xref: /freebsd/sys/kern/kern_jail.c (revision 89ddfbbac84cb923e41782c014dc581352e498a9)
19454b2d8SWarner Losh /*-
28a36da99SPedro F. Giffuni  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
38a36da99SPedro F. Giffuni  *
4413628a7SBjoern A. Zeeb  * Copyright (c) 1999 Poul-Henning Kamp.
5413628a7SBjoern A. Zeeb  * Copyright (c) 2008 Bjoern A. Zeeb.
6b38ff370SJamie Gritton  * Copyright (c) 2009 James Gritton.
7413628a7SBjoern A. Zeeb  * All rights reserved.
8b9f0b66cSBjoern A. Zeeb  *
9b9f0b66cSBjoern A. Zeeb  * Redistribution and use in source and binary forms, with or without
10b9f0b66cSBjoern A. Zeeb  * modification, are permitted provided that the following conditions
11b9f0b66cSBjoern A. Zeeb  * are met:
12b9f0b66cSBjoern A. Zeeb  * 1. Redistributions of source code must retain the above copyright
13b9f0b66cSBjoern A. Zeeb  *    notice, this list of conditions and the following disclaimer.
14b9f0b66cSBjoern A. Zeeb  * 2. Redistributions in binary form must reproduce the above copyright
15b9f0b66cSBjoern A. Zeeb  *    notice, this list of conditions and the following disclaimer in the
16b9f0b66cSBjoern A. Zeeb  *    documentation and/or other materials provided with the distribution.
17b9f0b66cSBjoern A. Zeeb  *
18b9f0b66cSBjoern A. Zeeb  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19b9f0b66cSBjoern A. Zeeb  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20b9f0b66cSBjoern A. Zeeb  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21b9f0b66cSBjoern A. Zeeb  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22b9f0b66cSBjoern A. Zeeb  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23b9f0b66cSBjoern A. Zeeb  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24b9f0b66cSBjoern A. Zeeb  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25b9f0b66cSBjoern A. Zeeb  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26b9f0b66cSBjoern A. Zeeb  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27b9f0b66cSBjoern A. Zeeb  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28b9f0b66cSBjoern A. Zeeb  * SUCH DAMAGE.
2907901f22SPoul-Henning Kamp  */
3075c13541SPoul-Henning Kamp 
31677b542eSDavid E. O'Brien #include <sys/cdefs.h>
32677b542eSDavid E. O'Brien __FBSDID("$FreeBSD$");
33677b542eSDavid E. O'Brien 
34413628a7SBjoern A. Zeeb #include "opt_ddb.h"
35413628a7SBjoern A. Zeeb #include "opt_inet.h"
36413628a7SBjoern A. Zeeb #include "opt_inet6.h"
37bba7a2e8SRick Macklem #include "opt_nfs.h"
3846e3b1cbSPawel Jakub Dawidek 
3975c13541SPoul-Henning Kamp #include <sys/param.h>
4075c13541SPoul-Henning Kamp #include <sys/types.h>
4175c13541SPoul-Henning Kamp #include <sys/kernel.h>
4275c13541SPoul-Henning Kamp #include <sys/systm.h>
4375c13541SPoul-Henning Kamp #include <sys/errno.h>
4475c13541SPoul-Henning Kamp #include <sys/sysproto.h>
4575c13541SPoul-Henning Kamp #include <sys/malloc.h>
460304c731SJamie Gritton #include <sys/osd.h>
47800c9408SRobert Watson #include <sys/priv.h>
4875c13541SPoul-Henning Kamp #include <sys/proc.h>
49eb8dcdeaSGleb Smirnoff #include <sys/epoch.h>
50b3059e09SRobert Watson #include <sys/taskqueue.h>
5157b4252eSKonstantin Belousov #include <sys/fcntl.h>
5275c13541SPoul-Henning Kamp #include <sys/jail.h>
53c3188289SKyle Evans #include <sys/linker.h>
5401137630SRobert Watson #include <sys/lock.h>
557060da62SJamie Gritton #include <sys/mman.h>
5601137630SRobert Watson #include <sys/mutex.h>
57097055e2SEdward Tomasz Napierala #include <sys/racct.h>
58f87beb93SAndriy Gapon #include <sys/rctl.h>
59a7ad07bfSEdward Tomasz Napierala #include <sys/refcount.h>
60dc68a633SPawel Jakub Dawidek #include <sys/sx.h>
6176ca6f88SJamie Gritton #include <sys/sysent.h>
62fd7a8150SMike Barcroft #include <sys/namei.h>
63820a0de9SPawel Jakub Dawidek #include <sys/mount.h>
64fd7a8150SMike Barcroft #include <sys/queue.h>
6575c13541SPoul-Henning Kamp #include <sys/socket.h>
66fd7a8150SMike Barcroft #include <sys/syscallsubr.h>
6783f1e257SRobert Watson #include <sys/sysctl.h>
68c3188289SKyle Evans #include <sys/uuid.h>
69fd7a8150SMike Barcroft #include <sys/vnode.h>
70530c0060SRobert Watson 
7175c13541SPoul-Henning Kamp #include <net/if.h>
72530c0060SRobert Watson #include <net/vnet.h>
73530c0060SRobert Watson 
7475c13541SPoul-Henning Kamp #include <netinet/in.h>
75530c0060SRobert Watson 
76413628a7SBjoern A. Zeeb #ifdef DDB
77413628a7SBjoern A. Zeeb #include <ddb/ddb.h>
78413628a7SBjoern A. Zeeb #endif /* DDB */
7975c13541SPoul-Henning Kamp 
80aed55708SRobert Watson #include <security/mac/mac_framework.h>
81aed55708SRobert Watson 
82c3188289SKyle Evans #define	PRISON0_HOSTUUID_MODULE	"hostuuid"
838986e3a0SJamie Gritton 
8475c13541SPoul-Henning Kamp MALLOC_DEFINE(M_PRISON, "prison", "Prison structures");
85d745c852SEd Schouten static MALLOC_DEFINE(M_PRISON_RACCT, "prison_racct", "Prison racct structures");
8675c13541SPoul-Henning Kamp 
87592bcae8SBjoern A. Zeeb /* Keep struct prison prison0 and some code in kern_jail_set() readable. */
88592bcae8SBjoern A. Zeeb #ifdef INET
89592bcae8SBjoern A. Zeeb #ifdef INET6
90592bcae8SBjoern A. Zeeb #define	_PR_IP_SADDRSEL	PR_IP4_SADDRSEL|PR_IP6_SADDRSEL
91592bcae8SBjoern A. Zeeb #else
92592bcae8SBjoern A. Zeeb #define	_PR_IP_SADDRSEL	PR_IP4_SADDRSEL
93592bcae8SBjoern A. Zeeb #endif
94592bcae8SBjoern A. Zeeb #else /* !INET */
95592bcae8SBjoern A. Zeeb #ifdef INET6
96592bcae8SBjoern A. Zeeb #define	_PR_IP_SADDRSEL	PR_IP6_SADDRSEL
97592bcae8SBjoern A. Zeeb #else
98592bcae8SBjoern A. Zeeb #define	_PR_IP_SADDRSEL	0
99592bcae8SBjoern A. Zeeb #endif
100592bcae8SBjoern A. Zeeb #endif
101592bcae8SBjoern A. Zeeb 
1020304c731SJamie Gritton /* prison0 describes what is "real" about the system. */
1030304c731SJamie Gritton struct prison prison0 = {
1040304c731SJamie Gritton 	.pr_id		= 0,
1050304c731SJamie Gritton 	.pr_name	= "0",
1060304c731SJamie Gritton 	.pr_ref		= 1,
1070304c731SJamie Gritton 	.pr_uref	= 1,
1080304c731SJamie Gritton 	.pr_path	= "/",
1090304c731SJamie Gritton 	.pr_securelevel	= -1,
1100cc207a6SMartin Matuska 	.pr_devfs_rsnum = 0,
1111158508aSJamie Gritton 	.pr_state	= PRISON_STATE_ALIVE,
112b97457e2SJamie Gritton 	.pr_childmax	= JAIL_MAX,
1138986e3a0SJamie Gritton 	.pr_hostuuid	= DEFAULT_HOSTUUID,
11413e403fdSAntoine Brodin 	.pr_children	= LIST_HEAD_INITIALIZER(prison0.pr_children),
115eb79e1c7SBjoern A. Zeeb #ifdef VIMAGE
116592bcae8SBjoern A. Zeeb 	.pr_flags	= PR_HOST|PR_VNET|_PR_IP_SADDRSEL,
117eb79e1c7SBjoern A. Zeeb #else
118592bcae8SBjoern A. Zeeb 	.pr_flags	= PR_HOST|_PR_IP_SADDRSEL,
119eb79e1c7SBjoern A. Zeeb #endif
1200e5c6bd4SJamie Gritton 	.pr_allow	= PR_ALLOW_ALL_STATIC,
1210304c731SJamie Gritton };
1220304c731SJamie Gritton MTX_SYSINIT(prison0, &prison0.pr_mtx, "jail mutex", MTX_DEF);
12383f1e257SRobert Watson 
124672756aaSJamie Gritton struct bool_flags {
125672756aaSJamie Gritton 	const char	*name;
126672756aaSJamie Gritton 	const char	*noname;
1275d58f959SJamie Gritton 	volatile u_int	 flag;
128672756aaSJamie Gritton };
129672756aaSJamie Gritton struct jailsys_flags {
130672756aaSJamie Gritton 	const char	*name;
131672756aaSJamie Gritton 	unsigned	 disable;
132672756aaSJamie Gritton 	unsigned	 new;
133672756aaSJamie Gritton };
134672756aaSJamie Gritton 
135a7ad07bfSEdward Tomasz Napierala /* allprison, allprison_racct and lastprid are protected by allprison_lock. */
136dc68a633SPawel Jakub Dawidek struct	sx allprison_lock;
137b38ff370SJamie Gritton SX_SYSINIT(allprison_lock, &allprison_lock, "allprison");
138b38ff370SJamie Gritton struct	prisonlist allprison = TAILQ_HEAD_INITIALIZER(allprison);
139a7ad07bfSEdward Tomasz Napierala LIST_HEAD(, prison_racct) allprison_racct;
1402110d913SXin LI int	lastprid = 0;
141fd7a8150SMike Barcroft 
1427de883c8SJamie Gritton static int get_next_prid(struct prison **insprp);
143f7496dcaSJamie Gritton static int do_jail_attach(struct thread *td, struct prison *pr, int drflags);
144b3059e09SRobert Watson static void prison_complete(void *context, int pending);
145b38ff370SJamie Gritton static void prison_deref(struct prison *pr, int flags);
146c861373bSJamie Gritton static void prison_deref_kill(struct prison *pr, struct prisonlist *freeprison);
147f7496dcaSJamie Gritton static int prison_lock_xlock(struct prison *pr, int flags);
148a9f7455cSJamie Gritton static void prison_cleanup(struct prison *pr);
149f7496dcaSJamie Gritton static void prison_free_not_last(struct prison *pr);
150c861373bSJamie Gritton static void prison_proc_free_not_last(struct prison *pr);
1515ecb5444SMateusz Guzik static void prison_proc_relink(struct prison *opr, struct prison *npr,
1525ecb5444SMateusz Guzik     struct proc *p);
1530fe74ae6SJamie Gritton static void prison_set_allow_locked(struct prison *pr, unsigned flag,
1540fe74ae6SJamie Gritton     int enable);
1550304c731SJamie Gritton static char *prison_path(struct prison *pr1, struct prison *pr2);
156a7ad07bfSEdward Tomasz Napierala #ifdef RACCT
157a7ad07bfSEdward Tomasz Napierala static void prison_racct_attach(struct prison *pr);
158c34bbd2aSEdward Tomasz Napierala static void prison_racct_modify(struct prison *pr);
159a7ad07bfSEdward Tomasz Napierala static void prison_racct_detach(struct prison *pr);
160a7ad07bfSEdward Tomasz Napierala #endif
161fd7a8150SMike Barcroft 
162b38ff370SJamie Gritton /* Flags for prison_deref */
1632a4b2251SJamie Gritton #define	PD_DEREF	0x01	/* Decrement pr_ref */
1642a4b2251SJamie Gritton #define	PD_DEUREF	0x02	/* Decrement pr_uref */
165c861373bSJamie Gritton #define	PD_KILL		0x04	/* Remove jail, kill processes, etc */
166c861373bSJamie Gritton #define	PD_LOCKED	0x10	/* pr_mtx is held */
167c861373bSJamie Gritton #define	PD_LIST_SLOCKED	0x20	/* allprison_lock is held shared */
168c861373bSJamie Gritton #define	PD_LIST_XLOCKED	0x40	/* allprison_lock is held exclusive */
169589e4c1dSJamie Gritton #define PD_OP_FLAGS	0x07	/* Operation flags */
170589e4c1dSJamie Gritton #define PD_LOCK_FLAGS	0x70	/* Lock status flags */
171fd7a8150SMike Barcroft 
1720304c731SJamie Gritton /*
1735cc70397SBjoern A. Zeeb  * Parameter names corresponding to PR_* flag values.  Size values are for kvm
1745cc70397SBjoern A. Zeeb  * as we cannot figure out the size of a sparse array, or an array without a
1755cc70397SBjoern A. Zeeb  * terminating entry.
1760304c731SJamie Gritton  */
177672756aaSJamie Gritton static struct bool_flags pr_flag_bool[] = {
178672756aaSJamie Gritton 	{"persist", "nopersist", PR_PERSIST},
179592bcae8SBjoern A. Zeeb #ifdef INET
180672756aaSJamie Gritton 	{"ip4.saddrsel", "ip4.nosaddrsel", PR_IP4_SADDRSEL},
181592bcae8SBjoern A. Zeeb #endif
182592bcae8SBjoern A. Zeeb #ifdef INET6
183672756aaSJamie Gritton 	{"ip6.saddrsel", "ip6.nosaddrsel", PR_IP6_SADDRSEL},
184592bcae8SBjoern A. Zeeb #endif
1850304c731SJamie Gritton };
186672756aaSJamie Gritton const size_t pr_flag_bool_size = sizeof(pr_flag_bool);
1870304c731SJamie Gritton 
188672756aaSJamie Gritton static struct jailsys_flags pr_flag_jailsys[] = {
1897cbf7213SJamie Gritton 	{"host", 0, PR_HOST},
1907cbf7213SJamie Gritton #ifdef VIMAGE
1917cbf7213SJamie Gritton 	{"vnet", 0, PR_VNET},
1927cbf7213SJamie Gritton #endif
1930304c731SJamie Gritton #ifdef INET
1946a3f2779SJamie Gritton 	{"ip4", PR_IP4_USER, PR_IP4_USER},
1950304c731SJamie Gritton #endif
1960304c731SJamie Gritton #ifdef INET6
1976a3f2779SJamie Gritton 	{"ip6", PR_IP6_USER, PR_IP6_USER},
198679e1390SJamie Gritton #endif
1990304c731SJamie Gritton };
2005cc70397SBjoern A. Zeeb const size_t pr_flag_jailsys_size = sizeof(pr_flag_jailsys);
2010304c731SJamie Gritton 
2025d58f959SJamie Gritton /*
2035d58f959SJamie Gritton  * Make this array full-size so dynamic parameters can be added.
2045d58f959SJamie Gritton  * It is protected by prison0.mtx, but lockless reading is allowed
2055d58f959SJamie Gritton  * with an atomic check of the flag values.
2065d58f959SJamie Gritton  */
2070e5c6bd4SJamie Gritton static struct bool_flags pr_flag_allow[NBBY * NBPW] = {
208672756aaSJamie Gritton 	{"allow.set_hostname", "allow.noset_hostname", PR_ALLOW_SET_HOSTNAME},
209672756aaSJamie Gritton 	{"allow.sysvipc", "allow.nosysvipc", PR_ALLOW_SYSVIPC},
210672756aaSJamie Gritton 	{"allow.raw_sockets", "allow.noraw_sockets", PR_ALLOW_RAW_SOCKETS},
211672756aaSJamie Gritton 	{"allow.chflags", "allow.nochflags", PR_ALLOW_CHFLAGS},
212672756aaSJamie Gritton 	{"allow.mount", "allow.nomount", PR_ALLOW_MOUNT},
213672756aaSJamie Gritton 	{"allow.quotas", "allow.noquotas", PR_ALLOW_QUOTAS},
214672756aaSJamie Gritton 	{"allow.socket_af", "allow.nosocket_af", PR_ALLOW_SOCKET_AF},
215ccd6ac9fSAntoine Brodin 	{"allow.mlock", "allow.nomlock", PR_ALLOW_MLOCK},
216672756aaSJamie Gritton 	{"allow.reserved_ports", "allow.noreserved_ports",
217672756aaSJamie Gritton 	 PR_ALLOW_RESERVED_PORTS},
218b19d66fdSJamie Gritton 	{"allow.read_msgbuf", "allow.noread_msgbuf", PR_ALLOW_READ_MSGBUF},
219b3079544SJamie Gritton 	{"allow.unprivileged_proc_debug", "allow.nounprivileged_proc_debug",
220b3079544SJamie Gritton 	 PR_ALLOW_UNPRIV_DEBUG},
22105e1e482SMariusz Zaborski 	{"allow.suser", "allow.nosuser", PR_ALLOW_SUSER},
222bba7a2e8SRick Macklem #if defined(VNET_NFSD) && defined(VIMAGE) && defined(NFSD)
223bba7a2e8SRick Macklem 	{"allow.nfsd", "allow.nonfsd", PR_ALLOW_NFSD},
224bba7a2e8SRick Macklem #endif
2250304c731SJamie Gritton };
2265d58f959SJamie Gritton static unsigned pr_allow_all = PR_ALLOW_ALL_STATIC;
227672756aaSJamie Gritton const size_t pr_flag_allow_size = sizeof(pr_flag_allow);
2280304c731SJamie Gritton 
229b3079544SJamie Gritton #define	JAIL_DEFAULT_ALLOW		(PR_ALLOW_SET_HOSTNAME | \
230b3079544SJamie Gritton 					 PR_ALLOW_RESERVED_PORTS | \
23105e1e482SMariusz Zaborski 					 PR_ALLOW_UNPRIV_DEBUG | \
23205e1e482SMariusz Zaborski 					 PR_ALLOW_SUSER)
23342bebd82SJamie Gritton #define	JAIL_DEFAULT_ENFORCE_STATFS	2
234bf3db8aaSMartin Matuska #define	JAIL_DEFAULT_DEVFS_RSNUM	0
2350304c731SJamie Gritton static unsigned jail_default_allow = JAIL_DEFAULT_ALLOW;
23642bebd82SJamie Gritton static int jail_default_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS;
2370cc207a6SMartin Matuska static int jail_default_devfs_rsnum = JAIL_DEFAULT_DEVFS_RSNUM;
2380304c731SJamie Gritton #if defined(INET) || defined(INET6)
239e92e0574SJamie Gritton static unsigned jail_max_af_ips = 255;
2400304c731SJamie Gritton #endif
2410304c731SJamie Gritton 
242b96bd95bSIan Lepore /*
243b96bd95bSIan Lepore  * Initialize the parts of prison0 that can't be static-initialized with
244b96bd95bSIan Lepore  * constants.  This is called from proc0_init() after creating thread0 cpuset.
245b96bd95bSIan Lepore  */
246b96bd95bSIan Lepore void
247b96bd95bSIan Lepore prison0_init(void)
248b96bd95bSIan Lepore {
249c3188289SKyle Evans 	uint8_t *file, *data;
250c3188289SKyle Evans 	size_t size;
251d2ef3774SJessica Clarke 	char buf[sizeof(prison0.pr_hostuuid)];
252d2ef3774SJessica Clarke 	bool valid;
253b96bd95bSIan Lepore 
254b96bd95bSIan Lepore 	prison0.pr_cpuset = cpuset_ref(thread0.td_cpuset);
255b96bd95bSIan Lepore 	prison0.pr_osreldate = osreldate;
256b96bd95bSIan Lepore 	strlcpy(prison0.pr_osrelease, osrelease, sizeof(prison0.pr_osrelease));
257c3188289SKyle Evans 
258c3188289SKyle Evans 	/* If we have a preloaded hostuuid, use it. */
259c3188289SKyle Evans 	file = preload_search_by_type(PRISON0_HOSTUUID_MODULE);
260c3188289SKyle Evans 	if (file != NULL) {
261c3188289SKyle Evans 		data = preload_fetch_addr(file);
262c3188289SKyle Evans 		size = preload_fetch_size(file);
263c3188289SKyle Evans 		if (data != NULL) {
264c3188289SKyle Evans 			/*
265c3188289SKyle Evans 			 * The preloaded data may include trailing whitespace, almost
266c3188289SKyle Evans 			 * certainly a newline; skip over any whitespace or
267c3188289SKyle Evans 			 * non-printable characters to be safe.
268c3188289SKyle Evans 			 */
269c3188289SKyle Evans 			while (size > 0 && data[size - 1] <= 0x20) {
270b6be9566SColin Percival 				size--;
271c3188289SKyle Evans 			}
272d2ef3774SJessica Clarke 
273d2ef3774SJessica Clarke 			valid = false;
274d2ef3774SJessica Clarke 
275d2ef3774SJessica Clarke 			/*
276d2ef3774SJessica Clarke 			 * Not NUL-terminated when passed from loader, but
277d2ef3774SJessica Clarke 			 * validate_uuid requires that due to using sscanf (as
278d2ef3774SJessica Clarke 			 * does the subsequent strlcpy, since it still reads
279d2ef3774SJessica Clarke 			 * past the given size to return the true length);
280d2ef3774SJessica Clarke 			 * bounce to a temporary buffer to fix.
281d2ef3774SJessica Clarke 			 */
282d2ef3774SJessica Clarke 			if (size >= sizeof(buf))
283d2ef3774SJessica Clarke 				goto done;
284d2ef3774SJessica Clarke 
285d2ef3774SJessica Clarke 			memcpy(buf, data, size);
286d2ef3774SJessica Clarke 			buf[size] = '\0';
287d2ef3774SJessica Clarke 
288d2ef3774SJessica Clarke 			if (validate_uuid(buf, size, NULL, 0) != 0)
289d2ef3774SJessica Clarke 				goto done;
290d2ef3774SJessica Clarke 
291d2ef3774SJessica Clarke 			valid = true;
292d2ef3774SJessica Clarke 			(void)strlcpy(prison0.pr_hostuuid, buf,
293d2ef3774SJessica Clarke 			    sizeof(prison0.pr_hostuuid));
294d2ef3774SJessica Clarke 
295d2ef3774SJessica Clarke done:
296d2ef3774SJessica Clarke 			if (bootverbose && !valid) {
297330f110bSColin Percival 				printf("hostuuid: preload data malformed: '%.*s'\n",
298330f110bSColin Percival 				    (int)size, data);
299c3188289SKyle Evans 			}
300c3188289SKyle Evans 		}
301c3188289SKyle Evans 	}
302c3188289SKyle Evans 	if (bootverbose)
303c3188289SKyle Evans 		printf("hostuuid: using %s\n", prison0.pr_hostuuid);
304b96bd95bSIan Lepore }
305b96bd95bSIan Lepore 
306116734c4SMatthew Dillon /*
3079ddb7954SMike Barcroft  * struct jail_args {
3089ddb7954SMike Barcroft  *	struct jail *jail;
3099ddb7954SMike Barcroft  * };
310116734c4SMatthew Dillon  */
31175c13541SPoul-Henning Kamp int
312c542c43eSJamie Gritton sys_jail(struct thread *td, struct jail_args *uap)
31375c13541SPoul-Henning Kamp {
314413628a7SBjoern A. Zeeb 	uint32_t version;
315413628a7SBjoern A. Zeeb 	int error;
3160304c731SJamie Gritton 	struct jail j;
317413628a7SBjoern A. Zeeb 
318413628a7SBjoern A. Zeeb 	error = copyin(uap->jail, &version, sizeof(uint32_t));
319413628a7SBjoern A. Zeeb 	if (error)
320413628a7SBjoern A. Zeeb 		return (error);
321413628a7SBjoern A. Zeeb 
322413628a7SBjoern A. Zeeb 	switch (version) {
323413628a7SBjoern A. Zeeb 	case 0:
324413628a7SBjoern A. Zeeb 	{
325413628a7SBjoern A. Zeeb 		struct jail_v0 j0;
326413628a7SBjoern A. Zeeb 
3270304c731SJamie Gritton 		/* FreeBSD single IPv4 jails. */
3280304c731SJamie Gritton 		bzero(&j, sizeof(struct jail));
329413628a7SBjoern A. Zeeb 		error = copyin(uap->jail, &j0, sizeof(struct jail_v0));
330413628a7SBjoern A. Zeeb 		if (error)
331413628a7SBjoern A. Zeeb 			return (error);
3320304c731SJamie Gritton 		j.version = j0.version;
3330304c731SJamie Gritton 		j.path = j0.path;
3340304c731SJamie Gritton 		j.hostname = j0.hostname;
335b5019bc4SPeter Wemm 		j.ip4s = htonl(j0.ip_number);	/* jail_v0 is host order */
336413628a7SBjoern A. Zeeb 		break;
337413628a7SBjoern A. Zeeb 	}
338413628a7SBjoern A. Zeeb 
339413628a7SBjoern A. Zeeb 	case 1:
340413628a7SBjoern A. Zeeb 		/*
341413628a7SBjoern A. Zeeb 		 * Version 1 was used by multi-IPv4 jail implementations
342413628a7SBjoern A. Zeeb 		 * that never made it into the official kernel.
343413628a7SBjoern A. Zeeb 		 */
344413628a7SBjoern A. Zeeb 		return (EINVAL);
345413628a7SBjoern A. Zeeb 
346413628a7SBjoern A. Zeeb 	case 2:	/* JAIL_API_VERSION */
347413628a7SBjoern A. Zeeb 		/* FreeBSD multi-IPv4/IPv6,noIP jails. */
348413628a7SBjoern A. Zeeb 		error = copyin(uap->jail, &j, sizeof(struct jail));
349413628a7SBjoern A. Zeeb 		if (error)
350413628a7SBjoern A. Zeeb 			return (error);
3510304c731SJamie Gritton 		break;
3520304c731SJamie Gritton 
3530304c731SJamie Gritton 	default:
3540304c731SJamie Gritton 		/* Sci-Fi jails are not supported, sorry. */
3550304c731SJamie Gritton 		return (EINVAL);
3560304c731SJamie Gritton 	}
357c542c43eSJamie Gritton 	return (kern_jail(td, &j));
3580304c731SJamie Gritton }
3590304c731SJamie Gritton 
3600304c731SJamie Gritton int
361c542c43eSJamie Gritton kern_jail(struct thread *td, struct jail *j)
3620304c731SJamie Gritton {
363c542c43eSJamie Gritton 	struct iovec optiov[2 * (4 + nitems(pr_flag_allow)
364e92e0574SJamie Gritton #ifdef INET
365e92e0574SJamie Gritton 			    + 1
366e92e0574SJamie Gritton #endif
367e92e0574SJamie Gritton #ifdef INET6
368e92e0574SJamie Gritton 			    + 1
369e92e0574SJamie Gritton #endif
370e92e0574SJamie Gritton 			    )];
3710304c731SJamie Gritton 	struct uio opt;
3720304c731SJamie Gritton 	char *u_path, *u_hostname, *u_name;
373672756aaSJamie Gritton 	struct bool_flags *bf;
3740304c731SJamie Gritton #ifdef INET
375e92e0574SJamie Gritton 	uint32_t ip4s;
3760304c731SJamie Gritton 	struct in_addr *u_ip4;
3770304c731SJamie Gritton #endif
3780304c731SJamie Gritton #ifdef INET6
3790304c731SJamie Gritton 	struct in6_addr *u_ip6;
3800304c731SJamie Gritton #endif
3810304c731SJamie Gritton 	size_t tmplen;
382c542c43eSJamie Gritton 	int error, enforce_statfs;
3830304c731SJamie Gritton 
3840304c731SJamie Gritton 	bzero(&optiov, sizeof(optiov));
3850304c731SJamie Gritton 	opt.uio_iov = optiov;
3860304c731SJamie Gritton 	opt.uio_iovcnt = 0;
3870304c731SJamie Gritton 	opt.uio_offset = -1;
3880304c731SJamie Gritton 	opt.uio_resid = -1;
3890304c731SJamie Gritton 	opt.uio_segflg = UIO_SYSSPACE;
3900304c731SJamie Gritton 	opt.uio_rw = UIO_READ;
3910304c731SJamie Gritton 	opt.uio_td = td;
3920304c731SJamie Gritton 
3930304c731SJamie Gritton 	/* Set permissions for top-level jails from sysctls. */
3940304c731SJamie Gritton 	if (!jailed(td->td_ucred)) {
395672756aaSJamie Gritton 		for (bf = pr_flag_allow;
3960e5c6bd4SJamie Gritton 		     bf < pr_flag_allow + nitems(pr_flag_allow) &&
3975d58f959SJamie Gritton 			atomic_load_int(&bf->flag) != 0;
398672756aaSJamie Gritton 		     bf++) {
399672756aaSJamie Gritton 			optiov[opt.uio_iovcnt].iov_base = __DECONST(char *,
400672756aaSJamie Gritton 			    (jail_default_allow & bf->flag)
401672756aaSJamie Gritton 			    ? bf->name : bf->noname);
4020304c731SJamie Gritton 			optiov[opt.uio_iovcnt].iov_len =
4030304c731SJamie Gritton 			    strlen(optiov[opt.uio_iovcnt].iov_base) + 1;
4040304c731SJamie Gritton 			opt.uio_iovcnt += 2;
4050304c731SJamie Gritton 		}
4060304c731SJamie Gritton 		optiov[opt.uio_iovcnt].iov_base = "enforce_statfs";
4070304c731SJamie Gritton 		optiov[opt.uio_iovcnt].iov_len = sizeof("enforce_statfs");
4080304c731SJamie Gritton 		opt.uio_iovcnt++;
4090304c731SJamie Gritton 		enforce_statfs = jail_default_enforce_statfs;
4100304c731SJamie Gritton 		optiov[opt.uio_iovcnt].iov_base = &enforce_statfs;
4110304c731SJamie Gritton 		optiov[opt.uio_iovcnt].iov_len = sizeof(enforce_statfs);
4120304c731SJamie Gritton 		opt.uio_iovcnt++;
4130304c731SJamie Gritton 	}
4140304c731SJamie Gritton 
415b38ff370SJamie Gritton 	tmplen = MAXPATHLEN + MAXHOSTNAMELEN + MAXHOSTNAMELEN;
416b38ff370SJamie Gritton #ifdef INET
4170304c731SJamie Gritton 	ip4s = (j->version == 0) ? 1 : j->ip4s;
4180304c731SJamie Gritton 	if (ip4s > jail_max_af_ips)
419b38ff370SJamie Gritton 		return (EINVAL);
4200304c731SJamie Gritton 	tmplen += ip4s * sizeof(struct in_addr);
421b38ff370SJamie Gritton #else
4220304c731SJamie Gritton 	if (j->ip4s > 0)
423b38ff370SJamie Gritton 		return (EINVAL);
424b38ff370SJamie Gritton #endif
425b38ff370SJamie Gritton #ifdef INET6
4260304c731SJamie Gritton 	if (j->ip6s > jail_max_af_ips)
427b38ff370SJamie Gritton 		return (EINVAL);
4280304c731SJamie Gritton 	tmplen += j->ip6s * sizeof(struct in6_addr);
429b38ff370SJamie Gritton #else
4300304c731SJamie Gritton 	if (j->ip6s > 0)
431b38ff370SJamie Gritton 		return (EINVAL);
432b38ff370SJamie Gritton #endif
433b38ff370SJamie Gritton 	u_path = malloc(tmplen, M_TEMP, M_WAITOK);
434b38ff370SJamie Gritton 	u_hostname = u_path + MAXPATHLEN;
435b38ff370SJamie Gritton 	u_name = u_hostname + MAXHOSTNAMELEN;
436b38ff370SJamie Gritton #ifdef INET
437b38ff370SJamie Gritton 	u_ip4 = (struct in_addr *)(u_name + MAXHOSTNAMELEN);
438b38ff370SJamie Gritton #endif
439b38ff370SJamie Gritton #ifdef INET6
440b38ff370SJamie Gritton #ifdef INET
4410304c731SJamie Gritton 	u_ip6 = (struct in6_addr *)(u_ip4 + ip4s);
442b38ff370SJamie Gritton #else
443b38ff370SJamie Gritton 	u_ip6 = (struct in6_addr *)(u_name + MAXHOSTNAMELEN);
444b38ff370SJamie Gritton #endif
445b38ff370SJamie Gritton #endif
4460304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = "path";
4470304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = sizeof("path");
4480304c731SJamie Gritton 	opt.uio_iovcnt++;
4490304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = u_path;
4500304c731SJamie Gritton 	error = copyinstr(j->path, u_path, MAXPATHLEN,
4510304c731SJamie Gritton 	    &optiov[opt.uio_iovcnt].iov_len);
452b38ff370SJamie Gritton 	if (error) {
453b38ff370SJamie Gritton 		free(u_path, M_TEMP);
454b38ff370SJamie Gritton 		return (error);
455b38ff370SJamie Gritton 	}
4560304c731SJamie Gritton 	opt.uio_iovcnt++;
4570304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = "host.hostname";
4580304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = sizeof("host.hostname");
4590304c731SJamie Gritton 	opt.uio_iovcnt++;
4600304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = u_hostname;
4610304c731SJamie Gritton 	error = copyinstr(j->hostname, u_hostname, MAXHOSTNAMELEN,
4620304c731SJamie Gritton 	    &optiov[opt.uio_iovcnt].iov_len);
463b38ff370SJamie Gritton 	if (error) {
464b38ff370SJamie Gritton 		free(u_path, M_TEMP);
465b38ff370SJamie Gritton 		return (error);
466b38ff370SJamie Gritton 	}
4670304c731SJamie Gritton 	opt.uio_iovcnt++;
4680304c731SJamie Gritton 	if (j->jailname != NULL) {
469b38ff370SJamie Gritton 		optiov[opt.uio_iovcnt].iov_base = "name";
470b38ff370SJamie Gritton 		optiov[opt.uio_iovcnt].iov_len = sizeof("name");
471b38ff370SJamie Gritton 		opt.uio_iovcnt++;
472b38ff370SJamie Gritton 		optiov[opt.uio_iovcnt].iov_base = u_name;
4730304c731SJamie Gritton 		error = copyinstr(j->jailname, u_name, MAXHOSTNAMELEN,
474b38ff370SJamie Gritton 		    &optiov[opt.uio_iovcnt].iov_len);
475b38ff370SJamie Gritton 		if (error) {
476b38ff370SJamie Gritton 			free(u_path, M_TEMP);
477b38ff370SJamie Gritton 			return (error);
478b38ff370SJamie Gritton 		}
479b38ff370SJamie Gritton 		opt.uio_iovcnt++;
480b38ff370SJamie Gritton 	}
481b38ff370SJamie Gritton #ifdef INET
482b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = "ip4.addr";
483b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = sizeof("ip4.addr");
484b38ff370SJamie Gritton 	opt.uio_iovcnt++;
485b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = u_ip4;
4860304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = ip4s * sizeof(struct in_addr);
4870304c731SJamie Gritton 	if (j->version == 0)
4880304c731SJamie Gritton 		u_ip4->s_addr = j->ip4s;
4890304c731SJamie Gritton 	else {
4900304c731SJamie Gritton 		error = copyin(j->ip4, u_ip4, optiov[opt.uio_iovcnt].iov_len);
491b38ff370SJamie Gritton 		if (error) {
492b38ff370SJamie Gritton 			free(u_path, M_TEMP);
493b38ff370SJamie Gritton 			return (error);
494b38ff370SJamie Gritton 		}
4950304c731SJamie Gritton 	}
496b38ff370SJamie Gritton 	opt.uio_iovcnt++;
497b38ff370SJamie Gritton #endif
498b38ff370SJamie Gritton #ifdef INET6
499b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = "ip6.addr";
500b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = sizeof("ip6.addr");
501b38ff370SJamie Gritton 	opt.uio_iovcnt++;
502b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = u_ip6;
5030304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = j->ip6s * sizeof(struct in6_addr);
5040304c731SJamie Gritton 	error = copyin(j->ip6, u_ip6, optiov[opt.uio_iovcnt].iov_len);
505b38ff370SJamie Gritton 	if (error) {
506b38ff370SJamie Gritton 		free(u_path, M_TEMP);
507b38ff370SJamie Gritton 		return (error);
508b38ff370SJamie Gritton 	}
509b38ff370SJamie Gritton 	opt.uio_iovcnt++;
510b38ff370SJamie Gritton #endif
51102abd400SPedro F. Giffuni 	KASSERT(opt.uio_iovcnt <= nitems(optiov),
5120304c731SJamie Gritton 		("kern_jail: too many iovecs (%d)", opt.uio_iovcnt));
513b38ff370SJamie Gritton 	error = kern_jail_set(td, &opt, JAIL_CREATE | JAIL_ATTACH);
514b38ff370SJamie Gritton 	free(u_path, M_TEMP);
515b38ff370SJamie Gritton 	return (error);
516b38ff370SJamie Gritton }
517b38ff370SJamie Gritton 
518b38ff370SJamie Gritton /*
519b38ff370SJamie Gritton  * struct jail_set_args {
520b38ff370SJamie Gritton  *	struct iovec *iovp;
521b38ff370SJamie Gritton  *	unsigned int iovcnt;
522b38ff370SJamie Gritton  *	int flags;
523b38ff370SJamie Gritton  * };
524b38ff370SJamie Gritton  */
525b38ff370SJamie Gritton int
5268451d0ddSKip Macy sys_jail_set(struct thread *td, struct jail_set_args *uap)
527b38ff370SJamie Gritton {
528b38ff370SJamie Gritton 	struct uio *auio;
529b38ff370SJamie Gritton 	int error;
530b38ff370SJamie Gritton 
531b38ff370SJamie Gritton 	/* Check that we have an even number of iovecs. */
532b38ff370SJamie Gritton 	if (uap->iovcnt & 1)
533b38ff370SJamie Gritton 		return (EINVAL);
534b38ff370SJamie Gritton 
535b38ff370SJamie Gritton 	error = copyinuio(uap->iovp, uap->iovcnt, &auio);
536b38ff370SJamie Gritton 	if (error)
537b38ff370SJamie Gritton 		return (error);
538b38ff370SJamie Gritton 	error = kern_jail_set(td, auio, uap->flags);
539b38ff370SJamie Gritton 	free(auio, M_IOV);
540b38ff370SJamie Gritton 	return (error);
541413628a7SBjoern A. Zeeb }
542413628a7SBjoern A. Zeeb 
543eb8dcdeaSGleb Smirnoff #if defined(INET) || defined(INET6)
544eb8dcdeaSGleb Smirnoff typedef int prison_addr_cmp_t(const void *, const void *);
545eb8dcdeaSGleb Smirnoff typedef bool prison_addr_valid_t(const void *);
546eb8dcdeaSGleb Smirnoff static const struct pr_family {
547eb8dcdeaSGleb Smirnoff 	size_t			size;
548eb8dcdeaSGleb Smirnoff 	prison_addr_cmp_t	*cmp;
549eb8dcdeaSGleb Smirnoff 	prison_addr_valid_t	*valid;
550eb8dcdeaSGleb Smirnoff 	int			ip_flag;
551eb8dcdeaSGleb Smirnoff } pr_families[PR_FAMILY_MAX] = {
552eb8dcdeaSGleb Smirnoff #ifdef INET
553eb8dcdeaSGleb Smirnoff 	[PR_INET] = {
554eb8dcdeaSGleb Smirnoff 		.size = sizeof(struct in_addr),
555eb8dcdeaSGleb Smirnoff 		.cmp = prison_qcmp_v4,
556eb8dcdeaSGleb Smirnoff 		.valid = prison_valid_v4,
557eb8dcdeaSGleb Smirnoff 		.ip_flag = PR_IP4_USER,
558eb8dcdeaSGleb Smirnoff 	 },
559eb8dcdeaSGleb Smirnoff #endif
560eb8dcdeaSGleb Smirnoff #ifdef INET6
561eb8dcdeaSGleb Smirnoff 	[PR_INET6] = {
562eb8dcdeaSGleb Smirnoff 		.size = sizeof(struct in6_addr),
563eb8dcdeaSGleb Smirnoff 		.cmp = prison_qcmp_v6,
564eb8dcdeaSGleb Smirnoff 		.valid = prison_valid_v6,
565eb8dcdeaSGleb Smirnoff 		.ip_flag = PR_IP6_USER,
566eb8dcdeaSGleb Smirnoff 	},
567eb8dcdeaSGleb Smirnoff #endif
568eb8dcdeaSGleb Smirnoff };
569eb8dcdeaSGleb Smirnoff 
570eb8dcdeaSGleb Smirnoff /*
571eb8dcdeaSGleb Smirnoff  * Network address lists (pr_addrs) allocation for jails.  The addresses
572eb8dcdeaSGleb Smirnoff  * are accessed locklessly by the network stack, thus need to be protected by
573eb8dcdeaSGleb Smirnoff  * the network epoch.
574eb8dcdeaSGleb Smirnoff  */
575eb8dcdeaSGleb Smirnoff struct prison_ip {
576eb8dcdeaSGleb Smirnoff 	struct epoch_context ctx;
577eb8dcdeaSGleb Smirnoff 	uint32_t	ips;
578eb8dcdeaSGleb Smirnoff #ifdef FUTURE_C
579eb8dcdeaSGleb Smirnoff 	union {
580eb8dcdeaSGleb Smirnoff 		struct in_addr pr_ip4[];
581eb8dcdeaSGleb Smirnoff 		struct in6_addr pr_ip6[];
582eb8dcdeaSGleb Smirnoff 	};
583eb8dcdeaSGleb Smirnoff #else /* No future C :( */
584eb8dcdeaSGleb Smirnoff #define	PR_IP(pip, i)	((const char *)((pip) + 1) + pr_families[af].size * (i))
585eb8dcdeaSGleb Smirnoff #define	PR_IPD(pip, i)	((char *)((pip) + 1) + pr_families[af].size * (i))
586eb8dcdeaSGleb Smirnoff #endif
587eb8dcdeaSGleb Smirnoff };
588eb8dcdeaSGleb Smirnoff 
589eb8dcdeaSGleb Smirnoff static struct prison_ip *
590eb8dcdeaSGleb Smirnoff prison_ip_alloc(const pr_family_t af, uint32_t cnt, int flags)
591eb8dcdeaSGleb Smirnoff {
592eb8dcdeaSGleb Smirnoff 	struct prison_ip *pip;
593eb8dcdeaSGleb Smirnoff 
594eb8dcdeaSGleb Smirnoff 	pip = malloc(sizeof(struct prison_ip) + cnt * pr_families[af].size,
595eb8dcdeaSGleb Smirnoff 	    M_PRISON, flags);
596eb8dcdeaSGleb Smirnoff 	if (pip != NULL)
597eb8dcdeaSGleb Smirnoff 		pip->ips = cnt;
598eb8dcdeaSGleb Smirnoff 	return (pip);
599eb8dcdeaSGleb Smirnoff }
600eb8dcdeaSGleb Smirnoff 
601eb8dcdeaSGleb Smirnoff /*
602eb8dcdeaSGleb Smirnoff  * Allocate and copyin user supplied address list, sorting and validating.
603eb8dcdeaSGleb Smirnoff  * kern_jail_set() helper.
604eb8dcdeaSGleb Smirnoff  */
605eb8dcdeaSGleb Smirnoff static struct prison_ip *
606eb8dcdeaSGleb Smirnoff prison_ip_copyin(const pr_family_t af, void *op, uint32_t cnt)
607eb8dcdeaSGleb Smirnoff {
608eb8dcdeaSGleb Smirnoff 	prison_addr_cmp_t *const cmp = pr_families[af].cmp;
609eb8dcdeaSGleb Smirnoff 	const size_t size = pr_families[af].size;
610eb8dcdeaSGleb Smirnoff 	struct prison_ip *pip;
611eb8dcdeaSGleb Smirnoff 
612eb8dcdeaSGleb Smirnoff 	pip = prison_ip_alloc(af, cnt, M_WAITOK);
613eb8dcdeaSGleb Smirnoff 	bcopy(op, pip + 1, cnt * size);
614eb8dcdeaSGleb Smirnoff 	/*
615eb8dcdeaSGleb Smirnoff 	 * IP addresses are all sorted but ip[0] to preserve
616eb8dcdeaSGleb Smirnoff 	 * the primary IP address as given from userland.
617eb8dcdeaSGleb Smirnoff 	 * This special IP is used for unbound outgoing
618eb8dcdeaSGleb Smirnoff 	 * connections as well for "loopback" traffic in case
619eb8dcdeaSGleb Smirnoff 	 * source address selection cannot find any more fitting
620eb8dcdeaSGleb Smirnoff 	 * address to connect from.
