19454b2d8SWarner Losh /*- 207901f22SPoul-Henning Kamp * ---------------------------------------------------------------------------- 307901f22SPoul-Henning Kamp * "THE BEER-WARE LICENSE" (Revision 42): 407901f22SPoul-Henning Kamp * <phk@FreeBSD.ORG> wrote this file. As long as you retain this notice you 507901f22SPoul-Henning Kamp * can do whatever you want with this stuff. If we meet some day, and you think 607901f22SPoul-Henning Kamp * this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp 707901f22SPoul-Henning Kamp * ---------------------------------------------------------------------------- 807901f22SPoul-Henning Kamp */ 975c13541SPoul-Henning Kamp 10677b542eSDavid E. O'Brien #include <sys/cdefs.h> 11677b542eSDavid E. O'Brien __FBSDID("$FreeBSD$"); 12677b542eSDavid E. O'Brien 1346e3b1cbSPawel Jakub Dawidek #include "opt_mac.h" 1446e3b1cbSPawel Jakub Dawidek 1575c13541SPoul-Henning Kamp #include <sys/param.h> 1675c13541SPoul-Henning Kamp #include <sys/types.h> 1775c13541SPoul-Henning Kamp #include <sys/kernel.h> 1875c13541SPoul-Henning Kamp #include <sys/systm.h> 1975c13541SPoul-Henning Kamp #include <sys/errno.h> 2075c13541SPoul-Henning Kamp #include <sys/sysproto.h> 2175c13541SPoul-Henning Kamp #include <sys/malloc.h> 22800c9408SRobert Watson #include <sys/priv.h> 2375c13541SPoul-Henning Kamp #include <sys/proc.h> 24b3059e09SRobert Watson #include <sys/taskqueue.h> 2575c13541SPoul-Henning Kamp #include <sys/jail.h> 2601137630SRobert Watson #include <sys/lock.h> 2701137630SRobert Watson #include <sys/mutex.h> 28fd7a8150SMike Barcroft #include <sys/namei.h> 29820a0de9SPawel Jakub Dawidek #include <sys/mount.h> 30fd7a8150SMike Barcroft #include <sys/queue.h> 3175c13541SPoul-Henning Kamp #include <sys/socket.h> 32fd7a8150SMike Barcroft #include <sys/syscallsubr.h> 3383f1e257SRobert Watson #include <sys/sysctl.h> 34fd7a8150SMike Barcroft #include <sys/vnode.h> 3575c13541SPoul-Henning Kamp #include <net/if.h> 3675c13541SPoul-Henning Kamp #include <netinet/in.h> 3775c13541SPoul-Henning Kamp 38aed55708SRobert Watson #include <security/mac/mac_framework.h> 39aed55708SRobert Watson 4075c13541SPoul-Henning Kamp MALLOC_DEFINE(M_PRISON, "prison", "Prison structures"); 4175c13541SPoul-Henning Kamp 42d0615c64SAndrew R. Reiter SYSCTL_NODE(_security, OID_AUTO, jail, CTLFLAG_RW, 0, 4383f1e257SRobert Watson "Jail rules"); 4483f1e257SRobert Watson 4583f1e257SRobert Watson int jail_set_hostname_allowed = 1; 46d0615c64SAndrew R. Reiter SYSCTL_INT(_security_jail, OID_AUTO, set_hostname_allowed, CTLFLAG_RW, 4783f1e257SRobert Watson &jail_set_hostname_allowed, 0, 4883f1e257SRobert Watson "Processes in jail can set their hostnames"); 4983f1e257SRobert Watson 507cadc266SRobert Watson int jail_socket_unixiproute_only = 1; 51d0615c64SAndrew R. Reiter SYSCTL_INT(_security_jail, OID_AUTO, socket_unixiproute_only, CTLFLAG_RW, 527cadc266SRobert Watson &jail_socket_unixiproute_only, 0, 537cadc266SRobert Watson "Processes in jail are limited to creating UNIX/IPv4/route sockets only"); 547cadc266SRobert Watson 55cb1f0db9SRobert Watson int jail_sysvipc_allowed = 0; 56d0615c64SAndrew R. Reiter SYSCTL_INT(_security_jail, OID_AUTO, sysvipc_allowed, CTLFLAG_RW, 57cb1f0db9SRobert Watson &jail_sysvipc_allowed, 0, 58cb1f0db9SRobert Watson "Processes in jail can use System V IPC primitives"); 59cb1f0db9SRobert Watson 60820a0de9SPawel Jakub Dawidek static int jail_enforce_statfs = 2; 61820a0de9SPawel Jakub Dawidek SYSCTL_INT(_security_jail, OID_AUTO, enforce_statfs, CTLFLAG_RW, 62820a0de9SPawel Jakub Dawidek &jail_enforce_statfs, 0, 63820a0de9SPawel Jakub Dawidek "Processes in jail cannot see all mounted file systems"); 64f08df373SRobert Watson 655a59cefcSBosko Milekic int jail_allow_raw_sockets = 0; 665a59cefcSBosko Milekic SYSCTL_INT(_security_jail, OID_AUTO, allow_raw_sockets, CTLFLAG_RW, 675a59cefcSBosko Milekic &jail_allow_raw_sockets, 0, 685a59cefcSBosko Milekic "Prison root can create raw sockets"); 695a59cefcSBosko Milekic 7079653046SColin Percival int jail_chflags_allowed = 0; 7179653046SColin Percival SYSCTL_INT(_security_jail, OID_AUTO, chflags_allowed, CTLFLAG_RW, 7279653046SColin Percival &jail_chflags_allowed, 0, 7379653046SColin Percival "Processes in jail can alter system file flags"); 7479653046SColin Percival 75f3a8d2f9SPawel Jakub Dawidek int jail_mount_allowed = 0; 76f3a8d2f9SPawel Jakub Dawidek SYSCTL_INT(_security_jail, OID_AUTO, mount_allowed, CTLFLAG_RW, 77f3a8d2f9SPawel Jakub Dawidek &jail_mount_allowed, 0, 78f3a8d2f9SPawel Jakub Dawidek "Processes in jail can mount/unmount jail-friendly file systems"); 79f3a8d2f9SPawel Jakub Dawidek 80fd7a8150SMike Barcroft /* allprison, lastprid, and prisoncount