsg")) { 1588b6f47c23SJamie Gritton error = EINVAL; 1589b6f47c23SJamie Gritton vfs_opterror(opts, "unknown parameter: %s", opt->name); 15902a4b2251SJamie Gritton goto done_deref; 1591b6f47c23SJamie Gritton } 1592b6f47c23SJamie Gritton } 1593b6f47c23SJamie Gritton 1594b38ff370SJamie Gritton /* Set the parameters of the prison. */ 1595b38ff370SJamie Gritton #ifdef INET 15960304c731SJamie Gritton redo_ip4 = 0; 15970304c731SJamie Gritton if (pr_flags & PR_IP4_USER) { 15980304c731SJamie Gritton pr->pr_flags |= PR_IP4; 1599b38ff370SJamie Gritton free(pr->pr_ip4, M_PRISON); 16000304c731SJamie Gritton pr->pr_ip4s = ip4s; 1601b38ff370SJamie Gritton pr->pr_ip4 = ip4; 1602b38ff370SJamie Gritton ip4 = NULL; 16030304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 1604bdfc8cc4SJamie Gritton #ifdef VIMAGE 1605bdfc8cc4SJamie Gritton if (tpr->pr_flags & PR_VNET) { 1606bdfc8cc4SJamie Gritton descend = 0; 1607bdfc8cc4SJamie Gritton continue; 1608bdfc8cc4SJamie Gritton } 1609bdfc8cc4SJamie Gritton #endif 16100304c731SJamie Gritton if (prison_restrict_ip4(tpr, NULL)) { 16110304c731SJamie Gritton redo_ip4 = 1; 16120304c731SJamie Gritton descend = 0; 16130304c731SJamie Gritton } 16140304c731SJamie Gritton } 16150304c731SJamie Gritton } 1616b38ff370SJamie Gritton #endif 1617b38ff370SJamie Gritton #ifdef INET6 16180304c731SJamie Gritton redo_ip6 = 0; 16190304c731SJamie Gritton if (pr_flags & PR_IP6_USER) { 16200304c731SJamie Gritton pr->pr_flags |= PR_IP6; 1621b38ff370SJamie Gritton free(pr->pr_ip6, M_PRISON); 16220304c731SJamie Gritton pr->pr_ip6s = ip6s; 1623b38ff370SJamie Gritton pr->pr_ip6 = ip6; 1624b38ff370SJamie Gritton ip6 = NULL; 16250304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 1626bdfc8cc4SJamie Gritton #ifdef VIMAGE 1627bdfc8cc4SJamie Gritton if (tpr->pr_flags & PR_VNET) { 1628bdfc8cc4SJamie Gritton descend = 0; 1629bdfc8cc4SJamie Gritton continue; 1630bdfc8cc4SJamie Gritton } 1631bdfc8cc4SJamie Gritton #endif 16320304c731SJamie Gritton if (prison_restrict_ip6(tpr, NULL)) { 16330304c731SJamie Gritton redo_ip6 = 1; 16340304c731SJamie Gritton descend = 0; 16350304c731SJamie Gritton } 16360304c731SJamie Gritton } 16370304c731SJamie Gritton } 1638b38ff370SJamie Gritton #endif 16390304c731SJamie Gritton if (gotslevel) { 1640b38ff370SJamie Gritton pr->pr_securelevel = slevel; 16410304c731SJamie Gritton /* Set all child jails to be at least this level. */ 16420304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) 16430304c731SJamie Gritton if (tpr->pr_securelevel < slevel) 16440304c731SJamie Gritton tpr->pr_securelevel = slevel; 16450304c731SJamie Gritton } 1646b97457e2SJamie Gritton if (gotchildmax) { 1647b97457e2SJamie Gritton pr->pr_childmax = childmax; 1648b97457e2SJamie Gritton /* Set all child jails to under this limit. */ 1649b97457e2SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED_LEVEL(pr, tpr, descend, level) 1650b97457e2SJamie Gritton if (tpr->pr_childmax > childmax - level) 1651b97457e2SJamie Gritton tpr->pr_childmax = childmax > level 1652b97457e2SJamie Gritton ? childmax - level : 0; 1653b97457e2SJamie Gritton } 16540304c731SJamie Gritton if (gotenforce) { 16550304c731SJamie Gritton pr->pr_enforce_statfs = enforce; 16560304c731SJamie Gritton /* Pass this restriction on to the children. */ 16570304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) 16580304c731SJamie Gritton if (tpr->pr_enforce_statfs < enforce) 16590304c731SJamie Gritton tpr->pr_enforce_statfs = enforce; 16600304c731SJamie Gritton } 16610cc207a6SMartin Matuska if (gotrsnum) { 16620cc207a6SMartin Matuska pr->pr_devfs_rsnum = rsnum; 16630cc207a6SMartin Matuska /* Pass this restriction on to the children. */ 16640cc207a6SMartin Matuska FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) 16650cc207a6SMartin Matuska tpr->pr_devfs_rsnum = rsnum; 16660cc207a6SMartin Matuska } 1667b6f47c23SJamie Gritton if (namelc != NULL) { 16680304c731SJamie Gritton if (ppr == &prison0) 1669b6f47c23SJamie Gritton strlcpy(pr->pr_name, namelc, sizeof(pr->pr_name)); 16700304c731SJamie Gritton else 16710304c731SJamie Gritton snprintf(pr->pr_name, sizeof(pr->pr_name), "%s.%s", 1672b6f47c23SJamie Gritton ppr->pr_name, namelc); 16730304c731SJamie Gritton /* Change this component of child names. */ 16740304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 16750304c731SJamie Gritton bcopy(tpr->pr_name + onamelen, tpr->pr_name + namelen, 16760304c731SJamie Gritton strlen(tpr->pr_name + onamelen) + 1); 16770304c731SJamie Gritton bcopy(pr->pr_name, tpr->pr_name, namelen); 16780304c731SJamie Gritton } 16790304c731SJamie Gritton } 1680b38ff370SJamie Gritton if (path != NULL) { 16810304c731SJamie Gritton /* Try to keep a real-rooted full pathname. */ 1682b38ff370SJamie Gritton strlcpy(pr->pr_path, path, sizeof(pr->pr_path)); 1683b38ff370SJamie Gritton pr->pr_root = root; 16842a4b2251SJamie Gritton root = NULL; 1685b38ff370SJamie Gritton } 168676ca6f88SJamie Gritton if (PR_HOST & ch_flags & ~pr_flags) { 168776ca6f88SJamie Gritton if (pr->pr_flags & PR_HOST) { 168876ca6f88SJamie Gritton /* 168976ca6f88SJamie Gritton * Copy the parent's host info. As with pr_ip4 above, 169076ca6f88SJamie Gritton * the lack of a lock on the parent is not a problem; 169176ca6f88SJamie Gritton * it is always set with allprison_lock at least 169276ca6f88SJamie Gritton * shared, and is held exclusively here. 169376ca6f88SJamie Gritton */ 1694c1f19219SJamie Gritton strlcpy(pr->pr_hostname, pr->pr_parent->pr_hostname, 1695c1f19219SJamie Gritton sizeof(pr->pr_hostname)); 1696c1f19219SJamie Gritton strlcpy(pr->pr_domainname, pr->pr_parent->pr_domainname, 1697c1f19219SJamie Gritton sizeof(pr->pr_domainname)); 1698c1f19219SJamie Gritton strlcpy(pr->pr_hostuuid, pr->pr_parent->pr_hostuuid, 1699c1f19219SJamie Gritton sizeof(pr->pr_hostuuid)); 170076ca6f88SJamie Gritton pr->pr_hostid = pr->pr_parent->pr_hostid; 170176ca6f88SJamie Gritton } 170276ca6f88SJamie Gritton } else if (host != NULL || domain != NULL || uuid != NULL || gothid) { 170376ca6f88SJamie Gritton /* Set this prison, and any descendants without PR_HOST. */ 1704b38ff370SJamie Gritton if (host != NULL) 1705c1f19219SJamie Gritton strlcpy(pr->pr_hostname, host, sizeof(pr->pr_hostname)); 170676ca6f88SJamie Gritton if (domain != NULL) 1707c1f19219SJamie Gritton strlcpy(pr->pr_domainname, domain, 1708c1f19219SJamie Gritton sizeof(pr->pr_domainname)); 170976ca6f88SJamie Gritton if (uuid != NULL) 1710c1f19219SJamie Gritton strlcpy(pr->pr_hostuuid, uuid, sizeof(pr->pr_hostuuid)); 171176ca6f88SJamie Gritton if (gothid) 171276ca6f88SJamie Gritton pr->pr_hostid = hid; 171376ca6f88SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 171476ca6f88SJamie Gritton if (tpr->pr_flags & PR_HOST) 171576ca6f88SJamie Gritton descend = 0; 171676ca6f88SJamie Gritton else { 171776ca6f88SJamie Gritton if (host != NULL) 1718c1f19219SJamie Gritton strlcpy(tpr->pr_hostname, 1719c1f19219SJamie Gritton pr->pr_hostname, 1720c1f19219SJamie Gritton sizeof(tpr->pr_hostname)); 172176ca6f88SJamie Gritton if (domain != NULL) 1722c1f19219SJamie Gritton strlcpy(tpr->pr_domainname, 1723c1f19219SJamie Gritton pr->pr_domainname, 1724c1f19219SJamie Gritton sizeof(tpr->pr_domainname)); 172576ca6f88SJamie Gritton if (uuid != NULL) 1726c1f19219SJamie Gritton strlcpy(tpr->pr_hostuuid, 1727c1f19219SJamie Gritton pr->pr_hostuuid, 1728c1f19219SJamie Gritton sizeof(tpr->pr_hostuuid)); 172976ca6f88SJamie Gritton if (gothid) 173076ca6f88SJamie Gritton tpr->pr_hostid = hid; 173176ca6f88SJamie Gritton } 173276ca6f88SJamie Gritton } 173376ca6f88SJamie Gritton } 17340304c731SJamie Gritton pr->pr_allow = (pr->pr_allow & ~ch_allow) | pr_allow; 17350fe74ae6SJamie Gritton if ((tallow = ch_allow & ~pr_allow)) 17360fe74ae6SJamie Gritton prison_set_allow_locked(pr, tallow, 0); 1737b38ff370SJamie Gritton /* 1738b38ff370SJamie Gritton * Persistent prisons get an extra reference, and prisons losing their 1739*1158508aSJamie Gritton * persist flag lose that reference. 1740b38ff370SJamie Gritton */ 174176ad42abSJamie Gritton born = !prison_isalive(pr); 1742*1158508aSJamie Gritton if (ch_flags & PR_PERSIST & (pr_flags ^ pr->pr_flags)) { 1743b38ff370SJamie Gritton if (pr_flags & PR_PERSIST) { 17446754ae25SJamie Gritton prison_hold(pr); 1745*1158508aSJamie Gritton /* 1746*1158508aSJamie Gritton * This may make a dead prison alive again, but wait 1747*1158508aSJamie Gritton * to label it as such until after OSD calls have had 1748*1158508aSJamie Gritton * a chance to run (and perhaps to fail). 1749*1158508aSJamie Gritton */ 17506754ae25SJamie Gritton refcount_acquire(&pr->pr_uref); 1751b38ff370SJamie Gritton } else { 175239c8ef90SJamie Gritton drflags |= PD_DEUREF; 1753f7496dcaSJamie Gritton prison_free_not_last(pr); 1754b38ff370SJamie Gritton } 1755b38ff370SJamie Gritton } 1756b38ff370SJamie Gritton pr->pr_flags = (pr->pr_flags & ~ch_flags) | pr_flags; 1757b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 17582a4b2251SJamie Gritton drflags &= ~PD_LOCKED; 1759b38ff370SJamie Gritton 1760a7ad07bfSEdward Tomasz Napierala #ifdef RACCT 17614b5c9cf6SEdward Tomasz Napierala if (racct_enable && created) 1762a7ad07bfSEdward Tomasz Napierala prison_racct_attach(pr); 1763a7ad07bfSEdward Tomasz Napierala #endif 1764a7ad07bfSEdward Tomasz Napierala 17650304c731SJamie Gritton /* Locks may have prevented a complete restriction of child IP 17660304c731SJamie Gritton * addresses. If so, allocate some more memory and try again. 17670304c731SJamie Gritton */ 17680304c731SJamie Gritton #ifdef INET 17690304c731SJamie Gritton while (redo_ip4) { 17700304c731SJamie Gritton ip4s = pr->pr_ip4s; 17710304c731SJamie Gritton ip4 = malloc(ip4s * sizeof(*ip4), M_PRISON, M_WAITOK); 17720304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 17730304c731SJamie Gritton redo_ip4 = 0; 17740304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 1775bdfc8cc4SJamie Gritton #ifdef VIMAGE 1776bdfc8cc4SJamie Gritton if (tpr->pr_flags & PR_VNET) { 1777bdfc8cc4SJamie Gritton descend = 0; 1778bdfc8cc4SJamie Gritton continue; 1779bdfc8cc4SJamie Gritton } 1780bdfc8cc4SJamie Gritton #endif 17810304c731SJamie Gritton if (prison_restrict_ip4(tpr, ip4)) { 17820304c731SJamie Gritton if (ip4 != NULL) 17830304c731SJamie Gritton ip4 = NULL; 17840304c731SJamie Gritton else 17850304c731SJamie Gritton redo_ip4 = 1; 17860304c731SJamie Gritton } 17870304c731SJamie Gritton } 17880304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 17890304c731SJamie Gritton } 17900304c731SJamie Gritton #endif 17910304c731SJamie Gritton #ifdef INET6 17920304c731SJamie Gritton while (redo_ip6) { 17930304c731SJamie Gritton ip6s = pr->pr_ip6s; 17940304c731SJamie Gritton ip6 = malloc(ip6s * sizeof(*ip6), M_PRISON, M_WAITOK); 17950304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 17960304c731SJamie Gritton redo_ip6 = 0; 17970304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 1798bdfc8cc4SJamie Gritton #ifdef VIMAGE 1799bdfc8cc4SJamie Gritton if (tpr->pr_flags & PR_VNET) { 1800bdfc8cc4SJamie Gritton descend = 0; 1801bdfc8cc4SJamie Gritton continue; 1802bdfc8cc4SJamie Gritton } 1803bdfc8cc4SJamie Gritton #endif 18040304c731SJamie Gritton if (prison_restrict_ip6(tpr, ip6)) { 18050304c731SJamie Gritton if (ip6 != NULL) 18060304c731SJamie Gritton ip6 = NULL; 18070304c731SJamie Gritton else 18080304c731SJamie Gritton redo_ip6 = 1; 18090304c731SJamie Gritton } 18100304c731SJamie Gritton } 18110304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 18120304c731SJamie Gritton } 18130304c731SJamie Gritton #endif 18140304c731SJamie Gritton 1815b38ff370SJamie Gritton /* Let the modules do their work. */ 1816cc5fd8c7SJamie Gritton if (born) { 1817b38ff370SJamie Gritton error = osd_jail_call(pr, PR_METHOD_CREATE, opts); 1818b38ff370SJamie Gritton if (error) { 1819cc5fd8c7SJamie Gritton (void)osd_jail_call(pr, PR_METHOD_REMOVE, NULL); 18202a4b2251SJamie Gritton goto done_deref; 1821b38ff370SJamie Gritton } 1822b38ff370SJamie Gritton } 1823b38ff370SJamie Gritton error = osd_jail_call(pr, PR_METHOD_SET, opts); 1824b38ff370SJamie Gritton if (error) { 1825cc5fd8c7SJamie Gritton if (born) 1826cc5fd8c7SJamie Gritton (void)osd_jail_call(pr, PR_METHOD_REMOVE, NULL); 18272a4b2251SJamie Gritton goto done_deref; 1828b38ff370SJamie Gritton } 1829b38ff370SJamie Gritton 1830*1158508aSJamie Gritton /* 1831*1158508aSJamie Gritton * A new prison is now ready to be seen; either it has gained a user 1832*1158508aSJamie Gritton * reference via persistence, or is about to gain one via attachment. 1833*1158508aSJamie Gritton */ 1834*1158508aSJamie Gritton if (born) { 1835*1158508aSJamie Gritton drflags = prison_lock_xlock(pr, drflags); 1836*1158508aSJamie Gritton pr->pr_state = PRISON_STATE_ALIVE; 1837*1158508aSJamie Gritton } 1838*1158508aSJamie Gritton 1839b38ff370SJamie Gritton /* Attach this process to the prison if requested. */ 1840b38ff370SJamie Gritton if (flags & JAIL_ATTACH) { 1841f7496dcaSJamie Gritton error = do_jail_attach(td, pr, prison_lock_xlock(pr, drflags)); 1842f7496dcaSJamie Gritton drflags &= ~(PD_LOCKED | PD_LIST_XLOCKED); 1843b38ff370SJamie Gritton if (error) { 1844b38ff370SJamie Gritton vfs_opterror(opts, "attach failed"); 18452a4b2251SJamie Gritton goto done_deref; 1846b38ff370SJamie Gritton } 1847b38ff370SJamie Gritton } 1848b38ff370SJamie Gritton 18491fb24974SEdward Tomasz Napierala #ifdef RACCT 18504b5c9cf6SEdward Tomasz Napierala if (racct_enable && !created) { 1851f7496dcaSJamie Gritton if (drflags & PD_LIST_XLOCKED) { 1852f7496dcaSJamie Gritton sx_xunlock(&allprison_lock); 1853f7496dcaSJamie Gritton drflags &= ~PD_LIST_XLOCKED; 1854b4e87a63SJamie Gritton } 18551fb24974SEdward Tomasz Napierala prison_racct_modify(pr); 18561fb24974SEdward Tomasz Napierala } 18571fb24974SEdward Tomasz Napierala #endif 18581fb24974SEdward Tomasz Napierala 18591fb24974SEdward Tomasz Napierala td->td_retval[0] = pr->pr_id; 18601fb24974SEdward Tomasz Napierala 18612a4b2251SJamie Gritton done_deref: 18622a4b2251SJamie Gritton /* Release any temporary prison holds and/or locks. */ 18632a4b2251SJamie Gritton if (pr != NULL) 18642a4b2251SJamie Gritton prison_deref(pr, drflags); 18652a4b2251SJamie Gritton else if (drflags & PD_LIST_SLOCKED) 1866b38ff370SJamie Gritton sx_sunlock(&allprison_lock); 18672a4b2251SJamie Gritton else if (drflags & PD_LIST_XLOCKED) 1868b38ff370SJamie Gritton sx_xunlock(&allprison_lock); 18695050aa86SKonstantin Belousov if (root != NULL) 1870b38ff370SJamie Gritton vrele(root); 1871b38ff370SJamie Gritton done_errmsg: 1872b38ff370SJamie Gritton if (error) { 18732a4b2251SJamie Gritton /* Write the error message back to userspace. */ 1874176ff3a0SJamie Gritton if (vfs_getopt(opts, "errmsg", (void **)&errmsg, 1875176ff3a0SJamie Gritton &errmsg_len) == 0 && errmsg_len > 0) { 1876b38ff370SJamie Gritton errmsg_pos = 2 * vfs_getopt_pos(opts, "errmsg") + 1; 1877b38ff370SJamie Gritton if (optuio->uio_segflg == UIO_SYSSPACE) 1878b38ff370SJamie Gritton bcopy(errmsg, 1879b38ff370SJamie Gritton optuio->uio_iov[errmsg_pos].iov_base, 1880b38ff370SJamie Gritton errmsg_len); 1881b38ff370SJamie Gritton else 1882b38ff370SJamie Gritton copyout(errmsg, 1883b38ff370SJamie Gritton optuio->uio_iov[errmsg_pos].iov_base, 1884b38ff370SJamie Gritton errmsg_len); 1885b38ff370SJamie Gritton } 1886b38ff370SJamie Gritton } 1887b38ff370SJamie Gritton done_free: 1888b38ff370SJamie Gritton #ifdef INET 1889b38ff370SJamie Gritton free(ip4, M_PRISON); 1890b38ff370SJamie Gritton #endif 1891b38ff370SJamie Gritton #ifdef INET6 1892b38ff370SJamie Gritton free(ip6, M_PRISON); 1893b38ff370SJamie Gritton #endif 18946dfe0a3dSMartin Matuska if (g_path != NULL) 18956dfe0a3dSMartin Matuska free(g_path, M_TEMP); 1896b38ff370SJamie Gritton vfs_freeopts(opts); 1897b38ff370SJamie Gritton return (error); 1898b38ff370SJamie Gritton } 1899b38ff370SJamie Gritton 1900b38ff370SJamie Gritton /* 19017de883c8SJamie Gritton * Find the next available prison ID. Return the ID on success, or zero 19027de883c8SJamie Gritton * on failure. Also set a pointer to the allprison list entry the prison 19037de883c8SJamie Gritton * should be inserted before. 19047de883c8SJamie Gritton */ 19057de883c8SJamie Gritton static int 19067de883c8SJamie Gritton get_next_prid(struct prison **insprp) 19077de883c8SJamie Gritton { 19087de883c8SJamie Gritton struct prison *inspr; 19097de883c8SJamie Gritton int jid, maxid; 19107de883c8SJamie Gritton 19117de883c8SJamie Gritton jid = lastprid % JAIL_MAX + 1; 19127de883c8SJamie Gritton if (TAILQ_EMPTY(&allprison) || 19137de883c8SJamie Gritton TAILQ_LAST(&allprison, prisonlist)->pr_id < jid) { 19147de883c8SJamie Gritton /* 19157de883c8SJamie Gritton * A common case is for all jails to be implicitly numbered, 19167de883c8SJamie Gritton * which means they'll go on the end of the list, at least 19177de883c8SJamie Gritton * for the first JAIL_MAX times. 