xref: /freebsd/sys/kern/kern_jail.c (revision 54b369c1ae6658de5968f127fb36ce41a8a4a01d)
19454b2d8SWarner Losh /*-
207901f22SPoul-Henning Kamp  * ----------------------------------------------------------------------------
307901f22SPoul-Henning Kamp  * "THE BEER-WARE LICENSE" (Revision 42):
407901f22SPoul-Henning Kamp  * <phk@FreeBSD.ORG> wrote this file.  As long as you retain this notice you
507901f22SPoul-Henning Kamp  * can do whatever you want with this stuff. If we meet some day, and you think
607901f22SPoul-Henning Kamp  * this stuff is worth it, you can buy me a beer in return.   Poul-Henning Kamp
707901f22SPoul-Henning Kamp  * ----------------------------------------------------------------------------
807901f22SPoul-Henning Kamp  */
975c13541SPoul-Henning Kamp 
10677b542eSDavid E. O'Brien #include <sys/cdefs.h>
11677b542eSDavid E. O'Brien __FBSDID("$FreeBSD$");
12677b542eSDavid E. O'Brien 
1346e3b1cbSPawel Jakub Dawidek #include "opt_mac.h"
1446e3b1cbSPawel Jakub Dawidek 
1575c13541SPoul-Henning Kamp #include <sys/param.h>
1675c13541SPoul-Henning Kamp #include <sys/types.h>
1775c13541SPoul-Henning Kamp #include <sys/kernel.h>
1875c13541SPoul-Henning Kamp #include <sys/systm.h>
1975c13541SPoul-Henning Kamp #include <sys/errno.h>
2075c13541SPoul-Henning Kamp #include <sys/sysproto.h>
2175c13541SPoul-Henning Kamp #include <sys/malloc.h>
22800c9408SRobert Watson #include <sys/priv.h>
2375c13541SPoul-Henning Kamp #include <sys/proc.h>
24b3059e09SRobert Watson #include <sys/taskqueue.h>
2575c13541SPoul-Henning Kamp #include <sys/jail.h>
2601137630SRobert Watson #include <sys/lock.h>
2701137630SRobert Watson #include <sys/mutex.h>
28fd7a8150SMike Barcroft #include <sys/namei.h>
29820a0de9SPawel Jakub Dawidek #include <sys/mount.h>
30fd7a8150SMike Barcroft #include <sys/queue.h>
3175c13541SPoul-Henning Kamp #include <sys/socket.h>
32fd7a8150SMike Barcroft #include <sys/syscallsubr.h>
3383f1e257SRobert Watson #include <sys/sysctl.h>
34fd7a8150SMike Barcroft #include <sys/vnode.h>
3575c13541SPoul-Henning Kamp #include <net/if.h>
3675c13541SPoul-Henning Kamp #include <netinet/in.h>
3775c13541SPoul-Henning Kamp 
38aed55708SRobert Watson #include <security/mac/mac_framework.h>
39aed55708SRobert Watson 
4075c13541SPoul-Henning Kamp MALLOC_DEFINE(M_PRISON, "prison", "Prison structures");
4175c13541SPoul-Henning Kamp 
42d0615c64SAndrew R. Reiter SYSCTL_NODE(_security, OID_AUTO, jail, CTLFLAG_RW, 0,
4383f1e257SRobert Watson     "Jail rules");
4483f1e257SRobert Watson 
4583f1e257SRobert Watson int	jail_set_hostname_allowed = 1;
46d0615c64SAndrew R. Reiter SYSCTL_INT(_security_jail, OID_AUTO, set_hostname_allowed, CTLFLAG_RW,
4783f1e257SRobert Watson     &jail_set_hostname_allowed, 0,
4883f1e257SRobert Watson     "Processes in jail can set their hostnames");
4983f1e257SRobert Watson 
507cadc266SRobert Watson int	jail_socket_unixiproute_only = 1;
51d0615c64SAndrew R. Reiter SYSCTL_INT(_security_jail, OID_AUTO, socket_unixiproute_only, CTLFLAG_RW,
527cadc266SRobert Watson     &jail_socket_unixiproute_only, 0,
537cadc266SRobert Watson     "Processes in jail are limited to creating UNIX/IPv4/route sockets only");
547cadc266SRobert Watson 
55cb1f0db9SRobert Watson int	jail_sysvipc_allowed = 0;
56d0615c64SAndrew R. Reiter SYSCTL_INT(_security_jail, OID_AUTO, sysvipc_allowed, CTLFLAG_RW,
57cb1f0db9SRobert Watson     &jail_sysvipc_allowed, 0,
58cb1f0db9SRobert Watson     "Processes in jail can use System V IPC primitives");
59cb1f0db9SRobert Watson 
60820a0de9SPawel Jakub Dawidek static int jail_enforce_statfs = 2;
61820a0de9SPawel Jakub Dawidek SYSCTL_INT(_security_jail, OID_AUTO, enforce_statfs, CTLFLAG_RW,
62820a0de9SPawel Jakub Dawidek     &jail_enforce_statfs, 0,
63820a0de9SPawel Jakub Dawidek     "Processes in jail cannot see all mounted file systems");
64f08df373SRobert Watson 
655a59cefcSBosko Milekic int	jail_allow_raw_sockets = 0;
665a59cefcSBosko Milekic SYSCTL_INT(_security_jail, OID_AUTO, allow_raw_sockets, CTLFLAG_RW,
675a59cefcSBosko Milekic     &jail_allow_raw_sockets, 0,
685a59cefcSBosko Milekic     "Prison root can create raw sockets");
695a59cefcSBosko Milekic 
7079653046SColin Percival int	jail_chflags_allowed = 0;
7179653046SColin Percival SYSCTL_INT(_security_jail, OID_AUTO, chflags_allowed, CTLFLAG_RW,
7279653046SColin Percival     &jail_chflags_allowed, 0,
7379653046SColin Percival     "Processes in jail can alter system file flags");
7479653046SColin Percival 
75f3a8d2f9SPawel Jakub Dawidek int	jail_mount_allowed = 0;
76f3a8d2f9SPawel Jakub Dawidek SYSCTL_INT(_security_jail, OID_AUTO, mount_allowed, CTLFLAG_RW,
