19454b2d8SWarner Losh /*- 28a36da99SPedro F. Giffuni * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 38a36da99SPedro F. Giffuni * 4413628a7SBjoern A. Zeeb * Copyright (c) 1999 Poul-Henning Kamp. 5413628a7SBjoern A. Zeeb * Copyright (c) 2008 Bjoern A. Zeeb. 6b38ff370SJamie Gritton * Copyright (c) 2009 James Gritton. 7413628a7SBjoern A. Zeeb * All rights reserved. 8b9f0b66cSBjoern A. Zeeb * 9b9f0b66cSBjoern A. Zeeb * Redistribution and use in source and binary forms, with or without 10b9f0b66cSBjoern A. Zeeb * modification, are permitted provided that the following conditions 11b9f0b66cSBjoern A. Zeeb * are met: 12b9f0b66cSBjoern A. Zeeb * 1. Redistributions of source code must retain the above copyright 13b9f0b66cSBjoern A. Zeeb * notice, this list of conditions and the following disclaimer. 14b9f0b66cSBjoern A. Zeeb * 2. Redistributions in binary form must reproduce the above copyright 15b9f0b66cSBjoern A. Zeeb * notice, this list of conditions and the following disclaimer in the 16b9f0b66cSBjoern A. Zeeb * documentation and/or other materials provided with the distribution. 17b9f0b66cSBjoern A. Zeeb * 18b9f0b66cSBjoern A. Zeeb * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 19b9f0b66cSBjoern A. Zeeb * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20b9f0b66cSBjoern A. Zeeb * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21b9f0b66cSBjoern A. Zeeb * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 22b9f0b66cSBjoern A. Zeeb * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23b9f0b66cSBjoern A. Zeeb * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24b9f0b66cSBjoern A. Zeeb * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25b9f0b66cSBjoern A. Zeeb * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26b9f0b66cSBjoern A. Zeeb * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27b9f0b66cSBjoern A. Zeeb * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28b9f0b66cSBjoern A. Zeeb * SUCH DAMAGE. 2907901f22SPoul-Henning Kamp */ 3075c13541SPoul-Henning Kamp 31677b542eSDavid E. O'Brien #include <sys/cdefs.h> 32677b542eSDavid E. O'Brien __FBSDID("$FreeBSD$"); 33677b542eSDavid E. O'Brien 34413628a7SBjoern A. Zeeb #include "opt_ddb.h" 35413628a7SBjoern A. Zeeb #include "opt_inet.h" 36413628a7SBjoern A. Zeeb #include "opt_inet6.h" 37bba7a2e8SRick Macklem #include "opt_nfs.h" 3846e3b1cbSPawel Jakub Dawidek 3975c13541SPoul-Henning Kamp #include <sys/param.h> 4075c13541SPoul-Henning Kamp #include <sys/types.h> 4175c13541SPoul-Henning Kamp #include <sys/kernel.h> 4275c13541SPoul-Henning Kamp #include <sys/systm.h> 4375c13541SPoul-Henning Kamp #include <sys/errno.h> 4475c13541SPoul-Henning Kamp #include <sys/sysproto.h> 4575c13541SPoul-Henning Kamp #include <sys/malloc.h> 460304c731SJamie Gritton #include <sys/osd.h> 47800c9408SRobert Watson #include <sys/priv.h> 4875c13541SPoul-Henning Kamp #include <sys/proc.h> 49eb8dcdeaSGleb Smirnoff #include <sys/epoch.h> 50b3059e09SRobert Watson #include <sys/taskqueue.h> 5157b4252eSKonstantin Belousov #include <sys/fcntl.h> 5275c13541SPoul-Henning Kamp #include <sys/jail.h> 53c3188289SKyle Evans #include <sys/linker.h> 5401137630SRobert Watson #include <sys/lock.h> 557060da62SJamie Gritton #include <sys/mman.h> 5601137630SRobert Watson #include <sys/mutex.h> 57097055e2SEdward Tomasz Napierala #include <sys/racct.h> 58f87beb93SAndriy Gapon #include <sys/rctl.h> 59a7ad07bfSEdward Tomasz Napierala #include <sys/refcount.h> 60dc68a633SPawel Jakub Dawidek #include <sys/sx.h> 6176ca6f88SJamie Gritton #include <sys/sysent.h> 62fd7a8150SMike Barcroft #include <sys/namei.h> 63820a0de9SPawel Jakub Dawidek #include <sys/mount.h> 64fd7a8150SMike Barcroft #include <sys/queue.h> 6575c13541SPoul-Henning Kamp #include <sys/socket.h> 66fd7a8150SMike Barcroft #include <sys/syscallsubr.h> 6783f1e257SRobert Watson #include <sys/sysctl.h> 68c3188289SKyle Evans #include <sys/uuid.h> 69fd7a8150SMike Barcroft #include <sys/vnode.h> 70530c0060SRobert Watson 7175c13541SPoul-Henning Kamp #include <net/if.h> 72530c0060SRobert Watson #include <net/vnet.h> 73530c0060SRobert Watson 7475c13541SPoul-Henning Kamp #include <netinet/in.h> 75530c0060SRobert Watson 76413628a7SBjoern A. Zeeb #ifdef DDB 77413628a7SBjoern A. Zeeb #include <ddb/ddb.h> 78413628a7SBjoern A. Zeeb #endif /* DDB */ 7975c13541SPoul-Henning Kamp 80aed55708SRobert Watson #include <security/mac/mac_framework.h> 81aed55708SRobert Watson 82c3188289SKyle Evans #define PRISON0_HOSTUUID_MODULE "hostuuid" 838986e3a0SJamie Gritton 8475c13541SPoul-Henning Kamp MALLOC_DEFINE(M_PRISON, "prison", "Prison structures"); 85d745c852SEd Schouten static MALLOC_DEFINE(M_PRISON_RACCT, "prison_racct", "Prison racct structures"); 8675c13541SPoul-Henning Kamp 87592bcae8SBjoern A. Zeeb /* Keep struct prison prison0 and some code in kern_jail_set() readable. */ 88592bcae8SBjoern A. Zeeb #ifdef INET 89592bcae8SBjoern A. Zeeb #ifdef INET6 90592bcae8SBjoern A. Zeeb #define _PR_IP_SADDRSEL PR_IP4_SADDRSEL|PR_IP6_SADDRSEL 91592bcae8SBjoern A. Zeeb #else 92592bcae8SBjoern A. Zeeb #define _PR_IP_SADDRSEL PR_IP4_SADDRSEL 93592bcae8SBjoern A. Zeeb #endif 94592bcae8SBjoern A. Zeeb #else /* !INET */ 95592bcae8SBjoern A. Zeeb #ifdef INET6 96592bcae8SBjoern A. Zeeb #define _PR_IP_SADDRSEL PR_IP6_SADDRSEL 97592bcae8SBjoern A. Zeeb #else 98592bcae8SBjoern A. Zeeb #define _PR_IP_SADDRSEL 0 99592bcae8SBjoern A. Zeeb #endif 100592bcae8SBjoern A. Zeeb #endif 101592bcae8SBjoern A. Zeeb 1020304c731SJamie Gritton /* prison0 describes what is "real" about the system. */ 1030304c731SJamie Gritton struct prison prison0 = { 1040304c731SJamie Gritton .pr_id = 0, 1050304c731SJamie Gritton .pr_name = "0", 1060304c731SJamie Gritton .pr_ref = 1, 1070304c731SJamie Gritton .pr_uref = 1, 1080304c731SJamie Gritton .pr_path = "/", 1090304c731SJamie Gritton .pr_securelevel = -1, 1100cc207a6SMartin Matuska .pr_devfs_rsnum = 0, 1111158508aSJamie Gritton .pr_state = PRISON_STATE_ALIVE, 112b97457e2SJamie Gritton .pr_childmax = JAIL_MAX, 1138986e3a0SJamie Gritton .pr_hostuuid = DEFAULT_HOSTUUID, 11413e403fdSAntoine Brodin .pr_children = LIST_HEAD_INITIALIZER(prison0.pr_children), 115eb79e1c7SBjoern A. Zeeb #ifdef VIMAGE 116592bcae8SBjoern A. Zeeb .pr_flags = PR_HOST|PR_VNET|_PR_IP_SADDRSEL, 117eb79e1c7SBjoern A. Zeeb #else 118592bcae8SBjoern A. Zeeb .pr_flags = PR_HOST|_PR_IP_SADDRSEL, 119eb79e1c7SBjoern A. Zeeb #endif 1200e5c6bd4SJamie Gritton .pr_allow = PR_ALLOW_ALL_STATIC, 1210304c731SJamie Gritton }; 1220304c731SJamie Gritton MTX_SYSINIT(prison0, &prison0.pr_mtx, "jail mutex", MTX_DEF); 12383f1e257SRobert Watson 124672756aaSJamie Gritton struct bool_flags { 125672756aaSJamie Gritton const char *name; 126672756aaSJamie Gritton const char *noname; 1275d58f959SJamie Gritton volatile u_int flag; 128672756aaSJamie Gritton }; 129672756aaSJamie Gritton struct jailsys_flags { 130672756aaSJamie Gritton const char *name; 131672756aaSJamie Gritton unsigned disable; 132672756aaSJamie Gritton unsigned new; 133672756aaSJamie Gritton }; 134672756aaSJamie Gritton 135a7ad07bfSEdward Tomasz Napierala /* allprison, allprison_racct and lastprid are protected by allprison_lock. */ 136dc68a633SPawel Jakub Dawidek struct sx allprison_lock; 137b38ff370SJamie Gritton SX_SYSINIT(allprison_lock, &allprison_lock, "allprison"); 138b38ff370SJamie Gritton struct prisonlist allprison = TAILQ_HEAD_INITIALIZER(allprison); 139a7ad07bfSEdward Tomasz Napierala LIST_HEAD(, prison_racct) allprison_racct; 1402110d913SXin LI int lastprid = 0; 141fd7a8150SMike Barcroft 1427de883c8SJamie Gritton static int get_next_prid(struct prison **insprp); 143f7496dcaSJamie Gritton static int do_jail_attach(struct thread *td, struct prison *pr, int drflags); 144b3059e09SRobert Watson static void prison_complete(void *context, int pending); 145b38ff370SJamie Gritton static void prison_deref(struct prison *pr, int flags); 146c861373bSJamie Gritton static void prison_deref_kill(struct prison *pr, struct prisonlist *freeprison); 147f7496dcaSJamie Gritton static int prison_lock_xlock(struct prison *pr, int flags); 148a9f7455cSJamie Gritton static void prison_cleanup(struct prison *pr); 149f7496dcaSJamie Gritton static void prison_free_not_last(struct prison *pr); 150c861373bSJamie Gritton static void prison_proc_free_not_last(struct prison *pr); 1515ecb5444SMateusz Guzik static void prison_proc_relink(struct prison *opr, struct prison *npr, 1525ecb5444SMateusz Guzik struct proc *p); 1530fe74ae6SJamie Gritton static void prison_set_allow_locked(struct prison *pr, unsigned flag, 1540fe74ae6SJamie Gritton int enable); 1550304c731SJamie Gritton static char *prison_path(struct prison *pr1, struct prison *pr2); 156a7ad07bfSEdward Tomasz Napierala #ifdef RACCT 157a7ad07bfSEdward Tomasz Napierala static void prison_racct_attach(struct prison *pr); 158c34bbd2aSEdward Tomasz Napierala static void prison_racct_modify(struct prison *pr); 159a7ad07bfSEdward Tomasz Napierala static void prison_racct_detach(struct prison *pr); 160a7ad07bfSEdward Tomasz Napierala #endif 161fd7a8150SMike Barcroft 162b38ff370SJamie Gritton /* Flags for prison_deref */ 1632a4b2251SJamie Gritton #define PD_DEREF 0x01 /* Decrement pr_ref */ 1642a4b2251SJamie Gritton #define PD_DEUREF 0x02 /* Decrement pr_uref */ 165c861373bSJamie Gritton #define PD_KILL 0x04 /* Remove jail, kill processes, etc */ 166c861373bSJamie Gritton #define PD_LOCKED 0x10 /* pr_mtx is held */ 167c861373bSJamie Gritton #define PD_LIST_SLOCKED 0x20 /* allprison_lock is held shared */ 168c861373bSJamie Gritton #define PD_LIST_XLOCKED 0x40 /* allprison_lock is held exclusive */ 169589e4c1dSJamie Gritton #define PD_OP_FLAGS 0x07 /* Operation flags */ 170589e4c1dSJamie Gritton #define PD_LOCK_FLAGS 0x70 /* Lock status flags */ 171fd7a8150SMike Barcroft 1720304c731SJamie Gritton /* 1735cc70397SBjoern A. Zeeb * Parameter names corresponding to PR_* flag values. Size values are for kvm 1745cc70397SBjoern A. Zeeb * as we cannot figure out the size of a sparse array, or an array without a 1755cc70397SBjoern A. Zeeb * terminating entry. 1760304c731SJamie Gritton */ 177672756aaSJamie Gritton static struct bool_flags pr_flag_bool[] = { 178672756aaSJamie Gritton {"persist", "nopersist", PR_PERSIST}, 179592bcae8SBjoern A. Zeeb #ifdef INET 180672756aaSJamie Gritton {"ip4.saddrsel", "ip4.nosaddrsel", PR_IP4_SADDRSEL}, 181592bcae8SBjoern A. Zeeb #endif 182592bcae8SBjoern A. Zeeb #ifdef INET6 183672756aaSJamie Gritton {"ip6.saddrsel", "ip6.nosaddrsel", PR_IP6_SADDRSEL}, 184592bcae8SBjoern A. Zeeb #endif 1850304c731SJamie Gritton }; 186672756aaSJamie Gritton const size_t pr_flag_bool_size = sizeof(pr_flag_bool); 1870304c731SJamie Gritton 188672756aaSJamie Gritton static struct jailsys_flags pr_flag_jailsys[] = { 1897cbf7213SJamie Gritton {"host", 0, PR_HOST}, 1907cbf7213SJamie Gritton #ifdef VIMAGE 1917cbf7213SJamie Gritton {"vnet", 0, PR_VNET}, 1927cbf7213SJamie Gritton #endif 1930304c731SJamie Gritton #ifdef INET 1946a3f2779SJamie Gritton {"ip4", PR_IP4_USER, PR_IP4_USER}, 1950304c731SJamie Gritton #endif 1960304c731SJamie Gritton #ifdef INET6 1976a3f2779SJamie Gritton {"ip6", PR_IP6_USER, PR_IP6_USER}, 198679e1390SJamie Gritton #endif 1990304c731SJamie Gritton }; 2005cc70397SBjoern A. Zeeb const size_t pr_flag_jailsys_size = sizeof(pr_flag_jailsys); 2010304c731SJamie Gritton 2025d58f959SJamie Gritton /* 2035d58f959SJamie Gritton * Make this array full-size so dynamic parameters can be added. 2045d58f959SJamie Gritton * It is protected by prison0.mtx, but lockless reading is allowed 2055d58f959SJamie Gritton * with an atomic check of the flag values. 2065d58f959SJamie Gritton */ 2070e5c6bd4SJamie Gritton static struct bool_flags pr_flag_allow[NBBY * NBPW] = { 208672756aaSJamie Gritton {"allow.set_hostname", "allow.noset_hostname", PR_ALLOW_SET_HOSTNAME}, 209672756aaSJamie Gritton {"allow.sysvipc", "allow.nosysvipc", PR_ALLOW_SYSVIPC}, 210672756aaSJamie Gritton {"allow.raw_sockets", "allow.noraw_sockets", PR_ALLOW_RAW_SOCKETS}, 211672756aaSJamie Gritton {"allow.chflags", "allow.nochflags", PR_ALLOW_CHFLAGS}, 212672756aaSJamie Gritton {"allow.mount", "allow.nomount", PR_ALLOW_MOUNT}, 213672756aaSJamie Gritton {"allow.quotas", "allow.noquotas", PR_ALLOW_QUOTAS}, 214672756aaSJamie Gritton {"allow.socket_af", "allow.nosocket_af", PR_ALLOW_SOCKET_AF}, 215ccd6ac9fSAntoine Brodin {"allow.mlock", "allow.nomlock", PR_ALLOW_MLOCK}, 216672756aaSJamie Gritton {"allow.reserved_ports", "allow.noreserved_ports", 217672756aaSJamie Gritton PR_ALLOW_RESERVED_PORTS}, 218b19d66fdSJamie Gritton {"allow.read_msgbuf", "allow.noread_msgbuf", PR_ALLOW_READ_MSGBUF}, 219b3079544SJamie Gritton {"allow.unprivileged_proc_debug", "allow.nounprivileged_proc_debug", 220b3079544SJamie Gritton PR_ALLOW_UNPRIV_DEBUG}, 22105e1e482SMariusz Zaborski {"allow.suser", "allow.nosuser", PR_ALLOW_SUSER}, 222bba7a2e8SRick Macklem #if defined(VNET_NFSD) && defined(VIMAGE) && defined(NFSD) 223bba7a2e8SRick Macklem {"allow.nfsd", "allow.nonfsd", PR_ALLOW_NFSD}, 224bba7a2e8SRick Macklem #endif 2250304c731SJamie Gritton }; 2265d58f959SJamie Gritton static unsigned pr_allow_all = PR_ALLOW_ALL_STATIC; 227672756aaSJamie Gritton const size_t pr_flag_allow_size = sizeof(pr_flag_allow); 2280304c731SJamie Gritton 229b3079544SJamie Gritton #define JAIL_DEFAULT_ALLOW (PR_ALLOW_SET_HOSTNAME | \ 230b3079544SJamie Gritton PR_ALLOW_RESERVED_PORTS | \ 23105e1e482SMariusz Zaborski PR_ALLOW_UNPRIV_DEBUG | \ 23205e1e482SMariusz Zaborski PR_ALLOW_SUSER) 23342bebd82SJamie Gritton #define JAIL_DEFAULT_ENFORCE_STATFS 2 234bf3db8aaSMartin Matuska #define JAIL_DEFAULT_DEVFS_RSNUM 0 2350304c731SJamie Gritton static unsigned jail_default_allow = JAIL_DEFAULT_ALLOW; 23642bebd82SJamie Gritton static int jail_default_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS; 2370cc207a6SMartin Matuska static int jail_default_devfs_rsnum = JAIL_DEFAULT_DEVFS_RSNUM; 2380304c731SJamie Gritton #if defined(INET) || defined(INET6) 239e92e0574SJamie Gritton static unsigned jail_max_af_ips = 255; 2400304c731SJamie Gritton #endif 2410304c731SJamie Gritton 242b96bd95bSIan Lepore /* 243b96bd95bSIan Lepore * Initialize the parts of prison0 that can't be static-initialized with 244b96bd95bSIan Lepore * constants. This is called from proc0_init() after creating thread0 cpuset. 245b96bd95bSIan Lepore */ 246b96bd95bSIan Lepore void 247b96bd95bSIan Lepore prison0_init(void) 248b96bd95bSIan Lepore { 249c3188289SKyle Evans uint8_t *file, *data; 250c3188289SKyle Evans size_t size; 251d2ef3774SJessica Clarke char buf[sizeof(prison0.pr_hostuuid)]; 252d2ef3774SJessica Clarke bool valid; 253b96bd95bSIan Lepore 254b96bd95bSIan Lepore prison0.pr_cpuset = cpuset_ref(thread0.td_cpuset); 255b96bd95bSIan Lepore prison0.pr_osreldate = osreldate; 256b96bd95bSIan Lepore strlcpy(prison0.pr_osrelease, osrelease, sizeof(prison0.pr_osrelease)); 257c3188289SKyle Evans 258c3188289SKyle Evans /* If we have a preloaded hostuuid, use it. */ 259c3188289SKyle Evans file = preload_search_by_type(PRISON0_HOSTUUID_MODULE); 260c3188289SKyle Evans if (file != NULL) { 261c3188289SKyle Evans data = preload_fetch_addr(file); 262c3188289SKyle Evans size = preload_fetch_size(file); 263c3188289SKyle Evans if (data != NULL) { 264c3188289SKyle Evans /* 265c3188289SKyle Evans * The preloaded data may include trailing whitespace, almost 266c3188289SKyle Evans * certainly a newline; skip over any whitespace or 267c3188289SKyle Evans * non-printable characters to be safe. 268c3188289SKyle Evans */ 269c3188289SKyle Evans while (size > 0 && data[size - 1] <= 0x20) { 270b6be9566SColin Percival size--; 271c3188289SKyle Evans } 272d2ef3774SJessica Clarke 273d2ef3774SJessica Clarke valid = false; 274d2ef3774SJessica Clarke 275d2ef3774SJessica Clarke /* 276d2ef3774SJessica Clarke * Not NUL-terminated when passed from loader, but 277d2ef3774SJessica Clarke * validate_uuid requires that due to using sscanf (as 278d2ef3774SJessica Clarke * does the subsequent strlcpy, since it still reads 279d2ef3774SJessica Clarke * past the given size to return the true length); 280d2ef3774SJessica Clarke * bounce to a temporary buffer to fix. 281d2ef3774SJessica Clarke */ 282d2ef3774SJessica Clarke if (size >= sizeof(buf)) 283d2ef3774SJessica Clarke goto done; 284d2ef3774SJessica Clarke 285d2ef3774SJessica Clarke memcpy(buf, data, size); 286d2ef3774SJessica Clarke buf[size] = '\0'; 287d2ef3774SJessica Clarke 288d2ef3774SJessica Clarke if (validate_uuid(buf, size, NULL, 0) != 0) 289d2ef3774SJessica Clarke goto done; 290d2ef3774SJessica Clarke 291d2ef3774SJessica Clarke valid = true; 292d2ef3774SJessica Clarke (void)strlcpy(prison0.pr_hostuuid, buf, 293d2ef3774SJessica Clarke sizeof(prison0.pr_hostuuid)); 294d2ef3774SJessica Clarke 295d2ef3774SJessica Clarke done: 296d2ef3774SJessica Clarke if (bootverbose && !valid) { 297330f110bSColin Percival printf("hostuuid: preload data malformed: '%.*s'\n", 298330f110bSColin Percival (int)size, data); 299c3188289SKyle Evans } 300c3188289SKyle Evans } 301c3188289SKyle Evans } 302c3188289SKyle Evans if (bootverbose) 303c3188289SKyle Evans printf("hostuuid: using %s\n", prison0.pr_hostuuid); 304b96bd95bSIan Lepore } 305b96bd95bSIan Lepore 306116734c4SMatthew Dillon /* 3079ddb7954SMike Barcroft * struct jail_args { 3089ddb7954SMike Barcroft * struct jail *jail; 3099ddb7954SMike Barcroft * }; 310116734c4SMatthew Dillon */ 31175c13541SPoul-Henning Kamp int 312c542c43eSJamie Gritton sys_jail(struct thread *td, struct jail_args *uap) 31375c13541SPoul-Henning Kamp { 314413628a7SBjoern A. Zeeb uint32_t version; 315413628a7SBjoern A. Zeeb int error; 3160304c731SJamie Gritton struct jail j; 317413628a7SBjoern A. Zeeb 318413628a7SBjoern A. Zeeb error = copyin(uap->jail, &version, sizeof(uint32_t)); 319413628a7SBjoern A. Zeeb if (error) 320413628a7SBjoern A. Zeeb return (error); 321413628a7SBjoern A. Zeeb 322413628a7SBjoern A. Zeeb switch (version) { 323413628a7SBjoern A. Zeeb case 0: 324413628a7SBjoern A. Zeeb { 325413628a7SBjoern A. Zeeb struct jail_v0 j0; 326413628a7SBjoern A. Zeeb 3270304c731SJamie Gritton /* FreeBSD single IPv4 jails. */ 3280304c731SJamie Gritton bzero(&j, sizeof(struct jail)); 329413628a7SBjoern A. Zeeb error = copyin(uap->jail, &j0, sizeof(struct jail_v0)); 330413628a7SBjoern A. Zeeb if (error) 331413628a7SBjoern A. Zeeb return (error); 3320304c731SJamie Gritton j.version = j0.version; 3330304c731SJamie Gritton j.path = j0.path; 3340304c731SJamie Gritton j.hostname = j0.hostname; 335b5019bc4SPeter Wemm j.ip4s = htonl(j0.ip_number); /* jail_v0 is host order */ 336413628a7SBjoern A. Zeeb break; 337413628a7SBjoern A. Zeeb } 338413628a7SBjoern A. Zeeb 339413628a7SBjoern A. Zeeb case 1: 340413628a7SBjoern A. Zeeb /* 341413628a7SBjoern A. Zeeb * Version 1 was used by multi-IPv4 jail implementations 342413628a7SBjoern A. Zeeb * that never made it into the official kernel. 343413628a7SBjoern A. Zeeb */ 344413628a7SBjoern A. Zeeb return (EINVAL); 345413628a7SBjoern A. Zeeb 346413628a7SBjoern A. Zeeb case 2: /* JAIL_API_VERSION */ 347413628a7SBjoern A. Zeeb /* FreeBSD multi-IPv4/IPv6,noIP jails. */ 348413628a7SBjoern A. Zeeb error = copyin(uap->jail, &j, sizeof(struct jail)); 349413628a7SBjoern A. Zeeb if (error) 350413628a7SBjoern A. Zeeb return (error); 3510304c731SJamie Gritton break; 3520304c731SJamie Gritton 3530304c731SJamie Gritton default: 3540304c731SJamie Gritton /* Sci-Fi jails are not supported, sorry. */ 3550304c731SJamie Gritton return (EINVAL); 3560304c731SJamie Gritton } 357c542c43eSJamie Gritton return (kern_jail(td, &j)); 3580304c731SJamie Gritton } 3590304c731SJamie Gritton 3600304c731SJamie Gritton int 361c542c43eSJamie Gritton kern_jail(struct thread *td, struct jail *j) 3620304c731SJamie Gritton { 363c542c43eSJamie Gritton struct iovec optiov[2 * (4 + nitems(pr_flag_allow) 364e92e0574SJamie Gritton #ifdef INET 365e92e0574SJamie Gritton + 1 366e92e0574SJamie Gritton #endif 367e92e0574SJamie Gritton #ifdef INET6 368e92e0574SJamie Gritton + 1 369e92e0574SJamie Gritton #endif 370e92e0574SJamie Gritton )]; 3710304c731SJamie Gritton struct uio opt; 3720304c731SJamie Gritton char *u_path, *u_hostname, *u_name; 373672756aaSJamie Gritton struct bool_flags *bf; 3740304c731SJamie Gritton #ifdef INET 375e92e0574SJamie Gritton uint32_t ip4s; 3760304c731SJamie Gritton struct in_addr *u_ip4; 3770304c731SJamie Gritton #endif 3780304c731SJamie Gritton #ifdef INET6 3790304c731SJamie Gritton struct in6_addr *u_ip6; 3800304c731SJamie Gritton #endif 3810304c731SJamie Gritton size_t tmplen; 382c542c43eSJamie Gritton int error, enforce_statfs; 3830304c731SJamie Gritton 3840304c731SJamie Gritton bzero(&optiov, sizeof(optiov)); 3850304c731SJamie Gritton opt.uio_iov = optiov; 3860304c731SJamie Gritton opt.uio_iovcnt = 0; 3870304c731SJamie Gritton opt.uio_offset = -1; 3880304c731SJamie Gritton opt.uio_resid = -1; 3890304c731SJamie Gritton opt.uio_segflg = UIO_SYSSPACE; 3900304c731SJamie Gritton opt.uio_rw = UIO_READ; 3910304c731SJamie Gritton opt.uio_td = td; 3920304c731SJamie Gritton 3930304c731SJamie Gritton /* Set permissions for top-level jails from sysctls. */ 3940304c731SJamie Gritton if (!jailed(td->td_ucred)) { 395672756aaSJamie Gritton for (bf = pr_flag_allow; 3960e5c6bd4SJamie Gritton bf < pr_flag_allow + nitems(pr_flag_allow) && 3975d58f959SJamie Gritton atomic_load_int(&bf->flag) != 0; 398672756aaSJamie Gritton bf++) { 399672756aaSJamie Gritton optiov[opt.uio_iovcnt].iov_base = __DECONST(char *, 400672756aaSJamie Gritton (jail_default_allow & bf->flag) 401672756aaSJamie Gritton ? bf->name : bf->noname); 4020304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = 4030304c731SJamie Gritton strlen(optiov[opt.uio_iovcnt].iov_base) + 1; 4040304c731SJamie Gritton opt.uio_iovcnt += 2; 4050304c731SJamie Gritton } 4060304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "enforce_statfs"; 4070304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("enforce_statfs"); 4080304c731SJamie Gritton opt.uio_iovcnt++; 4090304c731SJamie Gritton enforce_statfs = jail_default_enforce_statfs; 4100304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = &enforce_statfs; 4110304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof(enforce_statfs); 4120304c731SJamie Gritton opt.uio_iovcnt++; 4130304c731SJamie Gritton } 4140304c731SJamie Gritton 415b38ff370SJamie Gritton tmplen = MAXPATHLEN + MAXHOSTNAMELEN + MAXHOSTNAMELEN; 416b38ff370SJamie Gritton #ifdef INET 4170304c731SJamie Gritton ip4s = (j->version == 0) ? 1 : j->ip4s; 4180304c731SJamie Gritton if (ip4s > jail_max_af_ips) 419b38ff370SJamie Gritton return (EINVAL); 4200304c731SJamie Gritton tmplen += ip4s * sizeof(struct in_addr); 421b38ff370SJamie Gritton #else 4220304c731SJamie Gritton if (j->ip4s > 0) 423b38ff370SJamie Gritton return (EINVAL); 424b38ff370SJamie Gritton #endif 425b38ff370SJamie Gritton #ifdef INET6 4260304c731SJamie Gritton if (j->ip6s > jail_max_af_ips) 427b38ff370SJamie Gritton return (EINVAL); 4280304c731SJamie Gritton tmplen += j->ip6s * sizeof(struct in6_addr); 429b38ff370SJamie Gritton #else 4300304c731SJamie Gritton if (j->ip6s > 0) 431b38ff370SJamie Gritton return (EINVAL); 432b38ff370SJamie Gritton #endif 433b38ff370SJamie Gritton u_path = malloc(tmplen, M_TEMP, M_WAITOK); 434b38ff370SJamie Gritton u_hostname = u_path + MAXPATHLEN; 435b38ff370SJamie Gritton u_name = u_hostname + MAXHOSTNAMELEN; 436b38ff370SJamie Gritton #ifdef INET 437b38ff370SJamie Gritton u_ip4 = (struct in_addr *)(u_name + MAXHOSTNAMELEN); 438b38ff370SJamie Gritton #endif 439b38ff370SJamie Gritton #ifdef INET6 440b38ff370SJamie Gritton #ifdef INET 4410304c731SJamie Gritton u_ip6 = (struct in6_addr *)(u_ip4 + ip4s); 442b38ff370SJamie Gritton #else 443b38ff370SJamie Gritton u_ip6 = (struct in6_addr *)(u_name + MAXHOSTNAMELEN); 444b38ff370SJamie Gritton #endif 445b38ff370SJamie Gritton #endif 4460304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "path"; 4470304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("path"); 4480304c731SJamie Gritton opt.uio_iovcnt++; 4490304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = u_path; 4500304c731SJamie Gritton error = copyinstr(j->path, u_path, MAXPATHLEN, 4510304c731SJamie Gritton &optiov[opt.uio_iovcnt].iov_len); 452b38ff370SJamie Gritton if (error) { 453b38ff370SJamie Gritton free(u_path, M_TEMP); 454b38ff370SJamie Gritton return (error); 455b38ff370SJamie Gritton } 4560304c731SJamie Gritton opt.uio_iovcnt++; 4570304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "host.hostname"; 4580304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("host.hostname"); 4590304c731SJamie Gritton opt.uio_iovcnt++; 4600304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = u_hostname; 4610304c731SJamie Gritton error = copyinstr(j->hostname, u_hostname, MAXHOSTNAMELEN, 4620304c731SJamie Gritton &optiov[opt.uio_iovcnt].iov_len); 463b38ff370SJamie Gritton if (error) { 464b38ff370SJamie Gritton free(u_path, M_TEMP); 465b38ff370SJamie Gritton return (error); 466b38ff370SJamie Gritton } 4670304c731SJamie Gritton opt.uio_iovcnt++; 4680304c731SJamie Gritton if (j->jailname != NULL) { 469b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "name"; 470b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("name"); 471b38ff370SJamie Gritton opt.uio_iovcnt++; 472b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = u_name; 4730304c731SJamie Gritton error = copyinstr(j->jailname, u_name, MAXHOSTNAMELEN, 474b38ff370SJamie Gritton &optiov[opt.uio_iovcnt].iov_len); 475b38ff370SJamie Gritton if (error) { 476b38ff370SJamie Gritton free(u_path, M_TEMP); 477b38ff370SJamie Gritton return (error); 478b38ff370SJamie Gritton } 479b38ff370SJamie Gritton opt.uio_iovcnt++; 480b38ff370SJamie Gritton } 481b38ff370SJamie Gritton #ifdef INET 482b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "ip4.addr"; 483b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("ip4.addr"); 484b38ff370SJamie Gritton opt.uio_iovcnt++; 485b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = u_ip4; 4860304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = ip4s * sizeof(struct in_addr); 4870304c731SJamie Gritton if (j->version == 0) 4880304c731SJamie Gritton u_ip4->s_addr = j->ip4s; 4890304c731SJamie Gritton else { 4900304c731SJamie Gritton error = copyin(j->ip4, u_ip4, optiov[opt.uio_iovcnt].iov_len); 491b38ff370SJamie Gritton if (error) { 492b38ff370SJamie Gritton free(u_path, M_TEMP); 493b38ff370SJamie Gritton return (error); 494b38ff370SJamie Gritton } 4950304c731SJamie Gritton } 496b38ff370SJamie Gritton opt.uio_iovcnt++; 497b38ff370SJamie Gritton #endif 498b38ff370SJamie Gritton #ifdef INET6 499b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "ip6.addr"; 500b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("ip6.addr"); 501b38ff370SJamie Gritton opt.uio_iovcnt++; 502b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = u_ip6; 5030304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = j->ip6s * sizeof(struct in6_addr); 5040304c731SJamie Gritton error = copyin(j->ip6, u_ip6, optiov[opt.uio_iovcnt].iov_len); 505b38ff370SJamie Gritton if (error) { 506b38ff370SJamie Gritton free(u_path, M_TEMP); 507b38ff370SJamie Gritton return (error); 508b38ff370SJamie Gritton } 509b38ff370SJamie Gritton opt.uio_iovcnt++; 510b38ff370SJamie Gritton #endif 51102abd400SPedro F. Giffuni KASSERT(opt.uio_iovcnt <= nitems(optiov), 5120304c731SJamie Gritton ("kern_jail: too many iovecs (%d)", opt.uio_iovcnt)); 513b38ff370SJamie Gritton error = kern_jail_set(td, &opt, JAIL_CREATE | JAIL_ATTACH); 514b38ff370SJamie Gritton free(u_path, M_TEMP); 515b38ff370SJamie Gritton return (error); 516b38ff370SJamie Gritton } 517b38ff370SJamie Gritton 518b38ff370SJamie Gritton /* 519b38ff370SJamie Gritton * struct jail_set_args { 520b38ff370SJamie Gritton * struct iovec *iovp; 521b38ff370SJamie Gritton * unsigned int iovcnt; 522b38ff370SJamie Gritton * int flags; 523b38ff370SJamie Gritton * }; 524b38ff370SJamie Gritton */ 525b38ff370SJamie Gritton int 5268451d0ddSKip Macy sys_jail_set(struct thread *td, struct jail_set_args *uap) 527b38ff370SJamie Gritton { 528b38ff370SJamie Gritton struct uio *auio; 529b38ff370SJamie Gritton int error; 530b38ff370SJamie Gritton 531b38ff370SJamie Gritton /* Check that we have an even number of iovecs. */ 532b38ff370SJamie Gritton if (uap->iovcnt & 1) 533b38ff370SJamie Gritton return (EINVAL); 534b38ff370SJamie Gritton 535b38ff370SJamie Gritton error = copyinuio(uap->iovp, uap->iovcnt, &auio); 536b38ff370SJamie Gritton if (error) 537b38ff370SJamie Gritton return (error); 538b38ff370SJamie Gritton error = kern_jail_set(td, auio, uap->flags); 539b38ff370SJamie Gritton free(auio, M_IOV); 540b38ff370SJamie Gritton return (error); 541413628a7SBjoern A. Zeeb } 542413628a7SBjoern A. Zeeb 543eb8dcdeaSGleb Smirnoff #if defined(INET) || defined(INET6) 544eb8dcdeaSGleb Smirnoff typedef int prison_addr_cmp_t(const void *, const void *); 545eb8dcdeaSGleb Smirnoff typedef bool prison_addr_valid_t(const void *); 546eb8dcdeaSGleb Smirnoff static const struct pr_family { 547eb8dcdeaSGleb Smirnoff size_t size; 548eb8dcdeaSGleb Smirnoff prison_addr_cmp_t *cmp; 549eb8dcdeaSGleb Smirnoff prison_addr_valid_t *valid; 550eb8dcdeaSGleb Smirnoff int ip_flag; 551eb8dcdeaSGleb Smirnoff } pr_families[PR_FAMILY_MAX] = { 552eb8dcdeaSGleb Smirnoff #ifdef INET 553eb8dcdeaSGleb Smirnoff [PR_INET] = { 554eb8dcdeaSGleb Smirnoff .size = sizeof(struct in_addr), 555eb8dcdeaSGleb Smirnoff .cmp = prison_qcmp_v4, 556eb8dcdeaSGleb Smirnoff .valid = prison_valid_v4, 557eb8dcdeaSGleb Smirnoff .ip_flag = PR_IP4_USER, 558eb8dcdeaSGleb Smirnoff }, 559eb8dcdeaSGleb Smirnoff #endif 560eb8dcdeaSGleb Smirnoff #ifdef INET6 561eb8dcdeaSGleb Smirnoff [PR_INET6] = { 562eb8dcdeaSGleb Smirnoff .size = sizeof(struct in6_addr), 563eb8dcdeaSGleb Smirnoff .cmp = prison_qcmp_v6, 564eb8dcdeaSGleb Smirnoff .valid = prison_valid_v6, 565eb8dcdeaSGleb Smirnoff .ip_flag = PR_IP6_USER, 566eb8dcdeaSGleb Smirnoff }, 567eb8dcdeaSGleb Smirnoff #endif 568eb8dcdeaSGleb Smirnoff }; 569eb8dcdeaSGleb Smirnoff 570eb8dcdeaSGleb Smirnoff /* 571eb8dcdeaSGleb Smirnoff * Network address lists (pr_addrs) allocation for jails. The addresses 572eb8dcdeaSGleb Smirnoff * are accessed locklessly by the network stack, thus need to be protected by 573eb8dcdeaSGleb Smirnoff * the network epoch. 574eb8dcdeaSGleb Smirnoff */ 575eb8dcdeaSGleb Smirnoff struct prison_ip { 576eb8dcdeaSGleb Smirnoff struct epoch_context ctx; 577eb8dcdeaSGleb Smirnoff uint32_t ips; 578eb8dcdeaSGleb Smirnoff #ifdef FUTURE_C 579eb8dcdeaSGleb Smirnoff union { 580eb8dcdeaSGleb Smirnoff struct in_addr pr_ip4[]; 581eb8dcdeaSGleb Smirnoff struct in6_addr pr_ip6[]; 582eb8dcdeaSGleb Smirnoff }; 583eb8dcdeaSGleb Smirnoff #else /* No future C :( */ 584eb8dcdeaSGleb Smirnoff #define PR_IP(pip, i) ((const char *)((pip) + 1) + pr_families[af].size * (i)) 585eb8dcdeaSGleb Smirnoff #define PR_IPD(pip, i) ((char *)((pip) + 1) + pr_families[af].size * (i)) 586eb8dcdeaSGleb Smirnoff #endif 587eb8dcdeaSGleb Smirnoff }; 588eb8dcdeaSGleb Smirnoff 589eb8dcdeaSGleb Smirnoff static struct prison_ip * 590eb8dcdeaSGleb Smirnoff prison_ip_alloc(const pr_family_t af, uint32_t cnt, int flags) 591eb8dcdeaSGleb Smirnoff { 592eb8dcdeaSGleb Smirnoff struct prison_ip *pip; 593eb8dcdeaSGleb Smirnoff 594eb8dcdeaSGleb Smirnoff pip = malloc(sizeof(struct prison_ip) + cnt * pr_families[af].size, 595eb8dcdeaSGleb Smirnoff M_PRISON, flags); 596eb8dcdeaSGleb Smirnoff if (pip != NULL) 597eb8dcdeaSGleb Smirnoff pip->ips = cnt; 598eb8dcdeaSGleb Smirnoff return (pip); 599eb8dcdeaSGleb Smirnoff } 600eb8dcdeaSGleb Smirnoff 601eb8dcdeaSGleb Smirnoff /* 602eb8dcdeaSGleb Smirnoff * Allocate and copyin user supplied address list, sorting and validating. 603eb8dcdeaSGleb Smirnoff * kern_jail_set() helper. 