xref: /freebsd/sys/kern/kern_jail.c (revision ccd6ac9f6e5c1f92c0ce92de1f037a1b5d7716cb)
19454b2d8SWarner Losh /*-
28a36da99SPedro F. Giffuni  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
38a36da99SPedro F. Giffuni  *
4413628a7SBjoern A. Zeeb  * Copyright (c) 1999 Poul-Henning Kamp.
5413628a7SBjoern A. Zeeb  * Copyright (c) 2008 Bjoern A. Zeeb.
6b38ff370SJamie Gritton  * Copyright (c) 2009 James Gritton.
7413628a7SBjoern A. Zeeb  * All rights reserved.
8b9f0b66cSBjoern A. Zeeb  *
9b9f0b66cSBjoern A. Zeeb  * Redistribution and use in source and binary forms, with or without
10b9f0b66cSBjoern A. Zeeb  * modification, are permitted provided that the following conditions
11b9f0b66cSBjoern A. Zeeb  * are met:
12b9f0b66cSBjoern A. Zeeb  * 1. Redistributions of source code must retain the above copyright
13b9f0b66cSBjoern A. Zeeb  *    notice, this list of conditions and the following disclaimer.
14b9f0b66cSBjoern A. Zeeb  * 2. Redistributions in binary form must reproduce the above copyright
15b9f0b66cSBjoern A. Zeeb  *    notice, this list of conditions and the following disclaimer in the
16b9f0b66cSBjoern A. Zeeb  *    documentation and/or other materials provided with the distribution.
17b9f0b66cSBjoern A. Zeeb  *
18b9f0b66cSBjoern A. Zeeb  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19b9f0b66cSBjoern A. Zeeb  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20b9f0b66cSBjoern A. Zeeb  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21b9f0b66cSBjoern A. Zeeb  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22b9f0b66cSBjoern A. Zeeb  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23b9f0b66cSBjoern A. Zeeb  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24b9f0b66cSBjoern A. Zeeb  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25b9f0b66cSBjoern A. Zeeb  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26b9f0b66cSBjoern A. Zeeb  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27b9f0b66cSBjoern A. Zeeb  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28b9f0b66cSBjoern A. Zeeb  * SUCH DAMAGE.
2907901f22SPoul-Henning Kamp  */
3075c13541SPoul-Henning Kamp 
31677b542eSDavid E. O'Brien #include <sys/cdefs.h>
32677b542eSDavid E. O'Brien __FBSDID("$FreeBSD$");
33677b542eSDavid E. O'Brien 
34413628a7SBjoern A. Zeeb #include "opt_ddb.h"
35413628a7SBjoern A. Zeeb #include "opt_inet.h"
36413628a7SBjoern A. Zeeb #include "opt_inet6.h"
3746e3b1cbSPawel Jakub Dawidek 
3875c13541SPoul-Henning Kamp #include <sys/param.h>
3975c13541SPoul-Henning Kamp #include <sys/types.h>
4075c13541SPoul-Henning Kamp #include <sys/kernel.h>
4175c13541SPoul-Henning Kamp #include <sys/systm.h>
4275c13541SPoul-Henning Kamp #include <sys/errno.h>
4375c13541SPoul-Henning Kamp #include <sys/sysproto.h>
4475c13541SPoul-Henning Kamp #include <sys/malloc.h>
450304c731SJamie Gritton #include <sys/osd.h>
46800c9408SRobert Watson #include <sys/priv.h>
4775c13541SPoul-Henning Kamp #include <sys/proc.h>
48b3059e09SRobert Watson #include <sys/taskqueue.h>
4957b4252eSKonstantin Belousov #include <sys/fcntl.h>
5075c13541SPoul-Henning Kamp #include <sys/jail.h>
5101137630SRobert Watson #include <sys/lock.h>
5201137630SRobert Watson #include <sys/mutex.h>
53097055e2SEdward Tomasz Napierala #include <sys/racct.h>
54f87beb93SAndriy Gapon #include <sys/rctl.h>
55a7ad07bfSEdward Tomasz Napierala #include <sys/refcount.h>
56dc68a633SPawel Jakub Dawidek #include <sys/sx.h>
5776ca6f88SJamie Gritton #include <sys/sysent.h>
58fd7a8150SMike Barcroft #include <sys/namei.h>
59820a0de9SPawel Jakub Dawidek #include <sys/mount.h>
60fd7a8150SMike Barcroft #include <sys/queue.h>
6175c13541SPoul-Henning Kamp #include <sys/socket.h>
62fd7a8150SMike Barcroft #include <sys/syscallsubr.h>
6383f1e257SRobert Watson #include <sys/sysctl.h>
64fd7a8150SMike Barcroft #include <sys/vnode.h>
65530c0060SRobert Watson 
6675c13541SPoul-Henning Kamp #include <net/if.h>
67530c0060SRobert Watson #include <net/vnet.h>
68530c0060SRobert Watson 
6975c13541SPoul-Henning Kamp #include <netinet/in.h>
70530c0060SRobert Watson 
71413628a7SBjoern A. Zeeb #ifdef DDB
72413628a7SBjoern A. Zeeb #include <ddb/ddb.h>
73413628a7SBjoern A. Zeeb #endif /* DDB */
7475c13541SPoul-Henning Kamp 
75aed55708SRobert Watson #include <security/mac/mac_framework.h>
76aed55708SRobert Watson 
778986e3a0SJamie Gritton #define	DEFAULT_HOSTUUID	"00000000-0000-0000-0000-000000000000"
788986e3a0SJamie Gritton 
7975c13541SPoul-Henning Kamp MALLOC_DEFINE(M_PRISON, "prison", "Prison structures");
80d745c852SEd Schouten static MALLOC_DEFINE(M_PRISON_RACCT, "prison_racct", "Prison racct structures");
8175c13541SPoul-Henning Kamp 
82592bcae8SBjoern A. Zeeb /* Keep struct prison prison0 and some code in kern_jail_set() readable. */
83592bcae8SBjoern A. Zeeb #ifdef INET
84592bcae8SBjoern A. Zeeb #ifdef INET6
85592bcae8SBjoern A. Zeeb #define	_PR_IP_SADDRSEL	PR_IP4_SADDRSEL|PR_IP6_SADDRSEL
86592bcae8SBjoern A. Zeeb #else
87592bcae8SBjoern A. Zeeb #define	_PR_IP_SADDRSEL	PR_IP4_SADDRSEL
88592bcae8SBjoern A. Zeeb #endif
89592bcae8SBjoern A. Zeeb #else /* !INET */
90592bcae8SBjoern A. Zeeb #ifdef INET6
91592bcae8SBjoern A. Zeeb #define	_PR_IP_SADDRSEL	PR_IP6_SADDRSEL
92592bcae8SBjoern A. Zeeb #else
93592bcae8SBjoern A. Zeeb #define	_PR_IP_SADDRSEL	0
94592bcae8SBjoern A. Zeeb #endif
95592bcae8SBjoern A. Zeeb #endif
96592bcae8SBjoern A. Zeeb 
970304c731SJamie Gritton /* prison0 describes what is "real" about the system. */
980304c731SJamie Gritton struct prison prison0 = {
990304c731SJamie Gritton 	.pr_id		= 0,
1000304c731SJamie Gritton 	.pr_name	= "0",
1010304c731SJamie Gritton 	.pr_ref		= 1,
1020304c731SJamie Gritton 	.pr_uref	= 1,
1030304c731SJamie Gritton 	.pr_path	= "/",
1040304c731SJamie Gritton 	.pr_securelevel	= -1,
1050cc207a6SMartin Matuska 	.pr_devfs_rsnum = 0,
106b97457e2SJamie Gritton 	.pr_childmax	= JAIL_MAX,
1078986e3a0SJamie Gritton 	.pr_hostuuid	= DEFAULT_HOSTUUID,
10813e403fdSAntoine Brodin 	.pr_children	= LIST_HEAD_INITIALIZER(prison0.pr_children),
109eb79e1c7SBjoern A. Zeeb #ifdef VIMAGE
110592bcae8SBjoern A. Zeeb 	.pr_flags	= PR_HOST|PR_VNET|_PR_IP_SADDRSEL,
111eb79e1c7SBjoern A. Zeeb #else
112592bcae8SBjoern A. Zeeb 	.pr_flags	= PR_HOST|_PR_IP_SADDRSEL,
113eb79e1c7SBjoern A. Zeeb #endif
1140e5c6bd4SJamie Gritton 	.pr_allow	= PR_ALLOW_ALL_STATIC,
1150304c731SJamie Gritton };
1160304c731SJamie Gritton MTX_SYSINIT(prison0, &prison0.pr_mtx, "jail mutex", MTX_DEF);
11783f1e257SRobert Watson 
118672756aaSJamie Gritton struct bool_flags {
119672756aaSJamie Gritton 	const char	*name;
120672756aaSJamie Gritton 	const char	*noname;
121672756aaSJamie Gritton 	unsigned	 flag;
122672756aaSJamie Gritton };
123672756aaSJamie Gritton struct jailsys_flags {
124672756aaSJamie Gritton 	const char	*name;
125672756aaSJamie Gritton 	unsigned	 disable;
126672756aaSJamie Gritton 	unsigned	 new;
127672756aaSJamie Gritton };
128672756aaSJamie Gritton 
129a7ad07bfSEdward Tomasz Napierala /* allprison, allprison_racct and lastprid are protected by allprison_lock. */
130dc68a633SPawel Jakub Dawidek struct	sx allprison_lock;
131b38ff370SJamie Gritton SX_SYSINIT(allprison_lock, &allprison_lock, "allprison");
132b38ff370SJamie Gritton struct	prisonlist allprison = TAILQ_HEAD_INITIALIZER(allprison);
133a7ad07bfSEdward Tomasz Napierala LIST_HEAD(, prison_racct) allprison_racct;
1342110d913SXin LI int	lastprid = 0;
135fd7a8150SMike Barcroft 
136b38ff370SJamie Gritton static int do_jail_attach(struct thread *td, struct prison *pr);
137b3059e09SRobert Watson static void prison_complete(void *context, int pending);
138b38ff370SJamie Gritton static void prison_deref(struct prison *pr, int flags);
1390304c731SJamie Gritton static char *prison_path(struct prison *pr1, struct prison *pr2);
1400304c731SJamie Gritton static void prison_remove_one(struct prison *pr);
141a7ad07bfSEdward Tomasz Napierala #ifdef RACCT
142a7ad07bfSEdward Tomasz Napierala static void prison_racct_attach(struct prison *pr);
143c34bbd2aSEdward Tomasz Napierala static void prison_racct_modify(struct prison *pr);
144a7ad07bfSEdward Tomasz Napierala static void prison_racct_detach(struct prison *pr);
145a7ad07bfSEdward Tomasz Napierala #endif
146fd7a8150SMike Barcroft 
147b38ff370SJamie Gritton /* Flags for prison_deref */
148b38ff370SJamie Gritton #define	PD_DEREF	0x01
149b38ff370SJamie Gritton #define	PD_DEUREF	0x02
150b38ff370SJamie Gritton #define	PD_LOCKED	0x04
151b38ff370SJamie Gritton #define	PD_LIST_SLOCKED	0x08
152b38ff370SJamie Gritton #define	PD_LIST_XLOCKED	0x10
153fd7a8150SMike Barcroft 
1540304c731SJamie Gritton /*
1555cc70397SBjoern A. Zeeb  * Parameter names corresponding to PR_* flag values.  Size values are for kvm
1565cc70397SBjoern A. Zeeb  * as we cannot figure out the size of a sparse array, or an array without a
1575cc70397SBjoern A. Zeeb  * terminating entry.
1580304c731SJamie Gritton  */
159672756aaSJamie Gritton static struct bool_flags pr_flag_bool[] = {
160672756aaSJamie Gritton 	{"persist", "nopersist", PR_PERSIST},
161592bcae8SBjoern A. Zeeb #ifdef INET
162672756aaSJamie Gritton 	{"ip4.saddrsel", "ip4.nosaddrsel", PR_IP4_SADDRSEL},
163592bcae8SBjoern A. Zeeb #endif
164592bcae8SBjoern A. Zeeb #ifdef INET6
165672756aaSJamie Gritton 	{"ip6.saddrsel", "ip6.nosaddrsel", PR_IP6_SADDRSEL},
166592bcae8SBjoern A. Zeeb #endif
1670304c731SJamie Gritton };
168672756aaSJamie Gritton const size_t pr_flag_bool_size = sizeof(pr_flag_bool);
1690304c731SJamie Gritton 
170672756aaSJamie Gritton static struct jailsys_flags pr_flag_jailsys[] = {
1717cbf7213SJamie Gritton 	{"host", 0, PR_HOST},
1727cbf7213SJamie Gritton #ifdef VIMAGE
1737cbf7213SJamie Gritton 	{"vnet", 0, PR_VNET},
1747cbf7213SJamie Gritton #endif
1750304c731SJamie Gritton #ifdef INET
1766a3f2779SJamie Gritton 	{"ip4", PR_IP4_USER, PR_IP4_USER},
1770304c731SJamie Gritton #endif
1780304c731SJamie Gritton #ifdef INET6
1796a3f2779SJamie Gritton 	{"ip6", PR_IP6_USER, PR_IP6_USER},
180679e1390SJamie Gritton #endif
1810304c731SJamie Gritton };
1825cc70397SBjoern A. Zeeb const size_t pr_flag_jailsys_size = sizeof(pr_flag_jailsys);
1830304c731SJamie Gritton 
1840e5c6bd4SJamie Gritton /* Make this array full-size so dynamic parameters can be added. */
1850e5c6bd4SJamie Gritton static struct bool_flags pr_flag_allow[NBBY * NBPW] = {
186672756aaSJamie Gritton 	{"allow.set_hostname", "allow.noset_hostname", PR_ALLOW_SET_HOSTNAME},
187672756aaSJamie Gritton 	{"allow.sysvipc", "allow.nosysvipc", PR_ALLOW_SYSVIPC},
188672756aaSJamie Gritton 	{"allow.raw_sockets", "allow.noraw_sockets", PR_ALLOW_RAW_SOCKETS},
189672756aaSJamie Gritton 	{"allow.chflags", "allow.nochflags", PR_ALLOW_CHFLAGS},
190672756aaSJamie Gritton 	{"allow.mount", "allow.nomount", PR_ALLOW_MOUNT},
191672756aaSJamie Gritton 	{"allow.quotas", "allow.noquotas", PR_ALLOW_QUOTAS},
192672756aaSJamie Gritton 	{"allow.socket_af", "allow.nosocket_af", PR_ALLOW_SOCKET_AF},
193*ccd6ac9fSAntoine Brodin 	{"allow.mlock", "allow.nomlock", PR_ALLOW_MLOCK},
194672756aaSJamie Gritton 	{"allow.reserved_ports", "allow.noreserved_ports",
195672756aaSJamie Gritton 	 PR_ALLOW_RESERVED_PORTS},
1960304c731SJamie Gritton };
197672756aaSJamie Gritton const size_t pr_flag_allow_size = sizeof(pr_flag_allow);
1980304c731SJamie Gritton 
199e28f9b7dSAllan Jude #define	JAIL_DEFAULT_ALLOW		(PR_ALLOW_SET_HOSTNAME | PR_ALLOW_RESERVED_PORTS)
20042bebd82SJamie Gritton #define	JAIL_DEFAULT_ENFORCE_STATFS	2
201bf3db8aaSMartin Matuska #define	JAIL_DEFAULT_DEVFS_RSNUM	0
2020304c731SJamie Gritton static unsigned jail_default_allow = JAIL_DEFAULT_ALLOW;
20342bebd82SJamie Gritton static int jail_default_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS;
2040cc207a6SMartin Matuska static int jail_default_devfs_rsnum = JAIL_DEFAULT_DEVFS_RSNUM;
2050304c731SJamie Gritton #if defined(INET) || defined(INET6)
206e92e0574SJamie Gritton static unsigned jail_max_af_ips = 255;
2070304c731SJamie Gritton #endif
2080304c731SJamie Gritton 
209b96bd95bSIan Lepore /*
210b96bd95bSIan Lepore  * Initialize the parts of prison0 that can't be static-initialized with
211b96bd95bSIan Lepore  * constants.  This is called from proc0_init() after creating thread0 cpuset.
212b96bd95bSIan Lepore  */
213b96bd95bSIan Lepore void
214b96bd95bSIan Lepore prison0_init(void)
215b96bd95bSIan Lepore {
216b96bd95bSIan Lepore 
217b96bd95bSIan Lepore 	prison0.pr_cpuset = cpuset_ref(thread0.td_cpuset);
218b96bd95bSIan Lepore 	prison0.pr_osreldate = osreldate;
219b96bd95bSIan Lepore 	strlcpy(prison0.pr_osrelease, osrelease, sizeof(prison0.pr_osrelease));
220b96bd95bSIan Lepore }
221b96bd95bSIan Lepore 
222116734c4SMatthew Dillon /*
2239ddb7954SMike Barcroft  * struct jail_args {
2249ddb7954SMike Barcroft  *	struct jail *jail;
2259ddb7954SMike Barcroft  * };
226116734c4SMatthew Dillon  */
22775c13541SPoul-Henning Kamp int
2288451d0ddSKip Macy sys_jail(struct thread *td, struct jail_args *uap)
22975c13541SPoul-Henning Kamp {
230413628a7SBjoern A. Zeeb 	uint32_t version;
231413628a7SBjoern A. Zeeb 	int error;
2320304c731SJamie Gritton 	struct jail j;
233413628a7SBjoern A. Zeeb 
234413628a7SBjoern A. Zeeb 	error = copyin(uap->jail, &version, sizeof(uint32_t));
235413628a7SBjoern A. Zeeb 	if (error)
236413628a7SBjoern A. Zeeb 		return (error);
237413628a7SBjoern A. Zeeb 
238413628a7SBjoern A. Zeeb 	switch (version) {
239413628a7SBjoern A. Zeeb 	case 0:
240413628a7SBjoern A. Zeeb 	{
241413628a7SBjoern A. Zeeb 		struct jail_v0 j0;
242413628a7SBjoern A. Zeeb 
2430304c731SJamie Gritton 		/* FreeBSD single IPv4 jails. */
2440304c731SJamie Gritton 		bzero(&j, sizeof(struct jail));
245413628a7SBjoern A. Zeeb 		error = copyin(uap->jail, &j0, sizeof(struct jail_v0));
246413628a7SBjoern A. Zeeb 		if (error)
247413628a7SBjoern A. Zeeb 			return (error);
2480304c731SJamie Gritton 		j.version = j0.version;
2490304c731SJamie Gritton 		j.path = j0.path;
2500304c731SJamie Gritton 		j.hostname = j0.hostname;
251b5019bc4SPeter Wemm 		j.ip4s = htonl(j0.ip_number);	/* jail_v0 is host order */
252413628a7SBjoern A. Zeeb 		break;
253413628a7SBjoern A. Zeeb 	}
254413628a7SBjoern A. Zeeb 
255413628a7SBjoern A. Zeeb 	case 1:
256413628a7SBjoern A. Zeeb 		/*
257413628a7SBjoern A. Zeeb 		 * Version 1 was used by multi-IPv4 jail implementations
258413628a7SBjoern A. Zeeb 		 * that never made it into the official kernel.
259413628a7SBjoern A. Zeeb 		 */
260413628a7SBjoern A. Zeeb 		return (EINVAL);
261413628a7SBjoern A. Zeeb 
262413628a7SBjoern A. Zeeb 	case 2:	/* JAIL_API_VERSION */
263413628a7SBjoern A. Zeeb 		/* FreeBSD multi-IPv4/IPv6,noIP jails. */
264413628a7SBjoern A. Zeeb 		error = copyin(uap->jail, &j, sizeof(struct jail));
265413628a7SBjoern A. Zeeb 		if (error)
266413628a7SBjoern A. Zeeb 			return (error);
2670304c731SJamie Gritton 		break;
2680304c731SJamie Gritton 
2690304c731SJamie Gritton 	default:
2700304c731SJamie Gritton 		/* Sci-Fi jails are not supported, sorry. */
2710304c731SJamie Gritton 		return (EINVAL);
2720304c731SJamie Gritton 	}
2730304c731SJamie Gritton 	return (kern_jail(td, &j));
2740304c731SJamie Gritton }
2750304c731SJamie Gritton 
2760304c731SJamie Gritton int
2770304c731SJamie Gritton kern_jail(struct thread *td, struct jail *j)
2780304c731SJamie Gritton {
279672756aaSJamie Gritton 	struct iovec optiov[2 * (4 + nitems(pr_flag_allow)
280e92e0574SJamie Gritton #ifdef INET
281e92e0574SJamie Gritton 			    + 1
282e92e0574SJamie Gritton #endif
283e92e0574SJamie Gritton #ifdef INET6
284e92e0574SJamie Gritton 			    + 1
285e92e0574SJamie Gritton #endif
286e92e0574SJamie Gritton 			    )];
2870304c731SJamie Gritton 	struct uio opt;
2880304c731SJamie Gritton 	char *u_path, *u_hostname, *u_name;
289672756aaSJamie Gritton 	struct bool_flags *bf;
2900304c731SJamie Gritton #ifdef INET
291e92e0574SJamie Gritton 	uint32_t ip4s;
2920304c731SJamie Gritton 	struct in_addr *u_ip4;
2930304c731SJamie Gritton #endif
2940304c731SJamie Gritton #ifdef INET6
2950304c731SJamie Gritton 	struct in6_addr *u_ip6;
2960304c731SJamie Gritton #endif
2970304c731SJamie Gritton 	size_t tmplen;
298672756aaSJamie Gritton 	int error, enforce_statfs;
2990304c731SJamie Gritton 
3000304c731SJamie Gritton 	bzero(&optiov, sizeof(optiov));
3010304c731SJamie Gritton 	opt.uio_iov = optiov;
3020304c731SJamie Gritton 	opt.uio_iovcnt = 0;
3030304c731SJamie Gritton 	opt.uio_offset = -1;
3040304c731SJamie Gritton 	opt.uio_resid = -1;
3050304c731SJamie Gritton 	opt.uio_segflg = UIO_SYSSPACE;
3060304c731SJamie Gritton 	opt.uio_rw = UIO_READ;
3070304c731SJamie Gritton 	opt.uio_td = td;
3080304c731SJamie Gritton 
3090304c731SJamie Gritton 	/* Set permissions for top-level jails from sysctls. */
3100304c731SJamie Gritton 	if (!jailed(td->td_ucred)) {
311672756aaSJamie Gritton 		for (bf = pr_flag_allow;
3120e5c6bd4SJamie Gritton 		     bf < pr_flag_allow + nitems(pr_flag_allow) &&
3130e5c6bd4SJamie Gritton 			bf->flag != 0;
314672756aaSJamie Gritton 		     bf++) {
315672756aaSJamie Gritton 			optiov[opt.uio_iovcnt].iov_base = __DECONST(char *,
316672756aaSJamie Gritton 			    (jail_default_allow & bf->flag)
317672756aaSJamie Gritton 			    ? bf->name : bf->noname);
3180304c731SJamie Gritton 			optiov[opt.uio_iovcnt].iov_len =
3190304c731SJamie Gritton 			    strlen(optiov[opt.uio_iovcnt].iov_base) + 1;
3200304c731SJamie Gritton 			opt.uio_iovcnt += 2;
3210304c731SJamie Gritton 		}
3220304c731SJamie Gritton 		optiov[opt.uio_iovcnt].iov_base = "enforce_statfs";
3230304c731SJamie Gritton 		optiov[opt.uio_iovcnt].iov_len = sizeof("enforce_statfs");
3240304c731SJamie Gritton 		opt.uio_iovcnt++;
3250304c731SJamie Gritton 		enforce_statfs = jail_default_enforce_statfs;
3260304c731SJamie Gritton 		optiov[opt.uio_iovcnt].iov_base = &enforce_statfs;
3270304c731SJamie Gritton 		optiov[opt.uio_iovcnt].iov_len = sizeof(enforce_statfs);
3280304c731SJamie Gritton 		opt.uio_iovcnt++;
3290304c731SJamie Gritton 	}
3300304c731SJamie Gritton 
331b38ff370SJamie Gritton 	tmplen = MAXPATHLEN + MAXHOSTNAMELEN + MAXHOSTNAMELEN;
332b38ff370SJamie Gritton #ifdef INET
3330304c731SJamie Gritton 	ip4s = (j->version == 0) ? 1 : j->ip4s;
3340304c731SJamie Gritton 	if (ip4s > jail_max_af_ips)
335b38ff370SJamie Gritton 		return (EINVAL);
3360304c731SJamie Gritton 	tmplen += ip4s * sizeof(struct in_addr);
337b38ff370SJamie Gritton #else
3380304c731SJamie Gritton 	if (j->ip4s > 0)
339b38ff370SJamie Gritton 		return (EINVAL);
340b38ff370SJamie Gritton #endif
341b38ff370SJamie Gritton #ifdef INET6
3420304c731SJamie Gritton 	if (j->ip6s > jail_max_af_ips)
343b38ff370SJamie Gritton 		return (EINVAL);
3440304c731SJamie Gritton 	tmplen += j->ip6s * sizeof(struct in6_addr);
345b38ff370SJamie Gritton #else
3460304c731SJamie Gritton 	if (j->ip6s > 0)
347b38ff370SJamie Gritton 		return (EINVAL);
348b38ff370SJamie Gritton #endif
349b38ff370SJamie Gritton 	u_path = malloc(tmplen, M_TEMP, M_WAITOK);
350b38ff370SJamie Gritton 	u_hostname = u_path + MAXPATHLEN;
351b38ff370SJamie Gritton 	u_name = u_hostname + MAXHOSTNAMELEN;
352b38ff370SJamie Gritton #ifdef INET
353b38ff370SJamie Gritton 	u_ip4 = (struct in_addr *)(u_name + MAXHOSTNAMELEN);
354b38ff370SJamie Gritton #endif
355b38ff370SJamie Gritton #ifdef INET6
356b38ff370SJamie Gritton #ifdef INET
3570304c731SJamie Gritton 	u_ip6 = (struct in6_addr *)(u_ip4 + ip4s);
358b38ff370SJamie Gritton #else
359b38ff370SJamie Gritton 	u_ip6 = (struct in6_addr *)(u_name + MAXHOSTNAMELEN);
360b38ff370SJamie Gritton #endif
361b38ff370SJamie Gritton #endif
3620304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = "path";
3630304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = sizeof("path");
3640304c731SJamie Gritton 	opt.uio_iovcnt++;
3650304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = u_path;
3660304c731SJamie Gritton 	error = copyinstr(j->path, u_path, MAXPATHLEN,
3670304c731SJamie Gritton 	    &optiov[opt.uio_iovcnt].iov_len);
368b38ff370SJamie Gritton 	if (error) {
369b38ff370SJamie Gritton 		free(u_path, M_TEMP);
370b38ff370SJamie Gritton 		return (error);
371b38ff370SJamie Gritton 	}
3720304c731SJamie Gritton 	opt.uio_iovcnt++;
3730304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = "host.hostname";
3740304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = sizeof("host.hostname");
3750304c731SJamie Gritton 	opt.uio_iovcnt++;
3760304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = u_hostname;
3770304c731SJamie Gritton 	error = copyinstr(j->hostname, u_hostname, MAXHOSTNAMELEN,
3780304c731SJamie Gritton 	    &optiov[opt.uio_iovcnt].iov_len);
