19454b2d8SWarner Losh /*- 28a36da99SPedro F. Giffuni * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 38a36da99SPedro F. Giffuni * 4413628a7SBjoern A. Zeeb * Copyright (c) 1999 Poul-Henning Kamp. 5413628a7SBjoern A. Zeeb * Copyright (c) 2008 Bjoern A. Zeeb. 6b38ff370SJamie Gritton * Copyright (c) 2009 James Gritton. 7413628a7SBjoern A. Zeeb * All rights reserved. 8b9f0b66cSBjoern A. Zeeb * 9b9f0b66cSBjoern A. Zeeb * Redistribution and use in source and binary forms, with or without 10b9f0b66cSBjoern A. Zeeb * modification, are permitted provided that the following conditions 11b9f0b66cSBjoern A. Zeeb * are met: 12b9f0b66cSBjoern A. Zeeb * 1. Redistributions of source code must retain the above copyright 13b9f0b66cSBjoern A. Zeeb * notice, this list of conditions and the following disclaimer. 14b9f0b66cSBjoern A. Zeeb * 2. Redistributions in binary form must reproduce the above copyright 15b9f0b66cSBjoern A. Zeeb * notice, this list of conditions and the following disclaimer in the 16b9f0b66cSBjoern A. Zeeb * documentation and/or other materials provided with the distribution. 17b9f0b66cSBjoern A. Zeeb * 18b9f0b66cSBjoern A. Zeeb * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 19b9f0b66cSBjoern A. Zeeb * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20b9f0b66cSBjoern A. Zeeb * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21b9f0b66cSBjoern A. Zeeb * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 22b9f0b66cSBjoern A. Zeeb * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23b9f0b66cSBjoern A. Zeeb * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24b9f0b66cSBjoern A. Zeeb * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25b9f0b66cSBjoern A. Zeeb * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26b9f0b66cSBjoern A. Zeeb * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27b9f0b66cSBjoern A. Zeeb * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28b9f0b66cSBjoern A. Zeeb * SUCH DAMAGE. 2907901f22SPoul-Henning Kamp */ 3075c13541SPoul-Henning Kamp 31677b542eSDavid E. O'Brien #include <sys/cdefs.h> 32677b542eSDavid E. O'Brien __FBSDID("$FreeBSD$"); 33677b542eSDavid E. O'Brien 34413628a7SBjoern A. Zeeb #include "opt_ddb.h" 35413628a7SBjoern A. Zeeb #include "opt_inet.h" 36413628a7SBjoern A. Zeeb #include "opt_inet6.h" 3746e3b1cbSPawel Jakub Dawidek 3875c13541SPoul-Henning Kamp #include <sys/param.h> 3975c13541SPoul-Henning Kamp #include <sys/types.h> 4075c13541SPoul-Henning Kamp #include <sys/kernel.h> 4175c13541SPoul-Henning Kamp #include <sys/systm.h> 4275c13541SPoul-Henning Kamp #include <sys/errno.h> 4375c13541SPoul-Henning Kamp #include <sys/sysproto.h> 4475c13541SPoul-Henning Kamp #include <sys/malloc.h> 450304c731SJamie Gritton #include <sys/osd.h> 46800c9408SRobert Watson #include <sys/priv.h> 4775c13541SPoul-Henning Kamp #include <sys/proc.h> 48b3059e09SRobert Watson #include <sys/taskqueue.h> 4957b4252eSKonstantin Belousov #include <sys/fcntl.h> 5075c13541SPoul-Henning Kamp #include <sys/jail.h> 5101137630SRobert Watson #include <sys/lock.h> 5201137630SRobert Watson #include <sys/mutex.h> 53097055e2SEdward Tomasz Napierala #include <sys/racct.h> 54f87beb93SAndriy Gapon #include <sys/rctl.h> 55a7ad07bfSEdward Tomasz Napierala #include <sys/refcount.h> 56dc68a633SPawel Jakub Dawidek #include <sys/sx.h> 5776ca6f88SJamie Gritton #include <sys/sysent.h> 58fd7a8150SMike Barcroft #include <sys/namei.h> 59820a0de9SPawel Jakub Dawidek #include <sys/mount.h> 60fd7a8150SMike Barcroft #include <sys/queue.h> 6175c13541SPoul-Henning Kamp #include <sys/socket.h> 62fd7a8150SMike Barcroft #include <sys/syscallsubr.h> 6383f1e257SRobert Watson #include <sys/sysctl.h> 64fd7a8150SMike Barcroft #include <sys/vnode.h> 65530c0060SRobert Watson 6675c13541SPoul-Henning Kamp #include <net/if.h> 67530c0060SRobert Watson #include <net/vnet.h> 68530c0060SRobert Watson 6975c13541SPoul-Henning Kamp #include <netinet/in.h> 70530c0060SRobert Watson 71413628a7SBjoern A. Zeeb #ifdef DDB 72413628a7SBjoern A. Zeeb #include <ddb/ddb.h> 73413628a7SBjoern A. Zeeb #endif /* DDB */ 7475c13541SPoul-Henning Kamp 75aed55708SRobert Watson #include <security/mac/mac_framework.h> 76aed55708SRobert Watson 778986e3a0SJamie Gritton #define DEFAULT_HOSTUUID "00000000-0000-0000-0000-000000000000" 788986e3a0SJamie Gritton 7975c13541SPoul-Henning Kamp MALLOC_DEFINE(M_PRISON, "prison", "Prison structures"); 80d745c852SEd Schouten static MALLOC_DEFINE(M_PRISON_RACCT, "prison_racct", "Prison racct structures"); 8175c13541SPoul-Henning Kamp 82592bcae8SBjoern A. Zeeb /* Keep struct prison prison0 and some code in kern_jail_set() readable. */ 83592bcae8SBjoern A. Zeeb #ifdef INET 84592bcae8SBjoern A. Zeeb #ifdef INET6 85592bcae8SBjoern A. Zeeb #define _PR_IP_SADDRSEL PR_IP4_SADDRSEL|PR_IP6_SADDRSEL 86592bcae8SBjoern A. Zeeb #else 87592bcae8SBjoern A. Zeeb #define _PR_IP_SADDRSEL PR_IP4_SADDRSEL 88592bcae8SBjoern A. Zeeb #endif 89592bcae8SBjoern A. Zeeb #else /* !INET */ 90592bcae8SBjoern A. Zeeb #ifdef INET6 91592bcae8SBjoern A. Zeeb #define _PR_IP_SADDRSEL PR_IP6_SADDRSEL 92592bcae8SBjoern A. Zeeb #else 93592bcae8SBjoern A. Zeeb #define _PR_IP_SADDRSEL 0 94592bcae8SBjoern A. Zeeb #endif 95592bcae8SBjoern A. Zeeb #endif 96592bcae8SBjoern A. Zeeb 970304c731SJamie Gritton /* prison0 describes what is "real" about the system. */ 980304c731SJamie Gritton struct prison prison0 = { 990304c731SJamie Gritton .pr_id = 0, 1000304c731SJamie Gritton .pr_name = "0", 1010304c731SJamie Gritton .pr_ref = 1, 1020304c731SJamie Gritton .pr_uref = 1, 1030304c731SJamie Gritton .pr_path = "/", 1040304c731SJamie Gritton .pr_securelevel = -1, 1050cc207a6SMartin Matuska .pr_devfs_rsnum = 0, 106b97457e2SJamie Gritton .pr_childmax = JAIL_MAX, 1078986e3a0SJamie Gritton .pr_hostuuid = DEFAULT_HOSTUUID, 10813e403fdSAntoine Brodin .pr_children = LIST_HEAD_INITIALIZER(prison0.pr_children), 109eb79e1c7SBjoern A. Zeeb #ifdef VIMAGE 110592bcae8SBjoern A. Zeeb .pr_flags = PR_HOST|PR_VNET|_PR_IP_SADDRSEL, 111eb79e1c7SBjoern A. Zeeb #else 112592bcae8SBjoern A. Zeeb .pr_flags = PR_HOST|_PR_IP_SADDRSEL, 113eb79e1c7SBjoern A. Zeeb #endif 1140e5c6bd4SJamie Gritton .pr_allow = PR_ALLOW_ALL_STATIC, 1150304c731SJamie Gritton }; 1160304c731SJamie Gritton MTX_SYSINIT(prison0, &prison0.pr_mtx, "jail mutex", MTX_DEF); 11783f1e257SRobert Watson 118672756aaSJamie Gritton struct bool_flags { 119672756aaSJamie Gritton const char *name; 120672756aaSJamie Gritton const char *noname; 121672756aaSJamie Gritton unsigned flag; 122672756aaSJamie Gritton }; 123672756aaSJamie Gritton struct jailsys_flags { 124672756aaSJamie Gritton const char *name; 125672756aaSJamie Gritton unsigned disable; 126672756aaSJamie Gritton unsigned new; 127672756aaSJamie Gritton }; 128672756aaSJamie Gritton 129a7ad07bfSEdward Tomasz Napierala /* allprison, allprison_racct and lastprid are protected by allprison_lock. */ 130dc68a633SPawel Jakub Dawidek struct sx allprison_lock; 131b38ff370SJamie Gritton SX_SYSINIT(allprison_lock, &allprison_lock, "allprison"); 132b38ff370SJamie Gritton struct prisonlist allprison = TAILQ_HEAD_INITIALIZER(allprison); 133a7ad07bfSEdward Tomasz Napierala LIST_HEAD(, prison_racct) allprison_racct; 1342110d913SXin LI int lastprid = 0; 135fd7a8150SMike Barcroft 136b38ff370SJamie Gritton static int do_jail_attach(struct thread *td, struct prison *pr); 137b3059e09SRobert Watson static void prison_complete(void *context, int pending); 138b38ff370SJamie Gritton static void prison_deref(struct prison *pr, int flags); 1390304c731SJamie Gritton static char *prison_path(struct prison *pr1, struct prison *pr2); 1400304c731SJamie Gritton static void prison_remove_one(struct prison *pr); 141a7ad07bfSEdward Tomasz Napierala #ifdef RACCT 142a7ad07bfSEdward Tomasz Napierala static void prison_racct_attach(struct prison *pr); 143c34bbd2aSEdward Tomasz Napierala static void prison_racct_modify(struct prison *pr); 144a7ad07bfSEdward Tomasz Napierala static void prison_racct_detach(struct prison *pr); 145a7ad07bfSEdward Tomasz Napierala #endif 146fd7a8150SMike Barcroft 147b38ff370SJamie Gritton /* Flags for prison_deref */ 148b38ff370SJamie Gritton #define PD_DEREF 0x01 149b38ff370SJamie Gritton #define PD_DEUREF 0x02 150b38ff370SJamie Gritton #define PD_LOCKED 0x04 151b38ff370SJamie Gritton #define PD_LIST_SLOCKED 0x08 152b38ff370SJamie Gritton #define PD_LIST_XLOCKED 0x10 153fd7a8150SMike Barcroft 1540304c731SJamie Gritton /* 1555cc70397SBjoern A. Zeeb * Parameter names corresponding to PR_* flag values. Size values are for kvm 1565cc70397SBjoern A. Zeeb * as we cannot figure out the size of a sparse array, or an array without a 1575cc70397SBjoern A. Zeeb * terminating entry. 1580304c731SJamie Gritton */ 159672756aaSJamie Gritton static struct bool_flags pr_flag_bool[] = { 160672756aaSJamie Gritton {"persist", "nopersist", PR_PERSIST}, 161592bcae8SBjoern A. Zeeb #ifdef INET 162672756aaSJamie Gritton {"ip4.saddrsel", "ip4.nosaddrsel", PR_IP4_SADDRSEL}, 163592bcae8SBjoern A. Zeeb #endif 164592bcae8SBjoern A. Zeeb #ifdef INET6 165672756aaSJamie Gritton {"ip6.saddrsel", "ip6.nosaddrsel", PR_IP6_SADDRSEL}, 166592bcae8SBjoern A. Zeeb #endif 1670304c731SJamie Gritton }; 168672756aaSJamie Gritton const size_t pr_flag_bool_size = sizeof(pr_flag_bool); 1690304c731SJamie Gritton 170672756aaSJamie Gritton static struct jailsys_flags pr_flag_jailsys[] = { 1717cbf7213SJamie Gritton {"host", 0, PR_HOST}, 1727cbf7213SJamie Gritton #ifdef VIMAGE 1737cbf7213SJamie Gritton {"vnet", 0, PR_VNET}, 1747cbf7213SJamie Gritton #endif 1750304c731SJamie Gritton #ifdef INET 1766a3f2779SJamie Gritton {"ip4", PR_IP4_USER, PR_IP4_USER}, 1770304c731SJamie Gritton #endif 1780304c731SJamie Gritton #ifdef INET6 1796a3f2779SJamie Gritton {"ip6", PR_IP6_USER, PR_IP6_USER}, 180679e1390SJamie Gritton #endif 1810304c731SJamie Gritton }; 1825cc70397SBjoern A. Zeeb const size_t pr_flag_jailsys_size = sizeof(pr_flag_jailsys); 1830304c731SJamie Gritton 1840e5c6bd4SJamie Gritton /* Make this array full-size so dynamic parameters can be added. */ 1850e5c6bd4SJamie Gritton static struct bool_flags pr_flag_allow[NBBY * NBPW] = { 186672756aaSJamie Gritton {"allow.set_hostname", "allow.noset_hostname", PR_ALLOW_SET_HOSTNAME}, 187672756aaSJamie Gritton {"allow.sysvipc", "allow.nosysvipc", PR_ALLOW_SYSVIPC}, 188672756aaSJamie Gritton {"allow.raw_sockets", "allow.noraw_sockets", PR_ALLOW_RAW_SOCKETS}, 189672756aaSJamie Gritton {"allow.chflags", "allow.nochflags", PR_ALLOW_CHFLAGS}, 190672756aaSJamie Gritton {"allow.mount", "allow.nomount", PR_ALLOW_MOUNT}, 191672756aaSJamie Gritton {"allow.quotas", "allow.noquotas", PR_ALLOW_QUOTAS}, 192672756aaSJamie Gritton {"allow.socket_af", "allow.nosocket_af", PR_ALLOW_SOCKET_AF}, 193ccd6ac9fSAntoine Brodin {"allow.mlock", "allow.nomlock", PR_ALLOW_MLOCK}, 194672756aaSJamie Gritton {"allow.reserved_ports", "allow.noreserved_ports", 195672756aaSJamie Gritton PR_ALLOW_RESERVED_PORTS}, 196b19d66fdSJamie Gritton {"allow.read_msgbuf", "allow.noread_msgbuf", PR_ALLOW_READ_MSGBUF}, 197b3079544SJamie Gritton {"allow.unprivileged_proc_debug", "allow.nounprivileged_proc_debug", 198b3079544SJamie Gritton PR_ALLOW_UNPRIV_DEBUG}, 1990304c731SJamie Gritton }; 200672756aaSJamie Gritton const size_t pr_flag_allow_size = sizeof(pr_flag_allow); 2010304c731SJamie Gritton 202b3079544SJamie Gritton #define JAIL_DEFAULT_ALLOW (PR_ALLOW_SET_HOSTNAME | \ 203b3079544SJamie Gritton PR_ALLOW_RESERVED_PORTS | \ 204b3079544SJamie Gritton PR_ALLOW_UNPRIV_DEBUG) 20542bebd82SJamie Gritton #define JAIL_DEFAULT_ENFORCE_STATFS 2 206bf3db8aaSMartin Matuska #define JAIL_DEFAULT_DEVFS_RSNUM 0 2070304c731SJamie Gritton static unsigned jail_default_allow = JAIL_DEFAULT_ALLOW; 20842bebd82SJamie Gritton static int jail_default_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS; 2090cc207a6SMartin Matuska static int jail_default_devfs_rsnum = JAIL_DEFAULT_DEVFS_RSNUM; 2100304c731SJamie Gritton #if defined(INET) || defined(INET6) 211e92e0574SJamie Gritton static unsigned jail_max_af_ips = 255; 2120304c731SJamie Gritton #endif 2130304c731SJamie Gritton 214b96bd95bSIan Lepore /* 215b96bd95bSIan Lepore * Initialize the parts of prison0 that can't be static-initialized with 216b96bd95bSIan Lepore * constants. This is called from proc0_init() after creating thread0 cpuset. 217b96bd95bSIan Lepore */ 218b96bd95bSIan Lepore void 219b96bd95bSIan Lepore prison0_init(void) 220b96bd95bSIan Lepore { 221b96bd95bSIan Lepore 222b96bd95bSIan Lepore prison0.pr_cpuset = cpuset_ref(thread0.td_cpuset); 223b96bd95bSIan Lepore prison0.pr_osreldate = osreldate; 224b96bd95bSIan Lepore strlcpy(prison0.pr_osrelease, osrelease, sizeof(prison0.pr_osrelease)); 225b96bd95bSIan Lepore } 226b96bd95bSIan Lepore 227116734c4SMatthew Dillon /* 2289ddb7954SMike Barcroft * struct jail_args { 2299ddb7954SMike Barcroft * struct jail *jail; 2309ddb7954SMike Barcroft * }; 231116734c4SMatthew Dillon */ 23275c13541SPoul-Henning Kamp int 233c542c43eSJamie Gritton sys_jail(struct thread *td, struct jail_args *uap) 23475c13541SPoul-Henning Kamp { 235413628a7SBjoern A. Zeeb uint32_t version; 236413628a7SBjoern A. Zeeb int error; 2370304c731SJamie Gritton struct jail j; 238413628a7SBjoern A. Zeeb 239413628a7SBjoern A. Zeeb error = copyin(uap->jail, &version, sizeof(uint32_t)); 240413628a7SBjoern A. Zeeb if (error) 241413628a7SBjoern A. Zeeb return (error); 242413628a7SBjoern A. Zeeb 243413628a7SBjoern A. Zeeb switch (version) { 244413628a7SBjoern A. Zeeb case 0: 245413628a7SBjoern A. Zeeb { 246413628a7SBjoern A. Zeeb struct jail_v0 j0; 247413628a7SBjoern A. Zeeb 2480304c731SJamie Gritton /* FreeBSD single IPv4 jails. */ 2490304c731SJamie Gritton bzero(&j, sizeof(struct jail)); 250413628a7SBjoern A. Zeeb error = copyin(uap->jail, &j0, sizeof(struct jail_v0)); 251413628a7SBjoern A. Zeeb if (error) 252413628a7SBjoern A. Zeeb return (error); 2530304c731SJamie Gritton j.version = j0.version; 2540304c731SJamie Gritton j.path = j0.path; 2550304c731SJamie Gritton j.hostname = j0.hostname; 256b5019bc4SPeter Wemm j.ip4s = htonl(j0.ip_number); /* jail_v0 is host order */ 257413628a7SBjoern A. Zeeb break; 258413628a7SBjoern A. Zeeb } 259413628a7SBjoern A. Zeeb 260413628a7SBjoern A. Zeeb case 1: 261413628a7SBjoern A. Zeeb /* 262413628a7SBjoern A. Zeeb * Version 1 was used by multi-IPv4 jail implementations 263413628a7SBjoern A. Zeeb * that never made it into the official kernel. 264413628a7SBjoern A. Zeeb */ 265413628a7SBjoern A. Zeeb return (EINVAL); 266413628a7SBjoern A. Zeeb 267413628a7SBjoern A. Zeeb case 2: /* JAIL_API_VERSION */ 268413628a7SBjoern A. Zeeb /* FreeBSD multi-IPv4/IPv6,noIP jails. */ 269413628a7SBjoern A. Zeeb error = copyin(uap->jail, &j, sizeof(struct jail)); 270413628a7SBjoern A. Zeeb if (error) 271413628a7SBjoern A. Zeeb return (error); 2720304c731SJamie Gritton break; 2730304c731SJamie Gritton 2740304c731SJamie Gritton default: 2750304c731SJamie Gritton /* Sci-Fi jails are not supported, sorry. */ 2760304c731SJamie Gritton return (EINVAL); 2770304c731SJamie Gritton } 278c542c43eSJamie Gritton return (kern_jail(td, &j)); 2790304c731SJamie Gritton } 2800304c731SJamie Gritton 2810304c731SJamie Gritton int 282c542c43eSJamie Gritton kern_jail(struct thread *td, struct jail *j) 2830304c731SJamie Gritton { 284c542c43eSJamie Gritton struct iovec optiov[2 * (4 + nitems(pr_flag_allow) 285e92e0574SJamie Gritton #ifdef INET 286e92e0574SJamie Gritton + 1 287e92e0574SJamie Gritton #endif 288e92e0574SJamie Gritton #ifdef INET6 289e92e0574SJamie Gritton + 1 290e92e0574SJamie Gritton #endif 291e92e0574SJamie Gritton )]; 2920304c731SJamie Gritton struct uio opt; 2930304c731SJamie Gritton char *u_path, *u_hostname, *u_name; 294672756aaSJamie Gritton struct bool_flags *bf; 2950304c731SJamie Gritton #ifdef INET 296e92e0574SJamie Gritton uint32_t ip4s; 2970304c731SJamie Gritton struct in_addr *u_ip4; 2980304c731SJamie Gritton #endif 2990304c731SJamie Gritton #ifdef INET6 3000304c731SJamie Gritton struct in6_addr *u_ip6; 3010304c731SJamie Gritton #endif 3020304c731SJamie Gritton size_t tmplen; 303c542c43eSJamie Gritton int error, enforce_statfs; 3040304c731SJamie Gritton 3050304c731SJamie Gritton bzero(&optiov, sizeof(optiov)); 3060304c731SJamie Gritton opt.uio_iov = optiov; 3070304c731SJamie Gritton opt.uio_iovcnt = 0; 3080304c731SJamie Gritton opt.uio_offset = -1; 3090304c731SJamie Gritton opt.uio_resid = -1; 3100304c731SJamie Gritton opt.uio_segflg = UIO_SYSSPACE; 3110304c731SJamie Gritton opt.uio_rw = UIO_READ; 3120304c731SJamie Gritton opt.uio_td = td; 3130304c731SJamie Gritton 3140304c731SJamie Gritton /* Set permissions for top-level jails from sysctls. */ 3150304c731SJamie Gritton if (!jailed(td->td_ucred)) { 316672756aaSJamie Gritton for (bf = pr_flag_allow; 3170e5c6bd4SJamie Gritton bf < pr_flag_allow + nitems(pr_flag_allow) && 3180e5c6bd4SJamie Gritton bf->flag != 0; 319672756aaSJamie Gritton bf++) { 320672756aaSJamie Gritton optiov[opt.uio_iovcnt].iov_base = __DECONST(char *, 321672756aaSJamie Gritton (jail_default_allow & bf->flag) 322672756aaSJamie Gritton ? bf->name : bf->noname); 3230304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = 3240304c731SJamie Gritton strlen(optiov[opt.uio_iovcnt].iov_base) + 1; 3250304c731SJamie Gritton opt.uio_iovcnt += 2; 3260304c731SJamie Gritton } 3270304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "enforce_statfs"; 3280304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("enforce_statfs"); 3290304c731SJamie Gritton opt.uio_iovcnt++; 3300304c731SJamie Gritton enforce_statfs = jail_default_enforce_statfs; 3310304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = &enforce_statfs; 3320304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof(enforce_statfs); 3330304c731SJamie Gritton opt.uio_iovcnt++; 3340304c731SJamie Gritton } 3350304c731SJamie Gritton 336b38ff370SJamie Gritton tmplen = MAXPATHLEN + MAXHOSTNAMELEN + MAXHOSTNAMELEN; 337b38ff370SJamie Gritton #ifdef INET 3380304c731SJamie Gritton ip4s = (j->version == 0) ? 1 : j->ip4s; 3390304c731SJamie Gritton if (ip4s > jail_max_af_ips) 340b38ff370SJamie Gritton return (EINVAL); 3410304c731SJamie Gritton tmplen += ip4s * sizeof(struct in_addr); 342b38ff370SJamie Gritton #else 3430304c731SJamie Gritton if (j->ip4s > 0) 344b38ff370SJamie Gritton return (EINVAL); 345b38ff370SJamie Gritton #endif 346b38ff370SJamie Gritton #ifdef INET6 3470304c731SJamie Gritton if (j->ip6s > jail_max_af_ips) 348b38ff370SJamie Gritton return (EINVAL); 3490304c731SJamie Gritton tmplen += j->ip6s * sizeof(struct in6_addr); 350b38ff370SJamie Gritton #else 3510304c731SJamie Gritton if (j->ip6s > 0) 352b38ff370SJamie Gritton return (EINVAL); 353b38ff370SJamie Gritton #endif 354b38ff370SJamie Gritton u_path = malloc(tmplen, M_TEMP, M_WAITOK); 355b38ff370SJamie Gritton u_hostname = u_path + MAXPATHLEN; 356b38ff370SJamie Gritton u_name = u_hostname + MAXHOSTNAMELEN; 357b38ff370SJamie Gritton #ifdef INET 358b38ff370SJamie Gritton u_ip4 = (struct in_addr *)(u_name + MAXHOSTNAMELEN); 359b38ff370SJamie Gritton #endif 360b38ff370SJamie Gritton #ifdef INET6 361b38ff370SJamie Gritton #ifdef INET 3620304c731SJamie Gritton u_ip6 = (struct in6_addr *)(u_ip4 + ip4s); 363b38ff370SJamie Gritton #else 364b38ff370SJamie Gritton u_ip6 = (struct in6_addr *)(u_name + MAXHOSTNAMELEN); 365b38ff370SJamie Gritton #endif 366b38ff370SJamie Gritton #endif 3670304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "path"; 3680304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("path"); 3690304c731SJamie Gritton opt.uio_iovcnt++; 3700304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = u_path; 3710304c731SJamie Gritton error = copyinstr(j->path, u_path, MAXPATHLEN, 3720304c731SJamie Gritton &optiov[opt.uio_iovcnt].iov_len); 373b38ff370SJamie Gritton if (error) { 374b38ff370SJamie Gritton free(u_path, M_TEMP); 375b38ff370SJamie Gritton return (error); 376b38ff370SJamie Gritton } 3770304c731SJamie Gritton opt.uio_iovcnt++; 3780304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "host.hostname"; 3790304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("host.hostname"); 3800304c731SJamie Gritton opt.uio_iovcnt++; 3810304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = u_hostname; 3820304c731SJamie Gritton error = copyinstr(j->hostname, u_hostname, MAXHOSTNAMELEN, 3830304c731SJamie Gritton &optiov[opt.uio_iovcnt].iov_len); 384b38ff370SJamie Gritton if (error) { 385b38ff370SJamie Gritton free(u_path, M_TEMP); 386b38ff370SJamie Gritton return (error); 387b38ff370SJamie Gritton } 3880304c731SJamie Gritton opt.uio_iovcnt++; 3890304c731SJamie Gritton if (j->jailname != NULL) { 390b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "name"; 391b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("name"); 392b38ff370SJamie Gritton opt.uio_iovcnt++; 393b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = u_name; 3940304c731SJamie Gritton error = copyinstr(j->jailname, u_name, MAXHOSTNAMELEN, 395b38ff370SJamie Gritton &optiov[opt.uio_iovcnt].iov_len); 396b38ff370SJamie Gritton if (error) { 397b38ff370SJamie Gritton free(u_path, M_TEMP); 398b38ff370SJamie Gritton return (error); 399b38ff370SJamie Gritton } 400b38ff370SJamie Gritton opt.uio_iovcnt++; 401b38ff370SJamie Gritton } 402b38ff370SJamie Gritton #ifdef INET 403b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "ip4.addr"; 404b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("ip4.addr"); 405b38ff370SJamie Gritton opt.uio_iovcnt++; 406b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = u_ip4; 4070304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = ip4s * sizeof(struct in_addr); 4080304c731SJamie Gritton if (j->version == 0) 4090304c731SJamie Gritton u_ip4->s_addr = j->ip4s; 4100304c731SJamie Gritton else { 4110304c731SJamie Gritton error = copyin(j->ip4, u_ip4, optiov[opt.uio_iovcnt].iov_len); 412b38ff370SJamie Gritton if (error) { 413b38ff370SJamie Gritton free(u_path, M_TEMP); 414b38ff370SJamie Gritton return (error); 415b38ff370SJamie Gritton } 4160304c731SJamie Gritton } 417b38ff370SJamie Gritton opt.uio_iovcnt++; 418b38ff370SJamie Gritton #endif 419b38ff370SJamie Gritton #ifdef INET6 420b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "ip6.addr"; 421b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("ip6.addr"); 422b38ff370SJamie Gritton opt.uio_iovcnt++; 423b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = u_ip6; 4240304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = j->ip6s * sizeof(struct in6_addr); 4250304c731SJamie Gritton error = copyin(j->ip6, u_ip6, optiov[opt.uio_iovcnt].iov_len); 426b38ff370SJamie Gritton if (error) { 427b38ff370SJamie Gritton free(u_path, M_TEMP); 428b38ff370SJamie Gritton return (error); 429b38ff370SJamie Gritton } 430b38ff370SJamie Gritton opt.uio_iovcnt++; 431b38ff370SJamie Gritton #endif 43202abd400SPedro F. Giffuni KASSERT(opt.uio_iovcnt <= nitems(optiov), 4330304c731SJamie Gritton ("kern_jail: too many iovecs (%d)", opt.uio_iovcnt)); 434b38ff370SJamie Gritton error = kern_jail_set(td, &opt, JAIL_CREATE | JAIL_ATTACH); 435b38ff370SJamie Gritton free(u_path, M_TEMP); 436b38ff370SJamie Gritton return (error); 437b38ff370SJamie Gritton } 438b38ff370SJamie Gritton 439b38ff370SJamie Gritton /* 440b38ff370SJamie Gritton * struct jail_set_args { 441b38ff370SJamie Gritton * struct iovec *iovp; 442b38ff370SJamie Gritton * unsigned int iovcnt; 443b38ff370SJamie Gritton * int flags; 444b38ff370SJamie Gritton * }; 445b38ff370SJamie Gritton */ 446b38ff370SJamie Gritton int 4478451d0ddSKip Macy sys_jail_set(struct thread *td, struct jail_set_args *uap) 448b38ff370SJamie Gritton { 449b38ff370SJamie Gritton struct uio *auio; 450b38ff370SJamie Gritton int error; 451b38ff370SJamie Gritton 452b38ff370SJamie Gritton /* Check that we have an even number of iovecs. */ 453b38ff370SJamie Gritton if (uap->iovcnt & 1) 454b38ff370SJamie Gritton return (EINVAL); 455b38ff370SJamie Gritton 456b38ff370SJamie Gritton error = copyinuio(uap->iovp, uap->iovcnt, &auio); 457b38ff370SJamie Gritton if (error) 458b38ff370SJamie Gritton return (error); 459b38ff370SJamie Gritton error = kern_jail_set(td, auio, uap->flags); 460b38ff370SJamie Gritton free(auio, M_IOV); 461b38ff370SJamie Gritton return (error); 462413628a7SBjoern A. Zeeb } 463413628a7SBjoern A. Zeeb 464413628a7SBjoern A. Zeeb int 465b38ff370SJamie Gritton kern_jail_set(struct thread *td, struct uio *optuio, int flags) 466413628a7SBjoern A. Zeeb { 467fd7a8150SMike Barcroft struct nameidata nd; 468b38ff370SJamie Gritton #ifdef INET 469b38ff370SJamie Gritton struct in_addr *ip4; 470413628a7SBjoern A. Zeeb #endif 471b38ff370SJamie Gritton #ifdef INET6 472b38ff370SJamie Gritton struct in6_addr *ip6; 473b38ff370SJamie Gritton #endif 474b38ff370SJamie Gritton struct vfsopt *opt; 475b38ff370SJamie Gritton struct vfsoptlist *opts; 47657aea6dfSBjoern A. Zeeb struct prison *pr, *deadpr, *mypr, *ppr, *tpr; 477b38ff370SJamie Gritton struct vnode *root; 478babbbb9cSJamie Gritton char *domain, *errmsg, *host, *name, *namelc, *p, *path, *uuid; 479b96bd95bSIan Lepore char *g_path, *osrelstr; 480672756aaSJamie Gritton struct bool_flags *bf; 481672756aaSJamie Gritton struct jailsys_flags *jsf; 4820304c731SJamie Gritton #if defined(INET) || defined(INET6) 48357aea6dfSBjoern A. Zeeb struct prison *tppr; 484b38ff370SJamie Gritton void *op; 4850304c731SJamie Gritton #endif 48676ca6f88SJamie Gritton unsigned long hid; 487b6f47c23SJamie Gritton size_t namelen, onamelen, pnamelen; 488cc5fd8c7SJamie Gritton int born, created, cuflags, descend, enforce; 489cc5fd8c7SJamie Gritton int error, errmsg_len, errmsg_pos; 4900cc207a6SMartin Matuska int gotchildmax, gotenforce, gothid, gotrsnum, gotslevel; 491672756aaSJamie Gritton int jid, jsys, len, level; 492b96bd95bSIan Lepore int childmax, osreldt, rsnum, slevel; 493d465a41dSBjoern A. Zeeb #if defined(INET) || defined(INET6) 4940304c731SJamie Gritton int ii, ij; 495413628a7SBjoern A. Zeeb #endif 496413628a7SBjoern A. Zeeb #ifdef INET 4972b0d6f81SJamie Gritton int ip4s, redo_ip4; 498413628a7SBjoern A. Zeeb #endif 499b38ff370SJamie Gritton #ifdef INET6 5002b0d6f81SJamie Gritton int ip6s, redo_ip6; 501b38ff370SJamie Gritton #endif 5026beb3bb4SKirk McKusick uint64_t pr_allow, ch_allow, pr_flags, ch_flags; 503b3079544SJamie Gritton uint64_t pr_allow_diff; 5046beb3bb4SKirk McKusick unsigned tallow; 505b38ff370SJamie Gritton char numbuf[12]; 506b38ff370SJamie Gritton 507b38ff370SJamie Gritton error = priv_check(td, PRIV_JAIL_SET); 508b38ff370SJamie Gritton if (!error && (flags & JAIL_ATTACH)) 509b38ff370SJamie Gritton error = priv_check(td, PRIV_JAIL_ATTACH); 510b38ff370SJamie Gritton if (error) 51175c13541SPoul-Henning Kamp return (error); 512b6f47c23SJamie Gritton mypr = td->td_ucred->cr_prison; 513b97457e2SJamie Gritton if ((flags & JAIL_CREATE) && mypr->pr_childmax == 0) 5140304c731SJamie Gritton return (EPERM); 515b38ff370SJamie Gritton if (flags & ~JAIL_SET_MASK) 