are protected by allprison_mtx. */ 81fd7a8150SMike Barcroft struct prisonlist allprison; 82fd7a8150SMike Barcroft struct mtx allprison_mtx; 83fd7a8150SMike Barcroft int lastprid = 0; 84fd7a8150SMike Barcroft int prisoncount = 0; 85fd7a8150SMike Barcroft 86fd7a8150SMike Barcroft static void init_prison(void *); 87b3059e09SRobert Watson static void prison_complete(void *context, int pending); 88fd7a8150SMike Barcroft static int sysctl_jail_list(SYSCTL_HANDLER_ARGS); 89fd7a8150SMike Barcroft 90fd7a8150SMike Barcroft static void 91fd7a8150SMike Barcroft init_prison(void *data __unused) 92fd7a8150SMike Barcroft { 93fd7a8150SMike Barcroft 94fd7a8150SMike Barcroft mtx_init(&allprison_mtx, "allprison", NULL, MTX_DEF); 95fd7a8150SMike Barcroft LIST_INIT(&allprison); 96fd7a8150SMike Barcroft } 97fd7a8150SMike Barcroft 98fd7a8150SMike Barcroft SYSINIT(prison, SI_SUB_INTRINSIC, SI_ORDER_ANY, init_prison, NULL); 99fd7a8150SMike Barcroft 100116734c4SMatthew Dillon /* 1019ddb7954SMike Barcroft * struct jail_args { 1029ddb7954SMike Barcroft * struct jail *jail; 1039ddb7954SMike Barcroft * }; 104116734c4SMatthew Dillon */ 10575c13541SPoul-Henning Kamp int 1069ddb7954SMike Barcroft jail(struct thread *td, struct jail_args *uap) 10775c13541SPoul-Henning Kamp { 108fd7a8150SMike Barcroft struct nameidata nd; 109fd7a8150SMike Barcroft struct prison *pr, *tpr; 11075c13541SPoul-Henning Kamp struct jail j; 111fd7a8150SMike Barcroft struct jail_attach_args jaa; 112453f7d53SChristian S.J. Peron int vfslocked, error, tryprid; 11375c13541SPoul-Henning Kamp 1149ddb7954SMike Barcroft error = copyin(uap->jail, &j, sizeof(j)); 11575c13541SPoul-Henning Kamp if (error) 116a2f2b3afSJohn Baldwin return (error); 117a2f2b3afSJohn Baldwin if (j.version != 0) 118a2f2b3afSJohn Baldwin return (EINVAL); 119a2f2b3afSJohn Baldwin 1209ddb7954SMike Barcroft MALLOC(pr, struct prison *, sizeof(*pr), M_PRISON, M_WAITOK | M_ZERO); 1216008862bSJohn Baldwin mtx_init(&pr->pr_mtx, "jail mutex", NULL, MTX_DEF); 122fd7a8150SMike Barcroft pr->pr_ref = 1; 1239ddb7954SMike Barcroft error = copyinstr(j.path, &pr->pr_path, sizeof(pr->pr_path), 0); 124fd7a8150SMike Barcroft if (error) 125fd7a8150SMike Barcroft goto e_killmtx; 126453f7d53SChristian S.J. Peron NDINIT(&nd, LOOKUP, MPSAFE | FOLLOW | LOCKLEAF, UIO_SYSSPACE, 127453f7d53SChristian S.J. Peron pr->pr_path, td); 128fd7a8150SMike Barcroft error = namei(&nd); 129453f7d53SChristian S.J. Peron if (error) 130fd7a8150SMike Barcroft goto e_killmtx; 131453f7d53SChristian S.J. Peron vfslocked = NDHASGIANT(&nd); 132fd7a8150SMike Barcroft pr->pr_root = nd.ni_vp; 133fd7a8150SMike Barcroft VOP_UNLOCK(nd.ni_vp, 0, td); 134fd7a8150SMike Barcroft NDFREE(&nd, NDF_ONLY_PNBUF); 135453f7d53SChristian S.J. Peron VFS_UNLOCK_GIANT(vfslocked); 1369ddb7954SMike Barcroft error = copyinstr(j.hostname, &pr->pr_host, sizeof(pr->pr_host), 0); 13775c13541SPoul-Henning Kamp if (error) 138fd7a8150SMike Barcroft goto e_dropvnref; 139a2f2b3afSJohn Baldwin pr->pr_ip = j.ip_number; 140fd7a8150SMike Barcroft pr->pr_linux = NULL; 141fd7a8150SMike Barcroft pr->pr_securelevel = securelevel; 142fd7a8150SMike Barcroft 143fd7a8150SMike Barcroft /* Determine next pr_id and add prison to allprison list. */ 144fd7a8150SMike Barcroft mtx_lock(&allprison_mtx); 145fd7a8150SMike Barcroft tryprid = lastprid + 1; 146fd7a8150SMike Barcroft if (tryprid == JAIL_MAX) 147fd7a8150SMike Barcroft tryprid = 1; 148fd7a8150SMike Barcroft next: 149fd7a8150SMike Barcroft LIST_FOREACH(tpr, &allprison, pr_list) { 150fd7a8150SMike Barcroft if (tpr->pr_id == tryprid) { 151fd7a8150SMike Barcroft tryprid++; 152fd7a8150SMike Barcroft if (tryprid == JAIL_MAX) { 153fd7a8150SMike Barcroft mtx_unlock(&allprison_mtx); 154fd7a8150SMike Barcroft error = EAGAIN; 155fd7a8150SMike Barcroft goto e_dropvnref; 156fd7a8150SMike Barcroft } 157fd7a8150SMike Barcroft goto next; 158fd7a8150SMike Barcroft } 159fd7a8150SMike Barcroft } 160fd7a8150SMike Barcroft pr->pr_id = jaa.jid = lastprid = tryprid; 161fd7a8150SMike Barcroft LIST_INSERT_HEAD(&allprison, pr, pr_list); 162fd7a8150SMike Barcroft prisoncount++; 163fd7a8150SMike Barcroft mtx_unlock(&allprison_mtx); 164fd7a8150SMike Barcroft 165fd7a8150SMike Barcroft error = jail_attach(td, &jaa); 166a2f2b3afSJohn Baldwin if (error) 167fd7a8150SMike Barcroft goto e_dropprref; 168fd7a8150SMike Barcroft mtx_lock(&pr->pr_mtx); 169fd7a8150SMike Barcroft pr->pr_ref--; 170fd7a8150SMike Barcroft mtx_unlock(&pr->pr_mtx); 171fd7a8150SMike Barcroft td->td_retval[0] = jaa.jid; 17275c13541SPoul-Henning Kamp return (0); 173fd7a8150SMike Barcroft e_dropprref: 174fd7a8150SMike Barcroft mtx_lock(&allprison_mtx); 175fd7a8150SMike Barcroft