379b38ff370SJamie Gritton 	if (error) {
380b38ff370SJamie Gritton 		free(u_path, M_TEMP);
381b38ff370SJamie Gritton 		return (error);
382b38ff370SJamie Gritton 	}
3830304c731SJamie Gritton 	opt.uio_iovcnt++;
3840304c731SJamie Gritton 	if (j->jailname != NULL) {
385b38ff370SJamie Gritton 		optiov[opt.uio_iovcnt].iov_base = "name";
386b38ff370SJamie Gritton 		optiov[opt.uio_iovcnt].iov_len = sizeof("name");
387b38ff370SJamie Gritton 		opt.uio_iovcnt++;
388b38ff370SJamie Gritton 		optiov[opt.uio_iovcnt].iov_base = u_name;
3890304c731SJamie Gritton 		error = copyinstr(j->jailname, u_name, MAXHOSTNAMELEN,
390b38ff370SJamie Gritton 		    &optiov[opt.uio_iovcnt].iov_len);
391b38ff370SJamie Gritton 		if (error) {
392b38ff370SJamie Gritton 			free(u_path, M_TEMP);
393b38ff370SJamie Gritton 			return (error);
394b38ff370SJamie Gritton 		}
395b38ff370SJamie Gritton 		opt.uio_iovcnt++;
396b38ff370SJamie Gritton 	}
397b38ff370SJamie Gritton #ifdef INET
398b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = "ip4.addr";
399b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = sizeof("ip4.addr");
400b38ff370SJamie Gritton 	opt.uio_iovcnt++;
401b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = u_ip4;
4020304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = ip4s * sizeof(struct in_addr);
4030304c731SJamie Gritton 	if (j->version == 0)
4040304c731SJamie Gritton 		u_ip4->s_addr = j->ip4s;
4050304c731SJamie Gritton 	else {
4060304c731SJamie Gritton 		error = copyin(j->ip4, u_ip4, optiov[opt.uio_iovcnt].iov_len);
407b38ff370SJamie Gritton 		if (error) {
408b38ff370SJamie Gritton 			free(u_path, M_TEMP);
409b38ff370SJamie Gritton 			return (error);
410b38ff370SJamie Gritton 		}
4110304c731SJamie Gritton 	}
412b38ff370SJamie Gritton 	opt.uio_iovcnt++;
413b38ff370SJamie Gritton #endif
414b38ff370SJamie Gritton #ifdef INET6
415b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = "ip6.addr";
416b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = sizeof("ip6.addr");
417b38ff370SJamie Gritton 	opt.uio_iovcnt++;
418b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = u_ip6;
4190304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = j->ip6s * sizeof(struct in6_addr);
4200304c731SJamie Gritton 	error = copyin(j->ip6, u_ip6, optiov[opt.uio_iovcnt].iov_len);
421b38ff370SJamie Gritton 	if (error) {
422b38ff370SJamie Gritton 		free(u_path, M_TEMP);
423b38ff370SJamie Gritton 		return (error);
424b38ff370SJamie Gritton 	}
425b38ff370SJamie Gritton 	opt.uio_iovcnt++;
426b38ff370SJamie Gritton #endif
42702abd400SPedro F. Giffuni 	KASSERT(opt.uio_iovcnt <= nitems(optiov),
4280304c731SJamie Gritton 		("kern_jail: too many iovecs (%d)", opt.uio_iovcnt));
429b38ff370SJamie Gritton 	error = kern_jail_set(td, &opt, JAIL_CREATE | JAIL_ATTACH);
430b38ff370SJamie Gritton 	free(u_path, M_TEMP);
431b38ff370SJamie Gritton 	return (error);
432b38ff370SJamie Gritton }
433b38ff370SJamie Gritton 
4340304c731SJamie Gritton 
435b38ff370SJamie Gritton /*
436b38ff370SJamie Gritton  * struct jail_set_args {
437b38ff370SJamie Gritton  *	struct iovec *iovp;
438b38ff370SJamie Gritton  *	unsigned int iovcnt;
439b38ff370SJamie Gritton  *	int flags;
440b38ff370SJamie Gritton  * };
441b38ff370SJamie Gritton  */
442b38ff370SJamie Gritton int
4438451d0ddSKip Macy sys_jail_set(struct thread *td, struct jail_set_args *uap)
444b38ff370SJamie Gritton {
445b38ff370SJamie Gritton 	struct uio *auio;
446b38ff370SJamie Gritton 	int error;
447b38ff370SJamie Gritton 
448b38ff370SJamie Gritton 	/* Check that we have an even number of iovecs. */
449b38ff370SJamie Gritton 	if (uap->iovcnt & 1)
450b38ff370SJamie Gritton 		return (EINVAL);
451b38ff370SJamie Gritton 
452b38ff370SJamie Gritton 	error = copyinuio(uap->iovp, uap->iovcnt, &auio);
453b38ff370SJamie Gritton 	if (error)
454b38ff370SJamie Gritton 		return (error);
455b38ff370SJamie Gritton 	error = kern_jail_set(td, auio, uap->flags);
456b38ff370SJamie Gritton 	free(auio, M_IOV);
457b38ff370SJamie Gritton 	return (error);
458413628a7SBjoern A. Zeeb }
459413628a7SBjoern A. Zeeb 
460413628a7SBjoern A. Zeeb int
461b38ff370SJamie Gritton kern_jail_set(struct thread *td, struct uio *optuio, int flags)
462413628a7SBjoern A. Zeeb {
463fd7a8150SMike Barcroft 	struct nameidata nd;
464b38ff370SJamie Gritton #ifdef INET
465b38ff370SJamie Gritton 	struct in_addr *ip4;
466413628a7SBjoern A. Zeeb #endif
467b38ff370SJamie Gritton #ifdef INET6
468b38ff370SJamie Gritton 	struct in6_addr *ip6;
469b38ff370SJamie Gritton #endif
470b38ff370SJamie Gritton 	struct vfsopt *opt;
471b38ff370SJamie Gritton 	struct vfsoptlist *opts;
47257aea6dfSBjoern A. Zeeb 	struct prison *pr, *deadpr, *mypr, *ppr, *tpr;
473b38ff370SJamie Gritton 	struct vnode *root;
474babbbb9cSJamie Gritton 	char *domain, *errmsg, *host, *name, *namelc, *p, *path, *uuid;
475b96bd95bSIan Lepore 	char *g_path, *osrelstr;
476672756aaSJamie Gritton 	struct bool_flags *bf;
477672756aaSJamie Gritton 	struct jailsys_flags *jsf;
4780304c731SJamie Gritton #if defined(INET) || defined(INET6)
47957aea6dfSBjoern A. Zeeb 	struct prison *tppr;
480b38ff370SJamie Gritton 	void *op;
4810304c731SJamie Gritton #endif
48276ca6f88SJamie Gritton 	unsigned long hid;
483b6f47c23SJamie Gritton 	size_t namelen, onamelen, pnamelen;
484cc5fd8c7SJamie Gritton 	int born, created, cuflags, descend, enforce;
485cc5fd8c7SJamie Gritton 	int error, errmsg_len, errmsg_pos;
4860cc207a6SMartin Matuska 	int gotchildmax, gotenforce, gothid, gotrsnum, gotslevel;
487672756aaSJamie Gritton 	int jid, jsys, len, level;
488b96bd95bSIan Lepore 	int childmax, osreldt, rsnum, slevel;
489f6e633a9SMartin Matuska 	int fullpath_disabled;
490d465a41dSBjoern A. Zeeb #if defined(INET) || defined(INET6)
4910304c731SJamie Gritton 	int ii, ij;
492413628a7SBjoern A. Zeeb #endif
493413628a7SBjoern A. Zeeb #ifdef INET
4942b0d6f81SJamie Gritton 	int ip4s, redo_ip4;
495413628a7SBjoern A. Zeeb #endif
496b38ff370SJamie Gritton #ifdef INET6
4972b0d6f81SJamie Gritton 	int ip6s, redo_ip6;
498b38ff370SJamie Gritton #endif
4996beb3bb4SKirk McKusick 	uint64_t pr_allow, ch_allow, pr_flags, ch_flags;
5006beb3bb4SKirk McKusick 	unsigned tallow;
501b38ff370SJamie Gritton 	char numbuf[12];
502b38ff370SJamie Gritton 
503b38ff370SJamie Gritton 	error = priv_check(td, PRIV_JAIL_SET);
504b38ff370SJamie Gritton 	if (!error && (flags & JAIL_ATTACH))
505b38ff370SJamie Gritton 		error = priv_check(td, PRIV_JAIL_ATTACH);
506b38ff370SJamie Gritton 	if (error)
50775c13541SPoul-Henning Kamp 		return (error);
508b6f47c23SJamie Gritton 	mypr = td->td_ucred->cr_prison;
509b97457e2SJamie Gritton 	if ((flags & JAIL_CREATE) && mypr->pr_childmax == 0)
5100304c731SJamie Gritton 		return (EPERM);
511b38ff370SJamie Gritton 	if (flags & ~JAIL_SET_MASK)
512b38ff370SJamie Gritton 		return (EINVAL);
513b38ff370SJamie Gritton 
514b38ff370SJamie Gritton 	/*
515b38ff370SJamie Gritton 	 * Check all the parameters before committing to anything.  Not all
516b38ff370SJamie Gritton 	 * errors can be caught early, but we may as well try.  Also, this
517b38ff370SJamie Gritton 	 * takes care of some expensive stuff (path lookup) before getting
518b38ff370SJamie Gritton 	 * the allprison lock.
519b38ff370SJamie Gritton 	 *
520b38ff370SJamie Gritton 	 * XXX Jails are not filesystems, and jail parameters are not mount
521b38ff370SJamie Gritton 	 *     options.  But it makes more sense to re-use the vfsopt code
522b38ff370SJamie Gritton 	 *     than duplicate it under a different name.
523b38ff370SJamie Gritton 	 */
524b38ff370SJamie Gritton 	error = vfs_buildopts(optuio, &opts);
525b38ff370SJamie Gritton 	if (error)
526b38ff370SJamie Gritton 		return (error);
527b38ff370SJamie Gritton #ifdef INET
528b38ff370SJamie Gritton 	ip4 = NULL;
529b38ff370SJamie Gritton #endif
530b38ff370SJamie Gritton #ifdef INET6
531b38ff370SJamie Gritton 	ip6 = NULL;
532b38ff370SJamie Gritton #endif
5336dfe0a3dSMartin Matuska 	g_path = NULL;
534b38ff370SJamie Gritton 
535b6f47c23SJamie Gritton 	cuflags = flags & (JAIL_CREATE | JAIL_UPDATE);
536b6f47c23SJamie Gritton 	if (!cuflags) {
537b6f47c23SJamie Gritton 		error = EINVAL;
538b6f47c23SJamie Gritton 		vfs_opterror(opts, "no valid operation (create or update)");
539b6f47c23SJamie Gritton 		goto done_errmsg;
540b6f47c23SJamie Gritton 	}
541b6f47c23SJamie Gritton 
542b38ff370SJamie Gritton 	error = vfs_copyopt(opts, "jid", &jid, sizeof(jid));
543b38ff370SJamie Gritton 	if (error == ENOENT)
544b38ff370SJamie Gritton 		jid = 0;
545b38ff370SJamie Gritton 	else if (error != 0)
546b38ff370SJamie Gritton 		goto done_free;
547b38ff370SJamie Gritton 
548b38ff370SJamie Gritton 	error = vfs_copyopt(opts, "securelevel", &slevel, sizeof(slevel));
549b38ff370SJamie Gritton 	if (error == ENOENT)
550b38ff370SJamie Gritton 		gotslevel = 0;
551b38ff370SJamie Gritton 	else if (error != 0)
552b38ff370SJamie Gritton 		goto done_free;
553b38ff370SJamie Gritton 	else
554b38ff370SJamie Gritton 		gotslevel = 1;
555b38ff370SJamie Gritton 
556b97457e2SJamie Gritton 	error =
557b97457e2SJamie Gritton 	    vfs_copyopt(opts, "children.max", &childmax, sizeof(childmax));
558b97457e2SJamie Gritton 	if (error == ENOENT)
559b97457e2SJamie Gritton 		gotchildmax = 0;
560b97457e2SJamie Gritton 	else if (error != 0)
561b97457e2SJamie Gritton 		goto done_free;
562b97457e2SJamie Gritton 	else
563b97457e2SJamie Gritton 		gotchildmax = 1;
564b97457e2SJamie Gritton 
5650304c731SJamie Gritton 	error = vfs_copyopt(opts, "enforce_statfs", &enforce, sizeof(enforce));
566f337198dSJamie Gritton 	if (error == ENOENT)
567f337198dSJamie Gritton 		gotenforce = 0;
568f337198dSJamie Gritton 	else if (error != 0)
5690304c731SJamie Gritton 		goto done_free;
570f337198dSJamie Gritton 	else if (enforce < 0 || enforce > 2) {
571f337198dSJamie Gritton 		error = EINVAL;
572f337198dSJamie Gritton 		goto done_free;
573f337198dSJamie Gritton 	} else
574f337198dSJamie Gritton 		gotenforce = 1;
5750304c731SJamie Gritton 
5760cc207a6SMartin Matuska 	error = vfs_copyopt(opts, "devfs_ruleset", &rsnum, sizeof(rsnum));
5770cc207a6SMartin Matuska 	if (error == ENOENT)
5780cc207a6SMartin Matuska 		gotrsnum = 0;
5790cc207a6SMartin Matuska 	else if (error != 0)
5800cc207a6SMartin Matuska 		goto done_free;
5810cc207a6SMartin Matuska 	else
5820cc207a6SMartin Matuska 		gotrsnum = 1;
5830cc207a6SMartin Matuska 
584b38ff370SJamie Gritton 	pr_flags = ch_flags = 0;
585672756aaSJamie Gritton 	for (bf = pr_flag_bool;
586672756aaSJamie Gritton 	     bf < pr_flag_bool + nitems(pr_flag_bool);
587672756aaSJamie Gritton 	     bf++) {
588672756aaSJamie Gritton 		vfs_flagopt(opts, bf->name, &pr_flags, bf->flag);
589672756aaSJamie Gritton 		vfs_flagopt(opts, bf->noname, &ch_flags, bf->flag);
5900304c731SJamie Gritton 	}
591b38ff370SJamie Gritton 	ch_flags |= pr_flags;
592672756aaSJamie Gritton 	for (jsf = pr_flag_jailsys;
593672756aaSJamie Gritton 	     jsf < pr_flag_jailsys + nitems(pr_flag_jailsys);
594672756aaSJamie Gritton 	     jsf++) {
595672756aaSJamie Gritton 		error = vfs_copyopt(opts, jsf->name, &jsys, sizeof(jsys));
5967cbf7213SJamie Gritton 		if (error == ENOENT)
5977cbf7213SJamie Gritton 			continue;
5987cbf7213SJamie Gritton 		if (error != 0)
5997cbf7213SJamie Gritton 			goto done_free;
6007cbf7213SJamie Gritton 		switch (jsys) {
6017cbf7213SJamie Gritton 		case JAIL_SYS_DISABLE:
602672756aaSJamie Gritton 			if (!jsf->disable) {
6037cbf7213SJamie Gritton 				error = EINVAL;
6047cbf7213SJamie Gritton 				goto done_free;
6057cbf7213SJamie Gritton 			}
606672756aaSJamie Gritton 			pr_flags |= jsf->disable;
6077cbf7213SJamie Gritton 			break;
6087cbf7213SJamie Gritton 		case JAIL_SYS_NEW:
609672756aaSJamie Gritton 			pr_flags |= jsf->new;
6107cbf7213SJamie Gritton 			break;
6117cbf7213SJamie Gritton 		case JAIL_SYS_INHERIT:
6127cbf7213SJamie Gritton 			break;
6137cbf7213SJamie Gritton 		default:
6147cbf7213SJamie Gritton 			error = EINVAL;
6157cbf7213SJamie Gritton 			goto done_free;
6167cbf7213SJamie Gritton 		}
617672756aaSJamie Gritton 		ch_flags |= jsf->new | jsf->disable;
6187cbf7213SJamie Gritton 	}
6194affa14cSJamie Gritton 	if ((flags & (JAIL_CREATE | JAIL_UPDATE | JAIL_ATTACH)) == JAIL_CREATE
6204affa14cSJamie Gritton 	    && !(pr_flags & PR_PERSIST)) {
6214affa14cSJamie Gritton 		error = EINVAL;
6224affa14cSJamie Gritton 		vfs_opterror(opts, "new jail must persist or attach");
6234affa14cSJamie Gritton 		goto done_errmsg;
6244affa14cSJamie Gritton 	}
625679e1390SJamie Gritton #ifdef VIMAGE
626679e1390SJamie Gritton 	if ((flags & JAIL_UPDATE) && (ch_flags & PR_VNET)) {
627679e1390SJamie Gritton 		error = EINVAL;
628679e1390SJamie Gritton 		vfs_opterror(opts, "vnet cannot be changed after creation");
629679e1390SJamie Gritton 		goto done_errmsg;
630679e1390SJamie Gritton 	}
631679e1390SJamie Gritton #endif
6322b0d6f81SJamie Gritton #ifdef INET
6332b0d6f81SJamie Gritton 	if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP4_USER)) {
6342b0d6f81SJamie Gritton 		error = EINVAL;
6352b0d6f81SJamie Gritton 		vfs_opterror(opts, "ip4 cannot be changed after creation");
6362b0d6f81SJamie Gritton 		goto done_errmsg;
6372b0d6f81SJamie Gritton 	}
6382b0d6f81SJamie Gritton #endif
6392b0d6f81SJamie Gritton #ifdef INET6
6402b0d6f81SJamie Gritton 	if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP6_USER)) {
6412b0d6f81SJamie Gritton 		error = EINVAL;
6422b0d6f81SJamie Gritton 		vfs_opterror(opts, "ip6 cannot be changed after creation");
6432b0d6f81SJamie Gritton 		goto done_errmsg;
6442b0d6f81SJamie Gritton 	}
6452b0d6f81SJamie Gritton #endif
646b38ff370SJamie Gritton 
6470304c731SJamie Gritton 	pr_allow = ch_allow = 0;
648672756aaSJamie Gritton 	for (bf = pr_flag_allow;
6490e5c6bd4SJamie Gritton 	     bf < pr_flag_allow + nitems(pr_flag_allow) && bf->flag != 0;
650672756aaSJamie Gritton 	     bf++) {
651672756aaSJamie Gritton 		vfs_flagopt(opts, bf->name, &pr_allow, bf->flag);
652672756aaSJamie Gritton 		vfs_flagopt(opts, bf->noname, &ch_allow, bf->flag);
6530304c731SJamie Gritton 	}
6540304c731SJamie Gritton 	ch_allow |= pr_allow;
6550304c731SJamie Gritton 
656b38ff370SJamie Gritton 	error = vfs_getopt(opts, "name", (void **)&name, &len);
657b38ff370SJamie Gritton 	if (error == ENOENT)
658b38ff370SJamie Gritton 		name = NULL;
659b38ff370SJamie Gritton 	else if (error != 0)
660b38ff370SJamie Gritton 		goto done_free;
661b38ff370SJamie Gritton 	else {
662b38ff370SJamie Gritton 		if (len == 0 || name[len - 1] != '\0') {
663b38ff370SJamie Gritton 			error = EINVAL;
664b38ff370SJamie Gritton 			goto done_free;
665b38ff370SJamie Gritton 		}
666b38ff370SJamie Gritton 		if (len > MAXHOSTNAMELEN) {
667b38ff370SJamie Gritton 			error = ENAMETOOLONG;
668b38ff370SJamie Gritton 			goto done_free;
669b38ff370SJamie Gritton 		}
670b38ff370SJamie Gritton 	}
671b38ff370SJamie Gritton 
672b38ff370SJamie Gritton 	error = vfs_getopt(opts, "host.hostname", (void **)&host, &len);
673b38ff370SJamie Gritton 	if (error == ENOENT)
674b38ff370SJamie Gritton 		host = NULL;
675b38ff370SJamie Gritton 	else if (error != 0)
676b38ff370SJamie Gritton 		goto done_free;
677b38ff370SJamie Gritton 	else {
67876ca6f88SJamie Gritton 		ch_flags |= PR_HOST;
67976ca6f88SJamie Gritton 		pr_flags |= PR_HOST;
680b38ff370SJamie Gritton 		if (len == 0 || host[len - 1] != '\0') {
681b38ff370SJamie Gritton 			error = EINVAL;
682b38ff370SJamie Gritton 			goto done_free;
683b38ff370SJamie Gritton 		}
684b38ff370SJamie Gritton 		if (len > MAXHOSTNAMELEN) {
685b38ff370SJamie Gritton 			error = ENAMETOOLONG;
686b38ff370SJamie Gritton 			goto done_free;
687b38ff370SJamie Gritton 		}
688b38ff370SJamie Gritton 	}
689b38ff370SJamie Gritton 
69076ca6f88SJamie Gritton 	error = vfs_getopt(opts, "host.domainname", (void **)&domain, &len);
69176ca6f88SJamie Gritton 	if (error == ENOENT)
69276ca6f88SJamie Gritton 		domain = NULL;
69376ca6f88SJamie Gritton 	else if (error != 0)
69476ca6f88SJamie Gritton 		goto done_free;
69576ca6f88SJamie Gritton 	else {
69676ca6f88SJamie Gritton 		ch_flags |= PR_HOST;
69776ca6f88SJamie Gritton 		pr_flags |= PR_HOST;
69876ca6f88SJamie Gritton 		if (len == 0 || domain[len - 1] != '\0') {
69976ca6f88SJamie Gritton 			error = EINVAL;
70076ca6f88SJamie Gritton 			goto done_free;
70176ca6f88SJamie Gritton 		}
70276ca6f88SJamie Gritton 		if (len > MAXHOSTNAMELEN) {
70376ca6f88SJamie Gritton 			error = ENAMETOOLONG;
70476ca6f88SJamie Gritton 			goto done_free;
70576ca6f88SJamie Gritton 		}
70676ca6f88SJamie Gritton 	}
70776ca6f88SJamie Gritton 
70876ca6f88SJamie Gritton 	error = vfs_getopt(opts, "host.hostuuid", (void **)&uuid, &len);
70976ca6f88SJamie Gritton 	if (error == ENOENT)
71076ca6f88SJamie Gritton 		uuid = NULL;
71176ca6f88SJamie Gritton 	else if (error != 0)
71276ca6f88SJamie Gritton 		goto done_free;
71376ca6f88SJamie Gritton 	else {
71476ca6f88SJamie Gritton 		ch_flags |= PR_HOST;
71576ca6f88SJamie Gritton 		pr_flags |= PR_HOST;
71676ca6f88SJamie Gritton 		if (len == 0 || uuid[len - 1] != '\0') {
71776ca6f88SJamie Gritton 			error = EINVAL;
71876ca6f88SJamie Gritton 			goto done_free;
71976ca6f88SJamie Gritton 		}
72076ca6f88SJamie Gritton 		if (len > HOSTUUIDLEN) {
72176ca6f88SJamie Gritton 			error = ENAMETOOLONG;
72276ca6f88SJamie Gritton 			goto done_free;
72376ca6f88SJamie Gritton 		}
72476ca6f88SJamie Gritton 	}
72576ca6f88SJamie Gritton 
726841c0c7eSNathan Whitehorn #ifdef COMPAT_FREEBSD32
727a5c1afadSDmitry Chagin 	if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) {
72876ca6f88SJamie Gritton 		uint32_t hid32;
72976ca6f88SJamie Gritton 
73076ca6f88SJamie Gritton 		error = vfs_copyopt(opts, "host.hostid", &hid32, sizeof(hid32));
73176ca6f88SJamie Gritton 		hid = hid32;
73276ca6f88SJamie Gritton 	} else
73376ca6f88SJamie Gritton #endif
73476ca6f88SJamie Gritton 		error = vfs_copyopt(opts, "host.hostid", &hid, sizeof(hid));
73576ca6f88SJamie Gritton 	if (error == ENOENT)
73676ca6f88SJamie Gritton 		gothid = 0;
73776ca6f88SJamie Gritton 	else if (error != 0)
73876ca6f88SJamie Gritton 		goto done_free;
73976ca6f88SJamie Gritton 	else {
74076ca6f88SJamie Gritton 		gothid = 1;
74176ca6f88SJamie Gritton 		ch_flags |= PR_HOST;
74276ca6f88SJamie Gritton 		pr_flags |= PR_HOST;
74376ca6f88SJamie Gritton 	}
74476ca6f88SJamie Gritton 
745b38ff370SJamie Gritton #ifdef INET
746b38ff370SJamie Gritton 	error = vfs_getopt(opts, "ip4.addr", &op, &ip4s);
747b38ff370SJamie Gritton 	if (error == ENOENT)
7480e5e396eSJamie Gritton 		ip4s = 0;
749b38ff370SJamie Gritton 	else if (error != 0)
750b38ff370SJamie Gritton 		goto done_free;
751b38ff370SJamie Gritton 	else if (ip4s & (sizeof(*ip4) - 1)) {
752b38ff370SJamie Gritton 		error = EINVAL;
753b38ff370SJamie Gritton 		goto done_free;
7540304c731SJamie Gritton 	} else {
7556a3f2779SJamie Gritton 		ch_flags |= PR_IP4_USER;
7566a3f2779SJamie Gritton 		pr_flags |= PR_IP4_USER;
7576a3f2779SJamie Gritton 		if (ip4s > 0) {
758b38ff370SJamie Gritton 			ip4s /= sizeof(*ip4);
759b38ff370SJamie Gritton 			if (ip4s > jail_max_af_ips) {
760b38ff370SJamie Gritton 				error = EINVAL;
761b38ff370SJamie Gritton 				vfs_opterror(opts, "too many IPv4 addresses");
762b38ff370SJamie Gritton 				goto done_errmsg;
763b38ff370SJamie Gritton 			}
7642b0d6f81SJamie Gritton 			ip4 = malloc(ip4s * sizeof(*ip4), M_PRISON, M_WAITOK);
765b38ff370SJamie Gritton 			bcopy(op, ip4, ip4s * sizeof(*ip4));
766b38ff370SJamie Gritton 			/*
7670304c731SJamie Gritton 			 * IP addresses are all sorted but ip[0] to preserve
7680304c731SJamie Gritton 			 * the primary IP address as given from userland.
7690304c731SJamie Gritton 			 * This special IP is used for unbound outgoing
770bef916f9SBjoern A. Zeeb 			 * connections as well for "loopback" traffic in case
771bef916f9SBjoern A. Zeeb 			 * source address selection cannot find any more fitting
772bef916f9SBjoern A. Zeeb 			 * address to connect from.
773b38ff370SJamie Gritton 			 */
774b38ff370SJamie Gritton 			if (ip4s > 1)
7750ce1624dSStephen J. Kiernan 				qsort(ip4 + 1, ip4s - 1, sizeof(*ip4),
7760ce1624dSStephen J. Kiernan 				    prison_qcmp_v4);
777b38ff370SJamie Gritton 			/*
7780304c731SJamie Gritton 			 * Check for duplicate addresses and do some simple
7790304c731SJamie Gritton 			 * zero and broadcast checks. If users give other bogus
7800304c731SJamie Gritton 			 * addresses it is their problem.
781b38ff370SJamie Gritton 			 *
7820304c731SJamie Gritton 			 * We do not have to care about byte order for these
7830304c731SJamie Gritton 			 * checks so we will do them in NBO.