621eb8dcdeaSGleb Smirnoff 	 */
622eb8dcdeaSGleb Smirnoff 	if (cnt > 1)
623eb8dcdeaSGleb Smirnoff 		qsort((char *)(pip + 1) + size, cnt - 1, size,
624eb8dcdeaSGleb Smirnoff 		    pr_families[af].cmp);
625eb8dcdeaSGleb Smirnoff 	/*
626eb8dcdeaSGleb Smirnoff 	 * Check for duplicate addresses and do some simple
627eb8dcdeaSGleb Smirnoff 	 * zero and broadcast checks. If users give other bogus
628eb8dcdeaSGleb Smirnoff 	 * addresses it is their problem.
629eb8dcdeaSGleb Smirnoff 	 */
630eb8dcdeaSGleb Smirnoff 	for (int i = 0; i < cnt; i++) {
631eb8dcdeaSGleb Smirnoff 		if (!pr_families[af].valid(PR_IP(pip, i))) {
632eb8dcdeaSGleb Smirnoff 			free(pip, M_PRISON);
633eb8dcdeaSGleb Smirnoff 			return (NULL);
634eb8dcdeaSGleb Smirnoff 		}
635eb8dcdeaSGleb Smirnoff 		if (i + 1 < cnt &&
636eb8dcdeaSGleb Smirnoff 		    (cmp(PR_IP(pip, 0), PR_IP(pip, i + 1)) == 0 ||
637eb8dcdeaSGleb Smirnoff 		     cmp(PR_IP(pip, i), PR_IP(pip, i + 1)) == 0)) {
638eb8dcdeaSGleb Smirnoff 			free(pip, M_PRISON);
639eb8dcdeaSGleb Smirnoff 			return (NULL);
640eb8dcdeaSGleb Smirnoff 		}
641eb8dcdeaSGleb Smirnoff 	}
642eb8dcdeaSGleb Smirnoff 
643eb8dcdeaSGleb Smirnoff 	return (pip);
644eb8dcdeaSGleb Smirnoff }
645eb8dcdeaSGleb Smirnoff 
646eb8dcdeaSGleb Smirnoff /*
647eb8dcdeaSGleb Smirnoff  * Allocate and dup parent prison address list.
648eb8dcdeaSGleb Smirnoff  * kern_jail_set() helper.
649eb8dcdeaSGleb Smirnoff  */
650eb8dcdeaSGleb Smirnoff static void
651eb8dcdeaSGleb Smirnoff prison_ip_dup(struct prison *ppr, struct prison *pr, const pr_family_t af)
652eb8dcdeaSGleb Smirnoff {
653eb8dcdeaSGleb Smirnoff 
654eb8dcdeaSGleb Smirnoff 	if (ppr->pr_addrs[af] != NULL) {
655eb8dcdeaSGleb Smirnoff 		pr->pr_addrs[af] = prison_ip_alloc(af,
656eb8dcdeaSGleb Smirnoff 		    ppr->pr_addrs[af]->ips, M_WAITOK);
657ddbf879dSZhenlei Huang 		bcopy(ppr->pr_addrs[af] + 1, pr->pr_addrs[af] + 1,
658eb8dcdeaSGleb Smirnoff 		    pr->pr_addrs[af]->ips * pr_families[af].size);
659eb8dcdeaSGleb Smirnoff 	}
660eb8dcdeaSGleb Smirnoff }
661eb8dcdeaSGleb Smirnoff 
662eb8dcdeaSGleb Smirnoff /*
663eb8dcdeaSGleb Smirnoff  * Make sure the new set of IP addresses is a subset of the parent's list.
664eb8dcdeaSGleb Smirnoff  * Don't worry about the parent being unlocked, as any setting is done with
665eb8dcdeaSGleb Smirnoff  * allprison_lock held.
666eb8dcdeaSGleb Smirnoff  * kern_jail_set() helper.
667eb8dcdeaSGleb Smirnoff  */
668eb8dcdeaSGleb Smirnoff static bool
669eb8dcdeaSGleb Smirnoff prison_ip_parent_match(const struct prison_ip *ppip,
670eb8dcdeaSGleb Smirnoff     const struct prison_ip *pip, const pr_family_t af)
671eb8dcdeaSGleb Smirnoff {
672eb8dcdeaSGleb Smirnoff 	prison_addr_cmp_t *const cmp = pr_families[af].cmp;
673eb8dcdeaSGleb Smirnoff 	int i, j;
674eb8dcdeaSGleb Smirnoff 
675eb8dcdeaSGleb Smirnoff 	if (ppip == NULL)
676eb8dcdeaSGleb Smirnoff 		return (false);
677eb8dcdeaSGleb Smirnoff 
678eb8dcdeaSGleb Smirnoff 	for (i = 0; i < ppip->ips; i++)
679eb8dcdeaSGleb Smirnoff 		if (cmp(PR_IP(pip, 0), PR_IP(ppip, i)) == 0)
680eb8dcdeaSGleb Smirnoff 			break;
681eb8dcdeaSGleb Smirnoff 
682eb8dcdeaSGleb Smirnoff 	if (i == ppip->ips)
683eb8dcdeaSGleb Smirnoff 		/* Main address not present in parent. */
684eb8dcdeaSGleb Smirnoff 		return (false);
685eb8dcdeaSGleb Smirnoff 
686eb8dcdeaSGleb Smirnoff 	if (pip->ips > 1) {
687eb8dcdeaSGleb Smirnoff 		for (i = j = 1; i < pip->ips; i++) {
688eb8dcdeaSGleb Smirnoff 			if (cmp(PR_IP(pip, i), PR_IP(ppip, 0)) == 0)
689eb8dcdeaSGleb Smirnoff 				/* Equals to parent primary address. */
690eb8dcdeaSGleb Smirnoff 				continue;
691eb8dcdeaSGleb Smirnoff 			for (; j < ppip->ips; j++)
692eb8dcdeaSGleb Smirnoff 				if (cmp(PR_IP(pip, i), PR_IP(ppip, j)) == 0)
693eb8dcdeaSGleb Smirnoff 					break;
694eb8dcdeaSGleb Smirnoff 			if (j == ppip->ips)
695eb8dcdeaSGleb Smirnoff 				break;
696eb8dcdeaSGleb Smirnoff 		}
697eb8dcdeaSGleb Smirnoff 		if (j == ppip->ips)
698eb8dcdeaSGleb Smirnoff 			/* Address not present in parent. */
699eb8dcdeaSGleb Smirnoff 			return (false);
700eb8dcdeaSGleb Smirnoff 	}
701eb8dcdeaSGleb Smirnoff 	return (true);
702eb8dcdeaSGleb Smirnoff }
703eb8dcdeaSGleb Smirnoff 
704eb8dcdeaSGleb Smirnoff /*
705eb8dcdeaSGleb Smirnoff  * Check for conflicting IP addresses.  We permit them if there is no more
706eb8dcdeaSGleb Smirnoff  * than one IP on each jail.  If there is a duplicate on a jail with more
707eb8dcdeaSGleb Smirnoff  * than one IP stop checking and return error.
708eb8dcdeaSGleb Smirnoff  * kern_jail_set() helper.
709eb8dcdeaSGleb Smirnoff  */
710eb8dcdeaSGleb Smirnoff static bool
711eb8dcdeaSGleb Smirnoff prison_ip_conflict_check(const struct prison *ppr, const struct prison *pr,
712eb8dcdeaSGleb Smirnoff     const struct prison_ip *pip, pr_family_t af)
713eb8dcdeaSGleb Smirnoff {
714eb8dcdeaSGleb Smirnoff 	const struct prison *tppr, *tpr;
715eb8dcdeaSGleb Smirnoff 	int descend;
716eb8dcdeaSGleb Smirnoff 
717eb8dcdeaSGleb Smirnoff #ifdef VIMAGE
718eb8dcdeaSGleb Smirnoff 	for (tppr = ppr; tppr != &prison0; tppr = tppr->pr_parent)
719eb8dcdeaSGleb Smirnoff 		if (tppr->pr_flags & PR_VNET)
720eb8dcdeaSGleb Smirnoff 			break;
721eb8dcdeaSGleb Smirnoff #else
722eb8dcdeaSGleb Smirnoff 	tppr = &prison0;
723eb8dcdeaSGleb Smirnoff #endif
724eb8dcdeaSGleb Smirnoff 	FOREACH_PRISON_DESCENDANT(tppr, tpr, descend) {
725eb8dcdeaSGleb Smirnoff 		if (tpr == pr ||
726eb8dcdeaSGleb Smirnoff #ifdef VIMAGE
727eb8dcdeaSGleb Smirnoff 		    (tpr != tppr && (tpr->pr_flags & PR_VNET)) ||
728eb8dcdeaSGleb Smirnoff #endif
729eb8dcdeaSGleb Smirnoff 		    !prison_isalive(tpr)) {
730eb8dcdeaSGleb Smirnoff 			descend = 0;
731eb8dcdeaSGleb Smirnoff 			continue;
732eb8dcdeaSGleb Smirnoff 		}
733eb8dcdeaSGleb Smirnoff 		if (!(tpr->pr_flags & pr_families[af].ip_flag))
734eb8dcdeaSGleb Smirnoff 			continue;
735eb8dcdeaSGleb Smirnoff 		descend = 0;
736eb8dcdeaSGleb Smirnoff 		if (tpr->pr_addrs[af] == NULL ||
737eb8dcdeaSGleb Smirnoff 		    (pip->ips == 1 && tpr->pr_addrs[af]->ips == 1))
738eb8dcdeaSGleb Smirnoff 			continue;
739eb8dcdeaSGleb Smirnoff 		for (int i = 0; i < pip->ips; i++)
740eb8dcdeaSGleb Smirnoff 			if (prison_ip_check(tpr, af, PR_IP(pip, i)) == 0)
741eb8dcdeaSGleb Smirnoff 				return (false);
742eb8dcdeaSGleb Smirnoff 	}
743eb8dcdeaSGleb Smirnoff 
744eb8dcdeaSGleb Smirnoff 	return (true);
745eb8dcdeaSGleb Smirnoff }
746eb8dcdeaSGleb Smirnoff 
747eb8dcdeaSGleb Smirnoff _Static_assert(offsetof(struct prison_ip, ctx) == 0,
748eb8dcdeaSGleb Smirnoff     "prison must start with epoch context");
749eb8dcdeaSGleb Smirnoff static void
750eb8dcdeaSGleb Smirnoff prison_ip_free_deferred(epoch_context_t ctx)
751eb8dcdeaSGleb Smirnoff {
752eb8dcdeaSGleb Smirnoff 
753eb8dcdeaSGleb Smirnoff 	free(ctx, M_PRISON);
754eb8dcdeaSGleb Smirnoff }
755eb8dcdeaSGleb Smirnoff 
756eb8dcdeaSGleb Smirnoff static void
757eb8dcdeaSGleb Smirnoff prison_ip_free(struct prison_ip *pip)
758eb8dcdeaSGleb Smirnoff {
759eb8dcdeaSGleb Smirnoff 
760eb8dcdeaSGleb Smirnoff 	if (pip != NULL)
761eb8dcdeaSGleb Smirnoff 		NET_EPOCH_CALL(prison_ip_free_deferred, &pip->ctx);
762eb8dcdeaSGleb Smirnoff }
763eb8dcdeaSGleb Smirnoff 
764eb8dcdeaSGleb Smirnoff static void
765eb8dcdeaSGleb Smirnoff prison_ip_set(struct prison *pr, const pr_family_t af, struct prison_ip *new)
766eb8dcdeaSGleb Smirnoff {
767eb8dcdeaSGleb Smirnoff 	struct prison_ip **mem, *old;
768eb8dcdeaSGleb Smirnoff 
769eb8dcdeaSGleb Smirnoff 	mtx_assert(&pr->pr_mtx, MA_OWNED);
770eb8dcdeaSGleb Smirnoff 
771eb8dcdeaSGleb Smirnoff 	mem = &pr->pr_addrs[af];
772eb8dcdeaSGleb Smirnoff 
773eb8dcdeaSGleb Smirnoff 	old = *mem;
774eb8dcdeaSGleb Smirnoff 	ck_pr_store_ptr(mem, new);
775eb8dcdeaSGleb Smirnoff 	prison_ip_free(old);
776eb8dcdeaSGleb Smirnoff }
777eb8dcdeaSGleb Smirnoff 
778eb8dcdeaSGleb Smirnoff /*
779eb8dcdeaSGleb Smirnoff  * Restrict a prison's IP address list with its parent's, possibly replacing
780*89ddfbbaSZhenlei Huang  * it.  Return true if the replacement buffer was used (or should redo).
781eb8dcdeaSGleb Smirnoff  * kern_jail_set() helper.
782eb8dcdeaSGleb Smirnoff  */
783eb8dcdeaSGleb Smirnoff static bool
784eb8dcdeaSGleb Smirnoff prison_ip_restrict(struct prison *pr, const pr_family_t af,
785eb8dcdeaSGleb Smirnoff     struct prison_ip *new)
786eb8dcdeaSGleb Smirnoff {
787eb8dcdeaSGleb Smirnoff 	const struct prison_ip *ppip = pr->pr_parent->pr_addrs[af];
788eb8dcdeaSGleb Smirnoff 	const struct prison_ip *pip = pr->pr_addrs[af];
789eb8dcdeaSGleb Smirnoff 	int (*const cmp)(const void *, const void *) = pr_families[af].cmp;
790eb8dcdeaSGleb Smirnoff 	const size_t size = pr_families[af].size;
791eb8dcdeaSGleb Smirnoff 	uint32_t ips;
792*89ddfbbaSZhenlei Huang 	bool alloced, used;
793eb8dcdeaSGleb Smirnoff 
794eb8dcdeaSGleb Smirnoff 	mtx_assert(&pr->pr_mtx, MA_OWNED);
795eb8dcdeaSGleb Smirnoff 
796eb8dcdeaSGleb Smirnoff 	/*
797eb8dcdeaSGleb Smirnoff 	 * Due to epoch-synchronized access to the IP address lists we always
798eb8dcdeaSGleb Smirnoff 	 * allocate a new list even if the old one has enough space.  We could
799eb8dcdeaSGleb Smirnoff 	 * atomically update an IPv4 address inside a list, but that would
800eb8dcdeaSGleb Smirnoff 	 * screw up sorting, and in case of IPv6 we can't even atomically write
801eb8dcdeaSGleb Smirnoff 	 * one.
802eb8dcdeaSGleb Smirnoff 	 */
803*89ddfbbaSZhenlei Huang 	if (ppip == NULL) {
804*89ddfbbaSZhenlei Huang 		if (pip != NULL)
805eb8dcdeaSGleb Smirnoff 			prison_ip_set(pr, af, NULL);
806eb8dcdeaSGleb Smirnoff 		return (false);
807eb8dcdeaSGleb Smirnoff 	}
808*89ddfbbaSZhenlei Huang 
809eb8dcdeaSGleb Smirnoff 	if (!(pr->pr_flags & pr_families[af].ip_flag)) {
810*89ddfbbaSZhenlei Huang 		if (new == NULL) {
811*89ddfbbaSZhenlei Huang 			new = prison_ip_alloc(af, ppip->ips, M_NOWAIT);
812*89ddfbbaSZhenlei Huang 			if (new == NULL)
813*89ddfbbaSZhenlei Huang 				return (true); /* redo */
814*89ddfbbaSZhenlei Huang 			used = false;
815*89ddfbbaSZhenlei Huang 		} else
816*89ddfbbaSZhenlei Huang 			used = true;
817eb8dcdeaSGleb Smirnoff 		/* This has no user settings, so just copy the parent's list. */
818*89ddfbbaSZhenlei Huang 		MPASS(new->ips == ppip->ips);
819*89ddfbbaSZhenlei Huang 		bcopy(ppip + 1, new + 1, ppip->ips * size);
820*89ddfbbaSZhenlei Huang 		prison_ip_set(pr, af, new);
821*89ddfbbaSZhenlei Huang 		return (used);
822*89ddfbbaSZhenlei Huang 	} else if (pip != NULL) {
823eb8dcdeaSGleb Smirnoff 		/* Remove addresses that aren't in the parent. */
824eb8dcdeaSGleb Smirnoff 		int i;
825eb8dcdeaSGleb Smirnoff 
826eb8dcdeaSGleb Smirnoff 		i = 0; /* index in pip */
827eb8dcdeaSGleb Smirnoff 		ips = 0; /* index in new */
828eb8dcdeaSGleb Smirnoff 
829*89ddfbbaSZhenlei Huang 		used = true;
830*89ddfbbaSZhenlei Huang 		if (new == NULL) {
831*89ddfbbaSZhenlei Huang 			new = prison_ip_alloc(af, pip->ips, M_NOWAIT);
832*89ddfbbaSZhenlei Huang 			if (new == NULL)
833*89ddfbbaSZhenlei Huang 				return (true); /* redo */
834*89ddfbbaSZhenlei Huang 			used = false;
835*89ddfbbaSZhenlei Huang 			alloced = true;
836*89ddfbbaSZhenlei Huang 		} else {
837*89ddfbbaSZhenlei Huang 			used = true;
838*89ddfbbaSZhenlei Huang 			alloced = false;
839*89ddfbbaSZhenlei Huang 		}
840*89ddfbbaSZhenlei Huang 
841eb8dcdeaSGleb Smirnoff 		for (int pi = 0; pi < ppip->ips; pi++)
842eb8dcdeaSGleb Smirnoff 			if (cmp(PR_IP(pip, 0), PR_IP(ppip, pi)) == 0) {
843eb8dcdeaSGleb Smirnoff 				/* Found our primary address in parent. */
844eb8dcdeaSGleb Smirnoff 				bcopy(PR_IP(pip, i), PR_IPD(new, ips), size);
845eb8dcdeaSGleb Smirnoff 				i++;
846eb8dcdeaSGleb Smirnoff 				ips++;
847eb8dcdeaSGleb Smirnoff 				break;
848eb8dcdeaSGleb Smirnoff 			}
849eb8dcdeaSGleb Smirnoff 		for (int pi = 1; i < pip->ips; ) {
850eb8dcdeaSGleb Smirnoff 			/* Check against primary, which is unsorted. */
851eb8dcdeaSGleb Smirnoff 			if (cmp(PR_IP(pip, i), PR_IP(ppip, 0)) == 0) {
852eb8dcdeaSGleb Smirnoff 				/* Matches parent's primary address. */
853eb8dcdeaSGleb Smirnoff 				bcopy(PR_IP(pip, i), PR_IPD(new, ips), size);
854eb8dcdeaSGleb Smirnoff 				i++;
855eb8dcdeaSGleb Smirnoff 				ips++;
856eb8dcdeaSGleb Smirnoff 				continue;
857eb8dcdeaSGleb Smirnoff 			}
858eb8dcdeaSGleb Smirnoff 			/* The rest are sorted. */
859eb8dcdeaSGleb Smirnoff 			switch (pi >= ppip->ips ? -1 :
860eb8dcdeaSGleb Smirnoff 				cmp(PR_IP(pip, i), PR_IP(ppip, pi))) {
861eb8dcdeaSGleb Smirnoff 			case -1:
862eb8dcdeaSGleb Smirnoff 				i++;
863eb8dcdeaSGleb Smirnoff 				break;
864eb8dcdeaSGleb Smirnoff 			case 0:
865ddbf879dSZhenlei Huang 				bcopy(PR_IP(pip, i), PR_IPD(new, ips), size);
866eb8dcdeaSGleb Smirnoff 				i++;
867eb8dcdeaSGleb Smirnoff 				pi++;
868eb8dcdeaSGleb Smirnoff 				ips++;
869eb8dcdeaSGleb Smirnoff 				break;
870eb8dcdeaSGleb Smirnoff 			case 1:
871eb8dcdeaSGleb Smirnoff 				pi++;
872eb8dcdeaSGleb Smirnoff 				break;
873eb8dcdeaSGleb Smirnoff 			}
874eb8dcdeaSGleb Smirnoff 		}
875eb8dcdeaSGleb Smirnoff 		if (ips == 0) {
876eb8dcdeaSGleb Smirnoff 			if (alloced)
877eb8dcdeaSGleb Smirnoff 				prison_ip_free(new);
878eb8dcdeaSGleb Smirnoff 			new = NULL;
879*89ddfbbaSZhenlei Huang 			used = false;
880*89ddfbbaSZhenlei Huang 		} else {
881*89ddfbbaSZhenlei Huang 			/* Shrink to real size */
882*89ddfbbaSZhenlei Huang 			KASSERT((new->ips >= ips),
883*89ddfbbaSZhenlei Huang 			    ("Out-of-bounds write to prison_ip %p", new));
884*89ddfbbaSZhenlei Huang 			new->ips = ips;
885eb8dcdeaSGleb Smirnoff 		}
886eb8dcdeaSGleb Smirnoff 		prison_ip_set(pr, af, new);
887*89ddfbbaSZhenlei Huang 		return (used);
888*89ddfbbaSZhenlei Huang 	}
889*89ddfbbaSZhenlei Huang 	return (false);
890eb8dcdeaSGleb Smirnoff }
891eb8dcdeaSGleb Smirnoff 
892eb8dcdeaSGleb Smirnoff /*
893eb8dcdeaSGleb Smirnoff  * Fast-path check if an address belongs to a prison.
894eb8dcdeaSGleb Smirnoff  */
895eb8dcdeaSGleb Smirnoff int
896eb8dcdeaSGleb Smirnoff prison_ip_check(const struct prison *pr, const pr_family_t af,
897eb8dcdeaSGleb Smirnoff     const void *addr)
898eb8dcdeaSGleb Smirnoff {
899eb8dcdeaSGleb Smirnoff 	int (*const cmp)(const void *, const void *) = pr_families[af].cmp;
900eb8dcdeaSGleb Smirnoff 	const struct prison_ip *pip;
901eb8dcdeaSGleb Smirnoff 	int i, a, z, d;
902eb8dcdeaSGleb Smirnoff 
903eb8dcdeaSGleb Smirnoff 	MPASS(mtx_owned(&pr->pr_mtx) ||
904eb8dcdeaSGleb Smirnoff 	    in_epoch(net_epoch_preempt) ||
905eb8dcdeaSGleb Smirnoff 	    sx_xlocked(&allprison_lock));
906eb8dcdeaSGleb Smirnoff 
907eb8dcdeaSGleb Smirnoff 	pip = ck_pr_load_ptr(&pr->pr_addrs[af]);
908eb8dcdeaSGleb Smirnoff 	if (__predict_false(pip == NULL))
909eb8dcdeaSGleb Smirnoff 		return (EAFNOSUPPORT);
910eb8dcdeaSGleb Smirnoff 
911eb8dcdeaSGleb Smirnoff 	/* Check the primary IP. */
912eb8dcdeaSGleb Smirnoff 	if (cmp(PR_IP(pip, 0), addr) == 0)
913eb8dcdeaSGleb Smirnoff 		return (0);
914eb8dcdeaSGleb Smirnoff 
915eb8dcdeaSGleb Smirnoff 	/*
916eb8dcdeaSGleb Smirnoff 	 * All the other IPs are sorted so we can do a binary search.
917eb8dcdeaSGleb Smirnoff 	 */
918eb8dcdeaSGleb Smirnoff 	a = 0;
919eb8dcdeaSGleb Smirnoff 	z = pip->ips - 2;
920eb8dcdeaSGleb Smirnoff 	while (a <= z) {
921eb8dcdeaSGleb Smirnoff 		i = (a + z) / 2;
922eb8dcdeaSGleb Smirnoff 		d = cmp(PR_IP(pip, i + 1), addr);
923eb8dcdeaSGleb Smirnoff 		if (d > 0)
924eb8dcdeaSGleb Smirnoff 			z = i - 1;
925eb8dcdeaSGleb Smirnoff 		else if (d < 0)
926eb8dcdeaSGleb Smirnoff 			a = i + 1;
927eb8dcdeaSGleb Smirnoff 		else
928eb8dcdeaSGleb Smirnoff 			return (0);
929eb8dcdeaSGleb Smirnoff 	}
930eb8dcdeaSGleb Smirnoff 
931eb8dcdeaSGleb Smirnoff 	return (EADDRNOTAVAIL);
932eb8dcdeaSGleb Smirnoff }
933eb8dcdeaSGleb Smirnoff 
934eb8dcdeaSGleb Smirnoff /*
935eb8dcdeaSGleb Smirnoff  * Grab primary IP.  Historically required mutex, but nothing prevents
936eb8dcdeaSGleb Smirnoff  * us to support epoch-protected access.  Is it used in fast path?
937eb8dcdeaSGleb Smirnoff  * in{6}_jail.c helper
938eb8dcdeaSGleb Smirnoff  */
939eb8dcdeaSGleb Smirnoff const void *
940eb8dcdeaSGleb Smirnoff prison_ip_get0(const struct prison *pr, const pr_family_t af)
941eb8dcdeaSGleb Smirnoff {
942eb8dcdeaSGleb Smirnoff 	const struct prison_ip *pip = pr->pr_addrs[af];
943eb8dcdeaSGleb Smirnoff 
944eb8dcdeaSGleb Smirnoff 	mtx_assert(&pr->pr_mtx, MA_OWNED);
945eb8dcdeaSGleb Smirnoff 	MPASS(pip);
946eb8dcdeaSGleb Smirnoff 
947eb8dcdeaSGleb Smirnoff 	return (pip + 1);
948eb8dcdeaSGleb Smirnoff }
949eb8dcdeaSGleb Smirnoff 
950eb8dcdeaSGleb Smirnoff u_int
951eb8dcdeaSGleb Smirnoff prison_ip_cnt(const struct prison *pr, const pr_family_t af)
952eb8dcdeaSGleb Smirnoff {
953eb8dcdeaSGleb Smirnoff 
954eb8dcdeaSGleb Smirnoff 	return (pr->pr_addrs[af]->ips);
955eb8dcdeaSGleb Smirnoff }
956eb8dcdeaSGleb Smirnoff #endif	/* defined(INET) || defined(INET6) */
957eb8dcdeaSGleb Smirnoff 
958413628a7SBjoern A. Zeeb int
959b38ff370SJamie Gritton kern_jail_set(struct thread *td, struct uio *optuio, int flags)
960413628a7SBjoern A. Zeeb {
961fd7a8150SMike Barcroft 	struct nameidata nd;
962b38ff370SJamie Gritton #ifdef INET
963eb8dcdeaSGleb Smirnoff 	struct prison_ip *ip4;
964413628a7SBjoern A. Zeeb #endif
965b38ff370SJamie Gritton #ifdef INET6
966eb8dcdeaSGleb Smirnoff 	struct prison_ip *ip6;
967b38ff370SJamie Gritton #endif
968b38ff370SJamie Gritton 	struct vfsopt *opt;
969b38ff370SJamie Gritton 	struct vfsoptlist *opts;
9707de883c8SJamie Gritton 	struct prison *pr, *deadpr, *inspr, *mypr, *ppr, *tpr;
971b38ff370SJamie Gritton 	struct vnode *root;
972babbbb9cSJamie Gritton 	char *domain, *errmsg, *host, *name, *namelc, *p, *path, *uuid;
973b96bd95bSIan Lepore 	char *g_path, *osrelstr;
974672756aaSJamie Gritton 	struct bool_flags *bf;
975672756aaSJamie Gritton 	struct jailsys_flags *jsf;
9760304c731SJamie Gritton #if defined(INET) || defined(INET6)
977b38ff370SJamie Gritton 	void *op;
9780304c731SJamie Gritton #endif
97976ca6f88SJamie Gritton 	unsigned long hid;
980b6f47c23SJamie Gritton 	size_t namelen, onamelen, pnamelen;
9812a4b2251SJamie Gritton 	int born, created, cuflags, descend, drflags, enforce;
982cc5fd8c7SJamie Gritton 	int error, errmsg_len, errmsg_pos;
9830cc207a6SMartin Matuska 	int gotchildmax, gotenforce, gothid, gotrsnum, gotslevel;
984672756aaSJamie Gritton 	int jid, jsys, len, level;
985b96bd95bSIan Lepore 	int childmax, osreldt, rsnum, slevel;
986413628a7SBjoern A. Zeeb #ifdef INET
9872b0d6f81SJamie Gritton 	int ip4s, redo_ip4;
988413628a7SBjoern A. Zeeb #endif
989b38ff370SJamie Gritton #ifdef INET6
9902b0d6f81SJamie Gritton 	int ip6s, redo_ip6;
991b38ff370SJamie Gritton #endif
9926beb3bb4SKirk McKusick 	uint64_t pr_allow, ch_allow, pr_flags, ch_flags;
993b3079544SJamie Gritton 	uint64_t pr_allow_diff;
9946beb3bb4SKirk McKusick 	unsigned tallow;
995b38ff370SJamie Gritton 	char numbuf[12];
996b38ff370SJamie Gritton 
997b38ff370SJamie Gritton 	error = priv_check(td, PRIV_JAIL_SET);
998b38ff370SJamie Gritton 	if (!error && (flags & JAIL_ATTACH))
999b38ff370SJamie Gritton 		error = priv_check(td, PRIV_JAIL_ATTACH);
1000b38ff370SJamie Gritton 	if (error)
100175c13541SPoul-Henning Kamp 		return (error);
1002b6f47c23SJamie Gritton 	mypr = td->td_ucred->cr_prison;
1003b97457e2SJamie Gritton 	if ((flags & JAIL_CREATE) && mypr->pr_childmax == 0)
10040304c731SJamie Gritton 		return (EPERM);
1005b38ff370SJamie Gritton 	if (flags & ~JAIL_SET_MASK)
1006b38ff370SJamie Gritton 		return (EINVAL);
1007b38ff370SJamie Gritton 
1008b38ff370SJamie Gritton 	/*
1009b38ff370SJamie Gritton 	 * Check all the parameters before committing to anything.  Not all
1010b38ff370SJamie Gritton 	 * errors can be caught early, but we may as well try.  Also, this
1011b38ff370SJamie Gritton 	 * takes care of some expensive stuff (path lookup) before getting
1012b38ff370SJamie Gritton 	 * the allprison lock.
1013b38ff370SJamie Gritton 	 *
1014b38ff370SJamie Gritton 	 * XXX Jails are not filesystems, and jail parameters are not mount
1015b38ff370SJamie Gritton 	 *     options.  But it makes more sense to re-use the vfsopt code
1016b38ff370SJamie Gritton 	 *     than duplicate it under a different name.
1017b38ff370SJamie Gritton 	 */
1018b38ff370SJamie Gritton 	error = vfs_buildopts(optuio, &opts);
1019b38ff370SJamie Gritton 	if (error)
1020b38ff370SJamie Gritton 		return (error);
1021b38ff370SJamie Gritton #ifdef INET
1022b38ff370SJamie Gritton 	ip4 = NULL;
1023b38ff370SJamie Gritton #endif
1024b38ff370SJamie Gritton #ifdef INET6
1025b38ff370SJamie Gritton 	ip6 = NULL;
1026b38ff370SJamie Gritton #endif
10276dfe0a3dSMartin Matuska 	g_path = NULL;
1028b38ff370SJamie Gritton 
1029b6f47c23SJamie Gritton 	cuflags = flags & (JAIL_CREATE | JAIL_UPDATE);
1030b6f47c23SJamie Gritton 	if (!cuflags) {
1031b6f47c23SJamie Gritton 		error = EINVAL;
1032b6f47c23SJamie Gritton 		vfs_opterror(opts, "no valid operation (create or update)");
1033b6f47c23SJamie Gritton 		goto done_errmsg;
1034b6f47c23SJamie Gritton 	}
1035b6f47c23SJamie Gritton 
1036b38ff370SJamie Gritton 	error = vfs_copyopt(opts, "jid", &jid, sizeof(jid));
1037b38ff370SJamie Gritton 	if (error == ENOENT)
1038b38ff370SJamie Gritton 		jid = 0;
1039b38ff370SJamie Gritton 	else if (error != 0)
1040b38ff370SJamie Gritton 		goto done_free;
1041b38ff370SJamie Gritton 
1042b38ff370SJamie Gritton 	error = vfs_copyopt(opts, "securelevel", &slevel, sizeof(slevel));
1043b38ff370SJamie Gritton 	if (error == ENOENT)
1044b38ff370SJamie Gritton 		gotslevel = 0;
1045b38ff370SJamie Gritton 	else if (error != 0)
1046b38ff370SJamie Gritton 		goto done_free;
1047b38ff370SJamie Gritton 	else
1048b38ff370SJamie Gritton 		gotslevel = 1;
1049b38ff370SJamie Gritton 
1050b97457e2SJamie Gritton 	error =
1051b97457e2SJamie Gritton 	    vfs_copyopt(opts, "children.max", &childmax, sizeof(childmax));
1052b97457e2SJamie Gritton 	if (error == ENOENT)
1053b97457e2SJamie Gritton 		gotchildmax = 0;
1054b97457e2SJamie Gritton 	else if (error != 0)
1055b97457e2SJamie Gritton 		goto done_free;
1056b97457e2SJamie Gritton 	else
1057b97457e2SJamie Gritton 		gotchildmax = 1;
1058b97457e2SJamie Gritton 
10590304c731SJamie Gritton 	error = vfs_copyopt(opts, "enforce_statfs", &enforce, sizeof(enforce));
1060f337198dSJamie Gritton 	if (error == ENOENT)
1061f337198dSJamie Gritton 		gotenforce = 0;
1062f337198dSJamie Gritton 	else if (error != 0)
10630304c731SJamie Gritton 		goto done_free;
1064f337198dSJamie Gritton 	else if (enforce < 0 || enforce > 2) {
1065f337198dSJamie Gritton 		error = EINVAL;
1066f337198dSJamie Gritton 		goto done_free;
1067f337198dSJamie Gritton 	} else
1068f337198dSJamie Gritton 		gotenforce = 1;
10690304c731SJamie Gritton 
10700cc207a6SMartin Matuska 	error = vfs_copyopt(opts, "devfs_ruleset", &rsnum, sizeof(rsnum));
10710cc207a6SMartin Matuska 	if (error == ENOENT)
10720cc207a6SMartin Matuska 		gotrsnum = 0;
10730cc207a6SMartin Matuska 	else if (error != 0)
10740cc207a6SMartin Matuska 		goto done_free;
10750cc207a6SMartin Matuska 	else
10760cc207a6SMartin Matuska 		gotrsnum = 1;
10770cc207a6SMartin Matuska 
1078b38ff370SJamie Gritton 	pr_flags = ch_flags = 0;
1079672756aaSJamie Gritton 	for (bf = pr_flag_bool;
1080672756aaSJamie Gritton 	     bf < pr_flag_bool + nitems(pr_flag_bool);
1081672756aaSJamie Gritton 	     bf++) {
1082672756aaSJamie Gritton 		vfs_flagopt(opts, bf->name, &pr_flags, bf->flag);
1083672756aaSJamie Gritton 		vfs_flagopt(opts, bf->noname, &ch_flags, bf->flag);
10840304c731SJamie Gritton 	}
1085b38ff370SJamie Gritton 	ch_flags |= pr_flags;
1086672756aaSJamie Gritton 	for (jsf = pr_flag_jailsys;
1087672756aaSJamie Gritton 	     jsf < pr_flag_jailsys + nitems(pr_flag_jailsys);
1088672756aaSJamie Gritton 	     jsf++) {
1089672756aaSJamie Gritton 		error = vfs_copyopt(opts, jsf->name, &jsys, sizeof(jsys));
10907cbf7213SJamie Gritton 		if (error == ENOENT)
10917cbf7213SJamie Gritton 			continue;
10927cbf7213SJamie Gritton 		if (error != 0)
10937cbf7213SJamie Gritton 			goto done_free;
10947cbf7213SJamie Gritton 		switch (jsys) {
10957cbf7213SJamie Gritton 		case JAIL_SYS_DISABLE:
1096672756aaSJamie Gritton 			if (!jsf->disable) {
10977cbf7213SJamie Gritton 				error = EINVAL;
10987cbf7213SJamie Gritton 				goto done_free;
10997cbf7213SJamie Gritton 			}
1100672756aaSJamie Gritton 			pr_flags |= jsf->disable;
11017cbf7213SJamie Gritton 			break;
11027cbf7213SJamie Gritton 		case JAIL_SYS_NEW:
1103672756aaSJamie Gritton 			pr_flags |= jsf->new;
11047cbf7213SJamie Gritton 			break;
11057cbf7213SJamie Gritton 		case JAIL_SYS_INHERIT:
11067cbf7213SJamie Gritton 			break;
11077cbf7213SJamie Gritton 		default:
11087cbf7213SJamie Gritton 			error = EINVAL;
11097cbf7213SJamie Gritton 			goto done_free;
11107cbf7213SJamie Gritton 		}
1111672756aaSJamie Gritton 		ch_flags |= jsf->new | jsf->disable;
11127cbf7213SJamie Gritton 	}
11131158508aSJamie Gritton 	if ((flags & (JAIL_CREATE | JAIL_ATTACH)) == JAIL_CREATE
11144affa14cSJamie Gritton 	    && !(pr_flags & PR_PERSIST)) {
11154affa14cSJamie Gritton 		error = EINVAL;
11164affa14cSJamie Gritton 		vfs_opterror(opts, "new jail must persist or attach");
11174affa14cSJamie Gritton 		goto done_errmsg;
11184affa14cSJamie Gritton 	}
1119679e1390SJamie Gritton #ifdef VIMAGE
1120679e1390SJamie Gritton 	if ((flags & JAIL_UPDATE) && (ch_flags & PR_VNET)) {
1121679e1390SJamie Gritton 		error = EINVAL;
1122679e1390SJamie Gritton 		vfs_opterror(opts, "vnet cannot be changed after creation");
1123679e1390SJamie Gritton 		goto done_errmsg;
1124679e1390SJamie Gritton 	}
1125679e1390SJamie Gritton #endif
11262b0d6f81SJamie Gritton #ifdef INET
11272b0d6f81SJamie Gritton 	if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP4_USER)) {
11282b0d6f81SJamie Gritton 		error = EINVAL;
11292b0d6f81SJamie Gritton 		vfs_opterror(opts, "ip4 cannot be changed after creation");
11302b0d6f81SJamie Gritton 		goto done_errmsg;
11312b0d6f81SJamie Gritton 	}
11322b0d6f81SJamie Gritton #endif
11332b0d6f81SJamie Gritton #ifdef INET6
11342b0d6f81SJamie Gritton 	if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP6_USER)) {
11352b0d6f81SJamie Gritton 		error = EINVAL;
11362b0d6f81SJamie Gritton 		vfs_opterror(opts, "ip6 cannot be changed after creation");
11372b0d6f81SJamie Gritton 		goto done_errmsg;
11382b0d6f81SJamie Gritton 	}
11392b0d6f81SJamie Gritton #endif
1140b38ff370SJamie Gritton 
11410304c731SJamie Gritton 	pr_allow = ch_allow = 0;
1142672756aaSJamie Gritton 	for (bf = pr_flag_allow;
11435d58f959SJamie Gritton 	     bf < pr_flag_allow + nitems(pr_flag_allow) &&
11445d58f959SJamie Gritton 		atomic_load_int(&bf->flag) != 0;
1145672756aaSJamie Gritton 	     bf++) {
1146672756aaSJamie Gritton 		vfs_flagopt(opts, bf->name, &pr_allow, bf->flag);
1147672756aaSJamie Gritton 		vfs_flagopt(opts, bf->noname, &ch_allow, bf->flag);
11480304c731SJamie Gritton 	}
11490304c731SJamie Gritton 	ch_allow |= pr_allow;
11500304c731SJamie Gritton 
1151b38ff370SJamie Gritton 	error = vfs_getopt(opts, "name", (void **)&name, &len);
1152b38ff370SJamie Gritton 	if (error == ENOENT)
1153b38ff370SJamie Gritton 		name = NULL;
1154b38ff370SJamie Gritton 	else if (error != 0)
1155b38ff370SJamie Gritton 		goto done_free;
1156b38ff370SJamie Gritton 	else {
1157b38ff370SJamie Gritton 		if (len == 0 || name[len - 1] != '\0') {
1158b38ff370SJamie Gritton 			error = EINVAL;
1159b38ff370SJamie Gritton 			goto done_free;
1160b38ff370SJamie Gritton 		}
1161b38ff370SJamie Gritton 		if (len > MAXHOSTNAMELEN) {
1162b38ff370SJamie Gritton 			error = ENAMETOOLONG;
1163b38ff370SJamie Gritton 			goto done_free;
1164b38ff370SJamie Gritton 		}
1165b38ff370SJamie Gritton 	}
1166b38ff370SJamie Gritton 
1167b38ff370SJamie Gritton 	error = vfs_getopt(opts, "host.hostname", (void **)&host, &len);
1168b38ff370SJamie Gritton 	if (error == ENOENT)
1169b38ff370SJamie Gritton 		host = NULL;
1170b38ff370SJamie Gritton 	else if (error != 0)
1171b38ff370SJamie Gritton 		goto done_free;
1172b38ff370SJamie Gritton 	else {
117376ca6f88SJamie Gritton 		ch_flags |= PR_HOST;
117476ca6f88SJamie Gritton 		pr_flags |= PR_HOST;
1175b38ff370SJamie Gritton 		if (len == 0 || host[len - 1] != '\0') {
1176b38ff370SJamie Gritton 			error = EINVAL;
1177b38ff370SJamie Gritton 			goto done_free;
1178b38ff370SJamie Gritton 		}
1179b38ff370SJamie Gritton 		if (len > MAXHOSTNAMELEN) {
1180b38ff370SJamie Gritton 			error = ENAMETOOLONG;
1181b38ff370SJamie Gritton 			goto done_free;
1182b38ff370SJamie Gritton 		}
1183b38ff370SJamie Gritton 	}
1184b38ff370SJamie Gritton 
118576ca6f88SJamie Gritton 	error = vfs_getopt(opts, "host.domainname", (void **)&domain, &len);
118676ca6f88SJamie Gritton 	if (error == ENOENT)
118776ca6f88SJamie Gritton 		domain = NULL;
118876ca6f88SJamie Gritton 	else if (error != 0)
118976ca6f88SJamie Gritton 		goto done_free;
119076ca6f88SJamie Gritton 	else {
119176ca6f88SJamie Gritton 		ch_flags |= PR_HOST;
119276ca6f88SJamie Gritton 		pr_flags |= PR_HOST;
119376ca6f88SJamie Gritton 		if (len == 0 || domain[len - 1] != '\0') {
119476ca6f88SJamie Gritton 			error = EINVAL;
119576ca6f88SJamie Gritton 			goto done_free;
119676ca6f88SJamie Gritton 		}
119776ca6f88SJamie Gritton 		if (len > MAXHOSTNAMELEN) {
119876ca6f88SJamie Gritton 			error = ENAMETOOLONG;
119976ca6f88SJamie Gritton 			goto done_free;
120076ca6f88SJamie Gritton 		}
120176ca6f88SJamie Gritton 	}
120276ca6f88SJamie Gritton 
120376ca6f88SJamie Gritton 	error = vfs_getopt(opts, "host.hostuuid", (void **)&uuid, &len);
120476ca6f88SJamie Gritton 	if (error == ENOENT)
120576ca6f88SJamie Gritton 		uuid = NULL;
120676ca6f88SJamie Gritton 	else if (error != 0)
120776ca6f88SJamie Gritton 		goto done_free;
120876ca6f88SJamie Gritton 	else {
120976ca6f88SJamie Gritton 		ch_flags |= PR_HOST;
121076ca6f88SJamie Gritton 		pr_flags |= PR_HOST;
121176ca6f88SJamie Gritton 		if (len == 0 || uuid[len - 1] != '\0') {
121276ca6f88SJamie Gritton 			error = EINVAL;
121376ca6f88SJamie Gritton 			goto done_free;
121476ca6f88SJamie Gritton 		}
121576ca6f88SJamie Gritton 		if (len > HOSTUUIDLEN) {
121676ca6f88SJamie Gritton 			error = ENAMETOOLONG;
121776ca6f88SJamie Gritton 			goto done_free;
121876ca6f88SJamie Gritton 		}
121976ca6f88SJamie Gritton 	}
122076ca6f88SJamie Gritton 
1221841c0c7eSNathan Whitehorn #ifdef COMPAT_FREEBSD32
1222a5c1afadSDmitry Chagin 	if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) {
122376ca6f88SJamie Gritton 		uint32_t hid32;
122476ca6f88SJamie Gritton 
122576ca6f88SJamie Gritton 		error = vfs_copyopt(opts, "host.hostid", &hid32, sizeof(hid32));
122676ca6f88SJamie Gritton 		hid = hid32;
122776ca6f88SJamie Gritton 	} else
122876ca6f88SJamie Gritton #endif
122976ca6f88SJamie Gritton 		error = vfs_copyopt(opts, "host.hostid", &hid, sizeof(hid));
123076ca6f88SJamie Gritton 	if (error == ENOENT)
123176ca6f88SJamie Gritton 		gothid = 0;
123276ca6f88SJamie Gritton 	else if (error != 0)
123376ca6f88SJamie Gritton 		goto done_free;
123476ca6f88SJamie Gritton 	else {
123576ca6f88SJamie Gritton 		gothid = 1;
123676ca6f88SJamie Gritton 		ch_flags |= PR_HOST;
123776ca6f88SJamie Gritton 		pr_flags |= PR_HOST;
123876ca6f88SJamie Gritton 	}
123976ca6f88SJamie Gritton 
1240b38ff370SJamie Gritton #ifdef INET
1241b38ff370SJamie Gritton 	error = vfs_getopt(opts, "ip4.addr", &op, &ip4s);
1242b38ff370SJamie Gritton 	if (error == ENOENT)
12430e5e396eSJamie Gritton 		ip4s = 0;
1244b38ff370SJamie Gritton 	else if (error != 0)
1245b38ff370SJamie Gritton 		goto done_free;
1246eb8dcdeaSGleb Smirnoff 	else if (ip4s & (sizeof(struct in_addr) - 1)) {
1247b38ff370SJamie Gritton 		error = EINVAL;
1248b38ff370SJamie Gritton 		goto done_free;
12490304c731SJamie Gritton 	} else {
12506a3f2779SJamie Gritton 		ch_flags |= PR_IP4_USER;
12516a3f2779SJamie Gritton 		pr_flags |= PR_IP4_USER;
12526a3f2779SJamie Gritton 		if (ip4s > 0) {
1253eb8dcdeaSGleb Smirnoff 			ip4s /= sizeof(struct in_addr);
1254b38ff370SJamie Gritton 			if (ip4s > jail_max_af_ips) {
1255b38ff370SJamie Gritton 				error = EINVAL;
1256b38ff370SJamie Gritton 				vfs_opterror(opts, "too many IPv4 addresses");
1257b38ff370SJamie Gritton 				goto done_errmsg;
1258b38ff370SJamie Gritton 			}
1259eb8dcdeaSGleb Smirnoff 			ip4 = prison_ip_copyin(PR_INET, op, ip4s);
1260eb8dcdeaSGleb Smirnoff 			if (ip4 == NULL) {
1261b38ff370SJamie Gritton 				error = EINVAL;
1262b38ff370SJamie Gritton 				goto done_free;
1263b38ff370SJamie Gritton 			}
1264b38ff370SJamie Gritton 		}
12650304c731SJamie Gritton 	}
1266b38ff370SJamie Gritton #endif
1267b38ff370SJamie Gritton 
1268b38ff370SJamie Gritton #ifdef INET6
1269b38ff370SJamie Gritton 	error = vfs_getopt(opts, "ip6.addr", &op, &ip6s);
1270b38ff370SJamie Gritton 	if (error == ENOENT)
12710e5e396eSJamie Gritton 		ip6s = 0;
1272b38ff370SJamie Gritton 	else if (error != 0)
1273b38ff370SJamie Gritton 		goto done_free;
1274eb8dcdeaSGleb Smirnoff 	else if (ip6s & (sizeof(struct in6_addr) - 1)) {
1275b38ff370SJamie Gritton 		error = EINVAL;
1276b38ff370SJamie Gritton 		goto done_free;
12770304c731SJamie Gritton 	} else {
12786a3f2779SJamie Gritton 		ch_flags |= PR_IP6_USER;
12796a3f2779SJamie Gritton 		pr_flags |= PR_IP6_USER;
12806a3f2779SJamie Gritton 		if (ip6s > 0) {
1281eb8dcdeaSGleb Smirnoff 			ip6s /= sizeof(struct in6_addr);
1282b38ff370SJamie Gritton 			if (ip6s > jail_max_af_ips) {
1283b38ff370SJamie Gritton 				error = EINVAL;
1284b38ff370SJamie Gritton 				vfs_opterror(opts, "too many IPv6 addresses");
1285b38ff370SJamie Gritton 				goto done_errmsg;
1286b38ff370SJamie Gritton 			}
1287eb8dcdeaSGleb Smirnoff 			ip6 = prison_ip_copyin(PR_INET6, op, ip6s);
1288eb8dcdeaSGleb Smirnoff 			if (ip6 == NULL) {
1289b38ff370SJamie Gritton 				error = EINVAL;
1290b38ff370SJamie Gritton 				goto done_free;
1291b38ff370SJamie Gritton 			}
1292b38ff370SJamie Gritton 		}
12930304c731SJamie Gritton 	}
1294b38ff370SJamie Gritton #endif
1295b38ff370SJamie Gritton 
1296bdfc8cc4SJamie Gritton #if defined(VIMAGE) && (defined(INET) || defined(INET6))
1297bdfc8cc4SJamie Gritton 	if ((ch_flags & PR_VNET) && (ch_flags & (PR_IP4_USER | PR_IP6_USER))) {
1298bdfc8cc4SJamie Gritton 		error = EINVAL;
1299bdfc8cc4SJamie Gritton 		vfs_opterror(opts,
1300bdfc8cc4SJamie Gritton 		    "vnet jails cannot have IP address restrictions");
1301bdfc8cc4SJamie Gritton 		goto done_errmsg;
1302bdfc8cc4SJamie Gritton 	}
1303bdfc8cc4SJamie Gritton #endif
1304bdfc8cc4SJamie Gritton 
1305cf0313c6SJamie Gritton 	error = vfs_getopt(opts, "osrelease", (void **)&osrelstr, &len);
1306cf0313c6SJamie Gritton 	if (error == ENOENT)
1307cf0313c6SJamie Gritton 		osrelstr = NULL;
1308cf0313c6SJamie Gritton 	else if (error != 0)
1309cf0313c6SJamie Gritton 		goto done_free;
1310cf0313c6SJamie Gritton 	else {
1311cf0313c6SJamie Gritton 		if (flags & JAIL_UPDATE) {
1312cf0313c6SJamie Gritton 			error = EINVAL;
1313cf0313c6SJamie Gritton 			vfs_opterror(opts,
1314cf0313c6SJamie Gritton 			    "osrelease cannot be changed after creation");
1315cf0313c6SJamie Gritton 			goto done_errmsg;
1316cf0313c6SJamie Gritton 		}
13171b786d01SBjoern A. Zeeb 		if (len == 0 || osrelstr[len - 1] != '\0') {
1318cf0313c6SJamie Gritton 			error = EINVAL;
13191b786d01SBjoern A. Zeeb 			goto done_free;
13201b786d01SBjoern A. Zeeb 		}
13211b786d01SBjoern A. Zeeb 		if (len >= OSRELEASELEN) {
13221b786d01SBjoern A. Zeeb 			error = ENAMETOOLONG;
1323cf0313c6SJamie Gritton 			vfs_opterror(opts,
1324cf0313c6SJamie Gritton 			    "osrelease string must be 1-%d bytes long",
1325cf0313c6SJamie Gritton 			    OSRELEASELEN - 1);
1326cf0313c6SJamie Gritton 			goto done_errmsg;
1327cf0313c6SJamie Gritton 		}
1328cf0313c6SJamie Gritton 	}
1329cf0313c6SJamie Gritton 
1330cf0313c6SJamie Gritton 	error = vfs_copyopt(opts, "osreldate", &osreldt, sizeof(osreldt));
1331cf0313c6SJamie Gritton 	if (error == ENOENT)
1332cf0313c6SJamie Gritton 		osreldt = 0;
1333cf0313c6SJamie Gritton 	else if (error != 0)
1334cf0313c6SJamie Gritton 		goto done_free;
1335cf0313c6SJamie Gritton 	else {
1336cf0313c6SJamie Gritton 		if (flags & JAIL_UPDATE) {
1337cf0313c6SJamie Gritton 			error = EINVAL;
1338cf0313c6SJamie Gritton 			vfs_opterror(opts,
1339cf0313c6SJamie Gritton 			    "osreldate cannot be changed after creation");
1340cf0313c6SJamie Gritton 			goto done_errmsg;
1341cf0313c6SJamie Gritton 		}
1342cf0313c6SJamie Gritton 		if (osreldt == 0) {
1343cf0313c6SJamie Gritton 			error = EINVAL;
1344cf0313c6SJamie Gritton 			vfs_opterror(opts, "osreldate cannot be 0");
1345cf0313c6SJamie Gritton 			goto done_errmsg;
1346cf0313c6SJamie Gritton 		}
1347cf0313c6SJamie Gritton 	}
1348cf0313c6SJamie Gritton 
1349b38ff370SJamie Gritton 	root = NULL;
1350b38ff370SJamie Gritton 	error = vfs_getopt(opts, "path", (void **)&path, &len);
1351b38ff370SJamie Gritton 	if (error == ENOENT)
1352b38ff370SJamie Gritton 		path = NULL;
1353b38ff370SJamie Gritton 	else if (error != 0)
1354b38ff370SJamie Gritton 		goto done_free;
1355b38ff370SJamie Gritton 	else {
1356b38ff370SJamie Gritton 		if (flags & JAIL_UPDATE) {
1357b38ff370SJamie Gritton 			error = EINVAL;
1358b38ff370SJamie Gritton 			vfs_opterror(opts,
1359b38ff370SJamie Gritton 			    "path cannot be changed after creation");
1360b38ff370SJamie Gritton 			goto done_errmsg;
1361b38ff370SJamie Gritton 		}
1362b38ff370SJamie Gritton 		if (len == 0 || path[len - 1] != '\0') {
1363b38ff370SJamie Gritton 			error = EINVAL;
1364b38ff370SJamie Gritton 			goto done_free;
1365b38ff370SJamie Gritton 		}
13667e1d3eefSMateusz Guzik 		NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE, path);
1367b38ff370SJamie Gritton 		error = namei(&nd);
1368b38ff370SJamie Gritton 		if (error)
1369b38ff370SJamie Gritton 			goto done_free;
1370b38ff370SJamie Gritton 		root = nd.ni_vp;
1371bb92cd7bSMateusz Guzik 		NDFREE_PNBUF(&nd);
13726dfe0a3dSMartin Matuska 		g_path = malloc(MAXPATHLEN, M_TEMP, M_WAITOK);
13736dfe0a3dSMartin Matuska 		strlcpy(g_path, path, MAXPATHLEN);
13746dfe0a3dSMartin Matuska 		error = vn_path_to_global_path(td, root, g_path, MAXPATHLEN);
13753eb6b656SMateusz Guzik 		if (error == 0) {
13766dfe0a3dSMartin Matuska 			path = g_path;
13776dfe0a3dSMartin Matuska 		} else {
1378f6e633a9SMartin Matuska 			/* exit on other errors */
1379b38ff370SJamie Gritton 			goto done_free;
1380b38ff370SJamie Gritton 		}
1381f6e633a9SMartin Matuska 		if (root->v_type != VDIR) {
1382f6e633a9SMartin Matuska 			error = ENOTDIR;
1383f6e633a9SMartin Matuska 			vput(root);
1384f6e633a9SMartin Matuska 			goto done_free;
1385f6e633a9SMartin Matuska 		}
1386b249ce48SMateusz Guzik 		VOP_UNLOCK(root);
1387b38ff370SJamie Gritton 	}
1388b38ff370SJamie Gritton 
1389b38ff370SJamie Gritton 	/*
1390b6f47c23SJamie Gritton 	 * Find the specified jail, or at least its parent.