516b38ff370SJamie Gritton return (EINVAL); 517b38ff370SJamie Gritton 518b38ff370SJamie Gritton /* 519b38ff370SJamie Gritton * Check all the parameters before committing to anything. Not all 520b38ff370SJamie Gritton * errors can be caught early, but we may as well try. Also, this 521b38ff370SJamie Gritton * takes care of some expensive stuff (path lookup) before getting 522b38ff370SJamie Gritton * the allprison lock. 523b38ff370SJamie Gritton * 524b38ff370SJamie Gritton * XXX Jails are not filesystems, and jail parameters are not mount 525b38ff370SJamie Gritton * options. But it makes more sense to re-use the vfsopt code 526b38ff370SJamie Gritton * than duplicate it under a different name. 527b38ff370SJamie Gritton */ 528b38ff370SJamie Gritton error = vfs_buildopts(optuio, &opts); 529b38ff370SJamie Gritton if (error) 530b38ff370SJamie Gritton return (error); 531b38ff370SJamie Gritton #ifdef INET 532b38ff370SJamie Gritton ip4 = NULL; 533b38ff370SJamie Gritton #endif 534b38ff370SJamie Gritton #ifdef INET6 535b38ff370SJamie Gritton ip6 = NULL; 536b38ff370SJamie Gritton #endif 5376dfe0a3dSMartin Matuska g_path = NULL; 538b38ff370SJamie Gritton 539b6f47c23SJamie Gritton cuflags = flags & (JAIL_CREATE | JAIL_UPDATE); 540b6f47c23SJamie Gritton if (!cuflags) { 541b6f47c23SJamie Gritton error = EINVAL; 542b6f47c23SJamie Gritton vfs_opterror(opts, "no valid operation (create or update)"); 543b6f47c23SJamie Gritton goto done_errmsg; 544b6f47c23SJamie Gritton } 545b6f47c23SJamie Gritton 546b38ff370SJamie Gritton error = vfs_copyopt(opts, "jid", &jid, sizeof(jid)); 547b38ff370SJamie Gritton if (error == ENOENT) 548b38ff370SJamie Gritton jid = 0; 549b38ff370SJamie Gritton else if (error != 0) 550b38ff370SJamie Gritton goto done_free; 551b38ff370SJamie Gritton 552b38ff370SJamie Gritton error = vfs_copyopt(opts, "securelevel", &slevel, sizeof(slevel)); 553b38ff370SJamie Gritton if (error == ENOENT) 554b38ff370SJamie Gritton gotslevel = 0; 555b38ff370SJamie Gritton else if (error != 0) 556b38ff370SJamie Gritton goto done_free; 557b38ff370SJamie Gritton else 558b38ff370SJamie Gritton gotslevel = 1; 559b38ff370SJamie Gritton 560b97457e2SJamie Gritton error = 561b97457e2SJamie Gritton vfs_copyopt(opts, "children.max", &childmax, sizeof(childmax)); 562b97457e2SJamie Gritton if (error == ENOENT) 563b97457e2SJamie Gritton gotchildmax = 0; 564b97457e2SJamie Gritton else if (error != 0) 565b97457e2SJamie Gritton goto done_free; 566b97457e2SJamie Gritton else 567b97457e2SJamie Gritton gotchildmax = 1; 568b97457e2SJamie Gritton 5690304c731SJamie Gritton error = vfs_copyopt(opts, "enforce_statfs", &enforce, sizeof(enforce)); 570f337198dSJamie Gritton if (error == ENOENT) 571f337198dSJamie Gritton gotenforce = 0; 572f337198dSJamie Gritton else if (error != 0) 5730304c731SJamie Gritton goto done_free; 574f337198dSJamie Gritton else if (enforce < 0 || enforce > 2) { 575f337198dSJamie Gritton error = EINVAL; 576f337198dSJamie Gritton goto done_free; 577f337198dSJamie Gritton } else 578f337198dSJamie Gritton gotenforce = 1; 5790304c731SJamie Gritton 5800cc207a6SMartin Matuska error = vfs_copyopt(opts, "devfs_ruleset", &rsnum, sizeof(rsnum)); 5810cc207a6SMartin Matuska if (error == ENOENT) 5820cc207a6SMartin Matuska gotrsnum = 0; 5830cc207a6SMartin Matuska else if (error != 0) 5840cc207a6SMartin Matuska goto done_free; 5850cc207a6SMartin Matuska else 5860cc207a6SMartin Matuska gotrsnum = 1; 5870cc207a6SMartin Matuska 588b38ff370SJamie Gritton pr_flags = ch_flags = 0; 589672756aaSJamie Gritton for (bf = pr_flag_bool; 590672756aaSJamie Gritton bf < pr_flag_bool + nitems(pr_flag_bool); 591672756aaSJamie Gritton bf++) { 592672756aaSJamie Gritton vfs_flagopt(opts, bf->name, &pr_flags, bf->flag); 593672756aaSJamie Gritton vfs_flagopt(opts, bf->noname, &ch_flags, bf->flag); 5940304c731SJamie Gritton } 595b38ff370SJamie Gritton ch_flags |= pr_flags; 596672756aaSJamie Gritton for (jsf = pr_flag_jailsys; 597672756aaSJamie Gritton jsf < pr_flag_jailsys + nitems(pr_flag_jailsys); 598672756aaSJamie Gritton jsf++) { 599672756aaSJamie Gritton error = vfs_copyopt(opts, jsf->name, &jsys, sizeof(jsys)); 6007cbf7213SJamie Gritton if (error == ENOENT) 6017cbf7213SJamie Gritton continue; 6027cbf7213SJamie Gritton if (error != 0) 6037cbf7213SJamie Gritton goto done_free; 6047cbf7213SJamie Gritton switch (jsys) { 6057cbf7213SJamie Gritton case JAIL_SYS_DISABLE: 606672756aaSJamie Gritton if (!jsf->disable) { 6077cbf7213SJamie Gritton error = EINVAL; 6087cbf7213SJamie Gritton goto done_free; 6097cbf7213SJamie Gritton } 610672756aaSJamie Gritton pr_flags |= jsf->disable; 6117cbf7213SJamie Gritton break; 6127cbf7213SJamie Gritton case JAIL_SYS_NEW: 613672756aaSJamie Gritton pr_flags |= jsf->new; 6147cbf7213SJamie Gritton break; 6157cbf7213SJamie Gritton case JAIL_SYS_INHERIT: 6167cbf7213SJamie Gritton break; 6177cbf7213SJamie Gritton default: 6187cbf7213SJamie Gritton error = EINVAL; 6197cbf7213SJamie Gritton goto done_free; 6207cbf7213SJamie Gritton } 621672756aaSJamie Gritton ch_flags |= jsf->new | jsf->disable; 6227cbf7213SJamie Gritton } 6234affa14cSJamie Gritton if ((flags & (JAIL_CREATE | JAIL_UPDATE | JAIL_ATTACH)) == JAIL_CREATE 6244affa14cSJamie Gritton && !(pr_flags & PR_PERSIST)) { 6254affa14cSJamie Gritton error = EINVAL; 6264affa14cSJamie Gritton vfs_opterror(opts, "new jail must persist or attach"); 6274affa14cSJamie Gritton goto done_errmsg; 6284affa14cSJamie Gritton } 629679e1390SJamie Gritton #ifdef VIMAGE 630679e1390SJamie Gritton if ((flags & JAIL_UPDATE) && (ch_flags & PR_VNET)) { 631679e1390SJamie Gritton error = EINVAL; 632679e1390SJamie Gritton vfs_opterror(opts, "vnet cannot be changed after creation"); 633679e1390SJamie Gritton goto done_errmsg; 634679e1390SJamie Gritton } 635679e1390SJamie Gritton #endif 6362b0d6f81SJamie Gritton #ifdef INET 6372b0d6f81SJamie Gritton if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP4_USER)) { 6382b0d6f81SJamie Gritton error = EINVAL; 6392b0d6f81SJamie Gritton vfs_opterror(opts, "ip4 cannot be changed after creation"); 6402b0d6f81SJamie Gritton goto done_errmsg; 6412b0d6f81SJamie Gritton } 6422b0d6f81SJamie Gritton #endif 6432b0d6f81SJamie Gritton #ifdef INET6 6442b0d6f81SJamie Gritton if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP6_USER)) { 6452b0d6f81SJamie Gritton error = EINVAL; 6462b0d6f81SJamie Gritton vfs_opterror(opts, "ip6 cannot be changed after creation"); 6472b0d6f81SJamie Gritton goto done_errmsg; 6482b0d6f81SJamie Gritton } 6492b0d6f81SJamie Gritton #endif 650b38ff370SJamie Gritton 6510304c731SJamie Gritton pr_allow = ch_allow = 0; 652672756aaSJamie Gritton for (bf = pr_flag_allow; 6530e5c6bd4SJamie Gritton bf < pr_flag_allow + nitems(pr_flag_allow) && bf->flag != 0; 654672756aaSJamie Gritton bf++) { 655672756aaSJamie Gritton vfs_flagopt(opts, bf->name, &pr_allow, bf->flag); 656672756aaSJamie Gritton vfs_flagopt(opts, bf->noname, &ch_allow, bf->flag); 6570304c731SJamie Gritton } 6580304c731SJamie Gritton ch_allow |= pr_allow; 6590304c731SJamie Gritton 660b38ff370SJamie Gritton error = vfs_getopt(opts, "name", (void **)&name, &len); 661b38ff370SJamie Gritton if (error == ENOENT) 662b38ff370SJamie Gritton name = NULL; 663b38ff370SJamie Gritton else if (error != 0) 664b38ff370SJamie Gritton goto done_free; 665b38ff370SJamie Gritton else { 666b38ff370SJamie Gritton if (len == 0 || name[len - 1] != '\0') { 667b38ff370SJamie Gritton error = EINVAL; 668b38ff370SJamie Gritton goto done_free; 669b38ff370SJamie Gritton } 670b38ff370SJamie Gritton if (len > MAXHOSTNAMELEN) { 671b38ff370SJamie Gritton error = ENAMETOOLONG; 672b38ff370SJamie Gritton goto done_free; 673b38ff370SJamie Gritton } 674b38ff370SJamie Gritton } 675b38ff370SJamie Gritton 676b38ff370SJamie Gritton error = vfs_getopt(opts, "host.hostname", (void **)&host, &len); 677b38ff370SJamie Gritton if (error == ENOENT) 678b38ff370SJamie Gritton host = NULL; 679b38ff370SJamie Gritton else if (error != 0) 680b38ff370SJamie Gritton goto done_free; 681b38ff370SJamie Gritton else { 68276ca6f88SJamie Gritton ch_flags |= PR_HOST; 68376ca6f88SJamie Gritton pr_flags |= PR_HOST; 684b38ff370SJamie Gritton if (len == 0 || host[len - 1] != '\0') { 685b38ff370SJamie Gritton error = EINVAL; 686b38ff370SJamie Gritton goto done_free; 687b38ff370SJamie Gritton } 688b38ff370SJamie Gritton if (len > MAXHOSTNAMELEN) { 689b38ff370SJamie Gritton error = ENAMETOOLONG; 690b38ff370SJamie Gritton goto done_free; 691b38ff370SJamie Gritton } 692b38ff370SJamie Gritton } 693b38ff370SJamie Gritton 69476ca6f88SJamie Gritton error = vfs_getopt(opts, "host.domainname", (void **)&domain, &len); 69576ca6f88SJamie Gritton if (error == ENOENT) 69676ca6f88SJamie Gritton domain = NULL; 69776ca6f88SJamie Gritton else if (error != 0) 69876ca6f88SJamie Gritton goto done_free; 69976ca6f88SJamie Gritton else { 70076ca6f88SJamie Gritton ch_flags |= PR_HOST; 70176ca6f88SJamie Gritton pr_flags |= PR_HOST; 70276ca6f88SJamie Gritton if (len == 0 || domain[len - 1] != '\0') { 70376ca6f88SJamie Gritton error = EINVAL; 70476ca6f88SJamie Gritton goto done_free; 70576ca6f88SJamie Gritton } 70676ca6f88SJamie Gritton if (len > MAXHOSTNAMELEN) { 70776ca6f88SJamie Gritton error = ENAMETOOLONG; 70876ca6f88SJamie Gritton goto done_free; 70976ca6f88SJamie Gritton } 71076ca6f88SJamie Gritton } 71176ca6f88SJamie Gritton 71276ca6f88SJamie Gritton error = vfs_getopt(opts, "host.hostuuid", (void **)&uuid, &len); 71376ca6f88SJamie Gritton if (error == ENOENT) 71476ca6f88SJamie Gritton uuid = NULL; 71576ca6f88SJamie Gritton else if (error != 0) 71676ca6f88SJamie Gritton goto done_free; 71776ca6f88SJamie Gritton else { 71876ca6f88SJamie Gritton ch_flags |= PR_HOST; 71976ca6f88SJamie Gritton pr_flags |= PR_HOST; 72076ca6f88SJamie Gritton if (len == 0 || uuid[len - 1] != '\0') { 72176ca6f88SJamie Gritton error = EINVAL; 72276ca6f88SJamie Gritton goto done_free; 72376ca6f88SJamie Gritton } 72476ca6f88SJamie Gritton if (len > HOSTUUIDLEN) { 72576ca6f88SJamie Gritton error = ENAMETOOLONG; 72676ca6f88SJamie Gritton goto done_free; 72776ca6f88SJamie Gritton } 72876ca6f88SJamie Gritton } 72976ca6f88SJamie Gritton 730841c0c7eSNathan Whitehorn #ifdef COMPAT_FREEBSD32 731a5c1afadSDmitry Chagin if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) { 73276ca6f88SJamie Gritton uint32_t hid32; 73376ca6f88SJamie Gritton 73476ca6f88SJamie Gritton error = vfs_copyopt(opts, "host.hostid", &hid32, sizeof(hid32)); 73576ca6f88SJamie Gritton hid = hid32; 73676ca6f88SJamie Gritton } else 73776ca6f88SJamie Gritton #endif 73876ca6f88SJamie Gritton error = vfs_copyopt(opts, "host.hostid", &hid, sizeof(hid)); 73976ca6f88SJamie Gritton if (error == ENOENT) 74076ca6f88SJamie Gritton gothid = 0; 74176ca6f88SJamie Gritton else if (error != 0) 74276ca6f88SJamie Gritton goto done_free; 74376ca6f88SJamie Gritton else { 74476ca6f88SJamie Gritton gothid = 1; 74576ca6f88SJamie Gritton ch_flags |= PR_HOST; 74676ca6f88SJamie Gritton pr_flags |= PR_HOST; 74776ca6f88SJamie Gritton } 74876ca6f88SJamie Gritton 749b38ff370SJamie Gritton #ifdef INET 750b38ff370SJamie Gritton error = vfs_getopt(opts, "ip4.addr", &op, &ip4s); 751b38ff370SJamie Gritton if (error == ENOENT) 7520e5e396eSJamie Gritton ip4s = 0; 753b38ff370SJamie Gritton else if (error != 0) 754b38ff370SJamie Gritton goto done_free; 755b38ff370SJamie Gritton else if (ip4s & (sizeof(*ip4) - 1)) { 756b38ff370SJamie Gritton error = EINVAL; 757b38ff370SJamie Gritton goto done_free; 7580304c731SJamie Gritton } else { 7596a3f2779SJamie Gritton ch_flags |= PR_IP4_USER; 7606a3f2779SJamie Gritton pr_flags |= PR_IP4_USER; 7616a3f2779SJamie Gritton if (ip4s > 0) { 762b38ff370SJamie Gritton ip4s /= sizeof(*ip4); 763b38ff370SJamie Gritton if (ip4s > jail_max_af_ips) { 764b38ff370SJamie Gritton error = EINVAL; 765b38ff370SJamie Gritton vfs_opterror(opts, "too many IPv4 addresses"); 766b38ff370SJamie Gritton goto done_errmsg; 767b38ff370SJamie Gritton } 7682b0d6f81SJamie Gritton ip4 = malloc(ip4s * sizeof(*ip4), M_PRISON, M_WAITOK); 769b38ff370SJamie Gritton bcopy(op, ip4, ip4s * sizeof(*ip4)); 770b38ff370SJamie Gritton /* 7710304c731SJamie Gritton * IP addresses are all sorted but ip[0] to preserve 7720304c731SJamie Gritton * the primary IP address as given from userland. 7730304c731SJamie Gritton * This special IP is used for unbound outgoing 774bef916f9SBjoern A. Zeeb * connections as well for "loopback" traffic in case 775bef916f9SBjoern A. Zeeb * source address selection cannot find any more fitting 776bef916f9SBjoern A. Zeeb * address to connect from. 777b38ff370SJamie Gritton */ 778b38ff370SJamie Gritton if (ip4s > 1) 7790ce1624dSStephen J. Kiernan qsort(ip4 + 1, ip4s - 1, sizeof(*ip4), 7800ce1624dSStephen J. Kiernan prison_qcmp_v4); 781b38ff370SJamie Gritton /* 7820304c731SJamie Gritton * Check for duplicate addresses and do some simple 7830304c731SJamie Gritton * zero and broadcast checks. If users give other bogus 7840304c731SJamie Gritton * addresses it is their problem. 785b38ff370SJamie Gritton * 7860304c731SJamie Gritton * We do not have to care about byte order for these 7870304c731SJamie Gritton * checks so we will do them in NBO. 788b38ff370SJamie Gritton */ 789b38ff370SJamie Gritton for (ii = 0; ii < ip4s; ii++) { 790b38ff370SJamie Gritton if (ip4[ii].s_addr == INADDR_ANY || 791b38ff370SJamie Gritton ip4[ii].s_addr == INADDR_BROADCAST) { 792b38ff370SJamie Gritton error = EINVAL; 793b38ff370SJamie Gritton goto done_free; 794b38ff370SJamie Gritton } 795b38ff370SJamie Gritton if ((ii+1) < ip4s && 796b38ff370SJamie Gritton (ip4[0].s_addr == ip4[ii+1].s_addr || 797b38ff370SJamie Gritton ip4[ii].s_addr == ip4[ii+1].s_addr)) { 798b38ff370SJamie Gritton error = EINVAL; 799b38ff370SJamie Gritton goto done_free; 800b38ff370SJamie Gritton } 801b38ff370SJamie Gritton } 802b38ff370SJamie Gritton } 8030304c731SJamie Gritton } 804b38ff370SJamie Gritton #endif 805b38ff370SJamie Gritton 806b38ff370SJamie Gritton #ifdef INET6 807b38ff370SJamie Gritton error = vfs_getopt(opts, "ip6.addr", &op, &ip6s); 808b38ff370SJamie Gritton if (error == ENOENT) 8090e5e396eSJamie Gritton ip6s = 0; 810b38ff370SJamie Gritton else if (error != 0) 811b38ff370SJamie Gritton goto done_free; 812b38ff370SJamie Gritton else if (ip6s & (sizeof(*ip6) - 1)) { 813b38ff370SJamie Gritton error = EINVAL; 814b38ff370SJamie Gritton goto done_free; 8150304c731SJamie Gritton } else { 8166a3f2779SJamie Gritton ch_flags |= PR_IP6_USER; 8176a3f2779SJamie Gritton pr_flags |= PR_IP6_USER; 8186a3f2779SJamie Gritton if (ip6s > 0) { 819b38ff370SJamie Gritton ip6s /= sizeof(*ip6); 820b38ff370SJamie Gritton if (ip6s > jail_max_af_ips) { 821b38ff370SJamie Gritton error = EINVAL; 822b38ff370SJamie Gritton vfs_opterror(opts, "too many IPv6 addresses"); 823b38ff370SJamie Gritton goto done_errmsg; 824b38ff370SJamie Gritton } 8252b0d6f81SJamie Gritton ip6 = malloc(ip6s * sizeof(*ip6), M_PRISON, M_WAITOK); 826b38ff370SJamie Gritton bcopy(op, ip6, ip6s * sizeof(*ip6)); 827b38ff370SJamie Gritton if (ip6s > 1) 8280ce1624dSStephen J. Kiernan qsort(ip6 + 1, ip6s - 1, sizeof(*ip6), 8290ce1624dSStephen J. Kiernan prison_qcmp_v6); 830b38ff370SJamie Gritton for (ii = 0; ii < ip6s; ii++) { 8310304c731SJamie Gritton if (IN6_IS_ADDR_UNSPECIFIED(&ip6[ii])) { 832b38ff370SJamie Gritton error = EINVAL; 833b38ff370SJamie Gritton goto done_free; 834b38ff370SJamie Gritton } 835b38ff370SJamie Gritton if ((ii+1) < ip6s && 836b38ff370SJamie Gritton (IN6_ARE_ADDR_EQUAL(&ip6[0], &ip6[ii+1]) || 837b38ff370SJamie Gritton IN6_ARE_ADDR_EQUAL(&ip6[ii], &ip6[ii+1]))) 838b38ff370SJamie Gritton { 839b38ff370SJamie Gritton error = EINVAL; 840b38ff370SJamie Gritton goto done_free; 841b38ff370SJamie Gritton } 842b38ff370SJamie Gritton } 843b38ff370SJamie Gritton } 8440304c731SJamie Gritton } 845b38ff370SJamie Gritton #endif 846b38ff370SJamie Gritton 847bdfc8cc4SJamie Gritton #if defined(VIMAGE) && (defined(INET) || defined(INET6)) 848bdfc8cc4SJamie Gritton if ((ch_flags & PR_VNET) && (ch_flags & (PR_IP4_USER | PR_IP6_USER))) { 849bdfc8cc4SJamie Gritton error = EINVAL; 850bdfc8cc4SJamie Gritton vfs_opterror(opts, 851bdfc8cc4SJamie Gritton "vnet jails cannot have IP address restrictions"); 852bdfc8cc4SJamie Gritton goto done_errmsg; 853bdfc8cc4SJamie Gritton } 854bdfc8cc4SJamie Gritton #endif 855bdfc8cc4SJamie Gritton 856cf0313c6SJamie Gritton error = vfs_getopt(opts, "osrelease", (void **)&osrelstr, &len); 857cf0313c6SJamie Gritton if (error == ENOENT) 858cf0313c6SJamie Gritton osrelstr = NULL; 859cf0313c6SJamie Gritton else if (error != 0) 860cf0313c6SJamie Gritton goto done_free; 861cf0313c6SJamie Gritton else { 862cf0313c6SJamie Gritton if (flags & JAIL_UPDATE) { 863cf0313c6SJamie Gritton error = EINVAL; 864cf0313c6SJamie Gritton vfs_opterror(opts, 865cf0313c6SJamie Gritton "osrelease cannot be changed after creation"); 866cf0313c6SJamie Gritton goto done_errmsg; 867cf0313c6SJamie Gritton } 868cf0313c6SJamie Gritton if (len == 0 || len >= OSRELEASELEN) { 869cf0313c6SJamie Gritton error = EINVAL; 870cf0313c6SJamie Gritton vfs_opterror(opts, 871cf0313c6SJamie Gritton "osrelease string must be 1-%d bytes long", 872cf0313c6SJamie Gritton OSRELEASELEN - 1); 873cf0313c6SJamie Gritton goto done_errmsg; 874cf0313c6SJamie Gritton } 875cf0313c6SJamie Gritton } 876cf0313c6SJamie Gritton 877cf0313c6SJamie Gritton error = vfs_copyopt(opts, "osreldate", &osreldt, sizeof(osreldt)); 878cf0313c6SJamie Gritton if (error == ENOENT) 879cf0313c6SJamie Gritton osreldt = 0; 880cf0313c6SJamie Gritton else if (error != 0) 881cf0313c6SJamie Gritton goto done_free; 882cf0313c6SJamie Gritton else { 883cf0313c6SJamie Gritton if (flags & JAIL_UPDATE) { 884cf0313c6SJamie Gritton error = EINVAL; 885cf0313c6SJamie Gritton vfs_opterror(opts, 886cf0313c6SJamie Gritton "osreldate cannot be changed after creation"); 887cf0313c6SJamie Gritton goto done_errmsg; 888cf0313c6SJamie Gritton } 889cf0313c6SJamie Gritton if (osreldt == 0) { 890cf0313c6SJamie Gritton error = EINVAL; 891cf0313c6SJamie Gritton vfs_opterror(opts, "osreldate cannot be 0"); 892cf0313c6SJamie Gritton goto done_errmsg; 893cf0313c6SJamie Gritton } 894cf0313c6SJamie Gritton } 895cf0313c6SJamie Gritton 896b38ff370SJamie Gritton root = NULL; 897b38ff370SJamie Gritton error = vfs_getopt(opts, "path", (void **)&path, &len); 898b38ff370SJamie Gritton if (error == ENOENT) 899b38ff370SJamie Gritton path = NULL; 900b38ff370SJamie Gritton else if (error != 0) 901b38ff370SJamie Gritton goto done_free; 902b38ff370SJamie Gritton else { 903b38ff370SJamie Gritton if (flags & JAIL_UPDATE) { 904b38ff370SJamie Gritton error = EINVAL; 905b38ff370SJamie Gritton vfs_opterror(opts, 906b38ff370SJamie Gritton "path cannot be changed after creation"); 907b38ff370SJamie Gritton goto done_errmsg; 908b38ff370SJamie Gritton } 909b38ff370SJamie Gritton if (len == 0 || path[len - 1] != '\0') { 910b38ff370SJamie Gritton error = EINVAL; 911b38ff370SJamie Gritton goto done_free; 912b38ff370SJamie Gritton } 9135050aa86SKonstantin Belousov NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE, 914b38ff370SJamie Gritton path, td); 915b38ff370SJamie Gritton error = namei(&nd); 916b38ff370SJamie Gritton if (error) 917b38ff370SJamie Gritton goto done_free; 918b38ff370SJamie Gritton root = nd.ni_vp; 919b38ff370SJamie Gritton NDFREE(&nd, NDF_ONLY_PNBUF); 9206dfe0a3dSMartin Matuska g_path = malloc(MAXPATHLEN, M_TEMP, M_WAITOK); 9216dfe0a3dSMartin Matuska strlcpy(g_path, path, MAXPATHLEN); 9226dfe0a3dSMartin Matuska error = vn_path_to_global_path(td, root, g_path, MAXPATHLEN); 9233eb6b656SMateusz Guzik if (error == 0) { 9246dfe0a3dSMartin Matuska path = g_path; 9256dfe0a3dSMartin Matuska } else { 926f6e633a9SMartin Matuska /* exit on other errors */ 927b38ff370SJamie Gritton goto done_free; 928b38ff370SJamie Gritton } 929f6e633a9SMartin Matuska if (root->v_type != VDIR) { 930f6e633a9SMartin Matuska error = ENOTDIR; 931f6e633a9SMartin Matuska vput(root); 932f6e633a9SMartin Matuska goto done_free; 933f6e633a9SMartin Matuska } 934b249ce48SMateusz Guzik VOP_UNLOCK(root); 935b38ff370SJamie Gritton } 936b38ff370SJamie Gritton 937b38ff370SJamie Gritton /* 938b6f47c23SJamie Gritton * Find the specified jail, or at least its parent. 939b38ff370SJamie Gritton * This abuses the file error codes ENOENT and EEXIST. 940b38ff370SJamie Gritton */ 941b38ff370SJamie Gritton pr = NULL; 942b6f47c23SJamie Gritton ppr = mypr; 943babbbb9cSJamie Gritton if (cuflags == JAIL_CREATE && jid == 0 && name != NULL) { 944babbbb9cSJamie Gritton namelc = strrchr(name, '.'); 945babbbb9cSJamie Gritton jid = strtoul(namelc != NULL ? namelc + 1 : name, &p, 10); 946babbbb9cSJamie Gritton if (*p != '\0') 947babbbb9cSJamie Gritton jid = 0; 948babbbb9cSJamie Gritton } 949b6f47c23SJamie Gritton sx_xlock(&allprison_lock); 950b38ff370SJamie Gritton if (jid != 0) { 9510304c731SJamie Gritton /* 9520304c731SJamie Gritton * See if a requested jid already exists. There is an 9530304c731SJamie Gritton * information leak here if the jid exists but is not within 9540304c731SJamie Gritton * the caller's jail hierarchy. Jail creators will get EEXIST 9550304c731SJamie Gritton * even though they cannot see the jail, and CREATE | UPDATE 9560304c731SJamie Gritton * will return ENOENT which is not normally a valid error. 9570304c731SJamie Gritton */ 958b38ff370SJamie Gritton if (jid < 0) { 959b38ff370SJamie Gritton error = EINVAL; 960b38ff370SJamie Gritton vfs_opterror(opts, "negative jid"); 961b38ff370SJamie Gritton goto done_unlock_list; 962b38ff370SJamie Gritton } 963b38ff370SJamie Gritton pr = prison_find(jid); 964b38ff370SJamie Gritton if (pr != NULL) { 9650304c731SJamie Gritton ppr = pr->pr_parent; 966b38ff370SJamie Gritton /* Create: jid must not exist. */ 967b38ff370SJamie Gritton if (cuflags == JAIL_CREATE) { 968b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 969b38ff370SJamie Gritton error = EEXIST; 970b38ff370SJamie Gritton vfs_opterror(opts, "jail %d already exists", 971b38ff370SJamie Gritton jid); 972b38ff370SJamie Gritton goto done_unlock_list; 973b38ff370SJamie Gritton } 9740304c731SJamie Gritton if (!prison_ischild(mypr, pr)) { 9750304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 9760304c731SJamie Gritton pr = NULL; 9770304c731SJamie Gritton } else if (pr->pr_uref == 0) { 978b38ff370SJamie Gritton if (!(flags & JAIL_DYING)) { 979b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 980b38ff370SJamie Gritton error = ENOENT; 981b38ff370SJamie Gritton vfs_opterror(opts, "jail %d is dying", 982b38ff370SJamie Gritton jid); 983b38ff370SJamie Gritton goto done_unlock_list; 984b38ff370SJamie Gritton } else if ((flags & JAIL_ATTACH) || 985b38ff370SJamie Gritton (pr_flags & PR_PERSIST)) { 986b38ff370SJamie Gritton /* 987b38ff370SJamie Gritton * A dying jail might be resurrected 988b38ff370SJamie Gritton * (via attach or persist), but first 989b38ff370SJamie Gritton * it must determine if another jail 990b38ff370SJamie Gritton * has claimed its name. Accomplish 991b38ff370SJamie Gritton * this by implicitly re-setting the 992b38ff370SJamie Gritton * name. 993b38ff370SJamie Gritton */ 994b38ff370SJamie Gritton if (name == NULL) 9950304c731SJamie Gritton name = prison_name(mypr, pr); 996b38ff370SJamie Gritton } 997b38ff370SJamie Gritton } 998b38ff370SJamie Gritton } 999b38ff370SJamie Gritton if (pr == NULL) { 1000b38ff370SJamie Gritton /* Update: jid must exist. */ 1001b38ff370SJamie Gritton if (cuflags == JAIL_UPDATE) { 1002b38ff370SJamie Gritton error = ENOENT; 1003b38ff370SJamie Gritton vfs_opterror(opts, "jail %d not found", jid); 1004b38ff370SJamie Gritton goto done_unlock_list; 1005b38ff370SJamie Gritton } 1006b38ff370SJamie Gritton } 1007b38ff370SJamie Gritton } 1008b38ff370SJamie Gritton /* 1009b38ff370SJamie Gritton * If the caller provided a name, look for a jail by that name. 1010b38ff370SJamie Gritton * This has different semantics for creates and updates keyed by jid 1011b38ff370SJamie Gritton * (where the name must not already exist in a different jail), 1012b38ff370SJamie Gritton * and updates keyed by the name itself (where the name must exist 1013b38ff370SJamie Gritton * because that is the jail being updated). 1014b38ff370SJamie Gritton */ 1015b6f47c23SJamie Gritton namelc = NULL; 1016b38ff370SJamie Gritton if (name != NULL) { 1017babbbb9cSJamie Gritton namelc = strrchr(name, '.'); 1018babbbb9cSJamie Gritton if (namelc == NULL) 1019babbbb9cSJamie Gritton namelc = name; 1020babbbb9cSJamie Gritton else { 10210304c731SJamie Gritton /* 10220304c731SJamie Gritton * This is a hierarchical name. Split it into the 10230304c731SJamie Gritton * parent and child names, and make sure the parent 10240304c731SJamie Gritton * exists or matches an already found jail. 10250304c731SJamie Gritton */ 10260304c731SJamie Gritton if (pr != NULL) { 1027babbbb9cSJamie Gritton if (strncmp(name, ppr->pr_name, namelc - name) 1028babbbb9cSJamie Gritton || ppr->pr_name[namelc - name] != '\0') { 10290304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 10300304c731SJamie Gritton error = EINVAL; 10310304c731SJamie Gritton vfs_opterror(opts, 10320304c731SJamie Gritton "cannot change jail's parent"); 10330304c731SJamie Gritton goto done_unlock_list; 10340304c731SJamie Gritton } 10350304c731SJamie Gritton } else { 1036b6f47c23SJamie Gritton *namelc = '\0'; 10370304c731SJamie Gritton ppr = prison_find_name(mypr, name); 10380304c731SJamie Gritton if (ppr == NULL) { 10390304c731SJamie Gritton error = ENOENT; 10400304c731SJamie Gritton vfs_opterror(opts, 10410304c731SJamie Gritton "jail \"%s\" not found", name); 10420304c731SJamie Gritton goto done_unlock_list; 10430304c731SJamie Gritton } 10440304c731SJamie Gritton mtx_unlock(&ppr->pr_mtx); 1045b6f47c23SJamie Gritton *namelc = '.'; 10460304c731SJamie Gritton } 1047b6f47c23SJamie Gritton namelc++; 10480304c731SJamie Gritton } 1049b6f47c23SJamie Gritton if (namelc[0] != '\0') { 1050b6f47c23SJamie Gritton pnamelen = 10510304c731SJamie Gritton (ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1; 1052b38ff370SJamie Gritton name_again: 10530304c731SJamie Gritton deadpr = NULL; 10540304c731SJamie Gritton FOREACH_PRISON_CHILD(ppr, tpr) { 1055b38ff370SJamie Gritton if (tpr != pr && tpr->pr_ref > 0 && 1056b6f47c23SJamie Gritton !strcmp(tpr->pr_name + pnamelen, namelc)) { 1057b38ff370SJamie Gritton if (pr == NULL && 1058b38ff370SJamie Gritton cuflags != JAIL_CREATE) { 1059b38ff370SJamie Gritton mtx_lock(&tpr->pr_mtx); 1060b38ff370SJamie Gritton if (tpr->pr_ref > 0) { 1061b38ff370SJamie Gritton /* 1062b38ff370SJamie Gritton * Use this jail 1063b38ff370SJamie Gritton * for updates. 