784b38ff370SJamie Gritton 			 */
785b38ff370SJamie Gritton 			for (ii = 0; ii < ip4s; ii++) {
786b38ff370SJamie Gritton 				if (ip4[ii].s_addr == INADDR_ANY ||
787b38ff370SJamie Gritton 				    ip4[ii].s_addr == INADDR_BROADCAST) {
788b38ff370SJamie Gritton 					error = EINVAL;
789b38ff370SJamie Gritton 					goto done_free;
790b38ff370SJamie Gritton 				}
791b38ff370SJamie Gritton 				if ((ii+1) < ip4s &&
792b38ff370SJamie Gritton 				    (ip4[0].s_addr == ip4[ii+1].s_addr ||
793b38ff370SJamie Gritton 				     ip4[ii].s_addr == ip4[ii+1].s_addr)) {
794b38ff370SJamie Gritton 					error = EINVAL;
795b38ff370SJamie Gritton 					goto done_free;
796b38ff370SJamie Gritton 				}
797b38ff370SJamie Gritton 			}
798b38ff370SJamie Gritton 		}
7990304c731SJamie Gritton 	}
800b38ff370SJamie Gritton #endif
801b38ff370SJamie Gritton 
802b38ff370SJamie Gritton #ifdef INET6
803b38ff370SJamie Gritton 	error = vfs_getopt(opts, "ip6.addr", &op, &ip6s);
804b38ff370SJamie Gritton 	if (error == ENOENT)
8050e5e396eSJamie Gritton 		ip6s = 0;
806b38ff370SJamie Gritton 	else if (error != 0)
807b38ff370SJamie Gritton 		goto done_free;
808b38ff370SJamie Gritton 	else if (ip6s & (sizeof(*ip6) - 1)) {
809b38ff370SJamie Gritton 		error = EINVAL;
810b38ff370SJamie Gritton 		goto done_free;
8110304c731SJamie Gritton 	} else {
8126a3f2779SJamie Gritton 		ch_flags |= PR_IP6_USER;
8136a3f2779SJamie Gritton 		pr_flags |= PR_IP6_USER;
8146a3f2779SJamie Gritton 		if (ip6s > 0) {
815b38ff370SJamie Gritton 			ip6s /= sizeof(*ip6);
816b38ff370SJamie Gritton 			if (ip6s > jail_max_af_ips) {
817b38ff370SJamie Gritton 				error = EINVAL;
818b38ff370SJamie Gritton 				vfs_opterror(opts, "too many IPv6 addresses");
819b38ff370SJamie Gritton 				goto done_errmsg;
820b38ff370SJamie Gritton 			}
8212b0d6f81SJamie Gritton 			ip6 = malloc(ip6s * sizeof(*ip6), M_PRISON, M_WAITOK);
822b38ff370SJamie Gritton 			bcopy(op, ip6, ip6s * sizeof(*ip6));
823b38ff370SJamie Gritton 			if (ip6s > 1)
8240ce1624dSStephen J. Kiernan 				qsort(ip6 + 1, ip6s - 1, sizeof(*ip6),
8250ce1624dSStephen J. Kiernan 				    prison_qcmp_v6);
826b38ff370SJamie Gritton 			for (ii = 0; ii < ip6s; ii++) {
8270304c731SJamie Gritton 				if (IN6_IS_ADDR_UNSPECIFIED(&ip6[ii])) {
828b38ff370SJamie Gritton 					error = EINVAL;
829b38ff370SJamie Gritton 					goto done_free;
830b38ff370SJamie Gritton 				}
831b38ff370SJamie Gritton 				if ((ii+1) < ip6s &&
832b38ff370SJamie Gritton 				    (IN6_ARE_ADDR_EQUAL(&ip6[0], &ip6[ii+1]) ||
833b38ff370SJamie Gritton 				     IN6_ARE_ADDR_EQUAL(&ip6[ii], &ip6[ii+1])))
834b38ff370SJamie Gritton 				{
835b38ff370SJamie Gritton 					error = EINVAL;
836b38ff370SJamie Gritton 					goto done_free;
837b38ff370SJamie Gritton 				}
838b38ff370SJamie Gritton 			}
839b38ff370SJamie Gritton 		}
8400304c731SJamie Gritton 	}
841b38ff370SJamie Gritton #endif
842b38ff370SJamie Gritton 
843bdfc8cc4SJamie Gritton #if defined(VIMAGE) && (defined(INET) || defined(INET6))
844bdfc8cc4SJamie Gritton 	if ((ch_flags & PR_VNET) && (ch_flags & (PR_IP4_USER | PR_IP6_USER))) {
845bdfc8cc4SJamie Gritton 		error = EINVAL;
846bdfc8cc4SJamie Gritton 		vfs_opterror(opts,
847bdfc8cc4SJamie Gritton 		    "vnet jails cannot have IP address restrictions");
848bdfc8cc4SJamie Gritton 		goto done_errmsg;
849bdfc8cc4SJamie Gritton 	}
850bdfc8cc4SJamie Gritton #endif
851bdfc8cc4SJamie Gritton 
852cf0313c6SJamie Gritton 	error = vfs_getopt(opts, "osrelease", (void **)&osrelstr, &len);
853cf0313c6SJamie Gritton 	if (error == ENOENT)
854cf0313c6SJamie Gritton 		osrelstr = NULL;
855cf0313c6SJamie Gritton 	else if (error != 0)
856cf0313c6SJamie Gritton 		goto done_free;
857cf0313c6SJamie Gritton 	else {
858cf0313c6SJamie Gritton 		if (flags & JAIL_UPDATE) {
859cf0313c6SJamie Gritton 			error = EINVAL;
860cf0313c6SJamie Gritton 			vfs_opterror(opts,
861cf0313c6SJamie Gritton 			    "osrelease cannot be changed after creation");
862cf0313c6SJamie Gritton 			goto done_errmsg;
863cf0313c6SJamie Gritton 		}
864cf0313c6SJamie Gritton 		if (len == 0 || len >= OSRELEASELEN) {
865cf0313c6SJamie Gritton 			error = EINVAL;
866cf0313c6SJamie Gritton 			vfs_opterror(opts,
867cf0313c6SJamie Gritton 			    "osrelease string must be 1-%d bytes long",
868cf0313c6SJamie Gritton 			    OSRELEASELEN - 1);
869cf0313c6SJamie Gritton 			goto done_errmsg;
870cf0313c6SJamie Gritton 		}
871cf0313c6SJamie Gritton 	}
872cf0313c6SJamie Gritton 
873cf0313c6SJamie Gritton 	error = vfs_copyopt(opts, "osreldate", &osreldt, sizeof(osreldt));
874cf0313c6SJamie Gritton 	if (error == ENOENT)
875cf0313c6SJamie Gritton 		osreldt = 0;
876cf0313c6SJamie Gritton 	else if (error != 0)
877cf0313c6SJamie Gritton 		goto done_free;
878cf0313c6SJamie Gritton 	else {
879cf0313c6SJamie Gritton 		if (flags & JAIL_UPDATE) {
880cf0313c6SJamie Gritton 			error = EINVAL;
881cf0313c6SJamie Gritton 			vfs_opterror(opts,
882cf0313c6SJamie Gritton 			    "osreldate cannot be changed after creation");
883cf0313c6SJamie Gritton 			goto done_errmsg;
884cf0313c6SJamie Gritton 		}
885cf0313c6SJamie Gritton 		if (osreldt == 0) {
886cf0313c6SJamie Gritton 			error = EINVAL;
887cf0313c6SJamie Gritton 			vfs_opterror(opts, "osreldate cannot be 0");
888cf0313c6SJamie Gritton 			goto done_errmsg;
889cf0313c6SJamie Gritton 		}
890cf0313c6SJamie Gritton 	}
891cf0313c6SJamie Gritton 
8929cbe30e1SMartin Matuska 	fullpath_disabled = 0;
893b38ff370SJamie Gritton 	root = NULL;
894b38ff370SJamie Gritton 	error = vfs_getopt(opts, "path", (void **)&path, &len);
895b38ff370SJamie Gritton 	if (error == ENOENT)
896b38ff370SJamie Gritton 		path = NULL;
897b38ff370SJamie Gritton 	else if (error != 0)
898b38ff370SJamie Gritton 		goto done_free;
899b38ff370SJamie Gritton 	else {
900b38ff370SJamie Gritton 		if (flags & JAIL_UPDATE) {
901b38ff370SJamie Gritton 			error = EINVAL;
902b38ff370SJamie Gritton 			vfs_opterror(opts,
903b38ff370SJamie Gritton 			    "path cannot be changed after creation");
904b38ff370SJamie Gritton 			goto done_errmsg;
905b38ff370SJamie Gritton 		}
906b38ff370SJamie Gritton 		if (len == 0 || path[len - 1] != '\0') {
907b38ff370SJamie Gritton 			error = EINVAL;
908b38ff370SJamie Gritton 			goto done_free;
909b38ff370SJamie Gritton 		}
9105050aa86SKonstantin Belousov 		NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE,
911b38ff370SJamie Gritton 		    path, td);
912b38ff370SJamie Gritton 		error = namei(&nd);
913b38ff370SJamie Gritton 		if (error)
914b38ff370SJamie Gritton 			goto done_free;
915b38ff370SJamie Gritton 		root = nd.ni_vp;
916b38ff370SJamie Gritton 		NDFREE(&nd, NDF_ONLY_PNBUF);
9176dfe0a3dSMartin Matuska 		g_path = malloc(MAXPATHLEN, M_TEMP, M_WAITOK);
9186dfe0a3dSMartin Matuska 		strlcpy(g_path, path, MAXPATHLEN);
9196dfe0a3dSMartin Matuska 		error = vn_path_to_global_path(td, root, g_path, MAXPATHLEN);
9206dfe0a3dSMartin Matuska 		if (error == 0)
9216dfe0a3dSMartin Matuska 			path = g_path;
9226dfe0a3dSMartin Matuska 		else if (error == ENODEV) {
923f6e633a9SMartin Matuska 			/* proceed if sysctl debug.disablefullpath == 1 */
924f6e633a9SMartin Matuska 			fullpath_disabled = 1;
925f6e633a9SMartin Matuska 			if (len < 2 || (len == 2 && path[0] == '/'))
926f6e633a9SMartin Matuska 				path = NULL;
9276dfe0a3dSMartin Matuska 		} else {
928f6e633a9SMartin Matuska 			/* exit on other errors */
929b38ff370SJamie Gritton 			goto done_free;
930b38ff370SJamie Gritton 		}
931f6e633a9SMartin Matuska 		if (root->v_type != VDIR) {
932f6e633a9SMartin Matuska 			error = ENOTDIR;
933f6e633a9SMartin Matuska 			vput(root);
934f6e633a9SMartin Matuska 			goto done_free;
935f6e633a9SMartin Matuska 		}
936f6e633a9SMartin Matuska 		VOP_UNLOCK(root, 0);
937f6e633a9SMartin Matuska 		if (fullpath_disabled) {
938f6e633a9SMartin Matuska 			/* Leave room for a real-root full pathname. */
939f6e633a9SMartin Matuska 			if (len + (path[0] == '/' && strcmp(mypr->pr_path, "/")
940f6e633a9SMartin Matuska 			    ? strlen(mypr->pr_path) : 0) > MAXPATHLEN) {
941f6e633a9SMartin Matuska 				error = ENAMETOOLONG;
942932a6e43SJamie Gritton 				vrele(root);
943f6e633a9SMartin Matuska 				goto done_free;
944f6e633a9SMartin Matuska 			}
945b38ff370SJamie Gritton 		}
946b38ff370SJamie Gritton 	}
947b38ff370SJamie Gritton 
948b38ff370SJamie Gritton 	/*
949b6f47c23SJamie Gritton 	 * Find the specified jail, or at least its parent.
950b38ff370SJamie Gritton 	 * This abuses the file error codes ENOENT and EEXIST.
951b38ff370SJamie Gritton 	 */
952b38ff370SJamie Gritton 	pr = NULL;
953b6f47c23SJamie Gritton 	ppr = mypr;
954babbbb9cSJamie Gritton 	if (cuflags == JAIL_CREATE && jid == 0 && name != NULL) {
955babbbb9cSJamie Gritton 		namelc = strrchr(name, '.');
956babbbb9cSJamie Gritton 		jid = strtoul(namelc != NULL ? namelc + 1 : name, &p, 10);
957babbbb9cSJamie Gritton 		if (*p != '\0')
958babbbb9cSJamie Gritton 			jid = 0;
959babbbb9cSJamie Gritton 	}
960b6f47c23SJamie Gritton 	sx_xlock(&allprison_lock);
961b38ff370SJamie Gritton 	if (jid != 0) {
9620304c731SJamie Gritton 		/*
9630304c731SJamie Gritton 		 * See if a requested jid already exists.  There is an
9640304c731SJamie Gritton 		 * information leak here if the jid exists but is not within
9650304c731SJamie Gritton 		 * the caller's jail hierarchy.  Jail creators will get EEXIST
9660304c731SJamie Gritton 		 * even though they cannot see the jail, and CREATE | UPDATE
9670304c731SJamie Gritton 		 * will return ENOENT which is not normally a valid error.
9680304c731SJamie Gritton 		 */
969b38ff370SJamie Gritton 		if (jid < 0) {
970b38ff370SJamie Gritton 			error = EINVAL;
971b38ff370SJamie Gritton 			vfs_opterror(opts, "negative jid");
972b38ff370SJamie Gritton 			goto done_unlock_list;
973b38ff370SJamie Gritton 		}
974b38ff370SJamie Gritton 		pr = prison_find(jid);
975b38ff370SJamie Gritton 		if (pr != NULL) {
9760304c731SJamie Gritton 			ppr = pr->pr_parent;
977b38ff370SJamie Gritton 			/* Create: jid must not exist. */
978b38ff370SJamie Gritton 			if (cuflags == JAIL_CREATE) {
979b38ff370SJamie Gritton 				mtx_unlock(&pr->pr_mtx);
980b38ff370SJamie Gritton 				error = EEXIST;
981b38ff370SJamie Gritton 				vfs_opterror(opts, "jail %d already exists",
982b38ff370SJamie Gritton 				    jid);
983b38ff370SJamie Gritton 				goto done_unlock_list;
984b38ff370SJamie Gritton 			}
9850304c731SJamie Gritton 			if (!prison_ischild(mypr, pr)) {
9860304c731SJamie Gritton 				mtx_unlock(&pr->pr_mtx);
9870304c731SJamie Gritton 				pr = NULL;
9880304c731SJamie Gritton 			} else if (pr->pr_uref == 0) {
989b38ff370SJamie Gritton 				if (!(flags & JAIL_DYING)) {
990b38ff370SJamie Gritton 					mtx_unlock(&pr->pr_mtx);
991b38ff370SJamie Gritton 					error = ENOENT;
992b38ff370SJamie Gritton 					vfs_opterror(opts, "jail %d is dying",
993b38ff370SJamie Gritton 					    jid);
994b38ff370SJamie Gritton 					goto done_unlock_list;
995b38ff370SJamie Gritton 				} else if ((flags & JAIL_ATTACH) ||
996b38ff370SJamie Gritton 				    (pr_flags & PR_PERSIST)) {
997b38ff370SJamie Gritton 					/*
998b38ff370SJamie Gritton 					 * A dying jail might be resurrected
999b38ff370SJamie Gritton 					 * (via attach or persist), but first
1000b38ff370SJamie Gritton 					 * it must determine if another jail
1001b38ff370SJamie Gritton 					 * has claimed its name.  Accomplish
1002b38ff370SJamie Gritton 					 * this by implicitly re-setting the
1003b38ff370SJamie Gritton 					 * name.
1004b38ff370SJamie Gritton 					 */
1005b38ff370SJamie Gritton 					if (name == NULL)
10060304c731SJamie Gritton 						name = prison_name(mypr, pr);
1007b38ff370SJamie Gritton 				}
1008b38ff370SJamie Gritton 			}
1009b38ff370SJamie Gritton 		}
1010b38ff370SJamie Gritton 		if (pr == NULL) {
1011b38ff370SJamie Gritton 			/* Update: jid must exist. */
1012b38ff370SJamie Gritton 			if (cuflags == JAIL_UPDATE) {
1013b38ff370SJamie Gritton 				error = ENOENT;
1014b38ff370SJamie Gritton 				vfs_opterror(opts, "jail %d not found", jid);
1015b38ff370SJamie Gritton 				goto done_unlock_list;
1016b38ff370SJamie Gritton 			}
1017b38ff370SJamie Gritton 		}
1018b38ff370SJamie Gritton 	}
1019b38ff370SJamie Gritton 	/*
1020b38ff370SJamie Gritton 	 * If the caller provided a name, look for a jail by that name.
1021b38ff370SJamie Gritton 	 * This has different semantics for creates and updates keyed by jid
1022b38ff370SJamie Gritton 	 * (where the name must not already exist in a different jail),
1023b38ff370SJamie Gritton 	 * and updates keyed by the name itself (where the name must exist
1024b38ff370SJamie Gritton 	 * because that is the jail being updated).
1025b38ff370SJamie Gritton 	 */
1026b6f47c23SJamie Gritton 	namelc = NULL;
1027b38ff370SJamie Gritton 	if (name != NULL) {
1028babbbb9cSJamie Gritton 		namelc = strrchr(name, '.');
1029babbbb9cSJamie Gritton 		if (namelc == NULL)
1030babbbb9cSJamie Gritton 			namelc = name;
1031babbbb9cSJamie Gritton 		else {
10320304c731SJamie Gritton 			/*
10330304c731SJamie Gritton 			 * This is a hierarchical name.  Split it into the
10340304c731SJamie Gritton 			 * parent and child names, and make sure the parent
10350304c731SJamie Gritton 			 * exists or matches an already found jail.
10360304c731SJamie Gritton 			 */
10370304c731SJamie Gritton 			if (pr != NULL) {
1038babbbb9cSJamie Gritton 				if (strncmp(name, ppr->pr_name, namelc - name)
1039babbbb9cSJamie Gritton 				    || ppr->pr_name[namelc - name] != '\0') {
10400304c731SJamie Gritton 					mtx_unlock(&pr->pr_mtx);
10410304c731SJamie Gritton 					error = EINVAL;
10420304c731SJamie Gritton 					vfs_opterror(opts,
10430304c731SJamie Gritton 					    "cannot change jail's parent");
10440304c731SJamie Gritton 					goto done_unlock_list;
10450304c731SJamie Gritton 				}
10460304c731SJamie Gritton 			} else {
1047b6f47c23SJamie Gritton 				*namelc = '\0';
10480304c731SJamie Gritton 				ppr = prison_find_name(mypr, name);
10490304c731SJamie Gritton 				if (ppr == NULL) {
10500304c731SJamie Gritton 					error = ENOENT;
10510304c731SJamie Gritton 					vfs_opterror(opts,
10520304c731SJamie Gritton 					    "jail \"%s\" not found", name);
10530304c731SJamie Gritton 					goto done_unlock_list;
10540304c731SJamie Gritton 				}
10550304c731SJamie Gritton 				mtx_unlock(&ppr->pr_mtx);
1056b6f47c23SJamie Gritton 				*namelc = '.';
10570304c731SJamie Gritton 			}
1058b6f47c23SJamie Gritton 			namelc++;
10590304c731SJamie Gritton 		}
1060b6f47c23SJamie Gritton 		if (namelc[0] != '\0') {
1061b6f47c23SJamie Gritton 			pnamelen =
10620304c731SJamie Gritton 			    (ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1;
1063b38ff370SJamie Gritton  name_again:
10640304c731SJamie Gritton 			deadpr = NULL;
10650304c731SJamie Gritton 			FOREACH_PRISON_CHILD(ppr, tpr) {
1066b38ff370SJamie Gritton 				if (tpr != pr && tpr->pr_ref > 0 &&
1067b6f47c23SJamie Gritton 				    !strcmp(tpr->pr_name + pnamelen, namelc)) {
1068b38ff370SJamie Gritton 					if (pr == NULL &&
1069b38ff370SJamie Gritton 					    cuflags != JAIL_CREATE) {
1070b38ff370SJamie Gritton 						mtx_lock(&tpr->pr_mtx);
1071b38ff370SJamie Gritton 						if (tpr->pr_ref > 0) {
1072b38ff370SJamie Gritton 							/*
1073b38ff370SJamie Gritton 							 * Use this jail
1074b38ff370SJamie Gritton 							 * for updates.
1075b38ff370SJamie Gritton 							 */
1076b38ff370SJamie Gritton 							if (tpr->pr_uref > 0) {
1077b38ff370SJamie Gritton 								pr = tpr;
1078b38ff370SJamie Gritton 								break;
1079b38ff370SJamie Gritton 							}
1080b38ff370SJamie Gritton 							deadpr = tpr;
1081b38ff370SJamie Gritton 						}
1082b38ff370SJamie Gritton 						mtx_unlock(&tpr->pr_mtx);
1083b38ff370SJamie Gritton 					} else if (tpr->pr_uref > 0) {
1084b38ff370SJamie Gritton 						/*
1085b38ff370SJamie Gritton 						 * Create, or update(jid):
1086b38ff370SJamie Gritton 						 * name must not exist in an
10870304c731SJamie Gritton 						 * active sibling jail.
1088b38ff370SJamie Gritton 						 */
1089b38ff370SJamie Gritton 						error = EEXIST;
1090b38ff370SJamie Gritton 						if (pr != NULL)
1091b38ff370SJamie Gritton 							mtx_unlock(&pr->pr_mtx);
1092b38ff370SJamie Gritton 						vfs_opterror(opts,
1093b38ff370SJamie Gritton 						   "jail \"%s\" already exists",
1094b38ff370SJamie Gritton 						   name);
1095b38ff370SJamie Gritton 						goto done_unlock_list;
1096b38ff370SJamie Gritton 					}
1097b38ff370SJamie Gritton 				}
1098b38ff370SJamie Gritton 			}
1099b38ff370SJamie Gritton 			/* If no active jail is found, use a dying one. */
1100b38ff370SJamie Gritton 			if (deadpr != NULL && pr == NULL) {
1101b38ff370SJamie Gritton 				if (flags & JAIL_DYING) {
1102b38ff370SJamie Gritton 					mtx_lock(&deadpr->pr_mtx);
1103b38ff370SJamie Gritton 					if (deadpr->pr_ref == 0) {
1104b38ff370SJamie Gritton 						mtx_unlock(&deadpr->pr_mtx);
1105b38ff370SJamie Gritton 						goto name_again;
1106b38ff370SJamie Gritton 					}
1107b38ff370SJamie Gritton 					pr = deadpr;
1108b38ff370SJamie Gritton 				} else if (cuflags == JAIL_UPDATE) {
1109b38ff370SJamie Gritton 					error = ENOENT;
1110b38ff370SJamie Gritton 					vfs_opterror(opts,
1111b38ff370SJamie Gritton 					    "jail \"%s\" is dying", name);
1112b38ff370SJamie Gritton 					goto done_unlock_list;
1113b38ff370SJamie Gritton 				}
1114b38ff370SJamie Gritton 			}
1115b38ff370SJamie Gritton 			/* Update: name must exist if no jid. */
1116b38ff370SJamie Gritton 			else if (cuflags == JAIL_UPDATE && pr == NULL) {
1117b38ff370SJamie Gritton 				error = ENOENT;
1118b38ff370SJamie Gritton 				vfs_opterror(opts, "jail \"%s\" not found",
1119b38ff370SJamie Gritton 				    name);
1120b38ff370SJamie Gritton 				goto done_unlock_list;
1121b38ff370SJamie Gritton 			}
1122b38ff370SJamie Gritton 		}
1123b38ff370SJamie Gritton 	}
1124b38ff370SJamie Gritton 	/* Update: must provide a jid or name. */
1125b38ff370SJamie Gritton 	else if (cuflags == JAIL_UPDATE && pr == NULL) {
1126b38ff370SJamie Gritton 		error = ENOENT;
1127b38ff370SJamie Gritton 		vfs_opterror(opts, "update specified no jail");
1128b38ff370SJamie Gritton 		goto done_unlock_list;
1129b38ff370SJamie Gritton 	}
1130b38ff370SJamie Gritton 
1131b38ff370SJamie Gritton 	/* If there's no prison to update, create a new one and link it in. */
1132b38ff370SJamie Gritton 	if (pr == NULL) {
1133b97457e2SJamie Gritton 		for (tpr = mypr; tpr != NULL; tpr = tpr->pr_parent)
1134b97457e2SJamie Gritton 			if (tpr->pr_childcount >= tpr->pr_childmax) {
1135b97457e2SJamie Gritton 				error = EPERM;
1136b97457e2SJamie Gritton 				vfs_opterror(opts, "prison limit exceeded");
1137b97457e2SJamie Gritton 				goto done_unlock_list;
1138b97457e2SJamie Gritton 			}
1139b38ff370SJamie Gritton 		created = 1;
11400304c731SJamie Gritton 		mtx_lock(&ppr->pr_mtx);
11412a549507SJamie Gritton 		if (ppr->pr_ref == 0) {
11420304c731SJamie Gritton 			mtx_unlock(&ppr->pr_mtx);
11430304c731SJamie Gritton 			error = ENOENT;
1144b6f47c23SJamie Gritton 			vfs_opterror(opts, "jail \"%s\" not found",
1145b6f47c23SJamie Gritton 			    prison_name(mypr, ppr));
11460304c731SJamie Gritton 			goto done_unlock_list;
11470304c731SJamie Gritton 		}
11480304c731SJamie Gritton 		ppr->pr_ref++;
11490304c731SJamie Gritton 		ppr->pr_uref++;
11500304c731SJamie Gritton 		mtx_unlock(&ppr->pr_mtx);
1151b38ff370SJamie Gritton 		pr = malloc(sizeof(*pr), M_PRISON, M_WAITOK | M_ZERO);
1152b38ff370SJamie Gritton 		if (jid == 0) {
1153b38ff370SJamie Gritton 			/* Find the next free jid. */
1154b38ff370SJamie Gritton 			jid = lastprid + 1;
1155b38ff370SJamie Gritton  findnext:
1156b38ff370SJamie Gritton 			if (jid == JAIL_MAX)
1157b38ff370SJamie Gritton 				jid = 1;
1158b38ff370SJamie Gritton 			TAILQ_FOREACH(tpr, &allprison, pr_list) {
1159b38ff370SJamie Gritton 				if (tpr->pr_id < jid)
1160b38ff370SJamie Gritton 					continue;
1161b38ff370SJamie Gritton 				if (tpr->pr_id > jid || tpr->pr_ref == 0) {
1162b38ff370SJamie Gritton 					TAILQ_INSERT_BEFORE(tpr, pr, pr_list);
1163b38ff370SJamie Gritton 					break;
1164b38ff370SJamie Gritton 				}
1165b38ff370SJamie Gritton 				if (jid == lastprid) {
1166b38ff370SJamie Gritton 					error = EAGAIN;
1167b38ff370SJamie Gritton 					vfs_opterror(opts,
1168b38ff370SJamie Gritton 					    "no available jail IDs");
1169b38ff370SJamie Gritton 					free(pr, M_PRISON);
11700304c731SJamie Gritton 					prison_deref(ppr, PD_DEREF |
11710304c731SJamie Gritton 					    PD_DEUREF | PD_LIST_XLOCKED);
11720304c731SJamie Gritton 					goto done_releroot;
1173b38ff370SJamie Gritton 				}
1174b38ff370SJamie Gritton 				jid++;
1175b38ff370SJamie Gritton 				goto findnext;
1176b38ff370SJamie Gritton 			}
1177b38ff370SJamie Gritton 			lastprid = jid;
1178b38ff370SJamie Gritton 		} else {
1179b38ff370SJamie Gritton 			/*
1180b38ff370SJamie Gritton 			 * The jail already has a jid (that did not yet exist),
1181b38ff370SJamie Gritton 			 * so just find where to insert it.
