xref: /freebsd/sys/kern/kern_jail.c (revision 7029da5c36f2d3cf6bb6c81bf551229f416399e8)
19454b2d8SWarner Losh /*-
28a36da99SPedro F. Giffuni  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
38a36da99SPedro F. Giffuni  *
4413628a7SBjoern A. Zeeb  * Copyright (c) 1999 Poul-Henning Kamp.
5413628a7SBjoern A. Zeeb  * Copyright (c) 2008 Bjoern A. Zeeb.
6b38ff370SJamie Gritton  * Copyright (c) 2009 James Gritton.
7413628a7SBjoern A. Zeeb  * All rights reserved.
8b9f0b66cSBjoern A. Zeeb  *
9b9f0b66cSBjoern A. Zeeb  * Redistribution and use in source and binary forms, with or without
10b9f0b66cSBjoern A. Zeeb  * modification, are permitted provided that the following conditions
11b9f0b66cSBjoern A. Zeeb  * are met:
12b9f0b66cSBjoern A. Zeeb  * 1. Redistributions of source code must retain the above copyright
13b9f0b66cSBjoern A. Zeeb  *    notice, this list of conditions and the following disclaimer.
14b9f0b66cSBjoern A. Zeeb  * 2. Redistributions in binary form must reproduce the above copyright
15b9f0b66cSBjoern A. Zeeb  *    notice, this list of conditions and the following disclaimer in the
16b9f0b66cSBjoern A. Zeeb  *    documentation and/or other materials provided with the distribution.
17b9f0b66cSBjoern A. Zeeb  *
18b9f0b66cSBjoern A. Zeeb  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19b9f0b66cSBjoern A. Zeeb  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20b9f0b66cSBjoern A. Zeeb  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21b9f0b66cSBjoern A. Zeeb  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22b9f0b66cSBjoern A. Zeeb  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23b9f0b66cSBjoern A. Zeeb  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24b9f0b66cSBjoern A. Zeeb  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25b9f0b66cSBjoern A. Zeeb  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26b9f0b66cSBjoern A. Zeeb  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27b9f0b66cSBjoern A. Zeeb  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28b9f0b66cSBjoern A. Zeeb  * SUCH DAMAGE.
2907901f22SPoul-Henning Kamp  */
3075c13541SPoul-Henning Kamp 
31677b542eSDavid E. O'Brien #include <sys/cdefs.h>
32677b542eSDavid E. O'Brien __FBSDID("$FreeBSD$");
33677b542eSDavid E. O'Brien 
34413628a7SBjoern A. Zeeb #include "opt_ddb.h"
35413628a7SBjoern A. Zeeb #include "opt_inet.h"
36413628a7SBjoern A. Zeeb #include "opt_inet6.h"
3746e3b1cbSPawel Jakub Dawidek 
3875c13541SPoul-Henning Kamp #include <sys/param.h>
3975c13541SPoul-Henning Kamp #include <sys/types.h>
4075c13541SPoul-Henning Kamp #include <sys/kernel.h>
4175c13541SPoul-Henning Kamp #include <sys/systm.h>
4275c13541SPoul-Henning Kamp #include <sys/errno.h>
4375c13541SPoul-Henning Kamp #include <sys/sysproto.h>
4475c13541SPoul-Henning Kamp #include <sys/malloc.h>
450304c731SJamie Gritton #include <sys/osd.h>
46800c9408SRobert Watson #include <sys/priv.h>
4775c13541SPoul-Henning Kamp #include <sys/proc.h>
48b3059e09SRobert Watson #include <sys/taskqueue.h>
4957b4252eSKonstantin Belousov #include <sys/fcntl.h>
5075c13541SPoul-Henning Kamp #include <sys/jail.h>
5101137630SRobert Watson #include <sys/lock.h>
5201137630SRobert Watson #include <sys/mutex.h>
53097055e2SEdward Tomasz Napierala #include <sys/racct.h>
54f87beb93SAndriy Gapon #include <sys/rctl.h>
55a7ad07bfSEdward Tomasz Napierala #include <sys/refcount.h>
56dc68a633SPawel Jakub Dawidek #include <sys/sx.h>
5776ca6f88SJamie Gritton #include <sys/sysent.h>
58fd7a8150SMike Barcroft #include <sys/namei.h>
59820a0de9SPawel Jakub Dawidek #include <sys/mount.h>
60fd7a8150SMike Barcroft #include <sys/queue.h>
6175c13541SPoul-Henning Kamp #include <sys/socket.h>
62fd7a8150SMike Barcroft #include <sys/syscallsubr.h>
6383f1e257SRobert Watson #include <sys/sysctl.h>
64fd7a8150SMike Barcroft #include <sys/vnode.h>
65530c0060SRobert Watson 
6675c13541SPoul-Henning Kamp #include <net/if.h>
67530c0060SRobert Watson #include <net/vnet.h>
68530c0060SRobert Watson 
6975c13541SPoul-Henning Kamp #include <netinet/in.h>
70530c0060SRobert Watson 
71413628a7SBjoern A. Zeeb #ifdef DDB
72413628a7SBjoern A. Zeeb #include <ddb/ddb.h>
73413628a7SBjoern A. Zeeb #endif /* DDB */
7475c13541SPoul-Henning Kamp 
75aed55708SRobert Watson #include <security/mac/mac_framework.h>
76aed55708SRobert Watson 
778986e3a0SJamie Gritton #define	DEFAULT_HOSTUUID	"00000000-0000-0000-0000-000000000000"
788986e3a0SJamie Gritton 
7975c13541SPoul-Henning Kamp MALLOC_DEFINE(M_PRISON, "prison", "Prison structures");
80d745c852SEd Schouten static MALLOC_DEFINE(M_PRISON_RACCT, "prison_racct", "Prison racct structures");
8175c13541SPoul-Henning Kamp 
82592bcae8SBjoern A. Zeeb /* Keep struct prison prison0 and some code in kern_jail_set() readable. */
83592bcae8SBjoern A. Zeeb #ifdef INET
84592bcae8SBjoern A. Zeeb #ifdef INET6
85592bcae8SBjoern A. Zeeb #define	_PR_IP_SADDRSEL	PR_IP4_SADDRSEL|PR_IP6_SADDRSEL
86592bcae8SBjoern A. Zeeb #else
87592bcae8SBjoern A. Zeeb #define	_PR_IP_SADDRSEL	PR_IP4_SADDRSEL
88592bcae8SBjoern A. Zeeb #endif
89592bcae8SBjoern A. Zeeb #else /* !INET */
90592bcae8SBjoern A. Zeeb #ifdef INET6
91592bcae8SBjoern A. Zeeb #define	_PR_IP_SADDRSEL	PR_IP6_SADDRSEL
92592bcae8SBjoern A. Zeeb #else
93592bcae8SBjoern A. Zeeb #define	_PR_IP_SADDRSEL	0
94592bcae8SBjoern A. Zeeb #endif
95592bcae8SBjoern A. Zeeb #endif
96592bcae8SBjoern A. Zeeb 
970304c731SJamie Gritton /* prison0 describes what is "real" about the system. */
980304c731SJamie Gritton struct prison prison0 = {
990304c731SJamie Gritton 	.pr_id		= 0,
1000304c731SJamie Gritton 	.pr_name	= "0",
1010304c731SJamie Gritton 	.pr_ref		= 1,
1020304c731SJamie Gritton 	.pr_uref	= 1,
1030304c731SJamie Gritton 	.pr_path	= "/",
1040304c731SJamie Gritton 	.pr_securelevel	= -1,
1050cc207a6SMartin Matuska 	.pr_devfs_rsnum = 0,
106b97457e2SJamie Gritton 	.pr_childmax	= JAIL_MAX,
1078986e3a0SJamie Gritton 	.pr_hostuuid	= DEFAULT_HOSTUUID,
10813e403fdSAntoine Brodin 	.pr_children	= LIST_HEAD_INITIALIZER(prison0.pr_children),
109eb79e1c7SBjoern A. Zeeb #ifdef VIMAGE
110592bcae8SBjoern A. Zeeb 	.pr_flags	= PR_HOST|PR_VNET|_PR_IP_SADDRSEL,
111eb79e1c7SBjoern A. Zeeb #else
112592bcae8SBjoern A. Zeeb 	.pr_flags	= PR_HOST|_PR_IP_SADDRSEL,
113eb79e1c7SBjoern A. Zeeb #endif
1140e5c6bd4SJamie Gritton 	.pr_allow	= PR_ALLOW_ALL_STATIC,
1150304c731SJamie Gritton };
1160304c731SJamie Gritton MTX_SYSINIT(prison0, &prison0.pr_mtx, "jail mutex", MTX_DEF);
11783f1e257SRobert Watson 
118672756aaSJamie Gritton struct bool_flags {
119672756aaSJamie Gritton 	const char	*name;
120672756aaSJamie Gritton 	const char	*noname;
121672756aaSJamie Gritton 	unsigned	 flag;
122672756aaSJamie Gritton };
123672756aaSJamie Gritton struct jailsys_flags {
124672756aaSJamie Gritton 	const char	*name;
125672756aaSJamie Gritton 	unsigned	 disable;
126672756aaSJamie Gritton 	unsigned	 new;
127672756aaSJamie Gritton };
128672756aaSJamie Gritton 
129a7ad07bfSEdward Tomasz Napierala /* allprison, allprison_racct and lastprid are protected by allprison_lock. */
130dc68a633SPawel Jakub Dawidek struct	sx allprison_lock;
131b38ff370SJamie Gritton SX_SYSINIT(allprison_lock, &allprison_lock, "allprison");
132b38ff370SJamie Gritton struct	prisonlist allprison = TAILQ_HEAD_INITIALIZER(allprison);
133a7ad07bfSEdward Tomasz Napierala LIST_HEAD(, prison_racct) allprison_racct;
1342110d913SXin LI int	lastprid = 0;
135fd7a8150SMike Barcroft 
136b38ff370SJamie Gritton static int do_jail_attach(struct thread *td, struct prison *pr);
137b3059e09SRobert Watson static void prison_complete(void *context, int pending);
138b38ff370SJamie Gritton static void prison_deref(struct prison *pr, int flags);
1390304c731SJamie Gritton static char *prison_path(struct prison *pr1, struct prison *pr2);
1400304c731SJamie Gritton static void prison_remove_one(struct prison *pr);
141a7ad07bfSEdward Tomasz Napierala #ifdef RACCT
142a7ad07bfSEdward Tomasz Napierala static void prison_racct_attach(struct prison *pr);
143c34bbd2aSEdward Tomasz Napierala static void prison_racct_modify(struct prison *pr);
144a7ad07bfSEdward Tomasz Napierala static void prison_racct_detach(struct prison *pr);
145a7ad07bfSEdward Tomasz Napierala #endif
146fd7a8150SMike Barcroft 
147b38ff370SJamie Gritton /* Flags for prison_deref */
148b38ff370SJamie Gritton #define	PD_DEREF	0x01
149b38ff370SJamie Gritton #define	PD_DEUREF	0x02
150b38ff370SJamie Gritton #define	PD_LOCKED	0x04
151b38ff370SJamie Gritton #define	PD_LIST_SLOCKED	0x08
152b38ff370SJamie Gritton #define	PD_LIST_XLOCKED	0x10
153fd7a8150SMike Barcroft 
1540304c731SJamie Gritton /*
1555cc70397SBjoern A. Zeeb  * Parameter names corresponding to PR_* flag values.  Size values are for kvm
1565cc70397SBjoern A. Zeeb  * as we cannot figure out the size of a sparse array, or an array without a
1575cc70397SBjoern A. Zeeb  * terminating entry.
1580304c731SJamie Gritton  */
159672756aaSJamie Gritton static struct bool_flags pr_flag_bool[] = {
160672756aaSJamie Gritton 	{"persist", "nopersist", PR_PERSIST},
161592bcae8SBjoern A. Zeeb #ifdef INET
162672756aaSJamie Gritton 	{"ip4.saddrsel", "ip4.nosaddrsel", PR_IP4_SADDRSEL},
163592bcae8SBjoern A. Zeeb #endif
164592bcae8SBjoern A. Zeeb #ifdef INET6
165672756aaSJamie Gritton 	{"ip6.saddrsel", "ip6.nosaddrsel", PR_IP6_SADDRSEL},
166592bcae8SBjoern A. Zeeb #endif
1670304c731SJamie Gritton };
168672756aaSJamie Gritton const size_t pr_flag_bool_size = sizeof(pr_flag_bool);
1690304c731SJamie Gritton 
170672756aaSJamie Gritton static struct jailsys_flags pr_flag_jailsys[] = {
1717cbf7213SJamie Gritton 	{"host", 0, PR_HOST},
1727cbf7213SJamie Gritton #ifdef VIMAGE
1737cbf7213SJamie Gritton 	{"vnet", 0, PR_VNET},
1747cbf7213SJamie Gritton #endif
1750304c731SJamie Gritton #ifdef INET
1766a3f2779SJamie Gritton 	{"ip4", PR_IP4_USER, PR_IP4_USER},
1770304c731SJamie Gritton #endif
1780304c731SJamie Gritton #ifdef INET6
1796a3f2779SJamie Gritton 	{"ip6", PR_IP6_USER, PR_IP6_USER},
180679e1390SJamie Gritton #endif
1810304c731SJamie Gritton };
1825cc70397SBjoern A. Zeeb const size_t pr_flag_jailsys_size = sizeof(pr_flag_jailsys);
1830304c731SJamie Gritton 
1840e5c6bd4SJamie Gritton /* Make this array full-size so dynamic parameters can be added. */
1850e5c6bd4SJamie Gritton static struct bool_flags pr_flag_allow[NBBY * NBPW] = {
186672756aaSJamie Gritton 	{"allow.set_hostname", "allow.noset_hostname", PR_ALLOW_SET_HOSTNAME},
187672756aaSJamie Gritton 	{"allow.sysvipc", "allow.nosysvipc", PR_ALLOW_SYSVIPC},
188672756aaSJamie Gritton 	{"allow.raw_sockets", "allow.noraw_sockets", PR_ALLOW_RAW_SOCKETS},
189672756aaSJamie Gritton 	{"allow.chflags", "allow.nochflags", PR_ALLOW_CHFLAGS},
190672756aaSJamie Gritton 	{"allow.mount", "allow.nomount", PR_ALLOW_MOUNT},
191672756aaSJamie Gritton 	{"allow.quotas", "allow.noquotas", PR_ALLOW_QUOTAS},
192672756aaSJamie Gritton 	{"allow.socket_af", "allow.nosocket_af", PR_ALLOW_SOCKET_AF},
193ccd6ac9fSAntoine Brodin 	{"allow.mlock", "allow.nomlock", PR_ALLOW_MLOCK},
194672756aaSJamie Gritton 	{"allow.reserved_ports", "allow.noreserved_ports",
195672756aaSJamie Gritton 	 PR_ALLOW_RESERVED_PORTS},
196b19d66fdSJamie Gritton 	{"allow.read_msgbuf", "allow.noread_msgbuf", PR_ALLOW_READ_MSGBUF},
197b3079544SJamie Gritton 	{"allow.unprivileged_proc_debug", "allow.nounprivileged_proc_debug",
198b3079544SJamie Gritton 	 PR_ALLOW_UNPRIV_DEBUG},
1990304c731SJamie Gritton };
200672756aaSJamie Gritton const size_t pr_flag_allow_size = sizeof(pr_flag_allow);
2010304c731SJamie Gritton 
202b3079544SJamie Gritton #define	JAIL_DEFAULT_ALLOW		(PR_ALLOW_SET_HOSTNAME | \
203b3079544SJamie Gritton 					 PR_ALLOW_RESERVED_PORTS | \
204b3079544SJamie Gritton 					 PR_ALLOW_UNPRIV_DEBUG)
20542bebd82SJamie Gritton #define	JAIL_DEFAULT_ENFORCE_STATFS	2
206bf3db8aaSMartin Matuska #define	JAIL_DEFAULT_DEVFS_RSNUM	0
2070304c731SJamie Gritton static unsigned jail_default_allow = JAIL_DEFAULT_ALLOW;
20842bebd82SJamie Gritton static int jail_default_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS;
2090cc207a6SMartin Matuska static int jail_default_devfs_rsnum = JAIL_DEFAULT_DEVFS_RSNUM;
2100304c731SJamie Gritton #if defined(INET) || defined(INET6)
211e92e0574SJamie Gritton static unsigned jail_max_af_ips = 255;
2120304c731SJamie Gritton #endif
2130304c731SJamie Gritton 
214b96bd95bSIan Lepore /*
215b96bd95bSIan Lepore  * Initialize the parts of prison0 that can't be static-initialized with
216b96bd95bSIan Lepore  * constants.  This is called from proc0_init() after creating thread0 cpuset.
217b96bd95bSIan Lepore  */
218b96bd95bSIan Lepore void
219b96bd95bSIan Lepore prison0_init(void)
220b96bd95bSIan Lepore {
221b96bd95bSIan Lepore 
222b96bd95bSIan Lepore 	prison0.pr_cpuset = cpuset_ref(thread0.td_cpuset);
223b96bd95bSIan Lepore 	prison0.pr_osreldate = osreldate;
224b96bd95bSIan Lepore 	strlcpy(prison0.pr_osrelease, osrelease, sizeof(prison0.pr_osrelease));
225b96bd95bSIan Lepore }
226b96bd95bSIan Lepore 
227116734c4SMatthew Dillon /*
2289ddb7954SMike Barcroft  * struct jail_args {
2299ddb7954SMike Barcroft  *	struct jail *jail;
2309ddb7954SMike Barcroft  * };
231116734c4SMatthew Dillon  */
23275c13541SPoul-Henning Kamp int
233c542c43eSJamie Gritton sys_jail(struct thread *td, struct jail_args *uap)
23475c13541SPoul-Henning Kamp {
235413628a7SBjoern A. Zeeb 	uint32_t version;
236413628a7SBjoern A. Zeeb 	int error;
2370304c731SJamie Gritton 	struct jail j;
238413628a7SBjoern A. Zeeb 
239413628a7SBjoern A. Zeeb 	error = copyin(uap->jail, &version, sizeof(uint32_t));
240413628a7SBjoern A. Zeeb 	if (error)
241413628a7SBjoern A. Zeeb 		return (error);
242413628a7SBjoern A. Zeeb 
243413628a7SBjoern A. Zeeb 	switch (version) {
244413628a7SBjoern A. Zeeb 	case 0:
245413628a7SBjoern A. Zeeb 	{
246413628a7SBjoern A. Zeeb 		struct jail_v0 j0;
247413628a7SBjoern A. Zeeb 
2480304c731SJamie Gritton 		/* FreeBSD single IPv4 jails. */
2490304c731SJamie Gritton 		bzero(&j, sizeof(struct jail));
250413628a7SBjoern A. Zeeb 		error = copyin(uap->jail, &j0, sizeof(struct jail_v0));
251413628a7SBjoern A. Zeeb 		if (error)
252413628a7SBjoern A. Zeeb 			return (error);
2530304c731SJamie Gritton 		j.version = j0.version;
2540304c731SJamie Gritton 		j.path = j0.path;
2550304c731SJamie Gritton 		j.hostname = j0.hostname;
256b5019bc4SPeter Wemm 		j.ip4s = htonl(j0.ip_number);	/* jail_v0 is host order */
257413628a7SBjoern A. Zeeb 		break;
258413628a7SBjoern A. Zeeb 	}
259413628a7SBjoern A. Zeeb 
260413628a7SBjoern A. Zeeb 	case 1:
261413628a7SBjoern A. Zeeb 		/*
262413628a7SBjoern A. Zeeb 		 * Version 1 was used by multi-IPv4 jail implementations
263413628a7SBjoern A. Zeeb 		 * that never made it into the official kernel.
264413628a7SBjoern A. Zeeb 		 */
265413628a7SBjoern A. Zeeb 		return (EINVAL);
266413628a7SBjoern A. Zeeb 
267413628a7SBjoern A. Zeeb 	case 2:	/* JAIL_API_VERSION */
268413628a7SBjoern A. Zeeb 		/* FreeBSD multi-IPv4/IPv6,noIP jails. */
269413628a7SBjoern A. Zeeb 		error = copyin(uap->jail, &j, sizeof(struct jail));
270413628a7SBjoern A. Zeeb 		if (error)
271413628a7SBjoern A. Zeeb 			return (error);
2720304c731SJamie Gritton 		break;
2730304c731SJamie Gritton 
2740304c731SJamie Gritton 	default:
2750304c731SJamie Gritton 		/* Sci-Fi jails are not supported, sorry. */
2760304c731SJamie Gritton 		return (EINVAL);
2770304c731SJamie Gritton 	}
278c542c43eSJamie Gritton 	return (kern_jail(td, &j));
2790304c731SJamie Gritton }
2800304c731SJamie Gritton 
2810304c731SJamie Gritton int
282c542c43eSJamie Gritton kern_jail(struct thread *td, struct jail *j)
2830304c731SJamie Gritton {
284c542c43eSJamie Gritton 	struct iovec optiov[2 * (4 + nitems(pr_flag_allow)
285e92e0574SJamie Gritton #ifdef INET
286e92e0574SJamie Gritton 			    + 1
287e92e0574SJamie Gritton #endif
288e92e0574SJamie Gritton #ifdef INET6
289e92e0574SJamie Gritton 			    + 1
290e92e0574SJamie Gritton #endif
291e92e0574SJamie Gritton 			    )];
2920304c731SJamie Gritton 	struct uio opt;
2930304c731SJamie Gritton 	char *u_path, *u_hostname, *u_name;
294672756aaSJamie Gritton 	struct bool_flags *bf;
2950304c731SJamie Gritton #ifdef INET
296e92e0574SJamie Gritton 	uint32_t ip4s;
2970304c731SJamie Gritton 	struct in_addr *u_ip4;
2980304c731SJamie Gritton #endif
2990304c731SJamie Gritton #ifdef INET6
3000304c731SJamie Gritton 	struct in6_addr *u_ip6;
3010304c731SJamie Gritton #endif
3020304c731SJamie Gritton 	size_t tmplen;
303c542c43eSJamie Gritton 	int error, enforce_statfs;
3040304c731SJamie Gritton 
3050304c731SJamie Gritton 	bzero(&optiov, sizeof(optiov));
3060304c731SJamie Gritton 	opt.uio_iov = optiov;
3070304c731SJamie Gritton 	opt.uio_iovcnt = 0;
3080304c731SJamie Gritton 	opt.uio_offset = -1;
3090304c731SJamie Gritton 	opt.uio_resid = -1;
3100304c731SJamie Gritton 	opt.uio_segflg = UIO_SYSSPACE;
3110304c731SJamie Gritton 	opt.uio_rw = UIO_READ;
3120304c731SJamie Gritton 	opt.uio_td = td;
3130304c731SJamie Gritton 
3140304c731SJamie Gritton 	/* Set permissions for top-level jails from sysctls. */
3150304c731SJamie Gritton 	if (!jailed(td->td_ucred)) {
316672756aaSJamie Gritton 		for (bf = pr_flag_allow;
3170e5c6bd4SJamie Gritton 		     bf < pr_flag_allow + nitems(pr_flag_allow) &&
3180e5c6bd4SJamie Gritton 			bf->flag != 0;
319672756aaSJamie Gritton 		     bf++) {
320672756aaSJamie Gritton 			optiov[opt.uio_iovcnt].iov_base = __DECONST(char *,
321672756aaSJamie Gritton 			    (jail_default_allow & bf->flag)
322672756aaSJamie Gritton 			    ? bf->name : bf->noname);
3230304c731SJamie Gritton 			optiov[opt.uio_iovcnt].iov_len =
3240304c731SJamie Gritton 			    strlen(optiov[opt.uio_iovcnt].iov_base) + 1;
3250304c731SJamie Gritton 			opt.uio_iovcnt += 2;
3260304c731SJamie Gritton 		}
3270304c731SJamie Gritton 		optiov[opt.uio_iovcnt].iov_base = "enforce_statfs";
3280304c731SJamie Gritton 		optiov[opt.uio_iovcnt].iov_len = sizeof("enforce_statfs");
3290304c731SJamie Gritton 		opt.uio_iovcnt++;
3300304c731SJamie Gritton 		enforce_statfs = jail_default_enforce_statfs;
3310304c731SJamie Gritton 		optiov[opt.uio_iovcnt].iov_base = &enforce_statfs;
3320304c731SJamie Gritton 		optiov[opt.uio_iovcnt].iov_len = sizeof(enforce_statfs);
3330304c731SJamie Gritton 		opt.uio_iovcnt++;
3340304c731SJamie Gritton 	}
3350304c731SJamie Gritton 
336b38ff370SJamie Gritton 	tmplen = MAXPATHLEN + MAXHOSTNAMELEN + MAXHOSTNAMELEN;
337b38ff370SJamie Gritton #ifdef INET
3380304c731SJamie Gritton 	ip4s = (j->version == 0) ? 1 : j->ip4s;
3390304c731SJamie Gritton 	if (ip4s > jail_max_af_ips)
340b38ff370SJamie Gritton 		return (EINVAL);
3410304c731SJamie Gritton 	tmplen += ip4s * sizeof(struct in_addr);
342b38ff370SJamie Gritton #else
3430304c731SJamie Gritton 	if (j->ip4s > 0)
344b38ff370SJamie Gritton 		return (EINVAL);
345b38ff370SJamie Gritton #endif
346b38ff370SJamie Gritton #ifdef INET6
3470304c731SJamie Gritton 	if (j->ip6s > jail_max_af_ips)
348b38ff370SJamie Gritton 		return (EINVAL);
3490304c731SJamie Gritton 	tmplen += j->ip6s * sizeof(struct in6_addr);
350b38ff370SJamie Gritton #else
3510304c731SJamie Gritton 	if (j->ip6s > 0)
352b38ff370SJamie Gritton 		return (EINVAL);
353b38ff370SJamie Gritton #endif
354b38ff370SJamie Gritton 	u_path = malloc(tmplen, M_TEMP, M_WAITOK);
355b38ff370SJamie Gritton 	u_hostname = u_path + MAXPATHLEN;
356b38ff370SJamie Gritton 	u_name = u_hostname + MAXHOSTNAMELEN;
357b38ff370SJamie Gritton #ifdef INET
358b38ff370SJamie Gritton 	u_ip4 = (struct in_addr *)(u_name + MAXHOSTNAMELEN);
359b38ff370SJamie Gritton #endif
360b38ff370SJamie Gritton #ifdef INET6
361b38ff370SJamie Gritton #ifdef INET
3620304c731SJamie Gritton 	u_ip6 = (struct in6_addr *)(u_ip4 + ip4s);
363b38ff370SJamie Gritton #else
364b38ff370SJamie Gritton 	u_ip6 = (struct in6_addr *)(u_name + MAXHOSTNAMELEN);
365b38ff370SJamie Gritton #endif
366b38ff370SJamie Gritton #endif
3670304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = "path";
3680304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = sizeof("path");
3690304c731SJamie Gritton 	opt.uio_iovcnt++;
3700304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = u_path;
3710304c731SJamie Gritton 	error = copyinstr(j->path, u_path, MAXPATHLEN,
3720304c731SJamie Gritton 	    &optiov[opt.uio_iovcnt].iov_len);
373b38ff370SJamie Gritton 	if (error) {
374b38ff370SJamie Gritton 		free(u_path, M_TEMP);
375b38ff370SJamie Gritton 		return (error);
376b38ff370SJamie Gritton 	}
3770304c731SJamie Gritton 	opt.uio_iovcnt++;
3780304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = "host.hostname";
3790304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = sizeof("host.hostname");
3800304c731SJamie Gritton 	opt.uio_iovcnt++;
3810304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = u_hostname;
3820304c731SJamie Gritton 	error = copyinstr(j->hostname, u_hostname, MAXHOSTNAMELEN,
3830304c731SJamie Gritton 	    &optiov[opt.uio_iovcnt].iov_len);
384b38ff370SJamie Gritton 	if (error) {
385b38ff370SJamie Gritton 		free(u_path, M_TEMP);
386b38ff370SJamie Gritton 		return (error);
387b38ff370SJamie Gritton 	}
3880304c731SJamie Gritton 	opt.uio_iovcnt++;
3890304c731SJamie Gritton 	if (j->jailname != NULL) {
390b38ff370SJamie Gritton 		optiov[opt.uio_iovcnt].iov_base = "name";
391b38ff370SJamie Gritton 		optiov[opt.uio_iovcnt].iov_len = sizeof("name");
392b38ff370SJamie Gritton 		opt.uio_iovcnt++;
393b38ff370SJamie Gritton 		optiov[opt.uio_iovcnt].iov_base = u_name;
3940304c731SJamie Gritton 		error = copyinstr(j->jailname, u_name, MAXHOSTNAMELEN,
395b38ff370SJamie Gritton 		    &optiov[opt.uio_iovcnt].iov_len);
396b38ff370SJamie Gritton 		if (error) {
397b38ff370SJamie Gritton 			free(u_path, M_TEMP);
398b38ff370SJamie Gritton 			return (error);
399b38ff370SJamie Gritton 		}
400b38ff370SJamie Gritton 		opt.uio_iovcnt++;
401b38ff370SJamie Gritton 	}
402b38ff370SJamie Gritton #ifdef INET
403b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = "ip4.addr";
404b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = sizeof("ip4.addr");
405b38ff370SJamie Gritton 	opt.uio_iovcnt++;
406b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = u_ip4;
4070304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = ip4s * sizeof(struct in_addr);
4080304c731SJamie Gritton 	if (j->version == 0)
4090304c731SJamie Gritton 		u_ip4->s_addr = j->ip4s;
4100304c731SJamie Gritton 	else {
4110304c731SJamie Gritton 		error = copyin(j->ip4, u_ip4, optiov[opt.uio_iovcnt].iov_len);
412b38ff370SJamie Gritton 		if (error) {
413b38ff370SJamie Gritton 			free(u_path, M_TEMP);
414b38ff370SJamie Gritton 			return (error);
415b38ff370SJamie Gritton 		}
4160304c731SJamie Gritton 	}
417b38ff370SJamie Gritton 	opt.uio_iovcnt++;
418b38ff370SJamie Gritton #endif
419b38ff370SJamie Gritton #ifdef INET6
420b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = "ip6.addr";
421b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = sizeof("ip6.addr");
422b38ff370SJamie Gritton 	opt.uio_iovcnt++;
423b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = u_ip6;
4240304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = j->ip6s * sizeof(struct in6_addr);
4250304c731SJamie Gritton 	error = copyin(j->ip6, u_ip6, optiov[opt.uio_iovcnt].iov_len);
426b38ff370SJamie Gritton 	if (error) {
427b38ff370SJamie Gritton 		free(u_path, M_TEMP);
428b38ff370SJamie Gritton 		return (error);
429b38ff370SJamie Gritton 	}
430b38ff370SJamie Gritton 	opt.uio_iovcnt++;
431b38ff370SJamie Gritton #endif
43202abd400SPedro F. Giffuni 	KASSERT(opt.uio_iovcnt <= nitems(optiov),
4330304c731SJamie Gritton 		("kern_jail: too many iovecs (%d)", opt.uio_iovcnt));
434b38ff370SJamie Gritton 	error = kern_jail_set(td, &opt, JAIL_CREATE | JAIL_ATTACH);
435b38ff370SJamie Gritton 	free(u_path, M_TEMP);
436b38ff370SJamie Gritton 	return (error);
437b38ff370SJamie Gritton }
438b38ff370SJamie Gritton 
439b38ff370SJamie Gritton /*
440b38ff370SJamie Gritton  * struct jail_set_args {
441b38ff370SJamie Gritton  *	struct iovec *iovp;
442b38ff370SJamie Gritton  *	unsigned int iovcnt;
443b38ff370SJamie Gritton  *	int flags;
444b38ff370SJamie Gritton  * };
445b38ff370SJamie Gritton  */
446b38ff370SJamie Gritton int
4478451d0ddSKip Macy sys_jail_set(struct thread *td, struct jail_set_args *uap)
448b38ff370SJamie Gritton {
449b38ff370SJamie Gritton 	struct uio *auio;
450b38ff370SJamie Gritton 	int error;
451b38ff370SJamie Gritton 
452b38ff370SJamie Gritton 	/* Check that we have an even number of iovecs. */
453b38ff370SJamie Gritton 	if (uap->iovcnt & 1)
454b38ff370SJamie Gritton 		return (EINVAL);
455b38ff370SJamie Gritton 
456b38ff370SJamie Gritton 	error = copyinuio(uap->iovp, uap->iovcnt, &auio);
457b38ff370SJamie Gritton 	if (error)
458b38ff370SJamie Gritton 		return (error);
459b38ff370SJamie Gritton 	error = kern_jail_set(td, auio, uap->flags);
460b38ff370SJamie Gritton 	free(auio, M_IOV);
461b38ff370SJamie Gritton 	return (error);
462413628a7SBjoern A. Zeeb }
463413628a7SBjoern A. Zeeb 
464413628a7SBjoern A. Zeeb int
465b38ff370SJamie Gritton kern_jail_set(struct thread *td, struct uio *optuio, int flags)
466413628a7SBjoern A. Zeeb {
467fd7a8150SMike Barcroft 	struct nameidata nd;
468b38ff370SJamie Gritton #ifdef INET
469b38ff370SJamie Gritton 	struct in_addr *ip4;
470413628a7SBjoern A. Zeeb #endif
471b38ff370SJamie Gritton #ifdef INET6
472b38ff370SJamie Gritton 	struct in6_addr *ip6;
473b38ff370SJamie Gritton #endif
474b38ff370SJamie Gritton 	struct vfsopt *opt;
475b38ff370SJamie Gritton 	struct vfsoptlist *opts;
47657aea6dfSBjoern A. Zeeb 	struct prison *pr, *deadpr, *mypr, *ppr, *tpr;
477b38ff370SJamie Gritton 	struct vnode *root;
478babbbb9cSJamie Gritton 	char *domain, *errmsg, *host, *name, *namelc, *p, *path, *uuid;
479b96bd95bSIan Lepore 	char *g_path, *osrelstr;
480672756aaSJamie Gritton 	struct bool_flags *bf;
481672756aaSJamie Gritton 	struct jailsys_flags *jsf;
4820304c731SJamie Gritton #if defined(INET) || defined(INET6)
48357aea6dfSBjoern A. Zeeb 	struct prison *tppr;
484b38ff370SJamie Gritton 	void *op;
4850304c731SJamie Gritton #endif
48676ca6f88SJamie Gritton 	unsigned long hid;
487b6f47c23SJamie Gritton 	size_t namelen, onamelen, pnamelen;
488cc5fd8c7SJamie Gritton 	int born, created, cuflags, descend, enforce;
489cc5fd8c7SJamie Gritton 	int error, errmsg_len, errmsg_pos;
4900cc207a6SMartin Matuska 	int gotchildmax, gotenforce, gothid, gotrsnum, gotslevel;
491672756aaSJamie Gritton 	int jid, jsys, len, level;
492b96bd95bSIan Lepore 	int childmax, osreldt, rsnum, slevel;
493d465a41dSBjoern A. Zeeb #if defined(INET) || defined(INET6)
4940304c731SJamie Gritton 	int ii, ij;
495413628a7SBjoern A. Zeeb #endif
496413628a7SBjoern A. Zeeb #ifdef INET
4972b0d6f81SJamie Gritton 	int ip4s, redo_ip4;
498413628a7SBjoern A. Zeeb #endif
499b38ff370SJamie Gritton #ifdef INET6
5002b0d6f81SJamie Gritton 	int ip6s, redo_ip6;
501b38ff370SJamie Gritton #endif
5026beb3bb4SKirk McKusick 	uint64_t pr_allow, ch_allow, pr_flags, ch_flags;
503b3079544SJamie Gritton 	uint64_t pr_allow_diff;
5046beb3bb4SKirk McKusick 	unsigned tallow;
505b38ff370SJamie Gritton 	char numbuf[12];
506b38ff370SJamie Gritton 
507b38ff370SJamie Gritton 	error = priv_check(td, PRIV_JAIL_SET);
508b38ff370SJamie Gritton 	if (!error && (flags & JAIL_ATTACH))
509b38ff370SJamie Gritton 		error = priv_check(td, PRIV_JAIL_ATTACH);
510b38ff370SJamie Gritton 	if (error)
51175c13541SPoul-Henning Kamp 		return (error);
512b6f47c23SJamie Gritton 	mypr = td->td_ucred->cr_prison;
513b97457e2SJamie Gritton 	if ((flags & JAIL_CREATE) && mypr->pr_childmax == 0)
5140304c731SJamie Gritton 		return (EPERM);
515b38ff370SJamie Gritton 	if (flags & ~JAIL_SET_MASK)
516b38ff370SJamie Gritton 		return (EINVAL);
517b38ff370SJamie Gritton 
518b38ff370SJamie Gritton 	/*
519b38ff370SJamie Gritton 	 * Check all the parameters before committing to anything.  Not all
520b38ff370SJamie Gritton 	 * errors can be caught early, but we may as well try.  Also, this
521b38ff370SJamie Gritton 	 * takes care of some expensive stuff (path lookup) before getting
522b38ff370SJamie Gritton 	 * the allprison lock.
523b38ff370SJamie Gritton 	 *
524b38ff370SJamie Gritton 	 * XXX Jails are not filesystems, and jail parameters are not mount
525b38ff370SJamie Gritton 	 *     options.  But it makes more sense to re-use the vfsopt code
526b38ff370SJamie Gritton 	 *     than duplicate it under a different name.