1064b38ff370SJamie Gritton */ 1065b38ff370SJamie Gritton if (tpr->pr_uref > 0) { 1066b38ff370SJamie Gritton pr = tpr; 1067b38ff370SJamie Gritton break; 1068b38ff370SJamie Gritton } 1069b38ff370SJamie Gritton deadpr = tpr; 1070b38ff370SJamie Gritton } 1071b38ff370SJamie Gritton mtx_unlock(&tpr->pr_mtx); 1072b38ff370SJamie Gritton } else if (tpr->pr_uref > 0) { 1073b38ff370SJamie Gritton /* 1074b38ff370SJamie Gritton * Create, or update(jid): 1075b38ff370SJamie Gritton * name must not exist in an 10760304c731SJamie Gritton * active sibling jail. 1077b38ff370SJamie Gritton */ 1078b38ff370SJamie Gritton error = EEXIST; 1079b38ff370SJamie Gritton if (pr != NULL) 1080b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 1081b38ff370SJamie Gritton vfs_opterror(opts, 1082b38ff370SJamie Gritton "jail \"%s\" already exists", 1083b38ff370SJamie Gritton name); 1084b38ff370SJamie Gritton goto done_unlock_list; 1085b38ff370SJamie Gritton } 1086b38ff370SJamie Gritton } 1087b38ff370SJamie Gritton } 1088b38ff370SJamie Gritton /* If no active jail is found, use a dying one. */ 1089b38ff370SJamie Gritton if (deadpr != NULL && pr == NULL) { 1090b38ff370SJamie Gritton if (flags & JAIL_DYING) { 1091b38ff370SJamie Gritton mtx_lock(&deadpr->pr_mtx); 1092b38ff370SJamie Gritton if (deadpr->pr_ref == 0) { 1093b38ff370SJamie Gritton mtx_unlock(&deadpr->pr_mtx); 1094b38ff370SJamie Gritton goto name_again; 1095b38ff370SJamie Gritton } 1096b38ff370SJamie Gritton pr = deadpr; 1097b38ff370SJamie Gritton } else if (cuflags == JAIL_UPDATE) { 1098b38ff370SJamie Gritton error = ENOENT; 1099b38ff370SJamie Gritton vfs_opterror(opts, 1100b38ff370SJamie Gritton "jail \"%s\" is dying", name); 1101b38ff370SJamie Gritton goto done_unlock_list; 1102b38ff370SJamie Gritton } 1103b38ff370SJamie Gritton } 1104b38ff370SJamie Gritton /* Update: name must exist if no jid. */ 1105b38ff370SJamie Gritton else if (cuflags == JAIL_UPDATE && pr == NULL) { 1106b38ff370SJamie Gritton error = ENOENT; 1107b38ff370SJamie Gritton vfs_opterror(opts, "jail \"%s\" not found", 1108b38ff370SJamie Gritton name); 1109b38ff370SJamie Gritton goto done_unlock_list; 1110b38ff370SJamie Gritton } 1111b38ff370SJamie Gritton } 1112b38ff370SJamie Gritton } 1113b38ff370SJamie Gritton /* Update: must provide a jid or name. */ 1114b38ff370SJamie Gritton else if (cuflags == JAIL_UPDATE && pr == NULL) { 1115b38ff370SJamie Gritton error = ENOENT; 1116b38ff370SJamie Gritton vfs_opterror(opts, "update specified no jail"); 1117b38ff370SJamie Gritton goto done_unlock_list; 1118b38ff370SJamie Gritton } 1119b38ff370SJamie Gritton 1120b38ff370SJamie Gritton /* If there's no prison to update, create a new one and link it in. */ 1121b38ff370SJamie Gritton if (pr == NULL) { 1122b97457e2SJamie Gritton for (tpr = mypr; tpr != NULL; tpr = tpr->pr_parent) 1123b97457e2SJamie Gritton if (tpr->pr_childcount >= tpr->pr_childmax) { 1124b97457e2SJamie Gritton error = EPERM; 1125b97457e2SJamie Gritton vfs_opterror(opts, "prison limit exceeded"); 1126b97457e2SJamie Gritton goto done_unlock_list; 1127b97457e2SJamie Gritton } 1128b38ff370SJamie Gritton created = 1; 11290304c731SJamie Gritton mtx_lock(&ppr->pr_mtx); 11302a549507SJamie Gritton if (ppr->pr_ref == 0) { 11310304c731SJamie Gritton mtx_unlock(&ppr->pr_mtx); 11320304c731SJamie Gritton error = ENOENT; 1133b6f47c23SJamie Gritton vfs_opterror(opts, "jail \"%s\" not found", 1134b6f47c23SJamie Gritton prison_name(mypr, ppr)); 11350304c731SJamie Gritton goto done_unlock_list; 11360304c731SJamie Gritton } 11370304c731SJamie Gritton ppr->pr_ref++; 11380304c731SJamie Gritton ppr->pr_uref++; 11390304c731SJamie Gritton mtx_unlock(&ppr->pr_mtx); 1140b38ff370SJamie Gritton pr = malloc(sizeof(*pr), M_PRISON, M_WAITOK | M_ZERO); 1141b38ff370SJamie Gritton if (jid == 0) { 1142b38ff370SJamie Gritton /* Find the next free jid. */ 1143b38ff370SJamie Gritton jid = lastprid + 1; 1144b38ff370SJamie Gritton findnext: 1145b38ff370SJamie Gritton if (jid == JAIL_MAX) 1146b38ff370SJamie Gritton jid = 1; 1147b38ff370SJamie Gritton TAILQ_FOREACH(tpr, &allprison, pr_list) { 1148b38ff370SJamie Gritton if (tpr->pr_id < jid) 1149b38ff370SJamie Gritton continue; 1150b38ff370SJamie Gritton if (tpr->pr_id > jid || tpr->pr_ref == 0) { 1151b38ff370SJamie Gritton TAILQ_INSERT_BEFORE(tpr, pr, pr_list); 1152b38ff370SJamie Gritton break; 1153b38ff370SJamie Gritton } 1154b38ff370SJamie Gritton if (jid == lastprid) { 1155b38ff370SJamie Gritton error = EAGAIN; 1156b38ff370SJamie Gritton vfs_opterror(opts, 1157b38ff370SJamie Gritton "no available jail IDs"); 1158b38ff370SJamie Gritton free(pr, M_PRISON); 11590304c731SJamie Gritton prison_deref(ppr, PD_DEREF | 11600304c731SJamie Gritton PD_DEUREF | PD_LIST_XLOCKED); 11610304c731SJamie Gritton goto done_releroot; 1162b38ff370SJamie Gritton } 1163b38ff370SJamie Gritton jid++; 1164b38ff370SJamie Gritton goto findnext; 1165b38ff370SJamie Gritton } 1166b38ff370SJamie Gritton lastprid = jid; 1167b38ff370SJamie Gritton } else { 1168b38ff370SJamie Gritton /* 1169b38ff370SJamie Gritton * The jail already has a jid (that did not yet exist), 1170b38ff370SJamie Gritton * so just find where to insert it. 1171b38ff370SJamie Gritton */ 1172b38ff370SJamie Gritton TAILQ_FOREACH(tpr, &allprison, pr_list) 1173b38ff370SJamie Gritton if (tpr->pr_id >= jid) { 1174b38ff370SJamie Gritton TAILQ_INSERT_BEFORE(tpr, pr, pr_list); 1175b38ff370SJamie Gritton break; 1176b38ff370SJamie Gritton } 1177b38ff370SJamie Gritton } 1178b38ff370SJamie Gritton if (tpr == NULL) 1179b38ff370SJamie Gritton TAILQ_INSERT_TAIL(&allprison, pr, pr_list); 11800304c731SJamie Gritton LIST_INSERT_HEAD(&ppr->pr_children, pr, pr_sibling); 11810304c731SJamie Gritton for (tpr = ppr; tpr != NULL; tpr = tpr->pr_parent) 1182b97457e2SJamie Gritton tpr->pr_childcount++; 1183b38ff370SJamie Gritton 11840304c731SJamie Gritton pr->pr_parent = ppr; 1185b38ff370SJamie Gritton pr->pr_id = jid; 11860304c731SJamie Gritton 11870304c731SJamie Gritton /* Set some default values, and inherit some from the parent. */ 1188b6f47c23SJamie Gritton if (namelc == NULL) 1189b6f47c23SJamie Gritton namelc = ""; 1190b38ff370SJamie Gritton if (path == NULL) { 1191b38ff370SJamie Gritton path = "/"; 11920304c731SJamie Gritton root = mypr->pr_root; 1193b38ff370SJamie Gritton vref(root); 1194b38ff370SJamie Gritton } 11958986e3a0SJamie Gritton strlcpy(pr->pr_hostuuid, DEFAULT_HOSTUUID, HOSTUUIDLEN); 11968986e3a0SJamie Gritton pr->pr_flags |= PR_HOST; 1197bdfc8cc4SJamie Gritton #if defined(INET) || defined(INET6) 1198bdfc8cc4SJamie Gritton #ifdef VIMAGE 1199bdfc8cc4SJamie Gritton if (!(pr_flags & PR_VNET)) 1200bdfc8cc4SJamie Gritton #endif 1201bdfc8cc4SJamie Gritton { 12020304c731SJamie Gritton #ifdef INET 12032b0d6f81SJamie Gritton if (!(ch_flags & PR_IP4_USER)) 12046a3f2779SJamie Gritton pr->pr_flags |= PR_IP4 | PR_IP4_USER; 12052b0d6f81SJamie Gritton else if (!(pr_flags & PR_IP4_USER)) { 12062b0d6f81SJamie Gritton pr->pr_flags |= ppr->pr_flags & PR_IP4; 12072b0d6f81SJamie Gritton if (ppr->pr_ip4 != NULL) { 12082b0d6f81SJamie Gritton pr->pr_ip4s = ppr->pr_ip4s; 12092b0d6f81SJamie Gritton pr->pr_ip4 = malloc(pr->pr_ip4s * 12102b0d6f81SJamie Gritton sizeof(struct in_addr), M_PRISON, 12112b0d6f81SJamie Gritton M_WAITOK); 12122b0d6f81SJamie Gritton bcopy(ppr->pr_ip4, pr->pr_ip4, 12132b0d6f81SJamie Gritton pr->pr_ip4s * sizeof(*pr->pr_ip4)); 12142b0d6f81SJamie Gritton } 12152b0d6f81SJamie Gritton } 12160304c731SJamie Gritton #endif 12170304c731SJamie Gritton #ifdef INET6 12182b0d6f81SJamie Gritton if (!(ch_flags & PR_IP6_USER)) 12196a3f2779SJamie Gritton pr->pr_flags |= PR_IP6 | PR_IP6_USER; 12202b0d6f81SJamie Gritton else if (!(pr_flags & PR_IP6_USER)) { 12212b0d6f81SJamie Gritton pr->pr_flags |= ppr->pr_flags & PR_IP6; 12222b0d6f81SJamie Gritton if (ppr->pr_ip6 != NULL) { 12232b0d6f81SJamie Gritton pr->pr_ip6s = ppr->pr_ip6s; 12242b0d6f81SJamie Gritton pr->pr_ip6 = malloc(pr->pr_ip6s * 12252b0d6f81SJamie Gritton sizeof(struct in6_addr), M_PRISON, 12262b0d6f81SJamie Gritton M_WAITOK); 12272b0d6f81SJamie Gritton bcopy(ppr->pr_ip6, pr->pr_ip6, 12282b0d6f81SJamie Gritton pr->pr_ip6s * sizeof(*pr->pr_ip6)); 12292b0d6f81SJamie Gritton } 12302b0d6f81SJamie Gritton } 12310304c731SJamie Gritton #endif 1232bdfc8cc4SJamie Gritton } 1233bdfc8cc4SJamie Gritton #endif 1234592bcae8SBjoern A. Zeeb /* Source address selection is always on by default. */ 1235592bcae8SBjoern A. Zeeb pr->pr_flags |= _PR_IP_SADDRSEL; 1236592bcae8SBjoern A. Zeeb 12370304c731SJamie Gritton pr->pr_securelevel = ppr->pr_securelevel; 12380304c731SJamie Gritton pr->pr_allow = JAIL_DEFAULT_ALLOW & ppr->pr_allow; 1239af10bf05SBjoern A. Zeeb pr->pr_enforce_statfs = jail_default_enforce_statfs; 1240bf3db8aaSMartin Matuska pr->pr_devfs_rsnum = ppr->pr_devfs_rsnum; 1241b38ff370SJamie Gritton 1242b96bd95bSIan Lepore pr->pr_osreldate = osreldt ? osreldt : ppr->pr_osreldate; 1243b96bd95bSIan Lepore if (osrelstr == NULL) 1244b96bd95bSIan Lepore strcpy(pr->pr_osrelease, ppr->pr_osrelease); 1245b96bd95bSIan Lepore else 1246b96bd95bSIan Lepore strcpy(pr->pr_osrelease, osrelstr); 1247b96bd95bSIan Lepore 12480304c731SJamie Gritton LIST_INIT(&pr->pr_children); 12490304c731SJamie Gritton mtx_init(&pr->pr_mtx, "jail mutex", NULL, MTX_DEF | MTX_DUPOK); 125073d9e52dSJamie Gritton TASK_INIT(&pr->pr_task, 0, prison_complete, pr); 1251b38ff370SJamie Gritton 1252679e1390SJamie Gritton #ifdef VIMAGE 1253679e1390SJamie Gritton /* Allocate a new vnet if specified. */ 1254679e1390SJamie Gritton pr->pr_vnet = (pr_flags & PR_VNET) 1255679e1390SJamie Gritton ? vnet_alloc() : ppr->pr_vnet; 1256679e1390SJamie Gritton #endif 1257b38ff370SJamie Gritton /* 1258b38ff370SJamie Gritton * Allocate a dedicated cpuset for each jail. 1259b38ff370SJamie Gritton * Unlike other initial settings, this may return an erorr. 1260b38ff370SJamie Gritton */ 12610304c731SJamie Gritton error = cpuset_create_root(ppr, &pr->pr_cpuset); 1262b38ff370SJamie Gritton if (error) { 1263b38ff370SJamie Gritton prison_deref(pr, PD_LIST_XLOCKED); 1264b38ff370SJamie Gritton goto done_releroot; 1265b38ff370SJamie Gritton } 1266b38ff370SJamie Gritton 1267b38ff370SJamie Gritton mtx_lock(&pr->pr_mtx); 1268b38ff370SJamie Gritton /* 1269b38ff370SJamie Gritton * New prisons do not yet have a reference, because we do not 1270b6f47c23SJamie Gritton * want others to see the incomplete prison once the 1271b38ff370SJamie Gritton * allprison_lock is downgraded. 1272b38ff370SJamie Gritton */ 1273b38ff370SJamie Gritton } else { 1274b38ff370SJamie Gritton created = 0; 12752b0d6f81SJamie Gritton /* 12762b0d6f81SJamie Gritton * Grab a reference for existing prisons, to ensure they 12772b0d6f81SJamie Gritton * continue to exist for the duration of the call. 12782b0d6f81SJamie Gritton */ 12792b0d6f81SJamie Gritton pr->pr_ref++; 1280bdfc8cc4SJamie Gritton #if defined(VIMAGE) && (defined(INET) || defined(INET6)) 1281bdfc8cc4SJamie Gritton if ((pr->pr_flags & PR_VNET) && 1282bdfc8cc4SJamie Gritton (ch_flags & (PR_IP4_USER | PR_IP6_USER))) { 1283bdfc8cc4SJamie Gritton error = EINVAL; 1284bdfc8cc4SJamie Gritton vfs_opterror(opts, 1285bdfc8cc4SJamie Gritton "vnet jails cannot have IP address restrictions"); 1286bdfc8cc4SJamie Gritton goto done_deref_locked; 1287bdfc8cc4SJamie Gritton } 1288bdfc8cc4SJamie Gritton #endif 12892b0d6f81SJamie Gritton #ifdef INET 12902b0d6f81SJamie Gritton if (PR_IP4_USER & ch_flags & (pr_flags ^ pr->pr_flags)) { 12912b0d6f81SJamie Gritton error = EINVAL; 12922b0d6f81SJamie Gritton vfs_opterror(opts, 12932b0d6f81SJamie Gritton "ip4 cannot be changed after creation"); 12942b0d6f81SJamie Gritton goto done_deref_locked; 12952b0d6f81SJamie Gritton } 12962b0d6f81SJamie Gritton #endif 12972b0d6f81SJamie Gritton #ifdef INET6 12982b0d6f81SJamie Gritton if (PR_IP6_USER & ch_flags & (pr_flags ^ pr->pr_flags)) { 12992b0d6f81SJamie Gritton error = EINVAL; 13002b0d6f81SJamie Gritton vfs_opterror(opts, 13012b0d6f81SJamie Gritton "ip6 cannot be changed after creation"); 13022b0d6f81SJamie Gritton goto done_deref_locked; 13032b0d6f81SJamie Gritton } 13042b0d6f81SJamie Gritton #endif 1305b38ff370SJamie Gritton } 1306b38ff370SJamie Gritton 1307b38ff370SJamie Gritton /* Do final error checking before setting anything. */ 13080304c731SJamie Gritton if (gotslevel) { 13090304c731SJamie Gritton if (slevel < ppr->pr_securelevel) { 13100304c731SJamie Gritton error = EPERM; 13110304c731SJamie Gritton goto done_deref_locked; 13120304c731SJamie Gritton } 13130304c731SJamie Gritton } 1314b97457e2SJamie Gritton if (gotchildmax) { 1315b97457e2SJamie Gritton if (childmax >= ppr->pr_childmax) { 1316b97457e2SJamie Gritton error = EPERM; 1317b97457e2SJamie Gritton goto done_deref_locked; 1318b97457e2SJamie Gritton } 1319b97457e2SJamie Gritton } 13200304c731SJamie Gritton if (gotenforce) { 13210304c731SJamie Gritton if (enforce < ppr->pr_enforce_statfs) { 13220304c731SJamie Gritton error = EPERM; 13230304c731SJamie Gritton goto done_deref_locked; 13240304c731SJamie Gritton } 13250304c731SJamie Gritton } 13260cc207a6SMartin Matuska if (gotrsnum) { 13270cc207a6SMartin Matuska /* 13280cc207a6SMartin Matuska * devfs_rsnum is a uint16_t 13290cc207a6SMartin Matuska */ 1330bf3db8aaSMartin Matuska if (rsnum < 0 || rsnum > 65535) { 13310cc207a6SMartin Matuska error = EINVAL; 13320cc207a6SMartin Matuska goto done_deref_locked; 13330cc207a6SMartin Matuska } 13340cc207a6SMartin Matuska /* 1335bf3db8aaSMartin Matuska * Nested jails always inherit parent's devfs ruleset 13360cc207a6SMartin Matuska */ 13370cc207a6SMartin Matuska if (jailed(td->td_ucred)) { 13380cc207a6SMartin Matuska if (rsnum > 0 && rsnum != ppr->pr_devfs_rsnum) { 13390cc207a6SMartin Matuska error = EPERM; 13400cc207a6SMartin Matuska goto done_deref_locked; 1341bf3db8aaSMartin Matuska } else 13420cc207a6SMartin Matuska rsnum = ppr->pr_devfs_rsnum; 13430cc207a6SMartin Matuska } 13440cc207a6SMartin Matuska } 1345b38ff370SJamie Gritton #ifdef INET 13462b0d6f81SJamie Gritton if (ip4s > 0) { 13470304c731SJamie Gritton if (ppr->pr_flags & PR_IP4) { 13480304c731SJamie Gritton /* 13490304c731SJamie Gritton * Make sure the new set of IP addresses is a 13500304c731SJamie Gritton * subset of the parent's list. Don't worry 13510304c731SJamie Gritton * about the parent being unlocked, as any 13520304c731SJamie Gritton * setting is done with allprison_lock held. 13530304c731SJamie Gritton */ 13540304c731SJamie Gritton for (ij = 0; ij < ppr->pr_ip4s; ij++) 13552b0d6f81SJamie Gritton if (ip4[0].s_addr == ppr->pr_ip4[ij].s_addr) 13560304c731SJamie Gritton break; 13570304c731SJamie Gritton if (ij == ppr->pr_ip4s) { 13580304c731SJamie Gritton error = EPERM; 13590304c731SJamie Gritton goto done_deref_locked; 13600304c731SJamie Gritton } 13610304c731SJamie Gritton if (ip4s > 1) { 13620304c731SJamie Gritton for (ii = ij = 1; ii < ip4s; ii++) { 13630304c731SJamie Gritton if (ip4[ii].s_addr == 13640304c731SJamie Gritton ppr->pr_ip4[0].s_addr) 1365b38ff370SJamie Gritton continue; 13660304c731SJamie Gritton for (; ij < ppr->pr_ip4s; ij++) 13670304c731SJamie Gritton if (ip4[ii].s_addr == 13680304c731SJamie Gritton ppr->pr_ip4[ij].s_addr) 13690304c731SJamie Gritton break; 13700304c731SJamie Gritton if (ij == ppr->pr_ip4s) 13710304c731SJamie Gritton break; 13720304c731SJamie Gritton } 13730304c731SJamie Gritton if (ij == ppr->pr_ip4s) { 13740304c731SJamie Gritton error = EPERM; 13750304c731SJamie Gritton goto done_deref_locked; 13760304c731SJamie Gritton } 13770304c731SJamie Gritton } 13780304c731SJamie Gritton } 13790304c731SJamie Gritton /* 13800304c731SJamie Gritton * Check for conflicting IP addresses. We permit them 13810304c731SJamie Gritton * if there is no more than one IP on each jail. If 13820304c731SJamie Gritton * there is a duplicate on a jail with more than one 13830304c731SJamie Gritton * IP stop checking and return error. 13840304c731SJamie Gritton */ 1385bdfc8cc4SJamie Gritton #ifdef VIMAGE 138608b43333SJamie Gritton for (tppr = ppr; tppr != &prison0; tppr = tppr->pr_parent) 1387bdfc8cc4SJamie Gritton if (tppr->pr_flags & PR_VNET) 1388bdfc8cc4SJamie Gritton break; 138908b43333SJamie Gritton #else 139008b43333SJamie Gritton tppr = &prison0; 1391bdfc8cc4SJamie Gritton #endif 1392bdfc8cc4SJamie Gritton FOREACH_PRISON_DESCENDANT(tppr, tpr, descend) { 1393bdfc8cc4SJamie Gritton if (tpr == pr || 1394bdfc8cc4SJamie Gritton #ifdef VIMAGE 13952b0d6f81SJamie Gritton (tpr != tppr && (tpr->pr_flags & PR_VNET)) || 1396bdfc8cc4SJamie Gritton #endif 1397bdfc8cc4SJamie Gritton tpr->pr_uref == 0) { 13980304c731SJamie Gritton descend = 0; 13990304c731SJamie Gritton continue; 14000304c731SJamie Gritton } 14010304c731SJamie Gritton if (!(tpr->pr_flags & PR_IP4_USER)) 14020304c731SJamie Gritton continue; 14030304c731SJamie Gritton descend = 0; 14040304c731SJamie Gritton if (tpr->pr_ip4 == NULL || 14050304c731SJamie Gritton (ip4s == 1 && tpr->pr_ip4s == 1)) 14060304c731SJamie Gritton continue; 14070304c731SJamie Gritton for (ii = 0; ii < ip4s; ii++) { 14080ce1624dSStephen J. Kiernan if (prison_check_ip4_locked(tpr, &ip4[ii]) == 14090ce1624dSStephen J. Kiernan 0) { 14100304c731SJamie Gritton error = EADDRINUSE; 1411b38ff370SJamie Gritton vfs_opterror(opts, 1412b38ff370SJamie Gritton "IPv4 addresses clash"); 1413b38ff370SJamie Gritton goto done_deref_locked; 1414b38ff370SJamie Gritton } 14150304c731SJamie Gritton } 14160304c731SJamie Gritton } 14170304c731SJamie Gritton } 1418b38ff370SJamie Gritton #endif 1419b38ff370SJamie Gritton #ifdef INET6 14202b0d6f81SJamie Gritton if (ip6s > 0) { 14210304c731SJamie Gritton if (ppr->pr_flags & PR_IP6) { 14220304c731SJamie Gritton /* 14230304c731SJamie Gritton * Make sure the new set of IP addresses is a 14240304c731SJamie Gritton * subset of the parent's list. 14250304c731SJamie Gritton */ 14260304c731SJamie Gritton for (ij = 0; ij < ppr->pr_ip6s; ij++) 14270304c731SJamie Gritton if (IN6_ARE_ADDR_EQUAL(&ip6[0], 14280304c731SJamie Gritton &ppr->pr_ip6[ij])) 14290304c731SJamie Gritton break; 14300304c731SJamie Gritton if (ij == ppr->pr_ip6s) { 14310304c731SJamie Gritton error = EPERM; 14320304c731SJamie Gritton goto done_deref_locked; 14330304c731SJamie Gritton } 14340304c731SJamie Gritton if (ip6s > 1) { 14350304c731SJamie Gritton for (ii = ij = 1; ii < ip6s; ii++) { 14360304c731SJamie Gritton if (IN6_ARE_ADDR_EQUAL(&ip6[ii], 14370304c731SJamie Gritton &ppr->pr_ip6[0])) 14380304c731SJamie Gritton continue; 14390304c731SJamie Gritton for (; ij < ppr->pr_ip6s; ij++) 14400304c731SJamie Gritton if (IN6_ARE_ADDR_EQUAL( 14412b0d6f81SJamie Gritton &ip6[ii], &ppr->pr_ip6[ij])) 14420304c731SJamie Gritton break; 14430304c731SJamie Gritton if (ij == ppr->pr_ip6s) 14440304c731SJamie Gritton break; 14450304c731SJamie Gritton } 14460304c731SJamie Gritton if (ij == ppr->pr_ip6s) { 14470304c731SJamie Gritton error = EPERM; 14480304c731SJamie Gritton goto done_deref_locked; 14490304c731SJamie Gritton } 14500304c731SJamie Gritton } 14510304c731SJamie Gritton } 14520304c731SJamie Gritton /* Check for conflicting IP addresses. */ 1453bdfc8cc4SJamie Gritton #ifdef VIMAGE 145408b43333SJamie Gritton for (tppr = ppr; tppr != &prison0; tppr = tppr->pr_parent) 1455bdfc8cc4SJamie Gritton if (tppr->pr_flags & PR_VNET) 1456bdfc8cc4SJamie Gritton break; 145708b43333SJamie Gritton #else 145808b43333SJamie Gritton tppr = &prison0; 1459bdfc8cc4SJamie Gritton #endif 1460bdfc8cc4SJamie Gritton FOREACH_PRISON_DESCENDANT(tppr, tpr, descend) { 1461bdfc8cc4SJamie Gritton if (tpr == pr || 1462bdfc8cc4SJamie Gritton #ifdef VIMAGE 14632b0d6f81SJamie Gritton (tpr != tppr && (tpr->pr_flags & PR_VNET)) || 1464bdfc8cc4SJamie Gritton #endif 1465bdfc8cc4SJamie Gritton tpr->pr_uref == 0) { 14660304c731SJamie Gritton descend = 0; 14670304c731SJamie Gritton continue; 14680304c731SJamie Gritton } 14690304c731SJamie Gritton if (!(tpr->pr_flags & PR_IP6_USER)) 14700304c731SJamie Gritton continue; 14710304c731SJamie Gritton descend = 0; 14720304c731SJamie Gritton if (tpr->pr_ip6 == NULL || 14730304c731SJamie Gritton (ip6s == 1 && tpr->pr_ip6s == 1)) 14740304c731SJamie Gritton continue; 14750304c731SJamie Gritton for (ii = 0; ii < ip6s; ii++) { 14760ce1624dSStephen J. Kiernan if (prison_check_ip6_locked(tpr, &ip6[ii]) == 14770ce1624dSStephen J. Kiernan 0) { 14780304c731SJamie Gritton error = EADDRINUSE; 1479b38ff370SJamie Gritton vfs_opterror(opts, 1480b38ff370SJamie Gritton "IPv6 addresses clash"); 1481b38ff370SJamie Gritton goto done_deref_locked; 1482b38ff370SJamie Gritton } 14830304c731SJamie Gritton } 14840304c731SJamie Gritton } 14850304c731SJamie Gritton } 1486b38ff370SJamie Gritton #endif 14870304c731SJamie Gritton onamelen = namelen = 0; 1488b6f47c23SJamie Gritton if (namelc != NULL) { 14896ab6058eSJamie Gritton /* Give a default name of the jid. Also allow the name to be 14906ab6058eSJamie Gritton * explicitly the jid - but not any other number, and only in 14916ab6058eSJamie Gritton * normal form (no leading zero/etc). 14926ab6058eSJamie Gritton */ 1493b6f47c23SJamie Gritton if (namelc[0] == '\0') 1494b6f47c23SJamie Gritton snprintf(namelc = numbuf, sizeof(numbuf), "%d", jid); 14956ab6058eSJamie Gritton else if ((strtoul(namelc, &p, 10) != jid || 14966ab6058eSJamie Gritton namelc[0] < '1' || namelc[0] > '9') && *p == '\0') { 1497b38ff370SJamie Gritton error = EINVAL; 1498babbbb9cSJamie Gritton vfs_opterror(opts, 1499babbbb9cSJamie Gritton "name cannot be numeric (unless it is the jid)"); 15000304c731SJamie Gritton goto done_deref_locked; 1501b38ff370SJamie Gritton } 1502b38ff370SJamie Gritton /* 15030304c731SJamie Gritton * Make sure the name isn't too long for the prison or its 15040304c731SJamie Gritton * children. 1505b38ff370SJamie Gritton */ 1506b6f47c23SJamie Gritton pnamelen = (ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1; 1507b6f47c23SJamie Gritton onamelen = strlen(pr->pr_name + pnamelen); 1508b6f47c23SJamie Gritton namelen = strlen(namelc); 1509b6f47c23SJamie Gritton if (pnamelen + namelen + 1 > sizeof(pr->pr_name)) { 15100304c731SJamie Gritton error = ENAMETOOLONG; 15110304c731SJamie Gritton goto done_deref_locked; 15120304c731SJamie Gritton } 15130304c731SJamie Gritton FOREACH_PRISON_DESCENDANT(pr, tpr, descend) { 15140304c731SJamie Gritton if (strlen(tpr->pr_name) + (namelen - onamelen) >= 15150304c731SJamie Gritton sizeof(pr->pr_name)) { 15160304c731SJamie Gritton error = ENAMETOOLONG; 15170304c731SJamie Gritton goto done_deref_locked; 15180304c731SJamie Gritton } 15190304c731SJamie Gritton } 15200304c731SJamie Gritton } 1521b3079544SJamie Gritton pr_allow_diff = pr_allow & ~ppr->pr_allow; 1522b3079544SJamie Gritton if (pr_allow_diff & ~PR_ALLOW_DIFFERENCES) { 15230304c731SJamie Gritton error = EPERM; 15240304c731SJamie Gritton goto done_deref_locked; 1525b38ff370SJamie Gritton } 1526b38ff370SJamie Gritton 1527b6f47c23SJamie Gritton /* 1528b6f47c23SJamie Gritton * Let modules check their parameters. This requires unlocking and 1529b6f47c23SJamie Gritton * then re-locking the prison, but this is still a valid state as long 1530b6f47c23SJamie Gritton * as allprison_lock remains xlocked. 1531b6f47c23SJamie Gritton */ 1532b6f47c23SJamie Gritton mtx_unlock(&pr->pr_mtx); 1533b6f47c23SJamie Gritton error = osd_jail_call(pr, PR_METHOD_CHECK, opts); 1534b6f47c23SJamie Gritton if (error != 0) { 1535b6f47c23SJamie Gritton prison_deref(pr, created 1536b6f47c23SJamie Gritton ? PD_LIST_XLOCKED 1537b6f47c23SJamie Gritton : PD_DEREF | PD_LIST_XLOCKED); 1538b6f47c23SJamie Gritton goto done_releroot; 1539b6f47c23SJamie Gritton } 1540b6f47c23SJamie Gritton mtx_lock(&pr->pr_mtx); 1541b6f47c23SJamie Gritton 1542b6f47c23SJamie Gritton /* At this point, all valid parameters should have been noted. */ 1543b6f47c23SJamie Gritton TAILQ_FOREACH(opt, opts, link) { 1544b6f47c23SJamie Gritton if (!opt->seen && strcmp(opt->name, "errmsg")) { 1545b6f47c23SJamie Gritton error = EINVAL; 1546b6f47c23SJamie Gritton vfs_opterror(opts, "unknown parameter: %s", opt->name); 1547b6f47c23SJamie Gritton goto done_deref_locked; 1548b6f47c23SJamie Gritton } 1549b6f47c23SJamie Gritton } 1550b6f47c23SJamie Gritton 1551b38ff370SJamie Gritton /* Set the parameters of the prison. */ 1552b38ff370SJamie Gritton #ifdef INET 15530304c731SJamie Gritton redo_ip4 = 0; 15540304c731SJamie Gritton if (pr_flags & PR_IP4_USER) { 15550304c731SJamie Gritton pr->pr_flags |= PR_IP4; 1556b38ff370SJamie Gritton free(pr->pr_ip4, M_PRISON); 15570304c731SJamie Gritton pr->pr_ip4s = ip4s; 1558b38ff370SJamie Gritton pr->pr_ip4 = ip4; 1559b38ff370SJamie Gritton ip4 = NULL; 15600304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 1561bdfc8cc4SJamie Gritton #ifdef VIMAGE 1562bdfc8cc4SJamie Gritton if (tpr->pr_flags & PR_VNET) { 1563bdfc8cc4SJamie Gritton descend = 0; 1564bdfc8cc4SJamie Gritton continue; 1565bdfc8cc4SJamie Gritton } 1566bdfc8cc4SJamie Gritton #endif 15670304c731SJamie Gritton if (prison_restrict_ip4(tpr, NULL)) { 15680304c731SJamie Gritton redo_ip4 = 1; 15690304c731SJamie Gritton descend = 0; 15700304c731SJamie Gritton } 15710304c731SJamie Gritton } 15720304c731SJamie Gritton } 1573b38ff370SJamie Gritton #endif 1574b38ff370SJamie Gritton #ifdef INET6 15750304c731SJamie Gritton redo_ip6 = 0; 15760304c731SJamie Gritton if (pr_flags & PR_IP6_USER) { 15770304c731SJamie Gritton pr->pr_flags |= PR_IP6; 1578b38ff370SJamie Gritton free(pr->pr_ip6, M_PRISON); 15790304c731SJamie Gritton pr->pr_ip6s = ip6s; 1580b38ff370SJamie Gritton pr->pr_ip6 = ip6; 1581b38ff370SJamie Gritton ip6 = NULL; 15820304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 1583bdfc8cc4SJamie Gritton #ifdef VIMAGE 1584bdfc8cc4SJamie Gritton if (tpr->pr_flags & PR_VNET) { 1585bdfc8cc4SJamie Gritton descend = 0; 1586bdfc8cc4SJamie Gritton continue; 1587bdfc8cc4SJamie Gritton } 1588bdfc8cc4SJamie Gritton #endif 15890304c731SJamie Gritton if (prison_restrict_ip6(tpr, NULL)) { 15900304c731SJamie Gritton redo_ip6 = 1; 15910304c731SJamie Gritton descend = 0; 15920304c731SJamie Gritton } 15930304c731SJamie Gritton } 15940304c731SJamie Gritton } 1595b38ff370SJamie Gritton #endif 15960304c731SJamie Gritton if (gotslevel) { 1597b38ff370SJamie Gritton pr->pr_securelevel = slevel; 15980304c731SJamie Gritton /* Set all child jails to be at least this level. */ 15990304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) 16000304c731SJamie Gritton if (tpr->pr_securelevel < slevel) 16010304c731SJamie Gritton tpr->pr_securelevel = slevel; 16020304c731SJamie Gritton } 1603b97457e2SJamie Gritton if (gotchildmax) { 1604b97457e2SJamie Gritton pr->pr_childmax = childmax; 1605b97457e2SJamie Gritton /* Set all child jails to under this limit. */ 1606b97457e2SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED_LEVEL(pr, tpr, descend, level) 1607b97457e2SJamie Gritton if (tpr->pr_childmax > childmax - level) 1608b97457e2SJamie Gritton tpr->pr_childmax = childmax > level 1609b97457e2SJamie Gritton ? childmax - level : 0; 1610b97457e2SJamie Gritton } 16110304c731SJamie Gritton if (gotenforce) { 16120304c731SJamie Gritton pr->pr_enforce_statfs = enforce; 16130304c731SJamie Gritton /* Pass this restriction on to the children. */ 16140304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) 16150304c731SJamie Gritton if (tpr->pr_enforce_statfs < enforce) 16160304c731SJamie Gritton tpr->pr_enforce_statfs = enforce; 16170304c731SJamie Gritton } 16180cc207a6SMartin Matuska if (gotrsnum) { 16190cc207a6SMartin Matuska pr->pr_devfs_rsnum = rsnum; 16200cc207a6SMartin Matuska /* Pass this restriction on to the children. */ 16210cc207a6SMartin Matuska FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) 16220cc207a6SMartin Matuska tpr->pr_devfs_rsnum = rsnum; 16230cc207a6SMartin Matuska } 1624b6f47c23SJamie Gritton if (namelc != NULL) { 16250304c731SJamie Gritton if (ppr == &prison0) 1626b6f47c23SJamie Gritton strlcpy(pr->pr_name, namelc, sizeof(pr->pr_name)); 16270304c731SJamie Gritton else 16280304c731SJamie Gritton snprintf(pr->pr_name, sizeof(pr->pr_name), "%s.