LIST_REMOVE(pr, pr_list); 176fd7a8150SMike Barcroft prisoncount--; 177fd7a8150SMike Barcroft mtx_unlock(&allprison_mtx); 178fd7a8150SMike Barcroft e_dropvnref: 179453f7d53SChristian S.J. Peron vfslocked = VFS_LOCK_GIANT(pr->pr_root->v_mount); 180fd7a8150SMike Barcroft vrele(pr->pr_root); 181453f7d53SChristian S.J. Peron VFS_UNLOCK_GIANT(vfslocked); 182fd7a8150SMike Barcroft e_killmtx: 183894db7b0SMaxime Henrion mtx_destroy(&pr->pr_mtx); 18475c13541SPoul-Henning Kamp FREE(pr, M_PRISON); 18575c13541SPoul-Henning Kamp return (error); 18675c13541SPoul-Henning Kamp } 18775c13541SPoul-Henning Kamp 188fd7a8150SMike Barcroft /* 1899ddb7954SMike Barcroft * struct jail_attach_args { 1909ddb7954SMike Barcroft * int jid; 1919ddb7954SMike Barcroft * }; 192fd7a8150SMike Barcroft */ 193fd7a8150SMike Barcroft int 1949ddb7954SMike Barcroft jail_attach(struct thread *td, struct jail_attach_args *uap) 195fd7a8150SMike Barcroft { 196fd7a8150SMike Barcroft struct proc *p; 197fd7a8150SMike Barcroft struct ucred *newcred, *oldcred; 198fd7a8150SMike Barcroft struct prison *pr; 199453f7d53SChristian S.J. Peron int vfslocked, error; 200fd7a8150SMike Barcroft 20157f22bd4SJacques Vidrine /* 20257f22bd4SJacques Vidrine * XXX: Note that there is a slight race here if two threads 20357f22bd4SJacques Vidrine * in the same privileged process attempt to attach to two 20457f22bd4SJacques Vidrine * different jails at the same time. It is important for 20557f22bd4SJacques Vidrine * user processes not to do this, or they might end up with 20657f22bd4SJacques Vidrine * a process root from one prison, but attached to the jail 20757f22bd4SJacques Vidrine * of another. 20857f22bd4SJacques Vidrine */ 209800c9408SRobert Watson error = priv_check(td, PRIV_JAIL_ATTACH); 21057f22bd4SJacques Vidrine if (error) 21157f22bd4SJacques Vidrine return (error); 212fd7a8150SMike Barcroft 21357f22bd4SJacques Vidrine p = td->td_proc; 214fd7a8150SMike Barcroft mtx_lock(&allprison_mtx); 215fd7a8150SMike Barcroft pr = prison_find(uap->jid); 216fd7a8150SMike Barcroft if (pr == NULL) { 217fd7a8150SMike Barcroft mtx_unlock(&allprison_mtx); 218fd7a8150SMike Barcroft return (EINVAL); 219fd7a8150SMike Barcroft } 220fd7a8150SMike Barcroft pr->pr_ref++; 221fd7a8150SMike Barcroft mtx_unlock(&pr->pr_mtx); 222fd7a8150SMike Barcroft mtx_unlock(&allprison_mtx); 223fd7a8150SMike Barcroft 224453f7d53SChristian S.J. Peron vfslocked = VFS_LOCK_GIANT(pr->pr_root->v_mount); 225fd7a8150SMike Barcroft vn_lock(pr->pr_root, LK_EXCLUSIVE | LK_RETRY, td); 226fd7a8150SMike Barcroft if ((error = change_dir(pr->pr_root, td)) != 0) 227fd7a8150SMike Barcroft goto e_unlock; 228fd7a8150SMike Barcroft #ifdef MAC 229fd7a8150SMike Barcroft if ((error = mac_check_vnode_chroot(td->td_ucred, pr->pr_root))) 230fd7a8150SMike Barcroft goto e_unlock; 231fd7a8150SMike Barcroft #endif 232fd7a8150SMike Barcroft VOP_UNLOCK(pr->pr_root, 0, td); 233fd7a8150SMike Barcroft change_root(pr->pr_root, td); 234453f7d53SChristian S.J. Peron VFS_UNLOCK_GIANT(vfslocked); 235fd7a8150SMike Barcroft 236fd7a8150SMike Barcroft newcred = crget(); 237fd7a8150SMike Barcroft PROC_LOCK(p); 238fd7a8150SMike Barcroft oldcred = p->p_ucred; 239fd7a8150SMike Barcroft setsugid(p); 240fd7a8150SMike Barcroft crcopy(newcred, oldcred); 24169c4ee54SJohn Baldwin newcred->cr_prison = pr; 242fd7a8150SMike Barcroft p->p_ucred = newcred; 243fd7a8150SMike Barcroft PROC_UNLOCK(p); 244fd7a8150SMike Barcroft crfree(oldcred); 245fd7a8150SMike Barcroft return (0); 246fd7a8150SMike Barcroft e_unlock: 247fd7a8150SMike Barcroft VOP_UNLOCK(pr->pr_root, 0, td); 248453f7d53SChristian S.J. Peron VFS_UNLOCK_GIANT(vfslocked); 249fd7a8150SMike Barcroft mtx_lock(&pr->pr_mtx); 250fd7a8150SMike Barcroft pr->pr_ref--; 251fd7a8150SMike Barcroft mtx_unlock(&pr->pr_mtx); 252fd7a8150SMike Barcroft return (error); 253fd7a8150SMike Barcroft } 254fd7a8150SMike Barcroft 255fd7a8150SMike Barcroft /* 256fd7a8150SMike Barcroft * Returns a locked prison instance, or NULL on failure. 