527b38ff370SJamie Gritton 	 */
528b38ff370SJamie Gritton 	error = vfs_buildopts(optuio, &opts);
529b38ff370SJamie Gritton 	if (error)
530b38ff370SJamie Gritton 		return (error);
531b38ff370SJamie Gritton #ifdef INET
532b38ff370SJamie Gritton 	ip4 = NULL;
533b38ff370SJamie Gritton #endif
534b38ff370SJamie Gritton #ifdef INET6
535b38ff370SJamie Gritton 	ip6 = NULL;
536b38ff370SJamie Gritton #endif
5376dfe0a3dSMartin Matuska 	g_path = NULL;
538b38ff370SJamie Gritton 
539b6f47c23SJamie Gritton 	cuflags = flags & (JAIL_CREATE | JAIL_UPDATE);
540b6f47c23SJamie Gritton 	if (!cuflags) {
541b6f47c23SJamie Gritton 		error = EINVAL;
542b6f47c23SJamie Gritton 		vfs_opterror(opts, "no valid operation (create or update)");
543b6f47c23SJamie Gritton 		goto done_errmsg;
544b6f47c23SJamie Gritton 	}
545b6f47c23SJamie Gritton 
546b38ff370SJamie Gritton 	error = vfs_copyopt(opts, "jid", &jid, sizeof(jid));
547b38ff370SJamie Gritton 	if (error == ENOENT)
548b38ff370SJamie Gritton 		jid = 0;
549b38ff370SJamie Gritton 	else if (error != 0)
550b38ff370SJamie Gritton 		goto done_free;
551b38ff370SJamie Gritton 
552b38ff370SJamie Gritton 	error = vfs_copyopt(opts, "securelevel", &slevel, sizeof(slevel));
553b38ff370SJamie Gritton 	if (error == ENOENT)
554b38ff370SJamie Gritton 		gotslevel = 0;
555b38ff370SJamie Gritton 	else if (error != 0)
556b38ff370SJamie Gritton 		goto done_free;
557b38ff370SJamie Gritton 	else
558b38ff370SJamie Gritton 		gotslevel = 1;
559b38ff370SJamie Gritton 
560b97457e2SJamie Gritton 	error =
561b97457e2SJamie Gritton 	    vfs_copyopt(opts, "children.max", &childmax, sizeof(childmax));
562b97457e2SJamie Gritton 	if (error == ENOENT)
563b97457e2SJamie Gritton 		gotchildmax = 0;
564b97457e2SJamie Gritton 	else if (error != 0)
565b97457e2SJamie Gritton 		goto done_free;
566b97457e2SJamie Gritton 	else
567b97457e2SJamie Gritton 		gotchildmax = 1;
568b97457e2SJamie Gritton 
5690304c731SJamie Gritton 	error = vfs_copyopt(opts, "enforce_statfs", &enforce, sizeof(enforce));
570f337198dSJamie Gritton 	if (error == ENOENT)
571f337198dSJamie Gritton 		gotenforce = 0;
572f337198dSJamie Gritton 	else if (error != 0)
5730304c731SJamie Gritton 		goto done_free;
574f337198dSJamie Gritton 	else if (enforce < 0 || enforce > 2) {
575f337198dSJamie Gritton 		error = EINVAL;
576f337198dSJamie Gritton 		goto done_free;
577f337198dSJamie Gritton 	} else
578f337198dSJamie Gritton 		gotenforce = 1;
5790304c731SJamie Gritton 
5800cc207a6SMartin Matuska 	error = vfs_copyopt(opts, "devfs_ruleset", &rsnum, sizeof(rsnum));
5810cc207a6SMartin Matuska 	if (error == ENOENT)
5820cc207a6SMartin Matuska 		gotrsnum = 0;
5830cc207a6SMartin Matuska 	else if (error != 0)
5840cc207a6SMartin Matuska 		goto done_free;
5850cc207a6SMartin Matuska 	else
5860cc207a6SMartin Matuska 		gotrsnum = 1;
5870cc207a6SMartin Matuska 
588b38ff370SJamie Gritton 	pr_flags = ch_flags = 0;
589672756aaSJamie Gritton 	for (bf = pr_flag_bool;
590672756aaSJamie Gritton 	     bf < pr_flag_bool + nitems(pr_flag_bool);
591672756aaSJamie Gritton 	     bf++) {
592672756aaSJamie Gritton 		vfs_flagopt(opts, bf->name, &pr_flags, bf->flag);
593672756aaSJamie Gritton 		vfs_flagopt(opts, bf->noname, &ch_flags, bf->flag);
5940304c731SJamie Gritton 	}
595b38ff370SJamie Gritton 	ch_flags |= pr_flags;
596672756aaSJamie Gritton 	for (jsf = pr_flag_jailsys;
597672756aaSJamie Gritton 	     jsf < pr_flag_jailsys + nitems(pr_flag_jailsys);
598672756aaSJamie Gritton 	     jsf++) {
599672756aaSJamie Gritton 		error = vfs_copyopt(opts, jsf->name, &jsys, sizeof(jsys));
6007cbf7213SJamie Gritton 		if (error == ENOENT)
6017cbf7213SJamie Gritton 			continue;
6027cbf7213SJamie Gritton 		if (error != 0)
6037cbf7213SJamie Gritton 			goto done_free;
6047cbf7213SJamie Gritton 		switch (jsys) {
6057cbf7213SJamie Gritton 		case JAIL_SYS_DISABLE:
606672756aaSJamie Gritton 			if (!jsf->disable) {
6077cbf7213SJamie Gritton 				error = EINVAL;
6087cbf7213SJamie Gritton 				goto done_free;
6097cbf7213SJamie Gritton 			}
610672756aaSJamie Gritton 			pr_flags |= jsf->disable;
6117cbf7213SJamie Gritton 			break;
6127cbf7213SJamie Gritton 		case JAIL_SYS_NEW:
613672756aaSJamie Gritton 			pr_flags |= jsf->new;
6147cbf7213SJamie Gritton 			break;
6157cbf7213SJamie Gritton 		case JAIL_SYS_INHERIT:
6167cbf7213SJamie Gritton 			break;
6177cbf7213SJamie Gritton 		default:
6187cbf7213SJamie Gritton 			error = EINVAL;
6197cbf7213SJamie Gritton 			goto done_free;
6207cbf7213SJamie Gritton 		}
621672756aaSJamie Gritton 		ch_flags |= jsf->new | jsf->disable;
6227cbf7213SJamie Gritton 	}
6234affa14cSJamie Gritton 	if ((flags & (JAIL_CREATE | JAIL_UPDATE | JAIL_ATTACH)) == JAIL_CREATE
6244affa14cSJamie Gritton 	    && !(pr_flags & PR_PERSIST)) {
6254affa14cSJamie Gritton 		error = EINVAL;
6264affa14cSJamie Gritton 		vfs_opterror(opts, "new jail must persist or attach");
6274affa14cSJamie Gritton 		goto done_errmsg;
6284affa14cSJamie Gritton 	}
629679e1390SJamie Gritton #ifdef VIMAGE
630679e1390SJamie Gritton 	if ((flags & JAIL_UPDATE) && (ch_flags & PR_VNET)) {
631679e1390SJamie Gritton 		error = EINVAL;
632679e1390SJamie Gritton 		vfs_opterror(opts, "vnet cannot be changed after creation");
633679e1390SJamie Gritton 		goto done_errmsg;
634679e1390SJamie Gritton 	}
635679e1390SJamie Gritton #endif
6362b0d6f81SJamie Gritton #ifdef INET
6372b0d6f81SJamie Gritton 	if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP4_USER)) {
6382b0d6f81SJamie Gritton 		error = EINVAL;
6392b0d6f81SJamie Gritton 		vfs_opterror(opts, "ip4 cannot be changed after creation");
6402b0d6f81SJamie Gritton 		goto done_errmsg;
6412b0d6f81SJamie Gritton 	}
6422b0d6f81SJamie Gritton #endif
6432b0d6f81SJamie Gritton #ifdef INET6
6442b0d6f81SJamie Gritton 	if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP6_USER)) {
6452b0d6f81SJamie Gritton 		error = EINVAL;
6462b0d6f81SJamie Gritton 		vfs_opterror(opts, "ip6 cannot be changed after creation");
6472b0d6f81SJamie Gritton 		goto done_errmsg;
6482b0d6f81SJamie Gritton 	}
6492b0d6f81SJamie Gritton #endif
650b38ff370SJamie Gritton 
6510304c731SJamie Gritton 	pr_allow = ch_allow = 0;
652672756aaSJamie Gritton 	for (bf = pr_flag_allow;
6530e5c6bd4SJamie Gritton 	     bf < pr_flag_allow + nitems(pr_flag_allow) && bf->flag != 0;
654672756aaSJamie Gritton 	     bf++) {
655672756aaSJamie Gritton 		vfs_flagopt(opts, bf->name, &pr_allow, bf->flag);
656672756aaSJamie Gritton 		vfs_flagopt(opts, bf->noname, &ch_allow, bf->flag);
6570304c731SJamie Gritton 	}
6580304c731SJamie Gritton 	ch_allow |= pr_allow;
6590304c731SJamie Gritton 
660b38ff370SJamie Gritton 	error = vfs_getopt(opts, "name", (void **)&name, &len);
661b38ff370SJamie Gritton 	if (error == ENOENT)
662b38ff370SJamie Gritton 		name = NULL;
663b38ff370SJamie Gritton 	else if (error != 0)
664b38ff370SJamie Gritton 		goto done_free;
665b38ff370SJamie Gritton 	else {
666b38ff370SJamie Gritton 		if (len == 0 || name[len - 1] != '\0') {
667b38ff370SJamie Gritton 			error = EINVAL;
668b38ff370SJamie Gritton 			goto done_free;
669b38ff370SJamie Gritton 		}
670b38ff370SJamie Gritton 		if (len > MAXHOSTNAMELEN) {
671b38ff370SJamie Gritton 			error = ENAMETOOLONG;
672b38ff370SJamie Gritton 			goto done_free;
673b38ff370SJamie Gritton 		}
674b38ff370SJamie Gritton 	}
675b38ff370SJamie Gritton 
676b38ff370SJamie Gritton 	error = vfs_getopt(opts, "host.hostname", (void **)&host, &len);
677b38ff370SJamie Gritton 	if (error == ENOENT)
678b38ff370SJamie Gritton 		host = NULL;
679b38ff370SJamie Gritton 	else if (error != 0)
680b38ff370SJamie Gritton 		goto done_free;
681b38ff370SJamie Gritton 	else {
68276ca6f88SJamie Gritton 		ch_flags |= PR_HOST;
68376ca6f88SJamie Gritton 		pr_flags |= PR_HOST;
684b38ff370SJamie Gritton 		if (len == 0 || host[len - 1] != '\0') {
685b38ff370SJamie Gritton 			error = EINVAL;
686b38ff370SJamie Gritton 			goto done_free;
687b38ff370SJamie Gritton 		}
688b38ff370SJamie Gritton 		if (len > MAXHOSTNAMELEN) {
689b38ff370SJamie Gritton 			error = ENAMETOOLONG;
690b38ff370SJamie Gritton 			goto done_free;
691b38ff370SJamie Gritton 		}
692b38ff370SJamie Gritton 	}
693b38ff370SJamie Gritton 
69476ca6f88SJamie Gritton 	error = vfs_getopt(opts, "host.domainname", (void **)&domain, &len);
69576ca6f88SJamie Gritton 	if (error == ENOENT)
69676ca6f88SJamie Gritton 		domain = NULL;
69776ca6f88SJamie Gritton 	else if (error != 0)
69876ca6f88SJamie Gritton 		goto done_free;
69976ca6f88SJamie Gritton 	else {
70076ca6f88SJamie Gritton 		ch_flags |= PR_HOST;
70176ca6f88SJamie Gritton 		pr_flags |= PR_HOST;
70276ca6f88SJamie Gritton 		if (len == 0 || domain[len - 1] != '\0') {
70376ca6f88SJamie Gritton 			error = EINVAL;
70476ca6f88SJamie Gritton 			goto done_free;
70576ca6f88SJamie Gritton 		}
70676ca6f88SJamie Gritton 		if (len > MAXHOSTNAMELEN) {
70776ca6f88SJamie Gritton 			error = ENAMETOOLONG;
70876ca6f88SJamie Gritton 			goto done_free;
70976ca6f88SJamie Gritton 		}
71076ca6f88SJamie Gritton 	}
71176ca6f88SJamie Gritton 
71276ca6f88SJamie Gritton 	error = vfs_getopt(opts, "host.hostuuid", (void **)&uuid, &len);
71376ca6f88SJamie Gritton 	if (error == ENOENT)
71476ca6f88SJamie Gritton 		uuid = NULL;
71576ca6f88SJamie Gritton 	else if (error != 0)
71676ca6f88SJamie Gritton 		goto done_free;
71776ca6f88SJamie Gritton 	else {
71876ca6f88SJamie Gritton 		ch_flags |= PR_HOST;
71976ca6f88SJamie Gritton 		pr_flags |= PR_HOST;
72076ca6f88SJamie Gritton 		if (len == 0 || uuid[len - 1] != '\0') {
72176ca6f88SJamie Gritton 			error = EINVAL;
72276ca6f88SJamie Gritton 			goto done_free;
72376ca6f88SJamie Gritton 		}
72476ca6f88SJamie Gritton 		if (len > HOSTUUIDLEN) {
72576ca6f88SJamie Gritton 			error = ENAMETOOLONG;
72676ca6f88SJamie Gritton 			goto done_free;
72776ca6f88SJamie Gritton 		}
72876ca6f88SJamie Gritton 	}
72976ca6f88SJamie Gritton 
730841c0c7eSNathan Whitehorn #ifdef COMPAT_FREEBSD32
731a5c1afadSDmitry Chagin 	if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) {
73276ca6f88SJamie Gritton 		uint32_t hid32;
73376ca6f88SJamie Gritton 
73476ca6f88SJamie Gritton 		error = vfs_copyopt(opts, "host.hostid", &hid32, sizeof(hid32));
73576ca6f88SJamie Gritton 		hid = hid32;
73676ca6f88SJamie Gritton 	} else
73776ca6f88SJamie Gritton #endif
73876ca6f88SJamie Gritton 		error = vfs_copyopt(opts, "host.hostid", &hid, sizeof(hid));
73976ca6f88SJamie Gritton 	if (error == ENOENT)
74076ca6f88SJamie Gritton 		gothid = 0;
74176ca6f88SJamie Gritton 	else if (error != 0)
74276ca6f88SJamie Gritton 		goto done_free;
74376ca6f88SJamie Gritton 	else {
74476ca6f88SJamie Gritton 		gothid = 1;
74576ca6f88SJamie Gritton 		ch_flags |= PR_HOST;
74676ca6f88SJamie Gritton 		pr_flags |= PR_HOST;
74776ca6f88SJamie Gritton 	}
74876ca6f88SJamie Gritton 
749b38ff370SJamie Gritton #ifdef INET
750b38ff370SJamie Gritton 	error = vfs_getopt(opts, "ip4.addr", &op, &ip4s);
751b38ff370SJamie Gritton 	if (error == ENOENT)
7520e5e396eSJamie Gritton 		ip4s = 0;
753b38ff370SJamie Gritton 	else if (error != 0)
754b38ff370SJamie Gritton 		goto done_free;
755b38ff370SJamie Gritton 	else if (ip4s & (sizeof(*ip4) - 1)) {
756b38ff370SJamie Gritton 		error = EINVAL;
757b38ff370SJamie Gritton 		goto done_free;
7580304c731SJamie Gritton 	} else {
7596a3f2779SJamie Gritton 		ch_flags |= PR_IP4_USER;
7606a3f2779SJamie Gritton 		pr_flags |= PR_IP4_USER;
7616a3f2779SJamie Gritton 		if (ip4s > 0) {
762b38ff370SJamie Gritton 			ip4s /= sizeof(*ip4);
763b38ff370SJamie Gritton 			if (ip4s > jail_max_af_ips) {
764b38ff370SJamie Gritton 				error = EINVAL;
765b38ff370SJamie Gritton 				vfs_opterror(opts, "too many IPv4 addresses");
766b38ff370SJamie Gritton 				goto done_errmsg;
767b38ff370SJamie Gritton 			}
7682b0d6f81SJamie Gritton 			ip4 = malloc(ip4s * sizeof(*ip4), M_PRISON, M_WAITOK);
769b38ff370SJamie Gritton 			bcopy(op, ip4, ip4s * sizeof(*ip4));
770b38ff370SJamie Gritton 			/*
7710304c731SJamie Gritton 			 * IP addresses are all sorted but ip[0] to preserve
7720304c731SJamie Gritton 			 * the primary IP address as given from userland.
7730304c731SJamie Gritton 			 * This special IP is used for unbound outgoing
774bef916f9SBjoern A. Zeeb 			 * connections as well for "loopback" traffic in case
775bef916f9SBjoern A. Zeeb 			 * source address selection cannot find any more fitting
776bef916f9SBjoern A. Zeeb 			 * address to connect from.
777b38ff370SJamie Gritton 			 */
778b38ff370SJamie Gritton 			if (ip4s > 1)
7790ce1624dSStephen J. Kiernan 				qsort(ip4 + 1, ip4s - 1, sizeof(*ip4),
7800ce1624dSStephen J. Kiernan 				    prison_qcmp_v4);
781b38ff370SJamie Gritton 			/*
7820304c731SJamie Gritton 			 * Check for duplicate addresses and do some simple
7830304c731SJamie Gritton 			 * zero and broadcast checks. If users give other bogus
7840304c731SJamie Gritton 			 * addresses it is their problem.
785b38ff370SJamie Gritton 			 *
7860304c731SJamie Gritton 			 * We do not have to care about byte order for these
7870304c731SJamie Gritton 			 * checks so we will do them in NBO.
788b38ff370SJamie Gritton 			 */
789b38ff370SJamie Gritton 			for (ii = 0; ii < ip4s; ii++) {
790b38ff370SJamie Gritton 				if (ip4[ii].s_addr == INADDR_ANY ||
791b38ff370SJamie Gritton 				    ip4[ii].s_addr == INADDR_BROADCAST) {
792b38ff370SJamie Gritton 					error = EINVAL;
793b38ff370SJamie Gritton 					goto done_free;
794b38ff370SJamie Gritton 				}
795b38ff370SJamie Gritton 				if ((ii+1) < ip4s &&
796b38ff370SJamie Gritton 				    (ip4[0].s_addr == ip4[ii+1].s_addr ||
797b38ff370SJamie Gritton 				     ip4[ii].s_addr == ip4[ii+1].s_addr)) {
798b38ff370SJamie Gritton 					error = EINVAL;
799b38ff370SJamie Gritton 					goto done_free;
800b38ff370SJamie Gritton 				}
801b38ff370SJamie Gritton 			}
802b38ff370SJamie Gritton 		}
8030304c731SJamie Gritton 	}
804b38ff370SJamie Gritton #endif
805b38ff370SJamie Gritton 
806b38ff370SJamie Gritton #ifdef INET6
807b38ff370SJamie Gritton 	error = vfs_getopt(opts, "ip6.addr", &op, &ip6s);
808b38ff370SJamie Gritton 	if (error == ENOENT)
8090e5e396eSJamie Gritton 		ip6s = 0;
810b38ff370SJamie Gritton 	else if (error != 0)
811b38ff370SJamie Gritton 		goto done_free;
812b38ff370SJamie Gritton 	else if (ip6s & (sizeof(*ip6) - 1)) {
813b38ff370SJamie Gritton 		error = EINVAL;
814b38ff370SJamie Gritton 		goto done_free;
8150304c731SJamie Gritton 	} else {
8166a3f2779SJamie Gritton 		ch_flags |= PR_IP6_USER;
8176a3f2779SJamie Gritton 		pr_flags |= PR_IP6_USER;
8186a3f2779SJamie Gritton 		if (ip6s > 0) {
819b38ff370SJamie Gritton 			ip6s /= sizeof(*ip6);
820b38ff370SJamie Gritton 			if (ip6s > jail_max_af_ips) {
821b38ff370SJamie Gritton 				error = EINVAL;
822b38ff370SJamie Gritton 				vfs_opterror(opts, "too many IPv6 addresses");
823b38ff370SJamie Gritton 				goto done_errmsg;
824b38ff370SJamie Gritton 			}
8252b0d6f81SJamie Gritton 			ip6 = malloc(ip6s * sizeof(*ip6), M_PRISON, M_WAITOK);
826b38ff370SJamie Gritton 			bcopy(op, ip6, ip6s * sizeof(*ip6));
827b38ff370SJamie Gritton 			if (ip6s > 1)
8280ce1624dSStephen J. Kiernan 				qsort(ip6 + 1, ip6s - 1, sizeof(*ip6),
8290ce1624dSStephen J. Kiernan 				    prison_qcmp_v6);
830b38ff370SJamie Gritton 			for (ii = 0; ii < ip6s; ii++) {
8310304c731SJamie Gritton 				if (IN6_IS_ADDR_UNSPECIFIED(&ip6[ii])) {
832b38ff370SJamie Gritton 					error = EINVAL;
833b38ff370SJamie Gritton 					goto done_free;
834b38ff370SJamie Gritton 				}
835b38ff370SJamie Gritton 				if ((ii+1) < ip6s &&
836b38ff370SJamie Gritton 				    (IN6_ARE_ADDR_EQUAL(&ip6[0], &ip6[ii+1]) ||
837b38ff370SJamie Gritton 				     IN6_ARE_ADDR_EQUAL(&ip6[ii], &ip6[ii+1])))
838b38ff370SJamie Gritton 				{
839b38ff370SJamie Gritton 					error = EINVAL;
840b38ff370SJamie Gritton 					goto done_free;
841b38ff370SJamie Gritton 				}
842b38ff370SJamie Gritton 			}
843b38ff370SJamie Gritton 		}
8440304c731SJamie Gritton 	}
845b38ff370SJamie Gritton #endif
846b38ff370SJamie Gritton 
847bdfc8cc4SJamie Gritton #if defined(VIMAGE) && (defined(INET) || defined(INET6))
848bdfc8cc4SJamie Gritton 	if ((ch_flags & PR_VNET) && (ch_flags & (PR_IP4_USER | PR_IP6_USER))) {
849bdfc8cc4SJamie Gritton 		error = EINVAL;
850bdfc8cc4SJamie Gritton 		vfs_opterror(opts,
851bdfc8cc4SJamie Gritton 		    "vnet jails cannot have IP address restrictions");
852bdfc8cc4SJamie Gritton 		goto done_errmsg;
853bdfc8cc4SJamie Gritton 	}
854bdfc8cc4SJamie Gritton #endif
855bdfc8cc4SJamie Gritton 
856cf0313c6SJamie Gritton 	error = vfs_getopt(opts, "osrelease", (void **)&osrelstr, &len);
857cf0313c6SJamie Gritton 	if (error == ENOENT)
858cf0313c6SJamie Gritton 		osrelstr = NULL;
859cf0313c6SJamie Gritton 	else if (error != 0)
860cf0313c6SJamie Gritton 		goto done_free;
861cf0313c6SJamie Gritton 	else {
862cf0313c6SJamie Gritton 		if (flags & JAIL_UPDATE) {
863cf0313c6SJamie Gritton 			error = EINVAL;
864cf0313c6SJamie Gritton 			vfs_opterror(opts,
865cf0313c6SJamie Gritton 			    "osrelease cannot be changed after creation");
866cf0313c6SJamie Gritton 			goto done_errmsg;
867cf0313c6SJamie Gritton 		}
868cf0313c6SJamie Gritton 		if (len == 0 || len >= OSRELEASELEN) {
869cf0313c6SJamie Gritton 			error = EINVAL;
870cf0313c6SJamie Gritton 			vfs_opterror(opts,
871cf0313c6SJamie Gritton 			    "osrelease string must be 1-%d bytes long",
872cf0313c6SJamie Gritton 			    OSRELEASELEN - 1);
873cf0313c6SJamie Gritton 			goto done_errmsg;
874cf0313c6SJamie Gritton 		}
875cf0313c6SJamie Gritton 	}
876cf0313c6SJamie Gritton 
877cf0313c6SJamie Gritton 	error = vfs_copyopt(opts, "osreldate", &osreldt, sizeof(osreldt));
878cf0313c6SJamie Gritton 	if (error == ENOENT)
879cf0313c6SJamie Gritton 		osreldt = 0;
880cf0313c6SJamie Gritton 	else if (error != 0)
881cf0313c6SJamie Gritton 		goto done_free;
882cf0313c6SJamie Gritton 	else {
883cf0313c6SJamie Gritton 		if (flags & JAIL_UPDATE) {
884cf0313c6SJamie Gritton 			error = EINVAL;
885cf0313c6SJamie Gritton 			vfs_opterror(opts,
886cf0313c6SJamie Gritton 			    "osreldate cannot be changed after creation");
887cf0313c6SJamie Gritton 			goto done_errmsg;
888cf0313c6SJamie Gritton 		}
889cf0313c6SJamie Gritton 		if (osreldt == 0) {
890cf0313c6SJamie Gritton 			error = EINVAL;
891cf0313c6SJamie Gritton 			vfs_opterror(opts, "osreldate cannot be 0");
892cf0313c6SJamie Gritton 			goto done_errmsg;
893cf0313c6SJamie Gritton 		}
894cf0313c6SJamie Gritton 	}
895cf0313c6SJamie Gritton 
896b38ff370SJamie Gritton 	root = NULL;
897b38ff370SJamie Gritton 	error = vfs_getopt(opts, "path", (void **)&path, &len);
898b38ff370SJamie Gritton 	if (error == ENOENT)
899b38ff370SJamie Gritton 		path = NULL;
900b38ff370SJamie Gritton 	else if (error != 0)
901b38ff370SJamie Gritton 		goto done_free;
902b38ff370SJamie Gritton 	else {
903b38ff370SJamie Gritton 		if (flags & JAIL_UPDATE) {
904b38ff370SJamie Gritton 			error = EINVAL;
905b38ff370SJamie Gritton 			vfs_opterror(opts,
906b38ff370SJamie Gritton 			    "path cannot be changed after creation");
907b38ff370SJamie Gritton 			goto done_errmsg;
908b38ff370SJamie Gritton 		}
909b38ff370SJamie Gritton 		if (len == 0 || path[len - 1] != '\0') {
910b38ff370SJamie Gritton 			error = EINVAL;
911b38ff370SJamie Gritton 			goto done_free;
912b38ff370SJamie Gritton 		}
9135050aa86SKonstantin Belousov 		NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE,
914b38ff370SJamie Gritton 		    path, td);
915b38ff370SJamie Gritton 		error = namei(&nd);
916b38ff370SJamie Gritton 		if (error)
917b38ff370SJamie Gritton 			goto done_free;
918b38ff370SJamie Gritton 		root = nd.ni_vp;
919b38ff370SJamie Gritton 		NDFREE(&nd, NDF_ONLY_PNBUF);
9206dfe0a3dSMartin Matuska 		g_path = malloc(MAXPATHLEN, M_TEMP, M_WAITOK);
9216dfe0a3dSMartin Matuska 		strlcpy(g_path, path, MAXPATHLEN);
9226dfe0a3dSMartin Matuska 		error = vn_path_to_global_path(td, root, g_path, MAXPATHLEN);
9233eb6b656SMateusz Guzik 		if (error == 0) {
9246dfe0a3dSMartin Matuska 			path = g_path;
9256dfe0a3dSMartin Matuska 		} else {
926f6e633a9SMartin Matuska 			/* exit on other errors */
927b38ff370SJamie Gritton 			goto done_free;
928b38ff370SJamie Gritton 		}
929f6e633a9SMartin Matuska 		if (root->v_type != VDIR) {
930f6e633a9SMartin Matuska 			error = ENOTDIR;
931f6e633a9SMartin Matuska 			vput(root);
932f6e633a9SMartin Matuska 			goto done_free;
933f6e633a9SMartin Matuska 		}
934b249ce48SMateusz Guzik 		VOP_UNLOCK(root);
935b38ff370SJamie Gritton 	}
936b38ff370SJamie Gritton 
937b38ff370SJamie Gritton 	/*
938b6f47c23SJamie Gritton 	 * Find the specified jail, or at least its parent.
939b38ff370SJamie Gritton 	 * This abuses the file error codes ENOENT and EEXIST.
940b38ff370SJamie Gritton 	 */
941b38ff370SJamie Gritton 	pr = NULL;
942b6f47c23SJamie Gritton 	ppr = mypr;
943babbbb9cSJamie Gritton 	if (cuflags == JAIL_CREATE && jid == 0 && name != NULL) {
944babbbb9cSJamie Gritton 		namelc = strrchr(name, '.');
945babbbb9cSJamie Gritton 		jid = strtoul(namelc != NULL ? namelc + 1 : name, &p, 10);
946babbbb9cSJamie Gritton 		if (*p != '\0')
947babbbb9cSJamie Gritton 			jid = 0;
948babbbb9cSJamie Gritton 	}
949b6f47c23SJamie Gritton 	sx_xlock(&allprison_lock);
950b38ff370SJamie Gritton 	if (jid != 0) {
9510304c731SJamie Gritton 		/*
9520304c731SJamie Gritton 		 * See if a requested jid already exists.  There is an
9530304c731SJamie Gritton 		 * information leak here if the jid exists but is not within
9540304c731SJamie Gritton 		 * the caller's jail hierarchy.  Jail creators will get EEXIST
9550304c731SJamie Gritton 		 * even though they cannot see the jail, and CREATE | UPDATE
9560304c731SJamie Gritton 		 * will return ENOENT which is not normally a valid error.
9570304c731SJamie Gritton 		 */
958b38ff370SJamie Gritton 		if (jid < 0) {
959b38ff370SJamie Gritton 			error = EINVAL;
960b38ff370SJamie Gritton 			vfs_opterror(opts, "negative jid");
961b38ff370SJamie Gritton 			goto done_unlock_list;
962b38ff370SJamie Gritton 		}
963b38ff370SJamie Gritton 		pr = prison_find(jid);
964b38ff370SJamie Gritton 		if (pr != NULL) {
9650304c731SJamie Gritton 			ppr = pr->pr_parent;
966b38ff370SJamie Gritton 			/* Create: jid must not exist. */
967b38ff370SJamie Gritton 			if (cuflags == JAIL_CREATE) {
968b38ff370SJamie Gritton 				mtx_unlock(&pr->pr_mtx);
969b38ff370SJamie Gritton 				error = EEXIST;
970b38ff370SJamie Gritton 				vfs_opterror(opts, "jail %d already exists",
971b38ff370SJamie Gritton 				    jid);
972b38ff370SJamie Gritton 				goto done_unlock_list;
973b38ff370SJamie Gritton 			}
9740304c731SJamie Gritton 			if (!prison_ischild(mypr, pr)) {
9750304c731SJamie Gritton 				mtx_unlock(&pr->pr_mtx);
9760304c731SJamie Gritton 				pr = NULL;
9770304c731SJamie Gritton 			} else if (pr->pr_uref == 0) {
978b38ff370SJamie Gritton 				if (!(flags & JAIL_DYING)) {
979b38ff370SJamie Gritton 					mtx_unlock(&pr->pr_mtx);
980b38ff370SJamie Gritton 					error = ENOENT;
981b38ff370SJamie Gritton 					vfs_opterror(opts, "jail %d is dying",
982b38ff370SJamie Gritton 					    jid);
983b38ff370SJamie Gritton 					goto done_unlock_list;
984b38ff370SJamie Gritton 				} else if ((flags & JAIL_ATTACH) ||
985b38ff370SJamie Gritton 				    (pr_flags & PR_PERSIST)) {
986b38ff370SJamie Gritton 					/*
987b38ff370SJamie Gritton 					 * A dying jail might be resurrected
988b38ff370SJamie Gritton 					 * (via attach or persist), but first
989b38ff370SJamie Gritton 					 * it must determine if another jail
990b38ff370SJamie Gritton 					 * has claimed its name.  Accomplish
991b38ff370SJamie Gritton 					 * this by implicitly re-setting the
992b38ff370SJamie Gritton 					 * name.
993b38ff370SJamie Gritton 					 */
994b38ff370SJamie Gritton 					if (name == NULL)
9950304c731SJamie Gritton 						name = prison_name(mypr, pr);
996b38ff370SJamie Gritton 				}
997b38ff370SJamie Gritton 			}
998b38ff370SJamie Gritton 		}
999b38ff370SJamie Gritton 		if (pr == NULL) {
1000b38ff370SJamie Gritton 			/* Update: jid must exist. */
1001b38ff370SJamie Gritton 			if (cuflags == JAIL_UPDATE) {
1002b38ff370SJamie Gritton 				error = ENOENT;
1003b38ff370SJamie Gritton 				vfs_opterror(opts, "jail %d not found", jid);
1004b38ff370SJamie Gritton 				goto done_unlock_list;
1005b38ff370SJamie Gritton 			}
1006b38ff370SJamie Gritton 		}
1007b38ff370SJamie Gritton 	}
1008b38ff370SJamie Gritton 	/*
1009b38ff370SJamie Gritton 	 * If the caller provided a name, look for a jail by that name.
1010b38ff370SJamie Gritton 	 * This has different semantics for creates and updates keyed by jid
1011b38ff370SJamie Gritton 	 * (where the name must not already exist in a different jail),
1012b38ff370SJamie Gritton 	 * and updates keyed by the name itself (where the name must exist
1013b38ff370SJamie Gritton 	 * because that is the jail being updated).
1014b38ff370SJamie Gritton 	 */
1015b6f47c23SJamie Gritton 	namelc = NULL;
1016b38ff370SJamie Gritton 	if (name != NULL) {
1017babbbb9cSJamie Gritton 		namelc = strrchr(name, '.');
1018babbbb9cSJamie Gritton 		if (namelc == NULL)
1019babbbb9cSJamie Gritton 			namelc = name;
1020babbbb9cSJamie Gritton 		else {
10210304c731SJamie Gritton 			/*
10220304c731SJamie Gritton 			 * This is a hierarchical name.  Split it into the
10230304c731SJamie Gritton 			 * parent and child names, and make sure the parent
10240304c731SJamie Gritton 			 * exists or matches an already found jail.
10250304c731SJamie Gritton 			 */
10260304c731SJamie Gritton 			if (pr != NULL) {
1027babbbb9cSJamie Gritton 				if (strncmp(name, ppr->pr_name, namelc - name)
1028babbbb9cSJamie Gritton 				    || ppr->pr_name[namelc - name] != '\0') {
10290304c731SJamie Gritton 					mtx_unlock(&pr->pr_mtx);
10300304c731SJamie Gritton 					error = EINVAL;
10310304c731SJamie Gritton 					vfs_opterror(opts,
10320304c731SJamie Gritton 					    "cannot change jail's parent");
10330304c731SJamie Gritton 					goto done_unlock_list;
10340304c731SJamie Gritton 				}
10350304c731SJamie Gritton 			} else {
1036b6f47c23SJamie Gritton 				*namelc = '\0';
10370304c731SJamie Gritton 				ppr = prison_find_name(mypr, name);
10380304c731SJamie Gritton 				if (ppr == NULL) {
10390304c731SJamie Gritton 					error = ENOENT;
10400304c731SJamie Gritton 					vfs_opterror(opts,
10410304c731SJamie Gritton 					    "jail \"%s\" not found", name);
10420304c731SJamie Gritton 					goto done_unlock_list;
10430304c731SJamie Gritton 				}
10440304c731SJamie Gritton 				mtx_unlock(&ppr->pr_mtx);
1045b6f47c23SJamie Gritton 				*namelc = '.';
10460304c731SJamie Gritton 			}
1047b6f47c23SJamie Gritton 			namelc++;
10480304c731SJamie Gritton 		}
1049b6f47c23SJamie Gritton 		if (namelc[0] != '\0') {
1050b6f47c23SJamie Gritton 			pnamelen =
10510304c731SJamie Gritton 			    (ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1;
1052b38ff370SJamie Gritton  name_again:
10530304c731SJamie Gritton 			deadpr = NULL;
10540304c731SJamie Gritton 			FOREACH_PRISON_CHILD(ppr, tpr) {
1055b38ff370SJamie Gritton 				if (tpr != pr && tpr->pr_ref > 0 &&
1056b6f47c23SJamie Gritton 				    !strcmp(tpr->pr_name + pnamelen, namelc)) {
1057b38ff370SJamie Gritton 					if (pr == NULL &&
1058b38ff370SJamie Gritton 					    cuflags != JAIL_CREATE) {
1059b38ff370SJamie Gritton 						mtx_lock(&tpr->pr_mtx);
1060b38ff370SJamie Gritton 						if (tpr->pr_ref > 0) {
1061b38ff370SJamie Gritton 							/*
1062b38ff370SJamie Gritton 							 * Use this jail
1063b38ff370SJamie Gritton 							 * for updates.
1064b38ff370SJamie Gritton 							 */
1065b38ff370SJamie Gritton 							if (tpr->pr_uref > 0) {
1066b38ff370SJamie Gritton 								pr = tpr;
1067b38ff370SJamie Gritton 								break;
1068b38ff370SJamie Gritton 							}
1069b38ff370SJamie Gritton 							deadpr = tpr;
1070b38ff370SJamie Gritton 						}
1071b38ff370SJamie Gritton 						mtx_unlock(&tpr->pr_mtx);
1072b38ff370SJamie Gritton 					} else if (tpr->pr_uref > 0) {
1073b38ff370SJamie Gritton 						/*
1074b38ff370SJamie Gritton 						 * Create, or update(jid):
1075b38ff370SJamie Gritton 						 * name must not exist in an
10760304c731SJamie Gritton 						 * active sibling jail.