1391b38ff370SJamie Gritton 	 * This abuses the file error codes ENOENT and EEXIST.
1392b38ff370SJamie Gritton 	 */
1393b38ff370SJamie Gritton 	pr = NULL;
13947de883c8SJamie Gritton 	inspr = NULL;
1395babbbb9cSJamie Gritton 	if (cuflags == JAIL_CREATE && jid == 0 && name != NULL) {
1396babbbb9cSJamie Gritton 		namelc = strrchr(name, '.');
1397babbbb9cSJamie Gritton 		jid = strtoul(namelc != NULL ? namelc + 1 : name, &p, 10);
1398babbbb9cSJamie Gritton 		if (*p != '\0')
1399babbbb9cSJamie Gritton 			jid = 0;
1400babbbb9cSJamie Gritton 	}
1401b6f47c23SJamie Gritton 	sx_xlock(&allprison_lock);
1402108a9384SJamie Gritton 	drflags = PD_LIST_XLOCKED;
14030a2a96f3SJamie Gritton 	ppr = mypr;
14040a2a96f3SJamie Gritton 	if (!prison_isalive(ppr)) {
14050a2a96f3SJamie Gritton 		/* This jail is dying.  This process will surely follow. */
14060a2a96f3SJamie Gritton 		error = EAGAIN;
14070a2a96f3SJamie Gritton 		goto done_deref;
14080a2a96f3SJamie Gritton 	}
1409b38ff370SJamie Gritton 	if (jid != 0) {
1410b38ff370SJamie Gritton 		if (jid < 0) {
1411b38ff370SJamie Gritton 			error = EINVAL;
1412b38ff370SJamie Gritton 			vfs_opterror(opts, "negative jid");
14132a4b2251SJamie Gritton 			goto done_deref;
1414b38ff370SJamie Gritton 		}
14157de883c8SJamie Gritton 		/*
14167de883c8SJamie Gritton 		 * See if a requested jid already exists.  Keep track of
14177de883c8SJamie Gritton 		 * where it can be inserted later.
14187de883c8SJamie Gritton 		 */
14197de883c8SJamie Gritton 		TAILQ_FOREACH(inspr, &allprison, pr_list) {
1420f7496dcaSJamie Gritton 			if (inspr->pr_id < jid)
1421f7496dcaSJamie Gritton 				continue;
1422f7496dcaSJamie Gritton 			if (inspr->pr_id > jid)
1423f7496dcaSJamie Gritton 				break;
14247de883c8SJamie Gritton 			pr = inspr;
1425f7496dcaSJamie Gritton 			mtx_lock(&pr->pr_mtx);
14262a4b2251SJamie Gritton 			drflags |= PD_LOCKED;
14277de883c8SJamie Gritton 			inspr = NULL;
14287de883c8SJamie Gritton 			break;
14297de883c8SJamie Gritton 		}
1430b38ff370SJamie Gritton 		if (pr != NULL) {
1431b38ff370SJamie Gritton 			/* Create: jid must not exist. */
1432b38ff370SJamie Gritton 			if (cuflags == JAIL_CREATE) {
14337de883c8SJamie Gritton 				/*
14347de883c8SJamie Gritton 				 * Even creators that cannot see the jail will
14357de883c8SJamie Gritton 				 * get EEXIST.
14367de883c8SJamie Gritton 				 */
1437b38ff370SJamie Gritton 				error = EEXIST;
1438b38ff370SJamie Gritton 				vfs_opterror(opts, "jail %d already exists",
1439b38ff370SJamie Gritton 				    jid);
14402a4b2251SJamie Gritton 				goto done_deref;
1441b38ff370SJamie Gritton 			}
14420304c731SJamie Gritton 			if (!prison_ischild(mypr, pr)) {
14437de883c8SJamie Gritton 				/*
14447de883c8SJamie Gritton 				 * Updaters get ENOENT if they cannot see the
14457de883c8SJamie Gritton 				 * jail.  This is true even for CREATE | UPDATE,
14467de883c8SJamie Gritton 				 * which normally cannot give this error.
14477de883c8SJamie Gritton 				 */
14482a4b2251SJamie Gritton 				error = ENOENT;
14492a4b2251SJamie Gritton 				vfs_opterror(opts, "jail %d not found", jid);
14502a4b2251SJamie Gritton 				goto done_deref;
1451f7496dcaSJamie Gritton 			}
14520a2a96f3SJamie Gritton 			ppr = pr->pr_parent;
14530a2a96f3SJamie Gritton 			if (!prison_isalive(ppr)) {
14540a2a96f3SJamie Gritton 				error = ENOENT;
14550a2a96f3SJamie Gritton 				vfs_opterror(opts, "jail %d is dying",
14560a2a96f3SJamie Gritton 				    ppr->pr_id);
14570a2a96f3SJamie Gritton 				goto done_deref;
14580a2a96f3SJamie Gritton 			}
1459f7496dcaSJamie Gritton 			if (!prison_isalive(pr)) {
1460b38ff370SJamie Gritton 				if (!(flags & JAIL_DYING)) {
1461b38ff370SJamie Gritton 					error = ENOENT;
1462b38ff370SJamie Gritton 					vfs_opterror(opts, "jail %d is dying",
1463b38ff370SJamie Gritton 					    jid);
14642a4b2251SJamie Gritton 					goto done_deref;
1465f7496dcaSJamie Gritton 				}
1466f7496dcaSJamie Gritton 				if ((flags & JAIL_ATTACH) ||
1467b38ff370SJamie Gritton 				    (pr_flags & PR_PERSIST)) {
1468b38ff370SJamie Gritton 					/*
1469b38ff370SJamie Gritton 					 * A dying jail might be resurrected
1470b38ff370SJamie Gritton 					 * (via attach or persist), but first
1471b38ff370SJamie Gritton 					 * it must determine if another jail
1472b38ff370SJamie Gritton 					 * has claimed its name.  Accomplish
1473b38ff370SJamie Gritton 					 * this by implicitly re-setting the
1474b38ff370SJamie Gritton 					 * name.
1475b38ff370SJamie Gritton 					 */
1476b38ff370SJamie Gritton 					if (name == NULL)
14770304c731SJamie Gritton 						name = prison_name(mypr, pr);
1478b38ff370SJamie Gritton 				}
1479b38ff370SJamie Gritton 			}
14802a4b2251SJamie Gritton 		} else {
1481b38ff370SJamie Gritton 			/* Update: jid must exist. */
1482b38ff370SJamie Gritton 			if (cuflags == JAIL_UPDATE) {
1483b38ff370SJamie Gritton 				error = ENOENT;
1484b38ff370SJamie Gritton 				vfs_opterror(opts, "jail %d not found", jid);
14852a4b2251SJamie Gritton 				goto done_deref;
1486b38ff370SJamie Gritton 			}
1487b38ff370SJamie Gritton 		}
1488b38ff370SJamie Gritton 	}
1489b38ff370SJamie Gritton 	/*
1490b38ff370SJamie Gritton 	 * If the caller provided a name, look for a jail by that name.
1491b38ff370SJamie Gritton 	 * This has different semantics for creates and updates keyed by jid
1492b38ff370SJamie Gritton 	 * (where the name must not already exist in a different jail),
1493b38ff370SJamie Gritton 	 * and updates keyed by the name itself (where the name must exist
1494b38ff370SJamie Gritton 	 * because that is the jail being updated).
1495b38ff370SJamie Gritton 	 */
1496b6f47c23SJamie Gritton 	namelc = NULL;
1497b38ff370SJamie Gritton 	if (name != NULL) {
1498babbbb9cSJamie Gritton 		namelc = strrchr(name, '.');
1499babbbb9cSJamie Gritton 		if (namelc == NULL)
1500babbbb9cSJamie Gritton 			namelc = name;
1501babbbb9cSJamie Gritton 		else {
15020304c731SJamie Gritton 			/*
15030304c731SJamie Gritton 			 * This is a hierarchical name.  Split it into the
15040304c731SJamie Gritton 			 * parent and child names, and make sure the parent
15050304c731SJamie Gritton 			 * exists or matches an already found jail.
15060304c731SJamie Gritton 			 */
15070304c731SJamie Gritton 			if (pr != NULL) {
1508babbbb9cSJamie Gritton 				if (strncmp(name, ppr->pr_name, namelc - name)
1509babbbb9cSJamie Gritton 				    || ppr->pr_name[namelc - name] != '\0') {
15100304c731SJamie Gritton 					error = EINVAL;
15110304c731SJamie Gritton 					vfs_opterror(opts,
15120304c731SJamie Gritton 					    "cannot change jail's parent");
15132a4b2251SJamie Gritton 					goto done_deref;
15140304c731SJamie Gritton 				}
15150304c731SJamie Gritton 			} else {
1516b6f47c23SJamie Gritton 				*namelc = '\0';
15170304c731SJamie Gritton 				ppr = prison_find_name(mypr, name);
15180304c731SJamie Gritton 				if (ppr == NULL) {
15190304c731SJamie Gritton 					error = ENOENT;
15200304c731SJamie Gritton 					vfs_opterror(opts,
15210304c731SJamie Gritton 					    "jail \"%s\" not found", name);
15222a4b2251SJamie Gritton 					goto done_deref;
15230304c731SJamie Gritton 				}
1524c050ea80SJamie Gritton 				mtx_unlock(&ppr->pr_mtx);
15250a2a96f3SJamie Gritton 				if (!prison_isalive(ppr)) {
1526c050ea80SJamie Gritton 					error = ENOENT;
1527c050ea80SJamie Gritton 					vfs_opterror(opts,
1528c050ea80SJamie Gritton 					    "jail \"%s\" is dying", name);
1529c050ea80SJamie Gritton 					goto done_deref;
1530c050ea80SJamie Gritton 				}
1531b6f47c23SJamie Gritton 				*namelc = '.';
15320304c731SJamie Gritton 			}
1533b6f47c23SJamie Gritton 			namelc++;
15340304c731SJamie Gritton 		}
1535b6f47c23SJamie Gritton 		if (namelc[0] != '\0') {
1536b6f47c23SJamie Gritton 			pnamelen =
15370304c731SJamie Gritton 			    (ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1;
15380304c731SJamie Gritton 			deadpr = NULL;
15390304c731SJamie Gritton 			FOREACH_PRISON_CHILD(ppr, tpr) {
15406754ae25SJamie Gritton 				if (tpr != pr &&
1541b6f47c23SJamie Gritton 				    !strcmp(tpr->pr_name + pnamelen, namelc)) {
154276ad42abSJamie Gritton 					if (prison_isalive(tpr)) {
1543b38ff370SJamie Gritton 						if (pr == NULL &&
1544b38ff370SJamie Gritton 						    cuflags != JAIL_CREATE) {
1545b38ff370SJamie Gritton 							/*
1546b38ff370SJamie Gritton 							 * Use this jail
1547b38ff370SJamie Gritton 							 * for updates.
1548b38ff370SJamie Gritton 							 */
1549b38ff370SJamie Gritton 							pr = tpr;
1550f7496dcaSJamie Gritton 							mtx_lock(&pr->pr_mtx);
155183bc72a0SJamie Gritton 							drflags |= PD_LOCKED;
1552b38ff370SJamie Gritton 							break;
1553b38ff370SJamie Gritton 						}
1554b38ff370SJamie Gritton 						/*
1555b38ff370SJamie Gritton 						 * Create, or update(jid):
1556b38ff370SJamie Gritton 						 * name must not exist in an
15570304c731SJamie Gritton 						 * active sibling jail.
1558b38ff370SJamie Gritton 						 */
1559b38ff370SJamie Gritton 						error = EEXIST;
1560b38ff370SJamie Gritton 						vfs_opterror(opts,
1561b38ff370SJamie Gritton 						   "jail \"%s\" already exists",
1562b38ff370SJamie Gritton 						   name);
15632a4b2251SJamie Gritton 						goto done_deref;
1564b38ff370SJamie Gritton 					}
156576ad42abSJamie Gritton 					if (pr == NULL &&
1566f7496dcaSJamie Gritton 					    cuflags != JAIL_CREATE) {
156776ad42abSJamie Gritton 						deadpr = tpr;
1568f7496dcaSJamie Gritton 					}
1569b38ff370SJamie Gritton 				}
1570b38ff370SJamie Gritton 			}
1571b38ff370SJamie Gritton 			/* If no active jail is found, use a dying one. */
1572b38ff370SJamie Gritton 			if (deadpr != NULL && pr == NULL) {
1573b38ff370SJamie Gritton 				if (flags & JAIL_DYING) {
1574b38ff370SJamie Gritton 					pr = deadpr;
1575f7496dcaSJamie Gritton 					mtx_lock(&pr->pr_mtx);
15762a4b2251SJamie Gritton 					drflags |= PD_LOCKED;
1577b38ff370SJamie Gritton 				} else if (cuflags == JAIL_UPDATE) {
1578b38ff370SJamie Gritton 					error = ENOENT;
1579b38ff370SJamie Gritton 					vfs_opterror(opts,
1580b38ff370SJamie Gritton 					    "jail \"%s\" is dying", name);
15812a4b2251SJamie Gritton 					goto done_deref;
1582b38ff370SJamie Gritton 				}
1583b38ff370SJamie Gritton 			}
1584b38ff370SJamie Gritton 			/* Update: name must exist if no jid. */
1585b38ff370SJamie Gritton 			else if (cuflags == JAIL_UPDATE && pr == NULL) {
1586b38ff370SJamie Gritton 				error = ENOENT;
1587b38ff370SJamie Gritton 				vfs_opterror(opts, "jail \"%s\" not found",
1588b38ff370SJamie Gritton 				    name);
15892a4b2251SJamie Gritton 				goto done_deref;
1590b38ff370SJamie Gritton 			}
1591b38ff370SJamie Gritton 		}
1592b38ff370SJamie Gritton 	}
1593b38ff370SJamie Gritton 	/* Update: must provide a jid or name. */
1594b38ff370SJamie Gritton 	else if (cuflags == JAIL_UPDATE && pr == NULL) {
1595b38ff370SJamie Gritton 		error = ENOENT;
1596b38ff370SJamie Gritton 		vfs_opterror(opts, "update specified no jail");
15972a4b2251SJamie Gritton 		goto done_deref;
1598b38ff370SJamie Gritton 	}
1599b38ff370SJamie Gritton 
1600b38ff370SJamie Gritton 	/* If there's no prison to update, create a new one and link it in. */
16012a4b2251SJamie Gritton 	created = pr == NULL;
16022a4b2251SJamie Gritton 	if (created) {
1603b97457e2SJamie Gritton 		for (tpr = mypr; tpr != NULL; tpr = tpr->pr_parent)
1604b97457e2SJamie Gritton 			if (tpr->pr_childcount >= tpr->pr_childmax) {
1605b97457e2SJamie Gritton 				error = EPERM;
1606b97457e2SJamie Gritton 				vfs_opterror(opts, "prison limit exceeded");
16072a4b2251SJamie Gritton 				goto done_deref;
1608b97457e2SJamie Gritton 			}
16097de883c8SJamie Gritton 		if (jid == 0 && (jid = get_next_prid(&inspr)) == 0) {
1610b38ff370SJamie Gritton 			error = EAGAIN;
16117de883c8SJamie Gritton 			vfs_opterror(opts, "no available jail IDs");
16122a4b2251SJamie Gritton 			goto done_deref;
1613b38ff370SJamie Gritton 		}
16142a4b2251SJamie Gritton 
16152a4b2251SJamie Gritton 		pr = malloc(sizeof(*pr), M_PRISON, M_WAITOK | M_ZERO);
16161158508aSJamie Gritton 		pr->pr_state = PRISON_STATE_INVALID;
16171158508aSJamie Gritton 		refcount_init(&pr->pr_ref, 1);
1618f7496dcaSJamie Gritton 		refcount_init(&pr->pr_uref, 0);
16191158508aSJamie Gritton 		drflags |= PD_DEREF;
16202a4b2251SJamie Gritton 		LIST_INIT(&pr->pr_children);
16212a4b2251SJamie Gritton 		mtx_init(&pr->pr_mtx, "jail mutex", NULL, MTX_DEF | MTX_DUPOK);
16222a4b2251SJamie Gritton 		TASK_INIT(&pr->pr_task, 0, prison_complete, pr);
16232a4b2251SJamie Gritton 
16247de883c8SJamie Gritton 		pr->pr_id = jid;
16257de883c8SJamie Gritton 		if (inspr != NULL)
16267de883c8SJamie Gritton 			TAILQ_INSERT_BEFORE(inspr, pr, pr_list);
16277de883c8SJamie Gritton 		else
1628b38ff370SJamie Gritton 			TAILQ_INSERT_TAIL(&allprison, pr, pr_list);
16297de883c8SJamie Gritton 
16307de883c8SJamie Gritton 		pr->pr_parent = ppr;
16310a2a96f3SJamie Gritton 		prison_hold(ppr);
16320a2a96f3SJamie Gritton 		prison_proc_hold(ppr);
16330304c731SJamie Gritton 		LIST_INSERT_HEAD(&ppr->pr_children, pr, pr_sibling);
16340304c731SJamie Gritton 		for (tpr = ppr; tpr != NULL; tpr = tpr->pr_parent)
1635b97457e2SJamie Gritton 			tpr->pr_childcount++;
1636b38ff370SJamie Gritton 
16370304c731SJamie Gritton 		/* Set some default values, and inherit some from the parent. */
1638b6f47c23SJamie Gritton 		if (namelc == NULL)
1639b6f47c23SJamie Gritton 			namelc = "";
1640b38ff370SJamie Gritton 		if (path == NULL) {
1641b38ff370SJamie Gritton 			path = "/";
16420304c731SJamie Gritton 			root = mypr->pr_root;
1643b38ff370SJamie Gritton 			vref(root);
1644b38ff370SJamie Gritton 		}
16458986e3a0SJamie Gritton 		strlcpy(pr->pr_hostuuid, DEFAULT_HOSTUUID, HOSTUUIDLEN);
16468986e3a0SJamie Gritton 		pr->pr_flags |= PR_HOST;
1647bdfc8cc4SJamie Gritton #if defined(INET) || defined(INET6)
1648bdfc8cc4SJamie Gritton #ifdef VIMAGE
1649bdfc8cc4SJamie Gritton 		if (!(pr_flags & PR_VNET))
1650bdfc8cc4SJamie Gritton #endif
1651bdfc8cc4SJamie Gritton 		{
16520304c731SJamie Gritton #ifdef INET
16532b0d6f81SJamie Gritton 			if (!(ch_flags & PR_IP4_USER))
16546a3f2779SJamie Gritton 				pr->pr_flags |= PR_IP4 | PR_IP4_USER;
16552b0d6f81SJamie Gritton 			else if (!(pr_flags & PR_IP4_USER)) {
16562b0d6f81SJamie Gritton 				pr->pr_flags |= ppr->pr_flags & PR_IP4;
1657eb8dcdeaSGleb Smirnoff 				prison_ip_dup(ppr, pr, PR_INET);
16582b0d6f81SJamie Gritton 			}
16590304c731SJamie Gritton #endif
16600304c731SJamie Gritton #ifdef INET6
16612b0d6f81SJamie Gritton 			if (!(ch_flags & PR_IP6_USER))
16626a3f2779SJamie Gritton 				pr->pr_flags |= PR_IP6 | PR_IP6_USER;
16632b0d6f81SJamie Gritton 			else if (!(pr_flags & PR_IP6_USER)) {
16642b0d6f81SJamie Gritton 				pr->pr_flags |= ppr->pr_flags & PR_IP6;
1665eb8dcdeaSGleb Smirnoff 				prison_ip_dup(ppr, pr, PR_INET6);
16662b0d6f81SJamie Gritton 			}
16670304c731SJamie Gritton #endif
1668bdfc8cc4SJamie Gritton 		}
1669bdfc8cc4SJamie Gritton #endif
1670592bcae8SBjoern A. Zeeb 		/* Source address selection is always on by default. */
1671592bcae8SBjoern A. Zeeb 		pr->pr_flags |= _PR_IP_SADDRSEL;
1672592bcae8SBjoern A. Zeeb 
16730304c731SJamie Gritton 		pr->pr_securelevel = ppr->pr_securelevel;
16740304c731SJamie Gritton 		pr->pr_allow = JAIL_DEFAULT_ALLOW & ppr->pr_allow;
1675af10bf05SBjoern A. Zeeb 		pr->pr_enforce_statfs = jail_default_enforce_statfs;
1676bf3db8aaSMartin Matuska 		pr->pr_devfs_rsnum = ppr->pr_devfs_rsnum;
1677b38ff370SJamie Gritton 
1678b96bd95bSIan Lepore 		pr->pr_osreldate = osreldt ? osreldt : ppr->pr_osreldate;
1679b96bd95bSIan Lepore 		if (osrelstr == NULL)
16801b786d01SBjoern A. Zeeb 			strlcpy(pr->pr_osrelease, ppr->pr_osrelease,
16811b786d01SBjoern A. Zeeb 			    sizeof(pr->pr_osrelease));
1682b96bd95bSIan Lepore 		else
16831b786d01SBjoern A. Zeeb 			strlcpy(pr->pr_osrelease, osrelstr,
16841b786d01SBjoern A. Zeeb 			    sizeof(pr->pr_osrelease));
1685b96bd95bSIan Lepore 
1686679e1390SJamie Gritton #ifdef VIMAGE
1687679e1390SJamie Gritton 		/* Allocate a new vnet if specified. */
1688679e1390SJamie Gritton 		pr->pr_vnet = (pr_flags & PR_VNET)
1689679e1390SJamie Gritton 		    ? vnet_alloc() : ppr->pr_vnet;
1690679e1390SJamie Gritton #endif
1691b38ff370SJamie Gritton 		/*
1692b38ff370SJamie Gritton 		 * Allocate a dedicated cpuset for each jail.
16938771ff75SGordon Bergling 		 * Unlike other initial settings, this may return an error.
1694b38ff370SJamie Gritton 		 */
16950304c731SJamie Gritton 		error = cpuset_create_root(ppr, &pr->pr_cpuset);
16962a4b2251SJamie Gritton 		if (error)
16972a4b2251SJamie Gritton 			goto done_deref;
1698b38ff370SJamie Gritton 
1699b38ff370SJamie Gritton 		mtx_lock(&pr->pr_mtx);
17002a4b2251SJamie Gritton 		drflags |= PD_LOCKED;
1701b38ff370SJamie Gritton 	} else {
17022b0d6f81SJamie Gritton 		/*
17032b0d6f81SJamie Gritton 		 * Grab a reference for existing prisons, to ensure they
17042b0d6f81SJamie Gritton 		 * continue to exist for the duration of the call.
17052b0d6f81SJamie Gritton 		 */
17066754ae25SJamie Gritton 		prison_hold(pr);
17072a4b2251SJamie Gritton 		drflags |= PD_DEREF;
1708bdfc8cc4SJamie Gritton #if defined(VIMAGE) && (defined(INET) || defined(INET6))
1709bdfc8cc4SJamie Gritton 		if ((pr->pr_flags & PR_VNET) &&
1710bdfc8cc4SJamie Gritton 		    (ch_flags & (PR_IP4_USER | PR_IP6_USER))) {
1711bdfc8cc4SJamie Gritton 			error = EINVAL;
1712bdfc8cc4SJamie Gritton 			vfs_opterror(opts,
1713bdfc8cc4SJamie Gritton 			    "vnet jails cannot have IP address restrictions");
17142a4b2251SJamie Gritton 			goto done_deref;
1715bdfc8cc4SJamie Gritton 		}
1716bdfc8cc4SJamie Gritton #endif
17172b0d6f81SJamie Gritton #ifdef INET
17182b0d6f81SJamie Gritton 		if (PR_IP4_USER & ch_flags & (pr_flags ^ pr->pr_flags)) {
17192b0d6f81SJamie Gritton 			error = EINVAL;
17202b0d6f81SJamie Gritton 			vfs_opterror(opts,
17212b0d6f81SJamie Gritton 			    "ip4 cannot be changed after creation");
17222a4b2251SJamie Gritton 			goto done_deref;
17232b0d6f81SJamie Gritton 		}
17242b0d6f81SJamie Gritton #endif
17252b0d6f81SJamie Gritton #ifdef INET6
17262b0d6f81SJamie Gritton 		if (PR_IP6_USER & ch_flags & (pr_flags ^ pr->pr_flags)) {
17272b0d6f81SJamie Gritton 			error = EINVAL;
17282b0d6f81SJamie Gritton 			vfs_opterror(opts,
17292b0d6f81SJamie Gritton 			    "ip6 cannot be changed after creation");
17302a4b2251SJamie Gritton 			goto done_deref;
17312b0d6f81SJamie Gritton 		}
17322b0d6f81SJamie Gritton #endif
1733b38ff370SJamie Gritton 	}
1734b38ff370SJamie Gritton 
1735b38ff370SJamie Gritton 	/* Do final error checking before setting anything. */
17360304c731SJamie Gritton 	if (gotslevel) {
17370304c731SJamie Gritton 		if (slevel < ppr->pr_securelevel) {
17380304c731SJamie Gritton 			error = EPERM;
17392a4b2251SJamie Gritton 			goto done_deref;
17400304c731SJamie Gritton 		}
17410304c731SJamie Gritton 	}
1742b97457e2SJamie Gritton 	if (gotchildmax) {
1743b97457e2SJamie Gritton 		if (childmax >= ppr->pr_childmax) {
1744b97457e2SJamie Gritton 			error = EPERM;
17452a4b2251SJamie Gritton 			goto done_deref;
1746b97457e2SJamie Gritton 		}
1747b97457e2SJamie Gritton 	}
17480304c731SJamie Gritton 	if (gotenforce) {
17490304c731SJamie Gritton 		if (enforce < ppr->pr_enforce_statfs) {
17500304c731SJamie Gritton 			error = EPERM;
17512a4b2251SJamie Gritton 			goto done_deref;
17520304c731SJamie Gritton 		}
17530304c731SJamie Gritton 	}
17540cc207a6SMartin Matuska 	if (gotrsnum) {
17550cc207a6SMartin Matuska 		/*
17560cc207a6SMartin Matuska 		 * devfs_rsnum is a uint16_t
17570cc207a6SMartin Matuska 		 */
1758bf3db8aaSMartin Matuska 		if (rsnum < 0 || rsnum > 65535) {
17590cc207a6SMartin Matuska 			error = EINVAL;
17602a4b2251SJamie Gritton 			goto done_deref;
17610cc207a6SMartin Matuska 		}
17620cc207a6SMartin Matuska 		/*
1763bf3db8aaSMartin Matuska 		 * Nested jails always inherit parent's devfs ruleset
17640cc207a6SMartin Matuska 		 */
17650cc207a6SMartin Matuska 		if (jailed(td->td_ucred)) {
17660cc207a6SMartin Matuska 			if (rsnum > 0 && rsnum != ppr->pr_devfs_rsnum) {
17670cc207a6SMartin Matuska 				error = EPERM;
17682a4b2251SJamie Gritton 				goto done_deref;
1769bf3db8aaSMartin Matuska 			} else
17700cc207a6SMartin Matuska 				rsnum = ppr->pr_devfs_rsnum;
17710cc207a6SMartin Matuska 		}
17720cc207a6SMartin Matuska 	}
1773b38ff370SJamie Gritton #ifdef INET
17742b0d6f81SJamie Gritton 	if (ip4s > 0) {
1775eb8dcdeaSGleb Smirnoff 		if ((ppr->pr_flags & PR_IP4) &&
1776eb8dcdeaSGleb Smirnoff 		    !prison_ip_parent_match(ppr->pr_addrs[PR_INET], ip4,
1777eb8dcdeaSGleb Smirnoff 		    PR_INET)) {
17780304c731SJamie Gritton 			error = EPERM;
17792a4b2251SJamie Gritton 			goto done_deref;
17800304c731SJamie Gritton 		}
1781eb8dcdeaSGleb Smirnoff 		if (!prison_ip_conflict_check(ppr, pr, ip4, PR_INET)) {
17820304c731SJamie Gritton 			error = EADDRINUSE;
1783eb8dcdeaSGleb Smirnoff 			vfs_opterror(opts, "IPv4 addresses clash");
17842a4b2251SJamie Gritton 			goto done_deref;
1785b38ff370SJamie Gritton 		}
17860304c731SJamie Gritton 	}
1787b38ff370SJamie Gritton #endif
1788b38ff370SJamie Gritton #ifdef INET6
17892b0d6f81SJamie Gritton 	if (ip6s > 0) {
1790eb8dcdeaSGleb Smirnoff 		if ((ppr->pr_flags & PR_IP6) &&
1791eb8dcdeaSGleb Smirnoff 		    !prison_ip_parent_match(ppr->pr_addrs[PR_INET6], ip6,
1792eb8dcdeaSGleb Smirnoff 		    PR_INET6)) {
17930304c731SJamie Gritton 			error = EPERM;
17942a4b2251SJamie Gritton 			goto done_deref;
17950304c731SJamie Gritton 		}
1796eb8dcdeaSGleb Smirnoff 		if (!prison_ip_conflict_check(ppr, pr, ip6, PR_INET6)) {
17970304c731SJamie Gritton 			error = EADDRINUSE;
1798eb8dcdeaSGleb Smirnoff 			vfs_opterror(opts, "IPv6 addresses clash");
17992a4b2251SJamie Gritton 			goto done_deref;
1800b38ff370SJamie Gritton 		}
18010304c731SJamie Gritton 	}
1802b38ff370SJamie Gritton #endif
18030304c731SJamie Gritton 	onamelen = namelen = 0;
1804b6f47c23SJamie Gritton 	if (namelc != NULL) {
18056ab6058eSJamie Gritton 		/* Give a default name of the jid.  Also allow the name to be
18066ab6058eSJamie Gritton 		 * explicitly the jid - but not any other number, and only in
18076ab6058eSJamie Gritton 		 * normal form (no leading zero/etc).
18086ab6058eSJamie Gritton 		 */
1809b6f47c23SJamie Gritton 		if (namelc[0] == '\0')
1810b6f47c23SJamie Gritton 			snprintf(namelc = numbuf, sizeof(numbuf), "%d", jid);
18116ab6058eSJamie Gritton 		else if ((strtoul(namelc, &p, 10) != jid ||
18126ab6058eSJamie Gritton 			  namelc[0] < '1' || namelc[0] > '9') && *p == '\0') {
1813b38ff370SJamie Gritton 			error = EINVAL;
1814babbbb9cSJamie Gritton 			vfs_opterror(opts,
1815babbbb9cSJamie Gritton 			    "name cannot be numeric (unless it is the jid)");
18162a4b2251SJamie Gritton 			goto done_deref;
1817b38ff370SJamie Gritton 		}
1818b38ff370SJamie Gritton 		/*
18190304c731SJamie Gritton 		 * Make sure the name isn't too long for the prison or its
18200304c731SJamie Gritton 		 * children.
1821b38ff370SJamie Gritton 		 */
1822b6f47c23SJamie Gritton 		pnamelen = (ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1;
1823b6f47c23SJamie Gritton 		onamelen = strlen(pr->pr_name + pnamelen);
1824b6f47c23SJamie Gritton 		namelen = strlen(namelc);
1825b6f47c23SJamie Gritton 		if (pnamelen + namelen + 1 > sizeof(pr->pr_name)) {
18260304c731SJamie Gritton 			error = ENAMETOOLONG;
18272a4b2251SJamie Gritton 			goto done_deref;
18280304c731SJamie Gritton 		}
18290304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT(pr, tpr, descend) {
18300304c731SJamie Gritton 			if (strlen(tpr->pr_name) + (namelen - onamelen) >=
18310304c731SJamie Gritton 			    sizeof(pr->pr_name)) {
18320304c731SJamie Gritton 				error = ENAMETOOLONG;
18332a4b2251SJamie Gritton 				goto done_deref;
18340304c731SJamie Gritton 			}
18350304c731SJamie Gritton 		}
18360304c731SJamie Gritton 	}
1837b3079544SJamie Gritton 	pr_allow_diff = pr_allow & ~ppr->pr_allow;
1838b3079544SJamie Gritton 	if (pr_allow_diff & ~PR_ALLOW_DIFFERENCES) {
18390304c731SJamie Gritton 		error = EPERM;
18402a4b2251SJamie Gritton 		goto done_deref;
1841b38ff370SJamie Gritton 	}
1842b38ff370SJamie Gritton 
1843b6f47c23SJamie Gritton 	/*
1844b6f47c23SJamie Gritton 	 * Let modules check their parameters.  This requires unlocking and
1845b6f47c23SJamie Gritton 	 * then re-locking the prison, but this is still a valid state as long
1846b6f47c23SJamie Gritton 	 * as allprison_lock remains xlocked.