257fd7a8150SMike Barcroft */ 25854b369c1SPawel Jakub Dawidek struct prison * 259fd7a8150SMike Barcroft prison_find(int prid) 260fd7a8150SMike Barcroft { 261fd7a8150SMike Barcroft struct prison *pr; 262fd7a8150SMike Barcroft 263fd7a8150SMike Barcroft mtx_assert(&allprison_mtx, MA_OWNED); 264fd7a8150SMike Barcroft LIST_FOREACH(pr, &allprison, pr_list) { 265fd7a8150SMike Barcroft if (pr->pr_id == prid) { 266fd7a8150SMike Barcroft mtx_lock(&pr->pr_mtx); 267fd7a8150SMike Barcroft return (pr); 268fd7a8150SMike Barcroft } 269fd7a8150SMike Barcroft } 270fd7a8150SMike Barcroft return (NULL); 271fd7a8150SMike Barcroft } 272fd7a8150SMike Barcroft 27391421ba2SRobert Watson void 27491421ba2SRobert Watson prison_free(struct prison *pr) 27591421ba2SRobert Watson { 27691421ba2SRobert Watson 277fd7a8150SMike Barcroft mtx_lock(&allprison_mtx); 27801137630SRobert Watson mtx_lock(&pr->pr_mtx); 27991421ba2SRobert Watson pr->pr_ref--; 28091421ba2SRobert Watson if (pr->pr_ref == 0) { 281fd7a8150SMike Barcroft LIST_REMOVE(pr, pr_list); 28201137630SRobert Watson mtx_unlock(&pr->pr_mtx); 283fd7a8150SMike Barcroft prisoncount--; 284fd7a8150SMike Barcroft mtx_unlock(&allprison_mtx); 285b3059e09SRobert Watson 286b3059e09SRobert Watson TASK_INIT(&pr->pr_task, 0, prison_complete, pr); 28722fdc83fSJeff Roberson taskqueue_enqueue(taskqueue_thread, &pr->pr_task); 28801137630SRobert Watson return; 28991421ba2SRobert Watson } 29001137630SRobert Watson mtx_unlock(&pr->pr_mtx); 291fd7a8150SMike Barcroft mtx_unlock(&allprison_mtx); 29291421ba2SRobert Watson } 29391421ba2SRobert Watson 294b3059e09SRobert Watson static void 295b3059e09SRobert Watson prison_complete(void *context, int pending) 296b3059e09SRobert Watson { 297b3059e09SRobert Watson struct prison *pr; 298453f7d53SChristian S.J. Peron int vfslocked; 299b3059e09SRobert Watson 300b3059e09SRobert Watson pr = (struct prison *)context; 301b3059e09SRobert Watson 302453f7d53SChristian S.J. Peron vfslocked = VFS_LOCK_GIANT(pr->pr_root->v_mount); 303b3059e09SRobert Watson vrele(pr->pr_root); 304453f7d53SChristian S.J. Peron VFS_UNLOCK_GIANT(vfslocked); 305b3059e09SRobert Watson 306b3059e09SRobert Watson mtx_destroy(&pr->pr_mtx); 307b3059e09SRobert Watson if (pr->pr_linux != NULL) 308b3059e09SRobert Watson FREE(pr->pr_linux, M_PRISON); 309b3059e09SRobert Watson FREE(pr, M_PRISON); 310b3059e09SRobert Watson } 311b3059e09SRobert Watson 31291421ba2SRobert Watson void 31391421ba2SRobert Watson prison_hold(struct prison *pr) 31491421ba2SRobert Watson { 31591421ba2SRobert Watson 31601137630SRobert Watson mtx_lock(&pr->pr_mtx); 31791421ba2SRobert Watson pr->pr_ref++; 31801137630SRobert Watson mtx_unlock(&pr->pr_mtx); 31901137630SRobert Watson } 32001137630SRobert Watson 32101137630SRobert Watson u_int32_t 32201137630SRobert Watson prison_getip(struct ucred *cred) 32301137630SRobert Watson { 32401137630SRobert Watson 32501137630SRobert Watson return (cred->cr_prison->pr_ip); 32691421ba2SRobert Watson } 32791421ba2SRobert Watson 32875c13541SPoul-Henning Kamp int 32991421ba2SRobert Watson prison_ip(struct ucred *cred, int flag, u_int32_t *ip) 33075c13541SPoul-Henning Kamp { 33175c13541SPoul-Henning Kamp u_int32_t tmp; 33275c13541SPoul-Henning Kamp 33391421ba2SRobert Watson if (!jailed(cred)) 33475c13541SPoul-Henning Kamp return (0); 33575c13541SPoul-Henning Kamp if (flag) 33675c13541SPoul-Henning Kamp tmp = *ip; 33775c13541SPoul-Henning Kamp else 33875c13541SPoul-Henning Kamp tmp = ntohl(*ip); 33975c13541SPoul-Henning Kamp if (tmp == INADDR_ANY) { 34075c13541SPoul-Henning Kamp if (flag) 34191421ba2SRobert Watson *ip = cred->cr_prison->pr_ip; 34275c13541SPoul-Henning Kamp else 34391421ba2SRobert Watson *ip = htonl(cred->cr_prison->pr_ip); 34475c13541SPoul-Henning Kamp return (0); 34575c13541SPoul-Henning Kamp } 346fd6aaf7fSRobert Watson if (tmp == INADDR_LOOPBACK) { 347fd6aaf7fSRobert Watson if (flag) 348fd6aaf7fSRobert Watson *ip = cred->cr_prison->pr_ip; 349fd6aaf7fSRobert Watson else 350fd6aaf7fSRobert Watson *ip = htonl(cred->cr_prison->pr_ip); 351fd6aaf7fSRobert Watson return (0); 352fd6aaf7fSRobert Watson } 35391421ba2SRobert Watson if (cred->cr_prison->pr_ip != tmp) 35475c13541SPoul-Henning Kamp return (1); 35575c13541SPoul-Henning Kamp return (0); 35675c13541SPoul-Henning Kamp } 35775c13541SPoul-Henning Kamp 35875c13541SPoul-Henning Kamp void 35991421ba2SRobert Watson prison_remote_ip(struct ucred *cred, int flag, u_int32_t *ip) 36075c13541SPoul-Henning Kamp { 36175c13541SPoul-Henning Kamp u_int32_t tmp; 36275c13541SPoul-Henning Kamp 36391421ba2SRobert Watson if (!jailed(cred)) 36475c13541SPoul-Henning Kamp return; 36575c13541SPoul-Henning Kamp if (flag) 36675c13541SPoul-Henning Kamp tmp = *ip; 36775c13541SPoul-Henning Kamp else 36875c13541SPoul-Henning Kamp tmp = ntohl(*ip); 369fd6aaf7fSRobert Watson if (tmp == INADDR_LOOPBACK) { 37075c13541SPoul-Henning Kamp if (flag) 37191421ba2SRobert Watson *ip = cred->cr_prison->pr_ip; 37275c13541SPoul-Henning Kamp else 37391421ba2SRobert Watson *ip = htonl(cred->cr_prison->pr_ip); 37475c13541SPoul-Henning Kamp return; 37575c13541SPoul-Henning Kamp } 37675c13541SPoul-Henning Kamp return; 37775c13541SPoul-Henning Kamp } 37875c13541SPoul-Henning Kamp 37975c13541SPoul-Henning Kamp int 38091421ba2SRobert Watson prison_if(struct ucred *cred, struct sockaddr *sa) 38175c13541SPoul-Henning Kamp { 3829ddb7954SMike Barcroft struct