77f3a8d2f9SPawel Jakub Dawidek     &jail_mount_allowed, 0,
78f3a8d2f9SPawel Jakub Dawidek     "Processes in jail can mount/unmount jail-friendly file systems");
79f3a8d2f9SPawel Jakub Dawidek 
80fd7a8150SMike Barcroft /* allprison, lastprid, and prisoncount are protected by allprison_mtx. */
81fd7a8150SMike Barcroft struct	prisonlist allprison;
82fd7a8150SMike Barcroft struct	mtx allprison_mtx;
83fd7a8150SMike Barcroft int	lastprid = 0;
84fd7a8150SMike Barcroft int	prisoncount = 0;
85fd7a8150SMike Barcroft 
86fd7a8150SMike Barcroft static void		 init_prison(void *);
87b3059e09SRobert Watson static void		 prison_complete(void *context, int pending);
88fd7a8150SMike Barcroft static int		 sysctl_jail_list(SYSCTL_HANDLER_ARGS);
89fd7a8150SMike Barcroft 
90fd7a8150SMike Barcroft static void
91fd7a8150SMike Barcroft init_prison(void *data __unused)
92fd7a8150SMike Barcroft {
93fd7a8150SMike Barcroft 
94fd7a8150SMike Barcroft 	mtx_init(&allprison_mtx, "allprison", NULL, MTX_DEF);
95fd7a8150SMike Barcroft 	LIST_INIT(&allprison);
96fd7a8150SMike Barcroft }
97fd7a8150SMike Barcroft 
98fd7a8150SMike Barcroft SYSINIT(prison, SI_SUB_INTRINSIC, SI_ORDER_ANY, init_prison, NULL);
99fd7a8150SMike Barcroft 
100116734c4SMatthew Dillon /*
1019ddb7954SMike Barcroft  * struct jail_args {
1029ddb7954SMike Barcroft  *	struct jail *jail;
1039ddb7954SMike Barcroft  * };
104116734c4SMatthew Dillon  */
10575c13541SPoul-Henning Kamp int
1069ddb7954SMike Barcroft jail(struct thread *td, struct jail_args *uap)
10775c13541SPoul-Henning Kamp {
108fd7a8150SMike Barcroft 	struct nameidata nd;
109fd7a8150SMike Barcroft 	struct prison *pr, *tpr;
11075c13541SPoul-Henning Kamp 	struct jail j;
111fd7a8150SMike Barcroft 	struct jail_attach_args jaa;
112453f7d53SChristian S.J. Peron 	int vfslocked, error, tryprid;
11375c13541SPoul-Henning Kamp 
1149ddb7954SMike Barcroft 	error = copyin(uap->jail, &j, sizeof(j));
11575c13541SPoul-Henning Kamp 	if (error)
116a2f2b3afSJohn Baldwin 		return (error);
117a2f2b3afSJohn Baldwin 	if (j.version != 0)
118a2f2b3afSJohn Baldwin 		return (EINVAL);
119a2f2b3afSJohn Baldwin 
1209ddb7954SMike Barcroft 	MALLOC(pr, struct prison *, sizeof(*pr), M_PRISON, M_WAITOK | M_ZERO);
1216008862bSJohn Baldwin 	mtx_init(&pr->pr_mtx, "jail mutex", NULL, MTX_DEF);
122fd7a8150SMike Barcroft 	pr->pr_ref = 1;
1239ddb7954SMike Barcroft 	error = copyinstr(j.path, &pr->pr_path, sizeof(pr->pr_path), 0);
124fd7a8150SMike Barcroft 	if (error)
125fd7a8150SMike Barcroft 		goto e_killmtx;
126453f7d53SChristian S.J. Peron 	NDINIT(&nd, LOOKUP, MPSAFE | FOLLOW | LOCKLEAF, UIO_SYSSPACE,
127453f7d53SChristian S.J. Peron 	    pr->pr_path, td);
128fd7a8150SMike Barcroft 	error = namei(&nd);
129453f7d53SChristian S.J. Peron 	if (error)
130fd7a8150SMike Barcroft 		goto e_killmtx;
131453f7d53SChristian S.J. Peron 	vfslocked = NDHASGIANT(&nd);
132fd7a8150SMike Barcroft 	pr->pr_root = nd.ni_vp;
133fd7a8150SMike Barcroft 	VOP_UNLOCK(nd.ni_vp, 0, td);
134fd7a8150SMike Barcroft 	NDFREE(&nd, NDF_ONLY_PNBUF);
135453f7d53SChristian S.J. Peron 	VFS_UNLOCK_GIANT(vfslocked);
1369ddb7954SMike Barcroft 	error = copyinstr(j.hostname, &pr->pr_host, sizeof(pr->pr_host), 0);
13775c13541SPoul-Henning Kamp 	if (error)
138fd7a8150SMike Barcroft 		goto e_dropvnref;
139a2f2b3afSJohn Baldwin 	pr->pr_ip = j.ip_number;
140fd7a8150SMike Barcroft 	pr->pr_linux = NULL;
141fd7a8150SMike Barcroft 	pr->pr_securelevel = securelevel;
142fd7a8150SMike Barcroft 
143fd7a8150SMike Barcroft 	/* Determine next pr_id and add prison to allprison list. */
144fd7a8150SMike Barcroft 	mtx_lock(&allprison_mtx);
145fd7a8150SMike Barcroft 	tryprid = lastprid + 1;
146fd7a8150SMike Barcroft 	if (tryprid == JAIL_MAX)
147fd7a8150SMike Barcroft 		tryprid = 1;
148fd7a8150SMike Barcroft next:
149fd7a8150SMike Barcroft 	LIST_FOREACH(tpr, &allprison, pr_list) {
150fd7a8150SMike Barcroft 		if (tpr->pr_id == tryprid) {
151fd7a8150SMike Barcroft 			tryprid++;
152fd7a8150SMike Barcroft 			if (tryprid == JAIL_MAX) {
153fd7a8150SMike Barcroft 				mtx_unlock(&allprison_mtx);
154fd7a8150SMike Barcroft 				error = EAGAIN;
155fd7a8150SMike Barcroft 				goto e_dropvnref;
156fd7a8150SMike Barcroft 			}
157fd7a8150SMike Barcroft 			goto next;
158fd7a8150SMike Barcroft 		}
159fd7a8150SMike Barcroft 	}
160fd7a8150SMike Barcroft 	pr->pr_id = jaa.jid = lastprid = tryprid;
161fd7a8150SMike Barcroft 	LIST_INSERT_HEAD(&allprison, pr, pr_list);
162fd7a8150SMike Barcroft 	prisoncount++;
163fd7a8150SMike Barcroft 	mtx_unlock(&allprison_mtx);
164fd7a8150SMike Barcroft 