604eb8dcdeaSGleb Smirnoff */ 605eb8dcdeaSGleb Smirnoff static struct prison_ip * 606eb8dcdeaSGleb Smirnoff prison_ip_copyin(const pr_family_t af, void *op, uint32_t cnt) 607eb8dcdeaSGleb Smirnoff { 608eb8dcdeaSGleb Smirnoff prison_addr_cmp_t *const cmp = pr_families[af].cmp; 609eb8dcdeaSGleb Smirnoff const size_t size = pr_families[af].size; 610eb8dcdeaSGleb Smirnoff struct prison_ip *pip; 611eb8dcdeaSGleb Smirnoff 612eb8dcdeaSGleb Smirnoff pip = prison_ip_alloc(af, cnt, M_WAITOK); 613eb8dcdeaSGleb Smirnoff bcopy(op, pip + 1, cnt * size); 614eb8dcdeaSGleb Smirnoff /* 615eb8dcdeaSGleb Smirnoff * IP addresses are all sorted but ip[0] to preserve 616eb8dcdeaSGleb Smirnoff * the primary IP address as given from userland. 617eb8dcdeaSGleb Smirnoff * This special IP is used for unbound outgoing 618eb8dcdeaSGleb Smirnoff * connections as well for "loopback" traffic in case 619eb8dcdeaSGleb Smirnoff * source address selection cannot find any more fitting 620eb8dcdeaSGleb Smirnoff * address to connect from. 621eb8dcdeaSGleb Smirnoff */ 622eb8dcdeaSGleb Smirnoff if (cnt > 1) 623eb8dcdeaSGleb Smirnoff qsort((char *)(pip + 1) + size, cnt - 1, size, 624eb8dcdeaSGleb Smirnoff pr_families[af].cmp); 625eb8dcdeaSGleb Smirnoff /* 626eb8dcdeaSGleb Smirnoff * Check for duplicate addresses and do some simple 627eb8dcdeaSGleb Smirnoff * zero and broadcast checks. If users give other bogus 628eb8dcdeaSGleb Smirnoff * addresses it is their problem. 629eb8dcdeaSGleb Smirnoff */ 630eb8dcdeaSGleb Smirnoff for (int i = 0; i < cnt; i++) { 631eb8dcdeaSGleb Smirnoff if (!pr_families[af].valid(PR_IP(pip, i))) { 632eb8dcdeaSGleb Smirnoff free(pip, M_PRISON); 633eb8dcdeaSGleb Smirnoff return (NULL); 634eb8dcdeaSGleb Smirnoff } 635eb8dcdeaSGleb Smirnoff if (i + 1 < cnt && 636eb8dcdeaSGleb Smirnoff (cmp(PR_IP(pip, 0), PR_IP(pip, i + 1)) == 0 || 637eb8dcdeaSGleb Smirnoff cmp(PR_IP(pip, i), PR_IP(pip, i + 1)) == 0)) { 638eb8dcdeaSGleb Smirnoff free(pip, M_PRISON); 639eb8dcdeaSGleb Smirnoff return (NULL); 640eb8dcdeaSGleb Smirnoff } 641eb8dcdeaSGleb Smirnoff } 642eb8dcdeaSGleb Smirnoff 643eb8dcdeaSGleb Smirnoff return (pip); 644eb8dcdeaSGleb Smirnoff } 645eb8dcdeaSGleb Smirnoff 646eb8dcdeaSGleb Smirnoff /* 647eb8dcdeaSGleb Smirnoff * Allocate and dup parent prison address list. 648eb8dcdeaSGleb Smirnoff * kern_jail_set() helper. 649eb8dcdeaSGleb Smirnoff */ 650eb8dcdeaSGleb Smirnoff static void 651eb8dcdeaSGleb Smirnoff prison_ip_dup(struct prison *ppr, struct prison *pr, const pr_family_t af) 652eb8dcdeaSGleb Smirnoff { 653eb8dcdeaSGleb Smirnoff 654eb8dcdeaSGleb Smirnoff if (ppr->pr_addrs[af] != NULL) { 655eb8dcdeaSGleb Smirnoff pr->pr_addrs[af] = prison_ip_alloc(af, 656eb8dcdeaSGleb Smirnoff ppr->pr_addrs[af]->ips, M_WAITOK); 657ddbf879dSZhenlei Huang bcopy(ppr->pr_addrs[af] + 1, pr->pr_addrs[af] + 1, 658eb8dcdeaSGleb Smirnoff pr->pr_addrs[af]->ips * pr_families[af].size); 659eb8dcdeaSGleb Smirnoff } 660eb8dcdeaSGleb Smirnoff } 661eb8dcdeaSGleb Smirnoff 662eb8dcdeaSGleb Smirnoff /* 663eb8dcdeaSGleb Smirnoff * Make sure the new set of IP addresses is a subset of the parent's list. 664eb8dcdeaSGleb Smirnoff * Don't worry about the parent being unlocked, as any setting is done with 665eb8dcdeaSGleb Smirnoff * allprison_lock held. 666eb8dcdeaSGleb Smirnoff * kern_jail_set() helper. 667eb8dcdeaSGleb Smirnoff */ 668eb8dcdeaSGleb Smirnoff static bool 669eb8dcdeaSGleb Smirnoff prison_ip_parent_match(const struct prison_ip *ppip, 670eb8dcdeaSGleb Smirnoff const struct prison_ip *pip, const pr_family_t af) 671eb8dcdeaSGleb Smirnoff { 672eb8dcdeaSGleb Smirnoff prison_addr_cmp_t *const cmp = pr_families[af].cmp; 673eb8dcdeaSGleb Smirnoff int i, j; 674eb8dcdeaSGleb Smirnoff 675eb8dcdeaSGleb Smirnoff if (ppip == NULL) 676eb8dcdeaSGleb Smirnoff return (false); 677eb8dcdeaSGleb Smirnoff 678eb8dcdeaSGleb Smirnoff for (i = 0; i < ppip->ips; i++) 679eb8dcdeaSGleb Smirnoff if (cmp(PR_IP(pip, 0), PR_IP(ppip, i)) == 0) 680eb8dcdeaSGleb Smirnoff break; 681eb8dcdeaSGleb Smirnoff 682eb8dcdeaSGleb Smirnoff if (i == ppip->ips) 683eb8dcdeaSGleb Smirnoff /* Main address not present in parent. */ 684eb8dcdeaSGleb Smirnoff return (false); 685eb8dcdeaSGleb Smirnoff 686eb8dcdeaSGleb Smirnoff if (pip->ips > 1) { 687eb8dcdeaSGleb Smirnoff for (i = j = 1; i < pip->ips; i++) { 688eb8dcdeaSGleb Smirnoff if (cmp(PR_IP(pip, i), PR_IP(ppip, 0)) == 0) 689eb8dcdeaSGleb Smirnoff /* Equals to parent primary address. */ 690eb8dcdeaSGleb Smirnoff continue; 691eb8dcdeaSGleb Smirnoff for (; j < ppip->ips; j++) 692eb8dcdeaSGleb Smirnoff if (cmp(PR_IP(pip, i), PR_IP(ppip, j)) == 0) 693eb8dcdeaSGleb Smirnoff break; 694eb8dcdeaSGleb Smirnoff if (j == ppip->ips) 695eb8dcdeaSGleb Smirnoff break; 696eb8dcdeaSGleb Smirnoff } 697eb8dcdeaSGleb Smirnoff if (j == ppip->ips) 698eb8dcdeaSGleb Smirnoff /* Address not present in parent. */ 699eb8dcdeaSGleb Smirnoff return (false); 700eb8dcdeaSGleb Smirnoff } 701eb8dcdeaSGleb Smirnoff return (true); 702eb8dcdeaSGleb Smirnoff } 703eb8dcdeaSGleb Smirnoff 704eb8dcdeaSGleb Smirnoff /* 705eb8dcdeaSGleb Smirnoff * Check for conflicting IP addresses. We permit them if there is no more 706eb8dcdeaSGleb Smirnoff * than one IP on each jail. If there is a duplicate on a jail with more 707eb8dcdeaSGleb Smirnoff * than one IP stop checking and return error. 708eb8dcdeaSGleb Smirnoff * kern_jail_set() helper. 709eb8dcdeaSGleb Smirnoff */ 710eb8dcdeaSGleb Smirnoff static bool 711eb8dcdeaSGleb Smirnoff prison_ip_conflict_check(const struct prison *ppr, const struct prison *pr, 712eb8dcdeaSGleb Smirnoff const struct prison_ip *pip, pr_family_t af) 713eb8dcdeaSGleb Smirnoff { 714eb8dcdeaSGleb Smirnoff const struct prison *tppr, *tpr; 715eb8dcdeaSGleb Smirnoff int descend; 716eb8dcdeaSGleb Smirnoff 717eb8dcdeaSGleb Smirnoff #ifdef VIMAGE 718eb8dcdeaSGleb Smirnoff for (tppr = ppr; tppr != &prison0; tppr = tppr->pr_parent) 719eb8dcdeaSGleb Smirnoff if (tppr->pr_flags & PR_VNET) 720eb8dcdeaSGleb Smirnoff break; 721eb8dcdeaSGleb Smirnoff #else 722eb8dcdeaSGleb Smirnoff tppr = &prison0; 723eb8dcdeaSGleb Smirnoff #endif 724eb8dcdeaSGleb Smirnoff FOREACH_PRISON_DESCENDANT(tppr, tpr, descend) { 725eb8dcdeaSGleb Smirnoff if (tpr == pr || 726eb8dcdeaSGleb Smirnoff #ifdef VIMAGE 727eb8dcdeaSGleb Smirnoff (tpr != tppr && (tpr->pr_flags & PR_VNET)) || 728eb8dcdeaSGleb Smirnoff #endif 729eb8dcdeaSGleb Smirnoff !prison_isalive(tpr)) { 730eb8dcdeaSGleb Smirnoff descend = 0; 731eb8dcdeaSGleb Smirnoff continue; 732eb8dcdeaSGleb Smirnoff } 733eb8dcdeaSGleb Smirnoff if (!(tpr->pr_flags & pr_families[af].ip_flag)) 734eb8dcdeaSGleb Smirnoff continue; 735eb8dcdeaSGleb Smirnoff descend = 0; 736eb8dcdeaSGleb Smirnoff if (tpr->pr_addrs[af] == NULL || 737eb8dcdeaSGleb Smirnoff (pip->ips == 1 && tpr->pr_addrs[af]->ips == 1)) 738eb8dcdeaSGleb Smirnoff continue; 739eb8dcdeaSGleb Smirnoff for (int i = 0; i < pip->ips; i++) 740eb8dcdeaSGleb Smirnoff if (prison_ip_check(tpr, af, PR_IP(pip, i)) == 0) 741eb8dcdeaSGleb Smirnoff return (false); 742eb8dcdeaSGleb Smirnoff } 743eb8dcdeaSGleb Smirnoff 744eb8dcdeaSGleb Smirnoff return (true); 745eb8dcdeaSGleb Smirnoff } 746eb8dcdeaSGleb Smirnoff 747eb8dcdeaSGleb Smirnoff _Static_assert(offsetof(struct prison_ip, ctx) == 0, 748eb8dcdeaSGleb Smirnoff "prison must start with epoch context"); 749eb8dcdeaSGleb Smirnoff static void 750eb8dcdeaSGleb Smirnoff prison_ip_free_deferred(epoch_context_t ctx) 751eb8dcdeaSGleb Smirnoff { 752eb8dcdeaSGleb Smirnoff 753eb8dcdeaSGleb Smirnoff free(ctx, M_PRISON); 754eb8dcdeaSGleb Smirnoff } 755eb8dcdeaSGleb Smirnoff 756eb8dcdeaSGleb Smirnoff static void 757eb8dcdeaSGleb Smirnoff prison_ip_free(struct prison_ip *pip) 758eb8dcdeaSGleb Smirnoff { 759eb8dcdeaSGleb Smirnoff 760eb8dcdeaSGleb Smirnoff if (pip != NULL) 761eb8dcdeaSGleb Smirnoff NET_EPOCH_CALL(prison_ip_free_deferred, &pip->ctx); 762eb8dcdeaSGleb Smirnoff } 763eb8dcdeaSGleb Smirnoff 764eb8dcdeaSGleb Smirnoff static void 765eb8dcdeaSGleb Smirnoff prison_ip_set(struct prison *pr, const pr_family_t af, struct prison_ip *new) 766eb8dcdeaSGleb Smirnoff { 767eb8dcdeaSGleb Smirnoff struct prison_ip **mem, *old; 768eb8dcdeaSGleb Smirnoff 769eb8dcdeaSGleb Smirnoff mtx_assert(&pr->pr_mtx, MA_OWNED); 770eb8dcdeaSGleb Smirnoff 771eb8dcdeaSGleb Smirnoff mem = &pr->pr_addrs[af]; 772eb8dcdeaSGleb Smirnoff 773eb8dcdeaSGleb Smirnoff old = *mem; 774eb8dcdeaSGleb Smirnoff ck_pr_store_ptr(mem, new); 775eb8dcdeaSGleb Smirnoff prison_ip_free(old); 776eb8dcdeaSGleb Smirnoff } 777eb8dcdeaSGleb Smirnoff 778eb8dcdeaSGleb Smirnoff /* 779eb8dcdeaSGleb Smirnoff * Restrict a prison's IP address list with its parent's, possibly replacing 780*89ddfbbaSZhenlei Huang * it. Return true if the replacement buffer was used (or should redo). 781eb8dcdeaSGleb Smirnoff * kern_jail_set() helper. 782eb8dcdeaSGleb Smirnoff */ 783eb8dcdeaSGleb Smirnoff static bool 784eb8dcdeaSGleb Smirnoff prison_ip_restrict(struct prison *pr, const pr_family_t af, 785eb8dcdeaSGleb Smirnoff struct prison_ip *new) 786eb8dcdeaSGleb Smirnoff { 787eb8dcdeaSGleb Smirnoff const struct prison_ip *ppip = pr->pr_parent->pr_addrs[af]; 788eb8dcdeaSGleb Smirnoff const struct prison_ip *pip = pr->pr_addrs[af]; 789eb8dcdeaSGleb Smirnoff int (*const cmp)(const void *, const void *) = pr_families[af].cmp; 790eb8dcdeaSGleb Smirnoff const size_t size = pr_families[af].size; 791eb8dcdeaSGleb Smirnoff uint32_t ips; 792*89ddfbbaSZhenlei Huang bool alloced, used; 793eb8dcdeaSGleb Smirnoff 794eb8dcdeaSGleb Smirnoff mtx_assert(&pr->pr_mtx, MA_OWNED); 795eb8dcdeaSGleb Smirnoff 796eb8dcdeaSGleb Smirnoff /* 797eb8dcdeaSGleb Smirnoff * Due to epoch-synchronized access to the IP address lists we always 798eb8dcdeaSGleb Smirnoff * allocate a new list even if the old one has enough space. We could 799eb8dcdeaSGleb Smirnoff * atomically update an IPv4 address inside a list, but that would 800eb8dcdeaSGleb Smirnoff * screw up sorting, and in case of IPv6 we can't even atomically write 801eb8dcdeaSGleb Smirnoff * one. 802eb8dcdeaSGleb Smirnoff */ 803*89ddfbbaSZhenlei Huang if (ppip == NULL) { 804*89ddfbbaSZhenlei Huang if (pip != NULL) 805eb8dcdeaSGleb Smirnoff prison_ip_set(pr, af, NULL); 806eb8dcdeaSGleb Smirnoff return (false); 807eb8dcdeaSGleb Smirnoff } 808*89ddfbbaSZhenlei Huang 809eb8dcdeaSGleb Smirnoff if (!(pr->pr_flags & pr_families[af].ip_flag)) { 810*89ddfbbaSZhenlei Huang if (new == NULL) { 811*89ddfbbaSZhenlei Huang new = prison_ip_alloc(af, ppip->ips, M_NOWAIT); 812*89ddfbbaSZhenlei Huang if (new == NULL) 813*89ddfbbaSZhenlei Huang return (true); /* redo */ 814*89ddfbbaSZhenlei Huang used = false; 815*89ddfbbaSZhenlei Huang } else 816*89ddfbbaSZhenlei Huang used = true; 817eb8dcdeaSGleb Smirnoff /* This has no user settings, so just copy the parent's list. */ 818*89ddfbbaSZhenlei Huang MPASS(new->ips == ppip->ips); 819*89ddfbbaSZhenlei Huang bcopy(ppip + 1, new + 1, ppip->ips * size); 820*89ddfbbaSZhenlei Huang prison_ip_set(pr, af, new); 821*89ddfbbaSZhenlei Huang return (used); 822*89ddfbbaSZhenlei Huang } else if (pip != NULL) { 823eb8dcdeaSGleb Smirnoff /* Remove addresses that aren't in the parent. */ 824eb8dcdeaSGleb Smirnoff int i; 825eb8dcdeaSGleb Smirnoff 826eb8dcdeaSGleb Smirnoff i = 0; /* index in pip */ 827eb8dcdeaSGleb Smirnoff ips = 0; /* index in new */ 828eb8dcdeaSGleb Smirnoff 829*89ddfbbaSZhenlei Huang used = true; 830*89ddfbbaSZhenlei Huang if (new == NULL) { 831*89ddfbbaSZhenlei Huang new = prison_ip_alloc(af, pip->ips, M_NOWAIT); 832*89ddfbbaSZhenlei Huang if (new == NULL) 833*89ddfbbaSZhenlei Huang return (true); /* redo */ 834*89ddfbbaSZhenlei Huang used = false; 835*89ddfbbaSZhenlei Huang alloced = true; 836*89ddfbbaSZhenlei Huang } else { 837*89ddfbbaSZhenlei Huang used = true; 838*89ddfbbaSZhenlei Huang alloced = false; 839*89ddfbbaSZhenlei Huang } 840*89ddfbbaSZhenlei Huang 841eb8dcdeaSGleb Smirnoff for (int pi = 0; pi < ppip->ips; pi++) 842eb8dcdeaSGleb Smirnoff if (cmp(PR_IP(pip, 0), PR_IP(ppip, pi)) == 0) { 843eb8dcdeaSGleb Smirnoff /* Found our primary address in parent. */ 844eb8dcdeaSGleb Smirnoff bcopy(PR_IP(pip, i), PR_IPD(new, ips), size); 845eb8dcdeaSGleb Smirnoff i++; 846eb8dcdeaSGleb Smirnoff ips++; 847eb8dcdeaSGleb Smirnoff break; 848eb8dcdeaSGleb Smirnoff } 849eb8dcdeaSGleb Smirnoff for (int pi = 1; i < pip->ips; ) { 850eb8dcdeaSGleb Smirnoff /* Check against primary, which is unsorted. */ 851eb8dcdeaSGleb Smirnoff if (cmp(PR_IP(pip, i), PR_IP(ppip, 0)) == 0) { 852eb8dcdeaSGleb Smirnoff /* Matches parent's primary address. */ 853eb8dcdeaSGleb Smirnoff bcopy(PR_IP(pip, i), PR_IPD(new, ips), size); 854eb8dcdeaSGleb Smirnoff i++; 855eb8dcdeaSGleb Smirnoff ips++; 856eb8dcdeaSGleb Smirnoff continue; 857eb8dcdeaSGleb Smirnoff } 858eb8dcdeaSGleb Smirnoff /* The rest are sorted. */ 859eb8dcdeaSGleb Smirnoff switch (pi >= ppip->ips ? -1 : 860eb8dcdeaSGleb Smirnoff cmp(PR_IP(pip, i), PR_IP(ppip, pi))) { 861eb8dcdeaSGleb Smirnoff case -1: 862eb8dcdeaSGleb Smirnoff i++; 863eb8dcdeaSGleb Smirnoff break; 864eb8dcdeaSGleb Smirnoff case 0: 865ddbf879dSZhenlei Huang bcopy(PR_IP(pip, i), PR_IPD(new, ips), size); 866eb8dcdeaSGleb Smirnoff i++; 867eb8dcdeaSGleb Smirnoff pi++; 868eb8dcdeaSGleb Smirnoff ips++; 869eb8dcdeaSGleb Smirnoff break; 870eb8dcdeaSGleb Smirnoff case 1: 871eb8dcdeaSGleb Smirnoff pi++; 872eb8dcdeaSGleb Smirnoff break; 873eb8dcdeaSGleb Smirnoff } 874eb8dcdeaSGleb Smirnoff } 875eb8dcdeaSGleb Smirnoff if (ips == 0) { 876eb8dcdeaSGleb Smirnoff if (alloced) 877eb8dcdeaSGleb Smirnoff prison_ip_free(new); 878eb8dcdeaSGleb Smirnoff new = NULL; 879*89ddfbbaSZhenlei Huang used = false; 880*89ddfbbaSZhenlei Huang } else { 881*89ddfbbaSZhenlei Huang /* Shrink to real size */ 882*89ddfbbaSZhenlei Huang KASSERT((new->ips >= ips), 883*89ddfbbaSZhenlei Huang ("Out-of-bounds write to prison_ip %p", new)); 884*89ddfbbaSZhenlei Huang new->ips = ips; 885eb8dcdeaSGleb Smirnoff } 886eb8dcdeaSGleb Smirnoff prison_ip_set(pr, af, new); 887*89ddfbbaSZhenlei Huang return (used); 888*89ddfbbaSZhenlei Huang } 889*89ddfbbaSZhenlei Huang return (false); 890eb8dcdeaSGleb Smirnoff } 891eb8dcdeaSGleb Smirnoff 892eb8dcdeaSGleb Smirnoff /* 893eb8dcdeaSGleb Smirnoff * Fast-path check if an address belongs to a prison. 894eb8dcdeaSGleb Smirnoff */ 895eb8dcdeaSGleb Smirnoff int 896eb8dcdeaSGleb Smirnoff prison_ip_check(const struct prison *pr, const pr_family_t af, 897eb8dcdeaSGleb Smirnoff const void *addr) 898eb8dcdeaSGleb Smirnoff { 899eb8dcdeaSGleb Smirnoff int (*const cmp)(const void *, const void *) = pr_families[af].cmp; 900eb8dcdeaSGleb Smirnoff const struct prison_ip *pip; 901eb8dcdeaSGleb Smirnoff int i, a, z, d; 902eb8dcdeaSGleb Smirnoff 903eb8dcdeaSGleb Smirnoff MPASS(mtx_owned(&pr->pr_mtx) || 904eb8dcdeaSGleb Smirnoff in_epoch(net_epoch_preempt) || 905eb8dcdeaSGleb Smirnoff sx_xlocked(&allprison_lock)); 906eb8dcdeaSGleb Smirnoff 907eb8dcdeaSGleb Smirnoff pip = ck_pr_load_ptr(&pr->pr_addrs[af]); 908eb8dcdeaSGleb Smirnoff if (__predict_false(pip == NULL)) 909eb8dcdeaSGleb Smirnoff return (EAFNOSUPPORT); 910eb8dcdeaSGleb Smirnoff 911eb8dcdeaSGleb Smirnoff /* Check the primary IP. */ 912eb8dcdeaSGleb Smirnoff if (cmp(PR_IP(pip, 0), addr) == 0) 913eb8dcdeaSGleb Smirnoff return (0); 914eb8dcdeaSGleb Smirnoff 915eb8dcdeaSGleb Smirnoff /* 916eb8dcdeaSGleb Smirnoff * All the other IPs are sorted so we can do a binary search. 917eb8dcdeaSGleb Smirnoff */ 918eb8dcdeaSGleb Smirnoff a = 0; 919eb8dcdeaSGleb Smirnoff z = pip->ips - 2; 920eb8dcdeaSGleb Smirnoff while (a <= z) { 921eb8dcdeaSGleb Smirnoff i = (a + z) / 2; 922eb8dcdeaSGleb Smirnoff d = cmp(PR_IP(pip, i + 1), addr); 923eb8dcdeaSGleb Smirnoff if (d > 0) 924eb8dcdeaSGleb Smirnoff z = i - 1; 925eb8dcdeaSGleb Smirnoff else if (d < 0) 926eb8dcdeaSGleb Smirnoff a = i + 1; 927eb8dcdeaSGleb Smirnoff else 928eb8dcdeaSGleb Smirnoff return (0); 929eb8dcdeaSGleb Smirnoff } 930eb8dcdeaSGleb Smirnoff 931eb8dcdeaSGleb Smirnoff return (EADDRNOTAVAIL); 932eb8dcdeaSGleb Smirnoff } 933eb8dcdeaSGleb Smirnoff 934eb8dcdeaSGleb Smirnoff /* 935eb8dcdeaSGleb Smirnoff * Grab primary IP. Historically required mutex, but nothing prevents 936eb8dcdeaSGleb Smirnoff * us to support epoch-protected access. Is it used in fast path? 937eb8dcdeaSGleb Smirnoff * in{6}_jail.c helper 938eb8dcdeaSGleb Smirnoff */ 939eb8dcdeaSGleb Smirnoff const void * 940eb8dcdeaSGleb Smirnoff prison_ip_get0(const struct prison *pr, const pr_family_t af) 941eb8dcdeaSGleb Smirnoff { 942eb8dcdeaSGleb Smirnoff const struct prison_ip *pip = pr->pr_addrs[af]; 943eb8dcdeaSGleb Smirnoff 944eb8dcdeaSGleb Smirnoff mtx_assert(&pr->pr_mtx, MA_OWNED); 945eb8dcdeaSGleb Smirnoff MPASS(pip); 946eb8dcdeaSGleb Smirnoff 947eb8dcdeaSGleb Smirnoff return (pip + 1); 948eb8dcdeaSGleb Smirnoff } 949eb8dcdeaSGleb Smirnoff 950eb8dcdeaSGleb Smirnoff u_int 951eb8dcdeaSGleb Smirnoff prison_ip_cnt(const struct prison *pr, const pr_family_t af) 952eb8dcdeaSGleb Smirnoff { 953eb8dcdeaSGleb Smirnoff 954eb8dcdeaSGleb Smirnoff return (pr->pr_addrs[af]->ips); 955eb8dcdeaSGleb Smirnoff } 956eb8dcdeaSGleb Smirnoff #endif /* defined(INET) || defined(INET6) */ 957eb8dcdeaSGleb Smirnoff 958413628a7SBjoern A. Zeeb int 959b38ff370SJamie Gritton kern_jail_set(struct thread *td, struct uio *optuio, int flags) 960413628a7SBjoern A. Zeeb { 961fd7a8150SMike Barcroft struct nameidata nd; 962b38ff370SJamie Gritton #ifdef INET 963eb8dcdeaSGleb Smirnoff struct prison_ip *ip4; 964413628a7SBjoern A. Zeeb #endif 965b38ff370SJamie Gritton #ifdef INET6 966eb8dcdeaSGleb Smirnoff struct prison_ip *ip6; 967b38ff370SJamie Gritton #endif 968b38ff370SJamie Gritton struct vfsopt *opt; 969b38ff370SJamie Gritton struct vfsoptlist *opts; 9707de883c8SJamie Gritton struct prison *pr, *deadpr, *inspr, *mypr, *ppr, *tpr; 971b38ff370SJamie Gritton struct vnode *root; 972babbbb9cSJamie Gritton char *domain, *errmsg, *host, *name, *namelc, *p, *path, *uuid; 973b96bd95bSIan Lepore char *g_path, *osrelstr; 974672756aaSJamie Gritton struct bool_flags *bf; 975672756aaSJamie Gritton struct jailsys_flags *jsf; 9760304c731SJamie Gritton #if defined(INET) || defined(INET6) 977b38ff370SJamie Gritton void *op; 9780304c731SJamie Gritton #endif 97976ca6f88SJamie Gritton unsigned long hid; 980b6f47c23SJamie Gritton size_t namelen, onamelen, pnamelen; 9812a4b2251SJamie Gritton int born, created, cuflags, descend, drflags, enforce; 982cc5fd8c7SJamie Gritton int error, errmsg_len, errmsg_pos; 9830cc207a6SMartin Matuska int gotchildmax, gotenforce, gothid, gotrsnum, gotslevel; 984672756aaSJamie Gritton int jid, jsys, len, level; 985b96bd95bSIan Lepore int childmax, osreldt, rsnum, slevel; 986413628a7SBjoern A. Zeeb #ifdef INET 9872b0d6f81SJamie Gritton int ip4s, redo_ip4; 988413628a7SBjoern A. Zeeb #endif 989b38ff370SJamie Gritton #ifdef INET6 9902b0d6f81SJamie Gritton int ip6s, redo_ip6; 991b38ff370SJamie Gritton #endif 9926beb3bb4SKirk McKusick uint64_t pr_allow, ch_allow, pr_flags, ch_flags; 993b3079544SJamie Gritton uint64_t pr_allow_diff; 9946beb3bb4SKirk McKusick unsigned tallow; 995b38ff370SJamie Gritton char numbuf[12]; 996b38ff370SJamie Gritton 997b38ff370SJamie Gritton error = priv_check(td, PRIV_JAIL_SET); 998b38ff370SJamie Gritton if (!error && (flags & JAIL_ATTACH)) 999b38ff370SJamie Gritton error = priv_check(td, PRIV_JAIL_ATTACH); 1000b38ff370SJamie Gritton if (error) 100175c13541SPoul-Henning Kamp return (error); 1002b6f47c23SJamie Gritton mypr = td->td_ucred->cr_prison; 1003b97457e2SJamie Gritton if ((flags & JAIL_CREATE) && mypr->pr_childmax == 0) 10040304c731SJamie Gritton return (EPERM); 1005b38ff370SJamie Gritton if (flags & ~JAIL_SET_MASK) 1006b38ff370SJamie Gritton return (EINVAL); 1007b38ff370SJamie Gritton 1008b38ff370SJamie Gritton /* 1009b38ff370SJamie Gritton * Check all the parameters before committing to anything. Not all 1010b38ff370SJamie Gritton * errors can be caught early, but we may as well try. Also, this 1011b38ff370SJamie Gritton * takes care of some expensive stuff (path lookup) before getting 1012b38ff370SJamie Gritton * the allprison lock. 1013b38ff370SJamie Gritton * 1014b38ff370SJamie Gritton * XXX Jails are not filesystems, and jail parameters are not mount 1015b38ff370SJamie Gritton * options. But it makes more sense to re-use the vfsopt code 1016b38ff370SJamie Gritton * than duplicate it under a different name. 1017b38ff370SJamie Gritton */ 1018b38ff370SJamie Gritton error = vfs_buildopts(optuio, &opts); 1019b38ff370SJamie Gritton if (error) 1020b38ff370SJamie Gritton return (error); 1021b38ff370SJamie Gritton #ifdef INET 1022b38ff370SJamie Gritton ip4 = NULL; 1023b38ff370SJamie Gritton #endif 1024b38ff370SJamie Gritton #ifdef INET6 1025b38ff370SJamie Gritton ip6 = NULL; 1026b38ff370SJamie Gritton #endif 10276dfe0a3dSMartin Matuska g_path = NULL; 1028b38ff370SJamie Gritton 1029b6f47c23SJamie Gritton cuflags = flags & (JAIL_CREATE | JAIL_UPDATE); 1030b6f47c23SJamie Gritton if (!cuflags) { 1031b6f47c23SJamie Gritton error = EINVAL; 1032b6f47c23SJamie Gritton vfs_opterror(opts, "no valid operation (create or update)"); 1033b6f47c23SJamie Gritton goto done_errmsg; 1034b6f47c23SJamie Gritton } 1035b6f47c23SJamie Gritton 1036b38ff370SJamie Gritton error = vfs_copyopt(opts, "jid", &jid, sizeof(jid)); 1037b38ff370SJamie Gritton if (error == ENOENT) 1038b38ff370SJamie Gritton jid = 0; 1039b38ff370SJamie Gritton else if (error != 0) 1040b38ff370SJamie Gritton goto done_free; 1041b38ff370SJamie Gritton 1042b38ff370SJamie Gritton error = vfs_copyopt(opts, "securelevel", &slevel, sizeof(slevel)); 1043b38ff370SJamie Gritton if (error == ENOENT) 1044b38ff370SJamie Gritton gotslevel = 0; 1045b38ff370SJamie Gritton else if (error != 0) 1046b38ff370SJamie Gritton goto done_free; 1047b38ff370SJamie Gritton else 1048b38ff370SJamie Gritton gotslevel = 1; 1049b38ff370SJamie Gritton 1050b97457e2SJamie Gritton error = 1051b97457e2SJamie Gritton vfs_copyopt(opts, "children.max", &childmax, sizeof(childmax)); 1052b97457e2SJamie Gritton if (error == ENOENT) 1053b97457e2SJamie Gritton gotchildmax = 0; 1054b97457e2SJamie Gritton else if (error != 0) 1055b97457e2SJamie Gritton goto done_free; 1056b97457e2SJamie Gritton else 1057b97457e2SJamie Gritton gotchildmax = 1; 1058b97457e2SJamie Gritton 10590304c731SJamie Gritton error = vfs_copyopt(opts, "enforce_statfs", &enforce, sizeof(enforce)); 1060f337198dSJamie Gritton if (error == ENOENT) 1061f337198dSJamie Gritton gotenforce = 0; 1062f337198dSJamie Gritton else if (error != 0) 10630304c731SJamie Gritton goto done_free; 1064f337198dSJamie Gritton else if (enforce < 0 || enforce > 2) { 1065f337198dSJamie Gritton error = EINVAL; 1066f337198dSJamie Gritton goto done_free; 1067f337198dSJamie Gritton } else 1068f337198dSJamie Gritton gotenforce = 1; 10690304c731SJamie Gritton 10700cc207a6SMartin Matuska error = vfs_copyopt(opts, "devfs_ruleset", &rsnum, sizeof(rsnum)); 10710cc207a6SMartin Matuska if (error == ENOENT) 10720cc207a6SMartin Matuska gotrsnum = 0; 10730cc207a6SMartin Matuska else if (error != 0) 10740cc207a6SMartin Matuska goto done_free; 10750cc207a6SMartin Matuska else 10760cc207a6SMartin Matuska gotrsnum = 1; 10770cc207a6SMartin Matuska 1078b38ff370SJamie Gritton pr_flags = ch_flags = 0; 1079672756aaSJamie Gritton for (bf = pr_flag_bool; 1080672756aaSJamie Gritton bf < pr_flag_bool + nitems(pr_flag_bool); 1081672756aaSJamie Gritton bf++) { 1082672756aaSJamie Gritton vfs_flagopt(opts, bf->name, &pr_flags, bf->flag); 1083672756aaSJamie Gritton vfs_flagopt(opts, bf->noname, &ch_flags, bf->flag); 10840304c731SJamie Gritton } 1085b38ff370SJamie Gritton ch_flags |= pr_flags; 1086672756aaSJamie Gritton for (jsf = pr_flag_jailsys; 1087672756aaSJamie Gritton jsf < pr_flag_jailsys + nitems(pr_flag_jailsys); 1088672756aaSJamie Gritton jsf++) { 1089672756aaSJamie Gritton error = vfs_copyopt(opts, jsf->name, &jsys, sizeof(jsys)); 10907cbf7213SJamie Gritton if (error == ENOENT) 10917cbf7213SJamie Gritton continue; 10927cbf7213SJamie Gritton if (error != 0) 10937cbf7213SJamie Gritton goto done_free; 10947cbf7213SJamie Gritton switch (jsys) { 10957cbf7213SJamie Gritton case JAIL_SYS_DISABLE: 1096672756aaSJamie Gritton if (!jsf->disable) { 10977cbf7213SJamie Gritton error = EINVAL; 10987cbf7213SJamie Gritton goto done_free; 10997cbf7213SJamie Gritton } 1100672756aaSJamie Gritton pr_flags |= jsf->disable; 11017cbf7213SJamie Gritton break; 11027cbf7213SJamie Gritton case JAIL_SYS_NEW: 1103672756aaSJamie Gritton pr_flags |= jsf->new; 11047cbf7213SJamie Gritton break; 11057cbf7213SJamie Gritton case JAIL_SYS_INHERIT: 11067cbf7213SJamie Gritton break; 11077cbf7213SJamie Gritton default: 11087cbf7213SJamie Gritton error = EINVAL; 11097cbf7213SJamie Gritton goto done_free; 11107cbf7213SJamie Gritton } 1111672756aaSJamie Gritton ch_flags |= jsf->new | jsf->disable; 11127cbf7213SJamie Gritton } 11131158508aSJamie Gritton if ((flags & (JAIL_CREATE | JAIL_ATTACH)) == JAIL_CREATE 11144affa14cSJamie Gritton && !(pr_flags & PR_PERSIST)) { 11154affa14cSJamie Gritton error = EINVAL; 11164affa14cSJamie Gritton vfs_opterror(opts, "new jail must persist or attach"); 11174affa14cSJamie Gritton goto done_errmsg; 11184affa14cSJamie Gritton } 1119679e1390SJamie Gritton #ifdef VIMAGE 1120679e1390SJamie Gritton if ((flags & JAIL_UPDATE) && (ch_flags & PR_VNET)) { 1121679e1390SJamie Gritton error = EINVAL; 1122679e1390SJamie Gritton vfs_opterror(opts, "vnet cannot be changed after creation"); 1123679e1390SJamie Gritton goto done_errmsg; 1124679e1390SJamie Gritton } 1125679e1390SJamie Gritton #endif 11262b0d6f81SJamie Gritton #ifdef INET 11272b0d6f81SJamie Gritton if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP4_USER)) { 11282b0d6f81SJamie Gritton error = EINVAL; 11292b0d6f81SJamie Gritton vfs_opterror(opts, "ip4 cannot be changed after creation"); 11302b0d6f81SJamie Gritton goto done_errmsg; 11312b0d6f81SJamie Gritton } 11322b0d6f81SJamie Gritton #endif 11332b0d6f81SJamie Gritton #ifdef INET6 11342b0d6f81SJamie Gritton if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP6_USER)) { 11352b0d6f81SJamie Gritton error = EINVAL; 11362b0d6f81SJamie Gritton vfs_opterror(opts, "ip6 cannot be changed after creation"); 11372b0d6f81SJamie Gritton goto done_errmsg; 11382b0d6f81SJamie Gritton } 11392b0d6f81SJamie Gritton #endif 1140b38ff370SJamie Gritton 11410304c731SJamie Gritton pr_allow = ch_allow = 0; 1142672756aaSJamie Gritton for (bf = pr_flag_allow; 11435d58f959SJamie Gritton bf < pr_flag_allow + nitems(pr_flag_allow) && 11445d58f959SJamie Gritton atomic_load_int(&bf->flag) != 0; 1145672756aaSJamie Gritton bf++) { 1146672756aaSJamie Gritton vfs_flagopt(opts, bf->name, &pr_allow, bf->flag); 1147672756aaSJamie Gritton vfs_flagopt(opts, bf->noname, &ch_allow, bf->flag); 11480304c731SJamie Gritton } 11490304c731SJamie Gritton ch_allow |= pr_allow; 11500304c731SJamie Gritton 1151b38ff370SJamie Gritton error = vfs_getopt(opts, "name", (void **)&name, &len); 1152b38ff370SJamie Gritton if (error == ENOENT) 1153b38ff370SJamie Gritton name = NULL; 1154b38ff370SJamie Gritton else if (error != 0) 1155b38ff370SJamie Gritton goto done_free; 1156b38ff370SJamie Gritton else { 1157b38ff370SJamie Gritton if (len == 0 || name[len - 1] != '\0') { 1158b38ff370SJamie Gritton error = EINVAL; 1159b38ff370SJamie Gritton goto done_free; 1160b38ff370SJamie Gritton } 1161b38ff370SJamie Gritton if (len > MAXHOSTNAMELEN) { 1162b38ff370SJamie Gritton error = ENAMETOOLONG; 1163b38ff370SJamie Gritton goto done_free; 1164b38ff370SJamie Gritton } 1165b38ff370SJamie Gritton } 1166b38ff370SJamie Gritton 1167b38ff370SJamie Gritton error = vfs_getopt(opts, "host.hostname", (void **)&host, &len); 1168b38ff370SJamie Gritton if (error == ENOENT) 1169b38ff370SJamie Gritton host = NULL; 1170b38ff370SJamie Gritton else if (error != 0) 1171b38ff370SJamie Gritton goto done_free; 1172b38ff370SJamie Gritton else { 117376ca6f88SJamie Gritton ch_flags |= PR_HOST; 117476ca6f88SJamie Gritton pr_flags |= PR_HOST; 1175b38ff370SJamie Gritton if (len == 0 || host[len - 1] != '\0') { 1176b38ff370SJamie Gritton error = EINVAL; 1177b38ff370SJamie Gritton goto done_free; 1178b38ff370SJamie Gritton } 1179b38ff370SJamie Gritton if (len > MAXHOSTNAMELEN) { 1180b38ff370SJamie Gritton error = ENAMETOOLONG; 1181b38ff370SJamie Gritton goto done_free; 1182b38ff370SJamie Gritton } 1183b38ff370SJamie Gritton } 1184b38ff370SJamie Gritton 118576ca6f88SJamie Gritton error = vfs_getopt(opts, "host.domainname", (void **)&domain, &len); 118676ca6f88SJamie Gritton if (error == ENOENT) 118776ca6f88SJamie Gritton domain = NULL; 118876ca6f88SJamie Gritton else if (error != 0) 118976ca6f88SJamie Gritton goto done_free; 119076ca6f88SJamie Gritton else { 119176ca6f88SJamie Gritton ch_flags |= PR_HOST; 119276ca6f88SJamie Gritton pr_flags |= PR_HOST; 119376ca6f88SJamie Gritton if (len == 0 || domain[len - 1] != '\0') { 119476ca6f88SJamie Gritton error = EINVAL; 119576ca6f88SJamie Gritton goto done_free; 119676ca6f88SJamie Gritton } 119776ca6f88SJamie Gritton if (len > MAXHOSTNAMELEN) { 119876ca6f88SJamie Gritton error = ENAMETOOLONG; 119976ca6f88SJamie Gritton goto done_free; 120076ca6f88SJamie Gritton } 120176ca6f88SJamie Gritton } 120276ca6f88SJamie Gritton 120376ca6f88SJamie Gritton error = vfs_getopt(opts, "host.hostuuid", (void **)&uuid, &len); 120476ca6f88SJamie Gritton if (error == ENOENT) 120576ca6f88SJamie Gritton uuid = NULL; 120676ca6f88SJamie Gritton else if (error != 0) 120776ca6f88SJamie Gritton goto done_free; 120876ca6f88SJamie Gritton else { 120976ca6f88SJamie Gritton ch_flags |= PR_HOST; 121076ca6f88SJamie Gritton pr_flags |= PR_HOST; 121176ca6f88SJamie Gritton if (len == 0 || uuid[len - 1] != '\0') { 121276ca6f88SJamie Gritton error = EINVAL; 121376ca6f88SJamie Gritton goto done_free; 121476ca6f88SJamie Gritton } 121576ca6f88SJamie Gritton if (len > HOSTUUIDLEN) { 121676ca6f88SJamie Gritton error = ENAMETOOLONG; 121776ca6f88SJamie Gritton goto done_free; 121876ca6f88SJamie Gritton } 121976ca6f88SJamie Gritton } 122076ca6f88SJamie Gritton 1221841c0c7eSNathan Whitehorn #ifdef COMPAT_FREEBSD32 1222a5c1afadSDmitry Chagin if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) { 122376ca6f88SJamie Gritton uint32_t hid32; 122476ca6f88SJamie Gritton 122576ca6f88SJamie Gritton error = vfs_copyopt(opts, "host.hostid", &hid32, sizeof(hid32)); 122676ca6f88SJamie Gritton hid = hid32; 122776ca6f88SJamie Gritton } else 122876ca6f88SJamie Gritton #endif 122976ca6f88SJamie Gritton error = vfs_copyopt(opts, "host.hostid", &hid, sizeof(hid)); 123076ca6f88SJamie Gritton if (error == ENOENT) 123176ca6f88SJamie Gritton gothid = 0; 123276ca6f88SJamie Gritton else if (error != 0) 123376ca6f88SJamie Gritton goto done_free; 123476ca6f88SJamie Gritton else { 123576ca6f88SJamie Gritton gothid = 1; 123676ca6f88SJamie Gritton ch_flags |= PR_HOST; 123776ca6f88SJamie Gritton pr_flags |= PR_HOST; 123876ca6f88SJamie Gritton } 123976ca6f88SJamie Gritton 1240b38ff370SJamie Gritton #ifdef INET 1241b38ff370SJamie Gritton error = vfs_getopt(opts, "ip4.addr", &op, &ip4s); 1242b38ff370SJamie Gritton if (error == ENOENT) 12430e5e396eSJamie Gritton ip4s = 0; 1244b38ff370SJamie Gritton else if (error != 0) 1245b38ff370SJamie Gritton goto done_free; 1246eb8dcdeaSGleb Smirnoff else if (ip4s & (sizeof(struct in_addr) - 1)) { 1247b38ff370SJamie Gritton error = EINVAL; 1248b38ff370SJamie Gritton goto done_free; 12490304c731SJamie Gritton } else { 12506a3f2779SJamie Gritton ch_flags |= PR_IP4_USER; 12516a3f2779SJamie Gritton pr_flags |= PR_IP4_USER; 12526a3f2779SJamie Gritton if (ip4s > 0) { 1253eb8dcdeaSGleb Smirnoff ip4s /= sizeof(struct in_addr); 1254b38ff370SJamie Gritton if (ip4s > jail_max_af_ips) { 1255b38ff370SJamie Gritton error = EINVAL; 1256b38ff370SJamie Gritton vfs_opterror(opts, "too many IPv4 addresses"); 1257b38ff370SJamie Gritton goto done_errmsg; 1258b38ff370SJamie Gritton } 1259eb8dcdeaSGleb Smirnoff ip4 = prison_ip_copyin(PR_INET, op, ip4s); 1260eb8dcdeaSGleb Smirnoff if (ip4 == NULL) { 1261b38ff370SJamie Gritton error = EINVAL; 1262b38ff370SJamie Gritton goto done_free; 1263b38ff370SJamie Gritton } 1264b38ff370SJamie Gritton } 12650304c731SJamie Gritton } 1266b38ff370SJamie Gritton #endif 1267b38ff370SJamie Gritton 1268b38ff370SJamie Gritton #ifdef INET6 1269b38ff370SJamie Gritton error = vfs_getopt(opts, "ip6.addr", &op, &ip6s); 1270b38ff370SJamie Gritton if (error == ENOENT) 12710e5e396eSJamie Gritton ip6s = 0; 1272b38ff370SJamie Gritton else if (error != 0) 1273b38ff370SJamie Gritton goto done_free; 1274eb8dcdeaSGleb Smirnoff else if (ip6s & (sizeof(struct in6_addr) - 1)) { 1275b38ff370SJamie Gritton error = EINVAL; 1276b38ff370SJamie Gritton goto done_free; 12770304c731SJamie Gritton } else { 12786a3f2779SJamie Gritton ch_flags |= PR_IP6_USER; 12796a3f2779SJamie Gritton pr_flags |= PR_IP6_USER; 12806a3f2779SJamie Gritton if (ip6s > 0) { 1281eb8dcdeaSGleb Smirnoff ip6s /= sizeof(struct in6_addr); 1282b38ff370SJamie Gritton if (ip6s > jail_max_af_ips) { 1283b38ff370SJamie Gritton error = EINVAL; 1284b38ff370SJamie Gritton vfs_opterror(opts, "too many IPv6 addresses"); 1285b38ff370SJamie Gritton goto done_errmsg; 1286b38ff370SJamie Gritton } 1287eb8dcdeaSGleb Smirnoff ip6 = prison_ip_copyin(PR_INET6, op, ip6s); 1288eb8dcdeaSGleb Smirnoff if (ip6 == NULL) { 1289b38ff370SJamie Gritton error = EINVAL; 1290b38ff370SJamie Gritton goto done_free; 1291b38ff370SJamie Gritton } 1292b38ff370SJamie Gritton } 12930304c731SJamie Gritton } 1294b38ff370SJamie Gritton #endif 1295b38ff370SJamie Gritton 1296bdfc8cc4SJamie Gritton #if defined(VIMAGE) && (defined(INET) || defined(INET6)) 1297bdfc8cc4SJamie Gritton if ((ch_flags & PR_VNET) && (ch_flags & (PR_IP4_USER | PR_IP6_USER))) { 1298bdfc8cc4SJamie Gritton error = EINVAL; 1299bdfc8cc4SJamie Gritton vfs_opterror(opts, 1300bdfc8cc4SJamie Gritton "vnet jails cannot have IP address restrictions"); 1301bdfc8cc4SJamie Gritton goto done_errmsg; 1302bdfc8cc4SJamie Gritton } 1303bdfc8cc4SJamie Gritton #endif 1304bdfc8cc4SJamie Gritton 1305cf0313c6SJamie Gritton error = vfs_getopt(opts, "osrelease", (void **)&osrelstr, &len); 1306cf0313c6SJamie Gritton if (error == ENOENT) 1307cf0313c6SJamie Gritton osrelstr = NULL; 1308cf0313c6SJamie Gritton else if (error != 0) 1309cf0313c6SJamie Gritton goto done_free; 1310cf0313c6SJamie Gritton else { 1311cf0313c6SJamie Gritton if (flags & JAIL_UPDATE) { 1312cf0313c6SJamie Gritton error = EINVAL; 1313cf0313c6SJamie Gritton vfs_opterror(opts, 1314cf0313c6SJamie Gritton "osrelease cannot be changed after creation"); 1315cf0313c6SJamie Gritton goto done_errmsg; 1316cf0313c6SJamie Gritton } 13171b786d01SBjoern A. Zeeb if (len == 0 || osrelstr[len - 1] != '\0') { 1318cf0313c6SJamie Gritton error = EINVAL; 13191b786d01SBjoern A. Zeeb goto done_free; 13201b786d01SBjoern A. Zeeb } 13211b786d01SBjoern A. Zeeb if (len >= OSRELEASELEN) { 13221b786d01SBjoern A. Zeeb error = ENAMETOOLONG; 1323cf0313c6SJamie Gritton vfs_opterror(opts, 1324cf0313c6SJamie Gritton "osrelease string must be 1-%d bytes long", 1325cf0313c6SJamie Gritton OSRELEASELEN - 1); 1326cf0313c6SJamie Gritton goto done_errmsg; 1327cf0313c6SJamie Gritton } 1328cf0313c6SJamie Gritton } 1329cf0313c6SJamie Gritton 1330cf0313c6SJamie Gritton error = vfs_copyopt(opts, "osreldate", &osreldt, sizeof(osreldt)); 1331cf0313c6SJamie Gritton if (error == ENOENT) 1332cf0313c6SJamie Gritton osreldt = 0; 1333cf0313c6SJamie Gritton else if (error != 0) 1334cf0313c6SJamie Gritton goto done_free; 1335cf0313c6SJamie Gritton else { 1336cf0313c6SJamie Gritton if (flags & JAIL_UPDATE) { 1337cf0313c6SJamie Gritton error = EINVAL; 1338cf0313c6SJamie Gritton vfs_opterror(opts, 1339cf0313c6SJamie Gritton "osreldate cannot be changed after creation"); 1340cf0313c6SJamie Gritton goto done_errmsg; 1341cf0313c6SJamie Gritton } 1342cf0313c6SJamie Gritton if (osreldt == 0) { 1343cf0313c6SJamie Gritton error = EINVAL; 1344cf0313c6SJamie Gritton vfs_opterror(opts, "osreldate cannot be 0"); 1345cf0313c6SJamie Gritton goto done_errmsg; 1346cf0313c6SJamie Gritton } 1347cf0313c6SJamie Gritton } 1348cf0313c6SJamie Gritton 1349b38ff370SJamie Gritton root = NULL; 1350b38ff370SJamie Gritton error = vfs_getopt(opts, "path", (void **)&path, &len); 1351b38ff370SJamie Gritton if (error == ENOENT) 1352b38ff370SJamie Gritton path = NULL; 1353b38ff370SJamie Gritton else if (error != 0) 1354b38ff370SJamie Gritton goto done_free; 1355b38ff370SJamie Gritton else { 1356b38ff370SJamie Gritton if (flags & JAIL_UPDATE) { 1357b38ff370SJamie Gritton error = EINVAL; 1358b38ff370SJamie Gritton vfs_opterror(opts, 1359b38ff370SJamie Gritton "path cannot be changed after creation"); 1360b38ff370SJamie Gritton goto done_errmsg; 1361b38ff370SJamie Gritton } 1362b38ff370SJamie Gritton if (len == 0 || path[len - 1] != '\0') { 1363b38ff370SJamie Gritton error = EINVAL; 1364b38ff370SJamie Gritton goto done_free; 1365b38ff370SJamie Gritton } 13667e1d3eefSMateusz Guzik NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE, path); 1367b38ff370SJamie Gritton error = namei(&nd); 1368b38ff370SJamie Gritton if (error) 1369b38ff370SJamie Gritton goto done_free; 1370b38ff370SJamie Gritton root = nd.ni_vp; 1371bb92cd7bSMateusz Guzik NDFREE_PNBUF(&nd); 13726dfe0a3dSMartin Matuska g_path = malloc(MAXPATHLEN, M_TEMP, M_WAITOK); 13736dfe0a3dSMartin Matuska strlcpy(g_path, path, MAXPATHLEN); 13746dfe0a3dSMartin Matuska error = vn_path_to_global_path(td, root, g_path, MAXPATHLEN); 13753eb6b656SMateusz Guzik if (error == 0) { 13766dfe0a3dSMartin Matuska path = g_path; 13776dfe0a3dSMartin Matuska } else { 1378f6e633a9SMartin Matuska /* exit on other errors */ 1379b38ff370SJamie Gritton goto done_free; 1380b38ff370SJamie Gritton } 1381f6e633a9SMartin Matuska if (root->v_type != VDIR) { 1382f6e633a9SMartin Matuska error = ENOTDIR; 1383f6e633a9SMartin Matuska vput(root); 1384f6e633a9SMartin Matuska goto done_free; 1385f6e633a9SMartin Matuska } 1386b249ce48SMateusz Guzik VOP_UNLOCK(root); 1387b38ff370SJamie Gritton } 1388b38ff370SJamie Gritton 1389b38ff370SJamie Gritton /* 1390b6f47c23SJamie Gritton * Find the specified jail, or at least its parent. 1391b38ff370SJamie Gritton * This abuses the file error codes ENOENT and EEXIST. 1392b38ff370SJamie Gritton */ 1393b38ff370SJamie Gritton pr = NULL; 13947de883c8SJamie Gritton inspr = NULL; 1395babbbb9cSJamie Gritton if (cuflags == JAIL_CREATE && jid == 0 && name != NULL) { 1396babbbb9cSJamie Gritton namelc = strrchr(name, '.'); 1397babbbb9cSJamie Gritton jid = strtoul(namelc != NULL ? namelc + 1 : name, &p, 10); 1398babbbb9cSJamie Gritton if (*p != '\0') 1399babbbb9cSJamie Gritton jid = 0; 1400babbbb9cSJamie Gritton } 1401b6f47c23SJamie Gritton sx_xlock(&allprison_lock); 1402108a9384SJamie Gritton drflags = PD_LIST_XLOCKED; 14030a2a96f3SJamie Gritton ppr = mypr; 14040a2a96f3SJamie Gritton if (!prison_isalive(ppr)) { 14050a2a96f3SJamie Gritton /* This jail is dying. This process will surely follow. */ 14060a2a96f3SJamie Gritton error = EAGAIN; 14070a2a96f3SJamie Gritton goto done_deref; 14080a2a96f3SJamie Gritton } 1409b38ff370SJamie Gritton if (jid != 0) { 1410b38ff370SJamie Gritton if (jid < 0) { 1411b38ff370SJamie Gritton error = EINVAL; 1412b38ff370SJamie Gritton vfs_opterror(opts, "negative jid"); 14132a4b2251SJamie Gritton goto done_deref; 1414b38ff370SJamie Gritton } 14157de883c8SJamie Gritton /* 14167de883c8SJamie Gritton * See if a requested jid already exists. Keep track of 14177de883c8SJamie Gritton * where it can be inserted later. 14187de883c8SJamie Gritton */ 14197de883c8SJamie Gritton TAILQ_FOREACH(inspr, &allprison, pr_list) { 1420f7496dcaSJamie Gritton if (inspr->pr_id < jid) 1421f7496dcaSJamie Gritton continue; 1422f7496dcaSJamie Gritton if (inspr->pr_id > jid) 1423f7496dcaSJamie Gritton break; 14247de883c8SJamie Gritton pr = inspr; 1425f7496dcaSJamie Gritton mtx_lock(&pr->pr_mtx); 14262a4b2251SJamie Gritton drflags |= PD_LOCKED; 14277de883c8SJamie Gritton inspr = NULL; 14287de883c8SJamie Gritton break; 14297de883c8SJamie Gritton } 1430b38ff370SJamie Gritton if (pr != NULL) { 1431b38ff370SJamie Gritton /* Create: jid must not exist. */ 1432b38ff370SJamie Gritton if (cuflags == JAIL_CREATE) { 14337de883c8SJamie Gritton /* 14347de883c8SJamie Gritton * Even creators that cannot see the jail will 14357de883c8SJamie Gritton * get EEXIST. 14367de883c8SJamie Gritton */ 1437b38ff370SJamie Gritton error = EEXIST; 1438b38ff370SJamie Gritton vfs_opterror(opts, "jail %d already exists", 1439b38ff370SJamie Gritton jid); 14402a4b2251SJamie Gritton goto done_deref; 1441b38ff370SJamie Gritton } 14420304c731SJamie Gritton if (!prison_ischild(mypr, pr)) { 14437de883c8SJamie Gritton /* 14447de883c8SJamie Gritton * Updaters get ENOENT if they cannot see the 14457de883c8SJamie Gritton * jail. This is true even for CREATE | UPDATE, 14467de883c8SJamie Gritton * which normally cannot give this error. 14477de883c8SJamie Gritton */ 14482a4b2251SJamie Gritton error = ENOENT; 14492a4b2251SJamie Gritton vfs_opterror(opts, "jail %d not found", jid); 14502a4b2251SJamie Gritton goto done_deref; 1451f7496dcaSJamie Gritton } 14520a2a96f3SJamie Gritton ppr = pr->pr_parent; 14530a2a96f3SJamie Gritton if (!prison_isalive(ppr)) { 14540a2a96f3SJamie Gritton error = ENOENT; 14550a2a96f3SJamie Gritton vfs_opterror(opts, "jail %d is dying", 14560a2a96f3SJamie Gritton ppr->pr_id); 14570a2a96f3SJamie Gritton goto done_deref; 14580a2a96f3SJamie Gritton } 1459f7496dcaSJamie Gritton if (!prison_isalive(pr)) { 1460b38ff370SJamie Gritton if (!(flags & JAIL_DYING)) { 1461b38ff370SJamie Gritton error = ENOENT; 1462b38ff370SJamie Gritton vfs_opterror(opts, "jail %d is dying", 1463b38ff370SJamie Gritton jid); 14642a4b2251SJamie Gritton goto done_deref; 1465f7496dcaSJamie Gritton } 1466f7496dcaSJamie Gritton if ((flags & JAIL_ATTACH) || 1467b38ff370SJamie Gritton (pr_flags & PR_PERSIST)) { 1468b38ff370SJamie Gritton /* 1469b38ff370SJamie Gritton * A dying jail might be resurrected 1470b38ff370SJamie Gritton * (via attach or persist), but first 1471b38ff370SJamie Gritton * it must determine if another jail 1472b38ff370SJamie Gritton * has claimed its name. Accomplish 1473b38ff370SJamie Gritton * this by implicitly re-setting the 1474b38ff370SJamie Gritton * name. 1475b38ff370SJamie Gritton */ 1476b38ff370SJamie Gritton if (name == NULL) 14770304c731SJamie Gritton name = prison_name(mypr, pr); 1478b38ff370SJamie Gritton } 1479b38ff370SJamie Gritton } 14802a4b2251SJamie Gritton } else { 1481b38ff370SJamie Gritton /* Update: jid must exist. */ 1482b38ff370SJamie Gritton if (cuflags == JAIL_UPDATE) { 1483b38ff370SJamie Gritton error = ENOENT; 1484b38ff370SJamie Gritton vfs_opterror(opts, "jail %d not found", jid); 14852a4b2251SJamie Gritton goto done_deref; 1486b38ff370SJamie Gritton } 1487b38ff370SJamie Gritton } 1488b38ff370SJamie Gritton } 1489b38ff370SJamie Gritton /* 1490b38ff370SJamie Gritton * If the caller provided a name, look for a jail by that name. 1491b38ff370SJamie Gritton * This has different semantics for creates and updates keyed by jid 1492b38ff370SJamie Gritton * (where the name must not already exist in a different jail), 1493b38ff370SJamie Gritton * and updates keyed by the name itself (where the name must exist 1494b38ff370SJamie Gritton * because that is the jail being updated). 1495b38ff370SJamie Gritton */ 1496b6f47c23SJamie Gritton namelc = NULL; 1497b38ff370SJamie Gritton if (name != NULL) { 1498babbbb9cSJamie Gritton namelc = strrchr(name, '.'); 1499babbbb9cSJamie Gritton if (namelc == NULL) 1500babbbb9cSJamie Gritton namelc = name; 1501babbbb9cSJamie Gritton else { 15020304c731SJamie Gritton /* 15030304c731SJamie Gritton * This is a hierarchical name. Split it into the 15040304c731SJamie Gritton * parent and child names, and make sure the parent 15050304c731SJamie Gritton * exists or matches an already found jail. 15060304c731SJamie Gritton */ 15070304c731SJamie Gritton if (pr != NULL) { 1508babbbb9cSJamie Gritton if (strncmp(name, ppr->pr_name, namelc - name) 1509babbbb9cSJamie Gritton || ppr->pr_name[namelc - name] != '\0') { 15100304c731SJamie Gritton error = EINVAL; 15110304c731SJamie Gritton vfs_opterror(opts, 15120304c731SJamie Gritton "cannot change jail's parent"); 15132a4b2251SJamie Gritton goto done_deref; 15140304c731SJamie Gritton } 15150304c731SJamie Gritton } else { 1516b6f47c23SJamie Gritton *namelc = '\0'; 15170304c731SJamie Gritton ppr = prison_find_name(mypr, name); 15180304c731SJamie Gritton if (ppr == NULL) { 15190304c731SJamie Gritton error = ENOENT; 15200304c731SJamie Gritton vfs_opterror(opts, 15210304c731SJamie Gritton "jail \"%s\" not found", name); 15222a4b2251SJamie Gritton goto done_deref; 15230304c731SJamie Gritton } 1524c050ea80SJamie Gritton mtx_unlock(&ppr->pr_mtx); 15250a2a96f3SJamie Gritton if (!prison_isalive(ppr)) { 1526c050ea80SJamie Gritton error = ENOENT; 1527c050ea80SJamie Gritton vfs_opterror(opts, 1528c050ea80SJamie Gritton "jail \"%s\" is dying", name); 1529c050ea80SJamie Gritton goto done_deref; 1530c050ea80SJamie Gritton } 1531b6f47c23SJamie Gritton *namelc = '.'; 15320304c731SJamie Gritton } 1533b6f47c23SJamie Gritton namelc++; 15340304c731SJamie Gritton } 1535b6f47c23SJamie Gritton if (namelc[0] != '\0') { 1536b6f47c23SJamie Gritton pnamelen = 15370304c731SJamie Gritton (ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1; 15380304c731SJamie Gritton deadpr = NULL; 15390304c731SJamie Gritton FOREACH_PRISON_CHILD(ppr, tpr) { 15406754ae25SJamie Gritton if (tpr != pr && 1541b6f47c23SJamie Gritton !strcmp(tpr->pr_name + pnamelen, namelc)) { 154276ad42abSJamie Gritton if (prison_isalive(tpr)) { 1543b38ff370SJamie Gritton if (pr == NULL && 1544b38ff370SJamie Gritton cuflags != JAIL_CREATE) { 1545b38ff370SJamie Gritton /* 1546b38ff370SJamie Gritton * Use this jail 1547b38ff370SJamie Gritton * for updates. 1548b38ff370SJamie Gritton */ 1549b38ff370SJamie Gritton pr = tpr; 1550f7496dcaSJamie Gritton mtx_lock(&pr->pr_mtx); 155183bc72a0SJamie Gritton drflags |= PD_LOCKED; 1552b38ff370SJamie Gritton break; 1553b38ff370SJamie Gritton } 1554b38ff370SJamie Gritton /* 1555b38ff370SJamie Gritton * Create, or update(jid): 1556b38ff370SJamie Gritton * name must not exist in an 15570304c731SJamie Gritton * active sibling jail. 1558b38ff370SJamie Gritton */ 1559b38ff370SJamie Gritton error = EEXIST; 1560b38ff370SJamie Gritton vfs_opterror(opts, 1561b38ff370SJamie Gritton "jail \"%s\" already exists", 1562b38ff370SJamie Gritton name); 15632a4b2251SJamie Gritton goto done_deref; 1564b38ff370SJamie Gritton } 156576ad42abSJamie Gritton if (pr == NULL && 1566f7496dcaSJamie Gritton cuflags != JAIL_CREATE) { 156776ad42abSJamie Gritton deadpr = tpr; 1568f7496dcaSJamie Gritton } 1569b38ff370SJamie Gritton } 1570b38ff370SJamie Gritton } 1571b38ff370SJamie Gritton /* If no active jail is found, use a dying one. */ 1572b38ff370SJamie Gritton if (deadpr != NULL && pr == NULL) { 1573b38ff370SJamie Gritton if (flags & JAIL_DYING) { 1574b38ff370SJamie Gritton pr = deadpr; 1575f7496dcaSJamie Gritton mtx_lock(&pr->pr_mtx); 15762a4b2251SJamie Gritton drflags |= PD_LOCKED; 1577b38ff370SJamie Gritton } else if (cuflags == JAIL_UPDATE) { 1578b38ff370SJamie Gritton error = ENOENT; 1579b38ff370SJamie Gritton vfs_opterror(opts, 1580b38ff370SJamie Gritton "jail \"%s\" is dying", name); 15812a4b2251SJamie Gritton goto done_deref; 1582b38ff370SJamie Gritton } 1583b38ff370SJamie Gritton } 1584b38ff370SJamie Gritton /* Update: name must exist if no jid. */ 1585b38ff370SJamie Gritton else if (cuflags == JAIL_UPDATE && pr == NULL) { 1586b38ff370SJamie Gritton error = ENOENT; 1587b38ff370SJamie Gritton vfs_opterror(opts, "jail \"%s\" not found", 1588b38ff370SJamie Gritton name); 15892a4b2251SJamie Gritton goto done_deref; 1590b38ff370SJamie Gritton } 1591b38ff370SJamie Gritton } 1592b38ff370SJamie Gritton } 1593b38ff370SJamie Gritton /* Update: must provide a jid or name. */ 1594b38ff370SJamie Gritton else if (cuflags == JAIL_UPDATE && pr == NULL) { 1595b38ff370SJamie Gritton error = ENOENT; 1596b38ff370SJamie Gritton vfs_opterror(opts, "update specified no jail"); 15972a4b2251SJamie Gritton goto done_deref; 1598b38ff370SJamie Gritton } 1599b38ff370SJamie Gritton 1600b38ff370SJamie Gritton /* If there's no prison to update, create a new one and link it in. */ 16012a4b2251SJamie Gritton created = pr == NULL; 16022a4b2251SJamie Gritton if (created) { 1603b97457e2SJamie Gritton for (tpr = mypr; tpr != NULL; tpr = tpr->pr_parent) 1604b97457e2SJamie Gritton if (tpr->pr_childcount >= tpr->pr_childmax) { 1605b97457e2SJamie Gritton error = EPERM; 1606b97457e2SJamie Gritton vfs_opterror(opts, "prison limit exceeded"); 16072a4b2251SJamie Gritton goto done_deref; 1608b97457e2SJamie Gritton } 16097de883c8SJamie Gritton if (jid == 0 && (jid = get_next_prid(&inspr)) == 0) { 1610b38ff370SJamie Gritton error = EAGAIN; 16117de883c8SJamie Gritton vfs_opterror(opts, "no available jail IDs"); 16122a4b2251SJamie Gritton goto done_deref; 1613b38ff370SJamie Gritton } 16142a4b2251SJamie Gritton 16152a4b2251SJamie Gritton pr = malloc(sizeof(*pr), M_PRISON, M_WAITOK | M_ZERO); 16161158508aSJamie Gritton pr->pr_state = PRISON_STATE_INVALID; 16171158508aSJamie Gritton refcount_init(&pr->pr_ref, 1); 1618f7496dcaSJamie Gritton refcount_init(&pr->pr_uref, 0); 16191158508aSJamie Gritton drflags |= PD_DEREF; 16202a4b2251SJamie Gritton LIST_INIT(&pr->pr_children); 16212a4b2251SJamie Gritton mtx_init(&pr->pr_mtx, "jail mutex", NULL, MTX_DEF | MTX_DUPOK); 16222a4b2251SJamie Gritton TASK_INIT(&pr->pr_task, 0, prison_complete, pr); 16232a4b2251SJamie Gritton 16247de883c8SJamie Gritton pr->pr_id = jid; 16257de883c8SJamie Gritton if (inspr != NULL) 16267de883c8SJamie Gritton TAILQ_INSERT_BEFORE(inspr, pr, pr_list); 16277de883c8SJamie Gritton else 1628b38ff370SJamie Gritton TAILQ_INSERT_TAIL(&allprison, pr, pr_list); 16297de883c8SJamie Gritton 16307de883c8SJamie Gritton pr->pr_parent = ppr; 16310a2a96f3SJamie Gritton prison_hold(ppr); 16320a2a96f3SJamie Gritton prison_proc_hold(ppr); 16330304c731SJamie Gritton LIST_INSERT_HEAD(&ppr->pr_children, pr, pr_sibling); 16340304c731SJamie Gritton for (tpr = ppr; tpr != NULL; tpr = tpr->pr_parent) 1635b97457e2SJamie Gritton tpr->pr_childcount++; 1636b38ff370SJamie Gritton 16370304c731SJamie Gritton /* Set some default values, and inherit some from the parent. */ 1638b6f47c23SJamie Gritton if (namelc == NULL) 1639b6f47c23SJamie Gritton namelc = ""; 1640b38ff370SJamie Gritton if (path == NULL) { 1641b38ff370SJamie Gritton path = "/"; 16420304c731SJamie Gritton root = mypr->pr_root; 1643b38ff370SJamie Gritton vref(root); 1644b38ff370SJamie Gritton } 16458986e3a0SJamie Gritton strlcpy(pr->pr_hostuuid, DEFAULT_HOSTUUID, HOSTUUIDLEN); 16468986e3a0SJamie Gritton pr->pr_flags |= PR_HOST; 1647bdfc8cc4SJamie Gritton #if defined(INET) || defined(INET6) 1648bdfc8cc4SJamie Gritton #ifdef VIMAGE 1649bdfc8cc4SJamie Gritton if (!(pr_flags & PR_VNET)) 1650bdfc8cc4SJamie Gritton #endif 1651bdfc8cc4SJamie Gritton { 16520304c731SJamie Gritton #ifdef INET 16532b0d6f81SJamie Gritton if (!(ch_flags & PR_IP4_USER)) 16546a3f2779SJamie Gritton pr->pr_flags |= PR_IP4 | PR_IP4_USER; 16552b0d6f81SJamie Gritton else if (!(pr_flags & PR_IP4_USER)) { 16562b0d6f81SJamie Gritton pr->pr_flags |= ppr->pr_flags & PR_IP4; 1657eb8dcdeaSGleb Smirnoff prison_ip_dup(ppr, pr, PR_INET); 16582b0d6f81SJamie Gritton } 16590304c731SJamie Gritton #endif 16600304c731SJamie Gritton #ifdef INET6 16612b0d6f81SJamie Gritton if (!(ch_flags & PR_IP6_USER)) 16626a3f2779SJamie Gritton pr->pr_flags |= PR_IP6 | PR_IP6_USER; 16632b0d6f81SJamie Gritton else if (!(pr_flags & PR_IP6_USER)) { 16642b0d6f81SJamie Gritton pr->pr_flags |= ppr->pr_flags & PR_IP6; 1665eb8dcdeaSGleb Smirnoff prison_ip_dup(ppr, pr, PR_INET6); 16662b0d6f81SJamie Gritton } 16670304c731SJamie Gritton #endif 1668bdfc8cc4SJamie Gritton } 1669bdfc8cc4SJamie Gritton #endif 1670592bcae8SBjoern A. Zeeb /* Source address selection is always on by default. */ 1671592bcae8SBjoern A. Zeeb pr->pr_flags |= _PR_IP_SADDRSEL; 1672592bcae8SBjoern A. Zeeb 16730304c731SJamie Gritton pr->pr_securelevel = ppr->pr_securelevel; 16740304c731SJamie Gritton pr->pr_allow = JAIL_DEFAULT_ALLOW & ppr->pr_allow; 1675af10bf05SBjoern A. Zeeb pr->pr_enforce_statfs = jail_default_enforce_statfs; 1676bf3db8aaSMartin Matuska pr->pr_devfs_rsnum = ppr->pr_devfs_rsnum; 1677b38ff370SJamie Gritton 1678b96bd95bSIan Lepore pr->pr_osreldate = osreldt ? osreldt : ppr->pr_osreldate; 1679b96bd95bSIan Lepore if (osrelstr == NULL) 16801b786d01SBjoern A. Zeeb strlcpy(pr->pr_osrelease, ppr->pr_osrelease, 16811b786d01SBjoern A. Zeeb sizeof(pr->pr_osrelease)); 1682b96bd95bSIan Lepore else 16831b786d01SBjoern A. Zeeb strlcpy(pr->pr_osrelease, osrelstr, 16841b786d01SBjoern A. Zeeb sizeof(pr->pr_osrelease)); 1685b96bd95bSIan Lepore 1686679e1390SJamie Gritton #ifdef VIMAGE 1687679e1390SJamie Gritton /* Allocate a new vnet if specified. */ 1688679e1390SJamie Gritton pr->pr_vnet = (pr_flags & PR_VNET) 1689679e1390SJamie Gritton ? vnet_alloc() : ppr->pr_vnet; 1690679e1390SJamie Gritton #endif 1691b38ff370SJamie Gritton /* 1692b38ff370SJamie Gritton * Allocate a dedicated cpuset for each jail. 16938771ff75SGordon Bergling * Unlike other initial settings, this may return an error. 1694b38ff370SJamie Gritton */ 16950304c731SJamie Gritton error = cpuset_create_root(ppr, &pr->pr_cpuset); 16962a4b2251SJamie Gritton if (error) 16972a4b2251SJamie Gritton goto done_deref; 1698b38ff370SJamie Gritton 1699b38ff370SJamie Gritton mtx_lock(&pr->pr_mtx); 17002a4b2251SJamie Gritton drflags |= PD_LOCKED; 1701b38ff370SJamie Gritton } else { 17022b0d6f81SJamie Gritton /* 17032b0d6f81SJamie Gritton * Grab a reference for existing prisons, to ensure they 17042b0d6f81SJamie Gritton * continue to exist for the duration of the call. 17052b0d6f81SJamie Gritton */ 17066754ae25SJamie Gritton prison_hold(pr); 17072a4b2251SJamie Gritton drflags |= PD_DEREF; 1708bdfc8cc4SJamie Gritton #if defined(VIMAGE) && (defined(INET) || defined(INET6)) 1709bdfc8cc4SJamie Gritton if ((pr->pr_flags & PR_VNET) && 1710bdfc8cc4SJamie Gritton (ch_flags & (PR_IP4_USER | PR_IP6_USER))) { 1711bdfc8cc4SJamie Gritton error = EINVAL; 1712bdfc8cc4SJamie Gritton vfs_opterror(opts, 1713bdfc8cc4SJamie Gritton "vnet jails cannot have IP address restrictions"); 17142a4b2251SJamie Gritton goto done_deref; 1715bdfc8cc4SJamie Gritton } 1716bdfc8cc4SJamie Gritton #endif 17172b0d6f81SJamie Gritton #ifdef INET 17182b0d6f81SJamie Gritton if (PR_IP4_USER & ch_flags & (pr_flags ^ pr->pr_flags)) { 17192b0d6f81SJamie Gritton error = EINVAL; 17202b0d6f81SJamie Gritton vfs_opterror(opts, 17212b0d6f81SJamie Gritton "ip4 cannot be changed after creation"); 17222a4b2251SJamie Gritton goto done_deref; 17232b0d6f81SJamie Gritton } 17242b0d6f81SJamie Gritton #endif 17252b0d6f81SJamie Gritton #ifdef INET6 17262b0d6f81SJamie Gritton if (PR_IP6_USER & ch_flags & (pr_flags ^ pr->pr_flags)) { 17272b0d6f81SJamie Gritton error = EINVAL; 17282b0d6f81SJamie Gritton vfs_opterror(opts, 17292b0d6f81SJamie Gritton "ip6 cannot be changed after creation"); 17302a4b2251SJamie Gritton goto done_deref; 17312b0d6f81SJamie Gritton } 17322b0d6f81SJamie Gritton #endif 1733b38ff370SJamie Gritton } 1734b38ff370SJamie Gritton 1735b38ff370SJamie Gritton /* Do final error checking before setting anything. */ 17360304c731SJamie Gritton if (gotslevel) { 17370304c731SJamie Gritton if (slevel < ppr->pr_securelevel) { 17380304c731SJamie Gritton error = EPERM; 17392a4b2251SJamie Gritton goto done_deref; 17400304c731SJamie Gritton } 17410304c731SJamie Gritton } 1742b97457e2SJamie Gritton if (gotchildmax) { 1743b97457e2SJamie Gritton if (childmax >= ppr->pr_childmax) { 1744b97457e2SJamie Gritton error = EPERM; 17452a4b2251SJamie Gritton goto done_deref; 1746b97457e2SJamie Gritton } 1747b97457e2SJamie Gritton } 17480304c731SJamie Gritton if (gotenforce) { 17490304c731SJamie Gritton if (enforce < ppr->pr_enforce_statfs) { 17500304c731SJamie Gritton error = EPERM; 17512a4b2251SJamie Gritton goto done_deref; 17520304c731SJamie Gritton } 17530304c731SJamie Gritton } 17540cc207a6SMartin Matuska if (gotrsnum) { 17550cc207a6SMartin Matuska /* 17560cc207a6SMartin Matuska * devfs_rsnum is a uint16_t 17570cc207a6SMartin Matuska */ 1758bf3db8aaSMartin Matuska if (rsnum < 0 || rsnum > 65535) { 17590cc207a6SMartin Matuska error = EINVAL; 17602a4b2251SJamie Gritton goto done_deref; 17610cc207a6SMartin Matuska } 17620cc207a6SMartin Matuska /* 1763bf3db8aaSMartin Matuska * Nested jails always inherit parent's devfs ruleset 17640cc207a6SMartin Matuska */ 17650cc207a6SMartin Matuska if (jailed(td->td_ucred)) { 17660cc207a6SMartin Matuska if (rsnum > 0 && rsnum != ppr->pr_devfs_rsnum) { 17670cc207a6SMartin Matuska error = EPERM; 17682a4b2251SJamie Gritton goto done_deref; 1769bf3db8aaSMartin Matuska } else 17700cc207a6SMartin Matuska rsnum = ppr->pr_devfs_rsnum; 17710cc207a6SMartin Matuska } 17720cc207a6SMartin Matuska } 1773b38ff370SJamie Gritton #ifdef INET 17742b0d6f81SJamie Gritton if (ip4s > 0) { 1775eb8dcdeaSGleb Smirnoff if ((ppr->pr_flags & PR_IP4) && 1776eb8dcdeaSGleb Smirnoff !prison_ip_parent_match(ppr->pr_addrs[PR_INET], ip4, 1777eb8dcdeaSGleb Smirnoff PR_INET)) { 17780304c731SJamie Gritton error = EPERM; 17792a4b2251SJamie Gritton goto done_deref; 17800304c731SJamie Gritton } 1781eb8dcdeaSGleb Smirnoff if (!prison_ip_conflict_check(ppr, pr, ip4, PR_INET)) { 17820304c731SJamie Gritton error = EADDRINUSE; 1783eb8dcdeaSGleb Smirnoff vfs_opterror(opts, "IPv4 addresses clash"); 17842a4b2251SJamie Gritton goto done_deref; 1785b38ff370SJamie Gritton } 17860304c731SJamie Gritton } 1787b38ff370SJamie Gritton #endif 1788b38ff370SJamie Gritton #ifdef INET6 17892b0d6f81SJamie Gritton if (ip6s > 0) { 1790eb8dcdeaSGleb Smirnoff if ((ppr->pr_flags & PR_IP6) && 1791eb8dcdeaSGleb Smirnoff !prison_ip_parent_match(ppr->pr_addrs[PR_INET6], ip6, 1792eb8dcdeaSGleb Smirnoff PR_INET6)) { 17930304c731SJamie Gritton error = EPERM; 17942a4b2251SJamie Gritton goto done_deref; 17950304c731SJamie Gritton } 1796eb8dcdeaSGleb Smirnoff if (!prison_ip_conflict_check(ppr, pr, ip6, PR_INET6)) { 17970304c731SJamie Gritton error = EADDRINUSE; 1798eb8dcdeaSGleb Smirnoff vfs_opterror(opts, "IPv6 addresses clash"); 17992a4b2251SJamie Gritton goto done_deref; 1800b38ff370SJamie Gritton } 18010304c731SJamie Gritton } 1802b38ff370SJamie Gritton #endif 18030304c731SJamie Gritton onamelen = namelen = 0; 1804b6f47c23SJamie Gritton if (namelc != NULL) { 18056ab6058eSJamie Gritton /* Give a default name of the jid. Also allow the name to be 18066ab6058eSJamie Gritton * explicitly the jid - but not any other number, and only in 18076ab6058eSJamie Gritton * normal form (no leading zero/etc). 18086ab6058eSJamie Gritton */ 1809b6f47c23SJamie Gritton if (namelc[0] == '\0') 1810b6f47c23SJamie Gritton snprintf(namelc = numbuf, sizeof(numbuf), "%d", jid); 18116ab6058eSJamie Gritton else if ((strtoul(namelc, &p, 10) != jid || 18126ab6058eSJamie Gritton namelc[0] < '1' || namelc[0] > '9') && *p == '\0') { 1813b38ff370SJamie Gritton error = EINVAL; 1814babbbb9cSJamie Gritton vfs_opterror(opts, 1815babbbb9cSJamie Gritton "name cannot be numeric (unless it is the jid)"); 18162a4b2251SJamie Gritton goto done_deref; 1817b38ff370SJamie Gritton } 1818b38ff370SJamie Gritton /* 18190304c731SJamie Gritton * Make sure the name isn't too long for the prison or its 18200304c731SJamie Gritton * children. 1821b38ff370SJamie Gritton */ 1822b6f47c23SJamie Gritton pnamelen = (ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1; 1823b6f47c23SJamie Gritton onamelen = strlen(pr->pr_name + pnamelen); 1824b6f47c23SJamie Gritton namelen = strlen(namelc); 1825b6f47c23SJamie Gritton if (pnamelen + namelen + 1 > sizeof(pr->pr_name)) { 18260304c731SJamie Gritton error = ENAMETOOLONG; 18272a4b2251SJamie Gritton goto done_deref; 18280304c731SJamie Gritton } 18290304c731SJamie Gritton FOREACH_PRISON_DESCENDANT(pr, tpr, descend) { 18300304c731SJamie Gritton if (strlen(tpr->pr_name) + (namelen - onamelen) >= 18310304c731SJamie Gritton sizeof(pr->pr_name)) { 18320304c731SJamie Gritton error = ENAMETOOLONG; 18332a4b2251SJamie Gritton goto done_deref; 18340304c731SJamie Gritton } 18350304c731SJamie Gritton } 18360304c731SJamie Gritton } 1837b3079544SJamie Gritton pr_allow_diff = pr_allow & ~ppr->pr_allow; 1838b3079544SJamie Gritton if (pr_allow_diff & ~PR_ALLOW_DIFFERENCES) { 18390304c731SJamie Gritton error = EPERM; 18402a4b2251SJamie Gritton goto done_deref; 1841b38ff370SJamie Gritton } 1842b38ff370SJamie Gritton 1843b6f47c23SJamie Gritton /* 1844b6f47c23SJamie Gritton * Let modules check their parameters. This requires unlocking and 1845b6f47c23SJamie Gritton * then re-locking the prison, but this is still a valid state as long 1846b6f47c23SJamie Gritton * as allprison_lock remains xlocked. 1847b6f47c23SJamie Gritton */ 1848b6f47c23SJamie Gritton mtx_unlock(&pr->pr_mtx); 18492a4b2251SJamie Gritton drflags &= ~PD_LOCKED; 1850b6f47c23SJamie Gritton error = osd_jail_call(pr, PR_METHOD_CHECK, opts); 18512a4b2251SJamie Gritton if (error != 0) 18522a4b2251SJamie Gritton goto done_deref; 1853b6f47c23SJamie Gritton mtx_lock(&pr->pr_mtx); 18542a4b2251SJamie Gritton drflags |= PD_LOCKED; 1855b6f47c23SJamie Gritton 1856b6f47c23SJamie Gritton /* At this point, all valid parameters should have been noted. */ 1857b6f47c23SJamie Gritton TAILQ_FOREACH(opt, opts, link) { 1858b6f47c23SJamie Gritton if (!opt->seen && strcmp(opt->name, "errmsg")) { 1859b6f47c23SJamie Gritton error = EINVAL; 1860b6f47c23SJamie Gritton vfs_opterror(opts, "unknown parameter: %s", opt->name); 18612a4b2251SJamie Gritton goto done_deref; 1862b6f47c23SJamie Gritton } 1863b6f47c23SJamie Gritton } 1864b6f47c23SJamie Gritton 1865b38ff370SJamie Gritton /* Set the parameters of the prison. */ 1866b38ff370SJamie Gritton #ifdef INET 18670304c731SJamie Gritton redo_ip4 = 0; 18680304c731SJamie Gritton if (pr_flags & PR_IP4_USER) { 18690304c731SJamie Gritton pr->pr_flags |= PR_IP4; 1870eb8dcdeaSGleb Smirnoff prison_ip_set(pr, PR_INET, ip4); 1871b38ff370SJamie Gritton ip4 = NULL; 18720304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 1873bdfc8cc4SJamie Gritton #ifdef VIMAGE 1874bdfc8cc4SJamie Gritton if (tpr->pr_flags & PR_VNET) { 1875bdfc8cc4SJamie Gritton descend = 0; 1876bdfc8cc4SJamie Gritton continue; 1877bdfc8cc4SJamie Gritton } 1878bdfc8cc4SJamie Gritton #endif 1879eb8dcdeaSGleb Smirnoff if (prison_ip_restrict(tpr, PR_INET, NULL)) { 18800304c731SJamie Gritton redo_ip4 = 1; 18810304c731SJamie Gritton descend = 0; 18820304c731SJamie Gritton } 18830304c731SJamie Gritton } 18840304c731SJamie Gritton } 1885b38ff370SJamie Gritton #endif 1886b38ff370SJamie Gritton #ifdef INET6 18870304c731SJamie Gritton redo_ip6 = 0; 18880304c731SJamie Gritton if (pr_flags & PR_IP6_USER) { 18890304c731SJamie Gritton pr->pr_flags |= PR_IP6; 1890eb8dcdeaSGleb Smirnoff prison_ip_set(pr, PR_INET6, ip6); 1891b38ff370SJamie Gritton ip6 = NULL; 18920304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 1893bdfc8cc4SJamie Gritton #ifdef VIMAGE 1894bdfc8cc4SJamie Gritton if (tpr->pr_flags & PR_VNET) { 1895bdfc8cc4SJamie Gritton descend = 0; 1896bdfc8cc4SJamie Gritton continue; 1897bdfc8cc4SJamie Gritton } 1898bdfc8cc4SJamie Gritton #endif 1899eb8dcdeaSGleb Smirnoff if (prison_ip_restrict(tpr, PR_INET6, NULL)) { 19000304c731SJamie Gritton redo_ip6 = 1; 19010304c731SJamie Gritton descend = 0; 19020304c731SJamie Gritton } 19030304c731SJamie Gritton } 19040304c731SJamie Gritton } 1905b38ff370SJamie Gritton #endif 19060304c731SJamie Gritton if (gotslevel) { 1907b38ff370SJamie Gritton pr->pr_securelevel = slevel; 19080304c731SJamie Gritton /* Set all child jails to be at least this level. */ 19090304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) 19100304c731SJamie Gritton if (tpr->pr_securelevel < slevel) 19110304c731SJamie Gritton tpr->pr_securelevel = slevel; 19120304c731SJamie Gritton } 1913b97457e2SJamie Gritton if (gotchildmax) { 1914b97457e2SJamie Gritton pr->pr_childmax = childmax; 1915b97457e2SJamie Gritton /* Set all child jails to under this limit. */ 1916b97457e2SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED_LEVEL(pr, tpr, descend, level) 1917b97457e2SJamie Gritton if (tpr->pr_childmax > childmax - level) 1918b97457e2SJamie Gritton tpr->pr_childmax = childmax > level 1919b97457e2SJamie Gritton ? childmax - level : 0; 1920b97457e2SJamie Gritton } 19210304c731SJamie Gritton if (gotenforce) { 19220304c731SJamie Gritton pr->pr_enforce_statfs = enforce; 19230304c731SJamie Gritton /* Pass this restriction on to the children. */ 19240304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) 19250304c731SJamie Gritton if (tpr->pr_enforce_statfs < enforce) 19260304c731SJamie Gritton tpr->pr_enforce_statfs = enforce; 19270304c731SJamie Gritton } 19280cc207a6SMartin Matuska if (gotrsnum) { 19290cc207a6SMartin Matuska pr->pr_devfs_rsnum = rsnum; 19300cc207a6SMartin Matuska /* Pass this restriction on to the children. */ 19310cc207a6SMartin Matuska FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) 19320cc207a6SMartin Matuska tpr->pr_devfs_rsnum = rsnum; 19330cc207a6SMartin Matuska } 1934b6f47c23SJamie Gritton if (namelc != NULL) { 19350304c731SJamie Gritton if (ppr == &prison0) 1936b6f47c23SJamie Gritton strlcpy(pr->pr_name, namelc, sizeof(pr->pr_name)); 19370304c731SJamie Gritton else 19380304c731SJamie Gritton snprintf(pr->pr_name, sizeof(pr->pr_name), "%s.