19187de883c8SJamie Gritton */ 19197de883c8SJamie Gritton inspr = NULL; 19207de883c8SJamie Gritton } else { 19217de883c8SJamie Gritton /* 19227de883c8SJamie Gritton * Take two passes through the allprison list: first starting 19237de883c8SJamie Gritton * with the proposed jid, then ending with it. 19247de883c8SJamie Gritton */ 19257de883c8SJamie Gritton for (maxid = JAIL_MAX; maxid != 0; ) { 19267de883c8SJamie Gritton TAILQ_FOREACH(inspr, &allprison, pr_list) { 19277de883c8SJamie Gritton if (inspr->pr_id < jid) 19287de883c8SJamie Gritton continue; 1929f7496dcaSJamie Gritton if (inspr->pr_id > jid) { 1930f7496dcaSJamie Gritton /* Found an opening. */ 19317de883c8SJamie Gritton maxid = 0; 19327de883c8SJamie Gritton break; 19337de883c8SJamie Gritton } 19347de883c8SJamie Gritton if (++jid > maxid) { 19357de883c8SJamie Gritton if (lastprid == maxid || lastprid == 0) 19367de883c8SJamie Gritton { 19377de883c8SJamie Gritton /* 19387de883c8SJamie Gritton * The entire legal range 19397de883c8SJamie Gritton * has been traversed 19407de883c8SJamie Gritton */ 19417de883c8SJamie Gritton return 0; 19427de883c8SJamie Gritton } 19437de883c8SJamie Gritton /* Try again from the start. */ 19447de883c8SJamie Gritton jid = 1; 19457de883c8SJamie Gritton maxid = lastprid; 19467de883c8SJamie Gritton break; 19477de883c8SJamie Gritton } 19487de883c8SJamie Gritton } 19497de883c8SJamie Gritton if (inspr == NULL) { 19507de883c8SJamie Gritton /* Found room at the end of the list. */ 19517de883c8SJamie Gritton break; 19527de883c8SJamie Gritton } 19537de883c8SJamie Gritton } 19547de883c8SJamie Gritton } 19557de883c8SJamie Gritton *insprp = inspr; 19567de883c8SJamie Gritton lastprid = jid; 19577de883c8SJamie Gritton return (jid); 19587de883c8SJamie Gritton } 19597de883c8SJamie Gritton 19607de883c8SJamie Gritton /* 1961b38ff370SJamie Gritton * struct jail_get_args { 1962b38ff370SJamie Gritton * struct iovec *iovp; 1963b38ff370SJamie Gritton * unsigned int iovcnt; 1964b38ff370SJamie Gritton * int flags; 1965b38ff370SJamie Gritton * }; 1966b38ff370SJamie Gritton */ 1967b38ff370SJamie Gritton int 19688451d0ddSKip Macy sys_jail_get(struct thread *td, struct jail_get_args *uap) 1969b38ff370SJamie Gritton { 1970b38ff370SJamie Gritton struct uio *auio; 1971b38ff370SJamie Gritton int error; 1972b38ff370SJamie Gritton 1973b38ff370SJamie Gritton /* Check that we have an even number of iovecs. */ 1974b38ff370SJamie Gritton if (uap->iovcnt & 1) 1975b38ff370SJamie Gritton return (EINVAL); 1976b38ff370SJamie Gritton 1977b38ff370SJamie Gritton error = copyinuio(uap->iovp, uap->iovcnt, &auio); 1978b38ff370SJamie Gritton if (error) 1979b38ff370SJamie Gritton return (error); 1980b38ff370SJamie Gritton error = kern_jail_get(td, auio, uap->flags); 1981b38ff370SJamie Gritton if (error == 0) 1982b38ff370SJamie Gritton error = copyout(auio->uio_iov, uap->iovp, 1983b38ff370SJamie Gritton uap->iovcnt * sizeof (struct iovec)); 1984b38ff370SJamie Gritton free(auio, M_IOV); 1985b38ff370SJamie Gritton return (error); 1986b38ff370SJamie Gritton } 1987b38ff370SJamie Gritton 1988b38ff370SJamie Gritton int 1989b38ff370SJamie Gritton kern_jail_get(struct thread *td, struct uio *optuio, int flags) 1990b38ff370SJamie Gritton { 1991672756aaSJamie Gritton struct bool_flags *bf; 1992672756aaSJamie Gritton struct jailsys_flags *jsf; 19930304c731SJamie Gritton struct prison *pr, *mypr; 1994b38ff370SJamie Gritton struct vfsopt *opt; 1995b38ff370SJamie Gritton struct vfsoptlist *opts; 1996b38ff370SJamie Gritton char *errmsg, *name; 19972a4b2251SJamie Gritton int drflags, error, errmsg_len, errmsg_pos, i, jid, len, pos; 1998672756aaSJamie Gritton unsigned f; 1999b38ff370SJamie Gritton 2000b38ff370SJamie Gritton if (flags & ~JAIL_GET_MASK) 2001b38ff370SJamie Gritton return (EINVAL); 2002b38ff370SJamie Gritton 2003b38ff370SJamie Gritton /* Get the parameter list. */ 2004b38ff370SJamie Gritton error = vfs_buildopts(optuio, &opts); 2005b38ff370SJamie Gritton if (error) 2006b38ff370SJamie Gritton return (error); 2007b38ff370SJamie Gritton errmsg_pos = vfs_getopt_pos(opts, "errmsg"); 20080304c731SJamie Gritton mypr = td->td_ucred->cr_prison; 20092a4b2251SJamie Gritton pr = NULL; 20101e2a13e6SJamie Gritton 2011b38ff370SJamie Gritton /* 2012b38ff370SJamie Gritton * Find the prison specified by one of: lastjid, jid, name. 2013b38ff370SJamie Gritton */ 2014b38ff370SJamie Gritton sx_slock(&allprison_lock); 20152a4b2251SJamie Gritton drflags = PD_LIST_SLOCKED; 2016b38ff370SJamie Gritton error = vfs_copyopt(opts, "lastjid", &jid, sizeof(jid)); 2017b38ff370SJamie Gritton if (error == 0) { 2018b38ff370SJamie Gritton TAILQ_FOREACH(pr, &allprison, pr_list) { 2019f7496dcaSJamie Gritton if (pr->pr_id > jid && 2020f7496dcaSJamie Gritton ((flags & JAIL_DYING) || prison_isalive(pr)) && 2021f7496dcaSJamie Gritton prison_ischild(mypr, pr)) { 2022b38ff370SJamie Gritton mtx_lock(&pr->pr_mtx); 20232a4b2251SJamie Gritton drflags |= PD_LOCKED; 2024b38ff370SJamie Gritton goto found_prison; 20252a4b2251SJamie Gritton } 2026f7496dcaSJamie Gritton } 2027b38ff370SJamie Gritton error = ENOENT; 2028b38ff370SJamie Gritton vfs_opterror(opts, "no jail after %d", jid); 20292a4b2251SJamie Gritton goto done; 2030b38ff370SJamie Gritton } else if (error != ENOENT) 20312a4b2251SJamie Gritton goto done; 2032b38ff370SJamie Gritton 2033b38ff370SJamie Gritton error = vfs_copyopt(opts, "jid", &jid, sizeof(jid)); 2034b38ff370SJamie Gritton if (error == 0) { 2035b38ff370SJamie Gritton if (jid != 0) { 20360304c731SJamie Gritton pr = prison_find_child(mypr, jid); 2037b38ff370SJamie Gritton if (pr != NULL) { 20382a4b2251SJamie Gritton drflags |= PD_LOCKED; 203976ad42abSJamie Gritton if (!(prison_isalive(pr) || 204076ad42abSJamie Gritton (flags & JAIL_DYING))) { 2041b38ff370SJamie Gritton error = ENOENT; 2042b38ff370SJamie Gritton vfs_opterror(opts, "jail %d is dying", 2043b38ff370SJamie Gritton jid); 20442a4b2251SJamie Gritton goto done; 2045b38ff370SJamie Gritton } 2046b38ff370SJamie Gritton goto found_prison; 2047b38ff370SJamie Gritton } 2048b38ff370SJamie Gritton error = ENOENT; 2049b38ff370SJamie Gritton vfs_opterror(opts, "jail %d not found", jid); 20502a4b2251SJamie Gritton goto done; 2051b38ff370SJamie Gritton } 2052b38ff370SJamie Gritton } else if (error != ENOENT) 20532a4b2251SJamie Gritton goto done; 2054b38ff370SJamie Gritton 2055b38ff370SJamie Gritton error = vfs_getopt(opts, "name", (void **)&name, &len); 2056b38ff370SJamie Gritton if (error == 0) { 2057b38ff370SJamie Gritton if (len == 0 || name[len - 1] != '\0') { 2058b38ff370SJamie Gritton error = EINVAL; 20592a4b2251SJamie Gritton goto done; 2060b38ff370SJamie Gritton } 20610304c731SJamie Gritton pr = prison_find_name(mypr, name); 2062b38ff370SJamie Gritton if (pr != NULL) { 20632a4b2251SJamie Gritton drflags |= PD_LOCKED; 206476ad42abSJamie Gritton if (!(prison_isalive(pr) || (flags & JAIL_DYING))) { 2065b38ff370SJamie Gritton error = ENOENT; 2066b38ff370SJamie Gritton vfs_opterror(opts, "jail \"%s\" is dying", 2067b38ff370SJamie Gritton name); 20682a4b2251SJamie Gritton goto done; 2069b38ff370SJamie Gritton } 2070b38ff370SJamie Gritton goto found_prison; 2071b38ff370SJamie Gritton } 2072b38ff370SJamie Gritton error = ENOENT; 2073b38ff370SJamie Gritton vfs_opterror(opts, "jail \"%s\" not found", name); 20742a4b2251SJamie Gritton goto done; 2075b38ff370SJamie Gritton } else if (error != ENOENT) 20762a4b2251SJamie Gritton goto done; 2077b38ff370SJamie Gritton 2078b38ff370SJamie Gritton vfs_opterror(opts, "no jail specified"); 2079b38ff370SJamie Gritton error = ENOENT; 20802a4b2251SJamie Gritton goto done; 2081b38ff370SJamie Gritton 2082b38ff370SJamie Gritton found_prison: 2083b38ff370SJamie Gritton /* Get the parameters of the prison. */ 20846754ae25SJamie Gritton prison_hold(pr); 20852a4b2251SJamie Gritton drflags |= PD_DEREF; 2086b38ff370SJamie Gritton td->td_retval[0] = pr->pr_id; 2087b38ff370SJamie Gritton error = vfs_setopt(opts, "jid", &pr->pr_id, sizeof(pr->pr_id)); 2088b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 20892a4b2251SJamie Gritton goto done; 20900304c731SJamie Gritton i = (pr->pr_parent == mypr) ? 0 : pr->pr_parent->pr_id; 20910304c731SJamie Gritton error = vfs_setopt(opts, "parent", &i, sizeof(i)); 2092b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 20932a4b2251SJamie Gritton goto done; 20940304c731SJamie Gritton error = vfs_setopts(opts, "name", prison_name(mypr, pr)); 20950304c731SJamie Gritton if (error != 0 && error != ENOENT) 20962a4b2251SJamie Gritton goto done; 20970304c731SJamie Gritton error = vfs_setopt(opts, "cpuset.id", &pr->pr_cpuset->cs_id, 2098b38ff370SJamie Gritton sizeof(pr->pr_cpuset->cs_id)); 2099b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 21002a4b2251SJamie Gritton goto done; 21010304c731SJamie Gritton error = vfs_setopts(opts, "path", prison_path(mypr, pr)); 2102b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 21032a4b2251SJamie Gritton goto done; 2104b38ff370SJamie Gritton #ifdef INET 2105b38ff370SJamie Gritton error = vfs_setopt_part(opts, "ip4.addr", pr->pr_ip4, 2106b38ff370SJamie Gritton pr->pr_ip4s * sizeof(*pr->pr_ip4)); 2107b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 21082a4b2251SJamie Gritton goto done; 2109b38ff370SJamie Gritton #endif 2110b38ff370SJamie Gritton #ifdef INET6 2111b38ff370SJamie Gritton error = vfs_setopt_part(opts, "ip6.addr", pr->pr_ip6, 2112b38ff370SJamie Gritton pr->pr_ip6s * sizeof(*pr->pr_ip6)); 2113b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 21142a4b2251SJamie Gritton goto done; 2115b38ff370SJamie Gritton #endif 2116b38ff370SJamie Gritton error = vfs_setopt(opts, "securelevel", &pr->pr_securelevel, 2117b38ff370SJamie Gritton sizeof(pr->pr_securelevel)); 2118b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 21192a4b2251SJamie Gritton goto done; 2120b97457e2SJamie Gritton error = vfs_setopt(opts, "children.cur", &pr->pr_childcount, 2121b97457e2SJamie Gritton sizeof(pr->pr_childcount)); 2122b97457e2SJamie Gritton if (error != 0 && error != ENOENT) 21232a4b2251SJamie Gritton goto done; 2124b97457e2SJamie Gritton error = vfs_setopt(opts, "children.max", &pr->pr_childmax, 2125b97457e2SJamie Gritton sizeof(pr->pr_childmax)); 2126b97457e2SJamie Gritton if (error != 0 && error != ENOENT) 21272a4b2251SJamie Gritton goto done; 2128c1f19219SJamie Gritton error = vfs_setopts(opts, "host.hostname", pr->pr_hostname); 2129b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 21302a4b2251SJamie Gritton goto done; 2131c1f19219SJamie Gritton error = vfs_setopts(opts, "host.domainname", pr->pr_domainname); 213276ca6f88SJamie Gritton if (error != 0 && error != ENOENT) 21332a4b2251SJamie Gritton goto done; 2134c1f19219SJamie Gritton error = vfs_setopts(opts, "host.hostuuid", pr->pr_hostuuid); 213576ca6f88SJamie Gritton if (error != 0 && error != ENOENT) 21362a4b2251SJamie Gritton goto done; 2137841c0c7eSNathan Whitehorn #ifdef COMPAT_FREEBSD32 2138a5c1afadSDmitry Chagin if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) { 213976ca6f88SJamie Gritton uint32_t hid32 = pr->pr_hostid; 214076ca6f88SJamie Gritton 214176ca6f88SJamie Gritton error = vfs_setopt(opts, "host.hostid", &hid32, sizeof(hid32)); 214276ca6f88SJamie Gritton } else 214376ca6f88SJamie Gritton #endif 214476ca6f88SJamie Gritton error = vfs_setopt(opts, "host.hostid", &pr->pr_hostid, 214576ca6f88SJamie Gritton sizeof(pr->pr_hostid)); 214676ca6f88SJamie Gritton if (error != 0 && error != ENOENT) 21472a4b2251SJamie Gritton goto done; 21480304c731SJamie Gritton error = vfs_setopt(opts, "enforce_statfs", &pr->pr_enforce_statfs, 21490304c731SJamie Gritton sizeof(pr->pr_enforce_statfs)); 21500304c731SJamie Gritton if (error != 0 && error != ENOENT) 21512a4b2251SJamie Gritton goto done; 21520cc207a6SMartin Matuska error = vfs_setopt(opts, "devfs_ruleset", &pr->pr_devfs_rsnum, 21530cc207a6SMartin Matuska sizeof(pr->pr_devfs_rsnum)); 21540cc207a6SMartin Matuska if (error != 0 && error != ENOENT) 21552a4b2251SJamie Gritton goto done; 2156672756aaSJamie Gritton for (bf = pr_flag_bool; 2157672756aaSJamie Gritton bf < pr_flag_bool + nitems(pr_flag_bool); 2158672756aaSJamie Gritton bf++) { 2159672756aaSJamie Gritton i = (pr->pr_flags & bf->flag) ? 1 : 0; 2160672756aaSJamie Gritton error = vfs_setopt(opts, bf->name, &i, sizeof(i)); 2161b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 21622a4b2251SJamie Gritton goto done; 2163b38ff370SJamie Gritton i = !i; 2164672756aaSJamie Gritton error = vfs_setopt(opts, bf->noname, &i, sizeof(i)); 2165b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 21662a4b2251SJamie Gritton goto done; 21670304c731SJamie Gritton } 2168672756aaSJamie Gritton for (jsf = pr_flag_jailsys; 2169672756aaSJamie Gritton jsf < pr_flag_jailsys + nitems(pr_flag_jailsys); 2170672756aaSJamie Gritton jsf++) { 2171672756aaSJamie Gritton f = pr->pr_flags & (jsf->disable | jsf->new); 2172672756aaSJamie Gritton i = (f != 0 && f == jsf->disable) ? JAIL_SYS_DISABLE 2173672756aaSJamie Gritton : (f == jsf->new) ? JAIL_SYS_NEW 21747cbf7213SJamie Gritton : JAIL_SYS_INHERIT; 2175672756aaSJamie Gritton error = vfs_setopt(opts, jsf->name, &i, sizeof(i)); 21767cbf7213SJamie Gritton if (error != 0 && error != ENOENT) 21772a4b2251SJamie Gritton goto done; 21787cbf7213SJamie Gritton } 2179672756aaSJamie Gritton for (bf = pr_flag_allow; 21805d58f959SJamie Gritton bf < pr_flag_allow + nitems(pr_flag_allow) && 21815d58f959SJamie Gritton atomic_load_int(&bf->flag) != 0; 2182672756aaSJamie Gritton bf++) { 2183672756aaSJamie Gritton i = (pr->pr_allow & bf->flag) ? 1 : 0; 2184672756aaSJamie Gritton error = vfs_setopt(opts, bf->name, &i, sizeof(i)); 21850304c731SJamie Gritton if (error != 0 && error != ENOENT) 21862a4b2251SJamie Gritton goto done; 21870304c731SJamie Gritton i = !i; 2188672756aaSJamie Gritton error = vfs_setopt(opts, bf->noname, &i, sizeof(i)); 21890304c731SJamie Gritton if (error != 0 && error != ENOENT) 21902a4b2251SJamie Gritton goto done; 21910304c731SJamie Gritton } 219276ad42abSJamie Gritton i = !prison_isalive(pr); 2193b38ff370SJamie Gritton error = vfs_setopt(opts, "dying", &i, sizeof(i)); 2194b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 21952a4b2251SJamie Gritton goto done; 2196b38ff370SJamie Gritton i = !i; 2197b38ff370SJamie Gritton error = vfs_setopt(opts, "nodying", &i, sizeof(i)); 2198b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 21992a4b2251SJamie Gritton goto done; 2200bd96bd15SIan Lepore error = vfs_setopt(opts, "osreldate", &pr->pr_osreldate, 2201bd96bd15SIan Lepore sizeof(pr->pr_osreldate)); 2202a1a4c1b0SIan Lepore if (error != 0 && error != ENOENT) 22032a4b2251SJamie Gritton goto done; 2204a1a4c1b0SIan Lepore error = vfs_setopts(opts, "osrelease", pr->pr_osrelease); 2205a1a4c1b0SIan Lepore if (error != 0 && error != ENOENT) 22062a4b2251SJamie Gritton goto done; 2207b38ff370SJamie Gritton 2208b38ff370SJamie Gritton /* Get the module parameters. */ 2209b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 22102a4b2251SJamie Gritton drflags &= ~PD_LOCKED; 2211b38ff370SJamie Gritton error = osd_jail_call(pr, PR_METHOD_GET, opts); 2212b38ff370SJamie Gritton if (error) 22132a4b2251SJamie Gritton goto done; 22142a4b2251SJamie Gritton prison_deref(pr, drflags); 22152a4b2251SJamie Gritton pr = NULL; 22162a4b2251SJamie Gritton drflags = 0; 2217b38ff370SJamie Gritton 2218b38ff370SJamie Gritton /* By now, all parameters should have been noted. */ 2219b38ff370SJamie Gritton TAILQ_FOREACH(opt, opts, link) { 2220b38ff370SJamie Gritton if (!opt->seen && strcmp(opt->name, "errmsg")) { 2221b38ff370SJamie Gritton error = EINVAL; 2222b38ff370SJamie Gritton vfs_opterror(opts, "unknown parameter: %s", opt->name); 22232a4b2251SJamie Gritton goto done; 2224b38ff370SJamie Gritton } 2225b38ff370SJamie Gritton } 2226b38ff370SJamie Gritton 2227b38ff370SJamie Gritton /* Write the fetched parameters back to userspace. */ 2228b38ff370SJamie Gritton error = 0; 2229b38ff370SJamie Gritton TAILQ_FOREACH(opt, opts, link) { 2230b38ff370SJamie Gritton if (opt->pos >= 0 && opt->pos != errmsg_pos) { 2231b38ff370SJamie Gritton pos = 2 * opt->pos + 1; 2232b38ff370SJamie Gritton optuio->uio_iov[pos].iov_len = opt->len; 2233b38ff370SJamie Gritton if (opt->value != NULL) { 2234b38ff370SJamie Gritton if (optuio->uio_segflg == UIO_SYSSPACE) { 2235b38ff370SJamie Gritton bcopy(opt->value, 2236b38ff370SJamie Gritton optuio->uio_iov[pos].iov_base, 2237b38ff370SJamie Gritton opt->len); 2238b38ff370SJamie Gritton } else { 2239b38ff370SJamie Gritton error = copyout(opt->value, 2240b38ff370SJamie Gritton optuio->uio_iov[pos].iov_base, 2241b38ff370SJamie Gritton opt->len); 2242b38ff370SJamie Gritton if (error) 2243b38ff370SJamie Gritton break; 2244b38ff370SJamie Gritton } 2245b38ff370SJamie Gritton } 2246b38ff370SJamie Gritton } 2247b38ff370SJamie Gritton } 2248b38ff370SJamie Gritton 22492a4b2251SJamie Gritton done: 22502a4b2251SJamie Gritton /* Release any temporary prison holds and/or locks. */ 22512a4b2251SJamie Gritton if (pr != NULL) 22522a4b2251SJamie Gritton prison_deref(pr, drflags); 22532a4b2251SJamie Gritton else if (drflags & PD_LIST_SLOCKED) 2254b38ff370SJamie Gritton sx_sunlock(&allprison_lock); 2255b38ff370SJamie Gritton if (error && errmsg_pos >= 0) { 22562a4b2251SJamie Gritton /* Write the error message back to userspace. */ 2257b38ff370SJamie Gritton vfs_getopt(opts, "errmsg", (void **)&errmsg, &errmsg_len); 2258b38ff370SJamie Gritton errmsg_pos = 2 * errmsg_pos + 1; 2259b38ff370SJamie Gritton if (errmsg_len > 0) { 2260b38ff370SJamie Gritton if (optuio->uio_segflg == UIO_SYSSPACE) 2261b38ff370SJamie Gritton bcopy(errmsg, 2262b38ff370SJamie Gritton optuio->uio_iov[errmsg_pos].iov_base, 2263b38ff370SJamie Gritton errmsg_len); 2264b38ff370SJamie Gritton else 2265b38ff370SJamie Gritton copyout(errmsg, 2266b38ff370SJamie Gritton optuio->uio_iov[errmsg_pos].iov_base, 2267b38ff370SJamie Gritton errmsg_len); 2268b38ff370SJamie Gritton } 2269b38ff370SJamie Gritton } 2270b38ff370SJamie Gritton vfs_freeopts(opts); 2271b38ff370SJamie Gritton return (error); 2272b38ff370SJamie Gritton } 2273b38ff370SJamie Gritton 2274b38ff370SJamie Gritton /* 2275b38ff370SJamie Gritton * struct jail_remove_args { 2276b38ff370SJamie Gritton * int jid; 2277b38ff370SJamie Gritton * }; 2278b38ff370SJamie Gritton */ 2279b38ff370SJamie Gritton int 22808451d0ddSKip Macy sys_jail_remove(struct thread *td, struct jail_remove_args *uap) 2281b38ff370SJamie Gritton { 2282f7496dcaSJamie Gritton struct prison *pr, *cpr, *lpr; 22830304c731SJamie Gritton int descend, error; 2284b38ff370SJamie Gritton 2285b38ff370SJamie Gritton error = priv_check(td, PRIV_JAIL_REMOVE); 2286b38ff370SJamie Gritton if (error) 2287b38ff370SJamie Gritton return (error); 2288b38ff370SJamie Gritton 2289b38ff370SJamie Gritton sx_xlock(&allprison_lock); 22900304c731SJamie Gritton pr = prison_find_child(td->td_ucred->cr_prison, uap->jid); 2291b38ff370SJamie Gritton if (pr == NULL) { 2292b38ff370SJamie Gritton sx_xunlock(&allprison_lock); 2293b38ff370SJamie Gritton return (EINVAL); 2294b38ff370SJamie Gritton } 2295b38ff370SJamie Gritton 22960304c731SJamie Gritton /* Remove all descendants of this prison, then remove this prison. */ 22976754ae25SJamie Gritton prison_hold(pr); 22980304c731SJamie Gritton if (!LIST_EMPTY(&pr->pr_children)) { 22990304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 23000304c731SJamie Gritton lpr = NULL; 23010304c731SJamie Gritton FOREACH_PRISON_DESCENDANT(pr, cpr, descend) { 23026754ae25SJamie Gritton prison_hold(cpr); 23030304c731SJamie Gritton if (lpr != NULL) { 23040304c731SJamie Gritton mtx_lock(&lpr->pr_mtx); 23050304c731SJamie Gritton prison_remove_one(lpr); 23060304c731SJamie Gritton sx_xlock(&allprison_lock); 23070304c731SJamie Gritton } 2308f7496dcaSJamie Gritton lpr = cpr; 23090304c731SJamie Gritton } 23100304c731SJamie Gritton if (lpr != NULL) { 23110304c731SJamie Gritton mtx_lock(&lpr->pr_mtx); 23120304c731SJamie Gritton prison_remove_one(lpr); 23130304c731SJamie Gritton sx_xlock(&allprison_lock); 23140304c731SJamie Gritton } 23150304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 23160304c731SJamie Gritton } 23170304c731SJamie Gritton prison_remove_one(pr); 23180304c731SJamie Gritton return (0); 23190304c731SJamie Gritton } 23200304c731SJamie Gritton 23210304c731SJamie Gritton static void 23220304c731SJamie Gritton prison_remove_one(struct prison *pr) 23230304c731SJamie Gritton { 23240304c731SJamie Gritton struct proc *p; 2325*1158508aSJamie Gritton int was_alive, drflags; 23262a4b2251SJamie Gritton 23272a4b2251SJamie Gritton drflags = PD_DEREF | PD_LOCKED | PD_LIST_XLOCKED; 23280304c731SJamie Gritton 2329cc7b7306SJamie Gritton /* 2330cc7b7306SJamie Gritton * Mark the prison as doomed, so it doesn't accidentally come back 2331cc7b7306SJamie Gritton * to life. It may still be explicitly brought back by jail_set(2). 