sockaddr_in *sai; 38375c13541SPoul-Henning Kamp int ok; 38475c13541SPoul-Henning Kamp 3859ddb7954SMike Barcroft sai = (struct sockaddr_in *)sa; 3867cadc266SRobert Watson if ((sai->sin_family != AF_INET) && jail_socket_unixiproute_only) 3877cadc266SRobert Watson ok = 1; 3887cadc266SRobert Watson else if (sai->sin_family != AF_INET) 38975c13541SPoul-Henning Kamp ok = 0; 39091421ba2SRobert Watson else if (cred->cr_prison->pr_ip != ntohl(sai->sin_addr.s_addr)) 39175c13541SPoul-Henning Kamp ok = 1; 39275c13541SPoul-Henning Kamp else 39375c13541SPoul-Henning Kamp ok = 0; 39475c13541SPoul-Henning Kamp return (ok); 39575c13541SPoul-Henning Kamp } 39691421ba2SRobert Watson 39791421ba2SRobert Watson /* 39891421ba2SRobert Watson * Return 0 if jails permit p1 to frob p2, otherwise ESRCH. 39991421ba2SRobert Watson */ 40091421ba2SRobert Watson int 4019ddb7954SMike Barcroft prison_check(struct ucred *cred1, struct ucred *cred2) 40291421ba2SRobert Watson { 40391421ba2SRobert Watson 40491421ba2SRobert Watson if (jailed(cred1)) { 40591421ba2SRobert Watson if (!jailed(cred2)) 40691421ba2SRobert Watson return (ESRCH); 40791421ba2SRobert Watson if (cred2->cr_prison != cred1->cr_prison) 40891421ba2SRobert Watson return (ESRCH); 40991421ba2SRobert Watson } 41091421ba2SRobert Watson 41191421ba2SRobert Watson return (0); 41291421ba2SRobert Watson } 41391421ba2SRobert Watson 41491421ba2SRobert Watson /* 41591421ba2SRobert Watson * Return 1 if the passed credential is in a jail, otherwise 0. 41691421ba2SRobert Watson */ 41791421ba2SRobert Watson int 4189ddb7954SMike Barcroft jailed(struct ucred *cred) 41991421ba2SRobert Watson { 42091421ba2SRobert Watson 42191421ba2SRobert Watson return (cred->cr_prison != NULL); 42291421ba2SRobert Watson } 4239484d0c0SRobert Drehmel 4249484d0c0SRobert Drehmel /* 4259484d0c0SRobert Drehmel * Return the correct hostname for the passed credential. 4269484d0c0SRobert Drehmel */ 427ad1ff099SRobert Drehmel void 4289ddb7954SMike Barcroft getcredhostname(struct ucred *cred, char *buf, size_t size) 4299484d0c0SRobert Drehmel { 4309484d0c0SRobert Drehmel 431ad1ff099SRobert Drehmel if (jailed(cred)) { 432ad1ff099SRobert Drehmel mtx_lock(&cred->cr_prison->pr_mtx); 433e80fb434SRobert Drehmel strlcpy(buf, cred->cr_prison->pr_host, size); 434ad1ff099SRobert Drehmel mtx_unlock(&cred->cr_prison->pr_mtx); 4359ddb7954SMike Barcroft } else 436e80fb434SRobert Drehmel strlcpy(buf, hostname, size); 4379484d0c0SRobert Drehmel } 438fd7a8150SMike Barcroft 439f08df373SRobert Watson /* 440820a0de9SPawel Jakub Dawidek * Determine whether the subject represented by cred can "see" 441820a0de9SPawel Jakub Dawidek * status of a mount point. 442820a0de9SPawel Jakub Dawidek * Returns: 0 for permitted, ENOENT otherwise. 443820a0de9SPawel Jakub Dawidek * XXX: This function should be called cr_canseemount() and should be 444820a0de9SPawel Jakub Dawidek * placed in kern_prot.c. 445f08df373SRobert Watson */ 446f08df373SRobert Watson int 447820a0de9SPawel Jakub Dawidek prison_canseemount(struct ucred *cred, struct mount *mp) 448f08df373SRobert Watson { 449820a0de9SPawel Jakub Dawidek struct prison *pr; 450820a0de9SPawel Jakub Dawidek struct statfs *sp; 451820a0de9SPawel Jakub Dawidek size_t len; 452f08df373SRobert Watson 453820a0de9SPawel Jakub Dawidek if (!jailed(cred) || jail_enforce_statfs == 0) 454820a0de9SPawel Jakub Dawidek return (0); 455820a0de9SPawel Jakub Dawidek pr = cred->cr_prison; 456820a0de9SPawel Jakub Dawidek if (pr->pr_root->v_mount == mp) 457820a0de9SPawel Jakub Dawidek return (0); 458820a0de9SPawel Jakub Dawidek if (jail_enforce_statfs == 2) 459820a0de9SPawel Jakub Dawidek return (ENOENT); 460820a0de9SPawel Jakub Dawidek /* 461820a0de9SPawel Jakub Dawidek * If jail's chroot directory is set to "/" we should be able to see 462820a0de9SPawel Jakub Dawidek * all mount-points from inside a jail. 463820a0de9SPawel Jakub Dawidek * This is ugly check, but this is the only situation when jail's 464820a0de9SPawel Jakub Dawidek * directory ends with '/'. 465820a0de9SPawel Jakub Dawidek */ 466820a0de9SPawel Jakub Dawidek if (strcmp(pr->pr_path, "/") == 0) 467820a0de9SPawel Jakub Dawidek return (0); 468820a0de9SPawel Jakub Dawidek len = strlen(pr->pr_path); 469820a0de9SPawel Jakub Dawidek sp = &mp->mnt_stat; 470820a0de9SPawel Jakub Dawidek if (strncmp(pr->pr_path, sp->f_mntonname, len) != 0) 471820a0de9SPawel Jakub Dawidek return (ENOENT); 472820a0de9SPawel Jakub Dawidek /* 473820a0de9SPawel Jakub Dawidek * Be sure that we don't have situation where jail's root directory 474820a0de9SPawel Jakub Dawidek * is "/some/path" and mount point is "/some/pathpath". 