%s", 1939b6f47c23SJamie Gritton ppr->pr_name, namelc); 19400304c731SJamie Gritton /* Change this component of child names. */ 19410304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 19420304c731SJamie Gritton bcopy(tpr->pr_name + onamelen, tpr->pr_name + namelen, 19430304c731SJamie Gritton strlen(tpr->pr_name + onamelen) + 1); 19440304c731SJamie Gritton bcopy(pr->pr_name, tpr->pr_name, namelen); 19450304c731SJamie Gritton } 19460304c731SJamie Gritton } 1947b38ff370SJamie Gritton if (path != NULL) { 19480304c731SJamie Gritton /* Try to keep a real-rooted full pathname. */ 1949b38ff370SJamie Gritton strlcpy(pr->pr_path, path, sizeof(pr->pr_path)); 1950b38ff370SJamie Gritton pr->pr_root = root; 19512a4b2251SJamie Gritton root = NULL; 1952b38ff370SJamie Gritton } 195376ca6f88SJamie Gritton if (PR_HOST & ch_flags & ~pr_flags) { 195476ca6f88SJamie Gritton if (pr->pr_flags & PR_HOST) { 195576ca6f88SJamie Gritton /* 195676ca6f88SJamie Gritton * Copy the parent's host info. As with pr_ip4 above, 195776ca6f88SJamie Gritton * the lack of a lock on the parent is not a problem; 195876ca6f88SJamie Gritton * it is always set with allprison_lock at least 195976ca6f88SJamie Gritton * shared, and is held exclusively here. 196076ca6f88SJamie Gritton */ 1961c1f19219SJamie Gritton strlcpy(pr->pr_hostname, pr->pr_parent->pr_hostname, 1962c1f19219SJamie Gritton sizeof(pr->pr_hostname)); 1963c1f19219SJamie Gritton strlcpy(pr->pr_domainname, pr->pr_parent->pr_domainname, 1964c1f19219SJamie Gritton sizeof(pr->pr_domainname)); 1965c1f19219SJamie Gritton strlcpy(pr->pr_hostuuid, pr->pr_parent->pr_hostuuid, 1966c1f19219SJamie Gritton sizeof(pr->pr_hostuuid)); 196776ca6f88SJamie Gritton pr->pr_hostid = pr->pr_parent->pr_hostid; 196876ca6f88SJamie Gritton } 196976ca6f88SJamie Gritton } else if (host != NULL || domain != NULL || uuid != NULL || gothid) { 197076ca6f88SJamie Gritton /* Set this prison, and any descendants without PR_HOST. */ 1971b38ff370SJamie Gritton if (host != NULL) 1972c1f19219SJamie Gritton strlcpy(pr->pr_hostname, host, sizeof(pr->pr_hostname)); 197376ca6f88SJamie Gritton if (domain != NULL) 1974c1f19219SJamie Gritton strlcpy(pr->pr_domainname, domain, 1975c1f19219SJamie Gritton sizeof(pr->pr_domainname)); 197676ca6f88SJamie Gritton if (uuid != NULL) 1977c1f19219SJamie Gritton strlcpy(pr->pr_hostuuid, uuid, sizeof(pr->pr_hostuuid)); 197876ca6f88SJamie Gritton if (gothid) 197976ca6f88SJamie Gritton pr->pr_hostid = hid; 198076ca6f88SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 198176ca6f88SJamie Gritton if (tpr->pr_flags & PR_HOST) 198276ca6f88SJamie Gritton descend = 0; 198376ca6f88SJamie Gritton else { 198476ca6f88SJamie Gritton if (host != NULL) 1985c1f19219SJamie Gritton strlcpy(tpr->pr_hostname, 1986c1f19219SJamie Gritton pr->pr_hostname, 1987c1f19219SJamie Gritton sizeof(tpr->pr_hostname)); 198876ca6f88SJamie Gritton if (domain != NULL) 1989c1f19219SJamie Gritton strlcpy(tpr->pr_domainname, 1990c1f19219SJamie Gritton pr->pr_domainname, 1991c1f19219SJamie Gritton sizeof(tpr->pr_domainname)); 199276ca6f88SJamie Gritton if (uuid != NULL) 1993c1f19219SJamie Gritton strlcpy(tpr->pr_hostuuid, 1994c1f19219SJamie Gritton pr->pr_hostuuid, 1995c1f19219SJamie Gritton sizeof(tpr->pr_hostuuid)); 199676ca6f88SJamie Gritton if (gothid) 199776ca6f88SJamie Gritton tpr->pr_hostid = hid; 199876ca6f88SJamie Gritton } 199976ca6f88SJamie Gritton } 200076ca6f88SJamie Gritton } 20010304c731SJamie Gritton pr->pr_allow = (pr->pr_allow & ~ch_allow) | pr_allow; 20020fe74ae6SJamie Gritton if ((tallow = ch_allow & ~pr_allow)) 20030fe74ae6SJamie Gritton prison_set_allow_locked(pr, tallow, 0); 2004b38ff370SJamie Gritton /* 2005b38ff370SJamie Gritton * Persistent prisons get an extra reference, and prisons losing their 20061158508aSJamie Gritton * persist flag lose that reference. 2007b38ff370SJamie Gritton */ 200876ad42abSJamie Gritton born = !prison_isalive(pr); 20091158508aSJamie Gritton if (ch_flags & PR_PERSIST & (pr_flags ^ pr->pr_flags)) { 2010b38ff370SJamie Gritton if (pr_flags & PR_PERSIST) { 20116754ae25SJamie Gritton prison_hold(pr); 20121158508aSJamie Gritton /* 20131158508aSJamie Gritton * This may make a dead prison alive again, but wait 20141158508aSJamie Gritton * to label it as such until after OSD calls have had 20151158508aSJamie Gritton * a chance to run (and perhaps to fail). 20161158508aSJamie Gritton */ 20176754ae25SJamie Gritton refcount_acquire(&pr->pr_uref); 2018b38ff370SJamie Gritton } else { 201939c8ef90SJamie Gritton drflags |= PD_DEUREF; 2020f7496dcaSJamie Gritton prison_free_not_last(pr); 2021b38ff370SJamie Gritton } 2022b38ff370SJamie Gritton } 2023b38ff370SJamie Gritton pr->pr_flags = (pr->pr_flags & ~ch_flags) | pr_flags; 2024b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 20252a4b2251SJamie Gritton drflags &= ~PD_LOCKED; 2026c861373bSJamie Gritton /* 2027c861373bSJamie Gritton * Any errors past this point will need to de-persist newly created 2028c861373bSJamie Gritton * prisons, as well as call remove methods. 2029c861373bSJamie Gritton */ 2030c861373bSJamie Gritton if (born) 2031c861373bSJamie Gritton drflags |= PD_KILL; 2032b38ff370SJamie Gritton 2033a7ad07bfSEdward Tomasz Napierala #ifdef RACCT 20344b5c9cf6SEdward Tomasz Napierala if (racct_enable && created) 2035a7ad07bfSEdward Tomasz Napierala prison_racct_attach(pr); 2036a7ad07bfSEdward Tomasz Napierala #endif 2037a7ad07bfSEdward Tomasz Napierala 20380304c731SJamie Gritton /* Locks may have prevented a complete restriction of child IP 20390304c731SJamie Gritton * addresses. If so, allocate some more memory and try again. 20400304c731SJamie Gritton */ 20410304c731SJamie Gritton #ifdef INET 20420304c731SJamie Gritton while (redo_ip4) { 2043eb8dcdeaSGleb Smirnoff ip4s = pr->pr_addrs[PR_INET]->ips; 2044eb8dcdeaSGleb Smirnoff ip4 = prison_ip_alloc(PR_INET, ip4s, M_WAITOK); 20450304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 20460304c731SJamie Gritton redo_ip4 = 0; 20470304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 2048bdfc8cc4SJamie Gritton #ifdef VIMAGE 2049bdfc8cc4SJamie Gritton if (tpr->pr_flags & PR_VNET) { 2050bdfc8cc4SJamie Gritton descend = 0; 2051bdfc8cc4SJamie Gritton continue; 2052bdfc8cc4SJamie Gritton } 2053bdfc8cc4SJamie Gritton #endif 2054eb8dcdeaSGleb Smirnoff if (prison_ip_restrict(tpr, PR_INET, ip4)) { 20550304c731SJamie Gritton if (ip4 != NULL) 20560304c731SJamie Gritton ip4 = NULL; 20570304c731SJamie Gritton else 20580304c731SJamie Gritton redo_ip4 = 1; 20590304c731SJamie Gritton } 20600304c731SJamie Gritton } 20610304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 20620304c731SJamie Gritton } 20630304c731SJamie Gritton #endif 20640304c731SJamie Gritton #ifdef INET6 20650304c731SJamie Gritton while (redo_ip6) { 2066eb8dcdeaSGleb Smirnoff ip6s = pr->pr_addrs[PR_INET6]->ips; 2067eb8dcdeaSGleb Smirnoff ip6 = prison_ip_alloc(PR_INET6, ip6s, M_WAITOK); 20680304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 20690304c731SJamie Gritton redo_ip6 = 0; 20700304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 2071bdfc8cc4SJamie Gritton #ifdef VIMAGE 2072bdfc8cc4SJamie Gritton if (tpr->pr_flags & PR_VNET) { 2073bdfc8cc4SJamie Gritton descend = 0; 2074bdfc8cc4SJamie Gritton continue; 2075bdfc8cc4SJamie Gritton } 2076bdfc8cc4SJamie Gritton #endif 2077eb8dcdeaSGleb Smirnoff if (prison_ip_restrict(tpr, PR_INET6, ip6)) { 20780304c731SJamie Gritton if (ip6 != NULL) 20790304c731SJamie Gritton ip6 = NULL; 20800304c731SJamie Gritton else 20810304c731SJamie Gritton redo_ip6 = 1; 20820304c731SJamie Gritton } 20830304c731SJamie Gritton } 20840304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 20850304c731SJamie Gritton } 20860304c731SJamie Gritton #endif 20870304c731SJamie Gritton 2088b38ff370SJamie Gritton /* Let the modules do their work. */ 2089cc5fd8c7SJamie Gritton if (born) { 2090b38ff370SJamie Gritton error = osd_jail_call(pr, PR_METHOD_CREATE, opts); 2091c861373bSJamie Gritton if (error) 20922a4b2251SJamie Gritton goto done_deref; 2093b38ff370SJamie Gritton } 2094b38ff370SJamie Gritton error = osd_jail_call(pr, PR_METHOD_SET, opts); 2095c861373bSJamie Gritton if (error) 20962a4b2251SJamie Gritton goto done_deref; 2097b38ff370SJamie Gritton 20981158508aSJamie Gritton /* 20991158508aSJamie Gritton * A new prison is now ready to be seen; either it has gained a user 21001158508aSJamie Gritton * reference via persistence, or is about to gain one via attachment. 21011158508aSJamie Gritton */ 21021158508aSJamie Gritton if (born) { 21031158508aSJamie Gritton drflags = prison_lock_xlock(pr, drflags); 21041158508aSJamie Gritton pr->pr_state = PRISON_STATE_ALIVE; 21051158508aSJamie Gritton } 21061158508aSJamie Gritton 2107b38ff370SJamie Gritton /* Attach this process to the prison if requested. */ 2108b38ff370SJamie Gritton if (flags & JAIL_ATTACH) { 2109c861373bSJamie Gritton error = do_jail_attach(td, pr, 2110589e4c1dSJamie Gritton prison_lock_xlock(pr, drflags & PD_LOCK_FLAGS)); 2111f7496dcaSJamie Gritton drflags &= ~(PD_LOCKED | PD_LIST_XLOCKED); 2112b38ff370SJamie Gritton if (error) { 2113b38ff370SJamie Gritton vfs_opterror(opts, "attach failed"); 21142a4b2251SJamie Gritton goto done_deref; 2115b38ff370SJamie Gritton } 2116b38ff370SJamie Gritton } 2117b38ff370SJamie Gritton 21181fb24974SEdward Tomasz Napierala #ifdef RACCT 21194b5c9cf6SEdward Tomasz Napierala if (racct_enable && !created) { 2120701d6b50SJamie Gritton if (drflags & PD_LOCKED) { 2121701d6b50SJamie Gritton mtx_unlock(&pr->pr_mtx); 2122701d6b50SJamie Gritton drflags &= ~PD_LOCKED; 2123701d6b50SJamie Gritton } 2124f7496dcaSJamie Gritton if (drflags & PD_LIST_XLOCKED) { 2125f7496dcaSJamie Gritton sx_xunlock(&allprison_lock); 2126f7496dcaSJamie Gritton drflags &= ~PD_LIST_XLOCKED; 2127b4e87a63SJamie Gritton } 21281fb24974SEdward Tomasz Napierala prison_racct_modify(pr); 21291fb24974SEdward Tomasz Napierala } 21301fb24974SEdward Tomasz Napierala #endif 21311fb24974SEdward Tomasz Napierala 2132bba7a2e8SRick Macklem #ifdef VNET_NFSD 2133bba7a2e8SRick Macklem if (born && pr != &prison0 && (pr->pr_allow & PR_ALLOW_NFSD) != 0 && 2134bba7a2e8SRick Macklem (pr->pr_root->v_vflag & VV_ROOT) == 0) 2135bba7a2e8SRick Macklem printf("Warning jail jid=%d: mountd/nfsd requires a separate" 2136bba7a2e8SRick Macklem " file system\n", pr->pr_id); 2137bba7a2e8SRick Macklem #endif 2138bba7a2e8SRick Macklem 2139c861373bSJamie Gritton drflags &= ~PD_KILL; 21401fb24974SEdward Tomasz Napierala td->td_retval[0] = pr->pr_id; 21411fb24974SEdward Tomasz Napierala 21422a4b2251SJamie Gritton done_deref: 21432a4b2251SJamie Gritton /* Release any temporary prison holds and/or locks. */ 21442a4b2251SJamie Gritton if (pr != NULL) 21452a4b2251SJamie Gritton prison_deref(pr, drflags); 21462a4b2251SJamie Gritton else if (drflags & PD_LIST_SLOCKED) 2147b38ff370SJamie Gritton sx_sunlock(&allprison_lock); 21482a4b2251SJamie Gritton else if (drflags & PD_LIST_XLOCKED) 2149b38ff370SJamie Gritton sx_xunlock(&allprison_lock); 21505050aa86SKonstantin Belousov if (root != NULL) 2151b38ff370SJamie Gritton vrele(root); 2152b38ff370SJamie Gritton done_errmsg: 2153b38ff370SJamie Gritton if (error) { 21542a4b2251SJamie Gritton /* Write the error message back to userspace. */ 2155176ff3a0SJamie Gritton if (vfs_getopt(opts, "errmsg", (void **)&errmsg, 2156176ff3a0SJamie Gritton &errmsg_len) == 0 && errmsg_len > 0) { 2157b38ff370SJamie Gritton errmsg_pos = 2 * vfs_getopt_pos(opts, "errmsg") + 1; 2158b38ff370SJamie Gritton if (optuio->uio_segflg == UIO_SYSSPACE) 2159b38ff370SJamie Gritton bcopy(errmsg, 2160b38ff370SJamie Gritton optuio->uio_iov[errmsg_pos].iov_base, 2161b38ff370SJamie Gritton errmsg_len); 2162b38ff370SJamie Gritton else 2163b38ff370SJamie Gritton copyout(errmsg, 2164b38ff370SJamie Gritton optuio->uio_iov[errmsg_pos].iov_base, 2165b38ff370SJamie Gritton errmsg_len); 2166b38ff370SJamie Gritton } 2167b38ff370SJamie Gritton } 2168b38ff370SJamie Gritton done_free: 2169b38ff370SJamie Gritton #ifdef INET 2170eb8dcdeaSGleb Smirnoff prison_ip_free(ip4); 2171b38ff370SJamie Gritton #endif 2172b38ff370SJamie Gritton #ifdef INET6 2173eb8dcdeaSGleb Smirnoff prison_ip_free(ip6); 2174b38ff370SJamie Gritton #endif 21756dfe0a3dSMartin Matuska if (g_path != NULL) 21766dfe0a3dSMartin Matuska free(g_path, M_TEMP); 2177b38ff370SJamie Gritton vfs_freeopts(opts); 2178b38ff370SJamie Gritton return (error); 2179b38ff370SJamie Gritton } 2180b38ff370SJamie Gritton 2181b38ff370SJamie Gritton /* 21827de883c8SJamie Gritton * Find the next available prison ID. Return the ID on success, or zero 21837de883c8SJamie Gritton * on failure. Also set a pointer to the allprison list entry the prison 21847de883c8SJamie Gritton * should be inserted before. 21857de883c8SJamie Gritton */ 21867de883c8SJamie Gritton static int 21877de883c8SJamie Gritton get_next_prid(struct prison **insprp) 21887de883c8SJamie Gritton { 21897de883c8SJamie Gritton struct prison *inspr; 21907de883c8SJamie Gritton int jid, maxid; 21917de883c8SJamie Gritton 21927de883c8SJamie Gritton jid = lastprid % JAIL_MAX + 1; 21937de883c8SJamie Gritton if (TAILQ_EMPTY(&allprison) || 21947de883c8SJamie Gritton TAILQ_LAST(&allprison, prisonlist)->pr_id < jid) { 21957de883c8SJamie Gritton /* 21967de883c8SJamie Gritton * A common case is for all jails to be implicitly numbered, 21977de883c8SJamie Gritton * which means they'll go on the end of the list, at least 21987de883c8SJamie Gritton * for the first JAIL_MAX times. 21997de883c8SJamie Gritton */ 22007de883c8SJamie Gritton inspr = NULL; 22017de883c8SJamie Gritton } else { 22027de883c8SJamie Gritton /* 22037de883c8SJamie Gritton * Take two passes through the allprison list: first starting 22047de883c8SJamie Gritton * with the proposed jid, then ending with it. 22057de883c8SJamie Gritton */ 22067de883c8SJamie Gritton for (maxid = JAIL_MAX; maxid != 0; ) { 22077de883c8SJamie Gritton TAILQ_FOREACH(inspr, &allprison, pr_list) { 22087de883c8SJamie Gritton if (inspr->pr_id < jid) 22097de883c8SJamie Gritton continue; 2210f7496dcaSJamie Gritton if (inspr->pr_id > jid) { 2211f7496dcaSJamie Gritton /* Found an opening. */ 22127de883c8SJamie Gritton maxid = 0; 22137de883c8SJamie Gritton break; 22147de883c8SJamie Gritton } 22157de883c8SJamie Gritton if (++jid > maxid) { 22167de883c8SJamie Gritton if (lastprid == maxid || lastprid == 0) 22177de883c8SJamie Gritton { 22187de883c8SJamie Gritton /* 22197de883c8SJamie Gritton * The entire legal range 22207de883c8SJamie Gritton * has been traversed 22217de883c8SJamie Gritton */ 22227de883c8SJamie Gritton return 0; 22237de883c8SJamie Gritton } 22247de883c8SJamie Gritton /* Try again from the start. */ 22257de883c8SJamie Gritton jid = 1; 22267de883c8SJamie Gritton maxid = lastprid; 22277de883c8SJamie Gritton break; 22287de883c8SJamie Gritton } 22297de883c8SJamie Gritton } 22307de883c8SJamie Gritton if (inspr == NULL) { 22317de883c8SJamie Gritton /* Found room at the end of the list. */ 22327de883c8SJamie Gritton break; 22337de883c8SJamie Gritton } 22347de883c8SJamie Gritton } 22357de883c8SJamie Gritton } 22367de883c8SJamie Gritton *insprp = inspr; 22377de883c8SJamie Gritton lastprid = jid; 22387de883c8SJamie Gritton return (jid); 22397de883c8SJamie Gritton } 22407de883c8SJamie Gritton 22417de883c8SJamie Gritton /* 2242b38ff370SJamie Gritton * struct jail_get_args { 2243b38ff370SJamie Gritton * struct iovec *iovp; 2244b38ff370SJamie Gritton * unsigned int iovcnt; 2245b38ff370SJamie Gritton * int flags; 2246b38ff370SJamie Gritton * }; 2247b38ff370SJamie Gritton */ 2248b38ff370SJamie Gritton int 22498451d0ddSKip Macy sys_jail_get(struct thread *td, struct jail_get_args *uap) 2250b38ff370SJamie Gritton { 2251b38ff370SJamie Gritton struct uio *auio; 2252b38ff370SJamie Gritton int error; 2253b38ff370SJamie Gritton 2254b38ff370SJamie Gritton /* Check that we have an even number of iovecs. */ 2255b38ff370SJamie Gritton if (uap->iovcnt & 1) 2256b38ff370SJamie Gritton return (EINVAL); 2257b38ff370SJamie Gritton 2258b38ff370SJamie Gritton error = copyinuio(uap->iovp, uap->iovcnt, &auio); 2259b38ff370SJamie Gritton if (error) 2260b38ff370SJamie Gritton return (error); 2261b38ff370SJamie Gritton error = kern_jail_get(td, auio, uap->flags); 2262b38ff370SJamie Gritton if (error == 0) 2263b38ff370SJamie Gritton error = copyout(auio->uio_iov, uap->iovp, 2264b38ff370SJamie Gritton uap->iovcnt * sizeof (struct iovec)); 2265b38ff370SJamie Gritton free(auio, M_IOV); 2266b38ff370SJamie Gritton return (error); 2267b38ff370SJamie Gritton } 2268b38ff370SJamie Gritton 2269b38ff370SJamie Gritton int 2270b38ff370SJamie Gritton kern_jail_get(struct thread *td, struct uio *optuio, int flags) 2271b38ff370SJamie Gritton { 2272672756aaSJamie Gritton struct bool_flags *bf; 2273672756aaSJamie Gritton struct jailsys_flags *jsf; 22740304c731SJamie Gritton struct prison *pr, *mypr; 2275b38ff370SJamie Gritton struct vfsopt *opt; 2276b38ff370SJamie Gritton struct vfsoptlist *opts; 2277b38ff370SJamie Gritton char *errmsg, *name; 22782a4b2251SJamie Gritton int drflags, error, errmsg_len, errmsg_pos, i, jid, len, pos; 2279672756aaSJamie Gritton unsigned f; 2280b38ff370SJamie Gritton 2281b38ff370SJamie Gritton if (flags & ~JAIL_GET_MASK) 2282b38ff370SJamie Gritton return (EINVAL); 2283b38ff370SJamie Gritton 2284b38ff370SJamie Gritton /* Get the parameter list. */ 2285b38ff370SJamie Gritton error = vfs_buildopts(optuio, &opts); 2286b38ff370SJamie Gritton if (error) 2287b38ff370SJamie Gritton return (error); 2288b38ff370SJamie Gritton errmsg_pos = vfs_getopt_pos(opts, "errmsg"); 22890304c731SJamie Gritton mypr = td->td_ucred->cr_prison; 22902a4b2251SJamie Gritton pr = NULL; 22911e2a13e6SJamie Gritton 2292b38ff370SJamie Gritton /* 2293b38ff370SJamie Gritton * Find the prison specified by one of: lastjid, jid, name. 2294b38ff370SJamie Gritton */ 2295b38ff370SJamie Gritton sx_slock(&allprison_lock); 22962a4b2251SJamie Gritton drflags = PD_LIST_SLOCKED; 2297b38ff370SJamie Gritton error = vfs_copyopt(opts, "lastjid", &jid, sizeof(jid)); 2298b38ff370SJamie Gritton if (error == 0) { 2299b38ff370SJamie Gritton TAILQ_FOREACH(pr, &allprison, pr_list) { 2300f7496dcaSJamie Gritton if (pr->pr_id > jid && 2301f7496dcaSJamie Gritton ((flags & JAIL_DYING) || prison_isalive(pr)) && 2302f7496dcaSJamie Gritton prison_ischild(mypr, pr)) { 2303b38ff370SJamie Gritton mtx_lock(&pr->pr_mtx); 23042a4b2251SJamie Gritton drflags |= PD_LOCKED; 2305b38ff370SJamie Gritton goto found_prison; 23062a4b2251SJamie Gritton } 2307f7496dcaSJamie Gritton } 2308b38ff370SJamie Gritton error = ENOENT; 2309b38ff370SJamie Gritton vfs_opterror(opts, "no jail after %d", jid); 23102a4b2251SJamie Gritton goto done; 2311b38ff370SJamie Gritton } else if (error != ENOENT) 23122a4b2251SJamie Gritton goto done; 2313b38ff370SJamie Gritton 2314b38ff370SJamie Gritton error = vfs_copyopt(opts, "jid", &jid, sizeof(jid)); 2315b38ff370SJamie Gritton if (error == 0) { 2316b38ff370SJamie Gritton if (jid != 0) { 23170304c731SJamie Gritton pr = prison_find_child(mypr, jid); 2318b38ff370SJamie Gritton if (pr != NULL) { 23192a4b2251SJamie Gritton drflags |= PD_LOCKED; 232076ad42abSJamie Gritton if (!(prison_isalive(pr) || 232176ad42abSJamie Gritton (flags & JAIL_DYING))) { 2322b38ff370SJamie Gritton error = ENOENT; 2323b38ff370SJamie Gritton vfs_opterror(opts, "jail %d is dying", 2324b38ff370SJamie Gritton jid); 23252a4b2251SJamie Gritton goto done; 2326b38ff370SJamie Gritton } 2327b38ff370SJamie Gritton goto found_prison; 2328b38ff370SJamie Gritton } 2329b38ff370SJamie Gritton error = ENOENT; 2330b38ff370SJamie Gritton vfs_opterror(opts, "jail %d not found", jid); 23312a4b2251SJamie Gritton goto done; 2332b38ff370SJamie Gritton } 2333b38ff370SJamie Gritton } else if (error != ENOENT) 23342a4b2251SJamie Gritton goto done; 2335b38ff370SJamie Gritton 2336b38ff370SJamie Gritton error = vfs_getopt(opts, "name", (void **)&name, &len); 2337b38ff370SJamie Gritton if (error == 0) { 2338b38ff370SJamie Gritton if (len == 0 || name[len - 1] != '\0') { 2339b38ff370SJamie Gritton error = EINVAL; 23402a4b2251SJamie Gritton goto done; 2341b38ff370SJamie Gritton } 23420304c731SJamie Gritton pr = prison_find_name(mypr, name); 2343b38ff370SJamie Gritton if (pr != NULL) { 23442a4b2251SJamie Gritton drflags |= PD_LOCKED; 234576ad42abSJamie Gritton if (!(prison_isalive(pr) || (flags & JAIL_DYING))) { 2346b38ff370SJamie Gritton error = ENOENT; 2347b38ff370SJamie Gritton vfs_opterror(opts, "jail \"%s\" is dying", 2348b38ff370SJamie Gritton name); 23492a4b2251SJamie Gritton goto done; 2350b38ff370SJamie Gritton } 2351b38ff370SJamie Gritton goto found_prison; 2352b38ff370SJamie Gritton } 2353b38ff370SJamie Gritton error = ENOENT; 2354b38ff370SJamie Gritton vfs_opterror(opts, "jail \"%s\" not found", name); 23552a4b2251SJamie Gritton goto done; 2356b38ff370SJamie Gritton } else if (error != ENOENT) 23572a4b2251SJamie Gritton goto done; 2358b38ff370SJamie Gritton 2359b38ff370SJamie Gritton vfs_opterror(opts, "no jail specified"); 2360b38ff370SJamie Gritton error = ENOENT; 23612a4b2251SJamie Gritton goto done; 2362b38ff370SJamie Gritton 2363b38ff370SJamie Gritton found_prison: 2364b38ff370SJamie Gritton /* Get the parameters of the prison. */ 23656754ae25SJamie Gritton prison_hold(pr); 23662a4b2251SJamie Gritton drflags |= PD_DEREF; 2367b38ff370SJamie Gritton td->td_retval[0] = pr->pr_id; 2368b38ff370SJamie Gritton error = vfs_setopt(opts, "jid", &pr->pr_id, sizeof(pr->pr_id)); 2369b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 23702a4b2251SJamie Gritton goto done; 23710304c731SJamie Gritton i = (pr->pr_parent == mypr) ? 0 : pr->pr_parent->pr_id; 23720304c731SJamie Gritton error = vfs_setopt(opts, "parent", &i, sizeof(i)); 2373b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 23742a4b2251SJamie Gritton goto done; 23750304c731SJamie Gritton error = vfs_setopts(opts, "name", prison_name(mypr, pr)); 23760304c731SJamie Gritton if (error != 0 && error != ENOENT) 23772a4b2251SJamie Gritton goto done; 23780304c731SJamie Gritton error = vfs_setopt(opts, "cpuset.id", &pr->pr_cpuset->cs_id, 2379b38ff370SJamie Gritton sizeof(pr->pr_cpuset->cs_id)); 2380b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 23812a4b2251SJamie Gritton goto done; 23820304c731SJamie Gritton error = vfs_setopts(opts, "path", prison_path(mypr, pr)); 2383b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 23842a4b2251SJamie Gritton goto done; 2385b38ff370SJamie Gritton #ifdef INET 2386eb8dcdeaSGleb Smirnoff error = vfs_setopt_part(opts, "ip4.addr", pr->pr_addrs[PR_INET] + 1, 2387eb8dcdeaSGleb Smirnoff pr->pr_addrs[PR_INET] ? pr->pr_addrs[PR_INET]->ips * 2388eb8dcdeaSGleb Smirnoff pr_families[PR_INET].size : 0 ); 2389b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 23902a4b2251SJamie Gritton goto done; 2391b38ff370SJamie Gritton #endif 2392b38ff370SJamie Gritton #ifdef INET6 2393eb8dcdeaSGleb Smirnoff error = vfs_setopt_part(opts, "ip6.addr", pr->pr_addrs[PR_INET6] + 1, 2394eb8dcdeaSGleb Smirnoff pr->pr_addrs[PR_INET6] ? pr->pr_addrs[PR_INET6]->ips * 2395eb8dcdeaSGleb Smirnoff pr_families[PR_INET6].size : 0 ); 2396b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 23972a4b2251SJamie Gritton goto done; 2398b38ff370SJamie Gritton #endif 2399b38ff370SJamie Gritton error = vfs_setopt(opts, "securelevel", &pr->pr_securelevel, 2400b38ff370SJamie Gritton sizeof(pr->pr_securelevel)); 2401b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 24022a4b2251SJamie Gritton goto done; 2403b97457e2SJamie Gritton error = vfs_setopt(opts, "children.cur", &pr->pr_childcount, 2404b97457e2SJamie Gritton sizeof(pr->pr_childcount)); 2405b97457e2SJamie Gritton if (error != 0 && error != ENOENT) 24062a4b2251SJamie Gritton goto done; 2407b97457e2SJamie Gritton error = vfs_setopt(opts, "children.max", &pr->pr_childmax, 2408b97457e2SJamie Gritton sizeof(pr->pr_childmax)); 2409b97457e2SJamie Gritton if (error != 0 && error != ENOENT) 24102a4b2251SJamie Gritton goto done; 2411c1f19219SJamie Gritton error = vfs_setopts(opts, "host.hostname", pr->pr_hostname); 2412b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 24132a4b2251SJamie Gritton goto done; 2414c1f19219SJamie Gritton error = vfs_setopts(opts, "host.domainname", pr->pr_domainname); 241576ca6f88SJamie Gritton if (error != 0 && error != ENOENT) 24162a4b2251SJamie Gritton goto done; 2417c1f19219SJamie Gritton error = vfs_setopts(opts, "host.hostuuid", pr->pr_hostuuid); 241876ca6f88SJamie Gritton if (error != 0 && error != ENOENT) 24192a4b2251SJamie Gritton goto done; 2420841c0c7eSNathan Whitehorn #ifdef COMPAT_FREEBSD32 2421a5c1afadSDmitry Chagin if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) { 242276ca6f88SJamie Gritton uint32_t hid32 = pr->pr_hostid; 242376ca6f88SJamie Gritton 242476ca6f88SJamie Gritton error = vfs_setopt(opts, "host.hostid", &hid32, sizeof(hid32)); 242576ca6f88SJamie Gritton } else 242676ca6f88SJamie Gritton #endif 242776ca6f88SJamie Gritton error = vfs_setopt(opts, "host.hostid", &pr->pr_hostid, 242876ca6f88SJamie Gritton sizeof(pr->pr_hostid)); 242976ca6f88SJamie Gritton if (error != 0 && error != ENOENT) 24302a4b2251SJamie Gritton goto done; 24310304c731SJamie Gritton error = vfs_setopt(opts, "enforce_statfs", &pr->pr_enforce_statfs, 24320304c731SJamie Gritton sizeof(pr->pr_enforce_statfs)); 24330304c731SJamie Gritton if (error != 0 && error != ENOENT) 24342a4b2251SJamie Gritton goto done; 24350cc207a6SMartin Matuska error = vfs_setopt(opts, "devfs_ruleset", &pr->pr_devfs_rsnum, 24360cc207a6SMartin Matuska sizeof(pr->pr_devfs_rsnum)); 24370cc207a6SMartin Matuska if (error != 0 && error != ENOENT) 24382a4b2251SJamie Gritton goto done; 2439672756aaSJamie Gritton for (bf = pr_flag_bool; 2440672756aaSJamie Gritton bf < pr_flag_bool + nitems(pr_flag_bool); 2441672756aaSJamie Gritton bf++) { 2442672756aaSJamie Gritton i = (pr->pr_flags & bf->flag) ? 1 : 0; 2443672756aaSJamie Gritton error = vfs_setopt(opts, bf->name, &i, sizeof(i)); 2444b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 24452a4b2251SJamie Gritton goto done; 2446b38ff370SJamie Gritton i = !i; 2447672756aaSJamie Gritton error = vfs_setopt(opts, bf->noname, &i, sizeof(i)); 2448b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 24492a4b2251SJamie Gritton goto done; 24500304c731SJamie Gritton } 2451672756aaSJamie Gritton for (jsf = pr_flag_jailsys; 2452672756aaSJamie Gritton jsf < pr_flag_jailsys + nitems(pr_flag_jailsys); 2453672756aaSJamie Gritton jsf++) { 2454672756aaSJamie Gritton f = pr->pr_flags & (jsf->disable | jsf->new); 2455672756aaSJamie Gritton i = (f != 0 && f == jsf->disable) ? JAIL_SYS_DISABLE 2456672756aaSJamie Gritton : (f == jsf->new) ? JAIL_SYS_NEW 24577cbf7213SJamie Gritton : JAIL_SYS_INHERIT; 2458672756aaSJamie Gritton error = vfs_setopt(opts, jsf->name, &i, sizeof(i)); 24597cbf7213SJamie Gritton if (error != 0 && error != ENOENT) 24602a4b2251SJamie Gritton goto done; 24617cbf7213SJamie Gritton } 2462672756aaSJamie Gritton for (bf = pr_flag_allow; 24635d58f959SJamie Gritton bf < pr_flag_allow + nitems(pr_flag_allow) && 24645d58f959SJamie Gritton atomic_load_int(&bf->flag) != 0; 2465672756aaSJamie Gritton bf++) { 2466672756aaSJamie Gritton i = (pr->pr_allow & bf->flag) ? 