2332cc7b7306SJamie Gritton */ 2333*1158508aSJamie Gritton was_alive = pr->pr_state == PRISON_STATE_ALIVE; 2334*1158508aSJamie Gritton pr->pr_state = PRISON_STATE_DYING; 2335cc7b7306SJamie Gritton 2336b38ff370SJamie Gritton /* If the prison was persistent, it is not anymore. */ 2337b38ff370SJamie Gritton if (pr->pr_flags & PR_PERSIST) { 23382a4b2251SJamie Gritton drflags |= PD_DEUREF; 2339f7496dcaSJamie Gritton prison_free_not_last(pr); 2340b38ff370SJamie Gritton pr->pr_flags &= ~PR_PERSIST; 2341b38ff370SJamie Gritton } 2342b38ff370SJamie Gritton 23430304c731SJamie Gritton /* 23440304c731SJamie Gritton * jail_remove added a reference. If that's the only one, remove 23456754ae25SJamie Gritton * the prison now. refcount(9) doesn't guarantee the cache coherence 23466754ae25SJamie Gritton * of non-zero counters, so force it here. 23470304c731SJamie Gritton */ 23486754ae25SJamie Gritton KASSERT(refcount_load(&pr->pr_ref) > 0, 23490304c731SJamie Gritton ("prison_remove_one removing a dead prison (jid=%d)", pr->pr_id)); 23506754ae25SJamie Gritton if (atomic_load_acq_int(&pr->pr_ref) == 1) { 23512a4b2251SJamie Gritton prison_deref(pr, drflags); 23520304c731SJamie Gritton return; 2353b38ff370SJamie Gritton } 2354b38ff370SJamie Gritton 2355*1158508aSJamie Gritton /* Tell modules this prison has died. */ 2356b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 2357*1158508aSJamie Gritton drflags &= ~PD_LOCKED; 2358*1158508aSJamie Gritton if (was_alive) 2359*1158508aSJamie Gritton (void)osd_jail_call(pr, PR_METHOD_REMOVE, NULL); 2360*1158508aSJamie Gritton 2361b38ff370SJamie Gritton sx_xunlock(&allprison_lock); 2362*1158508aSJamie Gritton drflags &= ~PD_LIST_XLOCKED; 2363b38ff370SJamie Gritton /* 2364b38ff370SJamie Gritton * Kill all processes unfortunate enough to be attached to this prison. 2365b38ff370SJamie Gritton */ 2366b38ff370SJamie Gritton sx_slock(&allproc_lock); 23677938a442SBjoern A. Zeeb FOREACH_PROC_IN_SYSTEM(p) { 2368b38ff370SJamie Gritton PROC_LOCK(p); 2369b38ff370SJamie Gritton if (p->p_state != PRS_NEW && p->p_ucred && 2370b38ff370SJamie Gritton p->p_ucred->cr_prison == pr) 23718451d0ddSKip Macy kern_psignal(p, SIGKILL); 2372b38ff370SJamie Gritton PROC_UNLOCK(p); 2373b38ff370SJamie Gritton } 2374b38ff370SJamie Gritton sx_sunlock(&allproc_lock); 23750304c731SJamie Gritton /* Remove the temporary reference added by jail_remove. */ 23762a4b2251SJamie Gritton prison_deref(pr, drflags); 237775c13541SPoul-Henning Kamp } 237875c13541SPoul-Henning Kamp 2379fd7a8150SMike Barcroft /* 23809ddb7954SMike Barcroft * struct jail_attach_args { 23819ddb7954SMike Barcroft * int jid; 23829ddb7954SMike Barcroft * }; 2383fd7a8150SMike Barcroft */ 2384fd7a8150SMike Barcroft int 23858451d0ddSKip Macy sys_jail_attach(struct thread *td, struct jail_attach_args *uap) 2386fd7a8150SMike Barcroft { 2387b38ff370SJamie Gritton struct prison *pr; 2388b38ff370SJamie Gritton int error; 2389b38ff370SJamie Gritton 2390b38ff370SJamie Gritton error = priv_check(td, PRIV_JAIL_ATTACH); 2391b38ff370SJamie Gritton if (error) 2392b38ff370SJamie Gritton return (error); 2393b38ff370SJamie Gritton 2394f7496dcaSJamie Gritton sx_slock(&allprison_lock); 23950304c731SJamie Gritton pr = prison_find_child(td->td_ucred->cr_prison, uap->jid); 2396b38ff370SJamie Gritton if (pr == NULL) { 2397b38ff370SJamie Gritton sx_sunlock(&allprison_lock); 2398b38ff370SJamie Gritton return (EINVAL); 2399b38ff370SJamie Gritton } 2400b38ff370SJamie Gritton 240176ad42abSJamie Gritton /* Do not allow a process to attach to a prison that is not alive. */ 240276ad42abSJamie Gritton if (!prison_isalive(pr)) { 2403b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 2404b38ff370SJamie Gritton sx_sunlock(&allprison_lock); 2405b38ff370SJamie Gritton return (EINVAL); 2406b38ff370SJamie Gritton } 2407b38ff370SJamie Gritton 2408f7496dcaSJamie Gritton return (do_jail_attach(td, pr, PD_LOCKED | PD_LIST_SLOCKED)); 2409b38ff370SJamie Gritton } 2410b38ff370SJamie Gritton 2411b38ff370SJamie Gritton static int 2412f7496dcaSJamie Gritton do_jail_attach(struct thread *td, struct prison *pr, int drflags) 2413b38ff370SJamie Gritton { 2414fd7a8150SMike Barcroft struct proc *p; 2415fd7a8150SMike Barcroft struct ucred *newcred, *oldcred; 24165050aa86SKonstantin Belousov int error; 2417fd7a8150SMike Barcroft 2418f7496dcaSJamie Gritton mtx_assert(&pr->pr_mtx, MA_OWNED); 2419f7496dcaSJamie Gritton sx_assert(&allprison_lock, SX_LOCKED); 242057f22bd4SJacques Vidrine /* 242157f22bd4SJacques Vidrine * XXX: Note that there is a slight race here if two threads 242257f22bd4SJacques Vidrine * in the same privileged process attempt to attach to two 242357f22bd4SJacques Vidrine * different jails at the same time. It is important for 242457f22bd4SJacques Vidrine * user processes not to do this, or they might end up with 242557f22bd4SJacques Vidrine * a process root from one prison, but attached to the jail 242657f22bd4SJacques Vidrine * of another. 242757f22bd4SJacques Vidrine */ 2428*1158508aSJamie Gritton prison_hold(pr); 24296754ae25SJamie Gritton refcount_acquire(&pr->pr_uref); 2430f7496dcaSJamie Gritton drflags |= PD_DEREF | PD_DEUREF; 2431fd7a8150SMike Barcroft mtx_unlock(&pr->pr_mtx); 2432f7496dcaSJamie Gritton drflags &= ~PD_LOCKED; 2433b38ff370SJamie Gritton 2434b38ff370SJamie Gritton /* Let modules do whatever they need to prepare for attaching. */ 2435b38ff370SJamie Gritton error = osd_jail_call(pr, PR_METHOD_ATTACH, td); 2436b38ff370SJamie Gritton if (error) { 2437f7496dcaSJamie Gritton prison_deref(pr, drflags); 2438b38ff370SJamie Gritton return (error); 2439b38ff370SJamie Gritton } 2440f7496dcaSJamie Gritton sx_unlock(&allprison_lock); 2441f7496dcaSJamie Gritton drflags &= ~(PD_LIST_SLOCKED | PD_LIST_XLOCKED); 2442fd7a8150SMike Barcroft 2443413628a7SBjoern A. Zeeb /* 2444413628a7SBjoern A. Zeeb * Reparent the newly attached process to this jail. 2445413628a7SBjoern A. Zeeb */ 2446b38ff370SJamie Gritton p = td->td_proc; 2447413628a7SBjoern A. Zeeb error = cpuset_setproc_update_set(p, pr->pr_cpuset); 2448413628a7SBjoern A. Zeeb if (error) 2449b38ff370SJamie Gritton goto e_revert_osd; 2450413628a7SBjoern A. Zeeb 2451cb05b60aSAttilio Rao vn_lock(pr->pr_root, LK_EXCLUSIVE | LK_RETRY); 2452fd7a8150SMike Barcroft if ((error = change_dir(pr->pr_root, td)) != 0) 2453fd7a8150SMike Barcroft goto e_unlock; 2454fd7a8150SMike Barcroft #ifdef MAC 245530d239bcSRobert Watson if ((error = mac_vnode_check_chroot(td->td_ucred, pr->pr_root))) 2456fd7a8150SMike Barcroft goto e_unlock; 2457fd7a8150SMike Barcroft #endif 2458b249ce48SMateusz Guzik VOP_UNLOCK(pr->pr_root); 2459d4380c0cSJamie Gritton if ((error = pwd_chroot_chdir(td, pr->pr_root))) 24605050aa86SKonstantin Belousov goto e_revert_osd; 2461fd7a8150SMike Barcroft 2462fd7a8150SMike Barcroft newcred = crget(); 2463fd7a8150SMike Barcroft PROC_LOCK(p); 24641fb6767dSJamie Gritton oldcred = crcopysafe(p, newcred); 246569c4ee54SJohn Baldwin newcred->cr_prison = pr; 2466daf63fd2SMateusz Guzik proc_set_cred(p, newcred); 24671fb6767dSJamie Gritton setsugid(p); 2468097055e2SEdward Tomasz Napierala #ifdef RACCT 2469097055e2SEdward Tomasz Napierala racct_proc_ucred_changed(p, oldcred, newcred); 2470f87beb93SAndriy Gapon crhold(newcred); 2471f87beb93SAndriy Gapon #endif 2472f87beb93SAndriy Gapon PROC_UNLOCK(p); 2473f87beb93SAndriy Gapon #ifdef RCTL 2474f87beb93SAndriy Gapon rctl_proc_ucred_changed(p, newcred); 2475f87beb93SAndriy Gapon crfree(newcred); 2476097055e2SEdward Tomasz Napierala #endif 2477f7496dcaSJamie Gritton prison_deref(oldcred->cr_prison, drflags); 2478fd7a8150SMike Barcroft crfree(oldcred); 2479cc7b7306SJamie Gritton 2480cc7b7306SJamie Gritton /* 2481cc7b7306SJamie Gritton * If the prison was killed while changing credentials, die along 2482cc7b7306SJamie Gritton * with it. 2483cc7b7306SJamie Gritton */ 2484cc7b7306SJamie Gritton if (!prison_isalive(pr)) { 2485cc7b7306SJamie Gritton PROC_LOCK(p); 2486cc7b7306SJamie Gritton kern_psignal(p, SIGKILL); 2487cc7b7306SJamie Gritton PROC_UNLOCK(p); 2488cc7b7306SJamie Gritton } 2489cc7b7306SJamie Gritton 2490fd7a8150SMike Barcroft return (0); 24911fb6767dSJamie Gritton 2492fd7a8150SMike Barcroft e_unlock: 2493b249ce48SMateusz Guzik VOP_UNLOCK(pr->pr_root); 2494b38ff370SJamie Gritton e_revert_osd: 2495b38ff370SJamie Gritton /* Tell modules this thread is still in its old jail after all. */ 24967f4e7248SJamie Gritton sx_slock(&allprison_lock); 2497f7496dcaSJamie Gritton drflags |= PD_LIST_SLOCKED; 24981fb6767dSJamie Gritton (void)osd_jail_call(td->td_ucred->cr_prison, PR_METHOD_ATTACH, td); 2499f7496dcaSJamie Gritton prison_deref(pr, drflags); 2500fd7a8150SMike Barcroft return (error); 2501fd7a8150SMike Barcroft } 2502fd7a8150SMike Barcroft 2503fd7a8150SMike Barcroft /* 2504fd7a8150SMike Barcroft * Returns a locked prison instance, or NULL on failure. 2505fd7a8150SMike Barcroft */ 250654b369c1SPawel Jakub Dawidek struct prison * 2507fd7a8150SMike Barcroft prison_find(int prid) 2508fd7a8150SMike Barcroft { 2509fd7a8150SMike Barcroft struct prison *pr; 2510fd7a8150SMike Barcroft 2511dc68a633SPawel Jakub Dawidek sx_assert(&allprison_lock, SX_LOCKED); 2512b38ff370SJamie Gritton TAILQ_FOREACH(pr, &allprison, pr_list) { 2513f7496dcaSJamie Gritton if (pr->pr_id < prid) 2514f7496dcaSJamie Gritton continue; 25157de883c8SJamie Gritton if (pr->pr_id > prid) 25167de883c8SJamie Gritton break; 2517f7496dcaSJamie Gritton KASSERT(prison_isvalid(pr), ("Found invalid prison %p", pr)); 2518f7496dcaSJamie Gritton mtx_lock(&pr->pr_mtx); 2519f7496dcaSJamie Gritton return (pr); 2520fd7a8150SMike Barcroft } 2521fd7a8150SMike Barcroft return (NULL); 2522fd7a8150SMike Barcroft } 2523fd7a8150SMike Barcroft 2524b38ff370SJamie Gritton /* 25250304c731SJamie Gritton * Find a prison that is a descendant of mypr. Returns a locked prison or NULL. 2526b38ff370SJamie Gritton */ 2527b38ff370SJamie Gritton struct prison * 25280304c731SJamie Gritton prison_find_child(struct prison *mypr, int prid) 2529b38ff370SJamie Gritton { 25300304c731SJamie Gritton struct prison *pr; 25310304c731SJamie Gritton int descend; 2532b38ff370SJamie Gritton 2533b38ff370SJamie Gritton sx_assert(&allprison_lock, SX_LOCKED); 25340304c731SJamie Gritton FOREACH_PRISON_DESCENDANT(mypr, pr, descend) { 25350304c731SJamie Gritton if (pr->pr_id == prid) { 2536f7496dcaSJamie Gritton KASSERT(prison_isvalid(pr), 2537f7496dcaSJamie Gritton ("Found invalid prison %p", pr)); 25380304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 25390304c731SJamie Gritton return (pr); 25400304c731SJamie Gritton } 25410304c731SJamie Gritton } 25420304c731SJamie Gritton return (NULL); 25430304c731SJamie Gritton } 25440304c731SJamie Gritton 25450304c731SJamie Gritton /* 25460304c731SJamie Gritton * Look for the name relative to mypr. Returns a locked prison or NULL. 25470304c731SJamie Gritton */ 25480304c731SJamie Gritton struct prison * 25490304c731SJamie Gritton prison_find_name(struct prison *mypr, const char *name) 25500304c731SJamie Gritton { 25510304c731SJamie Gritton struct prison *pr, *deadpr; 25520304c731SJamie Gritton size_t mylen; 25530304c731SJamie Gritton int descend; 25540304c731SJamie Gritton 25550304c731SJamie Gritton sx_assert(&allprison_lock, SX_LOCKED); 25560304c731SJamie Gritton mylen = (mypr == &prison0) ? 0 : strlen(mypr->pr_name) + 1; 2557b38ff370SJamie Gritton deadpr = NULL; 25580304c731SJamie Gritton FOREACH_PRISON_DESCENDANT(mypr, pr, descend) { 25590304c731SJamie Gritton if (!strcmp(pr->pr_name + mylen, name)) { 2560f7496dcaSJamie Gritton KASSERT(prison_isvalid(pr), 2561f7496dcaSJamie Gritton ("Found invalid prison %p", pr)); 2562f7496dcaSJamie Gritton if (prison_isalive(pr)) { 2563b38ff370SJamie Gritton mtx_lock(&pr->pr_mtx); 2564b38ff370SJamie Gritton return (pr); 2565f7496dcaSJamie Gritton } 2566b38ff370SJamie Gritton deadpr = pr; 2567b38ff370SJamie Gritton } 2568b38ff370SJamie Gritton } 25690304c731SJamie Gritton /* There was no valid prison - perhaps there was a dying one. */ 2570f7496dcaSJamie Gritton if (deadpr != NULL) 2571b38ff370SJamie Gritton mtx_lock(&deadpr->pr_mtx); 2572b38ff370SJamie Gritton return (deadpr); 2573b38ff370SJamie Gritton } 2574b38ff370SJamie Gritton 2575b38ff370SJamie Gritton /* 25760fe74ae6SJamie Gritton * See if a prison has the specific flag set. The prison should be locked, 25770fe74ae6SJamie Gritton * unless checking for flags that are only set at jail creation (such as 25780fe74ae6SJamie Gritton * PR_IP4 and PR_IP6), or only the single bit is examined, without regard 25790fe74ae6SJamie Gritton * to any other prison data. 25800304c731SJamie Gritton */ 25810304c731SJamie Gritton int 25820304c731SJamie Gritton prison_flag(struct ucred *cred, unsigned flag) 25830304c731SJamie Gritton { 25840304c731SJamie Gritton 25850304c731SJamie Gritton return (cred->cr_prison->pr_flags & flag); 25860304c731SJamie Gritton } 25870304c731SJamie Gritton 25880304c731SJamie Gritton int 25890304c731SJamie Gritton prison_allow(struct ucred *cred, unsigned flag) 25900304c731SJamie Gritton { 25910304c731SJamie Gritton 25920fe74ae6SJamie Gritton return ((cred->cr_prison->pr_allow & flag) != 0); 25930304c731SJamie Gritton } 25940304c731SJamie Gritton 25950304c731SJamie Gritton /* 2596effad35eSJamie Gritton * Hold a prison reference, by incrementing pr_ref. It is generally 2597effad35eSJamie Gritton * an error to hold a prison that does not already have a reference. 2598effad35eSJamie Gritton * A prison record will remain valid as long as it has at least one 2599effad35eSJamie Gritton * reference, and will not be removed as long as either the prison 2600effad35eSJamie Gritton * mutex or the allprison lock is held (allprison_lock may be shared). 2601effad35eSJamie Gritton */ 2602effad35eSJamie Gritton void 2603effad35eSJamie Gritton prison_hold_locked(struct prison *pr) 2604effad35eSJamie Gritton { 2605effad35eSJamie Gritton 26066754ae25SJamie Gritton /* Locking is no longer required. */ 26076754ae25SJamie Gritton prison_hold(pr); 2608effad35eSJamie Gritton } 2609effad35eSJamie Gritton 2610effad35eSJamie Gritton void 2611effad35eSJamie Gritton prison_hold(struct prison *pr) 2612effad35eSJamie Gritton { 26136754ae25SJamie Gritton #ifdef INVARIANTS 26146754ae25SJamie Gritton int was_valid = refcount_acquire_if_not_zero(&pr->pr_ref); 2615effad35eSJamie Gritton 26166754ae25SJamie Gritton KASSERT(was_valid, 26176754ae25SJamie Gritton ("Trying to hold dead prison %p (jid=%d).", pr, pr->pr_id)); 26186754ae25SJamie Gritton #else 26196754ae25SJamie Gritton refcount_acquire(&pr->pr_ref); 26206754ae25SJamie Gritton #endif 2621effad35eSJamie Gritton } 2622effad35eSJamie Gritton 2623effad35eSJamie Gritton /* 2624effad35eSJamie Gritton * Remove a prison reference. If that was the last reference, the 2625f7496dcaSJamie Gritton * prison will be removed (at a later time). 2626b38ff370SJamie Gritton */ 262791421ba2SRobert Watson void 26281ba4a712SPawel Jakub Dawidek prison_free_locked(struct prison *pr) 262991421ba2SRobert Watson { 263091421ba2SRobert Watson 26311ba4a712SPawel Jakub Dawidek mtx_assert(&pr->pr_mtx, MA_OWNED); 2632effad35eSJamie Gritton /* 2633f7496dcaSJamie Gritton * Locking is no longer required, but unlock because the caller 2634f7496dcaSJamie Gritton * expects it. 2635effad35eSJamie Gritton */ 2636f7496dcaSJamie Gritton mtx_unlock(&pr->pr_mtx); 2637f7496dcaSJamie Gritton prison_free(pr); 2638effad35eSJamie Gritton } 2639c2cda609SPawel Jakub Dawidek 26401ba4a712SPawel Jakub Dawidek void 26411ba4a712SPawel Jakub Dawidek prison_free(struct prison *pr) 26421ba4a712SPawel Jakub Dawidek { 26431ba4a712SPawel Jakub Dawidek 26446754ae25SJamie Gritton KASSERT(refcount_load(&pr->pr_ref) > 0, 26456754ae25SJamie Gritton ("Trying to free dead prison %p (jid=%d).", 26466754ae25SJamie Gritton pr, pr->pr_id)); 2647f7496dcaSJamie Gritton if (!refcount_release_if_not_last(&pr->pr_ref)) { 2648f7496dcaSJamie Gritton /* 2649f7496dcaSJamie Gritton * Don't remove the last reference in this context, 2650f7496dcaSJamie Gritton * in case there are locks held. 2651f7496dcaSJamie Gritton */ 2652f7496dcaSJamie Gritton taskqueue_enqueue(taskqueue_thread, &pr->pr_task); 2653f7496dcaSJamie Gritton } 2654f7496dcaSJamie Gritton } 2655f7496dcaSJamie Gritton 2656f7496dcaSJamie Gritton static void 2657f7496dcaSJamie Gritton prison_free_not_last(struct prison *pr) 2658f7496dcaSJamie Gritton { 2659f7496dcaSJamie Gritton #ifdef INVARIANTS 2660f7496dcaSJamie Gritton int lastref; 2661f7496dcaSJamie Gritton 2662f7496dcaSJamie Gritton KASSERT(refcount_load(&pr->pr_ref) > 0, 2663f7496dcaSJamie Gritton ("Trying to free dead prison %p (jid=%d).", 2664f7496dcaSJamie Gritton pr, pr->pr_id)); 2665f7496dcaSJamie Gritton lastref = refcount_release(&pr->pr_ref); 2666f7496dcaSJamie Gritton KASSERT(!lastref, 2667f7496dcaSJamie Gritton ("prison_free_not_last freed last ref on prison %p (jid=%d).", 2668f7496dcaSJamie Gritton pr, pr->pr_id)); 2669f7496dcaSJamie Gritton #else 2670ee9b37aeSMateusz Guzik refcount_release(&pr->pr_ref); 2671f7496dcaSJamie Gritton #endif 26721ba4a712SPawel Jakub Dawidek } 26731ba4a712SPawel Jakub Dawidek 267473d9e52dSJamie Gritton /* 2675effad35eSJamie Gritton * Hold a a prison for user visibility, by incrementing pr_uref. 2676effad35eSJamie Gritton * It is generally an error to hold a prison that isn't already 2677effad35eSJamie Gritton * user-visible, except through the the jail system calls. It is also 2678effad35eSJamie Gritton * an error to hold an invalid prison. A prison record will remain 2679effad35eSJamie Gritton * alive as long as it has at least one user reference, and will not 2680f7496dcaSJamie Gritton * be set to the dying state until the prison mutex and allprison_lock 2681f7496dcaSJamie Gritton * are both freed. 2682effad35eSJamie Gritton */ 2683effad35eSJamie Gritton void 2684effad35eSJamie Gritton prison_proc_hold(struct prison *pr) 2685effad35eSJamie Gritton { 26866754ae25SJamie Gritton #ifdef INVARIANTS 26876754ae25SJamie Gritton int was_alive = refcount_acquire_if_not_zero(&pr->pr_uref); 2688effad35eSJamie Gritton 26896754ae25SJamie Gritton KASSERT(was_alive, 2690effad35eSJamie Gritton ("Cannot add a process to a non-alive prison (jid=%d)", pr->pr_id)); 26916754ae25SJamie Gritton #else 26926754ae25SJamie Gritton refcount_acquire(&pr->pr_uref); 26936754ae25SJamie Gritton #endif 2694effad35eSJamie Gritton } 2695effad35eSJamie Gritton 2696effad35eSJamie Gritton /* 2697effad35eSJamie Gritton * Remove a prison user reference. If it was the last reference, the 2698effad35eSJamie Gritton * prison will be considered "dying", and may be removed once all of 2699effad35eSJamie Gritton * its references are dropped. 2700effad35eSJamie Gritton */ 2701effad35eSJamie Gritton void 2702effad35eSJamie Gritton prison_proc_free(struct prison *pr) 2703effad35eSJamie Gritton { 2704effad35eSJamie Gritton 27056754ae25SJamie Gritton /* 27066754ae25SJamie Gritton * Locking is only required when releasing the last reference. 27076754ae25SJamie Gritton * This allows assurance that a locked prison will remain alive 27086754ae25SJamie Gritton * until it is unlocked. 