1077b38ff370SJamie Gritton 						 */
1078b38ff370SJamie Gritton 						error = EEXIST;
1079b38ff370SJamie Gritton 						if (pr != NULL)
1080b38ff370SJamie Gritton 							mtx_unlock(&pr->pr_mtx);
1081b38ff370SJamie Gritton 						vfs_opterror(opts,
1082b38ff370SJamie Gritton 						   "jail \"%s\" already exists",
1083b38ff370SJamie Gritton 						   name);
1084b38ff370SJamie Gritton 						goto done_unlock_list;
1085b38ff370SJamie Gritton 					}
1086b38ff370SJamie Gritton 				}
1087b38ff370SJamie Gritton 			}
1088b38ff370SJamie Gritton 			/* If no active jail is found, use a dying one. */
1089b38ff370SJamie Gritton 			if (deadpr != NULL && pr == NULL) {
1090b38ff370SJamie Gritton 				if (flags & JAIL_DYING) {
1091b38ff370SJamie Gritton 					mtx_lock(&deadpr->pr_mtx);
1092b38ff370SJamie Gritton 					if (deadpr->pr_ref == 0) {
1093b38ff370SJamie Gritton 						mtx_unlock(&deadpr->pr_mtx);
1094b38ff370SJamie Gritton 						goto name_again;
1095b38ff370SJamie Gritton 					}
1096b38ff370SJamie Gritton 					pr = deadpr;
1097b38ff370SJamie Gritton 				} else if (cuflags == JAIL_UPDATE) {
1098b38ff370SJamie Gritton 					error = ENOENT;
1099b38ff370SJamie Gritton 					vfs_opterror(opts,
1100b38ff370SJamie Gritton 					    "jail \"%s\" is dying", name);
1101b38ff370SJamie Gritton 					goto done_unlock_list;
1102b38ff370SJamie Gritton 				}
1103b38ff370SJamie Gritton 			}
1104b38ff370SJamie Gritton 			/* Update: name must exist if no jid. */
1105b38ff370SJamie Gritton 			else if (cuflags == JAIL_UPDATE && pr == NULL) {
1106b38ff370SJamie Gritton 				error = ENOENT;
1107b38ff370SJamie Gritton 				vfs_opterror(opts, "jail \"%s\" not found",
1108b38ff370SJamie Gritton 				    name);
1109b38ff370SJamie Gritton 				goto done_unlock_list;
1110b38ff370SJamie Gritton 			}
1111b38ff370SJamie Gritton 		}
1112b38ff370SJamie Gritton 	}
1113b38ff370SJamie Gritton 	/* Update: must provide a jid or name. */
1114b38ff370SJamie Gritton 	else if (cuflags == JAIL_UPDATE && pr == NULL) {
1115b38ff370SJamie Gritton 		error = ENOENT;
1116b38ff370SJamie Gritton 		vfs_opterror(opts, "update specified no jail");
1117b38ff370SJamie Gritton 		goto done_unlock_list;
1118b38ff370SJamie Gritton 	}
1119b38ff370SJamie Gritton 
1120b38ff370SJamie Gritton 	/* If there's no prison to update, create a new one and link it in. */
1121b38ff370SJamie Gritton 	if (pr == NULL) {
1122b97457e2SJamie Gritton 		for (tpr = mypr; tpr != NULL; tpr = tpr->pr_parent)
1123b97457e2SJamie Gritton 			if (tpr->pr_childcount >= tpr->pr_childmax) {
1124b97457e2SJamie Gritton 				error = EPERM;
1125b97457e2SJamie Gritton 				vfs_opterror(opts, "prison limit exceeded");
1126b97457e2SJamie Gritton 				goto done_unlock_list;
1127b97457e2SJamie Gritton 			}
1128b38ff370SJamie Gritton 		created = 1;
11290304c731SJamie Gritton 		mtx_lock(&ppr->pr_mtx);
11302a549507SJamie Gritton 		if (ppr->pr_ref == 0) {
11310304c731SJamie Gritton 			mtx_unlock(&ppr->pr_mtx);
11320304c731SJamie Gritton 			error = ENOENT;
1133b6f47c23SJamie Gritton 			vfs_opterror(opts, "jail \"%s\" not found",
1134b6f47c23SJamie Gritton 			    prison_name(mypr, ppr));
11350304c731SJamie Gritton 			goto done_unlock_list;
11360304c731SJamie Gritton 		}
11370304c731SJamie Gritton 		ppr->pr_ref++;
11380304c731SJamie Gritton 		ppr->pr_uref++;
11390304c731SJamie Gritton 		mtx_unlock(&ppr->pr_mtx);
1140b38ff370SJamie Gritton 		pr = malloc(sizeof(*pr), M_PRISON, M_WAITOK | M_ZERO);
1141b38ff370SJamie Gritton 		if (jid == 0) {
1142b38ff370SJamie Gritton 			/* Find the next free jid. */
1143b38ff370SJamie Gritton 			jid = lastprid + 1;
1144b38ff370SJamie Gritton  findnext:
1145b38ff370SJamie Gritton 			if (jid == JAIL_MAX)
1146b38ff370SJamie Gritton 				jid = 1;
1147b38ff370SJamie Gritton 			TAILQ_FOREACH(tpr, &allprison, pr_list) {
1148b38ff370SJamie Gritton 				if (tpr->pr_id < jid)
1149b38ff370SJamie Gritton 					continue;
1150b38ff370SJamie Gritton 				if (tpr->pr_id > jid || tpr->pr_ref == 0) {
1151b38ff370SJamie Gritton 					TAILQ_INSERT_BEFORE(tpr, pr, pr_list);
1152b38ff370SJamie Gritton 					break;
1153b38ff370SJamie Gritton 				}
1154b38ff370SJamie Gritton 				if (jid == lastprid) {
1155b38ff370SJamie Gritton 					error = EAGAIN;
1156b38ff370SJamie Gritton 					vfs_opterror(opts,
1157b38ff370SJamie Gritton 					    "no available jail IDs");
1158b38ff370SJamie Gritton 					free(pr, M_PRISON);
11590304c731SJamie Gritton 					prison_deref(ppr, PD_DEREF |
11600304c731SJamie Gritton 					    PD_DEUREF | PD_LIST_XLOCKED);
11610304c731SJamie Gritton 					goto done_releroot;
1162b38ff370SJamie Gritton 				}
1163b38ff370SJamie Gritton 				jid++;
1164b38ff370SJamie Gritton 				goto findnext;
1165b38ff370SJamie Gritton 			}
1166b38ff370SJamie Gritton 			lastprid = jid;
1167b38ff370SJamie Gritton 		} else {
1168b38ff370SJamie Gritton 			/*
1169b38ff370SJamie Gritton 			 * The jail already has a jid (that did not yet exist),
1170b38ff370SJamie Gritton 			 * so just find where to insert it.
1171b38ff370SJamie Gritton 			 */
1172b38ff370SJamie Gritton 			TAILQ_FOREACH(tpr, &allprison, pr_list)
1173b38ff370SJamie Gritton 				if (tpr->pr_id >= jid) {
1174b38ff370SJamie Gritton 					TAILQ_INSERT_BEFORE(tpr, pr, pr_list);
1175b38ff370SJamie Gritton 					break;
1176b38ff370SJamie Gritton 				}
1177b38ff370SJamie Gritton 		}
1178b38ff370SJamie Gritton 		if (tpr == NULL)
1179b38ff370SJamie Gritton 			TAILQ_INSERT_TAIL(&allprison, pr, pr_list);
11800304c731SJamie Gritton 		LIST_INSERT_HEAD(&ppr->pr_children, pr, pr_sibling);
11810304c731SJamie Gritton 		for (tpr = ppr; tpr != NULL; tpr = tpr->pr_parent)
1182b97457e2SJamie Gritton 			tpr->pr_childcount++;
1183b38ff370SJamie Gritton 
11840304c731SJamie Gritton 		pr->pr_parent = ppr;
1185b38ff370SJamie Gritton 		pr->pr_id = jid;
11860304c731SJamie Gritton 
11870304c731SJamie Gritton 		/* Set some default values, and inherit some from the parent. */
1188b6f47c23SJamie Gritton 		if (namelc == NULL)
1189b6f47c23SJamie Gritton 			namelc = "";
1190b38ff370SJamie Gritton 		if (path == NULL) {
1191b38ff370SJamie Gritton 			path = "/";
11920304c731SJamie Gritton 			root = mypr->pr_root;
1193b38ff370SJamie Gritton 			vref(root);
1194b38ff370SJamie Gritton 		}
11958986e3a0SJamie Gritton 		strlcpy(pr->pr_hostuuid, DEFAULT_HOSTUUID, HOSTUUIDLEN);
11968986e3a0SJamie Gritton 		pr->pr_flags |= PR_HOST;
1197bdfc8cc4SJamie Gritton #if defined(INET) || defined(INET6)
1198bdfc8cc4SJamie Gritton #ifdef VIMAGE
1199bdfc8cc4SJamie Gritton 		if (!(pr_flags & PR_VNET))
1200bdfc8cc4SJamie Gritton #endif
1201bdfc8cc4SJamie Gritton 		{
12020304c731SJamie Gritton #ifdef INET
12032b0d6f81SJamie Gritton 			if (!(ch_flags & PR_IP4_USER))
12046a3f2779SJamie Gritton 				pr->pr_flags |= PR_IP4 | PR_IP4_USER;
12052b0d6f81SJamie Gritton 			else if (!(pr_flags & PR_IP4_USER)) {
12062b0d6f81SJamie Gritton 				pr->pr_flags |= ppr->pr_flags & PR_IP4;
12072b0d6f81SJamie Gritton 				if (ppr->pr_ip4 != NULL) {
12082b0d6f81SJamie Gritton 					pr->pr_ip4s = ppr->pr_ip4s;
12092b0d6f81SJamie Gritton 					pr->pr_ip4 = malloc(pr->pr_ip4s *
12102b0d6f81SJamie Gritton 					    sizeof(struct in_addr), M_PRISON,
12112b0d6f81SJamie Gritton 					    M_WAITOK);
12122b0d6f81SJamie Gritton 					bcopy(ppr->pr_ip4, pr->pr_ip4,
12132b0d6f81SJamie Gritton 					    pr->pr_ip4s * sizeof(*pr->pr_ip4));
12142b0d6f81SJamie Gritton 				}
12152b0d6f81SJamie Gritton 			}
12160304c731SJamie Gritton #endif
12170304c731SJamie Gritton #ifdef INET6
12182b0d6f81SJamie Gritton 			if (!(ch_flags & PR_IP6_USER))
12196a3f2779SJamie Gritton 				pr->pr_flags |= PR_IP6 | PR_IP6_USER;
12202b0d6f81SJamie Gritton 			else if (!(pr_flags & PR_IP6_USER)) {
12212b0d6f81SJamie Gritton 				pr->pr_flags |= ppr->pr_flags & PR_IP6;
12222b0d6f81SJamie Gritton 				if (ppr->pr_ip6 != NULL) {
12232b0d6f81SJamie Gritton 					pr->pr_ip6s = ppr->pr_ip6s;
12242b0d6f81SJamie Gritton 					pr->pr_ip6 = malloc(pr->pr_ip6s *
12252b0d6f81SJamie Gritton 					    sizeof(struct in6_addr), M_PRISON,
12262b0d6f81SJamie Gritton 					    M_WAITOK);
12272b0d6f81SJamie Gritton 					bcopy(ppr->pr_ip6, pr->pr_ip6,
12282b0d6f81SJamie Gritton 					    pr->pr_ip6s * sizeof(*pr->pr_ip6));
12292b0d6f81SJamie Gritton 				}
12302b0d6f81SJamie Gritton 			}
12310304c731SJamie Gritton #endif
1232bdfc8cc4SJamie Gritton 		}
1233bdfc8cc4SJamie Gritton #endif
1234592bcae8SBjoern A. Zeeb 		/* Source address selection is always on by default. */
1235592bcae8SBjoern A. Zeeb 		pr->pr_flags |= _PR_IP_SADDRSEL;
1236592bcae8SBjoern A. Zeeb 
12370304c731SJamie Gritton 		pr->pr_securelevel = ppr->pr_securelevel;
12380304c731SJamie Gritton 		pr->pr_allow = JAIL_DEFAULT_ALLOW & ppr->pr_allow;
1239af10bf05SBjoern A. Zeeb 		pr->pr_enforce_statfs = jail_default_enforce_statfs;
1240bf3db8aaSMartin Matuska 		pr->pr_devfs_rsnum = ppr->pr_devfs_rsnum;
1241b38ff370SJamie Gritton 
1242b96bd95bSIan Lepore 		pr->pr_osreldate = osreldt ? osreldt : ppr->pr_osreldate;
1243b96bd95bSIan Lepore 		if (osrelstr == NULL)
1244b96bd95bSIan Lepore 		    strcpy(pr->pr_osrelease, ppr->pr_osrelease);
1245b96bd95bSIan Lepore 		else
1246b96bd95bSIan Lepore 		    strcpy(pr->pr_osrelease, osrelstr);
1247b96bd95bSIan Lepore 
12480304c731SJamie Gritton 		LIST_INIT(&pr->pr_children);
12490304c731SJamie Gritton 		mtx_init(&pr->pr_mtx, "jail mutex", NULL, MTX_DEF | MTX_DUPOK);
125073d9e52dSJamie Gritton 		TASK_INIT(&pr->pr_task, 0, prison_complete, pr);
1251b38ff370SJamie Gritton 
1252679e1390SJamie Gritton #ifdef VIMAGE
1253679e1390SJamie Gritton 		/* Allocate a new vnet if specified. */
1254679e1390SJamie Gritton 		pr->pr_vnet = (pr_flags & PR_VNET)
1255679e1390SJamie Gritton 		    ? vnet_alloc() : ppr->pr_vnet;
1256679e1390SJamie Gritton #endif
1257b38ff370SJamie Gritton 		/*
1258b38ff370SJamie Gritton 		 * Allocate a dedicated cpuset for each jail.
1259b38ff370SJamie Gritton 		 * Unlike other initial settings, this may return an erorr.
1260b38ff370SJamie Gritton 		 */
12610304c731SJamie Gritton 		error = cpuset_create_root(ppr, &pr->pr_cpuset);
1262b38ff370SJamie Gritton 		if (error) {
1263b38ff370SJamie Gritton 			prison_deref(pr, PD_LIST_XLOCKED);
1264b38ff370SJamie Gritton 			goto done_releroot;
1265b38ff370SJamie Gritton 		}
1266b38ff370SJamie Gritton 
1267b38ff370SJamie Gritton 		mtx_lock(&pr->pr_mtx);
1268b38ff370SJamie Gritton 		/*
1269b38ff370SJamie Gritton 		 * New prisons do not yet have a reference, because we do not
1270b6f47c23SJamie Gritton 		 * want others to see the incomplete prison once the
1271b38ff370SJamie Gritton 		 * allprison_lock is downgraded.
1272b38ff370SJamie Gritton 		 */
1273b38ff370SJamie Gritton 	} else {
1274b38ff370SJamie Gritton 		created = 0;
12752b0d6f81SJamie Gritton 		/*
12762b0d6f81SJamie Gritton 		 * Grab a reference for existing prisons, to ensure they
12772b0d6f81SJamie Gritton 		 * continue to exist for the duration of the call.
12782b0d6f81SJamie Gritton 		 */
12792b0d6f81SJamie Gritton 		pr->pr_ref++;
1280bdfc8cc4SJamie Gritton #if defined(VIMAGE) && (defined(INET) || defined(INET6))
1281bdfc8cc4SJamie Gritton 		if ((pr->pr_flags & PR_VNET) &&
1282bdfc8cc4SJamie Gritton 		    (ch_flags & (PR_IP4_USER | PR_IP6_USER))) {
1283bdfc8cc4SJamie Gritton 			error = EINVAL;
1284bdfc8cc4SJamie Gritton 			vfs_opterror(opts,
1285bdfc8cc4SJamie Gritton 			    "vnet jails cannot have IP address restrictions");
1286bdfc8cc4SJamie Gritton 			goto done_deref_locked;
1287bdfc8cc4SJamie Gritton 		}
1288bdfc8cc4SJamie Gritton #endif
12892b0d6f81SJamie Gritton #ifdef INET
12902b0d6f81SJamie Gritton 		if (PR_IP4_USER & ch_flags & (pr_flags ^ pr->pr_flags)) {
12912b0d6f81SJamie Gritton 			error = EINVAL;
12922b0d6f81SJamie Gritton 			vfs_opterror(opts,
12932b0d6f81SJamie Gritton 			    "ip4 cannot be changed after creation");
12942b0d6f81SJamie Gritton 			goto done_deref_locked;
12952b0d6f81SJamie Gritton 		}
12962b0d6f81SJamie Gritton #endif
12972b0d6f81SJamie Gritton #ifdef INET6
12982b0d6f81SJamie Gritton 		if (PR_IP6_USER & ch_flags & (pr_flags ^ pr->pr_flags)) {
12992b0d6f81SJamie Gritton 			error = EINVAL;
13002b0d6f81SJamie Gritton 			vfs_opterror(opts,
13012b0d6f81SJamie Gritton 			    "ip6 cannot be changed after creation");
13022b0d6f81SJamie Gritton 			goto done_deref_locked;
13032b0d6f81SJamie Gritton 		}
13042b0d6f81SJamie Gritton #endif
1305b38ff370SJamie Gritton 	}
1306b38ff370SJamie Gritton 
1307b38ff370SJamie Gritton 	/* Do final error checking before setting anything. */
13080304c731SJamie Gritton 	if (gotslevel) {
13090304c731SJamie Gritton 		if (slevel < ppr->pr_securelevel) {
13100304c731SJamie Gritton 			error = EPERM;
13110304c731SJamie Gritton 			goto done_deref_locked;
13120304c731SJamie Gritton 		}
13130304c731SJamie Gritton 	}
1314b97457e2SJamie Gritton 	if (gotchildmax) {
1315b97457e2SJamie Gritton 		if (childmax >= ppr->pr_childmax) {
1316b97457e2SJamie Gritton 			error = EPERM;
1317b97457e2SJamie Gritton 			goto done_deref_locked;
1318b97457e2SJamie Gritton 		}
1319b97457e2SJamie Gritton 	}
13200304c731SJamie Gritton 	if (gotenforce) {
13210304c731SJamie Gritton 		if (enforce < ppr->pr_enforce_statfs) {
13220304c731SJamie Gritton 			error = EPERM;
13230304c731SJamie Gritton 			goto done_deref_locked;
13240304c731SJamie Gritton 		}
13250304c731SJamie Gritton 	}
13260cc207a6SMartin Matuska 	if (gotrsnum) {
13270cc207a6SMartin Matuska 		/*
13280cc207a6SMartin Matuska 		 * devfs_rsnum is a uint16_t
13290cc207a6SMartin Matuska 		 */
1330bf3db8aaSMartin Matuska 		if (rsnum < 0 || rsnum > 65535) {
13310cc207a6SMartin Matuska 			error = EINVAL;
13320cc207a6SMartin Matuska 			goto done_deref_locked;
13330cc207a6SMartin Matuska 		}
13340cc207a6SMartin Matuska 		/*
1335bf3db8aaSMartin Matuska 		 * Nested jails always inherit parent's devfs ruleset
13360cc207a6SMartin Matuska 		 */
13370cc207a6SMartin Matuska 		if (jailed(td->td_ucred)) {
13380cc207a6SMartin Matuska 			if (rsnum > 0 && rsnum != ppr->pr_devfs_rsnum) {
13390cc207a6SMartin Matuska 				error = EPERM;
13400cc207a6SMartin Matuska 				goto done_deref_locked;
1341bf3db8aaSMartin Matuska 			} else
13420cc207a6SMartin Matuska 				rsnum = ppr->pr_devfs_rsnum;
13430cc207a6SMartin Matuska 		}
13440cc207a6SMartin Matuska 	}
1345b38ff370SJamie Gritton #ifdef INET
13462b0d6f81SJamie Gritton 	if (ip4s > 0) {
13470304c731SJamie Gritton 		if (ppr->pr_flags & PR_IP4) {
13480304c731SJamie Gritton 			/*
13490304c731SJamie Gritton 			 * Make sure the new set of IP addresses is a
13500304c731SJamie Gritton 			 * subset of the parent's list.  Don't worry
13510304c731SJamie Gritton 			 * about the parent being unlocked, as any
13520304c731SJamie Gritton 			 * setting is done with allprison_lock held.
13530304c731SJamie Gritton 			 */
13540304c731SJamie Gritton 			for (ij = 0; ij < ppr->pr_ip4s; ij++)
13552b0d6f81SJamie Gritton 				if (ip4[0].s_addr == ppr->pr_ip4[ij].s_addr)
13560304c731SJamie Gritton 					break;
13570304c731SJamie Gritton 			if (ij == ppr->pr_ip4s) {
13580304c731SJamie Gritton 				error = EPERM;
13590304c731SJamie Gritton 				goto done_deref_locked;
13600304c731SJamie Gritton 			}
13610304c731SJamie Gritton 			if (ip4s > 1) {
13620304c731SJamie Gritton 				for (ii = ij = 1; ii < ip4s; ii++) {
13630304c731SJamie Gritton 					if (ip4[ii].s_addr ==
13640304c731SJamie Gritton 					    ppr->pr_ip4[0].s_addr)
1365b38ff370SJamie Gritton 						continue;
13660304c731SJamie Gritton 					for (; ij < ppr->pr_ip4s; ij++)
13670304c731SJamie Gritton 						if (ip4[ii].s_addr ==
13680304c731SJamie Gritton 						    ppr->pr_ip4[ij].s_addr)
13690304c731SJamie Gritton 							break;
13700304c731SJamie Gritton 					if (ij == ppr->pr_ip4s)
13710304c731SJamie Gritton 						break;
13720304c731SJamie Gritton 				}
13730304c731SJamie Gritton 				if (ij == ppr->pr_ip4s) {
13740304c731SJamie Gritton 					error = EPERM;
13750304c731SJamie Gritton 					goto done_deref_locked;
13760304c731SJamie Gritton 				}
13770304c731SJamie Gritton 			}
13780304c731SJamie Gritton 		}
13790304c731SJamie Gritton 		/*
13800304c731SJamie Gritton 		 * Check for conflicting IP addresses.  We permit them
13810304c731SJamie Gritton 		 * if there is no more than one IP on each jail.  If
13820304c731SJamie Gritton 		 * there is a duplicate on a jail with more than one
13830304c731SJamie Gritton 		 * IP stop checking and return error.
13840304c731SJamie Gritton 		 */
1385bdfc8cc4SJamie Gritton #ifdef VIMAGE
138608b43333SJamie Gritton 		for (tppr = ppr; tppr != &prison0; tppr = tppr->pr_parent)
1387bdfc8cc4SJamie Gritton 			if (tppr->pr_flags & PR_VNET)
1388bdfc8cc4SJamie Gritton 				break;
138908b43333SJamie Gritton #else
139008b43333SJamie Gritton 		tppr = &prison0;
1391bdfc8cc4SJamie Gritton #endif
1392bdfc8cc4SJamie Gritton 		FOREACH_PRISON_DESCENDANT(tppr, tpr, descend) {
1393bdfc8cc4SJamie Gritton 			if (tpr == pr ||
1394bdfc8cc4SJamie Gritton #ifdef VIMAGE
13952b0d6f81SJamie Gritton 			    (tpr != tppr && (tpr->pr_flags & PR_VNET)) ||
1396bdfc8cc4SJamie Gritton #endif
1397bdfc8cc4SJamie Gritton 			    tpr->pr_uref == 0) {
13980304c731SJamie Gritton 				descend = 0;
13990304c731SJamie Gritton 				continue;
14000304c731SJamie Gritton 			}
14010304c731SJamie Gritton 			if (!(tpr->pr_flags & PR_IP4_USER))
14020304c731SJamie Gritton 				continue;
14030304c731SJamie Gritton 			descend = 0;
14040304c731SJamie Gritton 			if (tpr->pr_ip4 == NULL ||
14050304c731SJamie Gritton 			    (ip4s == 1 && tpr->pr_ip4s == 1))
14060304c731SJamie Gritton 				continue;
14070304c731SJamie Gritton 			for (ii = 0; ii < ip4s; ii++) {
14080ce1624dSStephen J. Kiernan 				if (prison_check_ip4_locked(tpr, &ip4[ii]) ==
14090ce1624dSStephen J. Kiernan 				    0) {
14100304c731SJamie Gritton 					error = EADDRINUSE;
1411b38ff370SJamie Gritton 					vfs_opterror(opts,
1412b38ff370SJamie Gritton 					    "IPv4 addresses clash");
1413b38ff370SJamie Gritton 					goto done_deref_locked;
1414b38ff370SJamie Gritton 				}
14150304c731SJamie Gritton 			}
14160304c731SJamie Gritton 		}
14170304c731SJamie Gritton 	}
1418b38ff370SJamie Gritton #endif
1419b38ff370SJamie Gritton #ifdef INET6
14202b0d6f81SJamie Gritton 	if (ip6s > 0) {
14210304c731SJamie Gritton 		if (ppr->pr_flags & PR_IP6) {
14220304c731SJamie Gritton 			/*
14230304c731SJamie Gritton 			 * Make sure the new set of IP addresses is a
14240304c731SJamie Gritton 			 * subset of the parent's list.
14250304c731SJamie Gritton 			 */
14260304c731SJamie Gritton 			for (ij = 0; ij < ppr->pr_ip6s; ij++)
14270304c731SJamie Gritton 				if (IN6_ARE_ADDR_EQUAL(&ip6[0],
14280304c731SJamie Gritton 				    &ppr->pr_ip6[ij]))
14290304c731SJamie Gritton 					break;
14300304c731SJamie Gritton 			if (ij == ppr->pr_ip6s) {
14310304c731SJamie Gritton 				error = EPERM;
14320304c731SJamie Gritton 				goto done_deref_locked;
14330304c731SJamie Gritton 			}
14340304c731SJamie Gritton 			if (ip6s > 1) {
14350304c731SJamie Gritton 				for (ii = ij = 1; ii < ip6s; ii++) {
14360304c731SJamie Gritton 					if (IN6_ARE_ADDR_EQUAL(&ip6[ii],
14370304c731SJamie Gritton 					     &ppr->pr_ip6[0]))
14380304c731SJamie Gritton 						continue;
14390304c731SJamie Gritton 					for (; ij < ppr->pr_ip6s; ij++)
14400304c731SJamie Gritton 						if (IN6_ARE_ADDR_EQUAL(
14412b0d6f81SJamie Gritton 						    &ip6[ii], &ppr->pr_ip6[ij]))
14420304c731SJamie Gritton 							break;
14430304c731SJamie Gritton 					if (ij == ppr->pr_ip6s)
14440304c731SJamie Gritton 						break;
14450304c731SJamie Gritton 				}
14460304c731SJamie Gritton 				if (ij == ppr->pr_ip6s) {
14470304c731SJamie Gritton 					error = EPERM;
14480304c731SJamie Gritton 					goto done_deref_locked;
14490304c731SJamie Gritton 				}
14500304c731SJamie Gritton 			}
14510304c731SJamie Gritton 		}
14520304c731SJamie Gritton 		/* Check for conflicting IP addresses. */
1453bdfc8cc4SJamie Gritton #ifdef VIMAGE
145408b43333SJamie Gritton 		for (tppr = ppr; tppr != &prison0; tppr = tppr->pr_parent)
1455bdfc8cc4SJamie Gritton 			if (tppr->pr_flags & PR_VNET)
1456bdfc8cc4SJamie Gritton 				break;
145708b43333SJamie Gritton #else
145808b43333SJamie Gritton 		tppr = &prison0;
1459bdfc8cc4SJamie Gritton #endif
1460bdfc8cc4SJamie Gritton 		FOREACH_PRISON_DESCENDANT(tppr, tpr, descend) {
1461bdfc8cc4SJamie Gritton 			if (tpr == pr ||
1462bdfc8cc4SJamie Gritton #ifdef VIMAGE
14632b0d6f81SJamie Gritton 			    (tpr != tppr && (tpr->pr_flags & PR_VNET)) ||
1464bdfc8cc4SJamie Gritton #endif
1465bdfc8cc4SJamie Gritton 			    tpr->pr_uref == 0) {
14660304c731SJamie Gritton 				descend = 0;
14670304c731SJamie Gritton 				continue;
14680304c731SJamie Gritton 			}
14690304c731SJamie Gritton 			if (!(tpr->pr_flags & PR_IP6_USER))
14700304c731SJamie Gritton 				continue;
14710304c731SJamie Gritton 			descend = 0;
14720304c731SJamie Gritton 			if (tpr->pr_ip6 == NULL ||
14730304c731SJamie Gritton 			    (ip6s == 1 && tpr->pr_ip6s == 1))
14740304c731SJamie Gritton 				continue;
14750304c731SJamie Gritton 			for (ii = 0; ii < ip6s; ii++) {
14760ce1624dSStephen J. Kiernan 				if (prison_check_ip6_locked(tpr, &ip6[ii]) ==
14770ce1624dSStephen J. Kiernan 				    0) {
14780304c731SJamie Gritton 					error = EADDRINUSE;
1479b38ff370SJamie Gritton 					vfs_opterror(opts,
1480b38ff370SJamie Gritton 					    "IPv6 addresses clash");
1481b38ff370SJamie Gritton 					goto done_deref_locked;
1482b38ff370SJamie Gritton 				}
14830304c731SJamie Gritton 			}
14840304c731SJamie Gritton 		}
14850304c731SJamie Gritton 	}
1486b38ff370SJamie Gritton #endif
14870304c731SJamie Gritton 	onamelen = namelen = 0;
1488b6f47c23SJamie Gritton 	if (namelc != NULL) {
14896ab6058eSJamie Gritton 		/* Give a default name of the jid.  Also allow the name to be
14906ab6058eSJamie Gritton 		 * explicitly the jid - but not any other number, and only in
14916ab6058eSJamie Gritton 		 * normal form (no leading zero/etc).
14926ab6058eSJamie Gritton 		 */
1493b6f47c23SJamie Gritton 		if (namelc[0] == '\0')
1494b6f47c23SJamie Gritton 			snprintf(namelc = numbuf, sizeof(numbuf), "%d", jid);
14956ab6058eSJamie Gritton 		else if ((strtoul(namelc, &p, 10) != jid ||
14966ab6058eSJamie Gritton 			  namelc[0] < '1' || namelc[0] > '9') && *p == '\0') {
1497b38ff370SJamie Gritton 			error = EINVAL;
1498babbbb9cSJamie Gritton 			vfs_opterror(opts,
1499babbbb9cSJamie Gritton 			    "name cannot be numeric (unless it is the jid)");
15000304c731SJamie Gritton 			goto done_deref_locked;
1501b38ff370SJamie Gritton 		}
1502b38ff370SJamie Gritton 		/*
15030304c731SJamie Gritton 		 * Make sure the name isn't too long for the prison or its
15040304c731SJamie Gritton 		 * children.
1505b38ff370SJamie Gritton 		 */
1506b6f47c23SJamie Gritton 		pnamelen = (ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1;
1507b6f47c23SJamie Gritton 		onamelen = strlen(pr->pr_name + pnamelen);
1508b6f47c23SJamie Gritton 		namelen = strlen(namelc);
1509b6f47c23SJamie Gritton 		if (pnamelen + namelen + 1 > sizeof(pr->pr_name)) {
15100304c731SJamie Gritton 			error = ENAMETOOLONG;
15110304c731SJamie Gritton 			goto done_deref_locked;
15120304c731SJamie Gritton 		}
15130304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT(pr, tpr, descend) {
15140304c731SJamie Gritton 			if (strlen(tpr->pr_name) + (namelen - onamelen) >=
15150304c731SJamie Gritton 			    sizeof(pr->pr_name)) {
15160304c731SJamie Gritton 				error = ENAMETOOLONG;
15170304c731SJamie Gritton 				goto done_deref_locked;
15180304c731SJamie Gritton 			}
15190304c731SJamie Gritton 		}
15200304c731SJamie Gritton 	}
1521b3079544SJamie Gritton 	pr_allow_diff = pr_allow & ~ppr->pr_allow;
1522b3079544SJamie Gritton 	if (pr_allow_diff & ~PR_ALLOW_DIFFERENCES) {
15230304c731SJamie Gritton 		error = EPERM;
15240304c731SJamie Gritton 		goto done_deref_locked;
1525b38ff370SJamie Gritton 	}
1526b38ff370SJamie Gritton 
1527b6f47c23SJamie Gritton 	/*
1528b6f47c23SJamie Gritton 	 * Let modules check their parameters.  This requires unlocking and
1529b6f47c23SJamie Gritton 	 * then re-locking the prison, but this is still a valid state as long
1530b6f47c23SJamie Gritton 	 * as allprison_lock remains xlocked.
1531b6f47c23SJamie Gritton 	 */
1532b6f47c23SJamie Gritton 	mtx_unlock(&pr->pr_mtx);
1533b6f47c23SJamie Gritton 	error = osd_jail_call(pr, PR_METHOD_CHECK, opts);
1534b6f47c23SJamie Gritton 	if (error != 0) {
1535b6f47c23SJamie Gritton 		prison_deref(pr, created
1536b6f47c23SJamie Gritton 		    ? PD_LIST_XLOCKED
1537b6f47c23SJamie Gritton 		    : PD_DEREF | PD_LIST_XLOCKED);
1538b6f47c23SJamie Gritton 		goto done_releroot;
1539b6f47c23SJamie Gritton 	}
1540b6f47c23SJamie Gritton 	mtx_lock(&pr->pr_mtx);
1541b6f47c23SJamie Gritton 
1542b6f47c23SJamie Gritton 	/* At this point, all valid parameters should have been noted. */
1543b6f47c23SJamie Gritton 	TAILQ_FOREACH(opt, opts, link) {
1544b6f47c23SJamie Gritton 		if (!opt->seen && strcmp(opt->name, "errmsg")) {
1545b6f47c23SJamie Gritton 			error = EINVAL;
1546b6f47c23SJamie Gritton 			vfs_opterror(opts, "unknown parameter: %s", opt->name);
1547b6f47c23SJamie Gritton 			goto done_deref_locked;
1548b6f47c23SJamie Gritton 		}
1549b6f47c23SJamie Gritton 	}
1550b6f47c23SJamie Gritton 
1551b38ff370SJamie Gritton 	/* Set the parameters of the prison. */
1552b38ff370SJamie Gritton #ifdef INET
15530304c731SJamie Gritton 	redo_ip4 = 0;
15540304c731SJamie Gritton 	if (pr_flags & PR_IP4_USER) {
15550304c731SJamie Gritton 		pr->pr_flags |= PR_IP4;
1556b38ff370SJamie Gritton 		free(pr->pr_ip4, M_PRISON);
15570304c731SJamie Gritton 		pr->pr_ip4s = ip4s;
1558b38ff370SJamie Gritton 		pr->pr_ip4 = ip4;
1559b38ff370SJamie Gritton 		ip4 = NULL;
15600304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1561bdfc8cc4SJamie Gritton #ifdef VIMAGE
1562bdfc8cc4SJamie Gritton 			if (tpr->pr_flags & PR_VNET) {
1563bdfc8cc4SJamie Gritton 				descend = 0;
1564bdfc8cc4SJamie Gritton 				continue;
1565bdfc8cc4SJamie Gritton 			}
1566bdfc8cc4SJamie Gritton #endif
15670304c731SJamie Gritton 			if (prison_restrict_ip4(tpr, NULL)) {
15680304c731SJamie Gritton 				redo_ip4 = 1;
15690304c731SJamie Gritton 				descend = 0;
15700304c731SJamie Gritton 			}
15710304c731SJamie Gritton 		}
15720304c731SJamie Gritton 	}
1573b38ff370SJamie Gritton #endif
1574b38ff370SJamie Gritton #ifdef INET6
15750304c731SJamie Gritton 	redo_ip6 = 0;
15760304c731SJamie Gritton 	if (pr_flags & PR_IP6_USER) {
15770304c731SJamie Gritton 		pr->pr_flags |= PR_IP6;
1578b38ff370SJamie Gritton 		free(pr->pr_ip6, M_PRISON);
15790304c731SJamie Gritton 		pr->pr_ip6s = ip6s;
1580b38ff370SJamie Gritton 		pr->pr_ip6 = ip6;
1581b38ff370SJamie Gritton 		ip6 = NULL;
15820304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1583bdfc8cc4SJamie Gritton #ifdef VIMAGE
1584bdfc8cc4SJamie Gritton 			if (tpr->pr_flags & PR_VNET) {
1585bdfc8cc4SJamie Gritton 				descend = 0;
1586bdfc8cc4SJamie Gritton 				continue;
1587bdfc8cc4SJamie Gritton 			}
1588bdfc8cc4SJamie Gritton #endif
15890304c731SJamie Gritton 			if (prison_restrict_ip6(tpr, NULL)) {
15900304c731SJamie Gritton 				redo_ip6 = 1;
15910304c731SJamie Gritton 				descend = 0;
15920304c731SJamie Gritton 			}
15930304c731SJamie Gritton 		}
15940304c731SJamie Gritton 	}
1595b38ff370SJamie Gritton #endif
15960304c731SJamie Gritton 	if (gotslevel) {
1597b38ff370SJamie Gritton 		pr->pr_securelevel = slevel;
15980304c731SJamie Gritton 		/* Set all child jails to be at least this level. */
15990304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
16000304c731SJamie Gritton 			if (tpr->pr_securelevel < slevel)
16010304c731SJamie Gritton 				tpr->pr_securelevel = slevel;
16020304c731SJamie Gritton 	}
1603b97457e2SJamie Gritton 	if (gotchildmax) {
1604b97457e2SJamie Gritton 		pr->pr_childmax = childmax;
1605b97457e2SJamie Gritton 		/* Set all child jails to under this limit. */
1606b97457e2SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED_LEVEL(pr, tpr, descend, level)
1607b97457e2SJamie Gritton 			if (tpr->pr_childmax > childmax - level)
1608b97457e2SJamie Gritton 				tpr->pr_childmax = childmax > level
1609b97457e2SJamie Gritton 				    ? childmax - level : 0;
1610b97457e2SJamie Gritton 	}
16110304c731SJamie Gritton 	if (gotenforce) {
16120304c731SJamie Gritton 		pr->pr_enforce_statfs = enforce;
16130304c731SJamie Gritton 		/* Pass this restriction on to the children. */
16140304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
16150304c731SJamie Gritton 			if (tpr->pr_enforce_statfs < enforce)
16160304c731SJamie Gritton 				tpr->pr_enforce_statfs = enforce;
16170304c731SJamie Gritton 	}
16180cc207a6SMartin Matuska 	if (gotrsnum) {
16190cc207a6SMartin Matuska 		pr->pr_devfs_rsnum = rsnum;
16200cc207a6SMartin Matuska 		/* Pass this restriction on to the children. */
16210cc207a6SMartin Matuska 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
16220cc207a6SMartin Matuska 			tpr->pr_devfs_rsnum = rsnum;
16230cc207a6SMartin Matuska 	}
1624b6f47c23SJamie Gritton 	if (namelc != NULL) {
16250304c731SJamie Gritton 		if (ppr == &prison0)
1626b6f47c23SJamie Gritton 			strlcpy(pr->pr_name, namelc, sizeof(pr->pr_name));
16270304c731SJamie Gritton 		else
16280304c731SJamie Gritton 			snprintf(pr->pr_name, sizeof(pr->pr_name), "%s.%s",
1629b6f47c23SJamie Gritton 			    ppr->pr_name, namelc);
16300304c731SJamie Gritton 		/* Change this component of child names. */
16310304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
16320304c731SJamie Gritton 			bcopy(tpr->pr_name + onamelen, tpr->pr_name + namelen,
16330304c731SJamie Gritton 			    strlen(tpr->pr_name + onamelen) + 1);
16340304c731SJamie Gritton 			bcopy(pr->pr_name, tpr->pr_name, namelen);
16350304c731SJamie Gritton 		}
16360304c731SJamie Gritton 	}
1637b38ff370SJamie Gritton 	if (path != NULL) {
16380304c731SJamie Gritton 		/* Try to keep a real-rooted full pathname. */
1639b38ff370SJamie Gritton 		strlcpy(pr->pr_path, path, sizeof(pr->pr_path));
1640b38ff370SJamie Gritton 		pr->pr_root = root;
1641b38ff370SJamie Gritton 	}
164276ca6f88SJamie Gritton 	if (PR_HOST & ch_flags & ~pr_flags) {
164376ca6f88SJamie Gritton 		if (pr->pr_flags & PR_HOST) {
164476ca6f88SJamie Gritton 			/*
164576ca6f88SJamie Gritton 			 * Copy the parent's host info.  As with pr_ip4 above,
164676ca6f88SJamie Gritton 			 * the lack of a lock on the parent is not a problem;
164776ca6f88SJamie Gritton 			 * it is always set with allprison_lock at least
164876ca6f88SJamie Gritton 			 * shared, and is held exclusively here.