1847b6f47c23SJamie Gritton 	 */
1848b6f47c23SJamie Gritton 	mtx_unlock(&pr->pr_mtx);
18492a4b2251SJamie Gritton 	drflags &= ~PD_LOCKED;
1850b6f47c23SJamie Gritton 	error = osd_jail_call(pr, PR_METHOD_CHECK, opts);
18512a4b2251SJamie Gritton 	if (error != 0)
18522a4b2251SJamie Gritton 		goto done_deref;
1853b6f47c23SJamie Gritton 	mtx_lock(&pr->pr_mtx);
18542a4b2251SJamie Gritton 	drflags |= PD_LOCKED;
1855b6f47c23SJamie Gritton 
1856b6f47c23SJamie Gritton 	/* At this point, all valid parameters should have been noted. */
1857b6f47c23SJamie Gritton 	TAILQ_FOREACH(opt, opts, link) {
1858b6f47c23SJamie Gritton 		if (!opt->seen && strcmp(opt->name, "errmsg")) {
1859b6f47c23SJamie Gritton 			error = EINVAL;
1860b6f47c23SJamie Gritton 			vfs_opterror(opts, "unknown parameter: %s", opt->name);
18612a4b2251SJamie Gritton 			goto done_deref;
1862b6f47c23SJamie Gritton 		}
1863b6f47c23SJamie Gritton 	}
1864b6f47c23SJamie Gritton 
1865b38ff370SJamie Gritton 	/* Set the parameters of the prison. */
1866b38ff370SJamie Gritton #ifdef INET
18670304c731SJamie Gritton 	redo_ip4 = 0;
18680304c731SJamie Gritton 	if (pr_flags & PR_IP4_USER) {
18690304c731SJamie Gritton 		pr->pr_flags |= PR_IP4;
1870eb8dcdeaSGleb Smirnoff 		prison_ip_set(pr, PR_INET, ip4);
1871b38ff370SJamie Gritton 		ip4 = NULL;
18720304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1873bdfc8cc4SJamie Gritton #ifdef VIMAGE
1874bdfc8cc4SJamie Gritton 			if (tpr->pr_flags & PR_VNET) {
1875bdfc8cc4SJamie Gritton 				descend = 0;
1876bdfc8cc4SJamie Gritton 				continue;
1877bdfc8cc4SJamie Gritton 			}
1878bdfc8cc4SJamie Gritton #endif
1879eb8dcdeaSGleb Smirnoff 			if (prison_ip_restrict(tpr, PR_INET, NULL)) {
18800304c731SJamie Gritton 				redo_ip4 = 1;
18810304c731SJamie Gritton 				descend = 0;
18820304c731SJamie Gritton 			}
18830304c731SJamie Gritton 		}
18840304c731SJamie Gritton 	}
1885b38ff370SJamie Gritton #endif
1886b38ff370SJamie Gritton #ifdef INET6
18870304c731SJamie Gritton 	redo_ip6 = 0;
18880304c731SJamie Gritton 	if (pr_flags & PR_IP6_USER) {
18890304c731SJamie Gritton 		pr->pr_flags |= PR_IP6;
1890eb8dcdeaSGleb Smirnoff 		prison_ip_set(pr, PR_INET6, ip6);
1891b38ff370SJamie Gritton 		ip6 = NULL;
18920304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1893bdfc8cc4SJamie Gritton #ifdef VIMAGE
1894bdfc8cc4SJamie Gritton 			if (tpr->pr_flags & PR_VNET) {
1895bdfc8cc4SJamie Gritton 				descend = 0;
1896bdfc8cc4SJamie Gritton 				continue;
1897bdfc8cc4SJamie Gritton 			}
1898bdfc8cc4SJamie Gritton #endif
1899eb8dcdeaSGleb Smirnoff 			if (prison_ip_restrict(tpr, PR_INET6, NULL)) {
19000304c731SJamie Gritton 				redo_ip6 = 1;
19010304c731SJamie Gritton 				descend = 0;
19020304c731SJamie Gritton 			}
19030304c731SJamie Gritton 		}
19040304c731SJamie Gritton 	}
1905b38ff370SJamie Gritton #endif
19060304c731SJamie Gritton 	if (gotslevel) {
1907b38ff370SJamie Gritton 		pr->pr_securelevel = slevel;
19080304c731SJamie Gritton 		/* Set all child jails to be at least this level. */
19090304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
19100304c731SJamie Gritton 			if (tpr->pr_securelevel < slevel)
19110304c731SJamie Gritton 				tpr->pr_securelevel = slevel;
19120304c731SJamie Gritton 	}
1913b97457e2SJamie Gritton 	if (gotchildmax) {
1914b97457e2SJamie Gritton 		pr->pr_childmax = childmax;
1915b97457e2SJamie Gritton 		/* Set all child jails to under this limit. */
1916b97457e2SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED_LEVEL(pr, tpr, descend, level)
1917b97457e2SJamie Gritton 			if (tpr->pr_childmax > childmax - level)
1918b97457e2SJamie Gritton 				tpr->pr_childmax = childmax > level
1919b97457e2SJamie Gritton 				    ? childmax - level : 0;
1920b97457e2SJamie Gritton 	}
19210304c731SJamie Gritton 	if (gotenforce) {
19220304c731SJamie Gritton 		pr->pr_enforce_statfs = enforce;
19230304c731SJamie Gritton 		/* Pass this restriction on to the children. */
19240304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
19250304c731SJamie Gritton 			if (tpr->pr_enforce_statfs < enforce)
19260304c731SJamie Gritton 				tpr->pr_enforce_statfs = enforce;
19270304c731SJamie Gritton 	}
19280cc207a6SMartin Matuska 	if (gotrsnum) {
19290cc207a6SMartin Matuska 		pr->pr_devfs_rsnum = rsnum;
19300cc207a6SMartin Matuska 		/* Pass this restriction on to the children. */
19310cc207a6SMartin Matuska 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
19320cc207a6SMartin Matuska 			tpr->pr_devfs_rsnum = rsnum;
19330cc207a6SMartin Matuska 	}
1934b6f47c23SJamie Gritton 	if (namelc != NULL) {
19350304c731SJamie Gritton 		if (ppr == &prison0)
1936b6f47c23SJamie Gritton 			strlcpy(pr->pr_name, namelc, sizeof(pr->pr_name));
19370304c731SJamie Gritton 		else
19380304c731SJamie Gritton 			snprintf(pr->pr_name, sizeof(pr->pr_name), "%s.%s",
1939b6f47c23SJamie Gritton 			    ppr->pr_name, namelc);
19400304c731SJamie Gritton 		/* Change this component of child names. */
19410304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
19420304c731SJamie Gritton 			bcopy(tpr->pr_name + onamelen, tpr->pr_name + namelen,
19430304c731SJamie Gritton 			    strlen(tpr->pr_name + onamelen) + 1);
19440304c731SJamie Gritton 			bcopy(pr->pr_name, tpr->pr_name, namelen);
19450304c731SJamie Gritton 		}
19460304c731SJamie Gritton 	}
1947b38ff370SJamie Gritton 	if (path != NULL) {
19480304c731SJamie Gritton 		/* Try to keep a real-rooted full pathname. */
1949b38ff370SJamie Gritton 		strlcpy(pr->pr_path, path, sizeof(pr->pr_path));
1950b38ff370SJamie Gritton 		pr->pr_root = root;
19512a4b2251SJamie Gritton 		root = NULL;
1952b38ff370SJamie Gritton 	}
195376ca6f88SJamie Gritton 	if (PR_HOST & ch_flags & ~pr_flags) {
195476ca6f88SJamie Gritton 		if (pr->pr_flags & PR_HOST) {
195576ca6f88SJamie Gritton 			/*
195676ca6f88SJamie Gritton 			 * Copy the parent's host info.  As with pr_ip4 above,
195776ca6f88SJamie Gritton 			 * the lack of a lock on the parent is not a problem;
195876ca6f88SJamie Gritton 			 * it is always set with allprison_lock at least
195976ca6f88SJamie Gritton 			 * shared, and is held exclusively here.
196076ca6f88SJamie Gritton 			 */
1961c1f19219SJamie Gritton 			strlcpy(pr->pr_hostname, pr->pr_parent->pr_hostname,
1962c1f19219SJamie Gritton 			    sizeof(pr->pr_hostname));
1963c1f19219SJamie Gritton 			strlcpy(pr->pr_domainname, pr->pr_parent->pr_domainname,
1964c1f19219SJamie Gritton 			    sizeof(pr->pr_domainname));
1965c1f19219SJamie Gritton 			strlcpy(pr->pr_hostuuid, pr->pr_parent->pr_hostuuid,
1966c1f19219SJamie Gritton 			    sizeof(pr->pr_hostuuid));
196776ca6f88SJamie Gritton 			pr->pr_hostid = pr->pr_parent->pr_hostid;
196876ca6f88SJamie Gritton 		}
196976ca6f88SJamie Gritton 	} else if (host != NULL || domain != NULL || uuid != NULL || gothid) {
197076ca6f88SJamie Gritton 		/* Set this prison, and any descendants without PR_HOST. */
1971b38ff370SJamie Gritton 		if (host != NULL)
1972c1f19219SJamie Gritton 			strlcpy(pr->pr_hostname, host, sizeof(pr->pr_hostname));
197376ca6f88SJamie Gritton 		if (domain != NULL)
1974c1f19219SJamie Gritton 			strlcpy(pr->pr_domainname, domain,
1975c1f19219SJamie Gritton 			    sizeof(pr->pr_domainname));
197676ca6f88SJamie Gritton 		if (uuid != NULL)
1977c1f19219SJamie Gritton 			strlcpy(pr->pr_hostuuid, uuid, sizeof(pr->pr_hostuuid));
197876ca6f88SJamie Gritton 		if (gothid)
197976ca6f88SJamie Gritton 			pr->pr_hostid = hid;
198076ca6f88SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
198176ca6f88SJamie Gritton 			if (tpr->pr_flags & PR_HOST)
198276ca6f88SJamie Gritton 				descend = 0;
198376ca6f88SJamie Gritton 			else {
198476ca6f88SJamie Gritton 				if (host != NULL)
1985c1f19219SJamie Gritton 					strlcpy(tpr->pr_hostname,
1986c1f19219SJamie Gritton 					    pr->pr_hostname,
1987c1f19219SJamie Gritton 					    sizeof(tpr->pr_hostname));
198876ca6f88SJamie Gritton 				if (domain != NULL)
1989c1f19219SJamie Gritton 					strlcpy(tpr->pr_domainname,
1990c1f19219SJamie Gritton 					    pr->pr_domainname,
1991c1f19219SJamie Gritton 					    sizeof(tpr->pr_domainname));
199276ca6f88SJamie Gritton 				if (uuid != NULL)
1993c1f19219SJamie Gritton 					strlcpy(tpr->pr_hostuuid,
1994c1f19219SJamie Gritton 					    pr->pr_hostuuid,
1995c1f19219SJamie Gritton 					    sizeof(tpr->pr_hostuuid));
199676ca6f88SJamie Gritton 				if (gothid)
199776ca6f88SJamie Gritton 					tpr->pr_hostid = hid;
199876ca6f88SJamie Gritton 			}
199976ca6f88SJamie Gritton 		}
200076ca6f88SJamie Gritton 	}
20010304c731SJamie Gritton 	pr->pr_allow = (pr->pr_allow & ~ch_allow) | pr_allow;
20020fe74ae6SJamie Gritton 	if ((tallow = ch_allow & ~pr_allow))
20030fe74ae6SJamie Gritton 		prison_set_allow_locked(pr, tallow, 0);
2004b38ff370SJamie Gritton 	/*
2005b38ff370SJamie Gritton 	 * Persistent prisons get an extra reference, and prisons losing their
20061158508aSJamie Gritton 	 * persist flag lose that reference.
2007b38ff370SJamie Gritton 	 */
200876ad42abSJamie Gritton 	born = !prison_isalive(pr);
20091158508aSJamie Gritton 	if (ch_flags & PR_PERSIST & (pr_flags ^ pr->pr_flags)) {
2010b38ff370SJamie Gritton 		if (pr_flags & PR_PERSIST) {
20116754ae25SJamie Gritton 			prison_hold(pr);
20121158508aSJamie Gritton 			/*
20131158508aSJamie Gritton 			 * This may make a dead prison alive again, but wait
20141158508aSJamie Gritton 			 * to label it as such until after OSD calls have had
20151158508aSJamie Gritton 			 * a chance to run (and perhaps to fail).
20161158508aSJamie Gritton 			 */
20176754ae25SJamie Gritton 			refcount_acquire(&pr->pr_uref);
2018b38ff370SJamie Gritton 		} else {
201939c8ef90SJamie Gritton 			drflags |= PD_DEUREF;
2020f7496dcaSJamie Gritton 			prison_free_not_last(pr);
2021b38ff370SJamie Gritton 		}
2022b38ff370SJamie Gritton 	}
2023b38ff370SJamie Gritton 	pr->pr_flags = (pr->pr_flags & ~ch_flags) | pr_flags;
2024b38ff370SJamie Gritton 	mtx_unlock(&pr->pr_mtx);
20252a4b2251SJamie Gritton 	drflags &= ~PD_LOCKED;
2026c861373bSJamie Gritton 	/*
2027c861373bSJamie Gritton 	 * Any errors past this point will need to de-persist newly created
2028c861373bSJamie Gritton 	 * prisons, as well as call remove methods.
2029c861373bSJamie Gritton 	 */
2030c861373bSJamie Gritton 	if (born)
2031c861373bSJamie Gritton 		drflags |= PD_KILL;
2032b38ff370SJamie Gritton 
2033a7ad07bfSEdward Tomasz Napierala #ifdef RACCT
20344b5c9cf6SEdward Tomasz Napierala 	if (racct_enable && created)
2035a7ad07bfSEdward Tomasz Napierala 		prison_racct_attach(pr);
2036a7ad07bfSEdward Tomasz Napierala #endif
2037a7ad07bfSEdward Tomasz Napierala 
20380304c731SJamie Gritton 	/* Locks may have prevented a complete restriction of child IP
20390304c731SJamie Gritton 	 * addresses.  If so, allocate some more memory and try again.
20400304c731SJamie Gritton 	 */
20410304c731SJamie Gritton #ifdef INET
20420304c731SJamie Gritton 	while (redo_ip4) {
2043eb8dcdeaSGleb Smirnoff 		ip4s = pr->pr_addrs[PR_INET]->ips;
2044eb8dcdeaSGleb Smirnoff 		ip4 = prison_ip_alloc(PR_INET, ip4s, M_WAITOK);
20450304c731SJamie Gritton 		mtx_lock(&pr->pr_mtx);
20460304c731SJamie Gritton 		redo_ip4 = 0;
20470304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
2048bdfc8cc4SJamie Gritton #ifdef VIMAGE
2049bdfc8cc4SJamie Gritton 			if (tpr->pr_flags & PR_VNET) {
2050bdfc8cc4SJamie Gritton 				descend = 0;
2051bdfc8cc4SJamie Gritton 				continue;
2052bdfc8cc4SJamie Gritton 			}
2053bdfc8cc4SJamie Gritton #endif
2054eb8dcdeaSGleb Smirnoff 			if (prison_ip_restrict(tpr, PR_INET, ip4)) {
20550304c731SJamie Gritton 				if (ip4 != NULL)
20560304c731SJamie Gritton 					ip4 = NULL;
20570304c731SJamie Gritton 				else
20580304c731SJamie Gritton 					redo_ip4 = 1;
20590304c731SJamie Gritton 			}
20600304c731SJamie Gritton 		}
20610304c731SJamie Gritton 		mtx_unlock(&pr->pr_mtx);
20620304c731SJamie Gritton 	}
20630304c731SJamie Gritton #endif
20640304c731SJamie Gritton #ifdef INET6
20650304c731SJamie Gritton 	while (redo_ip6) {
2066eb8dcdeaSGleb Smirnoff 		ip6s = pr->pr_addrs[PR_INET6]->ips;
2067eb8dcdeaSGleb Smirnoff 		ip6 = prison_ip_alloc(PR_INET6, ip6s, M_WAITOK);
20680304c731SJamie Gritton 		mtx_lock(&pr->pr_mtx);
20690304c731SJamie Gritton 		redo_ip6 = 0;
20700304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
2071bdfc8cc4SJamie Gritton #ifdef VIMAGE
2072bdfc8cc4SJamie Gritton 			if (tpr->pr_flags & PR_VNET) {
2073bdfc8cc4SJamie Gritton 				descend = 0;
2074bdfc8cc4SJamie Gritton 				continue;
2075bdfc8cc4SJamie Gritton 			}
2076bdfc8cc4SJamie Gritton #endif
2077eb8dcdeaSGleb Smirnoff 			if (prison_ip_restrict(tpr, PR_INET6, ip6)) {
20780304c731SJamie Gritton 				if (ip6 != NULL)
20790304c731SJamie Gritton 					ip6 = NULL;
20800304c731SJamie Gritton 				else
20810304c731SJamie Gritton 					redo_ip6 = 1;
20820304c731SJamie Gritton 			}
20830304c731SJamie Gritton 		}
20840304c731SJamie Gritton 		mtx_unlock(&pr->pr_mtx);
20850304c731SJamie Gritton 	}
20860304c731SJamie Gritton #endif
20870304c731SJamie Gritton 
2088b38ff370SJamie Gritton 	/* Let the modules do their work. */
2089cc5fd8c7SJamie Gritton 	if (born) {
2090b38ff370SJamie Gritton 		error = osd_jail_call(pr, PR_METHOD_CREATE, opts);
2091c861373bSJamie Gritton 		if (error)
20922a4b2251SJamie Gritton 			goto done_deref;
2093b38ff370SJamie Gritton 	}
2094b38ff370SJamie Gritton 	error = osd_jail_call(pr, PR_METHOD_SET, opts);
2095c861373bSJamie Gritton 	if (error)
20962a4b2251SJamie Gritton 		goto done_deref;
2097b38ff370SJamie Gritton 
20981158508aSJamie Gritton 	/*
20991158508aSJamie Gritton 	 * A new prison is now ready to be seen; either it has gained a user
21001158508aSJamie Gritton 	 * reference via persistence, or is about to gain one via attachment.
21011158508aSJamie Gritton 	 */
21021158508aSJamie Gritton 	if (born) {
21031158508aSJamie Gritton 		drflags = prison_lock_xlock(pr, drflags);
21041158508aSJamie Gritton 		pr->pr_state = PRISON_STATE_ALIVE;
21051158508aSJamie Gritton 	}
21061158508aSJamie Gritton 
2107b38ff370SJamie Gritton 	/* Attach this process to the prison if requested. */
2108b38ff370SJamie Gritton 	if (flags & JAIL_ATTACH) {
2109c861373bSJamie Gritton 		error = do_jail_attach(td, pr,
2110589e4c1dSJamie Gritton 		    prison_lock_xlock(pr, drflags & PD_LOCK_FLAGS));
2111f7496dcaSJamie Gritton 		drflags &= ~(PD_LOCKED | PD_LIST_XLOCKED);
2112b38ff370SJamie Gritton 		if (error) {
2113b38ff370SJamie Gritton 			vfs_opterror(opts, "attach failed");
21142a4b2251SJamie Gritton 			goto done_deref;
2115b38ff370SJamie Gritton 		}
2116b38ff370SJamie Gritton 	}
2117b38ff370SJamie Gritton 
21181fb24974SEdward Tomasz Napierala #ifdef RACCT
21194b5c9cf6SEdward Tomasz Napierala 	if (racct_enable && !created) {
2120701d6b50SJamie Gritton 		if (drflags & PD_LOCKED) {
2121701d6b50SJamie Gritton 			mtx_unlock(&pr->pr_mtx);
2122701d6b50SJamie Gritton 			drflags &= ~PD_LOCKED;
2123701d6b50SJamie Gritton 		}
2124f7496dcaSJamie Gritton 		if (drflags & PD_LIST_XLOCKED) {
2125f7496dcaSJamie Gritton 			sx_xunlock(&allprison_lock);
2126f7496dcaSJamie Gritton 			drflags &= ~PD_LIST_XLOCKED;
2127b4e87a63SJamie Gritton 		}
21281fb24974SEdward Tomasz Napierala 		prison_racct_modify(pr);
21291fb24974SEdward Tomasz Napierala 	}
21301fb24974SEdward Tomasz Napierala #endif
21311fb24974SEdward Tomasz Napierala 
2132bba7a2e8SRick Macklem #ifdef VNET_NFSD
2133bba7a2e8SRick Macklem 	if (born && pr != &prison0 && (pr->pr_allow & PR_ALLOW_NFSD) != 0 &&
2134bba7a2e8SRick Macklem 	    (pr->pr_root->v_vflag & VV_ROOT) == 0)
2135bba7a2e8SRick Macklem 		printf("Warning jail jid=%d: mountd/nfsd requires a separate"
2136bba7a2e8SRick Macklem 		   " file system\n", pr->pr_id);
2137bba7a2e8SRick Macklem #endif
2138bba7a2e8SRick Macklem 
2139c861373bSJamie Gritton 	drflags &= ~PD_KILL;
21401fb24974SEdward Tomasz Napierala 	td->td_retval[0] = pr->pr_id;
21411fb24974SEdward Tomasz Napierala 
21422a4b2251SJamie Gritton  done_deref:
21432a4b2251SJamie Gritton 	/* Release any temporary prison holds and/or locks. */
21442a4b2251SJamie Gritton 	if (pr != NULL)
21452a4b2251SJamie Gritton 		prison_deref(pr, drflags);
21462a4b2251SJamie Gritton 	else if (drflags & PD_LIST_SLOCKED)
2147b38ff370SJamie Gritton 		sx_sunlock(&allprison_lock);
21482a4b2251SJamie Gritton 	else if (drflags & PD_LIST_XLOCKED)
2149b38ff370SJamie Gritton 		sx_xunlock(&allprison_lock);
21505050aa86SKonstantin Belousov 	if (root != NULL)
2151b38ff370SJamie Gritton 		vrele(root);
2152b38ff370SJamie Gritton  done_errmsg:
2153b38ff370SJamie Gritton 	if (error) {
21542a4b2251SJamie Gritton 		/* Write the error message back to userspace. */
2155176ff3a0SJamie Gritton 		if (vfs_getopt(opts, "errmsg", (void **)&errmsg,
2156176ff3a0SJamie Gritton 		    &errmsg_len) == 0 && errmsg_len > 0) {
2157b38ff370SJamie Gritton 			errmsg_pos = 2 * vfs_getopt_pos(opts, "errmsg") + 1;
2158b38ff370SJamie Gritton 			if (optuio->uio_segflg == UIO_SYSSPACE)
2159b38ff370SJamie Gritton 				bcopy(errmsg,
2160b38ff370SJamie Gritton 				    optuio->uio_iov[errmsg_pos].iov_base,
2161b38ff370SJamie Gritton 				    errmsg_len);
2162b38ff370SJamie Gritton 			else
2163b38ff370SJamie Gritton 				copyout(errmsg,
2164b38ff370SJamie Gritton 				    optuio->uio_iov[errmsg_pos].iov_base,
2165b38ff370SJamie Gritton 				    errmsg_len);
2166b38ff370SJamie Gritton 		}
2167b38ff370SJamie Gritton 	}
2168b38ff370SJamie Gritton  done_free:
2169b38ff370SJamie Gritton #ifdef INET
2170eb8dcdeaSGleb Smirnoff 	prison_ip_free(ip4);
2171b38ff370SJamie Gritton #endif
2172b38ff370SJamie Gritton #ifdef INET6
2173eb8dcdeaSGleb Smirnoff 	prison_ip_free(ip6);
2174b38ff370SJamie Gritton #endif
21756dfe0a3dSMartin Matuska 	if (g_path != NULL)
21766dfe0a3dSMartin Matuska 		free(g_path, M_TEMP);
2177b38ff370SJamie Gritton 	vfs_freeopts(opts);
2178b38ff370SJamie Gritton 	return (error);
2179b38ff370SJamie Gritton }
2180b38ff370SJamie Gritton 
2181b38ff370SJamie Gritton /*
21827de883c8SJamie Gritton  * Find the next available prison ID.  Return the ID on success, or zero
21837de883c8SJamie Gritton  * on failure.  Also set a pointer to the allprison list entry the prison
21847de883c8SJamie Gritton  * should be inserted before.
21857de883c8SJamie Gritton  */
21867de883c8SJamie Gritton static int
21877de883c8SJamie Gritton get_next_prid(struct prison **insprp)
21887de883c8SJamie Gritton {
21897de883c8SJamie Gritton 	struct prison *inspr;
21907de883c8SJamie Gritton 	int jid, maxid;
21917de883c8SJamie Gritton 
21927de883c8SJamie Gritton 	jid = lastprid % JAIL_MAX + 1;
21937de883c8SJamie Gritton 	if (TAILQ_EMPTY(&allprison) ||
21947de883c8SJamie Gritton 	    TAILQ_LAST(&allprison, prisonlist)->pr_id < jid) {
21957de883c8SJamie Gritton 		/*
21967de883c8SJamie Gritton 		 * A common case is for all jails to be implicitly numbered,
21977de883c8SJamie Gritton 		 * which means they'll go on the end of the list, at least
21987de883c8SJamie Gritton 		 * for the first JAIL_MAX times.
21997de883c8SJamie Gritton 		 */
22007de883c8SJamie Gritton 		inspr = NULL;
22017de883c8SJamie Gritton 	} else {
22027de883c8SJamie Gritton 		/*
22037de883c8SJamie Gritton 		 * Take two passes through the allprison list: first starting
22047de883c8SJamie Gritton 		 * with the proposed jid, then ending with it.
22057de883c8SJamie Gritton 		 */
22067de883c8SJamie Gritton 		for (maxid = JAIL_MAX; maxid != 0; ) {
22077de883c8SJamie Gritton 			TAILQ_FOREACH(inspr, &allprison, pr_list) {
22087de883c8SJamie Gritton 				if (inspr->pr_id < jid)
22097de883c8SJamie Gritton 					continue;
2210f7496dcaSJamie Gritton 				if (inspr->pr_id > jid) {
2211f7496dcaSJamie Gritton 					/* Found an opening. */
22127de883c8SJamie Gritton 					maxid = 0;
22137de883c8SJamie Gritton 					break;
22147de883c8SJamie Gritton 				}
22157de883c8SJamie Gritton 				if (++jid > maxid) {
22167de883c8SJamie Gritton 					if (lastprid == maxid || lastprid == 0)
22177de883c8SJamie Gritton 					{
22187de883c8SJamie Gritton 						/*
22197de883c8SJamie Gritton 						 * The entire legal range
22207de883c8SJamie Gritton 						 * has been traversed
22217de883c8SJamie Gritton 						 */
22227de883c8SJamie Gritton 						return 0;
22237de883c8SJamie Gritton 					}
22247de883c8SJamie Gritton 					/* Try again from the start. */
22257de883c8SJamie Gritton 					jid = 1;
22267de883c8SJamie Gritton 					maxid = lastprid;
22277de883c8SJamie Gritton 					break;
22287de883c8SJamie Gritton 				}
22297de883c8SJamie Gritton 			}
22307de883c8SJamie Gritton 			if (inspr == NULL) {
22317de883c8SJamie Gritton 				/* Found room at the end of the list. */
22327de883c8SJamie Gritton 				break;
22337de883c8SJamie Gritton 			}
22347de883c8SJamie Gritton 		}
22357de883c8SJamie Gritton 	}
22367de883c8SJamie Gritton 	*insprp = inspr;
22377de883c8SJamie Gritton 	lastprid = jid;
22387de883c8SJamie Gritton 	return (jid);
22397de883c8SJamie Gritton }
22407de883c8SJamie Gritton 
22417de883c8SJamie Gritton /*
2242b38ff370SJamie Gritton  * struct jail_get_args {
2243b38ff370SJamie Gritton  *	struct iovec *iovp;
2244b38ff370SJamie Gritton  *	unsigned int iovcnt;
2245b38ff370SJamie Gritton  *	int flags;
2246b38ff370SJamie Gritton  * };
2247b38ff370SJamie Gritton  */
2248b38ff370SJamie Gritton int
22498451d0ddSKip Macy sys_jail_get(struct thread *td, struct jail_get_args *uap)
2250b38ff370SJamie Gritton {
2251b38ff370SJamie Gritton 	struct uio *auio;
2252b38ff370SJamie Gritton 	int error;
2253b38ff370SJamie Gritton 
2254b38ff370SJamie Gritton 	/* Check that we have an even number of iovecs. */
2255b38ff370SJamie Gritton 	if (uap->iovcnt & 1)
2256b38ff370SJamie Gritton 		return (EINVAL);
2257b38ff370SJamie Gritton 
2258b38ff370SJamie Gritton 	error = copyinuio(uap->iovp, uap->iovcnt, &auio);
2259b38ff370SJamie Gritton 	if (error)
2260b38ff370SJamie Gritton 		return (error);
2261b38ff370SJamie Gritton 	error = kern_jail_get(td, auio, uap->flags);
2262b38ff370SJamie Gritton 	if (error == 0)
2263b38ff370SJamie Gritton 		error = copyout(auio->uio_iov, uap->iovp,
2264b38ff370SJamie Gritton 		    uap->iovcnt * sizeof (struct iovec));
2265b38ff370SJamie Gritton 	free(auio, M_IOV);
2266b38ff370SJamie Gritton 	return (error);
2267b38ff370SJamie Gritton }
2268b38ff370SJamie Gritton 
2269b38ff370SJamie Gritton int
2270b38ff370SJamie Gritton kern_jail_get(struct thread *td, struct uio *optuio, int flags)
2271b38ff370SJamie Gritton {
2272672756aaSJamie Gritton 	struct bool_flags *bf;
2273672756aaSJamie Gritton 	struct jailsys_flags *jsf;
22740304c731SJamie Gritton 	struct prison *pr, *mypr;
2275b38ff370SJamie Gritton 	struct vfsopt *opt;
2276b38ff370SJamie Gritton 	struct vfsoptlist *opts;
2277b38ff370SJamie Gritton 	char *errmsg, *name;
22782a4b2251SJamie Gritton 	int drflags, error, errmsg_len, errmsg_pos, i, jid, len, pos;
2279672756aaSJamie Gritton 	unsigned f;
2280b38ff370SJamie Gritton 
2281b38ff370SJamie Gritton 	if (flags & ~JAIL_GET_MASK)
2282b38ff370SJamie Gritton 		return (EINVAL);
2283b38ff370SJamie Gritton 
2284b38ff370SJamie Gritton 	/* Get the parameter list. */
2285b38ff370SJamie Gritton 	error = vfs_buildopts(optuio, &opts);
2286b38ff370SJamie Gritton 	if (error)
2287b38ff370SJamie Gritton 		return (error);
2288b38ff370SJamie Gritton 	errmsg_pos = vfs_getopt_pos(opts, "errmsg");
22890304c731SJamie Gritton 	mypr = td->td_ucred->cr_prison;
22902a4b2251SJamie Gritton 	pr = NULL;
22911e2a13e6SJamie Gritton 
2292b38ff370SJamie Gritton 	/*
2293b38ff370SJamie Gritton 	 * Find the prison specified by one of: lastjid, jid, name.
2294b38ff370SJamie Gritton 	 */
2295b38ff370SJamie Gritton 	sx_slock(&allprison_lock);
22962a4b2251SJamie Gritton 	drflags = PD_LIST_SLOCKED;
2297b38ff370SJamie Gritton 	error = vfs_copyopt(opts, "lastjid", &jid, sizeof(jid));
2298b38ff370SJamie Gritton 	if (error == 0) {
2299b38ff370SJamie Gritton 		TAILQ_FOREACH(pr, &allprison, pr_list) {
2300f7496dcaSJamie Gritton 			if (pr->pr_id > jid &&
2301f7496dcaSJamie Gritton 			    ((flags & JAIL_DYING) || prison_isalive(pr)) &&
2302f7496dcaSJamie Gritton 			    prison_ischild(mypr, pr)) {
2303b38ff370SJamie Gritton 				mtx_lock(&pr->pr_mtx);
23042a4b2251SJamie Gritton 				drflags |= PD_LOCKED;
2305b38ff370SJamie Gritton 				goto found_prison;
23062a4b2251SJamie Gritton 			}
2307f7496dcaSJamie Gritton 		}
2308b38ff370SJamie Gritton 		error = ENOENT;
2309b38ff370SJamie Gritton 		vfs_opterror(opts, "no jail after %d", jid);
23102a4b2251SJamie Gritton 		goto done;
2311b38ff370SJamie Gritton 	} else if (error != ENOENT)
23122a4b2251SJamie Gritton 		goto done;
2313b38ff370SJamie Gritton 
2314b38ff370SJamie Gritton 	error = vfs_copyopt(opts, "jid", &jid, sizeof(jid));
2315b38ff370SJamie Gritton 	if (error == 0) {
2316b38ff370SJamie Gritton 		if (jid != 0) {
23170304c731SJamie Gritton 			pr = prison_find_child(mypr, jid);
2318b38ff370SJamie Gritton 			if (pr != NULL) {
23192a4b2251SJamie Gritton 				drflags |= PD_LOCKED;
232076ad42abSJamie Gritton 				if (!(prison_isalive(pr) ||
232176ad42abSJamie Gritton 				    (flags & JAIL_DYING))) {
2322b38ff370SJamie Gritton 					error = ENOENT;
2323b38ff370SJamie Gritton 					vfs_opterror(opts, "jail %d is dying",
2324b38ff370SJamie Gritton 					    jid);
23252a4b2251SJamie Gritton 					goto done;
2326b38ff370SJamie Gritton 				}
2327b38ff370SJamie Gritton 				goto found_prison;
2328b38ff370SJamie Gritton 			}
2329b38ff370SJamie Gritton 			error = ENOENT;
2330b38ff370SJamie Gritton 			vfs_opterror(opts, "jail %d not found", jid);
23312a4b2251SJamie Gritton 			goto done;
2332b38ff370SJamie Gritton 		}
2333b38ff370SJamie Gritton 	} else if (error != ENOENT)
23342a4b2251SJamie Gritton 		goto done;
2335b38ff370SJamie Gritton 
2336b38ff370SJamie Gritton 	error = vfs_getopt(opts, "name", (void **)&name, &len);
2337b38ff370SJamie Gritton 	if (error == 0) {
2338b38ff370SJamie Gritton 		if (len == 0 || name[len - 1] != '\0') {
2339b38ff370SJamie Gritton 			error = EINVAL;
23402a4b2251SJamie Gritton 			goto done;
2341b38ff370SJamie Gritton 		}
23420304c731SJamie Gritton 		pr = prison_find_name(mypr, name);
2343b38ff370SJamie Gritton 		if (pr != NULL) {
23442a4b2251SJamie Gritton 			drflags |= PD_LOCKED;
234576ad42abSJamie Gritton 			if (!(prison_isalive(pr) || (flags & JAIL_DYING))) {
2346b38ff370SJamie Gritton 				error = ENOENT;
2347b38ff370SJamie Gritton 				vfs_opterror(opts, "jail \"%s\" is dying",
2348b38ff370SJamie Gritton 				    name);
23492a4b2251SJamie Gritton 				goto done;
2350b38ff370SJamie Gritton 			}
2351b38ff370SJamie Gritton 			goto found_prison;
2352b38ff370SJamie Gritton 		}
2353b38ff370SJamie Gritton 		error = ENOENT;
2354b38ff370SJamie Gritton 		vfs_opterror(opts, "jail \"%s\" not found", name);
23552a4b2251SJamie Gritton 		goto done;
2356b38ff370SJamie Gritton 	} else if (error != ENOENT)
23572a4b2251SJamie Gritton 		goto done;
2358b38ff370SJamie Gritton 
2359b38ff370SJamie Gritton 	vfs_opterror(opts, "no jail specified");
2360b38ff370SJamie Gritton 	error = ENOENT;
23612a4b2251SJamie Gritton 	goto done;
2362b38ff370SJamie Gritton 
2363b38ff370SJamie Gritton  found_prison:
2364b38ff370SJamie Gritton 	/* Get the parameters of the prison. */
23656754ae25SJamie Gritton 	prison_hold(pr);
23662a4b2251SJamie Gritton 	drflags |= PD_DEREF;
2367b38ff370SJamie Gritton 	td->td_retval[0] = pr->pr_id;
2368b38ff370SJamie Gritton 	error = vfs_setopt(opts, "jid", &pr->pr_id, sizeof(pr->pr_id));
2369b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
23702a4b2251SJamie Gritton 		goto done;
23710304c731SJamie Gritton 	i = (pr->pr_parent == mypr) ? 0 : pr->pr_parent->pr_id;
23720304c731SJamie Gritton 	error = vfs_setopt(opts, "parent", &i, sizeof(i));
2373b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
23742a4b2251SJamie Gritton 		goto done;
23750304c731SJamie Gritton 	error = vfs_setopts(opts, "name", prison_name(mypr, pr));
23760304c731SJamie Gritton 	if (error != 0 && error != ENOENT)
23772a4b2251SJamie Gritton 		goto done;
23780304c731SJamie Gritton 	error = vfs_setopt(opts, "cpuset.id", &pr->pr_cpuset->cs_id,
2379b38ff370SJamie Gritton 	    sizeof(pr->pr_cpuset->cs_id));
2380b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
23812a4b2251SJamie Gritton 		goto done;
23820304c731SJamie Gritton 	error = vfs_setopts(opts, "path", prison_path(mypr, pr));
2383b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
23842a4b2251SJamie Gritton 		goto done;
2385b38ff370SJamie Gritton #ifdef INET
2386eb8dcdeaSGleb Smirnoff 	error = vfs_setopt_part(opts, "ip4.addr", pr->pr_addrs[PR_INET] + 1,
2387eb8dcdeaSGleb Smirnoff 	    pr->pr_addrs[PR_INET] ? pr->pr_addrs[PR_INET]->ips *
2388eb8dcdeaSGleb Smirnoff 	    pr_families[PR_INET].size : 0 );
2389b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
23902a4b2251SJamie Gritton 		goto done;
2391b38ff370SJamie Gritton #endif
2392b38ff370SJamie Gritton #ifdef INET6
2393eb8dcdeaSGleb Smirnoff 	error = vfs_setopt_part(opts, "ip6.addr", pr->pr_addrs[PR_INET6] + 1,
2394eb8dcdeaSGleb Smirnoff 	    pr->pr_addrs[PR_INET6] ? pr->pr_addrs[PR_INET6]->ips *
2395eb8dcdeaSGleb Smirnoff 	    pr_families[PR_INET6].size : 0 );
2396b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
23972a4b2251SJamie Gritton 		goto done;
2398b38ff370SJamie Gritton #endif
2399b38ff370SJamie Gritton 	error = vfs_setopt(opts, "securelevel", &pr->pr_securelevel,
2400b38ff370SJamie Gritton 	    sizeof(pr->pr_securelevel));
2401b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
24022a4b2251SJamie Gritton 		goto done;
2403b97457e2SJamie Gritton 	error = vfs_setopt(opts, "children.cur", &pr->pr_childcount,
2404b97457e2SJamie Gritton 	    sizeof(pr->pr_childcount));
2405b97457e2SJamie Gritton 	if (error != 0 && error != ENOENT)
24062a4b2251SJamie Gritton 		goto done;
2407b97457e2SJamie Gritton 	error = vfs_setopt(opts, "children.max", &pr->pr_childmax,
2408b97457e2SJamie Gritton 	    sizeof(pr->pr_childmax));
2409b97457e2SJamie Gritton 	if (error != 0 && error != ENOENT)
24102a4b2251SJamie Gritton 		goto done;
2411c1f19219SJamie Gritton 	error = vfs_setopts(opts, "host.hostname", pr->pr_hostname);
2412b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
24132a4b2251SJamie Gritton 		goto done;
2414c1f19219SJamie Gritton 	error = vfs_setopts(opts, "host.domainname", pr->pr_domainname);
241576ca6f88SJamie Gritton 	if (error != 0 && error != ENOENT)
24162a4b2251SJamie Gritton 		goto done;
2417c1f19219SJamie Gritton 	error = vfs_setopts(opts, "host.hostuuid", pr->pr_hostuuid);
241876ca6f88SJamie Gritton 	if (error != 0 && error != ENOENT)
24192a4b2251SJamie Gritton 		goto done;
2420841c0c7eSNathan Whitehorn #ifdef COMPAT_FREEBSD32
2421a5c1afadSDmitry Chagin 	if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) {
242276ca6f88SJamie Gritton 		uint32_t hid32 = pr->pr_hostid;
242376ca6f88SJamie Gritton 
242476ca6f88SJamie Gritton 		error = vfs_setopt(opts, "host.hostid", &hid32, sizeof(hid32));
242576ca6f88SJamie Gritton 	} else
242676ca6f88SJamie Gritton #endif
242776ca6f88SJamie Gritton 	error = vfs_setopt(opts, "host.hostid", &pr->pr_hostid,
242876ca6f88SJamie Gritton 	    sizeof(pr->pr_hostid));
242976ca6f88SJamie Gritton 	if (error != 0 && error != ENOENT)
24302a4b2251SJamie Gritton 		goto done;
24310304c731SJamie Gritton 	error = vfs_setopt(opts, "enforce_statfs", &pr->pr_enforce_statfs,
24320304c731SJamie Gritton 	    sizeof(pr->pr_enforce_statfs));
24330304c731SJamie Gritton 	if (error != 0 && error != ENOENT)
24342a4b2251SJamie Gritton 		goto done;
24350cc207a6SMartin Matuska 	error = vfs_setopt(opts, "devfs_ruleset", &pr->pr_devfs_rsnum,
24360cc207a6SMartin Matuska 	    sizeof(pr->pr_devfs_rsnum));
24370cc207a6SMartin Matuska 	if (error != 0 && error != ENOENT)
24382a4b2251SJamie Gritton 		goto done;
2439672756aaSJamie Gritton 	for (bf = pr_flag_bool;
2440672756aaSJamie Gritton 	     bf < pr_flag_bool + nitems(pr_flag_bool);
2441672756aaSJamie Gritton 	     bf++) {
2442672756aaSJamie Gritton 		i = (pr->pr_flags & bf->flag) ? 1 : 0;
2443672756aaSJamie Gritton 		error = vfs_setopt(opts, bf->name, &i, sizeof(i));
2444b38ff370SJamie Gritton 		if (error != 0 && error != ENOENT)
24452a4b2251SJamie Gritton 			goto done;
2446b38ff370SJamie Gritton 		i = !i;
2447672756aaSJamie Gritton 		error = vfs_setopt(opts, bf->noname, &i, sizeof(i));
2448b38ff370SJamie Gritton 		if (error != 0 && error != ENOENT)
24492a4b2251SJamie Gritton 			goto done;
24500304c731SJamie Gritton 	}
2451672756aaSJamie Gritton 	for (jsf = pr_flag_jailsys;
2452672756aaSJamie Gritton 	     jsf < pr_flag_jailsys + nitems(pr_flag_jailsys);
2453672756aaSJamie Gritton 	     jsf++) {
2454672756aaSJamie Gritton 		f = pr->pr_flags & (jsf->disable | jsf->new);
2455672756aaSJamie Gritton 		i = (f != 0 && f == jsf->disable) ? JAIL_SYS_DISABLE
2456672756aaSJamie Gritton 		    : (f == jsf->new) ? JAIL_SYS_NEW
24577cbf7213SJamie Gritton 		    : JAIL_SYS_INHERIT;
2458672756aaSJamie Gritton 		error = vfs_setopt(opts, jsf->name, &i, sizeof(i));
24597cbf7213SJamie Gritton 		if (error != 0 && error != ENOENT)
24602a4b2251SJamie Gritton 			goto done;
24617cbf7213SJamie Gritton 	}
2462672756aaSJamie Gritton 	for (bf = pr_flag_allow;
24635d58f959SJamie Gritton 	     bf < pr_flag_allow + nitems(pr_flag_allow) &&
24645d58f959SJamie Gritton 		atomic_load_int(&bf->flag) != 0;
2465672756aaSJamie Gritton 	     bf++) {
2466672756aaSJamie Gritton 		i = (pr->pr_allow & bf->flag) ? 1 : 0;
2467672756aaSJamie Gritton 		error = vfs_setopt(opts, bf->name, &i, sizeof(i));
24680304c731SJamie Gritton 		if (error != 0 && error != ENOENT)
24692a4b2251SJamie Gritton 			goto done;
24700304c731SJamie Gritton 		i = !i;
2471672756aaSJamie Gritton 		error = vfs_setopt(opts, bf->noname, &i, sizeof(i));
24720304c731SJamie Gritton 		if (error != 0 && error != ENOENT)
24732a4b2251SJamie Gritton 			goto done;
24740304c731SJamie Gritton 	}
247576ad42abSJamie Gritton 	i = !prison_isalive(pr);
2476b38ff370SJamie Gritton 	error = vfs_setopt(opts, "dying", &i, sizeof(i));
2477b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
24782a4b2251SJamie Gritton 		goto done;
2479b38ff370SJamie Gritton 	i = !i;
2480b38ff370SJamie Gritton 	error = vfs_setopt(opts, "nodying", &i, sizeof(i));
2481b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
24822a4b2251SJamie Gritton 		goto done;
2483bd96bd15SIan Lepore 	error = vfs_setopt(opts, "osreldate", &pr->pr_osreldate,
2484bd96bd15SIan Lepore 	    sizeof(pr->pr_osreldate));
2485a1a4c1b0SIan Lepore 	if (error != 0 && error != ENOENT)
24862a4b2251SJamie Gritton 		goto done;
2487a1a4c1b0SIan Lepore 	error = vfs_setopts(opts, "osrelease", pr->pr_osrelease);
2488a1a4c1b0SIan Lepore 	if (error != 0 && error != ENOENT)
24892a4b2251SJamie Gritton 		goto done;
2490b38ff370SJamie Gritton 
2491b38ff370SJamie Gritton 	/* Get the module parameters. */
2492b38ff370SJamie Gritton 	mtx_unlock(&pr->pr_mtx);
24932a4b2251SJamie Gritton 	drflags &= ~PD_LOCKED;
2494b38ff370SJamie Gritton 	error = osd_jail_call(pr, PR_METHOD_GET, opts);
2495b38ff370SJamie Gritton 	if (error)
24962a4b2251SJamie Gritton 		goto done;
24972a4b2251SJamie Gritton 	prison_deref(pr, drflags);
24982a4b2251SJamie Gritton 	pr = NULL;
24992a4b2251SJamie Gritton 	drflags = 0;
2500b38ff370SJamie Gritton 
2501b38ff370SJamie Gritton 	/* By now, all parameters should have been noted. */
2502b38ff370SJamie Gritton 	TAILQ_FOREACH(opt, opts, link) {
2503b38ff370SJamie Gritton 		if (!opt->seen && strcmp(opt->name, "errmsg")) {
2504b38ff370SJamie Gritton 			error = EINVAL;
2505b38ff370SJamie Gritton 			vfs_opterror(opts, "unknown parameter: %s", opt->name);
25062a4b2251SJamie Gritton 			goto done;
2507b38ff370SJamie Gritton 		}
2508b38ff370SJamie Gritton 	}
2509b38ff370SJamie Gritton 
2510b38ff370SJamie Gritton 	/* Write the fetched parameters back to userspace. */
2511b38ff370SJamie Gritton 	error = 0;
2512b38ff370SJamie Gritton 	TAILQ_FOREACH(opt, opts, link) {
2513b38ff370SJamie Gritton 		if (opt->pos >= 0 && opt->pos != errmsg_pos) {
2514b38ff370SJamie Gritton 			pos = 2 * opt->pos + 1;
2515b38ff370SJamie Gritton 			optuio->uio_iov[pos].iov_len = opt->len;
2516b38ff370SJamie Gritton 			if (opt->value != NULL) {
2517b38ff370SJamie Gritton 				if (optuio->uio_segflg == UIO_SYSSPACE) {
2518b38ff370SJamie Gritton 					bcopy(opt->value,
2519b38ff370SJamie Gritton 					    optuio->uio_iov[pos].iov_base,
2520b38ff370SJamie Gritton 					    opt->len);
2521b38ff370SJamie Gritton 				} else {
2522b38ff370SJamie Gritton 					error = copyout(opt->value,
2523b38ff370SJamie Gritton 					    optuio->uio_iov[pos].iov_base,
2524b38ff370SJamie Gritton 					    opt->len);
2525b38ff370SJamie Gritton 					if (error)
2526b38ff370SJamie Gritton 						break;
2527b38ff370SJamie Gritton 				}
2528b38ff370SJamie Gritton 			}
2529b38ff370SJamie Gritton 		}
2530b38ff370SJamie Gritton 	}
2531b38ff370SJamie Gritton 
25322a4b2251SJamie Gritton  done:
25332a4b2251SJamie Gritton 	/* Release any temporary prison holds and/or locks. */
25342a4b2251SJamie Gritton 	if (pr != NULL)
25352a4b2251SJamie Gritton 		prison_deref(pr, drflags);
25362a4b2251SJamie Gritton 	else if (drflags & PD_LIST_SLOCKED)
2537b38ff370SJamie Gritton 		sx_sunlock(&allprison_lock);
2538b38ff370SJamie Gritton 	if (error && errmsg_pos >= 0) {
25392a4b2251SJamie Gritton 		/* Write the error message back to userspace. */
2540b38ff370SJamie Gritton 		vfs_getopt(opts, "errmsg", (void **)&errmsg, &errmsg_len);
2541b38ff370SJamie Gritton 		errmsg_pos = 2 * errmsg_pos + 1;
2542b38ff370SJamie Gritton 		if (errmsg_len > 0) {
2543b38ff370SJamie Gritton 			if (optuio->uio_segflg == UIO_SYSSPACE)
2544b38ff370SJamie Gritton 				bcopy(errmsg,
2545b38ff370SJamie Gritton 				    optuio->uio_iov[errmsg_pos].iov_base,
2546b38ff370SJamie Gritton 				    errmsg_len);
2547b38ff370SJamie Gritton 			else
2548b38ff370SJamie Gritton 				copyout(errmsg,
2549b38ff370SJamie Gritton 				    optuio->uio_iov[errmsg_pos].iov_base,
2550b38ff370SJamie Gritton 				    errmsg_len);
2551b38ff370SJamie Gritton 		}
2552b38ff370SJamie Gritton 	}
2553b38ff370SJamie Gritton 	vfs_freeopts(opts);
2554b38ff370SJamie Gritton 	return (error);
2555b38ff370SJamie Gritton }
2556b38ff370SJamie Gritton 
2557b38ff370SJamie Gritton /*
2558b38ff370SJamie Gritton  * struct jail_remove_args {
2559b38ff370SJamie Gritton  *	int jid;
2560b38ff370SJamie Gritton  * };
2561b38ff370SJamie Gritton  */
2562b38ff370SJamie Gritton int
25638451d0ddSKip Macy sys_jail_remove(struct thread *td, struct jail_remove_args *uap)
2564b38ff370SJamie Gritton {
2565c861373bSJamie Gritton 	struct prison *pr;
2566c861373bSJamie Gritton 	int error;
2567b38ff370SJamie Gritton 
2568b38ff370SJamie Gritton 	error = priv_check(td, PRIV_JAIL_REMOVE);
2569b38ff370SJamie Gritton 	if (error)
2570b38ff370SJamie Gritton 		return (error);
2571b38ff370SJamie Gritton 
2572b38ff370SJamie Gritton 	sx_xlock(&allprison_lock);
25730304c731SJamie Gritton 	pr = prison_find_child(td->td_ucred->cr_prison, uap->jid);
2574b38ff370SJamie Gritton 	if (pr == NULL) {
2575b38ff370SJamie Gritton 		sx_xunlock(&allprison_lock);
2576b38ff370SJamie Gritton 		return (EINVAL);
2577b38ff370SJamie Gritton 	}
2578c861373bSJamie Gritton 	if (!prison_isalive(pr)) {
2579c861373bSJamie Gritton 		/* Silently ignore already-dying prisons. */
25800304c731SJamie Gritton 		mtx_unlock(&pr->pr_mtx);
2581c861373bSJamie Gritton 		sx_xunlock(&allprison_lock);
25820304c731SJamie Gritton 		return (0);
25830304c731SJamie Gritton 	}
2584c861373bSJamie Gritton 	prison_deref(pr, PD_KILL | PD_LOCKED | PD_LIST_XLOCKED);
2585c861373bSJamie Gritton 	return (0);
258675c13541SPoul-Henning Kamp }
258775c13541SPoul-Henning Kamp 
2588fd7a8150SMike Barcroft /*
25899ddb7954SMike Barcroft  * struct jail_attach_args {
25909ddb7954SMike Barcroft  *	int jid;
25919ddb7954SMike Barcroft  * };
2592fd7a8150SMike Barcroft  */
2593fd7a8150SMike Barcroft int
25948451d0ddSKip Macy sys_jail_attach(struct thread *td, struct jail_attach_args *uap)
2595fd7a8150SMike Barcroft {
2596b38ff370SJamie Gritton 	struct prison *pr;
2597b38ff370SJamie Gritton 	int error;
2598b38ff370SJamie Gritton 
2599b38ff370SJamie Gritton 	error = priv_check(td, PRIV_JAIL_ATTACH);
2600b38ff370SJamie Gritton 	if (error)
2601b38ff370SJamie Gritton 		return (error);
2602b38ff370SJamie Gritton 
2603f7496dcaSJamie Gritton 	sx_slock(&allprison_lock);
26040304c731SJamie Gritton 	pr = prison_find_child(td->td_ucred->cr_prison, uap->jid);
2605b38ff370SJamie Gritton 	if (pr == NULL) {
2606b38ff370SJamie Gritton 		sx_sunlock(&allprison_lock);
2607b38ff370SJamie Gritton 		return (EINVAL);
2608b38ff370SJamie Gritton 	}
2609b38ff370SJamie Gritton 
261076ad42abSJamie Gritton 	/* Do not allow a process to attach to a prison that is not alive. */
261176ad42abSJamie Gritton 	if (!prison_isalive(pr)) {
2612b38ff370SJamie Gritton 		mtx_unlock(&pr->pr_mtx);
2613b38ff370SJamie Gritton 		sx_sunlock(&allprison_lock);
2614b38ff370SJamie Gritton 		return (EINVAL);
2615b38ff370SJamie Gritton 	}
2616b38ff370SJamie Gritton 
2617f7496dcaSJamie Gritton 	return (do_jail_attach(td, pr, PD_LOCKED | PD_LIST_SLOCKED));
2618b38ff370SJamie Gritton }
2619b38ff370SJamie Gritton 
2620b38ff370SJamie Gritton static int
2621f7496dcaSJamie Gritton do_jail_attach(struct thread *td, struct prison *pr, int drflags)
2622b38ff370SJamie Gritton {
2623fd7a8150SMike Barcroft 	struct proc *p;
2624fd7a8150SMike Barcroft 	struct ucred *newcred, *oldcred;
26255050aa86SKonstantin Belousov 	int error;
2626fd7a8150SMike Barcroft 
2627f7496dcaSJamie Gritton 	mtx_assert(&pr->pr_mtx, MA_OWNED);
2628f7496dcaSJamie Gritton 	sx_assert(&allprison_lock, SX_LOCKED);
2629589e4c1dSJamie Gritton 	drflags &= PD_LOCK_FLAGS;
263057f22bd4SJacques Vidrine 	/*
263157f22bd4SJacques Vidrine 	 * XXX: Note that there is a slight race here if two threads
263257f22bd4SJacques Vidrine 	 * in the same privileged process attempt to attach to two
263357f22bd4SJacques Vidrine 	 * different jails at the same time.  It is important for
263457f22bd4SJacques Vidrine 	 * user processes not to do this, or they might end up with
263557f22bd4SJacques Vidrine 	 * a process root from one prison, but attached to the jail
263657f22bd4SJacques Vidrine 	 * of another.