1182b38ff370SJamie Gritton 			 */
1183b38ff370SJamie Gritton 			TAILQ_FOREACH(tpr, &allprison, pr_list)
1184b38ff370SJamie Gritton 				if (tpr->pr_id >= jid) {
1185b38ff370SJamie Gritton 					TAILQ_INSERT_BEFORE(tpr, pr, pr_list);
1186b38ff370SJamie Gritton 					break;
1187b38ff370SJamie Gritton 				}
1188b38ff370SJamie Gritton 		}
1189b38ff370SJamie Gritton 		if (tpr == NULL)
1190b38ff370SJamie Gritton 			TAILQ_INSERT_TAIL(&allprison, pr, pr_list);
11910304c731SJamie Gritton 		LIST_INSERT_HEAD(&ppr->pr_children, pr, pr_sibling);
11920304c731SJamie Gritton 		for (tpr = ppr; tpr != NULL; tpr = tpr->pr_parent)
1193b97457e2SJamie Gritton 			tpr->pr_childcount++;
1194b38ff370SJamie Gritton 
11950304c731SJamie Gritton 		pr->pr_parent = ppr;
1196b38ff370SJamie Gritton 		pr->pr_id = jid;
11970304c731SJamie Gritton 
11980304c731SJamie Gritton 		/* Set some default values, and inherit some from the parent. */
1199b6f47c23SJamie Gritton 		if (namelc == NULL)
1200b6f47c23SJamie Gritton 			namelc = "";
1201b38ff370SJamie Gritton 		if (path == NULL) {
1202b38ff370SJamie Gritton 			path = "/";
12030304c731SJamie Gritton 			root = mypr->pr_root;
1204b38ff370SJamie Gritton 			vref(root);
1205b38ff370SJamie Gritton 		}
12068986e3a0SJamie Gritton 		strlcpy(pr->pr_hostuuid, DEFAULT_HOSTUUID, HOSTUUIDLEN);
12078986e3a0SJamie Gritton 		pr->pr_flags |= PR_HOST;
1208bdfc8cc4SJamie Gritton #if defined(INET) || defined(INET6)
1209bdfc8cc4SJamie Gritton #ifdef VIMAGE
1210bdfc8cc4SJamie Gritton 		if (!(pr_flags & PR_VNET))
1211bdfc8cc4SJamie Gritton #endif
1212bdfc8cc4SJamie Gritton 		{
12130304c731SJamie Gritton #ifdef INET
12142b0d6f81SJamie Gritton 			if (!(ch_flags & PR_IP4_USER))
12156a3f2779SJamie Gritton 				pr->pr_flags |= PR_IP4 | PR_IP4_USER;
12162b0d6f81SJamie Gritton 			else if (!(pr_flags & PR_IP4_USER)) {
12172b0d6f81SJamie Gritton 				pr->pr_flags |= ppr->pr_flags & PR_IP4;
12182b0d6f81SJamie Gritton 				if (ppr->pr_ip4 != NULL) {
12192b0d6f81SJamie Gritton 					pr->pr_ip4s = ppr->pr_ip4s;
12202b0d6f81SJamie Gritton 					pr->pr_ip4 = malloc(pr->pr_ip4s *
12212b0d6f81SJamie Gritton 					    sizeof(struct in_addr), M_PRISON,
12222b0d6f81SJamie Gritton 					    M_WAITOK);
12232b0d6f81SJamie Gritton 					bcopy(ppr->pr_ip4, pr->pr_ip4,
12242b0d6f81SJamie Gritton 					    pr->pr_ip4s * sizeof(*pr->pr_ip4));
12252b0d6f81SJamie Gritton 				}
12262b0d6f81SJamie Gritton 			}
12270304c731SJamie Gritton #endif
12280304c731SJamie Gritton #ifdef INET6
12292b0d6f81SJamie Gritton 			if (!(ch_flags & PR_IP6_USER))
12306a3f2779SJamie Gritton 				pr->pr_flags |= PR_IP6 | PR_IP6_USER;
12312b0d6f81SJamie Gritton 			else if (!(pr_flags & PR_IP6_USER)) {
12322b0d6f81SJamie Gritton 				pr->pr_flags |= ppr->pr_flags & PR_IP6;
12332b0d6f81SJamie Gritton 				if (ppr->pr_ip6 != NULL) {
12342b0d6f81SJamie Gritton 					pr->pr_ip6s = ppr->pr_ip6s;
12352b0d6f81SJamie Gritton 					pr->pr_ip6 = malloc(pr->pr_ip6s *
12362b0d6f81SJamie Gritton 					    sizeof(struct in6_addr), M_PRISON,
12372b0d6f81SJamie Gritton 					    M_WAITOK);
12382b0d6f81SJamie Gritton 					bcopy(ppr->pr_ip6, pr->pr_ip6,
12392b0d6f81SJamie Gritton 					    pr->pr_ip6s * sizeof(*pr->pr_ip6));
12402b0d6f81SJamie Gritton 				}
12412b0d6f81SJamie Gritton 			}
12420304c731SJamie Gritton #endif
1243bdfc8cc4SJamie Gritton 		}
1244bdfc8cc4SJamie Gritton #endif
1245592bcae8SBjoern A. Zeeb 		/* Source address selection is always on by default. */
1246592bcae8SBjoern A. Zeeb 		pr->pr_flags |= _PR_IP_SADDRSEL;
1247592bcae8SBjoern A. Zeeb 
12480304c731SJamie Gritton 		pr->pr_securelevel = ppr->pr_securelevel;
12490304c731SJamie Gritton 		pr->pr_allow = JAIL_DEFAULT_ALLOW & ppr->pr_allow;
1250af10bf05SBjoern A. Zeeb 		pr->pr_enforce_statfs = jail_default_enforce_statfs;
1251bf3db8aaSMartin Matuska 		pr->pr_devfs_rsnum = ppr->pr_devfs_rsnum;
1252b38ff370SJamie Gritton 
1253b96bd95bSIan Lepore 		pr->pr_osreldate = osreldt ? osreldt : ppr->pr_osreldate;
1254b96bd95bSIan Lepore 		if (osrelstr == NULL)
1255b96bd95bSIan Lepore 		    strcpy(pr->pr_osrelease, ppr->pr_osrelease);
1256b96bd95bSIan Lepore 		else
1257b96bd95bSIan Lepore 		    strcpy(pr->pr_osrelease, osrelstr);
1258b96bd95bSIan Lepore 
12590304c731SJamie Gritton 		LIST_INIT(&pr->pr_children);
12600304c731SJamie Gritton 		mtx_init(&pr->pr_mtx, "jail mutex", NULL, MTX_DEF | MTX_DUPOK);
126173d9e52dSJamie Gritton 		TASK_INIT(&pr->pr_task, 0, prison_complete, pr);
1262b38ff370SJamie Gritton 
1263679e1390SJamie Gritton #ifdef VIMAGE
1264679e1390SJamie Gritton 		/* Allocate a new vnet if specified. */
1265679e1390SJamie Gritton 		pr->pr_vnet = (pr_flags & PR_VNET)
1266679e1390SJamie Gritton 		    ? vnet_alloc() : ppr->pr_vnet;
1267679e1390SJamie Gritton #endif
1268b38ff370SJamie Gritton 		/*
1269b38ff370SJamie Gritton 		 * Allocate a dedicated cpuset for each jail.
1270b38ff370SJamie Gritton 		 * Unlike other initial settings, this may return an erorr.
1271b38ff370SJamie Gritton 		 */
12720304c731SJamie Gritton 		error = cpuset_create_root(ppr, &pr->pr_cpuset);
1273b38ff370SJamie Gritton 		if (error) {
1274b38ff370SJamie Gritton 			prison_deref(pr, PD_LIST_XLOCKED);
1275b38ff370SJamie Gritton 			goto done_releroot;
1276b38ff370SJamie Gritton 		}
1277b38ff370SJamie Gritton 
1278b38ff370SJamie Gritton 		mtx_lock(&pr->pr_mtx);
1279b38ff370SJamie Gritton 		/*
1280b38ff370SJamie Gritton 		 * New prisons do not yet have a reference, because we do not
1281b6f47c23SJamie Gritton 		 * want others to see the incomplete prison once the
1282b38ff370SJamie Gritton 		 * allprison_lock is downgraded.
1283b38ff370SJamie Gritton 		 */
1284b38ff370SJamie Gritton 	} else {
1285b38ff370SJamie Gritton 		created = 0;
12862b0d6f81SJamie Gritton 		/*
12872b0d6f81SJamie Gritton 		 * Grab a reference for existing prisons, to ensure they
12882b0d6f81SJamie Gritton 		 * continue to exist for the duration of the call.
12892b0d6f81SJamie Gritton 		 */
12902b0d6f81SJamie Gritton 		pr->pr_ref++;
1291bdfc8cc4SJamie Gritton #if defined(VIMAGE) && (defined(INET) || defined(INET6))
1292bdfc8cc4SJamie Gritton 		if ((pr->pr_flags & PR_VNET) &&
1293bdfc8cc4SJamie Gritton 		    (ch_flags & (PR_IP4_USER | PR_IP6_USER))) {
1294bdfc8cc4SJamie Gritton 			error = EINVAL;
1295bdfc8cc4SJamie Gritton 			vfs_opterror(opts,
1296bdfc8cc4SJamie Gritton 			    "vnet jails cannot have IP address restrictions");
1297bdfc8cc4SJamie Gritton 			goto done_deref_locked;
1298bdfc8cc4SJamie Gritton 		}
1299bdfc8cc4SJamie Gritton #endif
13002b0d6f81SJamie Gritton #ifdef INET
13012b0d6f81SJamie Gritton 		if (PR_IP4_USER & ch_flags & (pr_flags ^ pr->pr_flags)) {
13022b0d6f81SJamie Gritton 			error = EINVAL;
13032b0d6f81SJamie Gritton 			vfs_opterror(opts,
13042b0d6f81SJamie Gritton 			    "ip4 cannot be changed after creation");
13052b0d6f81SJamie Gritton 			goto done_deref_locked;
13062b0d6f81SJamie Gritton 		}
13072b0d6f81SJamie Gritton #endif
13082b0d6f81SJamie Gritton #ifdef INET6
13092b0d6f81SJamie Gritton 		if (PR_IP6_USER & ch_flags & (pr_flags ^ pr->pr_flags)) {
13102b0d6f81SJamie Gritton 			error = EINVAL;
13112b0d6f81SJamie Gritton 			vfs_opterror(opts,
13122b0d6f81SJamie Gritton 			    "ip6 cannot be changed after creation");
13132b0d6f81SJamie Gritton 			goto done_deref_locked;
13142b0d6f81SJamie Gritton 		}
13152b0d6f81SJamie Gritton #endif
1316b38ff370SJamie Gritton 	}
1317b38ff370SJamie Gritton 
1318b38ff370SJamie Gritton 	/* Do final error checking before setting anything. */
13190304c731SJamie Gritton 	if (gotslevel) {
13200304c731SJamie Gritton 		if (slevel < ppr->pr_securelevel) {
13210304c731SJamie Gritton 			error = EPERM;
13220304c731SJamie Gritton 			goto done_deref_locked;
13230304c731SJamie Gritton 		}
13240304c731SJamie Gritton 	}
1325b97457e2SJamie Gritton 	if (gotchildmax) {
1326b97457e2SJamie Gritton 		if (childmax >= ppr->pr_childmax) {
1327b97457e2SJamie Gritton 			error = EPERM;
1328b97457e2SJamie Gritton 			goto done_deref_locked;
1329b97457e2SJamie Gritton 		}
1330b97457e2SJamie Gritton 	}
13310304c731SJamie Gritton 	if (gotenforce) {
13320304c731SJamie Gritton 		if (enforce < ppr->pr_enforce_statfs) {
13330304c731SJamie Gritton 			error = EPERM;
13340304c731SJamie Gritton 			goto done_deref_locked;
13350304c731SJamie Gritton 		}
13360304c731SJamie Gritton 	}
13370cc207a6SMartin Matuska 	if (gotrsnum) {
13380cc207a6SMartin Matuska 		/*
13390cc207a6SMartin Matuska 		 * devfs_rsnum is a uint16_t
13400cc207a6SMartin Matuska 		 */
1341bf3db8aaSMartin Matuska 		if (rsnum < 0 || rsnum > 65535) {
13420cc207a6SMartin Matuska 			error = EINVAL;
13430cc207a6SMartin Matuska 			goto done_deref_locked;
13440cc207a6SMartin Matuska 		}
13450cc207a6SMartin Matuska 		/*
1346bf3db8aaSMartin Matuska 		 * Nested jails always inherit parent's devfs ruleset
13470cc207a6SMartin Matuska 		 */
13480cc207a6SMartin Matuska 		if (jailed(td->td_ucred)) {
13490cc207a6SMartin Matuska 			if (rsnum > 0 && rsnum != ppr->pr_devfs_rsnum) {
13500cc207a6SMartin Matuska 				error = EPERM;
13510cc207a6SMartin Matuska 				goto done_deref_locked;
1352bf3db8aaSMartin Matuska 			} else
13530cc207a6SMartin Matuska 				rsnum = ppr->pr_devfs_rsnum;
13540cc207a6SMartin Matuska 		}
13550cc207a6SMartin Matuska 	}
1356b38ff370SJamie Gritton #ifdef INET
13572b0d6f81SJamie Gritton 	if (ip4s > 0) {
13580304c731SJamie Gritton 		if (ppr->pr_flags & PR_IP4) {
13590304c731SJamie Gritton 			/*
13600304c731SJamie Gritton 			 * Make sure the new set of IP addresses is a
13610304c731SJamie Gritton 			 * subset of the parent's list.  Don't worry
13620304c731SJamie Gritton 			 * about the parent being unlocked, as any
13630304c731SJamie Gritton 			 * setting is done with allprison_lock held.
13640304c731SJamie Gritton 			 */
13650304c731SJamie Gritton 			for (ij = 0; ij < ppr->pr_ip4s; ij++)
13662b0d6f81SJamie Gritton 				if (ip4[0].s_addr == ppr->pr_ip4[ij].s_addr)
13670304c731SJamie Gritton 					break;
13680304c731SJamie Gritton 			if (ij == ppr->pr_ip4s) {
13690304c731SJamie Gritton 				error = EPERM;
13700304c731SJamie Gritton 				goto done_deref_locked;
13710304c731SJamie Gritton 			}
13720304c731SJamie Gritton 			if (ip4s > 1) {
13730304c731SJamie Gritton 				for (ii = ij = 1; ii < ip4s; ii++) {
13740304c731SJamie Gritton 					if (ip4[ii].s_addr ==
13750304c731SJamie Gritton 					    ppr->pr_ip4[0].s_addr)
1376b38ff370SJamie Gritton 						continue;
13770304c731SJamie Gritton 					for (; ij < ppr->pr_ip4s; ij++)
13780304c731SJamie Gritton 						if (ip4[ii].s_addr ==
13790304c731SJamie Gritton 						    ppr->pr_ip4[ij].s_addr)
13800304c731SJamie Gritton 							break;
13810304c731SJamie Gritton 					if (ij == ppr->pr_ip4s)
13820304c731SJamie Gritton 						break;
13830304c731SJamie Gritton 				}
13840304c731SJamie Gritton 				if (ij == ppr->pr_ip4s) {
13850304c731SJamie Gritton 					error = EPERM;
13860304c731SJamie Gritton 					goto done_deref_locked;
13870304c731SJamie Gritton 				}
13880304c731SJamie Gritton 			}
13890304c731SJamie Gritton 		}
13900304c731SJamie Gritton 		/*
13910304c731SJamie Gritton 		 * Check for conflicting IP addresses.  We permit them
13920304c731SJamie Gritton 		 * if there is no more than one IP on each jail.  If
13930304c731SJamie Gritton 		 * there is a duplicate on a jail with more than one
13940304c731SJamie Gritton 		 * IP stop checking and return error.
13950304c731SJamie Gritton 		 */
1396bdfc8cc4SJamie Gritton 		tppr = ppr;
1397bdfc8cc4SJamie Gritton #ifdef VIMAGE
1398bdfc8cc4SJamie Gritton 		for (; tppr != &prison0; tppr = tppr->pr_parent)
1399bdfc8cc4SJamie Gritton 			if (tppr->pr_flags & PR_VNET)
1400bdfc8cc4SJamie Gritton 				break;
1401bdfc8cc4SJamie Gritton #endif
1402bdfc8cc4SJamie Gritton 		FOREACH_PRISON_DESCENDANT(tppr, tpr, descend) {
1403bdfc8cc4SJamie Gritton 			if (tpr == pr ||
1404bdfc8cc4SJamie Gritton #ifdef VIMAGE
14052b0d6f81SJamie Gritton 			    (tpr != tppr && (tpr->pr_flags & PR_VNET)) ||
1406bdfc8cc4SJamie Gritton #endif
1407bdfc8cc4SJamie Gritton 			    tpr->pr_uref == 0) {
14080304c731SJamie Gritton 				descend = 0;
14090304c731SJamie Gritton 				continue;
14100304c731SJamie Gritton 			}
14110304c731SJamie Gritton 			if (!(tpr->pr_flags & PR_IP4_USER))
14120304c731SJamie Gritton 				continue;
14130304c731SJamie Gritton 			descend = 0;
14140304c731SJamie Gritton 			if (tpr->pr_ip4 == NULL ||
14150304c731SJamie Gritton 			    (ip4s == 1 && tpr->pr_ip4s == 1))
14160304c731SJamie Gritton 				continue;
14170304c731SJamie Gritton 			for (ii = 0; ii < ip4s; ii++) {
14180ce1624dSStephen J. Kiernan 				if (prison_check_ip4_locked(tpr, &ip4[ii]) ==
14190ce1624dSStephen J. Kiernan 				    0) {
14200304c731SJamie Gritton 					error = EADDRINUSE;
1421b38ff370SJamie Gritton 					vfs_opterror(opts,
1422b38ff370SJamie Gritton 					    "IPv4 addresses clash");
1423b38ff370SJamie Gritton 					goto done_deref_locked;
1424b38ff370SJamie Gritton 				}
14250304c731SJamie Gritton 			}
14260304c731SJamie Gritton 		}
14270304c731SJamie Gritton 	}
1428b38ff370SJamie Gritton #endif
1429b38ff370SJamie Gritton #ifdef INET6
14302b0d6f81SJamie Gritton 	if (ip6s > 0) {
14310304c731SJamie Gritton 		if (ppr->pr_flags & PR_IP6) {
14320304c731SJamie Gritton 			/*
14330304c731SJamie Gritton 			 * Make sure the new set of IP addresses is a
14340304c731SJamie Gritton 			 * subset of the parent's list.
14350304c731SJamie Gritton 			 */
14360304c731SJamie Gritton 			for (ij = 0; ij < ppr->pr_ip6s; ij++)
14370304c731SJamie Gritton 				if (IN6_ARE_ADDR_EQUAL(&ip6[0],
14380304c731SJamie Gritton 				    &ppr->pr_ip6[ij]))
14390304c731SJamie Gritton 					break;
14400304c731SJamie Gritton 			if (ij == ppr->pr_ip6s) {
14410304c731SJamie Gritton 				error = EPERM;
14420304c731SJamie Gritton 				goto done_deref_locked;
14430304c731SJamie Gritton 			}
14440304c731SJamie Gritton 			if (ip6s > 1) {
14450304c731SJamie Gritton 				for (ii = ij = 1; ii < ip6s; ii++) {
14460304c731SJamie Gritton 					if (IN6_ARE_ADDR_EQUAL(&ip6[ii],
14470304c731SJamie Gritton 					     &ppr->pr_ip6[0]))
14480304c731SJamie Gritton 						continue;
14490304c731SJamie Gritton 					for (; ij < ppr->pr_ip6s; ij++)
14500304c731SJamie Gritton 						if (IN6_ARE_ADDR_EQUAL(
14512b0d6f81SJamie Gritton 						    &ip6[ii], &ppr->pr_ip6[ij]))
14520304c731SJamie Gritton 							break;
14530304c731SJamie Gritton 					if (ij == ppr->pr_ip6s)
14540304c731SJamie Gritton 						break;
14550304c731SJamie Gritton 				}
14560304c731SJamie Gritton 				if (ij == ppr->pr_ip6s) {
14570304c731SJamie Gritton 					error = EPERM;
14580304c731SJamie Gritton 					goto done_deref_locked;
14590304c731SJamie Gritton 				}
14600304c731SJamie Gritton 			}
14610304c731SJamie Gritton 		}
14620304c731SJamie Gritton 		/* Check for conflicting IP addresses. */
1463bdfc8cc4SJamie Gritton 		tppr = ppr;
1464bdfc8cc4SJamie Gritton #ifdef VIMAGE
1465bdfc8cc4SJamie Gritton 		for (; tppr != &prison0; tppr = tppr->pr_parent)
1466bdfc8cc4SJamie Gritton 			if (tppr->pr_flags & PR_VNET)
1467bdfc8cc4SJamie Gritton 				break;
1468bdfc8cc4SJamie Gritton #endif
1469bdfc8cc4SJamie Gritton 		FOREACH_PRISON_DESCENDANT(tppr, tpr, descend) {
1470bdfc8cc4SJamie Gritton 			if (tpr == pr ||
1471bdfc8cc4SJamie Gritton #ifdef VIMAGE
14722b0d6f81SJamie Gritton 			    (tpr != tppr && (tpr->pr_flags & PR_VNET)) ||
1473bdfc8cc4SJamie Gritton #endif
1474bdfc8cc4SJamie Gritton 			    tpr->pr_uref == 0) {
14750304c731SJamie Gritton 				descend = 0;
14760304c731SJamie Gritton 				continue;
14770304c731SJamie Gritton 			}
14780304c731SJamie Gritton 			if (!(tpr->pr_flags & PR_IP6_USER))
14790304c731SJamie Gritton 				continue;
14800304c731SJamie Gritton 			descend = 0;
14810304c731SJamie Gritton 			if (tpr->pr_ip6 == NULL ||
14820304c731SJamie Gritton 			    (ip6s == 1 && tpr->pr_ip6s == 1))
14830304c731SJamie Gritton 				continue;
14840304c731SJamie Gritton 			for (ii = 0; ii < ip6s; ii++) {
14850ce1624dSStephen J. Kiernan 				if (prison_check_ip6_locked(tpr, &ip6[ii]) ==
14860ce1624dSStephen J. Kiernan 				    0) {
14870304c731SJamie Gritton 					error = EADDRINUSE;
1488b38ff370SJamie Gritton 					vfs_opterror(opts,
1489b38ff370SJamie Gritton 					    "IPv6 addresses clash");
1490b38ff370SJamie Gritton 					goto done_deref_locked;
1491b38ff370SJamie Gritton 				}
14920304c731SJamie Gritton 			}
14930304c731SJamie Gritton 		}
14940304c731SJamie Gritton 	}
1495b38ff370SJamie Gritton #endif
14960304c731SJamie Gritton 	onamelen = namelen = 0;
1497b6f47c23SJamie Gritton 	if (namelc != NULL) {
14986ab6058eSJamie Gritton 		/* Give a default name of the jid.  Also allow the name to be
14996ab6058eSJamie Gritton 		 * explicitly the jid - but not any other number, and only in
15006ab6058eSJamie Gritton 		 * normal form (no leading zero/etc).
15016ab6058eSJamie Gritton 		 */
1502b6f47c23SJamie Gritton 		if (namelc[0] == '\0')
1503b6f47c23SJamie Gritton 			snprintf(namelc = numbuf, sizeof(numbuf), "%d", jid);
15046ab6058eSJamie Gritton 		else if ((strtoul(namelc, &p, 10) != jid ||
15056ab6058eSJamie Gritton 			  namelc[0] < '1' || namelc[0] > '9') && *p == '\0') {
1506b38ff370SJamie Gritton 			error = EINVAL;
1507babbbb9cSJamie Gritton 			vfs_opterror(opts,
1508babbbb9cSJamie Gritton 			    "name cannot be numeric (unless it is the jid)");
15090304c731SJamie Gritton 			goto done_deref_locked;
1510b38ff370SJamie Gritton 		}
1511b38ff370SJamie Gritton 		/*
15120304c731SJamie Gritton 		 * Make sure the name isn't too long for the prison or its
15130304c731SJamie Gritton 		 * children.
1514b38ff370SJamie Gritton 		 */
1515b6f47c23SJamie Gritton 		pnamelen = (ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1;
1516b6f47c23SJamie Gritton 		onamelen = strlen(pr->pr_name + pnamelen);
1517b6f47c23SJamie Gritton 		namelen = strlen(namelc);
1518b6f47c23SJamie Gritton 		if (pnamelen + namelen + 1 > sizeof(pr->pr_name)) {
15190304c731SJamie Gritton 			error = ENAMETOOLONG;
15200304c731SJamie Gritton 			goto done_deref_locked;
15210304c731SJamie Gritton 		}
15220304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT(pr, tpr, descend) {
15230304c731SJamie Gritton 			if (strlen(tpr->pr_name) + (namelen - onamelen) >=
15240304c731SJamie Gritton 			    sizeof(pr->pr_name)) {
15250304c731SJamie Gritton 				error = ENAMETOOLONG;
15260304c731SJamie Gritton 				goto done_deref_locked;
15270304c731SJamie Gritton 			}
15280304c731SJamie Gritton 		}
15290304c731SJamie Gritton 	}
15300304c731SJamie Gritton 	if (pr_allow & ~ppr->pr_allow) {
15310304c731SJamie Gritton 		error = EPERM;
15320304c731SJamie Gritton 		goto done_deref_locked;
1533b38ff370SJamie Gritton 	}
1534b38ff370SJamie Gritton 
1535b6f47c23SJamie Gritton 	/*
1536b6f47c23SJamie Gritton 	 * Let modules check their parameters.  This requires unlocking and
1537b6f47c23SJamie Gritton 	 * then re-locking the prison, but this is still a valid state as long
1538b6f47c23SJamie Gritton 	 * as allprison_lock remains xlocked.
1539b6f47c23SJamie Gritton 	 */
1540b6f47c23SJamie Gritton 	mtx_unlock(&pr->pr_mtx);
1541b6f47c23SJamie Gritton 	error = osd_jail_call(pr, PR_METHOD_CHECK, opts);
1542b6f47c23SJamie Gritton 	if (error != 0) {
1543b6f47c23SJamie Gritton 		prison_deref(pr, created
1544b6f47c23SJamie Gritton 		    ? PD_LIST_XLOCKED
1545b6f47c23SJamie Gritton 		    : PD_DEREF | PD_LIST_XLOCKED);
1546b6f47c23SJamie Gritton 		goto done_releroot;
1547b6f47c23SJamie Gritton 	}
1548b6f47c23SJamie Gritton 	mtx_lock(&pr->pr_mtx);
1549b6f47c23SJamie Gritton 
1550b6f47c23SJamie Gritton 	/* At this point, all valid parameters should have been noted. */
1551b6f47c23SJamie Gritton 	TAILQ_FOREACH(opt, opts, link) {
1552b6f47c23SJamie Gritton 		if (!opt->seen && strcmp(opt->name, "errmsg")) {
1553b6f47c23SJamie Gritton 			error = EINVAL;
1554b6f47c23SJamie Gritton 			vfs_opterror(opts, "unknown parameter: %s", opt->name);
1555b6f47c23SJamie Gritton 			goto done_deref_locked;
1556b6f47c23SJamie Gritton 		}
1557b6f47c23SJamie Gritton 	}
1558b6f47c23SJamie Gritton 
1559b38ff370SJamie Gritton 	/* Set the parameters of the prison. */
1560b38ff370SJamie Gritton #ifdef INET
15610304c731SJamie Gritton 	redo_ip4 = 0;
15620304c731SJamie Gritton 	if (pr_flags & PR_IP4_USER) {
15630304c731SJamie Gritton 		pr->pr_flags |= PR_IP4;
1564b38ff370SJamie Gritton 		free(pr->pr_ip4, M_PRISON);
15650304c731SJamie Gritton 		pr->pr_ip4s = ip4s;
1566b38ff370SJamie Gritton 		pr->pr_ip4 = ip4;
1567b38ff370SJamie Gritton 		ip4 = NULL;
15680304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1569bdfc8cc4SJamie Gritton #ifdef VIMAGE
1570bdfc8cc4SJamie Gritton 			if (tpr->pr_flags & PR_VNET) {
1571bdfc8cc4SJamie Gritton 				descend = 0;
1572bdfc8cc4SJamie Gritton 				continue;
1573bdfc8cc4SJamie Gritton 			}
1574bdfc8cc4SJamie Gritton #endif
15750304c731SJamie Gritton 			if (prison_restrict_ip4(tpr, NULL)) {
15760304c731SJamie Gritton 				redo_ip4 = 1;
15770304c731SJamie Gritton 				descend = 0;
15780304c731SJamie Gritton 			}
15790304c731SJamie Gritton 		}
15800304c731SJamie Gritton 	}
1581b38ff370SJamie Gritton #endif
1582b38ff370SJamie Gritton #ifdef INET6
15830304c731SJamie Gritton 	redo_ip6 = 0;
15840304c731SJamie Gritton 	if (pr_flags & PR_IP6_USER) {
15850304c731SJamie Gritton 		pr->pr_flags |= PR_IP6;
1586b38ff370SJamie Gritton 		free(pr->pr_ip6, M_PRISON);
15870304c731SJamie Gritton 		pr->pr_ip6s = ip6s;
1588b38ff370SJamie Gritton 		pr->pr_ip6 = ip6;
1589b38ff370SJamie Gritton 		ip6 = NULL;
15900304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1591bdfc8cc4SJamie Gritton #ifdef VIMAGE
1592bdfc8cc4SJamie Gritton 			if (tpr->pr_flags & PR_VNET) {
1593bdfc8cc4SJamie Gritton 				descend = 0;
1594bdfc8cc4SJamie Gritton 				continue;
1595bdfc8cc4SJamie Gritton 			}
1596bdfc8cc4SJamie Gritton #endif
15970304c731SJamie Gritton 			if (prison_restrict_ip6(tpr, NULL)) {
15980304c731SJamie Gritton 				redo_ip6 = 1;
15990304c731SJamie Gritton 				descend = 0;
16000304c731SJamie Gritton 			}
16010304c731SJamie Gritton 		}
16020304c731SJamie Gritton 	}
1603b38ff370SJamie Gritton #endif
16040304c731SJamie Gritton 	if (gotslevel) {
1605b38ff370SJamie Gritton 		pr->pr_securelevel = slevel;
16060304c731SJamie Gritton 		/* Set all child jails to be at least this level. */
16070304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
16080304c731SJamie Gritton 			if (tpr->pr_securelevel < slevel)
16090304c731SJamie Gritton 				tpr->pr_securelevel = slevel;
16100304c731SJamie Gritton 	}
1611b97457e2SJamie Gritton 	if (gotchildmax) {
1612b97457e2SJamie Gritton 		pr->pr_childmax = childmax;
1613b97457e2SJamie Gritton 		/* Set all child jails to under this limit. */
1614b97457e2SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED_LEVEL(pr, tpr, descend, level)
1615b97457e2SJamie Gritton 			if (tpr->pr_childmax > childmax - level)
1616b97457e2SJamie Gritton 				tpr->pr_childmax = childmax > level
1617b97457e2SJamie Gritton 				    ? childmax - level : 0;
1618b97457e2SJamie Gritton 	}
16190304c731SJamie Gritton 	if (gotenforce) {
16200304c731SJamie Gritton 		pr->pr_enforce_statfs = enforce;
16210304c731SJamie Gritton 		/* Pass this restriction on to the children. */
16220304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
16230304c731SJamie Gritton 			if (tpr->pr_enforce_statfs < enforce)
16240304c731SJamie Gritton 				tpr->pr_enforce_statfs = enforce;
16250304c731SJamie Gritton 	}
16260cc207a6SMartin Matuska 	if (gotrsnum) {
16270cc207a6SMartin Matuska 		pr->pr_devfs_rsnum = rsnum;
16280cc207a6SMartin Matuska 		/* Pass this restriction on to the children. */
16290cc207a6SMartin Matuska 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
16300cc207a6SMartin Matuska 			tpr->pr_devfs_rsnum = rsnum;
16310cc207a6SMartin Matuska 	}
1632b6f47c23SJamie Gritton 	if (namelc != NULL) {
16330304c731SJamie Gritton 		if (ppr == &prison0)
1634b6f47c23SJamie Gritton 			strlcpy(pr->pr_name, namelc, sizeof(pr->pr_name));
16350304c731SJamie Gritton 		else
16360304c731SJamie Gritton 			snprintf(pr->pr_name, sizeof(pr->pr_name), "%s.%s",
1637b6f47c23SJamie Gritton 			    ppr->pr_name, namelc);
16380304c731SJamie Gritton 		/* Change this component of child names. */
16390304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
16400304c731SJamie Gritton 			bcopy(tpr->pr_name + onamelen, tpr->pr_name + namelen,
16410304c731SJamie Gritton 			    strlen(tpr->pr_name + onamelen) + 1);
16420304c731SJamie Gritton 			bcopy(pr->pr_name, tpr->pr_name, namelen);
16430304c731SJamie Gritton 		}
16440304c731SJamie Gritton 	}
1645b38ff370SJamie Gritton 	if (path != NULL) {
16460304c731SJamie Gritton 		/* Try to keep a real-rooted full pathname. */
1647f6e633a9SMartin Matuska 		if (fullpath_disabled && path[0] == '/' &&
1648f6e633a9SMartin Matuska 		    strcmp(mypr->pr_path, "/"))
16490304c731SJamie Gritton 			snprintf(pr->pr_path, sizeof(pr->pr_path), "%s%s",
16500304c731SJamie Gritton 			    mypr->pr_path, path);
16510304c731SJamie Gritton 		else
1652b38ff370SJamie Gritton 			strlcpy(pr->pr_path, path, sizeof(pr->pr_path));
1653b38ff370SJamie Gritton 		pr->pr_root = root;
1654b38ff370SJamie Gritton 	}
165576ca6f88SJamie Gritton 	if (PR_HOST & ch_flags & ~pr_flags) {
165676ca6f88SJamie Gritton 		if (pr->pr_flags & PR_HOST) {
165776ca6f88SJamie Gritton 			/*
165876ca6f88SJamie Gritton 			 * Copy the parent's host info.  As with pr_ip4 above,
165976ca6f88SJamie Gritton 			 * the lack of a lock on the parent is not a problem;
166076ca6f88SJamie Gritton 			 * it is always set with allprison_lock at least
166176ca6f88SJamie Gritton 			 * shared, and is held exclusively here.