475820a0de9SPawel Jakub Dawidek */ 476820a0de9SPawel Jakub Dawidek if (sp->f_mntonname[len] != '\0' && sp->f_mntonname[len] != '/') 477820a0de9SPawel Jakub Dawidek return (ENOENT); 478f08df373SRobert Watson return (0); 479f08df373SRobert Watson } 480820a0de9SPawel Jakub Dawidek 481820a0de9SPawel Jakub Dawidek void 482820a0de9SPawel Jakub Dawidek prison_enforce_statfs(struct ucred *cred, struct mount *mp, struct statfs *sp) 483820a0de9SPawel Jakub Dawidek { 484820a0de9SPawel Jakub Dawidek char jpath[MAXPATHLEN]; 485820a0de9SPawel Jakub Dawidek struct prison *pr; 486820a0de9SPawel Jakub Dawidek size_t len; 487820a0de9SPawel Jakub Dawidek 488820a0de9SPawel Jakub Dawidek if (!jailed(cred) || jail_enforce_statfs == 0) 489820a0de9SPawel Jakub Dawidek return; 490820a0de9SPawel Jakub Dawidek pr = cred->cr_prison; 491820a0de9SPawel Jakub Dawidek if (prison_canseemount(cred, mp) != 0) { 492820a0de9SPawel Jakub Dawidek bzero(sp->f_mntonname, sizeof(sp->f_mntonname)); 493820a0de9SPawel Jakub Dawidek strlcpy(sp->f_mntonname, "[restricted]", 494820a0de9SPawel Jakub Dawidek sizeof(sp->f_mntonname)); 495820a0de9SPawel Jakub Dawidek return; 496820a0de9SPawel Jakub Dawidek } 497820a0de9SPawel Jakub Dawidek if (pr->pr_root->v_mount == mp) { 498820a0de9SPawel Jakub Dawidek /* 499820a0de9SPawel Jakub Dawidek * Clear current buffer data, so we are sure nothing from 500820a0de9SPawel Jakub Dawidek * the valid path left there. 501820a0de9SPawel Jakub Dawidek */ 502820a0de9SPawel Jakub Dawidek bzero(sp->f_mntonname, sizeof(sp->f_mntonname)); 503820a0de9SPawel Jakub Dawidek *sp->f_mntonname = '/'; 504820a0de9SPawel Jakub Dawidek return; 505820a0de9SPawel Jakub Dawidek } 506820a0de9SPawel Jakub Dawidek /* 507820a0de9SPawel Jakub Dawidek * If jail's chroot directory is set to "/" we should be able to see 508820a0de9SPawel Jakub Dawidek * all mount-points from inside a jail. 509820a0de9SPawel Jakub Dawidek */ 510820a0de9SPawel Jakub Dawidek if (strcmp(pr->pr_path, "/") == 0) 511820a0de9SPawel Jakub Dawidek return; 512820a0de9SPawel Jakub Dawidek len = strlen(pr->pr_path); 513820a0de9SPawel Jakub Dawidek strlcpy(jpath, sp->f_mntonname + len, sizeof(jpath)); 514820a0de9SPawel Jakub Dawidek /* 515820a0de9SPawel Jakub Dawidek * Clear current buffer data, so we are sure nothing from 516820a0de9SPawel Jakub Dawidek * the valid path left there. 517820a0de9SPawel Jakub Dawidek */ 518820a0de9SPawel Jakub Dawidek bzero(sp->f_mntonname, sizeof(sp->f_mntonname)); 519820a0de9SPawel Jakub Dawidek if (*jpath == '\0') { 520820a0de9SPawel Jakub Dawidek /* Should never happen. */ 521820a0de9SPawel Jakub Dawidek *sp->f_mntonname = '/'; 522820a0de9SPawel Jakub Dawidek } else { 523820a0de9SPawel Jakub Dawidek strlcpy(sp->f_mntonname, jpath, sizeof(sp->f_mntonname)); 524820a0de9SPawel Jakub Dawidek } 525f08df373SRobert Watson } 526f08df373SRobert Watson 527800c9408SRobert Watson /* 528800c9408SRobert Watson * Check with permission for a specific privilege is granted within jail. We 529800c9408SRobert Watson * have a specific list of accepted privileges; the rest are denied. 530800c9408SRobert Watson */ 531800c9408SRobert Watson int 532800c9408SRobert Watson prison_priv_check(struct ucred *cred, int priv) 533800c9408SRobert Watson { 534800c9408SRobert Watson 535800c9408SRobert Watson if (!jailed(cred)) 536800c9408SRobert Watson return (0); 537800c9408SRobert Watson 538800c9408SRobert Watson switch (priv) { 539800c9408SRobert Watson 540800c9408SRobert Watson /* 541800c9408SRobert Watson * Allow ktrace privileges for root in jail. 542800c9408SRobert Watson */ 543800c9408SRobert Watson case PRIV_KTRACE: 544800c9408SRobert Watson 545c3c1b5e6SRobert Watson #if 0 546800c9408SRobert Watson /* 547800c9408SRobert Watson * Allow jailed processes to configure audit identity and 548800c9408SRobert Watson * submit audit records (login, etc). In the future we may 549800c9408SRobert Watson * want to further refine the relationship between audit and 550800c9408SRobert Watson * jail. 551800c9408SRobert Watson */ 552800c9408SRobert Watson case PRIV_AUDIT_GETAUDIT: 553800c9408SRobert Watson case PRIV_AUDIT_SETAUDIT: 554800c9408SRobert Watson case PRIV_AUDIT_SUBMIT: 555c3c1b5e6SRobert Watson #endif 556800c9408SRobert Watson 557800c9408SRobert Watson /* 558800c9408SRobert Watson * Allow jailed processes to manipulate process UNIX 559800c9408SRobert Watson * credentials in any way they see fit. 560800c9408SRobert Watson */ 561800c9408SRobert Watson case PRIV_CRED_SETUID: 562800c9408SRobert Watson case PRIV_CRED_SETEUID: 563800c9408SRobert Watson case PRIV_CRED_SETGID: 564800c9408SRobert Watson case PRIV_CRED_SETEGID: 565800c9408SRobert Watson case PRIV_CRED_SETGROUPS: 566800c9408SRobert Watson case PRIV_CRED_SETREUID: 567800c9408SRobert Watson case PRIV_CRED_SETREGID: 568800c9408SRobert Watson case PRIV_CRED_SETRESUID: 569800c9408SRobert Watson case PRIV_CRED_SETRESGID: 570800c9408SRobert Watson 571800c9408SRobert Watson /* 572800c9408SRobert Watson * Jail implements visibility constraints already, so allow 573800c9408SRobert Watson * jailed root to override uid/gid-based constraints. 