263757f22bd4SJacques Vidrine 	 */
26381158508aSJamie Gritton 	prison_hold(pr);
26396754ae25SJamie Gritton 	refcount_acquire(&pr->pr_uref);
2640f7496dcaSJamie Gritton 	drflags |= PD_DEREF | PD_DEUREF;
2641fd7a8150SMike Barcroft 	mtx_unlock(&pr->pr_mtx);
2642f7496dcaSJamie Gritton 	drflags &= ~PD_LOCKED;
2643b38ff370SJamie Gritton 
2644b38ff370SJamie Gritton 	/* Let modules do whatever they need to prepare for attaching. */
2645b38ff370SJamie Gritton 	error = osd_jail_call(pr, PR_METHOD_ATTACH, td);
2646b38ff370SJamie Gritton 	if (error) {
2647f7496dcaSJamie Gritton 		prison_deref(pr, drflags);
2648b38ff370SJamie Gritton 		return (error);
2649b38ff370SJamie Gritton 	}
2650f7496dcaSJamie Gritton 	sx_unlock(&allprison_lock);
2651f7496dcaSJamie Gritton 	drflags &= ~(PD_LIST_SLOCKED | PD_LIST_XLOCKED);
2652fd7a8150SMike Barcroft 
2653413628a7SBjoern A. Zeeb 	/*
2654413628a7SBjoern A. Zeeb 	 * Reparent the newly attached process to this jail.
2655413628a7SBjoern A. Zeeb 	 */
2656b38ff370SJamie Gritton 	p = td->td_proc;
2657413628a7SBjoern A. Zeeb 	error = cpuset_setproc_update_set(p, pr->pr_cpuset);
2658413628a7SBjoern A. Zeeb 	if (error)
2659b38ff370SJamie Gritton 		goto e_revert_osd;
2660413628a7SBjoern A. Zeeb 
2661cb05b60aSAttilio Rao 	vn_lock(pr->pr_root, LK_EXCLUSIVE | LK_RETRY);
2662fd7a8150SMike Barcroft 	if ((error = change_dir(pr->pr_root, td)) != 0)
2663fd7a8150SMike Barcroft 		goto e_unlock;
2664fd7a8150SMike Barcroft #ifdef MAC
266530d239bcSRobert Watson 	if ((error = mac_vnode_check_chroot(td->td_ucred, pr->pr_root)))
2666fd7a8150SMike Barcroft 		goto e_unlock;
2667fd7a8150SMike Barcroft #endif
2668b249ce48SMateusz Guzik 	VOP_UNLOCK(pr->pr_root);
2669d4380c0cSJamie Gritton 	if ((error = pwd_chroot_chdir(td, pr->pr_root)))
26705050aa86SKonstantin Belousov 		goto e_revert_osd;
2671fd7a8150SMike Barcroft 
2672fd7a8150SMike Barcroft 	newcred = crget();
2673fd7a8150SMike Barcroft 	PROC_LOCK(p);
26741fb6767dSJamie Gritton 	oldcred = crcopysafe(p, newcred);
267569c4ee54SJohn Baldwin 	newcred->cr_prison = pr;
2676daf63fd2SMateusz Guzik 	proc_set_cred(p, newcred);
26771fb6767dSJamie Gritton 	setsugid(p);
2678097055e2SEdward Tomasz Napierala #ifdef RACCT
2679097055e2SEdward Tomasz Napierala 	racct_proc_ucred_changed(p, oldcred, newcred);
2680f87beb93SAndriy Gapon 	crhold(newcred);
2681f87beb93SAndriy Gapon #endif
2682f87beb93SAndriy Gapon 	PROC_UNLOCK(p);
2683f87beb93SAndriy Gapon #ifdef RCTL
2684f87beb93SAndriy Gapon 	rctl_proc_ucred_changed(p, newcred);
2685f87beb93SAndriy Gapon 	crfree(newcred);
2686097055e2SEdward Tomasz Napierala #endif
26875ecb5444SMateusz Guzik 	prison_proc_relink(oldcred->cr_prison, pr, p);
2688f7496dcaSJamie Gritton 	prison_deref(oldcred->cr_prison, drflags);
2689fd7a8150SMike Barcroft 	crfree(oldcred);
2690cc7b7306SJamie Gritton 
2691cc7b7306SJamie Gritton 	/*
2692cc7b7306SJamie Gritton 	 * If the prison was killed while changing credentials, die along
2693cc7b7306SJamie Gritton 	 * with it.
2694cc7b7306SJamie Gritton 	 */
2695cc7b7306SJamie Gritton 	if (!prison_isalive(pr)) {
2696cc7b7306SJamie Gritton 		PROC_LOCK(p);
2697cc7b7306SJamie Gritton 		kern_psignal(p, SIGKILL);
2698cc7b7306SJamie Gritton 		PROC_UNLOCK(p);
2699cc7b7306SJamie Gritton 	}
2700cc7b7306SJamie Gritton 
2701fd7a8150SMike Barcroft 	return (0);
27021fb6767dSJamie Gritton 
2703fd7a8150SMike Barcroft  e_unlock:
2704b249ce48SMateusz Guzik 	VOP_UNLOCK(pr->pr_root);
2705b38ff370SJamie Gritton  e_revert_osd:
2706b38ff370SJamie Gritton 	/* Tell modules this thread is still in its old jail after all. */
27077f4e7248SJamie Gritton 	sx_slock(&allprison_lock);
2708f7496dcaSJamie Gritton 	drflags |= PD_LIST_SLOCKED;
27091fb6767dSJamie Gritton 	(void)osd_jail_call(td->td_ucred->cr_prison, PR_METHOD_ATTACH, td);
2710f7496dcaSJamie Gritton 	prison_deref(pr, drflags);
2711fd7a8150SMike Barcroft 	return (error);
2712fd7a8150SMike Barcroft }
2713fd7a8150SMike Barcroft 
2714fd7a8150SMike Barcroft /*
2715fd7a8150SMike Barcroft  * Returns a locked prison instance, or NULL on failure.
2716fd7a8150SMike Barcroft  */
271754b369c1SPawel Jakub Dawidek struct prison *
2718fd7a8150SMike Barcroft prison_find(int prid)
2719fd7a8150SMike Barcroft {
2720fd7a8150SMike Barcroft 	struct prison *pr;
2721fd7a8150SMike Barcroft 
2722dc68a633SPawel Jakub Dawidek 	sx_assert(&allprison_lock, SX_LOCKED);
2723b38ff370SJamie Gritton 	TAILQ_FOREACH(pr, &allprison, pr_list) {
2724f7496dcaSJamie Gritton 		if (pr->pr_id < prid)
2725f7496dcaSJamie Gritton 			continue;
27267de883c8SJamie Gritton 		if (pr->pr_id > prid)
27277de883c8SJamie Gritton 			break;
2728f7496dcaSJamie Gritton 		KASSERT(prison_isvalid(pr), ("Found invalid prison %p", pr));
2729f7496dcaSJamie Gritton 		mtx_lock(&pr->pr_mtx);
2730f7496dcaSJamie Gritton 		return (pr);
2731fd7a8150SMike Barcroft 	}
2732fd7a8150SMike Barcroft 	return (NULL);
2733fd7a8150SMike Barcroft }
2734fd7a8150SMike Barcroft 
2735b38ff370SJamie Gritton /*
27360304c731SJamie Gritton  * Find a prison that is a descendant of mypr.  Returns a locked prison or NULL.
2737b38ff370SJamie Gritton  */
2738b38ff370SJamie Gritton struct prison *
27390304c731SJamie Gritton prison_find_child(struct prison *mypr, int prid)
2740b38ff370SJamie Gritton {
27410304c731SJamie Gritton 	struct prison *pr;
27420304c731SJamie Gritton 	int descend;
2743b38ff370SJamie Gritton 
2744b38ff370SJamie Gritton 	sx_assert(&allprison_lock, SX_LOCKED);
27450304c731SJamie Gritton 	FOREACH_PRISON_DESCENDANT(mypr, pr, descend) {
27460304c731SJamie Gritton 		if (pr->pr_id == prid) {
2747f7496dcaSJamie Gritton 			KASSERT(prison_isvalid(pr),
2748f7496dcaSJamie Gritton 			    ("Found invalid prison %p", pr));
27490304c731SJamie Gritton 			mtx_lock(&pr->pr_mtx);
27500304c731SJamie Gritton 			return (pr);
27510304c731SJamie Gritton 		}
27520304c731SJamie Gritton 	}
27530304c731SJamie Gritton 	return (NULL);
27540304c731SJamie Gritton }
27550304c731SJamie Gritton 
27560304c731SJamie Gritton /*
27570304c731SJamie Gritton  * Look for the name relative to mypr.  Returns a locked prison or NULL.
27580304c731SJamie Gritton  */
27590304c731SJamie Gritton struct prison *
27600304c731SJamie Gritton prison_find_name(struct prison *mypr, const char *name)
27610304c731SJamie Gritton {
27620304c731SJamie Gritton 	struct prison *pr, *deadpr;
27630304c731SJamie Gritton 	size_t mylen;
27640304c731SJamie Gritton 	int descend;
27650304c731SJamie Gritton 
27660304c731SJamie Gritton 	sx_assert(&allprison_lock, SX_LOCKED);
27670304c731SJamie Gritton 	mylen = (mypr == &prison0) ? 0 : strlen(mypr->pr_name) + 1;
2768b38ff370SJamie Gritton 	deadpr = NULL;
27690304c731SJamie Gritton 	FOREACH_PRISON_DESCENDANT(mypr, pr, descend) {
27700304c731SJamie Gritton 		if (!strcmp(pr->pr_name + mylen, name)) {
2771f7496dcaSJamie Gritton 			KASSERT(prison_isvalid(pr),
2772f7496dcaSJamie Gritton 			    ("Found invalid prison %p", pr));
2773f7496dcaSJamie Gritton 			if (prison_isalive(pr)) {
2774b38ff370SJamie Gritton 				mtx_lock(&pr->pr_mtx);
2775b38ff370SJamie Gritton 				return (pr);
2776f7496dcaSJamie Gritton 			}
2777b38ff370SJamie Gritton 			deadpr = pr;
2778b38ff370SJamie Gritton 		}
2779b38ff370SJamie Gritton 	}
27800304c731SJamie Gritton 	/* There was no valid prison - perhaps there was a dying one. */
2781f7496dcaSJamie Gritton 	if (deadpr != NULL)
2782b38ff370SJamie Gritton 		mtx_lock(&deadpr->pr_mtx);
2783b38ff370SJamie Gritton 	return (deadpr);
2784b38ff370SJamie Gritton }
2785b38ff370SJamie Gritton 
2786b38ff370SJamie Gritton /*
27870fe74ae6SJamie Gritton  * See if a prison has the specific flag set.  The prison should be locked,
27880fe74ae6SJamie Gritton  * unless checking for flags that are only set at jail creation (such as
27890fe74ae6SJamie Gritton  * PR_IP4 and PR_IP6), or only the single bit is examined, without regard
27900fe74ae6SJamie Gritton  * to any other prison data.
27910304c731SJamie Gritton  */
27920304c731SJamie Gritton int
27930304c731SJamie Gritton prison_flag(struct ucred *cred, unsigned flag)
27940304c731SJamie Gritton {
27950304c731SJamie Gritton 
27960304c731SJamie Gritton 	return (cred->cr_prison->pr_flags & flag);
27970304c731SJamie Gritton }
27980304c731SJamie Gritton 
27990304c731SJamie Gritton int
28000304c731SJamie Gritton prison_allow(struct ucred *cred, unsigned flag)
28010304c731SJamie Gritton {
28020304c731SJamie Gritton 
28030fe74ae6SJamie Gritton 	return ((cred->cr_prison->pr_allow & flag) != 0);
28040304c731SJamie Gritton }
28050304c731SJamie Gritton 
28060304c731SJamie Gritton /*
2807effad35eSJamie Gritton  * Hold a prison reference, by incrementing pr_ref.  It is generally
2808effad35eSJamie Gritton  * an error to hold a prison that does not already have a reference.
2809effad35eSJamie Gritton  * A prison record will remain valid as long as it has at least one
2810effad35eSJamie Gritton  * reference, and will not be removed as long as either the prison
2811effad35eSJamie Gritton  * mutex or the allprison lock is held (allprison_lock may be shared).
2812effad35eSJamie Gritton  */
2813effad35eSJamie Gritton void
2814effad35eSJamie Gritton prison_hold_locked(struct prison *pr)
2815effad35eSJamie Gritton {
2816effad35eSJamie Gritton 
28176754ae25SJamie Gritton 	/* Locking is no longer required. */
28186754ae25SJamie Gritton 	prison_hold(pr);
2819effad35eSJamie Gritton }
2820effad35eSJamie Gritton 
2821effad35eSJamie Gritton void
2822effad35eSJamie Gritton prison_hold(struct prison *pr)
2823effad35eSJamie Gritton {
28246754ae25SJamie Gritton #ifdef INVARIANTS
28256754ae25SJamie Gritton 	int was_valid = refcount_acquire_if_not_zero(&pr->pr_ref);
2826effad35eSJamie Gritton 
28276754ae25SJamie Gritton 	KASSERT(was_valid,
28286754ae25SJamie Gritton 	    ("Trying to hold dead prison %p (jid=%d).", pr, pr->pr_id));
28296754ae25SJamie Gritton #else
28306754ae25SJamie Gritton 	refcount_acquire(&pr->pr_ref);
28316754ae25SJamie Gritton #endif
2832effad35eSJamie Gritton }
2833effad35eSJamie Gritton 
2834effad35eSJamie Gritton /*
2835effad35eSJamie Gritton  * Remove a prison reference.  If that was the last reference, the
2836f7496dcaSJamie Gritton  * prison will be removed (at a later time).
2837b38ff370SJamie Gritton  */
283891421ba2SRobert Watson void
28391ba4a712SPawel Jakub Dawidek prison_free_locked(struct prison *pr)
284091421ba2SRobert Watson {
284191421ba2SRobert Watson 
28421ba4a712SPawel Jakub Dawidek 	mtx_assert(&pr->pr_mtx, MA_OWNED);
2843effad35eSJamie Gritton 	/*
2844f7496dcaSJamie Gritton 	 * Locking is no longer required, but unlock because the caller
2845f7496dcaSJamie Gritton 	 * expects it.
2846effad35eSJamie Gritton 	 */
2847f7496dcaSJamie Gritton 	mtx_unlock(&pr->pr_mtx);
2848f7496dcaSJamie Gritton 	prison_free(pr);
2849effad35eSJamie Gritton }
2850c2cda609SPawel Jakub Dawidek 
28511ba4a712SPawel Jakub Dawidek void
28521ba4a712SPawel Jakub Dawidek prison_free(struct prison *pr)
28531ba4a712SPawel Jakub Dawidek {
28541ba4a712SPawel Jakub Dawidek 
28556754ae25SJamie Gritton 	KASSERT(refcount_load(&pr->pr_ref) > 0,
28566754ae25SJamie Gritton 	    ("Trying to free dead prison %p (jid=%d).",
28576754ae25SJamie Gritton 	     pr, pr->pr_id));
2858f7496dcaSJamie Gritton 	if (!refcount_release_if_not_last(&pr->pr_ref)) {
2859f7496dcaSJamie Gritton 		/*
2860f7496dcaSJamie Gritton 		 * Don't remove the last reference in this context,
2861f7496dcaSJamie Gritton 		 * in case there are locks held.
2862f7496dcaSJamie Gritton 		 */
2863f7496dcaSJamie Gritton 		taskqueue_enqueue(taskqueue_thread, &pr->pr_task);
2864f7496dcaSJamie Gritton 	}
2865f7496dcaSJamie Gritton }
2866f7496dcaSJamie Gritton 
2867f7496dcaSJamie Gritton static void
2868f7496dcaSJamie Gritton prison_free_not_last(struct prison *pr)
2869f7496dcaSJamie Gritton {
2870f7496dcaSJamie Gritton #ifdef INVARIANTS
2871f7496dcaSJamie Gritton 	int lastref;
2872f7496dcaSJamie Gritton 
2873f7496dcaSJamie Gritton 	KASSERT(refcount_load(&pr->pr_ref) > 0,
2874f7496dcaSJamie Gritton 	    ("Trying to free dead prison %p (jid=%d).",
2875f7496dcaSJamie Gritton 	     pr, pr->pr_id));
2876f7496dcaSJamie Gritton 	lastref = refcount_release(&pr->pr_ref);
2877f7496dcaSJamie Gritton 	KASSERT(!lastref,
2878f7496dcaSJamie Gritton 	    ("prison_free_not_last freed last ref on prison %p (jid=%d).",
2879f7496dcaSJamie Gritton 	     pr, pr->pr_id));
2880f7496dcaSJamie Gritton #else
2881ee9b37aeSMateusz Guzik 	refcount_release(&pr->pr_ref);
2882f7496dcaSJamie Gritton #endif
28831ba4a712SPawel Jakub Dawidek }
28841ba4a712SPawel Jakub Dawidek 
288573d9e52dSJamie Gritton /*
2886f171938cSGordon Bergling  * Hold a prison for user visibility, by incrementing pr_uref.
2887effad35eSJamie Gritton  * It is generally an error to hold a prison that isn't already
288849a033d8SGordon Bergling  * user-visible, except through the jail system calls.  It is also
2889effad35eSJamie Gritton  * an error to hold an invalid prison.  A prison record will remain
2890effad35eSJamie Gritton  * alive as long as it has at least one user reference, and will not
2891f7496dcaSJamie Gritton  * be set to the dying state until the prison mutex and allprison_lock
2892f7496dcaSJamie Gritton  * are both freed.
2893effad35eSJamie Gritton  */
2894effad35eSJamie Gritton void
2895effad35eSJamie Gritton prison_proc_hold(struct prison *pr)
2896effad35eSJamie Gritton {
28976754ae25SJamie Gritton #ifdef INVARIANTS
28986754ae25SJamie Gritton 	int was_alive = refcount_acquire_if_not_zero(&pr->pr_uref);
2899effad35eSJamie Gritton 
29006754ae25SJamie Gritton 	KASSERT(was_alive,
2901effad35eSJamie Gritton 	    ("Cannot add a process to a non-alive prison (jid=%d)", pr->pr_id));
29026754ae25SJamie Gritton #else
29036754ae25SJamie Gritton 	refcount_acquire(&pr->pr_uref);
29046754ae25SJamie Gritton #endif
2905effad35eSJamie Gritton }
2906effad35eSJamie Gritton 
2907effad35eSJamie Gritton /*
2908effad35eSJamie Gritton  * Remove a prison user reference.  If it was the last reference, the
2909effad35eSJamie Gritton  * prison will be considered "dying", and may be removed once all of
2910effad35eSJamie Gritton  * its references are dropped.
2911effad35eSJamie Gritton  */
2912effad35eSJamie Gritton void
2913effad35eSJamie Gritton prison_proc_free(struct prison *pr)
2914effad35eSJamie Gritton {
2915effad35eSJamie Gritton 
29166754ae25SJamie Gritton 	/*
29176754ae25SJamie Gritton 	 * Locking is only required when releasing the last reference.
29186754ae25SJamie Gritton 	 * This allows assurance that a locked prison will remain alive
29196754ae25SJamie Gritton 	 * until it is unlocked.
29206754ae25SJamie Gritton 	 */
29216754ae25SJamie Gritton 	KASSERT(refcount_load(&pr->pr_uref) > 0,
2922effad35eSJamie Gritton 	    ("Trying to kill a process in a dead prison (jid=%d)", pr->pr_id));
2923195cd6aeSJamie Gritton 	if (!refcount_release_if_not_last(&pr->pr_uref)) {
2924effad35eSJamie Gritton 		/*
2925effad35eSJamie Gritton 		 * Don't remove the last user reference in this context,
2926effad35eSJamie Gritton 		 * which is expected to be a process that is not only locked,
2927effad35eSJamie Gritton 		 * but also half dead.  Add a reference so any calls to
2928effad35eSJamie Gritton 		 * prison_free() won't re-submit the task.
2929effad35eSJamie Gritton 		 */
2930f7496dcaSJamie Gritton 		prison_hold(pr);
29311158508aSJamie Gritton 		mtx_lock(&pr->pr_mtx);
29321158508aSJamie Gritton 		KASSERT(!(pr->pr_flags & PR_COMPLETE_PROC),
29331158508aSJamie Gritton 		    ("Redundant last reference in prison_proc_free (jid=%d)",
29341158508aSJamie Gritton 		     pr->pr_id));
29351158508aSJamie Gritton 		pr->pr_flags |= PR_COMPLETE_PROC;
29361158508aSJamie Gritton 		mtx_unlock(&pr->pr_mtx);
2937effad35eSJamie Gritton 		taskqueue_enqueue(taskqueue_thread, &pr->pr_task);
2938effad35eSJamie Gritton 	}
2939effad35eSJamie Gritton }
2940effad35eSJamie Gritton 
2941c861373bSJamie Gritton static void
2942c861373bSJamie Gritton prison_proc_free_not_last(struct prison *pr)
2943c861373bSJamie Gritton {
2944c861373bSJamie Gritton #ifdef INVARIANTS
2945c861373bSJamie Gritton 	int lastref;
2946c861373bSJamie Gritton 
2947c861373bSJamie Gritton 	KASSERT(refcount_load(&pr->pr_uref) > 0,
2948c861373bSJamie Gritton 	    ("Trying to free dead prison %p (jid=%d).",
2949c861373bSJamie Gritton 	     pr, pr->pr_id));
2950c861373bSJamie Gritton 	lastref = refcount_release(&pr->pr_uref);
2951c861373bSJamie Gritton 	KASSERT(!lastref,
2952c861373bSJamie Gritton 	    ("prison_proc_free_not_last freed last uref on prison %p (jid=%d).",
2953c861373bSJamie Gritton 	     pr, pr->pr_id));
2954c861373bSJamie Gritton #else
2955c861373bSJamie Gritton 	refcount_release(&pr->pr_uref);
2956c861373bSJamie Gritton #endif
2957c861373bSJamie Gritton }
2958c861373bSJamie Gritton 
29595ecb5444SMateusz Guzik void
29605ecb5444SMateusz Guzik prison_proc_link(struct prison *pr, struct proc *p)
29615ecb5444SMateusz Guzik {
29625ecb5444SMateusz Guzik 
29635ecb5444SMateusz Guzik 	sx_assert(&allproc_lock, SA_XLOCKED);
29645ecb5444SMateusz Guzik 	LIST_INSERT_HEAD(&pr->pr_proclist, p, p_jaillist);
29655ecb5444SMateusz Guzik }
29665ecb5444SMateusz Guzik 
29675ecb5444SMateusz Guzik void
29685ecb5444SMateusz Guzik prison_proc_unlink(struct prison *pr, struct proc *p)
29695ecb5444SMateusz Guzik {
29705ecb5444SMateusz Guzik 
29715ecb5444SMateusz Guzik 	sx_assert(&allproc_lock, SA_XLOCKED);
29725ecb5444SMateusz Guzik 	LIST_REMOVE(p, p_jaillist);
29735ecb5444SMateusz Guzik }
29745ecb5444SMateusz Guzik 
29755ecb5444SMateusz Guzik static void
29765ecb5444SMateusz Guzik prison_proc_relink(struct prison *opr, struct prison *npr, struct proc *p)
29775ecb5444SMateusz Guzik {
29785ecb5444SMateusz Guzik 
29795ecb5444SMateusz Guzik 	sx_xlock(&allproc_lock);
29805ecb5444SMateusz Guzik 	prison_proc_unlink(opr, p);
29815ecb5444SMateusz Guzik 	prison_proc_link(npr, p);
29825ecb5444SMateusz Guzik 	sx_xunlock(&allproc_lock);
29835ecb5444SMateusz Guzik }
29845ecb5444SMateusz Guzik 
2985effad35eSJamie Gritton /*
298673d9e52dSJamie Gritton  * Complete a call to either prison_free or prison_proc_free.
298773d9e52dSJamie Gritton  */
2988c2cda609SPawel Jakub Dawidek static void
2989c2cda609SPawel Jakub Dawidek prison_complete(void *context, int pending)
2990c2cda609SPawel Jakub Dawidek {
299173d9e52dSJamie Gritton 	struct prison *pr = context;
2992f7496dcaSJamie Gritton 	int drflags;
2993b38ff370SJamie Gritton 
2994effad35eSJamie Gritton 	/*
29951158508aSJamie Gritton 	 * This could be called to release the last reference, or the last
29961158508aSJamie Gritton 	 * user reference (plus the reference held in prison_proc_free).
2997effad35eSJamie Gritton 	 */
2998f7496dcaSJamie Gritton 	drflags = prison_lock_xlock(pr, PD_DEREF);
29991158508aSJamie Gritton 	if (pr->pr_flags & PR_COMPLETE_PROC) {
30001158508aSJamie Gritton 		pr->pr_flags &= ~PR_COMPLETE_PROC;
3001f7496dcaSJamie Gritton 		drflags |= PD_DEUREF;
30021158508aSJamie Gritton 	}
3003f7496dcaSJamie Gritton 	prison_deref(pr, drflags);
3004b38ff370SJamie Gritton }
3005b38ff370SJamie Gritton 
30065ecb5444SMateusz Guzik static void
30075ecb5444SMateusz Guzik prison_kill_processes_cb(struct proc *p, void *arg __unused)
30085ecb5444SMateusz Guzik {
30095ecb5444SMateusz Guzik 
30105ecb5444SMateusz Guzik 	kern_psignal(p, SIGKILL);
30115ecb5444SMateusz Guzik }
30125ecb5444SMateusz Guzik 
30135ecb5444SMateusz Guzik /*
30145ecb5444SMateusz Guzik  * Note the iteration does not guarantee acting on all processes.
30155ecb5444SMateusz Guzik  * Most notably there may be fork or jail_attach in progress.
30165ecb5444SMateusz Guzik  */
30175ecb5444SMateusz Guzik void
30185ecb5444SMateusz Guzik prison_proc_iterate(struct prison *pr, void (*cb)(struct proc *, void *),
30195ecb5444SMateusz Guzik     void *cbarg)
30205ecb5444SMateusz Guzik {
30215ecb5444SMateusz Guzik 	struct prison *ppr;
30225ecb5444SMateusz Guzik 	struct proc *p;
30235ecb5444SMateusz Guzik 
30245ecb5444SMateusz Guzik 	if (atomic_load_int(&pr->pr_childcount) == 0) {
30255ecb5444SMateusz Guzik 		sx_slock(&allproc_lock);
30265ecb5444SMateusz Guzik 		LIST_FOREACH(p, &pr->pr_proclist, p_jaillist) {
30275ecb5444SMateusz Guzik 			if (p->p_state == PRS_NEW)
30285ecb5444SMateusz Guzik 				continue;
30295ecb5444SMateusz Guzik 			PROC_LOCK(p);
30305ecb5444SMateusz Guzik 			cb(p, cbarg);
30315ecb5444SMateusz Guzik 			PROC_UNLOCK(p);
30325ecb5444SMateusz Guzik 		}
30335ecb5444SMateusz Guzik 		sx_sunlock(&allproc_lock);
30345ecb5444SMateusz Guzik 		if (atomic_load_int(&pr->pr_childcount) == 0)
30355ecb5444SMateusz Guzik 			return;
30365ecb5444SMateusz Guzik 		/*
30375ecb5444SMateusz Guzik 		 * Some jails popped up during the iteration, fall through to a
30385ecb5444SMateusz Guzik 		 * system-wide search.
30395ecb5444SMateusz Guzik 		 */
30405ecb5444SMateusz Guzik 	}
30415ecb5444SMateusz Guzik 
30425ecb5444SMateusz Guzik 	sx_slock(&allproc_lock);
30435ecb5444SMateusz Guzik 	FOREACH_PROC_IN_SYSTEM(p) {
30445ecb5444SMateusz Guzik 		PROC_LOCK(p);
30455ecb5444SMateusz Guzik 		if (p->p_state != PRS_NEW && p->p_ucred != NULL) {
30465ecb5444SMateusz Guzik 			for (ppr = p->p_ucred->cr_prison;
30475ecb5444SMateusz Guzik 			    ppr != &prison0;
30485ecb5444SMateusz Guzik 			    ppr = ppr->pr_parent) {
30495ecb5444SMateusz Guzik 				if (ppr == pr) {
30505ecb5444SMateusz Guzik 					cb(p, cbarg);
30515ecb5444SMateusz Guzik 					break;
30525ecb5444SMateusz Guzik 				}
30535ecb5444SMateusz Guzik 			}
30545ecb5444SMateusz Guzik 		}
30555ecb5444SMateusz Guzik 		PROC_UNLOCK(p);
30565ecb5444SMateusz Guzik 	}
30575ecb5444SMateusz Guzik 	sx_sunlock(&allproc_lock);
30585ecb5444SMateusz Guzik }
30595ecb5444SMateusz Guzik 
3060b38ff370SJamie Gritton /*
3061effad35eSJamie Gritton  * Remove a prison reference and/or user reference (usually).
3062effad35eSJamie Gritton  * This assumes context that allows sleeping (for allprison_lock),
3063effad35eSJamie Gritton  * with no non-sleeping locks held, except perhaps the prison itself.
3064effad35eSJamie Gritton  * If there are no more references, release and delist the prison.
3065effad35eSJamie Gritton  * On completion, the prison lock and the allprison lock are both
3066effad35eSJamie Gritton  * unlocked.
3067b38ff370SJamie Gritton  */
3068b38ff370SJamie Gritton static void
3069b38ff370SJamie Gritton prison_deref(struct prison *pr, int flags)
3070b38ff370SJamie Gritton {
30716e1d1bfcSJamie Gritton 	struct prisonlist freeprison;
3072c861373bSJamie Gritton 	struct prison *killpr, *rpr, *ppr, *tpr;
3073c2cda609SPawel Jakub Dawidek 
3074c861373bSJamie Gritton 	killpr = NULL;
30756e1d1bfcSJamie Gritton 	TAILQ_INIT(&freeprison);
30766e1d1bfcSJamie Gritton 	/*
30776e1d1bfcSJamie Gritton 	 * Release this prison as requested, which may cause its parent
30786e1d1bfcSJamie Gritton 	 * to be released, and then maybe its grandparent, etc.
30796e1d1bfcSJamie Gritton 	 */
30800304c731SJamie Gritton 	for (;;) {
3081c861373bSJamie Gritton 		if (flags & PD_KILL) {
3082c861373bSJamie Gritton 			/* Kill the prison and its descendents. */
3083589e4c1dSJamie Gritton 			KASSERT(pr != &prison0,
3084589e4c1dSJamie Gritton 			    ("prison_deref trying to kill prison0"));
3085c861373bSJamie Gritton 			if (!(flags & PD_DEREF)) {
3086c861373bSJamie Gritton 				prison_hold(pr);
3087c861373bSJamie Gritton 				flags |= PD_DEREF;
3088c861373bSJamie Gritton 			}
3089c861373bSJamie Gritton 			flags = prison_lock_xlock(pr, flags);
3090c861373bSJamie Gritton 			prison_deref_kill(pr, &freeprison);
3091c861373bSJamie Gritton 		}
3092e6d5cb63SJamie Gritton 		if (flags & PD_DEUREF) {
3093f7496dcaSJamie Gritton 			/* Drop a user reference. */
30946754ae25SJamie Gritton 			KASSERT(refcount_load(&pr->pr_uref) > 0,
309573d9e52dSJamie Gritton 			    ("prison_deref PD_DEUREF on a dead prison (jid=%d)",
309673d9e52dSJamie Gritton 			     pr->pr_id));
3097f7496dcaSJamie Gritton 			if (!refcount_release_if_not_last(&pr->pr_uref)) {
3098f7496dcaSJamie Gritton 				if (!(flags & PD_DEREF)) {
3099f7496dcaSJamie Gritton 					prison_hold(pr);
3100f7496dcaSJamie Gritton 					flags |= PD_DEREF;
3101f7496dcaSJamie Gritton 				}
3102f7496dcaSJamie Gritton 				flags = prison_lock_xlock(pr, flags);
31031158508aSJamie Gritton 				if (refcount_release(&pr->pr_uref) &&
31041158508aSJamie Gritton 				    pr->pr_state == PRISON_STATE_ALIVE) {
3105f7496dcaSJamie Gritton 					/*
3106f7496dcaSJamie Gritton 					 * When the last user references goes,
3107f7496dcaSJamie Gritton 					 * this becomes a dying prison.
3108f7496dcaSJamie Gritton 					 */
3109f7496dcaSJamie Gritton 					KASSERT(
3110f7496dcaSJamie Gritton 					    refcount_load(&prison0.pr_uref) > 0,
31116754ae25SJamie Gritton 					    ("prison0 pr_uref=0"));
31121158508aSJamie Gritton 					pr->pr_state = PRISON_STATE_DYING;
3113f7496dcaSJamie Gritton 					mtx_unlock(&pr->pr_mtx);
3114f7496dcaSJamie Gritton 					flags &= ~PD_LOCKED;
3115a9f7455cSJamie Gritton 					prison_cleanup(pr);
3116f7496dcaSJamie Gritton 				}
3117f7496dcaSJamie Gritton 			}
3118f7496dcaSJamie Gritton 		}
3119c861373bSJamie Gritton 		if (flags & PD_KILL) {
3120c861373bSJamie Gritton 			/*
3121c861373bSJamie Gritton 			 * Any remaining user references are probably processes
3122c861373bSJamie Gritton 			 * that need to be killed, either in this prison or its
3123c861373bSJamie Gritton 			 * descendants.
3124c861373bSJamie Gritton 			 */
3125c861373bSJamie Gritton 			if (refcount_load(&pr->pr_uref) > 0)
3126c861373bSJamie Gritton 				killpr = pr;
3127589e4c1dSJamie Gritton 			/* Make sure the parent prison doesn't get killed. */
3128589e4c1dSJamie Gritton 			flags &= ~PD_KILL;
3129c861373bSJamie Gritton 		}
313073d9e52dSJamie Gritton 		if (flags & PD_DEREF) {
3131f7496dcaSJamie Gritton 			/* Drop a reference. */
31326754ae25SJamie Gritton 			KASSERT(refcount_load(&pr->pr_ref) > 0,
313373d9e52dSJamie Gritton 			    ("prison_deref PD_DEREF on a dead prison (jid=%d)",
313473d9e52dSJamie Gritton 			     pr->pr_id));
3135f7496dcaSJamie Gritton 			if (!refcount_release_if_not_last(&pr->pr_ref)) {
3136f7496dcaSJamie Gritton 				flags = prison_lock_xlock(pr, flags);
3137f7496dcaSJamie Gritton 				if (refcount_release(&pr->pr_ref)) {
3138cc5fd8c7SJamie Gritton 					/*
3139f7496dcaSJamie Gritton 					 * When the last reference goes,
3140f7496dcaSJamie Gritton 					 * unlink the prison and set it aside.