165fd7a8150SMike Barcroft 	error = jail_attach(td, &jaa);
166a2f2b3afSJohn Baldwin 	if (error)
167fd7a8150SMike Barcroft 		goto e_dropprref;
168fd7a8150SMike Barcroft 	mtx_lock(&pr->pr_mtx);
169fd7a8150SMike Barcroft 	pr->pr_ref--;
170fd7a8150SMike Barcroft 	mtx_unlock(&pr->pr_mtx);
171fd7a8150SMike Barcroft 	td->td_retval[0] = jaa.jid;
17275c13541SPoul-Henning Kamp 	return (0);
173fd7a8150SMike Barcroft e_dropprref:
174fd7a8150SMike Barcroft 	mtx_lock(&allprison_mtx);
175fd7a8150SMike Barcroft 	LIST_REMOVE(pr, pr_list);
176fd7a8150SMike Barcroft 	prisoncount--;
177fd7a8150SMike Barcroft 	mtx_unlock(&allprison_mtx);
178fd7a8150SMike Barcroft e_dropvnref:
179453f7d53SChristian S.J. Peron 	vfslocked = VFS_LOCK_GIANT(pr->pr_root->v_mount);
180fd7a8150SMike Barcroft 	vrele(pr->pr_root);
181453f7d53SChristian S.J. Peron 	VFS_UNLOCK_GIANT(vfslocked);
182fd7a8150SMike Barcroft e_killmtx:
183894db7b0SMaxime Henrion 	mtx_destroy(&pr->pr_mtx);
18475c13541SPoul-Henning Kamp 	FREE(pr, M_PRISON);
18575c13541SPoul-Henning Kamp 	return (error);
18675c13541SPoul-Henning Kamp }
18775c13541SPoul-Henning Kamp 
188fd7a8150SMike Barcroft /*
1899ddb7954SMike Barcroft  * struct jail_attach_args {
1909ddb7954SMike Barcroft  *	int jid;
1919ddb7954SMike Barcroft  * };
192fd7a8150SMike Barcroft  */
193fd7a8150SMike Barcroft int
1949ddb7954SMike Barcroft jail_attach(struct thread *td, struct jail_attach_args *uap)
195fd7a8150SMike Barcroft {
196fd7a8150SMike Barcroft 	struct proc *p;
197fd7a8150SMike Barcroft 	struct ucred *newcred, *oldcred;
198fd7a8150SMike Barcroft 	struct prison *pr;
199453f7d53SChristian S.J. Peron 	int vfslocked, error;
200fd7a8150SMike Barcroft 
20157f22bd4SJacques Vidrine 	/*
20257f22bd4SJacques Vidrine 	 * XXX: Note that there is a slight race here if two threads
20357f22bd4SJacques Vidrine 	 * in the same privileged process attempt to attach to two
20457f22bd4SJacques Vidrine 	 * different jails at the same time.  It is important for
20557f22bd4SJacques Vidrine 	 * user processes not to do this, or they might end up with
20657f22bd4SJacques Vidrine 	 * a process root from one prison, but attached to the jail
20757f22bd4SJacques Vidrine 	 * of another.
20857f22bd4SJacques Vidrine 	 */
209800c9408SRobert Watson 	error = priv_check(td, PRIV_JAIL_ATTACH);
21057f22bd4SJacques Vidrine 	if (error)
21157f22bd4SJacques Vidrine 		return (error);
212fd7a8150SMike Barcroft 
21357f22bd4SJacques Vidrine 	p = td->td_proc;
214fd7a8150SMike Barcroft 	mtx_lock(&allprison_mtx);
215fd7a8150SMike Barcroft 	pr = prison_find(uap->jid);
216fd7a8150SMike Barcroft 	if (pr == NULL) {
217fd7a8150SMike Barcroft 		mtx_unlock(&allprison_mtx);
218fd7a8150SMike Barcroft 		return (EINVAL);
219fd7a8150SMike Barcroft 	}
220fd7a8150SMike Barcroft 	pr->pr_ref++;
221fd7a8150SMike Barcroft 	mtx_unlock(&pr->pr_mtx);
222fd7a8150SMike Barcroft 	mtx_unlock(&allprison_mtx);
223fd7a8150SMike Barcroft 
224453f7d53SChristian S.J. Peron 	vfslocked = VFS_LOCK_GIANT(pr->pr_root->v_mount);
225fd7a8150SMike Barcroft 	vn_lock(pr->pr_root, LK_EXCLUSIVE | LK_RETRY, td);
226fd7a8150SMike Barcroft 	if ((error = change_dir(pr->pr_root, td)) != 0)
227fd7a8150SMike Barcroft 		goto e_unlock;
228fd7a8150SMike Barcroft #ifdef MAC
229fd7a8150SMike Barcroft 	if ((error = mac_check_vnode_chroot(td->td_ucred, pr->pr_root)))
230fd7a8150SMike Barcroft 		goto e_unlock;
231fd7a8150SMike Barcroft #endif
232fd7a8150SMike Barcroft 	VOP_UNLOCK(pr->pr_root, 0, td);
233fd7a8150SMike Barcroft 	change_root(pr->pr_root, td);
234453f7d53SChristian S.J. Peron 	VFS_UNLOCK_GIANT(vfslocked);
235fd7a8150SMike Barcroft 
236fd7a8150SMike Barcroft 	newcred = crget();
237fd7a8150SMike Barcroft 	PROC_LOCK(p);
238fd7a8150SMike Barcroft 	oldcred = p->p_ucred;
239fd7a8150SMike Barcroft 	setsugid(p);
240fd7a8150SMike Barcroft 	crcopy(newcred, oldcred);
24169c4ee54SJohn Baldwin 	newcred->cr_prison = pr;
242fd7a8150SMike Barcroft 	p->p_ucred = newcred;
243fd7a8150SMike Barcroft 	PROC_UNLOCK(p);
244fd7a8150SMike Barcroft 	crfree(oldcred);
245fd7a8150SMike Barcroft 	return (0);
246fd7a8150SMike Barcroft e_unlock:
247fd7a8150SMike Barcroft 	VOP_UNLOCK(pr->pr_root, 0, td);
248453f7d53SChristian S.J. Peron 	VFS_UNLOCK_GIANT(vfslocked);
249fd7a8150SMike Barcroft 	mtx_lock(&pr->pr_mtx);
250fd7a8150SMike Barcroft 	pr->pr_ref--;
251fd7a8150SMike Barcroft 	mtx_unlock(&pr->pr_mtx);
252fd7a8150SMike Barcroft 	return (error);
253fd7a8150SMike Barcroft }
254fd7a8150SMike Barcroft 
255fd7a8150SMike Barcroft /*
256fd7a8150SMike Barcroft  * Returns a locked prison instance, or NULL on failure.