1 : 0; 2467672756aaSJamie Gritton error = vfs_setopt(opts, bf->name, &i, sizeof(i)); 24680304c731SJamie Gritton if (error != 0 && error != ENOENT) 24692a4b2251SJamie Gritton goto done; 24700304c731SJamie Gritton i = !i; 2471672756aaSJamie Gritton error = vfs_setopt(opts, bf->noname, &i, sizeof(i)); 24720304c731SJamie Gritton if (error != 0 && error != ENOENT) 24732a4b2251SJamie Gritton goto done; 24740304c731SJamie Gritton } 247576ad42abSJamie Gritton i = !prison_isalive(pr); 2476b38ff370SJamie Gritton error = vfs_setopt(opts, "dying", &i, sizeof(i)); 2477b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 24782a4b2251SJamie Gritton goto done; 2479b38ff370SJamie Gritton i = !i; 2480b38ff370SJamie Gritton error = vfs_setopt(opts, "nodying", &i, sizeof(i)); 2481b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 24822a4b2251SJamie Gritton goto done; 2483bd96bd15SIan Lepore error = vfs_setopt(opts, "osreldate", &pr->pr_osreldate, 2484bd96bd15SIan Lepore sizeof(pr->pr_osreldate)); 2485a1a4c1b0SIan Lepore if (error != 0 && error != ENOENT) 24862a4b2251SJamie Gritton goto done; 2487a1a4c1b0SIan Lepore error = vfs_setopts(opts, "osrelease", pr->pr_osrelease); 2488a1a4c1b0SIan Lepore if (error != 0 && error != ENOENT) 24892a4b2251SJamie Gritton goto done; 2490b38ff370SJamie Gritton 2491b38ff370SJamie Gritton /* Get the module parameters. */ 2492b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 24932a4b2251SJamie Gritton drflags &= ~PD_LOCKED; 2494b38ff370SJamie Gritton error = osd_jail_call(pr, PR_METHOD_GET, opts); 2495b38ff370SJamie Gritton if (error) 24962a4b2251SJamie Gritton goto done; 24972a4b2251SJamie Gritton prison_deref(pr, drflags); 24982a4b2251SJamie Gritton pr = NULL; 24992a4b2251SJamie Gritton drflags = 0; 2500b38ff370SJamie Gritton 2501b38ff370SJamie Gritton /* By now, all parameters should have been noted. */ 2502b38ff370SJamie Gritton TAILQ_FOREACH(opt, opts, link) { 2503b38ff370SJamie Gritton if (!opt->seen && strcmp(opt->name, "errmsg")) { 2504b38ff370SJamie Gritton error = EINVAL; 2505b38ff370SJamie Gritton vfs_opterror(opts, "unknown parameter: %s", opt->name); 25062a4b2251SJamie Gritton goto done; 2507b38ff370SJamie Gritton } 2508b38ff370SJamie Gritton } 2509b38ff370SJamie Gritton 2510b38ff370SJamie Gritton /* Write the fetched parameters back to userspace. */ 2511b38ff370SJamie Gritton error = 0; 2512b38ff370SJamie Gritton TAILQ_FOREACH(opt, opts, link) { 2513b38ff370SJamie Gritton if (opt->pos >= 0 && opt->pos != errmsg_pos) { 2514b38ff370SJamie Gritton pos = 2 * opt->pos + 1; 2515b38ff370SJamie Gritton optuio->uio_iov[pos].iov_len = opt->len; 2516b38ff370SJamie Gritton if (opt->value != NULL) { 2517b38ff370SJamie Gritton if (optuio->uio_segflg == UIO_SYSSPACE) { 2518b38ff370SJamie Gritton bcopy(opt->value, 2519b38ff370SJamie Gritton optuio->uio_iov[pos].iov_base, 2520b38ff370SJamie Gritton opt->len); 2521b38ff370SJamie Gritton } else { 2522b38ff370SJamie Gritton error = copyout(opt->value, 2523b38ff370SJamie Gritton optuio->uio_iov[pos].iov_base, 2524b38ff370SJamie Gritton opt->len); 2525b38ff370SJamie Gritton if (error) 2526b38ff370SJamie Gritton break; 2527b38ff370SJamie Gritton } 2528b38ff370SJamie Gritton } 2529b38ff370SJamie Gritton } 2530b38ff370SJamie Gritton } 2531b38ff370SJamie Gritton 25322a4b2251SJamie Gritton done: 25332a4b2251SJamie Gritton /* Release any temporary prison holds and/or locks. */ 25342a4b2251SJamie Gritton if (pr != NULL) 25352a4b2251SJamie Gritton prison_deref(pr, drflags); 25362a4b2251SJamie Gritton else if (drflags & PD_LIST_SLOCKED) 2537b38ff370SJamie Gritton sx_sunlock(&allprison_lock); 2538b38ff370SJamie Gritton if (error && errmsg_pos >= 0) { 25392a4b2251SJamie Gritton /* Write the error message back to userspace. */ 2540b38ff370SJamie Gritton vfs_getopt(opts, "errmsg", (void **)&errmsg, &errmsg_len); 2541b38ff370SJamie Gritton errmsg_pos = 2 * errmsg_pos + 1; 2542b38ff370SJamie Gritton if (errmsg_len > 0) { 2543b38ff370SJamie Gritton if (optuio->uio_segflg == UIO_SYSSPACE) 2544b38ff370SJamie Gritton bcopy(errmsg, 2545b38ff370SJamie Gritton optuio->uio_iov[errmsg_pos].iov_base, 2546b38ff370SJamie Gritton errmsg_len); 2547b38ff370SJamie Gritton else 2548b38ff370SJamie Gritton copyout(errmsg, 2549b38ff370SJamie Gritton optuio->uio_iov[errmsg_pos].iov_base, 2550b38ff370SJamie Gritton errmsg_len); 2551b38ff370SJamie Gritton } 2552b38ff370SJamie Gritton } 2553b38ff370SJamie Gritton vfs_freeopts(opts); 2554b38ff370SJamie Gritton return (error); 2555b38ff370SJamie Gritton } 2556b38ff370SJamie Gritton 2557b38ff370SJamie Gritton /* 2558b38ff370SJamie Gritton * struct jail_remove_args { 2559b38ff370SJamie Gritton * int jid; 2560b38ff370SJamie Gritton * }; 2561b38ff370SJamie Gritton */ 2562b38ff370SJamie Gritton int 25638451d0ddSKip Macy sys_jail_remove(struct thread *td, struct jail_remove_args *uap) 2564b38ff370SJamie Gritton { 2565c861373bSJamie Gritton struct prison *pr; 2566c861373bSJamie Gritton int error; 2567b38ff370SJamie Gritton 2568b38ff370SJamie Gritton error = priv_check(td, PRIV_JAIL_REMOVE); 2569b38ff370SJamie Gritton if (error) 2570b38ff370SJamie Gritton return (error); 2571b38ff370SJamie Gritton 2572b38ff370SJamie Gritton sx_xlock(&allprison_lock); 25730304c731SJamie Gritton pr = prison_find_child(td->td_ucred->cr_prison, uap->jid); 2574b38ff370SJamie Gritton if (pr == NULL) { 2575b38ff370SJamie Gritton sx_xunlock(&allprison_lock); 2576b38ff370SJamie Gritton return (EINVAL); 2577b38ff370SJamie Gritton } 2578c861373bSJamie Gritton if (!prison_isalive(pr)) { 2579c861373bSJamie Gritton /* Silently ignore already-dying prisons. */ 25800304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 2581c861373bSJamie Gritton sx_xunlock(&allprison_lock); 25820304c731SJamie Gritton return (0); 25830304c731SJamie Gritton } 2584c861373bSJamie Gritton prison_deref(pr, PD_KILL | PD_LOCKED | PD_LIST_XLOCKED); 2585c861373bSJamie Gritton return (0); 258675c13541SPoul-Henning Kamp } 258775c13541SPoul-Henning Kamp 2588fd7a8150SMike Barcroft /* 25899ddb7954SMike Barcroft * struct jail_attach_args { 25909ddb7954SMike Barcroft * int jid; 25919ddb7954SMike Barcroft * }; 2592fd7a8150SMike Barcroft */ 2593fd7a8150SMike Barcroft int 25948451d0ddSKip Macy sys_jail_attach(struct thread *td, struct jail_attach_args *uap) 2595fd7a8150SMike Barcroft { 2596b38ff370SJamie Gritton struct prison *pr; 2597b38ff370SJamie Gritton int error; 2598b38ff370SJamie Gritton 2599b38ff370SJamie Gritton error = priv_check(td, PRIV_JAIL_ATTACH); 2600b38ff370SJamie Gritton if (error) 2601b38ff370SJamie Gritton return (error); 2602b38ff370SJamie Gritton 2603f7496dcaSJamie Gritton sx_slock(&allprison_lock); 26040304c731SJamie Gritton pr = prison_find_child(td->td_ucred->cr_prison, uap->jid); 2605b38ff370SJamie Gritton if (pr == NULL) { 2606b38ff370SJamie Gritton sx_sunlock(&allprison_lock); 2607b38ff370SJamie Gritton return (EINVAL); 2608b38ff370SJamie Gritton } 2609b38ff370SJamie Gritton 261076ad42abSJamie Gritton /* Do not allow a process to attach to a prison that is not alive. */ 261176ad42abSJamie Gritton if (!prison_isalive(pr)) { 2612b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 2613b38ff370SJamie Gritton sx_sunlock(&allprison_lock); 2614b38ff370SJamie Gritton return (EINVAL); 2615b38ff370SJamie Gritton } 2616b38ff370SJamie Gritton 2617f7496dcaSJamie Gritton return (do_jail_attach(td, pr, PD_LOCKED | PD_LIST_SLOCKED)); 2618b38ff370SJamie Gritton } 2619b38ff370SJamie Gritton 2620b38ff370SJamie Gritton static int 2621f7496dcaSJamie Gritton do_jail_attach(struct thread *td, struct prison *pr, int drflags) 2622b38ff370SJamie Gritton { 2623fd7a8150SMike Barcroft struct proc *p; 2624fd7a8150SMike Barcroft struct ucred *newcred, *oldcred; 26255050aa86SKonstantin Belousov int error; 2626fd7a8150SMike Barcroft 2627f7496dcaSJamie Gritton mtx_assert(&pr->pr_mtx, MA_OWNED); 2628f7496dcaSJamie Gritton sx_assert(&allprison_lock, SX_LOCKED); 2629589e4c1dSJamie Gritton drflags &= PD_LOCK_FLAGS; 263057f22bd4SJacques Vidrine /* 263157f22bd4SJacques Vidrine * XXX: Note that there is a slight race here if two threads 263257f22bd4SJacques Vidrine * in the same privileged process attempt to attach to two 263357f22bd4SJacques Vidrine * different jails at the same time. It is important for 263457f22bd4SJacques Vidrine * user processes not to do this, or they might end up with 263557f22bd4SJacques Vidrine * a process root from one prison, but attached to the jail 263657f22bd4SJacques Vidrine * of another. 263757f22bd4SJacques Vidrine */ 26381158508aSJamie Gritton prison_hold(pr); 26396754ae25SJamie Gritton refcount_acquire(&pr->pr_uref); 2640f7496dcaSJamie Gritton drflags |= PD_DEREF | PD_DEUREF; 2641fd7a8150SMike Barcroft mtx_unlock(&pr->pr_mtx); 2642f7496dcaSJamie Gritton drflags &= ~PD_LOCKED; 2643b38ff370SJamie Gritton 2644b38ff370SJamie Gritton /* Let modules do whatever they need to prepare for attaching. */ 2645b38ff370SJamie Gritton error = osd_jail_call(pr, PR_METHOD_ATTACH, td); 2646b38ff370SJamie Gritton if (error) { 2647f7496dcaSJamie Gritton prison_deref(pr, drflags); 2648b38ff370SJamie Gritton return (error); 2649b38ff370SJamie Gritton } 2650f7496dcaSJamie Gritton sx_unlock(&allprison_lock); 2651f7496dcaSJamie Gritton drflags &= ~(PD_LIST_SLOCKED | PD_LIST_XLOCKED); 2652fd7a8150SMike Barcroft 2653413628a7SBjoern A. Zeeb /* 2654413628a7SBjoern A. Zeeb * Reparent the newly attached process to this jail. 2655413628a7SBjoern A. Zeeb */ 2656b38ff370SJamie Gritton p = td->td_proc; 2657413628a7SBjoern A. Zeeb error = cpuset_setproc_update_set(p, pr->pr_cpuset); 2658413628a7SBjoern A. Zeeb if (error) 2659b38ff370SJamie Gritton goto e_revert_osd; 2660413628a7SBjoern A. Zeeb 2661cb05b60aSAttilio Rao vn_lock(pr->pr_root, LK_EXCLUSIVE | LK_RETRY); 2662fd7a8150SMike Barcroft if ((error = change_dir(pr->pr_root, td)) != 0) 2663fd7a8150SMike Barcroft goto e_unlock; 2664fd7a8150SMike Barcroft #ifdef MAC 266530d239bcSRobert Watson if ((error = mac_vnode_check_chroot(td->td_ucred, pr->pr_root))) 2666fd7a8150SMike Barcroft goto e_unlock; 2667fd7a8150SMike Barcroft #endif 2668b249ce48SMateusz Guzik VOP_UNLOCK(pr->pr_root); 2669d4380c0cSJamie Gritton if ((error = pwd_chroot_chdir(td, pr->pr_root))) 26705050aa86SKonstantin Belousov goto e_revert_osd; 2671fd7a8150SMike Barcroft 2672fd7a8150SMike Barcroft newcred = crget(); 2673fd7a8150SMike Barcroft PROC_LOCK(p); 26741fb6767dSJamie Gritton oldcred = crcopysafe(p, newcred); 267569c4ee54SJohn Baldwin newcred->cr_prison = pr; 2676daf63fd2SMateusz Guzik proc_set_cred(p, newcred); 26771fb6767dSJamie Gritton setsugid(p); 2678097055e2SEdward Tomasz Napierala #ifdef RACCT 2679097055e2SEdward Tomasz Napierala racct_proc_ucred_changed(p, oldcred, newcred); 2680f87beb93SAndriy Gapon crhold(newcred); 2681f87beb93SAndriy Gapon #endif 2682f87beb93SAndriy Gapon PROC_UNLOCK(p); 2683f87beb93SAndriy Gapon #ifdef RCTL 2684f87beb93SAndriy Gapon rctl_proc_ucred_changed(p, newcred); 2685f87beb93SAndriy Gapon crfree(newcred); 2686097055e2SEdward Tomasz Napierala #endif 26875ecb5444SMateusz Guzik prison_proc_relink(oldcred->cr_prison, pr, p); 2688f7496dcaSJamie Gritton prison_deref(oldcred->cr_prison, drflags); 2689fd7a8150SMike Barcroft crfree(oldcred); 2690cc7b7306SJamie Gritton 2691cc7b7306SJamie Gritton /* 2692cc7b7306SJamie Gritton * If the prison was killed while changing credentials, die along 2693cc7b7306SJamie Gritton * with it. 2694cc7b7306SJamie Gritton */ 2695cc7b7306SJamie Gritton if (!prison_isalive(pr)) { 2696cc7b7306SJamie Gritton PROC_LOCK(p); 2697cc7b7306SJamie Gritton kern_psignal(p, SIGKILL); 2698cc7b7306SJamie Gritton PROC_UNLOCK(p); 2699cc7b7306SJamie Gritton } 2700cc7b7306SJamie Gritton 2701fd7a8150SMike Barcroft return (0); 27021fb6767dSJamie Gritton 2703fd7a8150SMike Barcroft e_unlock: 2704b249ce48SMateusz Guzik VOP_UNLOCK(pr->pr_root); 2705b38ff370SJamie Gritton e_revert_osd: 2706b38ff370SJamie Gritton /* Tell modules this thread is still in its old jail after all. */ 27077f4e7248SJamie Gritton sx_slock(&allprison_lock); 2708f7496dcaSJamie Gritton drflags |= PD_LIST_SLOCKED; 27091fb6767dSJamie Gritton (void)osd_jail_call(td->td_ucred->cr_prison, PR_METHOD_ATTACH, td); 2710f7496dcaSJamie Gritton prison_deref(pr, drflags); 2711fd7a8150SMike Barcroft return (error); 2712fd7a8150SMike Barcroft } 2713fd7a8150SMike Barcroft 2714fd7a8150SMike Barcroft /* 2715fd7a8150SMike Barcroft * Returns a locked prison instance, or NULL on failure. 2716fd7a8150SMike Barcroft */ 271754b369c1SPawel Jakub Dawidek struct prison * 2718fd7a8150SMike Barcroft prison_find(int prid) 2719fd7a8150SMike Barcroft { 2720fd7a8150SMike Barcroft struct prison *pr; 2721fd7a8150SMike Barcroft 2722dc68a633SPawel Jakub Dawidek sx_assert(&allprison_lock, SX_LOCKED); 2723b38ff370SJamie Gritton TAILQ_FOREACH(pr, &allprison, pr_list) { 2724f7496dcaSJamie Gritton if (pr->pr_id < prid) 2725f7496dcaSJamie Gritton continue; 27267de883c8SJamie Gritton if (pr->pr_id > prid) 27277de883c8SJamie Gritton break; 2728f7496dcaSJamie Gritton KASSERT(prison_isvalid(pr), ("Found invalid prison %p", pr)); 2729f7496dcaSJamie Gritton mtx_lock(&pr->pr_mtx); 2730f7496dcaSJamie Gritton return (pr); 2731fd7a8150SMike Barcroft } 2732fd7a8150SMike Barcroft return (NULL); 2733fd7a8150SMike Barcroft } 2734fd7a8150SMike Barcroft 2735b38ff370SJamie Gritton /* 27360304c731SJamie Gritton * Find a prison that is a descendant of mypr. Returns a locked prison or NULL. 2737b38ff370SJamie Gritton */ 2738b38ff370SJamie Gritton struct prison * 27390304c731SJamie Gritton prison_find_child(struct prison *mypr, int prid) 2740b38ff370SJamie Gritton { 27410304c731SJamie Gritton struct prison *pr; 27420304c731SJamie Gritton int descend; 2743b38ff370SJamie Gritton 2744b38ff370SJamie Gritton sx_assert(&allprison_lock, SX_LOCKED); 27450304c731SJamie Gritton FOREACH_PRISON_DESCENDANT(mypr, pr, descend) { 27460304c731SJamie Gritton if (pr->pr_id == prid) { 2747f7496dcaSJamie Gritton KASSERT(prison_isvalid(pr), 2748f7496dcaSJamie Gritton ("Found invalid prison %p", pr)); 27490304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 27500304c731SJamie Gritton return (pr); 27510304c731SJamie Gritton } 27520304c731SJamie Gritton } 27530304c731SJamie Gritton return (NULL); 27540304c731SJamie Gritton } 27550304c731SJamie Gritton 27560304c731SJamie Gritton /* 27570304c731SJamie Gritton * Look for the name relative to mypr. Returns a locked prison or NULL. 27580304c731SJamie Gritton */ 27590304c731SJamie Gritton struct prison * 27600304c731SJamie Gritton prison_find_name(struct prison *mypr, const char *name) 27610304c731SJamie Gritton { 27620304c731SJamie Gritton struct prison *pr, *deadpr; 27630304c731SJamie Gritton size_t mylen; 27640304c731SJamie Gritton int descend; 27650304c731SJamie Gritton 27660304c731SJamie Gritton sx_assert(&allprison_lock, SX_LOCKED); 27670304c731SJamie Gritton mylen = (mypr == &prison0) ? 0 : strlen(mypr->pr_name) + 1; 2768b38ff370SJamie Gritton deadpr = NULL; 27690304c731SJamie Gritton FOREACH_PRISON_DESCENDANT(mypr, pr, descend) { 27700304c731SJamie Gritton if (!strcmp(pr->pr_name + mylen, name)) { 2771f7496dcaSJamie Gritton KASSERT(prison_isvalid(pr), 2772f7496dcaSJamie Gritton ("Found invalid prison %p", pr)); 2773f7496dcaSJamie Gritton if (prison_isalive(pr)) { 2774b38ff370SJamie Gritton mtx_lock(&pr->pr_mtx); 2775b38ff370SJamie Gritton return (pr); 2776f7496dcaSJamie Gritton } 2777b38ff370SJamie Gritton deadpr = pr; 2778b38ff370SJamie Gritton } 2779b38ff370SJamie Gritton } 27800304c731SJamie Gritton /* There was no valid prison - perhaps there was a dying one. */ 2781f7496dcaSJamie Gritton if (deadpr != NULL) 2782b38ff370SJamie Gritton mtx_lock(&deadpr->pr_mtx); 2783b38ff370SJamie Gritton return (deadpr); 2784b38ff370SJamie Gritton } 2785b38ff370SJamie Gritton 2786b38ff370SJamie Gritton /* 27870fe74ae6SJamie Gritton * See if a prison has the specific flag set. The prison should be locked, 27880fe74ae6SJamie Gritton * unless checking for flags that are only set at jail creation (such as 27890fe74ae6SJamie Gritton * PR_IP4 and PR_IP6), or only the single bit is examined, without regard 27900fe74ae6SJamie Gritton * to any other prison data. 27910304c731SJamie Gritton */ 27920304c731SJamie Gritton int 27930304c731SJamie Gritton prison_flag(struct ucred *cred, unsigned flag) 27940304c731SJamie Gritton { 27950304c731SJamie Gritton 27960304c731SJamie Gritton return (cred->cr_prison->pr_flags & flag); 27970304c731SJamie Gritton } 27980304c731SJamie Gritton 27990304c731SJamie Gritton int 28000304c731SJamie Gritton prison_allow(struct ucred *cred, unsigned flag) 28010304c731SJamie Gritton { 28020304c731SJamie Gritton 28030fe74ae6SJamie Gritton return ((cred->cr_prison->pr_allow & flag) != 0); 28040304c731SJamie Gritton } 28050304c731SJamie Gritton 28060304c731SJamie Gritton /* 2807effad35eSJamie Gritton * Hold a prison reference, by incrementing pr_ref. It is generally 2808effad35eSJamie Gritton * an error to hold a prison that does not already have a reference. 2809effad35eSJamie Gritton * A prison record will remain valid as long as it has at least one 2810effad35eSJamie Gritton * reference, and will not be removed as long as either the prison 2811effad35eSJamie Gritton * mutex or the allprison lock is held (allprison_lock may be shared). 2812effad35eSJamie Gritton */ 2813effad35eSJamie Gritton void 2814effad35eSJamie Gritton prison_hold_locked(struct prison *pr) 2815effad35eSJamie Gritton { 2816effad35eSJamie Gritton 28176754ae25SJamie Gritton /* Locking is no longer required. */ 28186754ae25SJamie Gritton prison_hold(pr); 2819effad35eSJamie Gritton } 2820effad35eSJamie Gritton 2821effad35eSJamie Gritton void 2822effad35eSJamie Gritton prison_hold(struct prison *pr) 2823effad35eSJamie Gritton { 28246754ae25SJamie Gritton #ifdef INVARIANTS 28256754ae25SJamie Gritton int was_valid = refcount_acquire_if_not_zero(&pr->pr_ref); 2826effad35eSJamie Gritton 28276754ae25SJamie Gritton KASSERT(was_valid, 28286754ae25SJamie Gritton ("Trying to hold dead prison %p (jid=%d).", pr, pr->pr_id)); 28296754ae25SJamie Gritton #else 28306754ae25SJamie Gritton refcount_acquire(&pr->pr_ref); 28316754ae25SJamie Gritton #endif 2832effad35eSJamie Gritton } 2833effad35eSJamie Gritton 2834effad35eSJamie Gritton /* 2835effad35eSJamie Gritton * Remove a prison reference. If that was the last reference, the 2836f7496dcaSJamie Gritton * prison will be removed (at a later time). 2837b38ff370SJamie Gritton */ 283891421ba2SRobert Watson void 28391ba4a712SPawel Jakub Dawidek prison_free_locked(struct prison *pr) 284091421ba2SRobert Watson { 284191421ba2SRobert Watson 28421ba4a712SPawel Jakub Dawidek mtx_assert(&pr->pr_mtx, MA_OWNED); 2843effad35eSJamie Gritton /* 2844f7496dcaSJamie Gritton * Locking is no longer required, but unlock because the caller 2845f7496dcaSJamie Gritton * expects it. 2846effad35eSJamie Gritton */ 2847f7496dcaSJamie Gritton mtx_unlock(&pr->pr_mtx); 2848f7496dcaSJamie Gritton prison_free(pr); 2849effad35eSJamie Gritton } 2850c2cda609SPawel Jakub Dawidek 28511ba4a712SPawel Jakub Dawidek void 28521ba4a712SPawel Jakub Dawidek prison_free(struct prison *pr) 28531ba4a712SPawel Jakub Dawidek { 28541ba4a712SPawel Jakub Dawidek 28556754ae25SJamie Gritton KASSERT(refcount_load(&pr->pr_ref) > 0, 28566754ae25SJamie Gritton ("Trying to free dead prison %p (jid=%d).", 28576754ae25SJamie Gritton pr, pr->pr_id)); 2858f7496dcaSJamie Gritton if (!refcount_release_if_not_last(&pr->pr_ref)) { 2859f7496dcaSJamie Gritton /* 2860f7496dcaSJamie Gritton * Don't remove the last reference in this context, 2861f7496dcaSJamie Gritton * in case there are locks held. 2862f7496dcaSJamie Gritton */ 2863f7496dcaSJamie Gritton taskqueue_enqueue(taskqueue_thread, &pr->pr_task); 2864f7496dcaSJamie Gritton } 2865f7496dcaSJamie Gritton } 2866f7496dcaSJamie Gritton 2867f7496dcaSJamie Gritton static void 2868f7496dcaSJamie Gritton prison_free_not_last(struct prison *pr) 2869f7496dcaSJamie Gritton { 2870f7496dcaSJamie Gritton #ifdef INVARIANTS 2871f7496dcaSJamie Gritton int lastref; 2872f7496dcaSJamie Gritton 2873f7496dcaSJamie Gritton KASSERT(refcount_load(&pr->pr_ref) > 0, 2874f7496dcaSJamie Gritton ("Trying to free dead prison %p (jid=%d).", 2875f7496dcaSJamie Gritton pr, pr->pr_id)); 2876f7496dcaSJamie Gritton lastref = refcount_release(&pr->pr_ref); 2877f7496dcaSJamie Gritton KASSERT(!lastref, 2878f7496dcaSJamie Gritton ("prison_free_not_last freed last ref on prison %p (jid=%d).", 2879f7496dcaSJamie Gritton pr, pr->pr_id)); 2880f7496dcaSJamie Gritton #else 2881ee9b37aeSMateusz Guzik refcount_release(&pr->pr_ref); 2882f7496dcaSJamie Gritton #endif 28831ba4a712SPawel Jakub Dawidek } 28841ba4a712SPawel Jakub Dawidek 288573d9e52dSJamie Gritton /* 2886f171938cSGordon Bergling * Hold a prison for user visibility, by incrementing pr_uref. 2887effad35eSJamie Gritton * It is generally an error to hold a prison that isn't already 288849a033d8SGordon Bergling * user-visible, except through the jail system calls. It is also 2889effad35eSJamie Gritton * an error to hold an invalid prison. A prison record will remain 2890effad35eSJamie Gritton * alive as long as it has at least one user reference, and will not 2891f7496dcaSJamie Gritton * be set to the dying state until the prison mutex and allprison_lock 2892f7496dcaSJamie Gritton * are both freed. 2893effad35eSJamie Gritton */ 2894effad35eSJamie Gritton void 2895effad35eSJamie Gritton prison_proc_hold(struct prison *pr) 2896effad35eSJamie Gritton { 28976754ae25SJamie Gritton #ifdef INVARIANTS 28986754ae25SJamie Gritton int was_alive = refcount_acquire_if_not_zero(&pr->pr_uref); 2899effad35eSJamie Gritton 29006754ae25SJamie Gritton KASSERT(was_alive, 2901effad35eSJamie Gritton ("Cannot add a process to a non-alive prison (jid=%d)", pr->pr_id)); 29026754ae25SJamie Gritton #else 29036754ae25SJamie Gritton refcount_acquire(&pr->pr_uref); 29046754ae25SJamie Gritton #endif 2905effad35eSJamie Gritton } 2906effad35eSJamie Gritton 2907effad35eSJamie Gritton /* 2908effad35eSJamie Gritton * Remove a prison user reference. If it was the last reference, the 2909effad35eSJamie Gritton * prison will be considered "dying", and may be removed once all of 2910effad35eSJamie Gritton * its references are dropped. 2911effad35eSJamie Gritton */ 2912effad35eSJamie Gritton void 2913effad35eSJamie Gritton prison_proc_free(struct prison *pr) 2914effad35eSJamie Gritton { 2915effad35eSJamie Gritton 29166754ae25SJamie Gritton /* 29176754ae25SJamie Gritton * Locking is only required when releasing the last reference. 29186754ae25SJamie Gritton * This allows assurance that a locked prison will remain alive 29196754ae25SJamie Gritton * until it is unlocked. 29206754ae25SJamie Gritton */ 29216754ae25SJamie Gritton KASSERT(refcount_load(&pr->pr_uref) > 0, 2922effad35eSJamie Gritton ("Trying to kill a process in a dead prison (jid=%d)", pr->pr_id)); 2923195cd6aeSJamie Gritton if (!refcount_release_if_not_last(&pr->pr_uref)) { 2924effad35eSJamie Gritton /* 2925effad35eSJamie Gritton * Don't remove the last user reference in this context, 2926effad35eSJamie Gritton * which is expected to be a process that is not only locked, 2927effad35eSJamie Gritton * but also half dead. Add a reference so any calls to 2928effad35eSJamie Gritton * prison_free() won't re-submit the task. 2929effad35eSJamie Gritton */ 2930f7496dcaSJamie Gritton prison_hold(pr); 29311158508aSJamie Gritton mtx_lock(&pr->pr_mtx); 29321158508aSJamie Gritton KASSERT(!(pr->pr_flags & PR_COMPLETE_PROC), 29331158508aSJamie Gritton ("Redundant last reference in prison_proc_free (jid=%d)", 29341158508aSJamie Gritton pr->pr_id)); 29351158508aSJamie Gritton pr->pr_flags |= PR_COMPLETE_PROC; 29361158508aSJamie Gritton mtx_unlock(&pr->pr_mtx); 2937effad35eSJamie Gritton taskqueue_enqueue(taskqueue_thread, &pr->pr_task); 2938effad35eSJamie Gritton } 2939effad35eSJamie Gritton } 2940effad35eSJamie Gritton 2941c861373bSJamie Gritton static void 2942c861373bSJamie Gritton prison_proc_free_not_last(struct prison *pr) 2943c861373bSJamie Gritton { 2944c861373bSJamie Gritton #ifdef INVARIANTS 2945c861373bSJamie Gritton int lastref; 2946c861373bSJamie Gritton 2947c861373bSJamie Gritton KASSERT(refcount_load(&pr->pr_uref) > 0, 2948c861373bSJamie Gritton ("Trying to free dead prison %p (jid=%d).", 2949c861373bSJamie Gritton pr, pr->pr_id)); 2950c861373bSJamie Gritton lastref = refcount_release(&pr->pr_uref); 2951c861373bSJamie Gritton KASSERT(!lastref, 2952c861373bSJamie Gritton ("prison_proc_free_not_last freed last uref on prison %p (jid=%d).", 2953c861373bSJamie Gritton pr, pr->pr_id)); 2954c861373bSJamie Gritton #else 2955c861373bSJamie Gritton refcount_release(&pr->pr_uref); 2956c861373bSJamie Gritton #endif 2957c861373bSJamie Gritton } 2958c861373bSJamie Gritton 29595ecb5444SMateusz Guzik void 29605ecb5444SMateusz Guzik prison_proc_link(struct prison *pr, struct proc *p) 29615ecb5444SMateusz Guzik { 29625ecb5444SMateusz Guzik 29635ecb5444SMateusz Guzik sx_assert(&allproc_lock, SA_XLOCKED); 29645ecb5444SMateusz Guzik LIST_INSERT_HEAD(&pr->pr_proclist, p, p_jaillist); 29655ecb5444SMateusz Guzik } 29665ecb5444SMateusz Guzik 29675ecb5444SMateusz Guzik void 29685ecb5444SMateusz Guzik prison_proc_unlink(struct prison *pr, struct proc *p) 29695ecb5444SMateusz Guzik { 29705ecb5444SMateusz Guzik 29715ecb5444SMateusz Guzik sx_assert(&allproc_lock, SA_XLOCKED); 29725ecb5444SMateusz Guzik LIST_REMOVE(p, p_jaillist); 29735ecb5444SMateusz Guzik } 29745ecb5444SMateusz Guzik 29755ecb5444SMateusz Guzik static void 29765ecb5444SMateusz Guzik prison_proc_relink(struct prison *opr, struct prison *npr, struct proc *p) 29775ecb5444SMateusz Guzik { 29785ecb5444SMateusz Guzik 29795ecb5444SMateusz Guzik sx_xlock(&allproc_lock); 29805ecb5444SMateusz Guzik prison_proc_unlink(opr, p); 29815ecb5444SMateusz Guzik prison_proc_link(npr, p); 29825ecb5444SMateusz Guzik sx_xunlock(&allproc_lock); 29835ecb5444SMateusz Guzik } 29845ecb5444SMateusz Guzik 2985effad35eSJamie Gritton /* 298673d9e52dSJamie Gritton * Complete a call to either prison_free or prison_proc_free. 298773d9e52dSJamie Gritton */ 2988c2cda609SPawel Jakub Dawidek static void 2989c2cda609SPawel Jakub Dawidek prison_complete(void *context, int pending) 2990c2cda609SPawel Jakub Dawidek { 299173d9e52dSJamie Gritton struct prison *pr = context; 2992f7496dcaSJamie Gritton int drflags; 2993b38ff370SJamie Gritton 2994effad35eSJamie Gritton /* 29951158508aSJamie Gritton * This could be called to release the last reference, or the last 29961158508aSJamie Gritton * user reference (plus the reference held in prison_proc_free). 2997effad35eSJamie Gritton */ 2998f7496dcaSJamie Gritton drflags = prison_lock_xlock(pr, PD_DEREF); 29991158508aSJamie Gritton if (pr->pr_flags & PR_COMPLETE_PROC) { 30001158508aSJamie Gritton pr->pr_flags &= ~PR_COMPLETE_PROC; 3001f7496dcaSJamie Gritton drflags |= PD_DEUREF; 30021158508aSJamie Gritton } 3003f7496dcaSJamie Gritton prison_deref(pr, drflags); 3004b38ff370SJamie Gritton } 3005b38ff370SJamie Gritton 30065ecb5444SMateusz Guzik static void 30075ecb5444SMateusz Guzik prison_kill_processes_cb(struct proc *p, void *arg __unused) 30085ecb5444SMateusz Guzik { 30095ecb5444SMateusz Guzik 30105ecb5444SMateusz Guzik kern_psignal(p, SIGKILL); 30115ecb5444SMateusz Guzik } 30125ecb5444SMateusz Guzik 30135ecb5444SMateusz Guzik /* 30145ecb5444SMateusz Guzik * Note the iteration does not guarantee acting on all processes. 30155ecb5444SMateusz Guzik * Most notably there may be fork or jail_attach in progress. 30165ecb5444SMateusz Guzik */ 30175ecb5444SMateusz Guzik void 30185ecb5444SMateusz Guzik prison_proc_iterate(struct prison *pr, void (*cb)(struct proc *, void *), 30195ecb5444SMateusz Guzik void *cbarg) 30205ecb5444SMateusz Guzik { 30215ecb5444SMateusz Guzik struct prison *ppr; 30225ecb5444SMateusz Guzik struct proc *p; 30235ecb5444SMateusz Guzik 30245ecb5444SMateusz Guzik if (atomic_load_int(&pr->pr_childcount) == 0) { 30255ecb5444SMateusz Guzik sx_slock(&allproc_lock); 30265ecb5444SMateusz Guzik LIST_FOREACH(p, &pr->pr_proclist, p_jaillist) { 30275ecb5444SMateusz Guzik if (p->p_state == PRS_NEW) 30285ecb5444SMateusz Guzik continue; 30295ecb5444SMateusz Guzik PROC_LOCK(p); 30305ecb5444SMateusz Guzik cb(p, cbarg); 30315ecb5444SMateusz Guzik PROC_UNLOCK(p); 30325ecb5444SMateusz Guzik } 30335ecb5444SMateusz Guzik sx_sunlock(&allproc_lock); 30345ecb5444SMateusz Guzik if (atomic_load_int(&pr->pr_childcount) == 0) 30355ecb5444SMateusz Guzik return; 30365ecb5444SMateusz Guzik /* 30375ecb5444SMateusz Guzik * Some jails popped up during the iteration, fall through to a 30385ecb5444SMateusz Guzik * system-wide search. 30395ecb5444SMateusz Guzik */ 30405ecb5444SMateusz Guzik } 30415ecb5444SMateusz Guzik 30425ecb5444SMateusz Guzik sx_slock(&allproc_lock); 30435ecb5444SMateusz Guzik FOREACH_PROC_IN_SYSTEM(p) { 30445ecb5444SMateusz Guzik PROC_LOCK(p); 30455ecb5444SMateusz Guzik if (p->p_state != PRS_NEW && p->p_ucred != NULL) { 30465ecb5444SMateusz Guzik for (ppr = p->p_ucred->cr_prison; 30475ecb5444SMateusz Guzik ppr != &prison0; 30485ecb5444SMateusz Guzik ppr = ppr->pr_parent) { 30495ecb5444SMateusz Guzik if (ppr == pr) { 30505ecb5444SMateusz Guzik cb(p, cbarg); 30515ecb5444SMateusz Guzik break; 30525ecb5444SMateusz Guzik } 30535ecb5444SMateusz Guzik } 30545ecb5444SMateusz Guzik } 30555ecb5444SMateusz Guzik PROC_UNLOCK(p); 30565ecb5444SMateusz Guzik } 30575ecb5444SMateusz Guzik sx_sunlock(&allproc_lock); 30585ecb5444SMateusz Guzik } 30595ecb5444SMateusz Guzik 3060b38ff370SJamie Gritton /* 3061effad35eSJamie Gritton * Remove a prison reference and/or user reference (usually). 3062effad35eSJamie Gritton * This assumes context that allows sleeping (for allprison_lock), 3063effad35eSJamie Gritton * with no non-sleeping locks held, except perhaps the prison itself. 3064effad35eSJamie Gritton * If there are no more references, release and delist the prison. 3065effad35eSJamie Gritton * On completion, the prison lock and the allprison lock are both 3066effad35eSJamie Gritton * unlocked. 3067b38ff370SJamie Gritton */ 3068b38ff370SJamie Gritton static void 3069b38ff370SJamie Gritton prison_deref(struct prison *pr, int flags) 3070b38ff370SJamie Gritton { 30716e1d1bfcSJamie Gritton struct prisonlist freeprison; 3072c861373bSJamie Gritton struct prison *killpr, *rpr, *ppr, *tpr; 3073c2cda609SPawel Jakub Dawidek 3074c861373bSJamie Gritton killpr = NULL; 30756e1d1bfcSJamie Gritton TAILQ_INIT(&freeprison); 30766e1d1bfcSJamie Gritton /* 30776e1d1bfcSJamie Gritton * Release this prison as requested, which may cause its parent 30786e1d1bfcSJamie Gritton * to be released, and then maybe its grandparent, etc. 30796e1d1bfcSJamie Gritton */ 30800304c731SJamie Gritton for (;;) { 3081c861373bSJamie Gritton if (flags & PD_KILL) { 3082c861373bSJamie Gritton /* Kill the prison and its descendents. */ 3083589e4c1dSJamie Gritton KASSERT(pr != &prison0, 3084589e4c1dSJamie Gritton ("prison_deref trying to kill prison0")); 3085c861373bSJamie Gritton if (!(flags & PD_DEREF)) { 3086c861373bSJamie Gritton prison_hold(pr); 3087c861373bSJamie Gritton flags |= PD_DEREF; 3088c861373bSJamie Gritton } 3089c861373bSJamie Gritton flags = prison_lock_xlock(pr, flags); 3090c861373bSJamie Gritton prison_deref_kill(pr, &freeprison); 3091c861373bSJamie Gritton } 3092e6d5cb63SJamie Gritton if (flags & PD_DEUREF) { 3093f7496dcaSJamie Gritton /* Drop a user reference. */ 30946754ae25SJamie Gritton KASSERT(refcount_load(&pr->pr_uref) > 0, 309573d9e52dSJamie Gritton ("prison_deref PD_DEUREF on a dead prison (jid=%d)", 309673d9e52dSJamie Gritton pr->pr_id)); 3097f7496dcaSJamie Gritton if (!refcount_release_if_not_last(&pr->pr_uref)) { 3098f7496dcaSJamie Gritton if (!(flags & PD_DEREF)) { 3099f7496dcaSJamie Gritton prison_hold(pr); 3100f7496dcaSJamie Gritton flags |= PD_DEREF; 3101f7496dcaSJamie Gritton } 3102f7496dcaSJamie Gritton flags = prison_lock_xlock(pr, flags); 31031158508aSJamie Gritton if (refcount_release(&pr->pr_uref) && 31041158508aSJamie Gritton pr->pr_state == PRISON_STATE_ALIVE) { 3105f7496dcaSJamie Gritton /* 3106f7496dcaSJamie Gritton * When the last user references goes, 3107f7496dcaSJamie Gritton * this becomes a dying prison. 3108f7496dcaSJamie Gritton */ 3109f7496dcaSJamie Gritton KASSERT( 3110f7496dcaSJamie Gritton refcount_load(&prison0.pr_uref) > 0, 31116754ae25SJamie Gritton ("prison0 pr_uref=0")); 31121158508aSJamie Gritton pr->pr_state = PRISON_STATE_DYING; 3113f7496dcaSJamie Gritton mtx_unlock(&pr->pr_mtx); 3114f7496dcaSJamie Gritton flags &= ~PD_LOCKED; 3115a9f7455cSJamie Gritton prison_cleanup(pr); 3116f7496dcaSJamie Gritton } 3117f7496dcaSJamie Gritton } 3118f7496dcaSJamie Gritton } 3119c861373bSJamie Gritton if (flags & PD_KILL) { 3120c861373bSJamie Gritton /* 3121c861373bSJamie Gritton * Any remaining user references are probably processes 3122c861373bSJamie Gritton * that need to be killed, either in this prison or its 3123c861373bSJamie Gritton * descendants. 3124c861373bSJamie Gritton */ 3125c861373bSJamie Gritton if (refcount_load(&pr->pr_uref) > 0) 3126c861373bSJamie Gritton killpr = pr; 3127589e4c1dSJamie Gritton /* Make sure the parent prison doesn't get killed. */ 3128589e4c1dSJamie Gritton flags &= ~PD_KILL; 3129c861373bSJamie Gritton } 313073d9e52dSJamie Gritton if (flags & PD_DEREF) { 3131f7496dcaSJamie Gritton /* Drop a reference. */ 31326754ae25SJamie Gritton KASSERT(refcount_load(&pr->pr_ref) > 0, 313373d9e52dSJamie Gritton ("prison_deref PD_DEREF on a dead prison (jid=%d)", 313473d9e52dSJamie Gritton pr->pr_id)); 3135f7496dcaSJamie Gritton if (!refcount_release_if_not_last(&pr->pr_ref)) { 3136f7496dcaSJamie Gritton flags = prison_lock_xlock(pr, flags); 3137f7496dcaSJamie Gritton if (refcount_release(&pr->pr_ref)) { 3138cc5fd8c7SJamie Gritton /* 3139f7496dcaSJamie Gritton * When the last reference goes, 3140f7496dcaSJamie Gritton * unlink the prison and set it aside. 3141cc5fd8c7SJamie Gritton */ 3142f7496dcaSJamie Gritton KASSERT( 3143f7496dcaSJamie Gritton refcount_load(&pr->pr_uref) == 0, 3144f7496dcaSJamie Gritton ("prison_deref: last ref, " 3145f7496dcaSJamie Gritton "but still has %d urefs (jid=%d)", 3146f7496dcaSJamie Gritton pr->pr_uref, pr->pr_id)); 3147f7496dcaSJamie Gritton KASSERT( 3148f7496dcaSJamie Gritton refcount_load(&prison0.pr_ref) != 0, 3149f7496dcaSJamie Gritton ("prison0 pr_ref=0")); 31501158508aSJamie Gritton pr->pr_state = PRISON_STATE_INVALID; 3151b38ff370SJamie Gritton TAILQ_REMOVE(&allprison, pr, pr_list); 31520304c731SJamie Gritton LIST_REMOVE(pr, pr_sibling); 3153f7496dcaSJamie Gritton TAILQ_INSERT_TAIL(&freeprison, pr, 3154f7496dcaSJamie Gritton pr_list); 3155f7496dcaSJamie Gritton for (ppr = pr->pr_parent; 3156f7496dcaSJamie Gritton ppr != NULL; 3157f7496dcaSJamie Gritton ppr = ppr->pr_parent) 3158f7496dcaSJamie Gritton ppr->pr_childcount--; 3159f7496dcaSJamie Gritton /* 3160f7496dcaSJamie Gritton * Removing a prison frees references 3161f7496dcaSJamie Gritton * from its parent. 3162f7496dcaSJamie Gritton */ 3163f7496dcaSJamie Gritton mtx_unlock(&pr->pr_mtx); 3164f7496dcaSJamie Gritton flags &= ~PD_LOCKED; 31656e1d1bfcSJamie Gritton pr = pr->pr_parent; 31666e1d1bfcSJamie Gritton flags |= PD_DEREF | PD_DEUREF; 3167f7496dcaSJamie Gritton continue; 3168f7496dcaSJamie Gritton } 3169f7496dcaSJamie Gritton } 3170f7496dcaSJamie Gritton } 3171f7496dcaSJamie Gritton break; 31726e1d1bfcSJamie Gritton } 31736e1d1bfcSJamie Gritton 31746e1d1bfcSJamie Gritton /* Release all the prison locks. */ 3175f7496dcaSJamie Gritton if (flags & PD_LOCKED) 3176f7496dcaSJamie Gritton mtx_unlock(&pr->pr_mtx); 31776e1d1bfcSJamie Gritton if (flags & PD_LIST_SLOCKED) 31786e1d1bfcSJamie Gritton sx_sunlock(&allprison_lock); 31796e1d1bfcSJamie Gritton else if (flags & PD_LIST_XLOCKED) 31806e1d1bfcSJamie Gritton sx_xunlock(&allprison_lock); 31816e1d1bfcSJamie Gritton 3182c861373bSJamie Gritton /* Kill any processes attached to a killed prison. */ 31835ecb5444SMateusz Guzik if (killpr != NULL) 31845ecb5444SMateusz Guzik prison_proc_iterate(killpr, prison_kill_processes_cb, NULL); 3185c861373bSJamie Gritton 31866e1d1bfcSJamie Gritton /* 31876e1d1bfcSJamie Gritton * Finish removing any unreferenced prisons, which couldn't happen 31886e1d1bfcSJamie Gritton * while allprison_lock was held (to avoid a LOR on vrele). 