164976ca6f88SJamie Gritton 			 */
1650c1f19219SJamie Gritton 			strlcpy(pr->pr_hostname, pr->pr_parent->pr_hostname,
1651c1f19219SJamie Gritton 			    sizeof(pr->pr_hostname));
1652c1f19219SJamie Gritton 			strlcpy(pr->pr_domainname, pr->pr_parent->pr_domainname,
1653c1f19219SJamie Gritton 			    sizeof(pr->pr_domainname));
1654c1f19219SJamie Gritton 			strlcpy(pr->pr_hostuuid, pr->pr_parent->pr_hostuuid,
1655c1f19219SJamie Gritton 			    sizeof(pr->pr_hostuuid));
165676ca6f88SJamie Gritton 			pr->pr_hostid = pr->pr_parent->pr_hostid;
165776ca6f88SJamie Gritton 		}
165876ca6f88SJamie Gritton 	} else if (host != NULL || domain != NULL || uuid != NULL || gothid) {
165976ca6f88SJamie Gritton 		/* Set this prison, and any descendants without PR_HOST. */
1660b38ff370SJamie Gritton 		if (host != NULL)
1661c1f19219SJamie Gritton 			strlcpy(pr->pr_hostname, host, sizeof(pr->pr_hostname));
166276ca6f88SJamie Gritton 		if (domain != NULL)
1663c1f19219SJamie Gritton 			strlcpy(pr->pr_domainname, domain,
1664c1f19219SJamie Gritton 			    sizeof(pr->pr_domainname));
166576ca6f88SJamie Gritton 		if (uuid != NULL)
1666c1f19219SJamie Gritton 			strlcpy(pr->pr_hostuuid, uuid, sizeof(pr->pr_hostuuid));
166776ca6f88SJamie Gritton 		if (gothid)
166876ca6f88SJamie Gritton 			pr->pr_hostid = hid;
166976ca6f88SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
167076ca6f88SJamie Gritton 			if (tpr->pr_flags & PR_HOST)
167176ca6f88SJamie Gritton 				descend = 0;
167276ca6f88SJamie Gritton 			else {
167376ca6f88SJamie Gritton 				if (host != NULL)
1674c1f19219SJamie Gritton 					strlcpy(tpr->pr_hostname,
1675c1f19219SJamie Gritton 					    pr->pr_hostname,
1676c1f19219SJamie Gritton 					    sizeof(tpr->pr_hostname));
167776ca6f88SJamie Gritton 				if (domain != NULL)
1678c1f19219SJamie Gritton 					strlcpy(tpr->pr_domainname,
1679c1f19219SJamie Gritton 					    pr->pr_domainname,
1680c1f19219SJamie Gritton 					    sizeof(tpr->pr_domainname));
168176ca6f88SJamie Gritton 				if (uuid != NULL)
1682c1f19219SJamie Gritton 					strlcpy(tpr->pr_hostuuid,
1683c1f19219SJamie Gritton 					    pr->pr_hostuuid,
1684c1f19219SJamie Gritton 					    sizeof(tpr->pr_hostuuid));
168576ca6f88SJamie Gritton 				if (gothid)
168676ca6f88SJamie Gritton 					tpr->pr_hostid = hid;
168776ca6f88SJamie Gritton 			}
168876ca6f88SJamie Gritton 		}
168976ca6f88SJamie Gritton 	}
16900304c731SJamie Gritton 	if ((tallow = ch_allow & ~pr_allow)) {
16910304c731SJamie Gritton 		/* Clear allow bits in all children. */
16920304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
16930304c731SJamie Gritton 			tpr->pr_allow &= ~tallow;
16940304c731SJamie Gritton 	}
16950304c731SJamie Gritton 	pr->pr_allow = (pr->pr_allow & ~ch_allow) | pr_allow;
1696b38ff370SJamie Gritton 	/*
1697b38ff370SJamie Gritton 	 * Persistent prisons get an extra reference, and prisons losing their
1698b38ff370SJamie Gritton 	 * persist flag lose that reference.  Only do this for existing prisons
1699b38ff370SJamie Gritton 	 * for now, so new ones will remain unseen until after the module
1700b38ff370SJamie Gritton 	 * handlers have completed.
1701b38ff370SJamie Gritton 	 */
1702cc5fd8c7SJamie Gritton 	born = pr->pr_uref == 0;
1703b38ff370SJamie Gritton 	if (!created && (ch_flags & PR_PERSIST & (pr_flags ^ pr->pr_flags))) {
1704b38ff370SJamie Gritton 		if (pr_flags & PR_PERSIST) {
1705b38ff370SJamie Gritton 			pr->pr_ref++;
1706b38ff370SJamie Gritton 			pr->pr_uref++;
1707b38ff370SJamie Gritton 		} else {
1708b38ff370SJamie Gritton 			pr->pr_ref--;
1709b38ff370SJamie Gritton 			pr->pr_uref--;
1710b38ff370SJamie Gritton 		}
1711b38ff370SJamie Gritton 	}
1712b38ff370SJamie Gritton 	pr->pr_flags = (pr->pr_flags & ~ch_flags) | pr_flags;
1713b38ff370SJamie Gritton 	mtx_unlock(&pr->pr_mtx);
1714b38ff370SJamie Gritton 
1715a7ad07bfSEdward Tomasz Napierala #ifdef RACCT
17164b5c9cf6SEdward Tomasz Napierala 	if (racct_enable && created)
1717a7ad07bfSEdward Tomasz Napierala 		prison_racct_attach(pr);
1718a7ad07bfSEdward Tomasz Napierala #endif
1719a7ad07bfSEdward Tomasz Napierala 
17200304c731SJamie Gritton 	/* Locks may have prevented a complete restriction of child IP
17210304c731SJamie Gritton 	 * addresses.  If so, allocate some more memory and try again.
17220304c731SJamie Gritton 	 */
17230304c731SJamie Gritton #ifdef INET
17240304c731SJamie Gritton 	while (redo_ip4) {
17250304c731SJamie Gritton 		ip4s = pr->pr_ip4s;
17260304c731SJamie Gritton 		ip4 = malloc(ip4s * sizeof(*ip4), M_PRISON, M_WAITOK);
17270304c731SJamie Gritton 		mtx_lock(&pr->pr_mtx);
17280304c731SJamie Gritton 		redo_ip4 = 0;
17290304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1730bdfc8cc4SJamie Gritton #ifdef VIMAGE
1731bdfc8cc4SJamie Gritton 			if (tpr->pr_flags & PR_VNET) {
1732bdfc8cc4SJamie Gritton 				descend = 0;
1733bdfc8cc4SJamie Gritton 				continue;
1734bdfc8cc4SJamie Gritton 			}
1735bdfc8cc4SJamie Gritton #endif
17360304c731SJamie Gritton 			if (prison_restrict_ip4(tpr, ip4)) {
17370304c731SJamie Gritton 				if (ip4 != NULL)
17380304c731SJamie Gritton 					ip4 = NULL;
17390304c731SJamie Gritton 				else
17400304c731SJamie Gritton 					redo_ip4 = 1;
17410304c731SJamie Gritton 			}
17420304c731SJamie Gritton 		}
17430304c731SJamie Gritton 		mtx_unlock(&pr->pr_mtx);
17440304c731SJamie Gritton 	}
17450304c731SJamie Gritton #endif
17460304c731SJamie Gritton #ifdef INET6
17470304c731SJamie Gritton 	while (redo_ip6) {
17480304c731SJamie Gritton 		ip6s = pr->pr_ip6s;
17490304c731SJamie Gritton 		ip6 = malloc(ip6s * sizeof(*ip6), M_PRISON, M_WAITOK);
17500304c731SJamie Gritton 		mtx_lock(&pr->pr_mtx);
17510304c731SJamie Gritton 		redo_ip6 = 0;
17520304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1753bdfc8cc4SJamie Gritton #ifdef VIMAGE
1754bdfc8cc4SJamie Gritton 			if (tpr->pr_flags & PR_VNET) {
1755bdfc8cc4SJamie Gritton 				descend = 0;
1756bdfc8cc4SJamie Gritton 				continue;
1757bdfc8cc4SJamie Gritton 			}
1758bdfc8cc4SJamie Gritton #endif
17590304c731SJamie Gritton 			if (prison_restrict_ip6(tpr, ip6)) {
17600304c731SJamie Gritton 				if (ip6 != NULL)
17610304c731SJamie Gritton 					ip6 = NULL;
17620304c731SJamie Gritton 				else
17630304c731SJamie Gritton 					redo_ip6 = 1;
17640304c731SJamie Gritton 			}
17650304c731SJamie Gritton 		}
17660304c731SJamie Gritton 		mtx_unlock(&pr->pr_mtx);
17670304c731SJamie Gritton 	}
17680304c731SJamie Gritton #endif
17690304c731SJamie Gritton 
1770b38ff370SJamie Gritton 	/* Let the modules do their work. */
1771b38ff370SJamie Gritton 	sx_downgrade(&allprison_lock);
1772cc5fd8c7SJamie Gritton 	if (born) {
1773b38ff370SJamie Gritton 		error = osd_jail_call(pr, PR_METHOD_CREATE, opts);
1774b38ff370SJamie Gritton 		if (error) {
1775cc5fd8c7SJamie Gritton 			(void)osd_jail_call(pr, PR_METHOD_REMOVE, NULL);
1776cc5fd8c7SJamie Gritton 			prison_deref(pr, created
1777cc5fd8c7SJamie Gritton 			    ? PD_LIST_SLOCKED
1778cc5fd8c7SJamie Gritton 			    : PD_DEREF | PD_LIST_SLOCKED);
1779b38ff370SJamie Gritton 			goto done_errmsg;
1780b38ff370SJamie Gritton 		}
1781b38ff370SJamie Gritton 	}
1782b38ff370SJamie Gritton 	error = osd_jail_call(pr, PR_METHOD_SET, opts);
1783b38ff370SJamie Gritton 	if (error) {
1784cc5fd8c7SJamie Gritton 		if (born)
1785cc5fd8c7SJamie Gritton 			(void)osd_jail_call(pr, PR_METHOD_REMOVE, NULL);
1786b38ff370SJamie Gritton 		prison_deref(pr, created
1787b38ff370SJamie Gritton 		    ? PD_LIST_SLOCKED
1788b38ff370SJamie Gritton 		    : PD_DEREF | PD_LIST_SLOCKED);
1789b38ff370SJamie Gritton 		goto done_errmsg;
1790b38ff370SJamie Gritton 	}
1791b38ff370SJamie Gritton 
1792b38ff370SJamie Gritton 	/* Attach this process to the prison if requested. */
1793b38ff370SJamie Gritton 	if (flags & JAIL_ATTACH) {
1794b38ff370SJamie Gritton 		mtx_lock(&pr->pr_mtx);
1795b38ff370SJamie Gritton 		error = do_jail_attach(td, pr);
1796b38ff370SJamie Gritton 		if (error) {
1797b38ff370SJamie Gritton 			vfs_opterror(opts, "attach failed");
1798b38ff370SJamie Gritton 			if (!created)
1799b38ff370SJamie Gritton 				prison_deref(pr, PD_DEREF);
1800b38ff370SJamie Gritton 			goto done_errmsg;
1801b38ff370SJamie Gritton 		}
1802b38ff370SJamie Gritton 	}
1803b38ff370SJamie Gritton 
18041fb24974SEdward Tomasz Napierala #ifdef RACCT
18054b5c9cf6SEdward Tomasz Napierala 	if (racct_enable && !created) {
1806f514b97bSEdward Tomasz Napierala 		if (!(flags & JAIL_ATTACH))
18071fb24974SEdward Tomasz Napierala 			sx_sunlock(&allprison_lock);
18081fb24974SEdward Tomasz Napierala 		prison_racct_modify(pr);
1809f514b97bSEdward Tomasz Napierala 		if (!(flags & JAIL_ATTACH))
18101fb24974SEdward Tomasz Napierala 			sx_slock(&allprison_lock);
18111fb24974SEdward Tomasz Napierala 	}
18121fb24974SEdward Tomasz Napierala #endif
18131fb24974SEdward Tomasz Napierala 
18141fb24974SEdward Tomasz Napierala 	td->td_retval[0] = pr->pr_id;
18151fb24974SEdward Tomasz Napierala 
1816b38ff370SJamie Gritton 	/*
1817b38ff370SJamie Gritton 	 * Now that it is all there, drop the temporary reference from existing
1818b38ff370SJamie Gritton 	 * prisons.  Or add a reference to newly created persistent prisons
1819b38ff370SJamie Gritton 	 * (which was not done earlier so that the prison would not be publicly
1820b38ff370SJamie Gritton 	 * visible).
1821b38ff370SJamie Gritton 	 */
1822b38ff370SJamie Gritton 	if (!created) {
1823b38ff370SJamie Gritton 		prison_deref(pr, (flags & JAIL_ATTACH)
1824b38ff370SJamie Gritton 		    ? PD_DEREF
1825b38ff370SJamie Gritton 		    : PD_DEREF | PD_LIST_SLOCKED);
1826b38ff370SJamie Gritton 	} else {
1827b38ff370SJamie Gritton 		if (pr_flags & PR_PERSIST) {
1828b38ff370SJamie Gritton 			mtx_lock(&pr->pr_mtx);
1829b38ff370SJamie Gritton 			pr->pr_ref++;
1830b38ff370SJamie Gritton 			pr->pr_uref++;
1831b38ff370SJamie Gritton 			mtx_unlock(&pr->pr_mtx);
1832b38ff370SJamie Gritton 		}
1833b38ff370SJamie Gritton 		if (!(flags & JAIL_ATTACH))
1834b38ff370SJamie Gritton 			sx_sunlock(&allprison_lock);
1835b38ff370SJamie Gritton 	}
1836c34bbd2aSEdward Tomasz Napierala 
1837cc5fd8c7SJamie Gritton 	goto done_free;
1838b38ff370SJamie Gritton 
18390304c731SJamie Gritton  done_deref_locked:
18400304c731SJamie Gritton 	prison_deref(pr, created
18410304c731SJamie Gritton 	    ? PD_LOCKED | PD_LIST_XLOCKED
18420304c731SJamie Gritton 	    : PD_DEREF | PD_LOCKED | PD_LIST_XLOCKED);
18430304c731SJamie Gritton 	goto done_releroot;
1844b38ff370SJamie Gritton  done_unlock_list:
1845b38ff370SJamie Gritton 	sx_xunlock(&allprison_lock);
1846b38ff370SJamie Gritton  done_releroot:
18475050aa86SKonstantin Belousov 	if (root != NULL)
1848b38ff370SJamie Gritton 		vrele(root);
1849b38ff370SJamie Gritton  done_errmsg:
1850b38ff370SJamie Gritton 	if (error) {
1851176ff3a0SJamie Gritton 		if (vfs_getopt(opts, "errmsg", (void **)&errmsg,
1852176ff3a0SJamie Gritton 		    &errmsg_len) == 0 && errmsg_len > 0) {
1853b38ff370SJamie Gritton 			errmsg_pos = 2 * vfs_getopt_pos(opts, "errmsg") + 1;
1854b38ff370SJamie Gritton 			if (optuio->uio_segflg == UIO_SYSSPACE)
1855b38ff370SJamie Gritton 				bcopy(errmsg,
1856b38ff370SJamie Gritton 				    optuio->uio_iov[errmsg_pos].iov_base,
1857b38ff370SJamie Gritton 				    errmsg_len);
1858b38ff370SJamie Gritton 			else
1859b38ff370SJamie Gritton 				copyout(errmsg,
1860b38ff370SJamie Gritton 				    optuio->uio_iov[errmsg_pos].iov_base,
1861b38ff370SJamie Gritton 				    errmsg_len);
1862b38ff370SJamie Gritton 		}
1863b38ff370SJamie Gritton 	}
1864b38ff370SJamie Gritton  done_free:
1865b38ff370SJamie Gritton #ifdef INET
1866b38ff370SJamie Gritton 	free(ip4, M_PRISON);
1867b38ff370SJamie Gritton #endif
1868b38ff370SJamie Gritton #ifdef INET6
1869b38ff370SJamie Gritton 	free(ip6, M_PRISON);
1870b38ff370SJamie Gritton #endif
18716dfe0a3dSMartin Matuska 	if (g_path != NULL)
18726dfe0a3dSMartin Matuska 		free(g_path, M_TEMP);
1873b38ff370SJamie Gritton 	vfs_freeopts(opts);
1874b38ff370SJamie Gritton 	return (error);
1875b38ff370SJamie Gritton }
1876b38ff370SJamie Gritton 
1877b38ff370SJamie Gritton /*
1878b38ff370SJamie Gritton  * struct jail_get_args {
1879b38ff370SJamie Gritton  *	struct iovec *iovp;
1880b38ff370SJamie Gritton  *	unsigned int iovcnt;
1881b38ff370SJamie Gritton  *	int flags;
1882b38ff370SJamie Gritton  * };
1883b38ff370SJamie Gritton  */
1884b38ff370SJamie Gritton int
18858451d0ddSKip Macy sys_jail_get(struct thread *td, struct jail_get_args *uap)
1886b38ff370SJamie Gritton {
1887b38ff370SJamie Gritton 	struct uio *auio;
1888b38ff370SJamie Gritton 	int error;
1889b38ff370SJamie Gritton 
1890b38ff370SJamie Gritton 	/* Check that we have an even number of iovecs. */
1891b38ff370SJamie Gritton 	if (uap->iovcnt & 1)
1892b38ff370SJamie Gritton 		return (EINVAL);
1893b38ff370SJamie Gritton 
1894b38ff370SJamie Gritton 	error = copyinuio(uap->iovp, uap->iovcnt, &auio);
1895b38ff370SJamie Gritton 	if (error)
1896b38ff370SJamie Gritton 		return (error);
1897b38ff370SJamie Gritton 	error = kern_jail_get(td, auio, uap->flags);
1898b38ff370SJamie Gritton 	if (error == 0)
1899b38ff370SJamie Gritton 		error = copyout(auio->uio_iov, uap->iovp,
1900b38ff370SJamie Gritton 		    uap->iovcnt * sizeof (struct iovec));
1901b38ff370SJamie Gritton 	free(auio, M_IOV);
1902b38ff370SJamie Gritton 	return (error);
1903b38ff370SJamie Gritton }
1904b38ff370SJamie Gritton 
1905b38ff370SJamie Gritton int
1906b38ff370SJamie Gritton kern_jail_get(struct thread *td, struct uio *optuio, int flags)
1907b38ff370SJamie Gritton {
1908672756aaSJamie Gritton 	struct bool_flags *bf;
1909672756aaSJamie Gritton 	struct jailsys_flags *jsf;
19100304c731SJamie Gritton 	struct prison *pr, *mypr;
1911b38ff370SJamie Gritton 	struct vfsopt *opt;
1912b38ff370SJamie Gritton 	struct vfsoptlist *opts;
1913b38ff370SJamie Gritton 	char *errmsg, *name;
1914672756aaSJamie Gritton 	int error, errmsg_len, errmsg_pos, i, jid, len, locked, pos;
1915672756aaSJamie Gritton 	unsigned f;
1916b38ff370SJamie Gritton 
1917b38ff370SJamie Gritton 	if (flags & ~JAIL_GET_MASK)
1918b38ff370SJamie Gritton 		return (EINVAL);
1919b38ff370SJamie Gritton 
1920b38ff370SJamie Gritton 	/* Get the parameter list. */
1921b38ff370SJamie Gritton 	error = vfs_buildopts(optuio, &opts);
1922b38ff370SJamie Gritton 	if (error)
1923b38ff370SJamie Gritton 		return (error);
1924b38ff370SJamie Gritton 	errmsg_pos = vfs_getopt_pos(opts, "errmsg");
19250304c731SJamie Gritton 	mypr = td->td_ucred->cr_prison;
19261e2a13e6SJamie Gritton 
1927b38ff370SJamie Gritton 	/*
1928b38ff370SJamie Gritton 	 * Find the prison specified by one of: lastjid, jid, name.
1929b38ff370SJamie Gritton 	 */
1930b38ff370SJamie Gritton 	sx_slock(&allprison_lock);
1931b38ff370SJamie Gritton 	error = vfs_copyopt(opts, "lastjid", &jid, sizeof(jid));
1932b38ff370SJamie Gritton 	if (error == 0) {
1933b38ff370SJamie Gritton 		TAILQ_FOREACH(pr, &allprison, pr_list) {
19340304c731SJamie Gritton 			if (pr->pr_id > jid && prison_ischild(mypr, pr)) {
1935b38ff370SJamie Gritton 				mtx_lock(&pr->pr_mtx);
1936b38ff370SJamie Gritton 				if (pr->pr_ref > 0 &&
1937b38ff370SJamie Gritton 				    (pr->pr_uref > 0 || (flags & JAIL_DYING)))
1938b38ff370SJamie Gritton 					break;
1939b38ff370SJamie Gritton 				mtx_unlock(&pr->pr_mtx);
1940b38ff370SJamie Gritton 			}
1941b38ff370SJamie Gritton 		}
1942b38ff370SJamie Gritton 		if (pr != NULL)
1943b38ff370SJamie Gritton 			goto found_prison;
1944b38ff370SJamie Gritton 		error = ENOENT;
1945b38ff370SJamie Gritton 		vfs_opterror(opts, "no jail after %d", jid);
1946b38ff370SJamie Gritton 		goto done_unlock_list;
1947b38ff370SJamie Gritton 	} else if (error != ENOENT)
1948b38ff370SJamie Gritton 		goto done_unlock_list;
1949b38ff370SJamie Gritton 
1950b38ff370SJamie Gritton 	error = vfs_copyopt(opts, "jid", &jid, sizeof(jid));
1951b38ff370SJamie Gritton 	if (error == 0) {
1952b38ff370SJamie Gritton 		if (jid != 0) {
19530304c731SJamie Gritton 			pr = prison_find_child(mypr, jid);
1954b38ff370SJamie Gritton 			if (pr != NULL) {
1955b38ff370SJamie Gritton 				if (pr->pr_uref == 0 && !(flags & JAIL_DYING)) {
1956b38ff370SJamie Gritton 					mtx_unlock(&pr->pr_mtx);
1957b38ff370SJamie Gritton 					error = ENOENT;
1958b38ff370SJamie Gritton 					vfs_opterror(opts, "jail %d is dying",
1959b38ff370SJamie Gritton 					    jid);
1960b38ff370SJamie Gritton 					goto done_unlock_list;
1961b38ff370SJamie Gritton 				}
1962b38ff370SJamie Gritton 				goto found_prison;
1963b38ff370SJamie Gritton 			}
1964b38ff370SJamie Gritton 			error = ENOENT;
1965b38ff370SJamie Gritton 			vfs_opterror(opts, "jail %d not found", jid);
1966b38ff370SJamie Gritton 			goto done_unlock_list;
1967b38ff370SJamie Gritton 		}
1968b38ff370SJamie Gritton 	} else if (error != ENOENT)
1969b38ff370SJamie Gritton 		goto done_unlock_list;
1970b38ff370SJamie Gritton 
1971b38ff370SJamie Gritton 	error = vfs_getopt(opts, "name", (void **)&name, &len);
1972b38ff370SJamie Gritton 	if (error == 0) {
1973b38ff370SJamie Gritton 		if (len == 0 || name[len - 1] != '\0') {
1974b38ff370SJamie Gritton 			error = EINVAL;
1975b38ff370SJamie Gritton 			goto done_unlock_list;
1976b38ff370SJamie Gritton 		}
19770304c731SJamie Gritton 		pr = prison_find_name(mypr, name);
1978b38ff370SJamie Gritton 		if (pr != NULL) {
1979b38ff370SJamie Gritton 			if (pr->pr_uref == 0 && !(flags & JAIL_DYING)) {
1980b38ff370SJamie Gritton 				mtx_unlock(&pr->pr_mtx);
1981b38ff370SJamie Gritton 				error = ENOENT;
1982b38ff370SJamie Gritton 				vfs_opterror(opts, "jail \"%s\" is dying",
1983b38ff370SJamie Gritton 				    name);
1984b38ff370SJamie Gritton 				goto done_unlock_list;
1985b38ff370SJamie Gritton 			}
1986b38ff370SJamie Gritton 			goto found_prison;
1987b38ff370SJamie Gritton 		}
1988b38ff370SJamie Gritton 		error = ENOENT;
1989b38ff370SJamie Gritton 		vfs_opterror(opts, "jail \"%s\" not found", name);
1990b38ff370SJamie Gritton 		goto done_unlock_list;
1991b38ff370SJamie Gritton 	} else if (error != ENOENT)
1992b38ff370SJamie Gritton 		goto done_unlock_list;
1993b38ff370SJamie Gritton 
1994b38ff370SJamie Gritton 	vfs_opterror(opts, "no jail specified");
1995b38ff370SJamie Gritton 	error = ENOENT;
1996b38ff370SJamie Gritton 	goto done_unlock_list;
1997b38ff370SJamie Gritton 
1998b38ff370SJamie Gritton  found_prison:
1999b38ff370SJamie Gritton 	/* Get the parameters of the prison. */
2000b38ff370SJamie Gritton 	pr->pr_ref++;
2001b38ff370SJamie Gritton 	locked = PD_LOCKED;
2002b38ff370SJamie Gritton 	td->td_retval[0] = pr->pr_id;
2003b38ff370SJamie Gritton 	error = vfs_setopt(opts, "jid", &pr->pr_id, sizeof(pr->pr_id));
2004b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
2005b38ff370SJamie Gritton 		goto done_deref;
20060304c731SJamie Gritton 	i = (pr->pr_parent == mypr) ? 0 : pr->pr_parent->pr_id;
20070304c731SJamie Gritton 	error = vfs_setopt(opts, "parent", &i, sizeof(i));
2008b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
2009b38ff370SJamie Gritton 		goto done_deref;
20100304c731SJamie Gritton 	error = vfs_setopts(opts, "name", prison_name(mypr, pr));
20110304c731SJamie Gritton 	if (error != 0 && error != ENOENT)
20120304c731SJamie Gritton 		goto done_deref;
20130304c731SJamie Gritton 	error = vfs_setopt(opts, "cpuset.id", &pr->pr_cpuset->cs_id,
2014b38ff370SJamie Gritton 	    sizeof(pr->pr_cpuset->cs_id));
2015b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
2016b38ff370SJamie Gritton 		goto done_deref;
20170304c731SJamie Gritton 	error = vfs_setopts(opts, "path", prison_path(mypr, pr));
2018b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
2019b38ff370SJamie Gritton 		goto done_deref;
2020b38ff370SJamie Gritton #ifdef INET
2021b38ff370SJamie Gritton 	error = vfs_setopt_part(opts, "ip4.addr", pr->pr_ip4,
2022b38ff370SJamie Gritton 	    pr->pr_ip4s * sizeof(*pr->pr_ip4));
2023b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
2024b38ff370SJamie Gritton 		goto done_deref;
2025b38ff370SJamie Gritton #endif
2026b38ff370SJamie Gritton #ifdef INET6
2027b38ff370SJamie Gritton 	error = vfs_setopt_part(opts, "ip6.addr", pr->pr_ip6,
2028b38ff370SJamie Gritton 	    pr->pr_ip6s * sizeof(*pr->pr_ip6));
2029b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
2030b38ff370SJamie Gritton 		goto done_deref;
2031b38ff370SJamie Gritton #endif
2032b38ff370SJamie Gritton 	error = vfs_setopt(opts, "securelevel", &pr->pr_securelevel,
2033b38ff370SJamie Gritton 	    sizeof(pr->pr_securelevel));
2034b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
2035b38ff370SJamie Gritton 		goto done_deref;
2036b97457e2SJamie Gritton 	error = vfs_setopt(opts, "children.cur", &pr->pr_childcount,
2037b97457e2SJamie Gritton 	    sizeof(pr->pr_childcount));
2038b97457e2SJamie Gritton 	if (error != 0 && error != ENOENT)
2039b97457e2SJamie Gritton 		goto done_deref;
2040b97457e2SJamie Gritton 	error = vfs_setopt(opts, "children.max", &pr->pr_childmax,
2041b97457e2SJamie Gritton 	    sizeof(pr->pr_childmax));
2042b97457e2SJamie Gritton 	if (error != 0 && error != ENOENT)
2043b97457e2SJamie Gritton 		goto done_deref;
2044c1f19219SJamie Gritton 	error = vfs_setopts(opts, "host.hostname", pr->pr_hostname);
2045b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
2046b38ff370SJamie Gritton 		goto done_deref;
2047c1f19219SJamie Gritton 	error = vfs_setopts(opts, "host.domainname", pr->pr_domainname);
204876ca6f88SJamie Gritton 	if (error != 0 && error != ENOENT)
204976ca6f88SJamie Gritton 		goto done_deref;
2050c1f19219SJamie Gritton 	error = vfs_setopts(opts, "host.hostuuid", pr->pr_hostuuid);
205176ca6f88SJamie Gritton 	if (error != 0 && error != ENOENT)
205276ca6f88SJamie Gritton 		goto done_deref;
2053841c0c7eSNathan Whitehorn #ifdef COMPAT_FREEBSD32
2054a5c1afadSDmitry Chagin 	if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) {
205576ca6f88SJamie Gritton 		uint32_t hid32 = pr->pr_hostid;
205676ca6f88SJamie Gritton 
205776ca6f88SJamie Gritton 		error = vfs_setopt(opts, "host.hostid", &hid32, sizeof(hid32));
205876ca6f88SJamie Gritton 	} else
205976ca6f88SJamie Gritton #endif
206076ca6f88SJamie Gritton 	error = vfs_setopt(opts, "host.hostid", &pr->pr_hostid,
206176ca6f88SJamie Gritton 	    sizeof(pr->pr_hostid));
206276ca6f88SJamie Gritton 	if (error != 0 && error != ENOENT)
206376ca6f88SJamie Gritton 		goto done_deref;
20640304c731SJamie Gritton 	error = vfs_setopt(opts, "enforce_statfs", &pr->pr_enforce_statfs,
20650304c731SJamie Gritton 	    sizeof(pr->pr_enforce_statfs));
20660304c731SJamie Gritton 	if (error != 0 && error != ENOENT)
20670304c731SJamie Gritton 		goto done_deref;
20680cc207a6SMartin Matuska 	error = vfs_setopt(opts, "devfs_ruleset", &pr->pr_devfs_rsnum,
20690cc207a6SMartin Matuska 	    sizeof(pr->pr_devfs_rsnum));
20700cc207a6SMartin Matuska 	if (error != 0 && error != ENOENT)
20710cc207a6SMartin Matuska 		goto done_deref;
2072672756aaSJamie Gritton 	for (bf = pr_flag_bool;
2073672756aaSJamie Gritton 	     bf < pr_flag_bool + nitems(pr_flag_bool);
2074672756aaSJamie Gritton 	     bf++) {
2075672756aaSJamie Gritton 		i = (pr->pr_flags & bf->flag) ? 1 : 0;
2076672756aaSJamie Gritton 		error = vfs_setopt(opts, bf->name, &i, sizeof(i));
2077b38ff370SJamie Gritton 		if (error != 0 && error != ENOENT)
2078b38ff370SJamie Gritton 			goto done_deref;
2079b38ff370SJamie Gritton 		i = !i;
2080672756aaSJamie Gritton 		error = vfs_setopt(opts, bf->noname, &i, sizeof(i));
2081b38ff370SJamie Gritton 		if (error != 0 && error != ENOENT)
2082b38ff370SJamie Gritton 			goto done_deref;
20830304c731SJamie Gritton 	}
2084672756aaSJamie Gritton 	for (jsf = pr_flag_jailsys;
2085672756aaSJamie Gritton 	     jsf < pr_flag_jailsys + nitems(pr_flag_jailsys);
2086672756aaSJamie Gritton 	     jsf++) {
2087672756aaSJamie Gritton 		f = pr->pr_flags & (jsf->disable | jsf->new);
2088672756aaSJamie Gritton 		i = (f != 0 && f == jsf->disable) ? JAIL_SYS_DISABLE
2089672756aaSJamie Gritton 		    : (f == jsf->new) ? JAIL_SYS_NEW
20907cbf7213SJamie Gritton 		    : JAIL_SYS_INHERIT;
2091672756aaSJamie Gritton 		error = vfs_setopt(opts, jsf->name, &i, sizeof(i));
20927cbf7213SJamie Gritton 		if (error != 0 && error != ENOENT)
20937cbf7213SJamie Gritton 			goto done_deref;
20947cbf7213SJamie Gritton 	}
2095672756aaSJamie Gritton 	for (bf = pr_flag_allow;
20960e5c6bd4SJamie Gritton 	     bf < pr_flag_allow + nitems(pr_flag_allow) && bf->flag != 0;
2097672756aaSJamie Gritton 	     bf++) {
2098672756aaSJamie Gritton 		i = (pr->pr_allow & bf->flag) ? 1 : 0;
2099672756aaSJamie Gritton 		error = vfs_setopt(opts, bf->name, &i, sizeof(i));
21000304c731SJamie Gritton 		if (error != 0 && error != ENOENT)
21010304c731SJamie Gritton 			goto done_deref;
21020304c731SJamie Gritton 		i = !i;
2103672756aaSJamie Gritton 		error = vfs_setopt(opts, bf->noname, &i, sizeof(i));
21040304c731SJamie Gritton 		if (error != 0 && error != ENOENT)
21050304c731SJamie Gritton 			goto done_deref;
21060304c731SJamie Gritton 	}
2107b38ff370SJamie Gritton 	i = (pr->pr_uref == 0);
2108b38ff370SJamie Gritton 	error = vfs_setopt(opts, "dying", &i, sizeof(i));
2109b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
2110b38ff370SJamie Gritton 		goto done_deref;
2111b38ff370SJamie Gritton 	i = !i;
2112b38ff370SJamie Gritton 	error = vfs_setopt(opts, "nodying", &i, sizeof(i));
2113b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
2114b38ff370SJamie Gritton 		goto done_deref;
2115bd96bd15SIan Lepore 	error = vfs_setopt(opts, "osreldate", &pr->pr_osreldate,
2116bd96bd15SIan Lepore 	    sizeof(pr->pr_osreldate));
2117a1a4c1b0SIan Lepore 	if (error != 0 && error != ENOENT)
2118a1a4c1b0SIan Lepore 		goto done_deref;
2119a1a4c1b0SIan Lepore 	error = vfs_setopts(opts, "osrelease", pr->pr_osrelease);
2120a1a4c1b0SIan Lepore 	if (error != 0 && error != ENOENT)
2121a1a4c1b0SIan Lepore 		goto done_deref;
2122b38ff370SJamie Gritton 
2123b38ff370SJamie Gritton 	/* Get the module parameters. */
2124b38ff370SJamie Gritton 	mtx_unlock(&pr->pr_mtx);
2125b38ff370SJamie Gritton 	locked = 0;
2126b38ff370SJamie Gritton 	error = osd_jail_call(pr, PR_METHOD_GET, opts);
2127b38ff370SJamie Gritton 	if (error)
2128b38ff370SJamie Gritton 		goto done_deref;
2129b38ff370SJamie Gritton 	prison_deref(pr, PD_DEREF | PD_LIST_SLOCKED);
2130b38ff370SJamie Gritton 
2131b38ff370SJamie Gritton 	/* By now, all parameters should have been noted. */
2132b38ff370SJamie Gritton 	TAILQ_FOREACH(opt, opts, link) {
2133b38ff370SJamie Gritton 		if (!opt->seen && strcmp(opt->name, "errmsg")) {
2134b38ff370SJamie Gritton 			error = EINVAL;
2135b38ff370SJamie Gritton 			vfs_opterror(opts, "unknown parameter: %s", opt->name);
2136b38ff370SJamie Gritton 			goto done_errmsg;
2137b38ff370SJamie Gritton 		}
2138b38ff370SJamie Gritton 	}
2139b38ff370SJamie Gritton 
2140b38ff370SJamie Gritton 	/* Write the fetched parameters back to userspace. */
2141b38ff370SJamie Gritton 	error = 0;
2142b38ff370SJamie Gritton 	TAILQ_FOREACH(opt, opts, link) {
2143b38ff370SJamie Gritton 		if (opt->pos >= 0 && opt->pos != errmsg_pos) {
2144b38ff370SJamie Gritton 			pos = 2 * opt->pos + 1;
2145b38ff370SJamie Gritton 			optuio->uio_iov[pos].iov_len = opt->len;
2146b38ff370SJamie Gritton 			if (opt->value != NULL) {
2147b38ff370SJamie Gritton 				if (optuio->uio_segflg == UIO_SYSSPACE) {
2148b38ff370SJamie Gritton 					bcopy(opt->value,
2149b38ff370SJamie Gritton 					    optuio->uio_iov[pos].iov_base,
2150b38ff370SJamie Gritton 					    opt->len);
2151b38ff370SJamie Gritton 				} else {
2152b38ff370SJamie Gritton 					error = copyout(opt->value,
2153b38ff370SJamie Gritton 					    optuio->uio_iov[pos].iov_base,
2154b38ff370SJamie Gritton 					    opt->len);
2155b38ff370SJamie Gritton 					if (error)
2156b38ff370SJamie Gritton 						break;
2157b38ff370SJamie Gritton 				}
2158b38ff370SJamie Gritton 			}
2159b38ff370SJamie Gritton 		}
2160b38ff370SJamie Gritton 	}
2161b38ff370SJamie Gritton 	goto done_errmsg;
2162b38ff370SJamie Gritton 
2163b38ff370SJamie Gritton  done_deref:
2164b38ff370SJamie Gritton 	prison_deref(pr, locked | PD_DEREF | PD_LIST_SLOCKED);
2165b38ff370SJamie Gritton 	goto done_errmsg;
2166b38ff370SJamie Gritton 
2167b38ff370SJamie Gritton  done_unlock_list:
2168b38ff370SJamie Gritton 	sx_sunlock(&allprison_lock);
2169b38ff370SJamie Gritton  done_errmsg:
2170b38ff370SJamie Gritton 	if (error && errmsg_pos >= 0) {
2171b38ff370SJamie Gritton 		vfs_getopt(opts, "errmsg", (void **)&errmsg, &errmsg_len);
2172b38ff370SJamie Gritton 		errmsg_pos = 2 * errmsg_pos + 1;
2173b38ff370SJamie Gritton 		if (errmsg_len > 0) {
2174b38ff370SJamie Gritton 			if (optuio->uio_segflg == UIO_SYSSPACE)
2175b38ff370SJamie Gritton 				bcopy(errmsg,
2176b38ff370SJamie Gritton 				    optuio->uio_iov[errmsg_pos].iov_base,
2177b38ff370SJamie Gritton 				    errmsg_len);
2178b38ff370SJamie Gritton 			else
2179b38ff370SJamie Gritton 				copyout(errmsg,
2180b38ff370SJamie Gritton 				    optuio->uio_iov[errmsg_pos].iov_base,
2181b38ff370SJamie Gritton 				    errmsg_len);
2182b38ff370SJamie Gritton 		}
2183b38ff370SJamie Gritton 	}
2184b38ff370SJamie Gritton 	vfs_freeopts(opts);
2185b38ff370SJamie Gritton 	return (error);
2186b38ff370SJamie Gritton }
2187b38ff370SJamie Gritton 
2188b38ff370SJamie Gritton /*
2189b38ff370SJamie Gritton  * struct jail_remove_args {
2190b38ff370SJamie Gritton  *	int jid;
2191b38ff370SJamie Gritton  * };
2192b38ff370SJamie Gritton  */
2193b38ff370SJamie Gritton int
21948451d0ddSKip Macy sys_jail_remove(struct thread *td, struct jail_remove_args *uap)
2195b38ff370SJamie Gritton {
21960304c731SJamie Gritton 	struct prison *pr, *cpr, *lpr, *tpr;
21970304c731SJamie Gritton 	int descend, error;
2198b38ff370SJamie Gritton 
2199b38ff370SJamie Gritton 	error = priv_check(td, PRIV_JAIL_REMOVE);
2200b38ff370SJamie Gritton 	if (error)
2201b38ff370SJamie Gritton 		return (error);
2202b38ff370SJamie Gritton 
2203b38ff370SJamie Gritton 	sx_xlock(&allprison_lock);
22040304c731SJamie Gritton 	pr = prison_find_child(td->td_ucred->cr_prison, uap->jid);
2205b38ff370SJamie Gritton 	if (pr == NULL) {
2206b38ff370SJamie Gritton 		sx_xunlock(&allprison_lock);
2207b38ff370SJamie Gritton 		return (EINVAL);
2208b38ff370SJamie Gritton 	}
2209b38ff370SJamie Gritton 
22100304c731SJamie Gritton 	/* Remove all descendants of this prison, then remove this prison. */
22110304c731SJamie Gritton 	pr->pr_ref++;
22120304c731SJamie Gritton 	if (!LIST_EMPTY(&pr->pr_children)) {
22130304c731SJamie Gritton 		mtx_unlock(&pr->pr_mtx);
22140304c731SJamie Gritton 		lpr = NULL;
22150304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT(pr, cpr, descend) {
22160304c731SJamie Gritton 			mtx_lock(&cpr->pr_mtx);
22170304c731SJamie Gritton 			if (cpr->pr_ref > 0) {
22180304c731SJamie Gritton 				tpr = cpr;
22190304c731SJamie Gritton 				cpr->pr_ref++;
22200304c731SJamie Gritton 			} else {
22210304c731SJamie Gritton 				/* Already removed - do not do it again. */
22220304c731SJamie Gritton 				tpr = NULL;
22230304c731SJamie Gritton 			}
22240304c731SJamie Gritton 			mtx_unlock(&cpr->pr_mtx);
22250304c731SJamie Gritton 			if (lpr != NULL) {
22260304c731SJamie Gritton 				mtx_lock(&lpr->pr_mtx);
22270304c731SJamie Gritton 				prison_remove_one(lpr);
22280304c731SJamie Gritton 				sx_xlock(&allprison_lock);
22290304c731SJamie Gritton 			}
22300304c731SJamie Gritton 			lpr = tpr;
22310304c731SJamie Gritton 		}
22320304c731SJamie Gritton 		if (lpr != NULL) {
22330304c731SJamie Gritton 			mtx_lock(&lpr->pr_mtx);
22340304c731SJamie Gritton 			prison_remove_one(lpr);
22350304c731SJamie Gritton 			sx_xlock(&allprison_lock);
22360304c731SJamie Gritton 		}
22370304c731SJamie Gritton 		mtx_lock(&pr->pr_mtx);
22380304c731SJamie Gritton 	}
22390304c731SJamie Gritton 	prison_remove_one(pr);
22400304c731SJamie Gritton 	return (0);
22410304c731SJamie Gritton }
22420304c731SJamie Gritton 
22430304c731SJamie Gritton static void
22440304c731SJamie Gritton prison_remove_one(struct prison *pr)
22450304c731SJamie Gritton {
22460304c731SJamie Gritton 	struct proc *p;
22470304c731SJamie Gritton 	int deuref;
22480304c731SJamie Gritton 
2249b38ff370SJamie Gritton 	/* If the prison was persistent, it is not anymore. */
2250b38ff370SJamie Gritton 	deuref = 0;
2251b38ff370SJamie Gritton 	if (pr->pr_flags & PR_PERSIST) {
2252b38ff370SJamie Gritton 		pr->pr_ref--;
2253b38ff370SJamie Gritton 		deuref = PD_DEUREF;
2254b38ff370SJamie Gritton 		pr->pr_flags &= ~PR_PERSIST;
2255b38ff370SJamie Gritton 	}
2256b38ff370SJamie Gritton 
22570304c731SJamie Gritton 	/*
22580304c731SJamie Gritton 	 * jail_remove added a reference.  If that's the only one, remove
22590304c731SJamie Gritton 	 * the prison now.