257fd7a8150SMike Barcroft  */
25854b369c1SPawel Jakub Dawidek struct prison *
259fd7a8150SMike Barcroft prison_find(int prid)
260fd7a8150SMike Barcroft {
261fd7a8150SMike Barcroft 	struct prison *pr;
262fd7a8150SMike Barcroft 
263fd7a8150SMike Barcroft 	mtx_assert(&allprison_mtx, MA_OWNED);
264fd7a8150SMike Barcroft 	LIST_FOREACH(pr, &allprison, pr_list) {
265fd7a8150SMike Barcroft 		if (pr->pr_id == prid) {
266fd7a8150SMike Barcroft 			mtx_lock(&pr->pr_mtx);
267fd7a8150SMike Barcroft 			return (pr);
268fd7a8150SMike Barcroft 		}
269fd7a8150SMike Barcroft 	}
270fd7a8150SMike Barcroft 	return (NULL);
271fd7a8150SMike Barcroft }
272fd7a8150SMike Barcroft 
27391421ba2SRobert Watson void
27491421ba2SRobert Watson prison_free(struct prison *pr)
27591421ba2SRobert Watson {
27691421ba2SRobert Watson 
277fd7a8150SMike Barcroft 	mtx_lock(&allprison_mtx);
27801137630SRobert Watson 	mtx_lock(&pr->pr_mtx);
27991421ba2SRobert Watson 	pr->pr_ref--;
28091421ba2SRobert Watson 	if (pr->pr_ref == 0) {
281fd7a8150SMike Barcroft 		LIST_REMOVE(pr, pr_list);
28201137630SRobert Watson 		mtx_unlock(&pr->pr_mtx);
283fd7a8150SMike Barcroft 		prisoncount--;
284fd7a8150SMike Barcroft 		mtx_unlock(&allprison_mtx);
285b3059e09SRobert Watson 
286b3059e09SRobert Watson 		TASK_INIT(&pr->pr_task, 0, prison_complete, pr);
28722fdc83fSJeff Roberson 		taskqueue_enqueue(taskqueue_thread, &pr->pr_task);
28801137630SRobert Watson 		return;
28991421ba2SRobert Watson 	}
29001137630SRobert Watson 	mtx_unlock(&pr->pr_mtx);
291fd7a8150SMike Barcroft 	mtx_unlock(&allprison_mtx);
29291421ba2SRobert Watson }
29391421ba2SRobert Watson 
294b3059e09SRobert Watson static void
295b3059e09SRobert Watson prison_complete(void *context, int pending)
296b3059e09SRobert Watson {
297b3059e09SRobert Watson 	struct prison *pr;
298453f7d53SChristian S.J. Peron 	int vfslocked;
299b3059e09SRobert Watson 
300b3059e09SRobert Watson 	pr = (struct prison *)context;
301b3059e09SRobert Watson 
302453f7d53SChristian S.J. Peron 	vfslocked = VFS_LOCK_GIANT(pr->pr_root->v_mount);
303b3059e09SRobert Watson 	vrele(pr->pr_root);
304453f7d53SChristian S.J. Peron 	VFS_UNLOCK_GIANT(vfslocked);
305b3059e09SRobert Watson 
306b3059e09SRobert Watson 	mtx_destroy(&pr->pr_mtx);
307b3059e09SRobert Watson 	if (pr->pr_linux != NULL)
308b3059e09SRobert Watson 		FREE(pr->pr_linux, M_PRISON);
309b3059e09SRobert Watson 	FREE(pr, M_PRISON);
310b3059e09SRobert Watson }
311b3059e09SRobert Watson 
31291421ba2SRobert Watson void
31391421ba2SRobert Watson prison_hold(struct prison *pr)
31491421ba2SRobert Watson {
31591421ba2SRobert Watson 
31601137630SRobert Watson 	mtx_lock(&pr->pr_mtx);
31791421ba2SRobert Watson 	pr->pr_ref++;
31801137630SRobert Watson 	mtx_unlock(&pr->pr_mtx);
31901137630SRobert Watson }
32001137630SRobert Watson 
32101137630SRobert Watson u_int32_t
32201137630SRobert Watson prison_getip(struct ucred *cred)
32301137630SRobert Watson {
32401137630SRobert Watson 
32501137630SRobert Watson 	return (cred->cr_prison->pr_ip);
32691421ba2SRobert Watson }
32791421ba2SRobert Watson 
32875c13541SPoul-Henning Kamp int
32991421ba2SRobert Watson prison_ip(struct ucred *cred, int flag, u_int32_t *ip)
33075c13541SPoul-Henning Kamp {
33175c13541SPoul-Henning Kamp 	u_int32_t tmp;
33275c13541SPoul-Henning Kamp 
33391421ba2SRobert Watson 	if (!jailed(cred))
33475c13541SPoul-Henning Kamp 		return (0);
33575c13541SPoul-Henning Kamp 	if (flag)
33675c13541SPoul-Henning Kamp 		tmp = *ip;
33775c13541SPoul-Henning Kamp 	else
33875c13541SPoul-Henning Kamp 		tmp = ntohl(*ip);
33975c13541SPoul-Henning Kamp 	if (tmp == INADDR_ANY) {
34075c13541SPoul-Henning Kamp 		if (flag)
34191421ba2SRobert Watson 			*ip = cred->cr_prison->pr_ip;
34275c13541SPoul-Henning Kamp 		else
34391421ba2SRobert Watson 			*ip = htonl(cred->cr_prison->pr_ip);
34475c13541SPoul-Henning Kamp 		return (0);
34575c13541SPoul-Henning Kamp 	}
346fd6aaf7fSRobert Watson 	if (tmp == INADDR_LOOPBACK) {
347fd6aaf7fSRobert Watson 		if (flag)
348fd6aaf7fSRobert Watson 			*ip = cred->cr_prison->pr_ip;
349fd6aaf7fSRobert Watson 		else
350fd6aaf7fSRobert Watson 			*ip = htonl(cred->cr_prison->pr_ip);
351fd6aaf7fSRobert Watson 		return (0);
352fd6aaf7fSRobert Watson 	}
35391421ba2SRobert Watson 	if (cred->cr_prison->pr_ip != tmp)
35475c13541SPoul-Henning Kamp 		return (1);
35575c13541SPoul-Henning Kamp 	return (0);
35675c13541SPoul-Henning Kamp }
35775c13541SPoul-Henning Kamp 
35875c13541SPoul-Henning Kamp void
35991421ba2SRobert Watson prison_remote_ip(struct ucred *cred, int flag, u_int32_t *ip)
36075c13541SPoul-Henning Kamp {
36175c13541SPoul-Henning Kamp 	u_int32_t tmp;
36275c13541SPoul-Henning Kamp 
36391421ba2SRobert Watson 	if (!jailed(cred))
36475c13541SPoul-Henning Kamp 		return;
36575c13541SPoul-Henning Kamp 	if (flag)
36675c13541SPoul-Henning Kamp 		tmp = *ip;
36775c13541SPoul-Henning Kamp 	else
36875c13541SPoul-Henning Kamp 		tmp = ntohl(*ip);
369fd6aaf7fSRobert Watson 	if (tmp == INADDR_LOOPBACK) {
37075c13541SPoul-Henning Kamp 		if (flag)
37191421ba2SRobert Watson 			*ip = cred->cr_prison->pr_ip;
37275c13541SPoul-Henning Kamp 		else
37391421ba2SRobert Watson 			*ip = htonl(cred->cr_prison->pr_ip);
37475c13541SPoul-Henning Kamp 		return;
37575c13541SPoul-Henning Kamp 	}
37675c13541SPoul-Henning Kamp 	return;
37775c13541SPoul-Henning Kamp }
37875c13541SPoul-Henning Kamp 
37975c13541SPoul-Henning Kamp int
38091421ba2SRobert Watson prison_if(struct ucred *cred, struct sockaddr *sa)
38175c13541SPoul-Henning Kamp {
3829ddb7954SMike Barcroft 	struct sockaddr_in *sai;
38375c13541SPoul-Henning Kamp 	int ok;
38475c13541SPoul-Henning Kamp 
3859ddb7954SMike Barcroft 	sai = (struct sockaddr_in *)sa;
3867cadc266SRobert Watson 	if ((sai->sin_family != AF_INET) && jail_socket_unixiproute_only)
3877cadc266SRobert Watson 		ok = 1;
3887cadc266SRobert Watson 	else if (sai->sin_family != AF_INET)
38975c13541SPoul-Henning Kamp 		ok = 0;
39091421ba2SRobert Watson 	else if (cred->cr_prison->pr_ip != ntohl(sai->sin_addr.s_addr))
39175c13541SPoul-Henning Kamp 		ok = 1;
39275c13541SPoul-Henning Kamp 	else
39375c13541SPoul-Henning Kamp 		ok = 0;
39475c13541SPoul-Henning Kamp 	return (ok);
39575c13541SPoul-Henning Kamp }
39691421ba2SRobert Watson 
39791421ba2SRobert Watson /*
39891421ba2SRobert Watson  * Return 0 if jails permit p1 to frob p2, otherwise ESRCH.