31896e1d1bfcSJamie Gritton */ 31906e1d1bfcSJamie Gritton TAILQ_FOREACH_SAFE(rpr, &freeprison, pr_list, tpr) { 31916e1d1bfcSJamie Gritton #ifdef VIMAGE 31926e1d1bfcSJamie Gritton if (rpr->pr_vnet != rpr->pr_parent->pr_vnet) 31936e1d1bfcSJamie Gritton vnet_destroy(rpr->pr_vnet); 31946e1d1bfcSJamie Gritton #endif 31956e1d1bfcSJamie Gritton if (rpr->pr_root != NULL) 31966e1d1bfcSJamie Gritton vrele(rpr->pr_root); 31976e1d1bfcSJamie Gritton mtx_destroy(&rpr->pr_mtx); 31986e1d1bfcSJamie Gritton #ifdef INET 3199eb8dcdeaSGleb Smirnoff prison_ip_free(rpr->pr_addrs[PR_INET]); 32006e1d1bfcSJamie Gritton #endif 32016e1d1bfcSJamie Gritton #ifdef INET6 3202eb8dcdeaSGleb Smirnoff prison_ip_free(rpr->pr_addrs[PR_INET6]); 32036e1d1bfcSJamie Gritton #endif 32046e1d1bfcSJamie Gritton if (rpr->pr_cpuset != NULL) 32056e1d1bfcSJamie Gritton cpuset_rel(rpr->pr_cpuset); 32066e1d1bfcSJamie Gritton osd_jail_exit(rpr); 32076e1d1bfcSJamie Gritton #ifdef RACCT 32086e1d1bfcSJamie Gritton if (racct_enable) 32096e1d1bfcSJamie Gritton prison_racct_detach(rpr); 32106e1d1bfcSJamie Gritton #endif 3211f7496dcaSJamie Gritton TAILQ_REMOVE(&freeprison, rpr, pr_list); 32126e1d1bfcSJamie Gritton free(rpr, M_PRISON); 32130304c731SJamie Gritton } 3214b3059e09SRobert Watson } 3215b3059e09SRobert Watson 3216413628a7SBjoern A. Zeeb /* 3217c861373bSJamie Gritton * Kill the prison and its descendants. Mark them as dying, clear the 3218c861373bSJamie Gritton * persist flag, and call module remove methods. 3219c861373bSJamie Gritton */ 3220c861373bSJamie Gritton static void 3221c861373bSJamie Gritton prison_deref_kill(struct prison *pr, struct prisonlist *freeprison) 3222c861373bSJamie Gritton { 3223c861373bSJamie Gritton struct prison *cpr, *ppr, *rpr; 3224c861373bSJamie Gritton bool descend; 3225c861373bSJamie Gritton 3226c861373bSJamie Gritton /* 3227c861373bSJamie Gritton * Unlike the descendants, the target prison can be killed 3228c861373bSJamie Gritton * even if it is currently dying. This is useful for failed 3229c861373bSJamie Gritton * creation in jail_set(2). 3230c861373bSJamie Gritton */ 3231c861373bSJamie Gritton KASSERT(refcount_load(&pr->pr_ref) > 0, 3232c861373bSJamie Gritton ("Trying to kill dead prison %p (jid=%d).", 3233c861373bSJamie Gritton pr, pr->pr_id)); 3234c861373bSJamie Gritton refcount_acquire(&pr->pr_uref); 3235c861373bSJamie Gritton pr->pr_state = PRISON_STATE_DYING; 3236c861373bSJamie Gritton mtx_unlock(&pr->pr_mtx); 3237c861373bSJamie Gritton 3238c861373bSJamie Gritton rpr = NULL; 3239c861373bSJamie Gritton FOREACH_PRISON_DESCENDANT_PRE_POST(pr, cpr, descend) { 3240c861373bSJamie Gritton if (descend) { 3241c861373bSJamie Gritton if (!prison_isalive(cpr)) { 3242c861373bSJamie Gritton descend = false; 3243c861373bSJamie Gritton continue; 3244c861373bSJamie Gritton } 3245c861373bSJamie Gritton prison_hold(cpr); 3246c861373bSJamie Gritton prison_proc_hold(cpr); 3247c861373bSJamie Gritton mtx_lock(&cpr->pr_mtx); 3248c861373bSJamie Gritton cpr->pr_state = PRISON_STATE_DYING; 3249c861373bSJamie Gritton cpr->pr_flags |= PR_REMOVE; 3250c861373bSJamie Gritton mtx_unlock(&cpr->pr_mtx); 3251c861373bSJamie Gritton continue; 3252c861373bSJamie Gritton } 3253c861373bSJamie Gritton if (!(cpr->pr_flags & PR_REMOVE)) 3254c861373bSJamie Gritton continue; 3255a9f7455cSJamie Gritton prison_cleanup(cpr); 3256c861373bSJamie Gritton mtx_lock(&cpr->pr_mtx); 3257c861373bSJamie Gritton cpr->pr_flags &= ~PR_REMOVE; 3258c861373bSJamie Gritton if (cpr->pr_flags & PR_PERSIST) { 3259c861373bSJamie Gritton cpr->pr_flags &= ~PR_PERSIST; 3260c861373bSJamie Gritton prison_proc_free_not_last(cpr); 3261c861373bSJamie Gritton prison_free_not_last(cpr); 3262c861373bSJamie Gritton } 3263c861373bSJamie Gritton (void)refcount_release(&cpr->pr_uref); 3264c861373bSJamie Gritton if (refcount_release(&cpr->pr_ref)) { 3265c861373bSJamie Gritton /* 3266c861373bSJamie Gritton * When the last reference goes, unlink the prison 3267c861373bSJamie Gritton * and set it aside for prison_deref() to handle. 3268c861373bSJamie Gritton * Delay unlinking the sibling list to keep the loop 3269c861373bSJamie Gritton * safe. 3270c861373bSJamie Gritton */ 3271c861373bSJamie Gritton if (rpr != NULL) 3272c861373bSJamie Gritton LIST_REMOVE(rpr, pr_sibling); 3273c861373bSJamie Gritton rpr = cpr; 3274c861373bSJamie Gritton rpr->pr_state = PRISON_STATE_INVALID; 3275c861373bSJamie Gritton TAILQ_REMOVE(&allprison, rpr, pr_list); 3276c861373bSJamie Gritton TAILQ_INSERT_TAIL(freeprison, rpr, pr_list); 3277c861373bSJamie Gritton /* 3278c861373bSJamie Gritton * Removing a prison frees references from its parent. 3279c861373bSJamie Gritton */ 3280c861373bSJamie Gritton ppr = rpr->pr_parent; 3281c861373bSJamie Gritton prison_proc_free_not_last(ppr); 3282c861373bSJamie Gritton prison_free_not_last(ppr); 3283c861373bSJamie Gritton for (; ppr != NULL; ppr = ppr->pr_parent) 3284c861373bSJamie Gritton ppr->pr_childcount--; 3285c861373bSJamie Gritton } 3286c861373bSJamie Gritton mtx_unlock(&cpr->pr_mtx); 3287c861373bSJamie Gritton } 3288c861373bSJamie Gritton if (rpr != NULL) 3289c861373bSJamie Gritton LIST_REMOVE(rpr, pr_sibling); 3290c861373bSJamie Gritton 3291a9f7455cSJamie Gritton prison_cleanup(pr); 3292c861373bSJamie Gritton mtx_lock(&pr->pr_mtx); 3293c861373bSJamie Gritton if (pr->pr_flags & PR_PERSIST) { 3294c861373bSJamie Gritton pr->pr_flags &= ~PR_PERSIST; 3295c861373bSJamie Gritton prison_proc_free_not_last(pr); 3296c861373bSJamie Gritton prison_free_not_last(pr); 3297c861373bSJamie Gritton } 3298c861373bSJamie Gritton (void)refcount_release(&pr->pr_uref); 3299c861373bSJamie Gritton } 3300c861373bSJamie Gritton 3301c861373bSJamie Gritton /* 3302f7496dcaSJamie Gritton * Given the current locking state in the flags, make sure allprison_lock 3303f7496dcaSJamie Gritton * is held exclusive, and the prison is locked. Return flags indicating 3304f7496dcaSJamie Gritton * the new state. 3305f7496dcaSJamie Gritton */ 3306f7496dcaSJamie Gritton static int 3307f7496dcaSJamie Gritton prison_lock_xlock(struct prison *pr, int flags) 3308f7496dcaSJamie Gritton { 3309f7496dcaSJamie Gritton 3310f7496dcaSJamie Gritton if (!(flags & PD_LIST_XLOCKED)) { 3311f7496dcaSJamie Gritton /* 3312f7496dcaSJamie Gritton * Get allprison_lock, which may be an upgrade, 3313f7496dcaSJamie Gritton * and may require unlocking the prison. 3314f7496dcaSJamie Gritton */ 3315f7496dcaSJamie Gritton if (flags & PD_LOCKED) { 3316f7496dcaSJamie Gritton mtx_unlock(&pr->pr_mtx); 3317f7496dcaSJamie Gritton flags &= ~PD_LOCKED; 3318f7496dcaSJamie Gritton } 3319f7496dcaSJamie Gritton if (flags & PD_LIST_SLOCKED) { 3320f7496dcaSJamie Gritton if (!sx_try_upgrade(&allprison_lock)) { 3321f7496dcaSJamie Gritton sx_sunlock(&allprison_lock); 3322f7496dcaSJamie Gritton sx_xlock(&allprison_lock); 3323f7496dcaSJamie Gritton } 3324f7496dcaSJamie Gritton flags &= ~PD_LIST_SLOCKED; 3325f7496dcaSJamie Gritton } else 3326f7496dcaSJamie Gritton sx_xlock(&allprison_lock); 3327f7496dcaSJamie Gritton flags |= PD_LIST_XLOCKED; 3328f7496dcaSJamie Gritton } 3329f7496dcaSJamie Gritton if (!(flags & PD_LOCKED)) { 3330f7496dcaSJamie Gritton /* Lock the prison mutex. */ 3331f7496dcaSJamie Gritton mtx_lock(&pr->pr_mtx); 3332f7496dcaSJamie Gritton flags |= PD_LOCKED; 3333f7496dcaSJamie Gritton } 3334f7496dcaSJamie Gritton return flags; 3335f7496dcaSJamie Gritton } 3336f7496dcaSJamie Gritton 3337f7496dcaSJamie Gritton /* 3338a9f7455cSJamie Gritton * Release a prison's resources when it starts dying (when the last user 3339a9f7455cSJamie Gritton * reference is dropped, or when it is killed). 3340a9f7455cSJamie Gritton */ 3341a9f7455cSJamie Gritton static void 3342a9f7455cSJamie Gritton prison_cleanup(struct prison *pr) 3343a9f7455cSJamie Gritton { 3344a9f7455cSJamie Gritton sx_assert(&allprison_lock, SA_XLOCKED); 3345a9f7455cSJamie Gritton mtx_assert(&pr->pr_mtx, MA_NOTOWNED); 33467060da62SJamie Gritton shm_remove_prison(pr); 3347a9f7455cSJamie Gritton (void)osd_jail_call(pr, PR_METHOD_REMOVE, NULL); 3348a9f7455cSJamie Gritton } 3349a9f7455cSJamie Gritton 3350a9f7455cSJamie Gritton /* 33510fe74ae6SJamie Gritton * Set or clear a permission bit in the pr_allow field, passing restrictions 33520fe74ae6SJamie Gritton * (cleared permission) down to child jails. 33530fe74ae6SJamie Gritton */ 33540fe74ae6SJamie Gritton void 33550fe74ae6SJamie Gritton prison_set_allow(struct ucred *cred, unsigned flag, int enable) 33560fe74ae6SJamie Gritton { 33570fe74ae6SJamie Gritton struct prison *pr; 33580fe74ae6SJamie Gritton 33590fe74ae6SJamie Gritton pr = cred->cr_prison; 33600fe74ae6SJamie Gritton sx_slock(&allprison_lock); 33610fe74ae6SJamie Gritton mtx_lock(&pr->pr_mtx); 33620fe74ae6SJamie Gritton prison_set_allow_locked(pr, flag, enable); 33630fe74ae6SJamie Gritton mtx_unlock(&pr->pr_mtx); 33640fe74ae6SJamie Gritton sx_sunlock(&allprison_lock); 33650fe74ae6SJamie Gritton } 33660fe74ae6SJamie Gritton 33670fe74ae6SJamie Gritton static void 33680fe74ae6SJamie Gritton prison_set_allow_locked(struct prison *pr, unsigned flag, int enable) 33690fe74ae6SJamie Gritton { 33700fe74ae6SJamie Gritton struct prison *cpr; 33710fe74ae6SJamie Gritton int descend; 33720fe74ae6SJamie Gritton 33730fe74ae6SJamie Gritton if (enable != 0) 33740fe74ae6SJamie Gritton pr->pr_allow |= flag; 33750fe74ae6SJamie Gritton else { 33760fe74ae6SJamie Gritton pr->pr_allow &= ~flag; 33770fe74ae6SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, cpr, descend) 33780fe74ae6SJamie Gritton cpr->pr_allow &= ~flag; 33790fe74ae6SJamie Gritton } 33800fe74ae6SJamie Gritton } 33810fe74ae6SJamie Gritton 33820fe74ae6SJamie Gritton /* 3383ca04ba64SJamie Gritton * Check if a jail supports the given address family. 3384ca04ba64SJamie Gritton * 3385ca04ba64SJamie Gritton * Returns 0 if not jailed or the address family is supported, EAFNOSUPPORT 3386ca04ba64SJamie Gritton * if not. 3387ca04ba64SJamie Gritton */ 3388ca04ba64SJamie Gritton int 3389ca04ba64SJamie Gritton prison_check_af(struct ucred *cred, int af) 3390ca04ba64SJamie Gritton { 33910304c731SJamie Gritton struct prison *pr; 3392ca04ba64SJamie Gritton int error; 3393ca04ba64SJamie Gritton 3394ca04ba64SJamie Gritton KASSERT(cred != NULL, ("%s: cred is NULL", __func__)); 3395ca04ba64SJamie Gritton 33960304c731SJamie Gritton pr = cred->cr_prison; 3397499650a0SJamie Gritton #ifdef VIMAGE 33986bb79563SJamie Gritton /* Prisons with their own network stack are not limited. */ 3399de0bd6f7SBjoern A. Zeeb if (prison_owns_vnet(cred)) 34006bb79563SJamie Gritton return (0); 3401499650a0SJamie Gritton #endif 34026bb79563SJamie Gritton 3403ca04ba64SJamie Gritton error = 0; 3404ca04ba64SJamie Gritton switch (af) 3405ca04ba64SJamie Gritton { 3406ca04ba64SJamie Gritton #ifdef INET 3407ca04ba64SJamie Gritton case AF_INET: 34080304c731SJamie Gritton if (pr->pr_flags & PR_IP4) 34090304c731SJamie Gritton { 34100304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 3411eb8dcdeaSGleb Smirnoff if ((pr->pr_flags & PR_IP4) && 3412eb8dcdeaSGleb Smirnoff pr->pr_addrs[PR_INET] == NULL) 3413ca04ba64SJamie Gritton error = EAFNOSUPPORT; 34140304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 34150304c731SJamie Gritton } 3416ca04ba64SJamie Gritton break; 3417ca04ba64SJamie Gritton #endif 3418ca04ba64SJamie Gritton #ifdef INET6 3419ca04ba64SJamie Gritton case AF_INET6: 34200304c731SJamie Gritton if (pr->pr_flags & PR_IP6) 34210304c731SJamie Gritton { 34220304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 3423eb8dcdeaSGleb Smirnoff if ((pr->pr_flags & PR_IP6) && 3424eb8dcdeaSGleb Smirnoff pr->pr_addrs[PR_INET6] == NULL) 3425ca04ba64SJamie Gritton error = EAFNOSUPPORT; 34260304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 34270304c731SJamie Gritton } 3428ca04ba64SJamie Gritton break; 3429ca04ba64SJamie Gritton #endif 3430ca04ba64SJamie Gritton case AF_LOCAL: 3431ca04ba64SJamie Gritton case AF_ROUTE: 3432ca04ba64SJamie Gritton break; 3433ca04ba64SJamie Gritton default: 34340304c731SJamie Gritton if (!(pr->pr_allow & PR_ALLOW_SOCKET_AF)) 3435ca04ba64SJamie Gritton error = EAFNOSUPPORT; 3436ca04ba64SJamie Gritton } 3437ca04ba64SJamie Gritton return (error); 3438ca04ba64SJamie Gritton } 3439ca04ba64SJamie Gritton 3440ca04ba64SJamie Gritton /* 3441413628a7SBjoern A. Zeeb * Check if given address belongs to the jail referenced by cred (wrapper to 3442413628a7SBjoern A. Zeeb * prison_check_ip[46]). 3443413628a7SBjoern A. Zeeb * 34440304c731SJamie Gritton * Returns 0 if jail doesn't restrict the address family or if address belongs 34450304c731SJamie Gritton * to jail, EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if 34460304c731SJamie Gritton * the jail doesn't allow the address family. IPv4 Address passed in in NBO. 3447413628a7SBjoern A. Zeeb */ 3448413628a7SBjoern A. Zeeb int 3449c83dda36SAlexander V. Chernikov prison_if(struct ucred *cred, const struct sockaddr *sa) 345075c13541SPoul-Henning Kamp { 3451413628a7SBjoern A. Zeeb #ifdef INET 3452c83dda36SAlexander V. Chernikov const struct sockaddr_in *sai; 3453413628a7SBjoern A. Zeeb #endif 3454413628a7SBjoern A. Zeeb #ifdef INET6 3455c83dda36SAlexander V. Chernikov const struct sockaddr_in6 *sai6; 3456413628a7SBjoern A. Zeeb #endif 3457b89e82ddSJamie Gritton int error; 345875c13541SPoul-Henning Kamp 3459413628a7SBjoern A. Zeeb KASSERT(cred != NULL, ("%s: cred is NULL", __func__)); 3460413628a7SBjoern A. Zeeb KASSERT(sa != NULL, ("%s: sa is NULL", __func__)); 3461413628a7SBjoern A. Zeeb 3462de0bd6f7SBjoern A. Zeeb #ifdef VIMAGE 3463de0bd6f7SBjoern A. Zeeb if (prison_owns_vnet(cred)) 3464de0bd6f7SBjoern A. Zeeb return (0); 3465de0bd6f7SBjoern A. Zeeb #endif 3466de0bd6f7SBjoern A. Zeeb 3467b89e82ddSJamie Gritton error = 0; 3468413628a7SBjoern A. Zeeb switch (sa->sa_family) 3469413628a7SBjoern A. Zeeb { 3470413628a7SBjoern A. Zeeb #ifdef INET 3471413628a7SBjoern A. Zeeb case AF_INET: 3472c83dda36SAlexander V. Chernikov sai = (const struct sockaddr_in *)sa; 3473b89e82ddSJamie Gritton error = prison_check_ip4(cred, &sai->sin_addr); 3474413628a7SBjoern A. Zeeb break; 3475413628a7SBjoern A. Zeeb #endif 3476413628a7SBjoern A. Zeeb #ifdef INET6 3477413628a7SBjoern A. Zeeb case AF_INET6: 3478c83dda36SAlexander V. Chernikov sai6 = (const struct sockaddr_in6 *)sa; 3479b89e82ddSJamie Gritton error = prison_check_ip6(cred, &sai6->sin6_addr); 3480413628a7SBjoern A. Zeeb break; 3481413628a7SBjoern A. Zeeb #endif 3482413628a7SBjoern A. Zeeb default: 34830304c731SJamie Gritton if (!(cred->cr_prison->pr_allow & PR_ALLOW_SOCKET_AF)) 3484b89e82ddSJamie Gritton error = EAFNOSUPPORT; 3485413628a7SBjoern A. Zeeb } 3486b89e82ddSJamie Gritton return (error); 348775c13541SPoul-Henning Kamp } 348891421ba2SRobert Watson 348991421ba2SRobert Watson /* 349091421ba2SRobert Watson * Return 0 if jails permit p1 to frob p2, otherwise ESRCH. 349191421ba2SRobert Watson */ 349291421ba2SRobert Watson int 34939ddb7954SMike Barcroft prison_check(struct ucred *cred1, struct ucred *cred2) 349491421ba2SRobert Watson { 349591421ba2SRobert Watson 34960304c731SJamie Gritton return ((cred1->cr_prison == cred2->cr_prison || 34970304c731SJamie Gritton prison_ischild(cred1->cr_prison, cred2->cr_prison)) ? 0 : ESRCH); 34980304c731SJamie Gritton } 349991421ba2SRobert Watson 35000304c731SJamie Gritton /* 3501bba7a2e8SRick Macklem * For mountd/nfsd to run within a prison, it must be: 3502bba7a2e8SRick Macklem * - A vnet prison. 3503bba7a2e8SRick Macklem * - PR_ALLOW_NFSD must be set on it. 3504bba7a2e8SRick Macklem * - The root directory (pr_root) of the prison must be 3505bba7a2e8SRick Macklem * a file system mount point, so the mountd can hang 3506bba7a2e8SRick Macklem * export information on it. 3507bba7a2e8SRick Macklem */ 3508bba7a2e8SRick Macklem bool 3509bba7a2e8SRick Macklem prison_check_nfsd(struct ucred *cred) 3510bba7a2e8SRick Macklem { 3511bba7a2e8SRick Macklem 3512bba7a2e8SRick Macklem if (jailed_without_vnet(cred)) 3513bba7a2e8SRick Macklem return (false); 3514bba7a2e8SRick Macklem if (!prison_allow(cred, PR_ALLOW_NFSD)) 3515bba7a2e8SRick Macklem return (false); 3516bba7a2e8SRick Macklem if ((cred->cr_prison->pr_root->v_vflag & VV_ROOT) == 0) 3517bba7a2e8SRick Macklem return (false); 3518bba7a2e8SRick Macklem return (true); 3519bba7a2e8SRick Macklem } 3520bba7a2e8SRick Macklem 3521bba7a2e8SRick Macklem /* 35220304c731SJamie Gritton * Return 1 if p2 is a child of p1, otherwise 0. 35230304c731SJamie Gritton */ 35240304c731SJamie Gritton int 35250304c731SJamie Gritton prison_ischild(struct prison *pr1, struct prison *pr2) 35260304c731SJamie Gritton { 35270304c731SJamie Gritton 35280304c731SJamie Gritton for (pr2 = pr2->pr_parent; pr2 != NULL; pr2 = pr2->pr_parent) 35290304c731SJamie Gritton if (pr1 == pr2) 35300304c731SJamie Gritton return (1); 353191421ba2SRobert Watson return (0); 353291421ba2SRobert Watson } 353391421ba2SRobert Watson 353491421ba2SRobert Watson /* 3535f7496dcaSJamie Gritton * Return true if the prison is currently alive. A prison is alive if it 3536f7496dcaSJamie Gritton * holds user references and it isn't being removed. 353776ad42abSJamie Gritton */ 353876ad42abSJamie Gritton bool 3539eb8dcdeaSGleb Smirnoff prison_isalive(const struct prison *pr) 354076ad42abSJamie Gritton { 354176ad42abSJamie Gritton 35421158508aSJamie Gritton if (__predict_false(pr->pr_state != PRISON_STATE_ALIVE)) 3543cc7b7306SJamie Gritton return (false); 354476ad42abSJamie Gritton return (true); 354576ad42abSJamie Gritton } 354676ad42abSJamie Gritton 354776ad42abSJamie Gritton /* 354876ad42abSJamie Gritton * Return true if the prison is currently valid. A prison is valid if it has 354976ad42abSJamie Gritton * been fully created, and is not being destroyed. Note that dying prisons 3550f7496dcaSJamie Gritton * are still considered valid. Invalid prisons won't be found under normal 3551f7496dcaSJamie Gritton * circumstances, as they're only put in that state by functions that have 3552f7496dcaSJamie Gritton * an exclusive hold on allprison_lock. 355376ad42abSJamie Gritton */ 355476ad42abSJamie Gritton bool 355576ad42abSJamie Gritton prison_isvalid(struct prison *pr) 355676ad42abSJamie Gritton { 355776ad42abSJamie Gritton 35581158508aSJamie Gritton if (__predict_false(pr->pr_state == PRISON_STATE_INVALID)) 35591158508aSJamie Gritton return (false); 35606754ae25SJamie Gritton if (__predict_false(refcount_load(&pr->pr_ref) == 0)) 356176ad42abSJamie Gritton return (false); 356276ad42abSJamie Gritton return (true); 356376ad42abSJamie Gritton } 356476ad42abSJamie Gritton 356576ad42abSJamie Gritton /* 3566de0bd6f7SBjoern A. Zeeb * Return 1 if the passed credential is in a jail and that jail does not 3567de0bd6f7SBjoern A. Zeeb * have its own virtual network stack, otherwise 0. 3568de0bd6f7SBjoern A. Zeeb */ 3569de0bd6f7SBjoern A. Zeeb int 3570de0bd6f7SBjoern A. Zeeb jailed_without_vnet(struct ucred *cred) 3571de0bd6f7SBjoern A. Zeeb { 3572de0bd6f7SBjoern A. Zeeb 3573de0bd6f7SBjoern A. Zeeb if (!jailed(cred)) 3574de0bd6f7SBjoern A. Zeeb return (0); 3575de0bd6f7SBjoern A. Zeeb #ifdef VIMAGE 3576de0bd6f7SBjoern A. Zeeb if (prison_owns_vnet(cred)) 3577de0bd6f7SBjoern A. Zeeb return (0); 3578de0bd6f7SBjoern A. Zeeb #endif 3579de0bd6f7SBjoern A. Zeeb 3580de0bd6f7SBjoern A. Zeeb return (1); 3581de0bd6f7SBjoern A. Zeeb } 3582de0bd6f7SBjoern A. Zeeb 3583de0bd6f7SBjoern A. Zeeb /* 35847455b100SJamie Gritton * Return the correct hostname (domainname, et al) for the passed credential. 35859484d0c0SRobert Drehmel */ 3586ad1ff099SRobert Drehmel void 35879ddb7954SMike Barcroft getcredhostname(struct ucred *cred, char *buf, size_t size) 35889484d0c0SRobert Drehmel { 358976ca6f88SJamie Gritton struct prison *pr; 35909484d0c0SRobert Drehmel 35917455b100SJamie Gritton /* 35927455b100SJamie Gritton * A NULL credential can be used to shortcut to the physical 35937455b100SJamie Gritton * system's hostname. 35947455b100SJamie Gritton */ 359576ca6f88SJamie Gritton pr = (cred != NULL) ? cred->cr_prison : &prison0; 359676ca6f88SJamie Gritton mtx_lock(&pr->pr_mtx); 3597c1f19219SJamie Gritton strlcpy(buf, pr->pr_hostname, size); 359876ca6f88SJamie Gritton mtx_unlock(&pr->pr_mtx); 35999484d0c0SRobert Drehmel } 3600fd7a8150SMike Barcroft 36017455b100SJamie Gritton void 36027455b100SJamie Gritton getcreddomainname(struct ucred *cred, char *buf, size_t size) 36037455b100SJamie Gritton { 36047455b100SJamie Gritton 36057455b100SJamie Gritton mtx_lock(&cred->cr_prison->pr_mtx); 3606c1f19219SJamie Gritton strlcpy(buf, cred->cr_prison->pr_domainname, size); 36077455b100SJamie Gritton mtx_unlock(&cred->cr_prison->pr_mtx); 36087455b100SJamie Gritton } 36097455b100SJamie Gritton 36107455b100SJamie Gritton void 36117455b100SJamie Gritton getcredhostuuid(struct ucred *cred, char *buf, size_t size) 36127455b100SJamie Gritton { 36137455b100SJamie Gritton 36147455b100SJamie Gritton mtx_lock(&cred->cr_prison->pr_mtx); 3615c1f19219SJamie Gritton strlcpy(buf, cred->cr_prison->pr_hostuuid, size); 36167455b100SJamie Gritton mtx_unlock(&cred->cr_prison->pr_mtx); 36177455b100SJamie Gritton } 36187455b100SJamie Gritton 36197455b100SJamie Gritton void 36207455b100SJamie Gritton getcredhostid(struct ucred *cred, unsigned long *hostid) 36217455b100SJamie Gritton { 36227455b100SJamie Gritton 36237455b100SJamie Gritton mtx_lock(&cred->cr_prison->pr_mtx); 36247455b100SJamie Gritton *hostid = cred->cr_prison->pr_hostid; 36257455b100SJamie Gritton mtx_unlock(&cred->cr_prison->pr_mtx); 36267455b100SJamie Gritton } 36277455b100SJamie Gritton 36283f8bc99cSKristof Provost void 36293f8bc99cSKristof Provost getjailname(struct ucred *cred, char *name, size_t len) 36303f8bc99cSKristof Provost { 36313f8bc99cSKristof Provost 36323f8bc99cSKristof Provost mtx_lock(&cred->cr_prison->pr_mtx); 36333f8bc99cSKristof Provost strlcpy(name, cred->cr_prison->pr_name, len); 36343f8bc99cSKristof Provost mtx_unlock(&cred->cr_prison->pr_mtx); 36353f8bc99cSKristof Provost } 36363f8bc99cSKristof Provost 3637eb79e1c7SBjoern A. Zeeb #ifdef VIMAGE 3638eb79e1c7SBjoern A. Zeeb /* 3639eb79e1c7SBjoern A. Zeeb * Determine whether the prison represented by cred owns 3640eb79e1c7SBjoern A. Zeeb * its vnet rather than having it inherited. 3641eb79e1c7SBjoern A. Zeeb * 3642eb79e1c7SBjoern A. Zeeb * Returns 1 in case the prison owns the vnet, 0 otherwise. 3643eb79e1c7SBjoern A. Zeeb */ 3644eb79e1c7SBjoern A. Zeeb int 3645eb79e1c7SBjoern A. Zeeb prison_owns_vnet(struct ucred *cred) 3646eb79e1c7SBjoern A. Zeeb { 3647eb79e1c7SBjoern A. Zeeb 3648eb79e1c7SBjoern A. Zeeb /* 3649eb79e1c7SBjoern A. Zeeb * vnets cannot be added/removed after jail creation, 3650eb79e1c7SBjoern A. Zeeb * so no need to lock here. 3651eb79e1c7SBjoern A. Zeeb */ 3652eb79e1c7SBjoern A. Zeeb return (cred->cr_prison->pr_flags & PR_VNET ? 1 : 0); 3653eb79e1c7SBjoern A. Zeeb } 3654eb79e1c7SBjoern A. Zeeb #endif 3655eb79e1c7SBjoern A. Zeeb 3656f08df373SRobert Watson /* 3657820a0de9SPawel Jakub Dawidek * Determine whether the subject represented by cred can "see" 3658820a0de9SPawel Jakub Dawidek * status of a mount point. 3659820a0de9SPawel Jakub Dawidek * Returns: 0 for permitted, ENOENT otherwise. 3660820a0de9SPawel Jakub Dawidek * XXX: This function should be called cr_canseemount() and should be 3661820a0de9SPawel Jakub Dawidek * placed in kern_prot.c. 3662f08df373SRobert Watson */ 3663f08df373SRobert Watson int 3664820a0de9SPawel Jakub Dawidek prison_canseemount(struct ucred *cred, struct mount *mp) 3665f08df373SRobert Watson { 3666820a0de9SPawel Jakub Dawidek struct prison *pr; 3667820a0de9SPawel Jakub Dawidek struct statfs *sp; 3668820a0de9SPawel Jakub Dawidek size_t len; 3669f08df373SRobert Watson 3670820a0de9SPawel Jakub Dawidek pr = cred->cr_prison; 36710304c731SJamie Gritton if (pr->pr_enforce_statfs == 0) 36720304c731SJamie Gritton return (0); 3673820a0de9SPawel Jakub Dawidek if (pr->pr_root->v_mount == mp) 3674820a0de9SPawel Jakub Dawidek return (0); 36750304c731SJamie Gritton if (pr->pr_enforce_statfs == 2) 3676820a0de9SPawel Jakub Dawidek return (ENOENT); 3677820a0de9SPawel Jakub Dawidek /* 3678820a0de9SPawel Jakub Dawidek * If jail's chroot directory is set to "/" we should be able to see 3679820a0de9SPawel Jakub Dawidek * all mount-points from inside a jail. 3680820a0de9SPawel Jakub Dawidek * This is ugly check, but this is the only situation when jail's 3681820a0de9SPawel Jakub Dawidek * directory ends with '/'. 3682820a0de9SPawel Jakub Dawidek */ 3683820a0de9SPawel Jakub Dawidek if (strcmp(pr->pr_path, "/") == 0) 3684820a0de9SPawel Jakub Dawidek return (0); 3685820a0de9SPawel Jakub Dawidek len = strlen(pr->pr_path); 3686820a0de9SPawel Jakub Dawidek sp = &mp->mnt_stat; 3687820a0de9SPawel Jakub Dawidek if (strncmp(pr->pr_path, sp->f_mntonname, len) != 0) 3688820a0de9SPawel Jakub Dawidek return (ENOENT); 3689820a0de9SPawel Jakub Dawidek /* 3690820a0de9SPawel Jakub Dawidek * Be sure that we don't have situation where jail's root directory 3691820a0de9SPawel Jakub Dawidek * is "/some/path" and mount point is "/some/pathpath". 3692820a0de9SPawel Jakub Dawidek */ 3693820a0de9SPawel Jakub Dawidek if (sp->f_mntonname[len] != '\0' && sp->f_mntonname[len] != '/') 3694820a0de9SPawel Jakub Dawidek return (ENOENT); 3695f08df373SRobert Watson return (0); 3696f08df373SRobert Watson } 3697820a0de9SPawel Jakub Dawidek 3698820a0de9SPawel Jakub Dawidek void 3699820a0de9SPawel Jakub Dawidek prison_enforce_statfs(struct ucred *cred, struct mount *mp, struct statfs *sp) 3700820a0de9SPawel Jakub Dawidek { 3701820a0de9SPawel Jakub Dawidek char jpath[MAXPATHLEN]; 3702820a0de9SPawel Jakub Dawidek struct prison *pr; 3703820a0de9SPawel Jakub Dawidek size_t len; 3704820a0de9SPawel Jakub Dawidek 3705820a0de9SPawel Jakub Dawidek pr = cred->cr_prison; 37060304c731SJamie Gritton if (pr->pr_enforce_statfs == 0) 37070304c731SJamie Gritton return; 3708820a0de9SPawel Jakub Dawidek if (prison_canseemount(cred, mp) != 0) { 3709820a0de9SPawel Jakub Dawidek bzero(sp->f_mntonname, sizeof(sp->f_mntonname)); 3710820a0de9SPawel Jakub Dawidek strlcpy(sp->f_mntonname, "[restricted]", 3711820a0de9SPawel Jakub Dawidek sizeof(sp->f_mntonname)); 3712820a0de9SPawel Jakub Dawidek return; 3713820a0de9SPawel Jakub Dawidek } 3714820a0de9SPawel Jakub Dawidek if (pr->pr_root->v_mount == mp) { 3715820a0de9SPawel Jakub Dawidek /* 3716820a0de9SPawel Jakub Dawidek * Clear current buffer data, so we are sure nothing from 3717820a0de9SPawel Jakub Dawidek * the valid path left there. 3718820a0de9SPawel Jakub Dawidek */ 3719820a0de9SPawel Jakub Dawidek bzero(sp->f_mntonname, sizeof(sp->f_mntonname)); 3720820a0de9SPawel Jakub Dawidek *sp->f_mntonname = '/'; 3721820a0de9SPawel Jakub Dawidek return; 3722820a0de9SPawel Jakub Dawidek } 3723820a0de9SPawel Jakub Dawidek /* 3724820a0de9SPawel Jakub Dawidek * If jail's chroot directory is set to "/" we should be able to see 3725820a0de9SPawel Jakub Dawidek * all mount-points from inside a jail. 3726820a0de9SPawel Jakub Dawidek */ 3727820a0de9SPawel Jakub Dawidek if (strcmp(pr->pr_path, "/") == 0) 3728820a0de9SPawel Jakub Dawidek return; 3729820a0de9SPawel Jakub Dawidek len = strlen(pr->pr_path); 3730820a0de9SPawel Jakub Dawidek strlcpy(jpath, sp->f_mntonname + len, sizeof(jpath)); 3731820a0de9SPawel Jakub Dawidek /* 3732820a0de9SPawel Jakub Dawidek * Clear current buffer data, so we are sure nothing from 3733820a0de9SPawel Jakub Dawidek * the valid path left there. 3734820a0de9SPawel Jakub Dawidek */ 3735820a0de9SPawel Jakub Dawidek bzero(sp->f_mntonname, sizeof(sp->f_mntonname)); 3736820a0de9SPawel Jakub Dawidek if (*jpath == '\0') { 3737820a0de9SPawel Jakub Dawidek /* Should never happen. */ 3738820a0de9SPawel Jakub Dawidek *sp->f_mntonname = '/'; 3739820a0de9SPawel Jakub Dawidek } else { 3740820a0de9SPawel Jakub Dawidek strlcpy(sp->f_mntonname, jpath, sizeof(sp->f_mntonname)); 3741820a0de9SPawel Jakub Dawidek } 3742f08df373SRobert Watson } 3743f08df373SRobert Watson 3744800c9408SRobert Watson /* 3745800c9408SRobert Watson * Check with permission for a specific privilege is granted within jail. We 3746800c9408SRobert Watson * have a specific list of accepted privileges; the rest are denied. 3747800c9408SRobert Watson */ 3748800c9408SRobert Watson int 3749800c9408SRobert Watson prison_priv_check(struct ucred *cred, int priv) 3750800c9408SRobert Watson { 37510fe74ae6SJamie Gritton struct prison *pr; 37520fe74ae6SJamie Gritton int error; 3753800c9408SRobert Watson 37547b2ff0dcSMateusz Guzik /* 37557b2ff0dcSMateusz Guzik * Some policies have custom handlers. This routine should not be 37567b2ff0dcSMateusz Guzik * called for them. See priv_check_cred(). 37577b2ff0dcSMateusz Guzik */ 37587b2ff0dcSMateusz Guzik switch (priv) { 3759a459a6cfSMateusz Guzik case PRIV_VFS_LOOKUP: 37607b2ff0dcSMateusz Guzik case PRIV_VFS_GENERATION: 37617b2ff0dcSMateusz Guzik KASSERT(0, ("prison_priv_check instead of a custom handler " 37627b2ff0dcSMateusz Guzik "called for %d\n", priv)); 37637b2ff0dcSMateusz Guzik } 37647b2ff0dcSMateusz Guzik 3765800c9408SRobert Watson if (!jailed(cred)) 3766800c9408SRobert Watson return (0); 3767800c9408SRobert Watson 37686bb79563SJamie Gritton #ifdef VIMAGE 37696bb79563SJamie Gritton /* 37706bb79563SJamie Gritton * Privileges specific to prisons with a virtual network stack. 37716bb79563SJamie Gritton * There might be a duplicate entry here in case the privilege 37726bb79563SJamie Gritton * is only granted conditionally in the legacy jail case. 37736bb79563SJamie Gritton */ 37746bb79563SJamie Gritton switch (priv) { 37756bb79563SJamie Gritton /* 37766bb79563SJamie Gritton * NFS-specific privileges. 37776bb79563SJamie Gritton */ 37786bb79563SJamie Gritton case PRIV_NFS_DAEMON: 3779bba7a2e8SRick Macklem case PRIV_VFS_GETFH: 3780bba7a2e8SRick Macklem case PRIV_VFS_MOUNT_EXPORTED: 3781bba7a2e8SRick Macklem #ifdef VNET_NFSD 3782bba7a2e8SRick Macklem if (!prison_check_nfsd(cred)) 3783bba7a2e8SRick Macklem #else 3784bba7a2e8SRick Macklem printf("running nfsd in a prison requires a kernel " 3785bba7a2e8SRick Macklem "built with ''options VNET_NFSD''\n"); 3786bba7a2e8SRick Macklem #endif 3787bba7a2e8SRick Macklem return (EPERM); 3788bba7a2e8SRick Macklem #ifdef notyet 37896bb79563SJamie Gritton case PRIV_NFS_LOCKD: 37906bb79563SJamie Gritton #endif 37916bb79563SJamie Gritton /* 37926bb79563SJamie Gritton * Network stack privileges. 37936bb79563SJamie Gritton */ 37946bb79563SJamie Gritton case PRIV_NET_BRIDGE: 37956bb79563SJamie Gritton case PRIV_NET_GRE: 37966bb79563SJamie Gritton case PRIV_NET_BPF: 37976bb79563SJamie Gritton case PRIV_NET_RAW: /* Dup, cond. in legacy jail case. */ 37986bb79563SJamie Gritton case PRIV_NET_ROUTE: 37996bb79563SJamie Gritton case PRIV_NET_TAP: 38006bb79563SJamie Gritton case PRIV_NET_SETIFMTU: 38016bb79563SJamie Gritton case PRIV_NET_SETIFFLAGS: 38026bb79563SJamie Gritton case PRIV_NET_SETIFCAP: 3803215940b3SXin LI case PRIV_NET_SETIFDESCR: 38046bb79563SJamie Gritton case PRIV_NET_SETIFNAME : 38056bb79563SJamie Gritton case PRIV_NET_SETIFMETRIC: 38066bb79563SJamie Gritton case PRIV_NET_SETIFPHYS: 38076bb79563SJamie Gritton case PRIV_NET_SETIFMAC: 3808389474c1SKonstantin Belousov case PRIV_NET_SETLANPCP: 38096bb79563SJamie Gritton case PRIV_NET_ADDMULTI: 38106bb79563SJamie Gritton case PRIV_NET_DELMULTI: 38116bb79563SJamie Gritton case PRIV_NET_HWIOCTL: 38126bb79563SJamie Gritton case PRIV_NET_SETLLADDR: 38136bb79563SJamie Gritton case PRIV_NET_ADDIFGROUP: 38146bb79563SJamie Gritton case PRIV_NET_DELIFGROUP: 38156bb79563SJamie Gritton case PRIV_NET_IFCREATE: 38166bb79563SJamie Gritton case PRIV_NET_IFDESTROY: 38176bb79563SJamie Gritton case PRIV_NET_ADDIFADDR: 38186bb79563SJamie Gritton case PRIV_NET_DELIFADDR: 38196bb79563SJamie Gritton case PRIV_NET_LAGG: 38206bb79563SJamie Gritton case PRIV_NET_GIF: 38216bb79563SJamie Gritton case PRIV_NET_SETIFVNET: 382235fd7bc0SBjoern A. Zeeb case PRIV_NET_SETIFFIB: 3823ab91feabSKristof Provost case PRIV_NET_OVPN: 382443f8c763SZhenlei Huang case PRIV_NET_ME: 3825744bfb21SJohn Baldwin case PRIV_NET_WG: 38266bb79563SJamie Gritton 38276bb79563SJamie Gritton /* 38286bb79563SJamie Gritton * 802.11-related privileges. 