22600304c731SJamie Gritton 	 */
22610304c731SJamie Gritton 	KASSERT(pr->pr_ref > 0,
22620304c731SJamie Gritton 	    ("prison_remove_one removing a dead prison (jid=%d)", pr->pr_id));
22630304c731SJamie Gritton 	if (pr->pr_ref == 1) {
2264b38ff370SJamie Gritton 		prison_deref(pr,
2265b38ff370SJamie Gritton 		    deuref | PD_DEREF | PD_LOCKED | PD_LIST_XLOCKED);
22660304c731SJamie Gritton 		return;
2267b38ff370SJamie Gritton 	}
2268b38ff370SJamie Gritton 
2269b38ff370SJamie Gritton 	mtx_unlock(&pr->pr_mtx);
2270b38ff370SJamie Gritton 	sx_xunlock(&allprison_lock);
2271b38ff370SJamie Gritton 	/*
2272b38ff370SJamie Gritton 	 * Kill all processes unfortunate enough to be attached to this prison.
2273b38ff370SJamie Gritton 	 */
2274b38ff370SJamie Gritton 	sx_slock(&allproc_lock);
22757938a442SBjoern A. Zeeb 	FOREACH_PROC_IN_SYSTEM(p) {
2276b38ff370SJamie Gritton 		PROC_LOCK(p);
2277b38ff370SJamie Gritton 		if (p->p_state != PRS_NEW && p->p_ucred &&
2278b38ff370SJamie Gritton 		    p->p_ucred->cr_prison == pr)
22798451d0ddSKip Macy 			kern_psignal(p, SIGKILL);
2280b38ff370SJamie Gritton 		PROC_UNLOCK(p);
2281b38ff370SJamie Gritton 	}
2282b38ff370SJamie Gritton 	sx_sunlock(&allproc_lock);
22830304c731SJamie Gritton 	/* Remove the temporary reference added by jail_remove. */
2284b38ff370SJamie Gritton 	prison_deref(pr, deuref | PD_DEREF);
228575c13541SPoul-Henning Kamp }
228675c13541SPoul-Henning Kamp 
2287fd7a8150SMike Barcroft /*
22889ddb7954SMike Barcroft  * struct jail_attach_args {
22899ddb7954SMike Barcroft  *	int jid;
22909ddb7954SMike Barcroft  * };
2291fd7a8150SMike Barcroft  */
2292fd7a8150SMike Barcroft int
22938451d0ddSKip Macy sys_jail_attach(struct thread *td, struct jail_attach_args *uap)
2294fd7a8150SMike Barcroft {
2295b38ff370SJamie Gritton 	struct prison *pr;
2296b38ff370SJamie Gritton 	int error;
2297b38ff370SJamie Gritton 
2298b38ff370SJamie Gritton 	error = priv_check(td, PRIV_JAIL_ATTACH);
2299b38ff370SJamie Gritton 	if (error)
2300b38ff370SJamie Gritton 		return (error);
2301b38ff370SJamie Gritton 
2302ef0ddea3SJamie Gritton 	/*
2303ef0ddea3SJamie Gritton 	 * Start with exclusive hold on allprison_lock to ensure that a possible
2304ef0ddea3SJamie Gritton 	 * PR_METHOD_REMOVE call isn't concurrent with jail_set or jail_remove.
2305ef0ddea3SJamie Gritton 	 * But then immediately downgrade it since we don't need to stop
2306ef0ddea3SJamie Gritton 	 * readers.
2307ef0ddea3SJamie Gritton 	 */
2308ef0ddea3SJamie Gritton 	sx_xlock(&allprison_lock);
2309ef0ddea3SJamie Gritton 	sx_downgrade(&allprison_lock);
23100304c731SJamie Gritton 	pr = prison_find_child(td->td_ucred->cr_prison, uap->jid);
2311b38ff370SJamie Gritton 	if (pr == NULL) {
2312b38ff370SJamie Gritton 		sx_sunlock(&allprison_lock);
2313b38ff370SJamie Gritton 		return (EINVAL);
2314b38ff370SJamie Gritton 	}
2315b38ff370SJamie Gritton 
2316b38ff370SJamie Gritton 	/*
2317b38ff370SJamie Gritton 	 * Do not allow a process to attach to a prison that is not
2318b38ff370SJamie Gritton 	 * considered to be "alive".
2319b38ff370SJamie Gritton 	 */
2320b38ff370SJamie Gritton 	if (pr->pr_uref == 0) {
2321b38ff370SJamie Gritton 		mtx_unlock(&pr->pr_mtx);
2322b38ff370SJamie Gritton 		sx_sunlock(&allprison_lock);
2323b38ff370SJamie Gritton 		return (EINVAL);
2324b38ff370SJamie Gritton 	}
2325b38ff370SJamie Gritton 
2326b38ff370SJamie Gritton 	return (do_jail_attach(td, pr));
2327b38ff370SJamie Gritton }
2328b38ff370SJamie Gritton 
2329b38ff370SJamie Gritton static int
2330b38ff370SJamie Gritton do_jail_attach(struct thread *td, struct prison *pr)
2331b38ff370SJamie Gritton {
2332fd7a8150SMike Barcroft 	struct proc *p;
2333fd7a8150SMike Barcroft 	struct ucred *newcred, *oldcred;
23345050aa86SKonstantin Belousov 	int error;
2335fd7a8150SMike Barcroft 
233657f22bd4SJacques Vidrine 	/*
233757f22bd4SJacques Vidrine 	 * XXX: Note that there is a slight race here if two threads
233857f22bd4SJacques Vidrine 	 * in the same privileged process attempt to attach to two
233957f22bd4SJacques Vidrine 	 * different jails at the same time.  It is important for
234057f22bd4SJacques Vidrine 	 * user processes not to do this, or they might end up with
234157f22bd4SJacques Vidrine 	 * a process root from one prison, but attached to the jail
234257f22bd4SJacques Vidrine 	 * of another.
234357f22bd4SJacques Vidrine 	 */
2344fd7a8150SMike Barcroft 	pr->pr_ref++;
2345b38ff370SJamie Gritton 	pr->pr_uref++;
2346fd7a8150SMike Barcroft 	mtx_unlock(&pr->pr_mtx);
2347b38ff370SJamie Gritton 
2348b38ff370SJamie Gritton 	/* Let modules do whatever they need to prepare for attaching. */
2349b38ff370SJamie Gritton 	error = osd_jail_call(pr, PR_METHOD_ATTACH, td);
2350b38ff370SJamie Gritton 	if (error) {
2351b38ff370SJamie Gritton 		prison_deref(pr, PD_DEREF | PD_DEUREF | PD_LIST_SLOCKED);
2352b38ff370SJamie Gritton 		return (error);
2353b38ff370SJamie Gritton 	}
2354dc68a633SPawel Jakub Dawidek 	sx_sunlock(&allprison_lock);
2355fd7a8150SMike Barcroft 
2356413628a7SBjoern A. Zeeb 	/*
2357413628a7SBjoern A. Zeeb 	 * Reparent the newly attached process to this jail.
2358413628a7SBjoern A. Zeeb 	 */
2359b38ff370SJamie Gritton 	p = td->td_proc;
2360413628a7SBjoern A. Zeeb 	error = cpuset_setproc_update_set(p, pr->pr_cpuset);
2361413628a7SBjoern A. Zeeb 	if (error)
2362b38ff370SJamie Gritton 		goto e_revert_osd;
2363413628a7SBjoern A. Zeeb 
2364cb05b60aSAttilio Rao 	vn_lock(pr->pr_root, LK_EXCLUSIVE | LK_RETRY);
2365fd7a8150SMike Barcroft 	if ((error = change_dir(pr->pr_root, td)) != 0)
2366fd7a8150SMike Barcroft 		goto e_unlock;
2367fd7a8150SMike Barcroft #ifdef MAC
236830d239bcSRobert Watson 	if ((error = mac_vnode_check_chroot(td->td_ucred, pr->pr_root)))
2369fd7a8150SMike Barcroft 		goto e_unlock;
2370fd7a8150SMike Barcroft #endif
2371b249ce48SMateusz Guzik 	VOP_UNLOCK(pr->pr_root);
2372f0725a8eSMateusz Guzik 	if ((error = pwd_chroot(td, pr->pr_root)))
23735050aa86SKonstantin Belousov 		goto e_revert_osd;
2374fd7a8150SMike Barcroft 
2375fd7a8150SMike Barcroft 	newcred = crget();
2376fd7a8150SMike Barcroft 	PROC_LOCK(p);
23771fb6767dSJamie Gritton 	oldcred = crcopysafe(p, newcred);
237869c4ee54SJohn Baldwin 	newcred->cr_prison = pr;
2379daf63fd2SMateusz Guzik 	proc_set_cred(p, newcred);
23801fb6767dSJamie Gritton 	setsugid(p);
2381097055e2SEdward Tomasz Napierala #ifdef RACCT
2382097055e2SEdward Tomasz Napierala 	racct_proc_ucred_changed(p, oldcred, newcred);
2383f87beb93SAndriy Gapon 	crhold(newcred);
2384f87beb93SAndriy Gapon #endif
2385f87beb93SAndriy Gapon 	PROC_UNLOCK(p);
2386f87beb93SAndriy Gapon #ifdef RCTL
2387f87beb93SAndriy Gapon 	rctl_proc_ucred_changed(p, newcred);
2388f87beb93SAndriy Gapon 	crfree(newcred);
2389097055e2SEdward Tomasz Napierala #endif
23901fb6767dSJamie Gritton 	prison_deref(oldcred->cr_prison, PD_DEREF | PD_DEUREF);
2391fd7a8150SMike Barcroft 	crfree(oldcred);
2392fd7a8150SMike Barcroft 	return (0);
23931fb6767dSJamie Gritton 
2394fd7a8150SMike Barcroft  e_unlock:
2395b249ce48SMateusz Guzik 	VOP_UNLOCK(pr->pr_root);
2396b38ff370SJamie Gritton  e_revert_osd:
2397b38ff370SJamie Gritton 	/* Tell modules this thread is still in its old jail after all. */
23981fb6767dSJamie Gritton 	(void)osd_jail_call(td->td_ucred->cr_prison, PR_METHOD_ATTACH, td);
2399b38ff370SJamie Gritton 	prison_deref(pr, PD_DEREF | PD_DEUREF);
2400fd7a8150SMike Barcroft 	return (error);
2401fd7a8150SMike Barcroft }
2402fd7a8150SMike Barcroft 
2403fd7a8150SMike Barcroft /*
2404fd7a8150SMike Barcroft  * Returns a locked prison instance, or NULL on failure.
2405fd7a8150SMike Barcroft  */
240654b369c1SPawel Jakub Dawidek struct prison *
2407fd7a8150SMike Barcroft prison_find(int prid)
2408fd7a8150SMike Barcroft {
2409fd7a8150SMike Barcroft 	struct prison *pr;
2410fd7a8150SMike Barcroft 
2411dc68a633SPawel Jakub Dawidek 	sx_assert(&allprison_lock, SX_LOCKED);
2412b38ff370SJamie Gritton 	TAILQ_FOREACH(pr, &allprison, pr_list) {
2413fd7a8150SMike Barcroft 		if (pr->pr_id == prid) {
2414fd7a8150SMike Barcroft 			mtx_lock(&pr->pr_mtx);
2415b38ff370SJamie Gritton 			if (pr->pr_ref > 0)
2416fd7a8150SMike Barcroft 				return (pr);
2417b38ff370SJamie Gritton 			mtx_unlock(&pr->pr_mtx);
2418fd7a8150SMike Barcroft 		}
2419fd7a8150SMike Barcroft 	}
2420fd7a8150SMike Barcroft 	return (NULL);
2421fd7a8150SMike Barcroft }
2422fd7a8150SMike Barcroft 
2423b38ff370SJamie Gritton /*
24240304c731SJamie Gritton  * Find a prison that is a descendant of mypr.  Returns a locked prison or NULL.
2425b38ff370SJamie Gritton  */
2426b38ff370SJamie Gritton struct prison *
24270304c731SJamie Gritton prison_find_child(struct prison *mypr, int prid)
2428b38ff370SJamie Gritton {
24290304c731SJamie Gritton 	struct prison *pr;
24300304c731SJamie Gritton 	int descend;
2431b38ff370SJamie Gritton 
2432b38ff370SJamie Gritton 	sx_assert(&allprison_lock, SX_LOCKED);
24330304c731SJamie Gritton 	FOREACH_PRISON_DESCENDANT(mypr, pr, descend) {
24340304c731SJamie Gritton 		if (pr->pr_id == prid) {
24350304c731SJamie Gritton 			mtx_lock(&pr->pr_mtx);
24360304c731SJamie Gritton 			if (pr->pr_ref > 0)
24370304c731SJamie Gritton 				return (pr);
24380304c731SJamie Gritton 			mtx_unlock(&pr->pr_mtx);
24390304c731SJamie Gritton 		}
24400304c731SJamie Gritton 	}
24410304c731SJamie Gritton 	return (NULL);
24420304c731SJamie Gritton }
24430304c731SJamie Gritton 
24440304c731SJamie Gritton /*
24450304c731SJamie Gritton  * Look for the name relative to mypr.  Returns a locked prison or NULL.
24460304c731SJamie Gritton  */
24470304c731SJamie Gritton struct prison *
24480304c731SJamie Gritton prison_find_name(struct prison *mypr, const char *name)
24490304c731SJamie Gritton {
24500304c731SJamie Gritton 	struct prison *pr, *deadpr;
24510304c731SJamie Gritton 	size_t mylen;
24520304c731SJamie Gritton 	int descend;
24530304c731SJamie Gritton 
24540304c731SJamie Gritton 	sx_assert(&allprison_lock, SX_LOCKED);
24550304c731SJamie Gritton 	mylen = (mypr == &prison0) ? 0 : strlen(mypr->pr_name) + 1;
2456b38ff370SJamie Gritton  again:
2457b38ff370SJamie Gritton 	deadpr = NULL;
24580304c731SJamie Gritton 	FOREACH_PRISON_DESCENDANT(mypr, pr, descend) {
24590304c731SJamie Gritton 		if (!strcmp(pr->pr_name + mylen, name)) {
2460b38ff370SJamie Gritton 			mtx_lock(&pr->pr_mtx);
2461b38ff370SJamie Gritton 			if (pr->pr_ref > 0) {
2462b38ff370SJamie Gritton 				if (pr->pr_uref > 0)
2463b38ff370SJamie Gritton 					return (pr);
2464b38ff370SJamie Gritton 				deadpr = pr;
2465b38ff370SJamie Gritton 			}
2466b38ff370SJamie Gritton 			mtx_unlock(&pr->pr_mtx);
2467b38ff370SJamie Gritton 		}
2468b38ff370SJamie Gritton 	}
24690304c731SJamie Gritton 	/* There was no valid prison - perhaps there was a dying one. */
2470b38ff370SJamie Gritton 	if (deadpr != NULL) {
2471b38ff370SJamie Gritton 		mtx_lock(&deadpr->pr_mtx);
2472b38ff370SJamie Gritton 		if (deadpr->pr_ref == 0) {
2473b38ff370SJamie Gritton 			mtx_unlock(&deadpr->pr_mtx);
2474b38ff370SJamie Gritton 			goto again;
2475b38ff370SJamie Gritton 		}
2476b38ff370SJamie Gritton 	}
2477b38ff370SJamie Gritton 	return (deadpr);
2478b38ff370SJamie Gritton }
2479b38ff370SJamie Gritton 
2480b38ff370SJamie Gritton /*
24810304c731SJamie Gritton  * See if a prison has the specific flag set.
24820304c731SJamie Gritton  */
24830304c731SJamie Gritton int
24840304c731SJamie Gritton prison_flag(struct ucred *cred, unsigned flag)
24850304c731SJamie Gritton {
24860304c731SJamie Gritton 
24870304c731SJamie Gritton 	/* This is an atomic read, so no locking is necessary. */
24880304c731SJamie Gritton 	return (cred->cr_prison->pr_flags & flag);
24890304c731SJamie Gritton }
24900304c731SJamie Gritton 
24910304c731SJamie Gritton int
24920304c731SJamie Gritton prison_allow(struct ucred *cred, unsigned flag)
24930304c731SJamie Gritton {
24940304c731SJamie Gritton 
24950304c731SJamie Gritton 	/* This is an atomic read, so no locking is necessary. */
24960304c731SJamie Gritton 	return (cred->cr_prison->pr_allow & flag);
24970304c731SJamie Gritton }
24980304c731SJamie Gritton 
24990304c731SJamie Gritton /*
2500b38ff370SJamie Gritton  * Remove a prison reference.  If that was the last reference, remove the
2501b38ff370SJamie Gritton  * prison itself - but not in this context in case there are locks held.
2502b38ff370SJamie Gritton  */
250391421ba2SRobert Watson void
25041ba4a712SPawel Jakub Dawidek prison_free_locked(struct prison *pr)
250591421ba2SRobert Watson {
250673d9e52dSJamie Gritton 	int ref;
250791421ba2SRobert Watson 
25081ba4a712SPawel Jakub Dawidek 	mtx_assert(&pr->pr_mtx, MA_OWNED);
250973d9e52dSJamie Gritton 	ref = --pr->pr_ref;
251001137630SRobert Watson 	mtx_unlock(&pr->pr_mtx);
251173d9e52dSJamie Gritton 	if (ref == 0)
2512c2cda609SPawel Jakub Dawidek 		taskqueue_enqueue(taskqueue_thread, &pr->pr_task);
2513c2cda609SPawel Jakub Dawidek }
2514c2cda609SPawel Jakub Dawidek 
25151ba4a712SPawel Jakub Dawidek void
25161ba4a712SPawel Jakub Dawidek prison_free(struct prison *pr)
25171ba4a712SPawel Jakub Dawidek {
25181ba4a712SPawel Jakub Dawidek 
25191ba4a712SPawel Jakub Dawidek 	mtx_lock(&pr->pr_mtx);
25201ba4a712SPawel Jakub Dawidek 	prison_free_locked(pr);
25211ba4a712SPawel Jakub Dawidek }
25221ba4a712SPawel Jakub Dawidek 
252373d9e52dSJamie Gritton /*
252473d9e52dSJamie Gritton  * Complete a call to either prison_free or prison_proc_free.
252573d9e52dSJamie Gritton  */
2526c2cda609SPawel Jakub Dawidek static void
2527c2cda609SPawel Jakub Dawidek prison_complete(void *context, int pending)
2528c2cda609SPawel Jakub Dawidek {
252973d9e52dSJamie Gritton 	struct prison *pr = context;
2530b38ff370SJamie Gritton 
2531ef0ddea3SJamie Gritton 	sx_xlock(&allprison_lock);
253273d9e52dSJamie Gritton 	mtx_lock(&pr->pr_mtx);
253373d9e52dSJamie Gritton 	prison_deref(pr, pr->pr_uref
2534ef0ddea3SJamie Gritton 	    ? PD_DEREF | PD_DEUREF | PD_LOCKED | PD_LIST_XLOCKED
2535ef0ddea3SJamie Gritton 	    : PD_LOCKED | PD_LIST_XLOCKED);
2536b38ff370SJamie Gritton }
2537b38ff370SJamie Gritton 
2538b38ff370SJamie Gritton /*
2539b38ff370SJamie Gritton  * Remove a prison reference (usually).  This internal version assumes no
2540b38ff370SJamie Gritton  * mutexes are held, except perhaps the prison itself.  If there are no more
2541b38ff370SJamie Gritton  * references, release and delist the prison.  On completion, the prison lock
2542b38ff370SJamie Gritton  * and the allprison lock are both unlocked.
2543b38ff370SJamie Gritton  */
2544b38ff370SJamie Gritton static void
2545b38ff370SJamie Gritton prison_deref(struct prison *pr, int flags)
2546b38ff370SJamie Gritton {
25470304c731SJamie Gritton 	struct prison *ppr, *tpr;
2548cc5fd8c7SJamie Gritton 	int ref, lasturef;
2549c2cda609SPawel Jakub Dawidek 
2550b38ff370SJamie Gritton 	if (!(flags & PD_LOCKED))
2551b38ff370SJamie Gritton 		mtx_lock(&pr->pr_mtx);
25520304c731SJamie Gritton 	for (;;) {
2553e6d5cb63SJamie Gritton 		if (flags & PD_DEUREF) {
255473d9e52dSJamie Gritton 			KASSERT(pr->pr_uref > 0,
255573d9e52dSJamie Gritton 			    ("prison_deref PD_DEUREF on a dead prison (jid=%d)",
255673d9e52dSJamie Gritton 			     pr->pr_id));
2557e6d5cb63SJamie Gritton 			pr->pr_uref--;
2558cc5fd8c7SJamie Gritton 			lasturef = pr->pr_uref == 0;
2559cc5fd8c7SJamie Gritton 			if (lasturef)
2560cc5fd8c7SJamie Gritton 				pr->pr_ref++;
2561e6d5cb63SJamie Gritton 			KASSERT(prison0.pr_uref != 0, ("prison0 pr_uref=0"));
2562cc5fd8c7SJamie Gritton 		} else
2563cc5fd8c7SJamie Gritton 			lasturef = 0;
256473d9e52dSJamie Gritton 		if (flags & PD_DEREF) {
256573d9e52dSJamie Gritton 			KASSERT(pr->pr_ref > 0,
256673d9e52dSJamie Gritton 			    ("prison_deref PD_DEREF on a dead prison (jid=%d)",
256773d9e52dSJamie Gritton 			     pr->pr_id));
2568b38ff370SJamie Gritton 			pr->pr_ref--;
256973d9e52dSJamie Gritton 		}
2570cc5fd8c7SJamie Gritton 		ref = pr->pr_ref;
2571b38ff370SJamie Gritton 		mtx_unlock(&pr->pr_mtx);
2572cc5fd8c7SJamie Gritton 
2573cc5fd8c7SJamie Gritton 		/*
2574cc5fd8c7SJamie Gritton 		 * Tell the modules if the last user reference was removed
2575cc5fd8c7SJamie Gritton 		 * (even it sticks around in dying state).
2576cc5fd8c7SJamie Gritton 		 */
2577cc5fd8c7SJamie Gritton 		if (lasturef) {
2578cc5fd8c7SJamie Gritton 			if (!(flags & (PD_LIST_SLOCKED | PD_LIST_XLOCKED))) {
2579cc5fd8c7SJamie Gritton 				sx_xlock(&allprison_lock);
2580cc5fd8c7SJamie Gritton 				flags |= PD_LIST_XLOCKED;
2581cc5fd8c7SJamie Gritton 			}
2582cc5fd8c7SJamie Gritton 			(void)osd_jail_call(pr, PR_METHOD_REMOVE, NULL);
2583cc5fd8c7SJamie Gritton 			mtx_lock(&pr->pr_mtx);
2584cc5fd8c7SJamie Gritton 			ref = --pr->pr_ref;
2585cc5fd8c7SJamie Gritton 			mtx_unlock(&pr->pr_mtx);
2586cc5fd8c7SJamie Gritton 		}
2587cc5fd8c7SJamie Gritton 
2588cc5fd8c7SJamie Gritton 		/* If the prison still has references, nothing else to do. */
2589cc5fd8c7SJamie Gritton 		if (ref > 0) {
2590b38ff370SJamie Gritton 			if (flags & PD_LIST_SLOCKED)
2591b38ff370SJamie Gritton 				sx_sunlock(&allprison_lock);
2592b38ff370SJamie Gritton 			else if (flags & PD_LIST_XLOCKED)
2593b38ff370SJamie Gritton 				sx_xunlock(&allprison_lock);
2594b38ff370SJamie Gritton 			return;
2595b38ff370SJamie Gritton 		}
2596c2cda609SPawel Jakub Dawidek 
2597b38ff370SJamie Gritton 		if (flags & PD_LIST_SLOCKED) {
2598b38ff370SJamie Gritton 			if (!sx_try_upgrade(&allprison_lock)) {
2599b38ff370SJamie Gritton 				sx_sunlock(&allprison_lock);
2600c2cda609SPawel Jakub Dawidek 				sx_xlock(&allprison_lock);
2601b38ff370SJamie Gritton 			}
2602b38ff370SJamie Gritton 		} else if (!(flags & PD_LIST_XLOCKED))
2603b38ff370SJamie Gritton 			sx_xlock(&allprison_lock);
2604b38ff370SJamie Gritton 
2605b38ff370SJamie Gritton 		TAILQ_REMOVE(&allprison, pr, pr_list);
26060304c731SJamie Gritton 		LIST_REMOVE(pr, pr_sibling);
26070304c731SJamie Gritton 		ppr = pr->pr_parent;
26080304c731SJamie Gritton 		for (tpr = ppr; tpr != NULL; tpr = tpr->pr_parent)
2609b97457e2SJamie Gritton 			tpr->pr_childcount--;
2610c4884ffaSJamie Gritton 		sx_xunlock(&allprison_lock);
26111ba4a712SPawel Jakub Dawidek 
2612679e1390SJamie Gritton #ifdef VIMAGE
26130cb8b6a9SMarko Zec 		if (pr->pr_vnet != ppr->pr_vnet)
2614679e1390SJamie Gritton 			vnet_destroy(pr->pr_vnet);
2615679e1390SJamie Gritton #endif
26165050aa86SKonstantin Belousov 		if (pr->pr_root != NULL)
2617b3059e09SRobert Watson 			vrele(pr->pr_root);
2618b3059e09SRobert Watson 		mtx_destroy(&pr->pr_mtx);
2619413628a7SBjoern A. Zeeb #ifdef INET
2620413628a7SBjoern A. Zeeb 		free(pr->pr_ip4, M_PRISON);
2621413628a7SBjoern A. Zeeb #endif
2622b38ff370SJamie Gritton #ifdef INET6
2623b38ff370SJamie Gritton 		free(pr->pr_ip6, M_PRISON);
2624b38ff370SJamie Gritton #endif
2625b38ff370SJamie Gritton 		if (pr->pr_cpuset != NULL)
2626b38ff370SJamie Gritton 			cpuset_rel(pr->pr_cpuset);
2627b38ff370SJamie Gritton 		osd_jail_exit(pr);
2628a7ad07bfSEdward Tomasz Napierala #ifdef RACCT
26294b5c9cf6SEdward Tomasz Napierala 		if (racct_enable)
2630a7ad07bfSEdward Tomasz Napierala 			prison_racct_detach(pr);
2631ec125fbbSEdward Tomasz Napierala #endif
26321ede983cSDag-Erling Smørgrav 		free(pr, M_PRISON);
26330304c731SJamie Gritton 
26340304c731SJamie Gritton 		/* Removing a prison frees a reference on its parent. */
26350304c731SJamie Gritton 		pr = ppr;
26360304c731SJamie Gritton 		mtx_lock(&pr->pr_mtx);
2637e6d5cb63SJamie Gritton 		flags = PD_DEREF | PD_DEUREF;
26380304c731SJamie Gritton 	}
2639b3059e09SRobert Watson }
2640b3059e09SRobert Watson 
264191421ba2SRobert Watson void
26421ba4a712SPawel Jakub Dawidek prison_hold_locked(struct prison *pr)
26431ba4a712SPawel Jakub Dawidek {
26441ba4a712SPawel Jakub Dawidek 
26451ba4a712SPawel Jakub Dawidek 	mtx_assert(&pr->pr_mtx, MA_OWNED);
26461ba4a712SPawel Jakub Dawidek 	KASSERT(pr->pr_ref > 0,
264736b41cc3SBjoern A. Zeeb 	    ("Trying to hold dead prison %p (jid=%d).", pr, pr->pr_id));
26481ba4a712SPawel Jakub Dawidek 	pr->pr_ref++;
26491ba4a712SPawel Jakub Dawidek }
26501ba4a712SPawel Jakub Dawidek 
26511ba4a712SPawel Jakub Dawidek void
265291421ba2SRobert Watson prison_hold(struct prison *pr)
265391421ba2SRobert Watson {
265491421ba2SRobert Watson 
265501137630SRobert Watson 	mtx_lock(&pr->pr_mtx);
26561ba4a712SPawel Jakub Dawidek 	prison_hold_locked(pr);
265701137630SRobert Watson 	mtx_unlock(&pr->pr_mtx);
265801137630SRobert Watson }
265901137630SRobert Watson 
2660413628a7SBjoern A. Zeeb void
2661413628a7SBjoern A. Zeeb prison_proc_hold(struct prison *pr)
266201137630SRobert Watson {
266301137630SRobert Watson 
2664413628a7SBjoern A. Zeeb 	mtx_lock(&pr->pr_mtx);
2665b38ff370SJamie Gritton 	KASSERT(pr->pr_uref > 0,
2666b38ff370SJamie Gritton 	    ("Cannot add a process to a non-alive prison (jid=%d)", pr->pr_id));
2667b38ff370SJamie Gritton 	pr->pr_uref++;
2668413628a7SBjoern A. Zeeb 	mtx_unlock(&pr->pr_mtx);
266975c13541SPoul-Henning Kamp }
267075c13541SPoul-Henning Kamp 
267175c13541SPoul-Henning Kamp void
2672413628a7SBjoern A. Zeeb prison_proc_free(struct prison *pr)
267375c13541SPoul-Henning Kamp {
2674413628a7SBjoern A. Zeeb 
2675413628a7SBjoern A. Zeeb 	mtx_lock(&pr->pr_mtx);
2676b38ff370SJamie Gritton 	KASSERT(pr->pr_uref > 0,
2677b38ff370SJamie Gritton 	    ("Trying to kill a process in a dead prison (jid=%d)", pr->pr_id));
267873d9e52dSJamie Gritton 	if (pr->pr_uref > 1)
267973d9e52dSJamie Gritton 		pr->pr_uref--;
268073d9e52dSJamie Gritton 	else {
268173d9e52dSJamie Gritton 		/*
268273d9e52dSJamie Gritton 		 * Don't remove the last user reference in this context, which
268373d9e52dSJamie Gritton 		 * is expected to be a process that is not only locked, but
268473d9e52dSJamie Gritton 		 * also half dead.