39991421ba2SRobert Watson  */
40091421ba2SRobert Watson int
4019ddb7954SMike Barcroft prison_check(struct ucred *cred1, struct ucred *cred2)
40291421ba2SRobert Watson {
40391421ba2SRobert Watson 
40491421ba2SRobert Watson 	if (jailed(cred1)) {
40591421ba2SRobert Watson 		if (!jailed(cred2))
40691421ba2SRobert Watson 			return (ESRCH);
40791421ba2SRobert Watson 		if (cred2->cr_prison != cred1->cr_prison)
40891421ba2SRobert Watson 			return (ESRCH);
40991421ba2SRobert Watson 	}
41091421ba2SRobert Watson 
41191421ba2SRobert Watson 	return (0);
41291421ba2SRobert Watson }
41391421ba2SRobert Watson 
41491421ba2SRobert Watson /*
41591421ba2SRobert Watson  * Return 1 if the passed credential is in a jail, otherwise 0.
41691421ba2SRobert Watson  */
41791421ba2SRobert Watson int
4189ddb7954SMike Barcroft jailed(struct ucred *cred)
41991421ba2SRobert Watson {
42091421ba2SRobert Watson 
42191421ba2SRobert Watson 	return (cred->cr_prison != NULL);
42291421ba2SRobert Watson }
4239484d0c0SRobert Drehmel 
4249484d0c0SRobert Drehmel /*
4259484d0c0SRobert Drehmel  * Return the correct hostname for the passed credential.
4269484d0c0SRobert Drehmel  */
427ad1ff099SRobert Drehmel void
4289ddb7954SMike Barcroft getcredhostname(struct ucred *cred, char *buf, size_t size)
4299484d0c0SRobert Drehmel {
4309484d0c0SRobert Drehmel 
431ad1ff099SRobert Drehmel 	if (jailed(cred)) {
432ad1ff099SRobert Drehmel 		mtx_lock(&cred->cr_prison->pr_mtx);
433e80fb434SRobert Drehmel 		strlcpy(buf, cred->cr_prison->pr_host, size);
434ad1ff099SRobert Drehmel 		mtx_unlock(&cred->cr_prison->pr_mtx);
4359ddb7954SMike Barcroft 	} else
436e80fb434SRobert Drehmel 		strlcpy(buf, hostname, size);
4379484d0c0SRobert Drehmel }
438fd7a8150SMike Barcroft 
439f08df373SRobert Watson /*
440820a0de9SPawel Jakub Dawidek  * Determine whether the subject represented by cred can "see"
441820a0de9SPawel Jakub Dawidek  * status of a mount point.
442820a0de9SPawel Jakub Dawidek  * Returns: 0 for permitted, ENOENT otherwise.
443820a0de9SPawel Jakub Dawidek  * XXX: This function should be called cr_canseemount() and should be
444820a0de9SPawel Jakub Dawidek  *      placed in kern_prot.c.
445f08df373SRobert Watson  */
446f08df373SRobert Watson int
447820a0de9SPawel Jakub Dawidek prison_canseemount(struct ucred *cred, struct mount *mp)
448f08df373SRobert Watson {
449820a0de9SPawel Jakub Dawidek 	struct prison *pr;
450820a0de9SPawel Jakub Dawidek 	struct statfs *sp;
451820a0de9SPawel Jakub Dawidek 	size_t len;
452f08df373SRobert Watson 
453820a0de9SPawel Jakub Dawidek 	if (!jailed(cred) || jail_enforce_statfs == 0)
454820a0de9SPawel Jakub Dawidek 		return (0);
455820a0de9SPawel Jakub Dawidek 	pr = cred->cr_prison;
456820a0de9SPawel Jakub Dawidek 	if (pr->pr_root->v_mount == mp)
457820a0de9SPawel Jakub Dawidek 		return (0);
458820a0de9SPawel Jakub Dawidek 	if (jail_enforce_statfs == 2)
459820a0de9SPawel Jakub Dawidek 		return (ENOENT);
460820a0de9SPawel Jakub Dawidek 	/*
461820a0de9SPawel Jakub Dawidek 	 * If jail's chroot directory is set to "/" we should be able to see
462820a0de9SPawel Jakub Dawidek 	 * all mount-points from inside a jail.
463820a0de9SPawel Jakub Dawidek 	 * This is ugly check, but this is the only situation when jail's
464820a0de9SPawel Jakub Dawidek 	 * directory ends with '/'.