%s", 1629b6f47c23SJamie Gritton ppr->pr_name, namelc); 16300304c731SJamie Gritton /* Change this component of child names. */ 16310304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 16320304c731SJamie Gritton bcopy(tpr->pr_name + onamelen, tpr->pr_name + namelen, 16330304c731SJamie Gritton strlen(tpr->pr_name + onamelen) + 1); 16340304c731SJamie Gritton bcopy(pr->pr_name, tpr->pr_name, namelen); 16350304c731SJamie Gritton } 16360304c731SJamie Gritton } 1637b38ff370SJamie Gritton if (path != NULL) { 16380304c731SJamie Gritton /* Try to keep a real-rooted full pathname. */ 1639b38ff370SJamie Gritton strlcpy(pr->pr_path, path, sizeof(pr->pr_path)); 1640b38ff370SJamie Gritton pr->pr_root = root; 1641b38ff370SJamie Gritton } 164276ca6f88SJamie Gritton if (PR_HOST & ch_flags & ~pr_flags) { 164376ca6f88SJamie Gritton if (pr->pr_flags & PR_HOST) { 164476ca6f88SJamie Gritton /* 164576ca6f88SJamie Gritton * Copy the parent's host info. As with pr_ip4 above, 164676ca6f88SJamie Gritton * the lack of a lock on the parent is not a problem; 164776ca6f88SJamie Gritton * it is always set with allprison_lock at least 164876ca6f88SJamie Gritton * shared, and is held exclusively here. 164976ca6f88SJamie Gritton */ 1650c1f19219SJamie Gritton strlcpy(pr->pr_hostname, pr->pr_parent->pr_hostname, 1651c1f19219SJamie Gritton sizeof(pr->pr_hostname)); 1652c1f19219SJamie Gritton strlcpy(pr->pr_domainname, pr->pr_parent->pr_domainname, 1653c1f19219SJamie Gritton sizeof(pr->pr_domainname)); 1654c1f19219SJamie Gritton strlcpy(pr->pr_hostuuid, pr->pr_parent->pr_hostuuid, 1655c1f19219SJamie Gritton sizeof(pr->pr_hostuuid)); 165676ca6f88SJamie Gritton pr->pr_hostid = pr->pr_parent->pr_hostid; 165776ca6f88SJamie Gritton } 165876ca6f88SJamie Gritton } else if (host != NULL || domain != NULL || uuid != NULL || gothid) { 165976ca6f88SJamie Gritton /* Set this prison, and any descendants without PR_HOST. */ 1660b38ff370SJamie Gritton if (host != NULL) 1661c1f19219SJamie Gritton strlcpy(pr->pr_hostname, host, sizeof(pr->pr_hostname)); 166276ca6f88SJamie Gritton if (domain != NULL) 1663c1f19219SJamie Gritton strlcpy(pr->pr_domainname, domain, 1664c1f19219SJamie Gritton sizeof(pr->pr_domainname)); 166576ca6f88SJamie Gritton if (uuid != NULL) 1666c1f19219SJamie Gritton strlcpy(pr->pr_hostuuid, uuid, sizeof(pr->pr_hostuuid)); 166776ca6f88SJamie Gritton if (gothid) 166876ca6f88SJamie Gritton pr->pr_hostid = hid; 166976ca6f88SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 167076ca6f88SJamie Gritton if (tpr->pr_flags & PR_HOST) 167176ca6f88SJamie Gritton descend = 0; 167276ca6f88SJamie Gritton else { 167376ca6f88SJamie Gritton if (host != NULL) 1674c1f19219SJamie Gritton strlcpy(tpr->pr_hostname, 1675c1f19219SJamie Gritton pr->pr_hostname, 1676c1f19219SJamie Gritton sizeof(tpr->pr_hostname)); 167776ca6f88SJamie Gritton if (domain != NULL) 1678c1f19219SJamie Gritton strlcpy(tpr->pr_domainname, 1679c1f19219SJamie Gritton pr->pr_domainname, 1680c1f19219SJamie Gritton sizeof(tpr->pr_domainname)); 168176ca6f88SJamie Gritton if (uuid != NULL) 1682c1f19219SJamie Gritton strlcpy(tpr->pr_hostuuid, 1683c1f19219SJamie Gritton pr->pr_hostuuid, 1684c1f19219SJamie Gritton sizeof(tpr->pr_hostuuid)); 168576ca6f88SJamie Gritton if (gothid) 168676ca6f88SJamie Gritton tpr->pr_hostid = hid; 168776ca6f88SJamie Gritton } 168876ca6f88SJamie Gritton } 168976ca6f88SJamie Gritton } 16900304c731SJamie Gritton if ((tallow = ch_allow & ~pr_allow)) { 16910304c731SJamie Gritton /* Clear allow bits in all children. */ 16920304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) 16930304c731SJamie Gritton tpr->pr_allow &= ~tallow; 16940304c731SJamie Gritton } 16950304c731SJamie Gritton pr->pr_allow = (pr->pr_allow & ~ch_allow) | pr_allow; 1696b38ff370SJamie Gritton /* 1697b38ff370SJamie Gritton * Persistent prisons get an extra reference, and prisons losing their 1698b38ff370SJamie Gritton * persist flag lose that reference. Only do this for existing prisons 1699b38ff370SJamie Gritton * for now, so new ones will remain unseen until after the module 1700b38ff370SJamie Gritton * handlers have completed. 1701b38ff370SJamie Gritton */ 1702cc5fd8c7SJamie Gritton born = pr->pr_uref == 0; 1703b38ff370SJamie Gritton if (!created && (ch_flags & PR_PERSIST & (pr_flags ^ pr->pr_flags))) { 1704b38ff370SJamie Gritton if (pr_flags & PR_PERSIST) { 1705b38ff370SJamie Gritton pr->pr_ref++; 1706b38ff370SJamie Gritton pr->pr_uref++; 1707b38ff370SJamie Gritton } else { 1708b38ff370SJamie Gritton pr->pr_ref--; 1709b38ff370SJamie Gritton pr->pr_uref--; 1710b38ff370SJamie Gritton } 1711b38ff370SJamie Gritton } 1712b38ff370SJamie Gritton pr->pr_flags = (pr->pr_flags & ~ch_flags) | pr_flags; 1713b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 1714b38ff370SJamie Gritton 1715a7ad07bfSEdward Tomasz Napierala #ifdef RACCT 17164b5c9cf6SEdward Tomasz Napierala if (racct_enable && created) 1717a7ad07bfSEdward Tomasz Napierala prison_racct_attach(pr); 1718a7ad07bfSEdward Tomasz Napierala #endif 1719a7ad07bfSEdward Tomasz Napierala 17200304c731SJamie Gritton /* Locks may have prevented a complete restriction of child IP 17210304c731SJamie Gritton * addresses. If so, allocate some more memory and try again. 17220304c731SJamie Gritton */ 17230304c731SJamie Gritton #ifdef INET 17240304c731SJamie Gritton while (redo_ip4) { 17250304c731SJamie Gritton ip4s = pr->pr_ip4s; 17260304c731SJamie Gritton ip4 = malloc(ip4s * sizeof(*ip4), M_PRISON, M_WAITOK); 17270304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 17280304c731SJamie Gritton redo_ip4 = 0; 17290304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 1730bdfc8cc4SJamie Gritton #ifdef VIMAGE 1731bdfc8cc4SJamie Gritton if (tpr->pr_flags & PR_VNET) { 1732bdfc8cc4SJamie Gritton descend = 0; 1733bdfc8cc4SJamie Gritton continue; 1734bdfc8cc4SJamie Gritton } 1735bdfc8cc4SJamie Gritton #endif 17360304c731SJamie Gritton if (prison_restrict_ip4(tpr, ip4)) { 17370304c731SJamie Gritton if (ip4 != NULL) 17380304c731SJamie Gritton ip4 = NULL; 17390304c731SJamie Gritton else 17400304c731SJamie Gritton redo_ip4 = 1; 17410304c731SJamie Gritton } 17420304c731SJamie Gritton } 17430304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 17440304c731SJamie Gritton } 17450304c731SJamie Gritton #endif 17460304c731SJamie Gritton #ifdef INET6 17470304c731SJamie Gritton while (redo_ip6) { 17480304c731SJamie Gritton ip6s = pr->pr_ip6s; 17490304c731SJamie Gritton ip6 = malloc(ip6s * sizeof(*ip6), M_PRISON, M_WAITOK); 17500304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 17510304c731SJamie Gritton redo_ip6 = 0; 17520304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 1753bdfc8cc4SJamie Gritton #ifdef VIMAGE 1754bdfc8cc4SJamie Gritton if (tpr->pr_flags & PR_VNET) { 1755bdfc8cc4SJamie Gritton descend = 0; 1756bdfc8cc4SJamie Gritton continue; 1757bdfc8cc4SJamie Gritton } 1758bdfc8cc4SJamie Gritton #endif 17590304c731SJamie Gritton if (prison_restrict_ip6(tpr, ip6)) { 17600304c731SJamie Gritton if (ip6 != NULL) 17610304c731SJamie Gritton ip6 = NULL; 17620304c731SJamie Gritton else 17630304c731SJamie Gritton redo_ip6 = 1; 17640304c731SJamie Gritton } 17650304c731SJamie Gritton } 17660304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 17670304c731SJamie Gritton } 17680304c731SJamie Gritton #endif 17690304c731SJamie Gritton 1770b38ff370SJamie Gritton /* Let the modules do their work. */ 1771b38ff370SJamie Gritton sx_downgrade(&allprison_lock); 1772cc5fd8c7SJamie Gritton if (born) { 1773b38ff370SJamie Gritton error = osd_jail_call(pr, PR_METHOD_CREATE, opts); 1774b38ff370SJamie Gritton if (error) { 1775cc5fd8c7SJamie Gritton (void)osd_jail_call(pr, PR_METHOD_REMOVE, NULL); 1776cc5fd8c7SJamie Gritton prison_deref(pr, created 1777cc5fd8c7SJamie Gritton ? PD_LIST_SLOCKED 1778cc5fd8c7SJamie Gritton : PD_DEREF | PD_LIST_SLOCKED); 1779b38ff370SJamie Gritton goto done_errmsg; 1780b38ff370SJamie Gritton } 1781b38ff370SJamie Gritton } 1782b38ff370SJamie Gritton error = osd_jail_call(pr, PR_METHOD_SET, opts); 1783b38ff370SJamie Gritton if (error) { 1784cc5fd8c7SJamie Gritton if (born) 1785cc5fd8c7SJamie Gritton (void)osd_jail_call(pr, PR_METHOD_REMOVE, NULL); 1786b38ff370SJamie Gritton prison_deref(pr, created 1787b38ff370SJamie Gritton ? PD_LIST_SLOCKED 1788b38ff370SJamie Gritton : PD_DEREF | PD_LIST_SLOCKED); 1789b38ff370SJamie Gritton goto done_errmsg; 1790b38ff370SJamie Gritton } 1791b38ff370SJamie Gritton 1792b38ff370SJamie Gritton /* Attach this process to the prison if requested. */ 1793b38ff370SJamie Gritton if (flags & JAIL_ATTACH) { 1794b38ff370SJamie Gritton mtx_lock(&pr->pr_mtx); 1795b38ff370SJamie Gritton error = do_jail_attach(td, pr); 1796b38ff370SJamie Gritton if (error) { 1797b38ff370SJamie Gritton vfs_opterror(opts, "attach failed"); 1798b38ff370SJamie Gritton if (!created) 1799b38ff370SJamie Gritton prison_deref(pr, PD_DEREF); 1800b38ff370SJamie Gritton goto done_errmsg; 1801b38ff370SJamie Gritton } 1802b38ff370SJamie Gritton } 1803b38ff370SJamie Gritton 18041fb24974SEdward Tomasz Napierala #ifdef RACCT 18054b5c9cf6SEdward Tomasz Napierala if (racct_enable && !created) { 1806f514b97bSEdward Tomasz Napierala if (!(flags & JAIL_ATTACH)) 18071fb24974SEdward Tomasz Napierala sx_sunlock(&allprison_lock); 18081fb24974SEdward Tomasz Napierala prison_racct_modify(pr); 1809f514b97bSEdward Tomasz Napierala if (!(flags & JAIL_ATTACH)) 18101fb24974SEdward Tomasz Napierala sx_slock(&allprison_lock); 18111fb24974SEdward Tomasz Napierala } 18121fb24974SEdward Tomasz Napierala #endif 18131fb24974SEdward Tomasz Napierala 18141fb24974SEdward Tomasz Napierala td->td_retval[0] = pr->pr_id; 18151fb24974SEdward Tomasz Napierala 1816b38ff370SJamie Gritton /* 1817b38ff370SJamie Gritton * Now that it is all there, drop the temporary reference from existing 1818b38ff370SJamie Gritton * prisons. Or add a reference to newly created persistent prisons 1819b38ff370SJamie Gritton * (which was not done earlier so that the prison would not be publicly 1820b38ff370SJamie Gritton * visible). 1821b38ff370SJamie Gritton */ 1822b38ff370SJamie Gritton if (!created) { 1823b38ff370SJamie Gritton prison_deref(pr, (flags & JAIL_ATTACH) 1824b38ff370SJamie Gritton ? PD_DEREF 1825b38ff370SJamie Gritton : PD_DEREF | PD_LIST_SLOCKED); 1826b38ff370SJamie Gritton } else { 1827b38ff370SJamie Gritton if (pr_flags & PR_PERSIST) { 1828b38ff370SJamie Gritton mtx_lock(&pr->pr_mtx); 1829b38ff370SJamie Gritton pr->pr_ref++; 1830b38ff370SJamie Gritton pr->pr_uref++; 1831b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 1832b38ff370SJamie Gritton } 1833b38ff370SJamie Gritton if (!(flags & JAIL_ATTACH)) 1834b38ff370SJamie Gritton sx_sunlock(&allprison_lock); 1835b38ff370SJamie Gritton } 1836c34bbd2aSEdward Tomasz Napierala 1837cc5fd8c7SJamie Gritton goto done_free; 1838b38ff370SJamie Gritton 18390304c731SJamie Gritton done_deref_locked: 18400304c731SJamie Gritton prison_deref(pr, created 18410304c731SJamie Gritton ? PD_LOCKED | PD_LIST_XLOCKED 18420304c731SJamie Gritton : PD_DEREF | PD_LOCKED | PD_LIST_XLOCKED); 18430304c731SJamie Gritton goto done_releroot; 1844b38ff370SJamie Gritton done_unlock_list: 1845b38ff370SJamie Gritton sx_xunlock(&allprison_lock); 1846b38ff370SJamie Gritton done_releroot: 18475050aa86SKonstantin Belousov if (root != NULL) 1848b38ff370SJamie Gritton vrele(root); 1849b38ff370SJamie Gritton done_errmsg: 1850b38ff370SJamie Gritton if (error) { 1851176ff3a0SJamie Gritton if (vfs_getopt(opts, "errmsg", (void **)&errmsg, 1852176ff3a0SJamie Gritton &errmsg_len) == 0 && errmsg_len > 0) { 1853b38ff370SJamie Gritton errmsg_pos = 2 * vfs_getopt_pos(opts, "errmsg") + 1; 1854b38ff370SJamie Gritton if (optuio->uio_segflg == UIO_SYSSPACE) 1855b38ff370SJamie Gritton bcopy(errmsg, 1856b38ff370SJamie Gritton optuio->uio_iov[errmsg_pos].iov_base, 1857b38ff370SJamie Gritton errmsg_len); 1858b38ff370SJamie Gritton else 1859b38ff370SJamie Gritton copyout(errmsg, 1860b38ff370SJamie Gritton optuio->uio_iov[errmsg_pos].iov_base, 1861b38ff370SJamie Gritton errmsg_len); 1862b38ff370SJamie Gritton } 1863b38ff370SJamie Gritton } 1864b38ff370SJamie Gritton done_free: 1865b38ff370SJamie Gritton #ifdef INET 1866b38ff370SJamie Gritton free(ip4, M_PRISON); 1867b38ff370SJamie Gritton #endif 1868b38ff370SJamie Gritton #ifdef INET6 1869b38ff370SJamie Gritton free(ip6, M_PRISON); 1870b38ff370SJamie Gritton #endif 18716dfe0a3dSMartin Matuska if (g_path != NULL) 18726dfe0a3dSMartin Matuska free(g_path, M_TEMP); 1873b38ff370SJamie Gritton vfs_freeopts(opts); 1874b38ff370SJamie Gritton return (error); 1875b38ff370SJamie Gritton } 1876b38ff370SJamie Gritton 1877b38ff370SJamie Gritton /* 1878b38ff370SJamie Gritton * struct jail_get_args { 1879b38ff370SJamie Gritton * struct iovec *iovp; 1880b38ff370SJamie Gritton * unsigned int iovcnt; 1881b38ff370SJamie Gritton * int flags; 1882b38ff370SJamie Gritton * }; 1883b38ff370SJamie Gritton */ 1884b38ff370SJamie Gritton int 18858451d0ddSKip Macy sys_jail_get(struct thread *td, struct jail_get_args *uap) 1886b38ff370SJamie Gritton { 1887b38ff370SJamie Gritton struct uio *auio; 1888b38ff370SJamie Gritton int error; 1889b38ff370SJamie Gritton 1890b38ff370SJamie Gritton /* Check that we have an even number of iovecs. */ 1891b38ff370SJamie Gritton if (uap->iovcnt & 1) 1892b38ff370SJamie Gritton return (EINVAL); 1893b38ff370SJamie Gritton 1894b38ff370SJamie Gritton error = copyinuio(uap->iovp, uap->iovcnt, &auio); 1895b38ff370SJamie Gritton if (error) 1896b38ff370SJamie Gritton return (error); 1897b38ff370SJamie Gritton error = kern_jail_get(td, auio, uap->flags); 1898b38ff370SJamie Gritton if (error == 0) 1899b38ff370SJamie Gritton error = copyout(auio->uio_iov, uap->iovp, 1900b38ff370SJamie Gritton uap->iovcnt * sizeof (struct iovec)); 1901b38ff370SJamie Gritton free(auio, M_IOV); 1902b38ff370SJamie Gritton return (error); 1903b38ff370SJamie Gritton } 1904b38ff370SJamie Gritton 1905b38ff370SJamie Gritton int 1906b38ff370SJamie Gritton kern_jail_get(struct thread *td, struct uio *optuio, int flags) 1907b38ff370SJamie Gritton { 1908672756aaSJamie Gritton struct bool_flags *bf; 1909672756aaSJamie Gritton struct jailsys_flags *jsf; 19100304c731SJamie Gritton struct prison *pr, *mypr; 1911b38ff370SJamie Gritton struct vfsopt *opt; 1912b38ff370SJamie Gritton struct vfsoptlist *opts; 1913b38ff370SJamie Gritton char *errmsg, *name; 1914672756aaSJamie Gritton int error, errmsg_len, errmsg_pos, i, jid, len, locked, pos; 1915672756aaSJamie Gritton unsigned f; 1916b38ff370SJamie Gritton 1917b38ff370SJamie Gritton if (flags & ~JAIL_GET_MASK) 1918b38ff370SJamie Gritton return (EINVAL); 1919b38ff370SJamie Gritton 1920b38ff370SJamie Gritton /* Get the parameter list. */ 1921b38ff370SJamie Gritton error = vfs_buildopts(optuio, &opts); 1922b38ff370SJamie Gritton if (error) 1923b38ff370SJamie Gritton return (error); 1924b38ff370SJamie Gritton errmsg_pos = vfs_getopt_pos(opts, "errmsg"); 19250304c731SJamie Gritton mypr = td->td_ucred->cr_prison; 19261e2a13e6SJamie Gritton 1927b38ff370SJamie Gritton /* 1928b38ff370SJamie Gritton * Find the prison specified by one of: lastjid, jid, name. 1929b38ff370SJamie Gritton */ 1930b38ff370SJamie Gritton sx_slock(&allprison_lock); 1931b38ff370SJamie Gritton error = vfs_copyopt(opts, "lastjid", &jid, sizeof(jid)); 1932b38ff370SJamie Gritton if (error == 0) { 1933b38ff370SJamie Gritton TAILQ_FOREACH(pr, &allprison, pr_list) { 19340304c731SJamie Gritton if (pr->pr_id > jid && prison_ischild(mypr, pr)) { 1935b38ff370SJamie Gritton mtx_lock(&pr->pr_mtx); 1936b38ff370SJamie Gritton if (pr->pr_ref > 0 && 1937b38ff370SJamie Gritton (pr->pr_uref > 0 || (flags & JAIL_DYING))) 1938b38ff370SJamie Gritton break; 1939b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 1940b38ff370SJamie Gritton } 1941b38ff370SJamie Gritton } 1942b38ff370SJamie Gritton if (pr != NULL) 1943b38ff370SJamie Gritton goto found_prison; 1944b38ff370SJamie Gritton error = ENOENT; 1945b38ff370SJamie Gritton vfs_opterror(opts, "no jail after %d", jid); 1946b38ff370SJamie Gritton goto done_unlock_list; 1947b38ff370SJamie Gritton } else if (error != ENOENT) 1948b38ff370SJamie Gritton goto done_unlock_list; 1949b38ff370SJamie Gritton 1950b38ff370SJamie Gritton error = vfs_copyopt(opts, "jid", &jid, sizeof(jid)); 1951b38ff370SJamie Gritton if (error == 0) { 1952b38ff370SJamie Gritton if (jid != 0) { 19530304c731SJamie Gritton pr = prison_find_child(mypr, jid); 1954b38ff370SJamie Gritton if (pr != NULL) { 1955b38ff370SJamie Gritton if (pr->pr_uref == 0 && !(flags & JAIL_DYING)) { 1956b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 1957b38ff370SJamie Gritton error = ENOENT; 1958b38ff370SJamie Gritton vfs_opterror(opts, "jail %d is dying", 1959b38ff370SJamie Gritton jid); 1960b38ff370SJamie Gritton goto done_unlock_list; 1961b38ff370SJamie Gritton } 1962b38ff370SJamie Gritton goto found_prison; 1963b38ff370SJamie Gritton } 1964b38ff370SJamie Gritton error = ENOENT; 1965b38ff370SJamie Gritton vfs_opterror(opts, "jail %d not found", jid); 1966b38ff370SJamie Gritton goto done_unlock_list; 1967b38ff370SJamie Gritton } 1968b38ff370SJamie Gritton } else if (error != ENOENT) 1969b38ff370SJamie Gritton goto done_unlock_list; 1970b38ff370SJamie Gritton 1971b38ff370SJamie Gritton error = vfs_getopt(opts, "name", (void **)&name, &len); 1972b38ff370SJamie Gritton if (error == 0) { 1973b38ff370SJamie Gritton if (len == 0 || name[len - 1] != '\0') { 1974b38ff370SJamie Gritton error = EINVAL; 1975b38ff370SJamie Gritton goto done_unlock_list; 1976b38ff370SJamie Gritton } 19770304c731SJamie Gritton pr = prison_find_name(mypr, name); 1978b38ff370SJamie Gritton if (pr != NULL) { 1979b38ff370SJamie Gritton if (pr->pr_uref == 0 && !(flags & JAIL_DYING)) { 1980b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 1981b38ff370SJamie Gritton error = ENOENT; 1982b38ff370SJamie Gritton vfs_opterror(opts, "jail \"%s\" is dying", 1983b38ff370SJamie Gritton name); 1984b38ff370SJamie Gritton goto done_unlock_list; 1985b38ff370SJamie Gritton } 1986b38ff370SJamie Gritton goto found_prison; 1987b38ff370SJamie Gritton } 1988b38ff370SJamie Gritton error = ENOENT; 1989b38ff370SJamie Gritton vfs_opterror(opts, "jail \"%s\" not found", name); 1990b38ff370SJamie Gritton goto done_unlock_list; 1991b38ff370SJamie Gritton } else if (error != ENOENT) 1992b38ff370SJamie Gritton goto done_unlock_list; 1993b38ff370SJamie Gritton 1994b38ff370SJamie Gritton vfs_opterror(opts, "no jail specified"); 1995b38ff370SJamie Gritton error = ENOENT; 1996b38ff370SJamie Gritton goto done_unlock_list; 1997b38ff370SJamie Gritton 1998b38ff370SJamie Gritton found_prison: 1999b38ff370SJamie Gritton /* Get the parameters of the prison. */ 2000b38ff370SJamie Gritton pr->pr_ref++; 2001b38ff370SJamie Gritton locked = PD_LOCKED; 2002b38ff370SJamie Gritton td->td_retval[0] = pr->pr_id; 2003b38ff370SJamie Gritton error = vfs_setopt(opts, "jid", &pr->pr_id, sizeof(pr->pr_id)); 2004b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 2005b38ff370SJamie Gritton goto done_deref; 20060304c731SJamie Gritton i = (pr->pr_parent == mypr) ? 0 : pr->pr_parent->pr_id; 20070304c731SJamie Gritton error = vfs_setopt(opts, "parent", &i, sizeof(i)); 2008b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 2009b38ff370SJamie Gritton goto done_deref; 20100304c731SJamie Gritton error = vfs_setopts(opts, "name", prison_name(mypr, pr)); 20110304c731SJamie Gritton if (error != 0 && error != ENOENT) 20120304c731SJamie Gritton goto done_deref; 20130304c731SJamie Gritton error = vfs_setopt(opts, "cpuset.id", &pr->pr_cpuset->cs_id, 2014b38ff370SJamie Gritton sizeof(pr->pr_cpuset->cs_id)); 2015b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 2016b38ff370SJamie Gritton goto done_deref; 20170304c731SJamie Gritton error = vfs_setopts(opts, "path", prison_path(mypr, pr)); 2018b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 2019b38ff370SJamie Gritton goto done_deref; 2020b38ff370SJamie Gritton #ifdef INET 2021b38ff370SJamie Gritton error = vfs_setopt_part(opts, "ip4.addr", pr->pr_ip4, 2022b38ff370SJamie Gritton pr->pr_ip4s * sizeof(*pr->pr_ip4)); 2023b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 2024b38ff370SJamie Gritton goto done_deref; 2025b38ff370SJamie Gritton #endif 2026b38ff370SJamie Gritton #ifdef INET6 2027b38ff370SJamie Gritton error = vfs_setopt_part(opts, "ip6.addr", pr->pr_ip6, 2028b38ff370SJamie Gritton pr->pr_ip6s * sizeof(*pr->pr_ip6)); 2029b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 2030b38ff370SJamie Gritton goto done_deref; 2031b38ff370SJamie Gritton #endif 2032b38ff370SJamie Gritton error = vfs_setopt(opts, "securelevel", &pr->pr_securelevel, 2033b38ff370SJamie Gritton sizeof(pr->pr_securelevel)); 2034b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 2035b38ff370SJamie Gritton goto done_deref; 2036b97457e2SJamie Gritton error = vfs_setopt(opts, "children.cur", &pr->pr_childcount, 2037b97457e2SJamie Gritton sizeof(pr->pr_childcount)); 2038b97457e2SJamie Gritton if (error != 0 && error != ENOENT) 2039b97457e2SJamie Gritton goto done_deref; 2040b97457e2SJamie Gritton error = vfs_setopt(opts, "children.max", &pr->pr_childmax, 2041b97457e2SJamie Gritton sizeof(pr->pr_childmax)); 2042b97457e2SJamie Gritton if (error != 0 && error != ENOENT) 2043b97457e2SJamie Gritton goto done_deref; 2044c1f19219SJamie Gritton error = vfs_setopts(opts, "host.hostname", pr->pr_hostname); 2045b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 2046b38ff370SJamie Gritton goto done_deref; 2047c1f19219SJamie Gritton error = vfs_setopts(opts, "host.domainname", pr->pr_domainname); 204876ca6f88SJamie Gritton if (error != 0 && error != ENOENT) 204976ca6f88SJamie Gritton goto done_deref; 2050c1f19219SJamie Gritton error = vfs_setopts(opts, "host.hostuuid", pr->pr_hostuuid); 205176ca6f88SJamie Gritton if (error != 0 && error != ENOENT) 205276ca6f88SJamie Gritton goto done_deref; 2053841c0c7eSNathan Whitehorn #ifdef COMPAT_FREEBSD32 2054a5c1afadSDmitry Chagin if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) { 205576ca6f88SJamie Gritton uint32_t hid32 = pr->pr_hostid; 205676ca6f88SJamie Gritton 205776ca6f88SJamie Gritton error = vfs_setopt(opts, "host.hostid", &hid32, sizeof(hid32)); 205876ca6f88SJamie Gritton } else 205976ca6f88SJamie Gritton #endif 206076ca6f88SJamie Gritton error = vfs_setopt(opts, "host.hostid", &pr->pr_hostid, 206176ca6f88SJamie Gritton sizeof(pr->pr_hostid)); 206276ca6f88SJamie Gritton if (error != 0 && error != ENOENT) 206376ca6f88SJamie Gritton goto done_deref; 20640304c731SJamie Gritton error = vfs_setopt(opts, "enforce_statfs", &pr->pr_enforce_statfs, 20650304c731SJamie Gritton sizeof(pr->pr_enforce_statfs)); 20660304c731SJamie Gritton if (error != 0 && error != ENOENT) 20670304c731SJamie Gritton goto done_deref; 20680cc207a6SMartin Matuska error = vfs_setopt(opts, "devfs_ruleset", &pr->pr_devfs_rsnum, 20690cc207a6SMartin Matuska sizeof(pr->pr_devfs_rsnum)); 20700cc207a6SMartin Matuska if (error != 0 && error != ENOENT) 20710cc207a6SMartin Matuska goto done_deref; 2072672756aaSJamie Gritton for (bf = pr_flag_bool; 2073672756aaSJamie Gritton bf < pr_flag_bool + nitems(pr_flag_bool); 2074672756aaSJamie Gritton bf++) { 2075672756aaSJamie Gritton i = (pr->pr_flags & bf->flag) ? 1 : 0; 2076672756aaSJamie Gritton error = vfs_setopt(opts, bf->name, &i, sizeof(i)); 2077b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 2078b38ff370SJamie Gritton goto done_deref; 2079b38ff370SJamie Gritton i = !i; 2080672756aaSJamie Gritton error = vfs_setopt(opts, bf->noname, &i, sizeof(i)); 2081b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 2082b38ff370SJamie Gritton goto done_deref; 20830304c731SJamie Gritton } 2084672756aaSJamie Gritton for (jsf = pr_flag_jailsys; 2085672756aaSJamie Gritton jsf < pr_flag_jailsys + nitems(pr_flag_jailsys); 2086672756aaSJamie Gritton jsf++) { 2087672756aaSJamie Gritton f = pr->pr_flags & (jsf->disable | jsf->new); 2088672756aaSJamie Gritton i = (f != 0 && f == jsf->disable) ? JAIL_SYS_DISABLE 2089672756aaSJamie Gritton : (f == jsf->new) ? JAIL_SYS_NEW 20907cbf7213SJamie Gritton : JAIL_SYS_INHERIT; 2091672756aaSJamie Gritton error = vfs_setopt(opts, jsf->name, &i, sizeof(i)); 20927cbf7213SJamie Gritton if (error != 0 && error != ENOENT) 20937cbf7213SJamie Gritton goto done_deref; 20947cbf7213SJamie Gritton } 2095672756aaSJamie Gritton for (bf = pr_flag_allow; 20960e5c6bd4SJamie Gritton bf < pr_flag_allow + nitems(pr_flag_allow) && bf->flag != 0; 2097672756aaSJamie Gritton bf++) { 2098672756aaSJamie Gritton i = (pr->pr_allow & bf->flag) ? 