574800c9408SRobert Watson */ 575800c9408SRobert Watson case PRIV_SEEOTHERGIDS: 576800c9408SRobert Watson case PRIV_SEEOTHERUIDS: 577800c9408SRobert Watson 578800c9408SRobert Watson /* 579800c9408SRobert Watson * Jail implements inter-process debugging limits already, so 580800c9408SRobert Watson * allow jailed root various debugging privileges. 581800c9408SRobert Watson */ 582800c9408SRobert Watson case PRIV_DEBUG_DIFFCRED: 583800c9408SRobert Watson case PRIV_DEBUG_SUGID: 584800c9408SRobert Watson case PRIV_DEBUG_UNPRIV: 585800c9408SRobert Watson 586800c9408SRobert Watson /* 587800c9408SRobert Watson * Allow jail to set various resource limits and login 588800c9408SRobert Watson * properties, and for now, exceed process resource limits. 589800c9408SRobert Watson */ 590800c9408SRobert Watson case PRIV_PROC_LIMIT: 591800c9408SRobert Watson case PRIV_PROC_SETLOGIN: 592800c9408SRobert Watson case PRIV_PROC_SETRLIMIT: 593800c9408SRobert Watson 594800c9408SRobert Watson /* 595800c9408SRobert Watson * System V and POSIX IPC privileges are granted in jail. 596800c9408SRobert Watson */ 597800c9408SRobert Watson case PRIV_IPC_READ: 598800c9408SRobert Watson case PRIV_IPC_WRITE: 599800c9408SRobert Watson case PRIV_IPC_ADMIN: 600800c9408SRobert Watson case PRIV_IPC_MSGSIZE: 601800c9408SRobert Watson case PRIV_MQ_ADMIN: 602800c9408SRobert Watson 603800c9408SRobert Watson /* 604800c9408SRobert Watson * Jail implements its own inter-process limits, so allow 605800c9408SRobert Watson * root processes in jail to change scheduling on other 606800c9408SRobert Watson * processes in the same jail. Likewise for signalling. 607800c9408SRobert Watson */ 608800c9408SRobert Watson case PRIV_SCHED_DIFFCRED: 609800c9408SRobert Watson case PRIV_SIGNAL_DIFFCRED: 610800c9408SRobert Watson case PRIV_SIGNAL_SUGID: 611800c9408SRobert Watson 612800c9408SRobert Watson /* 613800c9408SRobert Watson * Allow jailed processes to write to sysctls marked as jail 614800c9408SRobert Watson * writable. 615800c9408SRobert Watson */ 616800c9408SRobert Watson case PRIV_SYSCTL_WRITEJAIL: 617800c9408SRobert Watson 618800c9408SRobert Watson /* 619800c9408SRobert Watson * Allow root in jail to manage a variety of quota 620e82d0201SRobert Watson * properties. These should likely be conditional on a 621e82d0201SRobert Watson * configuration option. 622800c9408SRobert Watson */ 62395b091d2SRobert Watson case PRIV_VFS_GETQUOTA: 62495b091d2SRobert Watson case PRIV_VFS_SETQUOTA: 625800c9408SRobert Watson 626800c9408SRobert Watson /* 627800c9408SRobert Watson * Since Jail relies on chroot() to implement file system 628800c9408SRobert Watson * protections, grant many VFS privileges to root in jail. 629800c9408SRobert Watson * Be careful to exclude mount-related and NFS-related 630800c9408SRobert Watson * privileges. 631800c9408SRobert Watson */ 632800c9408SRobert Watson case PRIV_VFS_READ: 633800c9408SRobert Watson case PRIV_VFS_WRITE: 634800c9408SRobert Watson case PRIV_VFS_ADMIN: 635800c9408SRobert Watson case PRIV_VFS_EXEC: 636800c9408SRobert Watson case PRIV_VFS_LOOKUP: 637800c9408SRobert Watson case PRIV_VFS_BLOCKRESERVE: /* XXXRW: Slightly surprising. */ 638800c9408SRobert Watson case PRIV_VFS_CHFLAGS_DEV: 639800c9408SRobert Watson case PRIV_VFS_CHOWN: 640800c9408SRobert Watson case PRIV_VFS_CHROOT: 641bb531912SPawel Jakub Dawidek case PRIV_VFS_RETAINSUGID: 642800c9408SRobert Watson case PRIV_VFS_FCHROOT: 643800c9408SRobert Watson case PRIV_VFS_LINK: 644800c9408SRobert Watson case PRIV_VFS_SETGID: 645800c9408SRobert Watson case PRIV_VFS_STICKYFILE: 646800c9408SRobert Watson return (0); 647800c9408SRobert Watson 648800c9408SRobert Watson /* 649800c9408SRobert Watson * Depending on the global setting, allow privilege of 650800c9408SRobert Watson * setting system flags. 651800c9408SRobert Watson */ 652800c9408SRobert Watson case PRIV_VFS_SYSFLAGS: 653800c9408SRobert Watson if (jail_chflags_allowed) 654800c9408SRobert Watson return (0); 655800c9408SRobert Watson else 656800c9408SRobert Watson return (EPERM); 657800c9408SRobert Watson 658800c9408SRobert Watson /* 659f3a8d2f9SPawel Jakub Dawidek * Depending on the global setting, allow privilege of 660f3a8d2f9SPawel Jakub Dawidek * mounting/unmounting file systems. 