166276ca6f88SJamie Gritton 			 */
1663c1f19219SJamie Gritton 			strlcpy(pr->pr_hostname, pr->pr_parent->pr_hostname,
1664c1f19219SJamie Gritton 			    sizeof(pr->pr_hostname));
1665c1f19219SJamie Gritton 			strlcpy(pr->pr_domainname, pr->pr_parent->pr_domainname,
1666c1f19219SJamie Gritton 			    sizeof(pr->pr_domainname));
1667c1f19219SJamie Gritton 			strlcpy(pr->pr_hostuuid, pr->pr_parent->pr_hostuuid,
1668c1f19219SJamie Gritton 			    sizeof(pr->pr_hostuuid));
166976ca6f88SJamie Gritton 			pr->pr_hostid = pr->pr_parent->pr_hostid;
167076ca6f88SJamie Gritton 		}
167176ca6f88SJamie Gritton 	} else if (host != NULL || domain != NULL || uuid != NULL || gothid) {
167276ca6f88SJamie Gritton 		/* Set this prison, and any descendants without PR_HOST. */
1673b38ff370SJamie Gritton 		if (host != NULL)
1674c1f19219SJamie Gritton 			strlcpy(pr->pr_hostname, host, sizeof(pr->pr_hostname));
167576ca6f88SJamie Gritton 		if (domain != NULL)
1676c1f19219SJamie Gritton 			strlcpy(pr->pr_domainname, domain,
1677c1f19219SJamie Gritton 			    sizeof(pr->pr_domainname));
167876ca6f88SJamie Gritton 		if (uuid != NULL)
1679c1f19219SJamie Gritton 			strlcpy(pr->pr_hostuuid, uuid, sizeof(pr->pr_hostuuid));
168076ca6f88SJamie Gritton 		if (gothid)
168176ca6f88SJamie Gritton 			pr->pr_hostid = hid;
168276ca6f88SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
168376ca6f88SJamie Gritton 			if (tpr->pr_flags & PR_HOST)
168476ca6f88SJamie Gritton 				descend = 0;
168576ca6f88SJamie Gritton 			else {
168676ca6f88SJamie Gritton 				if (host != NULL)
1687c1f19219SJamie Gritton 					strlcpy(tpr->pr_hostname,
1688c1f19219SJamie Gritton 					    pr->pr_hostname,
1689c1f19219SJamie Gritton 					    sizeof(tpr->pr_hostname));
169076ca6f88SJamie Gritton 				if (domain != NULL)
1691c1f19219SJamie Gritton 					strlcpy(tpr->pr_domainname,
1692c1f19219SJamie Gritton 					    pr->pr_domainname,
1693c1f19219SJamie Gritton 					    sizeof(tpr->pr_domainname));
169476ca6f88SJamie Gritton 				if (uuid != NULL)
1695c1f19219SJamie Gritton 					strlcpy(tpr->pr_hostuuid,
1696c1f19219SJamie Gritton 					    pr->pr_hostuuid,
1697c1f19219SJamie Gritton 					    sizeof(tpr->pr_hostuuid));
169876ca6f88SJamie Gritton 				if (gothid)
169976ca6f88SJamie Gritton 					tpr->pr_hostid = hid;
170076ca6f88SJamie Gritton 			}
170176ca6f88SJamie Gritton 		}
170276ca6f88SJamie Gritton 	}
17030304c731SJamie Gritton 	if ((tallow = ch_allow & ~pr_allow)) {
17040304c731SJamie Gritton 		/* Clear allow bits in all children. */
17050304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
17060304c731SJamie Gritton 			tpr->pr_allow &= ~tallow;
17070304c731SJamie Gritton 	}
17080304c731SJamie Gritton 	pr->pr_allow = (pr->pr_allow & ~ch_allow) | pr_allow;
1709b38ff370SJamie Gritton 	/*
1710b38ff370SJamie Gritton 	 * Persistent prisons get an extra reference, and prisons losing their
1711b38ff370SJamie Gritton 	 * persist flag lose that reference.  Only do this for existing prisons
1712b38ff370SJamie Gritton 	 * for now, so new ones will remain unseen until after the module
1713b38ff370SJamie Gritton 	 * handlers have completed.
1714b38ff370SJamie Gritton 	 */
1715cc5fd8c7SJamie Gritton 	born = pr->pr_uref == 0;
1716b38ff370SJamie Gritton 	if (!created && (ch_flags & PR_PERSIST & (pr_flags ^ pr->pr_flags))) {
1717b38ff370SJamie Gritton 		if (pr_flags & PR_PERSIST) {
1718b38ff370SJamie Gritton 			pr->pr_ref++;
1719b38ff370SJamie Gritton 			pr->pr_uref++;
1720b38ff370SJamie Gritton 		} else {
1721b38ff370SJamie Gritton 			pr->pr_ref--;
1722b38ff370SJamie Gritton 			pr->pr_uref--;
1723b38ff370SJamie Gritton 		}
1724b38ff370SJamie Gritton 	}
1725b38ff370SJamie Gritton 	pr->pr_flags = (pr->pr_flags & ~ch_flags) | pr_flags;
1726b38ff370SJamie Gritton 	mtx_unlock(&pr->pr_mtx);
1727b38ff370SJamie Gritton 
1728a7ad07bfSEdward Tomasz Napierala #ifdef RACCT
17294b5c9cf6SEdward Tomasz Napierala 	if (racct_enable && created)
1730a7ad07bfSEdward Tomasz Napierala 		prison_racct_attach(pr);
1731a7ad07bfSEdward Tomasz Napierala #endif
1732a7ad07bfSEdward Tomasz Napierala 
17330304c731SJamie Gritton 	/* Locks may have prevented a complete restriction of child IP
17340304c731SJamie Gritton 	 * addresses.  If so, allocate some more memory and try again.
17350304c731SJamie Gritton 	 */
17360304c731SJamie Gritton #ifdef INET
17370304c731SJamie Gritton 	while (redo_ip4) {
17380304c731SJamie Gritton 		ip4s = pr->pr_ip4s;
17390304c731SJamie Gritton 		ip4 = malloc(ip4s * sizeof(*ip4), M_PRISON, M_WAITOK);
17400304c731SJamie Gritton 		mtx_lock(&pr->pr_mtx);
17410304c731SJamie Gritton 		redo_ip4 = 0;
17420304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1743bdfc8cc4SJamie Gritton #ifdef VIMAGE
1744bdfc8cc4SJamie Gritton 			if (tpr->pr_flags & PR_VNET) {
1745bdfc8cc4SJamie Gritton 				descend = 0;
1746bdfc8cc4SJamie Gritton 				continue;
1747bdfc8cc4SJamie Gritton 			}
1748bdfc8cc4SJamie Gritton #endif
17490304c731SJamie Gritton 			if (prison_restrict_ip4(tpr, ip4)) {
17500304c731SJamie Gritton 				if (ip4 != NULL)
17510304c731SJamie Gritton 					ip4 = NULL;
17520304c731SJamie Gritton 				else
17530304c731SJamie Gritton 					redo_ip4 = 1;
17540304c731SJamie Gritton 			}
17550304c731SJamie Gritton 		}
17560304c731SJamie Gritton 		mtx_unlock(&pr->pr_mtx);
17570304c731SJamie Gritton 	}
17580304c731SJamie Gritton #endif
17590304c731SJamie Gritton #ifdef INET6
17600304c731SJamie Gritton 	while (redo_ip6) {
17610304c731SJamie Gritton 		ip6s = pr->pr_ip6s;
17620304c731SJamie Gritton 		ip6 = malloc(ip6s * sizeof(*ip6), M_PRISON, M_WAITOK);
17630304c731SJamie Gritton 		mtx_lock(&pr->pr_mtx);
17640304c731SJamie Gritton 		redo_ip6 = 0;
17650304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1766bdfc8cc4SJamie Gritton #ifdef VIMAGE
1767bdfc8cc4SJamie Gritton 			if (tpr->pr_flags & PR_VNET) {
1768bdfc8cc4SJamie Gritton 				descend = 0;
1769bdfc8cc4SJamie Gritton 				continue;
1770bdfc8cc4SJamie Gritton 			}
1771bdfc8cc4SJamie Gritton #endif
17720304c731SJamie Gritton 			if (prison_restrict_ip6(tpr, ip6)) {
17730304c731SJamie Gritton 				if (ip6 != NULL)
17740304c731SJamie Gritton 					ip6 = NULL;
17750304c731SJamie Gritton 				else
17760304c731SJamie Gritton 					redo_ip6 = 1;
17770304c731SJamie Gritton 			}
17780304c731SJamie Gritton 		}
17790304c731SJamie Gritton 		mtx_unlock(&pr->pr_mtx);
17800304c731SJamie Gritton 	}
17810304c731SJamie Gritton #endif
17820304c731SJamie Gritton 
1783b38ff370SJamie Gritton 	/* Let the modules do their work. */
1784b38ff370SJamie Gritton 	sx_downgrade(&allprison_lock);
1785cc5fd8c7SJamie Gritton 	if (born) {
1786b38ff370SJamie Gritton 		error = osd_jail_call(pr, PR_METHOD_CREATE, opts);
1787b38ff370SJamie Gritton 		if (error) {
1788cc5fd8c7SJamie Gritton 			(void)osd_jail_call(pr, PR_METHOD_REMOVE, NULL);
1789cc5fd8c7SJamie Gritton 			prison_deref(pr, created
1790cc5fd8c7SJamie Gritton 			    ? PD_LIST_SLOCKED
1791cc5fd8c7SJamie Gritton 			    : PD_DEREF | PD_LIST_SLOCKED);
1792b38ff370SJamie Gritton 			goto done_errmsg;
1793b38ff370SJamie Gritton 		}
1794b38ff370SJamie Gritton 	}
1795b38ff370SJamie Gritton 	error = osd_jail_call(pr, PR_METHOD_SET, opts);
1796b38ff370SJamie Gritton 	if (error) {
1797cc5fd8c7SJamie Gritton 		if (born)
1798cc5fd8c7SJamie Gritton 			(void)osd_jail_call(pr, PR_METHOD_REMOVE, NULL);
1799b38ff370SJamie Gritton 		prison_deref(pr, created
1800b38ff370SJamie Gritton 		    ? PD_LIST_SLOCKED
1801b38ff370SJamie Gritton 		    : PD_DEREF | PD_LIST_SLOCKED);
1802b38ff370SJamie Gritton 		goto done_errmsg;
1803b38ff370SJamie Gritton 	}
1804b38ff370SJamie Gritton 
1805b38ff370SJamie Gritton 	/* Attach this process to the prison if requested. */
1806b38ff370SJamie Gritton 	if (flags & JAIL_ATTACH) {
1807b38ff370SJamie Gritton 		mtx_lock(&pr->pr_mtx);
1808b38ff370SJamie Gritton 		error = do_jail_attach(td, pr);
1809b38ff370SJamie Gritton 		if (error) {
1810b38ff370SJamie Gritton 			vfs_opterror(opts, "attach failed");
1811b38ff370SJamie Gritton 			if (!created)
1812b38ff370SJamie Gritton 				prison_deref(pr, PD_DEREF);
1813b38ff370SJamie Gritton 			goto done_errmsg;
1814b38ff370SJamie Gritton 		}
1815b38ff370SJamie Gritton 	}
1816b38ff370SJamie Gritton 
18171fb24974SEdward Tomasz Napierala #ifdef RACCT
18184b5c9cf6SEdward Tomasz Napierala 	if (racct_enable && !created) {
1819f514b97bSEdward Tomasz Napierala 		if (!(flags & JAIL_ATTACH))
18201fb24974SEdward Tomasz Napierala 			sx_sunlock(&allprison_lock);
18211fb24974SEdward Tomasz Napierala 		prison_racct_modify(pr);
1822f514b97bSEdward Tomasz Napierala 		if (!(flags & JAIL_ATTACH))
18231fb24974SEdward Tomasz Napierala 			sx_slock(&allprison_lock);
18241fb24974SEdward Tomasz Napierala 	}
18251fb24974SEdward Tomasz Napierala #endif
18261fb24974SEdward Tomasz Napierala 
18271fb24974SEdward Tomasz Napierala 	td->td_retval[0] = pr->pr_id;
18281fb24974SEdward Tomasz Napierala 
1829b38ff370SJamie Gritton 	/*
1830b38ff370SJamie Gritton 	 * Now that it is all there, drop the temporary reference from existing
1831b38ff370SJamie Gritton 	 * prisons.  Or add a reference to newly created persistent prisons
1832b38ff370SJamie Gritton 	 * (which was not done earlier so that the prison would not be publicly
1833b38ff370SJamie Gritton 	 * visible).
1834b38ff370SJamie Gritton 	 */
1835b38ff370SJamie Gritton 	if (!created) {
1836b38ff370SJamie Gritton 		prison_deref(pr, (flags & JAIL_ATTACH)
1837b38ff370SJamie Gritton 		    ? PD_DEREF
1838b38ff370SJamie Gritton 		    : PD_DEREF | PD_LIST_SLOCKED);
1839b38ff370SJamie Gritton 	} else {
1840b38ff370SJamie Gritton 		if (pr_flags & PR_PERSIST) {
1841b38ff370SJamie Gritton 			mtx_lock(&pr->pr_mtx);
1842b38ff370SJamie Gritton 			pr->pr_ref++;
1843b38ff370SJamie Gritton 			pr->pr_uref++;
1844b38ff370SJamie Gritton 			mtx_unlock(&pr->pr_mtx);
1845b38ff370SJamie Gritton 		}
1846b38ff370SJamie Gritton 		if (!(flags & JAIL_ATTACH))
1847b38ff370SJamie Gritton 			sx_sunlock(&allprison_lock);
1848b38ff370SJamie Gritton 	}
1849c34bbd2aSEdward Tomasz Napierala 
1850cc5fd8c7SJamie Gritton 	goto done_free;
1851b38ff370SJamie Gritton 
18520304c731SJamie Gritton  done_deref_locked:
18530304c731SJamie Gritton 	prison_deref(pr, created
18540304c731SJamie Gritton 	    ? PD_LOCKED | PD_LIST_XLOCKED
18550304c731SJamie Gritton 	    : PD_DEREF | PD_LOCKED | PD_LIST_XLOCKED);
18560304c731SJamie Gritton 	goto done_releroot;
1857b38ff370SJamie Gritton  done_unlock_list:
1858b38ff370SJamie Gritton 	sx_xunlock(&allprison_lock);
1859b38ff370SJamie Gritton  done_releroot:
18605050aa86SKonstantin Belousov 	if (root != NULL)
1861b38ff370SJamie Gritton 		vrele(root);
1862b38ff370SJamie Gritton  done_errmsg:
1863b38ff370SJamie Gritton 	if (error) {
1864176ff3a0SJamie Gritton 		if (vfs_getopt(opts, "errmsg", (void **)&errmsg,
1865176ff3a0SJamie Gritton 		    &errmsg_len) == 0 && errmsg_len > 0) {
1866b38ff370SJamie Gritton 			errmsg_pos = 2 * vfs_getopt_pos(opts, "errmsg") + 1;
1867b38ff370SJamie Gritton 			if (optuio->uio_segflg == UIO_SYSSPACE)
1868b38ff370SJamie Gritton 				bcopy(errmsg,
1869b38ff370SJamie Gritton 				    optuio->uio_iov[errmsg_pos].iov_base,
1870b38ff370SJamie Gritton 				    errmsg_len);
1871b38ff370SJamie Gritton 			else
1872b38ff370SJamie Gritton 				copyout(errmsg,
1873b38ff370SJamie Gritton 				    optuio->uio_iov[errmsg_pos].iov_base,
1874b38ff370SJamie Gritton 				    errmsg_len);
1875b38ff370SJamie Gritton 		}
1876b38ff370SJamie Gritton 	}
1877b38ff370SJamie Gritton  done_free:
1878b38ff370SJamie Gritton #ifdef INET
1879b38ff370SJamie Gritton 	free(ip4, M_PRISON);
1880b38ff370SJamie Gritton #endif
1881b38ff370SJamie Gritton #ifdef INET6
1882b38ff370SJamie Gritton 	free(ip6, M_PRISON);
1883b38ff370SJamie Gritton #endif
18846dfe0a3dSMartin Matuska 	if (g_path != NULL)
18856dfe0a3dSMartin Matuska 		free(g_path, M_TEMP);
1886b38ff370SJamie Gritton 	vfs_freeopts(opts);
1887b38ff370SJamie Gritton 	return (error);
1888b38ff370SJamie Gritton }
1889b38ff370SJamie Gritton 
1890b38ff370SJamie Gritton 
1891b38ff370SJamie Gritton /*
1892b38ff370SJamie Gritton  * struct jail_get_args {
1893b38ff370SJamie Gritton  *	struct iovec *iovp;
1894b38ff370SJamie Gritton  *	unsigned int iovcnt;
1895b38ff370SJamie Gritton  *	int flags;
1896b38ff370SJamie Gritton  * };
1897b38ff370SJamie Gritton  */
1898b38ff370SJamie Gritton int
18998451d0ddSKip Macy sys_jail_get(struct thread *td, struct jail_get_args *uap)
1900b38ff370SJamie Gritton {
1901b38ff370SJamie Gritton 	struct uio *auio;
1902b38ff370SJamie Gritton 	int error;
1903b38ff370SJamie Gritton 
1904b38ff370SJamie Gritton 	/* Check that we have an even number of iovecs. */
1905b38ff370SJamie Gritton 	if (uap->iovcnt & 1)
1906b38ff370SJamie Gritton 		return (EINVAL);
1907b38ff370SJamie Gritton 
1908b38ff370SJamie Gritton 	error = copyinuio(uap->iovp, uap->iovcnt, &auio);
1909b38ff370SJamie Gritton 	if (error)
1910b38ff370SJamie Gritton 		return (error);
1911b38ff370SJamie Gritton 	error = kern_jail_get(td, auio, uap->flags);
1912b38ff370SJamie Gritton 	if (error == 0)
1913b38ff370SJamie Gritton 		error = copyout(auio->uio_iov, uap->iovp,
1914b38ff370SJamie Gritton 		    uap->iovcnt * sizeof (struct iovec));
1915b38ff370SJamie Gritton 	free(auio, M_IOV);
1916b38ff370SJamie Gritton 	return (error);
1917b38ff370SJamie Gritton }
1918b38ff370SJamie Gritton 
1919b38ff370SJamie Gritton int
1920b38ff370SJamie Gritton kern_jail_get(struct thread *td, struct uio *optuio, int flags)
1921b38ff370SJamie Gritton {
1922672756aaSJamie Gritton 	struct bool_flags *bf;
1923672756aaSJamie Gritton 	struct jailsys_flags *jsf;
19240304c731SJamie Gritton 	struct prison *pr, *mypr;
1925b38ff370SJamie Gritton 	struct vfsopt *opt;
1926b38ff370SJamie Gritton 	struct vfsoptlist *opts;
1927b38ff370SJamie Gritton 	char *errmsg, *name;
1928672756aaSJamie Gritton 	int error, errmsg_len, errmsg_pos, i, jid, len, locked, pos;
1929672756aaSJamie Gritton 	unsigned f;
1930b38ff370SJamie Gritton 
1931b38ff370SJamie Gritton 	if (flags & ~JAIL_GET_MASK)
1932b38ff370SJamie Gritton 		return (EINVAL);
1933b38ff370SJamie Gritton 
1934b38ff370SJamie Gritton 	/* Get the parameter list. */
1935b38ff370SJamie Gritton 	error = vfs_buildopts(optuio, &opts);
1936b38ff370SJamie Gritton 	if (error)
1937b38ff370SJamie Gritton 		return (error);
1938b38ff370SJamie Gritton 	errmsg_pos = vfs_getopt_pos(opts, "errmsg");
19390304c731SJamie Gritton 	mypr = td->td_ucred->cr_prison;
19401e2a13e6SJamie Gritton 
1941b38ff370SJamie Gritton 	/*
1942b38ff370SJamie Gritton 	 * Find the prison specified by one of: lastjid, jid, name.