1 : 0; 2099672756aaSJamie Gritton error = vfs_setopt(opts, bf->name, &i, sizeof(i)); 21000304c731SJamie Gritton if (error != 0 && error != ENOENT) 21010304c731SJamie Gritton goto done_deref; 21020304c731SJamie Gritton i = !i; 2103672756aaSJamie Gritton error = vfs_setopt(opts, bf->noname, &i, sizeof(i)); 21040304c731SJamie Gritton if (error != 0 && error != ENOENT) 21050304c731SJamie Gritton goto done_deref; 21060304c731SJamie Gritton } 2107b38ff370SJamie Gritton i = (pr->pr_uref == 0); 2108b38ff370SJamie Gritton error = vfs_setopt(opts, "dying", &i, sizeof(i)); 2109b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 2110b38ff370SJamie Gritton goto done_deref; 2111b38ff370SJamie Gritton i = !i; 2112b38ff370SJamie Gritton error = vfs_setopt(opts, "nodying", &i, sizeof(i)); 2113b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 2114b38ff370SJamie Gritton goto done_deref; 2115bd96bd15SIan Lepore error = vfs_setopt(opts, "osreldate", &pr->pr_osreldate, 2116bd96bd15SIan Lepore sizeof(pr->pr_osreldate)); 2117a1a4c1b0SIan Lepore if (error != 0 && error != ENOENT) 2118a1a4c1b0SIan Lepore goto done_deref; 2119a1a4c1b0SIan Lepore error = vfs_setopts(opts, "osrelease", pr->pr_osrelease); 2120a1a4c1b0SIan Lepore if (error != 0 && error != ENOENT) 2121a1a4c1b0SIan Lepore goto done_deref; 2122b38ff370SJamie Gritton 2123b38ff370SJamie Gritton /* Get the module parameters. */ 2124b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 2125b38ff370SJamie Gritton locked = 0; 2126b38ff370SJamie Gritton error = osd_jail_call(pr, PR_METHOD_GET, opts); 2127b38ff370SJamie Gritton if (error) 2128b38ff370SJamie Gritton goto done_deref; 2129b38ff370SJamie Gritton prison_deref(pr, PD_DEREF | PD_LIST_SLOCKED); 2130b38ff370SJamie Gritton 2131b38ff370SJamie Gritton /* By now, all parameters should have been noted. */ 2132b38ff370SJamie Gritton TAILQ_FOREACH(opt, opts, link) { 2133b38ff370SJamie Gritton if (!opt->seen && strcmp(opt->name, "errmsg")) { 2134b38ff370SJamie Gritton error = EINVAL; 2135b38ff370SJamie Gritton vfs_opterror(opts, "unknown parameter: %s", opt->name); 2136b38ff370SJamie Gritton goto done_errmsg; 2137b38ff370SJamie Gritton } 2138b38ff370SJamie Gritton } 2139b38ff370SJamie Gritton 2140b38ff370SJamie Gritton /* Write the fetched parameters back to userspace. */ 2141b38ff370SJamie Gritton error = 0; 2142b38ff370SJamie Gritton TAILQ_FOREACH(opt, opts, link) { 2143b38ff370SJamie Gritton if (opt->pos >= 0 && opt->pos != errmsg_pos) { 2144b38ff370SJamie Gritton pos = 2 * opt->pos + 1; 2145b38ff370SJamie Gritton optuio->uio_iov[pos].iov_len = opt->len; 2146b38ff370SJamie Gritton if (opt->value != NULL) { 2147b38ff370SJamie Gritton if (optuio->uio_segflg == UIO_SYSSPACE) { 2148b38ff370SJamie Gritton bcopy(opt->value, 2149b38ff370SJamie Gritton optuio->uio_iov[pos].iov_base, 2150b38ff370SJamie Gritton opt->len); 2151b38ff370SJamie Gritton } else { 2152b38ff370SJamie Gritton error = copyout(opt->value, 2153b38ff370SJamie Gritton optuio->uio_iov[pos].iov_base, 2154b38ff370SJamie Gritton opt->len); 2155b38ff370SJamie Gritton if (error) 2156b38ff370SJamie Gritton break; 2157b38ff370SJamie Gritton } 2158b38ff370SJamie Gritton } 2159b38ff370SJamie Gritton } 2160b38ff370SJamie Gritton } 2161b38ff370SJamie Gritton goto done_errmsg; 2162b38ff370SJamie Gritton 2163b38ff370SJamie Gritton done_deref: 2164b38ff370SJamie Gritton prison_deref(pr, locked | PD_DEREF | PD_LIST_SLOCKED); 2165b38ff370SJamie Gritton goto done_errmsg; 2166b38ff370SJamie Gritton 2167b38ff370SJamie Gritton done_unlock_list: 2168b38ff370SJamie Gritton sx_sunlock(&allprison_lock); 2169b38ff370SJamie Gritton done_errmsg: 2170b38ff370SJamie Gritton if (error && errmsg_pos >= 0) { 2171b38ff370SJamie Gritton vfs_getopt(opts, "errmsg", (void **)&errmsg, &errmsg_len); 2172b38ff370SJamie Gritton errmsg_pos = 2 * errmsg_pos + 1; 2173b38ff370SJamie Gritton if (errmsg_len > 0) { 2174b38ff370SJamie Gritton if (optuio->uio_segflg == UIO_SYSSPACE) 2175b38ff370SJamie Gritton bcopy(errmsg, 2176b38ff370SJamie Gritton optuio->uio_iov[errmsg_pos].iov_base, 2177b38ff370SJamie Gritton errmsg_len); 2178b38ff370SJamie Gritton else 2179b38ff370SJamie Gritton copyout(errmsg, 2180b38ff370SJamie Gritton optuio->uio_iov[errmsg_pos].iov_base, 2181b38ff370SJamie Gritton errmsg_len); 2182b38ff370SJamie Gritton } 2183b38ff370SJamie Gritton } 2184b38ff370SJamie Gritton vfs_freeopts(opts); 2185b38ff370SJamie Gritton return (error); 2186b38ff370SJamie Gritton } 2187b38ff370SJamie Gritton 2188b38ff370SJamie Gritton /* 2189b38ff370SJamie Gritton * struct jail_remove_args { 2190b38ff370SJamie Gritton * int jid; 2191b38ff370SJamie Gritton * }; 2192b38ff370SJamie Gritton */ 2193b38ff370SJamie Gritton int 21948451d0ddSKip Macy sys_jail_remove(struct thread *td, struct jail_remove_args *uap) 2195b38ff370SJamie Gritton { 21960304c731SJamie Gritton struct prison *pr, *cpr, *lpr, *tpr; 21970304c731SJamie Gritton int descend, error; 2198b38ff370SJamie Gritton 2199b38ff370SJamie Gritton error = priv_check(td, PRIV_JAIL_REMOVE); 2200b38ff370SJamie Gritton if (error) 2201b38ff370SJamie Gritton return (error); 2202b38ff370SJamie Gritton 2203b38ff370SJamie Gritton sx_xlock(&allprison_lock); 22040304c731SJamie Gritton pr = prison_find_child(td->td_ucred->cr_prison, uap->jid); 2205b38ff370SJamie Gritton if (pr == NULL) { 2206b38ff370SJamie Gritton sx_xunlock(&allprison_lock); 2207b38ff370SJamie Gritton return (EINVAL); 2208b38ff370SJamie Gritton } 2209b38ff370SJamie Gritton 22100304c731SJamie Gritton /* Remove all descendants of this prison, then remove this prison. */ 22110304c731SJamie Gritton pr->pr_ref++; 22120304c731SJamie Gritton if (!LIST_EMPTY(&pr->pr_children)) { 22130304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 22140304c731SJamie Gritton lpr = NULL; 22150304c731SJamie Gritton FOREACH_PRISON_DESCENDANT(pr, cpr, descend) { 22160304c731SJamie Gritton mtx_lock(&cpr->pr_mtx); 22170304c731SJamie Gritton if (cpr->pr_ref > 0) { 22180304c731SJamie Gritton tpr = cpr; 22190304c731SJamie Gritton cpr->pr_ref++; 22200304c731SJamie Gritton } else { 22210304c731SJamie Gritton /* Already removed - do not do it again. */ 22220304c731SJamie Gritton tpr = NULL; 22230304c731SJamie Gritton } 22240304c731SJamie Gritton mtx_unlock(&cpr->pr_mtx); 22250304c731SJamie Gritton if (lpr != NULL) { 22260304c731SJamie Gritton mtx_lock(&lpr->pr_mtx); 22270304c731SJamie Gritton prison_remove_one(lpr); 22280304c731SJamie Gritton sx_xlock(&allprison_lock); 22290304c731SJamie Gritton } 22300304c731SJamie Gritton lpr = tpr; 22310304c731SJamie Gritton } 22320304c731SJamie Gritton if (lpr != NULL) { 22330304c731SJamie Gritton mtx_lock(&lpr->pr_mtx); 22340304c731SJamie Gritton prison_remove_one(lpr); 22350304c731SJamie Gritton sx_xlock(&allprison_lock); 22360304c731SJamie Gritton } 22370304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 22380304c731SJamie Gritton } 22390304c731SJamie Gritton prison_remove_one(pr); 22400304c731SJamie Gritton return (0); 22410304c731SJamie Gritton } 22420304c731SJamie Gritton 22430304c731SJamie Gritton static void 22440304c731SJamie Gritton prison_remove_one(struct prison *pr) 22450304c731SJamie Gritton { 22460304c731SJamie Gritton struct proc *p; 22470304c731SJamie Gritton int deuref; 22480304c731SJamie Gritton 2249b38ff370SJamie Gritton /* If the prison was persistent, it is not anymore. */ 2250b38ff370SJamie Gritton deuref = 0; 2251b38ff370SJamie Gritton if (pr->pr_flags & PR_PERSIST) { 2252b38ff370SJamie Gritton pr->pr_ref--; 2253b38ff370SJamie Gritton deuref = PD_DEUREF; 2254b38ff370SJamie Gritton pr->pr_flags &= ~PR_PERSIST; 2255b38ff370SJamie Gritton } 2256b38ff370SJamie Gritton 22570304c731SJamie Gritton /* 22580304c731SJamie Gritton * jail_remove added a reference. If that's the only one, remove 22590304c731SJamie Gritton * the prison now. 22600304c731SJamie Gritton */ 22610304c731SJamie Gritton KASSERT(pr->pr_ref > 0, 22620304c731SJamie Gritton ("prison_remove_one removing a dead prison (jid=%d)", pr->pr_id)); 22630304c731SJamie Gritton if (pr->pr_ref == 1) { 2264b38ff370SJamie Gritton prison_deref(pr, 2265b38ff370SJamie Gritton deuref | PD_DEREF | PD_LOCKED | PD_LIST_XLOCKED); 22660304c731SJamie Gritton return; 2267b38ff370SJamie Gritton } 2268b38ff370SJamie Gritton 2269b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 2270b38ff370SJamie Gritton sx_xunlock(&allprison_lock); 2271b38ff370SJamie Gritton /* 2272b38ff370SJamie Gritton * Kill all processes unfortunate enough to be attached to this prison. 2273b38ff370SJamie Gritton */ 2274b38ff370SJamie Gritton sx_slock(&allproc_lock); 22757938a442SBjoern A. Zeeb FOREACH_PROC_IN_SYSTEM(p) { 2276b38ff370SJamie Gritton PROC_LOCK(p); 2277b38ff370SJamie Gritton if (p->p_state != PRS_NEW && p->p_ucred && 2278b38ff370SJamie Gritton p->p_ucred->cr_prison == pr) 22798451d0ddSKip Macy kern_psignal(p, SIGKILL); 2280b38ff370SJamie Gritton PROC_UNLOCK(p); 2281b38ff370SJamie Gritton } 2282b38ff370SJamie Gritton sx_sunlock(&allproc_lock); 22830304c731SJamie Gritton /* Remove the temporary reference added by jail_remove. */ 2284b38ff370SJamie Gritton prison_deref(pr, deuref | PD_DEREF); 228575c13541SPoul-Henning Kamp } 228675c13541SPoul-Henning Kamp 2287fd7a8150SMike Barcroft /* 22889ddb7954SMike Barcroft * struct jail_attach_args { 22899ddb7954SMike Barcroft * int jid; 22909ddb7954SMike Barcroft * }; 2291fd7a8150SMike Barcroft */ 2292fd7a8150SMike Barcroft int 22938451d0ddSKip Macy sys_jail_attach(struct thread *td, struct jail_attach_args *uap) 2294fd7a8150SMike Barcroft { 2295b38ff370SJamie Gritton struct prison *pr; 2296b38ff370SJamie Gritton int error; 2297b38ff370SJamie Gritton 2298b38ff370SJamie Gritton error = priv_check(td, PRIV_JAIL_ATTACH); 2299b38ff370SJamie Gritton if (error) 2300b38ff370SJamie Gritton return (error); 2301b38ff370SJamie Gritton 2302ef0ddea3SJamie Gritton /* 2303ef0ddea3SJamie Gritton * Start with exclusive hold on allprison_lock to ensure that a possible 2304ef0ddea3SJamie Gritton * PR_METHOD_REMOVE call isn't concurrent with jail_set or jail_remove. 2305ef0ddea3SJamie Gritton * But then immediately downgrade it since we don't need to stop 2306ef0ddea3SJamie Gritton * readers. 2307ef0ddea3SJamie Gritton */ 2308ef0ddea3SJamie Gritton sx_xlock(&allprison_lock); 2309ef0ddea3SJamie Gritton sx_downgrade(&allprison_lock); 23100304c731SJamie Gritton pr = prison_find_child(td->td_ucred->cr_prison, uap->jid); 2311b38ff370SJamie Gritton if (pr == NULL) { 2312b38ff370SJamie Gritton sx_sunlock(&allprison_lock); 2313b38ff370SJamie Gritton return (EINVAL); 2314b38ff370SJamie Gritton } 2315b38ff370SJamie Gritton 2316b38ff370SJamie Gritton /* 2317b38ff370SJamie Gritton * Do not allow a process to attach to a prison that is not 2318b38ff370SJamie Gritton * considered to be "alive". 2319b38ff370SJamie Gritton */ 2320b38ff370SJamie Gritton if (pr->pr_uref == 0) { 2321b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 2322b38ff370SJamie Gritton sx_sunlock(&allprison_lock); 2323b38ff370SJamie Gritton return (EINVAL); 2324b38ff370SJamie Gritton } 2325b38ff370SJamie Gritton 2326b38ff370SJamie Gritton return (do_jail_attach(td, pr)); 2327b38ff370SJamie Gritton } 2328b38ff370SJamie Gritton 2329b38ff370SJamie Gritton static int 2330b38ff370SJamie Gritton do_jail_attach(struct thread *td, struct prison *pr) 2331b38ff370SJamie Gritton { 2332fd7a8150SMike Barcroft struct proc *p; 2333fd7a8150SMike Barcroft struct ucred *newcred, *oldcred; 23345050aa86SKonstantin Belousov int error; 2335fd7a8150SMike Barcroft 233657f22bd4SJacques Vidrine /* 233757f22bd4SJacques Vidrine * XXX: Note that there is a slight race here if two threads 233857f22bd4SJacques Vidrine * in the same privileged process attempt to attach to two 233957f22bd4SJacques Vidrine * different jails at the same time. It is important for 234057f22bd4SJacques Vidrine * user processes not to do this, or they might end up with 234157f22bd4SJacques Vidrine * a process root from one prison, but attached to the jail 234257f22bd4SJacques Vidrine * of another. 234357f22bd4SJacques Vidrine */ 2344fd7a8150SMike Barcroft pr->pr_ref++; 2345b38ff370SJamie Gritton pr->pr_uref++; 2346fd7a8150SMike Barcroft mtx_unlock(&pr->pr_mtx); 2347b38ff370SJamie Gritton 2348b38ff370SJamie Gritton /* Let modules do whatever they need to prepare for attaching. */ 2349b38ff370SJamie Gritton error = osd_jail_call(pr, PR_METHOD_ATTACH, td); 2350b38ff370SJamie Gritton if (error) { 2351b38ff370SJamie Gritton prison_deref(pr, PD_DEREF | PD_DEUREF | PD_LIST_SLOCKED); 2352b38ff370SJamie Gritton return (error); 2353b38ff370SJamie Gritton } 2354dc68a633SPawel Jakub Dawidek sx_sunlock(&allprison_lock); 2355fd7a8150SMike Barcroft 2356413628a7SBjoern A. Zeeb /* 2357413628a7SBjoern A. Zeeb * Reparent the newly attached process to this jail. 2358413628a7SBjoern A. Zeeb */ 2359b38ff370SJamie Gritton p = td->td_proc; 2360413628a7SBjoern A. Zeeb error = cpuset_setproc_update_set(p, pr->pr_cpuset); 2361413628a7SBjoern A. Zeeb if (error) 2362b38ff370SJamie Gritton goto e_revert_osd; 2363413628a7SBjoern A. Zeeb 2364cb05b60aSAttilio Rao vn_lock(pr->pr_root, LK_EXCLUSIVE | LK_RETRY); 2365fd7a8150SMike Barcroft if ((error = change_dir(pr->pr_root, td)) != 0) 2366fd7a8150SMike Barcroft goto e_unlock; 2367fd7a8150SMike Barcroft #ifdef MAC 236830d239bcSRobert Watson if ((error = mac_vnode_check_chroot(td->td_ucred, pr->pr_root))) 2369fd7a8150SMike Barcroft goto e_unlock; 2370fd7a8150SMike Barcroft #endif 2371b249ce48SMateusz Guzik VOP_UNLOCK(pr->pr_root); 2372f0725a8eSMateusz Guzik if ((error = pwd_chroot(td, pr->pr_root))) 23735050aa86SKonstantin Belousov goto e_revert_osd; 2374fd7a8150SMike Barcroft 2375fd7a8150SMike Barcroft newcred = crget(); 2376fd7a8150SMike Barcroft PROC_LOCK(p); 23771fb6767dSJamie Gritton oldcred = crcopysafe(p, newcred); 237869c4ee54SJohn Baldwin newcred->cr_prison = pr; 2379daf63fd2SMateusz Guzik proc_set_cred(p, newcred); 23801fb6767dSJamie Gritton setsugid(p); 2381097055e2SEdward Tomasz Napierala #ifdef RACCT 2382097055e2SEdward Tomasz Napierala racct_proc_ucred_changed(p, oldcred, newcred); 2383f87beb93SAndriy Gapon crhold(newcred); 2384f87beb93SAndriy Gapon #endif 2385f87beb93SAndriy Gapon PROC_UNLOCK(p); 2386f87beb93SAndriy Gapon #ifdef RCTL 2387f87beb93SAndriy Gapon rctl_proc_ucred_changed(p, newcred); 2388f87beb93SAndriy Gapon crfree(newcred); 2389097055e2SEdward Tomasz Napierala #endif 23901fb6767dSJamie Gritton prison_deref(oldcred->cr_prison, PD_DEREF | PD_DEUREF); 2391fd7a8150SMike Barcroft crfree(oldcred); 2392fd7a8150SMike Barcroft return (0); 23931fb6767dSJamie Gritton 2394fd7a8150SMike Barcroft e_unlock: 2395b249ce48SMateusz Guzik VOP_UNLOCK(pr->pr_root); 2396b38ff370SJamie Gritton e_revert_osd: 2397b38ff370SJamie Gritton /* Tell modules this thread is still in its old jail after all. */ 23981fb6767dSJamie Gritton (void)osd_jail_call(td->td_ucred->cr_prison, PR_METHOD_ATTACH, td); 2399b38ff370SJamie Gritton prison_deref(pr, PD_DEREF | PD_DEUREF); 2400fd7a8150SMike Barcroft return (error); 2401fd7a8150SMike Barcroft } 2402fd7a8150SMike Barcroft 2403fd7a8150SMike Barcroft /* 2404fd7a8150SMike Barcroft * Returns a locked prison instance, or NULL on failure. 2405fd7a8150SMike Barcroft */ 240654b369c1SPawel Jakub Dawidek struct prison * 2407fd7a8150SMike Barcroft prison_find(int prid) 2408fd7a8150SMike Barcroft { 2409fd7a8150SMike Barcroft struct prison *pr; 2410fd7a8150SMike Barcroft 2411dc68a633SPawel Jakub Dawidek sx_assert(&allprison_lock, SX_LOCKED); 2412b38ff370SJamie Gritton TAILQ_FOREACH(pr, &allprison, pr_list) { 2413fd7a8150SMike Barcroft if (pr->pr_id == prid) { 2414fd7a8150SMike Barcroft mtx_lock(&pr->pr_mtx); 2415b38ff370SJamie Gritton if (pr->pr_ref > 0) 2416fd7a8150SMike Barcroft return (pr); 2417b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 2418fd7a8150SMike Barcroft } 2419fd7a8150SMike Barcroft } 2420fd7a8150SMike Barcroft return (NULL); 2421fd7a8150SMike Barcroft } 2422fd7a8150SMike Barcroft 2423b38ff370SJamie Gritton /* 24240304c731SJamie Gritton * Find a prison that is a descendant of mypr. Returns a locked prison or NULL. 2425b38ff370SJamie Gritton */ 2426b38ff370SJamie Gritton struct prison * 24270304c731SJamie Gritton prison_find_child(struct prison *mypr, int prid) 2428b38ff370SJamie Gritton { 24290304c731SJamie Gritton struct prison *pr; 24300304c731SJamie Gritton int descend; 2431b38ff370SJamie Gritton 2432b38ff370SJamie Gritton sx_assert(&allprison_lock, SX_LOCKED); 24330304c731SJamie Gritton FOREACH_PRISON_DESCENDANT(mypr, pr, descend) { 24340304c731SJamie Gritton if (pr->pr_id == prid) { 24350304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 24360304c731SJamie Gritton if (pr->pr_ref > 0) 24370304c731SJamie Gritton return (pr); 24380304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 24390304c731SJamie Gritton } 24400304c731SJamie Gritton } 24410304c731SJamie Gritton return (NULL); 24420304c731SJamie Gritton } 24430304c731SJamie Gritton 24440304c731SJamie Gritton /* 24450304c731SJamie Gritton * Look for the name relative to mypr. Returns a locked prison or NULL. 24460304c731SJamie Gritton */ 24470304c731SJamie Gritton struct prison * 24480304c731SJamie Gritton prison_find_name(struct prison *mypr, const char *name) 24490304c731SJamie Gritton { 24500304c731SJamie Gritton struct prison *pr, *deadpr; 24510304c731SJamie Gritton size_t mylen; 24520304c731SJamie Gritton int descend; 24530304c731SJamie Gritton 24540304c731SJamie Gritton sx_assert(&allprison_lock, SX_LOCKED); 24550304c731SJamie Gritton mylen = (mypr == &prison0) ? 0 : strlen(mypr->pr_name) + 1; 2456b38ff370SJamie Gritton again: 2457b38ff370SJamie Gritton deadpr = NULL; 24580304c731SJamie Gritton FOREACH_PRISON_DESCENDANT(mypr, pr, descend) { 24590304c731SJamie Gritton if (!strcmp(pr->pr_name + mylen, name)) { 2460b38ff370SJamie Gritton mtx_lock(&pr->pr_mtx); 2461b38ff370SJamie Gritton if (pr->pr_ref > 0) { 2462b38ff370SJamie Gritton if (pr->pr_uref > 0) 2463b38ff370SJamie Gritton return (pr); 2464b38ff370SJamie Gritton deadpr = pr; 2465b38ff370SJamie Gritton } 2466b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 2467b38ff370SJamie Gritton } 2468b38ff370SJamie Gritton } 24690304c731SJamie Gritton /* There was no valid prison - perhaps there was a dying one. */ 2470b38ff370SJamie Gritton if (deadpr != NULL) { 2471b38ff370SJamie Gritton mtx_lock(&deadpr->pr_mtx); 2472b38ff370SJamie Gritton if (deadpr->pr_ref == 0) { 2473b38ff370SJamie Gritton mtx_unlock(&deadpr->pr_mtx); 2474b38ff370SJamie Gritton goto again; 2475b38ff370SJamie Gritton } 2476b38ff370SJamie Gritton } 2477b38ff370SJamie Gritton return (deadpr); 2478b38ff370SJamie Gritton } 2479b38ff370SJamie Gritton 2480b38ff370SJamie Gritton /* 24810304c731SJamie Gritton * See if a prison has the specific flag set. 24820304c731SJamie Gritton */ 24830304c731SJamie Gritton int 24840304c731SJamie Gritton prison_flag(struct ucred *cred, unsigned flag) 24850304c731SJamie Gritton { 24860304c731SJamie Gritton 24870304c731SJamie Gritton /* This is an atomic read, so no locking is necessary. */ 24880304c731SJamie Gritton return (cred->cr_prison->pr_flags & flag); 24890304c731SJamie Gritton } 24900304c731SJamie Gritton 24910304c731SJamie Gritton int 24920304c731SJamie Gritton prison_allow(struct ucred *cred, unsigned flag) 24930304c731SJamie Gritton { 24940304c731SJamie Gritton 24950304c731SJamie Gritton /* This is an atomic read, so no locking is necessary. */ 24960304c731SJamie Gritton return (cred->cr_prison->pr_allow & flag); 24970304c731SJamie Gritton } 24980304c731SJamie Gritton 24990304c731SJamie Gritton /* 2500b38ff370SJamie Gritton * Remove a prison reference. If that was the last reference, remove the 2501b38ff370SJamie Gritton * prison itself - but not in this context in case there are locks held. 2502b38ff370SJamie Gritton */ 250391421ba2SRobert Watson void 25041ba4a712SPawel Jakub Dawidek prison_free_locked(struct prison *pr) 250591421ba2SRobert Watson { 250673d9e52dSJamie Gritton int ref; 250791421ba2SRobert Watson 25081ba4a712SPawel Jakub Dawidek mtx_assert(&pr->pr_mtx, MA_OWNED); 250973d9e52dSJamie Gritton ref = --pr->pr_ref; 251001137630SRobert Watson mtx_unlock(&pr->pr_mtx); 251173d9e52dSJamie Gritton if (ref == 0) 2512c2cda609SPawel Jakub Dawidek taskqueue_enqueue(taskqueue_thread, &pr->pr_task); 2513c2cda609SPawel Jakub Dawidek } 2514c2cda609SPawel Jakub Dawidek 25151ba4a712SPawel Jakub Dawidek void 25161ba4a712SPawel Jakub Dawidek prison_free(struct prison *pr) 25171ba4a712SPawel Jakub Dawidek { 25181ba4a712SPawel Jakub Dawidek 25191ba4a712SPawel Jakub Dawidek mtx_lock(&pr->pr_mtx); 25201ba4a712SPawel Jakub Dawidek prison_free_locked(pr); 25211ba4a712SPawel Jakub Dawidek } 25221ba4a712SPawel Jakub Dawidek 252373d9e52dSJamie Gritton /* 252473d9e52dSJamie Gritton * Complete a call to either prison_free or prison_proc_free. 252573d9e52dSJamie Gritton */ 2526c2cda609SPawel Jakub Dawidek static void 2527c2cda609SPawel Jakub Dawidek prison_complete(void *context, int pending) 2528c2cda609SPawel Jakub Dawidek { 252973d9e52dSJamie Gritton struct prison *pr = context; 2530b38ff370SJamie Gritton 2531ef0ddea3SJamie Gritton sx_xlock(&allprison_lock); 253273d9e52dSJamie Gritton mtx_lock(&pr->pr_mtx); 253373d9e52dSJamie Gritton prison_deref(pr, pr->pr_uref 2534ef0ddea3SJamie Gritton ? PD_DEREF | PD_DEUREF | PD_LOCKED | PD_LIST_XLOCKED 2535ef0ddea3SJamie Gritton : PD_LOCKED | PD_LIST_XLOCKED); 2536b38ff370SJamie Gritton } 2537b38ff370SJamie Gritton 2538b38ff370SJamie Gritton /* 2539b38ff370SJamie Gritton * Remove a prison reference (usually). This internal version assumes no 2540b38ff370SJamie Gritton * mutexes are held, except perhaps the prison itself. If there are no more 2541b38ff370SJamie Gritton * references, release and delist the prison. On completion, the prison lock 2542b38ff370SJamie Gritton * and the allprison lock are both unlocked. 2543b38ff370SJamie Gritton */ 2544b38ff370SJamie Gritton static void 2545b38ff370SJamie Gritton prison_deref(struct prison *pr, int flags) 2546b38ff370SJamie Gritton { 25470304c731SJamie Gritton struct prison *ppr, *tpr; 2548cc5fd8c7SJamie Gritton int ref, lasturef; 2549c2cda609SPawel Jakub Dawidek 2550b38ff370SJamie Gritton if (!(flags & PD_LOCKED)) 2551b38ff370SJamie Gritton mtx_lock(&pr->pr_mtx); 25520304c731SJamie Gritton for (;;) { 2553e6d5cb63SJamie Gritton if (flags & PD_DEUREF) { 255473d9e52dSJamie Gritton KASSERT(pr->pr_uref > 0, 255573d9e52dSJamie Gritton ("prison_deref PD_DEUREF on a dead prison (jid=%d)", 255673d9e52dSJamie Gritton pr->pr_id)); 2557e6d5cb63SJamie Gritton pr->pr_uref--; 2558cc5fd8c7SJamie Gritton lasturef = pr->pr_uref == 0; 2559cc5fd8c7SJamie Gritton if (lasturef) 2560cc5fd8c7SJamie Gritton pr->pr_ref++; 2561e6d5cb63SJamie Gritton KASSERT(prison0.pr_uref != 0, ("prison0 pr_uref=0")); 2562cc5fd8c7SJamie Gritton } else 2563cc5fd8c7SJamie Gritton lasturef = 0; 256473d9e52dSJamie Gritton if (flags & PD_DEREF) { 256573d9e52dSJamie Gritton KASSERT(pr->pr_ref > 0, 256673d9e52dSJamie Gritton ("prison_deref PD_DEREF on a dead prison (jid=%d)", 256773d9e52dSJamie Gritton pr->pr_id)); 2568b38ff370SJamie Gritton pr->pr_ref--; 256973d9e52dSJamie Gritton } 2570cc5fd8c7SJamie Gritton ref = pr->pr_ref; 2571b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 2572cc5fd8c7SJamie Gritton 2573cc5fd8c7SJamie Gritton /* 2574cc5fd8c7SJamie Gritton * Tell the modules if the last user reference was removed 2575cc5fd8c7SJamie Gritton * (even it sticks around in dying state). 2576cc5fd8c7SJamie Gritton */ 2577cc5fd8c7SJamie Gritton if (lasturef) { 2578cc5fd8c7SJamie Gritton if (!(flags & (PD_LIST_SLOCKED | PD_LIST_XLOCKED))) { 2579cc5fd8c7SJamie Gritton sx_xlock(&allprison_lock); 2580cc5fd8c7SJamie Gritton flags |= PD_LIST_XLOCKED; 2581cc5fd8c7SJamie Gritton } 2582cc5fd8c7SJamie Gritton (void)osd_jail_call(pr, PR_METHOD_REMOVE, NULL); 2583cc5fd8c7SJamie Gritton mtx_lock(&pr->pr_mtx); 2584cc5fd8c7SJamie Gritton ref = --pr->pr_ref; 2585cc5fd8c7SJamie Gritton mtx_unlock(&pr->pr_mtx); 2586cc5fd8c7SJamie Gritton } 2587cc5fd8c7SJamie Gritton 2588cc5fd8c7SJamie Gritton /* If the prison still has references, nothing else to do. */ 2589cc5fd8c7SJamie Gritton if (ref > 0) { 2590b38ff370SJamie Gritton if (flags & PD_LIST_SLOCKED) 2591b38ff370SJamie Gritton sx_sunlock(&allprison_lock); 2592b38ff370SJamie Gritton else if (flags & PD_LIST_XLOCKED) 2593b38ff370SJamie Gritton sx_xunlock(&allprison_lock); 2594b38ff370SJamie Gritton return; 2595b38ff370SJamie Gritton } 2596c2cda609SPawel Jakub Dawidek 2597b38ff370SJamie Gritton if (flags & PD_LIST_SLOCKED) { 2598b38ff370SJamie Gritton if (!sx_try_upgrade(&allprison_lock)) { 2599b38ff370SJamie Gritton sx_sunlock(&allprison_lock); 2600c2cda609SPawel Jakub Dawidek sx_xlock(&allprison_lock); 2601b38ff370SJamie Gritton } 2602b38ff370SJamie Gritton } else if (!(flags & PD_LIST_XLOCKED)) 2603b38ff370SJamie Gritton sx_xlock(&allprison_lock); 2604b38ff370SJamie Gritton 2605b38ff370SJamie Gritton TAILQ_REMOVE(&allprison, pr, pr_list); 26060304c731SJamie Gritton LIST_REMOVE(pr, pr_sibling); 26070304c731SJamie Gritton ppr = pr->pr_parent; 26080304c731SJamie Gritton for (tpr = ppr; tpr != NULL; tpr = tpr->pr_parent) 2609b97457e2SJamie Gritton tpr->pr_childcount--; 2610c4884ffaSJamie Gritton sx_xunlock(&allprison_lock); 26111ba4a712SPawel Jakub Dawidek 2612679e1390SJamie Gritton #ifdef VIMAGE 26130cb8b6a9SMarko Zec if (pr->pr_vnet != ppr->pr_vnet) 2614679e1390SJamie Gritton vnet_destroy(pr->pr_vnet); 2615679e1390SJamie Gritton #endif 26165050aa86SKonstantin Belousov if (pr->pr_root != NULL) 2617b3059e09SRobert Watson vrele(pr->pr_root); 2618b3059e09SRobert Watson mtx_destroy(&pr->pr_mtx); 2619413628a7SBjoern A. Zeeb #ifdef INET 2620413628a7SBjoern A. Zeeb free(pr->pr_ip4, M_PRISON); 2621413628a7SBjoern A. Zeeb #endif 2622b38ff370SJamie Gritton #ifdef INET6 2623b38ff370SJamie Gritton free(pr->pr_ip6, M_PRISON); 2624b38ff370SJamie Gritton #endif 2625b38ff370SJamie Gritton if (pr->pr_cpuset != NULL) 2626b38ff370SJamie Gritton cpuset_rel(pr->pr_cpuset); 2627b38ff370SJamie Gritton osd_jail_exit(pr); 2628a7ad07bfSEdward Tomasz Napierala #ifdef RACCT 26294b5c9cf6SEdward Tomasz Napierala if (racct_enable) 2630a7ad07bfSEdward Tomasz Napierala prison_racct_detach(pr); 2631ec125fbbSEdward Tomasz Napierala #endif 26321ede983cSDag-Erling Smørgrav free(pr, M_PRISON); 26330304c731SJamie Gritton 26340304c731SJamie Gritton /* Removing a prison frees a reference on its parent. */ 26350304c731SJamie Gritton pr = ppr; 26360304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 2637e6d5cb63SJamie Gritton flags = PD_DEREF | PD_DEUREF; 26380304c731SJamie Gritton } 2639b3059e09SRobert Watson } 2640b3059e09SRobert Watson 264191421ba2SRobert Watson void 26421ba4a712SPawel Jakub Dawidek prison_hold_locked(struct prison *pr) 26431ba4a712SPawel Jakub Dawidek { 26441ba4a712SPawel Jakub Dawidek 26451ba4a712SPawel Jakub Dawidek mtx_assert(&pr->pr_mtx, MA_OWNED); 26461ba4a712SPawel Jakub Dawidek KASSERT(pr->pr_ref > 0, 264736b41cc3SBjoern A. Zeeb ("Trying to hold dead prison %p (jid=%d).", pr, pr->pr_id)); 26481ba4a712SPawel Jakub Dawidek pr->pr_ref++; 26491ba4a712SPawel Jakub Dawidek } 26501ba4a712SPawel Jakub Dawidek 26511ba4a712SPawel Jakub Dawidek void 265291421ba2SRobert Watson prison_hold(struct prison *pr) 265391421ba2SRobert Watson { 265491421ba2SRobert Watson 265501137630SRobert Watson mtx_lock(&pr->pr_mtx); 26561ba4a712SPawel Jakub Dawidek prison_hold_locked(pr); 265701137630SRobert Watson mtx_unlock(&pr->pr_mtx); 265801137630SRobert Watson } 265901137630SRobert Watson 2660413628a7SBjoern A. Zeeb void 2661413628a7SBjoern A. Zeeb prison_proc_hold(struct prison *pr) 266201137630SRobert Watson { 266301137630SRobert Watson 2664413628a7SBjoern A. Zeeb mtx_lock(&pr->pr_mtx); 2665b38ff370SJamie Gritton KASSERT(pr->pr_uref > 0, 2666b38ff370SJamie Gritton ("Cannot add a process to a non-alive prison (jid=%d)", pr->pr_id)); 2667b38ff370SJamie Gritton pr->pr_uref++; 2668413628a7SBjoern A. Zeeb mtx_unlock(&pr->pr_mtx); 266975c13541SPoul-Henning Kamp } 267075c13541SPoul-Henning Kamp 267175c13541SPoul-Henning Kamp void 2672413628a7SBjoern A. Zeeb prison_proc_free(struct prison *pr) 267375c13541SPoul-Henning Kamp { 2674413628a7SBjoern A. Zeeb 2675413628a7SBjoern A. Zeeb mtx_lock(&pr->pr_mtx); 2676b38ff370SJamie Gritton KASSERT(pr->pr_uref > 0, 2677b38ff370SJamie Gritton ("Trying to kill a process in a dead prison (jid=%d)", pr->pr_id)); 267873d9e52dSJamie Gritton if (pr->pr_uref > 1) 267973d9e52dSJamie Gritton pr->pr_uref--; 268073d9e52dSJamie Gritton else { 268173d9e52dSJamie Gritton /* 268273d9e52dSJamie Gritton * Don't remove the last user reference in this context, which 268373d9e52dSJamie Gritton * is expected to be a process that is not only locked, but 268473d9e52dSJamie Gritton * also half dead. 268573d9e52dSJamie Gritton */ 268673d9e52dSJamie Gritton pr->pr_ref++; 268773d9e52dSJamie Gritton mtx_unlock(&pr->pr_mtx); 268873d9e52dSJamie Gritton taskqueue_enqueue(taskqueue_thread, &pr->pr_task); 268973d9e52dSJamie Gritton return; 269073d9e52dSJamie Gritton } 269173d9e52dSJamie Gritton mtx_unlock(&pr->pr_mtx); 2692413628a7SBjoern A. Zeeb } 2693413628a7SBjoern A. Zeeb 2694413628a7SBjoern A. Zeeb /* 2695ca04ba64SJamie Gritton * Check if a jail supports the given address family. 