465820a0de9SPawel Jakub Dawidek 	 */
466820a0de9SPawel Jakub Dawidek 	if (strcmp(pr->pr_path, "/") == 0)
467820a0de9SPawel Jakub Dawidek 		return (0);
468820a0de9SPawel Jakub Dawidek 	len = strlen(pr->pr_path);
469820a0de9SPawel Jakub Dawidek 	sp = &mp->mnt_stat;
470820a0de9SPawel Jakub Dawidek 	if (strncmp(pr->pr_path, sp->f_mntonname, len) != 0)
471820a0de9SPawel Jakub Dawidek 		return (ENOENT);
472820a0de9SPawel Jakub Dawidek 	/*
473820a0de9SPawel Jakub Dawidek 	 * Be sure that we don't have situation where jail's root directory
474820a0de9SPawel Jakub Dawidek 	 * is "/some/path" and mount point is "/some/pathpath".
475820a0de9SPawel Jakub Dawidek 	 */
476820a0de9SPawel Jakub Dawidek 	if (sp->f_mntonname[len] != '\0' && sp->f_mntonname[len] != '/')
477820a0de9SPawel Jakub Dawidek 		return (ENOENT);
478f08df373SRobert Watson 	return (0);
479f08df373SRobert Watson }
480820a0de9SPawel Jakub Dawidek 
481820a0de9SPawel Jakub Dawidek void
482820a0de9SPawel Jakub Dawidek prison_enforce_statfs(struct ucred *cred, struct mount *mp, struct statfs *sp)
483820a0de9SPawel Jakub Dawidek {
484820a0de9SPawel Jakub Dawidek 	char jpath[MAXPATHLEN];
485820a0de9SPawel Jakub Dawidek 	struct prison *pr;
486820a0de9SPawel Jakub Dawidek 	size_t len;
487820a0de9SPawel Jakub Dawidek 
488820a0de9SPawel Jakub Dawidek 	if (!jailed(cred) || jail_enforce_statfs == 0)
489820a0de9SPawel Jakub Dawidek 		return;
490820a0de9SPawel Jakub Dawidek 	pr = cred->cr_prison;
491820a0de9SPawel Jakub Dawidek 	if (prison_canseemount(cred, mp) != 0) {
492820a0de9SPawel Jakub Dawidek 		bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
493820a0de9SPawel Jakub Dawidek 		strlcpy(sp->f_mntonname, "[restricted]",
494820a0de9SPawel Jakub Dawidek 		    sizeof(sp->f_mntonname));
495820a0de9SPawel Jakub Dawidek 		return;
496820a0de9SPawel Jakub Dawidek 	}
497820a0de9SPawel Jakub Dawidek 	if (pr->pr_root->v_mount == mp) {
498820a0de9SPawel Jakub Dawidek 		/*
499820a0de9SPawel Jakub Dawidek 		 * Clear current buffer data, so we are sure nothing from
500820a0de9SPawel Jakub Dawidek 		 * the valid path left there.
501820a0de9SPawel Jakub Dawidek 		 */
502820a0de9SPawel Jakub Dawidek 		bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
503820a0de9SPawel Jakub Dawidek 		*sp->f_mntonname = '/';
504820a0de9SPawel Jakub Dawidek 		return;
505820a0de9SPawel Jakub Dawidek 	}
506820a0de9SPawel Jakub Dawidek 	/*
507820a0de9SPawel Jakub Dawidek 	 * If jail's chroot directory is set to "/" we should be able to see
508820a0de9SPawel Jakub Dawidek 	 * all mount-points from inside a jail.
509820a0de9SPawel Jakub Dawidek 	 */
510820a0de9SPawel Jakub Dawidek 	if (strcmp(pr->pr_path, "/") == 0)
511820a0de9SPawel Jakub Dawidek 		return;
512820a0de9SPawel Jakub Dawidek 	len = strlen(pr->pr_path);
513820a0de9SPawel Jakub Dawidek 	strlcpy(jpath, sp->f_mntonname + len, sizeof(jpath));
514820a0de9SPawel Jakub Dawidek 	/*
515820a0de9SPawel Jakub Dawidek 	 * Clear current buffer data, so we are sure nothing from
516820a0de9SPawel Jakub Dawidek 	 * the valid path left there.
517820a0de9SPawel Jakub Dawidek 	 */
518820a0de9SPawel Jakub Dawidek 	bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
519820a0de9SPawel Jakub Dawidek 	if (*jpath == '\0') {
520820a0de9SPawel Jakub Dawidek 		/* Should never happen. */
521820a0de9SPawel Jakub Dawidek 		*sp->f_mntonname = '/';
522820a0de9SPawel Jakub Dawidek 	} else {
523820a0de9SPawel Jakub Dawidek 		strlcpy(sp->f_mntonname, jpath, sizeof(sp->f_mntonname));
524820a0de9SPawel Jakub Dawidek 	}
525f08df373SRobert Watson }
526f08df373SRobert Watson 
527800c9408SRobert Watson /*
528800c9408SRobert Watson  * Check with permission for a specific privilege is granted within jail.  We
529800c9408SRobert Watson  * have a specific list of accepted privileges; the rest are denied.
530800c9408SRobert Watson  */
531800c9408SRobert Watson int
532800c9408SRobert Watson prison_priv_check(struct ucred *cred, int priv)
533800c9408SRobert Watson {
534800c9408SRobert Watson 
535800c9408SRobert Watson 	if (!jailed(cred))
536800c9408SRobert Watson 		return (0);
537800c9408SRobert Watson 
538800c9408SRobert Watson 	switch (priv) {
539800c9408SRobert Watson 
540800c9408SRobert Watson 		/*
541800c9408SRobert Watson 		 * Allow ktrace privileges for root in jail.
542800c9408SRobert Watson 		 */
543800c9408SRobert Watson 	case PRIV_KTRACE:
544800c9408SRobert Watson 
545c3c1b5e6SRobert Watson #if 0
546800c9408SRobert Watson 		/*
547800c9408SRobert Watson 		 * Allow jailed processes to configure audit identity and
548800c9408SRobert Watson 		 * submit audit records (login, etc).  In the future we may
549800c9408SRobert Watson 		 * want to further refine the relationship between audit and
550800c9408SRobert Watson 		 * jail.
551800c9408SRobert Watson 		 */
552800c9408SRobert Watson 	case PRIV_AUDIT_GETAUDIT:
553800c9408SRobert Watson 	case PRIV_AUDIT_SETAUDIT:
554800c9408SRobert Watson 	case PRIV_AUDIT_SUBMIT:
555c3c1b5e6SRobert Watson #endif
556800c9408SRobert Watson 
557800c9408SRobert Watson 		/*
558800c9408SRobert Watson 		 * Allow jailed processes to manipulate process UNIX
559800c9408SRobert Watson 		 * credentials in any way they see fit.