38296bb79563SJamie Gritton */ 3830f7d38a13SAdrian Chadd case PRIV_NET80211_VAP_GETKEY: 3831f7d38a13SAdrian Chadd case PRIV_NET80211_VAP_MANAGE: 38326bb79563SJamie Gritton 38336bb79563SJamie Gritton #ifdef notyet 38346bb79563SJamie Gritton /* 38356bb79563SJamie Gritton * ATM privileges. 38366bb79563SJamie Gritton */ 38376bb79563SJamie Gritton case PRIV_NETATM_CFG: 38386bb79563SJamie Gritton case PRIV_NETATM_ADD: 38396bb79563SJamie Gritton case PRIV_NETATM_DEL: 38406bb79563SJamie Gritton case PRIV_NETATM_SET: 38416bb79563SJamie Gritton 38426bb79563SJamie Gritton /* 38436bb79563SJamie Gritton * Bluetooth privileges. 38446bb79563SJamie Gritton */ 38456bb79563SJamie Gritton case PRIV_NETBLUETOOTH_RAW: 38466bb79563SJamie Gritton #endif 38476bb79563SJamie Gritton 38486bb79563SJamie Gritton /* 38496bb79563SJamie Gritton * Netgraph and netgraph module privileges. 38506bb79563SJamie Gritton */ 38516bb79563SJamie Gritton case PRIV_NETGRAPH_CONTROL: 38526bb79563SJamie Gritton #ifdef notyet 38536bb79563SJamie Gritton case PRIV_NETGRAPH_TTY: 38546bb79563SJamie Gritton #endif 38556bb79563SJamie Gritton 38566bb79563SJamie Gritton /* 38576bb79563SJamie Gritton * IPv4 and IPv6 privileges. 38586bb79563SJamie Gritton */ 38596bb79563SJamie Gritton case PRIV_NETINET_IPFW: 38606bb79563SJamie Gritton case PRIV_NETINET_DIVERT: 38616bb79563SJamie Gritton case PRIV_NETINET_PF: 38626bb79563SJamie Gritton case PRIV_NETINET_DUMMYNET: 38636bb79563SJamie Gritton case PRIV_NETINET_CARP: 38646bb79563SJamie Gritton case PRIV_NETINET_MROUTE: 38656bb79563SJamie Gritton case PRIV_NETINET_RAW: 38666bb79563SJamie Gritton case PRIV_NETINET_ADDRCTRL6: 38676bb79563SJamie Gritton case PRIV_NETINET_ND6: 38686bb79563SJamie Gritton case PRIV_NETINET_SCOPE6: 38696bb79563SJamie Gritton case PRIV_NETINET_ALIFETIME6: 38706bb79563SJamie Gritton case PRIV_NETINET_IPSEC: 38716bb79563SJamie Gritton case PRIV_NETINET_BINDANY: 38726bb79563SJamie Gritton 38736bb79563SJamie Gritton #ifdef notyet 38746bb79563SJamie Gritton /* 38756bb79563SJamie Gritton * NCP privileges. 38766bb79563SJamie Gritton */ 38776bb79563SJamie Gritton case PRIV_NETNCP: 38786bb79563SJamie Gritton 38796bb79563SJamie Gritton /* 38806bb79563SJamie Gritton * SMB privileges. 38816bb79563SJamie Gritton */ 38826bb79563SJamie Gritton case PRIV_NETSMB: 38836bb79563SJamie Gritton #endif 38846bb79563SJamie Gritton 38856bb79563SJamie Gritton /* 38866bb79563SJamie Gritton * No default: or deny here. 38876bb79563SJamie Gritton * In case of no permit fall through to next switch(). 38886bb79563SJamie Gritton */ 38896bb79563SJamie Gritton if (cred->cr_prison->pr_flags & PR_VNET) 38906bb79563SJamie Gritton return (0); 38916bb79563SJamie Gritton } 38926bb79563SJamie Gritton #endif /* VIMAGE */ 38936bb79563SJamie Gritton 3894800c9408SRobert Watson switch (priv) { 3895800c9408SRobert Watson /* 3896800c9408SRobert Watson * Allow ktrace privileges for root in jail. 3897800c9408SRobert Watson */ 3898800c9408SRobert Watson case PRIV_KTRACE: 3899800c9408SRobert Watson 3900c3c1b5e6SRobert Watson #if 0 3901800c9408SRobert Watson /* 3902800c9408SRobert Watson * Allow jailed processes to configure audit identity and 3903800c9408SRobert Watson * submit audit records (login, etc). In the future we may 3904800c9408SRobert Watson * want to further refine the relationship between audit and 3905800c9408SRobert Watson * jail. 3906800c9408SRobert Watson */ 3907800c9408SRobert Watson case PRIV_AUDIT_GETAUDIT: 3908800c9408SRobert Watson case PRIV_AUDIT_SETAUDIT: 3909800c9408SRobert Watson case PRIV_AUDIT_SUBMIT: 3910c3c1b5e6SRobert Watson #endif 3911800c9408SRobert Watson 3912800c9408SRobert Watson /* 3913800c9408SRobert Watson * Allow jailed processes to manipulate process UNIX 3914800c9408SRobert Watson * credentials in any way they see fit. 3915800c9408SRobert Watson */ 3916800c9408SRobert Watson case PRIV_CRED_SETUID: 3917800c9408SRobert Watson case PRIV_CRED_SETEUID: 3918800c9408SRobert Watson case PRIV_CRED_SETGID: 3919800c9408SRobert Watson case PRIV_CRED_SETEGID: 3920800c9408SRobert Watson case PRIV_CRED_SETGROUPS: 3921800c9408SRobert Watson case PRIV_CRED_SETREUID: 3922800c9408SRobert Watson case PRIV_CRED_SETREGID: 3923800c9408SRobert Watson case PRIV_CRED_SETRESUID: 3924800c9408SRobert Watson case PRIV_CRED_SETRESGID: 3925800c9408SRobert Watson 3926800c9408SRobert Watson /* 3927800c9408SRobert Watson * Jail implements visibility constraints already, so allow 3928800c9408SRobert Watson * jailed root to override uid/gid-based constraints. 3929800c9408SRobert Watson */ 3930800c9408SRobert Watson case PRIV_SEEOTHERGIDS: 3931800c9408SRobert Watson case PRIV_SEEOTHERUIDS: 3932800c9408SRobert Watson 3933800c9408SRobert Watson /* 3934800c9408SRobert Watson * Jail implements inter-process debugging limits already, so 3935800c9408SRobert Watson * allow jailed root various debugging privileges. 3936800c9408SRobert Watson */ 3937800c9408SRobert Watson case PRIV_DEBUG_DIFFCRED: 3938800c9408SRobert Watson case PRIV_DEBUG_SUGID: 3939800c9408SRobert Watson case PRIV_DEBUG_UNPRIV: 3940800c9408SRobert Watson 3941800c9408SRobert Watson /* 3942800c9408SRobert Watson * Allow jail to set various resource limits and login 3943800c9408SRobert Watson * properties, and for now, exceed process resource limits. 3944800c9408SRobert Watson */ 3945800c9408SRobert Watson case PRIV_PROC_LIMIT: 3946800c9408SRobert Watson case PRIV_PROC_SETLOGIN: 3947800c9408SRobert Watson case PRIV_PROC_SETRLIMIT: 3948800c9408SRobert Watson 3949800c9408SRobert Watson /* 3950800c9408SRobert Watson * System V and POSIX IPC privileges are granted in jail. 3951800c9408SRobert Watson */ 3952800c9408SRobert Watson case PRIV_IPC_READ: 3953800c9408SRobert Watson case PRIV_IPC_WRITE: 3954800c9408SRobert Watson case PRIV_IPC_ADMIN: 3955800c9408SRobert Watson case PRIV_IPC_MSGSIZE: 3956800c9408SRobert Watson case PRIV_MQ_ADMIN: 3957800c9408SRobert Watson 3958800c9408SRobert Watson /* 39590304c731SJamie Gritton * Jail operations within a jail work on child jails. 39600304c731SJamie Gritton */ 39610304c731SJamie Gritton case PRIV_JAIL_ATTACH: 39620304c731SJamie Gritton case PRIV_JAIL_SET: 39630304c731SJamie Gritton case PRIV_JAIL_REMOVE: 39640304c731SJamie Gritton 39650304c731SJamie Gritton /* 3966800c9408SRobert Watson * Jail implements its own inter-process limits, so allow 3967800c9408SRobert Watson * root processes in jail to change scheduling on other 3968800c9408SRobert Watson * processes in the same jail. Likewise for signalling. 3969800c9408SRobert Watson */ 3970800c9408SRobert Watson case PRIV_SCHED_DIFFCRED: 3971413628a7SBjoern A. Zeeb case PRIV_SCHED_CPUSET: 3972800c9408SRobert Watson case PRIV_SIGNAL_DIFFCRED: 3973800c9408SRobert Watson case PRIV_SIGNAL_SUGID: 3974800c9408SRobert Watson 3975800c9408SRobert Watson /* 3976800c9408SRobert Watson * Allow jailed processes to write to sysctls marked as jail 3977800c9408SRobert Watson * writable. 3978800c9408SRobert Watson */ 3979800c9408SRobert Watson case PRIV_SYSCTL_WRITEJAIL: 3980800c9408SRobert Watson 3981800c9408SRobert Watson /* 3982800c9408SRobert Watson * Allow root in jail to manage a variety of quota 3983e82d0201SRobert Watson * properties. These should likely be conditional on a 3984e82d0201SRobert Watson * configuration option. 3985800c9408SRobert Watson */ 398695b091d2SRobert Watson case PRIV_VFS_GETQUOTA: 398795b091d2SRobert Watson case PRIV_VFS_SETQUOTA: 3988800c9408SRobert Watson 3989800c9408SRobert Watson /* 3990800c9408SRobert Watson * Since Jail relies on chroot() to implement file system 3991800c9408SRobert Watson * protections, grant many VFS privileges to root in jail. 3992800c9408SRobert Watson * Be careful to exclude mount-related and NFS-related 3993800c9408SRobert Watson * privileges. 3994800c9408SRobert Watson */ 3995800c9408SRobert Watson case PRIV_VFS_READ: 3996800c9408SRobert Watson case PRIV_VFS_WRITE: 3997800c9408SRobert Watson case PRIV_VFS_ADMIN: 3998800c9408SRobert Watson case PRIV_VFS_EXEC: 3999800c9408SRobert Watson case PRIV_VFS_BLOCKRESERVE: /* XXXRW: Slightly surprising. */ 4000800c9408SRobert Watson case PRIV_VFS_CHFLAGS_DEV: 4001800c9408SRobert Watson case PRIV_VFS_CHOWN: 4002800c9408SRobert Watson case PRIV_VFS_CHROOT: 4003bb531912SPawel Jakub Dawidek case PRIV_VFS_RETAINSUGID: 4004800c9408SRobert Watson case PRIV_VFS_FCHROOT: 4005800c9408SRobert Watson case PRIV_VFS_LINK: 4006800c9408SRobert Watson case PRIV_VFS_SETGID: 4007e41966dcSRobert Watson case PRIV_VFS_STAT: 4008800c9408SRobert Watson case PRIV_VFS_STICKYFILE: 4009bb56d716SJamie Gritton 4010bb56d716SJamie Gritton /* 4011bb56d716SJamie Gritton * As in the non-jail case, non-root users are expected to be 401270de1003SGordon Bergling * able to read kernel/physical memory (provided /dev/[k]mem 4013bb56d716SJamie Gritton * exists in the jail and they have permission to access it). 4014bb56d716SJamie Gritton */ 4015bb56d716SJamie Gritton case PRIV_KMEM_READ: 4016800c9408SRobert Watson return (0); 4017800c9408SRobert Watson 4018800c9408SRobert Watson /* 4019800c9408SRobert Watson * Depending on the global setting, allow privilege of 4020800c9408SRobert Watson * setting system flags. 4021800c9408SRobert Watson */ 4022800c9408SRobert Watson case PRIV_VFS_SYSFLAGS: 40230304c731SJamie Gritton if (cred->cr_prison->pr_allow & PR_ALLOW_CHFLAGS) 4024800c9408SRobert Watson return (0); 4025800c9408SRobert Watson else 4026800c9408SRobert Watson return (EPERM); 4027800c9408SRobert Watson 4028800c9408SRobert Watson /* 4029f3a8d2f9SPawel Jakub Dawidek * Depending on the global setting, allow privilege of 4030f3a8d2f9SPawel Jakub Dawidek * mounting/unmounting file systems. 4031f3a8d2f9SPawel Jakub Dawidek */ 4032f3a8d2f9SPawel Jakub Dawidek case PRIV_VFS_MOUNT: 4033f3a8d2f9SPawel Jakub Dawidek case PRIV_VFS_UNMOUNT: 4034f3a8d2f9SPawel Jakub Dawidek case PRIV_VFS_MOUNT_NONUSER: 403524b0502eSPawel Jakub Dawidek case PRIV_VFS_MOUNT_OWNER: 40360fe74ae6SJamie Gritton pr = cred->cr_prison; 40370fe74ae6SJamie Gritton prison_lock(pr); 40380fe74ae6SJamie Gritton if (pr->pr_allow & PR_ALLOW_MOUNT && pr->pr_enforce_statfs < 2) 40390fe74ae6SJamie Gritton error = 0; 4040f3a8d2f9SPawel Jakub Dawidek else 40410fe74ae6SJamie Gritton error = EPERM; 40420fe74ae6SJamie Gritton prison_unlock(pr); 40430fe74ae6SJamie Gritton return (error); 4044f3a8d2f9SPawel Jakub Dawidek 4045f3a8d2f9SPawel Jakub Dawidek /* 404663619b6dSKyle Evans * Jails should hold no disposition on the PRIV_VFS_READ_DIR 404763619b6dSKyle Evans * policy. priv_check_cred will not specifically allow it, and 404863619b6dSKyle Evans * we may want a MAC policy to allow it. 404963619b6dSKyle Evans */ 405063619b6dSKyle Evans case PRIV_VFS_READ_DIR: 405163619b6dSKyle Evans return (0); 405263619b6dSKyle Evans 405363619b6dSKyle Evans /* 4054ccd6ac9fSAntoine Brodin * Conditionnaly allow locking (unlocking) physical pages 4055ccd6ac9fSAntoine Brodin * in memory. 4056ccd6ac9fSAntoine Brodin */ 4057ccd6ac9fSAntoine Brodin case PRIV_VM_MLOCK: 4058ccd6ac9fSAntoine Brodin case PRIV_VM_MUNLOCK: 4059ccd6ac9fSAntoine Brodin if (cred->cr_prison->pr_allow & PR_ALLOW_MLOCK) 4060ccd6ac9fSAntoine Brodin return (0); 4061ccd6ac9fSAntoine Brodin else 4062ccd6ac9fSAntoine Brodin return (EPERM); 4063ccd6ac9fSAntoine Brodin 4064ccd6ac9fSAntoine Brodin /* 4065e28f9b7dSAllan Jude * Conditionally allow jailed root to bind reserved ports. 4066800c9408SRobert Watson */ 4067800c9408SRobert Watson case PRIV_NETINET_RESERVEDPORT: 4068e28f9b7dSAllan Jude if (cred->cr_prison->pr_allow & PR_ALLOW_RESERVED_PORTS) 4069e28f9b7dSAllan Jude return (0); 4070e28f9b7dSAllan Jude else 4071e28f9b7dSAllan Jude return (EPERM); 4072e28f9b7dSAllan Jude 4073e28f9b7dSAllan Jude /* 4074e28f9b7dSAllan Jude * Allow jailed root to reuse in-use ports. 4075e28f9b7dSAllan Jude */ 40764b084056SRobert Watson case PRIV_NETINET_REUSEPORT: 4077800c9408SRobert Watson return (0); 4078800c9408SRobert Watson 4079800c9408SRobert Watson /* 4080e3043798SPedro F. Giffuni * Allow jailed root to set certain IPv4/6 (option) headers. 408179ba3952SBjoern A. Zeeb */ 408279ba3952SBjoern A. Zeeb case PRIV_NETINET_SETHDROPTS: 408379ba3952SBjoern A. Zeeb return (0); 408479ba3952SBjoern A. Zeeb 408579ba3952SBjoern A. Zeeb /* 4086800c9408SRobert Watson * Conditionally allow creating raw sockets in jail. 4087800c9408SRobert Watson */ 4088800c9408SRobert Watson case PRIV_NETINET_RAW: 40890304c731SJamie Gritton if (cred->cr_prison->pr_allow & PR_ALLOW_RAW_SOCKETS) 4090800c9408SRobert Watson return (0); 4091800c9408SRobert Watson else 4092800c9408SRobert Watson return (EPERM); 4093800c9408SRobert Watson 4094800c9408SRobert Watson /* 4095800c9408SRobert Watson * Since jail implements its own visibility limits on netstat 4096800c9408SRobert Watson * sysctls, allow getcred. This allows identd to work in 4097800c9408SRobert Watson * jail. 4098800c9408SRobert Watson */ 4099800c9408SRobert Watson case PRIV_NETINET_GETCRED: 4100800c9408SRobert Watson return (0); 4101800c9408SRobert Watson 41022bfc50bcSEdward Tomasz Napierala /* 41032bfc50bcSEdward Tomasz Napierala * Allow jailed root to set loginclass. 41042bfc50bcSEdward Tomasz Napierala */ 41052bfc50bcSEdward Tomasz Napierala case PRIV_PROC_SETLOGINCLASS: 41062bfc50bcSEdward Tomasz Napierala return (0); 41072bfc50bcSEdward Tomasz Napierala 4108b19d66fdSJamie Gritton /* 41094520f617SJamie Gritton * Do not allow a process inside a jail to read the kernel 4110b19d66fdSJamie Gritton * message buffer unless explicitly permitted. 4111b19d66fdSJamie Gritton */ 4112b19d66fdSJamie Gritton case PRIV_MSGBUF: 4113b19d66fdSJamie Gritton if (cred->cr_prison->pr_allow & PR_ALLOW_READ_MSGBUF) 4114b19d66fdSJamie Gritton return (0); 4115b19d66fdSJamie Gritton return (EPERM); 4116b19d66fdSJamie Gritton 4117800c9408SRobert Watson default: 4118800c9408SRobert Watson /* 4119800c9408SRobert Watson * In all remaining cases, deny the privilege request. This 4120800c9408SRobert Watson * includes almost all network privileges, many system 4121800c9408SRobert Watson * configuration privileges. 4122800c9408SRobert Watson */ 4123800c9408SRobert Watson return (EPERM); 4124800c9408SRobert Watson } 4125800c9408SRobert Watson } 4126800c9408SRobert Watson 41270304c731SJamie Gritton /* 41280304c731SJamie Gritton * Return the part of pr2's name that is relative to pr1, or the whole name 41290304c731SJamie Gritton * if it does not directly follow. 41300304c731SJamie Gritton */ 41310304c731SJamie Gritton 41320304c731SJamie Gritton char * 41330304c731SJamie Gritton prison_name(struct prison *pr1, struct prison *pr2) 41340304c731SJamie Gritton { 41350304c731SJamie Gritton char *name; 41360304c731SJamie Gritton 41370304c731SJamie Gritton /* Jails see themselves as "0" (if they see themselves at all). */ 41380304c731SJamie Gritton if (pr1 == pr2) 41390304c731SJamie Gritton return "0"; 41400304c731SJamie Gritton name = pr2->pr_name; 41410304c731SJamie Gritton if (prison_ischild(pr1, pr2)) { 41420304c731SJamie Gritton /* 41430304c731SJamie Gritton * pr1 isn't locked (and allprison_lock may not be either) 41440304c731SJamie Gritton * so its length can't be counted on. But the number of dots 41450304c731SJamie Gritton * can be counted on - and counted. 41460304c731SJamie Gritton */ 41470304c731SJamie Gritton for (; pr1 != &prison0; pr1 = pr1->pr_parent) 41480304c731SJamie Gritton name = strchr(name, '.') + 1; 41490304c731SJamie Gritton } 41500304c731SJamie Gritton return (name); 41510304c731SJamie Gritton } 41520304c731SJamie Gritton 41530304c731SJamie Gritton /* 41540304c731SJamie Gritton * Return the part of pr2's path that is relative to pr1, or the whole path 41550304c731SJamie Gritton * if it does not directly follow. 41560304c731SJamie Gritton */ 41570304c731SJamie Gritton static char * 41580304c731SJamie Gritton prison_path(struct prison *pr1, struct prison *pr2) 41590304c731SJamie Gritton { 41600304c731SJamie Gritton char *path1, *path2; 41610304c731SJamie Gritton int len1; 41620304c731SJamie Gritton 41630304c731SJamie Gritton path1 = pr1->pr_path; 41640304c731SJamie Gritton path2 = pr2->pr_path; 41650304c731SJamie Gritton if (!strcmp(path1, "/")) 41660304c731SJamie Gritton return (path2); 41670304c731SJamie Gritton len1 = strlen(path1); 41680304c731SJamie Gritton if (strncmp(path1, path2, len1)) 41690304c731SJamie Gritton return (path2); 41700304c731SJamie Gritton if (path2[len1] == '\0') 41710304c731SJamie Gritton return "/"; 41720304c731SJamie Gritton if (path2[len1] == '/') 41730304c731SJamie Gritton return (path2 + len1); 41740304c731SJamie Gritton return (path2); 41750304c731SJamie Gritton } 41760304c731SJamie Gritton 41770304c731SJamie Gritton /* 41780304c731SJamie Gritton * Jail-related sysctls. 41790304c731SJamie Gritton */ 41807029da5cSPawel Biernacki static SYSCTL_NODE(_security, OID_AUTO, jail, CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 41810304c731SJamie Gritton "Jails"); 41820304c731SJamie Gritton 4183eb8dcdeaSGleb Smirnoff #if defined(INET) || defined(INET6) 4184eb8dcdeaSGleb Smirnoff /* 4185eb8dcdeaSGleb Smirnoff * Copy address array to memory that would be then SYSCTL_OUT-ed. 4186eb8dcdeaSGleb Smirnoff * sysctl_jail_list() helper. 4187eb8dcdeaSGleb Smirnoff */ 4188eb8dcdeaSGleb Smirnoff static void 4189eb8dcdeaSGleb Smirnoff prison_ip_copyout(struct prison *pr, const pr_family_t af, void **out, int *len) 4190eb8dcdeaSGleb Smirnoff { 4191eb8dcdeaSGleb Smirnoff const size_t size = pr_families[af].size; 4192eb8dcdeaSGleb Smirnoff 4193eb8dcdeaSGleb Smirnoff again: 4194eb8dcdeaSGleb Smirnoff mtx_assert(&pr->pr_mtx, MA_OWNED); 4195eb8dcdeaSGleb Smirnoff if (pr->pr_addrs[af] != NULL) { 4196eb8dcdeaSGleb Smirnoff if (*len < pr->pr_addrs[af]->ips) { 4197eb8dcdeaSGleb Smirnoff *len = pr->pr_addrs[af]->ips; 4198eb8dcdeaSGleb Smirnoff mtx_unlock(&pr->pr_mtx); 4199eb8dcdeaSGleb Smirnoff *out = realloc(*out, *len * size, M_TEMP, M_WAITOK); 4200eb8dcdeaSGleb Smirnoff mtx_lock(&pr->pr_mtx); 4201eb8dcdeaSGleb Smirnoff goto again; 4202eb8dcdeaSGleb Smirnoff } 4203eb8dcdeaSGleb Smirnoff bcopy(pr->pr_addrs[af] + 1, *out, pr->pr_addrs[af]->ips * size); 4204eb8dcdeaSGleb Smirnoff } 4205eb8dcdeaSGleb Smirnoff } 4206eb8dcdeaSGleb Smirnoff #endif 4207eb8dcdeaSGleb Smirnoff 4208fd7a8150SMike Barcroft static int 4209fd7a8150SMike Barcroft sysctl_jail_list(SYSCTL_HANDLER_ARGS) 4210fd7a8150SMike Barcroft { 4211b38ff370SJamie Gritton struct xprison *xp; 42120304c731SJamie Gritton struct prison *pr, *cpr; 4213b38ff370SJamie Gritton #ifdef INET 4214b38ff370SJamie Gritton struct in_addr *ip4 = NULL; 4215b38ff370SJamie Gritton int ip4s = 0; 4216b38ff370SJamie Gritton #endif 4217b38ff370SJamie Gritton #ifdef INET6 42183beefaedSColin Percival struct in6_addr *ip6 = NULL; 4219b38ff370SJamie Gritton int ip6s = 0; 4220b38ff370SJamie Gritton #endif 42210304c731SJamie Gritton int descend, error; 4222fd7a8150SMike Barcroft 4223b38ff370SJamie Gritton xp = malloc(sizeof(*xp), M_TEMP, M_WAITOK); 42240304c731SJamie Gritton pr = req->td->td_ucred->cr_prison; 4225b38ff370SJamie Gritton error = 0; 4226dc68a633SPawel Jakub Dawidek sx_slock(&allprison_lock); 42270304c731SJamie Gritton FOREACH_PRISON_DESCENDANT(pr, cpr, descend) { 42280304c731SJamie Gritton mtx_lock(&cpr->pr_mtx); 4229413628a7SBjoern A. Zeeb #ifdef INET 4230eb8dcdeaSGleb Smirnoff prison_ip_copyout(cpr, PR_INET, (void **)&ip4, &ip4s); 4231413628a7SBjoern A. Zeeb #endif 4232413628a7SBjoern A. Zeeb #ifdef INET6 4233eb8dcdeaSGleb Smirnoff prison_ip_copyout(cpr, PR_INET6, (void **)&ip6, &ip6s); 4234b38ff370SJamie Gritton #endif 4235b38ff370SJamie Gritton bzero(xp, sizeof(*xp)); 4236fd7a8150SMike Barcroft xp->pr_version = XPRISON_VERSION; 42370304c731SJamie Gritton xp->pr_id = cpr->pr_id; 42381158508aSJamie Gritton xp->pr_state = cpr->pr_state; 42390304c731SJamie Gritton strlcpy(xp->pr_path, prison_path(pr, cpr), sizeof(xp->pr_path)); 4240c1f19219SJamie Gritton strlcpy(xp->pr_host, cpr->pr_hostname, sizeof(xp->pr_host)); 42410304c731SJamie Gritton strlcpy(xp->pr_name, prison_name(pr, cpr), sizeof(xp->pr_name)); 4242413628a7SBjoern A. Zeeb #ifdef INET 4243eb8dcdeaSGleb Smirnoff xp->pr_ip4s = ip4s; 4244413628a7SBjoern A. Zeeb #endif 4245413628a7SBjoern A. Zeeb #ifdef INET6 4246eb8dcdeaSGleb Smirnoff xp->pr_ip6s = ip6s; 4247413628a7SBjoern A. Zeeb #endif 42480304c731SJamie Gritton mtx_unlock(&cpr->pr_mtx); 4249b38ff370SJamie Gritton error = SYSCTL_OUT(req, xp, sizeof(*xp)); 4250b38ff370SJamie Gritton if (error) 4251b38ff370SJamie Gritton break; 4252413628a7SBjoern A. Zeeb #ifdef INET 4253b38ff370SJamie Gritton if (xp->pr_ip4s > 0) { 4254b38ff370SJamie Gritton error = SYSCTL_OUT(req, ip4, 4255b38ff370SJamie Gritton xp->pr_ip4s * sizeof(struct in_addr)); 4256b38ff370SJamie Gritton if (error) 4257b38ff370SJamie Gritton break; 4258413628a7SBjoern A. Zeeb } 4259413628a7SBjoern A. Zeeb #endif 4260413628a7SBjoern A. Zeeb #ifdef INET6 4261b38ff370SJamie Gritton if (xp->pr_ip6s > 0) { 4262b38ff370SJamie Gritton error = SYSCTL_OUT(req, ip6, 4263b38ff370SJamie Gritton xp->pr_ip6s * sizeof(struct in6_addr)); 4264b38ff370SJamie Gritton if (error) 4265b38ff370SJamie Gritton break; 4266413628a7SBjoern A. Zeeb } 4267413628a7SBjoern A. Zeeb #endif 4268fd7a8150SMike Barcroft } 4269dc68a633SPawel Jakub Dawidek sx_sunlock(&allprison_lock); 4270b38ff370SJamie Gritton free(xp, M_TEMP); 4271b38ff370SJamie Gritton #ifdef INET 4272b38ff370SJamie Gritton free(ip4, M_TEMP); 4273b38ff370SJamie Gritton #endif 4274b38ff370SJamie Gritton #ifdef INET6 4275b38ff370SJamie Gritton free(ip6, M_TEMP); 4276b38ff370SJamie Gritton #endif 4277fd7a8150SMike Barcroft return (error); 4278fd7a8150SMike Barcroft } 4279fd7a8150SMike Barcroft 4280f3b86a5fSEd Schouten SYSCTL_OID(_security_jail, OID_AUTO, list, 4281f3b86a5fSEd Schouten CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0, 4282f3b86a5fSEd Schouten sysctl_jail_list, "S", "List of active jails"); 4283461167c2SPawel Jakub Dawidek 4284461167c2SPawel Jakub Dawidek static int 4285461167c2SPawel Jakub Dawidek sysctl_jail_jailed(SYSCTL_HANDLER_ARGS) 4286461167c2SPawel Jakub Dawidek { 4287461167c2SPawel Jakub Dawidek int error, injail; 4288461167c2SPawel Jakub Dawidek 4289461167c2SPawel Jakub Dawidek injail = jailed(req->td->td_ucred); 4290461167c2SPawel Jakub Dawidek error = SYSCTL_OUT(req, &injail, sizeof(injail)); 4291461167c2SPawel Jakub Dawidek 4292461167c2SPawel Jakub Dawidek return (error); 4293461167c2SPawel Jakub Dawidek } 42940304c731SJamie Gritton 4295f3b86a5fSEd Schouten SYSCTL_PROC(_security_jail, OID_AUTO, jailed, 4296f3b86a5fSEd Schouten CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0, 4297f3b86a5fSEd Schouten sysctl_jail_jailed, "I", "Process in jail?"); 4298413628a7SBjoern A. Zeeb 4299761d2bb5SJamie Gritton static int 4300761d2bb5SJamie Gritton sysctl_jail_vnet(SYSCTL_HANDLER_ARGS) 4301761d2bb5SJamie Gritton { 4302761d2bb5SJamie Gritton int error, havevnet; 4303761d2bb5SJamie Gritton #ifdef VIMAGE 4304761d2bb5SJamie Gritton struct ucred *cred = req->td->td_ucred; 4305761d2bb5SJamie Gritton 4306761d2bb5SJamie Gritton havevnet = jailed(cred) && prison_owns_vnet(cred); 4307761d2bb5SJamie Gritton #else 4308761d2bb5SJamie Gritton havevnet = 0; 4309761d2bb5SJamie Gritton #endif 4310761d2bb5SJamie Gritton error = SYSCTL_OUT(req, &havevnet, sizeof(havevnet)); 4311761d2bb5SJamie Gritton 4312761d2bb5SJamie Gritton return (error); 4313761d2bb5SJamie Gritton } 4314761d2bb5SJamie Gritton 4315761d2bb5SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, vnet, 4316761d2bb5SJamie Gritton CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0, 4317bb8f1623SBjoern A. Zeeb sysctl_jail_vnet, "I", "Jail owns vnet?"); 4318761d2bb5SJamie Gritton 43190304c731SJamie Gritton #if defined(INET) || defined(INET6) 4320e92e0574SJamie Gritton SYSCTL_UINT(_security_jail, OID_AUTO, jail_max_af_ips, CTLFLAG_RW, 43210304c731SJamie Gritton &jail_max_af_ips, 0, 4322c542c43eSJamie Gritton "Number of IP addresses a jail may have at most per address family (deprecated)"); 43230304c731SJamie Gritton #endif 43240304c731SJamie Gritton 43250304c731SJamie Gritton /* 4326c542c43eSJamie Gritton * Default parameters for jail(2) compatibility. For historical reasons, 4327c542c43eSJamie Gritton * the sysctl names have varying similarity to the parameter names. Prisons 4328c542c43eSJamie Gritton * just see their own parameters, and can't change them. 43290304c731SJamie Gritton */ 43300304c731SJamie Gritton static int 43310304c731SJamie Gritton sysctl_jail_default_allow(SYSCTL_HANDLER_ARGS) 43320304c731SJamie Gritton { 43330fe74ae6SJamie Gritton int error, i; 43340304c731SJamie Gritton 43350304c731SJamie Gritton /* Get the current flag value, and convert it to a boolean. */ 43360fe74ae6SJamie Gritton if (req->td->td_ucred->cr_prison == &prison0) { 43370fe74ae6SJamie Gritton mtx_lock(&prison0.pr_mtx); 43380fe74ae6SJamie Gritton i = (jail_default_allow & arg2) != 0; 43390fe74ae6SJamie Gritton mtx_unlock(&prison0.pr_mtx); 43400fe74ae6SJamie Gritton } else 43410fe74ae6SJamie Gritton i = prison_allow(req->td->td_ucred, arg2); 43420fe74ae6SJamie Gritton 43430304c731SJamie Gritton if (arg1 != NULL) 43440304c731SJamie Gritton i = !i; 43450304c731SJamie Gritton error = sysctl_handle_int(oidp, &i, 0, req); 4346c542c43eSJamie Gritton if (error || !req->newptr) 43470304c731SJamie Gritton return (error); 43480304c731SJamie Gritton i = i ? arg2 : 0; 43490304c731SJamie Gritton if (arg1 != NULL) 43500304c731SJamie Gritton i ^= arg2; 43510304c731SJamie Gritton /* 43520304c731SJamie Gritton * The sysctls don't have CTLFLAGS_PRISON, so assume prison0 43530304c731SJamie Gritton * for writing. 43540304c731SJamie Gritton */ 43550304c731SJamie Gritton mtx_lock(&prison0.pr_mtx); 43560304c731SJamie Gritton jail_default_allow = (jail_default_allow & ~arg2) | i; 43570304c731SJamie Gritton mtx_unlock(&prison0.pr_mtx); 43580304c731SJamie Gritton return (0); 43590304c731SJamie Gritton } 43600304c731SJamie Gritton 43610304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, set_hostname_allowed, 4362c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 43630304c731SJamie Gritton NULL, PR_ALLOW_SET_HOSTNAME, sysctl_jail_default_allow, "I", 4364c542c43eSJamie Gritton "Processes in jail can set their hostnames (deprecated)"); 43650304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, socket_unixiproute_only, 4366c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 43670304c731SJamie Gritton (void *)1, PR_ALLOW_SOCKET_AF, sysctl_jail_default_allow, "I", 4368c542c43eSJamie Gritton "Processes in jail are limited to creating UNIX/IP/route sockets only (deprecated)"); 43690304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, sysvipc_allowed, 4370c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 43710304c731SJamie Gritton NULL, PR_ALLOW_SYSVIPC, sysctl_jail_default_allow, "I", 4372c542c43eSJamie Gritton "Processes in jail can use System V IPC primitives (deprecated)"); 43730304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, allow_raw_sockets, 4374c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 43750304c731SJamie Gritton NULL, PR_ALLOW_RAW_SOCKETS, sysctl_jail_default_allow, "I", 4376c542c43eSJamie Gritton "Prison root can create raw sockets (deprecated)"); 43770304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, chflags_allowed, 4378c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 43790304c731SJamie Gritton NULL, PR_ALLOW_CHFLAGS, sysctl_jail_default_allow, "I", 4380c542c43eSJamie Gritton "Processes in jail can alter system file flags (deprecated)"); 43810304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, mount_allowed, 4382c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 43830304c731SJamie Gritton NULL, PR_ALLOW_MOUNT, sysctl_jail_default_allow, "I", 4384c542c43eSJamie Gritton "Processes in jail can mount/unmount jail-friendly file systems (deprecated)"); 43850304c731SJamie Gritton 43860304c731SJamie Gritton static int 43870304c731SJamie Gritton sysctl_jail_default_level(SYSCTL_HANDLER_ARGS) 43880304c731SJamie Gritton { 43890304c731SJamie Gritton struct prison *pr; 43900304c731SJamie Gritton int level, error; 43910304c731SJamie Gritton 43920304c731SJamie Gritton pr = req->td->td_ucred->cr_prison; 43930304c731SJamie Gritton level = (pr == &prison0) ? *(int *)arg1 : *(int *)((char *)pr + arg2); 43940304c731SJamie Gritton error = sysctl_handle_int(oidp, &level, 0, req); 4395c542c43eSJamie Gritton if (error || !req->newptr) 43960304c731SJamie Gritton return (error); 43970304c731SJamie Gritton *(int *)arg1 = level; 43980304c731SJamie Gritton return (0); 43990304c731SJamie Gritton } 44000304c731SJamie Gritton 44010304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, enforce_statfs, 4402c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 4403c542c43eSJamie Gritton &jail_default_enforce_statfs, offsetof(struct prison, pr_enforce_statfs), 44040304c731SJamie Gritton sysctl_jail_default_level, "I", 4405c542c43eSJamie Gritton "Processes in jail cannot see all mounted file systems (deprecated)"); 4406c542c43eSJamie Gritton 44070cc207a6SMartin Matuska SYSCTL_PROC(_security_jail, OID_AUTO, devfs_ruleset, 4408c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, 4409c542c43eSJamie Gritton &jail_default_devfs_rsnum, offsetof(struct prison, pr_devfs_rsnum), 44100cc207a6SMartin Matuska sysctl_jail_default_level, "I", 4411c542c43eSJamie Gritton "Ruleset for the devfs filesystem in jail (deprecated)"); 44120cc207a6SMartin Matuska 44130304c731SJamie Gritton /* 44140304c731SJamie Gritton * Nodes to describe jail parameters. Maximum length of string parameters 44150304c731SJamie Gritton * is returned in the string itself, and the other parameters exist merely 44160304c731SJamie Gritton * to make themselves and their types known. 44170304c731SJamie Gritton */ 44187029da5cSPawel Biernacki SYSCTL_NODE(_security_jail, OID_AUTO, param, CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 44190304c731SJamie Gritton "Jail parameters"); 44200304c731SJamie Gritton 44210304c731SJamie Gritton int 44220304c731SJamie Gritton sysctl_jail_param(SYSCTL_HANDLER_ARGS) 44230304c731SJamie Gritton { 44240304c731SJamie Gritton int i; 44250304c731SJamie Gritton long l; 44260304c731SJamie Gritton size_t s; 44270304c731SJamie Gritton char numbuf[12]; 44280304c731SJamie Gritton 44290304c731SJamie Gritton switch (oidp->oid_kind & CTLTYPE) 44300304c731SJamie Gritton { 44310304c731SJamie Gritton case CTLTYPE_LONG: 44320304c731SJamie Gritton case CTLTYPE_ULONG: 44330304c731SJamie Gritton l = 0; 44340304c731SJamie Gritton #ifdef SCTL_MASK32 44350304c731SJamie Gritton if (!