2696ca04ba64SJamie Gritton * 2697ca04ba64SJamie Gritton * Returns 0 if not jailed or the address family is supported, EAFNOSUPPORT 2698ca04ba64SJamie Gritton * if not. 2699ca04ba64SJamie Gritton */ 2700ca04ba64SJamie Gritton int 2701ca04ba64SJamie Gritton prison_check_af(struct ucred *cred, int af) 2702ca04ba64SJamie Gritton { 27030304c731SJamie Gritton struct prison *pr; 2704ca04ba64SJamie Gritton int error; 2705ca04ba64SJamie Gritton 2706ca04ba64SJamie Gritton KASSERT(cred != NULL, ("%s: cred is NULL", __func__)); 2707ca04ba64SJamie Gritton 27080304c731SJamie Gritton pr = cred->cr_prison; 2709499650a0SJamie Gritton #ifdef VIMAGE 27106bb79563SJamie Gritton /* Prisons with their own network stack are not limited. */ 2711de0bd6f7SBjoern A. Zeeb if (prison_owns_vnet(cred)) 27126bb79563SJamie Gritton return (0); 2713499650a0SJamie Gritton #endif 27146bb79563SJamie Gritton 2715ca04ba64SJamie Gritton error = 0; 2716ca04ba64SJamie Gritton switch (af) 2717ca04ba64SJamie Gritton { 2718ca04ba64SJamie Gritton #ifdef INET 2719ca04ba64SJamie Gritton case AF_INET: 27200304c731SJamie Gritton if (pr->pr_flags & PR_IP4) 27210304c731SJamie Gritton { 27220304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 27230304c731SJamie Gritton if ((pr->pr_flags & PR_IP4) && pr->pr_ip4 == NULL) 2724ca04ba64SJamie Gritton error = EAFNOSUPPORT; 27250304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 27260304c731SJamie Gritton } 2727ca04ba64SJamie Gritton break; 2728ca04ba64SJamie Gritton #endif 2729ca04ba64SJamie Gritton #ifdef INET6 2730ca04ba64SJamie Gritton case AF_INET6: 27310304c731SJamie Gritton if (pr->pr_flags & PR_IP6) 27320304c731SJamie Gritton { 27330304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 27340304c731SJamie Gritton if ((pr->pr_flags & PR_IP6) && pr->pr_ip6 == NULL) 2735ca04ba64SJamie Gritton error = EAFNOSUPPORT; 27360304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 27370304c731SJamie Gritton } 2738ca04ba64SJamie Gritton break; 2739ca04ba64SJamie Gritton #endif 2740ca04ba64SJamie Gritton case AF_LOCAL: 2741ca04ba64SJamie Gritton case AF_ROUTE: 2742ca04ba64SJamie Gritton break; 2743ca04ba64SJamie Gritton default: 27440304c731SJamie Gritton if (!(pr->pr_allow & PR_ALLOW_SOCKET_AF)) 2745ca04ba64SJamie Gritton error = EAFNOSUPPORT; 2746ca04ba64SJamie Gritton } 2747ca04ba64SJamie Gritton return (error); 2748ca04ba64SJamie Gritton } 2749ca04ba64SJamie Gritton 2750ca04ba64SJamie Gritton /* 2751413628a7SBjoern A. Zeeb * Check if given address belongs to the jail referenced by cred (wrapper to 2752413628a7SBjoern A. Zeeb * prison_check_ip[46]). 2753413628a7SBjoern A. Zeeb * 27540304c731SJamie Gritton * Returns 0 if jail doesn't restrict the address family or if address belongs 27550304c731SJamie Gritton * to jail, EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if 27560304c731SJamie Gritton * the jail doesn't allow the address family. IPv4 Address passed in in NBO. 2757413628a7SBjoern A. Zeeb */ 2758413628a7SBjoern A. Zeeb int 2759c83dda36SAlexander V. Chernikov prison_if(struct ucred *cred, const struct sockaddr *sa) 276075c13541SPoul-Henning Kamp { 2761413628a7SBjoern A. Zeeb #ifdef INET 2762c83dda36SAlexander V. Chernikov const struct sockaddr_in *sai; 2763413628a7SBjoern A. Zeeb #endif 2764413628a7SBjoern A. Zeeb #ifdef INET6 2765c83dda36SAlexander V. Chernikov const struct sockaddr_in6 *sai6; 2766413628a7SBjoern A. Zeeb #endif 2767b89e82ddSJamie Gritton int error; 276875c13541SPoul-Henning Kamp 2769413628a7SBjoern A. Zeeb KASSERT(cred != NULL, ("%s: cred is NULL", __func__)); 2770413628a7SBjoern A. Zeeb KASSERT(sa != NULL, ("%s: sa is NULL", __func__)); 2771413628a7SBjoern A. Zeeb 2772de0bd6f7SBjoern A. Zeeb #ifdef VIMAGE 2773de0bd6f7SBjoern A. Zeeb if (prison_owns_vnet(cred)) 2774de0bd6f7SBjoern A. Zeeb return (0); 2775de0bd6f7SBjoern A. Zeeb #endif 2776de0bd6f7SBjoern A. Zeeb 2777b89e82ddSJamie Gritton error = 0; 2778413628a7SBjoern A. Zeeb switch (sa->sa_family) 2779413628a7SBjoern A. Zeeb { 2780413628a7SBjoern A. Zeeb #ifdef INET 2781413628a7SBjoern A. Zeeb case AF_INET: 2782c83dda36SAlexander V. Chernikov sai = (const struct sockaddr_in *)sa; 2783b89e82ddSJamie Gritton error = prison_check_ip4(cred, &sai->sin_addr); 2784413628a7SBjoern A. Zeeb break; 2785413628a7SBjoern A. Zeeb #endif 2786413628a7SBjoern A. Zeeb #ifdef INET6 2787413628a7SBjoern A. Zeeb case AF_INET6: 2788c83dda36SAlexander V. Chernikov sai6 = (const struct sockaddr_in6 *)sa; 2789b89e82ddSJamie Gritton error = prison_check_ip6(cred, &sai6->sin6_addr); 2790413628a7SBjoern A. Zeeb break; 2791413628a7SBjoern A. Zeeb #endif 2792413628a7SBjoern A. Zeeb default: 27930304c731SJamie Gritton if (!(cred->cr_prison->pr_allow & PR_ALLOW_SOCKET_AF)) 2794b89e82ddSJamie Gritton error = EAFNOSUPPORT; 2795413628a7SBjoern A. Zeeb } 2796b89e82ddSJamie Gritton return (error); 279775c13541SPoul-Henning Kamp } 279891421ba2SRobert Watson 279991421ba2SRobert Watson /* 280091421ba2SRobert Watson * Return 0 if jails permit p1 to frob p2, otherwise ESRCH. 280191421ba2SRobert Watson */ 280291421ba2SRobert Watson int 28039ddb7954SMike Barcroft prison_check(struct ucred *cred1, struct ucred *cred2) 280491421ba2SRobert Watson { 280591421ba2SRobert Watson 28060304c731SJamie Gritton return ((cred1->cr_prison == cred2->cr_prison || 28070304c731SJamie Gritton prison_ischild(cred1->cr_prison, cred2->cr_prison)) ? 0 : ESRCH); 28080304c731SJamie Gritton } 280991421ba2SRobert Watson 28100304c731SJamie Gritton /* 28110304c731SJamie Gritton * Return 1 if p2 is a child of p1, otherwise 0. 28120304c731SJamie Gritton */ 28130304c731SJamie Gritton int 28140304c731SJamie Gritton prison_ischild(struct prison *pr1, struct prison *pr2) 28150304c731SJamie Gritton { 28160304c731SJamie Gritton 28170304c731SJamie Gritton for (pr2 = pr2->pr_parent; pr2 != NULL; pr2 = pr2->pr_parent) 28180304c731SJamie Gritton if (pr1 == pr2) 28190304c731SJamie Gritton return (1); 282091421ba2SRobert Watson return (0); 282191421ba2SRobert Watson } 282291421ba2SRobert Watson 282391421ba2SRobert Watson /* 2824de0bd6f7SBjoern A. Zeeb * Return 1 if the passed credential is in a jail and that jail does not 2825de0bd6f7SBjoern A. Zeeb * have its own virtual network stack, otherwise 0. 2826de0bd6f7SBjoern A. Zeeb */ 2827de0bd6f7SBjoern A. Zeeb int 2828de0bd6f7SBjoern A. Zeeb jailed_without_vnet(struct ucred *cred) 2829de0bd6f7SBjoern A. Zeeb { 2830de0bd6f7SBjoern A. Zeeb 2831de0bd6f7SBjoern A. Zeeb if (!jailed(cred)) 2832de0bd6f7SBjoern A. Zeeb return (0); 2833de0bd6f7SBjoern A. Zeeb #ifdef VIMAGE 2834de0bd6f7SBjoern A. Zeeb if (prison_owns_vnet(cred)) 2835de0bd6f7SBjoern A. Zeeb return (0); 2836de0bd6f7SBjoern A. Zeeb #endif 2837de0bd6f7SBjoern A. Zeeb 2838de0bd6f7SBjoern A. Zeeb return (1); 2839de0bd6f7SBjoern A. Zeeb } 2840de0bd6f7SBjoern A. Zeeb 2841de0bd6f7SBjoern A. Zeeb /* 28427455b100SJamie Gritton * Return the correct hostname (domainname, et al) for the passed credential. 28439484d0c0SRobert Drehmel */ 2844ad1ff099SRobert Drehmel void 28459ddb7954SMike Barcroft getcredhostname(struct ucred *cred, char *buf, size_t size) 28469484d0c0SRobert Drehmel { 284776ca6f88SJamie Gritton struct prison *pr; 28489484d0c0SRobert Drehmel 28497455b100SJamie Gritton /* 28507455b100SJamie Gritton * A NULL credential can be used to shortcut to the physical 28517455b100SJamie Gritton * system's hostname. 28527455b100SJamie Gritton */ 285376ca6f88SJamie Gritton pr = (cred != NULL) ? cred->cr_prison : &prison0; 285476ca6f88SJamie Gritton mtx_lock(&pr->pr_mtx); 2855c1f19219SJamie Gritton strlcpy(buf, pr->pr_hostname, size); 285676ca6f88SJamie Gritton mtx_unlock(&pr->pr_mtx); 28579484d0c0SRobert Drehmel } 2858fd7a8150SMike Barcroft 28597455b100SJamie Gritton void 28607455b100SJamie Gritton getcreddomainname(struct ucred *cred, char *buf, size_t size) 28617455b100SJamie Gritton { 28627455b100SJamie Gritton 28637455b100SJamie Gritton mtx_lock(&cred->cr_prison->pr_mtx); 2864c1f19219SJamie Gritton strlcpy(buf, cred->cr_prison->pr_domainname, size); 28657455b100SJamie Gritton mtx_unlock(&cred->cr_prison->pr_mtx); 28667455b100SJamie Gritton } 28677455b100SJamie Gritton 28687455b100SJamie Gritton void 28697455b100SJamie Gritton getcredhostuuid(struct ucred *cred, char *buf, size_t size) 28707455b100SJamie Gritton { 28717455b100SJamie Gritton 28727455b100SJamie Gritton mtx_lock(&cred->cr_prison->pr_mtx); 2873c1f19219SJamie Gritton strlcpy(buf, cred->cr_prison->pr_hostuuid, size); 28747455b100SJamie Gritton mtx_unlock(&cred->cr_prison->pr_mtx); 28757455b100SJamie Gritton } 28767455b100SJamie Gritton 28777455b100SJamie Gritton void 28787455b100SJamie Gritton getcredhostid(struct ucred *cred, unsigned long *hostid) 28797455b100SJamie Gritton { 28807455b100SJamie Gritton 28817455b100SJamie Gritton mtx_lock(&cred->cr_prison->pr_mtx); 28827455b100SJamie Gritton *hostid = cred->cr_prison->pr_hostid; 28837455b100SJamie Gritton mtx_unlock(&cred->cr_prison->pr_mtx); 28847455b100SJamie Gritton } 28857455b100SJamie Gritton 2886eb79e1c7SBjoern A. Zeeb #ifdef VIMAGE 2887eb79e1c7SBjoern A. Zeeb /* 2888eb79e1c7SBjoern A. Zeeb * Determine whether the prison represented by cred owns 2889eb79e1c7SBjoern A. Zeeb * its vnet rather than having it inherited. 2890eb79e1c7SBjoern A. Zeeb * 2891eb79e1c7SBjoern A. Zeeb * Returns 1 in case the prison owns the vnet, 0 otherwise. 2892eb79e1c7SBjoern A. Zeeb */ 2893eb79e1c7SBjoern A. Zeeb int 2894eb79e1c7SBjoern A. Zeeb prison_owns_vnet(struct ucred *cred) 2895eb79e1c7SBjoern A. Zeeb { 2896eb79e1c7SBjoern A. Zeeb 2897eb79e1c7SBjoern A. Zeeb /* 2898eb79e1c7SBjoern A. Zeeb * vnets cannot be added/removed after jail creation, 2899eb79e1c7SBjoern A. Zeeb * so no need to lock here. 2900eb79e1c7SBjoern A. Zeeb */ 2901eb79e1c7SBjoern A. Zeeb return (cred->cr_prison->pr_flags & PR_VNET ? 1 : 0); 2902eb79e1c7SBjoern A. Zeeb } 2903eb79e1c7SBjoern A. Zeeb #endif 2904eb79e1c7SBjoern A. Zeeb 2905f08df373SRobert Watson /* 2906820a0de9SPawel Jakub Dawidek * Determine whether the subject represented by cred can "see" 2907820a0de9SPawel Jakub Dawidek * status of a mount point. 2908820a0de9SPawel Jakub Dawidek * Returns: 0 for permitted, ENOENT otherwise. 2909820a0de9SPawel Jakub Dawidek * XXX: This function should be called cr_canseemount() and should be 2910820a0de9SPawel Jakub Dawidek * placed in kern_prot.c. 2911f08df373SRobert Watson */ 2912f08df373SRobert Watson int 2913820a0de9SPawel Jakub Dawidek prison_canseemount(struct ucred *cred, struct mount *mp) 2914f08df373SRobert Watson { 2915820a0de9SPawel Jakub Dawidek struct prison *pr; 2916820a0de9SPawel Jakub Dawidek struct statfs *sp; 2917820a0de9SPawel Jakub Dawidek size_t len; 2918f08df373SRobert Watson 2919820a0de9SPawel Jakub Dawidek pr = cred->cr_prison; 29200304c731SJamie Gritton if (pr->pr_enforce_statfs == 0) 29210304c731SJamie Gritton return (0); 2922820a0de9SPawel Jakub Dawidek if (pr->pr_root->v_mount == mp) 2923820a0de9SPawel Jakub Dawidek return (0); 29240304c731SJamie Gritton if (pr->pr_enforce_statfs == 2) 2925820a0de9SPawel Jakub Dawidek return (ENOENT); 2926820a0de9SPawel Jakub Dawidek /* 2927820a0de9SPawel Jakub Dawidek * If jail's chroot directory is set to "/" we should be able to see 2928820a0de9SPawel Jakub Dawidek * all mount-points from inside a jail. 2929820a0de9SPawel Jakub Dawidek * This is ugly check, but this is the only situation when jail's 2930820a0de9SPawel Jakub Dawidek * directory ends with '/'. 2931820a0de9SPawel Jakub Dawidek */ 2932820a0de9SPawel Jakub Dawidek if (strcmp(pr->pr_path, "/") == 0) 2933820a0de9SPawel Jakub Dawidek return (0); 2934820a0de9SPawel Jakub Dawidek len = strlen(pr->pr_path); 2935820a0de9SPawel Jakub Dawidek sp = &mp->mnt_stat; 2936820a0de9SPawel Jakub Dawidek if (strncmp(pr->pr_path, sp->f_mntonname, len) != 0) 2937820a0de9SPawel Jakub Dawidek return (ENOENT); 2938820a0de9SPawel Jakub Dawidek /* 2939820a0de9SPawel Jakub Dawidek * Be sure that we don't have situation where jail's root directory 2940820a0de9SPawel Jakub Dawidek * is "/some/path" and mount point is "/some/pathpath". 2941820a0de9SPawel Jakub Dawidek */ 2942820a0de9SPawel Jakub Dawidek if (sp->f_mntonname[len] != '\0' && sp->f_mntonname[len] != '/') 2943820a0de9SPawel Jakub Dawidek return (ENOENT); 2944f08df373SRobert Watson return (0); 2945f08df373SRobert Watson } 2946820a0de9SPawel Jakub Dawidek 2947820a0de9SPawel Jakub Dawidek void 2948820a0de9SPawel Jakub Dawidek prison_enforce_statfs(struct ucred *cred, struct mount *mp, struct statfs *sp) 2949820a0de9SPawel Jakub Dawidek { 2950820a0de9SPawel Jakub Dawidek char jpath[MAXPATHLEN]; 2951820a0de9SPawel Jakub Dawidek struct prison *pr; 2952820a0de9SPawel Jakub Dawidek size_t len; 2953820a0de9SPawel Jakub Dawidek 2954820a0de9SPawel Jakub Dawidek pr = cred->cr_prison; 29550304c731SJamie Gritton if (pr->pr_enforce_statfs == 0) 29560304c731SJamie Gritton return; 2957820a0de9SPawel Jakub Dawidek if (prison_canseemount(cred, mp) != 0) { 2958820a0de9SPawel Jakub Dawidek bzero(sp->f_mntonname, sizeof(sp->f_mntonname)); 2959820a0de9SPawel Jakub Dawidek strlcpy(sp->f_mntonname, "[restricted]", 2960820a0de9SPawel Jakub Dawidek sizeof(sp->f_mntonname)); 2961820a0de9SPawel Jakub Dawidek return; 2962820a0de9SPawel Jakub Dawidek } 2963820a0de9SPawel Jakub Dawidek if (pr->pr_root->v_mount == mp) { 2964820a0de9SPawel Jakub Dawidek /* 2965820a0de9SPawel Jakub Dawidek * Clear current buffer data, so we are sure nothing from 2966820a0de9SPawel Jakub Dawidek * the valid path left there. 2967820a0de9SPawel Jakub Dawidek */ 2968820a0de9SPawel Jakub Dawidek bzero(sp->f_mntonname, sizeof(sp->f_mntonname)); 2969820a0de9SPawel Jakub Dawidek *sp->f_mntonname = '/'; 2970820a0de9SPawel Jakub Dawidek return; 2971820a0de9SPawel Jakub Dawidek } 2972820a0de9SPawel Jakub Dawidek /* 2973820a0de9SPawel Jakub Dawidek * If jail's chroot directory is set to "/" we should be able to see 2974820a0de9SPawel Jakub Dawidek * all mount-points from inside a jail. 2975820a0de9SPawel Jakub Dawidek */ 2976820a0de9SPawel Jakub Dawidek if (strcmp(pr->pr_path, "/") == 0) 2977820a0de9SPawel Jakub Dawidek return; 2978820a0de9SPawel Jakub Dawidek len = strlen(pr->pr_path); 2979820a0de9SPawel Jakub Dawidek strlcpy(jpath, sp->f_mntonname + len, sizeof(jpath)); 2980820a0de9SPawel Jakub Dawidek /* 2981820a0de9SPawel Jakub Dawidek * Clear current buffer data, so we are sure nothing from 2982820a0de9SPawel Jakub Dawidek * the valid path left there. 2983820a0de9SPawel Jakub Dawidek */ 2984820a0de9SPawel Jakub Dawidek bzero(sp->f_mntonname, sizeof(sp->f_mntonname)); 2985820a0de9SPawel Jakub Dawidek if (*jpath == '\0') { 2986820a0de9SPawel Jakub Dawidek /* Should never happen. */ 2987820a0de9SPawel Jakub Dawidek *sp->f_mntonname = '/'; 2988820a0de9SPawel Jakub Dawidek } else { 2989820a0de9SPawel Jakub Dawidek strlcpy(sp->f_mntonname, jpath, sizeof(sp->f_mntonname)); 2990820a0de9SPawel Jakub Dawidek } 2991f08df373SRobert Watson } 2992f08df373SRobert Watson 2993800c9408SRobert Watson /* 2994800c9408SRobert Watson * Check with permission for a specific privilege is granted within jail. We 2995800c9408SRobert Watson * have a specific list of accepted privileges; the rest are denied. 2996800c9408SRobert Watson */ 2997800c9408SRobert Watson int 2998800c9408SRobert Watson prison_priv_check(struct ucred *cred, int priv) 2999800c9408SRobert Watson { 3000800c9408SRobert Watson 30017b2ff0dcSMateusz Guzik /* 30027b2ff0dcSMateusz Guzik * Some policies have custom handlers. This routine should not be 30037b2ff0dcSMateusz Guzik * called for them. See priv_check_cred(). 30047b2ff0dcSMateusz Guzik */ 30057b2ff0dcSMateusz Guzik switch (priv) { 30067b2ff0dcSMateusz Guzik case PRIV_VFS_GENERATION: 30077b2ff0dcSMateusz Guzik KASSERT(0, ("prison_priv_check instead of a custom handler " 30087b2ff0dcSMateusz Guzik "called for %d\n", priv)); 30097b2ff0dcSMateusz Guzik } 30107b2ff0dcSMateusz Guzik 3011800c9408SRobert Watson if (!jailed(cred)) 3012800c9408SRobert Watson return (0); 3013800c9408SRobert Watson 30146bb79563SJamie Gritton #ifdef VIMAGE 30156bb79563SJamie Gritton /* 30166bb79563SJamie Gritton * Privileges specific to prisons with a virtual network stack. 30176bb79563SJamie Gritton * There might be a duplicate entry here in case the privilege 30186bb79563SJamie Gritton * is only granted conditionally in the legacy jail case. 30196bb79563SJamie Gritton */ 30206bb79563SJamie Gritton switch (priv) { 30216bb79563SJamie Gritton #ifdef notyet 30226bb79563SJamie Gritton /* 30236bb79563SJamie Gritton * NFS-specific privileges. 30246bb79563SJamie Gritton */ 30256bb79563SJamie Gritton case PRIV_NFS_DAEMON: 30266bb79563SJamie Gritton case PRIV_NFS_LOCKD: 30276bb79563SJamie Gritton #endif 30286bb79563SJamie Gritton /* 30296bb79563SJamie Gritton * Network stack privileges. 30306bb79563SJamie Gritton */ 30316bb79563SJamie Gritton case PRIV_NET_BRIDGE: 30326bb79563SJamie Gritton case PRIV_NET_GRE: 30336bb79563SJamie Gritton case PRIV_NET_BPF: 30346bb79563SJamie Gritton case PRIV_NET_RAW: /* Dup, cond. in legacy jail case. */ 30356bb79563SJamie Gritton case PRIV_NET_ROUTE: 30366bb79563SJamie Gritton case PRIV_NET_TAP: 30376bb79563SJamie Gritton case PRIV_NET_SETIFMTU: 30386bb79563SJamie Gritton case PRIV_NET_SETIFFLAGS: 30396bb79563SJamie Gritton case PRIV_NET_SETIFCAP: 3040215940b3SXin LI case PRIV_NET_SETIFDESCR: 30416bb79563SJamie Gritton case PRIV_NET_SETIFNAME : 30426bb79563SJamie Gritton case PRIV_NET_SETIFMETRIC: 30436bb79563SJamie Gritton case PRIV_NET_SETIFPHYS: 30446bb79563SJamie Gritton case PRIV_NET_SETIFMAC: 3045389474c1SKonstantin Belousov case PRIV_NET_SETLANPCP: 30466bb79563SJamie Gritton case PRIV_NET_ADDMULTI: 30476bb79563SJamie Gritton case PRIV_NET_DELMULTI: 30486bb79563SJamie Gritton case PRIV_NET_HWIOCTL: 30496bb79563SJamie Gritton case PRIV_NET_SETLLADDR: 30506bb79563SJamie Gritton case PRIV_NET_ADDIFGROUP: 30516bb79563SJamie Gritton case PRIV_NET_DELIFGROUP: 30526bb79563SJamie Gritton case PRIV_NET_IFCREATE: 30536bb79563SJamie Gritton case PRIV_NET_IFDESTROY: 30546bb79563SJamie Gritton case PRIV_NET_ADDIFADDR: 30556bb79563SJamie Gritton case PRIV_NET_DELIFADDR: 30566bb79563SJamie Gritton case PRIV_NET_LAGG: 30576bb79563SJamie Gritton case PRIV_NET_GIF: 30586bb79563SJamie Gritton case PRIV_NET_SETIFVNET: 305935fd7bc0SBjoern A. Zeeb case PRIV_NET_SETIFFIB: 30606bb79563SJamie Gritton 30616bb79563SJamie Gritton /* 30626bb79563SJamie Gritton * 802.11-related privileges. 30636bb79563SJamie Gritton */ 30646bb79563SJamie Gritton case PRIV_NET80211_GETKEY: 30656bb79563SJamie Gritton #ifdef notyet 30666bb79563SJamie Gritton case PRIV_NET80211_MANAGE: /* XXX-BZ discuss with sam@ */ 30676bb79563SJamie Gritton #endif 30686bb79563SJamie Gritton 30696bb79563SJamie Gritton #ifdef notyet 30706bb79563SJamie Gritton /* 30716bb79563SJamie Gritton * ATM privileges. 30726bb79563SJamie Gritton */ 30736bb79563SJamie Gritton case PRIV_NETATM_CFG: 30746bb79563SJamie Gritton case PRIV_NETATM_ADD: 30756bb79563SJamie Gritton case PRIV_NETATM_DEL: 30766bb79563SJamie Gritton case PRIV_NETATM_SET: 30776bb79563SJamie Gritton 30786bb79563SJamie Gritton /* 30796bb79563SJamie Gritton * Bluetooth privileges. 30806bb79563SJamie Gritton */ 30816bb79563SJamie Gritton case PRIV_NETBLUETOOTH_RAW: 30826bb79563SJamie Gritton #endif 30836bb79563SJamie Gritton 30846bb79563SJamie Gritton /* 30856bb79563SJamie Gritton * Netgraph and netgraph module privileges. 30866bb79563SJamie Gritton */ 30876bb79563SJamie Gritton case PRIV_NETGRAPH_CONTROL: 30886bb79563SJamie Gritton #ifdef notyet 30896bb79563SJamie Gritton case PRIV_NETGRAPH_TTY: 30906bb79563SJamie Gritton #endif 30916bb79563SJamie Gritton 30926bb79563SJamie Gritton /* 30936bb79563SJamie Gritton * IPv4 and IPv6 privileges. 30946bb79563SJamie Gritton */ 30956bb79563SJamie Gritton case PRIV_NETINET_IPFW: 30966bb79563SJamie Gritton case PRIV_NETINET_DIVERT: 30976bb79563SJamie Gritton case PRIV_NETINET_PF: 30986bb79563SJamie Gritton case PRIV_NETINET_DUMMYNET: 30996bb79563SJamie Gritton case PRIV_NETINET_CARP: 31006bb79563SJamie Gritton case PRIV_NETINET_MROUTE: 31016bb79563SJamie Gritton case PRIV_NETINET_RAW: 31026bb79563SJamie Gritton case PRIV_NETINET_ADDRCTRL6: 31036bb79563SJamie Gritton case PRIV_NETINET_ND6: 31046bb79563SJamie Gritton case PRIV_NETINET_SCOPE6: 31056bb79563SJamie Gritton case PRIV_NETINET_ALIFETIME6: 31066bb79563SJamie Gritton case PRIV_NETINET_IPSEC: 31076bb79563SJamie Gritton case PRIV_NETINET_BINDANY: 31086bb79563SJamie Gritton 31096bb79563SJamie Gritton #ifdef notyet 31106bb79563SJamie Gritton /* 31116bb79563SJamie Gritton * NCP privileges. 31126bb79563SJamie Gritton */ 31136bb79563SJamie Gritton case PRIV_NETNCP: 31146bb79563SJamie Gritton 31156bb79563SJamie Gritton /* 31166bb79563SJamie Gritton * SMB privileges. 31176bb79563SJamie Gritton */ 31186bb79563SJamie Gritton case PRIV_NETSMB: 31196bb79563SJamie Gritton #endif 31206bb79563SJamie Gritton 31216bb79563SJamie Gritton /* 31226bb79563SJamie Gritton * No default: or deny here. 31236bb79563SJamie Gritton * In case of no permit fall through to next switch(). 31246bb79563SJamie Gritton */ 31256bb79563SJamie Gritton if (cred->cr_prison->pr_flags & PR_VNET) 31266bb79563SJamie Gritton return (0); 31276bb79563SJamie Gritton } 31286bb79563SJamie Gritton #endif /* VIMAGE */ 31296bb79563SJamie Gritton 3130800c9408SRobert Watson switch (priv) { 3131800c9408SRobert Watson 3132800c9408SRobert Watson /* 3133800c9408SRobert Watson * Allow ktrace privileges for root in jail. 3134800c9408SRobert Watson */ 3135800c9408SRobert Watson case PRIV_KTRACE: 3136800c9408SRobert Watson 3137c3c1b5e6SRobert Watson #if 0 3138800c9408SRobert Watson /* 3139800c9408SRobert Watson * Allow jailed processes to configure audit identity and 3140800c9408SRobert Watson * submit audit records (login, etc). In the future we may 3141800c9408SRobert Watson * want to further refine the relationship between audit and 3142800c9408SRobert Watson * jail. 3143800c9408SRobert Watson */ 3144800c9408SRobert Watson case PRIV_AUDIT_GETAUDIT: 3145800c9408SRobert Watson case PRIV_AUDIT_SETAUDIT: 3146800c9408SRobert Watson case PRIV_AUDIT_SUBMIT: 3147c3c1b5e6SRobert Watson #endif 3148800c9408SRobert Watson 3149800c9408SRobert Watson /* 3150800c9408SRobert Watson * Allow jailed processes to manipulate process UNIX 3151800c9408SRobert Watson * credentials in any way they see fit. 3152800c9408SRobert Watson */ 3153800c9408SRobert Watson case PRIV_CRED_SETUID: 3154800c9408SRobert Watson case PRIV_CRED_SETEUID: 3155800c9408SRobert Watson case PRIV_CRED_SETGID: 3156800c9408SRobert Watson case PRIV_CRED_SETEGID: 3157800c9408SRobert Watson case PRIV_CRED_SETGROUPS: 3158800c9408SRobert Watson case PRIV_CRED_SETREUID: 3159800c9408SRobert Watson case PRIV_CRED_SETREGID: 3160800c9408SRobert Watson case PRIV_CRED_SETRESUID: 3161800c9408SRobert Watson case PRIV_CRED_SETRESGID: 3162800c9408SRobert Watson 3163800c9408SRobert Watson /* 3164800c9408SRobert Watson * Jail implements visibility constraints already, so allow 3165800c9408SRobert Watson * jailed root to override uid/gid-based constraints. 3166800c9408SRobert Watson */ 3167800c9408SRobert Watson case PRIV_SEEOTHERGIDS: 3168800c9408SRobert Watson case PRIV_SEEOTHERUIDS: 3169800c9408SRobert Watson 3170800c9408SRobert Watson /* 3171800c9408SRobert Watson * Jail implements inter-process debugging limits already, so 3172800c9408SRobert Watson * allow jailed root various debugging privileges. 3173800c9408SRobert Watson */ 3174800c9408SRobert Watson case PRIV_DEBUG_DIFFCRED: 3175800c9408SRobert Watson case PRIV_DEBUG_SUGID: 3176800c9408SRobert Watson case PRIV_DEBUG_UNPRIV: 3177800c9408SRobert Watson 3178800c9408SRobert Watson /* 3179800c9408SRobert Watson * Allow jail to set various resource limits and login 3180800c9408SRobert Watson * properties, and for now, exceed process resource limits. 3181800c9408SRobert Watson */ 3182800c9408SRobert Watson case PRIV_PROC_LIMIT: 3183800c9408SRobert Watson case PRIV_PROC_SETLOGIN: 3184800c9408SRobert Watson case PRIV_PROC_SETRLIMIT: 3185800c9408SRobert Watson 3186800c9408SRobert Watson /* 3187800c9408SRobert Watson * System V and POSIX IPC privileges are granted in jail. 3188800c9408SRobert Watson */ 3189800c9408SRobert Watson case PRIV_IPC_READ: 3190800c9408SRobert Watson case PRIV_IPC_WRITE: 3191800c9408SRobert Watson case PRIV_IPC_ADMIN: 3192800c9408SRobert Watson case PRIV_IPC_MSGSIZE: 3193800c9408SRobert Watson case PRIV_MQ_ADMIN: 3194800c9408SRobert Watson 3195800c9408SRobert Watson /* 31960304c731SJamie Gritton * Jail operations within a jail work on child jails. 31970304c731SJamie Gritton */ 31980304c731SJamie Gritton case PRIV_JAIL_ATTACH: 31990304c731SJamie Gritton case PRIV_JAIL_SET: 32000304c731SJamie Gritton case PRIV_JAIL_REMOVE: 32010304c731SJamie Gritton 32020304c731SJamie Gritton /* 3203800c9408SRobert Watson * Jail implements its own inter-process limits, so allow 3204800c9408SRobert Watson * root processes in jail to change scheduling on other 3205800c9408SRobert Watson * processes in the same jail. Likewise for signalling. 3206800c9408SRobert Watson */ 3207800c9408SRobert Watson case PRIV_SCHED_DIFFCRED: 3208413628a7SBjoern A. Zeeb case PRIV_SCHED_CPUSET: 3209800c9408SRobert Watson case PRIV_SIGNAL_DIFFCRED: 3210800c9408SRobert Watson case PRIV_SIGNAL_SUGID: 3211800c9408SRobert Watson 3212800c9408SRobert Watson /* 3213800c9408SRobert Watson * Allow jailed processes to write to sysctls marked as jail 3214800c9408SRobert Watson * writable. 3215800c9408SRobert Watson */ 3216800c9408SRobert Watson case PRIV_SYSCTL_WRITEJAIL: 3217800c9408SRobert Watson 3218800c9408SRobert Watson /* 3219800c9408SRobert Watson * Allow root in jail to manage a variety of quota 3220e82d0201SRobert Watson * properties. These should likely be conditional on a 3221e82d0201SRobert Watson * configuration option. 3222800c9408SRobert Watson */ 322395b091d2SRobert Watson case PRIV_VFS_GETQUOTA: 322495b091d2SRobert Watson case PRIV_VFS_SETQUOTA: 3225800c9408SRobert Watson 3226800c9408SRobert Watson /* 3227800c9408SRobert Watson * Since Jail relies on chroot() to implement file system 3228800c9408SRobert Watson * protections, grant many VFS privileges to root in jail. 3229800c9408SRobert Watson * Be careful to exclude mount-related and NFS-related 3230800c9408SRobert Watson * privileges. 