560800c9408SRobert Watson 		 */
561800c9408SRobert Watson 	case PRIV_CRED_SETUID:
562800c9408SRobert Watson 	case PRIV_CRED_SETEUID:
563800c9408SRobert Watson 	case PRIV_CRED_SETGID:
564800c9408SRobert Watson 	case PRIV_CRED_SETEGID:
565800c9408SRobert Watson 	case PRIV_CRED_SETGROUPS:
566800c9408SRobert Watson 	case PRIV_CRED_SETREUID:
567800c9408SRobert Watson 	case PRIV_CRED_SETREGID:
568800c9408SRobert Watson 	case PRIV_CRED_SETRESUID:
569800c9408SRobert Watson 	case PRIV_CRED_SETRESGID:
570800c9408SRobert Watson 
571800c9408SRobert Watson 		/*
572800c9408SRobert Watson 		 * Jail implements visibility constraints already, so allow
573800c9408SRobert Watson 		 * jailed root to override uid/gid-based constraints.
574800c9408SRobert Watson 		 */
575800c9408SRobert Watson 	case PRIV_SEEOTHERGIDS:
576800c9408SRobert Watson 	case PRIV_SEEOTHERUIDS:
577800c9408SRobert Watson 
578800c9408SRobert Watson 		/*
579800c9408SRobert Watson 		 * Jail implements inter-process debugging limits already, so
580800c9408SRobert Watson 		 * allow jailed root various debugging privileges.
581800c9408SRobert Watson 		 */
582800c9408SRobert Watson 	case PRIV_DEBUG_DIFFCRED:
583800c9408SRobert Watson 	case PRIV_DEBUG_SUGID:
584800c9408SRobert Watson 	case PRIV_DEBUG_UNPRIV:
585800c9408SRobert Watson 
586800c9408SRobert Watson 		/*
587800c9408SRobert Watson 		 * Allow jail to set various resource limits and login
588800c9408SRobert Watson 		 * properties, and for now, exceed process resource limits.
589800c9408SRobert Watson 		 */
590800c9408SRobert Watson 	case PRIV_PROC_LIMIT:
591800c9408SRobert Watson 	case PRIV_PROC_SETLOGIN:
592800c9408SRobert Watson 	case PRIV_PROC_SETRLIMIT:
593800c9408SRobert Watson 
594800c9408SRobert Watson 		/*
595800c9408SRobert Watson 		 * System V and POSIX IPC privileges are granted in jail.
596800c9408SRobert Watson 		 */
597800c9408SRobert Watson 	case PRIV_IPC_READ:
598800c9408SRobert Watson 	case PRIV_IPC_WRITE:
599800c9408SRobert Watson 	case PRIV_IPC_ADMIN:
600800c9408SRobert Watson 	case PRIV_IPC_MSGSIZE:
601800c9408SRobert Watson 	case PRIV_MQ_ADMIN:
602800c9408SRobert Watson 
603800c9408SRobert Watson 		/*
604800c9408SRobert Watson 		 * Jail implements its own inter-process limits, so allow
605800c9408SRobert Watson 		 * root processes in jail to change scheduling on other
606800c9408SRobert Watson 		 * processes in the same jail.  Likewise for signalling.
607800c9408SRobert Watson 		 */
608800c9408SRobert Watson 	case PRIV_SCHED_DIFFCRED:
609800c9408SRobert Watson 	case PRIV_SIGNAL_DIFFCRED:
610800c9408SRobert Watson 	case PRIV_SIGNAL_SUGID:
611800c9408SRobert Watson 
612800c9408SRobert Watson 		/*
613800c9408SRobert Watson 		 * Allow jailed processes to write to sysctls marked as jail
614800c9408SRobert Watson 		 * writable.
615800c9408SRobert Watson 		 */
616800c9408SRobert Watson 	case PRIV_SYSCTL_WRITEJAIL:
617800c9408SRobert Watson 
618800c9408SRobert Watson 		/*
619800c9408SRobert Watson 		 * Allow root in jail to manage a variety of quota
620e82d0201SRobert Watson 		 * properties.  These should likely be conditional on a
621e82d0201SRobert Watson 		 * configuration option.
622800c9408SRobert Watson 		 */
62395b091d2SRobert Watson 	case PRIV_VFS_GETQUOTA:
62495b091d2SRobert Watson 	case PRIV_VFS_SETQUOTA:
625800c9408SRobert Watson 
626800c9408SRobert Watson 		/*
627800c9408SRobert Watson 		 * Since Jail relies on chroot() to implement file system
628800c9408SRobert Watson 		 * protections, grant many VFS privileges to root in jail.
629800c9408SRobert Watson 		 * Be careful to exclude mount-related and NFS-related
630800c9408SRobert Watson 		 * privileges.
631800c9408SRobert Watson 		 */
632800c9408SRobert Watson 	case PRIV_VFS_READ:
633800c9408SRobert Watson 	case PRIV_VFS_WRITE:
634800c9408SRobert Watson 	case PRIV_VFS_ADMIN:
635800c9408SRobert Watson 	case PRIV_VFS_EXEC:
636800c9408SRobert Watson 	case PRIV_VFS_LOOKUP:
637800c9408SRobert Watson 	case PRIV_VFS_BLOCKRESERVE:	/* XXXRW: Slightly surprising. */
638800c9408SRobert Watson 	case PRIV_VFS_CHFLAGS_DEV:
639800c9408SRobert Watson 	case PRIV_VFS_CHOWN:
640800c9408SRobert Watson 	case PRIV_VFS_CHROOT:
641bb531912SPawel Jakub Dawidek 	case PRIV_VFS_RETAINSUGID:
642800c9408SRobert Watson 	case PRIV_VFS_FCHROOT:
643800c9408SRobert Watson 	case PRIV_VFS_LINK:
644800c9408SRobert Watson 	case PRIV_VFS_SETGID:
645800c9408SRobert Watson 	case PRIV_VFS_STICKYFILE:
646800c9408SRobert Watson 		return (0);
647800c9408SRobert Watson 
648800c9408SRobert Watson 		/*
649800c9408SRobert Watson 		 * Depending on the global setting, allow privilege of
650800c9408SRobert Watson 		 * setting system flags.
651800c9408SRobert Watson 		 */
652800c9408SRobert Watson 	case PRIV_VFS_SYSFLAGS:
653800c9408SRobert Watson 		if (jail_chflags_allowed)
654800c9408SRobert Watson 			return (0);
655800c9408SRobert Watson 		else
656800c9408SRobert Watson 			return (EPERM);
657800c9408SRobert Watson 
658800c9408SRobert Watson 		/*
659f3a8d2f9SPawel Jakub Dawidek 		 * Depending on the global setting, allow privilege of
660f3a8d2f9SPawel Jakub Dawidek 		 * mounting/unmounting file systems.