3141cc5fd8c7SJamie Gritton 					 */
3142f7496dcaSJamie Gritton 					KASSERT(
3143f7496dcaSJamie Gritton 					    refcount_load(&pr->pr_uref) == 0,
3144f7496dcaSJamie Gritton 					    ("prison_deref: last ref, "
3145f7496dcaSJamie Gritton 					     "but still has %d urefs (jid=%d)",
3146f7496dcaSJamie Gritton 					     pr->pr_uref, pr->pr_id));
3147f7496dcaSJamie Gritton 					KASSERT(
3148f7496dcaSJamie Gritton 					    refcount_load(&prison0.pr_ref) != 0,
3149f7496dcaSJamie Gritton 					    ("prison0 pr_ref=0"));
31501158508aSJamie Gritton 					pr->pr_state = PRISON_STATE_INVALID;
3151b38ff370SJamie Gritton 					TAILQ_REMOVE(&allprison, pr, pr_list);
31520304c731SJamie Gritton 					LIST_REMOVE(pr, pr_sibling);
3153f7496dcaSJamie Gritton 					TAILQ_INSERT_TAIL(&freeprison, pr,
3154f7496dcaSJamie Gritton 					    pr_list);
3155f7496dcaSJamie Gritton 					for (ppr = pr->pr_parent;
3156f7496dcaSJamie Gritton 					     ppr != NULL;
3157f7496dcaSJamie Gritton 					     ppr = ppr->pr_parent)
3158f7496dcaSJamie Gritton 						ppr->pr_childcount--;
3159f7496dcaSJamie Gritton 					/*
3160f7496dcaSJamie Gritton 					 * Removing a prison frees references
3161f7496dcaSJamie Gritton 					 * from its parent.
3162f7496dcaSJamie Gritton 					 */
3163f7496dcaSJamie Gritton 					mtx_unlock(&pr->pr_mtx);
3164f7496dcaSJamie Gritton 					flags &= ~PD_LOCKED;
31656e1d1bfcSJamie Gritton 					pr = pr->pr_parent;
31666e1d1bfcSJamie Gritton 					flags |= PD_DEREF | PD_DEUREF;
3167f7496dcaSJamie Gritton 					continue;
3168f7496dcaSJamie Gritton 				}
3169f7496dcaSJamie Gritton 			}
3170f7496dcaSJamie Gritton 		}
3171f7496dcaSJamie Gritton 		break;
31726e1d1bfcSJamie Gritton 	}
31736e1d1bfcSJamie Gritton 
31746e1d1bfcSJamie Gritton 	/* Release all the prison locks. */
3175f7496dcaSJamie Gritton 	if (flags & PD_LOCKED)
3176f7496dcaSJamie Gritton 		mtx_unlock(&pr->pr_mtx);
31776e1d1bfcSJamie Gritton 	if (flags & PD_LIST_SLOCKED)
31786e1d1bfcSJamie Gritton 		sx_sunlock(&allprison_lock);
31796e1d1bfcSJamie Gritton 	else if (flags & PD_LIST_XLOCKED)
31806e1d1bfcSJamie Gritton 		sx_xunlock(&allprison_lock);
31816e1d1bfcSJamie Gritton 
3182c861373bSJamie Gritton 	/* Kill any processes attached to a killed prison. */
31835ecb5444SMateusz Guzik 	if (killpr != NULL)
31845ecb5444SMateusz Guzik 		prison_proc_iterate(killpr, prison_kill_processes_cb, NULL);
3185c861373bSJamie Gritton 
31866e1d1bfcSJamie Gritton 	/*
31876e1d1bfcSJamie Gritton 	 * Finish removing any unreferenced prisons, which couldn't happen
31886e1d1bfcSJamie Gritton 	 * while allprison_lock was held (to avoid a LOR on vrele).
31896e1d1bfcSJamie Gritton 	 */
31906e1d1bfcSJamie Gritton 	TAILQ_FOREACH_SAFE(rpr, &freeprison, pr_list, tpr) {
31916e1d1bfcSJamie Gritton #ifdef VIMAGE
31926e1d1bfcSJamie Gritton 		if (rpr->pr_vnet != rpr->pr_parent->pr_vnet)
31936e1d1bfcSJamie Gritton 			vnet_destroy(rpr->pr_vnet);
31946e1d1bfcSJamie Gritton #endif
31956e1d1bfcSJamie Gritton 		if (rpr->pr_root != NULL)
31966e1d1bfcSJamie Gritton 			vrele(rpr->pr_root);
31976e1d1bfcSJamie Gritton 		mtx_destroy(&rpr->pr_mtx);
31986e1d1bfcSJamie Gritton #ifdef INET
3199eb8dcdeaSGleb Smirnoff 		prison_ip_free(rpr->pr_addrs[PR_INET]);
32006e1d1bfcSJamie Gritton #endif
32016e1d1bfcSJamie Gritton #ifdef INET6
3202eb8dcdeaSGleb Smirnoff 		prison_ip_free(rpr->pr_addrs[PR_INET6]);
32036e1d1bfcSJamie Gritton #endif
32046e1d1bfcSJamie Gritton 		if (rpr->pr_cpuset != NULL)
32056e1d1bfcSJamie Gritton 			cpuset_rel(rpr->pr_cpuset);
32066e1d1bfcSJamie Gritton 		osd_jail_exit(rpr);
32076e1d1bfcSJamie Gritton #ifdef RACCT
32086e1d1bfcSJamie Gritton 		if (racct_enable)
32096e1d1bfcSJamie Gritton 			prison_racct_detach(rpr);
32106e1d1bfcSJamie Gritton #endif
3211f7496dcaSJamie Gritton 		TAILQ_REMOVE(&freeprison, rpr, pr_list);
32126e1d1bfcSJamie Gritton 		free(rpr, M_PRISON);
32130304c731SJamie Gritton 	}
3214b3059e09SRobert Watson }
3215b3059e09SRobert Watson 
3216413628a7SBjoern A. Zeeb /*
3217c861373bSJamie Gritton  * Kill the prison and its descendants.  Mark them as dying, clear the
3218c861373bSJamie Gritton  * persist flag, and call module remove methods.
3219c861373bSJamie Gritton  */
3220c861373bSJamie Gritton static void
3221c861373bSJamie Gritton prison_deref_kill(struct prison *pr, struct prisonlist *freeprison)
3222c861373bSJamie Gritton {
3223c861373bSJamie Gritton 	struct prison *cpr, *ppr, *rpr;
3224c861373bSJamie Gritton 	bool descend;
3225c861373bSJamie Gritton 
3226c861373bSJamie Gritton 	/*
3227c861373bSJamie Gritton 	 * Unlike the descendants, the target prison can be killed
3228c861373bSJamie Gritton 	 * even if it is currently dying.  This is useful for failed
3229c861373bSJamie Gritton 	 * creation in jail_set(2).
3230c861373bSJamie Gritton 	 */
3231c861373bSJamie Gritton 	KASSERT(refcount_load(&pr->pr_ref) > 0,
3232c861373bSJamie Gritton 	    ("Trying to kill dead prison %p (jid=%d).",
3233c861373bSJamie Gritton 	     pr, pr->pr_id));
3234c861373bSJamie Gritton 	refcount_acquire(&pr->pr_uref);
3235c861373bSJamie Gritton 	pr->pr_state = PRISON_STATE_DYING;
3236c861373bSJamie Gritton 	mtx_unlock(&pr->pr_mtx);
3237c861373bSJamie Gritton 
3238c861373bSJamie Gritton 	rpr = NULL;
3239c861373bSJamie Gritton 	FOREACH_PRISON_DESCENDANT_PRE_POST(pr, cpr, descend) {
3240c861373bSJamie Gritton 		if (descend) {
3241c861373bSJamie Gritton 			if (!prison_isalive(cpr)) {
3242c861373bSJamie Gritton 				descend = false;
3243c861373bSJamie Gritton 				continue;
3244c861373bSJamie Gritton 			}
3245c861373bSJamie Gritton 			prison_hold(cpr);
3246c861373bSJamie Gritton 			prison_proc_hold(cpr);
3247c861373bSJamie Gritton 			mtx_lock(&cpr->pr_mtx);
3248c861373bSJamie Gritton 			cpr->pr_state = PRISON_STATE_DYING;
3249c861373bSJamie Gritton 			cpr->pr_flags |= PR_REMOVE;
3250c861373bSJamie Gritton 			mtx_unlock(&cpr->pr_mtx);
3251c861373bSJamie Gritton 			continue;
3252c861373bSJamie Gritton 		}
3253c861373bSJamie Gritton 		if (!(cpr->pr_flags & PR_REMOVE))
3254c861373bSJamie Gritton 			continue;
3255a9f7455cSJamie Gritton 		prison_cleanup(cpr);
3256c861373bSJamie Gritton 		mtx_lock(&cpr->pr_mtx);
3257c861373bSJamie Gritton 		cpr->pr_flags &= ~PR_REMOVE;
3258c861373bSJamie Gritton 		if (cpr->pr_flags & PR_PERSIST) {
3259c861373bSJamie Gritton 			cpr->pr_flags &= ~PR_PERSIST;
3260c861373bSJamie Gritton 			prison_proc_free_not_last(cpr);
3261c861373bSJamie Gritton 			prison_free_not_last(cpr);
3262c861373bSJamie Gritton 		}
3263c861373bSJamie Gritton 		(void)refcount_release(&cpr->pr_uref);
3264c861373bSJamie Gritton 		if (refcount_release(&cpr->pr_ref)) {
3265c861373bSJamie Gritton 			/*
3266c861373bSJamie Gritton 			 * When the last reference goes, unlink the prison
3267c861373bSJamie Gritton 			 * and set it aside for prison_deref() to handle.
3268c861373bSJamie Gritton 			 * Delay unlinking the sibling list to keep the loop
3269c861373bSJamie Gritton 			 * safe.
3270c861373bSJamie Gritton 			 */
3271c861373bSJamie Gritton 			if (rpr != NULL)
3272c861373bSJamie Gritton 				LIST_REMOVE(rpr, pr_sibling);
3273c861373bSJamie Gritton 			rpr = cpr;
3274c861373bSJamie Gritton 			rpr->pr_state = PRISON_STATE_INVALID;
3275c861373bSJamie Gritton 			TAILQ_REMOVE(&allprison, rpr, pr_list);
3276c861373bSJamie Gritton 			TAILQ_INSERT_TAIL(freeprison, rpr, pr_list);
3277c861373bSJamie Gritton 			/*
3278c861373bSJamie Gritton 			 * Removing a prison frees references from its parent.
3279c861373bSJamie Gritton 			 */
3280c861373bSJamie Gritton 			ppr = rpr->pr_parent;
3281c861373bSJamie Gritton 			prison_proc_free_not_last(ppr);
3282c861373bSJamie Gritton 			prison_free_not_last(ppr);
3283c861373bSJamie Gritton 			for (; ppr != NULL; ppr = ppr->pr_parent)
3284c861373bSJamie Gritton 				ppr->pr_childcount--;
3285c861373bSJamie Gritton 		}
3286c861373bSJamie Gritton 		mtx_unlock(&cpr->pr_mtx);
3287c861373bSJamie Gritton 	}
3288c861373bSJamie Gritton 	if (rpr != NULL)
3289c861373bSJamie Gritton 		LIST_REMOVE(rpr, pr_sibling);
3290c861373bSJamie Gritton 
3291a9f7455cSJamie Gritton 	prison_cleanup(pr);
3292c861373bSJamie Gritton 	mtx_lock(&pr->pr_mtx);
3293c861373bSJamie Gritton 	if (pr->pr_flags & PR_PERSIST) {
3294c861373bSJamie Gritton 		pr->pr_flags &= ~PR_PERSIST;
3295c861373bSJamie Gritton 		prison_proc_free_not_last(pr);
3296c861373bSJamie Gritton 		prison_free_not_last(pr);
3297c861373bSJamie Gritton 	}
3298c861373bSJamie Gritton 	(void)refcount_release(&pr->pr_uref);
3299c861373bSJamie Gritton }
3300c861373bSJamie Gritton 
3301c861373bSJamie Gritton /*
3302f7496dcaSJamie Gritton  * Given the current locking state in the flags, make sure allprison_lock
3303f7496dcaSJamie Gritton  * is held exclusive, and the prison is locked.  Return flags indicating
3304f7496dcaSJamie Gritton  * the new state.
3305f7496dcaSJamie Gritton  */
3306f7496dcaSJamie Gritton static int
3307f7496dcaSJamie Gritton prison_lock_xlock(struct prison *pr, int flags)
3308f7496dcaSJamie Gritton {
3309f7496dcaSJamie Gritton 
3310f7496dcaSJamie Gritton 	if (!(flags & PD_LIST_XLOCKED)) {
3311f7496dcaSJamie Gritton 		/*
3312f7496dcaSJamie Gritton 		 * Get allprison_lock, which may be an upgrade,
3313f7496dcaSJamie Gritton 		 * and may require unlocking the prison.
3314f7496dcaSJamie Gritton 		 */
3315f7496dcaSJamie Gritton 		if (flags & PD_LOCKED) {
3316f7496dcaSJamie Gritton 			mtx_unlock(&pr->pr_mtx);
3317f7496dcaSJamie Gritton 			flags &= ~PD_LOCKED;
3318f7496dcaSJamie Gritton 		}
3319f7496dcaSJamie Gritton 		if (flags & PD_LIST_SLOCKED) {
3320f7496dcaSJamie Gritton 			if (!sx_try_upgrade(&allprison_lock)) {
3321f7496dcaSJamie Gritton 				sx_sunlock(&allprison_lock);
3322f7496dcaSJamie Gritton 				sx_xlock(&allprison_lock);
3323f7496dcaSJamie Gritton 			}
3324f7496dcaSJamie Gritton 			flags &= ~PD_LIST_SLOCKED;
3325f7496dcaSJamie Gritton 		} else
3326f7496dcaSJamie Gritton 			sx_xlock(&allprison_lock);
3327f7496dcaSJamie Gritton 		flags |= PD_LIST_XLOCKED;
3328f7496dcaSJamie Gritton 	}
3329f7496dcaSJamie Gritton 	if (!(flags & PD_LOCKED)) {
3330f7496dcaSJamie Gritton 		/* Lock the prison mutex. */
3331f7496dcaSJamie Gritton 		mtx_lock(&pr->pr_mtx);
3332f7496dcaSJamie Gritton 		flags |= PD_LOCKED;
3333f7496dcaSJamie Gritton 	}
3334f7496dcaSJamie Gritton 	return flags;
3335f7496dcaSJamie Gritton }
3336f7496dcaSJamie Gritton 
3337f7496dcaSJamie Gritton /*
3338a9f7455cSJamie Gritton  * Release a prison's resources when it starts dying (when the last user
3339a9f7455cSJamie Gritton  * reference is dropped, or when it is killed).
3340a9f7455cSJamie Gritton  */
3341a9f7455cSJamie Gritton static void
3342a9f7455cSJamie Gritton prison_cleanup(struct prison *pr)
3343a9f7455cSJamie Gritton {
3344a9f7455cSJamie Gritton 	sx_assert(&allprison_lock, SA_XLOCKED);
3345a9f7455cSJamie Gritton 	mtx_assert(&pr->pr_mtx, MA_NOTOWNED);
33467060da62SJamie Gritton 	shm_remove_prison(pr);
3347a9f7455cSJamie Gritton 	(void)osd_jail_call(pr, PR_METHOD_REMOVE, NULL);
3348a9f7455cSJamie Gritton }
3349a9f7455cSJamie Gritton 
3350a9f7455cSJamie Gritton /*
33510fe74ae6SJamie Gritton  * Set or clear a permission bit in the pr_allow field, passing restrictions
33520fe74ae6SJamie Gritton  * (cleared permission) down to child jails.
33530fe74ae6SJamie Gritton  */
33540fe74ae6SJamie Gritton void
33550fe74ae6SJamie Gritton prison_set_allow(struct ucred *cred, unsigned flag, int enable)
33560fe74ae6SJamie Gritton {
33570fe74ae6SJamie Gritton 	struct prison *pr;
33580fe74ae6SJamie Gritton 
33590fe74ae6SJamie Gritton 	pr = cred->cr_prison;
33600fe74ae6SJamie Gritton 	sx_slock(&allprison_lock);
33610fe74ae6SJamie Gritton 	mtx_lock(&pr->pr_mtx);
33620fe74ae6SJamie Gritton 	prison_set_allow_locked(pr, flag, enable);
33630fe74ae6SJamie Gritton 	mtx_unlock(&pr->pr_mtx);
33640fe74ae6SJamie Gritton 	sx_sunlock(&allprison_lock);
33650fe74ae6SJamie Gritton }
33660fe74ae6SJamie Gritton 
33670fe74ae6SJamie Gritton static void
33680fe74ae6SJamie Gritton prison_set_allow_locked(struct prison *pr, unsigned flag, int enable)
33690fe74ae6SJamie Gritton {
33700fe74ae6SJamie Gritton 	struct prison *cpr;
33710fe74ae6SJamie Gritton 	int descend;
33720fe74ae6SJamie Gritton 
33730fe74ae6SJamie Gritton 	if (enable != 0)
33740fe74ae6SJamie Gritton 		pr->pr_allow |= flag;
33750fe74ae6SJamie Gritton 	else {
33760fe74ae6SJamie Gritton 		pr->pr_allow &= ~flag;
33770fe74ae6SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, cpr, descend)
33780fe74ae6SJamie Gritton 			cpr->pr_allow &= ~flag;
33790fe74ae6SJamie Gritton 	}
33800fe74ae6SJamie Gritton }
33810fe74ae6SJamie Gritton 
33820fe74ae6SJamie Gritton /*
3383ca04ba64SJamie Gritton  * Check if a jail supports the given address family.
3384ca04ba64SJamie Gritton  *
3385ca04ba64SJamie Gritton  * Returns 0 if not jailed or the address family is supported, EAFNOSUPPORT
3386ca04ba64SJamie Gritton  * if not.
3387ca04ba64SJamie Gritton  */
3388ca04ba64SJamie Gritton int
3389ca04ba64SJamie Gritton prison_check_af(struct ucred *cred, int af)
3390ca04ba64SJamie Gritton {
33910304c731SJamie Gritton 	struct prison *pr;
3392ca04ba64SJamie Gritton 	int error;
3393ca04ba64SJamie Gritton 
3394ca04ba64SJamie Gritton 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
3395ca04ba64SJamie Gritton 
33960304c731SJamie Gritton 	pr = cred->cr_prison;
3397499650a0SJamie Gritton #ifdef VIMAGE
33986bb79563SJamie Gritton 	/* Prisons with their own network stack are not limited. */
3399de0bd6f7SBjoern A. Zeeb 	if (prison_owns_vnet(cred))
34006bb79563SJamie Gritton 		return (0);
3401499650a0SJamie Gritton #endif
34026bb79563SJamie Gritton 
3403ca04ba64SJamie Gritton 	error = 0;
3404ca04ba64SJamie Gritton 	switch (af)
3405ca04ba64SJamie Gritton 	{
3406ca04ba64SJamie Gritton #ifdef INET
3407ca04ba64SJamie Gritton 	case AF_INET:
34080304c731SJamie Gritton 		if (pr->pr_flags & PR_IP4)
34090304c731SJamie Gritton 		{
34100304c731SJamie Gritton 			mtx_lock(&pr->pr_mtx);
3411eb8dcdeaSGleb Smirnoff 			if ((pr->pr_flags & PR_IP4) &&
3412eb8dcdeaSGleb Smirnoff 			    pr->pr_addrs[PR_INET] == NULL)
3413ca04ba64SJamie Gritton 				error = EAFNOSUPPORT;
34140304c731SJamie Gritton 			mtx_unlock(&pr->pr_mtx);
34150304c731SJamie Gritton 		}
3416ca04ba64SJamie Gritton 		break;
3417ca04ba64SJamie Gritton #endif
3418ca04ba64SJamie Gritton #ifdef INET6
3419ca04ba64SJamie Gritton 	case AF_INET6:
34200304c731SJamie Gritton 		if (pr->pr_flags & PR_IP6)
34210304c731SJamie Gritton 		{
34220304c731SJamie Gritton 			mtx_lock(&pr->pr_mtx);
3423eb8dcdeaSGleb Smirnoff 			if ((pr->pr_flags & PR_IP6) &&
3424eb8dcdeaSGleb Smirnoff 			    pr->pr_addrs[PR_INET6] == NULL)
3425ca04ba64SJamie Gritton 				error = EAFNOSUPPORT;
34260304c731SJamie Gritton 			mtx_unlock(&pr->pr_mtx);
34270304c731SJamie Gritton 		}
3428ca04ba64SJamie Gritton 		break;
3429ca04ba64SJamie Gritton #endif
3430ca04ba64SJamie Gritton 	case AF_LOCAL:
3431ca04ba64SJamie Gritton 	case AF_ROUTE:
3432ca04ba64SJamie Gritton 		break;
3433ca04ba64SJamie Gritton 	default:
34340304c731SJamie Gritton 		if (!(pr->pr_allow & PR_ALLOW_SOCKET_AF))
3435ca04ba64SJamie Gritton 			error = EAFNOSUPPORT;
3436ca04ba64SJamie Gritton 	}
3437ca04ba64SJamie Gritton 	return (error);
3438ca04ba64SJamie Gritton }
3439ca04ba64SJamie Gritton 
3440ca04ba64SJamie Gritton /*
3441413628a7SBjoern A. Zeeb  * Check if given address belongs to the jail referenced by cred (wrapper to
3442413628a7SBjoern A. Zeeb  * prison_check_ip[46]).
3443413628a7SBjoern A. Zeeb  *
34440304c731SJamie Gritton  * Returns 0 if jail doesn't restrict the address family or if address belongs
34450304c731SJamie Gritton  * to jail, EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if
34460304c731SJamie Gritton  * the jail doesn't allow the address family.  IPv4 Address passed in in NBO.
3447413628a7SBjoern A. Zeeb  */
3448413628a7SBjoern A. Zeeb int
3449c83dda36SAlexander V. Chernikov prison_if(struct ucred *cred, const struct sockaddr *sa)
345075c13541SPoul-Henning Kamp {
3451413628a7SBjoern A. Zeeb #ifdef INET
3452c83dda36SAlexander V. Chernikov 	const struct sockaddr_in *sai;
3453413628a7SBjoern A. Zeeb #endif
3454413628a7SBjoern A. Zeeb #ifdef INET6
3455c83dda36SAlexander V. Chernikov 	const struct sockaddr_in6 *sai6;
3456413628a7SBjoern A. Zeeb #endif
3457b89e82ddSJamie Gritton 	int error;
345875c13541SPoul-Henning Kamp 
3459413628a7SBjoern A. Zeeb 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
3460413628a7SBjoern A. Zeeb 	KASSERT(sa != NULL, ("%s: sa is NULL", __func__));
3461413628a7SBjoern A. Zeeb 
3462de0bd6f7SBjoern A. Zeeb #ifdef VIMAGE
3463de0bd6f7SBjoern A. Zeeb 	if (prison_owns_vnet(cred))
3464de0bd6f7SBjoern A. Zeeb 		return (0);
3465de0bd6f7SBjoern A. Zeeb #endif
3466de0bd6f7SBjoern A. Zeeb 
3467b89e82ddSJamie Gritton 	error = 0;
3468413628a7SBjoern A. Zeeb 	switch (sa->sa_family)
3469413628a7SBjoern A. Zeeb 	{
3470413628a7SBjoern A. Zeeb #ifdef INET
3471413628a7SBjoern A. Zeeb 	case AF_INET:
3472c83dda36SAlexander V. Chernikov 		sai = (const struct sockaddr_in *)sa;
3473b89e82ddSJamie Gritton 		error = prison_check_ip4(cred, &sai->sin_addr);
3474413628a7SBjoern A. Zeeb 		break;
3475413628a7SBjoern A. Zeeb #endif
3476413628a7SBjoern A. Zeeb #ifdef INET6
3477413628a7SBjoern A. Zeeb 	case AF_INET6:
3478c83dda36SAlexander V. Chernikov 		sai6 = (const struct sockaddr_in6 *)sa;
3479b89e82ddSJamie Gritton 		error = prison_check_ip6(cred, &sai6->sin6_addr);
3480413628a7SBjoern A. Zeeb 		break;
3481413628a7SBjoern A. Zeeb #endif
3482413628a7SBjoern A. Zeeb 	default:
34830304c731SJamie Gritton 		if (!(cred->cr_prison->pr_allow & PR_ALLOW_SOCKET_AF))
3484b89e82ddSJamie Gritton 			error = EAFNOSUPPORT;
3485413628a7SBjoern A. Zeeb 	}
3486b89e82ddSJamie Gritton 	return (error);
348775c13541SPoul-Henning Kamp }
348891421ba2SRobert Watson 
348991421ba2SRobert Watson /*
349091421ba2SRobert Watson  * Return 0 if jails permit p1 to frob p2, otherwise ESRCH.
349191421ba2SRobert Watson  */
349291421ba2SRobert Watson int
34939ddb7954SMike Barcroft prison_check(struct ucred *cred1, struct ucred *cred2)
349491421ba2SRobert Watson {
349591421ba2SRobert Watson 
34960304c731SJamie Gritton 	return ((cred1->cr_prison == cred2->cr_prison ||
34970304c731SJamie Gritton 	    prison_ischild(cred1->cr_prison, cred2->cr_prison)) ? 0 : ESRCH);
34980304c731SJamie Gritton }
349991421ba2SRobert Watson 
35000304c731SJamie Gritton /*
3501bba7a2e8SRick Macklem  * For mountd/nfsd to run within a prison, it must be:
3502bba7a2e8SRick Macklem  * - A vnet prison.
3503bba7a2e8SRick Macklem  * - PR_ALLOW_NFSD must be set on it.
3504bba7a2e8SRick Macklem  * - The root directory (pr_root) of the prison must be
3505bba7a2e8SRick Macklem  *   a file system mount point, so the mountd can hang
3506bba7a2e8SRick Macklem  *   export information on it.
3507bba7a2e8SRick Macklem  */
3508bba7a2e8SRick Macklem bool
3509bba7a2e8SRick Macklem prison_check_nfsd(struct ucred *cred)
3510bba7a2e8SRick Macklem {
3511bba7a2e8SRick Macklem 
3512bba7a2e8SRick Macklem 	if (jailed_without_vnet(cred))
3513bba7a2e8SRick Macklem 		return (false);
3514bba7a2e8SRick Macklem 	if (!prison_allow(cred, PR_ALLOW_NFSD))
3515bba7a2e8SRick Macklem 		return (false);
3516bba7a2e8SRick Macklem 	if ((cred->cr_prison->pr_root->v_vflag & VV_ROOT) == 0)
3517bba7a2e8SRick Macklem 		return (false);
3518bba7a2e8SRick Macklem 	return (true);
3519bba7a2e8SRick Macklem }
3520bba7a2e8SRick Macklem 
3521bba7a2e8SRick Macklem /*
35220304c731SJamie Gritton  * Return 1 if p2 is a child of p1, otherwise 0.
35230304c731SJamie Gritton  */
35240304c731SJamie Gritton int
35250304c731SJamie Gritton prison_ischild(struct prison *pr1, struct prison *pr2)
35260304c731SJamie Gritton {
35270304c731SJamie Gritton 
35280304c731SJamie Gritton 	for (pr2 = pr2->pr_parent; pr2 != NULL; pr2 = pr2->pr_parent)
35290304c731SJamie Gritton 		if (pr1 == pr2)
35300304c731SJamie Gritton 			return (1);
353191421ba2SRobert Watson 	return (0);
353291421ba2SRobert Watson }
353391421ba2SRobert Watson 
353491421ba2SRobert Watson /*
3535f7496dcaSJamie Gritton  * Return true if the prison is currently alive.  A prison is alive if it
3536f7496dcaSJamie Gritton  * holds user references and it isn't being removed.
353776ad42abSJamie Gritton  */
353876ad42abSJamie Gritton bool
3539eb8dcdeaSGleb Smirnoff prison_isalive(const struct prison *pr)
354076ad42abSJamie Gritton {
354176ad42abSJamie Gritton 
35421158508aSJamie Gritton 	if (__predict_false(pr->pr_state != PRISON_STATE_ALIVE))
3543cc7b7306SJamie Gritton 		return (false);
354476ad42abSJamie Gritton 	return (true);
354576ad42abSJamie Gritton }
354676ad42abSJamie Gritton 
354776ad42abSJamie Gritton /*
354876ad42abSJamie Gritton  * Return true if the prison is currently valid.  A prison is valid if it has
354976ad42abSJamie Gritton  * been fully created, and is not being destroyed.  Note that dying prisons
3550f7496dcaSJamie Gritton  * are still considered valid.  Invalid prisons won't be found under normal
3551f7496dcaSJamie Gritton  * circumstances, as they're only put in that state by functions that have
3552f7496dcaSJamie Gritton  * an exclusive hold on allprison_lock.
355376ad42abSJamie Gritton  */
355476ad42abSJamie Gritton bool
355576ad42abSJamie Gritton prison_isvalid(struct prison *pr)
355676ad42abSJamie Gritton {
355776ad42abSJamie Gritton 
35581158508aSJamie Gritton 	if (__predict_false(pr->pr_state == PRISON_STATE_INVALID))
35591158508aSJamie Gritton 		return (false);
35606754ae25SJamie Gritton 	if (__predict_false(refcount_load(&pr->pr_ref) == 0))
356176ad42abSJamie Gritton 		return (false);
356276ad42abSJamie Gritton 	return (true);
356376ad42abSJamie Gritton }
356476ad42abSJamie Gritton 
356576ad42abSJamie Gritton /*
3566de0bd6f7SBjoern A. Zeeb  * Return 1 if the passed credential is in a jail and that jail does not
3567de0bd6f7SBjoern A. Zeeb  * have its own virtual network stack, otherwise 0.
3568de0bd6f7SBjoern A. Zeeb  */
3569de0bd6f7SBjoern A. Zeeb int
3570de0bd6f7SBjoern A. Zeeb jailed_without_vnet(struct ucred *cred)
3571de0bd6f7SBjoern A. Zeeb {
3572de0bd6f7SBjoern A. Zeeb 
3573de0bd6f7SBjoern A. Zeeb 	if (!jailed(cred))
3574de0bd6f7SBjoern A. Zeeb 		return (0);
3575de0bd6f7SBjoern A. Zeeb #ifdef VIMAGE
3576de0bd6f7SBjoern A. Zeeb 	if (prison_owns_vnet(cred))
3577de0bd6f7SBjoern A. Zeeb 		return (0);
3578de0bd6f7SBjoern A. Zeeb #endif
3579de0bd6f7SBjoern A. Zeeb 
3580de0bd6f7SBjoern A. Zeeb 	return (1);
3581de0bd6f7SBjoern A. Zeeb }
3582de0bd6f7SBjoern A. Zeeb 
3583de0bd6f7SBjoern A. Zeeb /*
35847455b100SJamie Gritton  * Return the correct hostname (domainname, et al) for the passed credential.
35859484d0c0SRobert Drehmel  */
3586ad1ff099SRobert Drehmel void
35879ddb7954SMike Barcroft getcredhostname(struct ucred *cred, char *buf, size_t size)
35889484d0c0SRobert Drehmel {
358976ca6f88SJamie Gritton 	struct prison *pr;
35909484d0c0SRobert Drehmel 
35917455b100SJamie Gritton 	/*
35927455b100SJamie Gritton 	 * A NULL credential can be used to shortcut to the physical
35937455b100SJamie Gritton 	 * system's hostname.
35947455b100SJamie Gritton 	 */
359576ca6f88SJamie Gritton 	pr = (cred != NULL) ? cred->cr_prison : &prison0;
359676ca6f88SJamie Gritton 	mtx_lock(&pr->pr_mtx);
3597c1f19219SJamie Gritton 	strlcpy(buf, pr->pr_hostname, size);
359876ca6f88SJamie Gritton 	mtx_unlock(&pr->pr_mtx);
35999484d0c0SRobert Drehmel }
3600fd7a8150SMike Barcroft 
36017455b100SJamie Gritton void
36027455b100SJamie Gritton getcreddomainname(struct ucred *cred, char *buf, size_t size)
36037455b100SJamie Gritton {
36047455b100SJamie Gritton 
36057455b100SJamie Gritton 	mtx_lock(&cred->cr_prison->pr_mtx);
3606c1f19219SJamie Gritton 	strlcpy(buf, cred->cr_prison->pr_domainname, size);
36077455b100SJamie Gritton 	mtx_unlock(&cred->cr_prison->pr_mtx);
36087455b100SJamie Gritton }
36097455b100SJamie Gritton 
36107455b100SJamie Gritton void
36117455b100SJamie Gritton getcredhostuuid(struct ucred *cred, char *buf, size_t size)
36127455b100SJamie Gritton {
36137455b100SJamie Gritton 
36147455b100SJamie Gritton 	mtx_lock(&cred->cr_prison->pr_mtx);
3615c1f19219SJamie Gritton 	strlcpy(buf, cred->cr_prison->pr_hostuuid, size);
36167455b100SJamie Gritton 	mtx_unlock(&cred->cr_prison->pr_mtx);
36177455b100SJamie Gritton }
36187455b100SJamie Gritton 
36197455b100SJamie Gritton void
36207455b100SJamie Gritton getcredhostid(struct ucred *cred, unsigned long *hostid)
36217455b100SJamie Gritton {
36227455b100SJamie Gritton 
36237455b100SJamie Gritton 	mtx_lock(&cred->cr_prison->pr_mtx);
36247455b100SJamie Gritton 	*hostid = cred->cr_prison->pr_hostid;
36257455b100SJamie Gritton 	mtx_unlock(&cred->cr_prison->pr_mtx);
36267455b100SJamie Gritton }
36277455b100SJamie Gritton 
36283f8bc99cSKristof Provost void
36293f8bc99cSKristof Provost getjailname(struct ucred *cred, char *name, size_t len)
36303f8bc99cSKristof Provost {
36313f8bc99cSKristof Provost 
36323f8bc99cSKristof Provost 	mtx_lock(&cred->cr_prison->pr_mtx);
36333f8bc99cSKristof Provost 	strlcpy(name, cred->cr_prison->pr_name, len);
36343f8bc99cSKristof Provost 	mtx_unlock(&cred->cr_prison->pr_mtx);
36353f8bc99cSKristof Provost }
36363f8bc99cSKristof Provost 
3637eb79e1c7SBjoern A. Zeeb #ifdef VIMAGE
3638eb79e1c7SBjoern A. Zeeb /*
3639eb79e1c7SBjoern A. Zeeb  * Determine whether the prison represented by cred owns
3640eb79e1c7SBjoern A. Zeeb  * its vnet rather than having it inherited.
3641eb79e1c7SBjoern A. Zeeb  *
3642eb79e1c7SBjoern A. Zeeb  * Returns 1 in case the prison owns the vnet, 0 otherwise.
3643eb79e1c7SBjoern A. Zeeb  */
3644eb79e1c7SBjoern A. Zeeb int
3645eb79e1c7SBjoern A. Zeeb prison_owns_vnet(struct ucred *cred)
3646eb79e1c7SBjoern A. Zeeb {
3647eb79e1c7SBjoern A. Zeeb 
3648eb79e1c7SBjoern A. Zeeb 	/*
3649eb79e1c7SBjoern A. Zeeb 	 * vnets cannot be added/removed after jail creation,
3650eb79e1c7SBjoern A. Zeeb 	 * so no need to lock here.
3651eb79e1c7SBjoern A. Zeeb 	 */
3652eb79e1c7SBjoern A. Zeeb 	return (cred->cr_prison->pr_flags & PR_VNET ? 1 : 0);
3653eb79e1c7SBjoern A. Zeeb }
3654eb79e1c7SBjoern A. Zeeb #endif
3655eb79e1c7SBjoern A. Zeeb 
3656f08df373SRobert Watson /*
3657820a0de9SPawel Jakub Dawidek  * Determine whether the subject represented by cred can "see"
3658820a0de9SPawel Jakub Dawidek  * status of a mount point.
3659820a0de9SPawel Jakub Dawidek  * Returns: 0 for permitted, ENOENT otherwise.
3660820a0de9SPawel Jakub Dawidek  * XXX: This function should be called cr_canseemount() and should be
3661820a0de9SPawel Jakub Dawidek  *      placed in kern_prot.c.
3662f08df373SRobert Watson  */
3663f08df373SRobert Watson int
3664820a0de9SPawel Jakub Dawidek prison_canseemount(struct ucred *cred, struct mount *mp)
3665f08df373SRobert Watson {
3666820a0de9SPawel Jakub Dawidek 	struct prison *pr;
3667820a0de9SPawel Jakub Dawidek 	struct statfs *sp;
3668820a0de9SPawel Jakub Dawidek 	size_t len;
3669f08df373SRobert Watson 
3670820a0de9SPawel Jakub Dawidek 	pr = cred->cr_prison;
36710304c731SJamie Gritton 	if (pr->pr_enforce_statfs == 0)
36720304c731SJamie Gritton 		return (0);
3673820a0de9SPawel Jakub Dawidek 	if (pr->pr_root->v_mount == mp)
3674820a0de9SPawel Jakub Dawidek 		return (0);
36750304c731SJamie Gritton 	if (pr->pr_enforce_statfs == 2)
3676820a0de9SPawel Jakub Dawidek 		return (ENOENT);
3677820a0de9SPawel Jakub Dawidek 	/*
3678820a0de9SPawel Jakub Dawidek 	 * If jail's chroot directory is set to "/" we should be able to see
3679820a0de9SPawel Jakub Dawidek 	 * all mount-points from inside a jail.
3680820a0de9SPawel Jakub Dawidek 	 * This is ugly check, but this is the only situation when jail's
3681820a0de9SPawel Jakub Dawidek 	 * directory ends with '/'.
3682820a0de9SPawel Jakub Dawidek 	 */
3683820a0de9SPawel Jakub Dawidek 	if (strcmp(pr->pr_path, "/") == 0)
3684820a0de9SPawel Jakub Dawidek 		return (0);
3685820a0de9SPawel Jakub Dawidek 	len = strlen(pr->pr_path);
3686820a0de9SPawel Jakub Dawidek 	sp = &mp->mnt_stat;
3687820a0de9SPawel Jakub Dawidek 	if (strncmp(pr->pr_path, sp->f_mntonname, len) != 0)
3688820a0de9SPawel Jakub Dawidek 		return (ENOENT);
3689820a0de9SPawel Jakub Dawidek 	/*
3690820a0de9SPawel Jakub Dawidek 	 * Be sure that we don't have situation where jail's root directory
3691820a0de9SPawel Jakub Dawidek 	 * is "/some/path" and mount point is "/some/pathpath".
3692820a0de9SPawel Jakub Dawidek 	 */
3693820a0de9SPawel Jakub Dawidek 	if (sp->f_mntonname[len] != '\0' && sp->f_mntonname[len] != '/')
3694820a0de9SPawel Jakub Dawidek 		return (ENOENT);
3695f08df373SRobert Watson 	return (0);
3696f08df373SRobert Watson }
3697820a0de9SPawel Jakub Dawidek 
3698820a0de9SPawel Jakub Dawidek void
3699820a0de9SPawel Jakub Dawidek prison_enforce_statfs(struct ucred *cred, struct mount *mp, struct statfs *sp)
3700820a0de9SPawel Jakub Dawidek {
3701820a0de9SPawel Jakub Dawidek 	char jpath[MAXPATHLEN];
3702820a0de9SPawel Jakub Dawidek 	struct prison *pr;
3703820a0de9SPawel Jakub Dawidek 	size_t len;
3704820a0de9SPawel Jakub Dawidek 
3705820a0de9SPawel Jakub Dawidek 	pr = cred->cr_prison;
37060304c731SJamie Gritton 	if (pr->pr_enforce_statfs == 0)
37070304c731SJamie Gritton 		return;
3708820a0de9SPawel Jakub Dawidek 	if (prison_canseemount(cred, mp) != 0) {
3709820a0de9SPawel Jakub Dawidek 		bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
3710820a0de9SPawel Jakub Dawidek 		strlcpy(sp->f_mntonname, "[restricted]",
3711820a0de9SPawel Jakub Dawidek 		    sizeof(sp->f_mntonname));
3712820a0de9SPawel Jakub Dawidek 		return;
3713820a0de9SPawel Jakub Dawidek 	}
3714820a0de9SPawel Jakub Dawidek 	if (pr->pr_root->v_mount == mp) {
3715820a0de9SPawel Jakub Dawidek 		/*
3716820a0de9SPawel Jakub Dawidek 		 * Clear current buffer data, so we are sure nothing from
3717820a0de9SPawel Jakub Dawidek 		 * the valid path left there.
3718820a0de9SPawel Jakub Dawidek 		 */
3719820a0de9SPawel Jakub Dawidek 		bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
3720820a0de9SPawel Jakub Dawidek 		*sp->f_mntonname = '/';
3721820a0de9SPawel Jakub Dawidek 		return;
3722820a0de9SPawel Jakub Dawidek 	}
3723820a0de9SPawel Jakub Dawidek 	/*
3724820a0de9SPawel Jakub Dawidek 	 * If jail's chroot directory is set to "/" we should be able to see
3725820a0de9SPawel Jakub Dawidek 	 * all mount-points from inside a jail.
3726820a0de9SPawel Jakub Dawidek 	 */
3727820a0de9SPawel Jakub Dawidek 	if (strcmp(pr->pr_path, "/") == 0)
3728820a0de9SPawel Jakub Dawidek 		return;
3729820a0de9SPawel Jakub Dawidek 	len = strlen(pr->pr_path);
3730820a0de9SPawel Jakub Dawidek 	strlcpy(jpath, sp->f_mntonname + len, sizeof(jpath));
3731820a0de9SPawel Jakub Dawidek 	/*
3732820a0de9SPawel Jakub Dawidek 	 * Clear current buffer data, so we are sure nothing from
3733820a0de9SPawel Jakub Dawidek 	 * the valid path left there.
3734820a0de9SPawel Jakub Dawidek 	 */
3735820a0de9SPawel Jakub Dawidek 	bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
3736820a0de9SPawel Jakub Dawidek 	if (*jpath == '\0') {
3737820a0de9SPawel Jakub Dawidek 		/* Should never happen. */
3738820a0de9SPawel Jakub Dawidek 		*sp->f_mntonname = '/';
3739820a0de9SPawel Jakub Dawidek 	} else {
3740820a0de9SPawel Jakub Dawidek 		strlcpy(sp->f_mntonname, jpath, sizeof(sp->f_mntonname));
3741820a0de9SPawel Jakub Dawidek 	}
3742f08df373SRobert Watson }
3743f08df373SRobert Watson 
3744800c9408SRobert Watson /*
3745800c9408SRobert Watson  * Check with permission for a specific privilege is granted within jail.  We
3746800c9408SRobert Watson  * have a specific list of accepted privileges; the rest are denied.
3747800c9408SRobert Watson  */
3748800c9408SRobert Watson int
3749800c9408SRobert Watson prison_priv_check(struct ucred *cred, int priv)
3750800c9408SRobert Watson {
37510fe74ae6SJamie Gritton 	struct prison *pr;
37520fe74ae6SJamie Gritton 	int error;
3753800c9408SRobert Watson 
37547b2ff0dcSMateusz Guzik 	/*
37557b2ff0dcSMateusz Guzik 	 * Some policies have custom handlers. This routine should not be
37567b2ff0dcSMateusz Guzik 	 * called for them. See priv_check_cred().
37577b2ff0dcSMateusz Guzik 	 */
37587b2ff0dcSMateusz Guzik 	switch (priv) {
3759a459a6cfSMateusz Guzik 	case PRIV_VFS_LOOKUP:
37607b2ff0dcSMateusz Guzik 	case PRIV_VFS_GENERATION:
37617b2ff0dcSMateusz Guzik 		KASSERT(0, ("prison_priv_check instead of a custom handler "
37627b2ff0dcSMateusz Guzik 		    "called for %d\n", priv));
37637b2ff0dcSMateusz Guzik 	}
37647b2ff0dcSMateusz Guzik 
3765800c9408SRobert Watson 	if (!jailed(cred))
3766800c9408SRobert Watson 		return (0);
3767800c9408SRobert Watson 
37686bb79563SJamie Gritton #ifdef VIMAGE
37696bb79563SJamie Gritton 	/*
37706bb79563SJamie Gritton 	 * Privileges specific to prisons with a virtual network stack.
37716bb79563SJamie Gritton 	 * There might be a duplicate entry here in case the privilege
37726bb79563SJamie Gritton 	 * is only granted conditionally in the legacy jail case.
37736bb79563SJamie Gritton 	 */
37746bb79563SJamie Gritton 	switch (priv) {
37756bb79563SJamie Gritton 		/*
37766bb79563SJamie Gritton 		 * NFS-specific privileges.