3231800c9408SRobert Watson */ 3232800c9408SRobert Watson case PRIV_VFS_READ: 3233800c9408SRobert Watson case PRIV_VFS_WRITE: 3234800c9408SRobert Watson case PRIV_VFS_ADMIN: 3235800c9408SRobert Watson case PRIV_VFS_EXEC: 3236800c9408SRobert Watson case PRIV_VFS_LOOKUP: 3237800c9408SRobert Watson case PRIV_VFS_BLOCKRESERVE: /* XXXRW: Slightly surprising. */ 3238800c9408SRobert Watson case PRIV_VFS_CHFLAGS_DEV: 3239800c9408SRobert Watson case PRIV_VFS_CHOWN: 3240800c9408SRobert Watson case PRIV_VFS_CHROOT: 3241bb531912SPawel Jakub Dawidek case PRIV_VFS_RETAINSUGID: 3242800c9408SRobert Watson case PRIV_VFS_FCHROOT: 3243800c9408SRobert Watson case PRIV_VFS_LINK: 3244800c9408SRobert Watson case PRIV_VFS_SETGID: 3245e41966dcSRobert Watson case PRIV_VFS_STAT: 3246800c9408SRobert Watson case PRIV_VFS_STICKYFILE: 3247bb56d716SJamie Gritton 3248bb56d716SJamie Gritton /* 3249bb56d716SJamie Gritton * As in the non-jail case, non-root users are expected to be 3250bb56d716SJamie Gritton * able to read kernel/phyiscal memory (provided /dev/[k]mem 3251bb56d716SJamie Gritton * exists in the jail and they have permission to access it). 3252bb56d716SJamie Gritton */ 3253bb56d716SJamie Gritton case PRIV_KMEM_READ: 3254800c9408SRobert Watson return (0); 3255800c9408SRobert Watson 3256800c9408SRobert Watson /* 3257800c9408SRobert Watson * Depending on the global setting, allow privilege of 3258800c9408SRobert Watson * setting system flags. 3259800c9408SRobert Watson */ 3260800c9408SRobert Watson case PRIV_VFS_SYSFLAGS: 32610304c731SJamie Gritton if (cred->cr_prison->pr_allow & PR_ALLOW_CHFLAGS) 3262800c9408SRobert Watson return (0); 3263800c9408SRobert Watson else 3264800c9408SRobert Watson return (EPERM); 3265800c9408SRobert Watson 3266800c9408SRobert Watson /* 3267f3a8d2f9SPawel Jakub Dawidek * Depending on the global setting, allow privilege of 3268f3a8d2f9SPawel Jakub Dawidek * mounting/unmounting file systems. 3269f3a8d2f9SPawel Jakub Dawidek */ 3270f3a8d2f9SPawel Jakub Dawidek case PRIV_VFS_MOUNT: 3271f3a8d2f9SPawel Jakub Dawidek case PRIV_VFS_UNMOUNT: 3272f3a8d2f9SPawel Jakub Dawidek case PRIV_VFS_MOUNT_NONUSER: 327324b0502eSPawel Jakub Dawidek case PRIV_VFS_MOUNT_OWNER: 3274435d4667SMartin Matuska if (cred->cr_prison->pr_allow & PR_ALLOW_MOUNT && 3275435d4667SMartin Matuska cred->cr_prison->pr_enforce_statfs < 2) 3276f3a8d2f9SPawel Jakub Dawidek return (0); 3277f3a8d2f9SPawel Jakub Dawidek else 3278f3a8d2f9SPawel Jakub Dawidek return (EPERM); 3279f3a8d2f9SPawel Jakub Dawidek 3280f3a8d2f9SPawel Jakub Dawidek /* 3281ccd6ac9fSAntoine Brodin * Conditionnaly allow locking (unlocking) physical pages 3282ccd6ac9fSAntoine Brodin * in memory. 3283ccd6ac9fSAntoine Brodin */ 3284ccd6ac9fSAntoine Brodin case PRIV_VM_MLOCK: 3285ccd6ac9fSAntoine Brodin case PRIV_VM_MUNLOCK: 3286ccd6ac9fSAntoine Brodin if (cred->cr_prison->pr_allow & PR_ALLOW_MLOCK) 3287ccd6ac9fSAntoine Brodin return (0); 3288ccd6ac9fSAntoine Brodin else 3289ccd6ac9fSAntoine Brodin return (EPERM); 3290ccd6ac9fSAntoine Brodin 3291ccd6ac9fSAntoine Brodin /* 3292e28f9b7dSAllan Jude * Conditionally allow jailed root to bind reserved ports. 3293800c9408SRobert Watson */ 3294800c9408SRobert Watson case PRIV_NETINET_RESERVEDPORT: 3295e28f9b7dSAllan Jude if (cred->cr_prison->pr_allow & PR_ALLOW_RESERVED_PORTS) 3296e28f9b7dSAllan Jude return (0); 3297e28f9b7dSAllan Jude else 3298e28f9b7dSAllan Jude return (EPERM); 3299e28f9b7dSAllan Jude 3300e28f9b7dSAllan Jude /* 3301e28f9b7dSAllan Jude * Allow jailed root to reuse in-use ports. 3302e28f9b7dSAllan Jude */ 33034b084056SRobert Watson case PRIV_NETINET_REUSEPORT: 3304800c9408SRobert Watson return (0); 3305800c9408SRobert Watson 3306800c9408SRobert Watson /* 3307e3043798SPedro F. Giffuni * Allow jailed root to set certain IPv4/6 (option) headers. 330879ba3952SBjoern A. Zeeb */ 330979ba3952SBjoern A. Zeeb case PRIV_NETINET_SETHDROPTS: 331079ba3952SBjoern A. Zeeb return (0); 331179ba3952SBjoern A. Zeeb 331279ba3952SBjoern A. Zeeb /* 3313800c9408SRobert Watson * Conditionally allow creating raw sockets in jail. 3314800c9408SRobert Watson */ 3315800c9408SRobert Watson case PRIV_NETINET_RAW: 33160304c731SJamie Gritton if (cred->cr_prison->pr_allow & PR_ALLOW_RAW_SOCKETS) 3317800c9408SRobert Watson return (0); 3318800c9408SRobert Watson else 3319800c9408SRobert Watson return (EPERM); 3320800c9408SRobert Watson 3321800c9408SRobert Watson /* 3322800c9408SRobert Watson * Since jail implements its own visibility limits on netstat 3323800c9408SRobert Watson * sysctls, allow getcred. This allows identd to work in 3324800c9408SRobert Watson * jail. 3325800c9408SRobert Watson */ 3326800c9408SRobert Watson case PRIV_NETINET_GETCRED: 3327800c9408SRobert Watson return (0); 3328800c9408SRobert Watson 33292bfc50bcSEdward Tomasz Napierala /* 33302bfc50bcSEdward Tomasz Napierala * Allow jailed root to set loginclass. 33312bfc50bcSEdward Tomasz Napierala */ 33322bfc50bcSEdward Tomasz Napierala case PRIV_PROC_SETLOGINCLASS: 33332bfc50bcSEdward Tomasz Napierala return (0); 33342bfc50bcSEdward Tomasz Napierala 3335b19d66fdSJamie Gritton /* 33364520f617SJamie Gritton * Do not allow a process inside a jail to read the kernel 3337b19d66fdSJamie Gritton * message buffer unless explicitly permitted. 3338b19d66fdSJamie Gritton */ 3339b19d66fdSJamie Gritton case PRIV_MSGBUF: 3340b19d66fdSJamie Gritton if (cred->cr_prison->pr_allow & PR_ALLOW_READ_MSGBUF) 3341b19d66fdSJamie Gritton return (0); 3342b19d66fdSJamie Gritton return (EPERM); 3343b19d66fdSJamie Gritton 3344800c9408SRobert Watson default: 3345800c9408SRobert Watson /* 3346800c9408SRobert Watson * In all remaining cases, deny the privilege request. This 3347800c9408SRobert Watson * includes almost all network privileges, many system 3348800c9408SRobert Watson * configuration privileges. 3349800c9408SRobert Watson */ 3350800c9408SRobert Watson return (EPERM); 3351800c9408SRobert Watson } 3352800c9408SRobert Watson } 3353800c9408SRobert Watson 33540304c731SJamie Gritton /* 33550304c731SJamie Gritton * Return the part of pr2's name that is relative to pr1, or the whole name 33560304c731SJamie Gritton * if it does not directly follow. 33570304c731SJamie Gritton */ 33580304c731SJamie Gritton 33590304c731SJamie Gritton char * 33600304c731SJamie Gritton prison_name(struct prison *pr1, struct prison *pr2) 33610304c731SJamie Gritton { 33620304c731SJamie Gritton char *name; 33630304c731SJamie Gritton 33640304c731SJamie Gritton /* Jails see themselves as "0" (if they see themselves at all). */ 33650304c731SJamie Gritton if (pr1 == pr2) 33660304c731SJamie Gritton return "0"; 33670304c731SJamie Gritton name = pr2->pr_name; 33680304c731SJamie Gritton if (prison_ischild(pr1, pr2)) { 33690304c731SJamie Gritton /* 33700304c731SJamie Gritton * pr1 isn't locked (and allprison_lock may not be either) 33710304c731SJamie Gritton * so its length can't be counted on. But the number of dots 33720304c731SJamie Gritton * can be counted on - and counted. 33730304c731SJamie Gritton */ 33740304c731SJamie Gritton for (; pr1 != &prison0; pr1 = pr1->pr_parent) 33750304c731SJamie Gritton name = strchr(name, '.') + 1; 33760304c731SJamie Gritton } 33770304c731SJamie Gritton return (name); 33780304c731SJamie Gritton } 33790304c731SJamie Gritton 33800304c731SJamie Gritton /* 33810304c731SJamie Gritton * Return the part of pr2's path that is relative to pr1, or the whole path 33820304c731SJamie Gritton * if it does not directly follow. 33830304c731SJamie Gritton */ 33840304c731SJamie Gritton static char * 33850304c731SJamie Gritton prison_path(struct prison *pr1, struct prison *pr2) 33860304c731SJamie Gritton { 33870304c731SJamie Gritton char *path1, *path2; 33880304c731SJamie Gritton int len1; 33890304c731SJamie Gritton 33900304c731SJamie Gritton path1 = pr1->pr_path; 33910304c731SJamie Gritton path2 = pr2->pr_path; 33920304c731SJamie Gritton if (!strcmp(path1, "/")) 33930304c731SJamie Gritton return (path2); 33940304c731SJamie Gritton len1 = strlen(path1); 33950304c731SJamie Gritton if (strncmp(path1, path2, len1)) 33960304c731SJamie Gritton return (path2); 33970304c731SJamie Gritton if (path2[len1] == '\0') 33980304c731SJamie Gritton return "/"; 33990304c731SJamie Gritton if (path2[len1] == '/') 34000304c731SJamie Gritton return (path2 + len1); 34010304c731SJamie Gritton return (path2); 34020304c731SJamie Gritton } 34030304c731SJamie Gritton 34040304c731SJamie Gritton /* 34050304c731SJamie Gritton * Jail-related sysctls. 34060304c731SJamie Gritton */ 3407*7029da5cSPawel Biernacki static SYSCTL_NODE(_security, OID_AUTO, jail, CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 34080304c731SJamie Gritton "Jails"); 34090304c731SJamie Gritton 3410fd7a8150SMike Barcroft static int 3411fd7a8150SMike Barcroft sysctl_jail_list(SYSCTL_HANDLER_ARGS) 3412fd7a8150SMike Barcroft { 3413b38ff370SJamie Gritton struct xprison *xp; 34140304c731SJamie Gritton struct prison *pr, *cpr; 3415b38ff370SJamie Gritton #ifdef INET 3416b38ff370SJamie Gritton struct in_addr *ip4 = NULL; 3417b38ff370SJamie Gritton int ip4s = 0; 3418b38ff370SJamie Gritton #endif 3419b38ff370SJamie Gritton #ifdef INET6 34203beefaedSColin Percival struct in6_addr *ip6 = NULL; 3421b38ff370SJamie Gritton int ip6s = 0; 3422b38ff370SJamie Gritton #endif 34230304c731SJamie Gritton int descend, error; 3424fd7a8150SMike Barcroft 3425b38ff370SJamie Gritton xp = malloc(sizeof(*xp), M_TEMP, M_WAITOK); 34260304c731SJamie Gritton pr = req->td->td_ucred->cr_prison; 3427b38ff370SJamie Gritton error = 0; 3428dc68a633SPawel Jakub Dawidek sx_slock(&allprison_lock); 34290304c731SJamie Gritton FOREACH_PRISON_DESCENDANT(pr, cpr, descend) { 34300304c731SJamie Gritton #if defined(INET) || defined(INET6) 3431b38ff370SJamie Gritton again: 34320304c731SJamie Gritton #endif 34330304c731SJamie Gritton mtx_lock(&cpr->pr_mtx); 3434413628a7SBjoern A. Zeeb #ifdef INET 34350304c731SJamie Gritton if (cpr->pr_ip4s > 0) { 34360304c731SJamie Gritton if (ip4s < cpr->pr_ip4s) { 34370304c731SJamie Gritton ip4s = cpr->pr_ip4s; 34380304c731SJamie Gritton mtx_unlock(&cpr->pr_mtx); 3439b38ff370SJamie Gritton ip4 = realloc(ip4, ip4s * 3440b38ff370SJamie Gritton sizeof(struct in_addr), M_TEMP, M_WAITOK); 3441b38ff370SJamie Gritton goto again; 3442b38ff370SJamie Gritton } 34430304c731SJamie Gritton bcopy(cpr->pr_ip4, ip4, 34440304c731SJamie Gritton cpr->pr_ip4s * sizeof(struct in_addr)); 3445b38ff370SJamie Gritton } 3446413628a7SBjoern A. Zeeb #endif 3447413628a7SBjoern A. Zeeb #ifdef INET6 34480304c731SJamie Gritton if (cpr->pr_ip6s > 0) { 34490304c731SJamie Gritton if (ip6s < cpr->pr_ip6s) { 34500304c731SJamie Gritton ip6s = cpr->pr_ip6s; 34510304c731SJamie Gritton mtx_unlock(&cpr->pr_mtx); 3452b38ff370SJamie Gritton ip6 = realloc(ip6, ip6s * 3453b38ff370SJamie Gritton sizeof(struct in6_addr), M_TEMP, M_WAITOK); 3454b38ff370SJamie Gritton goto again; 3455413628a7SBjoern A. Zeeb } 34560304c731SJamie Gritton bcopy(cpr->pr_ip6, ip6, 34570304c731SJamie Gritton cpr->pr_ip6s * sizeof(struct in6_addr)); 3458b38ff370SJamie Gritton } 3459b38ff370SJamie Gritton #endif 34600304c731SJamie Gritton if (cpr->pr_ref == 0) { 34610304c731SJamie Gritton mtx_unlock(&cpr->pr_mtx); 3462b38ff370SJamie Gritton continue; 3463b38ff370SJamie Gritton } 3464b38ff370SJamie Gritton bzero(xp, sizeof(*xp)); 3465fd7a8150SMike Barcroft xp->pr_version = XPRISON_VERSION; 34660304c731SJamie Gritton xp->pr_id = cpr->pr_id; 34670304c731SJamie Gritton xp->pr_state = cpr->pr_uref > 0 3468b38ff370SJamie Gritton ? PRISON_STATE_ALIVE : PRISON_STATE_DYING; 34690304c731SJamie Gritton strlcpy(xp->pr_path, prison_path(pr, cpr), sizeof(xp->pr_path)); 3470c1f19219SJamie Gritton strlcpy(xp->pr_host, cpr->pr_hostname, sizeof(xp->pr_host)); 34710304c731SJamie Gritton strlcpy(xp->pr_name, prison_name(pr, cpr), sizeof(xp->pr_name)); 3472413628a7SBjoern A. Zeeb #ifdef INET 34730304c731SJamie Gritton xp->pr_ip4s = cpr->pr_ip4s; 3474413628a7SBjoern A. Zeeb #endif 3475413628a7SBjoern A. Zeeb #ifdef INET6 34760304c731SJamie Gritton xp->pr_ip6s = cpr->pr_ip6s; 3477413628a7SBjoern A. Zeeb #endif 34780304c731SJamie Gritton mtx_unlock(&cpr->pr_mtx); 3479b38ff370SJamie Gritton error = SYSCTL_OUT(req, xp, sizeof(*xp)); 3480b38ff370SJamie Gritton if (error) 3481b38ff370SJamie Gritton break; 3482413628a7SBjoern A. Zeeb #ifdef INET 3483b38ff370SJamie Gritton if (xp->pr_ip4s > 0) { 3484b38ff370SJamie Gritton error = SYSCTL_OUT(req, ip4, 3485b38ff370SJamie Gritton xp->pr_ip4s * sizeof(struct in_addr)); 3486b38ff370SJamie Gritton if (error) 3487b38ff370SJamie Gritton break; 3488413628a7SBjoern A. Zeeb } 3489413628a7SBjoern A. Zeeb #endif 3490413628a7SBjoern A. Zeeb #ifdef INET6 3491b38ff370SJamie Gritton if (xp->pr_ip6s > 0) { 3492b38ff370SJamie Gritton error = SYSCTL_OUT(req, ip6, 3493b38ff370SJamie Gritton xp->pr_ip6s * sizeof(struct in6_addr)); 3494b38ff370SJamie Gritton if (error) 3495b38ff370SJamie Gritton break; 3496413628a7SBjoern A. Zeeb } 3497413628a7SBjoern A. Zeeb #endif 3498fd7a8150SMike Barcroft } 3499dc68a633SPawel Jakub Dawidek sx_sunlock(&allprison_lock); 3500b38ff370SJamie Gritton free(xp, M_TEMP); 3501b38ff370SJamie Gritton #ifdef INET 3502b38ff370SJamie Gritton free(ip4, M_TEMP); 3503b38ff370SJamie Gritton #endif 3504b38ff370SJamie Gritton #ifdef INET6 3505b38ff370SJamie Gritton free(ip6, M_TEMP); 3506b38ff370SJamie Gritton #endif 3507fd7a8150SMike Barcroft return (error); 3508fd7a8150SMike Barcroft } 3509fd7a8150SMike Barcroft 3510f3b86a5fSEd Schouten SYSCTL_OID(_security_jail, OID_AUTO, list, 3511f3b86a5fSEd Schouten CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0, 3512f3b86a5fSEd Schouten sysctl_jail_list, "S", "List of active jails"); 3513461167c2SPawel Jakub Dawidek 3514461167c2SPawel Jakub Dawidek static int 3515461167c2SPawel Jakub Dawidek sysctl_jail_jailed(SYSCTL_HANDLER_ARGS) 3516461167c2SPawel Jakub Dawidek { 3517461167c2SPawel Jakub Dawidek int error, injail; 3518461167c2SPawel Jakub Dawidek 3519461167c2SPawel Jakub Dawidek injail = jailed(req->td->td_ucred); 3520461167c2SPawel Jakub Dawidek error = SYSCTL_OUT(req, &injail, sizeof(injail)); 3521461167c2SPawel Jakub Dawidek 3522461167c2SPawel Jakub Dawidek return (error); 3523461167c2SPawel Jakub Dawidek } 35240304c731SJamie Gritton 3525f3b86a5fSEd Schouten SYSCTL_PROC(_security_jail, OID_AUTO, jailed, 3526f3b86a5fSEd Schouten CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0, 3527f3b86a5fSEd Schouten sysctl_jail_jailed, "I", "Process in jail?"); 3528413628a7SBjoern A. Zeeb 3529761d2bb5SJamie Gritton static int 3530761d2bb5SJamie Gritton sysctl_jail_vnet(SYSCTL_HANDLER_ARGS) 3531761d2bb5SJamie Gritton { 3532761d2bb5SJamie Gritton int error, havevnet; 3533761d2bb5SJamie Gritton #ifdef VIMAGE 3534761d2bb5SJamie Gritton struct ucred *cred = req->td->td_ucred; 3535761d2bb5SJamie Gritton 3536761d2bb5SJamie Gritton havevnet = jailed(cred) && prison_owns_vnet(cred); 3537761d2bb5SJamie Gritton #else 3538761d2bb5SJamie Gritton havevnet = 0; 3539761d2bb5SJamie Gritton #endif 3540761d2bb5SJamie Gritton error = SYSCTL_OUT(req, &havevnet, sizeof(havevnet)); 3541761d2bb5SJamie Gritton 3542761d2bb5SJamie Gritton return (error); 3543761d2bb5SJamie Gritton } 3544761d2bb5SJamie Gritton 3545761d2bb5SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, vnet, 3546761d2bb5SJamie Gritton CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0, 3547bb8f1623SBjoern A. Zeeb sysctl_jail_vnet, "I", "Jail owns vnet?"); 3548761d2bb5SJamie Gritton 35490304c731SJamie Gritton #if defined(INET) || defined(INET6) 3550e92e0574SJamie Gritton SYSCTL_UINT(_security_jail, OID_AUTO, jail_max_af_ips, CTLFLAG_RW, 35510304c731SJamie Gritton &jail_max_af_ips, 0, 3552c542c43eSJamie Gritton "Number of IP addresses a jail may have at most per address family (deprecated)"); 35530304c731SJamie Gritton #endif 35540304c731SJamie Gritton 35550304c731SJamie Gritton /* 3556c542c43eSJamie Gritton * Default parameters for jail(2) compatibility. For historical reasons, 3557c542c43eSJamie Gritton * the sysctl names have varying similarity to the parameter names. Prisons 3558c542c43eSJamie Gritton * just see their own parameters, and can't change them. 35590304c731SJamie Gritton */ 35600304c731SJamie Gritton static int 35610304c731SJamie Gritton sysctl_jail_default_allow(SYSCTL_HANDLER_ARGS) 35620304c731SJamie Gritton { 35630304c731SJamie Gritton struct prison *pr; 35640304c731SJamie Gritton int allow, error, i; 35650304c731SJamie Gritton 35660304c731SJamie Gritton pr = req->td->td_ucred->cr_prison; 35670304c731SJamie Gritton allow = (pr == &prison0) ? jail_default_allow : pr->pr_allow; 35680304c731SJamie Gritton 35690304c731SJamie Gritton /* Get the current flag value, and convert it to a boolean. */ 35700304c731SJamie Gritton i = (allow & arg2) ? 1 : 0; 35710304c731SJamie Gritton if (arg1 != NULL) 35720304c731SJamie Gritton i = !i; 35730304c731SJamie Gritton error = sysctl_handle_int(oidp, &i, 0, req); 3574c542c43eSJamie Gritton if (error || !req->newptr) 35750304c731SJamie Gritton return (error); 35760304c731SJamie Gritton i = i ? arg2 : 0; 35770304c731SJamie Gritton if (arg1 != NULL) 35780304c731SJamie Gritton i ^= arg2; 35790304c731SJamie Gritton /* 35800304c731SJamie Gritton * The sysctls don't have CTLFLAGS_PRISON, so assume prison0 35810304c731SJamie Gritton * for writing. 35820304c731SJamie Gritton */ 35830304c731SJamie Gritton mtx_lock(&prison0.pr_mtx); 35840304c731SJamie Gritton jail_default_allow = (jail_default_allow & ~arg2) | i; 35850304c731SJamie Gritton mtx_unlock(&prison0.pr_mtx); 35860304c731SJamie Gritton return (0); 35870304c731SJamie Gritton } 35880304c731SJamie Gritton 35890304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, set_hostname_allowed, 3590c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 35910304c731SJamie Gritton NULL, PR_ALLOW_SET_HOSTNAME, sysctl_jail_default_allow, "I", 3592c542c43eSJamie Gritton "Processes in jail can set their hostnames (deprecated)"); 35930304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, socket_unixiproute_only, 3594c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 35950304c731SJamie Gritton (void *)1, PR_ALLOW_SOCKET_AF, sysctl_jail_default_allow, "I", 3596c542c43eSJamie Gritton "Processes in jail are limited to creating UNIX/IP/route sockets only (deprecated)"); 35970304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, sysvipc_allowed, 3598c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 35990304c731SJamie Gritton NULL, PR_ALLOW_SYSVIPC, sysctl_jail_default_allow, "I", 3600c542c43eSJamie Gritton "Processes in jail can use System V IPC primitives (deprecated)"); 36010304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, allow_raw_sockets, 3602c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 36030304c731SJamie Gritton NULL, PR_ALLOW_RAW_SOCKETS, sysctl_jail_default_allow, "I", 3604c542c43eSJamie Gritton "Prison root can create raw sockets (deprecated)"); 36050304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, chflags_allowed, 3606c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 36070304c731SJamie Gritton NULL, PR_ALLOW_CHFLAGS, sysctl_jail_default_allow, "I", 3608c542c43eSJamie Gritton "Processes in jail can alter system file flags (deprecated)"); 36090304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, mount_allowed, 3610c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 36110304c731SJamie Gritton NULL, PR_ALLOW_MOUNT, sysctl_jail_default_allow, "I", 3612c542c43eSJamie Gritton "Processes in jail can mount/unmount jail-friendly file systems (deprecated)"); 36130304c731SJamie Gritton 36140304c731SJamie Gritton static int 36150304c731SJamie Gritton sysctl_jail_default_level(SYSCTL_HANDLER_ARGS) 36160304c731SJamie Gritton { 36170304c731SJamie Gritton struct prison *pr; 36180304c731SJamie Gritton int level, error; 36190304c731SJamie Gritton 36200304c731SJamie Gritton pr = req->td->td_ucred->cr_prison; 36210304c731SJamie Gritton level = (pr == &prison0) ? *(int *)arg1 : *(int *)((char *)pr + arg2); 36220304c731SJamie Gritton error = sysctl_handle_int(oidp, &level, 0, req); 3623c542c43eSJamie Gritton if (error || !req->newptr) 36240304c731SJamie Gritton return (error); 36250304c731SJamie Gritton *(int *)arg1 = level; 36260304c731SJamie Gritton return (0); 36270304c731SJamie Gritton } 36280304c731SJamie Gritton 36290304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, enforce_statfs, 3630c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 3631c542c43eSJamie Gritton &jail_default_enforce_statfs, offsetof(struct prison, pr_enforce_statfs), 36320304c731SJamie Gritton sysctl_jail_default_level, "I", 3633c542c43eSJamie Gritton "Processes in jail cannot see all mounted file systems (deprecated)"); 3634c542c43eSJamie Gritton 36350cc207a6SMartin Matuska SYSCTL_PROC(_security_jail, OID_AUTO, devfs_ruleset, 3636c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, 3637c542c43eSJamie Gritton &jail_default_devfs_rsnum, offsetof(struct prison, pr_devfs_rsnum), 36380cc207a6SMartin Matuska sysctl_jail_default_level, "I", 3639c542c43eSJamie Gritton "Ruleset for the devfs filesystem in jail (deprecated)"); 36400cc207a6SMartin Matuska 36410304c731SJamie Gritton /* 36420304c731SJamie Gritton * Nodes to describe jail parameters. Maximum length of string parameters 36430304c731SJamie Gritton * is returned in the string itself, and the other parameters exist merely 36440304c731SJamie Gritton * to make themselves and their types known. 36450304c731SJamie Gritton */ 3646*7029da5cSPawel Biernacki SYSCTL_NODE(_security_jail, OID_AUTO, param, CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 36470304c731SJamie Gritton "Jail parameters"); 36480304c731SJamie Gritton 36490304c731SJamie Gritton int 36500304c731SJamie Gritton sysctl_jail_param(SYSCTL_HANDLER_ARGS) 36510304c731SJamie Gritton { 36520304c731SJamie Gritton int i; 36530304c731SJamie Gritton long l; 36540304c731SJamie Gritton size_t s; 36550304c731SJamie Gritton char numbuf[12]; 36560304c731SJamie Gritton 36570304c731SJamie Gritton switch (oidp->oid_kind & CTLTYPE) 36580304c731SJamie Gritton { 36590304c731SJamie Gritton case CTLTYPE_LONG: 36600304c731SJamie Gritton case CTLTYPE_ULONG: 36610304c731SJamie Gritton l = 0; 36620304c731SJamie Gritton #ifdef SCTL_MASK32 36630304c731SJamie Gritton if (!(req->flags & SCTL_MASK32)) 36640304c731SJamie Gritton #endif 36650304c731SJamie Gritton return (SYSCTL_OUT(req, &l, sizeof(l))); 36660304c731SJamie Gritton case CTLTYPE_INT: 36670304c731SJamie Gritton case CTLTYPE_UINT: 36680304c731SJamie Gritton i = 0; 36690304c731SJamie Gritton return (SYSCTL_OUT(req, &i, sizeof(i))); 36700304c731SJamie Gritton case CTLTYPE_STRING: 3671e4cd31ddSJeff Roberson snprintf(numbuf, sizeof(numbuf), "%jd", (intmax_t)arg2); 36720304c731SJamie Gritton return 36730304c731SJamie Gritton (sysctl_handle_string(oidp, numbuf, sizeof(numbuf), req)); 36740304c731SJamie Gritton case CTLTYPE_STRUCT: 36750304c731SJamie Gritton s = (size_t)arg2; 36760304c731SJamie Gritton return (SYSCTL_OUT(req, &s, sizeof(s))); 36770304c731SJamie Gritton } 36780304c731SJamie Gritton return (0); 36790304c731SJamie Gritton } 36800304c731SJamie Gritton 3681b96bd95bSIan Lepore /* 3682b96bd95bSIan Lepore * CTLFLAG_RDTUN in the following indicates jail parameters that can be set at 3683b96bd95bSIan Lepore * jail creation time but cannot be changed in an existing jail. 3684b96bd95bSIan Lepore */ 36850304c731SJamie Gritton SYSCTL_JAIL_PARAM(, jid, CTLTYPE_INT | CTLFLAG_RDTUN, "I", "Jail ID"); 36860304c731SJamie Gritton SYSCTL_JAIL_PARAM(, parent, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail parent ID"); 36870304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(, name, CTLFLAG_RW, MAXHOSTNAMELEN, "Jail name"); 36880304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(, path, CTLFLAG_RDTUN, MAXPATHLEN, "Jail root path"); 36890304c731SJamie Gritton SYSCTL_JAIL_PARAM(, securelevel, CTLTYPE_INT | CTLFLAG_RW, 36900304c731SJamie Gritton "I", "Jail secure level"); 3691b96bd95bSIan Lepore SYSCTL_JAIL_PARAM(, osreldate, CTLTYPE_INT | CTLFLAG_RDTUN, "I", 3692b96bd95bSIan Lepore "Jail value for kern.osreldate and uname -K"); 3693b96bd95bSIan Lepore SYSCTL_JAIL_PARAM_STRING(, osrelease, CTLFLAG_RDTUN, OSRELEASELEN, 3694b96bd95bSIan Lepore "Jail value for kern.osrelease and uname -r"); 36950304c731SJamie Gritton SYSCTL_JAIL_PARAM(, enforce_statfs, CTLTYPE_INT | CTLFLAG_RW, 36960304c731SJamie Gritton "I", "Jail cannot see all mounted file systems"); 36970cc207a6SMartin Matuska SYSCTL_JAIL_PARAM(, devfs_ruleset, CTLTYPE_INT | CTLFLAG_RW, 36980cc207a6SMartin Matuska "I", "Ruleset for in-jail devfs mounts"); 36990304c731SJamie Gritton SYSCTL_JAIL_PARAM(, persist, CTLTYPE_INT | CTLFLAG_RW, 37000304c731SJamie Gritton "B", "Jail persistence"); 3701679e1390SJamie Gritton #ifdef VIMAGE 3702679e1390SJamie Gritton SYSCTL_JAIL_PARAM(, vnet, CTLTYPE_INT | CTLFLAG_RDTUN, 37037cbf7213SJamie Gritton "E,jailsys", "Virtual network stack"); 3704679e1390SJamie Gritton #endif 37050304c731SJamie Gritton SYSCTL_JAIL_PARAM(, dying, CTLTYPE_INT | CTLFLAG_RD, 37060304c731SJamie Gritton "B", "Jail is in the process of shutting down"); 37070304c731SJamie Gritton 3708b97457e2SJamie Gritton SYSCTL_JAIL_PARAM_NODE(children, "Number of child jails"); 3709b97457e2SJamie Gritton SYSCTL_JAIL_PARAM(_children, cur, CTLTYPE_INT | CTLFLAG_RD, 3710b97457e2SJamie Gritton "I", "Current number of child jails"); 3711b97457e2SJamie Gritton SYSCTL_JAIL_PARAM(_children, max, CTLTYPE_INT | CTLFLAG_RW, 3712b97457e2SJamie Gritton "I", "Maximum number of child jails"); 3713b97457e2SJamie Gritton 37147cbf7213SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(host, CTLFLAG_RW, "Jail host info"); 37150304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, hostname, CTLFLAG_RW, MAXHOSTNAMELEN, 37160304c731SJamie Gritton "Jail hostname"); 371776ca6f88SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, domainname, CTLFLAG_RW, MAXHOSTNAMELEN, 371876ca6f88SJamie Gritton "Jail NIS domainname"); 371976ca6f88SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, hostuuid, CTLFLAG_RW, HOSTUUIDLEN, 372076ca6f88SJamie Gritton "Jail host UUID"); 372176ca6f88SJamie Gritton SYSCTL_JAIL_PARAM(_host, hostid, CTLTYPE_ULONG | CTLFLAG_RW, 372276ca6f88SJamie Gritton "LU", "Jail host ID"); 37230304c731SJamie Gritton 37240304c731SJamie Gritton SYSCTL_JAIL_PARAM_NODE(cpuset, "Jail cpuset"); 37250304c731SJamie Gritton SYSCTL_JAIL_PARAM(_cpuset, id, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail cpuset ID"); 37260304c731SJamie Gritton 37270304c731SJamie Gritton #ifdef INET 37282b0d6f81SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(ip4, CTLFLAG_RDTUN, 37292b0d6f81SJamie Gritton "Jail IPv4 address virtualization"); 37300304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRUCT(_ip4, addr, CTLFLAG_RW, sizeof(struct in_addr), 37310304c731SJamie Gritton "S,in_addr,a", "Jail IPv4 addresses"); 3732592bcae8SBjoern A. Zeeb SYSCTL_JAIL_PARAM(_ip4, saddrsel, CTLTYPE_INT | CTLFLAG_RW, 3733592bcae8SBjoern A. Zeeb "B", "Do (not) use IPv4 source address selection rather than the " 3734592bcae8SBjoern A. Zeeb "primary jail IPv4 address."); 37350304c731SJamie Gritton #endif 37360304c731SJamie Gritton #ifdef INET6 37372b0d6f81SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(ip6, CTLFLAG_RDTUN, 37382b0d6f81SJamie Gritton "Jail IPv6 address virtualization"); 37390304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRUCT(_ip6, addr, CTLFLAG_RW, sizeof(struct in6_addr), 37400304c731SJamie Gritton "S,in6_addr,a", "Jail IPv6 addresses"); 3741592bcae8SBjoern A. Zeeb SYSCTL_JAIL_PARAM(_ip6, saddrsel, CTLTYPE_INT | CTLFLAG_RW, 3742592bcae8SBjoern A. Zeeb "B", "Do (not) use IPv6 source address selection rather than the " 3743592bcae8SBjoern A. Zeeb "primary jail IPv6 address."); 37440304c731SJamie Gritton #endif 37450304c731SJamie Gritton 37460304c731SJamie Gritton SYSCTL_JAIL_PARAM_NODE(allow, "Jail permission flags"); 37470304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, set_hostname, CTLTYPE_INT | CTLFLAG_RW, 37480304c731SJamie Gritton "B", "Jail may set hostname"); 37490304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, sysvipc, CTLTYPE_INT | CTLFLAG_RW, 37500304c731SJamie Gritton "B", "Jail may use SYSV IPC"); 37510304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, raw_sockets, CTLTYPE_INT | CTLFLAG_RW, 37520304c731SJamie Gritton "B", "Jail may create raw sockets"); 37530304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, chflags, CTLTYPE_INT | CTLFLAG_RW, 37540304c731SJamie Gritton "B", "Jail may alter system file flags"); 37550304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, quotas, CTLTYPE_INT | CTLFLAG_RW, 37560304c731SJamie Gritton "B", "Jail may set file quotas"); 37570304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, socket_af, CTLTYPE_INT | CTLFLAG_RW, 37580304c731SJamie Gritton "B", "Jail may create sockets other than just UNIX/IPv4/IPv6/route"); 3759ccd6ac9fSAntoine Brodin SYSCTL_JAIL_PARAM(_allow, mlock, CTLTYPE_INT | CTLFLAG_RW, 3760ccd6ac9fSAntoine Brodin "B", "Jail may lock (unlock) physical pages in memory"); 3761e28f9b7dSAllan Jude SYSCTL_JAIL_PARAM(_allow, reserved_ports, CTLTYPE_INT | CTLFLAG_RW, 3762e28f9b7dSAllan Jude "B", "Jail may bind sockets to reserved ports"); 3763b19d66fdSJamie Gritton SYSCTL_JAIL_PARAM(_allow, read_msgbuf, CTLTYPE_INT | CTLFLAG_RW, 3764b19d66fdSJamie Gritton "B", "Jail may read the kernel message buffer"); 3765b3079544SJamie Gritton SYSCTL_JAIL_PARAM(_allow, unprivileged_proc_debug, CTLTYPE_INT | CTLFLAG_RW, 3766b3079544SJamie Gritton "B", "Unprivileged processes may use process debugging facilities"); 37670304c731SJamie Gritton 3768bf3db8aaSMartin Matuska SYSCTL_JAIL_PARAM_SUBNODE(allow, mount, "Jail mount/unmount permission flags"); 3769bf3db8aaSMartin Matuska SYSCTL_JAIL_PARAM(_allow_mount, , CTLTYPE_INT | CTLFLAG_RW, 3770bf3db8aaSMartin Matuska "B", "Jail may mount/unmount jail-friendly file systems in general"); 37710e5c6bd4SJamie Gritton 37720e5c6bd4SJamie Gritton /* 37730a172404SJamie Gritton * Add a dynamic parameter allow.