268573d9e52dSJamie Gritton 		 */
268673d9e52dSJamie Gritton 		pr->pr_ref++;
268773d9e52dSJamie Gritton 		mtx_unlock(&pr->pr_mtx);
268873d9e52dSJamie Gritton 		taskqueue_enqueue(taskqueue_thread, &pr->pr_task);
268973d9e52dSJamie Gritton 		return;
269073d9e52dSJamie Gritton 	}
269173d9e52dSJamie Gritton 	mtx_unlock(&pr->pr_mtx);
2692413628a7SBjoern A. Zeeb }
2693413628a7SBjoern A. Zeeb 
2694413628a7SBjoern A. Zeeb /*
2695ca04ba64SJamie Gritton  * Check if a jail supports the given address family.
2696ca04ba64SJamie Gritton  *
2697ca04ba64SJamie Gritton  * Returns 0 if not jailed or the address family is supported, EAFNOSUPPORT
2698ca04ba64SJamie Gritton  * if not.
2699ca04ba64SJamie Gritton  */
2700ca04ba64SJamie Gritton int
2701ca04ba64SJamie Gritton prison_check_af(struct ucred *cred, int af)
2702ca04ba64SJamie Gritton {
27030304c731SJamie Gritton 	struct prison *pr;
2704ca04ba64SJamie Gritton 	int error;
2705ca04ba64SJamie Gritton 
2706ca04ba64SJamie Gritton 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
2707ca04ba64SJamie Gritton 
27080304c731SJamie Gritton 	pr = cred->cr_prison;
2709499650a0SJamie Gritton #ifdef VIMAGE
27106bb79563SJamie Gritton 	/* Prisons with their own network stack are not limited. */
2711de0bd6f7SBjoern A. Zeeb 	if (prison_owns_vnet(cred))
27126bb79563SJamie Gritton 		return (0);
2713499650a0SJamie Gritton #endif
27146bb79563SJamie Gritton 
2715ca04ba64SJamie Gritton 	error = 0;
2716ca04ba64SJamie Gritton 	switch (af)
2717ca04ba64SJamie Gritton 	{
2718ca04ba64SJamie Gritton #ifdef INET
2719ca04ba64SJamie Gritton 	case AF_INET:
27200304c731SJamie Gritton 		if (pr->pr_flags & PR_IP4)
27210304c731SJamie Gritton 		{
27220304c731SJamie Gritton 			mtx_lock(&pr->pr_mtx);
27230304c731SJamie Gritton 			if ((pr->pr_flags & PR_IP4) && pr->pr_ip4 == NULL)
2724ca04ba64SJamie Gritton 				error = EAFNOSUPPORT;
27250304c731SJamie Gritton 			mtx_unlock(&pr->pr_mtx);
27260304c731SJamie Gritton 		}
2727ca04ba64SJamie Gritton 		break;
2728ca04ba64SJamie Gritton #endif
2729ca04ba64SJamie Gritton #ifdef INET6
2730ca04ba64SJamie Gritton 	case AF_INET6:
27310304c731SJamie Gritton 		if (pr->pr_flags & PR_IP6)
27320304c731SJamie Gritton 		{
27330304c731SJamie Gritton 			mtx_lock(&pr->pr_mtx);
27340304c731SJamie Gritton 			if ((pr->pr_flags & PR_IP6) && pr->pr_ip6 == NULL)
2735ca04ba64SJamie Gritton 				error = EAFNOSUPPORT;
27360304c731SJamie Gritton 			mtx_unlock(&pr->pr_mtx);
27370304c731SJamie Gritton 		}
2738ca04ba64SJamie Gritton 		break;
2739ca04ba64SJamie Gritton #endif
2740ca04ba64SJamie Gritton 	case AF_LOCAL:
2741ca04ba64SJamie Gritton 	case AF_ROUTE:
2742ca04ba64SJamie Gritton 		break;
2743ca04ba64SJamie Gritton 	default:
27440304c731SJamie Gritton 		if (!(pr->pr_allow & PR_ALLOW_SOCKET_AF))
2745ca04ba64SJamie Gritton 			error = EAFNOSUPPORT;
2746ca04ba64SJamie Gritton 	}
2747ca04ba64SJamie Gritton 	return (error);
2748ca04ba64SJamie Gritton }
2749ca04ba64SJamie Gritton 
2750ca04ba64SJamie Gritton /*
2751413628a7SBjoern A. Zeeb  * Check if given address belongs to the jail referenced by cred (wrapper to
2752413628a7SBjoern A. Zeeb  * prison_check_ip[46]).
2753413628a7SBjoern A. Zeeb  *
27540304c731SJamie Gritton  * Returns 0 if jail doesn't restrict the address family or if address belongs
27550304c731SJamie Gritton  * to jail, EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if
27560304c731SJamie Gritton  * the jail doesn't allow the address family.  IPv4 Address passed in in NBO.
2757413628a7SBjoern A. Zeeb  */
2758413628a7SBjoern A. Zeeb int
2759c83dda36SAlexander V. Chernikov prison_if(struct ucred *cred, const struct sockaddr *sa)
276075c13541SPoul-Henning Kamp {
2761413628a7SBjoern A. Zeeb #ifdef INET
2762c83dda36SAlexander V. Chernikov 	const struct sockaddr_in *sai;
2763413628a7SBjoern A. Zeeb #endif
2764413628a7SBjoern A. Zeeb #ifdef INET6
2765c83dda36SAlexander V. Chernikov 	const struct sockaddr_in6 *sai6;
2766413628a7SBjoern A. Zeeb #endif
2767b89e82ddSJamie Gritton 	int error;
276875c13541SPoul-Henning Kamp 
2769413628a7SBjoern A. Zeeb 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
2770413628a7SBjoern A. Zeeb 	KASSERT(sa != NULL, ("%s: sa is NULL", __func__));
2771413628a7SBjoern A. Zeeb 
2772de0bd6f7SBjoern A. Zeeb #ifdef VIMAGE
2773de0bd6f7SBjoern A. Zeeb 	if (prison_owns_vnet(cred))
2774de0bd6f7SBjoern A. Zeeb 		return (0);
2775de0bd6f7SBjoern A. Zeeb #endif
2776de0bd6f7SBjoern A. Zeeb 
2777b89e82ddSJamie Gritton 	error = 0;
2778413628a7SBjoern A. Zeeb 	switch (sa->sa_family)
2779413628a7SBjoern A. Zeeb 	{
2780413628a7SBjoern A. Zeeb #ifdef INET
2781413628a7SBjoern A. Zeeb 	case AF_INET:
2782c83dda36SAlexander V. Chernikov 		sai = (const struct sockaddr_in *)sa;
2783b89e82ddSJamie Gritton 		error = prison_check_ip4(cred, &sai->sin_addr);
2784413628a7SBjoern A. Zeeb 		break;
2785413628a7SBjoern A. Zeeb #endif
2786413628a7SBjoern A. Zeeb #ifdef INET6
2787413628a7SBjoern A. Zeeb 	case AF_INET6:
2788c83dda36SAlexander V. Chernikov 		sai6 = (const struct sockaddr_in6 *)sa;
2789b89e82ddSJamie Gritton 		error = prison_check_ip6(cred, &sai6->sin6_addr);
2790413628a7SBjoern A. Zeeb 		break;
2791413628a7SBjoern A. Zeeb #endif
2792413628a7SBjoern A. Zeeb 	default:
27930304c731SJamie Gritton 		if (!(cred->cr_prison->pr_allow & PR_ALLOW_SOCKET_AF))
2794b89e82ddSJamie Gritton 			error = EAFNOSUPPORT;
2795413628a7SBjoern A. Zeeb 	}
2796b89e82ddSJamie Gritton 	return (error);
279775c13541SPoul-Henning Kamp }
279891421ba2SRobert Watson 
279991421ba2SRobert Watson /*
280091421ba2SRobert Watson  * Return 0 if jails permit p1 to frob p2, otherwise ESRCH.
280191421ba2SRobert Watson  */
280291421ba2SRobert Watson int
28039ddb7954SMike Barcroft prison_check(struct ucred *cred1, struct ucred *cred2)
280491421ba2SRobert Watson {
280591421ba2SRobert Watson 
28060304c731SJamie Gritton 	return ((cred1->cr_prison == cred2->cr_prison ||
28070304c731SJamie Gritton 	    prison_ischild(cred1->cr_prison, cred2->cr_prison)) ? 0 : ESRCH);
28080304c731SJamie Gritton }
280991421ba2SRobert Watson 
28100304c731SJamie Gritton /*
28110304c731SJamie Gritton  * Return 1 if p2 is a child of p1, otherwise 0.
28120304c731SJamie Gritton  */
28130304c731SJamie Gritton int
28140304c731SJamie Gritton prison_ischild(struct prison *pr1, struct prison *pr2)
28150304c731SJamie Gritton {
28160304c731SJamie Gritton 
28170304c731SJamie Gritton 	for (pr2 = pr2->pr_parent; pr2 != NULL; pr2 = pr2->pr_parent)
28180304c731SJamie Gritton 		if (pr1 == pr2)
28190304c731SJamie Gritton 			return (1);
282091421ba2SRobert Watson 	return (0);
282191421ba2SRobert Watson }
282291421ba2SRobert Watson 
282391421ba2SRobert Watson /*
2824de0bd6f7SBjoern A. Zeeb  * Return 1 if the passed credential is in a jail and that jail does not
2825de0bd6f7SBjoern A. Zeeb  * have its own virtual network stack, otherwise 0.
2826de0bd6f7SBjoern A. Zeeb  */
2827de0bd6f7SBjoern A. Zeeb int
2828de0bd6f7SBjoern A. Zeeb jailed_without_vnet(struct ucred *cred)
2829de0bd6f7SBjoern A. Zeeb {
2830de0bd6f7SBjoern A. Zeeb 
2831de0bd6f7SBjoern A. Zeeb 	if (!jailed(cred))
2832de0bd6f7SBjoern A. Zeeb 		return (0);
2833de0bd6f7SBjoern A. Zeeb #ifdef VIMAGE
2834de0bd6f7SBjoern A. Zeeb 	if (prison_owns_vnet(cred))
2835de0bd6f7SBjoern A. Zeeb 		return (0);
2836de0bd6f7SBjoern A. Zeeb #endif
2837de0bd6f7SBjoern A. Zeeb 
2838de0bd6f7SBjoern A. Zeeb 	return (1);
2839de0bd6f7SBjoern A. Zeeb }
2840de0bd6f7SBjoern A. Zeeb 
2841de0bd6f7SBjoern A. Zeeb /*
28427455b100SJamie Gritton  * Return the correct hostname (domainname, et al) for the passed credential.
28439484d0c0SRobert Drehmel  */
2844ad1ff099SRobert Drehmel void
28459ddb7954SMike Barcroft getcredhostname(struct ucred *cred, char *buf, size_t size)
28469484d0c0SRobert Drehmel {
284776ca6f88SJamie Gritton 	struct prison *pr;
28489484d0c0SRobert Drehmel 
28497455b100SJamie Gritton 	/*
28507455b100SJamie Gritton 	 * A NULL credential can be used to shortcut to the physical
28517455b100SJamie Gritton 	 * system's hostname.
28527455b100SJamie Gritton 	 */
285376ca6f88SJamie Gritton 	pr = (cred != NULL) ? cred->cr_prison : &prison0;
285476ca6f88SJamie Gritton 	mtx_lock(&pr->pr_mtx);
2855c1f19219SJamie Gritton 	strlcpy(buf, pr->pr_hostname, size);
285676ca6f88SJamie Gritton 	mtx_unlock(&pr->pr_mtx);
28579484d0c0SRobert Drehmel }
2858fd7a8150SMike Barcroft 
28597455b100SJamie Gritton void
28607455b100SJamie Gritton getcreddomainname(struct ucred *cred, char *buf, size_t size)
28617455b100SJamie Gritton {
28627455b100SJamie Gritton 
28637455b100SJamie Gritton 	mtx_lock(&cred->cr_prison->pr_mtx);
2864c1f19219SJamie Gritton 	strlcpy(buf, cred->cr_prison->pr_domainname, size);
28657455b100SJamie Gritton 	mtx_unlock(&cred->cr_prison->pr_mtx);
28667455b100SJamie Gritton }
28677455b100SJamie Gritton 
28687455b100SJamie Gritton void
28697455b100SJamie Gritton getcredhostuuid(struct ucred *cred, char *buf, size_t size)
28707455b100SJamie Gritton {
28717455b100SJamie Gritton 
28727455b100SJamie Gritton 	mtx_lock(&cred->cr_prison->pr_mtx);
2873c1f19219SJamie Gritton 	strlcpy(buf, cred->cr_prison->pr_hostuuid, size);
28747455b100SJamie Gritton 	mtx_unlock(&cred->cr_prison->pr_mtx);
28757455b100SJamie Gritton }
28767455b100SJamie Gritton 
28777455b100SJamie Gritton void
28787455b100SJamie Gritton getcredhostid(struct ucred *cred, unsigned long *hostid)
28797455b100SJamie Gritton {
28807455b100SJamie Gritton 
28817455b100SJamie Gritton 	mtx_lock(&cred->cr_prison->pr_mtx);
28827455b100SJamie Gritton 	*hostid = cred->cr_prison->pr_hostid;
28837455b100SJamie Gritton 	mtx_unlock(&cred->cr_prison->pr_mtx);
28847455b100SJamie Gritton }
28857455b100SJamie Gritton 
2886eb79e1c7SBjoern A. Zeeb #ifdef VIMAGE
2887eb79e1c7SBjoern A. Zeeb /*
2888eb79e1c7SBjoern A. Zeeb  * Determine whether the prison represented by cred owns
2889eb79e1c7SBjoern A. Zeeb  * its vnet rather than having it inherited.
2890eb79e1c7SBjoern A. Zeeb  *
2891eb79e1c7SBjoern A. Zeeb  * Returns 1 in case the prison owns the vnet, 0 otherwise.
2892eb79e1c7SBjoern A. Zeeb  */
2893eb79e1c7SBjoern A. Zeeb int
2894eb79e1c7SBjoern A. Zeeb prison_owns_vnet(struct ucred *cred)
2895eb79e1c7SBjoern A. Zeeb {
2896eb79e1c7SBjoern A. Zeeb 
2897eb79e1c7SBjoern A. Zeeb 	/*
2898eb79e1c7SBjoern A. Zeeb 	 * vnets cannot be added/removed after jail creation,
2899eb79e1c7SBjoern A. Zeeb 	 * so no need to lock here.
2900eb79e1c7SBjoern A. Zeeb 	 */
2901eb79e1c7SBjoern A. Zeeb 	return (cred->cr_prison->pr_flags & PR_VNET ? 1 : 0);
2902eb79e1c7SBjoern A. Zeeb }
2903eb79e1c7SBjoern A. Zeeb #endif
2904eb79e1c7SBjoern A. Zeeb 
2905f08df373SRobert Watson /*
2906820a0de9SPawel Jakub Dawidek  * Determine whether the subject represented by cred can "see"
2907820a0de9SPawel Jakub Dawidek  * status of a mount point.
2908820a0de9SPawel Jakub Dawidek  * Returns: 0 for permitted, ENOENT otherwise.
2909820a0de9SPawel Jakub Dawidek  * XXX: This function should be called cr_canseemount() and should be
2910820a0de9SPawel Jakub Dawidek  *      placed in kern_prot.c.
2911f08df373SRobert Watson  */
2912f08df373SRobert Watson int
2913820a0de9SPawel Jakub Dawidek prison_canseemount(struct ucred *cred, struct mount *mp)
2914f08df373SRobert Watson {
2915820a0de9SPawel Jakub Dawidek 	struct prison *pr;
2916820a0de9SPawel Jakub Dawidek 	struct statfs *sp;
2917820a0de9SPawel Jakub Dawidek 	size_t len;
2918f08df373SRobert Watson 
2919820a0de9SPawel Jakub Dawidek 	pr = cred->cr_prison;
29200304c731SJamie Gritton 	if (pr->pr_enforce_statfs == 0)
29210304c731SJamie Gritton 		return (0);
2922820a0de9SPawel Jakub Dawidek 	if (pr->pr_root->v_mount == mp)
2923820a0de9SPawel Jakub Dawidek 		return (0);
29240304c731SJamie Gritton 	if (pr->pr_enforce_statfs == 2)
2925820a0de9SPawel Jakub Dawidek 		return (ENOENT);
2926820a0de9SPawel Jakub Dawidek 	/*
2927820a0de9SPawel Jakub Dawidek 	 * If jail's chroot directory is set to "/" we should be able to see
2928820a0de9SPawel Jakub Dawidek 	 * all mount-points from inside a jail.
2929820a0de9SPawel Jakub Dawidek 	 * This is ugly check, but this is the only situation when jail's
2930820a0de9SPawel Jakub Dawidek 	 * directory ends with '/'.
2931820a0de9SPawel Jakub Dawidek 	 */
2932820a0de9SPawel Jakub Dawidek 	if (strcmp(pr->pr_path, "/") == 0)
2933820a0de9SPawel Jakub Dawidek 		return (0);
2934820a0de9SPawel Jakub Dawidek 	len = strlen(pr->pr_path);
2935820a0de9SPawel Jakub Dawidek 	sp = &mp->mnt_stat;
2936820a0de9SPawel Jakub Dawidek 	if (strncmp(pr->pr_path, sp->f_mntonname, len) != 0)
2937820a0de9SPawel Jakub Dawidek 		return (ENOENT);
2938820a0de9SPawel Jakub Dawidek 	/*
2939820a0de9SPawel Jakub Dawidek 	 * Be sure that we don't have situation where jail's root directory
2940820a0de9SPawel Jakub Dawidek 	 * is "/some/path" and mount point is "/some/pathpath".
2941820a0de9SPawel Jakub Dawidek 	 */
2942820a0de9SPawel Jakub Dawidek 	if (sp->f_mntonname[len] != '\0' && sp->f_mntonname[len] != '/')
2943820a0de9SPawel Jakub Dawidek 		return (ENOENT);
2944f08df373SRobert Watson 	return (0);
2945f08df373SRobert Watson }
2946820a0de9SPawel Jakub Dawidek 
2947820a0de9SPawel Jakub Dawidek void
2948820a0de9SPawel Jakub Dawidek prison_enforce_statfs(struct ucred *cred, struct mount *mp, struct statfs *sp)
2949820a0de9SPawel Jakub Dawidek {
2950820a0de9SPawel Jakub Dawidek 	char jpath[MAXPATHLEN];
2951820a0de9SPawel Jakub Dawidek 	struct prison *pr;
2952820a0de9SPawel Jakub Dawidek 	size_t len;
2953820a0de9SPawel Jakub Dawidek 
2954820a0de9SPawel Jakub Dawidek 	pr = cred->cr_prison;
29550304c731SJamie Gritton 	if (pr->pr_enforce_statfs == 0)
29560304c731SJamie Gritton 		return;
2957820a0de9SPawel Jakub Dawidek 	if (prison_canseemount(cred, mp) != 0) {
2958820a0de9SPawel Jakub Dawidek 		bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
2959820a0de9SPawel Jakub Dawidek 		strlcpy(sp->f_mntonname, "[restricted]",
2960820a0de9SPawel Jakub Dawidek 		    sizeof(sp->f_mntonname));
2961820a0de9SPawel Jakub Dawidek 		return;
2962820a0de9SPawel Jakub Dawidek 	}
2963820a0de9SPawel Jakub Dawidek 	if (pr->pr_root->v_mount == mp) {
2964820a0de9SPawel Jakub Dawidek 		/*
2965820a0de9SPawel Jakub Dawidek 		 * Clear current buffer data, so we are sure nothing from
2966820a0de9SPawel Jakub Dawidek 		 * the valid path left there.
2967820a0de9SPawel Jakub Dawidek 		 */
2968820a0de9SPawel Jakub Dawidek 		bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
2969820a0de9SPawel Jakub Dawidek 		*sp->f_mntonname = '/';
2970820a0de9SPawel Jakub Dawidek 		return;
2971820a0de9SPawel Jakub Dawidek 	}
2972820a0de9SPawel Jakub Dawidek 	/*
2973820a0de9SPawel Jakub Dawidek 	 * If jail's chroot directory is set to "/" we should be able to see
2974820a0de9SPawel Jakub Dawidek 	 * all mount-points from inside a jail.
2975820a0de9SPawel Jakub Dawidek 	 */
2976820a0de9SPawel Jakub Dawidek 	if (strcmp(pr->pr_path, "/") == 0)
2977820a0de9SPawel Jakub Dawidek 		return;
2978820a0de9SPawel Jakub Dawidek 	len = strlen(pr->pr_path);
2979820a0de9SPawel Jakub Dawidek 	strlcpy(jpath, sp->f_mntonname + len, sizeof(jpath));
2980820a0de9SPawel Jakub Dawidek 	/*
2981820a0de9SPawel Jakub Dawidek 	 * Clear current buffer data, so we are sure nothing from
2982820a0de9SPawel Jakub Dawidek 	 * the valid path left there.
2983820a0de9SPawel Jakub Dawidek 	 */
2984820a0de9SPawel Jakub Dawidek 	bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
2985820a0de9SPawel Jakub Dawidek 	if (*jpath == '\0') {
2986820a0de9SPawel Jakub Dawidek 		/* Should never happen. */
2987820a0de9SPawel Jakub Dawidek 		*sp->f_mntonname = '/';
2988820a0de9SPawel Jakub Dawidek 	} else {
2989820a0de9SPawel Jakub Dawidek 		strlcpy(sp->f_mntonname, jpath, sizeof(sp->f_mntonname));
2990820a0de9SPawel Jakub Dawidek 	}
2991f08df373SRobert Watson }
2992f08df373SRobert Watson 
2993800c9408SRobert Watson /*
2994800c9408SRobert Watson  * Check with permission for a specific privilege is granted within jail.  We
2995800c9408SRobert Watson  * have a specific list of accepted privileges; the rest are denied.
2996800c9408SRobert Watson  */
2997800c9408SRobert Watson int
2998800c9408SRobert Watson prison_priv_check(struct ucred *cred, int priv)
2999800c9408SRobert Watson {
3000800c9408SRobert Watson 
30017b2ff0dcSMateusz Guzik 	/*
30027b2ff0dcSMateusz Guzik 	 * Some policies have custom handlers. This routine should not be
30037b2ff0dcSMateusz Guzik 	 * called for them. See priv_check_cred().
30047b2ff0dcSMateusz Guzik 	 */
30057b2ff0dcSMateusz Guzik 	switch (priv) {
30067b2ff0dcSMateusz Guzik 	case PRIV_VFS_GENERATION:
30077b2ff0dcSMateusz Guzik 		KASSERT(0, ("prison_priv_check instead of a custom handler "
30087b2ff0dcSMateusz Guzik 		    "called for %d\n", priv));
30097b2ff0dcSMateusz Guzik 	}
30107b2ff0dcSMateusz Guzik 
3011800c9408SRobert Watson 	if (!jailed(cred))
3012800c9408SRobert Watson 		return (0);
3013800c9408SRobert Watson 
30146bb79563SJamie Gritton #ifdef VIMAGE
30156bb79563SJamie Gritton 	/*
30166bb79563SJamie Gritton 	 * Privileges specific to prisons with a virtual network stack.
30176bb79563SJamie Gritton 	 * There might be a duplicate entry here in case the privilege
30186bb79563SJamie Gritton 	 * is only granted conditionally in the legacy jail case.
30196bb79563SJamie Gritton 	 */
30206bb79563SJamie Gritton 	switch (priv) {
30216bb79563SJamie Gritton #ifdef notyet
30226bb79563SJamie Gritton 		/*
30236bb79563SJamie Gritton 		 * NFS-specific privileges.
30246bb79563SJamie Gritton 		 */
30256bb79563SJamie Gritton 	case PRIV_NFS_DAEMON:
30266bb79563SJamie Gritton 	case PRIV_NFS_LOCKD:
30276bb79563SJamie Gritton #endif
30286bb79563SJamie Gritton 		/*
30296bb79563SJamie Gritton 		 * Network stack privileges.
30306bb79563SJamie Gritton 		 */
30316bb79563SJamie Gritton 	case PRIV_NET_BRIDGE:
30326bb79563SJamie Gritton 	case PRIV_NET_GRE:
30336bb79563SJamie Gritton 	case PRIV_NET_BPF:
30346bb79563SJamie Gritton 	case PRIV_NET_RAW:		/* Dup, cond. in legacy jail case. */
30356bb79563SJamie Gritton 	case PRIV_NET_ROUTE:
30366bb79563SJamie Gritton 	case PRIV_NET_TAP:
30376bb79563SJamie Gritton 	case PRIV_NET_SETIFMTU:
30386bb79563SJamie Gritton 	case PRIV_NET_SETIFFLAGS:
30396bb79563SJamie Gritton 	case PRIV_NET_SETIFCAP:
3040215940b3SXin LI 	case PRIV_NET_SETIFDESCR:
30416bb79563SJamie Gritton 	case PRIV_NET_SETIFNAME	:
30426bb79563SJamie Gritton 	case PRIV_NET_SETIFMETRIC:
30436bb79563SJamie Gritton 	case PRIV_NET_SETIFPHYS:
30446bb79563SJamie Gritton 	case PRIV_NET_SETIFMAC:
3045389474c1SKonstantin Belousov 	case PRIV_NET_SETLANPCP:
30466bb79563SJamie Gritton 	case PRIV_NET_ADDMULTI:
30476bb79563SJamie Gritton 	case PRIV_NET_DELMULTI:
30486bb79563SJamie Gritton 	case PRIV_NET_HWIOCTL:
30496bb79563SJamie Gritton 	case PRIV_NET_SETLLADDR:
30506bb79563SJamie Gritton 	case PRIV_NET_ADDIFGROUP:
30516bb79563SJamie Gritton 	case PRIV_NET_DELIFGROUP:
30526bb79563SJamie Gritton 	case PRIV_NET_IFCREATE:
30536bb79563SJamie Gritton 	case PRIV_NET_IFDESTROY:
30546bb79563SJamie Gritton 	case PRIV_NET_ADDIFADDR:
30556bb79563SJamie Gritton 	case PRIV_NET_DELIFADDR:
30566bb79563SJamie Gritton 	case PRIV_NET_LAGG:
30576bb79563SJamie Gritton 	case PRIV_NET_GIF:
30586bb79563SJamie Gritton 	case PRIV_NET_SETIFVNET:
305935fd7bc0SBjoern A. Zeeb 	case PRIV_NET_SETIFFIB:
30606bb79563SJamie Gritton 
30616bb79563SJamie Gritton 		/*
30626bb79563SJamie Gritton 		 * 802.11-related privileges.
30636bb79563SJamie Gritton 		 */
30646bb79563SJamie Gritton 	case PRIV_NET80211_GETKEY:
30656bb79563SJamie Gritton #ifdef notyet
30666bb79563SJamie Gritton 	case PRIV_NET80211_MANAGE:		/* XXX-BZ discuss with sam@ */
30676bb79563SJamie Gritton #endif
30686bb79563SJamie Gritton 
30696bb79563SJamie Gritton #ifdef notyet
30706bb79563SJamie Gritton 		/*
30716bb79563SJamie Gritton 		 * ATM privileges.
30726bb79563SJamie Gritton 		 */
30736bb79563SJamie Gritton 	case PRIV_NETATM_CFG:
30746bb79563SJamie Gritton 	case PRIV_NETATM_ADD:
30756bb79563SJamie Gritton 	case PRIV_NETATM_DEL:
30766bb79563SJamie Gritton 	case PRIV_NETATM_SET:
30776bb79563SJamie Gritton 
30786bb79563SJamie Gritton 		/*
30796bb79563SJamie Gritton 		 * Bluetooth privileges.
30806bb79563SJamie Gritton 		 */
30816bb79563SJamie Gritton 	case PRIV_NETBLUETOOTH_RAW:
30826bb79563SJamie Gritton #endif
30836bb79563SJamie Gritton 
30846bb79563SJamie Gritton 		/*
30856bb79563SJamie Gritton 		 * Netgraph and netgraph module privileges.
30866bb79563SJamie Gritton 		 */
30876bb79563SJamie Gritton 	case PRIV_NETGRAPH_CONTROL:
30886bb79563SJamie Gritton #ifdef notyet
30896bb79563SJamie Gritton 	case PRIV_NETGRAPH_TTY:
30906bb79563SJamie Gritton #endif
30916bb79563SJamie Gritton 
30926bb79563SJamie Gritton 		/*
30936bb79563SJamie Gritton 		 * IPv4 and IPv6 privileges.
30946bb79563SJamie Gritton 		 */
30956bb79563SJamie Gritton 	case PRIV_NETINET_IPFW:
30966bb79563SJamie Gritton 	case PRIV_NETINET_DIVERT:
30976bb79563SJamie Gritton 	case PRIV_NETINET_PF:
30986bb79563SJamie Gritton 	case PRIV_NETINET_DUMMYNET:
30996bb79563SJamie Gritton 	case PRIV_NETINET_CARP:
31006bb79563SJamie Gritton 	case PRIV_NETINET_MROUTE:
31016bb79563SJamie Gritton 	case PRIV_NETINET_RAW:
31026bb79563SJamie Gritton 	case PRIV_NETINET_ADDRCTRL6:
31036bb79563SJamie Gritton 	case PRIV_NETINET_ND6:
31046bb79563SJamie Gritton 	case PRIV_NETINET_SCOPE6:
31056bb79563SJamie Gritton 	case PRIV_NETINET_ALIFETIME6:
31066bb79563SJamie Gritton 	case PRIV_NETINET_IPSEC:
31076bb79563SJamie Gritton 	case PRIV_NETINET_BINDANY:
31086bb79563SJamie Gritton 
31096bb79563SJamie Gritton #ifdef notyet
31106bb79563SJamie Gritton 		/*
31116bb79563SJamie Gritton 		 * NCP privileges.
31126bb79563SJamie Gritton 		 */
31136bb79563SJamie Gritton 	case PRIV_NETNCP:
31146bb79563SJamie Gritton 
31156bb79563SJamie Gritton 		/*
31166bb79563SJamie Gritton 		 * SMB privileges.
31176bb79563SJamie Gritton 		 */
31186bb79563SJamie Gritton 	case PRIV_NETSMB:
31196bb79563SJamie Gritton #endif
31206bb79563SJamie Gritton 
31216bb79563SJamie Gritton 	/*
31226bb79563SJamie Gritton 	 * No default: or deny here.
31236bb79563SJamie Gritton 	 * In case of no permit fall through to next switch().
31246bb79563SJamie Gritton 	 */
31256bb79563SJamie Gritton 		if (cred->cr_prison->pr_flags & PR_VNET)
31266bb79563SJamie Gritton 			return (0);
31276bb79563SJamie Gritton 	}
31286bb79563SJamie Gritton #endif /* VIMAGE */
31296bb79563SJamie Gritton 
3130800c9408SRobert Watson 	switch (priv) {
3131800c9408SRobert Watson 
3132800c9408SRobert Watson 		/*
3133800c9408SRobert Watson 		 * Allow ktrace privileges for root in jail.
3134800c9408SRobert Watson 		 */
3135800c9408SRobert Watson 	case PRIV_KTRACE:
3136800c9408SRobert Watson 
3137c3c1b5e6SRobert Watson #if 0
3138800c9408SRobert Watson 		/*
3139800c9408SRobert Watson 		 * Allow jailed processes to configure audit identity and
3140800c9408SRobert Watson 		 * submit audit records (login, etc).  In the future we may
3141800c9408SRobert Watson 		 * want to further refine the relationship between audit and
3142800c9408SRobert Watson 		 * jail.
3143800c9408SRobert Watson 		 */
3144800c9408SRobert Watson 	case PRIV_AUDIT_GETAUDIT:
3145800c9408SRobert Watson 	case PRIV_AUDIT_SETAUDIT:
3146800c9408SRobert Watson 	case PRIV_AUDIT_SUBMIT:
3147c3c1b5e6SRobert Watson #endif
3148800c9408SRobert Watson 
3149800c9408SRobert Watson 		/*
3150800c9408SRobert Watson 		 * Allow jailed processes to manipulate process UNIX
3151800c9408SRobert Watson 		 * credentials in any way they see fit.
3152800c9408SRobert Watson 		 */
3153800c9408SRobert Watson 	case PRIV_CRED_SETUID:
3154800c9408SRobert Watson 	case PRIV_CRED_SETEUID:
3155800c9408SRobert Watson 	case PRIV_CRED_SETGID:
3156800c9408SRobert Watson 	case PRIV_CRED_SETEGID:
3157800c9408SRobert Watson 	case PRIV_CRED_SETGROUPS:
3158800c9408SRobert Watson 	case PRIV_CRED_SETREUID:
3159800c9408SRobert Watson 	case PRIV_CRED_SETREGID:
3160800c9408SRobert Watson 	case PRIV_CRED_SETRESUID:
3161800c9408SRobert Watson 	case PRIV_CRED_SETRESGID:
3162800c9408SRobert Watson 
3163800c9408SRobert Watson 		/*
3164800c9408SRobert Watson 		 * Jail implements visibility constraints already, so allow
3165800c9408SRobert Watson 		 * jailed root to override uid/gid-based constraints.
3166800c9408SRobert Watson 		 */
3167800c9408SRobert Watson 	case PRIV_SEEOTHERGIDS:
3168800c9408SRobert Watson 	case PRIV_SEEOTHERUIDS:
3169800c9408SRobert Watson 
3170800c9408SRobert Watson 		/*
3171800c9408SRobert Watson 		 * Jail implements inter-process debugging limits already, so
3172800c9408SRobert Watson 		 * allow jailed root various debugging privileges.
3173800c9408SRobert Watson 		 */
3174800c9408SRobert Watson 	case PRIV_DEBUG_DIFFCRED:
3175800c9408SRobert Watson 	case PRIV_DEBUG_SUGID:
3176800c9408SRobert Watson 	case PRIV_DEBUG_UNPRIV:
3177800c9408SRobert Watson 
3178800c9408SRobert Watson 		/*
3179800c9408SRobert Watson 		 * Allow jail to set various resource limits and login
3180800c9408SRobert Watson 		 * properties, and for now, exceed process resource limits.
3181800c9408SRobert Watson 		 */
3182800c9408SRobert Watson 	case PRIV_PROC_LIMIT:
3183800c9408SRobert Watson 	case PRIV_PROC_SETLOGIN:
3184800c9408SRobert Watson 	case PRIV_PROC_SETRLIMIT:
3185800c9408SRobert Watson 
3186800c9408SRobert Watson 		/*
3187800c9408SRobert Watson 		 * System V and POSIX IPC privileges are granted in jail.
3188800c9408SRobert Watson 		 */
3189800c9408SRobert Watson 	case PRIV_IPC_READ:
3190800c9408SRobert Watson 	case PRIV_IPC_WRITE:
3191800c9408SRobert Watson 	case PRIV_IPC_ADMIN:
3192800c9408SRobert Watson 	case PRIV_IPC_MSGSIZE:
3193800c9408SRobert Watson 	case PRIV_MQ_ADMIN:
3194800c9408SRobert Watson 
3195800c9408SRobert Watson 		/*
31960304c731SJamie Gritton 		 * Jail operations within a jail work on child jails.