37776bb79563SJamie Gritton 		 */
37786bb79563SJamie Gritton 	case PRIV_NFS_DAEMON:
3779bba7a2e8SRick Macklem 	case PRIV_VFS_GETFH:
3780bba7a2e8SRick Macklem 	case PRIV_VFS_MOUNT_EXPORTED:
3781bba7a2e8SRick Macklem #ifdef VNET_NFSD
3782bba7a2e8SRick Macklem 		if (!prison_check_nfsd(cred))
3783bba7a2e8SRick Macklem #else
3784bba7a2e8SRick Macklem 		printf("running nfsd in a prison requires a kernel "
3785bba7a2e8SRick Macklem 		    "built with ''options VNET_NFSD''\n");
3786bba7a2e8SRick Macklem #endif
3787bba7a2e8SRick Macklem 			return (EPERM);
3788bba7a2e8SRick Macklem #ifdef notyet
37896bb79563SJamie Gritton 	case PRIV_NFS_LOCKD:
37906bb79563SJamie Gritton #endif
37916bb79563SJamie Gritton 		/*
37926bb79563SJamie Gritton 		 * Network stack privileges.
37936bb79563SJamie Gritton 		 */
37946bb79563SJamie Gritton 	case PRIV_NET_BRIDGE:
37956bb79563SJamie Gritton 	case PRIV_NET_GRE:
37966bb79563SJamie Gritton 	case PRIV_NET_BPF:
37976bb79563SJamie Gritton 	case PRIV_NET_RAW:		/* Dup, cond. in legacy jail case. */
37986bb79563SJamie Gritton 	case PRIV_NET_ROUTE:
37996bb79563SJamie Gritton 	case PRIV_NET_TAP:
38006bb79563SJamie Gritton 	case PRIV_NET_SETIFMTU:
38016bb79563SJamie Gritton 	case PRIV_NET_SETIFFLAGS:
38026bb79563SJamie Gritton 	case PRIV_NET_SETIFCAP:
3803215940b3SXin LI 	case PRIV_NET_SETIFDESCR:
38046bb79563SJamie Gritton 	case PRIV_NET_SETIFNAME	:
38056bb79563SJamie Gritton 	case PRIV_NET_SETIFMETRIC:
38066bb79563SJamie Gritton 	case PRIV_NET_SETIFPHYS:
38076bb79563SJamie Gritton 	case PRIV_NET_SETIFMAC:
3808389474c1SKonstantin Belousov 	case PRIV_NET_SETLANPCP:
38096bb79563SJamie Gritton 	case PRIV_NET_ADDMULTI:
38106bb79563SJamie Gritton 	case PRIV_NET_DELMULTI:
38116bb79563SJamie Gritton 	case PRIV_NET_HWIOCTL:
38126bb79563SJamie Gritton 	case PRIV_NET_SETLLADDR:
38136bb79563SJamie Gritton 	case PRIV_NET_ADDIFGROUP:
38146bb79563SJamie Gritton 	case PRIV_NET_DELIFGROUP:
38156bb79563SJamie Gritton 	case PRIV_NET_IFCREATE:
38166bb79563SJamie Gritton 	case PRIV_NET_IFDESTROY:
38176bb79563SJamie Gritton 	case PRIV_NET_ADDIFADDR:
38186bb79563SJamie Gritton 	case PRIV_NET_DELIFADDR:
38196bb79563SJamie Gritton 	case PRIV_NET_LAGG:
38206bb79563SJamie Gritton 	case PRIV_NET_GIF:
38216bb79563SJamie Gritton 	case PRIV_NET_SETIFVNET:
382235fd7bc0SBjoern A. Zeeb 	case PRIV_NET_SETIFFIB:
3823ab91feabSKristof Provost 	case PRIV_NET_OVPN:
382443f8c763SZhenlei Huang 	case PRIV_NET_ME:
3825744bfb21SJohn Baldwin 	case PRIV_NET_WG:
38266bb79563SJamie Gritton 
38276bb79563SJamie Gritton 		/*
38286bb79563SJamie Gritton 		 * 802.11-related privileges.
38296bb79563SJamie Gritton 		 */
3830f7d38a13SAdrian Chadd 	case PRIV_NET80211_VAP_GETKEY:
3831f7d38a13SAdrian Chadd 	case PRIV_NET80211_VAP_MANAGE:
38326bb79563SJamie Gritton 
38336bb79563SJamie Gritton #ifdef notyet
38346bb79563SJamie Gritton 		/*
38356bb79563SJamie Gritton 		 * ATM privileges.
38366bb79563SJamie Gritton 		 */
38376bb79563SJamie Gritton 	case PRIV_NETATM_CFG:
38386bb79563SJamie Gritton 	case PRIV_NETATM_ADD:
38396bb79563SJamie Gritton 	case PRIV_NETATM_DEL:
38406bb79563SJamie Gritton 	case PRIV_NETATM_SET:
38416bb79563SJamie Gritton 
38426bb79563SJamie Gritton 		/*
38436bb79563SJamie Gritton 		 * Bluetooth privileges.
38446bb79563SJamie Gritton 		 */
38456bb79563SJamie Gritton 	case PRIV_NETBLUETOOTH_RAW:
38466bb79563SJamie Gritton #endif
38476bb79563SJamie Gritton 
38486bb79563SJamie Gritton 		/*
38496bb79563SJamie Gritton 		 * Netgraph and netgraph module privileges.
38506bb79563SJamie Gritton 		 */
38516bb79563SJamie Gritton 	case PRIV_NETGRAPH_CONTROL:
38526bb79563SJamie Gritton #ifdef notyet
38536bb79563SJamie Gritton 	case PRIV_NETGRAPH_TTY:
38546bb79563SJamie Gritton #endif
38556bb79563SJamie Gritton 
38566bb79563SJamie Gritton 		/*
38576bb79563SJamie Gritton 		 * IPv4 and IPv6 privileges.
38586bb79563SJamie Gritton 		 */
38596bb79563SJamie Gritton 	case PRIV_NETINET_IPFW:
38606bb79563SJamie Gritton 	case PRIV_NETINET_DIVERT:
38616bb79563SJamie Gritton 	case PRIV_NETINET_PF:
38626bb79563SJamie Gritton 	case PRIV_NETINET_DUMMYNET:
38636bb79563SJamie Gritton 	case PRIV_NETINET_CARP:
38646bb79563SJamie Gritton 	case PRIV_NETINET_MROUTE:
38656bb79563SJamie Gritton 	case PRIV_NETINET_RAW:
38666bb79563SJamie Gritton 	case PRIV_NETINET_ADDRCTRL6:
38676bb79563SJamie Gritton 	case PRIV_NETINET_ND6:
38686bb79563SJamie Gritton 	case PRIV_NETINET_SCOPE6:
38696bb79563SJamie Gritton 	case PRIV_NETINET_ALIFETIME6:
38706bb79563SJamie Gritton 	case PRIV_NETINET_IPSEC:
38716bb79563SJamie Gritton 	case PRIV_NETINET_BINDANY:
38726bb79563SJamie Gritton 
38736bb79563SJamie Gritton #ifdef notyet
38746bb79563SJamie Gritton 		/*
38756bb79563SJamie Gritton 		 * NCP privileges.
38766bb79563SJamie Gritton 		 */
38776bb79563SJamie Gritton 	case PRIV_NETNCP:
38786bb79563SJamie Gritton 
38796bb79563SJamie Gritton 		/*
38806bb79563SJamie Gritton 		 * SMB privileges.
38816bb79563SJamie Gritton 		 */
38826bb79563SJamie Gritton 	case PRIV_NETSMB:
38836bb79563SJamie Gritton #endif
38846bb79563SJamie Gritton 
38856bb79563SJamie Gritton 	/*
38866bb79563SJamie Gritton 	 * No default: or deny here.
38876bb79563SJamie Gritton 	 * In case of no permit fall through to next switch().
38886bb79563SJamie Gritton 	 */
38896bb79563SJamie Gritton 		if (cred->cr_prison->pr_flags & PR_VNET)
38906bb79563SJamie Gritton 			return (0);
38916bb79563SJamie Gritton 	}
38926bb79563SJamie Gritton #endif /* VIMAGE */
38936bb79563SJamie Gritton 
3894800c9408SRobert Watson 	switch (priv) {
3895800c9408SRobert Watson 		/*
3896800c9408SRobert Watson 		 * Allow ktrace privileges for root in jail.
3897800c9408SRobert Watson 		 */
3898800c9408SRobert Watson 	case PRIV_KTRACE:
3899800c9408SRobert Watson 
3900c3c1b5e6SRobert Watson #if 0
3901800c9408SRobert Watson 		/*
3902800c9408SRobert Watson 		 * Allow jailed processes to configure audit identity and
3903800c9408SRobert Watson 		 * submit audit records (login, etc).  In the future we may
3904800c9408SRobert Watson 		 * want to further refine the relationship between audit and
3905800c9408SRobert Watson 		 * jail.
3906800c9408SRobert Watson 		 */
3907800c9408SRobert Watson 	case PRIV_AUDIT_GETAUDIT:
3908800c9408SRobert Watson 	case PRIV_AUDIT_SETAUDIT:
3909800c9408SRobert Watson 	case PRIV_AUDIT_SUBMIT:
3910c3c1b5e6SRobert Watson #endif
3911800c9408SRobert Watson 
3912800c9408SRobert Watson 		/*
3913800c9408SRobert Watson 		 * Allow jailed processes to manipulate process UNIX
3914800c9408SRobert Watson 		 * credentials in any way they see fit.
3915800c9408SRobert Watson 		 */
3916800c9408SRobert Watson 	case PRIV_CRED_SETUID:
3917800c9408SRobert Watson 	case PRIV_CRED_SETEUID:
3918800c9408SRobert Watson 	case PRIV_CRED_SETGID:
3919800c9408SRobert Watson 	case PRIV_CRED_SETEGID:
3920800c9408SRobert Watson 	case PRIV_CRED_SETGROUPS:
3921800c9408SRobert Watson 	case PRIV_CRED_SETREUID:
3922800c9408SRobert Watson 	case PRIV_CRED_SETREGID:
3923800c9408SRobert Watson 	case PRIV_CRED_SETRESUID:
3924800c9408SRobert Watson 	case PRIV_CRED_SETRESGID:
3925800c9408SRobert Watson 
3926800c9408SRobert Watson 		/*
3927800c9408SRobert Watson 		 * Jail implements visibility constraints already, so allow
3928800c9408SRobert Watson 		 * jailed root to override uid/gid-based constraints.
3929800c9408SRobert Watson 		 */
3930800c9408SRobert Watson 	case PRIV_SEEOTHERGIDS:
3931800c9408SRobert Watson 	case PRIV_SEEOTHERUIDS:
3932800c9408SRobert Watson 
3933800c9408SRobert Watson 		/*
3934800c9408SRobert Watson 		 * Jail implements inter-process debugging limits already, so
3935800c9408SRobert Watson 		 * allow jailed root various debugging privileges.
3936800c9408SRobert Watson 		 */
3937800c9408SRobert Watson 	case PRIV_DEBUG_DIFFCRED:
3938800c9408SRobert Watson 	case PRIV_DEBUG_SUGID:
3939800c9408SRobert Watson 	case PRIV_DEBUG_UNPRIV:
3940800c9408SRobert Watson 
3941800c9408SRobert Watson 		/*
3942800c9408SRobert Watson 		 * Allow jail to set various resource limits and login
3943800c9408SRobert Watson 		 * properties, and for now, exceed process resource limits.
3944800c9408SRobert Watson 		 */
3945800c9408SRobert Watson 	case PRIV_PROC_LIMIT:
3946800c9408SRobert Watson 	case PRIV_PROC_SETLOGIN:
3947800c9408SRobert Watson 	case PRIV_PROC_SETRLIMIT:
3948800c9408SRobert Watson 
3949800c9408SRobert Watson 		/*
3950800c9408SRobert Watson 		 * System V and POSIX IPC privileges are granted in jail.
3951800c9408SRobert Watson 		 */
3952800c9408SRobert Watson 	case PRIV_IPC_READ:
3953800c9408SRobert Watson 	case PRIV_IPC_WRITE:
3954800c9408SRobert Watson 	case PRIV_IPC_ADMIN:
3955800c9408SRobert Watson 	case PRIV_IPC_MSGSIZE:
3956800c9408SRobert Watson 	case PRIV_MQ_ADMIN:
3957800c9408SRobert Watson 
3958800c9408SRobert Watson 		/*
39590304c731SJamie Gritton 		 * Jail operations within a jail work on child jails.
39600304c731SJamie Gritton 		 */
39610304c731SJamie Gritton 	case PRIV_JAIL_ATTACH:
39620304c731SJamie Gritton 	case PRIV_JAIL_SET:
39630304c731SJamie Gritton 	case PRIV_JAIL_REMOVE:
39640304c731SJamie Gritton 
39650304c731SJamie Gritton 		/*
3966800c9408SRobert Watson 		 * Jail implements its own inter-process limits, so allow
3967800c9408SRobert Watson 		 * root processes in jail to change scheduling on other
3968800c9408SRobert Watson 		 * processes in the same jail.  Likewise for signalling.
3969800c9408SRobert Watson 		 */
3970800c9408SRobert Watson 	case PRIV_SCHED_DIFFCRED:
3971413628a7SBjoern A. Zeeb 	case PRIV_SCHED_CPUSET:
3972800c9408SRobert Watson 	case PRIV_SIGNAL_DIFFCRED:
3973800c9408SRobert Watson 	case PRIV_SIGNAL_SUGID:
3974800c9408SRobert Watson 
3975800c9408SRobert Watson 		/*
3976800c9408SRobert Watson 		 * Allow jailed processes to write to sysctls marked as jail
3977800c9408SRobert Watson 		 * writable.
3978800c9408SRobert Watson 		 */
3979800c9408SRobert Watson 	case PRIV_SYSCTL_WRITEJAIL:
3980800c9408SRobert Watson 
3981800c9408SRobert Watson 		/*
3982800c9408SRobert Watson 		 * Allow root in jail to manage a variety of quota
3983e82d0201SRobert Watson 		 * properties.  These should likely be conditional on a
3984e82d0201SRobert Watson 		 * configuration option.
3985800c9408SRobert Watson 		 */
398695b091d2SRobert Watson 	case PRIV_VFS_GETQUOTA:
398795b091d2SRobert Watson 	case PRIV_VFS_SETQUOTA:
3988800c9408SRobert Watson 
3989800c9408SRobert Watson 		/*
3990800c9408SRobert Watson 		 * Since Jail relies on chroot() to implement file system
3991800c9408SRobert Watson 		 * protections, grant many VFS privileges to root in jail.
3992800c9408SRobert Watson 		 * Be careful to exclude mount-related and NFS-related
3993800c9408SRobert Watson 		 * privileges.
3994800c9408SRobert Watson 		 */
3995800c9408SRobert Watson 	case PRIV_VFS_READ:
3996800c9408SRobert Watson 	case PRIV_VFS_WRITE:
3997800c9408SRobert Watson 	case PRIV_VFS_ADMIN:
3998800c9408SRobert Watson 	case PRIV_VFS_EXEC:
3999800c9408SRobert Watson 	case PRIV_VFS_BLOCKRESERVE:	/* XXXRW: Slightly surprising. */
4000800c9408SRobert Watson 	case PRIV_VFS_CHFLAGS_DEV:
4001800c9408SRobert Watson 	case PRIV_VFS_CHOWN:
4002800c9408SRobert Watson 	case PRIV_VFS_CHROOT:
4003bb531912SPawel Jakub Dawidek 	case PRIV_VFS_RETAINSUGID:
4004800c9408SRobert Watson 	case PRIV_VFS_FCHROOT:
4005800c9408SRobert Watson 	case PRIV_VFS_LINK:
4006800c9408SRobert Watson 	case PRIV_VFS_SETGID:
4007e41966dcSRobert Watson 	case PRIV_VFS_STAT:
4008800c9408SRobert Watson 	case PRIV_VFS_STICKYFILE:
4009bb56d716SJamie Gritton 
4010bb56d716SJamie Gritton 		/*
4011bb56d716SJamie Gritton 		 * As in the non-jail case, non-root users are expected to be
401270de1003SGordon Bergling 		 * able to read kernel/physical memory (provided /dev/[k]mem
4013bb56d716SJamie Gritton 		 * exists in the jail and they have permission to access it).
4014bb56d716SJamie Gritton 		 */
4015bb56d716SJamie Gritton 	case PRIV_KMEM_READ:
4016800c9408SRobert Watson 		return (0);
4017800c9408SRobert Watson 
4018800c9408SRobert Watson 		/*
4019800c9408SRobert Watson 		 * Depending on the global setting, allow privilege of
4020800c9408SRobert Watson 		 * setting system flags.
4021800c9408SRobert Watson 		 */
4022800c9408SRobert Watson 	case PRIV_VFS_SYSFLAGS:
40230304c731SJamie Gritton 		if (cred->cr_prison->pr_allow & PR_ALLOW_CHFLAGS)
4024800c9408SRobert Watson 			return (0);
4025800c9408SRobert Watson 		else
4026800c9408SRobert Watson 			return (EPERM);
4027800c9408SRobert Watson 
4028800c9408SRobert Watson 		/*
4029f3a8d2f9SPawel Jakub Dawidek 		 * Depending on the global setting, allow privilege of
4030f3a8d2f9SPawel Jakub Dawidek 		 * mounting/unmounting file systems.
4031f3a8d2f9SPawel Jakub Dawidek 		 */
4032f3a8d2f9SPawel Jakub Dawidek 	case PRIV_VFS_MOUNT:
4033f3a8d2f9SPawel Jakub Dawidek 	case PRIV_VFS_UNMOUNT:
4034f3a8d2f9SPawel Jakub Dawidek 	case PRIV_VFS_MOUNT_NONUSER:
403524b0502eSPawel Jakub Dawidek 	case PRIV_VFS_MOUNT_OWNER:
40360fe74ae6SJamie Gritton 		pr = cred->cr_prison;
40370fe74ae6SJamie Gritton 		prison_lock(pr);
40380fe74ae6SJamie Gritton 		if (pr->pr_allow & PR_ALLOW_MOUNT && pr->pr_enforce_statfs < 2)
40390fe74ae6SJamie Gritton 			error = 0;
4040f3a8d2f9SPawel Jakub Dawidek 		else
40410fe74ae6SJamie Gritton 			error = EPERM;
40420fe74ae6SJamie Gritton 		prison_unlock(pr);
40430fe74ae6SJamie Gritton 		return (error);
4044f3a8d2f9SPawel Jakub Dawidek 
4045f3a8d2f9SPawel Jakub Dawidek 		/*
404663619b6dSKyle Evans 		 * Jails should hold no disposition on the PRIV_VFS_READ_DIR
404763619b6dSKyle Evans 		 * policy.  priv_check_cred will not specifically allow it, and
404863619b6dSKyle Evans 		 * we may want a MAC policy to allow it.
404963619b6dSKyle Evans 		 */
405063619b6dSKyle Evans 	case PRIV_VFS_READ_DIR:
405163619b6dSKyle Evans 		return (0);
405263619b6dSKyle Evans 
405363619b6dSKyle Evans 		/*
4054ccd6ac9fSAntoine Brodin 		 * Conditionnaly allow locking (unlocking) physical pages
4055ccd6ac9fSAntoine Brodin 		 * in memory.
4056ccd6ac9fSAntoine Brodin 		 */
4057ccd6ac9fSAntoine Brodin 	case PRIV_VM_MLOCK:
4058ccd6ac9fSAntoine Brodin 	case PRIV_VM_MUNLOCK:
4059ccd6ac9fSAntoine Brodin 		if (cred->cr_prison->pr_allow & PR_ALLOW_MLOCK)
4060ccd6ac9fSAntoine Brodin 			return (0);
4061ccd6ac9fSAntoine Brodin 		else
4062ccd6ac9fSAntoine Brodin 			return (EPERM);
4063ccd6ac9fSAntoine Brodin 
4064ccd6ac9fSAntoine Brodin 		/*
4065e28f9b7dSAllan Jude 		 * Conditionally allow jailed root to bind reserved ports.
4066800c9408SRobert Watson 		 */
4067800c9408SRobert Watson 	case PRIV_NETINET_RESERVEDPORT:
4068e28f9b7dSAllan Jude 		if (cred->cr_prison->pr_allow & PR_ALLOW_RESERVED_PORTS)
4069e28f9b7dSAllan Jude 			return (0);
4070e28f9b7dSAllan Jude 		else
4071e28f9b7dSAllan Jude 			return (EPERM);
4072e28f9b7dSAllan Jude 
4073e28f9b7dSAllan Jude 		/*
4074e28f9b7dSAllan Jude 		 * Allow jailed root to reuse in-use ports.
4075e28f9b7dSAllan Jude 		 */
40764b084056SRobert Watson 	case PRIV_NETINET_REUSEPORT:
4077800c9408SRobert Watson 		return (0);
4078800c9408SRobert Watson 
4079800c9408SRobert Watson 		/*
4080e3043798SPedro F. Giffuni 		 * Allow jailed root to set certain IPv4/6 (option) headers.
408179ba3952SBjoern A. Zeeb 		 */
408279ba3952SBjoern A. Zeeb 	case PRIV_NETINET_SETHDROPTS:
408379ba3952SBjoern A. Zeeb 		return (0);
408479ba3952SBjoern A. Zeeb 
408579ba3952SBjoern A. Zeeb 		/*
4086800c9408SRobert Watson 		 * Conditionally allow creating raw sockets in jail.
4087800c9408SRobert Watson 		 */
4088800c9408SRobert Watson 	case PRIV_NETINET_RAW:
40890304c731SJamie Gritton 		if (cred->cr_prison->pr_allow & PR_ALLOW_RAW_SOCKETS)
4090800c9408SRobert Watson 			return (0);
4091800c9408SRobert Watson 		else
4092800c9408SRobert Watson 			return (EPERM);
4093800c9408SRobert Watson 
4094800c9408SRobert Watson 		/*
4095800c9408SRobert Watson 		 * Since jail implements its own visibility limits on netstat
4096800c9408SRobert Watson 		 * sysctls, allow getcred.  This allows identd to work in
4097800c9408SRobert Watson 		 * jail.
4098800c9408SRobert Watson 		 */
4099800c9408SRobert Watson 	case PRIV_NETINET_GETCRED:
4100800c9408SRobert Watson 		return (0);
4101800c9408SRobert Watson 
41022bfc50bcSEdward Tomasz Napierala 		/*
41032bfc50bcSEdward Tomasz Napierala 		 * Allow jailed root to set loginclass.
41042bfc50bcSEdward Tomasz Napierala 		 */
41052bfc50bcSEdward Tomasz Napierala 	case PRIV_PROC_SETLOGINCLASS:
41062bfc50bcSEdward Tomasz Napierala 		return (0);
41072bfc50bcSEdward Tomasz Napierala 
4108b19d66fdSJamie Gritton 		/*
41094520f617SJamie Gritton 		 * Do not allow a process inside a jail to read the kernel
4110b19d66fdSJamie Gritton 		 * message buffer unless explicitly permitted.
4111b19d66fdSJamie Gritton 		 */
4112b19d66fdSJamie Gritton 	case PRIV_MSGBUF:
4113b19d66fdSJamie Gritton 		if (cred->cr_prison->pr_allow & PR_ALLOW_READ_MSGBUF)
4114b19d66fdSJamie Gritton 			return (0);
4115b19d66fdSJamie Gritton 		return (EPERM);
4116b19d66fdSJamie Gritton 
4117800c9408SRobert Watson 	default:
4118800c9408SRobert Watson 		/*
4119800c9408SRobert Watson 		 * In all remaining cases, deny the privilege request.  This
4120800c9408SRobert Watson 		 * includes almost all network privileges, many system
4121800c9408SRobert Watson 		 * configuration privileges.
4122800c9408SRobert Watson 		 */
4123800c9408SRobert Watson 		return (EPERM);
4124800c9408SRobert Watson 	}
4125800c9408SRobert Watson }
4126800c9408SRobert Watson 
41270304c731SJamie Gritton /*
41280304c731SJamie Gritton  * Return the part of pr2's name that is relative to pr1, or the whole name
41290304c731SJamie Gritton  * if it does not directly follow.
41300304c731SJamie Gritton  */
41310304c731SJamie Gritton 
41320304c731SJamie Gritton char *
41330304c731SJamie Gritton prison_name(struct prison *pr1, struct prison *pr2)
41340304c731SJamie Gritton {
41350304c731SJamie Gritton 	char *name;
41360304c731SJamie Gritton 
41370304c731SJamie Gritton 	/* Jails see themselves as "0" (if they see themselves at all). */
41380304c731SJamie Gritton 	if (pr1 == pr2)
41390304c731SJamie Gritton 		return "0";
41400304c731SJamie Gritton 	name = pr2->pr_name;
41410304c731SJamie Gritton 	if (prison_ischild(pr1, pr2)) {
41420304c731SJamie Gritton 		/*
41430304c731SJamie Gritton 		 * pr1 isn't locked (and allprison_lock may not be either)
41440304c731SJamie Gritton 		 * so its length can't be counted on.  But the number of dots
41450304c731SJamie Gritton 		 * can be counted on - and counted.
41460304c731SJamie Gritton 		 */
41470304c731SJamie Gritton 		for (; pr1 != &prison0; pr1 = pr1->pr_parent)
41480304c731SJamie Gritton 			name = strchr(name, '.') + 1;
41490304c731SJamie Gritton 	}
41500304c731SJamie Gritton 	return (name);
41510304c731SJamie Gritton }
41520304c731SJamie Gritton 
41530304c731SJamie Gritton /*
41540304c731SJamie Gritton  * Return the part of pr2's path that is relative to pr1, or the whole path
41550304c731SJamie Gritton  * if it does not directly follow.
41560304c731SJamie Gritton  */
41570304c731SJamie Gritton static char *
41580304c731SJamie Gritton prison_path(struct prison *pr1, struct prison *pr2)
41590304c731SJamie Gritton {
41600304c731SJamie Gritton 	char *path1, *path2;
41610304c731SJamie Gritton 	int len1;
41620304c731SJamie Gritton 
41630304c731SJamie Gritton 	path1 = pr1->pr_path;
41640304c731SJamie Gritton 	path2 = pr2->pr_path;
41650304c731SJamie Gritton 	if (!strcmp(path1, "/"))
41660304c731SJamie Gritton 		return (path2);
41670304c731SJamie Gritton 	len1 = strlen(path1);
41680304c731SJamie Gritton 	if (strncmp(path1, path2, len1))
41690304c731SJamie Gritton 		return (path2);
41700304c731SJamie Gritton 	if (path2[len1] == '\0')
41710304c731SJamie Gritton 		return "/";
41720304c731SJamie Gritton 	if (path2[len1] == '/')
41730304c731SJamie Gritton 		return (path2 + len1);
41740304c731SJamie Gritton 	return (path2);
41750304c731SJamie Gritton }
41760304c731SJamie Gritton 
41770304c731SJamie Gritton /*
41780304c731SJamie Gritton  * Jail-related sysctls.
41790304c731SJamie Gritton  */
41807029da5cSPawel Biernacki static SYSCTL_NODE(_security, OID_AUTO, jail, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
41810304c731SJamie Gritton     "Jails");
41820304c731SJamie Gritton 
4183eb8dcdeaSGleb Smirnoff #if defined(INET) || defined(INET6)
4184eb8dcdeaSGleb Smirnoff /*
4185eb8dcdeaSGleb Smirnoff  * Copy address array to memory that would be then SYSCTL_OUT-ed.
4186eb8dcdeaSGleb Smirnoff  * sysctl_jail_list() helper.
4187eb8dcdeaSGleb Smirnoff  */
4188eb8dcdeaSGleb Smirnoff static void
4189eb8dcdeaSGleb Smirnoff prison_ip_copyout(struct prison *pr, const pr_family_t af, void **out, int *len)
4190eb8dcdeaSGleb Smirnoff {
4191eb8dcdeaSGleb Smirnoff 	const size_t size = pr_families[af].size;
4192eb8dcdeaSGleb Smirnoff 
4193eb8dcdeaSGleb Smirnoff  again:
4194eb8dcdeaSGleb Smirnoff 	mtx_assert(&pr->pr_mtx, MA_OWNED);
4195eb8dcdeaSGleb Smirnoff 	if (pr->pr_addrs[af] != NULL) {
4196eb8dcdeaSGleb Smirnoff 		if (*len < pr->pr_addrs[af]->ips) {
4197eb8dcdeaSGleb Smirnoff 			*len = pr->pr_addrs[af]->ips;
4198eb8dcdeaSGleb Smirnoff 			mtx_unlock(&pr->pr_mtx);
4199eb8dcdeaSGleb Smirnoff 			*out = realloc(*out, *len * size, M_TEMP, M_WAITOK);
4200eb8dcdeaSGleb Smirnoff 			mtx_lock(&pr->pr_mtx);
4201eb8dcdeaSGleb Smirnoff 			goto again;
4202eb8dcdeaSGleb Smirnoff 		}
4203eb8dcdeaSGleb Smirnoff 		bcopy(pr->pr_addrs[af] + 1, *out, pr->pr_addrs[af]->ips * size);
4204eb8dcdeaSGleb Smirnoff 	}
4205eb8dcdeaSGleb Smirnoff }
4206eb8dcdeaSGleb Smirnoff #endif
4207eb8dcdeaSGleb Smirnoff 
4208fd7a8150SMike Barcroft static int
4209fd7a8150SMike Barcroft sysctl_jail_list(SYSCTL_HANDLER_ARGS)
4210fd7a8150SMike Barcroft {
4211b38ff370SJamie Gritton 	struct xprison *xp;
42120304c731SJamie Gritton 	struct prison *pr, *cpr;
4213b38ff370SJamie Gritton #ifdef INET
4214b38ff370SJamie Gritton 	struct in_addr *ip4 = NULL;
4215b38ff370SJamie Gritton 	int ip4s = 0;
4216b38ff370SJamie Gritton #endif
4217b38ff370SJamie Gritton #ifdef INET6
42183beefaedSColin Percival 	struct in6_addr *ip6 = NULL;
4219b38ff370SJamie Gritton 	int ip6s = 0;
4220b38ff370SJamie Gritton #endif
42210304c731SJamie Gritton 	int descend, error;
4222fd7a8150SMike Barcroft 
4223b38ff370SJamie Gritton 	xp = malloc(sizeof(*xp), M_TEMP, M_WAITOK);
42240304c731SJamie Gritton 	pr = req->td->td_ucred->cr_prison;
4225b38ff370SJamie Gritton 	error = 0;
4226dc68a633SPawel Jakub Dawidek 	sx_slock(&allprison_lock);
42270304c731SJamie Gritton 	FOREACH_PRISON_DESCENDANT(pr, cpr, descend) {
42280304c731SJamie Gritton 		mtx_lock(&cpr->pr_mtx);
4229413628a7SBjoern A. Zeeb #ifdef INET
4230eb8dcdeaSGleb Smirnoff 		prison_ip_copyout(cpr, PR_INET, (void **)&ip4, &ip4s);
4231413628a7SBjoern A. Zeeb #endif
4232413628a7SBjoern A. Zeeb #ifdef INET6
4233eb8dcdeaSGleb Smirnoff 		prison_ip_copyout(cpr, PR_INET6, (void **)&ip6, &ip6s);
4234b38ff370SJamie Gritton #endif
4235b38ff370SJamie Gritton 		bzero(xp, sizeof(*xp));
4236fd7a8150SMike Barcroft 		xp->pr_version = XPRISON_VERSION;
42370304c731SJamie Gritton 		xp->pr_id = cpr->pr_id;
42381158508aSJamie Gritton 		xp->pr_state = cpr->pr_state;
42390304c731SJamie Gritton 		strlcpy(xp->pr_path, prison_path(pr, cpr), sizeof(xp->pr_path));
4240c1f19219SJamie Gritton 		strlcpy(xp->pr_host, cpr->pr_hostname, sizeof(xp->pr_host));
42410304c731SJamie Gritton 		strlcpy(xp->pr_name, prison_name(pr, cpr), sizeof(xp->pr_name));
4242413628a7SBjoern A. Zeeb #ifdef INET
4243eb8dcdeaSGleb Smirnoff 		xp->pr_ip4s = ip4s;
4244413628a7SBjoern A. Zeeb #endif
4245413628a7SBjoern A. Zeeb #ifdef INET6
4246eb8dcdeaSGleb Smirnoff 		xp->pr_ip6s = ip6s;
4247413628a7SBjoern A. Zeeb #endif
42480304c731SJamie Gritton 		mtx_unlock(&cpr->pr_mtx);
4249b38ff370SJamie Gritton 		error = SYSCTL_OUT(req, xp, sizeof(*xp));
4250b38ff370SJamie Gritton 		if (error)
4251b38ff370SJamie Gritton 			break;
4252413628a7SBjoern A. Zeeb #ifdef INET
4253b38ff370SJamie Gritton 		if (xp->pr_ip4s > 0) {
4254b38ff370SJamie Gritton 			error = SYSCTL_OUT(req, ip4,
4255b38ff370SJamie Gritton 			    xp->pr_ip4s * sizeof(struct in_addr));
4256b38ff370SJamie Gritton 			if (error)
4257b38ff370SJamie Gritton 				break;
4258413628a7SBjoern A. Zeeb 		}
4259413628a7SBjoern A. Zeeb #endif
4260413628a7SBjoern A. Zeeb #ifdef INET6
4261b38ff370SJamie Gritton 		if (xp->pr_ip6s > 0) {
4262b38ff370SJamie Gritton 			error = SYSCTL_OUT(req, ip6,
4263b38ff370SJamie Gritton 			    xp->pr_ip6s * sizeof(struct in6_addr));
4264b38ff370SJamie Gritton 			if (error)
4265b38ff370SJamie Gritton 				break;
4266413628a7SBjoern A. Zeeb 		}
4267413628a7SBjoern A. Zeeb #endif
4268fd7a8150SMike Barcroft 	}
4269dc68a633SPawel Jakub Dawidek 	sx_sunlock(&allprison_lock);
4270b38ff370SJamie Gritton 	free(xp, M_TEMP);
4271b38ff370SJamie Gritton #ifdef INET
4272b38ff370SJamie Gritton 	free(ip4, M_TEMP);
4273b38ff370SJamie Gritton #endif
4274b38ff370SJamie Gritton #ifdef INET6
4275b38ff370SJamie Gritton 	free(ip6, M_TEMP);
4276b38ff370SJamie Gritton #endif
4277fd7a8150SMike Barcroft 	return (error);
4278fd7a8150SMike Barcroft }
4279fd7a8150SMike Barcroft 
4280f3b86a5fSEd Schouten SYSCTL_OID(_security_jail, OID_AUTO, list,
4281f3b86a5fSEd Schouten     CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
4282f3b86a5fSEd Schouten     sysctl_jail_list, "S", "List of active jails");
4283461167c2SPawel Jakub Dawidek 
4284461167c2SPawel Jakub Dawidek static int
4285461167c2SPawel Jakub Dawidek sysctl_jail_jailed(SYSCTL_HANDLER_ARGS)
4286461167c2SPawel Jakub Dawidek {
4287461167c2SPawel Jakub Dawidek 	int error, injail;
4288461167c2SPawel Jakub Dawidek 
4289461167c2SPawel Jakub Dawidek 	injail = jailed(req->td->td_ucred);
4290461167c2SPawel Jakub Dawidek 	error = SYSCTL_OUT(req, &injail, sizeof(injail));
4291461167c2SPawel Jakub Dawidek 
4292461167c2SPawel Jakub Dawidek 	return (error);
4293461167c2SPawel Jakub Dawidek }
42940304c731SJamie Gritton 
4295f3b86a5fSEd Schouten SYSCTL_PROC(_security_jail, OID_AUTO, jailed,
4296f3b86a5fSEd Schouten     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
4297f3b86a5fSEd Schouten     sysctl_jail_jailed, "I", "Process in jail?");
4298413628a7SBjoern A. Zeeb 
4299761d2bb5SJamie Gritton static int
4300761d2bb5SJamie Gritton sysctl_jail_vnet(SYSCTL_HANDLER_ARGS)
4301761d2bb5SJamie Gritton {
4302761d2bb5SJamie Gritton 	int error, havevnet;
4303761d2bb5SJamie Gritton #ifdef VIMAGE
4304761d2bb5SJamie Gritton 	struct ucred *cred = req->td->td_ucred;
4305761d2bb5SJamie Gritton 
4306761d2bb5SJamie Gritton 	havevnet = jailed(cred) && prison_owns_vnet(cred);
4307761d2bb5SJamie Gritton #else
4308761d2bb5SJamie Gritton 	havevnet = 0;
4309761d2bb5SJamie Gritton #endif
4310761d2bb5SJamie Gritton 	error = SYSCTL_OUT(req, &havevnet, sizeof(havevnet));
4311761d2bb5SJamie Gritton 
4312761d2bb5SJamie Gritton 	return (error);
4313761d2bb5SJamie Gritton }
4314761d2bb5SJamie Gritton 
4315761d2bb5SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, vnet,
4316761d2bb5SJamie Gritton     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
4317bb8f1623SBjoern A. Zeeb     sysctl_jail_vnet, "I", "Jail owns vnet?");
4318761d2bb5SJamie Gritton 
43190304c731SJamie Gritton #if defined(INET) || defined(INET6)
4320e92e0574SJamie Gritton SYSCTL_UINT(_security_jail, OID_AUTO, jail_max_af_ips, CTLFLAG_RW,
43210304c731SJamie Gritton     &jail_max_af_ips, 0,
4322c542c43eSJamie Gritton     "Number of IP addresses a jail may have at most per address family (deprecated)");
43230304c731SJamie Gritton #endif
43240304c731SJamie Gritton 
43250304c731SJamie Gritton /*
4326c542c43eSJamie Gritton  * Default parameters for jail(2) compatibility.  For historical reasons,
4327c542c43eSJamie Gritton  * the sysctl names have varying similarity to the parameter names.  Prisons
4328c542c43eSJamie Gritton  * just see their own parameters, and can't change them.
43290304c731SJamie Gritton  */
43300304c731SJamie Gritton static int
43310304c731SJamie Gritton sysctl_jail_default_allow(SYSCTL_HANDLER_ARGS)
43320304c731SJamie Gritton {
43330fe74ae6SJamie Gritton 	int error, i;
43340304c731SJamie Gritton 
43350304c731SJamie Gritton 	/* Get the current flag value, and convert it to a boolean. */
43360fe74ae6SJamie Gritton 	if (req->td->td_ucred->cr_prison == &prison0) {
43370fe74ae6SJamie Gritton 		mtx_lock(&prison0.pr_mtx);
43380fe74ae6SJamie Gritton 		i = (jail_default_allow & arg2) != 0;
43390fe74ae6SJamie Gritton 		mtx_unlock(&prison0.pr_mtx);
43400fe74ae6SJamie Gritton 	} else
43410fe74ae6SJamie Gritton 		i = prison_allow(req->td->td_ucred, arg2);
43420fe74ae6SJamie Gritton 
43430304c731SJamie Gritton 	if (arg1 != NULL)
43440304c731SJamie Gritton 		i = !i;
43450304c731SJamie Gritton 	error = sysctl_handle_int(oidp, &i, 0, req);
4346c542c43eSJamie Gritton 	if (error || !req->newptr)
43470304c731SJamie Gritton 		return (error);
43480304c731SJamie Gritton 	i = i ? arg2 : 0;
43490304c731SJamie Gritton 	if (arg1 != NULL)
43500304c731SJamie Gritton 		i ^= arg2;
43510304c731SJamie Gritton 	/*
43520304c731SJamie Gritton 	 * The sysctls don't have CTLFLAGS_PRISON, so assume prison0
43530304c731SJamie Gritton 	 * for writing.
43540304c731SJamie Gritton 	 */
43550304c731SJamie Gritton 	mtx_lock(&prison0.pr_mtx);
43560304c731SJamie Gritton 	jail_default_allow = (jail_default_allow & ~arg2) | i;
43570304c731SJamie Gritton 	mtx_unlock(&prison0.pr_mtx);
43580304c731SJamie Gritton 	return (0);
43590304c731SJamie Gritton }
43600304c731SJamie Gritton 
43610304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, set_hostname_allowed,
4362c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
43630304c731SJamie Gritton     NULL, PR_ALLOW_SET_HOSTNAME, sysctl_jail_default_allow, "I",
4364c542c43eSJamie Gritton     "Processes in jail can set their hostnames (deprecated)");
43650304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, socket_unixiproute_only,
4366c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
43670304c731SJamie Gritton     (void *)1, PR_ALLOW_SOCKET_AF, sysctl_jail_default_allow, "I",
4368c542c43eSJamie Gritton     "Processes in jail are limited to creating UNIX/IP/route sockets only (deprecated)");
43690304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, sysvipc_allowed,
4370c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
43710304c731SJamie Gritton     NULL, PR_ALLOW_SYSVIPC, sysctl_jail_default_allow, "I",
4372c542c43eSJamie Gritton     "Processes in jail can use System V IPC primitives (deprecated)");
43730304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, allow_raw_sockets,
4374c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
43750304c731SJamie Gritton     NULL, PR_ALLOW_RAW_SOCKETS, sysctl_jail_default_allow, "I",
4376c542c43eSJamie Gritton     "Prison root can create raw sockets (deprecated)");
43770304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, chflags_allowed,
4378c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
43790304c731SJamie Gritton     NULL, PR_ALLOW_CHFLAGS, sysctl_jail_default_allow, "I",
4380c542c43eSJamie Gritton     "Processes in jail can alter system file flags (deprecated)");
43810304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, mount_allowed,
4382c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
43830304c731SJamie Gritton     NULL, PR_ALLOW_MOUNT, sysctl_jail_default_allow, "I",
4384c542c43eSJamie Gritton     "Processes in jail can mount/unmount jail-friendly file systems (deprecated)");
43850304c731SJamie Gritton 
43860304c731SJamie Gritton static int
43870304c731SJamie Gritton sysctl_jail_default_level(SYSCTL_HANDLER_ARGS)
43880304c731SJamie Gritton {
43890304c731SJamie Gritton 	struct prison *pr;
43900304c731SJamie Gritton 	int level, error;
43910304c731SJamie Gritton 
43920304c731SJamie Gritton 	pr = req->td->td_ucred->cr_prison;
43930304c731SJamie Gritton 	level = (pr == &prison0) ? *(int *)arg1 : *(int *)((char *)pr + arg2);
43940304c731SJamie Gritton 	error = sysctl_handle_int(oidp, &level, 0, req);
4395c542c43eSJamie Gritton 	if (error || !req->newptr)
43960304c731SJamie Gritton 		return (error);
43970304c731SJamie Gritton 	*(int *)arg1 = level;
43980304c731SJamie Gritton 	return (0);
43990304c731SJamie Gritton }
44000304c731SJamie Gritton 
44010304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, enforce_statfs,
4402c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4403c542c43eSJamie Gritton     &jail_default_enforce_statfs, offsetof(struct prison, pr_enforce_statfs),
44040304c731SJamie Gritton     sysctl_jail_default_level, "I",
4405c542c43eSJamie Gritton     "Processes in jail cannot see all mounted file systems (deprecated)");
4406c542c43eSJamie Gritton 
44070cc207a6SMartin Matuska SYSCTL_PROC(_security_jail, OID_AUTO, devfs_ruleset,
4408c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE,
4409c542c43eSJamie Gritton     &jail_default_devfs_rsnum, offsetof(struct prison, pr_devfs_rsnum),
44100cc207a6SMartin Matuska     sysctl_jail_default_level, "I",
4411c542c43eSJamie Gritton     "Ruleset for the devfs filesystem in jail (deprecated)");
44120cc207a6SMartin Matuska 
44130304c731SJamie Gritton /*
44140304c731SJamie Gritton  * Nodes to describe jail parameters.  Maximum length of string parameters
44150304c731SJamie Gritton  * is returned in the string itself, and the other parameters exist merely
44160304c731SJamie Gritton  * to make themselves and their types known.
44170304c731SJamie Gritton  */
44187029da5cSPawel Biernacki SYSCTL_NODE(_security_jail, OID_AUTO, param, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
44190304c731SJamie Gritton     "Jail parameters");
44200304c731SJamie Gritton 
44210304c731SJamie Gritton int
44220304c731SJamie Gritton sysctl_jail_param(SYSCTL_HANDLER_ARGS)
44230304c731SJamie Gritton {
44240304c731SJamie Gritton 	int i;
44250304c731SJamie Gritton 	long l;
44260304c731SJamie Gritton 	size_t s;
44270304c731SJamie Gritton 	char numbuf[12];
44280304c731SJamie Gritton 
44290304c731SJamie Gritton 	switch (oidp->oid_kind & CTLTYPE)
44300304c731SJamie Gritton 	{
44310304c731SJamie Gritton 	case CTLTYPE_LONG:
44320304c731SJamie Gritton 	case CTLTYPE_ULONG:
44330304c731SJamie Gritton 		l = 0;
44340304c731SJamie Gritton #ifdef SCTL_MASK32
44350304c731SJamie Gritton 		if (!(req->flags & SCTL_MASK32))
44360304c731SJamie Gritton #endif
44370304c731SJamie Gritton 			return (SYSCTL_OUT(req, &l, sizeof(l)));
44380304c731SJamie Gritton 	case CTLTYPE_INT:
44390304c731SJamie Gritton 	case CTLTYPE_UINT:
44400304c731SJamie Gritton 		i = 0;
44410304c731SJamie Gritton 		return (SYSCTL_OUT(req, &i, sizeof(i)));
44420304c731SJamie Gritton 	case CTLTYPE_STRING:
4443e4cd31ddSJeff Roberson 		snprintf(numbuf, sizeof(numbuf), "%jd", (intmax_t)arg2);
44440304c731SJamie Gritton 		return
44450304c731SJamie Gritton 		    (sysctl_handle_string(oidp, numbuf, sizeof(numbuf), req));
44460304c731SJamie Gritton 	case CTLTYPE_STRUCT:
44470304c731SJamie Gritton 		s = (size_t)arg2;
44480304c731SJamie Gritton 		return (SYSCTL_OUT(req, &s, sizeof(s)));
44490304c731SJamie Gritton 	}
44500304c731SJamie Gritton 	return (0);
44510304c731SJamie Gritton }
44520304c731SJamie Gritton 
4453b96bd95bSIan Lepore /*
4454b96bd95bSIan Lepore  * CTLFLAG_RDTUN in the following indicates jail parameters that can be set at
4455b96bd95bSIan Lepore  * jail creation time but cannot be changed in an existing jail.