27096754ae25SJamie Gritton */ 27106754ae25SJamie Gritton KASSERT(refcount_load(&pr->pr_uref) > 0, 2711effad35eSJamie Gritton ("Trying to kill a process in a dead prison (jid=%d)", pr->pr_id)); 2712195cd6aeSJamie Gritton if (!refcount_release_if_not_last(&pr->pr_uref)) { 2713effad35eSJamie Gritton /* 2714effad35eSJamie Gritton * Don't remove the last user reference in this context, 2715effad35eSJamie Gritton * which is expected to be a process that is not only locked, 2716effad35eSJamie Gritton * but also half dead. Add a reference so any calls to 2717effad35eSJamie Gritton * prison_free() won't re-submit the task. 2718effad35eSJamie Gritton */ 2719f7496dcaSJamie Gritton prison_hold(pr); 2720*1158508aSJamie Gritton mtx_lock(&pr->pr_mtx); 2721*1158508aSJamie Gritton KASSERT(!(pr->pr_flags & PR_COMPLETE_PROC), 2722*1158508aSJamie Gritton ("Redundant last reference in prison_proc_free (jid=%d)", 2723*1158508aSJamie Gritton pr->pr_id)); 2724*1158508aSJamie Gritton pr->pr_flags |= PR_COMPLETE_PROC; 2725*1158508aSJamie Gritton mtx_unlock(&pr->pr_mtx); 2726effad35eSJamie Gritton taskqueue_enqueue(taskqueue_thread, &pr->pr_task); 2727effad35eSJamie Gritton } 2728effad35eSJamie Gritton } 2729effad35eSJamie Gritton 2730effad35eSJamie Gritton /* 273173d9e52dSJamie Gritton * Complete a call to either prison_free or prison_proc_free. 273273d9e52dSJamie Gritton */ 2733c2cda609SPawel Jakub Dawidek static void 2734c2cda609SPawel Jakub Dawidek prison_complete(void *context, int pending) 2735c2cda609SPawel Jakub Dawidek { 273673d9e52dSJamie Gritton struct prison *pr = context; 2737f7496dcaSJamie Gritton int drflags; 2738b38ff370SJamie Gritton 2739effad35eSJamie Gritton /* 2740*1158508aSJamie Gritton * This could be called to release the last reference, or the last 2741*1158508aSJamie Gritton * user reference (plus the reference held in prison_proc_free). 2742effad35eSJamie Gritton */ 2743f7496dcaSJamie Gritton drflags = prison_lock_xlock(pr, PD_DEREF); 2744*1158508aSJamie Gritton if (pr->pr_flags & PR_COMPLETE_PROC) { 2745*1158508aSJamie Gritton pr->pr_flags &= ~PR_COMPLETE_PROC; 2746f7496dcaSJamie Gritton drflags |= PD_DEUREF; 2747*1158508aSJamie Gritton } 2748f7496dcaSJamie Gritton prison_deref(pr, drflags); 2749b38ff370SJamie Gritton } 2750b38ff370SJamie Gritton 2751b38ff370SJamie Gritton /* 2752effad35eSJamie Gritton * Remove a prison reference and/or user reference (usually). 2753effad35eSJamie Gritton * This assumes context that allows sleeping (for allprison_lock), 2754effad35eSJamie Gritton * with no non-sleeping locks held, except perhaps the prison itself. 2755effad35eSJamie Gritton * If there are no more references, release and delist the prison. 2756effad35eSJamie Gritton * On completion, the prison lock and the allprison lock are both 2757effad35eSJamie Gritton * unlocked. 2758b38ff370SJamie Gritton */ 2759b38ff370SJamie Gritton static void 2760b38ff370SJamie Gritton prison_deref(struct prison *pr, int flags) 2761b38ff370SJamie Gritton { 27626e1d1bfcSJamie Gritton struct prisonlist freeprison; 2763f7496dcaSJamie Gritton struct prison *rpr, *ppr, *tpr; 2764c2cda609SPawel Jakub Dawidek 27656e1d1bfcSJamie Gritton TAILQ_INIT(&freeprison); 27666e1d1bfcSJamie Gritton /* 27676e1d1bfcSJamie Gritton * Release this prison as requested, which may cause its parent 27686e1d1bfcSJamie Gritton * to be released, and then maybe its grandparent, etc. 27696e1d1bfcSJamie Gritton */ 27700304c731SJamie Gritton for (;;) { 2771e6d5cb63SJamie Gritton if (flags & PD_DEUREF) { 2772f7496dcaSJamie Gritton /* Drop a user reference. */ 27736754ae25SJamie Gritton KASSERT(refcount_load(&pr->pr_uref) > 0, 277473d9e52dSJamie Gritton ("prison_deref PD_DEUREF on a dead prison (jid=%d)", 277573d9e52dSJamie Gritton pr->pr_id)); 2776f7496dcaSJamie Gritton if (!refcount_release_if_not_last(&pr->pr_uref)) { 2777f7496dcaSJamie Gritton if (!(flags & PD_DEREF)) { 2778f7496dcaSJamie Gritton prison_hold(pr); 2779f7496dcaSJamie Gritton flags |= PD_DEREF; 2780f7496dcaSJamie Gritton } 2781f7496dcaSJamie Gritton flags = prison_lock_xlock(pr, flags); 2782*1158508aSJamie Gritton if (refcount_release(&pr->pr_uref) && 2783*1158508aSJamie Gritton pr->pr_state == PRISON_STATE_ALIVE) { 2784f7496dcaSJamie Gritton /* 2785f7496dcaSJamie Gritton * When the last user references goes, 2786f7496dcaSJamie Gritton * this becomes a dying prison. 2787f7496dcaSJamie Gritton */ 2788f7496dcaSJamie Gritton KASSERT( 2789f7496dcaSJamie Gritton refcount_load(&prison0.pr_uref) > 0, 27906754ae25SJamie Gritton ("prison0 pr_uref=0")); 2791*1158508aSJamie Gritton pr->pr_state = PRISON_STATE_DYING; 2792f7496dcaSJamie Gritton mtx_unlock(&pr->pr_mtx); 2793f7496dcaSJamie Gritton flags &= ~PD_LOCKED; 2794f7496dcaSJamie Gritton (void)osd_jail_call(pr, 2795f7496dcaSJamie Gritton PR_METHOD_REMOVE, NULL); 2796f7496dcaSJamie Gritton } 2797f7496dcaSJamie Gritton } 2798f7496dcaSJamie Gritton } 279973d9e52dSJamie Gritton if (flags & PD_DEREF) { 2800f7496dcaSJamie Gritton /* Drop a reference. */ 28016754ae25SJamie Gritton KASSERT(refcount_load(&pr->pr_ref) > 0, 280273d9e52dSJamie Gritton ("prison_deref PD_DEREF on a dead prison (jid=%d)", 280373d9e52dSJamie Gritton pr->pr_id)); 2804f7496dcaSJamie Gritton if (!refcount_release_if_not_last(&pr->pr_ref)) { 2805f7496dcaSJamie Gritton flags = prison_lock_xlock(pr, flags); 2806f7496dcaSJamie Gritton if (refcount_release(&pr->pr_ref)) { 2807cc5fd8c7SJamie Gritton /* 2808f7496dcaSJamie Gritton * When the last reference goes, 2809f7496dcaSJamie Gritton * unlink the prison and set it aside. 2810cc5fd8c7SJamie Gritton */ 2811f7496dcaSJamie Gritton KASSERT( 2812f7496dcaSJamie Gritton refcount_load(&pr->pr_uref) == 0, 2813f7496dcaSJamie Gritton ("prison_deref: last ref, " 2814f7496dcaSJamie Gritton "but still has %d urefs (jid=%d)", 2815f7496dcaSJamie Gritton pr->pr_uref, pr->pr_id)); 2816f7496dcaSJamie Gritton KASSERT( 2817f7496dcaSJamie Gritton refcount_load(&prison0.pr_ref) != 0, 2818f7496dcaSJamie Gritton ("prison0 pr_ref=0")); 2819*1158508aSJamie Gritton pr->pr_state = PRISON_STATE_INVALID; 2820b38ff370SJamie Gritton TAILQ_REMOVE(&allprison, pr, pr_list); 28210304c731SJamie Gritton LIST_REMOVE(pr, pr_sibling); 2822f7496dcaSJamie Gritton TAILQ_INSERT_TAIL(&freeprison, pr, 2823f7496dcaSJamie Gritton pr_list); 2824f7496dcaSJamie Gritton for (ppr = pr->pr_parent; 2825f7496dcaSJamie Gritton ppr != NULL; 2826f7496dcaSJamie Gritton ppr = ppr->pr_parent) 2827f7496dcaSJamie Gritton ppr->pr_childcount--; 2828f7496dcaSJamie Gritton /* 2829f7496dcaSJamie Gritton * Removing a prison frees references 2830f7496dcaSJamie Gritton * from its parent. 2831f7496dcaSJamie Gritton */ 2832f7496dcaSJamie Gritton mtx_unlock(&pr->pr_mtx); 2833f7496dcaSJamie Gritton flags &= ~PD_LOCKED; 28346e1d1bfcSJamie Gritton pr = pr->pr_parent; 28356e1d1bfcSJamie Gritton flags |= PD_DEREF | PD_DEUREF; 2836f7496dcaSJamie Gritton continue; 2837f7496dcaSJamie Gritton } 2838f7496dcaSJamie Gritton } 2839f7496dcaSJamie Gritton } 2840f7496dcaSJamie Gritton break; 28416e1d1bfcSJamie Gritton } 28426e1d1bfcSJamie Gritton 28436e1d1bfcSJamie Gritton /* Release all the prison locks. */ 2844f7496dcaSJamie Gritton if (flags & PD_LOCKED) 2845f7496dcaSJamie Gritton mtx_unlock(&pr->pr_mtx); 28466e1d1bfcSJamie Gritton if (flags & PD_LIST_SLOCKED) 28476e1d1bfcSJamie Gritton sx_sunlock(&allprison_lock); 28486e1d1bfcSJamie Gritton else if (flags & PD_LIST_XLOCKED) 28496e1d1bfcSJamie Gritton sx_xunlock(&allprison_lock); 28506e1d1bfcSJamie Gritton 28516e1d1bfcSJamie Gritton /* 28526e1d1bfcSJamie Gritton * Finish removing any unreferenced prisons, which couldn't happen 28536e1d1bfcSJamie Gritton * while allprison_lock was held (to avoid a LOR on vrele). 28546e1d1bfcSJamie Gritton */ 28556e1d1bfcSJamie Gritton TAILQ_FOREACH_SAFE(rpr, &freeprison, pr_list, tpr) { 28566e1d1bfcSJamie Gritton #ifdef VIMAGE 28576e1d1bfcSJamie Gritton if (rpr->pr_vnet != rpr->pr_parent->pr_vnet) 28586e1d1bfcSJamie Gritton vnet_destroy(rpr->pr_vnet); 28596e1d1bfcSJamie Gritton #endif 28606e1d1bfcSJamie Gritton if (rpr->pr_root != NULL) 28616e1d1bfcSJamie Gritton vrele(rpr->pr_root); 28626e1d1bfcSJamie Gritton mtx_destroy(&rpr->pr_mtx); 28636e1d1bfcSJamie Gritton #ifdef INET 28646e1d1bfcSJamie Gritton free(rpr->pr_ip4, M_PRISON); 28656e1d1bfcSJamie Gritton #endif 28666e1d1bfcSJamie Gritton #ifdef INET6 28676e1d1bfcSJamie Gritton free(rpr->pr_ip6, M_PRISON); 28686e1d1bfcSJamie Gritton #endif 28696e1d1bfcSJamie Gritton if (rpr->pr_cpuset != NULL) 28706e1d1bfcSJamie Gritton cpuset_rel(rpr->pr_cpuset); 28716e1d1bfcSJamie Gritton osd_jail_exit(rpr); 28726e1d1bfcSJamie Gritton #ifdef RACCT 28736e1d1bfcSJamie Gritton if (racct_enable) 28746e1d1bfcSJamie Gritton prison_racct_detach(rpr); 28756e1d1bfcSJamie Gritton #endif 2876f7496dcaSJamie Gritton TAILQ_REMOVE(&freeprison, rpr, pr_list); 28776e1d1bfcSJamie Gritton free(rpr, M_PRISON); 28780304c731SJamie Gritton } 2879b3059e09SRobert Watson } 2880b3059e09SRobert Watson 2881413628a7SBjoern A. Zeeb /* 2882f7496dcaSJamie Gritton * Given the current locking state in the flags, make sure allprison_lock 2883f7496dcaSJamie Gritton * is held exclusive, and the prison is locked. Return flags indicating 2884f7496dcaSJamie Gritton * the new state. 2885f7496dcaSJamie Gritton */ 2886f7496dcaSJamie Gritton static int 2887f7496dcaSJamie Gritton prison_lock_xlock(struct prison *pr, int flags) 2888f7496dcaSJamie Gritton { 2889f7496dcaSJamie Gritton 2890f7496dcaSJamie Gritton if (!(flags & PD_LIST_XLOCKED)) { 2891f7496dcaSJamie Gritton /* 2892f7496dcaSJamie Gritton * Get allprison_lock, which may be an upgrade, 2893f7496dcaSJamie Gritton * and may require unlocking the prison. 2894f7496dcaSJamie Gritton */ 2895f7496dcaSJamie Gritton if (flags & PD_LOCKED) { 2896f7496dcaSJamie Gritton mtx_unlock(&pr->pr_mtx); 2897f7496dcaSJamie Gritton flags &= ~PD_LOCKED; 2898f7496dcaSJamie Gritton } 2899f7496dcaSJamie Gritton if (flags & PD_LIST_SLOCKED) { 2900f7496dcaSJamie Gritton if (!sx_try_upgrade(&allprison_lock)) { 2901f7496dcaSJamie Gritton sx_sunlock(&allprison_lock); 2902f7496dcaSJamie Gritton sx_xlock(&allprison_lock); 2903f7496dcaSJamie Gritton } 2904f7496dcaSJamie Gritton flags &= ~PD_LIST_SLOCKED; 2905f7496dcaSJamie Gritton } else 2906f7496dcaSJamie Gritton sx_xlock(&allprison_lock); 2907f7496dcaSJamie Gritton flags |= PD_LIST_XLOCKED; 2908f7496dcaSJamie Gritton } 2909f7496dcaSJamie Gritton if (!(flags & PD_LOCKED)) { 2910f7496dcaSJamie Gritton /* Lock the prison mutex. */ 2911f7496dcaSJamie Gritton mtx_lock(&pr->pr_mtx); 2912f7496dcaSJamie Gritton flags |= PD_LOCKED; 2913f7496dcaSJamie Gritton } 2914f7496dcaSJamie Gritton return flags; 2915f7496dcaSJamie Gritton } 2916f7496dcaSJamie Gritton 2917f7496dcaSJamie Gritton /* 29180fe74ae6SJamie Gritton * Set or clear a permission bit in the pr_allow field, passing restrictions 29190fe74ae6SJamie Gritton * (cleared permission) down to child jails. 29200fe74ae6SJamie Gritton */ 29210fe74ae6SJamie Gritton void 29220fe74ae6SJamie Gritton prison_set_allow(struct ucred *cred, unsigned flag, int enable) 29230fe74ae6SJamie Gritton { 29240fe74ae6SJamie Gritton struct prison *pr; 29250fe74ae6SJamie Gritton 29260fe74ae6SJamie Gritton pr = cred->cr_prison; 29270fe74ae6SJamie Gritton sx_slock(&allprison_lock); 29280fe74ae6SJamie Gritton mtx_lock(&pr->pr_mtx); 29290fe74ae6SJamie Gritton prison_set_allow_locked(pr, flag, enable); 29300fe74ae6SJamie Gritton mtx_unlock(&pr->pr_mtx); 29310fe74ae6SJamie Gritton sx_sunlock(&allprison_lock); 29320fe74ae6SJamie Gritton } 29330fe74ae6SJamie Gritton 29340fe74ae6SJamie Gritton static void 29350fe74ae6SJamie Gritton prison_set_allow_locked(struct prison *pr, unsigned flag, int enable) 29360fe74ae6SJamie Gritton { 29370fe74ae6SJamie Gritton struct prison *cpr; 29380fe74ae6SJamie Gritton int descend; 29390fe74ae6SJamie Gritton 29400fe74ae6SJamie Gritton if (enable != 0) 29410fe74ae6SJamie Gritton pr->pr_allow |= flag; 29420fe74ae6SJamie Gritton else { 29430fe74ae6SJamie Gritton pr->pr_allow &= ~flag; 29440fe74ae6SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, cpr, descend) 29450fe74ae6SJamie Gritton cpr->pr_allow &= ~flag; 29460fe74ae6SJamie Gritton } 29470fe74ae6SJamie Gritton } 29480fe74ae6SJamie Gritton 29490fe74ae6SJamie Gritton /* 2950ca04ba64SJamie Gritton * Check if a jail supports the given address family. 2951ca04ba64SJamie Gritton * 2952ca04ba64SJamie Gritton * Returns 0 if not jailed or the address family is supported, EAFNOSUPPORT 2953ca04ba64SJamie Gritton * if not. 2954ca04ba64SJamie Gritton */ 2955ca04ba64SJamie Gritton int 2956ca04ba64SJamie Gritton prison_check_af(struct ucred *cred, int af) 2957ca04ba64SJamie Gritton { 29580304c731SJamie Gritton struct prison *pr; 2959ca04ba64SJamie Gritton int error; 2960ca04ba64SJamie Gritton 2961ca04ba64SJamie Gritton KASSERT(cred != NULL, ("%s: cred is NULL", __func__)); 2962ca04ba64SJamie Gritton 29630304c731SJamie Gritton pr = cred->cr_prison; 2964499650a0SJamie Gritton #ifdef VIMAGE 29656bb79563SJamie Gritton /* Prisons with their own network stack are not limited. */ 2966de0bd6f7SBjoern A. Zeeb if (prison_owns_vnet(cred)) 29676bb79563SJamie Gritton return (0); 2968499650a0SJamie Gritton #endif 29696bb79563SJamie Gritton 2970ca04ba64SJamie Gritton error = 0; 2971ca04ba64SJamie Gritton switch (af) 2972ca04ba64SJamie Gritton { 2973ca04ba64SJamie Gritton #ifdef INET 2974ca04ba64SJamie Gritton case AF_INET: 29750304c731SJamie Gritton if (pr->pr_flags & PR_IP4) 29760304c731SJamie Gritton { 29770304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 29780304c731SJamie Gritton if ((pr->pr_flags & PR_IP4) && pr->pr_ip4 == NULL) 2979ca04ba64SJamie Gritton error = EAFNOSUPPORT; 29800304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 29810304c731SJamie Gritton } 2982ca04ba64SJamie Gritton break; 2983ca04ba64SJamie Gritton #endif 2984ca04ba64SJamie Gritton #ifdef INET6 2985ca04ba64SJamie Gritton case AF_INET6: 29860304c731SJamie Gritton if (pr->pr_flags & PR_IP6) 29870304c731SJamie Gritton { 29880304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 29890304c731SJamie Gritton if ((pr->pr_flags & PR_IP6) && pr->pr_ip6 == NULL) 2990ca04ba64SJamie Gritton error = EAFNOSUPPORT; 29910304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 29920304c731SJamie Gritton } 2993ca04ba64SJamie Gritton break; 2994ca04ba64SJamie Gritton #endif 2995ca04ba64SJamie Gritton case AF_LOCAL: 2996ca04ba64SJamie Gritton case AF_ROUTE: 2997ca04ba64SJamie Gritton break; 2998ca04ba64SJamie Gritton default: 29990304c731SJamie Gritton if (!(pr->pr_allow & PR_ALLOW_SOCKET_AF)) 3000ca04ba64SJamie Gritton error = EAFNOSUPPORT; 3001ca04ba64SJamie Gritton } 3002ca04ba64SJamie Gritton return (error); 3003ca04ba64SJamie Gritton } 3004ca04ba64SJamie Gritton 3005ca04ba64SJamie Gritton /* 3006413628a7SBjoern A. Zeeb * Check if given address belongs to the jail referenced by cred (wrapper to 3007413628a7SBjoern A. Zeeb * prison_check_ip[46]). 3008413628a7SBjoern A. Zeeb * 30090304c731SJamie Gritton * Returns 0 if jail doesn't restrict the address family or if address belongs 30100304c731SJamie Gritton * to jail, EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if 30110304c731SJamie Gritton * the jail doesn't allow the address family. IPv4 Address passed in in NBO. 3012413628a7SBjoern A. Zeeb */ 3013413628a7SBjoern A. Zeeb int 3014c83dda36SAlexander V. Chernikov prison_if(struct ucred *cred, const struct sockaddr *sa) 301575c13541SPoul-Henning Kamp { 3016413628a7SBjoern A. Zeeb #ifdef INET 3017c83dda36SAlexander V. Chernikov const struct sockaddr_in *sai; 3018413628a7SBjoern A. Zeeb #endif 3019413628a7SBjoern A. Zeeb #ifdef INET6 3020c83dda36SAlexander V. Chernikov const struct sockaddr_in6 *sai6; 3021413628a7SBjoern A. Zeeb #endif 3022b89e82ddSJamie Gritton int error; 302375c13541SPoul-Henning Kamp 3024413628a7SBjoern A. Zeeb KASSERT(cred != NULL, ("%s: cred is NULL", __func__)); 3025413628a7SBjoern A. Zeeb KASSERT(sa != NULL, ("%s: sa is NULL", __func__)); 3026413628a7SBjoern A. Zeeb 3027de0bd6f7SBjoern A. Zeeb #ifdef VIMAGE 3028de0bd6f7SBjoern A. Zeeb if (prison_owns_vnet(cred)) 3029de0bd6f7SBjoern A. Zeeb return (0); 3030de0bd6f7SBjoern A. Zeeb #endif 3031de0bd6f7SBjoern A. Zeeb 3032b89e82ddSJamie Gritton error = 0; 3033413628a7SBjoern A. Zeeb switch (sa->sa_family) 3034413628a7SBjoern A. Zeeb { 3035413628a7SBjoern A. Zeeb #ifdef INET 3036413628a7SBjoern A. Zeeb case AF_INET: 3037c83dda36SAlexander V. Chernikov sai = (const struct sockaddr_in *)sa; 3038b89e82ddSJamie Gritton error = prison_check_ip4(cred, &sai->sin_addr); 3039413628a7SBjoern A. Zeeb break; 3040413628a7SBjoern A. Zeeb #endif 3041413628a7SBjoern A. Zeeb #ifdef INET6 3042413628a7SBjoern A. Zeeb case AF_INET6: 3043c83dda36SAlexander V. Chernikov sai6 = (const struct sockaddr_in6 *)sa; 3044b89e82ddSJamie Gritton error = prison_check_ip6(cred, &sai6->sin6_addr); 3045413628a7SBjoern A. Zeeb break; 3046413628a7SBjoern A. Zeeb #endif 3047413628a7SBjoern A. Zeeb default: 30480304c731SJamie Gritton if (!(cred->cr_prison->pr_allow & PR_ALLOW_SOCKET_AF)) 3049b89e82ddSJamie Gritton error = EAFNOSUPPORT; 3050413628a7SBjoern A. Zeeb } 3051b89e82ddSJamie Gritton return (error); 305275c13541SPoul-Henning Kamp } 305391421ba2SRobert Watson 305491421ba2SRobert Watson /* 305591421ba2SRobert Watson * Return 0 if jails permit p1 to frob p2, otherwise ESRCH. 305691421ba2SRobert Watson */ 305791421ba2SRobert Watson int 30589ddb7954SMike Barcroft prison_check(struct ucred *cred1, struct ucred *cred2) 305991421ba2SRobert Watson { 306091421ba2SRobert Watson 30610304c731SJamie Gritton return ((cred1->cr_prison == cred2->cr_prison || 30620304c731SJamie Gritton prison_ischild(cred1->cr_prison, cred2->cr_prison)) ? 0 : ESRCH); 30630304c731SJamie Gritton } 306491421ba2SRobert Watson 30650304c731SJamie Gritton /* 30660304c731SJamie Gritton * Return 1 if p2 is a child of p1, otherwise 0. 30670304c731SJamie Gritton */ 30680304c731SJamie Gritton int 30690304c731SJamie Gritton prison_ischild(struct prison *pr1, struct prison *pr2) 30700304c731SJamie Gritton { 30710304c731SJamie Gritton 30720304c731SJamie Gritton for (pr2 = pr2->pr_parent; pr2 != NULL; pr2 = pr2->pr_parent) 30730304c731SJamie Gritton if (pr1 == pr2) 30740304c731SJamie Gritton return (1); 307591421ba2SRobert Watson return (0); 307691421ba2SRobert Watson } 307791421ba2SRobert Watson 307891421ba2SRobert Watson /* 3079f7496dcaSJamie Gritton * Return true if the prison is currently alive. A prison is alive if it 3080f7496dcaSJamie Gritton * holds user references and it isn't being removed. 