1943b38ff370SJamie Gritton 	 */
1944b38ff370SJamie Gritton 	sx_slock(&allprison_lock);
1945b38ff370SJamie Gritton 	error = vfs_copyopt(opts, "lastjid", &jid, sizeof(jid));
1946b38ff370SJamie Gritton 	if (error == 0) {
1947b38ff370SJamie Gritton 		TAILQ_FOREACH(pr, &allprison, pr_list) {
19480304c731SJamie Gritton 			if (pr->pr_id > jid && prison_ischild(mypr, pr)) {
1949b38ff370SJamie Gritton 				mtx_lock(&pr->pr_mtx);
1950b38ff370SJamie Gritton 				if (pr->pr_ref > 0 &&
1951b38ff370SJamie Gritton 				    (pr->pr_uref > 0 || (flags & JAIL_DYING)))
1952b38ff370SJamie Gritton 					break;
1953b38ff370SJamie Gritton 				mtx_unlock(&pr->pr_mtx);
1954b38ff370SJamie Gritton 			}
1955b38ff370SJamie Gritton 		}
1956b38ff370SJamie Gritton 		if (pr != NULL)
1957b38ff370SJamie Gritton 			goto found_prison;
1958b38ff370SJamie Gritton 		error = ENOENT;
1959b38ff370SJamie Gritton 		vfs_opterror(opts, "no jail after %d", jid);
1960b38ff370SJamie Gritton 		goto done_unlock_list;
1961b38ff370SJamie Gritton 	} else if (error != ENOENT)
1962b38ff370SJamie Gritton 		goto done_unlock_list;
1963b38ff370SJamie Gritton 
1964b38ff370SJamie Gritton 	error = vfs_copyopt(opts, "jid", &jid, sizeof(jid));
1965b38ff370SJamie Gritton 	if (error == 0) {
1966b38ff370SJamie Gritton 		if (jid != 0) {
19670304c731SJamie Gritton 			pr = prison_find_child(mypr, jid);
1968b38ff370SJamie Gritton 			if (pr != NULL) {
1969b38ff370SJamie Gritton 				if (pr->pr_uref == 0 && !(flags & JAIL_DYING)) {
1970b38ff370SJamie Gritton 					mtx_unlock(&pr->pr_mtx);
1971b38ff370SJamie Gritton 					error = ENOENT;
1972b38ff370SJamie Gritton 					vfs_opterror(opts, "jail %d is dying",
1973b38ff370SJamie Gritton 					    jid);
1974b38ff370SJamie Gritton 					goto done_unlock_list;
1975b38ff370SJamie Gritton 				}
1976b38ff370SJamie Gritton 				goto found_prison;
1977b38ff370SJamie Gritton 			}
1978b38ff370SJamie Gritton 			error = ENOENT;
1979b38ff370SJamie Gritton 			vfs_opterror(opts, "jail %d not found", jid);
1980b38ff370SJamie Gritton 			goto done_unlock_list;
1981b38ff370SJamie Gritton 		}
1982b38ff370SJamie Gritton 	} else if (error != ENOENT)
1983b38ff370SJamie Gritton 		goto done_unlock_list;
1984b38ff370SJamie Gritton 
1985b38ff370SJamie Gritton 	error = vfs_getopt(opts, "name", (void **)&name, &len);
1986b38ff370SJamie Gritton 	if (error == 0) {
1987b38ff370SJamie Gritton 		if (len == 0 || name[len - 1] != '\0') {
1988b38ff370SJamie Gritton 			error = EINVAL;
1989b38ff370SJamie Gritton 			goto done_unlock_list;
1990b38ff370SJamie Gritton 		}
19910304c731SJamie Gritton 		pr = prison_find_name(mypr, name);
1992b38ff370SJamie Gritton 		if (pr != NULL) {
1993b38ff370SJamie Gritton 			if (pr->pr_uref == 0 && !(flags & JAIL_DYING)) {
1994b38ff370SJamie Gritton 				mtx_unlock(&pr->pr_mtx);
1995b38ff370SJamie Gritton 				error = ENOENT;
1996b38ff370SJamie Gritton 				vfs_opterror(opts, "jail \"%s\" is dying",
1997b38ff370SJamie Gritton 				    name);
1998b38ff370SJamie Gritton 				goto done_unlock_list;
1999b38ff370SJamie Gritton 			}
2000b38ff370SJamie Gritton 			goto found_prison;
2001b38ff370SJamie Gritton 		}
2002b38ff370SJamie Gritton 		error = ENOENT;
2003b38ff370SJamie Gritton 		vfs_opterror(opts, "jail \"%s\" not found", name);
2004b38ff370SJamie Gritton 		goto done_unlock_list;
2005b38ff370SJamie Gritton 	} else if (error != ENOENT)
2006b38ff370SJamie Gritton 		goto done_unlock_list;
2007b38ff370SJamie Gritton 
2008b38ff370SJamie Gritton 	vfs_opterror(opts, "no jail specified");
2009b38ff370SJamie Gritton 	error = ENOENT;
2010b38ff370SJamie Gritton 	goto done_unlock_list;
2011b38ff370SJamie Gritton 
2012b38ff370SJamie Gritton  found_prison:
2013b38ff370SJamie Gritton 	/* Get the parameters of the prison. */
2014b38ff370SJamie Gritton 	pr->pr_ref++;
2015b38ff370SJamie Gritton 	locked = PD_LOCKED;
2016b38ff370SJamie Gritton 	td->td_retval[0] = pr->pr_id;
2017b38ff370SJamie Gritton 	error = vfs_setopt(opts, "jid", &pr->pr_id, sizeof(pr->pr_id));
2018b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
2019b38ff370SJamie Gritton 		goto done_deref;
20200304c731SJamie Gritton 	i = (pr->pr_parent == mypr) ? 0 : pr->pr_parent->pr_id;
20210304c731SJamie Gritton 	error = vfs_setopt(opts, "parent", &i, sizeof(i));
2022b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
2023b38ff370SJamie Gritton 		goto done_deref;
20240304c731SJamie Gritton 	error = vfs_setopts(opts, "name", prison_name(mypr, pr));
20250304c731SJamie Gritton 	if (error != 0 && error != ENOENT)
20260304c731SJamie Gritton 		goto done_deref;
20270304c731SJamie Gritton 	error = vfs_setopt(opts, "cpuset.id", &pr->pr_cpuset->cs_id,
2028b38ff370SJamie Gritton 	    sizeof(pr->pr_cpuset->cs_id));
2029b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
2030b38ff370SJamie Gritton 		goto done_deref;
20310304c731SJamie Gritton 	error = vfs_setopts(opts, "path", prison_path(mypr, pr));
2032b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
2033b38ff370SJamie Gritton 		goto done_deref;
2034b38ff370SJamie Gritton #ifdef INET
2035b38ff370SJamie Gritton 	error = vfs_setopt_part(opts, "ip4.addr", pr->pr_ip4,
2036b38ff370SJamie Gritton 	    pr->pr_ip4s * sizeof(*pr->pr_ip4));
2037b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
2038b38ff370SJamie Gritton 		goto done_deref;
2039b38ff370SJamie Gritton #endif
2040b38ff370SJamie Gritton #ifdef INET6
2041b38ff370SJamie Gritton 	error = vfs_setopt_part(opts, "ip6.addr", pr->pr_ip6,
2042b38ff370SJamie Gritton 	    pr->pr_ip6s * sizeof(*pr->pr_ip6));
2043b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
2044b38ff370SJamie Gritton 		goto done_deref;
2045b38ff370SJamie Gritton #endif
2046b38ff370SJamie Gritton 	error = vfs_setopt(opts, "securelevel", &pr->pr_securelevel,
2047b38ff370SJamie Gritton 	    sizeof(pr->pr_securelevel));
2048b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
2049b38ff370SJamie Gritton 		goto done_deref;
2050b97457e2SJamie Gritton 	error = vfs_setopt(opts, "children.cur", &pr->pr_childcount,
2051b97457e2SJamie Gritton 	    sizeof(pr->pr_childcount));
2052b97457e2SJamie Gritton 	if (error != 0 && error != ENOENT)
2053b97457e2SJamie Gritton 		goto done_deref;
2054b97457e2SJamie Gritton 	error = vfs_setopt(opts, "children.max", &pr->pr_childmax,
2055b97457e2SJamie Gritton 	    sizeof(pr->pr_childmax));
2056b97457e2SJamie Gritton 	if (error != 0 && error != ENOENT)
2057b97457e2SJamie Gritton 		goto done_deref;
2058c1f19219SJamie Gritton 	error = vfs_setopts(opts, "host.hostname", pr->pr_hostname);
2059b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
2060b38ff370SJamie Gritton 		goto done_deref;
2061c1f19219SJamie Gritton 	error = vfs_setopts(opts, "host.domainname", pr->pr_domainname);
206276ca6f88SJamie Gritton 	if (error != 0 && error != ENOENT)
206376ca6f88SJamie Gritton 		goto done_deref;
2064c1f19219SJamie Gritton 	error = vfs_setopts(opts, "host.hostuuid", pr->pr_hostuuid);
206576ca6f88SJamie Gritton 	if (error != 0 && error != ENOENT)
206676ca6f88SJamie Gritton 		goto done_deref;
2067841c0c7eSNathan Whitehorn #ifdef COMPAT_FREEBSD32
2068a5c1afadSDmitry Chagin 	if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) {
206976ca6f88SJamie Gritton 		uint32_t hid32 = pr->pr_hostid;
207076ca6f88SJamie Gritton 
207176ca6f88SJamie Gritton 		error = vfs_setopt(opts, "host.hostid", &hid32, sizeof(hid32));
207276ca6f88SJamie Gritton 	} else
207376ca6f88SJamie Gritton #endif
207476ca6f88SJamie Gritton 	error = vfs_setopt(opts, "host.hostid", &pr->pr_hostid,
207576ca6f88SJamie Gritton 	    sizeof(pr->pr_hostid));
207676ca6f88SJamie Gritton 	if (error != 0 && error != ENOENT)
207776ca6f88SJamie Gritton 		goto done_deref;
20780304c731SJamie Gritton 	error = vfs_setopt(opts, "enforce_statfs", &pr->pr_enforce_statfs,
20790304c731SJamie Gritton 	    sizeof(pr->pr_enforce_statfs));
20800304c731SJamie Gritton 	if (error != 0 && error != ENOENT)
20810304c731SJamie Gritton 		goto done_deref;
20820cc207a6SMartin Matuska 	error = vfs_setopt(opts, "devfs_ruleset", &pr->pr_devfs_rsnum,
20830cc207a6SMartin Matuska 	    sizeof(pr->pr_devfs_rsnum));
20840cc207a6SMartin Matuska 	if (error != 0 && error != ENOENT)
20850cc207a6SMartin Matuska 		goto done_deref;
2086672756aaSJamie Gritton 	for (bf = pr_flag_bool;
2087672756aaSJamie Gritton 	     bf < pr_flag_bool + nitems(pr_flag_bool);
2088672756aaSJamie Gritton 	     bf++) {
2089672756aaSJamie Gritton 		i = (pr->pr_flags & bf->flag) ? 1 : 0;
2090672756aaSJamie Gritton 		error = vfs_setopt(opts, bf->name, &i, sizeof(i));
2091b38ff370SJamie Gritton 		if (error != 0 && error != ENOENT)
2092b38ff370SJamie Gritton 			goto done_deref;
2093b38ff370SJamie Gritton 		i = !i;
2094672756aaSJamie Gritton 		error = vfs_setopt(opts, bf->noname, &i, sizeof(i));
2095b38ff370SJamie Gritton 		if (error != 0 && error != ENOENT)
2096b38ff370SJamie Gritton 			goto done_deref;
20970304c731SJamie Gritton 	}
2098672756aaSJamie Gritton 	for (jsf = pr_flag_jailsys;
2099672756aaSJamie Gritton 	     jsf < pr_flag_jailsys + nitems(pr_flag_jailsys);
2100672756aaSJamie Gritton 	     jsf++) {
2101672756aaSJamie Gritton 		f = pr->pr_flags & (jsf->disable | jsf->new);
2102672756aaSJamie Gritton 		i = (f != 0 && f == jsf->disable) ? JAIL_SYS_DISABLE
2103672756aaSJamie Gritton 		    : (f == jsf->new) ? JAIL_SYS_NEW
21047cbf7213SJamie Gritton 		    : JAIL_SYS_INHERIT;
2105672756aaSJamie Gritton 		error = vfs_setopt(opts, jsf->name, &i, sizeof(i));
21067cbf7213SJamie Gritton 		if (error != 0 && error != ENOENT)
21077cbf7213SJamie Gritton 			goto done_deref;
21087cbf7213SJamie Gritton 	}
2109672756aaSJamie Gritton 	for (bf = pr_flag_allow;
21100e5c6bd4SJamie Gritton 	     bf < pr_flag_allow + nitems(pr_flag_allow) && bf->flag != 0;
2111672756aaSJamie Gritton 	     bf++) {
2112672756aaSJamie Gritton 		i = (pr->pr_allow & bf->flag) ? 1 : 0;
2113672756aaSJamie Gritton 		error = vfs_setopt(opts, bf->name, &i, sizeof(i));
21140304c731SJamie Gritton 		if (error != 0 && error != ENOENT)
21150304c731SJamie Gritton 			goto done_deref;
21160304c731SJamie Gritton 		i = !i;
2117672756aaSJamie Gritton 		error = vfs_setopt(opts, bf->noname, &i, sizeof(i));
21180304c731SJamie Gritton 		if (error != 0 && error != ENOENT)
21190304c731SJamie Gritton 			goto done_deref;
21200304c731SJamie Gritton 	}
2121b38ff370SJamie Gritton 	i = (pr->pr_uref == 0);
2122b38ff370SJamie Gritton 	error = vfs_setopt(opts, "dying", &i, sizeof(i));
2123b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
2124b38ff370SJamie Gritton 		goto done_deref;
2125b38ff370SJamie Gritton 	i = !i;
2126b38ff370SJamie Gritton 	error = vfs_setopt(opts, "nodying", &i, sizeof(i));
2127b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
2128b38ff370SJamie Gritton 		goto done_deref;
2129bd96bd15SIan Lepore 	error = vfs_setopt(opts, "osreldate", &pr->pr_osreldate,
2130bd96bd15SIan Lepore 	    sizeof(pr->pr_osreldate));
2131a1a4c1b0SIan Lepore 	if (error != 0 && error != ENOENT)
2132a1a4c1b0SIan Lepore 		goto done_deref;
2133a1a4c1b0SIan Lepore 	error = vfs_setopts(opts, "osrelease", pr->pr_osrelease);
2134a1a4c1b0SIan Lepore 	if (error != 0 && error != ENOENT)
2135a1a4c1b0SIan Lepore 		goto done_deref;
2136b38ff370SJamie Gritton 
2137b38ff370SJamie Gritton 	/* Get the module parameters. */
2138b38ff370SJamie Gritton 	mtx_unlock(&pr->pr_mtx);
2139b38ff370SJamie Gritton 	locked = 0;
2140b38ff370SJamie Gritton 	error = osd_jail_call(pr, PR_METHOD_GET, opts);
2141b38ff370SJamie Gritton 	if (error)
2142b38ff370SJamie Gritton 		goto done_deref;
2143b38ff370SJamie Gritton 	prison_deref(pr, PD_DEREF | PD_LIST_SLOCKED);
2144b38ff370SJamie Gritton 
2145b38ff370SJamie Gritton 	/* By now, all parameters should have been noted. */
2146b38ff370SJamie Gritton 	TAILQ_FOREACH(opt, opts, link) {
2147b38ff370SJamie Gritton 		if (!opt->seen && strcmp(opt->name, "errmsg")) {
2148b38ff370SJamie Gritton 			error = EINVAL;
2149b38ff370SJamie Gritton 			vfs_opterror(opts, "unknown parameter: %s", opt->name);
2150b38ff370SJamie Gritton 			goto done_errmsg;
2151b38ff370SJamie Gritton 		}
2152b38ff370SJamie Gritton 	}
2153b38ff370SJamie Gritton 
2154b38ff370SJamie Gritton 	/* Write the fetched parameters back to userspace. */
2155b38ff370SJamie Gritton 	error = 0;
2156b38ff370SJamie Gritton 	TAILQ_FOREACH(opt, opts, link) {
2157b38ff370SJamie Gritton 		if (opt->pos >= 0 && opt->pos != errmsg_pos) {
2158b38ff370SJamie Gritton 			pos = 2 * opt->pos + 1;
2159b38ff370SJamie Gritton 			optuio->uio_iov[pos].iov_len = opt->len;
2160b38ff370SJamie Gritton 			if (opt->value != NULL) {
2161b38ff370SJamie Gritton 				if (optuio->uio_segflg == UIO_SYSSPACE) {
2162b38ff370SJamie Gritton 					bcopy(opt->value,
2163b38ff370SJamie Gritton 					    optuio->uio_iov[pos].iov_base,
2164b38ff370SJamie Gritton 					    opt->len);
2165b38ff370SJamie Gritton 				} else {
2166b38ff370SJamie Gritton 					error = copyout(opt->value,
2167b38ff370SJamie Gritton 					    optuio->uio_iov[pos].iov_base,
2168b38ff370SJamie Gritton 					    opt->len);
2169b38ff370SJamie Gritton 					if (error)
2170b38ff370SJamie Gritton 						break;
2171b38ff370SJamie Gritton 				}
2172b38ff370SJamie Gritton 			}
2173b38ff370SJamie Gritton 		}
2174b38ff370SJamie Gritton 	}
2175b38ff370SJamie Gritton 	goto done_errmsg;
2176b38ff370SJamie Gritton 
2177b38ff370SJamie Gritton  done_deref:
2178b38ff370SJamie Gritton 	prison_deref(pr, locked | PD_DEREF | PD_LIST_SLOCKED);
2179b38ff370SJamie Gritton 	goto done_errmsg;
2180b38ff370SJamie Gritton 
2181b38ff370SJamie Gritton  done_unlock_list:
2182b38ff370SJamie Gritton 	sx_sunlock(&allprison_lock);
2183b38ff370SJamie Gritton  done_errmsg:
2184b38ff370SJamie Gritton 	if (error && errmsg_pos >= 0) {
2185b38ff370SJamie Gritton 		vfs_getopt(opts, "errmsg", (void **)&errmsg, &errmsg_len);
2186b38ff370SJamie Gritton 		errmsg_pos = 2 * errmsg_pos + 1;
2187b38ff370SJamie Gritton 		if (errmsg_len > 0) {
2188b38ff370SJamie Gritton 			if (optuio->uio_segflg == UIO_SYSSPACE)
2189b38ff370SJamie Gritton 				bcopy(errmsg,
2190b38ff370SJamie Gritton 				    optuio->uio_iov[errmsg_pos].iov_base,
2191b38ff370SJamie Gritton 				    errmsg_len);
2192b38ff370SJamie Gritton 			else
2193b38ff370SJamie Gritton 				copyout(errmsg,
2194b38ff370SJamie Gritton 				    optuio->uio_iov[errmsg_pos].iov_base,
2195b38ff370SJamie Gritton 				    errmsg_len);
2196b38ff370SJamie Gritton 		}
2197b38ff370SJamie Gritton 	}
2198b38ff370SJamie Gritton 	vfs_freeopts(opts);
2199b38ff370SJamie Gritton 	return (error);
2200b38ff370SJamie Gritton }
2201b38ff370SJamie Gritton 
22020304c731SJamie Gritton 
2203b38ff370SJamie Gritton /*
2204b38ff370SJamie Gritton  * struct jail_remove_args {
2205b38ff370SJamie Gritton  *	int jid;
2206b38ff370SJamie Gritton  * };
2207b38ff370SJamie Gritton  */
2208b38ff370SJamie Gritton int
22098451d0ddSKip Macy sys_jail_remove(struct thread *td, struct jail_remove_args *uap)
2210b38ff370SJamie Gritton {
22110304c731SJamie Gritton 	struct prison *pr, *cpr, *lpr, *tpr;
22120304c731SJamie Gritton 	int descend, error;
2213b38ff370SJamie Gritton 
2214b38ff370SJamie Gritton 	error = priv_check(td, PRIV_JAIL_REMOVE);
2215b38ff370SJamie Gritton 	if (error)
2216b38ff370SJamie Gritton 		return (error);
2217b38ff370SJamie Gritton 
2218b38ff370SJamie Gritton 	sx_xlock(&allprison_lock);
22190304c731SJamie Gritton 	pr = prison_find_child(td->td_ucred->cr_prison, uap->jid);
2220b38ff370SJamie Gritton 	if (pr == NULL) {
2221b38ff370SJamie Gritton 		sx_xunlock(&allprison_lock);
2222b38ff370SJamie Gritton 		return (EINVAL);
2223b38ff370SJamie Gritton 	}
2224b38ff370SJamie Gritton 
22250304c731SJamie Gritton 	/* Remove all descendants of this prison, then remove this prison. */
22260304c731SJamie Gritton 	pr->pr_ref++;
22270304c731SJamie Gritton 	if (!LIST_EMPTY(&pr->pr_children)) {
22280304c731SJamie Gritton 		mtx_unlock(&pr->pr_mtx);
22290304c731SJamie Gritton 		lpr = NULL;
22300304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT(pr, cpr, descend) {
22310304c731SJamie Gritton 			mtx_lock(&cpr->pr_mtx);
22320304c731SJamie Gritton 			if (cpr->pr_ref > 0) {
22330304c731SJamie Gritton 				tpr = cpr;
22340304c731SJamie Gritton 				cpr->pr_ref++;
22350304c731SJamie Gritton 			} else {
22360304c731SJamie Gritton 				/* Already removed - do not do it again. */
22370304c731SJamie Gritton 				tpr = NULL;
22380304c731SJamie Gritton 			}
22390304c731SJamie Gritton 			mtx_unlock(&cpr->pr_mtx);
22400304c731SJamie Gritton 			if (lpr != NULL) {
22410304c731SJamie Gritton 				mtx_lock(&lpr->pr_mtx);
22420304c731SJamie Gritton 				prison_remove_one(lpr);
22430304c731SJamie Gritton 				sx_xlock(&allprison_lock);
22440304c731SJamie Gritton 			}
22450304c731SJamie Gritton 			lpr = tpr;
22460304c731SJamie Gritton 		}
22470304c731SJamie Gritton 		if (lpr != NULL) {
22480304c731SJamie Gritton 			mtx_lock(&lpr->pr_mtx);
22490304c731SJamie Gritton 			prison_remove_one(lpr);
22500304c731SJamie Gritton 			sx_xlock(&allprison_lock);
22510304c731SJamie Gritton 		}
22520304c731SJamie Gritton 		mtx_lock(&pr->pr_mtx);
22530304c731SJamie Gritton 	}
22540304c731SJamie Gritton 	prison_remove_one(pr);
22550304c731SJamie Gritton 	return (0);
22560304c731SJamie Gritton }
22570304c731SJamie Gritton 
22580304c731SJamie Gritton static void
22590304c731SJamie Gritton prison_remove_one(struct prison *pr)
22600304c731SJamie Gritton {
22610304c731SJamie Gritton 	struct proc *p;
22620304c731SJamie Gritton 	int deuref;
22630304c731SJamie Gritton 
2264b38ff370SJamie Gritton 	/* If the prison was persistent, it is not anymore. */
2265b38ff370SJamie Gritton 	deuref = 0;
2266b38ff370SJamie Gritton 	if (pr->pr_flags & PR_PERSIST) {
2267b38ff370SJamie Gritton 		pr->pr_ref--;
2268b38ff370SJamie Gritton 		deuref = PD_DEUREF;
2269b38ff370SJamie Gritton 		pr->pr_flags &= ~PR_PERSIST;
2270b38ff370SJamie Gritton 	}
2271b38ff370SJamie Gritton 
22720304c731SJamie Gritton 	/*
22730304c731SJamie Gritton 	 * jail_remove added a reference.  If that's the only one, remove
22740304c731SJamie Gritton 	 * the prison now.
22750304c731SJamie Gritton 	 */
22760304c731SJamie Gritton 	KASSERT(pr->pr_ref > 0,
22770304c731SJamie Gritton 	    ("prison_remove_one removing a dead prison (jid=%d)", pr->pr_id));
22780304c731SJamie Gritton 	if (pr->pr_ref == 1) {
2279b38ff370SJamie Gritton 		prison_deref(pr,
2280b38ff370SJamie Gritton 		    deuref | PD_DEREF | PD_LOCKED | PD_LIST_XLOCKED);
22810304c731SJamie Gritton 		return;
2282b38ff370SJamie Gritton 	}
2283b38ff370SJamie Gritton 
2284b38ff370SJamie Gritton 	mtx_unlock(&pr->pr_mtx);
2285b38ff370SJamie Gritton 	sx_xunlock(&allprison_lock);
2286b38ff370SJamie Gritton 	/*
2287b38ff370SJamie Gritton 	 * Kill all processes unfortunate enough to be attached to this prison.
2288b38ff370SJamie Gritton 	 */
2289b38ff370SJamie Gritton 	sx_slock(&allproc_lock);
22907938a442SBjoern A. Zeeb 	FOREACH_PROC_IN_SYSTEM(p) {
2291b38ff370SJamie Gritton 		PROC_LOCK(p);
2292b38ff370SJamie Gritton 		if (p->p_state != PRS_NEW && p->p_ucred &&
2293b38ff370SJamie Gritton 		    p->p_ucred->cr_prison == pr)
22948451d0ddSKip Macy 			kern_psignal(p, SIGKILL);
2295b38ff370SJamie Gritton 		PROC_UNLOCK(p);
2296b38ff370SJamie Gritton 	}
2297b38ff370SJamie Gritton 	sx_sunlock(&allproc_lock);
22980304c731SJamie Gritton 	/* Remove the temporary reference added by jail_remove. */
2299b38ff370SJamie Gritton 	prison_deref(pr, deuref | PD_DEREF);
230075c13541SPoul-Henning Kamp }
230175c13541SPoul-Henning Kamp 
23028571af59SJamie Gritton 
2303fd7a8150SMike Barcroft /*
23049ddb7954SMike Barcroft  * struct jail_attach_args {
23059ddb7954SMike Barcroft  *	int jid;
23069ddb7954SMike Barcroft  * };
2307fd7a8150SMike Barcroft  */
2308fd7a8150SMike Barcroft int
23098451d0ddSKip Macy sys_jail_attach(struct thread *td, struct jail_attach_args *uap)
2310fd7a8150SMike Barcroft {
2311b38ff370SJamie Gritton 	struct prison *pr;
2312b38ff370SJamie Gritton 	int error;
2313b38ff370SJamie Gritton 
2314b38ff370SJamie Gritton 	error = priv_check(td, PRIV_JAIL_ATTACH);
2315b38ff370SJamie Gritton 	if (error)
2316b38ff370SJamie Gritton 		return (error);
2317b38ff370SJamie Gritton 
2318ef0ddea3SJamie Gritton 	/*
2319ef0ddea3SJamie Gritton 	 * Start with exclusive hold on allprison_lock to ensure that a possible
2320ef0ddea3SJamie Gritton 	 * PR_METHOD_REMOVE call isn't concurrent with jail_set or jail_remove.
2321ef0ddea3SJamie Gritton 	 * But then immediately downgrade it since we don't need to stop
2322ef0ddea3SJamie Gritton 	 * readers.
2323ef0ddea3SJamie Gritton 	 */
2324ef0ddea3SJamie Gritton 	sx_xlock(&allprison_lock);
2325ef0ddea3SJamie Gritton 	sx_downgrade(&allprison_lock);
23260304c731SJamie Gritton 	pr = prison_find_child(td->td_ucred->cr_prison, uap->jid);
2327b38ff370SJamie Gritton 	if (pr == NULL) {
2328b38ff370SJamie Gritton 		sx_sunlock(&allprison_lock);
2329b38ff370SJamie Gritton 		return (EINVAL);
2330b38ff370SJamie Gritton 	}
2331b38ff370SJamie Gritton 
2332b38ff370SJamie Gritton 	/*
2333b38ff370SJamie Gritton 	 * Do not allow a process to attach to a prison that is not
2334b38ff370SJamie Gritton 	 * considered to be "alive".
2335b38ff370SJamie Gritton 	 */
2336b38ff370SJamie Gritton 	if (pr->pr_uref == 0) {
2337b38ff370SJamie Gritton 		mtx_unlock(&pr->pr_mtx);
2338b38ff370SJamie Gritton 		sx_sunlock(&allprison_lock);
2339b38ff370SJamie Gritton 		return (EINVAL);
2340b38ff370SJamie Gritton 	}
2341b38ff370SJamie Gritton 
2342b38ff370SJamie Gritton 	return (do_jail_attach(td, pr));
2343b38ff370SJamie Gritton }
2344b38ff370SJamie Gritton 
2345b38ff370SJamie Gritton static int
2346b38ff370SJamie Gritton do_jail_attach(struct thread *td, struct prison *pr)
2347b38ff370SJamie Gritton {
2348fd7a8150SMike Barcroft 	struct proc *p;
2349fd7a8150SMike Barcroft 	struct ucred *newcred, *oldcred;
23505050aa86SKonstantin Belousov 	int error;
2351fd7a8150SMike Barcroft 
235257f22bd4SJacques Vidrine 	/*
235357f22bd4SJacques Vidrine 	 * XXX: Note that there is a slight race here if two threads
235457f22bd4SJacques Vidrine 	 * in the same privileged process attempt to attach to two
235557f22bd4SJacques Vidrine 	 * different jails at the same time.  It is important for
235657f22bd4SJacques Vidrine 	 * user processes not to do this, or they might end up with
235757f22bd4SJacques Vidrine 	 * a process root from one prison, but attached to the jail
235857f22bd4SJacques Vidrine 	 * of another.
235957f22bd4SJacques Vidrine 	 */
2360fd7a8150SMike Barcroft 	pr->pr_ref++;
2361b38ff370SJamie Gritton 	pr->pr_uref++;
2362fd7a8150SMike Barcroft 	mtx_unlock(&pr->pr_mtx);
2363b38ff370SJamie Gritton 
2364b38ff370SJamie Gritton 	/* Let modules do whatever they need to prepare for attaching. */
2365b38ff370SJamie Gritton 	error = osd_jail_call(pr, PR_METHOD_ATTACH, td);
2366b38ff370SJamie Gritton 	if (error) {
2367b38ff370SJamie Gritton 		prison_deref(pr, PD_DEREF | PD_DEUREF | PD_LIST_SLOCKED);
2368b38ff370SJamie Gritton 		return (error);
2369b38ff370SJamie Gritton 	}
2370dc68a633SPawel Jakub Dawidek 	sx_sunlock(&allprison_lock);
2371fd7a8150SMike Barcroft 
2372413628a7SBjoern A. Zeeb 	/*
2373413628a7SBjoern A. Zeeb 	 * Reparent the newly attached process to this jail.