4456b96bd95bSIan Lepore  */
44570304c731SJamie Gritton SYSCTL_JAIL_PARAM(, jid, CTLTYPE_INT | CTLFLAG_RDTUN, "I", "Jail ID");
44580304c731SJamie Gritton SYSCTL_JAIL_PARAM(, parent, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail parent ID");
44590304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(, name, CTLFLAG_RW, MAXHOSTNAMELEN, "Jail name");
44600304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(, path, CTLFLAG_RDTUN, MAXPATHLEN, "Jail root path");
44610304c731SJamie Gritton SYSCTL_JAIL_PARAM(, securelevel, CTLTYPE_INT | CTLFLAG_RW,
44620304c731SJamie Gritton     "I", "Jail secure level");
4463b96bd95bSIan Lepore SYSCTL_JAIL_PARAM(, osreldate, CTLTYPE_INT | CTLFLAG_RDTUN, "I",
4464b96bd95bSIan Lepore     "Jail value for kern.osreldate and uname -K");
4465b96bd95bSIan Lepore SYSCTL_JAIL_PARAM_STRING(, osrelease, CTLFLAG_RDTUN, OSRELEASELEN,
4466b96bd95bSIan Lepore     "Jail value for kern.osrelease and uname -r");
44670304c731SJamie Gritton SYSCTL_JAIL_PARAM(, enforce_statfs, CTLTYPE_INT | CTLFLAG_RW,
44680304c731SJamie Gritton     "I", "Jail cannot see all mounted file systems");
44690cc207a6SMartin Matuska SYSCTL_JAIL_PARAM(, devfs_ruleset, CTLTYPE_INT | CTLFLAG_RW,
44700cc207a6SMartin Matuska     "I", "Ruleset for in-jail devfs mounts");
44710304c731SJamie Gritton SYSCTL_JAIL_PARAM(, persist, CTLTYPE_INT | CTLFLAG_RW,
44720304c731SJamie Gritton     "B", "Jail persistence");
4473679e1390SJamie Gritton #ifdef VIMAGE
4474679e1390SJamie Gritton SYSCTL_JAIL_PARAM(, vnet, CTLTYPE_INT | CTLFLAG_RDTUN,
44757cbf7213SJamie Gritton     "E,jailsys", "Virtual network stack");
4476679e1390SJamie Gritton #endif
44770304c731SJamie Gritton SYSCTL_JAIL_PARAM(, dying, CTLTYPE_INT | CTLFLAG_RD,
44780304c731SJamie Gritton     "B", "Jail is in the process of shutting down");
44790304c731SJamie Gritton 
4480b97457e2SJamie Gritton SYSCTL_JAIL_PARAM_NODE(children, "Number of child jails");
4481b97457e2SJamie Gritton SYSCTL_JAIL_PARAM(_children, cur, CTLTYPE_INT | CTLFLAG_RD,
4482b97457e2SJamie Gritton     "I", "Current number of child jails");
4483b97457e2SJamie Gritton SYSCTL_JAIL_PARAM(_children, max, CTLTYPE_INT | CTLFLAG_RW,
4484b97457e2SJamie Gritton     "I", "Maximum number of child jails");
4485b97457e2SJamie Gritton 
44867cbf7213SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(host, CTLFLAG_RW, "Jail host info");
44870304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, hostname, CTLFLAG_RW, MAXHOSTNAMELEN,
44880304c731SJamie Gritton     "Jail hostname");
448976ca6f88SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, domainname, CTLFLAG_RW, MAXHOSTNAMELEN,
449076ca6f88SJamie Gritton     "Jail NIS domainname");
449176ca6f88SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, hostuuid, CTLFLAG_RW, HOSTUUIDLEN,
449276ca6f88SJamie Gritton     "Jail host UUID");
449376ca6f88SJamie Gritton SYSCTL_JAIL_PARAM(_host, hostid, CTLTYPE_ULONG | CTLFLAG_RW,
449476ca6f88SJamie Gritton     "LU", "Jail host ID");
44950304c731SJamie Gritton 
44960304c731SJamie Gritton SYSCTL_JAIL_PARAM_NODE(cpuset, "Jail cpuset");
44970304c731SJamie Gritton SYSCTL_JAIL_PARAM(_cpuset, id, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail cpuset ID");
44980304c731SJamie Gritton 
44990304c731SJamie Gritton #ifdef INET
45002b0d6f81SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(ip4, CTLFLAG_RDTUN,
45012b0d6f81SJamie Gritton     "Jail IPv4 address virtualization");
45020304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRUCT(_ip4, addr, CTLFLAG_RW, sizeof(struct in_addr),
45030304c731SJamie Gritton     "S,in_addr,a", "Jail IPv4 addresses");
4504592bcae8SBjoern A. Zeeb SYSCTL_JAIL_PARAM(_ip4, saddrsel, CTLTYPE_INT | CTLFLAG_RW,
4505592bcae8SBjoern A. Zeeb     "B", "Do (not) use IPv4 source address selection rather than the "
4506592bcae8SBjoern A. Zeeb     "primary jail IPv4 address.");
45070304c731SJamie Gritton #endif
45080304c731SJamie Gritton #ifdef INET6
45092b0d6f81SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(ip6, CTLFLAG_RDTUN,
45102b0d6f81SJamie Gritton     "Jail IPv6 address virtualization");
45110304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRUCT(_ip6, addr, CTLFLAG_RW, sizeof(struct in6_addr),
45120304c731SJamie Gritton     "S,in6_addr,a", "Jail IPv6 addresses");
4513592bcae8SBjoern A. Zeeb SYSCTL_JAIL_PARAM(_ip6, saddrsel, CTLTYPE_INT | CTLFLAG_RW,
4514592bcae8SBjoern A. Zeeb     "B", "Do (not) use IPv6 source address selection rather than the "
4515592bcae8SBjoern A. Zeeb     "primary jail IPv6 address.");
45160304c731SJamie Gritton #endif
45170304c731SJamie Gritton 
45180304c731SJamie Gritton SYSCTL_JAIL_PARAM_NODE(allow, "Jail permission flags");
45190304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, set_hostname, CTLTYPE_INT | CTLFLAG_RW,
45200304c731SJamie Gritton     "B", "Jail may set hostname");
45210304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, sysvipc, CTLTYPE_INT | CTLFLAG_RW,
45220304c731SJamie Gritton     "B", "Jail may use SYSV IPC");
45230304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, raw_sockets, CTLTYPE_INT | CTLFLAG_RW,
45240304c731SJamie Gritton     "B", "Jail may create raw sockets");
45250304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, chflags, CTLTYPE_INT | CTLFLAG_RW,
45260304c731SJamie Gritton     "B", "Jail may alter system file flags");
45270304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, quotas, CTLTYPE_INT | CTLFLAG_RW,
45280304c731SJamie Gritton     "B", "Jail may set file quotas");
45290304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, socket_af, CTLTYPE_INT | CTLFLAG_RW,
45300304c731SJamie Gritton     "B", "Jail may create sockets other than just UNIX/IPv4/IPv6/route");
4531ccd6ac9fSAntoine Brodin SYSCTL_JAIL_PARAM(_allow, mlock, CTLTYPE_INT | CTLFLAG_RW,
4532ccd6ac9fSAntoine Brodin     "B", "Jail may lock (unlock) physical pages in memory");
4533e28f9b7dSAllan Jude SYSCTL_JAIL_PARAM(_allow, reserved_ports, CTLTYPE_INT | CTLFLAG_RW,
4534e28f9b7dSAllan Jude     "B", "Jail may bind sockets to reserved ports");
4535b19d66fdSJamie Gritton SYSCTL_JAIL_PARAM(_allow, read_msgbuf, CTLTYPE_INT | CTLFLAG_RW,
4536b19d66fdSJamie Gritton     "B", "Jail may read the kernel message buffer");
4537b3079544SJamie Gritton SYSCTL_JAIL_PARAM(_allow, unprivileged_proc_debug, CTLTYPE_INT | CTLFLAG_RW,
4538b3079544SJamie Gritton     "B", "Unprivileged processes may use process debugging facilities");
453905e1e482SMariusz Zaborski SYSCTL_JAIL_PARAM(_allow, suser, CTLTYPE_INT | CTLFLAG_RW,
454005e1e482SMariusz Zaborski     "B", "Processes in jail with uid 0 have privilege");
4541bba7a2e8SRick Macklem #if defined(VNET_NFSD) && defined(VIMAGE) && defined(NFSD)
4542bba7a2e8SRick Macklem SYSCTL_JAIL_PARAM(_allow, nfsd, CTLTYPE_INT | CTLFLAG_RW,
4543bba7a2e8SRick Macklem     "B", "Mountd/nfsd may run in the jail");
4544bba7a2e8SRick Macklem #endif
45450304c731SJamie Gritton 
4546bf3db8aaSMartin Matuska SYSCTL_JAIL_PARAM_SUBNODE(allow, mount, "Jail mount/unmount permission flags");
4547bf3db8aaSMartin Matuska SYSCTL_JAIL_PARAM(_allow_mount, , CTLTYPE_INT | CTLFLAG_RW,
4548bf3db8aaSMartin Matuska     "B", "Jail may mount/unmount jail-friendly file systems in general");
45490e5c6bd4SJamie Gritton 
45500e5c6bd4SJamie Gritton /*
45510a172404SJamie Gritton  * Add a dynamic parameter allow.<name>, or allow.<prefix>.<name>.  Return
45520a172404SJamie Gritton  * its associated bit in the pr_allow bitmask, or zero if the parameter was
45530a172404SJamie Gritton  * not created.
45540e5c6bd4SJamie Gritton  */
45550a172404SJamie Gritton unsigned
45560a172404SJamie Gritton prison_add_allow(const char *prefix, const char *name, const char *prefix_descr,
45570a172404SJamie Gritton     const char *descr)
45580e5c6bd4SJamie Gritton {
45590e5c6bd4SJamie Gritton 	struct bool_flags *bf;
45600a172404SJamie Gritton 	struct sysctl_oid *parent;
45610a172404SJamie Gritton 	char *allow_name, *allow_noname, *allowed;
4562c542c43eSJamie Gritton #ifndef NO_SYSCTL_DESCR
4563c542c43eSJamie Gritton 	char *descr_deprecated;
4564c542c43eSJamie Gritton #endif
45655d58f959SJamie Gritton 	u_int allow_flag;
45660e5c6bd4SJamie Gritton 
45670a172404SJamie Gritton 	if (prefix
45680a172404SJamie Gritton 	    ? asprintf(&allow_name, M_PRISON, "allow.%s.%s", prefix, name)
45690a172404SJamie Gritton 		< 0 ||
45700a172404SJamie Gritton 	      asprintf(&allow_noname, M_PRISON, "allow.%s.no%s", prefix, name)
45710a172404SJamie Gritton 		< 0
45720a172404SJamie Gritton 	    : asprintf(&allow_name, M_PRISON, "allow.%s", name) < 0 ||
45730a172404SJamie Gritton 	      asprintf(&allow_noname, M_PRISON, "allow.no%s", name) < 0) {
45740e5c6bd4SJamie Gritton 		free(allow_name, M_PRISON);
45750a172404SJamie Gritton 		return 0;
45760e5c6bd4SJamie Gritton 	}
45770e5c6bd4SJamie Gritton 
45780e5c6bd4SJamie Gritton 	/*
45790a172404SJamie Gritton 	 * See if this parameter has already beed added, i.e. a module was
45800a172404SJamie Gritton 	 * previously loaded/unloaded.
45810e5c6bd4SJamie Gritton 	 */
45820e5c6bd4SJamie Gritton 	mtx_lock(&prison0.pr_mtx);
45830e5c6bd4SJamie Gritton 	for (bf = pr_flag_allow;
45845d58f959SJamie Gritton 	     bf < pr_flag_allow + nitems(pr_flag_allow) &&
45855d58f959SJamie Gritton 		atomic_load_int(&bf->flag) != 0;
45860e5c6bd4SJamie Gritton 	     bf++) {
45870e5c6bd4SJamie Gritton 		if (strcmp(bf->name, allow_name) == 0) {
45880a172404SJamie Gritton 			allow_flag = bf->flag;
45890e5c6bd4SJamie Gritton 			goto no_add;
45900e5c6bd4SJamie Gritton 		}
45910e5c6bd4SJamie Gritton 	}
45920e5c6bd4SJamie Gritton 
45930e5c6bd4SJamie Gritton 	/*
45945d58f959SJamie Gritton 	 * Find a free bit in pr_allow_all, failing if there are none
45950e5c6bd4SJamie Gritton 	 * (which shouldn't happen as long as we keep track of how many
45960a172404SJamie Gritton 	 * potential dynamic flags exist).
45970e5c6bd4SJamie Gritton 	 */
45980e5c6bd4SJamie Gritton 	for (allow_flag = 1;; allow_flag <<= 1) {
45990e5c6bd4SJamie Gritton 		if (allow_flag == 0)
46000e5c6bd4SJamie Gritton 			goto no_add;
46015d58f959SJamie Gritton 		if ((pr_allow_all & allow_flag) == 0)
46020e5c6bd4SJamie Gritton 			break;
46030e5c6bd4SJamie Gritton 	}
46040e5c6bd4SJamie Gritton 
46055d58f959SJamie Gritton 	/* Note the parameter in the next open slot in pr_flag_allow. */
46065d58f959SJamie Gritton 	for (bf = pr_flag_allow; ; bf++) {
46070e5c6bd4SJamie Gritton 		if (bf == pr_flag_allow + nitems(pr_flag_allow)) {
46080e5c6bd4SJamie Gritton 			/* This should never happen, but is not fatal. */
46090a172404SJamie Gritton 			allow_flag = 0;
46100e5c6bd4SJamie Gritton 			goto no_add;
46110e5c6bd4SJamie Gritton 		}
46125d58f959SJamie Gritton 		if (atomic_load_int(&bf->flag) == 0)
46135d58f959SJamie Gritton 			break;
46145d58f959SJamie Gritton 	}
46150e5c6bd4SJamie Gritton 	bf->name = allow_name;
46160e5c6bd4SJamie Gritton 	bf->noname = allow_noname;
46175d58f959SJamie Gritton 	pr_allow_all |= allow_flag;
46185d58f959SJamie Gritton 	/*
46195d58f959SJamie Gritton 	 * prison0 always has permission for the new parameter.
46205d58f959SJamie Gritton 	 * Other jails must have it granted to them.
46215d58f959SJamie Gritton 	 */
46225d58f959SJamie Gritton 	prison0.pr_allow |= allow_flag;
46235d58f959SJamie Gritton 	/* The flag indicates a valid entry, so make sure it is set last. */
46245d58f959SJamie Gritton 	atomic_store_rel_int(&bf->flag, allow_flag);
46250e5c6bd4SJamie Gritton 	mtx_unlock(&prison0.pr_mtx);
46260e5c6bd4SJamie Gritton 
4627c542c43eSJamie Gritton 	/*
46284771011bSGordon Bergling 	 * Create sysctls for the parameter, and the back-compat global
4629c542c43eSJamie Gritton 	 * permission.
4630c542c43eSJamie Gritton 	 */
46310a172404SJamie Gritton 	parent = prefix
46320a172404SJamie Gritton 	    ? SYSCTL_ADD_NODE(NULL,
46330a172404SJamie Gritton 		  SYSCTL_CHILDREN(&sysctl___security_jail_param_allow),
46347029da5cSPawel Biernacki 		  OID_AUTO, prefix, CTLFLAG_MPSAFE, 0, prefix_descr)
46350a172404SJamie Gritton 	    : &sysctl___security_jail_param_allow;
46360a172404SJamie Gritton 	(void)SYSCTL_ADD_PROC(NULL, SYSCTL_CHILDREN(parent), OID_AUTO,
46370a172404SJamie Gritton 	    name, CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
46380e5c6bd4SJamie Gritton 	    NULL, 0, sysctl_jail_param, "B", descr);
46390a172404SJamie Gritton 	if ((prefix
46400a172404SJamie Gritton 	     ? asprintf(&allowed, M_TEMP, "%s_%s_allowed", prefix, name)
46410a172404SJamie Gritton 	     : asprintf(&allowed, M_TEMP, "%s_allowed", name)) >= 0) {
4642c542c43eSJamie Gritton #ifndef NO_SYSCTL_DESCR
4643c542c43eSJamie Gritton 		(void)asprintf(&descr_deprecated, M_TEMP, "%s (deprecated)",
4644c542c43eSJamie Gritton 		    descr);
4645c542c43eSJamie Gritton #endif
46460e5c6bd4SJamie Gritton 		(void)SYSCTL_ADD_PROC(NULL,
46470a172404SJamie Gritton 		    SYSCTL_CHILDREN(&sysctl___security_jail), OID_AUTO, allowed,
4648c542c43eSJamie Gritton 		    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, allow_flag,
4649c542c43eSJamie Gritton 		    sysctl_jail_default_allow, "I", descr_deprecated);
4650c542c43eSJamie Gritton #ifndef NO_SYSCTL_DESCR
4651c542c43eSJamie Gritton 		free(descr_deprecated, M_TEMP);
4652c542c43eSJamie Gritton #endif
46530a172404SJamie Gritton 		free(allowed, M_TEMP);
46540e5c6bd4SJamie Gritton 	}
46550a172404SJamie Gritton 	return allow_flag;
46560e5c6bd4SJamie Gritton 
46570e5c6bd4SJamie Gritton  no_add:
46580e5c6bd4SJamie Gritton 	mtx_unlock(&prison0.pr_mtx);
46590e5c6bd4SJamie Gritton 	free(allow_name, M_PRISON);
46600e5c6bd4SJamie Gritton 	free(allow_noname, M_PRISON);
46610a172404SJamie Gritton 	return allow_flag;
46620a172404SJamie Gritton }
46630a172404SJamie Gritton 
46640a172404SJamie Gritton /*
46650a172404SJamie Gritton  * The VFS system will register jail-aware filesystems here.  They each get
46660a172404SJamie Gritton  * a parameter allow.mount.xxxfs and a flag to check when a jailed user
46670a172404SJamie Gritton  * attempts to mount.
46680a172404SJamie Gritton  */
46690a172404SJamie Gritton void
46700a172404SJamie Gritton prison_add_vfs(struct vfsconf *vfsp)
46710a172404SJamie Gritton {
46720a172404SJamie Gritton #ifdef NO_SYSCTL_DESCR
46730a172404SJamie Gritton 
46740a172404SJamie Gritton 	vfsp->vfc_prison_flag = prison_add_allow("mount", vfsp->vfc_name,
46750a172404SJamie Gritton 	    NULL, NULL);
46760a172404SJamie Gritton #else
46770a172404SJamie Gritton 	char *descr;
46780a172404SJamie Gritton 
46790a172404SJamie Gritton 	(void)asprintf(&descr, M_TEMP, "Jail may mount the %s file system",
46800a172404SJamie Gritton 	    vfsp->vfc_name);
46810a172404SJamie Gritton 	vfsp->vfc_prison_flag = prison_add_allow("mount", vfsp->vfc_name,
46820a172404SJamie Gritton 	    NULL, descr);
46830a172404SJamie Gritton 	free(descr, M_TEMP);
46840a172404SJamie Gritton #endif
46850e5c6bd4SJamie Gritton }
4686bf3db8aaSMartin Matuska 
46874b5c9cf6SEdward Tomasz Napierala #ifdef RACCT
4688097055e2SEdward Tomasz Napierala void
4689097055e2SEdward Tomasz Napierala prison_racct_foreach(void (*callback)(struct racct *racct,
469015db3c07SEdward Tomasz Napierala     void *arg2, void *arg3), void (*pre)(void), void (*post)(void),
469115db3c07SEdward Tomasz Napierala     void *arg2, void *arg3)
4692097055e2SEdward Tomasz Napierala {
4693a7ad07bfSEdward Tomasz Napierala 	struct prison_racct *prr;
4694097055e2SEdward Tomasz Napierala 
46954b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
46964b5c9cf6SEdward Tomasz Napierala 
4697097055e2SEdward Tomasz Napierala 	sx_slock(&allprison_lock);
469815db3c07SEdward Tomasz Napierala 	if (pre != NULL)
469915db3c07SEdward Tomasz Napierala 		(pre)();
4700a7ad07bfSEdward Tomasz Napierala 	LIST_FOREACH(prr, &allprison_racct, prr_next)
4701a7ad07bfSEdward Tomasz Napierala 		(callback)(prr->prr_racct, arg2, arg3);
470215db3c07SEdward Tomasz Napierala 	if (post != NULL)
470315db3c07SEdward Tomasz Napierala 		(post)();
4704097055e2SEdward Tomasz Napierala 	sx_sunlock(&allprison_lock);
4705097055e2SEdward Tomasz Napierala }
47060304c731SJamie Gritton 
4707a7ad07bfSEdward Tomasz Napierala static struct prison_racct *
4708a7ad07bfSEdward Tomasz Napierala prison_racct_find_locked(const char *name)
4709a7ad07bfSEdward Tomasz Napierala {
4710a7ad07bfSEdward Tomasz Napierala 	struct prison_racct *prr;
4711a7ad07bfSEdward Tomasz Napierala 
47124b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
4713a7ad07bfSEdward Tomasz Napierala 	sx_assert(&allprison_lock, SA_XLOCKED);
4714a7ad07bfSEdward Tomasz Napierala 
4715a7ad07bfSEdward Tomasz Napierala 	if (name[0] == '\0' || strlen(name) >= MAXHOSTNAMELEN)
4716a7ad07bfSEdward Tomasz Napierala 		return (NULL);
4717a7ad07bfSEdward Tomasz Napierala 
4718a7ad07bfSEdward Tomasz Napierala 	LIST_FOREACH(prr, &allprison_racct, prr_next) {
4719a7ad07bfSEdward Tomasz Napierala 		if (strcmp(name, prr->prr_name) != 0)
4720a7ad07bfSEdward Tomasz Napierala 			continue;
4721a7ad07bfSEdward Tomasz Napierala 
4722a7ad07bfSEdward Tomasz Napierala 		/* Found prison_racct with a matching name? */
4723a7ad07bfSEdward Tomasz Napierala 		prison_racct_hold(prr);
4724a7ad07bfSEdward Tomasz Napierala 		return (prr);
4725a7ad07bfSEdward Tomasz Napierala 	}
4726a7ad07bfSEdward Tomasz Napierala 
4727a7ad07bfSEdward Tomasz Napierala 	/* Add new prison_racct. */
4728a7ad07bfSEdward Tomasz Napierala 	prr = malloc(sizeof(*prr), M_PRISON_RACCT, M_ZERO | M_WAITOK);
4729a7ad07bfSEdward Tomasz Napierala 	racct_create(&prr->prr_racct);
4730a7ad07bfSEdward Tomasz Napierala 
4731a7ad07bfSEdward Tomasz Napierala 	strcpy(prr->prr_name, name);
4732a7ad07bfSEdward Tomasz Napierala 	refcount_init(&prr->prr_refcount, 1);
4733a7ad07bfSEdward Tomasz Napierala 	LIST_INSERT_HEAD(&allprison_racct, prr, prr_next);
4734a7ad07bfSEdward Tomasz Napierala 
4735a7ad07bfSEdward Tomasz Napierala 	return (prr);
4736a7ad07bfSEdward Tomasz Napierala }
4737a7ad07bfSEdward Tomasz Napierala 
4738a7ad07bfSEdward Tomasz Napierala struct prison_racct *
4739a7ad07bfSEdward Tomasz Napierala prison_racct_find(const char *name)
4740a7ad07bfSEdward Tomasz Napierala {
4741a7ad07bfSEdward Tomasz Napierala 	struct prison_racct *prr;
4742a7ad07bfSEdward Tomasz Napierala 
47434b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
47444b5c9cf6SEdward Tomasz Napierala 
4745a7ad07bfSEdward Tomasz Napierala 	sx_xlock(&allprison_lock);
4746a7ad07bfSEdward Tomasz Napierala 	prr = prison_racct_find_locked(name);
4747a7ad07bfSEdward Tomasz Napierala 	sx_xunlock(&allprison_lock);
4748a7ad07bfSEdward Tomasz Napierala 	return (prr);
4749a7ad07bfSEdward Tomasz Napierala }
4750a7ad07bfSEdward Tomasz Napierala 
4751a7ad07bfSEdward Tomasz Napierala void
4752a7ad07bfSEdward Tomasz Napierala prison_racct_hold(struct prison_racct *prr)
4753a7ad07bfSEdward Tomasz Napierala {
4754a7ad07bfSEdward Tomasz Napierala 
47554b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
47564b5c9cf6SEdward Tomasz Napierala 
4757a7ad07bfSEdward Tomasz Napierala 	refcount_acquire(&prr->prr_refcount);
4758a7ad07bfSEdward Tomasz Napierala }
4759a7ad07bfSEdward Tomasz Napierala 
4760c34bbd2aSEdward Tomasz Napierala static void
4761c34bbd2aSEdward Tomasz Napierala prison_racct_free_locked(struct prison_racct *prr)
4762c34bbd2aSEdward Tomasz Napierala {
4763c34bbd2aSEdward Tomasz Napierala 
47644b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
4765c34bbd2aSEdward Tomasz Napierala 	sx_assert(&allprison_lock, SA_XLOCKED);
4766c34bbd2aSEdward Tomasz Napierala 
4767c34bbd2aSEdward Tomasz Napierala 	if (refcount_release(&prr->prr_refcount)) {
4768c34bbd2aSEdward Tomasz Napierala 		racct_destroy(&prr->prr_racct);
4769c34bbd2aSEdward Tomasz Napierala 		LIST_REMOVE(prr, prr_next);
4770c34bbd2aSEdward Tomasz Napierala 		free(prr, M_PRISON_RACCT);
4771c34bbd2aSEdward Tomasz Napierala 	}
4772c34bbd2aSEdward Tomasz Napierala }
4773c34bbd2aSEdward Tomasz Napierala 
4774a7ad07bfSEdward Tomasz Napierala void
4775a7ad07bfSEdward Tomasz Napierala prison_racct_free(struct prison_racct *prr)
4776a7ad07bfSEdward Tomasz Napierala {
4777a7ad07bfSEdward Tomasz Napierala 
47784b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
4779c34bbd2aSEdward Tomasz Napierala 	sx_assert(&allprison_lock, SA_UNLOCKED);
4780c34bbd2aSEdward Tomasz Napierala 
47816ff4688bSMateusz Guzik 	if (refcount_release_if_not_last(&prr->prr_refcount))
4782a7ad07bfSEdward Tomasz Napierala 		return;
4783a7ad07bfSEdward Tomasz Napierala 
4784a7ad07bfSEdward Tomasz Napierala 	sx_xlock(&allprison_lock);
4785c34bbd2aSEdward Tomasz Napierala 	prison_racct_free_locked(prr);
4786a7ad07bfSEdward Tomasz Napierala 	sx_xunlock(&allprison_lock);
4787a7ad07bfSEdward Tomasz Napierala }
4788a7ad07bfSEdward Tomasz Napierala 
4789a7ad07bfSEdward Tomasz Napierala static void
4790a7ad07bfSEdward Tomasz Napierala prison_racct_attach(struct prison *pr)
4791a7ad07bfSEdward Tomasz Napierala {
4792a7ad07bfSEdward Tomasz Napierala 	struct prison_racct *prr;
4793a7ad07bfSEdward Tomasz Napierala 
47944b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
4795c34bbd2aSEdward Tomasz Napierala 	sx_assert(&allprison_lock, SA_XLOCKED);
4796c34bbd2aSEdward Tomasz Napierala 
4797a7ad07bfSEdward Tomasz Napierala 	prr = prison_racct_find_locked(pr->pr_name);
4798a7ad07bfSEdward Tomasz Napierala 	KASSERT(prr != NULL, ("cannot find prison_racct"));
4799a7ad07bfSEdward Tomasz Napierala 
4800a7ad07bfSEdward Tomasz Napierala 	pr->pr_prison_racct = prr;
4801a7ad07bfSEdward Tomasz Napierala }
4802a7ad07bfSEdward Tomasz Napierala 
4803c34bbd2aSEdward Tomasz Napierala /*
4804c34bbd2aSEdward Tomasz Napierala  * Handle jail renaming.  From the racct point of view, renaming means
4805c34bbd2aSEdward Tomasz Napierala  * moving from one prison_racct to another.
4806c34bbd2aSEdward Tomasz Napierala  */
4807c34bbd2aSEdward Tomasz Napierala static void
4808c34bbd2aSEdward Tomasz Napierala prison_racct_modify(struct prison *pr)
4809c34bbd2aSEdward Tomasz Napierala {
4810dbadb015SKonstantin Belousov #ifdef RCTL
4811c34bbd2aSEdward Tomasz Napierala 	struct proc *p;
4812c34bbd2aSEdward Tomasz Napierala 	struct ucred *cred;
4813dbadb015SKonstantin Belousov #endif
4814c34bbd2aSEdward Tomasz Napierala 	struct prison_racct *oldprr;
4815c34bbd2aSEdward Tomasz Napierala 
48164b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
48174b5c9cf6SEdward Tomasz Napierala 
4818c34bbd2aSEdward Tomasz Napierala 	sx_slock(&allproc_lock);
4819c34bbd2aSEdward Tomasz Napierala 	sx_xlock(&allprison_lock);
4820c34bbd2aSEdward Tomasz Napierala 
4821e30345e7SEdward Tomasz Napierala 	if (strcmp(pr->pr_name, pr->pr_prison_racct->prr_name) == 0) {
4822e30345e7SEdward Tomasz Napierala 		sx_xunlock(&allprison_lock);
4823e30345e7SEdward Tomasz Napierala 		sx_sunlock(&allproc_lock);
4824c34bbd2aSEdward Tomasz Napierala 		return;
4825e30345e7SEdward Tomasz Napierala 	}
4826c34bbd2aSEdward Tomasz Napierala 
4827c34bbd2aSEdward Tomasz Napierala 	oldprr = pr->pr_prison_racct;
4828c34bbd2aSEdward Tomasz Napierala 	pr->pr_prison_racct = NULL;
4829c34bbd2aSEdward Tomasz Napierala 
4830c34bbd2aSEdward Tomasz Napierala 	prison_racct_attach(pr);
4831c34bbd2aSEdward Tomasz Napierala 
4832c34bbd2aSEdward Tomasz Napierala 	/*
4833c34bbd2aSEdward Tomasz Napierala 	 * Move resource utilisation records.
4834c34bbd2aSEdward Tomasz Napierala 	 */
4835c34bbd2aSEdward Tomasz Napierala 	racct_move(pr->pr_prison_racct->prr_racct, oldprr->prr_racct);
4836c34bbd2aSEdward Tomasz Napierala 
4837f87beb93SAndriy Gapon #ifdef RCTL
4838c34bbd2aSEdward Tomasz Napierala 	/*
4839c34bbd2aSEdward Tomasz Napierala 	 * Force rctl to reattach rules to processes.
4840c34bbd2aSEdward Tomasz Napierala 	 */
4841c34bbd2aSEdward Tomasz Napierala 	FOREACH_PROC_IN_SYSTEM(p) {
4842c34bbd2aSEdward Tomasz Napierala 		PROC_LOCK(p);
4843c34bbd2aSEdward Tomasz Napierala 		cred = crhold(p->p_ucred);
4844c34bbd2aSEdward Tomasz Napierala 		PROC_UNLOCK(p);
4845f87beb93SAndriy Gapon 		rctl_proc_ucred_changed(p, cred);
4846c34bbd2aSEdward Tomasz Napierala 		crfree(cred);
4847c34bbd2aSEdward Tomasz Napierala 	}
4848f87beb93SAndriy Gapon #endif
4849c34bbd2aSEdward Tomasz Napierala 
4850c34bbd2aSEdward Tomasz Napierala 	sx_sunlock(&allproc_lock);
4851c34bbd2aSEdward Tomasz Napierala 	prison_racct_free_locked(oldprr);
4852c34bbd2aSEdward Tomasz Napierala 	sx_xunlock(&allprison_lock);
4853c34bbd2aSEdward Tomasz Napierala }
4854c34bbd2aSEdward Tomasz Napierala 
4855a7ad07bfSEdward Tomasz Napierala static void
4856a7ad07bfSEdward Tomasz Napierala prison_racct_detach(struct prison *pr)
4857a7ad07bfSEdward Tomasz Napierala {
4858c34bbd2aSEdward Tomasz Napierala 
48594b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
4860c34bbd2aSEdward Tomasz Napierala 	sx_assert(&allprison_lock, SA_UNLOCKED);
4861c34bbd2aSEdward Tomasz Napierala 
4862af3c786cSMateusz Guzik 	if (pr->pr_prison_racct == NULL)
4863af3c786cSMateusz Guzik 		return;
4864a7ad07bfSEdward Tomasz Napierala 	prison_racct_free(pr->pr_prison_racct);
4865a7ad07bfSEdward Tomasz Napierala 	pr->pr_prison_racct = NULL;
4866a7ad07bfSEdward Tomasz Napierala }
4867a7ad07bfSEdward Tomasz Napierala #endif /* RACCT */
4868a7ad07bfSEdward Tomasz Napierala 
4869413628a7SBjoern A. Zeeb #ifdef DDB
4870b38ff370SJamie Gritton 
4871b38ff370SJamie Gritton static void
4872b38ff370SJamie Gritton db_show_prison(struct prison *pr)
4873413628a7SBjoern A. Zeeb {
4874672756aaSJamie Gritton 	struct bool_flags *bf;
4875672756aaSJamie Gritton 	struct jailsys_flags *jsf;
4876b38ff370SJamie Gritton #if defined(INET) || defined(INET6)
4877b38ff370SJamie Gritton 	int ii;
4878413628a7SBjoern A. Zeeb #endif
4879672756aaSJamie Gritton 	unsigned f;
48808144690aSEric van Gyzen #ifdef INET
48818144690aSEric van Gyzen 	char ip4buf[INET_ADDRSTRLEN];
48828144690aSEric van Gyzen #endif
4883413628a7SBjoern A. Zeeb #ifdef INET6
4884413628a7SBjoern A. Zeeb 	char ip6buf[INET6_ADDRSTRLEN];
4885413628a7SBjoern A. Zeeb #endif
4886413628a7SBjoern A. Zeeb 
4887b38ff370SJamie Gritton 	db_printf("prison %p:\n", pr);
4888b38ff370SJamie Gritton 	db_printf(" jid             = %d\n", pr->pr_id);
4889b38ff370SJamie Gritton 	db_printf(" name            = %s\n", pr->pr_name);
48900304c731SJamie Gritton 	db_printf(" parent          = %p\n", pr->pr_parent);
4891b38ff370SJamie Gritton 	db_printf(" ref             = %d\n", pr->pr_ref);
4892b38ff370SJamie Gritton 	db_printf(" uref            = %d\n", pr->pr_uref);
48931158508aSJamie Gritton 	db_printf(" state           = %s\n",
48941158508aSJamie Gritton 	    pr->pr_state == PRISON_STATE_ALIVE ? "alive" :
48951158508aSJamie Gritton 	    pr->pr_state == PRISON_STATE_DYING ? "dying" :
48961158508aSJamie Gritton 	    "invalid");
4897b38ff370SJamie Gritton 	db_printf(" path            = %s\n", pr->pr_path);
4898b38ff370SJamie Gritton 	db_printf(" cpuset          = %d\n", pr->pr_cpuset
4899b38ff370SJamie Gritton 	    ? pr->pr_cpuset->cs_id : -1);
4900679e1390SJamie Gritton #ifdef VIMAGE
4901679e1390SJamie Gritton 	db_printf(" vnet            = %p\n", pr->pr_vnet);
4902679e1390SJamie Gritton #endif
4903b38ff370SJamie Gritton 	db_printf(" root            = %p\n", pr->pr_root);
4904b38ff370SJamie Gritton 	db_printf(" securelevel     = %d\n", pr->pr_securelevel);
49050cc207a6SMartin Matuska 	db_printf(" devfs_rsnum     = %d\n", pr->pr_devfs_rsnum);
4906fe0518e9SBjoern A. Zeeb 	db_printf(" children.max    = %d\n", pr->pr_childmax);
4907fe0518e9SBjoern A. Zeeb 	db_printf(" children.cur    = %d\n", pr->pr_childcount);
49080304c731SJamie Gritton 	db_printf(" child           = %p\n", LIST_FIRST(&pr->pr_children));
49090304c731SJamie Gritton 	db_printf(" sibling         = %p\n", LIST_NEXT(pr, pr_sibling));
4910fe0518e9SBjoern A. Zeeb 	db_printf(" flags           = 0x%x", pr->pr_flags);
4911672756aaSJamie Gritton 	for (bf = pr_flag_bool; bf < pr_flag_bool + nitems(pr_flag_bool); bf++)
4912672756aaSJamie Gritton 		if (pr->pr_flags & bf->flag)
4913672756aaSJamie Gritton 			db_printf(" %s", bf->name);
4914672756aaSJamie Gritton 	for (jsf = pr_flag_jailsys;
4915672756aaSJamie Gritton 	     jsf < pr_flag_jailsys + nitems(pr_flag_jailsys);
4916672756aaSJamie Gritton 	     jsf++) {
4917672756aaSJamie Gritton 		f = pr->pr_flags & (jsf->disable | jsf->new);
4918672756aaSJamie Gritton 		db_printf(" %-16s= %s\n", jsf->name,
4919672756aaSJamie Gritton 		    (f != 0 && f == jsf->disable) ? "disable"
4920672756aaSJamie Gritton 		    : (f == jsf->new) ? "new"
49217cbf7213SJamie Gritton 		    : "inherit");
49227cbf7213SJamie Gritton 	}
4923fe0518e9SBjoern A. Zeeb 	db_printf(" allow           = 0x%x", pr->pr_allow);
4924672756aaSJamie Gritton 	for (bf = pr_flag_allow;
49255d58f959SJamie Gritton 	     bf < pr_flag_allow + nitems(pr_flag_allow) &&
49265d58f959SJamie Gritton 		atomic_load_int(&bf->flag) != 0;
4927672756aaSJamie Gritton 	     bf++)
4928672756aaSJamie Gritton 		if (pr->pr_allow & bf->flag)
4929672756aaSJamie Gritton 			db_printf(" %s", bf->name);
4930b38ff370SJamie Gritton 	db_printf("\n");
49310304c731SJamie Gritton 	db_printf(" enforce_statfs  = %d\n", pr->pr_enforce_statfs);
4932c1f19219SJamie Gritton 	db_printf(" host.hostname   = %s\n", pr->pr_hostname);
4933c1f19219SJamie Gritton 	db_printf(" host.domainname = %s\n", pr->pr_domainname);
4934c1f19219SJamie Gritton 	db_printf(" host.hostuuid   = %s\n", pr->pr_hostuuid);
493576ca6f88SJamie Gritton 	db_printf(" host.hostid     = %lu\n", pr->pr_hostid);
4936413628a7SBjoern A. Zeeb #ifdef INET
4937eb8dcdeaSGleb Smirnoff 	if (pr->pr_addrs[PR_INET] != NULL) {
4938eb8dcdeaSGleb Smirnoff 		pr_family_t af = PR_INET;
4939eb8dcdeaSGleb Smirnoff 
4940eb8dcdeaSGleb Smirnoff 		db_printf(" ip4s            = %d\n", pr->pr_addrs[af]->ips);
4941eb8dcdeaSGleb Smirnoff 		for (ii = 0; ii < pr->pr_addrs[af]->ips; ii++)
4942b38ff370SJamie Gritton 			db_printf(" %s %s\n",
4943fe0518e9SBjoern A. Zeeb 			    ii == 0 ? "ip4.addr        =" : "                 ",
4944eb8dcdeaSGleb Smirnoff 			    inet_ntoa_r(
494521ad3e27SZhenlei Huang 			    *(const struct in_addr *)PR_IP(pr->pr_addrs[af], ii),
4946eb8dcdeaSGleb Smirnoff 			    ip4buf));
4947eb8dcdeaSGleb Smirnoff 	}
4948413628a7SBjoern A. Zeeb #endif
4949413628a7SBjoern A. Zeeb #ifdef INET6
4950eb8dcdeaSGleb Smirnoff 	if (pr->pr_addrs[PR_INET6] != NULL) {
4951eb8dcdeaSGleb Smirnoff 		pr_family_t af = PR_INET6;
4952eb8dcdeaSGleb Smirnoff 
4953eb8dcdeaSGleb Smirnoff 		db_printf(" ip6s            = %d\n", pr->pr_addrs[af]->ips);
4954eb8dcdeaSGleb Smirnoff 		for (ii = 0; ii < pr->pr_addrs[af]->ips; ii++)
4955b38ff370SJamie Gritton 			db_printf(" %s %s\n",
4956fe0518e9SBjoern A. Zeeb 			    ii == 0 ? "ip6.addr        =" : "                 ",
4957eb8dcdeaSGleb Smirnoff 			    ip6_sprintf(ip6buf,
495821ad3e27SZhenlei Huang 			    (const struct in6_addr *)PR_IP(pr->pr_addrs[af], ii)));
4959eb8dcdeaSGleb Smirnoff 	}
4960b38ff370SJamie Gritton #endif
4961b38ff370SJamie Gritton }
4962b38ff370SJamie Gritton 
4963b38ff370SJamie Gritton DB_SHOW_COMMAND(prison, db_show_prison_command)
4964b38ff370SJamie Gritton {
4965b38ff370SJamie Gritton 	struct prison *pr;
4966b38ff370SJamie Gritton 
4967b38ff370SJamie Gritton 	if (!have_addr) {
49680304c731SJamie Gritton 		/*
49690304c731SJamie Gritton 		 * Show all prisons in the list, and prison0 which is not
49700304c731SJamie Gritton 		 * listed.
49710304c731SJamie Gritton 		 */
49720304c731SJamie Gritton 		db_show_prison(&prison0);
49730304c731SJamie Gritton 		if (!db_pager_quit) {
4974b38ff370SJamie Gritton 			TAILQ_FOREACH(pr, &allprison, pr_list) {
4975b38ff370SJamie Gritton 				db_show_prison(pr);
4976413628a7SBjoern A. Zeeb 				if (db_pager_quit)
4977413628a7SBjoern A. Zeeb 					break;
4978413628a7SBjoern A. Zeeb 			}
49790304c731SJamie Gritton 		}
4980b38ff370SJamie Gritton 		return;
4981413628a7SBjoern A. Zeeb 	}
4982b38ff370SJamie Gritton 
49830304c731SJamie Gritton 	if (addr == 0)
49840304c731SJamie Gritton 		pr = &prison0;
49850304c731SJamie Gritton 	else {
4986b38ff370SJamie Gritton 		/* Look for a prison with the ID and with references. */
4987b38ff370SJamie Gritton 		TAILQ_FOREACH(pr, &allprison, pr_list)
4988b38ff370SJamie Gritton 			if (pr->pr_id == addr && pr->pr_ref > 0)
4989b38ff370SJamie Gritton 				break;
4990b38ff370SJamie Gritton 		if (pr == NULL)
4991b38ff370SJamie Gritton 			/* Look again, without requiring a reference. */
4992b38ff370SJamie Gritton 			TAILQ_FOREACH(pr, &allprison, pr_list)
4993b38ff370SJamie Gritton 				if (pr->pr_id == addr)
4994b38ff370SJamie Gritton 					break;
4995b38ff370SJamie Gritton 		if (pr == NULL)
4996b38ff370SJamie Gritton 			/* Assume address points to a valid prison. */
4997b38ff370SJamie Gritton 			pr = (struct prison *)addr;
49980304c731SJamie Gritton 	}
4999b38ff370SJamie Gritton 	db_show_prison(pr);
5000b38ff370SJamie Gritton }
5001b38ff370SJamie Gritton 
5002413628a7SBjoern A. Zeeb #endif /* DDB */
5003