308176ad42abSJamie Gritton */ 308276ad42abSJamie Gritton bool 308376ad42abSJamie Gritton prison_isalive(struct prison *pr) 308476ad42abSJamie Gritton { 308576ad42abSJamie Gritton 3086*1158508aSJamie Gritton if (__predict_false(pr->pr_state != PRISON_STATE_ALIVE)) 3087cc7b7306SJamie Gritton return (false); 308876ad42abSJamie Gritton return (true); 308976ad42abSJamie Gritton } 309076ad42abSJamie Gritton 309176ad42abSJamie Gritton /* 309276ad42abSJamie Gritton * Return true if the prison is currently valid. A prison is valid if it has 309376ad42abSJamie Gritton * been fully created, and is not being destroyed. Note that dying prisons 3094f7496dcaSJamie Gritton * are still considered valid. Invalid prisons won't be found under normal 3095f7496dcaSJamie Gritton * circumstances, as they're only put in that state by functions that have 3096f7496dcaSJamie Gritton * an exclusive hold on allprison_lock. 309776ad42abSJamie Gritton */ 309876ad42abSJamie Gritton bool 309976ad42abSJamie Gritton prison_isvalid(struct prison *pr) 310076ad42abSJamie Gritton { 310176ad42abSJamie Gritton 3102*1158508aSJamie Gritton if (__predict_false(pr->pr_state == PRISON_STATE_INVALID)) 3103*1158508aSJamie Gritton return (false); 31046754ae25SJamie Gritton if (__predict_false(refcount_load(&pr->pr_ref) == 0)) 310576ad42abSJamie Gritton return (false); 310676ad42abSJamie Gritton return (true); 310776ad42abSJamie Gritton } 310876ad42abSJamie Gritton 310976ad42abSJamie Gritton /* 3110de0bd6f7SBjoern A. Zeeb * Return 1 if the passed credential is in a jail and that jail does not 3111de0bd6f7SBjoern A. Zeeb * have its own virtual network stack, otherwise 0. 3112de0bd6f7SBjoern A. Zeeb */ 3113de0bd6f7SBjoern A. Zeeb int 3114de0bd6f7SBjoern A. Zeeb jailed_without_vnet(struct ucred *cred) 3115de0bd6f7SBjoern A. Zeeb { 3116de0bd6f7SBjoern A. Zeeb 3117de0bd6f7SBjoern A. Zeeb if (!jailed(cred)) 3118de0bd6f7SBjoern A. Zeeb return (0); 3119de0bd6f7SBjoern A. Zeeb #ifdef VIMAGE 3120de0bd6f7SBjoern A. Zeeb if (prison_owns_vnet(cred)) 3121de0bd6f7SBjoern A. Zeeb return (0); 3122de0bd6f7SBjoern A. Zeeb #endif 3123de0bd6f7SBjoern A. Zeeb 3124de0bd6f7SBjoern A. Zeeb return (1); 3125de0bd6f7SBjoern A. Zeeb } 3126de0bd6f7SBjoern A. Zeeb 3127de0bd6f7SBjoern A. Zeeb /* 31287455b100SJamie Gritton * Return the correct hostname (domainname, et al) for the passed credential. 31299484d0c0SRobert Drehmel */ 3130ad1ff099SRobert Drehmel void 31319ddb7954SMike Barcroft getcredhostname(struct ucred *cred, char *buf, size_t size) 31329484d0c0SRobert Drehmel { 313376ca6f88SJamie Gritton struct prison *pr; 31349484d0c0SRobert Drehmel 31357455b100SJamie Gritton /* 31367455b100SJamie Gritton * A NULL credential can be used to shortcut to the physical 31377455b100SJamie Gritton * system's hostname. 31387455b100SJamie Gritton */ 313976ca6f88SJamie Gritton pr = (cred != NULL) ? cred->cr_prison : &prison0; 314076ca6f88SJamie Gritton mtx_lock(&pr->pr_mtx); 3141c1f19219SJamie Gritton strlcpy(buf, pr->pr_hostname, size); 314276ca6f88SJamie Gritton mtx_unlock(&pr->pr_mtx); 31439484d0c0SRobert Drehmel } 3144fd7a8150SMike Barcroft 31457455b100SJamie Gritton void 31467455b100SJamie Gritton getcreddomainname(struct ucred *cred, char *buf, size_t size) 31477455b100SJamie Gritton { 31487455b100SJamie Gritton 31497455b100SJamie Gritton mtx_lock(&cred->cr_prison->pr_mtx); 3150c1f19219SJamie Gritton strlcpy(buf, cred->cr_prison->pr_domainname, size); 31517455b100SJamie Gritton mtx_unlock(&cred->cr_prison->pr_mtx); 31527455b100SJamie Gritton } 31537455b100SJamie Gritton 31547455b100SJamie Gritton void 31557455b100SJamie Gritton getcredhostuuid(struct ucred *cred, char *buf, size_t size) 31567455b100SJamie Gritton { 31577455b100SJamie Gritton 31587455b100SJamie Gritton mtx_lock(&cred->cr_prison->pr_mtx); 3159c1f19219SJamie Gritton strlcpy(buf, cred->cr_prison->pr_hostuuid, size); 31607455b100SJamie Gritton mtx_unlock(&cred->cr_prison->pr_mtx); 31617455b100SJamie Gritton } 31627455b100SJamie Gritton 31637455b100SJamie Gritton void 31647455b100SJamie Gritton getcredhostid(struct ucred *cred, unsigned long *hostid) 31657455b100SJamie Gritton { 31667455b100SJamie Gritton 31677455b100SJamie Gritton mtx_lock(&cred->cr_prison->pr_mtx); 31687455b100SJamie Gritton *hostid = cred->cr_prison->pr_hostid; 31697455b100SJamie Gritton mtx_unlock(&cred->cr_prison->pr_mtx); 31707455b100SJamie Gritton } 31717455b100SJamie Gritton 31723f8bc99cSKristof Provost void 31733f8bc99cSKristof Provost getjailname(struct ucred *cred, char *name, size_t len) 31743f8bc99cSKristof Provost { 31753f8bc99cSKristof Provost 31763f8bc99cSKristof Provost mtx_lock(&cred->cr_prison->pr_mtx); 31773f8bc99cSKristof Provost strlcpy(name, cred->cr_prison->pr_name, len); 31783f8bc99cSKristof Provost mtx_unlock(&cred->cr_prison->pr_mtx); 31793f8bc99cSKristof Provost } 31803f8bc99cSKristof Provost 3181eb79e1c7SBjoern A. Zeeb #ifdef VIMAGE 3182eb79e1c7SBjoern A. Zeeb /* 3183eb79e1c7SBjoern A. Zeeb * Determine whether the prison represented by cred owns 3184eb79e1c7SBjoern A. Zeeb * its vnet rather than having it inherited. 3185eb79e1c7SBjoern A. Zeeb * 3186eb79e1c7SBjoern A. Zeeb * Returns 1 in case the prison owns the vnet, 0 otherwise. 3187eb79e1c7SBjoern A. Zeeb */ 3188eb79e1c7SBjoern A. Zeeb int 3189eb79e1c7SBjoern A. Zeeb prison_owns_vnet(struct ucred *cred) 3190eb79e1c7SBjoern A. Zeeb { 3191eb79e1c7SBjoern A. Zeeb 3192eb79e1c7SBjoern A. Zeeb /* 3193eb79e1c7SBjoern A. Zeeb * vnets cannot be added/removed after jail creation, 3194eb79e1c7SBjoern A. Zeeb * so no need to lock here. 3195eb79e1c7SBjoern A. Zeeb */ 3196eb79e1c7SBjoern A. Zeeb return (cred->cr_prison->pr_flags & PR_VNET ? 1 : 0); 3197eb79e1c7SBjoern A. Zeeb } 3198eb79e1c7SBjoern A. Zeeb #endif 3199eb79e1c7SBjoern A. Zeeb 3200f08df373SRobert Watson /* 3201820a0de9SPawel Jakub Dawidek * Determine whether the subject represented by cred can "see" 3202820a0de9SPawel Jakub Dawidek * status of a mount point. 3203820a0de9SPawel Jakub Dawidek * Returns: 0 for permitted, ENOENT otherwise. 3204820a0de9SPawel Jakub Dawidek * XXX: This function should be called cr_canseemount() and should be 3205820a0de9SPawel Jakub Dawidek * placed in kern_prot.c. 3206f08df373SRobert Watson */ 3207f08df373SRobert Watson int 3208820a0de9SPawel Jakub Dawidek prison_canseemount(struct ucred *cred, struct mount *mp) 3209f08df373SRobert Watson { 3210820a0de9SPawel Jakub Dawidek struct prison *pr; 3211820a0de9SPawel Jakub Dawidek struct statfs *sp; 3212820a0de9SPawel Jakub Dawidek size_t len; 3213f08df373SRobert Watson 3214820a0de9SPawel Jakub Dawidek pr = cred->cr_prison; 32150304c731SJamie Gritton if (pr->pr_enforce_statfs == 0) 32160304c731SJamie Gritton return (0); 3217820a0de9SPawel Jakub Dawidek if (pr->pr_root->v_mount == mp) 3218820a0de9SPawel Jakub Dawidek return (0); 32190304c731SJamie Gritton if (pr->pr_enforce_statfs == 2) 3220820a0de9SPawel Jakub Dawidek return (ENOENT); 3221820a0de9SPawel Jakub Dawidek /* 3222820a0de9SPawel Jakub Dawidek * If jail's chroot directory is set to "/" we should be able to see 3223820a0de9SPawel Jakub Dawidek * all mount-points from inside a jail. 3224820a0de9SPawel Jakub Dawidek * This is ugly check, but this is the only situation when jail's 3225820a0de9SPawel Jakub Dawidek * directory ends with '/'. 3226820a0de9SPawel Jakub Dawidek */ 3227820a0de9SPawel Jakub Dawidek if (strcmp(pr->pr_path, "/") == 0) 3228820a0de9SPawel Jakub Dawidek return (0); 3229820a0de9SPawel Jakub Dawidek len = strlen(pr->pr_path); 3230820a0de9SPawel Jakub Dawidek sp = &mp->mnt_stat; 3231820a0de9SPawel Jakub Dawidek if (strncmp(pr->pr_path, sp->f_mntonname, len) != 0) 3232820a0de9SPawel Jakub Dawidek return (ENOENT); 3233820a0de9SPawel Jakub Dawidek /* 3234820a0de9SPawel Jakub Dawidek * Be sure that we don't have situation where jail's root directory 3235820a0de9SPawel Jakub Dawidek * is "/some/path" and mount point is "/some/pathpath". 3236820a0de9SPawel Jakub Dawidek */ 3237820a0de9SPawel Jakub Dawidek if (sp->f_mntonname[len] != '\0' && sp->f_mntonname[len] != '/') 3238820a0de9SPawel Jakub Dawidek return (ENOENT); 3239f08df373SRobert Watson return (0); 3240f08df373SRobert Watson } 3241820a0de9SPawel Jakub Dawidek 3242820a0de9SPawel Jakub Dawidek void 3243820a0de9SPawel Jakub Dawidek prison_enforce_statfs(struct ucred *cred, struct mount *mp, struct statfs *sp) 3244820a0de9SPawel Jakub Dawidek { 3245820a0de9SPawel Jakub Dawidek char jpath[MAXPATHLEN]; 3246820a0de9SPawel Jakub Dawidek struct prison *pr; 3247820a0de9SPawel Jakub Dawidek size_t len; 3248820a0de9SPawel Jakub Dawidek 3249820a0de9SPawel Jakub Dawidek pr = cred->cr_prison; 32500304c731SJamie Gritton if (pr->pr_enforce_statfs == 0) 32510304c731SJamie Gritton return; 3252820a0de9SPawel Jakub Dawidek if (prison_canseemount(cred, mp) != 0) { 3253820a0de9SPawel Jakub Dawidek bzero(sp->f_mntonname, sizeof(sp->f_mntonname)); 3254820a0de9SPawel Jakub Dawidek strlcpy(sp->f_mntonname, "[restricted]", 3255820a0de9SPawel Jakub Dawidek sizeof(sp->f_mntonname)); 3256820a0de9SPawel Jakub Dawidek return; 3257820a0de9SPawel Jakub Dawidek } 3258820a0de9SPawel Jakub Dawidek if (pr->pr_root->v_mount == mp) { 3259820a0de9SPawel Jakub Dawidek /* 3260820a0de9SPawel Jakub Dawidek * Clear current buffer data, so we are sure nothing from 3261820a0de9SPawel Jakub Dawidek * the valid path left there. 3262820a0de9SPawel Jakub Dawidek */ 3263820a0de9SPawel Jakub Dawidek bzero(sp->f_mntonname, sizeof(sp->f_mntonname)); 3264820a0de9SPawel Jakub Dawidek *sp->f_mntonname = '/'; 3265820a0de9SPawel Jakub Dawidek return; 3266820a0de9SPawel Jakub Dawidek } 3267820a0de9SPawel Jakub Dawidek /* 3268820a0de9SPawel Jakub Dawidek * If jail's chroot directory is set to "/" we should be able to see 3269820a0de9SPawel Jakub Dawidek * all mount-points from inside a jail. 3270820a0de9SPawel Jakub Dawidek */ 3271820a0de9SPawel Jakub Dawidek if (strcmp(pr->pr_path, "/") == 0) 3272820a0de9SPawel Jakub Dawidek return; 3273820a0de9SPawel Jakub Dawidek len = strlen(pr->pr_path); 3274820a0de9SPawel Jakub Dawidek strlcpy(jpath, sp->f_mntonname + len, sizeof(jpath)); 3275820a0de9SPawel Jakub Dawidek /* 3276820a0de9SPawel Jakub Dawidek * Clear current buffer data, so we are sure nothing from 3277820a0de9SPawel Jakub Dawidek * the valid path left there. 3278820a0de9SPawel Jakub Dawidek */ 3279820a0de9SPawel Jakub Dawidek bzero(sp->f_mntonname, sizeof(sp->f_mntonname)); 3280820a0de9SPawel Jakub Dawidek if (*jpath == '\0') { 3281820a0de9SPawel Jakub Dawidek /* Should never happen. */ 3282820a0de9SPawel Jakub Dawidek *sp->f_mntonname = '/'; 3283820a0de9SPawel Jakub Dawidek } else { 3284820a0de9SPawel Jakub Dawidek strlcpy(sp->f_mntonname, jpath, sizeof(sp->f_mntonname)); 3285820a0de9SPawel Jakub Dawidek } 3286f08df373SRobert Watson } 3287f08df373SRobert Watson 3288800c9408SRobert Watson /* 3289800c9408SRobert Watson * Check with permission for a specific privilege is granted within jail. We 3290800c9408SRobert Watson * have a specific list of accepted privileges; the rest are denied. 3291800c9408SRobert Watson */ 3292800c9408SRobert Watson int 3293800c9408SRobert Watson prison_priv_check(struct ucred *cred, int priv) 3294800c9408SRobert Watson { 32950fe74ae6SJamie Gritton struct prison *pr; 32960fe74ae6SJamie Gritton int error; 3297800c9408SRobert Watson 32987b2ff0dcSMateusz Guzik /* 32997b2ff0dcSMateusz Guzik * Some policies have custom handlers. This routine should not be 33007b2ff0dcSMateusz Guzik * called for them. See priv_check_cred(). 33017b2ff0dcSMateusz Guzik */ 33027b2ff0dcSMateusz Guzik switch (priv) { 3303a459a6cfSMateusz Guzik case PRIV_VFS_LOOKUP: 33047b2ff0dcSMateusz Guzik case PRIV_VFS_GENERATION: 33057b2ff0dcSMateusz Guzik KASSERT(0, ("prison_priv_check instead of a custom handler " 33067b2ff0dcSMateusz Guzik "called for %d\n", priv)); 33077b2ff0dcSMateusz Guzik } 33087b2ff0dcSMateusz Guzik 3309800c9408SRobert Watson if (!jailed(cred)) 3310800c9408SRobert Watson return (0); 3311800c9408SRobert Watson 33126bb79563SJamie Gritton #ifdef VIMAGE 33136bb79563SJamie Gritton /* 33146bb79563SJamie Gritton * Privileges specific to prisons with a virtual network stack. 33156bb79563SJamie Gritton * There might be a duplicate entry here in case the privilege 33166bb79563SJamie Gritton * is only granted conditionally in the legacy jail case. 33176bb79563SJamie Gritton */ 33186bb79563SJamie Gritton switch (priv) { 33196bb79563SJamie Gritton #ifdef notyet 33206bb79563SJamie Gritton /* 33216bb79563SJamie Gritton * NFS-specific privileges. 33226bb79563SJamie Gritton */ 33236bb79563SJamie Gritton case PRIV_NFS_DAEMON: 33246bb79563SJamie Gritton case PRIV_NFS_LOCKD: 33256bb79563SJamie Gritton #endif 33266bb79563SJamie Gritton /* 33276bb79563SJamie Gritton * Network stack privileges. 33286bb79563SJamie Gritton */ 33296bb79563SJamie Gritton case PRIV_NET_BRIDGE: 33306bb79563SJamie Gritton case PRIV_NET_GRE: 33316bb79563SJamie Gritton case PRIV_NET_BPF: 33326bb79563SJamie Gritton case PRIV_NET_RAW: /* Dup, cond. in legacy jail case. */ 33336bb79563SJamie Gritton case PRIV_NET_ROUTE: 33346bb79563SJamie Gritton case PRIV_NET_TAP: 33356bb79563SJamie Gritton case PRIV_NET_SETIFMTU: 33366bb79563SJamie Gritton case PRIV_NET_SETIFFLAGS: 33376bb79563SJamie Gritton case PRIV_NET_SETIFCAP: 3338215940b3SXin LI case PRIV_NET_SETIFDESCR: 33396bb79563SJamie Gritton case PRIV_NET_SETIFNAME : 33406bb79563SJamie Gritton case PRIV_NET_SETIFMETRIC: 33416bb79563SJamie Gritton case PRIV_NET_SETIFPHYS: 33426bb79563SJamie Gritton case PRIV_NET_SETIFMAC: 3343389474c1SKonstantin Belousov case PRIV_NET_SETLANPCP: 33446bb79563SJamie Gritton case PRIV_NET_ADDMULTI: 33456bb79563SJamie Gritton case PRIV_NET_DELMULTI: 33466bb79563SJamie Gritton case PRIV_NET_HWIOCTL: 33476bb79563SJamie Gritton case PRIV_NET_SETLLADDR: 33486bb79563SJamie Gritton case PRIV_NET_ADDIFGROUP: 33496bb79563SJamie Gritton case PRIV_NET_DELIFGROUP: 33506bb79563SJamie Gritton case PRIV_NET_IFCREATE: 33516bb79563SJamie Gritton case PRIV_NET_IFDESTROY: 33526bb79563SJamie Gritton case PRIV_NET_ADDIFADDR: 33536bb79563SJamie Gritton case PRIV_NET_DELIFADDR: 33546bb79563SJamie Gritton case PRIV_NET_LAGG: 33556bb79563SJamie Gritton case PRIV_NET_GIF: 33566bb79563SJamie Gritton case PRIV_NET_SETIFVNET: 335735fd7bc0SBjoern A. Zeeb case PRIV_NET_SETIFFIB: 33586bb79563SJamie Gritton 33596bb79563SJamie Gritton /* 33606bb79563SJamie Gritton * 802.11-related privileges. 33616bb79563SJamie Gritton */ 3362f7d38a13SAdrian Chadd case PRIV_NET80211_VAP_GETKEY: 3363f7d38a13SAdrian Chadd case PRIV_NET80211_VAP_MANAGE: 33646bb79563SJamie Gritton 33656bb79563SJamie Gritton #ifdef notyet 33666bb79563SJamie Gritton /* 33676bb79563SJamie Gritton * ATM privileges. 33686bb79563SJamie Gritton */ 33696bb79563SJamie Gritton case PRIV_NETATM_CFG: 33706bb79563SJamie Gritton case PRIV_NETATM_ADD: 33716bb79563SJamie Gritton case PRIV_NETATM_DEL: 33726bb79563SJamie Gritton case PRIV_NETATM_SET: 33736bb79563SJamie Gritton 33746bb79563SJamie Gritton /* 33756bb79563SJamie Gritton * Bluetooth privileges. 33766bb79563SJamie Gritton */ 33776bb79563SJamie Gritton case PRIV_NETBLUETOOTH_RAW: 33786bb79563SJamie Gritton #endif 33796bb79563SJamie Gritton 33806bb79563SJamie Gritton /* 33816bb79563SJamie Gritton * Netgraph and netgraph module privileges. 33826bb79563SJamie Gritton */ 33836bb79563SJamie Gritton case PRIV_NETGRAPH_CONTROL: 33846bb79563SJamie Gritton #ifdef notyet 33856bb79563SJamie Gritton case PRIV_NETGRAPH_TTY: 33866bb79563SJamie Gritton #endif 33876bb79563SJamie Gritton 33886bb79563SJamie Gritton /* 33896bb79563SJamie Gritton * IPv4 and IPv6 privileges. 33906bb79563SJamie Gritton */ 33916bb79563SJamie Gritton case PRIV_NETINET_IPFW: 33926bb79563SJamie Gritton case PRIV_NETINET_DIVERT: 33936bb79563SJamie Gritton case PRIV_NETINET_PF: 33946bb79563SJamie Gritton case PRIV_NETINET_DUMMYNET: 33956bb79563SJamie Gritton case PRIV_NETINET_CARP: 33966bb79563SJamie Gritton case PRIV_NETINET_MROUTE: 33976bb79563SJamie Gritton case PRIV_NETINET_RAW: 33986bb79563SJamie Gritton case PRIV_NETINET_ADDRCTRL6: 33996bb79563SJamie Gritton case PRIV_NETINET_ND6: 34006bb79563SJamie Gritton case PRIV_NETINET_SCOPE6: 34016bb79563SJamie Gritton case PRIV_NETINET_ALIFETIME6: 34026bb79563SJamie Gritton case PRIV_NETINET_IPSEC: 34036bb79563SJamie Gritton case PRIV_NETINET_BINDANY: 34046bb79563SJamie Gritton 34056bb79563SJamie Gritton #ifdef notyet 34066bb79563SJamie Gritton /* 34076bb79563SJamie Gritton * NCP privileges. 34086bb79563SJamie Gritton */ 34096bb79563SJamie Gritton case PRIV_NETNCP: 34106bb79563SJamie Gritton 34116bb79563SJamie Gritton /* 34126bb79563SJamie Gritton * SMB privileges. 34136bb79563SJamie Gritton */ 34146bb79563SJamie Gritton case PRIV_NETSMB: 34156bb79563SJamie Gritton #endif 34166bb79563SJamie Gritton 34176bb79563SJamie Gritton /* 34186bb79563SJamie Gritton * No default: or deny here. 34196bb79563SJamie Gritton * In case of no permit fall through to next switch(). 34206bb79563SJamie Gritton */ 34216bb79563SJamie Gritton if (cred->cr_prison->pr_flags & PR_VNET) 34226bb79563SJamie Gritton return (0); 34236bb79563SJamie Gritton } 34246bb79563SJamie Gritton #endif /* VIMAGE */ 34256bb79563SJamie Gritton 3426800c9408SRobert Watson switch (priv) { 3427800c9408SRobert Watson /* 3428800c9408SRobert Watson * Allow ktrace privileges for root in jail. 3429800c9408SRobert Watson */ 3430800c9408SRobert Watson case PRIV_KTRACE: 3431800c9408SRobert Watson 3432c3c1b5e6SRobert Watson #if 0 3433800c9408SRobert Watson /* 3434800c9408SRobert Watson * Allow jailed processes to configure audit identity and 3435800c9408SRobert Watson * submit audit records (login, etc). In the future we may 3436800c9408SRobert Watson * want to further refine the relationship between audit and 3437800c9408SRobert Watson * jail. 3438800c9408SRobert Watson */ 3439800c9408SRobert Watson case PRIV_AUDIT_GETAUDIT: 3440800c9408SRobert Watson case PRIV_AUDIT_SETAUDIT: 3441800c9408SRobert Watson case PRIV_AUDIT_SUBMIT: 3442c3c1b5e6SRobert Watson #endif 3443800c9408SRobert Watson 3444800c9408SRobert Watson /* 3445800c9408SRobert Watson * Allow jailed processes to manipulate process UNIX 3446800c9408SRobert Watson * credentials in any way they see fit. 3447800c9408SRobert Watson */ 3448800c9408SRobert Watson case PRIV_CRED_SETUID: 3449800c9408SRobert Watson case PRIV_CRED_SETEUID: 3450800c9408SRobert Watson case PRIV_CRED_SETGID: 3451800c9408SRobert Watson case PRIV_CRED_SETEGID: 3452800c9408SRobert Watson case PRIV_CRED_SETGROUPS: 3453800c9408SRobert Watson case PRIV_CRED_SETREUID: 3454800c9408SRobert Watson case PRIV_CRED_SETREGID: 3455800c9408SRobert Watson case PRIV_CRED_SETRESUID: 3456800c9408SRobert Watson case PRIV_CRED_SETRESGID: 3457800c9408SRobert Watson 3458800c9408SRobert Watson /* 3459800c9408SRobert Watson * Jail implements visibility constraints already, so allow 3460800c9408SRobert Watson * jailed root to override uid/gid-based constraints. 3461800c9408SRobert Watson */ 3462800c9408SRobert Watson case PRIV_SEEOTHERGIDS: 3463800c9408SRobert Watson case PRIV_SEEOTHERUIDS: 3464800c9408SRobert Watson 3465800c9408SRobert Watson /* 3466800c9408SRobert Watson * Jail implements inter-process debugging limits already, so 3467800c9408SRobert Watson * allow jailed root various debugging privileges. 3468800c9408SRobert Watson */ 3469800c9408SRobert Watson case PRIV_DEBUG_DIFFCRED: 3470800c9408SRobert Watson case PRIV_DEBUG_SUGID: 3471800c9408SRobert Watson case PRIV_DEBUG_UNPRIV: 3472800c9408SRobert Watson 3473800c9408SRobert Watson /* 3474800c9408SRobert Watson * Allow jail to set various resource limits and login 3475800c9408SRobert Watson * properties, and for now, exceed process resource limits. 