2374413628a7SBjoern A. Zeeb 	 */
2375b38ff370SJamie Gritton 	p = td->td_proc;
2376413628a7SBjoern A. Zeeb 	error = cpuset_setproc_update_set(p, pr->pr_cpuset);
2377413628a7SBjoern A. Zeeb 	if (error)
2378b38ff370SJamie Gritton 		goto e_revert_osd;
2379413628a7SBjoern A. Zeeb 
2380cb05b60aSAttilio Rao 	vn_lock(pr->pr_root, LK_EXCLUSIVE | LK_RETRY);
2381fd7a8150SMike Barcroft 	if ((error = change_dir(pr->pr_root, td)) != 0)
2382fd7a8150SMike Barcroft 		goto e_unlock;
2383fd7a8150SMike Barcroft #ifdef MAC
238430d239bcSRobert Watson 	if ((error = mac_vnode_check_chroot(td->td_ucred, pr->pr_root)))
2385fd7a8150SMike Barcroft 		goto e_unlock;
2386fd7a8150SMike Barcroft #endif
238722db15c0SAttilio Rao 	VOP_UNLOCK(pr->pr_root, 0);
2388f0725a8eSMateusz Guzik 	if ((error = pwd_chroot(td, pr->pr_root)))
23895050aa86SKonstantin Belousov 		goto e_revert_osd;
2390fd7a8150SMike Barcroft 
2391fd7a8150SMike Barcroft 	newcred = crget();
2392fd7a8150SMike Barcroft 	PROC_LOCK(p);
23931fb6767dSJamie Gritton 	oldcred = crcopysafe(p, newcred);
239469c4ee54SJohn Baldwin 	newcred->cr_prison = pr;
2395daf63fd2SMateusz Guzik 	proc_set_cred(p, newcred);
23961fb6767dSJamie Gritton 	setsugid(p);
2397097055e2SEdward Tomasz Napierala #ifdef RACCT
2398097055e2SEdward Tomasz Napierala 	racct_proc_ucred_changed(p, oldcred, newcred);
2399f87beb93SAndriy Gapon 	crhold(newcred);
2400f87beb93SAndriy Gapon #endif
2401f87beb93SAndriy Gapon 	PROC_UNLOCK(p);
2402f87beb93SAndriy Gapon #ifdef RCTL
2403f87beb93SAndriy Gapon 	rctl_proc_ucred_changed(p, newcred);
2404f87beb93SAndriy Gapon 	crfree(newcred);
2405097055e2SEdward Tomasz Napierala #endif
24061fb6767dSJamie Gritton 	prison_deref(oldcred->cr_prison, PD_DEREF | PD_DEUREF);
2407fd7a8150SMike Barcroft 	crfree(oldcred);
2408fd7a8150SMike Barcroft 	return (0);
24091fb6767dSJamie Gritton 
2410fd7a8150SMike Barcroft  e_unlock:
241122db15c0SAttilio Rao 	VOP_UNLOCK(pr->pr_root, 0);
2412b38ff370SJamie Gritton  e_revert_osd:
2413b38ff370SJamie Gritton 	/* Tell modules this thread is still in its old jail after all. */
24141fb6767dSJamie Gritton 	(void)osd_jail_call(td->td_ucred->cr_prison, PR_METHOD_ATTACH, td);
2415b38ff370SJamie Gritton 	prison_deref(pr, PD_DEREF | PD_DEUREF);
2416fd7a8150SMike Barcroft 	return (error);
2417fd7a8150SMike Barcroft }
2418fd7a8150SMike Barcroft 
24190304c731SJamie Gritton 
2420fd7a8150SMike Barcroft /*
2421fd7a8150SMike Barcroft  * Returns a locked prison instance, or NULL on failure.
2422fd7a8150SMike Barcroft  */
242354b369c1SPawel Jakub Dawidek struct prison *
2424fd7a8150SMike Barcroft prison_find(int prid)
2425fd7a8150SMike Barcroft {
2426fd7a8150SMike Barcroft 	struct prison *pr;
2427fd7a8150SMike Barcroft 
2428dc68a633SPawel Jakub Dawidek 	sx_assert(&allprison_lock, SX_LOCKED);
2429b38ff370SJamie Gritton 	TAILQ_FOREACH(pr, &allprison, pr_list) {
2430fd7a8150SMike Barcroft 		if (pr->pr_id == prid) {
2431fd7a8150SMike Barcroft 			mtx_lock(&pr->pr_mtx);
2432b38ff370SJamie Gritton 			if (pr->pr_ref > 0)
2433fd7a8150SMike Barcroft 				return (pr);
2434b38ff370SJamie Gritton 			mtx_unlock(&pr->pr_mtx);
2435fd7a8150SMike Barcroft 		}
2436fd7a8150SMike Barcroft 	}
2437fd7a8150SMike Barcroft 	return (NULL);
2438fd7a8150SMike Barcroft }
2439fd7a8150SMike Barcroft 
2440b38ff370SJamie Gritton /*
24410304c731SJamie Gritton  * Find a prison that is a descendant of mypr.  Returns a locked prison or NULL.
2442b38ff370SJamie Gritton  */
2443b38ff370SJamie Gritton struct prison *
24440304c731SJamie Gritton prison_find_child(struct prison *mypr, int prid)
2445b38ff370SJamie Gritton {
24460304c731SJamie Gritton 	struct prison *pr;
24470304c731SJamie Gritton 	int descend;
2448b38ff370SJamie Gritton 
2449b38ff370SJamie Gritton 	sx_assert(&allprison_lock, SX_LOCKED);
24500304c731SJamie Gritton 	FOREACH_PRISON_DESCENDANT(mypr, pr, descend) {
24510304c731SJamie Gritton 		if (pr->pr_id == prid) {
24520304c731SJamie Gritton 			mtx_lock(&pr->pr_mtx);
24530304c731SJamie Gritton 			if (pr->pr_ref > 0)
24540304c731SJamie Gritton 				return (pr);
24550304c731SJamie Gritton 			mtx_unlock(&pr->pr_mtx);
24560304c731SJamie Gritton 		}
24570304c731SJamie Gritton 	}
24580304c731SJamie Gritton 	return (NULL);
24590304c731SJamie Gritton }
24600304c731SJamie Gritton 
24610304c731SJamie Gritton /*
24620304c731SJamie Gritton  * Look for the name relative to mypr.  Returns a locked prison or NULL.
24630304c731SJamie Gritton  */
24640304c731SJamie Gritton struct prison *
24650304c731SJamie Gritton prison_find_name(struct prison *mypr, const char *name)
24660304c731SJamie Gritton {
24670304c731SJamie Gritton 	struct prison *pr, *deadpr;
24680304c731SJamie Gritton 	size_t mylen;
24690304c731SJamie Gritton 	int descend;
24700304c731SJamie Gritton 
24710304c731SJamie Gritton 	sx_assert(&allprison_lock, SX_LOCKED);
24720304c731SJamie Gritton 	mylen = (mypr == &prison0) ? 0 : strlen(mypr->pr_name) + 1;
2473b38ff370SJamie Gritton  again:
2474b38ff370SJamie Gritton 	deadpr = NULL;
24750304c731SJamie Gritton 	FOREACH_PRISON_DESCENDANT(mypr, pr, descend) {
24760304c731SJamie Gritton 		if (!strcmp(pr->pr_name + mylen, name)) {
2477b38ff370SJamie Gritton 			mtx_lock(&pr->pr_mtx);
2478b38ff370SJamie Gritton 			if (pr->pr_ref > 0) {
2479b38ff370SJamie Gritton 				if (pr->pr_uref > 0)
2480b38ff370SJamie Gritton 					return (pr);
2481b38ff370SJamie Gritton 				deadpr = pr;
2482b38ff370SJamie Gritton 			}
2483b38ff370SJamie Gritton 			mtx_unlock(&pr->pr_mtx);
2484b38ff370SJamie Gritton 		}
2485b38ff370SJamie Gritton 	}
24860304c731SJamie Gritton 	/* There was no valid prison - perhaps there was a dying one. */
2487b38ff370SJamie Gritton 	if (deadpr != NULL) {
2488b38ff370SJamie Gritton 		mtx_lock(&deadpr->pr_mtx);
2489b38ff370SJamie Gritton 		if (deadpr->pr_ref == 0) {
2490b38ff370SJamie Gritton 			mtx_unlock(&deadpr->pr_mtx);
2491b38ff370SJamie Gritton 			goto again;
2492b38ff370SJamie Gritton 		}
2493b38ff370SJamie Gritton 	}
2494b38ff370SJamie Gritton 	return (deadpr);
2495b38ff370SJamie Gritton }
2496b38ff370SJamie Gritton 
2497b38ff370SJamie Gritton /*
24980304c731SJamie Gritton  * See if a prison has the specific flag set.
24990304c731SJamie Gritton  */
25000304c731SJamie Gritton int
25010304c731SJamie Gritton prison_flag(struct ucred *cred, unsigned flag)
25020304c731SJamie Gritton {
25030304c731SJamie Gritton 
25040304c731SJamie Gritton 	/* This is an atomic read, so no locking is necessary. */
25050304c731SJamie Gritton 	return (cred->cr_prison->pr_flags & flag);
25060304c731SJamie Gritton }
25070304c731SJamie Gritton 
25080304c731SJamie Gritton int
25090304c731SJamie Gritton prison_allow(struct ucred *cred, unsigned flag)
25100304c731SJamie Gritton {
25110304c731SJamie Gritton 
25120304c731SJamie Gritton 	/* This is an atomic read, so no locking is necessary. */
25130304c731SJamie Gritton 	return (cred->cr_prison->pr_allow & flag);
25140304c731SJamie Gritton }
25150304c731SJamie Gritton 
25160304c731SJamie Gritton /*
2517b38ff370SJamie Gritton  * Remove a prison reference.  If that was the last reference, remove the
2518b38ff370SJamie Gritton  * prison itself - but not in this context in case there are locks held.
2519b38ff370SJamie Gritton  */
252091421ba2SRobert Watson void
25211ba4a712SPawel Jakub Dawidek prison_free_locked(struct prison *pr)
252291421ba2SRobert Watson {
252373d9e52dSJamie Gritton 	int ref;
252491421ba2SRobert Watson 
25251ba4a712SPawel Jakub Dawidek 	mtx_assert(&pr->pr_mtx, MA_OWNED);
252673d9e52dSJamie Gritton 	ref = --pr->pr_ref;
252701137630SRobert Watson 	mtx_unlock(&pr->pr_mtx);
252873d9e52dSJamie Gritton 	if (ref == 0)
2529c2cda609SPawel Jakub Dawidek 		taskqueue_enqueue(taskqueue_thread, &pr->pr_task);
2530c2cda609SPawel Jakub Dawidek }
2531c2cda609SPawel Jakub Dawidek 
25321ba4a712SPawel Jakub Dawidek void
25331ba4a712SPawel Jakub Dawidek prison_free(struct prison *pr)
25341ba4a712SPawel Jakub Dawidek {
25351ba4a712SPawel Jakub Dawidek 
25361ba4a712SPawel Jakub Dawidek 	mtx_lock(&pr->pr_mtx);
25371ba4a712SPawel Jakub Dawidek 	prison_free_locked(pr);
25381ba4a712SPawel Jakub Dawidek }
25391ba4a712SPawel Jakub Dawidek 
254073d9e52dSJamie Gritton /*
254173d9e52dSJamie Gritton  * Complete a call to either prison_free or prison_proc_free.
254273d9e52dSJamie Gritton  */
2543c2cda609SPawel Jakub Dawidek static void
2544c2cda609SPawel Jakub Dawidek prison_complete(void *context, int pending)
2545c2cda609SPawel Jakub Dawidek {
254673d9e52dSJamie Gritton 	struct prison *pr = context;
2547b38ff370SJamie Gritton 
2548ef0ddea3SJamie Gritton 	sx_xlock(&allprison_lock);
254973d9e52dSJamie Gritton 	mtx_lock(&pr->pr_mtx);
255073d9e52dSJamie Gritton 	prison_deref(pr, pr->pr_uref
2551ef0ddea3SJamie Gritton 	    ? PD_DEREF | PD_DEUREF | PD_LOCKED | PD_LIST_XLOCKED
2552ef0ddea3SJamie Gritton 	    : PD_LOCKED | PD_LIST_XLOCKED);
2553b38ff370SJamie Gritton }
2554b38ff370SJamie Gritton 
2555b38ff370SJamie Gritton /*
2556b38ff370SJamie Gritton  * Remove a prison reference (usually).  This internal version assumes no
2557b38ff370SJamie Gritton  * mutexes are held, except perhaps the prison itself.  If there are no more
2558b38ff370SJamie Gritton  * references, release and delist the prison.  On completion, the prison lock
2559b38ff370SJamie Gritton  * and the allprison lock are both unlocked.
2560b38ff370SJamie Gritton  */
2561b38ff370SJamie Gritton static void
2562b38ff370SJamie Gritton prison_deref(struct prison *pr, int flags)
2563b38ff370SJamie Gritton {
25640304c731SJamie Gritton 	struct prison *ppr, *tpr;
2565cc5fd8c7SJamie Gritton 	int ref, lasturef;
2566c2cda609SPawel Jakub Dawidek 
2567b38ff370SJamie Gritton 	if (!(flags & PD_LOCKED))
2568b38ff370SJamie Gritton 		mtx_lock(&pr->pr_mtx);
25690304c731SJamie Gritton 	for (;;) {
2570e6d5cb63SJamie Gritton 		if (flags & PD_DEUREF) {
257173d9e52dSJamie Gritton 			KASSERT(pr->pr_uref > 0,
257273d9e52dSJamie Gritton 			    ("prison_deref PD_DEUREF on a dead prison (jid=%d)",
257373d9e52dSJamie Gritton 			     pr->pr_id));
2574e6d5cb63SJamie Gritton 			pr->pr_uref--;
2575cc5fd8c7SJamie Gritton 			lasturef = pr->pr_uref == 0;
2576cc5fd8c7SJamie Gritton 			if (lasturef)
2577cc5fd8c7SJamie Gritton 				pr->pr_ref++;
2578e6d5cb63SJamie Gritton 			KASSERT(prison0.pr_uref != 0, ("prison0 pr_uref=0"));
2579cc5fd8c7SJamie Gritton 		} else
2580cc5fd8c7SJamie Gritton 			lasturef = 0;
258173d9e52dSJamie Gritton 		if (flags & PD_DEREF) {
258273d9e52dSJamie Gritton 			KASSERT(pr->pr_ref > 0,
258373d9e52dSJamie Gritton 			    ("prison_deref PD_DEREF on a dead prison (jid=%d)",
258473d9e52dSJamie Gritton 			     pr->pr_id));
2585b38ff370SJamie Gritton 			pr->pr_ref--;
258673d9e52dSJamie Gritton 		}
2587cc5fd8c7SJamie Gritton 		ref = pr->pr_ref;
2588b38ff370SJamie Gritton 		mtx_unlock(&pr->pr_mtx);
2589cc5fd8c7SJamie Gritton 
2590cc5fd8c7SJamie Gritton 		/*
2591cc5fd8c7SJamie Gritton 		 * Tell the modules if the last user reference was removed
2592cc5fd8c7SJamie Gritton 		 * (even it sticks around in dying state).
2593cc5fd8c7SJamie Gritton 		 */
2594cc5fd8c7SJamie Gritton 		if (lasturef) {
2595cc5fd8c7SJamie Gritton 			if (!(flags & (PD_LIST_SLOCKED | PD_LIST_XLOCKED))) {
2596cc5fd8c7SJamie Gritton 				sx_xlock(&allprison_lock);
2597cc5fd8c7SJamie Gritton 				flags |= PD_LIST_XLOCKED;
2598cc5fd8c7SJamie Gritton 			}
2599cc5fd8c7SJamie Gritton 			(void)osd_jail_call(pr, PR_METHOD_REMOVE, NULL);
2600cc5fd8c7SJamie Gritton 			mtx_lock(&pr->pr_mtx);
2601cc5fd8c7SJamie Gritton 			ref = --pr->pr_ref;
2602cc5fd8c7SJamie Gritton 			mtx_unlock(&pr->pr_mtx);
2603cc5fd8c7SJamie Gritton 		}
2604cc5fd8c7SJamie Gritton 
2605cc5fd8c7SJamie Gritton 		/* If the prison still has references, nothing else to do. */
2606cc5fd8c7SJamie Gritton 		if (ref > 0) {
2607b38ff370SJamie Gritton 			if (flags & PD_LIST_SLOCKED)
2608b38ff370SJamie Gritton 				sx_sunlock(&allprison_lock);
2609b38ff370SJamie Gritton 			else if (flags & PD_LIST_XLOCKED)
2610b38ff370SJamie Gritton 				sx_xunlock(&allprison_lock);
2611b38ff370SJamie Gritton 			return;
2612b38ff370SJamie Gritton 		}
2613c2cda609SPawel Jakub Dawidek 
2614b38ff370SJamie Gritton 		if (flags & PD_LIST_SLOCKED) {
2615b38ff370SJamie Gritton 			if (!sx_try_upgrade(&allprison_lock)) {
2616b38ff370SJamie Gritton 				sx_sunlock(&allprison_lock);
2617c2cda609SPawel Jakub Dawidek 				sx_xlock(&allprison_lock);
2618b38ff370SJamie Gritton 			}
2619b38ff370SJamie Gritton 		} else if (!(flags & PD_LIST_XLOCKED))
2620b38ff370SJamie Gritton 			sx_xlock(&allprison_lock);
2621b38ff370SJamie Gritton 
2622b38ff370SJamie Gritton 		TAILQ_REMOVE(&allprison, pr, pr_list);
26230304c731SJamie Gritton 		LIST_REMOVE(pr, pr_sibling);
26240304c731SJamie Gritton 		ppr = pr->pr_parent;
26250304c731SJamie Gritton 		for (tpr = ppr; tpr != NULL; tpr = tpr->pr_parent)
2626b97457e2SJamie Gritton 			tpr->pr_childcount--;
2627c4884ffaSJamie Gritton 		sx_xunlock(&allprison_lock);
26281ba4a712SPawel Jakub Dawidek 
2629679e1390SJamie Gritton #ifdef VIMAGE
26300cb8b6a9SMarko Zec 		if (pr->pr_vnet != ppr->pr_vnet)
2631679e1390SJamie Gritton 			vnet_destroy(pr->pr_vnet);
2632679e1390SJamie Gritton #endif
26335050aa86SKonstantin Belousov 		if (pr->pr_root != NULL)
2634b3059e09SRobert Watson 			vrele(pr->pr_root);
2635b3059e09SRobert Watson 		mtx_destroy(&pr->pr_mtx);
2636413628a7SBjoern A. Zeeb #ifdef INET
2637413628a7SBjoern A. Zeeb 		free(pr->pr_ip4, M_PRISON);
2638413628a7SBjoern A. Zeeb #endif
2639b38ff370SJamie Gritton #ifdef INET6
2640b38ff370SJamie Gritton 		free(pr->pr_ip6, M_PRISON);
2641b38ff370SJamie Gritton #endif
2642b38ff370SJamie Gritton 		if (pr->pr_cpuset != NULL)
2643b38ff370SJamie Gritton 			cpuset_rel(pr->pr_cpuset);
2644b38ff370SJamie Gritton 		osd_jail_exit(pr);
2645a7ad07bfSEdward Tomasz Napierala #ifdef RACCT
26464b5c9cf6SEdward Tomasz Napierala 		if (racct_enable)
2647a7ad07bfSEdward Tomasz Napierala 			prison_racct_detach(pr);
2648ec125fbbSEdward Tomasz Napierala #endif
26491ede983cSDag-Erling Smørgrav 		free(pr, M_PRISON);
26500304c731SJamie Gritton 
26510304c731SJamie Gritton 		/* Removing a prison frees a reference on its parent. */
26520304c731SJamie Gritton 		pr = ppr;
26530304c731SJamie Gritton 		mtx_lock(&pr->pr_mtx);
2654e6d5cb63SJamie Gritton 		flags = PD_DEREF | PD_DEUREF;
26550304c731SJamie Gritton 	}
2656b3059e09SRobert Watson }
2657b3059e09SRobert Watson 
265891421ba2SRobert Watson void
26591ba4a712SPawel Jakub Dawidek prison_hold_locked(struct prison *pr)
26601ba4a712SPawel Jakub Dawidek {
26611ba4a712SPawel Jakub Dawidek 
26621ba4a712SPawel Jakub Dawidek 	mtx_assert(&pr->pr_mtx, MA_OWNED);
26631ba4a712SPawel Jakub Dawidek 	KASSERT(pr->pr_ref > 0,
266436b41cc3SBjoern A. Zeeb 	    ("Trying to hold dead prison %p (jid=%d).", pr, pr->pr_id));
26651ba4a712SPawel Jakub Dawidek 	pr->pr_ref++;
26661ba4a712SPawel Jakub Dawidek }
26671ba4a712SPawel Jakub Dawidek 
26681ba4a712SPawel Jakub Dawidek void
266991421ba2SRobert Watson prison_hold(struct prison *pr)
267091421ba2SRobert Watson {
267191421ba2SRobert Watson 
267201137630SRobert Watson 	mtx_lock(&pr->pr_mtx);
26731ba4a712SPawel Jakub Dawidek 	prison_hold_locked(pr);
267401137630SRobert Watson 	mtx_unlock(&pr->pr_mtx);
267501137630SRobert Watson }
267601137630SRobert Watson 
2677413628a7SBjoern A. Zeeb void
2678413628a7SBjoern A. Zeeb prison_proc_hold(struct prison *pr)
267901137630SRobert Watson {
268001137630SRobert Watson 
2681413628a7SBjoern A. Zeeb 	mtx_lock(&pr->pr_mtx);
2682b38ff370SJamie Gritton 	KASSERT(pr->pr_uref > 0,
2683b38ff370SJamie Gritton 	    ("Cannot add a process to a non-alive prison (jid=%d)", pr->pr_id));
2684b38ff370SJamie Gritton 	pr->pr_uref++;
2685413628a7SBjoern A. Zeeb 	mtx_unlock(&pr->pr_mtx);
268675c13541SPoul-Henning Kamp }
268775c13541SPoul-Henning Kamp 
268875c13541SPoul-Henning Kamp void
2689413628a7SBjoern A. Zeeb prison_proc_free(struct prison *pr)
269075c13541SPoul-Henning Kamp {
2691413628a7SBjoern A. Zeeb 
2692413628a7SBjoern A. Zeeb 	mtx_lock(&pr->pr_mtx);
2693b38ff370SJamie Gritton 	KASSERT(pr->pr_uref > 0,
2694b38ff370SJamie Gritton 	    ("Trying to kill a process in a dead prison (jid=%d)", pr->pr_id));
269573d9e52dSJamie Gritton 	if (pr->pr_uref > 1)
269673d9e52dSJamie Gritton 		pr->pr_uref--;
269773d9e52dSJamie Gritton 	else {
269873d9e52dSJamie Gritton 		/*
269973d9e52dSJamie Gritton 		 * Don't remove the last user reference in this context, which
270073d9e52dSJamie Gritton 		 * is expected to be a process that is not only locked, but
270173d9e52dSJamie Gritton 		 * also half dead.
270273d9e52dSJamie Gritton 		 */
270373d9e52dSJamie Gritton 		pr->pr_ref++;
270473d9e52dSJamie Gritton 		mtx_unlock(&pr->pr_mtx);
270573d9e52dSJamie Gritton 		taskqueue_enqueue(taskqueue_thread, &pr->pr_task);
270673d9e52dSJamie Gritton 		return;
270773d9e52dSJamie Gritton 	}
270873d9e52dSJamie Gritton 	mtx_unlock(&pr->pr_mtx);
2709413628a7SBjoern A. Zeeb }
2710413628a7SBjoern A. Zeeb 
2711413628a7SBjoern A. Zeeb /*
2712ca04ba64SJamie Gritton  * Check if a jail supports the given address family.
2713ca04ba64SJamie Gritton  *
2714ca04ba64SJamie Gritton  * Returns 0 if not jailed or the address family is supported, EAFNOSUPPORT
2715ca04ba64SJamie Gritton  * if not.
2716ca04ba64SJamie Gritton  */
2717ca04ba64SJamie Gritton int
2718ca04ba64SJamie Gritton prison_check_af(struct ucred *cred, int af)
2719ca04ba64SJamie Gritton {
27200304c731SJamie Gritton 	struct prison *pr;
2721ca04ba64SJamie Gritton 	int error;
2722ca04ba64SJamie Gritton 
2723ca04ba64SJamie Gritton 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
2724ca04ba64SJamie Gritton 
27250304c731SJamie Gritton 	pr = cred->cr_prison;
2726499650a0SJamie Gritton #ifdef VIMAGE
27276bb79563SJamie Gritton 	/* Prisons with their own network stack are not limited. */
2728de0bd6f7SBjoern A. Zeeb 	if (prison_owns_vnet(cred))
27296bb79563SJamie Gritton 		return (0);
2730499650a0SJamie Gritton #endif
27316bb79563SJamie Gritton 
2732ca04ba64SJamie Gritton 	error = 0;
2733ca04ba64SJamie Gritton 	switch (af)
2734ca04ba64SJamie Gritton 	{
2735ca04ba64SJamie Gritton #ifdef INET
2736ca04ba64SJamie Gritton 	case AF_INET:
27370304c731SJamie Gritton 		if (pr->pr_flags & PR_IP4)
27380304c731SJamie Gritton 		{
27390304c731SJamie Gritton 			mtx_lock(&pr->pr_mtx);
27400304c731SJamie Gritton 			if ((pr->pr_flags & PR_IP4) && pr->pr_ip4 == NULL)
2741ca04ba64SJamie Gritton 				error = EAFNOSUPPORT;
27420304c731SJamie Gritton 			mtx_unlock(&pr->pr_mtx);
27430304c731SJamie Gritton 		}
2744ca04ba64SJamie Gritton 		break;
2745ca04ba64SJamie Gritton #endif
2746ca04ba64SJamie Gritton #ifdef INET6
2747ca04ba64SJamie Gritton 	case AF_INET6:
27480304c731SJamie Gritton 		if (pr->pr_flags & PR_IP6)
27490304c731SJamie Gritton 		{
27500304c731SJamie Gritton 			mtx_lock(&pr->pr_mtx);
27510304c731SJamie Gritton 			if ((pr->pr_flags & PR_IP6) && pr->pr_ip6 == NULL)
2752ca04ba64SJamie Gritton 				error = EAFNOSUPPORT;
27530304c731SJamie Gritton 			mtx_unlock(&pr->pr_mtx);
27540304c731SJamie Gritton 		}
2755ca04ba64SJamie Gritton 		break;
2756ca04ba64SJamie Gritton #endif
2757ca04ba64SJamie Gritton 	case AF_LOCAL:
2758ca04ba64SJamie Gritton 	case AF_ROUTE:
2759ca04ba64SJamie Gritton 		break;
2760ca04ba64SJamie Gritton 	default:
27610304c731SJamie Gritton 		if (!(pr->pr_allow & PR_ALLOW_SOCKET_AF))
2762ca04ba64SJamie Gritton 			error = EAFNOSUPPORT;
2763ca04ba64SJamie Gritton 	}
2764ca04ba64SJamie Gritton 	return (error);
2765ca04ba64SJamie Gritton }
2766ca04ba64SJamie Gritton 
2767ca04ba64SJamie Gritton /*
2768413628a7SBjoern A. Zeeb  * Check if given address belongs to the jail referenced by cred (wrapper to
2769413628a7SBjoern A. Zeeb  * prison_check_ip[46]).
2770413628a7SBjoern A. Zeeb  *
27710304c731SJamie Gritton  * Returns 0 if jail doesn't restrict the address family or if address belongs
27720304c731SJamie Gritton  * to jail, EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if
27730304c731SJamie Gritton  * the jail doesn't allow the address family.  IPv4 Address passed in in NBO.
2774413628a7SBjoern A. Zeeb  */
2775413628a7SBjoern A. Zeeb int
277691421ba2SRobert Watson prison_if(struct ucred *cred, struct sockaddr *sa)
277775c13541SPoul-Henning Kamp {
2778413628a7SBjoern A. Zeeb #ifdef INET
27799ddb7954SMike Barcroft 	struct sockaddr_in *sai;
2780413628a7SBjoern A. Zeeb #endif
2781413628a7SBjoern A. Zeeb #ifdef INET6
2782413628a7SBjoern A. Zeeb 	struct sockaddr_in6 *sai6;
2783413628a7SBjoern A. Zeeb #endif
2784b89e82ddSJamie Gritton 	int error;
278575c13541SPoul-Henning Kamp 
2786413628a7SBjoern A. Zeeb 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
2787413628a7SBjoern A. Zeeb 	KASSERT(sa != NULL, ("%s: sa is NULL", __func__));
2788413628a7SBjoern A. Zeeb 
2789de0bd6f7SBjoern A. Zeeb #ifdef VIMAGE
2790de0bd6f7SBjoern A. Zeeb 	if (prison_owns_vnet(cred))
2791de0bd6f7SBjoern A. Zeeb 		return (0);
2792de0bd6f7SBjoern A. Zeeb #endif
2793de0bd6f7SBjoern A. Zeeb 
2794b89e82ddSJamie Gritton 	error = 0;
2795413628a7SBjoern A. Zeeb 	switch (sa->sa_family)
2796413628a7SBjoern A. Zeeb 	{
2797413628a7SBjoern A. Zeeb #ifdef INET
2798413628a7SBjoern A. Zeeb 	case AF_INET:
27999ddb7954SMike Barcroft 		sai = (struct sockaddr_in *)sa;
2800b89e82ddSJamie Gritton 		error = prison_check_ip4(cred, &sai->sin_addr);
2801413628a7SBjoern A. Zeeb 		break;
2802413628a7SBjoern A. Zeeb #endif
2803413628a7SBjoern A. Zeeb #ifdef INET6
2804413628a7SBjoern A. Zeeb 	case AF_INET6:
2805413628a7SBjoern A. Zeeb 		sai6 = (struct sockaddr_in6 *)sa;
2806b89e82ddSJamie Gritton 		error = prison_check_ip6(cred, &sai6->sin6_addr);
2807413628a7SBjoern A. Zeeb 		break;
2808413628a7SBjoern A. Zeeb #endif
2809413628a7SBjoern A. Zeeb 	default:
28100304c731SJamie Gritton 		if (!(cred->cr_prison->pr_allow & PR_ALLOW_SOCKET_AF))
2811b89e82ddSJamie Gritton 			error = EAFNOSUPPORT;
2812413628a7SBjoern A. Zeeb 	}
2813b89e82ddSJamie Gritton 	return (error);
281475c13541SPoul-Henning Kamp }
281591421ba2SRobert Watson 
281691421ba2SRobert Watson /*
281791421ba2SRobert Watson  * Return 0 if jails permit p1 to frob p2, otherwise ESRCH.