(req->flags & SCTL_MASK32)) 44360304c731SJamie Gritton #endif 44370304c731SJamie Gritton return (SYSCTL_OUT(req, &l, sizeof(l))); 44380304c731SJamie Gritton case CTLTYPE_INT: 44390304c731SJamie Gritton case CTLTYPE_UINT: 44400304c731SJamie Gritton i = 0; 44410304c731SJamie Gritton return (SYSCTL_OUT(req, &i, sizeof(i))); 44420304c731SJamie Gritton case CTLTYPE_STRING: 4443e4cd31ddSJeff Roberson snprintf(numbuf, sizeof(numbuf), "%jd", (intmax_t)arg2); 44440304c731SJamie Gritton return 44450304c731SJamie Gritton (sysctl_handle_string(oidp, numbuf, sizeof(numbuf), req)); 44460304c731SJamie Gritton case CTLTYPE_STRUCT: 44470304c731SJamie Gritton s = (size_t)arg2; 44480304c731SJamie Gritton return (SYSCTL_OUT(req, &s, sizeof(s))); 44490304c731SJamie Gritton } 44500304c731SJamie Gritton return (0); 44510304c731SJamie Gritton } 44520304c731SJamie Gritton 4453b96bd95bSIan Lepore /* 4454b96bd95bSIan Lepore * CTLFLAG_RDTUN in the following indicates jail parameters that can be set at 4455b96bd95bSIan Lepore * jail creation time but cannot be changed in an existing jail. 4456b96bd95bSIan Lepore */ 44570304c731SJamie Gritton SYSCTL_JAIL_PARAM(, jid, CTLTYPE_INT | CTLFLAG_RDTUN, "I", "Jail ID"); 44580304c731SJamie Gritton SYSCTL_JAIL_PARAM(, parent, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail parent ID"); 44590304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(, name, CTLFLAG_RW, MAXHOSTNAMELEN, "Jail name"); 44600304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(, path, CTLFLAG_RDTUN, MAXPATHLEN, "Jail root path"); 44610304c731SJamie Gritton SYSCTL_JAIL_PARAM(, securelevel, CTLTYPE_INT | CTLFLAG_RW, 44620304c731SJamie Gritton "I", "Jail secure level"); 4463b96bd95bSIan Lepore SYSCTL_JAIL_PARAM(, osreldate, CTLTYPE_INT | CTLFLAG_RDTUN, "I", 4464b96bd95bSIan Lepore "Jail value for kern.osreldate and uname -K"); 4465b96bd95bSIan Lepore SYSCTL_JAIL_PARAM_STRING(, osrelease, CTLFLAG_RDTUN, OSRELEASELEN, 4466b96bd95bSIan Lepore "Jail value for kern.osrelease and uname -r"); 44670304c731SJamie Gritton SYSCTL_JAIL_PARAM(, enforce_statfs, CTLTYPE_INT | CTLFLAG_RW, 44680304c731SJamie Gritton "I", "Jail cannot see all mounted file systems"); 44690cc207a6SMartin Matuska SYSCTL_JAIL_PARAM(, devfs_ruleset, CTLTYPE_INT | CTLFLAG_RW, 44700cc207a6SMartin Matuska "I", "Ruleset for in-jail devfs mounts"); 44710304c731SJamie Gritton SYSCTL_JAIL_PARAM(, persist, CTLTYPE_INT | CTLFLAG_RW, 44720304c731SJamie Gritton "B", "Jail persistence"); 4473679e1390SJamie Gritton #ifdef VIMAGE 4474679e1390SJamie Gritton SYSCTL_JAIL_PARAM(, vnet, CTLTYPE_INT | CTLFLAG_RDTUN, 44757cbf7213SJamie Gritton "E,jailsys", "Virtual network stack"); 4476679e1390SJamie Gritton #endif 44770304c731SJamie Gritton SYSCTL_JAIL_PARAM(, dying, CTLTYPE_INT | CTLFLAG_RD, 44780304c731SJamie Gritton "B", "Jail is in the process of shutting down"); 44790304c731SJamie Gritton 4480b97457e2SJamie Gritton SYSCTL_JAIL_PARAM_NODE(children, "Number of child jails"); 4481b97457e2SJamie Gritton SYSCTL_JAIL_PARAM(_children, cur, CTLTYPE_INT | CTLFLAG_RD, 4482b97457e2SJamie Gritton "I", "Current number of child jails"); 4483b97457e2SJamie Gritton SYSCTL_JAIL_PARAM(_children, max, CTLTYPE_INT | CTLFLAG_RW, 4484b97457e2SJamie Gritton "I", "Maximum number of child jails"); 4485b97457e2SJamie Gritton 44867cbf7213SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(host, CTLFLAG_RW, "Jail host info"); 44870304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, hostname, CTLFLAG_RW, MAXHOSTNAMELEN, 44880304c731SJamie Gritton "Jail hostname"); 448976ca6f88SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, domainname, CTLFLAG_RW, MAXHOSTNAMELEN, 449076ca6f88SJamie Gritton "Jail NIS domainname"); 449176ca6f88SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, hostuuid, CTLFLAG_RW, HOSTUUIDLEN, 449276ca6f88SJamie Gritton "Jail host UUID"); 449376ca6f88SJamie Gritton SYSCTL_JAIL_PARAM(_host, hostid, CTLTYPE_ULONG | CTLFLAG_RW, 449476ca6f88SJamie Gritton "LU", "Jail host ID"); 44950304c731SJamie Gritton 44960304c731SJamie Gritton SYSCTL_JAIL_PARAM_NODE(cpuset, "Jail cpuset"); 44970304c731SJamie Gritton SYSCTL_JAIL_PARAM(_cpuset, id, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail cpuset ID"); 44980304c731SJamie Gritton 44990304c731SJamie Gritton #ifdef INET 45002b0d6f81SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(ip4, CTLFLAG_RDTUN, 45012b0d6f81SJamie Gritton "Jail IPv4 address virtualization"); 45020304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRUCT(_ip4, addr, CTLFLAG_RW, sizeof(struct in_addr), 45030304c731SJamie Gritton "S,in_addr,a", "Jail IPv4 addresses"); 4504592bcae8SBjoern A. Zeeb SYSCTL_JAIL_PARAM(_ip4, saddrsel, CTLTYPE_INT | CTLFLAG_RW, 4505592bcae8SBjoern A. Zeeb "B", "Do (not) use IPv4 source address selection rather than the " 4506592bcae8SBjoern A. Zeeb "primary jail IPv4 address."); 45070304c731SJamie Gritton #endif 45080304c731SJamie Gritton #ifdef INET6 45092b0d6f81SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(ip6, CTLFLAG_RDTUN, 45102b0d6f81SJamie Gritton "Jail IPv6 address virtualization"); 45110304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRUCT(_ip6, addr, CTLFLAG_RW, sizeof(struct in6_addr), 45120304c731SJamie Gritton "S,in6_addr,a", "Jail IPv6 addresses"); 4513592bcae8SBjoern A. Zeeb SYSCTL_JAIL_PARAM(_ip6, saddrsel, CTLTYPE_INT | CTLFLAG_RW, 4514592bcae8SBjoern A. Zeeb "B", "Do (not) use IPv6 source address selection rather than the " 4515592bcae8SBjoern A. Zeeb "primary jail IPv6 address."); 45160304c731SJamie Gritton #endif 45170304c731SJamie Gritton 45180304c731SJamie Gritton SYSCTL_JAIL_PARAM_NODE(allow, "Jail permission flags"); 45190304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, set_hostname, CTLTYPE_INT | CTLFLAG_RW, 45200304c731SJamie Gritton "B", "Jail may set hostname"); 45210304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, sysvipc, CTLTYPE_INT | CTLFLAG_RW, 45220304c731SJamie Gritton "B", "Jail may use SYSV IPC"); 45230304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, raw_sockets, CTLTYPE_INT | CTLFLAG_RW, 45240304c731SJamie Gritton "B", "Jail may create raw sockets"); 45250304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, chflags, CTLTYPE_INT | CTLFLAG_RW, 45260304c731SJamie Gritton "B", "Jail may alter system file flags"); 45270304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, quotas, CTLTYPE_INT | CTLFLAG_RW, 45280304c731SJamie Gritton "B", "Jail may set file quotas"); 45290304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, socket_af, CTLTYPE_INT | CTLFLAG_RW, 45300304c731SJamie Gritton "B", "Jail may create sockets other than just UNIX/IPv4/IPv6/route"); 4531ccd6ac9fSAntoine Brodin SYSCTL_JAIL_PARAM(_allow, mlock, CTLTYPE_INT | CTLFLAG_RW, 4532ccd6ac9fSAntoine Brodin "B", "Jail may lock (unlock) physical pages in memory"); 4533e28f9b7dSAllan Jude SYSCTL_JAIL_PARAM(_allow, reserved_ports, CTLTYPE_INT | CTLFLAG_RW, 4534e28f9b7dSAllan Jude "B", "Jail may bind sockets to reserved ports"); 4535b19d66fdSJamie Gritton SYSCTL_JAIL_PARAM(_allow, read_msgbuf, CTLTYPE_INT | CTLFLAG_RW, 4536b19d66fdSJamie Gritton "B", "Jail may read the kernel message buffer"); 4537b3079544SJamie Gritton SYSCTL_JAIL_PARAM(_allow, unprivileged_proc_debug, CTLTYPE_INT | CTLFLAG_RW, 4538b3079544SJamie Gritton "B", "Unprivileged processes may use process debugging facilities"); 453905e1e482SMariusz Zaborski SYSCTL_JAIL_PARAM(_allow, suser, CTLTYPE_INT | CTLFLAG_RW, 454005e1e482SMariusz Zaborski "B", "Processes in jail with uid 0 have privilege"); 4541bba7a2e8SRick Macklem #if defined(VNET_NFSD) && defined(VIMAGE) && defined(NFSD) 4542bba7a2e8SRick Macklem SYSCTL_JAIL_PARAM(_allow, nfsd, CTLTYPE_INT | CTLFLAG_RW, 4543bba7a2e8SRick Macklem "B", "Mountd/nfsd may run in the jail"); 4544bba7a2e8SRick Macklem #endif 45450304c731SJamie Gritton 4546bf3db8aaSMartin Matuska SYSCTL_JAIL_PARAM_SUBNODE(allow, mount, "Jail mount/unmount permission flags"); 4547bf3db8aaSMartin Matuska SYSCTL_JAIL_PARAM(_allow_mount, , CTLTYPE_INT | CTLFLAG_RW, 4548bf3db8aaSMartin Matuska "B", "Jail may mount/unmount jail-friendly file systems in general"); 45490e5c6bd4SJamie Gritton 45500e5c6bd4SJamie Gritton /* 45510a172404SJamie Gritton * Add a dynamic parameter allow.<name>, or allow.<prefix>.<name>. Return 45520a172404SJamie Gritton * its associated bit in the pr_allow bitmask, or zero if the parameter was 45530a172404SJamie Gritton * not created. 45540e5c6bd4SJamie Gritton */ 45550a172404SJamie Gritton unsigned 45560a172404SJamie Gritton prison_add_allow(const char *prefix, const char *name, const char *prefix_descr, 45570a172404SJamie Gritton const char *descr) 45580e5c6bd4SJamie Gritton { 45590e5c6bd4SJamie Gritton struct bool_flags *bf; 45600a172404SJamie Gritton struct sysctl_oid *parent; 45610a172404SJamie Gritton char *allow_name, *allow_noname, *allowed; 4562c542c43eSJamie Gritton #ifndef NO_SYSCTL_DESCR 4563c542c43eSJamie Gritton char *descr_deprecated; 4564c542c43eSJamie Gritton #endif 45655d58f959SJamie Gritton u_int allow_flag; 45660e5c6bd4SJamie Gritton 45670a172404SJamie Gritton if (prefix 45680a172404SJamie Gritton ? asprintf(&allow_name, M_PRISON, "allow.%s.%s", prefix, name) 45690a172404SJamie Gritton < 0 || 45700a172404SJamie Gritton asprintf(&allow_noname, M_PRISON, "allow.%s.no%s", prefix, name) 45710a172404SJamie Gritton < 0 45720a172404SJamie Gritton : asprintf(&allow_name, M_PRISON, "allow.%s", name) < 0 || 45730a172404SJamie Gritton asprintf(&allow_noname, M_PRISON, "allow.no%s", name) < 0) { 45740e5c6bd4SJamie Gritton free(allow_name, M_PRISON); 45750a172404SJamie Gritton return 0; 45760e5c6bd4SJamie Gritton } 45770e5c6bd4SJamie Gritton 45780e5c6bd4SJamie Gritton /* 45790a172404SJamie Gritton * See if this parameter has already beed added, i.e. a module was 45800a172404SJamie Gritton * previously loaded/unloaded. 45810e5c6bd4SJamie Gritton */ 45820e5c6bd4SJamie Gritton mtx_lock(&prison0.pr_mtx); 45830e5c6bd4SJamie Gritton for (bf = pr_flag_allow; 45845d58f959SJamie Gritton bf < pr_flag_allow + nitems(pr_flag_allow) && 45855d58f959SJamie Gritton atomic_load_int(&bf->flag) != 0; 45860e5c6bd4SJamie Gritton bf++) { 45870e5c6bd4SJamie Gritton if (strcmp(bf->name, allow_name) == 0) { 45880a172404SJamie Gritton allow_flag = bf->flag; 45890e5c6bd4SJamie Gritton goto no_add; 45900e5c6bd4SJamie Gritton } 45910e5c6bd4SJamie Gritton } 45920e5c6bd4SJamie Gritton 45930e5c6bd4SJamie Gritton /* 45945d58f959SJamie Gritton * Find a free bit in pr_allow_all, failing if there are none 45950e5c6bd4SJamie Gritton * (which shouldn't happen as long as we keep track of how many 45960a172404SJamie Gritton * potential dynamic flags exist). 45970e5c6bd4SJamie Gritton */ 45980e5c6bd4SJamie Gritton for (allow_flag = 1;; allow_flag <<= 1) { 45990e5c6bd4SJamie Gritton if (allow_flag == 0) 46000e5c6bd4SJamie Gritton goto no_add; 46015d58f959SJamie Gritton if ((pr_allow_all & allow_flag) == 0) 46020e5c6bd4SJamie Gritton break; 46030e5c6bd4SJamie Gritton } 46040e5c6bd4SJamie Gritton 46055d58f959SJamie Gritton /* Note the parameter in the next open slot in pr_flag_allow. */ 46065d58f959SJamie Gritton for (bf = pr_flag_allow; ; bf++) { 46070e5c6bd4SJamie Gritton if (bf == pr_flag_allow + nitems(pr_flag_allow)) { 46080e5c6bd4SJamie Gritton /* This should never happen, but is not fatal. */ 46090a172404SJamie Gritton allow_flag = 0; 46100e5c6bd4SJamie Gritton goto no_add; 46110e5c6bd4SJamie Gritton } 46125d58f959SJamie Gritton if (atomic_load_int(&bf->flag) == 0) 46135d58f959SJamie Gritton break; 46145d58f959SJamie Gritton } 46150e5c6bd4SJamie Gritton bf->name = allow_name; 46160e5c6bd4SJamie Gritton bf->noname = allow_noname; 46175d58f959SJamie Gritton pr_allow_all |= allow_flag; 46185d58f959SJamie Gritton /* 46195d58f959SJamie Gritton * prison0 always has permission for the new parameter. 46205d58f959SJamie Gritton * Other jails must have it granted to them. 46215d58f959SJamie Gritton */ 46225d58f959SJamie Gritton prison0.pr_allow |= allow_flag; 46235d58f959SJamie Gritton /* The flag indicates a valid entry, so make sure it is set last. */ 46245d58f959SJamie Gritton atomic_store_rel_int(&bf->flag, allow_flag); 46250e5c6bd4SJamie Gritton mtx_unlock(&prison0.pr_mtx); 46260e5c6bd4SJamie Gritton 4627c542c43eSJamie Gritton /* 46284771011bSGordon Bergling * Create sysctls for the parameter, and the back-compat global 4629c542c43eSJamie Gritton * permission. 4630c542c43eSJamie Gritton */ 46310a172404SJamie Gritton parent = prefix 46320a172404SJamie Gritton ? SYSCTL_ADD_NODE(NULL, 46330a172404SJamie Gritton SYSCTL_CHILDREN(&sysctl___security_jail_param_allow), 46347029da5cSPawel Biernacki OID_AUTO, prefix, CTLFLAG_MPSAFE, 0, prefix_descr) 46350a172404SJamie Gritton : &sysctl___security_jail_param_allow; 46360a172404SJamie Gritton (void)SYSCTL_ADD_PROC(NULL, SYSCTL_CHILDREN(parent), OID_AUTO, 46370a172404SJamie Gritton name, CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 46380e5c6bd4SJamie Gritton NULL, 0, sysctl_jail_param, "B", descr); 46390a172404SJamie Gritton if ((prefix 46400a172404SJamie Gritton ? asprintf(&allowed, M_TEMP, "%s_%s_allowed", prefix, name) 46410a172404SJamie Gritton : asprintf(&allowed, M_TEMP, "%s_allowed", name)) >= 0) { 4642c542c43eSJamie Gritton #ifndef NO_SYSCTL_DESCR 4643c542c43eSJamie Gritton (void)asprintf(&descr_deprecated, M_TEMP, "%s (deprecated)", 4644c542c43eSJamie Gritton descr); 4645c542c43eSJamie Gritton #endif 46460e5c6bd4SJamie Gritton (void)SYSCTL_ADD_PROC(NULL, 46470a172404SJamie Gritton SYSCTL_CHILDREN(&sysctl___security_jail), OID_AUTO, allowed, 4648c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, allow_flag, 4649c542c43eSJamie Gritton sysctl_jail_default_allow, "I", descr_deprecated); 4650c542c43eSJamie Gritton #ifndef NO_SYSCTL_DESCR 4651c542c43eSJamie Gritton free(descr_deprecated, M_TEMP); 4652c542c43eSJamie Gritton #endif 46530a172404SJamie Gritton free(allowed, M_TEMP); 46540e5c6bd4SJamie Gritton } 46550a172404SJamie Gritton return allow_flag; 46560e5c6bd4SJamie Gritton 46570e5c6bd4SJamie Gritton no_add: 46580e5c6bd4SJamie Gritton mtx_unlock(&prison0.pr_mtx); 46590e5c6bd4SJamie Gritton free(allow_name, M_PRISON); 46600e5c6bd4SJamie Gritton free(allow_noname, M_PRISON); 46610a172404SJamie Gritton return allow_flag; 46620a172404SJamie Gritton } 46630a172404SJamie Gritton 46640a172404SJamie Gritton /* 46650a172404SJamie Gritton * The VFS system will register jail-aware filesystems here. They each get 46660a172404SJamie Gritton * a parameter allow.mount.xxxfs and a flag to check when a jailed user 46670a172404SJamie Gritton * attempts to mount. 46680a172404SJamie Gritton */ 46690a172404SJamie Gritton void 46700a172404SJamie Gritton prison_add_vfs(struct vfsconf *vfsp) 46710a172404SJamie Gritton { 46720a172404SJamie Gritton #ifdef NO_SYSCTL_DESCR 46730a172404SJamie Gritton 46740a172404SJamie Gritton vfsp->vfc_prison_flag = prison_add_allow("mount", vfsp->vfc_name, 46750a172404SJamie Gritton NULL, NULL); 46760a172404SJamie Gritton #else 46770a172404SJamie Gritton char *descr; 46780a172404SJamie Gritton 46790a172404SJamie Gritton (void)asprintf(&descr, M_TEMP, "Jail may mount the %s file system", 46800a172404SJamie Gritton vfsp->vfc_name); 46810a172404SJamie Gritton vfsp->vfc_prison_flag = prison_add_allow("mount", vfsp->vfc_name, 46820a172404SJamie Gritton NULL, descr); 46830a172404SJamie Gritton free(descr, M_TEMP); 46840a172404SJamie Gritton #endif 46850e5c6bd4SJamie Gritton } 4686bf3db8aaSMartin Matuska 46874b5c9cf6SEdward Tomasz Napierala #ifdef RACCT 4688097055e2SEdward Tomasz Napierala void 4689097055e2SEdward Tomasz Napierala prison_racct_foreach(void (*callback)(struct racct *racct, 469015db3c07SEdward Tomasz Napierala void *arg2, void *arg3), void (*pre)(void), void (*post)(void), 469115db3c07SEdward Tomasz Napierala void *arg2, void *arg3) 4692097055e2SEdward Tomasz Napierala { 4693a7ad07bfSEdward Tomasz Napierala struct prison_racct *prr; 4694097055e2SEdward Tomasz Napierala 46954b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 46964b5c9cf6SEdward Tomasz Napierala 4697097055e2SEdward Tomasz Napierala sx_slock(&allprison_lock); 469815db3c07SEdward Tomasz Napierala if (pre != NULL) 469915db3c07SEdward Tomasz Napierala (pre)(); 4700a7ad07bfSEdward Tomasz Napierala LIST_FOREACH(prr, &allprison_racct, prr_next) 4701a7ad07bfSEdward Tomasz Napierala (callback)(prr->prr_racct, arg2, arg3); 470215db3c07SEdward Tomasz Napierala if (post != NULL) 470315db3c07SEdward Tomasz Napierala (post)(); 4704097055e2SEdward Tomasz Napierala sx_sunlock(&allprison_lock); 4705097055e2SEdward Tomasz Napierala } 47060304c731SJamie Gritton 4707a7ad07bfSEdward Tomasz Napierala static struct prison_racct * 4708a7ad07bfSEdward Tomasz Napierala prison_racct_find_locked(const char *name) 4709a7ad07bfSEdward Tomasz Napierala { 4710a7ad07bfSEdward Tomasz Napierala struct prison_racct *prr; 4711a7ad07bfSEdward Tomasz Napierala 47124b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 4713a7ad07bfSEdward Tomasz Napierala sx_assert(&allprison_lock, SA_XLOCKED); 4714a7ad07bfSEdward Tomasz Napierala 4715a7ad07bfSEdward Tomasz Napierala if (name[0] == '\0' || strlen(name) >= MAXHOSTNAMELEN) 4716a7ad07bfSEdward Tomasz Napierala return (NULL); 4717a7ad07bfSEdward Tomasz Napierala 4718a7ad07bfSEdward Tomasz Napierala LIST_FOREACH(prr, &allprison_racct, prr_next) { 4719a7ad07bfSEdward Tomasz Napierala if (strcmp(name, prr->prr_name) != 0) 4720a7ad07bfSEdward Tomasz Napierala continue; 4721a7ad07bfSEdward Tomasz Napierala 4722a7ad07bfSEdward Tomasz Napierala /* Found prison_racct with a matching name? */ 4723a7ad07bfSEdward Tomasz Napierala prison_racct_hold(prr); 4724a7ad07bfSEdward Tomasz Napierala return (prr); 4725a7ad07bfSEdward Tomasz Napierala } 4726a7ad07bfSEdward Tomasz Napierala 4727a7ad07bfSEdward Tomasz Napierala /* Add new prison_racct. */ 4728a7ad07bfSEdward Tomasz Napierala prr = malloc(sizeof(*prr), M_PRISON_RACCT, M_ZERO | M_WAITOK); 4729a7ad07bfSEdward Tomasz Napierala racct_create(&prr->prr_racct); 4730a7ad07bfSEdward Tomasz Napierala 4731a7ad07bfSEdward Tomasz Napierala strcpy(prr->prr_name, name); 4732a7ad07bfSEdward Tomasz Napierala refcount_init(&prr->prr_refcount, 1); 4733a7ad07bfSEdward Tomasz Napierala LIST_INSERT_HEAD(&allprison_racct, prr, prr_next); 4734a7ad07bfSEdward Tomasz Napierala 4735a7ad07bfSEdward Tomasz Napierala return (prr); 4736a7ad07bfSEdward Tomasz Napierala } 4737a7ad07bfSEdward Tomasz Napierala 4738a7ad07bfSEdward Tomasz Napierala struct prison_racct * 4739a7ad07bfSEdward Tomasz Napierala prison_racct_find(const char *name) 4740a7ad07bfSEdward Tomasz Napierala { 4741a7ad07bfSEdward Tomasz Napierala struct prison_racct *prr; 4742a7ad07bfSEdward Tomasz Napierala 47434b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 47444b5c9cf6SEdward Tomasz Napierala 4745a7ad07bfSEdward Tomasz Napierala sx_xlock(&allprison_lock); 4746a7ad07bfSEdward Tomasz Napierala prr = prison_racct_find_locked(name); 4747a7ad07bfSEdward Tomasz Napierala sx_xunlock(&allprison_lock); 4748a7ad07bfSEdward Tomasz Napierala return (prr); 4749a7ad07bfSEdward Tomasz Napierala } 4750a7ad07bfSEdward Tomasz Napierala 4751a7ad07bfSEdward Tomasz Napierala void 4752a7ad07bfSEdward Tomasz Napierala prison_racct_hold(struct prison_racct *prr) 4753a7ad07bfSEdward Tomasz Napierala { 4754a7ad07bfSEdward Tomasz Napierala 47554b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 47564b5c9cf6SEdward Tomasz Napierala 4757a7ad07bfSEdward Tomasz Napierala refcount_acquire(&prr->prr_refcount); 4758a7ad07bfSEdward Tomasz Napierala } 4759a7ad07bfSEdward Tomasz Napierala 4760c34bbd2aSEdward Tomasz Napierala static void 4761c34bbd2aSEdward Tomasz Napierala prison_racct_free_locked(struct prison_racct *prr) 4762c34bbd2aSEdward Tomasz Napierala { 4763c34bbd2aSEdward Tomasz Napierala 47644b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 4765c34bbd2aSEdward Tomasz Napierala sx_assert(&allprison_lock, SA_XLOCKED); 4766c34bbd2aSEdward Tomasz Napierala 4767c34bbd2aSEdward Tomasz Napierala if (refcount_release(&prr->prr_refcount)) { 4768c34bbd2aSEdward Tomasz Napierala racct_destroy(&prr->prr_racct); 4769c34bbd2aSEdward Tomasz Napierala LIST_REMOVE(prr, prr_next); 4770c34bbd2aSEdward Tomasz Napierala free(prr, M_PRISON_RACCT); 4771c34bbd2aSEdward Tomasz Napierala } 4772c34bbd2aSEdward Tomasz Napierala } 4773c34bbd2aSEdward Tomasz Napierala 4774a7ad07bfSEdward Tomasz Napierala void 4775a7ad07bfSEdward Tomasz Napierala prison_racct_free(struct prison_racct *prr) 4776a7ad07bfSEdward Tomasz Napierala { 4777a7ad07bfSEdward Tomasz Napierala 47784b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 4779c34bbd2aSEdward Tomasz Napierala sx_assert(&allprison_lock, SA_UNLOCKED); 4780c34bbd2aSEdward Tomasz Napierala 47816ff4688bSMateusz Guzik if (refcount_release_if_not_last(&prr->prr_refcount)) 4782a7ad07bfSEdward Tomasz Napierala return; 4783a7ad07bfSEdward Tomasz Napierala 4784a7ad07bfSEdward Tomasz Napierala sx_xlock(&allprison_lock); 4785c34bbd2aSEdward Tomasz Napierala prison_racct_free_locked(prr); 4786a7ad07bfSEdward Tomasz Napierala sx_xunlock(&allprison_lock); 4787a7ad07bfSEdward Tomasz Napierala } 4788a7ad07bfSEdward Tomasz Napierala 4789a7ad07bfSEdward Tomasz Napierala static void 4790a7ad07bfSEdward Tomasz Napierala prison_racct_attach(struct prison *pr) 4791a7ad07bfSEdward Tomasz Napierala { 4792a7ad07bfSEdward Tomasz Napierala struct prison_racct *prr; 4793a7ad07bfSEdward Tomasz Napierala 47944b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 4795c34bbd2aSEdward Tomasz Napierala sx_assert(&allprison_lock, SA_XLOCKED); 4796c34bbd2aSEdward Tomasz Napierala 4797a7ad07bfSEdward Tomasz Napierala prr = prison_racct_find_locked(pr->pr_name); 4798a7ad07bfSEdward Tomasz Napierala KASSERT(prr != NULL, ("cannot find prison_racct")); 4799a7ad07bfSEdward Tomasz Napierala 4800a7ad07bfSEdward Tomasz Napierala pr->pr_prison_racct = prr; 4801a7ad07bfSEdward Tomasz Napierala } 4802a7ad07bfSEdward Tomasz Napierala 4803c34bbd2aSEdward Tomasz Napierala /* 4804c34bbd2aSEdward Tomasz Napierala * Handle jail renaming. From the racct point of view, renaming means 4805c34bbd2aSEdward Tomasz Napierala * moving from one prison_racct to another. 4806c34bbd2aSEdward Tomasz Napierala */ 4807c34bbd2aSEdward Tomasz Napierala static void 4808c34bbd2aSEdward Tomasz Napierala prison_racct_modify(struct prison *pr) 4809c34bbd2aSEdward Tomasz Napierala { 4810dbadb015SKonstantin Belousov #ifdef RCTL 4811c34bbd2aSEdward Tomasz Napierala struct proc *p; 4812c34bbd2aSEdward Tomasz Napierala struct ucred *cred; 4813dbadb015SKonstantin Belousov #endif 4814c34bbd2aSEdward Tomasz Napierala struct prison_racct *oldprr; 4815c34bbd2aSEdward Tomasz Napierala 48164b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 48174b5c9cf6SEdward Tomasz Napierala 4818c34bbd2aSEdward Tomasz Napierala sx_slock(&allproc_lock); 4819c34bbd2aSEdward Tomasz Napierala sx_xlock(&allprison_lock); 4820c34bbd2aSEdward Tomasz Napierala 4821e30345e7SEdward Tomasz Napierala if (strcmp(pr->pr_name, pr->pr_prison_racct->prr_name) == 0) { 4822e30345e7SEdward Tomasz Napierala sx_xunlock(&allprison_lock); 4823e30345e7SEdward Tomasz Napierala sx_sunlock(&allproc_lock); 4824c34bbd2aSEdward Tomasz Napierala return; 4825e30345e7SEdward Tomasz Napierala } 4826c34bbd2aSEdward Tomasz Napierala 4827c34bbd2aSEdward Tomasz Napierala oldprr = pr->pr_prison_racct; 4828c34bbd2aSEdward Tomasz Napierala pr->pr_prison_racct = NULL; 4829c34bbd2aSEdward Tomasz Napierala 4830c34bbd2aSEdward Tomasz Napierala prison_racct_attach(pr); 4831c34bbd2aSEdward Tomasz Napierala 4832c34bbd2aSEdward Tomasz Napierala /* 4833c34bbd2aSEdward Tomasz Napierala * Move resource utilisation records. 4834c34bbd2aSEdward Tomasz Napierala */ 4835c34bbd2aSEdward Tomasz Napierala racct_move(pr->pr_prison_racct->prr_racct, oldprr->prr_racct); 4836c34bbd2aSEdward Tomasz Napierala 4837f87beb93SAndriy Gapon #ifdef RCTL 4838c34bbd2aSEdward Tomasz Napierala /* 4839c34bbd2aSEdward Tomasz Napierala * Force rctl to reattach rules to processes. 4840c34bbd2aSEdward Tomasz Napierala */ 4841c34bbd2aSEdward Tomasz Napierala FOREACH_PROC_IN_SYSTEM(p) { 4842c34bbd2aSEdward Tomasz Napierala PROC_LOCK(p); 4843c34bbd2aSEdward Tomasz Napierala cred = crhold(p->p_ucred); 4844c34bbd2aSEdward Tomasz Napierala PROC_UNLOCK(p); 4845f87beb93SAndriy Gapon rctl_proc_ucred_changed(p, cred); 4846c34bbd2aSEdward Tomasz Napierala crfree(cred); 4847c34bbd2aSEdward Tomasz Napierala } 4848f87beb93SAndriy Gapon #endif 4849c34bbd2aSEdward Tomasz Napierala 4850c34bbd2aSEdward Tomasz Napierala sx_sunlock(&allproc_lock); 4851c34bbd2aSEdward Tomasz Napierala prison_racct_free_locked(oldprr); 4852c34bbd2aSEdward Tomasz Napierala sx_xunlock(&allprison_lock); 4853c34bbd2aSEdward Tomasz Napierala } 4854c34bbd2aSEdward Tomasz Napierala 4855a7ad07bfSEdward Tomasz Napierala static void 4856a7ad07bfSEdward Tomasz Napierala prison_racct_detach(struct prison *pr) 4857a7ad07bfSEdward Tomasz Napierala { 4858c34bbd2aSEdward Tomasz Napierala 48594b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 4860c34bbd2aSEdward Tomasz Napierala sx_assert(&allprison_lock, SA_UNLOCKED); 4861c34bbd2aSEdward Tomasz Napierala 4862af3c786cSMateusz Guzik if (pr->pr_prison_racct == NULL) 4863af3c786cSMateusz Guzik return; 4864a7ad07bfSEdward Tomasz Napierala prison_racct_free(pr->pr_prison_racct); 4865a7ad07bfSEdward Tomasz Napierala pr->pr_prison_racct = NULL; 4866a7ad07bfSEdward Tomasz Napierala } 4867a7ad07bfSEdward Tomasz Napierala #endif /* RACCT */ 4868a7ad07bfSEdward Tomasz Napierala 4869413628a7SBjoern A. Zeeb #ifdef DDB 4870b38ff370SJamie Gritton 4871b38ff370SJamie Gritton static void 4872b38ff370SJamie Gritton db_show_prison(struct prison *pr) 4873413628a7SBjoern A. Zeeb { 4874672756aaSJamie Gritton struct bool_flags *bf; 4875672756aaSJamie Gritton struct jailsys_flags *jsf; 4876b38ff370SJamie Gritton #if defined(INET) || defined(INET6) 4877b38ff370SJamie Gritton int ii; 4878413628a7SBjoern A. Zeeb #endif 4879672756aaSJamie Gritton unsigned f; 48808144690aSEric van Gyzen #ifdef INET 48818144690aSEric van Gyzen char ip4buf[INET_ADDRSTRLEN]; 48828144690aSEric van Gyzen #endif 4883413628a7SBjoern A. Zeeb #ifdef INET6 4884413628a7SBjoern A. Zeeb char ip6buf[INET6_ADDRSTRLEN]; 4885413628a7SBjoern A. Zeeb #endif 4886413628a7SBjoern A. Zeeb 4887b38ff370SJamie Gritton db_printf("prison %p:\n", pr); 4888b38ff370SJamie Gritton db_printf(" jid = %d\n", pr->pr_id); 4889b38ff370SJamie Gritton db_printf(" name = %s\n", pr->pr_name); 48900304c731SJamie Gritton db_printf(" parent = %p\n", pr->pr_parent); 4891b38ff370SJamie Gritton db_printf(" ref = %d\n", pr->pr_ref); 4892b38ff370SJamie Gritton db_printf(" uref = %d\n", pr->pr_uref); 48931158508aSJamie Gritton db_printf(" state = %s\n", 48941158508aSJamie Gritton pr->pr_state == PRISON_STATE_ALIVE ? "alive" : 48951158508aSJamie Gritton pr->pr_state == PRISON_STATE_DYING ? "dying" : 48961158508aSJamie Gritton "invalid"); 4897b38ff370SJamie Gritton db_printf(" path = %s\n", pr->pr_path); 4898b38ff370SJamie Gritton db_printf(" cpuset = %d\n", pr->pr_cpuset 4899b38ff370SJamie Gritton ? pr->pr_cpuset->cs_id : -1); 4900679e1390SJamie Gritton #ifdef VIMAGE 4901679e1390SJamie Gritton db_printf(" vnet = %p\n", pr->pr_vnet); 4902679e1390SJamie Gritton #endif 4903b38ff370SJamie Gritton db_printf(" root = %p\n", pr->pr_root); 4904b38ff370SJamie Gritton db_printf(" securelevel = %d\n", pr->pr_securelevel); 49050cc207a6SMartin Matuska db_printf(" devfs_rsnum = %d\n", pr->pr_devfs_rsnum); 4906fe0518e9SBjoern A. Zeeb db_printf(" children.max = %d\n", pr->pr_childmax); 4907fe0518e9SBjoern A. Zeeb db_printf(" children.cur = %d\n", pr->pr_childcount); 49080304c731SJamie Gritton db_printf(" child = %p\n", LIST_FIRST(&pr->pr_children)); 49090304c731SJamie Gritton db_printf(" sibling = %p\n", LIST_NEXT(pr, pr_sibling)); 4910fe0518e9SBjoern A. Zeeb db_printf(" flags = 0x%x", pr->pr_flags); 4911672756aaSJamie Gritton for (bf = pr_flag_bool; bf < pr_flag_bool + nitems(pr_flag_bool); bf++) 4912672756aaSJamie Gritton if (pr->pr_flags & bf->flag) 4913672756aaSJamie Gritton db_printf(" %s", bf->name); 4914672756aaSJamie Gritton for (jsf = pr_flag_jailsys; 4915672756aaSJamie Gritton jsf < pr_flag_jailsys + nitems(pr_flag_jailsys); 4916672756aaSJamie Gritton jsf++) { 4917672756aaSJamie Gritton f = pr->pr_flags & (jsf->disable | jsf->new); 4918672756aaSJamie Gritton db_printf(" %-16s= %s\n", jsf->name, 4919672756aaSJamie Gritton (f != 0 && f == jsf->disable) ? "disable" 4920672756aaSJamie Gritton : (f == jsf->new) ? "new" 49217cbf7213SJamie Gritton : "inherit"); 49227cbf7213SJamie Gritton } 4923fe0518e9SBjoern A. Zeeb db_printf(" allow = 0x%x", pr->pr_allow); 4924672756aaSJamie Gritton for (bf = pr_flag_allow; 49255d58f959SJamie Gritton bf < pr_flag_allow + nitems(pr_flag_allow) && 49265d58f959SJamie Gritton atomic_load_int(&bf->flag) != 0; 4927672756aaSJamie Gritton bf++) 4928672756aaSJamie Gritton if (pr->pr_allow & bf->flag) 4929672756aaSJamie Gritton db_printf(" %s", bf->name); 4930b38ff370SJamie Gritton db_printf("\n"); 49310304c731SJamie Gritton db_printf(" enforce_statfs = %d\n", pr->pr_enforce_statfs); 4932c1f19219SJamie Gritton db_printf(" host.hostname = %s\n", pr->pr_hostname); 4933c1f19219SJamie Gritton db_printf(" host.domainname = %s\n", pr->pr_domainname); 4934c1f19219SJamie Gritton db_printf(" host.hostuuid = %s\n", pr->pr_hostuuid); 493576ca6f88SJamie Gritton db_printf(" host.hostid = %lu\n", pr->pr_hostid); 4936413628a7SBjoern A. Zeeb #ifdef INET 4937eb8dcdeaSGleb Smirnoff if (pr->pr_addrs[PR_INET] != NULL) { 4938eb8dcdeaSGleb Smirnoff pr_family_t af = PR_INET; 4939eb8dcdeaSGleb Smirnoff 4940eb8dcdeaSGleb Smirnoff db_printf(" ip4s = %d\n", pr->pr_addrs[af]->ips); 4941eb8dcdeaSGleb Smirnoff for (ii = 0; ii < pr->pr_addrs[af]->ips; ii++) 4942b38ff370SJamie Gritton db_printf(" %s %s\n", 4943fe0518e9SBjoern A. Zeeb ii == 0 ? "ip4.addr =" : " ", 4944eb8dcdeaSGleb Smirnoff inet_ntoa_r( 494521ad3e27SZhenlei Huang *(const struct in_addr *)PR_IP(pr->pr_addrs[af], ii), 4946eb8dcdeaSGleb Smirnoff ip4buf)); 4947eb8dcdeaSGleb Smirnoff } 4948413628a7SBjoern A. Zeeb #endif 4949413628a7SBjoern A. Zeeb #ifdef INET6 4950eb8dcdeaSGleb Smirnoff if (pr->pr_addrs[PR_INET6] != NULL) { 4951eb8dcdeaSGleb Smirnoff pr_family_t af = PR_INET6; 4952eb8dcdeaSGleb Smirnoff 4953eb8dcdeaSGleb Smirnoff db_printf(" ip6s = %d\n", pr->pr_addrs[af]->ips); 4954eb8dcdeaSGleb Smirnoff for (ii = 0; ii < pr->pr_addrs[af]->ips; ii++) 4955b38ff370SJamie Gritton db_printf(" %s %s\n", 4956fe0518e9SBjoern A. Zeeb ii == 0 ? "ip6.addr =" : " ", 4957eb8dcdeaSGleb Smirnoff ip6_sprintf(ip6buf, 495821ad3e27SZhenlei Huang (const struct in6_addr *)PR_IP(pr->pr_addrs[af], ii))); 4959eb8dcdeaSGleb Smirnoff } 4960b38ff370SJamie Gritton #endif 4961b38ff370SJamie Gritton } 4962b38ff370SJamie Gritton 4963b38ff370SJamie Gritton DB_SHOW_COMMAND(prison, db_show_prison_command) 4964b38ff370SJamie Gritton { 4965b38ff370SJamie Gritton struct prison *pr; 4966b38ff370SJamie Gritton 4967b38ff370SJamie Gritton if (!have_addr) { 49680304c731SJamie Gritton /* 49690304c731SJamie Gritton * Show all prisons in the list, and prison0 which is not 49700304c731SJamie Gritton * listed. 49710304c731SJamie Gritton */ 49720304c731SJamie Gritton db_show_prison(&prison0); 49730304c731SJamie Gritton if (!db_pager_quit) { 4974b38ff370SJamie Gritton TAILQ_FOREACH(pr, &allprison, pr_list) { 4975b38ff370SJamie Gritton db_show_prison(pr); 4976413628a7SBjoern A. Zeeb if (db_pager_quit) 4977413628a7SBjoern A. Zeeb break; 4978413628a7SBjoern A. Zeeb } 49790304c731SJamie Gritton } 4980b38ff370SJamie Gritton return; 4981413628a7SBjoern A. Zeeb } 4982b38ff370SJamie Gritton 49830304c731SJamie Gritton if (addr == 0) 49840304c731SJamie Gritton pr = &prison0; 49850304c731SJamie Gritton else { 4986b38ff370SJamie Gritton /* Look for a prison with the ID and with references. */ 4987b38ff370SJamie Gritton TAILQ_FOREACH(pr, &allprison, pr_list) 4988b38ff370SJamie Gritton if (pr->pr_id == addr && pr->pr_ref > 0) 4989b38ff370SJamie Gritton break; 4990b38ff370SJamie Gritton if (pr == NULL) 4991b38ff370SJamie Gritton /* Look again, without requiring a reference. */ 4992b38ff370SJamie Gritton TAILQ_FOREACH(pr, &allprison, pr_list) 4993b38ff370SJamie Gritton if (pr->pr_id == addr) 4994b38ff370SJamie Gritton break; 4995b38ff370SJamie Gritton if (pr == NULL) 4996b38ff370SJamie Gritton /* Assume address points to a valid prison. */ 4997b38ff370SJamie Gritton pr = (struct prison *)addr; 49980304c731SJamie Gritton } 4999b38ff370SJamie Gritton db_show_prison(pr); 5000b38ff370SJamie Gritton } 5001b38ff370SJamie Gritton 5002413628a7SBjoern A. Zeeb #endif /* DDB */ 5003