3476800c9408SRobert Watson */ 3477800c9408SRobert Watson case PRIV_PROC_LIMIT: 3478800c9408SRobert Watson case PRIV_PROC_SETLOGIN: 3479800c9408SRobert Watson case PRIV_PROC_SETRLIMIT: 3480800c9408SRobert Watson 3481800c9408SRobert Watson /* 3482800c9408SRobert Watson * System V and POSIX IPC privileges are granted in jail. 3483800c9408SRobert Watson */ 3484800c9408SRobert Watson case PRIV_IPC_READ: 3485800c9408SRobert Watson case PRIV_IPC_WRITE: 3486800c9408SRobert Watson case PRIV_IPC_ADMIN: 3487800c9408SRobert Watson case PRIV_IPC_MSGSIZE: 3488800c9408SRobert Watson case PRIV_MQ_ADMIN: 3489800c9408SRobert Watson 3490800c9408SRobert Watson /* 34910304c731SJamie Gritton * Jail operations within a jail work on child jails. 34920304c731SJamie Gritton */ 34930304c731SJamie Gritton case PRIV_JAIL_ATTACH: 34940304c731SJamie Gritton case PRIV_JAIL_SET: 34950304c731SJamie Gritton case PRIV_JAIL_REMOVE: 34960304c731SJamie Gritton 34970304c731SJamie Gritton /* 3498800c9408SRobert Watson * Jail implements its own inter-process limits, so allow 3499800c9408SRobert Watson * root processes in jail to change scheduling on other 3500800c9408SRobert Watson * processes in the same jail. Likewise for signalling. 3501800c9408SRobert Watson */ 3502800c9408SRobert Watson case PRIV_SCHED_DIFFCRED: 3503413628a7SBjoern A. Zeeb case PRIV_SCHED_CPUSET: 3504800c9408SRobert Watson case PRIV_SIGNAL_DIFFCRED: 3505800c9408SRobert Watson case PRIV_SIGNAL_SUGID: 3506800c9408SRobert Watson 3507800c9408SRobert Watson /* 3508800c9408SRobert Watson * Allow jailed processes to write to sysctls marked as jail 3509800c9408SRobert Watson * writable. 3510800c9408SRobert Watson */ 3511800c9408SRobert Watson case PRIV_SYSCTL_WRITEJAIL: 3512800c9408SRobert Watson 3513800c9408SRobert Watson /* 3514800c9408SRobert Watson * Allow root in jail to manage a variety of quota 3515e82d0201SRobert Watson * properties. These should likely be conditional on a 3516e82d0201SRobert Watson * configuration option. 3517800c9408SRobert Watson */ 351895b091d2SRobert Watson case PRIV_VFS_GETQUOTA: 351995b091d2SRobert Watson case PRIV_VFS_SETQUOTA: 3520800c9408SRobert Watson 3521800c9408SRobert Watson /* 3522800c9408SRobert Watson * Since Jail relies on chroot() to implement file system 3523800c9408SRobert Watson * protections, grant many VFS privileges to root in jail. 3524800c9408SRobert Watson * Be careful to exclude mount-related and NFS-related 3525800c9408SRobert Watson * privileges. 3526800c9408SRobert Watson */ 3527800c9408SRobert Watson case PRIV_VFS_READ: 3528800c9408SRobert Watson case PRIV_VFS_WRITE: 3529800c9408SRobert Watson case PRIV_VFS_ADMIN: 3530800c9408SRobert Watson case PRIV_VFS_EXEC: 3531800c9408SRobert Watson case PRIV_VFS_BLOCKRESERVE: /* XXXRW: Slightly surprising. */ 3532800c9408SRobert Watson case PRIV_VFS_CHFLAGS_DEV: 3533800c9408SRobert Watson case PRIV_VFS_CHOWN: 3534800c9408SRobert Watson case PRIV_VFS_CHROOT: 3535bb531912SPawel Jakub Dawidek case PRIV_VFS_RETAINSUGID: 3536800c9408SRobert Watson case PRIV_VFS_FCHROOT: 3537800c9408SRobert Watson case PRIV_VFS_LINK: 3538800c9408SRobert Watson case PRIV_VFS_SETGID: 3539e41966dcSRobert Watson case PRIV_VFS_STAT: 3540800c9408SRobert Watson case PRIV_VFS_STICKYFILE: 3541bb56d716SJamie Gritton 3542bb56d716SJamie Gritton /* 3543bb56d716SJamie Gritton * As in the non-jail case, non-root users are expected to be 3544bb56d716SJamie Gritton * able to read kernel/phyiscal memory (provided /dev/[k]mem 3545bb56d716SJamie Gritton * exists in the jail and they have permission to access it). 3546bb56d716SJamie Gritton */ 3547bb56d716SJamie Gritton case PRIV_KMEM_READ: 3548800c9408SRobert Watson return (0); 3549800c9408SRobert Watson 3550800c9408SRobert Watson /* 3551800c9408SRobert Watson * Depending on the global setting, allow privilege of 3552800c9408SRobert Watson * setting system flags. 3553800c9408SRobert Watson */ 3554800c9408SRobert Watson case PRIV_VFS_SYSFLAGS: 35550304c731SJamie Gritton if (cred->cr_prison->pr_allow & PR_ALLOW_CHFLAGS) 3556800c9408SRobert Watson return (0); 3557800c9408SRobert Watson else 3558800c9408SRobert Watson return (EPERM); 3559800c9408SRobert Watson 3560800c9408SRobert Watson /* 3561f3a8d2f9SPawel Jakub Dawidek * Depending on the global setting, allow privilege of 3562f3a8d2f9SPawel Jakub Dawidek * mounting/unmounting file systems. 3563f3a8d2f9SPawel Jakub Dawidek */ 3564f3a8d2f9SPawel Jakub Dawidek case PRIV_VFS_MOUNT: 3565f3a8d2f9SPawel Jakub Dawidek case PRIV_VFS_UNMOUNT: 3566f3a8d2f9SPawel Jakub Dawidek case PRIV_VFS_MOUNT_NONUSER: 356724b0502eSPawel Jakub Dawidek case PRIV_VFS_MOUNT_OWNER: 35680fe74ae6SJamie Gritton pr = cred->cr_prison; 35690fe74ae6SJamie Gritton prison_lock(pr); 35700fe74ae6SJamie Gritton if (pr->pr_allow & PR_ALLOW_MOUNT && pr->pr_enforce_statfs < 2) 35710fe74ae6SJamie Gritton error = 0; 3572f3a8d2f9SPawel Jakub Dawidek else 35730fe74ae6SJamie Gritton error = EPERM; 35740fe74ae6SJamie Gritton prison_unlock(pr); 35750fe74ae6SJamie Gritton return (error); 3576f3a8d2f9SPawel Jakub Dawidek 3577f3a8d2f9SPawel Jakub Dawidek /* 357863619b6dSKyle Evans * Jails should hold no disposition on the PRIV_VFS_READ_DIR 357963619b6dSKyle Evans * policy. priv_check_cred will not specifically allow it, and 358063619b6dSKyle Evans * we may want a MAC policy to allow it. 358163619b6dSKyle Evans */ 358263619b6dSKyle Evans case PRIV_VFS_READ_DIR: 358363619b6dSKyle Evans return (0); 358463619b6dSKyle Evans 358563619b6dSKyle Evans /* 3586ccd6ac9fSAntoine Brodin * Conditionnaly allow locking (unlocking) physical pages 3587ccd6ac9fSAntoine Brodin * in memory. 3588ccd6ac9fSAntoine Brodin */ 3589ccd6ac9fSAntoine Brodin case PRIV_VM_MLOCK: 3590ccd6ac9fSAntoine Brodin case PRIV_VM_MUNLOCK: 3591ccd6ac9fSAntoine Brodin if (cred->cr_prison->pr_allow & PR_ALLOW_MLOCK) 3592ccd6ac9fSAntoine Brodin return (0); 3593ccd6ac9fSAntoine Brodin else 3594ccd6ac9fSAntoine Brodin return (EPERM); 3595ccd6ac9fSAntoine Brodin 3596ccd6ac9fSAntoine Brodin /* 3597e28f9b7dSAllan Jude * Conditionally allow jailed root to bind reserved ports. 3598800c9408SRobert Watson */ 3599800c9408SRobert Watson case PRIV_NETINET_RESERVEDPORT: 3600e28f9b7dSAllan Jude if (cred->cr_prison->pr_allow & PR_ALLOW_RESERVED_PORTS) 3601e28f9b7dSAllan Jude return (0); 3602e28f9b7dSAllan Jude else 3603e28f9b7dSAllan Jude return (EPERM); 3604e28f9b7dSAllan Jude 3605e28f9b7dSAllan Jude /* 3606e28f9b7dSAllan Jude * Allow jailed root to reuse in-use ports. 3607e28f9b7dSAllan Jude */ 36084b084056SRobert Watson case PRIV_NETINET_REUSEPORT: 3609800c9408SRobert Watson return (0); 3610800c9408SRobert Watson 3611800c9408SRobert Watson /* 3612e3043798SPedro F. Giffuni * Allow jailed root to set certain IPv4/6 (option) headers. 361379ba3952SBjoern A. Zeeb */ 361479ba3952SBjoern A. Zeeb case PRIV_NETINET_SETHDROPTS: 361579ba3952SBjoern A. Zeeb return (0); 361679ba3952SBjoern A. Zeeb 361779ba3952SBjoern A. Zeeb /* 3618800c9408SRobert Watson * Conditionally allow creating raw sockets in jail. 3619800c9408SRobert Watson */ 3620800c9408SRobert Watson case PRIV_NETINET_RAW: 36210304c731SJamie Gritton if (cred->cr_prison->pr_allow & PR_ALLOW_RAW_SOCKETS) 3622800c9408SRobert Watson return (0); 3623800c9408SRobert Watson else 3624800c9408SRobert Watson return (EPERM); 3625800c9408SRobert Watson 3626800c9408SRobert Watson /* 3627800c9408SRobert Watson * Since jail implements its own visibility limits on netstat 3628800c9408SRobert Watson * sysctls, allow getcred. This allows identd to work in 3629800c9408SRobert Watson * jail. 3630800c9408SRobert Watson */ 3631800c9408SRobert Watson case PRIV_NETINET_GETCRED: 3632800c9408SRobert Watson return (0); 3633800c9408SRobert Watson 36342bfc50bcSEdward Tomasz Napierala /* 36352bfc50bcSEdward Tomasz Napierala * Allow jailed root to set loginclass. 36362bfc50bcSEdward Tomasz Napierala */ 36372bfc50bcSEdward Tomasz Napierala case PRIV_PROC_SETLOGINCLASS: 36382bfc50bcSEdward Tomasz Napierala return (0); 36392bfc50bcSEdward Tomasz Napierala 3640b19d66fdSJamie Gritton /* 36414520f617SJamie Gritton * Do not allow a process inside a jail to read the kernel 3642b19d66fdSJamie Gritton * message buffer unless explicitly permitted. 3643b19d66fdSJamie Gritton */ 3644b19d66fdSJamie Gritton case PRIV_MSGBUF: 3645b19d66fdSJamie Gritton if (cred->cr_prison->pr_allow & PR_ALLOW_READ_MSGBUF) 3646b19d66fdSJamie Gritton return (0); 3647b19d66fdSJamie Gritton return (EPERM); 3648b19d66fdSJamie Gritton 3649800c9408SRobert Watson default: 3650800c9408SRobert Watson /* 3651800c9408SRobert Watson * In all remaining cases, deny the privilege request. This 3652800c9408SRobert Watson * includes almost all network privileges, many system 3653800c9408SRobert Watson * configuration privileges. 3654800c9408SRobert Watson */ 3655800c9408SRobert Watson return (EPERM); 3656800c9408SRobert Watson } 3657800c9408SRobert Watson } 3658800c9408SRobert Watson 36590304c731SJamie Gritton /* 36600304c731SJamie Gritton * Return the part of pr2's name that is relative to pr1, or the whole name 36610304c731SJamie Gritton * if it does not directly follow. 36620304c731SJamie Gritton */ 36630304c731SJamie Gritton 36640304c731SJamie Gritton char * 36650304c731SJamie Gritton prison_name(struct prison *pr1, struct prison *pr2) 36660304c731SJamie Gritton { 36670304c731SJamie Gritton char *name; 36680304c731SJamie Gritton 36690304c731SJamie Gritton /* Jails see themselves as "0" (if they see themselves at all). */ 36700304c731SJamie Gritton if (pr1 == pr2) 36710304c731SJamie Gritton return "0"; 36720304c731SJamie Gritton name = pr2->pr_name; 36730304c731SJamie Gritton if (prison_ischild(pr1, pr2)) { 36740304c731SJamie Gritton /* 36750304c731SJamie Gritton * pr1 isn't locked (and allprison_lock may not be either) 36760304c731SJamie Gritton * so its length can't be counted on. But the number of dots 36770304c731SJamie Gritton * can be counted on - and counted. 36780304c731SJamie Gritton */ 36790304c731SJamie Gritton for (; pr1 != &prison0; pr1 = pr1->pr_parent) 36800304c731SJamie Gritton name = strchr(name, '.') + 1; 36810304c731SJamie Gritton } 36820304c731SJamie Gritton return (name); 36830304c731SJamie Gritton } 36840304c731SJamie Gritton 36850304c731SJamie Gritton /* 36860304c731SJamie Gritton * Return the part of pr2's path that is relative to pr1, or the whole path 36870304c731SJamie Gritton * if it does not directly follow. 36880304c731SJamie Gritton */ 36890304c731SJamie Gritton static char * 36900304c731SJamie Gritton prison_path(struct prison *pr1, struct prison *pr2) 36910304c731SJamie Gritton { 36920304c731SJamie Gritton char *path1, *path2; 36930304c731SJamie Gritton int len1; 36940304c731SJamie Gritton 36950304c731SJamie Gritton path1 = pr1->pr_path; 36960304c731SJamie Gritton path2 = pr2->pr_path; 36970304c731SJamie Gritton if (!strcmp(path1, "/")) 36980304c731SJamie Gritton return (path2); 36990304c731SJamie Gritton len1 = strlen(path1); 37000304c731SJamie Gritton if (strncmp(path1, path2, len1)) 37010304c731SJamie Gritton return (path2); 37020304c731SJamie Gritton if (path2[len1] == '\0') 37030304c731SJamie Gritton return "/"; 37040304c731SJamie Gritton if (path2[len1] == '/') 37050304c731SJamie Gritton return (path2 + len1); 37060304c731SJamie Gritton return (path2); 37070304c731SJamie Gritton } 37080304c731SJamie Gritton 37090304c731SJamie Gritton /* 37100304c731SJamie Gritton * Jail-related sysctls. 37110304c731SJamie Gritton */ 37127029da5cSPawel Biernacki static SYSCTL_NODE(_security, OID_AUTO, jail, CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 37130304c731SJamie Gritton "Jails"); 37140304c731SJamie Gritton 3715fd7a8150SMike Barcroft static int 3716fd7a8150SMike Barcroft sysctl_jail_list(SYSCTL_HANDLER_ARGS) 3717fd7a8150SMike Barcroft { 3718b38ff370SJamie Gritton struct xprison *xp; 37190304c731SJamie Gritton struct prison *pr, *cpr; 3720b38ff370SJamie Gritton #ifdef INET 3721b38ff370SJamie Gritton struct in_addr *ip4 = NULL; 3722b38ff370SJamie Gritton int ip4s = 0; 3723b38ff370SJamie Gritton #endif 3724b38ff370SJamie Gritton #ifdef INET6 37253beefaedSColin Percival struct in6_addr *ip6 = NULL; 3726b38ff370SJamie Gritton int ip6s = 0; 3727b38ff370SJamie Gritton #endif 37280304c731SJamie Gritton int descend, error; 3729fd7a8150SMike Barcroft 3730b38ff370SJamie Gritton xp = malloc(sizeof(*xp), M_TEMP, M_WAITOK); 37310304c731SJamie Gritton pr = req->td->td_ucred->cr_prison; 3732b38ff370SJamie Gritton error = 0; 3733dc68a633SPawel Jakub Dawidek sx_slock(&allprison_lock); 37340304c731SJamie Gritton FOREACH_PRISON_DESCENDANT(pr, cpr, descend) { 37350304c731SJamie Gritton #if defined(INET) || defined(INET6) 3736b38ff370SJamie Gritton again: 37370304c731SJamie Gritton #endif 37380304c731SJamie Gritton mtx_lock(&cpr->pr_mtx); 3739413628a7SBjoern A. Zeeb #ifdef INET 37400304c731SJamie Gritton if (cpr->pr_ip4s > 0) { 37410304c731SJamie Gritton if (ip4s < cpr->pr_ip4s) { 37420304c731SJamie Gritton ip4s = cpr->pr_ip4s; 37430304c731SJamie Gritton mtx_unlock(&cpr->pr_mtx); 3744b38ff370SJamie Gritton ip4 = realloc(ip4, ip4s * 3745b38ff370SJamie Gritton sizeof(struct in_addr), M_TEMP, M_WAITOK); 3746b38ff370SJamie Gritton goto again; 3747b38ff370SJamie Gritton } 37480304c731SJamie Gritton bcopy(cpr->pr_ip4, ip4, 37490304c731SJamie Gritton cpr->pr_ip4s * sizeof(struct in_addr)); 3750b38ff370SJamie Gritton } 3751413628a7SBjoern A. Zeeb #endif 3752413628a7SBjoern A. Zeeb #ifdef INET6 37530304c731SJamie Gritton if (cpr->pr_ip6s > 0) { 37540304c731SJamie Gritton if (ip6s < cpr->pr_ip6s) { 37550304c731SJamie Gritton ip6s = cpr->pr_ip6s; 37560304c731SJamie Gritton mtx_unlock(&cpr->pr_mtx); 3757b38ff370SJamie Gritton ip6 = realloc(ip6, ip6s * 3758b38ff370SJamie Gritton sizeof(struct in6_addr), M_TEMP, M_WAITOK); 3759b38ff370SJamie Gritton goto again; 3760413628a7SBjoern A. Zeeb } 37610304c731SJamie Gritton bcopy(cpr->pr_ip6, ip6, 37620304c731SJamie Gritton cpr->pr_ip6s * sizeof(struct in6_addr)); 3763b38ff370SJamie Gritton } 3764b38ff370SJamie Gritton #endif 3765b38ff370SJamie Gritton bzero(xp, sizeof(*xp)); 3766fd7a8150SMike Barcroft xp->pr_version = XPRISON_VERSION; 37670304c731SJamie Gritton xp->pr_id = cpr->pr_id; 3768*1158508aSJamie Gritton xp->pr_state = cpr->pr_state; 37690304c731SJamie Gritton strlcpy(xp->pr_path, prison_path(pr, cpr), sizeof(xp->pr_path)); 3770c1f19219SJamie Gritton strlcpy(xp->pr_host, cpr->pr_hostname, sizeof(xp->pr_host)); 37710304c731SJamie Gritton strlcpy(xp->pr_name, prison_name(pr, cpr), sizeof(xp->pr_name)); 3772413628a7SBjoern A. Zeeb #ifdef INET 37730304c731SJamie Gritton xp->pr_ip4s = cpr->pr_ip4s; 3774413628a7SBjoern A. Zeeb #endif 3775413628a7SBjoern A. Zeeb #ifdef INET6 37760304c731SJamie Gritton xp->pr_ip6s = cpr->pr_ip6s; 3777413628a7SBjoern A. Zeeb #endif 37780304c731SJamie Gritton mtx_unlock(&cpr->pr_mtx); 3779b38ff370SJamie Gritton error = SYSCTL_OUT(req, xp, sizeof(*xp)); 3780b38ff370SJamie Gritton if (error) 3781b38ff370SJamie Gritton break; 3782413628a7SBjoern A. Zeeb #ifdef INET 3783b38ff370SJamie Gritton if (xp->pr_ip4s > 0) { 3784b38ff370SJamie Gritton error = SYSCTL_OUT(req, ip4, 3785b38ff370SJamie Gritton xp->pr_ip4s * sizeof(struct in_addr)); 3786b38ff370SJamie Gritton if (error) 3787b38ff370SJamie Gritton break; 3788413628a7SBjoern A. Zeeb } 3789413628a7SBjoern A. Zeeb #endif 3790413628a7SBjoern A. Zeeb #ifdef INET6 3791b38ff370SJamie Gritton if (xp->pr_ip6s > 0) { 3792b38ff370SJamie Gritton error = SYSCTL_OUT(req, ip6, 3793b38ff370SJamie Gritton xp->pr_ip6s * sizeof(struct in6_addr)); 3794b38ff370SJamie Gritton if (error) 3795b38ff370SJamie Gritton break; 3796413628a7SBjoern A. Zeeb } 3797413628a7SBjoern A. Zeeb #endif 3798fd7a8150SMike Barcroft } 3799dc68a633SPawel Jakub Dawidek sx_sunlock(&allprison_lock); 3800b38ff370SJamie Gritton free(xp, M_TEMP); 3801b38ff370SJamie Gritton #ifdef INET 3802b38ff370SJamie Gritton free(ip4, M_TEMP); 3803b38ff370SJamie Gritton #endif 3804b38ff370SJamie Gritton #ifdef INET6 3805b38ff370SJamie Gritton free(ip6, M_TEMP); 3806b38ff370SJamie Gritton #endif 3807fd7a8150SMike Barcroft return (error); 3808fd7a8150SMike Barcroft } 3809fd7a8150SMike Barcroft 3810f3b86a5fSEd Schouten SYSCTL_OID(_security_jail, OID_AUTO, list, 3811f3b86a5fSEd Schouten CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0, 3812f3b86a5fSEd Schouten sysctl_jail_list, "S", "List of active jails"); 3813461167c2SPawel Jakub Dawidek 3814461167c2SPawel Jakub Dawidek static int 3815461167c2SPawel Jakub Dawidek sysctl_jail_jailed(SYSCTL_HANDLER_ARGS) 3816461167c2SPawel Jakub Dawidek { 3817461167c2SPawel Jakub Dawidek int error, injail; 3818461167c2SPawel Jakub Dawidek 3819461167c2SPawel Jakub Dawidek injail = jailed(req->td->td_ucred); 3820461167c2SPawel Jakub Dawidek error = SYSCTL_OUT(req, &injail, sizeof(injail)); 3821461167c2SPawel Jakub Dawidek 3822461167c2SPawel Jakub Dawidek return (error); 3823461167c2SPawel Jakub Dawidek } 38240304c731SJamie Gritton 3825f3b86a5fSEd Schouten SYSCTL_PROC(_security_jail, OID_AUTO, jailed, 3826f3b86a5fSEd Schouten CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0, 3827f3b86a5fSEd Schouten sysctl_jail_jailed, "I", "Process in jail?"); 3828413628a7SBjoern A. Zeeb 3829761d2bb5SJamie Gritton static int 3830761d2bb5SJamie Gritton sysctl_jail_vnet(SYSCTL_HANDLER_ARGS) 3831761d2bb5SJamie Gritton { 3832761d2bb5SJamie Gritton int error, havevnet; 3833761d2bb5SJamie Gritton #ifdef VIMAGE 3834761d2bb5SJamie Gritton struct ucred *cred = req->td->td_ucred; 3835761d2bb5SJamie Gritton 3836761d2bb5SJamie Gritton havevnet = jailed(cred) && prison_owns_vnet(cred); 3837761d2bb5SJamie Gritton #else 3838761d2bb5SJamie Gritton havevnet = 0; 3839761d2bb5SJamie Gritton #endif 3840761d2bb5SJamie Gritton error = SYSCTL_OUT(req, &havevnet, sizeof(havevnet)); 3841761d2bb5SJamie Gritton 3842761d2bb5SJamie Gritton return (error); 3843761d2bb5SJamie Gritton } 3844761d2bb5SJamie Gritton 3845761d2bb5SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, vnet, 3846761d2bb5SJamie Gritton CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0, 3847bb8f1623SBjoern A. Zeeb sysctl_jail_vnet, "I", "Jail owns vnet?"); 3848761d2bb5SJamie Gritton 38490304c731SJamie Gritton #if defined(INET) || defined(INET6) 3850e92e0574SJamie Gritton SYSCTL_UINT(_security_jail, OID_AUTO, jail_max_af_ips, CTLFLAG_RW, 38510304c731SJamie Gritton &jail_max_af_ips, 0, 3852c542c43eSJamie Gritton "Number of IP addresses a jail may have at most per address family (deprecated)"); 38530304c731SJamie Gritton #endif 38540304c731SJamie Gritton 38550304c731SJamie Gritton /* 3856c542c43eSJamie Gritton * Default parameters for jail(2) compatibility. For historical reasons, 3857c542c43eSJamie Gritton * the sysctl names have varying similarity to the parameter names. Prisons 3858c542c43eSJamie Gritton * just see their own parameters, and can't change them. 38590304c731SJamie Gritton */ 38600304c731SJamie Gritton static int 38610304c731SJamie Gritton sysctl_jail_default_allow(SYSCTL_HANDLER_ARGS) 38620304c731SJamie Gritton { 38630fe74ae6SJamie Gritton int error, i; 38640304c731SJamie Gritton 38650304c731SJamie Gritton /* Get the current flag value, and convert it to a boolean. */ 38660fe74ae6SJamie Gritton if (req->td->td_ucred->cr_prison == &prison0) { 38670fe74ae6SJamie Gritton mtx_lock(&prison0.pr_mtx); 38680fe74ae6SJamie Gritton i = (jail_default_allow & arg2) != 0; 38690fe74ae6SJamie Gritton mtx_unlock(&prison0.pr_mtx); 38700fe74ae6SJamie Gritton } else 38710fe74ae6SJamie Gritton i = prison_allow(req->td->td_ucred, arg2); 38720fe74ae6SJamie Gritton 38730304c731SJamie Gritton if (arg1 != NULL) 38740304c731SJamie Gritton i = !i; 38750304c731SJamie Gritton error = sysctl_handle_int(oidp, &i, 0, req); 3876c542c43eSJamie Gritton if (error || !req->newptr) 38770304c731SJamie Gritton return (error); 38780304c731SJamie Gritton i = i ? arg2 : 0; 38790304c731SJamie Gritton if (arg1 != NULL) 38800304c731SJamie Gritton i ^= arg2; 38810304c731SJamie Gritton /* 38820304c731SJamie Gritton * The sysctls don't have CTLFLAGS_PRISON, so assume prison0 38830304c731SJamie Gritton * for writing. 