<name>, or allow.<prefix>.<name>. Return 37740a172404SJamie Gritton * its associated bit in the pr_allow bitmask, or zero if the parameter was 37750a172404SJamie Gritton * not created. 37760e5c6bd4SJamie Gritton */ 37770a172404SJamie Gritton unsigned 37780a172404SJamie Gritton prison_add_allow(const char *prefix, const char *name, const char *prefix_descr, 37790a172404SJamie Gritton const char *descr) 37800e5c6bd4SJamie Gritton { 37810e5c6bd4SJamie Gritton struct bool_flags *bf; 37820a172404SJamie Gritton struct sysctl_oid *parent; 37830a172404SJamie Gritton char *allow_name, *allow_noname, *allowed; 3784c542c43eSJamie Gritton #ifndef NO_SYSCTL_DESCR 3785c542c43eSJamie Gritton char *descr_deprecated; 3786c542c43eSJamie Gritton #endif 37870e5c6bd4SJamie Gritton unsigned allow_flag; 37880e5c6bd4SJamie Gritton 37890a172404SJamie Gritton if (prefix 37900a172404SJamie Gritton ? asprintf(&allow_name, M_PRISON, "allow.%s.%s", prefix, name) 37910a172404SJamie Gritton < 0 || 37920a172404SJamie Gritton asprintf(&allow_noname, M_PRISON, "allow.%s.no%s", prefix, name) 37930a172404SJamie Gritton < 0 37940a172404SJamie Gritton : asprintf(&allow_name, M_PRISON, "allow.%s", name) < 0 || 37950a172404SJamie Gritton asprintf(&allow_noname, M_PRISON, "allow.no%s", name) < 0) { 37960e5c6bd4SJamie Gritton free(allow_name, M_PRISON); 37970a172404SJamie Gritton return 0; 37980e5c6bd4SJamie Gritton } 37990e5c6bd4SJamie Gritton 38000e5c6bd4SJamie Gritton /* 38010a172404SJamie Gritton * See if this parameter has already beed added, i.e. a module was 38020a172404SJamie Gritton * previously loaded/unloaded. 38030e5c6bd4SJamie Gritton */ 38040e5c6bd4SJamie Gritton mtx_lock(&prison0.pr_mtx); 38050e5c6bd4SJamie Gritton for (bf = pr_flag_allow; 38060e5c6bd4SJamie Gritton bf < pr_flag_allow + nitems(pr_flag_allow) && bf->flag != 0; 38070e5c6bd4SJamie Gritton bf++) { 38080e5c6bd4SJamie Gritton if (strcmp(bf->name, allow_name) == 0) { 38090a172404SJamie Gritton allow_flag = bf->flag; 38100e5c6bd4SJamie Gritton goto no_add; 38110e5c6bd4SJamie Gritton } 38120e5c6bd4SJamie Gritton } 38130e5c6bd4SJamie Gritton 38140e5c6bd4SJamie Gritton /* 38150e5c6bd4SJamie Gritton * Find a free bit in prison0's pr_allow, failing if there are none 38160e5c6bd4SJamie Gritton * (which shouldn't happen as long as we keep track of how many 38170a172404SJamie Gritton * potential dynamic flags exist). 3818b3079544SJamie Gritton * 3819b3079544SJamie Gritton * Due to per-jail unprivileged process debugging support 3820b3079544SJamie Gritton * using pr_allow, also verify against PR_ALLOW_ALL_STATIC. 3821b3079544SJamie Gritton * prison0 may have unprivileged process debugging unset. 38220e5c6bd4SJamie Gritton */ 38230e5c6bd4SJamie Gritton for (allow_flag = 1;; allow_flag <<= 1) { 38240e5c6bd4SJamie Gritton if (allow_flag == 0) 38250e5c6bd4SJamie Gritton goto no_add; 3826b3079544SJamie Gritton if (allow_flag & PR_ALLOW_ALL_STATIC) 3827b3079544SJamie Gritton continue; 38280e5c6bd4SJamie Gritton if ((prison0.pr_allow & allow_flag) == 0) 38290e5c6bd4SJamie Gritton break; 38300e5c6bd4SJamie Gritton } 38310e5c6bd4SJamie Gritton 38320e5c6bd4SJamie Gritton /* 38330e5c6bd4SJamie Gritton * Note the parameter in the next open slot in pr_flag_allow. 38340e5c6bd4SJamie Gritton * Set the flag last so code that checks pr_flag_allow can do so 38350e5c6bd4SJamie Gritton * without locking. 38360e5c6bd4SJamie Gritton */ 38370e5c6bd4SJamie Gritton for (bf = pr_flag_allow; bf->flag != 0; bf++) 38380e5c6bd4SJamie Gritton if (bf == pr_flag_allow + nitems(pr_flag_allow)) { 38390e5c6bd4SJamie Gritton /* This should never happen, but is not fatal. */ 38400a172404SJamie Gritton allow_flag = 0; 38410e5c6bd4SJamie Gritton goto no_add; 38420e5c6bd4SJamie Gritton } 38430e5c6bd4SJamie Gritton prison0.pr_allow |= allow_flag; 38440e5c6bd4SJamie Gritton bf->name = allow_name; 38450e5c6bd4SJamie Gritton bf->noname = allow_noname; 38460e5c6bd4SJamie Gritton bf->flag = allow_flag; 38470e5c6bd4SJamie Gritton mtx_unlock(&prison0.pr_mtx); 38480e5c6bd4SJamie Gritton 3849c542c43eSJamie Gritton /* 3850c542c43eSJamie Gritton * Create sysctls for the paramter, and the back-compat global 3851c542c43eSJamie Gritton * permission. 3852c542c43eSJamie Gritton */ 38530a172404SJamie Gritton parent = prefix 38540a172404SJamie Gritton ? SYSCTL_ADD_NODE(NULL, 38550a172404SJamie Gritton SYSCTL_CHILDREN(&sysctl___security_jail_param_allow), 3856*7029da5cSPawel Biernacki OID_AUTO, prefix, CTLFLAG_MPSAFE, 0, prefix_descr) 38570a172404SJamie Gritton : &sysctl___security_jail_param_allow; 38580a172404SJamie Gritton (void)SYSCTL_ADD_PROC(NULL, SYSCTL_CHILDREN(parent), OID_AUTO, 38590a172404SJamie Gritton name, CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 38600e5c6bd4SJamie Gritton NULL, 0, sysctl_jail_param, "B", descr); 38610a172404SJamie Gritton if ((prefix 38620a172404SJamie Gritton ? asprintf(&allowed, M_TEMP, "%s_%s_allowed", prefix, name) 38630a172404SJamie Gritton : asprintf(&allowed, M_TEMP, "%s_allowed", name)) >= 0) { 3864c542c43eSJamie Gritton #ifndef NO_SYSCTL_DESCR 3865c542c43eSJamie Gritton (void)asprintf(&descr_deprecated, M_TEMP, "%s (deprecated)", 3866c542c43eSJamie Gritton descr); 3867c542c43eSJamie Gritton #endif 38680e5c6bd4SJamie Gritton (void)SYSCTL_ADD_PROC(NULL, 38690a172404SJamie Gritton SYSCTL_CHILDREN(&sysctl___security_jail), OID_AUTO, allowed, 3870c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, allow_flag, 3871c542c43eSJamie Gritton sysctl_jail_default_allow, "I", descr_deprecated); 3872c542c43eSJamie Gritton #ifndef NO_SYSCTL_DESCR 3873c542c43eSJamie Gritton free(descr_deprecated, M_TEMP); 3874c542c43eSJamie Gritton #endif 38750a172404SJamie Gritton free(allowed, M_TEMP); 38760e5c6bd4SJamie Gritton } 38770a172404SJamie Gritton return allow_flag; 38780e5c6bd4SJamie Gritton 38790e5c6bd4SJamie Gritton no_add: 38800e5c6bd4SJamie Gritton mtx_unlock(&prison0.pr_mtx); 38810e5c6bd4SJamie Gritton free(allow_name, M_PRISON); 38820e5c6bd4SJamie Gritton free(allow_noname, M_PRISON); 38830a172404SJamie Gritton return allow_flag; 38840a172404SJamie Gritton } 38850a172404SJamie Gritton 38860a172404SJamie Gritton /* 38870a172404SJamie Gritton * The VFS system will register jail-aware filesystems here. They each get 38880a172404SJamie Gritton * a parameter allow.mount.xxxfs and a flag to check when a jailed user 38890a172404SJamie Gritton * attempts to mount. 38900a172404SJamie Gritton */ 38910a172404SJamie Gritton void 38920a172404SJamie Gritton prison_add_vfs(struct vfsconf *vfsp) 38930a172404SJamie Gritton { 38940a172404SJamie Gritton #ifdef NO_SYSCTL_DESCR 38950a172404SJamie Gritton 38960a172404SJamie Gritton vfsp->vfc_prison_flag = prison_add_allow("mount", vfsp->vfc_name, 38970a172404SJamie Gritton NULL, NULL); 38980a172404SJamie Gritton #else 38990a172404SJamie Gritton char *descr; 39000a172404SJamie Gritton 39010a172404SJamie Gritton (void)asprintf(&descr, M_TEMP, "Jail may mount the %s file system", 39020a172404SJamie Gritton vfsp->vfc_name); 39030a172404SJamie Gritton vfsp->vfc_prison_flag = prison_add_allow("mount", vfsp->vfc_name, 39040a172404SJamie Gritton NULL, descr); 39050a172404SJamie Gritton free(descr, M_TEMP); 39060a172404SJamie Gritton #endif 39070e5c6bd4SJamie Gritton } 3908bf3db8aaSMartin Matuska 39094b5c9cf6SEdward Tomasz Napierala #ifdef RACCT 3910097055e2SEdward Tomasz Napierala void 3911097055e2SEdward Tomasz Napierala prison_racct_foreach(void (*callback)(struct racct *racct, 391215db3c07SEdward Tomasz Napierala void *arg2, void *arg3), void (*pre)(void), void (*post)(void), 391315db3c07SEdward Tomasz Napierala void *arg2, void *arg3) 3914097055e2SEdward Tomasz Napierala { 3915a7ad07bfSEdward Tomasz Napierala struct prison_racct *prr; 3916097055e2SEdward Tomasz Napierala 39174b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 39184b5c9cf6SEdward Tomasz Napierala 3919097055e2SEdward Tomasz Napierala sx_slock(&allprison_lock); 392015db3c07SEdward Tomasz Napierala if (pre != NULL) 392115db3c07SEdward Tomasz Napierala (pre)(); 3922a7ad07bfSEdward Tomasz Napierala LIST_FOREACH(prr, &allprison_racct, prr_next) 3923a7ad07bfSEdward Tomasz Napierala (callback)(prr->prr_racct, arg2, arg3); 392415db3c07SEdward Tomasz Napierala if (post != NULL) 392515db3c07SEdward Tomasz Napierala (post)(); 3926097055e2SEdward Tomasz Napierala sx_sunlock(&allprison_lock); 3927097055e2SEdward Tomasz Napierala } 39280304c731SJamie Gritton 3929a7ad07bfSEdward Tomasz Napierala static struct prison_racct * 3930a7ad07bfSEdward Tomasz Napierala prison_racct_find_locked(const char *name) 3931a7ad07bfSEdward Tomasz Napierala { 3932a7ad07bfSEdward Tomasz Napierala struct prison_racct *prr; 3933a7ad07bfSEdward Tomasz Napierala 39344b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 3935a7ad07bfSEdward Tomasz Napierala sx_assert(&allprison_lock, SA_XLOCKED); 3936a7ad07bfSEdward Tomasz Napierala 3937a7ad07bfSEdward Tomasz Napierala if (name[0] == '\0' || strlen(name) >= MAXHOSTNAMELEN) 3938a7ad07bfSEdward Tomasz Napierala return (NULL); 3939a7ad07bfSEdward Tomasz Napierala 3940a7ad07bfSEdward Tomasz Napierala LIST_FOREACH(prr, &allprison_racct, prr_next) { 3941a7ad07bfSEdward Tomasz Napierala if (strcmp(name, prr->prr_name) != 0) 3942a7ad07bfSEdward Tomasz Napierala continue; 3943a7ad07bfSEdward Tomasz Napierala 3944a7ad07bfSEdward Tomasz Napierala /* Found prison_racct with a matching name? */ 3945a7ad07bfSEdward Tomasz Napierala prison_racct_hold(prr); 3946a7ad07bfSEdward Tomasz Napierala return (prr); 3947a7ad07bfSEdward Tomasz Napierala } 3948a7ad07bfSEdward Tomasz Napierala 3949a7ad07bfSEdward Tomasz Napierala /* Add new prison_racct. */ 3950a7ad07bfSEdward Tomasz Napierala prr = malloc(sizeof(*prr), M_PRISON_RACCT, M_ZERO | M_WAITOK); 3951a7ad07bfSEdward Tomasz Napierala racct_create(&prr->prr_racct); 3952a7ad07bfSEdward Tomasz Napierala 3953a7ad07bfSEdward Tomasz Napierala strcpy(prr->prr_name, name); 3954a7ad07bfSEdward Tomasz Napierala refcount_init(&prr->prr_refcount, 1); 3955a7ad07bfSEdward Tomasz Napierala LIST_INSERT_HEAD(&allprison_racct, prr, prr_next); 3956a7ad07bfSEdward Tomasz Napierala 3957a7ad07bfSEdward Tomasz Napierala return (prr); 3958a7ad07bfSEdward Tomasz Napierala } 3959a7ad07bfSEdward Tomasz Napierala 3960a7ad07bfSEdward Tomasz Napierala struct prison_racct * 3961a7ad07bfSEdward Tomasz Napierala prison_racct_find(const char *name) 3962a7ad07bfSEdward Tomasz Napierala { 3963a7ad07bfSEdward Tomasz Napierala struct prison_racct *prr; 3964a7ad07bfSEdward Tomasz Napierala 39654b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 39664b5c9cf6SEdward Tomasz Napierala 3967a7ad07bfSEdward Tomasz Napierala sx_xlock(&allprison_lock); 3968a7ad07bfSEdward Tomasz Napierala prr = prison_racct_find_locked(name); 3969a7ad07bfSEdward Tomasz Napierala sx_xunlock(&allprison_lock); 3970a7ad07bfSEdward Tomasz Napierala return (prr); 3971a7ad07bfSEdward Tomasz Napierala } 3972a7ad07bfSEdward Tomasz Napierala 3973a7ad07bfSEdward Tomasz Napierala void 3974a7ad07bfSEdward Tomasz Napierala prison_racct_hold(struct prison_racct *prr) 3975a7ad07bfSEdward Tomasz Napierala { 3976a7ad07bfSEdward Tomasz Napierala 39774b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 39784b5c9cf6SEdward Tomasz Napierala 3979a7ad07bfSEdward Tomasz Napierala refcount_acquire(&prr->prr_refcount); 3980a7ad07bfSEdward Tomasz Napierala } 3981a7ad07bfSEdward Tomasz Napierala 3982c34bbd2aSEdward Tomasz Napierala static void 3983c34bbd2aSEdward Tomasz Napierala prison_racct_free_locked(struct prison_racct *prr) 3984c34bbd2aSEdward Tomasz Napierala { 3985c34bbd2aSEdward Tomasz Napierala 39864b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 3987c34bbd2aSEdward Tomasz Napierala sx_assert(&allprison_lock, SA_XLOCKED); 3988c34bbd2aSEdward Tomasz Napierala 3989c34bbd2aSEdward Tomasz Napierala if (refcount_release(&prr->prr_refcount)) { 3990c34bbd2aSEdward Tomasz Napierala racct_destroy(&prr->prr_racct); 3991c34bbd2aSEdward Tomasz Napierala LIST_REMOVE(prr, prr_next); 3992c34bbd2aSEdward Tomasz Napierala free(prr, M_PRISON_RACCT); 3993c34bbd2aSEdward Tomasz Napierala } 3994c34bbd2aSEdward Tomasz Napierala } 3995c34bbd2aSEdward Tomasz Napierala 3996a7ad07bfSEdward Tomasz Napierala void 3997a7ad07bfSEdward Tomasz Napierala prison_racct_free(struct prison_racct *prr) 3998a7ad07bfSEdward Tomasz Napierala { 3999a7ad07bfSEdward Tomasz Napierala 40004b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 4001c34bbd2aSEdward Tomasz Napierala sx_assert(&allprison_lock, SA_UNLOCKED); 4002c34bbd2aSEdward Tomasz Napierala 40036ff4688bSMateusz Guzik if (refcount_release_if_not_last(&prr->prr_refcount)) 4004a7ad07bfSEdward Tomasz Napierala return; 4005a7ad07bfSEdward Tomasz Napierala 4006a7ad07bfSEdward Tomasz Napierala sx_xlock(&allprison_lock); 4007c34bbd2aSEdward Tomasz Napierala prison_racct_free_locked(prr); 4008a7ad07bfSEdward Tomasz Napierala sx_xunlock(&allprison_lock); 4009a7ad07bfSEdward Tomasz Napierala } 4010a7ad07bfSEdward Tomasz Napierala 4011a7ad07bfSEdward Tomasz Napierala static void 4012a7ad07bfSEdward Tomasz Napierala prison_racct_attach(struct prison *pr) 4013a7ad07bfSEdward Tomasz Napierala { 4014a7ad07bfSEdward Tomasz Napierala struct prison_racct *prr; 4015a7ad07bfSEdward Tomasz Napierala 40164b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 4017c34bbd2aSEdward Tomasz Napierala sx_assert(&allprison_lock, SA_XLOCKED); 4018c34bbd2aSEdward Tomasz Napierala 4019a7ad07bfSEdward Tomasz Napierala prr = prison_racct_find_locked(pr->pr_name); 4020a7ad07bfSEdward Tomasz Napierala KASSERT(prr != NULL, ("cannot find prison_racct")); 4021a7ad07bfSEdward Tomasz Napierala 4022a7ad07bfSEdward Tomasz Napierala pr->pr_prison_racct = prr; 4023a7ad07bfSEdward Tomasz Napierala } 4024a7ad07bfSEdward Tomasz Napierala 4025c34bbd2aSEdward Tomasz Napierala /* 4026c34bbd2aSEdward Tomasz Napierala * Handle jail renaming. From the racct point of view, renaming means 4027c34bbd2aSEdward Tomasz Napierala * moving from one prison_racct to another. 4028c34bbd2aSEdward Tomasz Napierala */ 4029c34bbd2aSEdward Tomasz Napierala static void 4030c34bbd2aSEdward Tomasz Napierala prison_racct_modify(struct prison *pr) 4031c34bbd2aSEdward Tomasz Napierala { 4032dbadb015SKonstantin Belousov #ifdef RCTL 4033c34bbd2aSEdward Tomasz Napierala struct proc *p; 4034c34bbd2aSEdward Tomasz Napierala struct ucred *cred; 4035dbadb015SKonstantin Belousov #endif 4036c34bbd2aSEdward Tomasz Napierala struct prison_racct *oldprr; 4037c34bbd2aSEdward Tomasz Napierala 40384b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 40394b5c9cf6SEdward Tomasz Napierala 4040c34bbd2aSEdward Tomasz Napierala sx_slock(&allproc_lock); 4041c34bbd2aSEdward Tomasz Napierala sx_xlock(&allprison_lock); 4042c34bbd2aSEdward Tomasz Napierala 4043e30345e7SEdward Tomasz Napierala if (strcmp(pr->pr_name, pr->pr_prison_racct->prr_name) == 0) { 4044e30345e7SEdward Tomasz Napierala sx_xunlock(&allprison_lock); 4045e30345e7SEdward Tomasz Napierala sx_sunlock(&allproc_lock); 4046c34bbd2aSEdward Tomasz Napierala return; 4047e30345e7SEdward Tomasz Napierala } 4048c34bbd2aSEdward Tomasz Napierala 4049c34bbd2aSEdward Tomasz Napierala oldprr = pr->pr_prison_racct; 4050c34bbd2aSEdward Tomasz Napierala pr->pr_prison_racct = NULL; 4051c34bbd2aSEdward Tomasz Napierala 4052c34bbd2aSEdward Tomasz Napierala prison_racct_attach(pr); 4053c34bbd2aSEdward Tomasz Napierala 4054c34bbd2aSEdward Tomasz Napierala /* 4055c34bbd2aSEdward Tomasz Napierala * Move resource utilisation records. 4056c34bbd2aSEdward Tomasz Napierala */ 4057c34bbd2aSEdward Tomasz Napierala racct_move(pr->pr_prison_racct->prr_racct, oldprr->prr_racct); 4058c34bbd2aSEdward Tomasz Napierala 4059f87beb93SAndriy Gapon #ifdef RCTL 4060c34bbd2aSEdward Tomasz Napierala /* 4061c34bbd2aSEdward Tomasz Napierala * Force rctl to reattach rules to processes. 4062c34bbd2aSEdward Tomasz Napierala */ 4063c34bbd2aSEdward Tomasz Napierala FOREACH_PROC_IN_SYSTEM(p) { 4064c34bbd2aSEdward Tomasz Napierala PROC_LOCK(p); 4065c34bbd2aSEdward Tomasz Napierala cred = crhold(p->p_ucred); 4066c34bbd2aSEdward Tomasz Napierala PROC_UNLOCK(p); 4067f87beb93SAndriy Gapon rctl_proc_ucred_changed(p, cred); 4068c34bbd2aSEdward Tomasz Napierala crfree(cred); 4069c34bbd2aSEdward Tomasz Napierala } 4070f87beb93SAndriy Gapon #endif 4071c34bbd2aSEdward Tomasz Napierala 4072c34bbd2aSEdward Tomasz Napierala sx_sunlock(&allproc_lock); 4073c34bbd2aSEdward Tomasz Napierala prison_racct_free_locked(oldprr); 4074c34bbd2aSEdward Tomasz Napierala sx_xunlock(&allprison_lock); 4075c34bbd2aSEdward Tomasz Napierala } 4076c34bbd2aSEdward Tomasz Napierala 4077a7ad07bfSEdward Tomasz Napierala static void 4078a7ad07bfSEdward Tomasz Napierala prison_racct_detach(struct prison *pr) 4079a7ad07bfSEdward Tomasz Napierala { 4080c34bbd2aSEdward Tomasz Napierala 40814b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 4082c34bbd2aSEdward Tomasz Napierala sx_assert(&allprison_lock, SA_UNLOCKED); 4083c34bbd2aSEdward Tomasz Napierala 4084af3c786cSMateusz Guzik if (pr->pr_prison_racct == NULL) 4085af3c786cSMateusz Guzik return; 4086a7ad07bfSEdward Tomasz Napierala prison_racct_free(pr->pr_prison_racct); 4087a7ad07bfSEdward Tomasz Napierala pr->pr_prison_racct = NULL; 4088a7ad07bfSEdward Tomasz Napierala } 4089a7ad07bfSEdward Tomasz Napierala #endif /* RACCT */ 4090a7ad07bfSEdward Tomasz Napierala 4091413628a7SBjoern A. Zeeb #ifdef DDB 4092b38ff370SJamie Gritton 4093b38ff370SJamie Gritton static void 4094b38ff370SJamie Gritton db_show_prison(struct prison *pr) 4095413628a7SBjoern A. Zeeb { 4096672756aaSJamie Gritton struct bool_flags *bf; 4097672756aaSJamie Gritton struct jailsys_flags *jsf; 4098b38ff370SJamie Gritton #if defined(INET) || defined(INET6) 4099b38ff370SJamie Gritton int ii; 4100413628a7SBjoern A. Zeeb #endif 4101672756aaSJamie Gritton unsigned f; 41028144690aSEric van Gyzen #ifdef INET 41038144690aSEric van Gyzen char ip4buf[INET_ADDRSTRLEN]; 41048144690aSEric van Gyzen #endif 4105413628a7SBjoern A. Zeeb #ifdef INET6 4106413628a7SBjoern A. Zeeb char ip6buf[INET6_ADDRSTRLEN]; 4107413628a7SBjoern A. Zeeb #endif 4108413628a7SBjoern A. Zeeb 4109b38ff370SJamie Gritton db_printf("prison %p:\n", pr); 4110b38ff370SJamie Gritton db_printf(" jid = %d\n", pr->pr_id); 4111b38ff370SJamie Gritton db_printf(" name = %s\n", pr->pr_name); 41120304c731SJamie Gritton db_printf(" parent = %p\n", pr->pr_parent); 4113b38ff370SJamie Gritton db_printf(" ref = %d\n", pr->pr_ref); 4114b38ff370SJamie Gritton db_printf(" uref = %d\n", pr->pr_uref); 4115b38ff370SJamie Gritton db_printf(" path = %s\n", pr->pr_path); 4116b38ff370SJamie Gritton db_printf(" cpuset = %d\n", pr->pr_cpuset 4117b38ff370SJamie Gritton ? pr->pr_cpuset->cs_id : -1); 4118679e1390SJamie Gritton #ifdef VIMAGE 4119679e1390SJamie Gritton db_printf(" vnet = %p\n", pr->pr_vnet); 4120679e1390SJamie Gritton #endif 4121b38ff370SJamie Gritton db_printf(" root = %p\n", pr->pr_root); 4122b38ff370SJamie Gritton db_printf(" securelevel = %d\n", pr->pr_securelevel); 41230cc207a6SMartin Matuska db_printf(" devfs_rsnum = %d\n", pr->pr_devfs_rsnum); 4124fe0518e9SBjoern A. Zeeb db_printf(" children.max = %d\n", pr->pr_childmax); 4125fe0518e9SBjoern A. Zeeb db_printf(" children.cur = %d\n", pr->pr_childcount); 41260304c731SJamie Gritton db_printf(" child = %p\n", LIST_FIRST(&pr->pr_children)); 41270304c731SJamie Gritton db_printf(" sibling = %p\n", LIST_NEXT(pr, pr_sibling)); 4128fe0518e9SBjoern A. Zeeb db_printf(" flags = 0x%x", pr->pr_flags); 4129672756aaSJamie Gritton for (bf = pr_flag_bool; bf < pr_flag_bool + nitems(pr_flag_bool); bf++) 4130672756aaSJamie Gritton if (pr->pr_flags & bf->flag) 4131672756aaSJamie Gritton db_printf(" %s", bf->name); 4132672756aaSJamie Gritton for (jsf = pr_flag_jailsys; 4133672756aaSJamie Gritton jsf < pr_flag_jailsys + nitems(pr_flag_jailsys); 4134672756aaSJamie Gritton jsf++) { 4135672756aaSJamie Gritton f = pr->pr_flags & (jsf->disable | jsf->new); 4136672756aaSJamie Gritton db_printf(" %-16s= %s\n", jsf->name, 4137672756aaSJamie Gritton (f != 0 && f == jsf->disable) ? "disable" 4138672756aaSJamie Gritton : (f == jsf->new) ? "new" 41397cbf7213SJamie Gritton : "inherit"); 41407cbf7213SJamie Gritton } 4141fe0518e9SBjoern A. Zeeb db_printf(" allow = 0x%x", pr->pr_allow); 4142672756aaSJamie Gritton for (bf = pr_flag_allow; 41430e5c6bd4SJamie Gritton bf < pr_flag_allow + nitems(pr_flag_allow) && bf->flag != 0; 4144672756aaSJamie Gritton bf++) 4145672756aaSJamie Gritton if (pr->pr_allow & bf->flag) 4146672756aaSJamie Gritton db_printf(" %s", bf->name); 4147b38ff370SJamie Gritton db_printf("\n"); 41480304c731SJamie Gritton db_printf(" enforce_statfs = %d\n", pr->pr_enforce_statfs); 4149c1f19219SJamie Gritton db_printf(" host.hostname = %s\n", pr->pr_hostname); 4150c1f19219SJamie Gritton db_printf(" host.domainname = %s\n", pr->pr_domainname); 4151c1f19219SJamie Gritton db_printf(" host.hostuuid = %s\n", pr->pr_hostuuid); 415276ca6f88SJamie Gritton db_printf(" host.hostid = %lu\n", pr->pr_hostid); 4153413628a7SBjoern A. Zeeb #ifdef INET 4154b38ff370SJamie Gritton db_printf(" ip4s = %d\n", pr->pr_ip4s); 4155b38ff370SJamie Gritton for (ii = 0; ii < pr->pr_ip4s; ii++) 4156b38ff370SJamie Gritton db_printf(" %s %s\n", 4157fe0518e9SBjoern A. Zeeb ii == 0 ? "ip4.addr =" : " ", 41588144690aSEric van Gyzen inet_ntoa_r(pr->pr_ip4[ii], ip4buf)); 4159413628a7SBjoern A. Zeeb #endif 4160413628a7SBjoern A. Zeeb #ifdef INET6 4161b38ff370SJamie Gritton db_printf(" ip6s = %d\n", pr->pr_ip6s); 4162b38ff370SJamie Gritton for (ii = 0; ii < pr->pr_ip6s; ii++) 4163b38ff370SJamie Gritton db_printf(" %s %s\n", 4164fe0518e9SBjoern A. Zeeb ii == 0 ? "ip6.addr =" : " ", 4165b38ff370SJamie Gritton ip6_sprintf(ip6buf, &pr->pr_ip6[ii])); 4166b38ff370SJamie Gritton #endif 4167b38ff370SJamie Gritton } 4168b38ff370SJamie Gritton 4169b38ff370SJamie Gritton DB_SHOW_COMMAND(prison, db_show_prison_command) 4170b38ff370SJamie Gritton { 4171b38ff370SJamie Gritton struct prison *pr; 4172b38ff370SJamie Gritton 4173b38ff370SJamie Gritton if (!have_addr) { 41740304c731SJamie Gritton /* 41750304c731SJamie Gritton * Show all prisons in the list, and prison0 which is not 41760304c731SJamie Gritton * listed. 41770304c731SJamie Gritton */ 41780304c731SJamie Gritton db_show_prison(&prison0); 41790304c731SJamie Gritton if (!db_pager_quit) { 4180b38ff370SJamie Gritton TAILQ_FOREACH(pr, &allprison, pr_list) { 4181b38ff370SJamie Gritton db_show_prison(pr); 4182413628a7SBjoern A. Zeeb if (db_pager_quit) 4183413628a7SBjoern A. Zeeb break; 4184413628a7SBjoern A. Zeeb } 41850304c731SJamie Gritton } 4186b38ff370SJamie Gritton return; 4187413628a7SBjoern A. Zeeb } 4188b38ff370SJamie Gritton 41890304c731SJamie Gritton if (addr == 0) 41900304c731SJamie Gritton pr = &prison0; 41910304c731SJamie Gritton else { 4192b38ff370SJamie Gritton /* Look for a prison with the ID and with references. */ 4193b38ff370SJamie Gritton TAILQ_FOREACH(pr, &allprison, pr_list) 4194b38ff370SJamie Gritton if (pr->pr_id == addr && pr->pr_ref > 0) 4195b38ff370SJamie Gritton break; 4196b38ff370SJamie Gritton if (pr == NULL) 4197b38ff370SJamie Gritton /* Look again, without requiring a reference. */ 4198b38ff370SJamie Gritton TAILQ_FOREACH(pr, &allprison, pr_list) 4199b38ff370SJamie Gritton if (pr->pr_id == addr) 4200b38ff370SJamie Gritton break; 4201b38ff370SJamie Gritton if (pr == NULL) 4202b38ff370SJamie Gritton /* Assume address points to a valid prison. */ 4203b38ff370SJamie Gritton pr = (struct prison *)addr; 42040304c731SJamie Gritton } 4205b38ff370SJamie Gritton db_show_prison(pr); 4206b38ff370SJamie Gritton } 4207b38ff370SJamie Gritton 4208413628a7SBjoern A. Zeeb #endif /* DDB */ 4209