661f3a8d2f9SPawel Jakub Dawidek 		 */
662f3a8d2f9SPawel Jakub Dawidek 	case PRIV_VFS_MOUNT:
663f3a8d2f9SPawel Jakub Dawidek 	case PRIV_VFS_UNMOUNT:
664f3a8d2f9SPawel Jakub Dawidek 	case PRIV_VFS_MOUNT_NONUSER:
665f3a8d2f9SPawel Jakub Dawidek 		if (jail_mount_allowed)
666f3a8d2f9SPawel Jakub Dawidek 			return (0);
667f3a8d2f9SPawel Jakub Dawidek 		else
668f3a8d2f9SPawel Jakub Dawidek 			return (EPERM);
669f3a8d2f9SPawel Jakub Dawidek 
670f3a8d2f9SPawel Jakub Dawidek 		/*
671800c9408SRobert Watson 		 * Allow jailed root to bind reserved ports.
672800c9408SRobert Watson 		 */
673800c9408SRobert Watson 	case PRIV_NETINET_RESERVEDPORT:
674800c9408SRobert Watson 		return (0);
675800c9408SRobert Watson 
676800c9408SRobert Watson 		/*
677800c9408SRobert Watson 		 * Conditionally allow creating raw sockets in jail.
678800c9408SRobert Watson 		 */
679800c9408SRobert Watson 	case PRIV_NETINET_RAW:
680800c9408SRobert Watson 		if (jail_allow_raw_sockets)
681800c9408SRobert Watson 			return (0);
682800c9408SRobert Watson 		else
683800c9408SRobert Watson 			return (EPERM);
684800c9408SRobert Watson 
685800c9408SRobert Watson 		/*
686800c9408SRobert Watson 		 * Since jail implements its own visibility limits on netstat
687800c9408SRobert Watson 		 * sysctls, allow getcred.  This allows identd to work in
688800c9408SRobert Watson 		 * jail.
689800c9408SRobert Watson 		 */
690800c9408SRobert Watson 	case PRIV_NETINET_GETCRED:
691800c9408SRobert Watson 		return (0);
692800c9408SRobert Watson 
693800c9408SRobert Watson 	default:
694800c9408SRobert Watson 		/*
695800c9408SRobert Watson 		 * In all remaining cases, deny the privilege request.  This
696800c9408SRobert Watson 		 * includes almost all network privileges, many system
697800c9408SRobert Watson 		 * configuration privileges.
698800c9408SRobert Watson 		 */
699800c9408SRobert Watson 		return (EPERM);
700800c9408SRobert Watson 	}
701800c9408SRobert Watson }
702800c9408SRobert Watson 
703fd7a8150SMike Barcroft static int
704fd7a8150SMike Barcroft sysctl_jail_list(SYSCTL_HANDLER_ARGS)
705fd7a8150SMike Barcroft {
706fd7a8150SMike Barcroft 	struct xprison *xp, *sxp;
707fd7a8150SMike Barcroft 	struct prison *pr;
708fd7a8150SMike Barcroft 	int count, error;
709fd7a8150SMike Barcroft 
7107f4704c0SPawel Jakub Dawidek 	if (jailed(req->td->td_ucred))
711679a1060SRobert Watson 		return (0);
712fd7a8150SMike Barcroft retry:
713fd7a8150SMike Barcroft 	mtx_lock(&allprison_mtx);
714fd7a8150SMike Barcroft 	count = prisoncount;
715fd7a8150SMike Barcroft 	mtx_unlock(&allprison_mtx);
716fd7a8150SMike Barcroft 
717fd7a8150SMike Barcroft 	if (count == 0)
718fd7a8150SMike Barcroft 		return (0);
719fd7a8150SMike Barcroft 
720fd7a8150SMike Barcroft 	sxp = xp = malloc(sizeof(*xp) * count, M_TEMP, M_WAITOK | M_ZERO);
721fd7a8150SMike Barcroft 	mtx_lock(&allprison_mtx);
722fd7a8150SMike Barcroft 	if (count != prisoncount) {
723fd7a8150SMike Barcroft 		mtx_unlock(&allprison_mtx);
724fd7a8150SMike Barcroft 		free(sxp, M_TEMP);
725fd7a8150SMike Barcroft 		goto retry;
726fd7a8150SMike Barcroft 	}
727fd7a8150SMike Barcroft 
728fd7a8150SMike Barcroft 	LIST_FOREACH(pr, &allprison, pr_list) {
729fd7a8150SMike Barcroft 		mtx_lock(&pr->pr_mtx);
730fd7a8150SMike Barcroft 		xp->pr_version = XPRISON_VERSION;
731fd7a8150SMike Barcroft 		xp->pr_id = pr->pr_id;
732fd7a8150SMike Barcroft 		strlcpy(xp->pr_path, pr->pr_path, sizeof(xp->pr_path));
733fd7a8150SMike Barcroft 		strlcpy(xp->pr_host, pr->pr_host, sizeof(xp->pr_host));
734fd7a8150SMike Barcroft 		xp->pr_ip = pr->pr_ip;
735fd7a8150SMike Barcroft 		mtx_unlock(&pr->pr_mtx);
736fd7a8150SMike Barcroft 		xp++;
737fd7a8150SMike Barcroft 	}
738fd7a8150SMike Barcroft 	mtx_unlock(&allprison_mtx);
739fd7a8150SMike Barcroft 
740fd7a8150SMike Barcroft 	error = SYSCTL_OUT(req, sxp, sizeof(*sxp) * count);
741fd7a8150SMike Barcroft 	free(sxp, M_TEMP);
742fd7a8150SMike Barcroft 	return (error);
743fd7a8150SMike Barcroft }
744fd7a8150SMike Barcroft 
745fd7a8150SMike Barcroft SYSCTL_OID(_security_jail, OID_AUTO, list, CTLTYPE_STRUCT | CTLFLAG_RD,
746fd7a8150SMike Barcroft     NULL, 0, sysctl_jail_list, "S", "List of active jails");
747461167c2SPawel Jakub Dawidek 
748461167c2SPawel Jakub Dawidek static int
749461167c2SPawel Jakub Dawidek sysctl_jail_jailed(SYSCTL_HANDLER_ARGS)
750461167c2SPawel Jakub Dawidek {
751461167c2SPawel Jakub Dawidek 	int error, injail;
752461167c2SPawel Jakub Dawidek 
753461167c2SPawel Jakub Dawidek 	injail = jailed(req->td->td_ucred);
754461167c2SPawel Jakub Dawidek 	error = SYSCTL_OUT(req, &injail, sizeof(injail));
755461167c2SPawel Jakub Dawidek 
756461167c2SPawel Jakub Dawidek 	return (error);
757461167c2SPawel Jakub Dawidek }
758461167c2SPawel Jakub Dawidek SYSCTL_PROC(_security_jail, OID_AUTO, jailed, CTLTYPE_INT | CTLFLAG_RD,
759461167c2SPawel Jakub Dawidek     NULL, 0, sysctl_jail_jailed, "I", "Process in jail?");
760