38840304c731SJamie Gritton */ 38850304c731SJamie Gritton mtx_lock(&prison0.pr_mtx); 38860304c731SJamie Gritton jail_default_allow = (jail_default_allow & ~arg2) | i; 38870304c731SJamie Gritton mtx_unlock(&prison0.pr_mtx); 38880304c731SJamie Gritton return (0); 38890304c731SJamie Gritton } 38900304c731SJamie Gritton 38910304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, set_hostname_allowed, 3892c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 38930304c731SJamie Gritton NULL, PR_ALLOW_SET_HOSTNAME, sysctl_jail_default_allow, "I", 3894c542c43eSJamie Gritton "Processes in jail can set their hostnames (deprecated)"); 38950304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, socket_unixiproute_only, 3896c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 38970304c731SJamie Gritton (void *)1, PR_ALLOW_SOCKET_AF, sysctl_jail_default_allow, "I", 3898c542c43eSJamie Gritton "Processes in jail are limited to creating UNIX/IP/route sockets only (deprecated)"); 38990304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, sysvipc_allowed, 3900c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 39010304c731SJamie Gritton NULL, PR_ALLOW_SYSVIPC, sysctl_jail_default_allow, "I", 3902c542c43eSJamie Gritton "Processes in jail can use System V IPC primitives (deprecated)"); 39030304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, allow_raw_sockets, 3904c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 39050304c731SJamie Gritton NULL, PR_ALLOW_RAW_SOCKETS, sysctl_jail_default_allow, "I", 3906c542c43eSJamie Gritton "Prison root can create raw sockets (deprecated)"); 39070304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, chflags_allowed, 3908c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 39090304c731SJamie Gritton NULL, PR_ALLOW_CHFLAGS, sysctl_jail_default_allow, "I", 3910c542c43eSJamie Gritton "Processes in jail can alter system file flags (deprecated)"); 39110304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, mount_allowed, 3912c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 39130304c731SJamie Gritton NULL, PR_ALLOW_MOUNT, sysctl_jail_default_allow, "I", 3914c542c43eSJamie Gritton "Processes in jail can mount/unmount jail-friendly file systems (deprecated)"); 39150304c731SJamie Gritton 39160304c731SJamie Gritton static int 39170304c731SJamie Gritton sysctl_jail_default_level(SYSCTL_HANDLER_ARGS) 39180304c731SJamie Gritton { 39190304c731SJamie Gritton struct prison *pr; 39200304c731SJamie Gritton int level, error; 39210304c731SJamie Gritton 39220304c731SJamie Gritton pr = req->td->td_ucred->cr_prison; 39230304c731SJamie Gritton level = (pr == &prison0) ? *(int *)arg1 : *(int *)((char *)pr + arg2); 39240304c731SJamie Gritton error = sysctl_handle_int(oidp, &level, 0, req); 3925c542c43eSJamie Gritton if (error || !req->newptr) 39260304c731SJamie Gritton return (error); 39270304c731SJamie Gritton *(int *)arg1 = level; 39280304c731SJamie Gritton return (0); 39290304c731SJamie Gritton } 39300304c731SJamie Gritton 39310304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, enforce_statfs, 3932c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 3933c542c43eSJamie Gritton &jail_default_enforce_statfs, offsetof(struct prison, pr_enforce_statfs), 39340304c731SJamie Gritton sysctl_jail_default_level, "I", 3935c542c43eSJamie Gritton "Processes in jail cannot see all mounted file systems (deprecated)"); 3936c542c43eSJamie Gritton 39370cc207a6SMartin Matuska SYSCTL_PROC(_security_jail, OID_AUTO, devfs_ruleset, 3938c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, 3939c542c43eSJamie Gritton &jail_default_devfs_rsnum, offsetof(struct prison, pr_devfs_rsnum), 39400cc207a6SMartin Matuska sysctl_jail_default_level, "I", 3941c542c43eSJamie Gritton "Ruleset for the devfs filesystem in jail (deprecated)"); 39420cc207a6SMartin Matuska 39430304c731SJamie Gritton /* 39440304c731SJamie Gritton * Nodes to describe jail parameters. Maximum length of string parameters 39450304c731SJamie Gritton * is returned in the string itself, and the other parameters exist merely 39460304c731SJamie Gritton * to make themselves and their types known. 39470304c731SJamie Gritton */ 39487029da5cSPawel Biernacki SYSCTL_NODE(_security_jail, OID_AUTO, param, CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 39490304c731SJamie Gritton "Jail parameters"); 39500304c731SJamie Gritton 39510304c731SJamie Gritton int 39520304c731SJamie Gritton sysctl_jail_param(SYSCTL_HANDLER_ARGS) 39530304c731SJamie Gritton { 39540304c731SJamie Gritton int i; 39550304c731SJamie Gritton long l; 39560304c731SJamie Gritton size_t s; 39570304c731SJamie Gritton char numbuf[12]; 39580304c731SJamie Gritton 39590304c731SJamie Gritton switch (oidp->oid_kind & CTLTYPE) 39600304c731SJamie Gritton { 39610304c731SJamie Gritton case CTLTYPE_LONG: 39620304c731SJamie Gritton case CTLTYPE_ULONG: 39630304c731SJamie Gritton l = 0; 39640304c731SJamie Gritton #ifdef SCTL_MASK32 39650304c731SJamie Gritton if (!(req->flags & SCTL_MASK32)) 39660304c731SJamie Gritton #endif 39670304c731SJamie Gritton return (SYSCTL_OUT(req, &l, sizeof(l))); 39680304c731SJamie Gritton case CTLTYPE_INT: 39690304c731SJamie Gritton case CTLTYPE_UINT: 39700304c731SJamie Gritton i = 0; 39710304c731SJamie Gritton return (SYSCTL_OUT(req, &i, sizeof(i))); 39720304c731SJamie Gritton case CTLTYPE_STRING: 3973e4cd31ddSJeff Roberson snprintf(numbuf, sizeof(numbuf), "%jd", (intmax_t)arg2); 39740304c731SJamie Gritton return 39750304c731SJamie Gritton (sysctl_handle_string(oidp, numbuf, sizeof(numbuf), req)); 39760304c731SJamie Gritton case CTLTYPE_STRUCT: 39770304c731SJamie Gritton s = (size_t)arg2; 39780304c731SJamie Gritton return (SYSCTL_OUT(req, &s, sizeof(s))); 39790304c731SJamie Gritton } 39800304c731SJamie Gritton return (0); 39810304c731SJamie Gritton } 39820304c731SJamie Gritton 3983b96bd95bSIan Lepore /* 3984b96bd95bSIan Lepore * CTLFLAG_RDTUN in the following indicates jail parameters that can be set at 3985b96bd95bSIan Lepore * jail creation time but cannot be changed in an existing jail. 3986b96bd95bSIan Lepore */ 39870304c731SJamie Gritton SYSCTL_JAIL_PARAM(, jid, CTLTYPE_INT | CTLFLAG_RDTUN, "I", "Jail ID"); 39880304c731SJamie Gritton SYSCTL_JAIL_PARAM(, parent, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail parent ID"); 39890304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(, name, CTLFLAG_RW, MAXHOSTNAMELEN, "Jail name"); 39900304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(, path, CTLFLAG_RDTUN, MAXPATHLEN, "Jail root path"); 39910304c731SJamie Gritton SYSCTL_JAIL_PARAM(, securelevel, CTLTYPE_INT | CTLFLAG_RW, 39920304c731SJamie Gritton "I", "Jail secure level"); 3993b96bd95bSIan Lepore SYSCTL_JAIL_PARAM(, osreldate, CTLTYPE_INT | CTLFLAG_RDTUN, "I", 3994b96bd95bSIan Lepore "Jail value for kern.osreldate and uname -K"); 3995b96bd95bSIan Lepore SYSCTL_JAIL_PARAM_STRING(, osrelease, CTLFLAG_RDTUN, OSRELEASELEN, 3996b96bd95bSIan Lepore "Jail value for kern.osrelease and uname -r"); 39970304c731SJamie Gritton SYSCTL_JAIL_PARAM(, enforce_statfs, CTLTYPE_INT | CTLFLAG_RW, 39980304c731SJamie Gritton "I", "Jail cannot see all mounted file systems"); 39990cc207a6SMartin Matuska SYSCTL_JAIL_PARAM(, devfs_ruleset, CTLTYPE_INT | CTLFLAG_RW, 40000cc207a6SMartin Matuska "I", "Ruleset for in-jail devfs mounts"); 40010304c731SJamie Gritton SYSCTL_JAIL_PARAM(, persist, CTLTYPE_INT | CTLFLAG_RW, 40020304c731SJamie Gritton "B", "Jail persistence"); 4003679e1390SJamie Gritton #ifdef VIMAGE 4004679e1390SJamie Gritton SYSCTL_JAIL_PARAM(, vnet, CTLTYPE_INT | CTLFLAG_RDTUN, 40057cbf7213SJamie Gritton "E,jailsys", "Virtual network stack"); 4006679e1390SJamie Gritton #endif 40070304c731SJamie Gritton SYSCTL_JAIL_PARAM(, dying, CTLTYPE_INT | CTLFLAG_RD, 40080304c731SJamie Gritton "B", "Jail is in the process of shutting down"); 40090304c731SJamie Gritton 4010b97457e2SJamie Gritton SYSCTL_JAIL_PARAM_NODE(children, "Number of child jails"); 4011b97457e2SJamie Gritton SYSCTL_JAIL_PARAM(_children, cur, CTLTYPE_INT | CTLFLAG_RD, 4012b97457e2SJamie Gritton "I", "Current number of child jails"); 4013b97457e2SJamie Gritton SYSCTL_JAIL_PARAM(_children, max, CTLTYPE_INT | CTLFLAG_RW, 4014b97457e2SJamie Gritton "I", "Maximum number of child jails"); 4015b97457e2SJamie Gritton 40167cbf7213SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(host, CTLFLAG_RW, "Jail host info"); 40170304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, hostname, CTLFLAG_RW, MAXHOSTNAMELEN, 40180304c731SJamie Gritton "Jail hostname"); 401976ca6f88SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, domainname, CTLFLAG_RW, MAXHOSTNAMELEN, 402076ca6f88SJamie Gritton "Jail NIS domainname"); 402176ca6f88SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, hostuuid, CTLFLAG_RW, HOSTUUIDLEN, 402276ca6f88SJamie Gritton "Jail host UUID"); 402376ca6f88SJamie Gritton SYSCTL_JAIL_PARAM(_host, hostid, CTLTYPE_ULONG | CTLFLAG_RW, 402476ca6f88SJamie Gritton "LU", "Jail host ID"); 40250304c731SJamie Gritton 40260304c731SJamie Gritton SYSCTL_JAIL_PARAM_NODE(cpuset, "Jail cpuset"); 40270304c731SJamie Gritton SYSCTL_JAIL_PARAM(_cpuset, id, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail cpuset ID"); 40280304c731SJamie Gritton 40290304c731SJamie Gritton #ifdef INET 40302b0d6f81SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(ip4, CTLFLAG_RDTUN, 40312b0d6f81SJamie Gritton "Jail IPv4 address virtualization"); 40320304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRUCT(_ip4, addr, CTLFLAG_RW, sizeof(struct in_addr), 40330304c731SJamie Gritton "S,in_addr,a", "Jail IPv4 addresses"); 4034592bcae8SBjoern A. Zeeb SYSCTL_JAIL_PARAM(_ip4, saddrsel, CTLTYPE_INT | CTLFLAG_RW, 4035592bcae8SBjoern A. Zeeb "B", "Do (not) use IPv4 source address selection rather than the " 4036592bcae8SBjoern A. Zeeb "primary jail IPv4 address."); 40370304c731SJamie Gritton #endif 40380304c731SJamie Gritton #ifdef INET6 40392b0d6f81SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(ip6, CTLFLAG_RDTUN, 40402b0d6f81SJamie Gritton "Jail IPv6 address virtualization"); 40410304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRUCT(_ip6, addr, CTLFLAG_RW, sizeof(struct in6_addr), 40420304c731SJamie Gritton "S,in6_addr,a", "Jail IPv6 addresses"); 4043592bcae8SBjoern A. Zeeb SYSCTL_JAIL_PARAM(_ip6, saddrsel, CTLTYPE_INT | CTLFLAG_RW, 4044592bcae8SBjoern A. Zeeb "B", "Do (not) use IPv6 source address selection rather than the " 4045592bcae8SBjoern A. Zeeb "primary jail IPv6 address."); 40460304c731SJamie Gritton #endif 40470304c731SJamie Gritton 40480304c731SJamie Gritton SYSCTL_JAIL_PARAM_NODE(allow, "Jail permission flags"); 40490304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, set_hostname, CTLTYPE_INT | CTLFLAG_RW, 40500304c731SJamie Gritton "B", "Jail may set hostname"); 40510304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, sysvipc, CTLTYPE_INT | CTLFLAG_RW, 40520304c731SJamie Gritton "B", "Jail may use SYSV IPC"); 40530304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, raw_sockets, CTLTYPE_INT | CTLFLAG_RW, 40540304c731SJamie Gritton "B", "Jail may create raw sockets"); 40550304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, chflags, CTLTYPE_INT | CTLFLAG_RW, 40560304c731SJamie Gritton "B", "Jail may alter system file flags"); 40570304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, quotas, CTLTYPE_INT | CTLFLAG_RW, 40580304c731SJamie Gritton "B", "Jail may set file quotas"); 40590304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, socket_af, CTLTYPE_INT | CTLFLAG_RW, 40600304c731SJamie Gritton "B", "Jail may create sockets other than just UNIX/IPv4/IPv6/route"); 4061ccd6ac9fSAntoine Brodin SYSCTL_JAIL_PARAM(_allow, mlock, CTLTYPE_INT | CTLFLAG_RW, 4062ccd6ac9fSAntoine Brodin "B", "Jail may lock (unlock) physical pages in memory"); 4063e28f9b7dSAllan Jude SYSCTL_JAIL_PARAM(_allow, reserved_ports, CTLTYPE_INT | CTLFLAG_RW, 4064e28f9b7dSAllan Jude "B", "Jail may bind sockets to reserved ports"); 4065b19d66fdSJamie Gritton SYSCTL_JAIL_PARAM(_allow, read_msgbuf, CTLTYPE_INT | CTLFLAG_RW, 4066b19d66fdSJamie Gritton "B", "Jail may read the kernel message buffer"); 4067b3079544SJamie Gritton SYSCTL_JAIL_PARAM(_allow, unprivileged_proc_debug, CTLTYPE_INT | CTLFLAG_RW, 4068b3079544SJamie Gritton "B", "Unprivileged processes may use process debugging facilities"); 406905e1e482SMariusz Zaborski SYSCTL_JAIL_PARAM(_allow, suser, CTLTYPE_INT | CTLFLAG_RW, 407005e1e482SMariusz Zaborski "B", "Processes in jail with uid 0 have privilege"); 40710304c731SJamie Gritton 4072bf3db8aaSMartin Matuska SYSCTL_JAIL_PARAM_SUBNODE(allow, mount, "Jail mount/unmount permission flags"); 4073bf3db8aaSMartin Matuska SYSCTL_JAIL_PARAM(_allow_mount, , CTLTYPE_INT | CTLFLAG_RW, 4074bf3db8aaSMartin Matuska "B", "Jail may mount/unmount jail-friendly file systems in general"); 40750e5c6bd4SJamie Gritton 40760e5c6bd4SJamie Gritton /* 40770a172404SJamie Gritton * Add a dynamic parameter allow.<name>, or allow.<prefix>.<name>. Return 40780a172404SJamie Gritton * its associated bit in the pr_allow bitmask, or zero if the parameter was 40790a172404SJamie Gritton * not created. 40800e5c6bd4SJamie Gritton */ 40810a172404SJamie Gritton unsigned 40820a172404SJamie Gritton prison_add_allow(const char *prefix, const char *name, const char *prefix_descr, 40830a172404SJamie Gritton const char *descr) 40840e5c6bd4SJamie Gritton { 40850e5c6bd4SJamie Gritton struct bool_flags *bf; 40860a172404SJamie Gritton struct sysctl_oid *parent; 40870a172404SJamie Gritton char *allow_name, *allow_noname, *allowed; 4088c542c43eSJamie Gritton #ifndef NO_SYSCTL_DESCR 4089c542c43eSJamie Gritton char *descr_deprecated; 4090c542c43eSJamie Gritton #endif 40915d58f959SJamie Gritton u_int allow_flag; 40920e5c6bd4SJamie Gritton 40930a172404SJamie Gritton if (prefix 40940a172404SJamie Gritton ? asprintf(&allow_name, M_PRISON, "allow.%s.%s", prefix, name) 40950a172404SJamie Gritton < 0 || 40960a172404SJamie Gritton asprintf(&allow_noname, M_PRISON, "allow.%s.no%s", prefix, name) 40970a172404SJamie Gritton < 0 40980a172404SJamie Gritton : asprintf(&allow_name, M_PRISON, "allow.%s", name) < 0 || 40990a172404SJamie Gritton asprintf(&allow_noname, M_PRISON, "allow.no%s", name) < 0) { 41000e5c6bd4SJamie Gritton free(allow_name, M_PRISON); 41010a172404SJamie Gritton return 0; 41020e5c6bd4SJamie Gritton } 41030e5c6bd4SJamie Gritton 41040e5c6bd4SJamie Gritton /* 41050a172404SJamie Gritton * See if this parameter has already beed added, i.e. a module was 41060a172404SJamie Gritton * previously loaded/unloaded. 41070e5c6bd4SJamie Gritton */ 41080e5c6bd4SJamie Gritton mtx_lock(&prison0.pr_mtx); 41090e5c6bd4SJamie Gritton for (bf = pr_flag_allow; 41105d58f959SJamie Gritton bf < pr_flag_allow + nitems(pr_flag_allow) && 41115d58f959SJamie Gritton atomic_load_int(&bf->flag) != 0; 41120e5c6bd4SJamie Gritton bf++) { 41130e5c6bd4SJamie Gritton if (strcmp(bf->name, allow_name) == 0) { 41140a172404SJamie Gritton allow_flag = bf->flag; 41150e5c6bd4SJamie Gritton goto no_add; 41160e5c6bd4SJamie Gritton } 41170e5c6bd4SJamie Gritton } 41180e5c6bd4SJamie Gritton 41190e5c6bd4SJamie Gritton /* 41205d58f959SJamie Gritton * Find a free bit in pr_allow_all, failing if there are none 41210e5c6bd4SJamie Gritton * (which shouldn't happen as long as we keep track of how many 41220a172404SJamie Gritton * potential dynamic flags exist). 41230e5c6bd4SJamie Gritton */ 41240e5c6bd4SJamie Gritton for (allow_flag = 1;; allow_flag <<= 1) { 41250e5c6bd4SJamie Gritton if (allow_flag == 0) 41260e5c6bd4SJamie Gritton goto no_add; 41275d58f959SJamie Gritton if ((pr_allow_all & allow_flag) == 0) 41280e5c6bd4SJamie Gritton break; 41290e5c6bd4SJamie Gritton } 41300e5c6bd4SJamie Gritton 41315d58f959SJamie Gritton /* Note the parameter in the next open slot in pr_flag_allow. */ 41325d58f959SJamie Gritton for (bf = pr_flag_allow; ; bf++) { 41330e5c6bd4SJamie Gritton if (bf == pr_flag_allow + nitems(pr_flag_allow)) { 41340e5c6bd4SJamie Gritton /* This should never happen, but is not fatal. */ 41350a172404SJamie Gritton allow_flag = 0; 41360e5c6bd4SJamie Gritton goto no_add; 41370e5c6bd4SJamie Gritton } 41385d58f959SJamie Gritton if (atomic_load_int(&bf->flag) == 0) 41395d58f959SJamie Gritton break; 41405d58f959SJamie Gritton } 41410e5c6bd4SJamie Gritton bf->name = allow_name; 41420e5c6bd4SJamie Gritton bf->noname = allow_noname; 41435d58f959SJamie Gritton pr_allow_all |= allow_flag; 41445d58f959SJamie Gritton /* 41455d58f959SJamie Gritton * prison0 always has permission for the new parameter. 41465d58f959SJamie Gritton * Other jails must have it granted to them. 41475d58f959SJamie Gritton */ 41485d58f959SJamie Gritton prison0.pr_allow |= allow_flag; 41495d58f959SJamie Gritton /* The flag indicates a valid entry, so make sure it is set last. */ 41505d58f959SJamie Gritton atomic_store_rel_int(&bf->flag, allow_flag); 41510e5c6bd4SJamie Gritton mtx_unlock(&prison0.pr_mtx); 41520e5c6bd4SJamie Gritton 4153c542c43eSJamie Gritton /* 4154c542c43eSJamie Gritton * Create sysctls for the paramter, and the back-compat global 4155c542c43eSJamie Gritton * permission. 