661f3a8d2f9SPawel Jakub Dawidek */ 662f3a8d2f9SPawel Jakub Dawidek case PRIV_VFS_MOUNT: 663f3a8d2f9SPawel Jakub Dawidek case PRIV_VFS_UNMOUNT: 664f3a8d2f9SPawel Jakub Dawidek case PRIV_VFS_MOUNT_NONUSER: 665f3a8d2f9SPawel Jakub Dawidek if (jail_mount_allowed) 666f3a8d2f9SPawel Jakub Dawidek return (0); 667f3a8d2f9SPawel Jakub Dawidek else 668f3a8d2f9SPawel Jakub Dawidek return (EPERM); 669f3a8d2f9SPawel Jakub Dawidek 670f3a8d2f9SPawel Jakub Dawidek /* 671800c9408SRobert Watson * Allow jailed root to bind reserved ports. 672800c9408SRobert Watson */ 673800c9408SRobert Watson case PRIV_NETINET_RESERVEDPORT: 674800c9408SRobert Watson return (0); 675800c9408SRobert Watson 676800c9408SRobert Watson /* 677800c9408SRobert Watson * Conditionally allow creating raw sockets in jail. 678800c9408SRobert Watson */ 679800c9408SRobert Watson case PRIV_NETINET_RAW: 680800c9408SRobert Watson if (jail_allow_raw_sockets) 681800c9408SRobert Watson return (0); 682800c9408SRobert Watson else 683800c9408SRobert Watson return (EPERM); 684800c9408SRobert Watson 685800c9408SRobert Watson /* 686800c9408SRobert Watson * Since jail implements its own visibility limits on netstat 687800c9408SRobert Watson * sysctls, allow getcred. This allows identd to work in 688800c9408SRobert Watson * jail. 689800c9408SRobert Watson */ 690800c9408SRobert Watson case PRIV_NETINET_GETCRED: 691800c9408SRobert Watson return (0); 692800c9408SRobert Watson 693800c9408SRobert Watson default: 694800c9408SRobert Watson /* 695800c9408SRobert Watson * In all remaining cases, deny the privilege request. This 696800c9408SRobert Watson * includes almost all network privileges, many system 697800c9408SRobert Watson * configuration privileges. 698800c9408SRobert Watson */ 699800c9408SRobert Watson return (EPERM); 700800c9408SRobert Watson } 701800c9408SRobert Watson } 702800c9408SRobert Watson 703fd7a8150SMike Barcroft static int 704fd7a8150SMike Barcroft sysctl_jail_list(SYSCTL_HANDLER_ARGS) 705fd7a8150SMike Barcroft { 706fd7a8150SMike Barcroft struct xprison *xp, *sxp; 707fd7a8150SMike Barcroft struct prison *pr; 708fd7a8150SMike Barcroft int count, error; 709fd7a8150SMike Barcroft 7107f4704c0SPawel Jakub Dawidek if (jailed(req->td->td_ucred)) 711679a1060SRobert Watson return (0); 712fd7a8150SMike Barcroft retry: 713fd7a8150SMike Barcroft mtx_lock(&allprison_mtx); 714fd7a8150SMike Barcroft count = prisoncount; 715fd7a8150SMike Barcroft mtx_unlock(&allprison_mtx); 716fd7a8150SMike Barcroft 717fd7a8150SMike Barcroft if (count == 0) 718fd7a8150SMike Barcroft return (0); 719fd7a8150SMike Barcroft 720fd7a8150SMike Barcroft sxp = xp = malloc(sizeof(*xp) * count, M_TEMP, M_WAITOK | M_ZERO); 721fd7a8150SMike Barcroft mtx_lock(&allprison_mtx); 722fd7a8150SMike Barcroft if (count != prisoncount) { 723fd7a8150SMike Barcroft mtx_unlock(&allprison_mtx); 724fd7a8150SMike Barcroft free(sxp, M_TEMP); 725fd7a8150SMike Barcroft goto retry; 726fd7a8150SMike Barcroft } 727fd7a8150SMike Barcroft 728fd7a8150SMike Barcroft LIST_FOREACH(pr, &allprison, pr_list) { 729fd7a8150SMike Barcroft mtx_lock(&pr->pr_mtx); 730fd7a8150SMike Barcroft xp->pr_version = XPRISON_VERSION; 731fd7a8150SMike Barcroft xp->pr_id = pr->pr_id; 732fd7a8150SMike Barcroft strlcpy(xp->pr_path, pr->pr_path, sizeof(xp->pr_path)); 733fd7a8150SMike Barcroft strlcpy(xp->pr_host, pr->pr_host, sizeof(xp->pr_host)); 734fd7a8150SMike Barcroft xp->pr_ip = pr->pr_ip; 735fd7a8150SMike Barcroft mtx_unlock(&pr->pr_mtx); 736fd7a8150SMike Barcroft xp++; 737fd7a8150SMike Barcroft } 738fd7a8150SMike Barcroft mtx_unlock(&allprison_mtx); 739fd7a8150SMike Barcroft 740fd7a8150SMike Barcroft error = SYSCTL_OUT(req, sxp, sizeof(*sxp) * count); 741fd7a8150SMike Barcroft free(sxp, M_TEMP); 742fd7a8150SMike Barcroft return (error); 743fd7a8150SMike Barcroft } 744fd7a8150SMike Barcroft 745fd7a8150SMike Barcroft SYSCTL_OID(_security_jail, OID_AUTO, list, CTLTYPE_STRUCT | CTLFLAG_RD, 746fd7a8150SMike Barcroft NULL, 0, sysctl_jail_list, "S", "List of active jails"); 747461167c2SPawel Jakub Dawidek 748461167c2SPawel Jakub Dawidek static int 749461167c2SPawel Jakub Dawidek sysctl_jail_jailed(SYSCTL_HANDLER_ARGS) 750461167c2SPawel Jakub Dawidek { 751461167c2SPawel Jakub Dawidek int error, injail; 752461167c2SPawel Jakub Dawidek 753461167c2SPawel Jakub Dawidek injail = jailed(req->td->td_ucred); 754461167c2SPawel Jakub Dawidek error = SYSCTL_OUT(req, &injail, sizeof(injail)); 755461167c2SPawel Jakub Dawidek 756461167c2SPawel Jakub Dawidek return (error); 757461167c2SPawel Jakub Dawidek } 758461167c2SPawel Jakub Dawidek SYSCTL_PROC(_security_jail, OID_AUTO, jailed, CTLTYPE_INT | CTLFLAG_RD, 759461167c2SPawel Jakub Dawidek NULL, 0, sysctl_jail_jailed, "I", "Process in jail?"); 760