31970304c731SJamie Gritton 		 */
31980304c731SJamie Gritton 	case PRIV_JAIL_ATTACH:
31990304c731SJamie Gritton 	case PRIV_JAIL_SET:
32000304c731SJamie Gritton 	case PRIV_JAIL_REMOVE:
32010304c731SJamie Gritton 
32020304c731SJamie Gritton 		/*
3203800c9408SRobert Watson 		 * Jail implements its own inter-process limits, so allow
3204800c9408SRobert Watson 		 * root processes in jail to change scheduling on other
3205800c9408SRobert Watson 		 * processes in the same jail.  Likewise for signalling.
3206800c9408SRobert Watson 		 */
3207800c9408SRobert Watson 	case PRIV_SCHED_DIFFCRED:
3208413628a7SBjoern A. Zeeb 	case PRIV_SCHED_CPUSET:
3209800c9408SRobert Watson 	case PRIV_SIGNAL_DIFFCRED:
3210800c9408SRobert Watson 	case PRIV_SIGNAL_SUGID:
3211800c9408SRobert Watson 
3212800c9408SRobert Watson 		/*
3213800c9408SRobert Watson 		 * Allow jailed processes to write to sysctls marked as jail
3214800c9408SRobert Watson 		 * writable.
3215800c9408SRobert Watson 		 */
3216800c9408SRobert Watson 	case PRIV_SYSCTL_WRITEJAIL:
3217800c9408SRobert Watson 
3218800c9408SRobert Watson 		/*
3219800c9408SRobert Watson 		 * Allow root in jail to manage a variety of quota
3220e82d0201SRobert Watson 		 * properties.  These should likely be conditional on a
3221e82d0201SRobert Watson 		 * configuration option.
3222800c9408SRobert Watson 		 */
322395b091d2SRobert Watson 	case PRIV_VFS_GETQUOTA:
322495b091d2SRobert Watson 	case PRIV_VFS_SETQUOTA:
3225800c9408SRobert Watson 
3226800c9408SRobert Watson 		/*
3227800c9408SRobert Watson 		 * Since Jail relies on chroot() to implement file system
3228800c9408SRobert Watson 		 * protections, grant many VFS privileges to root in jail.
3229800c9408SRobert Watson 		 * Be careful to exclude mount-related and NFS-related
3230800c9408SRobert Watson 		 * privileges.
3231800c9408SRobert Watson 		 */
3232800c9408SRobert Watson 	case PRIV_VFS_READ:
3233800c9408SRobert Watson 	case PRIV_VFS_WRITE:
3234800c9408SRobert Watson 	case PRIV_VFS_ADMIN:
3235800c9408SRobert Watson 	case PRIV_VFS_EXEC:
3236800c9408SRobert Watson 	case PRIV_VFS_LOOKUP:
3237800c9408SRobert Watson 	case PRIV_VFS_BLOCKRESERVE:	/* XXXRW: Slightly surprising. */
3238800c9408SRobert Watson 	case PRIV_VFS_CHFLAGS_DEV:
3239800c9408SRobert Watson 	case PRIV_VFS_CHOWN:
3240800c9408SRobert Watson 	case PRIV_VFS_CHROOT:
3241bb531912SPawel Jakub Dawidek 	case PRIV_VFS_RETAINSUGID:
3242800c9408SRobert Watson 	case PRIV_VFS_FCHROOT:
3243800c9408SRobert Watson 	case PRIV_VFS_LINK:
3244800c9408SRobert Watson 	case PRIV_VFS_SETGID:
3245e41966dcSRobert Watson 	case PRIV_VFS_STAT:
3246800c9408SRobert Watson 	case PRIV_VFS_STICKYFILE:
3247bb56d716SJamie Gritton 
3248bb56d716SJamie Gritton 		/*
3249bb56d716SJamie Gritton 		 * As in the non-jail case, non-root users are expected to be
3250bb56d716SJamie Gritton 		 * able to read kernel/phyiscal memory (provided /dev/[k]mem
3251bb56d716SJamie Gritton 		 * exists in the jail and they have permission to access it).
3252bb56d716SJamie Gritton 		 */
3253bb56d716SJamie Gritton 	case PRIV_KMEM_READ:
3254800c9408SRobert Watson 		return (0);
3255800c9408SRobert Watson 
3256800c9408SRobert Watson 		/*
3257800c9408SRobert Watson 		 * Depending on the global setting, allow privilege of
3258800c9408SRobert Watson 		 * setting system flags.
3259800c9408SRobert Watson 		 */
3260800c9408SRobert Watson 	case PRIV_VFS_SYSFLAGS:
32610304c731SJamie Gritton 		if (cred->cr_prison->pr_allow & PR_ALLOW_CHFLAGS)
3262800c9408SRobert Watson 			return (0);
3263800c9408SRobert Watson 		else
3264800c9408SRobert Watson 			return (EPERM);
3265800c9408SRobert Watson 
3266800c9408SRobert Watson 		/*
3267f3a8d2f9SPawel Jakub Dawidek 		 * Depending on the global setting, allow privilege of
3268f3a8d2f9SPawel Jakub Dawidek 		 * mounting/unmounting file systems.
3269f3a8d2f9SPawel Jakub Dawidek 		 */
3270f3a8d2f9SPawel Jakub Dawidek 	case PRIV_VFS_MOUNT:
3271f3a8d2f9SPawel Jakub Dawidek 	case PRIV_VFS_UNMOUNT:
3272f3a8d2f9SPawel Jakub Dawidek 	case PRIV_VFS_MOUNT_NONUSER:
327324b0502eSPawel Jakub Dawidek 	case PRIV_VFS_MOUNT_OWNER:
3274435d4667SMartin Matuska 		if (cred->cr_prison->pr_allow & PR_ALLOW_MOUNT &&
3275435d4667SMartin Matuska 		    cred->cr_prison->pr_enforce_statfs < 2)
3276f3a8d2f9SPawel Jakub Dawidek 			return (0);
3277f3a8d2f9SPawel Jakub Dawidek 		else
3278f3a8d2f9SPawel Jakub Dawidek 			return (EPERM);
3279f3a8d2f9SPawel Jakub Dawidek 
3280f3a8d2f9SPawel Jakub Dawidek 		/*
3281ccd6ac9fSAntoine Brodin 		 * Conditionnaly allow locking (unlocking) physical pages
3282ccd6ac9fSAntoine Brodin 		 * in memory.
3283ccd6ac9fSAntoine Brodin 		 */
3284ccd6ac9fSAntoine Brodin 	case PRIV_VM_MLOCK:
3285ccd6ac9fSAntoine Brodin 	case PRIV_VM_MUNLOCK:
3286ccd6ac9fSAntoine Brodin 		if (cred->cr_prison->pr_allow & PR_ALLOW_MLOCK)
3287ccd6ac9fSAntoine Brodin 			return (0);
3288ccd6ac9fSAntoine Brodin 		else
3289ccd6ac9fSAntoine Brodin 			return (EPERM);
3290ccd6ac9fSAntoine Brodin 
3291ccd6ac9fSAntoine Brodin 		/*
3292e28f9b7dSAllan Jude 		 * Conditionally allow jailed root to bind reserved ports.
3293800c9408SRobert Watson 		 */
3294800c9408SRobert Watson 	case PRIV_NETINET_RESERVEDPORT:
3295e28f9b7dSAllan Jude 		if (cred->cr_prison->pr_allow & PR_ALLOW_RESERVED_PORTS)
3296e28f9b7dSAllan Jude 			return (0);
3297e28f9b7dSAllan Jude 		else
3298e28f9b7dSAllan Jude 			return (EPERM);
3299e28f9b7dSAllan Jude 
3300e28f9b7dSAllan Jude 		/*
3301e28f9b7dSAllan Jude 		 * Allow jailed root to reuse in-use ports.
3302e28f9b7dSAllan Jude 		 */
33034b084056SRobert Watson 	case PRIV_NETINET_REUSEPORT:
3304800c9408SRobert Watson 		return (0);
3305800c9408SRobert Watson 
3306800c9408SRobert Watson 		/*
3307e3043798SPedro F. Giffuni 		 * Allow jailed root to set certain IPv4/6 (option) headers.
330879ba3952SBjoern A. Zeeb 		 */
330979ba3952SBjoern A. Zeeb 	case PRIV_NETINET_SETHDROPTS:
331079ba3952SBjoern A. Zeeb 		return (0);
331179ba3952SBjoern A. Zeeb 
331279ba3952SBjoern A. Zeeb 		/*
3313800c9408SRobert Watson 		 * Conditionally allow creating raw sockets in jail.
3314800c9408SRobert Watson 		 */
3315800c9408SRobert Watson 	case PRIV_NETINET_RAW:
33160304c731SJamie Gritton 		if (cred->cr_prison->pr_allow & PR_ALLOW_RAW_SOCKETS)
3317800c9408SRobert Watson 			return (0);
3318800c9408SRobert Watson 		else
3319800c9408SRobert Watson 			return (EPERM);
3320800c9408SRobert Watson 
3321800c9408SRobert Watson 		/*
3322800c9408SRobert Watson 		 * Since jail implements its own visibility limits on netstat
3323800c9408SRobert Watson 		 * sysctls, allow getcred.  This allows identd to work in
3324800c9408SRobert Watson 		 * jail.
3325800c9408SRobert Watson 		 */
3326800c9408SRobert Watson 	case PRIV_NETINET_GETCRED:
3327800c9408SRobert Watson 		return (0);
3328800c9408SRobert Watson 
33292bfc50bcSEdward Tomasz Napierala 		/*
33302bfc50bcSEdward Tomasz Napierala 		 * Allow jailed root to set loginclass.
33312bfc50bcSEdward Tomasz Napierala 		 */
33322bfc50bcSEdward Tomasz Napierala 	case PRIV_PROC_SETLOGINCLASS:
33332bfc50bcSEdward Tomasz Napierala 		return (0);
33342bfc50bcSEdward Tomasz Napierala 
3335b19d66fdSJamie Gritton 		/*
33364520f617SJamie Gritton 		 * Do not allow a process inside a jail to read the kernel
3337b19d66fdSJamie Gritton 		 * message buffer unless explicitly permitted.
3338b19d66fdSJamie Gritton 		 */
3339b19d66fdSJamie Gritton 	case PRIV_MSGBUF:
3340b19d66fdSJamie Gritton 		if (cred->cr_prison->pr_allow & PR_ALLOW_READ_MSGBUF)
3341b19d66fdSJamie Gritton 			return (0);
3342b19d66fdSJamie Gritton 		return (EPERM);
3343b19d66fdSJamie Gritton 
3344800c9408SRobert Watson 	default:
3345800c9408SRobert Watson 		/*
3346800c9408SRobert Watson 		 * In all remaining cases, deny the privilege request.  This
3347800c9408SRobert Watson 		 * includes almost all network privileges, many system
3348800c9408SRobert Watson 		 * configuration privileges.
3349800c9408SRobert Watson 		 */
3350800c9408SRobert Watson 		return (EPERM);
3351800c9408SRobert Watson 	}
3352800c9408SRobert Watson }
3353800c9408SRobert Watson 
33540304c731SJamie Gritton /*
33550304c731SJamie Gritton  * Return the part of pr2's name that is relative to pr1, or the whole name
33560304c731SJamie Gritton  * if it does not directly follow.
33570304c731SJamie Gritton  */
33580304c731SJamie Gritton 
33590304c731SJamie Gritton char *
33600304c731SJamie Gritton prison_name(struct prison *pr1, struct prison *pr2)
33610304c731SJamie Gritton {
33620304c731SJamie Gritton 	char *name;
33630304c731SJamie Gritton 
33640304c731SJamie Gritton 	/* Jails see themselves as "0" (if they see themselves at all). */
33650304c731SJamie Gritton 	if (pr1 == pr2)
33660304c731SJamie Gritton 		return "0";
33670304c731SJamie Gritton 	name = pr2->pr_name;
33680304c731SJamie Gritton 	if (prison_ischild(pr1, pr2)) {
33690304c731SJamie Gritton 		/*
33700304c731SJamie Gritton 		 * pr1 isn't locked (and allprison_lock may not be either)
33710304c731SJamie Gritton 		 * so its length can't be counted on.  But the number of dots
33720304c731SJamie Gritton 		 * can be counted on - and counted.
33730304c731SJamie Gritton 		 */
33740304c731SJamie Gritton 		for (; pr1 != &prison0; pr1 = pr1->pr_parent)
33750304c731SJamie Gritton 			name = strchr(name, '.') + 1;
33760304c731SJamie Gritton 	}
33770304c731SJamie Gritton 	return (name);
33780304c731SJamie Gritton }
33790304c731SJamie Gritton 
33800304c731SJamie Gritton /*
33810304c731SJamie Gritton  * Return the part of pr2's path that is relative to pr1, or the whole path
33820304c731SJamie Gritton  * if it does not directly follow.
33830304c731SJamie Gritton  */
33840304c731SJamie Gritton static char *
33850304c731SJamie Gritton prison_path(struct prison *pr1, struct prison *pr2)
33860304c731SJamie Gritton {
33870304c731SJamie Gritton 	char *path1, *path2;
33880304c731SJamie Gritton 	int len1;
33890304c731SJamie Gritton 
33900304c731SJamie Gritton 	path1 = pr1->pr_path;
33910304c731SJamie Gritton 	path2 = pr2->pr_path;
33920304c731SJamie Gritton 	if (!strcmp(path1, "/"))
33930304c731SJamie Gritton 		return (path2);
33940304c731SJamie Gritton 	len1 = strlen(path1);
33950304c731SJamie Gritton 	if (strncmp(path1, path2, len1))
33960304c731SJamie Gritton 		return (path2);
33970304c731SJamie Gritton 	if (path2[len1] == '\0')
33980304c731SJamie Gritton 		return "/";
33990304c731SJamie Gritton 	if (path2[len1] == '/')
34000304c731SJamie Gritton 		return (path2 + len1);
34010304c731SJamie Gritton 	return (path2);
34020304c731SJamie Gritton }
34030304c731SJamie Gritton 
34040304c731SJamie Gritton /*
34050304c731SJamie Gritton  * Jail-related sysctls.
34060304c731SJamie Gritton  */
3407*7029da5cSPawel Biernacki static SYSCTL_NODE(_security, OID_AUTO, jail, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
34080304c731SJamie Gritton     "Jails");
34090304c731SJamie Gritton 
3410fd7a8150SMike Barcroft static int
3411fd7a8150SMike Barcroft sysctl_jail_list(SYSCTL_HANDLER_ARGS)
3412fd7a8150SMike Barcroft {
3413b38ff370SJamie Gritton 	struct xprison *xp;
34140304c731SJamie Gritton 	struct prison *pr, *cpr;
3415b38ff370SJamie Gritton #ifdef INET
3416b38ff370SJamie Gritton 	struct in_addr *ip4 = NULL;
3417b38ff370SJamie Gritton 	int ip4s = 0;
3418b38ff370SJamie Gritton #endif
3419b38ff370SJamie Gritton #ifdef INET6
34203beefaedSColin Percival 	struct in6_addr *ip6 = NULL;
3421b38ff370SJamie Gritton 	int ip6s = 0;
3422b38ff370SJamie Gritton #endif
34230304c731SJamie Gritton 	int descend, error;
3424fd7a8150SMike Barcroft 
3425b38ff370SJamie Gritton 	xp = malloc(sizeof(*xp), M_TEMP, M_WAITOK);
34260304c731SJamie Gritton 	pr = req->td->td_ucred->cr_prison;
3427b38ff370SJamie Gritton 	error = 0;
3428dc68a633SPawel Jakub Dawidek 	sx_slock(&allprison_lock);
34290304c731SJamie Gritton 	FOREACH_PRISON_DESCENDANT(pr, cpr, descend) {
34300304c731SJamie Gritton #if defined(INET) || defined(INET6)
3431b38ff370SJamie Gritton  again:
34320304c731SJamie Gritton #endif
34330304c731SJamie Gritton 		mtx_lock(&cpr->pr_mtx);
3434413628a7SBjoern A. Zeeb #ifdef INET
34350304c731SJamie Gritton 		if (cpr->pr_ip4s > 0) {
34360304c731SJamie Gritton 			if (ip4s < cpr->pr_ip4s) {
34370304c731SJamie Gritton 				ip4s = cpr->pr_ip4s;
34380304c731SJamie Gritton 				mtx_unlock(&cpr->pr_mtx);
3439b38ff370SJamie Gritton 				ip4 = realloc(ip4, ip4s *
3440b38ff370SJamie Gritton 				    sizeof(struct in_addr), M_TEMP, M_WAITOK);
3441b38ff370SJamie Gritton 				goto again;
3442b38ff370SJamie Gritton 			}
34430304c731SJamie Gritton 			bcopy(cpr->pr_ip4, ip4,
34440304c731SJamie Gritton 			    cpr->pr_ip4s * sizeof(struct in_addr));
3445b38ff370SJamie Gritton 		}
3446413628a7SBjoern A. Zeeb #endif
3447413628a7SBjoern A. Zeeb #ifdef INET6
34480304c731SJamie Gritton 		if (cpr->pr_ip6s > 0) {
34490304c731SJamie Gritton 			if (ip6s < cpr->pr_ip6s) {
34500304c731SJamie Gritton 				ip6s = cpr->pr_ip6s;
34510304c731SJamie Gritton 				mtx_unlock(&cpr->pr_mtx);
3452b38ff370SJamie Gritton 				ip6 = realloc(ip6, ip6s *
3453b38ff370SJamie Gritton 				    sizeof(struct in6_addr), M_TEMP, M_WAITOK);
3454b38ff370SJamie Gritton 				goto again;
3455413628a7SBjoern A. Zeeb 			}
34560304c731SJamie Gritton 			bcopy(cpr->pr_ip6, ip6,
34570304c731SJamie Gritton 			    cpr->pr_ip6s * sizeof(struct in6_addr));
3458b38ff370SJamie Gritton 		}
3459b38ff370SJamie Gritton #endif
34600304c731SJamie Gritton 		if (cpr->pr_ref == 0) {
34610304c731SJamie Gritton 			mtx_unlock(&cpr->pr_mtx);
3462b38ff370SJamie Gritton 			continue;
3463b38ff370SJamie Gritton 		}
3464b38ff370SJamie Gritton 		bzero(xp, sizeof(*xp));
3465fd7a8150SMike Barcroft 		xp->pr_version = XPRISON_VERSION;
34660304c731SJamie Gritton 		xp->pr_id = cpr->pr_id;
34670304c731SJamie Gritton 		xp->pr_state = cpr->pr_uref > 0
3468b38ff370SJamie Gritton 		    ? PRISON_STATE_ALIVE : PRISON_STATE_DYING;
34690304c731SJamie Gritton 		strlcpy(xp->pr_path, prison_path(pr, cpr), sizeof(xp->pr_path));
3470c1f19219SJamie Gritton 		strlcpy(xp->pr_host, cpr->pr_hostname, sizeof(xp->pr_host));
34710304c731SJamie Gritton 		strlcpy(xp->pr_name, prison_name(pr, cpr), sizeof(xp->pr_name));
3472413628a7SBjoern A. Zeeb #ifdef INET
34730304c731SJamie Gritton 		xp->pr_ip4s = cpr->pr_ip4s;
3474413628a7SBjoern A. Zeeb #endif
3475413628a7SBjoern A. Zeeb #ifdef INET6
34760304c731SJamie Gritton 		xp->pr_ip6s = cpr->pr_ip6s;
3477413628a7SBjoern A. Zeeb #endif
34780304c731SJamie Gritton 		mtx_unlock(&cpr->pr_mtx);
3479b38ff370SJamie Gritton 		error = SYSCTL_OUT(req, xp, sizeof(*xp));
3480b38ff370SJamie Gritton 		if (error)
3481b38ff370SJamie Gritton 			break;
3482413628a7SBjoern A. Zeeb #ifdef INET
3483b38ff370SJamie Gritton 		if (xp->pr_ip4s > 0) {
3484b38ff370SJamie Gritton 			error = SYSCTL_OUT(req, ip4,
3485b38ff370SJamie Gritton 			    xp->pr_ip4s * sizeof(struct in_addr));
3486b38ff370SJamie Gritton 			if (error)
3487b38ff370SJamie Gritton 				break;
3488413628a7SBjoern A. Zeeb 		}
3489413628a7SBjoern A. Zeeb #endif
3490413628a7SBjoern A. Zeeb #ifdef INET6
3491b38ff370SJamie Gritton 		if (xp->pr_ip6s > 0) {
3492b38ff370SJamie Gritton 			error = SYSCTL_OUT(req, ip6,
3493b38ff370SJamie Gritton 			    xp->pr_ip6s * sizeof(struct in6_addr));
3494b38ff370SJamie Gritton 			if (error)
3495b38ff370SJamie Gritton 				break;
3496413628a7SBjoern A. Zeeb 		}
3497413628a7SBjoern A. Zeeb #endif
3498fd7a8150SMike Barcroft 	}
3499dc68a633SPawel Jakub Dawidek 	sx_sunlock(&allprison_lock);
3500b38ff370SJamie Gritton 	free(xp, M_TEMP);
3501b38ff370SJamie Gritton #ifdef INET
3502b38ff370SJamie Gritton 	free(ip4, M_TEMP);
3503b38ff370SJamie Gritton #endif
3504b38ff370SJamie Gritton #ifdef INET6
3505b38ff370SJamie Gritton 	free(ip6, M_TEMP);
3506b38ff370SJamie Gritton #endif
3507fd7a8150SMike Barcroft 	return (error);
3508fd7a8150SMike Barcroft }
3509fd7a8150SMike Barcroft 
3510f3b86a5fSEd Schouten SYSCTL_OID(_security_jail, OID_AUTO, list,
3511f3b86a5fSEd Schouten     CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
3512f3b86a5fSEd Schouten     sysctl_jail_list, "S", "List of active jails");
3513461167c2SPawel Jakub Dawidek 
3514461167c2SPawel Jakub Dawidek static int
3515461167c2SPawel Jakub Dawidek sysctl_jail_jailed(SYSCTL_HANDLER_ARGS)
3516461167c2SPawel Jakub Dawidek {
3517461167c2SPawel Jakub Dawidek 	int error, injail;
3518461167c2SPawel Jakub Dawidek 
3519461167c2SPawel Jakub Dawidek 	injail = jailed(req->td->td_ucred);
3520461167c2SPawel Jakub Dawidek 	error = SYSCTL_OUT(req, &injail, sizeof(injail));
3521461167c2SPawel Jakub Dawidek 
3522461167c2SPawel Jakub Dawidek 	return (error);
3523461167c2SPawel Jakub Dawidek }
35240304c731SJamie Gritton 
3525f3b86a5fSEd Schouten SYSCTL_PROC(_security_jail, OID_AUTO, jailed,
3526f3b86a5fSEd Schouten     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
3527f3b86a5fSEd Schouten     sysctl_jail_jailed, "I", "Process in jail?");
3528413628a7SBjoern A. Zeeb 
3529761d2bb5SJamie Gritton static int
3530761d2bb5SJamie Gritton sysctl_jail_vnet(SYSCTL_HANDLER_ARGS)
3531761d2bb5SJamie Gritton {
3532761d2bb5SJamie Gritton 	int error, havevnet;
3533761d2bb5SJamie Gritton #ifdef VIMAGE
3534761d2bb5SJamie Gritton 	struct ucred *cred = req->td->td_ucred;
3535761d2bb5SJamie Gritton 
3536761d2bb5SJamie Gritton 	havevnet = jailed(cred) && prison_owns_vnet(cred);
3537761d2bb5SJamie Gritton #else
3538761d2bb5SJamie Gritton 	havevnet = 0;
3539761d2bb5SJamie Gritton #endif
3540761d2bb5SJamie Gritton 	error = SYSCTL_OUT(req, &havevnet, sizeof(havevnet));
3541761d2bb5SJamie Gritton 
3542761d2bb5SJamie Gritton 	return (error);
3543761d2bb5SJamie Gritton }
3544761d2bb5SJamie Gritton 
3545761d2bb5SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, vnet,
3546761d2bb5SJamie Gritton     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
3547bb8f1623SBjoern A. Zeeb     sysctl_jail_vnet, "I", "Jail owns vnet?");
3548761d2bb5SJamie Gritton 
35490304c731SJamie Gritton #if defined(INET) || defined(INET6)
3550e92e0574SJamie Gritton SYSCTL_UINT(_security_jail, OID_AUTO, jail_max_af_ips, CTLFLAG_RW,
35510304c731SJamie Gritton     &jail_max_af_ips, 0,
3552c542c43eSJamie Gritton     "Number of IP addresses a jail may have at most per address family (deprecated)");
35530304c731SJamie Gritton #endif
35540304c731SJamie Gritton 
35550304c731SJamie Gritton /*
3556c542c43eSJamie Gritton  * Default parameters for jail(2) compatibility.  For historical reasons,
3557c542c43eSJamie Gritton  * the sysctl names have varying similarity to the parameter names.  Prisons
3558c542c43eSJamie Gritton  * just see their own parameters, and can't change them.
35590304c731SJamie Gritton  */
35600304c731SJamie Gritton static int
35610304c731SJamie Gritton sysctl_jail_default_allow(SYSCTL_HANDLER_ARGS)
35620304c731SJamie Gritton {
35630304c731SJamie Gritton 	struct prison *pr;
35640304c731SJamie Gritton 	int allow, error, i;
35650304c731SJamie Gritton 
35660304c731SJamie Gritton 	pr = req->td->td_ucred->cr_prison;
35670304c731SJamie Gritton 	allow = (pr == &prison0) ? jail_default_allow : pr->pr_allow;
35680304c731SJamie Gritton 
35690304c731SJamie Gritton 	/* Get the current flag value, and convert it to a boolean. */
35700304c731SJamie Gritton 	i = (allow & arg2) ? 1 : 0;
35710304c731SJamie Gritton 	if (arg1 != NULL)
35720304c731SJamie Gritton 		i = !i;
35730304c731SJamie Gritton 	error = sysctl_handle_int(oidp, &i, 0, req);
3574c542c43eSJamie Gritton 	if (error || !req->newptr)
35750304c731SJamie Gritton 		return (error);
35760304c731SJamie Gritton 	i = i ? arg2 : 0;
35770304c731SJamie Gritton 	if (arg1 != NULL)
35780304c731SJamie Gritton 		i ^= arg2;
35790304c731SJamie Gritton 	/*
35800304c731SJamie Gritton 	 * The sysctls don't have CTLFLAGS_PRISON, so assume prison0
35810304c731SJamie Gritton 	 * for writing.
35820304c731SJamie Gritton 	 */
35830304c731SJamie Gritton 	mtx_lock(&prison0.pr_mtx);
35840304c731SJamie Gritton 	jail_default_allow = (jail_default_allow & ~arg2) | i;
35850304c731SJamie Gritton 	mtx_unlock(&prison0.pr_mtx);
35860304c731SJamie Gritton 	return (0);
35870304c731SJamie Gritton }
35880304c731SJamie Gritton 
35890304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, set_hostname_allowed,
3590c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
35910304c731SJamie Gritton     NULL, PR_ALLOW_SET_HOSTNAME, sysctl_jail_default_allow, "I",
3592c542c43eSJamie Gritton     "Processes in jail can set their hostnames (deprecated)");
35930304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, socket_unixiproute_only,
3594c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
35950304c731SJamie Gritton     (void *)1, PR_ALLOW_SOCKET_AF, sysctl_jail_default_allow, "I",
3596c542c43eSJamie Gritton     "Processes in jail are limited to creating UNIX/IP/route sockets only (deprecated)");
35970304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, sysvipc_allowed,
3598c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
35990304c731SJamie Gritton     NULL, PR_ALLOW_SYSVIPC, sysctl_jail_default_allow, "I",
3600c542c43eSJamie Gritton     "Processes in jail can use System V IPC primitives (deprecated)");
36010304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, allow_raw_sockets,
3602c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
36030304c731SJamie Gritton     NULL, PR_ALLOW_RAW_SOCKETS, sysctl_jail_default_allow, "I",
3604c542c43eSJamie Gritton     "Prison root can create raw sockets (deprecated)");
36050304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, chflags_allowed,
3606c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
36070304c731SJamie Gritton     NULL, PR_ALLOW_CHFLAGS, sysctl_jail_default_allow, "I",
3608c542c43eSJamie Gritton     "Processes in jail can alter system file flags (deprecated)");
36090304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, mount_allowed,
3610c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
36110304c731SJamie Gritton     NULL, PR_ALLOW_MOUNT, sysctl_jail_default_allow, "I",
3612c542c43eSJamie Gritton     "Processes in jail can mount/unmount jail-friendly file systems (deprecated)");
36130304c731SJamie Gritton 
36140304c731SJamie Gritton static int
36150304c731SJamie Gritton sysctl_jail_default_level(SYSCTL_HANDLER_ARGS)
36160304c731SJamie Gritton {
36170304c731SJamie Gritton 	struct prison *pr;
36180304c731SJamie Gritton 	int level, error;
36190304c731SJamie Gritton 
36200304c731SJamie Gritton 	pr = req->td->td_ucred->cr_prison;
36210304c731SJamie Gritton 	level = (pr == &prison0) ? *(int *)arg1 : *(int *)((char *)pr + arg2);
36220304c731SJamie Gritton 	error = sysctl_handle_int(oidp, &level, 0, req);
3623c542c43eSJamie Gritton 	if (error || !req->newptr)
36240304c731SJamie Gritton 		return (error);
36250304c731SJamie Gritton 	*(int *)arg1 = level;
36260304c731SJamie Gritton 	return (0);
36270304c731SJamie Gritton }
36280304c731SJamie Gritton 
36290304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, enforce_statfs,
3630c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
3631c542c43eSJamie Gritton     &jail_default_enforce_statfs, offsetof(struct prison, pr_enforce_statfs),
36320304c731SJamie Gritton     sysctl_jail_default_level, "I",
3633c542c43eSJamie Gritton     "Processes in jail cannot see all mounted file systems (deprecated)");
3634c542c43eSJamie Gritton 
36350cc207a6SMartin Matuska SYSCTL_PROC(_security_jail, OID_AUTO, devfs_ruleset,
3636c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE,
3637c542c43eSJamie Gritton     &jail_default_devfs_rsnum, offsetof(struct prison, pr_devfs_rsnum),
36380cc207a6SMartin Matuska     sysctl_jail_default_level, "I",
3639c542c43eSJamie Gritton     "Ruleset for the devfs filesystem in jail (deprecated)");
36400cc207a6SMartin Matuska 
36410304c731SJamie Gritton /*
36420304c731SJamie Gritton  * Nodes to describe jail parameters.  Maximum length of string parameters
36430304c731SJamie Gritton  * is returned in the string itself, and the other parameters exist merely
36440304c731SJamie Gritton  * to make themselves and their types known.
36450304c731SJamie Gritton  */
3646*7029da5cSPawel Biernacki SYSCTL_NODE(_security_jail, OID_AUTO, param, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
36470304c731SJamie Gritton     "Jail parameters");
36480304c731SJamie Gritton 
36490304c731SJamie Gritton int
36500304c731SJamie Gritton sysctl_jail_param(SYSCTL_HANDLER_ARGS)
36510304c731SJamie Gritton {
36520304c731SJamie Gritton 	int i;
36530304c731SJamie Gritton 	long l;
36540304c731SJamie Gritton 	size_t s;
36550304c731SJamie Gritton 	char numbuf[12];
36560304c731SJamie Gritton 
36570304c731SJamie Gritton 	switch (oidp->oid_kind & CTLTYPE)
36580304c731SJamie Gritton 	{
36590304c731SJamie Gritton 	case CTLTYPE_LONG:
36600304c731SJamie Gritton 	case CTLTYPE_ULONG:
36610304c731SJamie Gritton 		l = 0;
36620304c731SJamie Gritton #ifdef SCTL_MASK32
36630304c731SJamie Gritton 		if (!(req->flags & SCTL_MASK32))
36640304c731SJamie Gritton #endif
36650304c731SJamie Gritton 			return (SYSCTL_OUT(req, &l, sizeof(l)));
36660304c731SJamie Gritton 	case CTLTYPE_INT:
36670304c731SJamie Gritton 	case CTLTYPE_UINT:
36680304c731SJamie Gritton 		i = 0;
36690304c731SJamie Gritton 		return (SYSCTL_OUT(req, &i, sizeof(i)));
36700304c731SJamie Gritton 	case CTLTYPE_STRING:
3671e4cd31ddSJeff Roberson 		snprintf(numbuf, sizeof(numbuf), "%jd", (intmax_t)arg2);
36720304c731SJamie Gritton 		return
36730304c731SJamie Gritton 		    (sysctl_handle_string(oidp, numbuf, sizeof(numbuf), req));
36740304c731SJamie Gritton 	case CTLTYPE_STRUCT:
36750304c731SJamie Gritton 		s = (size_t)arg2;
36760304c731SJamie Gritton 		return (SYSCTL_OUT(req, &s, sizeof(s)));
36770304c731SJamie Gritton 	}
36780304c731SJamie Gritton 	return (0);
36790304c731SJamie Gritton }
36800304c731SJamie Gritton 
3681b96bd95bSIan Lepore /*
3682b96bd95bSIan Lepore  * CTLFLAG_RDTUN in the following indicates jail parameters that can be set at
3683b96bd95bSIan Lepore  * jail creation time but cannot be changed in an existing jail.