4156c542c43eSJamie Gritton */ 41570a172404SJamie Gritton parent = prefix 41580a172404SJamie Gritton ? SYSCTL_ADD_NODE(NULL, 41590a172404SJamie Gritton SYSCTL_CHILDREN(&sysctl___security_jail_param_allow), 41607029da5cSPawel Biernacki OID_AUTO, prefix, CTLFLAG_MPSAFE, 0, prefix_descr) 41610a172404SJamie Gritton : &sysctl___security_jail_param_allow; 41620a172404SJamie Gritton (void)SYSCTL_ADD_PROC(NULL, SYSCTL_CHILDREN(parent), OID_AUTO, 41630a172404SJamie Gritton name, CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 41640e5c6bd4SJamie Gritton NULL, 0, sysctl_jail_param, "B", descr); 41650a172404SJamie Gritton if ((prefix 41660a172404SJamie Gritton ? asprintf(&allowed, M_TEMP, "%s_%s_allowed", prefix, name) 41670a172404SJamie Gritton : asprintf(&allowed, M_TEMP, "%s_allowed", name)) >= 0) { 4168c542c43eSJamie Gritton #ifndef NO_SYSCTL_DESCR 4169c542c43eSJamie Gritton (void)asprintf(&descr_deprecated, M_TEMP, "%s (deprecated)", 4170c542c43eSJamie Gritton descr); 4171c542c43eSJamie Gritton #endif 41720e5c6bd4SJamie Gritton (void)SYSCTL_ADD_PROC(NULL, 41730a172404SJamie Gritton SYSCTL_CHILDREN(&sysctl___security_jail), OID_AUTO, allowed, 4174c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, allow_flag, 4175c542c43eSJamie Gritton sysctl_jail_default_allow, "I", descr_deprecated); 4176c542c43eSJamie Gritton #ifndef NO_SYSCTL_DESCR 4177c542c43eSJamie Gritton free(descr_deprecated, M_TEMP); 4178c542c43eSJamie Gritton #endif 41790a172404SJamie Gritton free(allowed, M_TEMP); 41800e5c6bd4SJamie Gritton } 41810a172404SJamie Gritton return allow_flag; 41820e5c6bd4SJamie Gritton 41830e5c6bd4SJamie Gritton no_add: 41840e5c6bd4SJamie Gritton mtx_unlock(&prison0.pr_mtx); 41850e5c6bd4SJamie Gritton free(allow_name, M_PRISON); 41860e5c6bd4SJamie Gritton free(allow_noname, M_PRISON); 41870a172404SJamie Gritton return allow_flag; 41880a172404SJamie Gritton } 41890a172404SJamie Gritton 41900a172404SJamie Gritton /* 41910a172404SJamie Gritton * The VFS system will register jail-aware filesystems here. They each get 41920a172404SJamie Gritton * a parameter allow.mount.xxxfs and a flag to check when a jailed user 41930a172404SJamie Gritton * attempts to mount. 41940a172404SJamie Gritton */ 41950a172404SJamie Gritton void 41960a172404SJamie Gritton prison_add_vfs(struct vfsconf *vfsp) 41970a172404SJamie Gritton { 41980a172404SJamie Gritton #ifdef NO_SYSCTL_DESCR 41990a172404SJamie Gritton 42000a172404SJamie Gritton vfsp->vfc_prison_flag = prison_add_allow("mount", vfsp->vfc_name, 42010a172404SJamie Gritton NULL, NULL); 42020a172404SJamie Gritton #else 42030a172404SJamie Gritton char *descr; 42040a172404SJamie Gritton 42050a172404SJamie Gritton (void)asprintf(&descr, M_TEMP, "Jail may mount the %s file system", 42060a172404SJamie Gritton vfsp->vfc_name); 42070a172404SJamie Gritton vfsp->vfc_prison_flag = prison_add_allow("mount", vfsp->vfc_name, 42080a172404SJamie Gritton NULL, descr); 42090a172404SJamie Gritton free(descr, M_TEMP); 42100a172404SJamie Gritton #endif 42110e5c6bd4SJamie Gritton } 4212bf3db8aaSMartin Matuska 42134b5c9cf6SEdward Tomasz Napierala #ifdef RACCT 4214097055e2SEdward Tomasz Napierala void 4215097055e2SEdward Tomasz Napierala prison_racct_foreach(void (*callback)(struct racct *racct, 421615db3c07SEdward Tomasz Napierala void *arg2, void *arg3), void (*pre)(void), void (*post)(void), 421715db3c07SEdward Tomasz Napierala void *arg2, void *arg3) 4218097055e2SEdward Tomasz Napierala { 4219a7ad07bfSEdward Tomasz Napierala struct prison_racct *prr; 4220097055e2SEdward Tomasz Napierala 42214b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 42224b5c9cf6SEdward Tomasz Napierala 4223097055e2SEdward Tomasz Napierala sx_slock(&allprison_lock); 422415db3c07SEdward Tomasz Napierala if (pre != NULL) 422515db3c07SEdward Tomasz Napierala (pre)(); 4226a7ad07bfSEdward Tomasz Napierala LIST_FOREACH(prr, &allprison_racct, prr_next) 4227a7ad07bfSEdward Tomasz Napierala (callback)(prr->prr_racct, arg2, arg3); 422815db3c07SEdward Tomasz Napierala if (post != NULL) 422915db3c07SEdward Tomasz Napierala (post)(); 4230097055e2SEdward Tomasz Napierala sx_sunlock(&allprison_lock); 4231097055e2SEdward Tomasz Napierala } 42320304c731SJamie Gritton 4233a7ad07bfSEdward Tomasz Napierala static struct prison_racct * 4234a7ad07bfSEdward Tomasz Napierala prison_racct_find_locked(const char *name) 4235a7ad07bfSEdward Tomasz Napierala { 4236a7ad07bfSEdward Tomasz Napierala struct prison_racct *prr; 4237a7ad07bfSEdward Tomasz Napierala 42384b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 4239a7ad07bfSEdward Tomasz Napierala sx_assert(&allprison_lock, SA_XLOCKED); 4240a7ad07bfSEdward Tomasz Napierala 4241a7ad07bfSEdward Tomasz Napierala if (name[0] == '\0' || strlen(name) >= MAXHOSTNAMELEN) 4242a7ad07bfSEdward Tomasz Napierala return (NULL); 4243a7ad07bfSEdward Tomasz Napierala 4244a7ad07bfSEdward Tomasz Napierala LIST_FOREACH(prr, &allprison_racct, prr_next) { 4245a7ad07bfSEdward Tomasz Napierala if (strcmp(name, prr->prr_name) != 0) 4246a7ad07bfSEdward Tomasz Napierala continue; 4247a7ad07bfSEdward Tomasz Napierala 4248a7ad07bfSEdward Tomasz Napierala /* Found prison_racct with a matching name? */ 4249a7ad07bfSEdward Tomasz Napierala prison_racct_hold(prr); 4250a7ad07bfSEdward Tomasz Napierala return (prr); 4251a7ad07bfSEdward Tomasz Napierala } 4252a7ad07bfSEdward Tomasz Napierala 4253a7ad07bfSEdward Tomasz Napierala /* Add new prison_racct. */ 4254a7ad07bfSEdward Tomasz Napierala prr = malloc(sizeof(*prr), M_PRISON_RACCT, M_ZERO | M_WAITOK); 4255a7ad07bfSEdward Tomasz Napierala racct_create(&prr->prr_racct); 4256a7ad07bfSEdward Tomasz Napierala 4257a7ad07bfSEdward Tomasz Napierala strcpy(prr->prr_name, name); 4258a7ad07bfSEdward Tomasz Napierala refcount_init(&prr->prr_refcount, 1); 4259a7ad07bfSEdward Tomasz Napierala LIST_INSERT_HEAD(&allprison_racct, prr, prr_next); 4260a7ad07bfSEdward Tomasz Napierala 4261a7ad07bfSEdward Tomasz Napierala return (prr); 4262a7ad07bfSEdward Tomasz Napierala } 4263a7ad07bfSEdward Tomasz Napierala 4264a7ad07bfSEdward Tomasz Napierala struct prison_racct * 4265a7ad07bfSEdward Tomasz Napierala prison_racct_find(const char *name) 4266a7ad07bfSEdward Tomasz Napierala { 4267a7ad07bfSEdward Tomasz Napierala struct prison_racct *prr; 4268a7ad07bfSEdward Tomasz Napierala 42694b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 42704b5c9cf6SEdward Tomasz Napierala 4271a7ad07bfSEdward Tomasz Napierala sx_xlock(&allprison_lock); 4272a7ad07bfSEdward Tomasz Napierala prr = prison_racct_find_locked(name); 4273a7ad07bfSEdward Tomasz Napierala sx_xunlock(&allprison_lock); 4274a7ad07bfSEdward Tomasz Napierala return (prr); 4275a7ad07bfSEdward Tomasz Napierala } 4276a7ad07bfSEdward Tomasz Napierala 4277a7ad07bfSEdward Tomasz Napierala void 4278a7ad07bfSEdward Tomasz Napierala prison_racct_hold(struct prison_racct *prr) 4279a7ad07bfSEdward Tomasz Napierala { 4280a7ad07bfSEdward Tomasz Napierala 42814b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 42824b5c9cf6SEdward Tomasz Napierala 4283a7ad07bfSEdward Tomasz Napierala refcount_acquire(&prr->prr_refcount); 4284a7ad07bfSEdward Tomasz Napierala } 4285a7ad07bfSEdward Tomasz Napierala 4286c34bbd2aSEdward Tomasz Napierala static void 4287c34bbd2aSEdward Tomasz Napierala prison_racct_free_locked(struct prison_racct *prr) 4288c34bbd2aSEdward Tomasz Napierala { 4289c34bbd2aSEdward Tomasz Napierala 42904b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 4291c34bbd2aSEdward Tomasz Napierala sx_assert(&allprison_lock, SA_XLOCKED); 4292c34bbd2aSEdward Tomasz Napierala 4293c34bbd2aSEdward Tomasz Napierala if (refcount_release(&prr->prr_refcount)) { 4294c34bbd2aSEdward Tomasz Napierala racct_destroy(&prr->prr_racct); 4295c34bbd2aSEdward Tomasz Napierala LIST_REMOVE(prr, prr_next); 4296c34bbd2aSEdward Tomasz Napierala free(prr, M_PRISON_RACCT); 4297c34bbd2aSEdward Tomasz Napierala } 4298c34bbd2aSEdward Tomasz Napierala } 4299c34bbd2aSEdward Tomasz Napierala 4300a7ad07bfSEdward Tomasz Napierala void 4301a7ad07bfSEdward Tomasz Napierala prison_racct_free(struct prison_racct *prr) 4302a7ad07bfSEdward Tomasz Napierala { 4303a7ad07bfSEdward Tomasz Napierala 43044b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 4305c34bbd2aSEdward Tomasz Napierala sx_assert(&allprison_lock, SA_UNLOCKED); 4306c34bbd2aSEdward Tomasz Napierala 43076ff4688bSMateusz Guzik if (refcount_release_if_not_last(&prr->prr_refcount)) 4308a7ad07bfSEdward Tomasz Napierala return; 4309a7ad07bfSEdward Tomasz Napierala 4310a7ad07bfSEdward Tomasz Napierala sx_xlock(&allprison_lock); 4311c34bbd2aSEdward Tomasz Napierala prison_racct_free_locked(prr); 4312a7ad07bfSEdward Tomasz Napierala sx_xunlock(&allprison_lock); 4313a7ad07bfSEdward Tomasz Napierala } 4314a7ad07bfSEdward Tomasz Napierala 4315a7ad07bfSEdward Tomasz Napierala static void 4316a7ad07bfSEdward Tomasz Napierala prison_racct_attach(struct prison *pr) 4317a7ad07bfSEdward Tomasz Napierala { 4318a7ad07bfSEdward Tomasz Napierala struct prison_racct *prr; 4319a7ad07bfSEdward Tomasz Napierala 43204b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 4321c34bbd2aSEdward Tomasz Napierala sx_assert(&allprison_lock, SA_XLOCKED); 4322c34bbd2aSEdward Tomasz Napierala 4323a7ad07bfSEdward Tomasz Napierala prr = prison_racct_find_locked(pr->pr_name); 4324a7ad07bfSEdward Tomasz Napierala KASSERT(prr != NULL, ("cannot find prison_racct")); 4325a7ad07bfSEdward Tomasz Napierala 4326a7ad07bfSEdward Tomasz Napierala pr->pr_prison_racct = prr; 4327a7ad07bfSEdward Tomasz Napierala } 4328a7ad07bfSEdward Tomasz Napierala 4329c34bbd2aSEdward Tomasz Napierala /* 4330c34bbd2aSEdward Tomasz Napierala * Handle jail renaming. From the racct point of view, renaming means 4331c34bbd2aSEdward Tomasz Napierala * moving from one prison_racct to another. 4332c34bbd2aSEdward Tomasz Napierala */ 4333c34bbd2aSEdward Tomasz Napierala static void 4334c34bbd2aSEdward Tomasz Napierala prison_racct_modify(struct prison *pr) 4335c34bbd2aSEdward Tomasz Napierala { 4336dbadb015SKonstantin Belousov #ifdef RCTL 4337c34bbd2aSEdward Tomasz Napierala struct proc *p; 4338c34bbd2aSEdward Tomasz Napierala struct ucred *cred; 4339dbadb015SKonstantin Belousov #endif 4340c34bbd2aSEdward Tomasz Napierala struct prison_racct *oldprr; 4341c34bbd2aSEdward Tomasz Napierala 43424b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 43434b5c9cf6SEdward Tomasz Napierala 4344c34bbd2aSEdward Tomasz Napierala sx_slock(&allproc_lock); 4345c34bbd2aSEdward Tomasz Napierala sx_xlock(&allprison_lock); 4346c34bbd2aSEdward Tomasz Napierala 4347e30345e7SEdward Tomasz Napierala if (strcmp(pr->pr_name, pr->pr_prison_racct->prr_name) == 0) { 4348e30345e7SEdward Tomasz Napierala sx_xunlock(&allprison_lock); 4349e30345e7SEdward Tomasz Napierala sx_sunlock(&allproc_lock); 4350c34bbd2aSEdward Tomasz Napierala return; 4351e30345e7SEdward Tomasz Napierala } 4352c34bbd2aSEdward Tomasz Napierala 4353c34bbd2aSEdward Tomasz Napierala oldprr = pr->pr_prison_racct; 4354c34bbd2aSEdward Tomasz Napierala pr->pr_prison_racct = NULL; 4355c34bbd2aSEdward Tomasz Napierala 4356c34bbd2aSEdward Tomasz Napierala prison_racct_attach(pr); 4357c34bbd2aSEdward Tomasz Napierala 4358c34bbd2aSEdward Tomasz Napierala /* 4359c34bbd2aSEdward Tomasz Napierala * Move resource utilisation records. 4360c34bbd2aSEdward Tomasz Napierala */ 4361c34bbd2aSEdward Tomasz Napierala racct_move(pr->pr_prison_racct->prr_racct, oldprr->prr_racct); 4362c34bbd2aSEdward Tomasz Napierala 4363f87beb93SAndriy Gapon #ifdef RCTL 4364c34bbd2aSEdward Tomasz Napierala /* 4365c34bbd2aSEdward Tomasz Napierala * Force rctl to reattach rules to processes. 4366c34bbd2aSEdward Tomasz Napierala */ 4367c34bbd2aSEdward Tomasz Napierala FOREACH_PROC_IN_SYSTEM(p) { 4368c34bbd2aSEdward Tomasz Napierala PROC_LOCK(p); 4369c34bbd2aSEdward Tomasz Napierala cred = crhold(p->p_ucred); 4370c34bbd2aSEdward Tomasz Napierala PROC_UNLOCK(p); 4371f87beb93SAndriy Gapon rctl_proc_ucred_changed(p, cred); 4372c34bbd2aSEdward Tomasz Napierala crfree(cred); 4373c34bbd2aSEdward Tomasz Napierala } 4374f87beb93SAndriy Gapon #endif 4375c34bbd2aSEdward Tomasz Napierala 4376c34bbd2aSEdward Tomasz Napierala sx_sunlock(&allproc_lock); 4377c34bbd2aSEdward Tomasz Napierala prison_racct_free_locked(oldprr); 4378c34bbd2aSEdward Tomasz Napierala sx_xunlock(&allprison_lock); 4379c34bbd2aSEdward Tomasz Napierala } 4380c34bbd2aSEdward Tomasz Napierala 4381a7ad07bfSEdward Tomasz Napierala static void 4382a7ad07bfSEdward Tomasz Napierala prison_racct_detach(struct prison *pr) 4383a7ad07bfSEdward Tomasz Napierala { 4384c34bbd2aSEdward Tomasz Napierala 43854b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 4386c34bbd2aSEdward Tomasz Napierala sx_assert(&allprison_lock, SA_UNLOCKED); 4387c34bbd2aSEdward Tomasz Napierala 4388af3c786cSMateusz Guzik if (pr->pr_prison_racct == NULL) 4389af3c786cSMateusz Guzik return; 4390a7ad07bfSEdward Tomasz Napierala prison_racct_free(pr->pr_prison_racct); 4391a7ad07bfSEdward Tomasz Napierala pr->pr_prison_racct = NULL; 4392a7ad07bfSEdward Tomasz Napierala } 4393a7ad07bfSEdward Tomasz Napierala #endif /* RACCT */ 4394a7ad07bfSEdward Tomasz Napierala 4395413628a7SBjoern A. Zeeb #ifdef DDB 4396b38ff370SJamie Gritton 4397b38ff370SJamie Gritton static void 4398b38ff370SJamie Gritton db_show_prison(struct prison *pr) 4399413628a7SBjoern A. Zeeb { 4400672756aaSJamie Gritton struct bool_flags *bf; 4401672756aaSJamie Gritton struct jailsys_flags *jsf; 4402b38ff370SJamie Gritton #if defined(INET) || defined(INET6) 4403b38ff370SJamie Gritton int ii; 4404413628a7SBjoern A. Zeeb #endif 4405672756aaSJamie Gritton unsigned f; 44068144690aSEric van Gyzen #ifdef INET 44078144690aSEric van Gyzen char ip4buf[INET_ADDRSTRLEN]; 44088144690aSEric van Gyzen #endif 4409413628a7SBjoern A. Zeeb #ifdef INET6 4410413628a7SBjoern A. Zeeb char ip6buf[INET6_ADDRSTRLEN]; 4411413628a7SBjoern A. Zeeb #endif 4412413628a7SBjoern A. Zeeb 4413b38ff370SJamie Gritton db_printf("prison %p:\n", pr); 4414b38ff370SJamie Gritton db_printf(" jid = %d\n", pr->pr_id); 4415b38ff370SJamie Gritton db_printf(" name = %s\n", pr->pr_name); 44160304c731SJamie Gritton db_printf(" parent = %p\n", pr->pr_parent); 4417b38ff370SJamie Gritton db_printf(" ref = %d\n", pr->pr_ref); 4418b38ff370SJamie Gritton db_printf(" uref = %d\n", pr->pr_uref); 4419*1158508aSJamie Gritton db_printf(" state = %s\n", 4420*1158508aSJamie Gritton pr->pr_state == PRISON_STATE_ALIVE ? "alive" : 4421*1158508aSJamie Gritton pr->pr_state == PRISON_STATE_DYING ? "dying" : 4422*1158508aSJamie Gritton "invalid"); 4423b38ff370SJamie Gritton db_printf(" path = %s\n", pr->pr_path); 4424b38ff370SJamie Gritton db_printf(" cpuset = %d\n", pr->pr_cpuset 4425b38ff370SJamie Gritton ? pr->pr_cpuset->cs_id : -1); 4426679e1390SJamie Gritton #ifdef VIMAGE 4427679e1390SJamie Gritton db_printf(" vnet = %p\n", pr->pr_vnet); 4428679e1390SJamie Gritton #endif 4429b38ff370SJamie Gritton db_printf(" root = %p\n", pr->pr_root); 4430b38ff370SJamie Gritton db_printf(" securelevel = %d\n", pr->pr_securelevel); 44310cc207a6SMartin Matuska db_printf(" devfs_rsnum = %d\n", pr->pr_devfs_rsnum); 4432fe0518e9SBjoern A. Zeeb db_printf(" children.max = %d\n", pr->pr_childmax); 4433fe0518e9SBjoern A. Zeeb db_printf(" children.cur = %d\n", pr->pr_childcount); 44340304c731SJamie Gritton db_printf(" child = %p\n", LIST_FIRST(&pr->pr_children)); 44350304c731SJamie Gritton db_printf(" sibling = %p\n", LIST_NEXT(pr, pr_sibling)); 4436fe0518e9SBjoern A. Zeeb db_printf(" flags = 0x%x", pr->pr_flags); 4437672756aaSJamie Gritton for (bf = pr_flag_bool; bf < pr_flag_bool + nitems(pr_flag_bool); bf++) 4438672756aaSJamie Gritton if (pr->pr_flags & bf->flag) 4439672756aaSJamie Gritton db_printf(" %s", bf->name); 4440672756aaSJamie Gritton for (jsf = pr_flag_jailsys; 4441672756aaSJamie Gritton jsf < pr_flag_jailsys + nitems(pr_flag_jailsys); 4442672756aaSJamie Gritton jsf++) { 4443672756aaSJamie Gritton f = pr->pr_flags & (jsf->disable | jsf->new); 4444672756aaSJamie Gritton db_printf(" %-16s= %s\n", jsf->name, 4445672756aaSJamie Gritton (f != 0 && f == jsf->disable) ? "disable" 4446672756aaSJamie Gritton : (f == jsf->new) ? "new" 44477cbf7213SJamie Gritton : "inherit"); 44487cbf7213SJamie Gritton } 4449fe0518e9SBjoern A. Zeeb db_printf(" allow = 0x%x", pr->pr_allow); 4450672756aaSJamie Gritton for (bf = pr_flag_allow; 44515d58f959SJamie Gritton bf < pr_flag_allow + nitems(pr_flag_allow) && 44525d58f959SJamie Gritton atomic_load_int(&bf->flag) != 0; 4453672756aaSJamie Gritton bf++) 4454672756aaSJamie Gritton if (pr->pr_allow & bf->flag) 4455672756aaSJamie Gritton db_printf(" %s", bf->name); 4456b38ff370SJamie Gritton db_printf("\n"); 44570304c731SJamie Gritton db_printf(" enforce_statfs = %d\n", pr->pr_enforce_statfs); 4458c1f19219SJamie Gritton db_printf(" host.hostname = %s\n", pr->pr_hostname); 4459c1f19219SJamie Gritton db_printf(" host.domainname = %s\n", pr->pr_domainname); 4460c1f19219SJamie Gritton db_printf(" host.hostuuid = %s\n", pr->pr_hostuuid); 446176ca6f88SJamie Gritton db_printf(" host.hostid = %lu\n", pr->pr_hostid); 4462413628a7SBjoern A. Zeeb #ifdef INET 4463b38ff370SJamie Gritton db_printf(" ip4s = %d\n", pr->pr_ip4s); 4464b38ff370SJamie Gritton for (ii = 0; ii < pr->pr_ip4s; ii++) 4465b38ff370SJamie Gritton db_printf(" %s %s\n", 4466fe0518e9SBjoern A. Zeeb ii == 0 ? "ip4.addr =" : " ", 44678144690aSEric van Gyzen inet_ntoa_r(pr->pr_ip4[ii], ip4buf)); 4468413628a7SBjoern A. Zeeb #endif 4469413628a7SBjoern A. Zeeb #ifdef INET6 4470b38ff370SJamie Gritton db_printf(" ip6s = %d\n", pr->pr_ip6s); 4471b38ff370SJamie Gritton for (ii = 0; ii < pr->pr_ip6s; ii++) 4472b38ff370SJamie Gritton db_printf(" %s %s\n", 4473fe0518e9SBjoern A. Zeeb ii == 0 ? "ip6.addr =" : " ", 4474b38ff370SJamie Gritton ip6_sprintf(ip6buf, &pr->pr_ip6[ii])); 4475b38ff370SJamie Gritton #endif 4476b38ff370SJamie Gritton } 4477b38ff370SJamie Gritton 4478b38ff370SJamie Gritton DB_SHOW_COMMAND(prison, db_show_prison_command) 4479b38ff370SJamie Gritton { 4480b38ff370SJamie Gritton struct prison *pr; 4481b38ff370SJamie Gritton 4482b38ff370SJamie Gritton if (!have_addr) { 44830304c731SJamie Gritton /* 44840304c731SJamie Gritton * Show all prisons in the list, and prison0 which is not 44850304c731SJamie Gritton * listed. 44860304c731SJamie Gritton */ 44870304c731SJamie Gritton db_show_prison(&prison0); 44880304c731SJamie Gritton if (!db_pager_quit) { 4489b38ff370SJamie Gritton TAILQ_FOREACH(pr, &allprison, pr_list) { 4490b38ff370SJamie Gritton db_show_prison(pr); 4491413628a7SBjoern A. Zeeb if (db_pager_quit) 4492413628a7SBjoern A. Zeeb break; 4493413628a7SBjoern A. Zeeb } 44940304c731SJamie Gritton } 4495b38ff370SJamie Gritton return; 4496413628a7SBjoern A. Zeeb } 4497b38ff370SJamie Gritton 44980304c731SJamie Gritton if (addr == 0) 44990304c731SJamie Gritton pr = &prison0; 45000304c731SJamie Gritton else { 4501b38ff370SJamie Gritton /* Look for a prison with the ID and with references. */ 4502b38ff370SJamie Gritton TAILQ_FOREACH(pr, &allprison, pr_list) 4503b38ff370SJamie Gritton if (pr->pr_id == addr && pr->pr_ref > 0) 4504b38ff370SJamie Gritton break; 4505b38ff370SJamie Gritton if (pr == NULL) 4506b38ff370SJamie Gritton /* Look again, without requiring a reference. */ 4507b38ff370SJamie Gritton TAILQ_FOREACH(pr, &allprison, pr_list) 4508b38ff370SJamie Gritton if (pr->pr_id == addr) 4509b38ff370SJamie Gritton break; 4510b38ff370SJamie Gritton if (pr == NULL) 4511b38ff370SJamie Gritton /* Assume address points to a valid prison. */ 4512b38ff370SJamie Gritton pr = (struct prison *)addr; 45130304c731SJamie Gritton } 4514b38ff370SJamie Gritton db_show_prison(pr); 4515b38ff370SJamie Gritton } 4516b38ff370SJamie Gritton 4517413628a7SBjoern A. Zeeb #endif /* DDB */ 4518