3684b96bd95bSIan Lepore  */
36850304c731SJamie Gritton SYSCTL_JAIL_PARAM(, jid, CTLTYPE_INT | CTLFLAG_RDTUN, "I", "Jail ID");
36860304c731SJamie Gritton SYSCTL_JAIL_PARAM(, parent, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail parent ID");
36870304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(, name, CTLFLAG_RW, MAXHOSTNAMELEN, "Jail name");
36880304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(, path, CTLFLAG_RDTUN, MAXPATHLEN, "Jail root path");
36890304c731SJamie Gritton SYSCTL_JAIL_PARAM(, securelevel, CTLTYPE_INT | CTLFLAG_RW,
36900304c731SJamie Gritton     "I", "Jail secure level");
3691b96bd95bSIan Lepore SYSCTL_JAIL_PARAM(, osreldate, CTLTYPE_INT | CTLFLAG_RDTUN, "I",
3692b96bd95bSIan Lepore     "Jail value for kern.osreldate and uname -K");
3693b96bd95bSIan Lepore SYSCTL_JAIL_PARAM_STRING(, osrelease, CTLFLAG_RDTUN, OSRELEASELEN,
3694b96bd95bSIan Lepore     "Jail value for kern.osrelease and uname -r");
36950304c731SJamie Gritton SYSCTL_JAIL_PARAM(, enforce_statfs, CTLTYPE_INT | CTLFLAG_RW,
36960304c731SJamie Gritton     "I", "Jail cannot see all mounted file systems");
36970cc207a6SMartin Matuska SYSCTL_JAIL_PARAM(, devfs_ruleset, CTLTYPE_INT | CTLFLAG_RW,
36980cc207a6SMartin Matuska     "I", "Ruleset for in-jail devfs mounts");
36990304c731SJamie Gritton SYSCTL_JAIL_PARAM(, persist, CTLTYPE_INT | CTLFLAG_RW,
37000304c731SJamie Gritton     "B", "Jail persistence");
3701679e1390SJamie Gritton #ifdef VIMAGE
3702679e1390SJamie Gritton SYSCTL_JAIL_PARAM(, vnet, CTLTYPE_INT | CTLFLAG_RDTUN,
37037cbf7213SJamie Gritton     "E,jailsys", "Virtual network stack");
3704679e1390SJamie Gritton #endif
37050304c731SJamie Gritton SYSCTL_JAIL_PARAM(, dying, CTLTYPE_INT | CTLFLAG_RD,
37060304c731SJamie Gritton     "B", "Jail is in the process of shutting down");
37070304c731SJamie Gritton 
3708b97457e2SJamie Gritton SYSCTL_JAIL_PARAM_NODE(children, "Number of child jails");
3709b97457e2SJamie Gritton SYSCTL_JAIL_PARAM(_children, cur, CTLTYPE_INT | CTLFLAG_RD,
3710b97457e2SJamie Gritton     "I", "Current number of child jails");
3711b97457e2SJamie Gritton SYSCTL_JAIL_PARAM(_children, max, CTLTYPE_INT | CTLFLAG_RW,
3712b97457e2SJamie Gritton     "I", "Maximum number of child jails");
3713b97457e2SJamie Gritton 
37147cbf7213SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(host, CTLFLAG_RW, "Jail host info");
37150304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, hostname, CTLFLAG_RW, MAXHOSTNAMELEN,
37160304c731SJamie Gritton     "Jail hostname");
371776ca6f88SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, domainname, CTLFLAG_RW, MAXHOSTNAMELEN,
371876ca6f88SJamie Gritton     "Jail NIS domainname");
371976ca6f88SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, hostuuid, CTLFLAG_RW, HOSTUUIDLEN,
372076ca6f88SJamie Gritton     "Jail host UUID");
372176ca6f88SJamie Gritton SYSCTL_JAIL_PARAM(_host, hostid, CTLTYPE_ULONG | CTLFLAG_RW,
372276ca6f88SJamie Gritton     "LU", "Jail host ID");
37230304c731SJamie Gritton 
37240304c731SJamie Gritton SYSCTL_JAIL_PARAM_NODE(cpuset, "Jail cpuset");
37250304c731SJamie Gritton SYSCTL_JAIL_PARAM(_cpuset, id, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail cpuset ID");
37260304c731SJamie Gritton 
37270304c731SJamie Gritton #ifdef INET
37282b0d6f81SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(ip4, CTLFLAG_RDTUN,
37292b0d6f81SJamie Gritton     "Jail IPv4 address virtualization");
37300304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRUCT(_ip4, addr, CTLFLAG_RW, sizeof(struct in_addr),
37310304c731SJamie Gritton     "S,in_addr,a", "Jail IPv4 addresses");
3732592bcae8SBjoern A. Zeeb SYSCTL_JAIL_PARAM(_ip4, saddrsel, CTLTYPE_INT | CTLFLAG_RW,
3733592bcae8SBjoern A. Zeeb     "B", "Do (not) use IPv4 source address selection rather than the "
3734592bcae8SBjoern A. Zeeb     "primary jail IPv4 address.");
37350304c731SJamie Gritton #endif
37360304c731SJamie Gritton #ifdef INET6
37372b0d6f81SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(ip6, CTLFLAG_RDTUN,
37382b0d6f81SJamie Gritton     "Jail IPv6 address virtualization");
37390304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRUCT(_ip6, addr, CTLFLAG_RW, sizeof(struct in6_addr),
37400304c731SJamie Gritton     "S,in6_addr,a", "Jail IPv6 addresses");
3741592bcae8SBjoern A. Zeeb SYSCTL_JAIL_PARAM(_ip6, saddrsel, CTLTYPE_INT | CTLFLAG_RW,
3742592bcae8SBjoern A. Zeeb     "B", "Do (not) use IPv6 source address selection rather than the "
3743592bcae8SBjoern A. Zeeb     "primary jail IPv6 address.");
37440304c731SJamie Gritton #endif
37450304c731SJamie Gritton 
37460304c731SJamie Gritton SYSCTL_JAIL_PARAM_NODE(allow, "Jail permission flags");
37470304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, set_hostname, CTLTYPE_INT | CTLFLAG_RW,
37480304c731SJamie Gritton     "B", "Jail may set hostname");
37490304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, sysvipc, CTLTYPE_INT | CTLFLAG_RW,
37500304c731SJamie Gritton     "B", "Jail may use SYSV IPC");
37510304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, raw_sockets, CTLTYPE_INT | CTLFLAG_RW,
37520304c731SJamie Gritton     "B", "Jail may create raw sockets");
37530304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, chflags, CTLTYPE_INT | CTLFLAG_RW,
37540304c731SJamie Gritton     "B", "Jail may alter system file flags");
37550304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, quotas, CTLTYPE_INT | CTLFLAG_RW,
37560304c731SJamie Gritton     "B", "Jail may set file quotas");
37570304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, socket_af, CTLTYPE_INT | CTLFLAG_RW,
37580304c731SJamie Gritton     "B", "Jail may create sockets other than just UNIX/IPv4/IPv6/route");
3759ccd6ac9fSAntoine Brodin SYSCTL_JAIL_PARAM(_allow, mlock, CTLTYPE_INT | CTLFLAG_RW,
3760ccd6ac9fSAntoine Brodin     "B", "Jail may lock (unlock) physical pages in memory");
3761e28f9b7dSAllan Jude SYSCTL_JAIL_PARAM(_allow, reserved_ports, CTLTYPE_INT | CTLFLAG_RW,
3762e28f9b7dSAllan Jude     "B", "Jail may bind sockets to reserved ports");
3763b19d66fdSJamie Gritton SYSCTL_JAIL_PARAM(_allow, read_msgbuf, CTLTYPE_INT | CTLFLAG_RW,
3764b19d66fdSJamie Gritton     "B", "Jail may read the kernel message buffer");
3765b3079544SJamie Gritton SYSCTL_JAIL_PARAM(_allow, unprivileged_proc_debug, CTLTYPE_INT | CTLFLAG_RW,
3766b3079544SJamie Gritton     "B", "Unprivileged processes may use process debugging facilities");
37670304c731SJamie Gritton 
3768bf3db8aaSMartin Matuska SYSCTL_JAIL_PARAM_SUBNODE(allow, mount, "Jail mount/unmount permission flags");
3769bf3db8aaSMartin Matuska SYSCTL_JAIL_PARAM(_allow_mount, , CTLTYPE_INT | CTLFLAG_RW,
3770bf3db8aaSMartin Matuska     "B", "Jail may mount/unmount jail-friendly file systems in general");
37710e5c6bd4SJamie Gritton 
37720e5c6bd4SJamie Gritton /*
37730a172404SJamie Gritton  * Add a dynamic parameter allow.<name>, or allow.<prefix>.<name>.  Return
37740a172404SJamie Gritton  * its associated bit in the pr_allow bitmask, or zero if the parameter was
37750a172404SJamie Gritton  * not created.
37760e5c6bd4SJamie Gritton  */
37770a172404SJamie Gritton unsigned
37780a172404SJamie Gritton prison_add_allow(const char *prefix, const char *name, const char *prefix_descr,
37790a172404SJamie Gritton     const char *descr)
37800e5c6bd4SJamie Gritton {
37810e5c6bd4SJamie Gritton 	struct bool_flags *bf;
37820a172404SJamie Gritton 	struct sysctl_oid *parent;
37830a172404SJamie Gritton 	char *allow_name, *allow_noname, *allowed;
3784c542c43eSJamie Gritton #ifndef NO_SYSCTL_DESCR
3785c542c43eSJamie Gritton 	char *descr_deprecated;
3786c542c43eSJamie Gritton #endif
37870e5c6bd4SJamie Gritton 	unsigned allow_flag;
37880e5c6bd4SJamie Gritton 
37890a172404SJamie Gritton 	if (prefix
37900a172404SJamie Gritton 	    ? asprintf(&allow_name, M_PRISON, "allow.%s.%s", prefix, name)
37910a172404SJamie Gritton 		< 0 ||
37920a172404SJamie Gritton 	      asprintf(&allow_noname, M_PRISON, "allow.%s.no%s", prefix, name)
37930a172404SJamie Gritton 		< 0
37940a172404SJamie Gritton 	    : asprintf(&allow_name, M_PRISON, "allow.%s", name) < 0 ||
37950a172404SJamie Gritton 	      asprintf(&allow_noname, M_PRISON, "allow.no%s", name) < 0) {
37960e5c6bd4SJamie Gritton 		free(allow_name, M_PRISON);
37970a172404SJamie Gritton 		return 0;
37980e5c6bd4SJamie Gritton 	}
37990e5c6bd4SJamie Gritton 
38000e5c6bd4SJamie Gritton 	/*
38010a172404SJamie Gritton 	 * See if this parameter has already beed added, i.e. a module was
38020a172404SJamie Gritton 	 * previously loaded/unloaded.
38030e5c6bd4SJamie Gritton 	 */
38040e5c6bd4SJamie Gritton 	mtx_lock(&prison0.pr_mtx);
38050e5c6bd4SJamie Gritton 	for (bf = pr_flag_allow;
38060e5c6bd4SJamie Gritton 	     bf < pr_flag_allow + nitems(pr_flag_allow) && bf->flag != 0;
38070e5c6bd4SJamie Gritton 	     bf++) {
38080e5c6bd4SJamie Gritton 		if (strcmp(bf->name, allow_name) == 0) {
38090a172404SJamie Gritton 			allow_flag = bf->flag;
38100e5c6bd4SJamie Gritton 			goto no_add;
38110e5c6bd4SJamie Gritton 		}
38120e5c6bd4SJamie Gritton 	}
38130e5c6bd4SJamie Gritton 
38140e5c6bd4SJamie Gritton 	/*
38150e5c6bd4SJamie Gritton 	 * Find a free bit in prison0's pr_allow, failing if there are none
38160e5c6bd4SJamie Gritton 	 * (which shouldn't happen as long as we keep track of how many
38170a172404SJamie Gritton 	 * potential dynamic flags exist).
3818b3079544SJamie Gritton 	 *
3819b3079544SJamie Gritton 	 * Due to per-jail unprivileged process debugging support
3820b3079544SJamie Gritton 	 * using pr_allow, also verify against PR_ALLOW_ALL_STATIC.
3821b3079544SJamie Gritton 	 * prison0 may have unprivileged process debugging unset.
38220e5c6bd4SJamie Gritton 	 */
38230e5c6bd4SJamie Gritton 	for (allow_flag = 1;; allow_flag <<= 1) {
38240e5c6bd4SJamie Gritton 		if (allow_flag == 0)
38250e5c6bd4SJamie Gritton 			goto no_add;
3826b3079544SJamie Gritton 		if (allow_flag & PR_ALLOW_ALL_STATIC)
3827b3079544SJamie Gritton 			continue;
38280e5c6bd4SJamie Gritton 		if ((prison0.pr_allow & allow_flag) == 0)
38290e5c6bd4SJamie Gritton 			break;
38300e5c6bd4SJamie Gritton 	}
38310e5c6bd4SJamie Gritton 
38320e5c6bd4SJamie Gritton 	/*
38330e5c6bd4SJamie Gritton 	 * Note the parameter in the next open slot in pr_flag_allow.
38340e5c6bd4SJamie Gritton 	 * Set the flag last so code that checks pr_flag_allow can do so
38350e5c6bd4SJamie Gritton 	 * without locking.
38360e5c6bd4SJamie Gritton 	 */
38370e5c6bd4SJamie Gritton 	for (bf = pr_flag_allow; bf->flag != 0; bf++)
38380e5c6bd4SJamie Gritton 		if (bf == pr_flag_allow + nitems(pr_flag_allow)) {
38390e5c6bd4SJamie Gritton 			/* This should never happen, but is not fatal. */
38400a172404SJamie Gritton 			allow_flag = 0;
38410e5c6bd4SJamie Gritton 			goto no_add;
38420e5c6bd4SJamie Gritton 		}
38430e5c6bd4SJamie Gritton 	prison0.pr_allow |= allow_flag;
38440e5c6bd4SJamie Gritton 	bf->name = allow_name;
38450e5c6bd4SJamie Gritton 	bf->noname = allow_noname;
38460e5c6bd4SJamie Gritton 	bf->flag = allow_flag;
38470e5c6bd4SJamie Gritton 	mtx_unlock(&prison0.pr_mtx);
38480e5c6bd4SJamie Gritton 
3849c542c43eSJamie Gritton 	/*
3850c542c43eSJamie Gritton 	 * Create sysctls for the paramter, and the back-compat global
3851c542c43eSJamie Gritton 	 * permission.
3852c542c43eSJamie Gritton 	 */
38530a172404SJamie Gritton 	parent = prefix
38540a172404SJamie Gritton 	    ? SYSCTL_ADD_NODE(NULL,
38550a172404SJamie Gritton 		  SYSCTL_CHILDREN(&sysctl___security_jail_param_allow),
3856*7029da5cSPawel Biernacki 		  OID_AUTO, prefix, CTLFLAG_MPSAFE, 0, prefix_descr)
38570a172404SJamie Gritton 	    : &sysctl___security_jail_param_allow;
38580a172404SJamie Gritton 	(void)SYSCTL_ADD_PROC(NULL, SYSCTL_CHILDREN(parent), OID_AUTO,
38590a172404SJamie Gritton 	    name, CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
38600e5c6bd4SJamie Gritton 	    NULL, 0, sysctl_jail_param, "B", descr);
38610a172404SJamie Gritton 	if ((prefix
38620a172404SJamie Gritton 	     ? asprintf(&allowed, M_TEMP, "%s_%s_allowed", prefix, name)
38630a172404SJamie Gritton 	     : asprintf(&allowed, M_TEMP, "%s_allowed", name)) >= 0) {
3864c542c43eSJamie Gritton #ifndef NO_SYSCTL_DESCR
3865c542c43eSJamie Gritton 		(void)asprintf(&descr_deprecated, M_TEMP, "%s (deprecated)",
3866c542c43eSJamie Gritton 		    descr);
3867c542c43eSJamie Gritton #endif
38680e5c6bd4SJamie Gritton 		(void)SYSCTL_ADD_PROC(NULL,
38690a172404SJamie Gritton 		    SYSCTL_CHILDREN(&sysctl___security_jail), OID_AUTO, allowed,
3870c542c43eSJamie Gritton 		    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, allow_flag,
3871c542c43eSJamie Gritton 		    sysctl_jail_default_allow, "I", descr_deprecated);
3872c542c43eSJamie Gritton #ifndef NO_SYSCTL_DESCR
3873c542c43eSJamie Gritton 		free(descr_deprecated, M_TEMP);
3874c542c43eSJamie Gritton #endif
38750a172404SJamie Gritton 		free(allowed, M_TEMP);
38760e5c6bd4SJamie Gritton 	}
38770a172404SJamie Gritton 	return allow_flag;
38780e5c6bd4SJamie Gritton 
38790e5c6bd4SJamie Gritton  no_add:
38800e5c6bd4SJamie Gritton 	mtx_unlock(&prison0.pr_mtx);
38810e5c6bd4SJamie Gritton 	free(allow_name, M_PRISON);
38820e5c6bd4SJamie Gritton 	free(allow_noname, M_PRISON);
38830a172404SJamie Gritton 	return allow_flag;
38840a172404SJamie Gritton }
38850a172404SJamie Gritton 
38860a172404SJamie Gritton /*
38870a172404SJamie Gritton  * The VFS system will register jail-aware filesystems here.  They each get
38880a172404SJamie Gritton  * a parameter allow.mount.xxxfs and a flag to check when a jailed user
38890a172404SJamie Gritton  * attempts to mount.
38900a172404SJamie Gritton  */
38910a172404SJamie Gritton void
38920a172404SJamie Gritton prison_add_vfs(struct vfsconf *vfsp)
38930a172404SJamie Gritton {
38940a172404SJamie Gritton #ifdef NO_SYSCTL_DESCR
38950a172404SJamie Gritton 
38960a172404SJamie Gritton 	vfsp->vfc_prison_flag = prison_add_allow("mount", vfsp->vfc_name,
38970a172404SJamie Gritton 	    NULL, NULL);
38980a172404SJamie Gritton #else
38990a172404SJamie Gritton 	char *descr;
39000a172404SJamie Gritton 
39010a172404SJamie Gritton 	(void)asprintf(&descr, M_TEMP, "Jail may mount the %s file system",
39020a172404SJamie Gritton 	    vfsp->vfc_name);
39030a172404SJamie Gritton 	vfsp->vfc_prison_flag = prison_add_allow("mount", vfsp->vfc_name,
39040a172404SJamie Gritton 	    NULL, descr);
39050a172404SJamie Gritton 	free(descr, M_TEMP);
39060a172404SJamie Gritton #endif
39070e5c6bd4SJamie Gritton }
3908bf3db8aaSMartin Matuska 
39094b5c9cf6SEdward Tomasz Napierala #ifdef RACCT
3910097055e2SEdward Tomasz Napierala void
3911097055e2SEdward Tomasz Napierala prison_racct_foreach(void (*callback)(struct racct *racct,
391215db3c07SEdward Tomasz Napierala     void *arg2, void *arg3), void (*pre)(void), void (*post)(void),
391315db3c07SEdward Tomasz Napierala     void *arg2, void *arg3)
3914097055e2SEdward Tomasz Napierala {
3915a7ad07bfSEdward Tomasz Napierala 	struct prison_racct *prr;
3916097055e2SEdward Tomasz Napierala 
39174b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
39184b5c9cf6SEdward Tomasz Napierala 
3919097055e2SEdward Tomasz Napierala 	sx_slock(&allprison_lock);
392015db3c07SEdward Tomasz Napierala 	if (pre != NULL)
392115db3c07SEdward Tomasz Napierala 		(pre)();
3922a7ad07bfSEdward Tomasz Napierala 	LIST_FOREACH(prr, &allprison_racct, prr_next)
3923a7ad07bfSEdward Tomasz Napierala 		(callback)(prr->prr_racct, arg2, arg3);
392415db3c07SEdward Tomasz Napierala 	if (post != NULL)
392515db3c07SEdward Tomasz Napierala 		(post)();
3926097055e2SEdward Tomasz Napierala 	sx_sunlock(&allprison_lock);
3927097055e2SEdward Tomasz Napierala }
39280304c731SJamie Gritton 
3929a7ad07bfSEdward Tomasz Napierala static struct prison_racct *
3930a7ad07bfSEdward Tomasz Napierala prison_racct_find_locked(const char *name)
3931a7ad07bfSEdward Tomasz Napierala {
3932a7ad07bfSEdward Tomasz Napierala 	struct prison_racct *prr;
3933a7ad07bfSEdward Tomasz Napierala 
39344b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
3935a7ad07bfSEdward Tomasz Napierala 	sx_assert(&allprison_lock, SA_XLOCKED);
3936a7ad07bfSEdward Tomasz Napierala 
3937a7ad07bfSEdward Tomasz Napierala 	if (name[0] == '\0' || strlen(name) >= MAXHOSTNAMELEN)
3938a7ad07bfSEdward Tomasz Napierala 		return (NULL);
3939a7ad07bfSEdward Tomasz Napierala 
3940a7ad07bfSEdward Tomasz Napierala 	LIST_FOREACH(prr, &allprison_racct, prr_next) {
3941a7ad07bfSEdward Tomasz Napierala 		if (strcmp(name, prr->prr_name) != 0)
3942a7ad07bfSEdward Tomasz Napierala 			continue;
3943a7ad07bfSEdward Tomasz Napierala 
3944a7ad07bfSEdward Tomasz Napierala 		/* Found prison_racct with a matching name? */
3945a7ad07bfSEdward Tomasz Napierala 		prison_racct_hold(prr);
3946a7ad07bfSEdward Tomasz Napierala 		return (prr);
3947a7ad07bfSEdward Tomasz Napierala 	}
3948a7ad07bfSEdward Tomasz Napierala 
3949a7ad07bfSEdward Tomasz Napierala 	/* Add new prison_racct. */
3950a7ad07bfSEdward Tomasz Napierala 	prr = malloc(sizeof(*prr), M_PRISON_RACCT, M_ZERO | M_WAITOK);
3951a7ad07bfSEdward Tomasz Napierala 	racct_create(&prr->prr_racct);
3952a7ad07bfSEdward Tomasz Napierala 
3953a7ad07bfSEdward Tomasz Napierala 	strcpy(prr->prr_name, name);
3954a7ad07bfSEdward Tomasz Napierala 	refcount_init(&prr->prr_refcount, 1);
3955a7ad07bfSEdward Tomasz Napierala 	LIST_INSERT_HEAD(&allprison_racct, prr, prr_next);
3956a7ad07bfSEdward Tomasz Napierala 
3957a7ad07bfSEdward Tomasz Napierala 	return (prr);
3958a7ad07bfSEdward Tomasz Napierala }
3959a7ad07bfSEdward Tomasz Napierala 
3960a7ad07bfSEdward Tomasz Napierala struct prison_racct *
3961a7ad07bfSEdward Tomasz Napierala prison_racct_find(const char *name)
3962a7ad07bfSEdward Tomasz Napierala {
3963a7ad07bfSEdward Tomasz Napierala 	struct prison_racct *prr;
3964a7ad07bfSEdward Tomasz Napierala 
39654b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
39664b5c9cf6SEdward Tomasz Napierala 
3967a7ad07bfSEdward Tomasz Napierala 	sx_xlock(&allprison_lock);
3968a7ad07bfSEdward Tomasz Napierala 	prr = prison_racct_find_locked(name);
3969a7ad07bfSEdward Tomasz Napierala 	sx_xunlock(&allprison_lock);
3970a7ad07bfSEdward Tomasz Napierala 	return (prr);
3971a7ad07bfSEdward Tomasz Napierala }
3972a7ad07bfSEdward Tomasz Napierala 
3973a7ad07bfSEdward Tomasz Napierala void
3974a7ad07bfSEdward Tomasz Napierala prison_racct_hold(struct prison_racct *prr)
3975a7ad07bfSEdward Tomasz Napierala {
3976a7ad07bfSEdward Tomasz Napierala 
39774b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
39784b5c9cf6SEdward Tomasz Napierala 
3979a7ad07bfSEdward Tomasz Napierala 	refcount_acquire(&prr->prr_refcount);
3980a7ad07bfSEdward Tomasz Napierala }
3981a7ad07bfSEdward Tomasz Napierala 
3982c34bbd2aSEdward Tomasz Napierala static void
3983c34bbd2aSEdward Tomasz Napierala prison_racct_free_locked(struct prison_racct *prr)
3984c34bbd2aSEdward Tomasz Napierala {
3985c34bbd2aSEdward Tomasz Napierala 
39864b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
3987c34bbd2aSEdward Tomasz Napierala 	sx_assert(&allprison_lock, SA_XLOCKED);
3988c34bbd2aSEdward Tomasz Napierala 
3989c34bbd2aSEdward Tomasz Napierala 	if (refcount_release(&prr->prr_refcount)) {
3990c34bbd2aSEdward Tomasz Napierala 		racct_destroy(&prr->prr_racct);
3991c34bbd2aSEdward Tomasz Napierala 		LIST_REMOVE(prr, prr_next);
3992c34bbd2aSEdward Tomasz Napierala 		free(prr, M_PRISON_RACCT);
3993c34bbd2aSEdward Tomasz Napierala 	}
3994c34bbd2aSEdward Tomasz Napierala }
3995c34bbd2aSEdward Tomasz Napierala 
3996a7ad07bfSEdward Tomasz Napierala void
3997a7ad07bfSEdward Tomasz Napierala prison_racct_free(struct prison_racct *prr)
3998a7ad07bfSEdward Tomasz Napierala {
3999a7ad07bfSEdward Tomasz Napierala 
40004b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
4001c34bbd2aSEdward Tomasz Napierala 	sx_assert(&allprison_lock, SA_UNLOCKED);
4002c34bbd2aSEdward Tomasz Napierala 
40036ff4688bSMateusz Guzik 	if (refcount_release_if_not_last(&prr->prr_refcount))
4004a7ad07bfSEdward Tomasz Napierala 		return;
4005a7ad07bfSEdward Tomasz Napierala 
4006a7ad07bfSEdward Tomasz Napierala 	sx_xlock(&allprison_lock);
4007c34bbd2aSEdward Tomasz Napierala 	prison_racct_free_locked(prr);
4008a7ad07bfSEdward Tomasz Napierala 	sx_xunlock(&allprison_lock);
4009a7ad07bfSEdward Tomasz Napierala }
4010a7ad07bfSEdward Tomasz Napierala 
4011a7ad07bfSEdward Tomasz Napierala static void
4012a7ad07bfSEdward Tomasz Napierala prison_racct_attach(struct prison *pr)
4013a7ad07bfSEdward Tomasz Napierala {
4014a7ad07bfSEdward Tomasz Napierala 	struct prison_racct *prr;
4015a7ad07bfSEdward Tomasz Napierala 
40164b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
4017c34bbd2aSEdward Tomasz Napierala 	sx_assert(&allprison_lock, SA_XLOCKED);
4018c34bbd2aSEdward Tomasz Napierala 
4019a7ad07bfSEdward Tomasz Napierala 	prr = prison_racct_find_locked(pr->pr_name);
4020a7ad07bfSEdward Tomasz Napierala 	KASSERT(prr != NULL, ("cannot find prison_racct"));
4021a7ad07bfSEdward Tomasz Napierala 
4022a7ad07bfSEdward Tomasz Napierala 	pr->pr_prison_racct = prr;
4023a7ad07bfSEdward Tomasz Napierala }
4024a7ad07bfSEdward Tomasz Napierala 
4025c34bbd2aSEdward Tomasz Napierala /*
4026c34bbd2aSEdward Tomasz Napierala  * Handle jail renaming.  From the racct point of view, renaming means
4027c34bbd2aSEdward Tomasz Napierala  * moving from one prison_racct to another.
4028c34bbd2aSEdward Tomasz Napierala  */
4029c34bbd2aSEdward Tomasz Napierala static void
4030c34bbd2aSEdward Tomasz Napierala prison_racct_modify(struct prison *pr)
4031c34bbd2aSEdward Tomasz Napierala {
4032dbadb015SKonstantin Belousov #ifdef RCTL
4033c34bbd2aSEdward Tomasz Napierala 	struct proc *p;
4034c34bbd2aSEdward Tomasz Napierala 	struct ucred *cred;
4035dbadb015SKonstantin Belousov #endif
4036c34bbd2aSEdward Tomasz Napierala 	struct prison_racct *oldprr;
4037c34bbd2aSEdward Tomasz Napierala 
40384b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
40394b5c9cf6SEdward Tomasz Napierala 
4040c34bbd2aSEdward Tomasz Napierala 	sx_slock(&allproc_lock);
4041c34bbd2aSEdward Tomasz Napierala 	sx_xlock(&allprison_lock);
4042c34bbd2aSEdward Tomasz Napierala 
4043e30345e7SEdward Tomasz Napierala 	if (strcmp(pr->pr_name, pr->pr_prison_racct->prr_name) == 0) {
4044e30345e7SEdward Tomasz Napierala 		sx_xunlock(&allprison_lock);
4045e30345e7SEdward Tomasz Napierala 		sx_sunlock(&allproc_lock);
4046c34bbd2aSEdward Tomasz Napierala 		return;
4047e30345e7SEdward Tomasz Napierala 	}
4048c34bbd2aSEdward Tomasz Napierala 
4049c34bbd2aSEdward Tomasz Napierala 	oldprr = pr->pr_prison_racct;
4050c34bbd2aSEdward Tomasz Napierala 	pr->pr_prison_racct = NULL;
4051c34bbd2aSEdward Tomasz Napierala 
4052c34bbd2aSEdward Tomasz Napierala 	prison_racct_attach(pr);
4053c34bbd2aSEdward Tomasz Napierala 
4054c34bbd2aSEdward Tomasz Napierala 	/*
4055c34bbd2aSEdward Tomasz Napierala 	 * Move resource utilisation records.
4056c34bbd2aSEdward Tomasz Napierala 	 */
4057c34bbd2aSEdward Tomasz Napierala 	racct_move(pr->pr_prison_racct->prr_racct, oldprr->prr_racct);
4058c34bbd2aSEdward Tomasz Napierala 
4059f87beb93SAndriy Gapon #ifdef RCTL
4060c34bbd2aSEdward Tomasz Napierala 	/*
4061c34bbd2aSEdward Tomasz Napierala 	 * Force rctl to reattach rules to processes.
4062c34bbd2aSEdward Tomasz Napierala 	 */
4063c34bbd2aSEdward Tomasz Napierala 	FOREACH_PROC_IN_SYSTEM(p) {
4064c34bbd2aSEdward Tomasz Napierala 		PROC_LOCK(p);
4065c34bbd2aSEdward Tomasz Napierala 		cred = crhold(p->p_ucred);
4066c34bbd2aSEdward Tomasz Napierala 		PROC_UNLOCK(p);
4067f87beb93SAndriy Gapon 		rctl_proc_ucred_changed(p, cred);
4068c34bbd2aSEdward Tomasz Napierala 		crfree(cred);
4069c34bbd2aSEdward Tomasz Napierala 	}
4070f87beb93SAndriy Gapon #endif
4071c34bbd2aSEdward Tomasz Napierala 
4072c34bbd2aSEdward Tomasz Napierala 	sx_sunlock(&allproc_lock);
4073c34bbd2aSEdward Tomasz Napierala 	prison_racct_free_locked(oldprr);
4074c34bbd2aSEdward Tomasz Napierala 	sx_xunlock(&allprison_lock);
4075c34bbd2aSEdward Tomasz Napierala }
4076c34bbd2aSEdward Tomasz Napierala 
4077a7ad07bfSEdward Tomasz Napierala static void
4078a7ad07bfSEdward Tomasz Napierala prison_racct_detach(struct prison *pr)
4079a7ad07bfSEdward Tomasz Napierala {
4080c34bbd2aSEdward Tomasz Napierala 
40814b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
4082c34bbd2aSEdward Tomasz Napierala 	sx_assert(&allprison_lock, SA_UNLOCKED);
4083c34bbd2aSEdward Tomasz Napierala 
4084af3c786cSMateusz Guzik 	if (pr->pr_prison_racct == NULL)
4085af3c786cSMateusz Guzik 		return;
4086a7ad07bfSEdward Tomasz Napierala 	prison_racct_free(pr->pr_prison_racct);
4087a7ad07bfSEdward Tomasz Napierala 	pr->pr_prison_racct = NULL;
4088a7ad07bfSEdward Tomasz Napierala }
4089a7ad07bfSEdward Tomasz Napierala #endif /* RACCT */
4090a7ad07bfSEdward Tomasz Napierala 
4091413628a7SBjoern A. Zeeb #ifdef DDB
4092b38ff370SJamie Gritton 
4093b38ff370SJamie Gritton static void
4094b38ff370SJamie Gritton db_show_prison(struct prison *pr)
4095413628a7SBjoern A. Zeeb {
4096672756aaSJamie Gritton 	struct bool_flags *bf;
4097672756aaSJamie Gritton 	struct jailsys_flags *jsf;
4098b38ff370SJamie Gritton #if defined(INET) || defined(INET6)
4099b38ff370SJamie Gritton 	int ii;
4100413628a7SBjoern A. Zeeb #endif
4101672756aaSJamie Gritton 	unsigned f;
41028144690aSEric van Gyzen #ifdef INET
41038144690aSEric van Gyzen 	char ip4buf[INET_ADDRSTRLEN];
41048144690aSEric van Gyzen #endif
4105413628a7SBjoern A. Zeeb #ifdef INET6
4106413628a7SBjoern A. Zeeb 	char ip6buf[INET6_ADDRSTRLEN];
4107413628a7SBjoern A. Zeeb #endif
4108413628a7SBjoern A. Zeeb 
4109b38ff370SJamie Gritton 	db_printf("prison %p:\n", pr);
4110b38ff370SJamie Gritton 	db_printf(" jid             = %d\n", pr->pr_id);
4111b38ff370SJamie Gritton 	db_printf(" name            = %s\n", pr->pr_name);
41120304c731SJamie Gritton 	db_printf(" parent          = %p\n", pr->pr_parent);
4113b38ff370SJamie Gritton 	db_printf(" ref             = %d\n", pr->pr_ref);
4114b38ff370SJamie Gritton 	db_printf(" uref            = %d\n", pr->pr_uref);
4115b38ff370SJamie Gritton 	db_printf(" path            = %s\n", pr->pr_path);
4116b38ff370SJamie Gritton 	db_printf(" cpuset          = %d\n", pr->pr_cpuset
4117b38ff370SJamie Gritton 	    ? pr->pr_cpuset->cs_id : -1);
4118679e1390SJamie Gritton #ifdef VIMAGE
4119679e1390SJamie Gritton 	db_printf(" vnet            = %p\n", pr->pr_vnet);
4120679e1390SJamie Gritton #endif
4121b38ff370SJamie Gritton 	db_printf(" root            = %p\n", pr->pr_root);
4122b38ff370SJamie Gritton 	db_printf(" securelevel     = %d\n", pr->pr_securelevel);
41230cc207a6SMartin Matuska 	db_printf(" devfs_rsnum     = %d\n", pr->pr_devfs_rsnum);
4124fe0518e9SBjoern A. Zeeb 	db_printf(" children.max    = %d\n", pr->pr_childmax);
4125fe0518e9SBjoern A. Zeeb 	db_printf(" children.cur    = %d\n", pr->pr_childcount);
41260304c731SJamie Gritton 	db_printf(" child           = %p\n", LIST_FIRST(&pr->pr_children));
41270304c731SJamie Gritton 	db_printf(" sibling         = %p\n", LIST_NEXT(pr, pr_sibling));
4128fe0518e9SBjoern A. Zeeb 	db_printf(" flags           = 0x%x", pr->pr_flags);
4129672756aaSJamie Gritton 	for (bf = pr_flag_bool; bf < pr_flag_bool + nitems(pr_flag_bool); bf++)
4130672756aaSJamie Gritton 		if (pr->pr_flags & bf->flag)
4131672756aaSJamie Gritton 			db_printf(" %s", bf->name);
4132672756aaSJamie Gritton 	for (jsf = pr_flag_jailsys;
4133672756aaSJamie Gritton 	     jsf < pr_flag_jailsys + nitems(pr_flag_jailsys);
4134672756aaSJamie Gritton 	     jsf++) {
4135672756aaSJamie Gritton 		f = pr->pr_flags & (jsf->disable | jsf->new);
4136672756aaSJamie Gritton 		db_printf(" %-16s= %s\n", jsf->name,
4137672756aaSJamie Gritton 		    (f != 0 && f == jsf->disable) ? "disable"
4138672756aaSJamie Gritton 		    : (f == jsf->new) ? "new"
41397cbf7213SJamie Gritton 		    : "inherit");
41407cbf7213SJamie Gritton 	}
4141fe0518e9SBjoern A. Zeeb 	db_printf(" allow           = 0x%x", pr->pr_allow);
4142672756aaSJamie Gritton 	for (bf = pr_flag_allow;
41430e5c6bd4SJamie Gritton 	     bf < pr_flag_allow + nitems(pr_flag_allow) && bf->flag != 0;
4144672756aaSJamie Gritton 	     bf++)
4145672756aaSJamie Gritton 		if (pr->pr_allow & bf->flag)
4146672756aaSJamie Gritton 			db_printf(" %s", bf->name);
4147b38ff370SJamie Gritton 	db_printf("\n");
41480304c731SJamie Gritton 	db_printf(" enforce_statfs  = %d\n", pr->pr_enforce_statfs);
4149c1f19219SJamie Gritton 	db_printf(" host.hostname   = %s\n", pr->pr_hostname);
4150c1f19219SJamie Gritton 	db_printf(" host.domainname = %s\n", pr->pr_domainname);
4151c1f19219SJamie Gritton 	db_printf(" host.hostuuid   = %s\n", pr->pr_hostuuid);
415276ca6f88SJamie Gritton 	db_printf(" host.hostid     = %lu\n", pr->pr_hostid);
4153413628a7SBjoern A. Zeeb #ifdef INET
4154b38ff370SJamie Gritton 	db_printf(" ip4s            = %d\n", pr->pr_ip4s);
4155b38ff370SJamie Gritton 	for (ii = 0; ii < pr->pr_ip4s; ii++)
4156b38ff370SJamie Gritton 		db_printf(" %s %s\n",
4157fe0518e9SBjoern A. Zeeb 		    ii == 0 ? "ip4.addr        =" : "                 ",
41588144690aSEric van Gyzen 		    inet_ntoa_r(pr->pr_ip4[ii], ip4buf));
4159413628a7SBjoern A. Zeeb #endif
4160413628a7SBjoern A. Zeeb #ifdef INET6
4161b38ff370SJamie Gritton 	db_printf(" ip6s            = %d\n", pr->pr_ip6s);
4162b38ff370SJamie Gritton 	for (ii = 0; ii < pr->pr_ip6s; ii++)
4163b38ff370SJamie Gritton 		db_printf(" %s %s\n",
4164fe0518e9SBjoern A. Zeeb 		    ii == 0 ? "ip6.addr        =" : "                 ",
4165b38ff370SJamie Gritton 		    ip6_sprintf(ip6buf, &pr->pr_ip6[ii]));
4166b38ff370SJamie Gritton #endif
4167b38ff370SJamie Gritton }
4168b38ff370SJamie Gritton 
4169b38ff370SJamie Gritton DB_SHOW_COMMAND(prison, db_show_prison_command)
4170b38ff370SJamie Gritton {
4171b38ff370SJamie Gritton 	struct prison *pr;
4172b38ff370SJamie Gritton 
4173b38ff370SJamie Gritton 	if (!have_addr) {
41740304c731SJamie Gritton 		/*
41750304c731SJamie Gritton 		 * Show all prisons in the list, and prison0 which is not
41760304c731SJamie Gritton 		 * listed.
41770304c731SJamie Gritton 		 */
41780304c731SJamie Gritton 		db_show_prison(&prison0);
41790304c731SJamie Gritton 		if (!db_pager_quit) {
4180b38ff370SJamie Gritton 			TAILQ_FOREACH(pr, &allprison, pr_list) {
4181b38ff370SJamie Gritton 				db_show_prison(pr);
4182413628a7SBjoern A. Zeeb 				if (db_pager_quit)
4183413628a7SBjoern A. Zeeb 					break;
4184413628a7SBjoern A. Zeeb 			}
41850304c731SJamie Gritton 		}
4186b38ff370SJamie Gritton 		return;
4187413628a7SBjoern A. Zeeb 	}
4188b38ff370SJamie Gritton 
41890304c731SJamie Gritton 	if (addr == 0)
41900304c731SJamie Gritton 		pr = &prison0;
41910304c731SJamie Gritton 	else {
4192b38ff370SJamie Gritton 		/* Look for a prison with the ID and with references. */
4193b38ff370SJamie Gritton 		TAILQ_FOREACH(pr, &allprison, pr_list)
4194b38ff370SJamie Gritton 			if (pr->pr_id == addr && pr->pr_ref > 0)
4195b38ff370SJamie Gritton 				break;
4196b38ff370SJamie Gritton 		if (pr == NULL)
4197b38ff370SJamie Gritton 			/* Look again, without requiring a reference. */
4198b38ff370SJamie Gritton 			TAILQ_FOREACH(pr, &allprison, pr_list)
4199b38ff370SJamie Gritton 				if (pr->pr_id == addr)
4200b38ff370SJamie Gritton 					break;
4201b38ff370SJamie Gritton 		if (pr == NULL)
4202b38ff370SJamie Gritton 			/* Assume address points to a valid prison. */
4203b38ff370SJamie Gritton 			pr = (struct prison *)addr;
42040304c731SJamie Gritton 	}
4205b38ff370SJamie Gritton 	db_show_prison(pr);
4206b38ff370SJamie Gritton }
4207b38ff370SJamie Gritton 
4208413628a7SBjoern A. Zeeb #endif /* DDB */
4209