281891421ba2SRobert Watson  */
281991421ba2SRobert Watson int
28209ddb7954SMike Barcroft prison_check(struct ucred *cred1, struct ucred *cred2)
282191421ba2SRobert Watson {
282291421ba2SRobert Watson 
28230304c731SJamie Gritton 	return ((cred1->cr_prison == cred2->cr_prison ||
28240304c731SJamie Gritton 	    prison_ischild(cred1->cr_prison, cred2->cr_prison)) ? 0 : ESRCH);
28250304c731SJamie Gritton }
282691421ba2SRobert Watson 
28270304c731SJamie Gritton /*
28280304c731SJamie Gritton  * Return 1 if p2 is a child of p1, otherwise 0.
28290304c731SJamie Gritton  */
28300304c731SJamie Gritton int
28310304c731SJamie Gritton prison_ischild(struct prison *pr1, struct prison *pr2)
28320304c731SJamie Gritton {
28330304c731SJamie Gritton 
28340304c731SJamie Gritton 	for (pr2 = pr2->pr_parent; pr2 != NULL; pr2 = pr2->pr_parent)
28350304c731SJamie Gritton 		if (pr1 == pr2)
28360304c731SJamie Gritton 			return (1);
283791421ba2SRobert Watson 	return (0);
283891421ba2SRobert Watson }
283991421ba2SRobert Watson 
284091421ba2SRobert Watson /*
284191421ba2SRobert Watson  * Return 1 if the passed credential is in a jail, otherwise 0.
284291421ba2SRobert Watson  */
284391421ba2SRobert Watson int
28449ddb7954SMike Barcroft jailed(struct ucred *cred)
284591421ba2SRobert Watson {
284691421ba2SRobert Watson 
28470304c731SJamie Gritton 	return (cred->cr_prison != &prison0);
284891421ba2SRobert Watson }
28499484d0c0SRobert Drehmel 
28509484d0c0SRobert Drehmel /*
2851de0bd6f7SBjoern A. Zeeb  * Return 1 if the passed credential is in a jail and that jail does not
2852de0bd6f7SBjoern A. Zeeb  * have its own virtual network stack, otherwise 0.
2853de0bd6f7SBjoern A. Zeeb  */
2854de0bd6f7SBjoern A. Zeeb int
2855de0bd6f7SBjoern A. Zeeb jailed_without_vnet(struct ucred *cred)
2856de0bd6f7SBjoern A. Zeeb {
2857de0bd6f7SBjoern A. Zeeb 
2858de0bd6f7SBjoern A. Zeeb 	if (!jailed(cred))
2859de0bd6f7SBjoern A. Zeeb 		return (0);
2860de0bd6f7SBjoern A. Zeeb #ifdef VIMAGE
2861de0bd6f7SBjoern A. Zeeb 	if (prison_owns_vnet(cred))
2862de0bd6f7SBjoern A. Zeeb 		return (0);
2863de0bd6f7SBjoern A. Zeeb #endif
2864de0bd6f7SBjoern A. Zeeb 
2865de0bd6f7SBjoern A. Zeeb 	return (1);
2866de0bd6f7SBjoern A. Zeeb }
2867de0bd6f7SBjoern A. Zeeb 
2868de0bd6f7SBjoern A. Zeeb /*
28697455b100SJamie Gritton  * Return the correct hostname (domainname, et al) for the passed credential.
28709484d0c0SRobert Drehmel  */
2871ad1ff099SRobert Drehmel void
28729ddb7954SMike Barcroft getcredhostname(struct ucred *cred, char *buf, size_t size)
28739484d0c0SRobert Drehmel {
287476ca6f88SJamie Gritton 	struct prison *pr;
28759484d0c0SRobert Drehmel 
28767455b100SJamie Gritton 	/*
28777455b100SJamie Gritton 	 * A NULL credential can be used to shortcut to the physical
28787455b100SJamie Gritton 	 * system's hostname.
28797455b100SJamie Gritton 	 */
288076ca6f88SJamie Gritton 	pr = (cred != NULL) ? cred->cr_prison : &prison0;
288176ca6f88SJamie Gritton 	mtx_lock(&pr->pr_mtx);
2882c1f19219SJamie Gritton 	strlcpy(buf, pr->pr_hostname, size);
288376ca6f88SJamie Gritton 	mtx_unlock(&pr->pr_mtx);
28849484d0c0SRobert Drehmel }
2885fd7a8150SMike Barcroft 
28867455b100SJamie Gritton void
28877455b100SJamie Gritton getcreddomainname(struct ucred *cred, char *buf, size_t size)
28887455b100SJamie Gritton {
28897455b100SJamie Gritton 
28907455b100SJamie Gritton 	mtx_lock(&cred->cr_prison->pr_mtx);
2891c1f19219SJamie Gritton 	strlcpy(buf, cred->cr_prison->pr_domainname, size);
28927455b100SJamie Gritton 	mtx_unlock(&cred->cr_prison->pr_mtx);
28937455b100SJamie Gritton }
28947455b100SJamie Gritton 
28957455b100SJamie Gritton void
28967455b100SJamie Gritton getcredhostuuid(struct ucred *cred, char *buf, size_t size)
28977455b100SJamie Gritton {
28987455b100SJamie Gritton 
28997455b100SJamie Gritton 	mtx_lock(&cred->cr_prison->pr_mtx);
2900c1f19219SJamie Gritton 	strlcpy(buf, cred->cr_prison->pr_hostuuid, size);
29017455b100SJamie Gritton 	mtx_unlock(&cred->cr_prison->pr_mtx);
29027455b100SJamie Gritton }
29037455b100SJamie Gritton 
29047455b100SJamie Gritton void
29057455b100SJamie Gritton getcredhostid(struct ucred *cred, unsigned long *hostid)
29067455b100SJamie Gritton {
29077455b100SJamie Gritton 
29087455b100SJamie Gritton 	mtx_lock(&cred->cr_prison->pr_mtx);
29097455b100SJamie Gritton 	*hostid = cred->cr_prison->pr_hostid;
29107455b100SJamie Gritton 	mtx_unlock(&cred->cr_prison->pr_mtx);
29117455b100SJamie Gritton }
29127455b100SJamie Gritton 
2913eb79e1c7SBjoern A. Zeeb #ifdef VIMAGE
2914eb79e1c7SBjoern A. Zeeb /*
2915eb79e1c7SBjoern A. Zeeb  * Determine whether the prison represented by cred owns
2916eb79e1c7SBjoern A. Zeeb  * its vnet rather than having it inherited.
2917eb79e1c7SBjoern A. Zeeb  *
2918eb79e1c7SBjoern A. Zeeb  * Returns 1 in case the prison owns the vnet, 0 otherwise.
2919eb79e1c7SBjoern A. Zeeb  */
2920eb79e1c7SBjoern A. Zeeb int
2921eb79e1c7SBjoern A. Zeeb prison_owns_vnet(struct ucred *cred)
2922eb79e1c7SBjoern A. Zeeb {
2923eb79e1c7SBjoern A. Zeeb 
2924eb79e1c7SBjoern A. Zeeb 	/*
2925eb79e1c7SBjoern A. Zeeb 	 * vnets cannot be added/removed after jail creation,
2926eb79e1c7SBjoern A. Zeeb 	 * so no need to lock here.
2927eb79e1c7SBjoern A. Zeeb 	 */
2928eb79e1c7SBjoern A. Zeeb 	return (cred->cr_prison->pr_flags & PR_VNET ? 1 : 0);
2929eb79e1c7SBjoern A. Zeeb }
2930eb79e1c7SBjoern A. Zeeb #endif
2931eb79e1c7SBjoern A. Zeeb 
2932f08df373SRobert Watson /*
2933820a0de9SPawel Jakub Dawidek  * Determine whether the subject represented by cred can "see"
2934820a0de9SPawel Jakub Dawidek  * status of a mount point.
2935820a0de9SPawel Jakub Dawidek  * Returns: 0 for permitted, ENOENT otherwise.
2936820a0de9SPawel Jakub Dawidek  * XXX: This function should be called cr_canseemount() and should be
2937820a0de9SPawel Jakub Dawidek  *      placed in kern_prot.c.
2938f08df373SRobert Watson  */
2939f08df373SRobert Watson int
2940820a0de9SPawel Jakub Dawidek prison_canseemount(struct ucred *cred, struct mount *mp)
2941f08df373SRobert Watson {
2942820a0de9SPawel Jakub Dawidek 	struct prison *pr;
2943820a0de9SPawel Jakub Dawidek 	struct statfs *sp;
2944820a0de9SPawel Jakub Dawidek 	size_t len;
2945f08df373SRobert Watson 
2946820a0de9SPawel Jakub Dawidek 	pr = cred->cr_prison;
29470304c731SJamie Gritton 	if (pr->pr_enforce_statfs == 0)
29480304c731SJamie Gritton 		return (0);
2949820a0de9SPawel Jakub Dawidek 	if (pr->pr_root->v_mount == mp)
2950820a0de9SPawel Jakub Dawidek 		return (0);
29510304c731SJamie Gritton 	if (pr->pr_enforce_statfs == 2)
2952820a0de9SPawel Jakub Dawidek 		return (ENOENT);
2953820a0de9SPawel Jakub Dawidek 	/*
2954820a0de9SPawel Jakub Dawidek 	 * If jail's chroot directory is set to "/" we should be able to see
2955820a0de9SPawel Jakub Dawidek 	 * all mount-points from inside a jail.
2956820a0de9SPawel Jakub Dawidek 	 * This is ugly check, but this is the only situation when jail's
2957820a0de9SPawel Jakub Dawidek 	 * directory ends with '/'.
2958820a0de9SPawel Jakub Dawidek 	 */
2959820a0de9SPawel Jakub Dawidek 	if (strcmp(pr->pr_path, "/") == 0)
2960820a0de9SPawel Jakub Dawidek 		return (0);
2961820a0de9SPawel Jakub Dawidek 	len = strlen(pr->pr_path);
2962820a0de9SPawel Jakub Dawidek 	sp = &mp->mnt_stat;
2963820a0de9SPawel Jakub Dawidek 	if (strncmp(pr->pr_path, sp->f_mntonname, len) != 0)
2964820a0de9SPawel Jakub Dawidek 		return (ENOENT);
2965820a0de9SPawel Jakub Dawidek 	/*
2966820a0de9SPawel Jakub Dawidek 	 * Be sure that we don't have situation where jail's root directory
2967820a0de9SPawel Jakub Dawidek 	 * is "/some/path" and mount point is "/some/pathpath".
2968820a0de9SPawel Jakub Dawidek 	 */
2969820a0de9SPawel Jakub Dawidek 	if (sp->f_mntonname[len] != '\0' && sp->f_mntonname[len] != '/')
2970820a0de9SPawel Jakub Dawidek 		return (ENOENT);
2971f08df373SRobert Watson 	return (0);
2972f08df373SRobert Watson }
2973820a0de9SPawel Jakub Dawidek 
2974820a0de9SPawel Jakub Dawidek void
2975820a0de9SPawel Jakub Dawidek prison_enforce_statfs(struct ucred *cred, struct mount *mp, struct statfs *sp)
2976820a0de9SPawel Jakub Dawidek {
2977820a0de9SPawel Jakub Dawidek 	char jpath[MAXPATHLEN];
2978820a0de9SPawel Jakub Dawidek 	struct prison *pr;
2979820a0de9SPawel Jakub Dawidek 	size_t len;
2980820a0de9SPawel Jakub Dawidek 
2981820a0de9SPawel Jakub Dawidek 	pr = cred->cr_prison;
29820304c731SJamie Gritton 	if (pr->pr_enforce_statfs == 0)
29830304c731SJamie Gritton 		return;
2984820a0de9SPawel Jakub Dawidek 	if (prison_canseemount(cred, mp) != 0) {
2985820a0de9SPawel Jakub Dawidek 		bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
2986820a0de9SPawel Jakub Dawidek 		strlcpy(sp->f_mntonname, "[restricted]",
2987820a0de9SPawel Jakub Dawidek 		    sizeof(sp->f_mntonname));
2988820a0de9SPawel Jakub Dawidek 		return;
2989820a0de9SPawel Jakub Dawidek 	}
2990820a0de9SPawel Jakub Dawidek 	if (pr->pr_root->v_mount == mp) {
2991820a0de9SPawel Jakub Dawidek 		/*
2992820a0de9SPawel Jakub Dawidek 		 * Clear current buffer data, so we are sure nothing from
2993820a0de9SPawel Jakub Dawidek 		 * the valid path left there.
2994820a0de9SPawel Jakub Dawidek 		 */
2995820a0de9SPawel Jakub Dawidek 		bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
2996820a0de9SPawel Jakub Dawidek 		*sp->f_mntonname = '/';
2997820a0de9SPawel Jakub Dawidek 		return;
2998820a0de9SPawel Jakub Dawidek 	}
2999820a0de9SPawel Jakub Dawidek 	/*
3000820a0de9SPawel Jakub Dawidek 	 * If jail's chroot directory is set to "/" we should be able to see
3001820a0de9SPawel Jakub Dawidek 	 * all mount-points from inside a jail.
3002820a0de9SPawel Jakub Dawidek 	 */
3003820a0de9SPawel Jakub Dawidek 	if (strcmp(pr->pr_path, "/") == 0)
3004820a0de9SPawel Jakub Dawidek 		return;
3005820a0de9SPawel Jakub Dawidek 	len = strlen(pr->pr_path);
3006820a0de9SPawel Jakub Dawidek 	strlcpy(jpath, sp->f_mntonname + len, sizeof(jpath));
3007820a0de9SPawel Jakub Dawidek 	/*
3008820a0de9SPawel Jakub Dawidek 	 * Clear current buffer data, so we are sure nothing from
3009820a0de9SPawel Jakub Dawidek 	 * the valid path left there.
3010820a0de9SPawel Jakub Dawidek 	 */
3011820a0de9SPawel Jakub Dawidek 	bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
3012820a0de9SPawel Jakub Dawidek 	if (*jpath == '\0') {
3013820a0de9SPawel Jakub Dawidek 		/* Should never happen. */
3014820a0de9SPawel Jakub Dawidek 		*sp->f_mntonname = '/';
3015820a0de9SPawel Jakub Dawidek 	} else {
3016820a0de9SPawel Jakub Dawidek 		strlcpy(sp->f_mntonname, jpath, sizeof(sp->f_mntonname));
3017820a0de9SPawel Jakub Dawidek 	}
3018f08df373SRobert Watson }
3019f08df373SRobert Watson 
3020800c9408SRobert Watson /*
3021800c9408SRobert Watson  * Check with permission for a specific privilege is granted within jail.  We
3022800c9408SRobert Watson  * have a specific list of accepted privileges; the rest are denied.
3023800c9408SRobert Watson  */
3024800c9408SRobert Watson int
3025800c9408SRobert Watson prison_priv_check(struct ucred *cred, int priv)
3026800c9408SRobert Watson {
3027800c9408SRobert Watson 
3028800c9408SRobert Watson 	if (!jailed(cred))
3029800c9408SRobert Watson 		return (0);
3030800c9408SRobert Watson 
30316bb79563SJamie Gritton #ifdef VIMAGE
30326bb79563SJamie Gritton 	/*
30336bb79563SJamie Gritton 	 * Privileges specific to prisons with a virtual network stack.
30346bb79563SJamie Gritton 	 * There might be a duplicate entry here in case the privilege
30356bb79563SJamie Gritton 	 * is only granted conditionally in the legacy jail case.
30366bb79563SJamie Gritton 	 */
30376bb79563SJamie Gritton 	switch (priv) {
30386bb79563SJamie Gritton #ifdef notyet
30396bb79563SJamie Gritton 		/*
30406bb79563SJamie Gritton 		 * NFS-specific privileges.
30416bb79563SJamie Gritton 		 */
30426bb79563SJamie Gritton 	case PRIV_NFS_DAEMON:
30436bb79563SJamie Gritton 	case PRIV_NFS_LOCKD:
30446bb79563SJamie Gritton #endif
30456bb79563SJamie Gritton 		/*
30466bb79563SJamie Gritton 		 * Network stack privileges.
30476bb79563SJamie Gritton 		 */
30486bb79563SJamie Gritton 	case PRIV_NET_BRIDGE:
30496bb79563SJamie Gritton 	case PRIV_NET_GRE:
30506bb79563SJamie Gritton 	case PRIV_NET_BPF:
30516bb79563SJamie Gritton 	case PRIV_NET_RAW:		/* Dup, cond. in legacy jail case. */
30526bb79563SJamie Gritton 	case PRIV_NET_ROUTE:
30536bb79563SJamie Gritton 	case PRIV_NET_TAP:
30546bb79563SJamie Gritton 	case PRIV_NET_SETIFMTU:
30556bb79563SJamie Gritton 	case PRIV_NET_SETIFFLAGS:
30566bb79563SJamie Gritton 	case PRIV_NET_SETIFCAP:
3057215940b3SXin LI 	case PRIV_NET_SETIFDESCR:
30586bb79563SJamie Gritton 	case PRIV_NET_SETIFNAME	:
30596bb79563SJamie Gritton 	case PRIV_NET_SETIFMETRIC:
30606bb79563SJamie Gritton 	case PRIV_NET_SETIFPHYS:
30616bb79563SJamie Gritton 	case PRIV_NET_SETIFMAC:
30626bb79563SJamie Gritton 	case PRIV_NET_ADDMULTI:
30636bb79563SJamie Gritton 	case PRIV_NET_DELMULTI:
30646bb79563SJamie Gritton 	case PRIV_NET_HWIOCTL:
30656bb79563SJamie Gritton 	case PRIV_NET_SETLLADDR:
30666bb79563SJamie Gritton 	case PRIV_NET_ADDIFGROUP:
30676bb79563SJamie Gritton 	case PRIV_NET_DELIFGROUP:
30686bb79563SJamie Gritton 	case PRIV_NET_IFCREATE:
30696bb79563SJamie Gritton 	case PRIV_NET_IFDESTROY:
30706bb79563SJamie Gritton 	case PRIV_NET_ADDIFADDR:
30716bb79563SJamie Gritton 	case PRIV_NET_DELIFADDR:
30726bb79563SJamie Gritton 	case PRIV_NET_LAGG:
30736bb79563SJamie Gritton 	case PRIV_NET_GIF:
30746bb79563SJamie Gritton 	case PRIV_NET_SETIFVNET:
307535fd7bc0SBjoern A. Zeeb 	case PRIV_NET_SETIFFIB:
30766bb79563SJamie Gritton 
30776bb79563SJamie Gritton 		/*
30786bb79563SJamie Gritton 		 * 802.11-related privileges.
30796bb79563SJamie Gritton 		 */
30806bb79563SJamie Gritton 	case PRIV_NET80211_GETKEY:
30816bb79563SJamie Gritton #ifdef notyet
30826bb79563SJamie Gritton 	case PRIV_NET80211_MANAGE:		/* XXX-BZ discuss with sam@ */
30836bb79563SJamie Gritton #endif
30846bb79563SJamie Gritton 
30856bb79563SJamie Gritton #ifdef notyet
30866bb79563SJamie Gritton 		/*
30876bb79563SJamie Gritton 		 * ATM privileges.
30886bb79563SJamie Gritton 		 */
30896bb79563SJamie Gritton 	case PRIV_NETATM_CFG:
30906bb79563SJamie Gritton 	case PRIV_NETATM_ADD:
30916bb79563SJamie Gritton 	case PRIV_NETATM_DEL:
30926bb79563SJamie Gritton 	case PRIV_NETATM_SET:
30936bb79563SJamie Gritton 
30946bb79563SJamie Gritton 		/*
30956bb79563SJamie Gritton 		 * Bluetooth privileges.
30966bb79563SJamie Gritton 		 */
30976bb79563SJamie Gritton 	case PRIV_NETBLUETOOTH_RAW:
30986bb79563SJamie Gritton #endif
30996bb79563SJamie Gritton 
31006bb79563SJamie Gritton 		/*
31016bb79563SJamie Gritton 		 * Netgraph and netgraph module privileges.
31026bb79563SJamie Gritton 		 */
31036bb79563SJamie Gritton 	case PRIV_NETGRAPH_CONTROL:
31046bb79563SJamie Gritton #ifdef notyet
31056bb79563SJamie Gritton 	case PRIV_NETGRAPH_TTY:
31066bb79563SJamie Gritton #endif
31076bb79563SJamie Gritton 
31086bb79563SJamie Gritton 		/*
31096bb79563SJamie Gritton 		 * IPv4 and IPv6 privileges.
31106bb79563SJamie Gritton 		 */
31116bb79563SJamie Gritton 	case PRIV_NETINET_IPFW:
31126bb79563SJamie Gritton 	case PRIV_NETINET_DIVERT:
31136bb79563SJamie Gritton 	case PRIV_NETINET_PF:
31146bb79563SJamie Gritton 	case PRIV_NETINET_DUMMYNET:
31156bb79563SJamie Gritton 	case PRIV_NETINET_CARP:
31166bb79563SJamie Gritton 	case PRIV_NETINET_MROUTE:
31176bb79563SJamie Gritton 	case PRIV_NETINET_RAW:
31186bb79563SJamie Gritton 	case PRIV_NETINET_ADDRCTRL6:
31196bb79563SJamie Gritton 	case PRIV_NETINET_ND6:
31206bb79563SJamie Gritton 	case PRIV_NETINET_SCOPE6:
31216bb79563SJamie Gritton 	case PRIV_NETINET_ALIFETIME6:
31226bb79563SJamie Gritton 	case PRIV_NETINET_IPSEC:
31236bb79563SJamie Gritton 	case PRIV_NETINET_BINDANY:
31246bb79563SJamie Gritton 
31256bb79563SJamie Gritton #ifdef notyet
31266bb79563SJamie Gritton 		/*
31276bb79563SJamie Gritton 		 * NCP privileges.
31286bb79563SJamie Gritton 		 */
31296bb79563SJamie Gritton 	case PRIV_NETNCP:
31306bb79563SJamie Gritton 
31316bb79563SJamie Gritton 		/*
31326bb79563SJamie Gritton 		 * SMB privileges.
31336bb79563SJamie Gritton 		 */
31346bb79563SJamie Gritton 	case PRIV_NETSMB:
31356bb79563SJamie Gritton #endif
31366bb79563SJamie Gritton 
31376bb79563SJamie Gritton 	/*
31386bb79563SJamie Gritton 	 * No default: or deny here.
31396bb79563SJamie Gritton 	 * In case of no permit fall through to next switch().
31406bb79563SJamie Gritton 	 */
31416bb79563SJamie Gritton 		if (cred->cr_prison->pr_flags & PR_VNET)
31426bb79563SJamie Gritton 			return (0);
31436bb79563SJamie Gritton 	}
31446bb79563SJamie Gritton #endif /* VIMAGE */
31456bb79563SJamie Gritton 
3146800c9408SRobert Watson 	switch (priv) {
3147800c9408SRobert Watson 
3148800c9408SRobert Watson 		/*
3149800c9408SRobert Watson 		 * Allow ktrace privileges for root in jail.
3150800c9408SRobert Watson 		 */
3151800c9408SRobert Watson 	case PRIV_KTRACE:
3152800c9408SRobert Watson 
3153c3c1b5e6SRobert Watson #if 0
3154800c9408SRobert Watson 		/*
3155800c9408SRobert Watson 		 * Allow jailed processes to configure audit identity and
3156800c9408SRobert Watson 		 * submit audit records (login, etc).  In the future we may
3157800c9408SRobert Watson 		 * want to further refine the relationship between audit and
3158800c9408SRobert Watson 		 * jail.
3159800c9408SRobert Watson 		 */
3160800c9408SRobert Watson 	case PRIV_AUDIT_GETAUDIT:
3161800c9408SRobert Watson 	case PRIV_AUDIT_SETAUDIT:
3162800c9408SRobert Watson 	case PRIV_AUDIT_SUBMIT:
3163c3c1b5e6SRobert Watson #endif
3164800c9408SRobert Watson 
3165800c9408SRobert Watson 		/*
3166800c9408SRobert Watson 		 * Allow jailed processes to manipulate process UNIX
3167800c9408SRobert Watson 		 * credentials in any way they see fit.
3168800c9408SRobert Watson 		 */
3169800c9408SRobert Watson 	case PRIV_CRED_SETUID:
3170800c9408SRobert Watson 	case PRIV_CRED_SETEUID:
3171800c9408SRobert Watson 	case PRIV_CRED_SETGID:
3172800c9408SRobert Watson 	case PRIV_CRED_SETEGID:
3173800c9408SRobert Watson 	case PRIV_CRED_SETGROUPS:
3174800c9408SRobert Watson 	case PRIV_CRED_SETREUID:
3175800c9408SRobert Watson 	case PRIV_CRED_SETREGID:
3176800c9408SRobert Watson 	case PRIV_CRED_SETRESUID:
3177800c9408SRobert Watson 	case PRIV_CRED_SETRESGID:
3178800c9408SRobert Watson 
3179800c9408SRobert Watson 		/*
3180800c9408SRobert Watson 		 * Jail implements visibility constraints already, so allow
3181800c9408SRobert Watson 		 * jailed root to override uid/gid-based constraints.
3182800c9408SRobert Watson 		 */
3183800c9408SRobert Watson 	case PRIV_SEEOTHERGIDS:
3184800c9408SRobert Watson 	case PRIV_SEEOTHERUIDS:
3185800c9408SRobert Watson 
3186800c9408SRobert Watson 		/*
3187800c9408SRobert Watson 		 * Jail implements inter-process debugging limits already, so
3188800c9408SRobert Watson 		 * allow jailed root various debugging privileges.
3189800c9408SRobert Watson 		 */
3190800c9408SRobert Watson 	case PRIV_DEBUG_DIFFCRED:
3191800c9408SRobert Watson 	case PRIV_DEBUG_SUGID:
3192800c9408SRobert Watson 	case PRIV_DEBUG_UNPRIV:
3193800c9408SRobert Watson 
3194800c9408SRobert Watson 		/*
3195800c9408SRobert Watson 		 * Allow jail to set various resource limits and login
3196800c9408SRobert Watson 		 * properties, and for now, exceed process resource limits.
3197800c9408SRobert Watson 		 */
3198800c9408SRobert Watson 	case PRIV_PROC_LIMIT:
3199800c9408SRobert Watson 	case PRIV_PROC_SETLOGIN:
3200800c9408SRobert Watson 	case PRIV_PROC_SETRLIMIT:
3201800c9408SRobert Watson 
3202800c9408SRobert Watson 		/*
3203800c9408SRobert Watson 		 * System V and POSIX IPC privileges are granted in jail.
3204800c9408SRobert Watson 		 */
3205800c9408SRobert Watson 	case PRIV_IPC_READ:
3206800c9408SRobert Watson 	case PRIV_IPC_WRITE:
3207800c9408SRobert Watson 	case PRIV_IPC_ADMIN:
3208800c9408SRobert Watson 	case PRIV_IPC_MSGSIZE:
3209800c9408SRobert Watson 	case PRIV_MQ_ADMIN:
3210800c9408SRobert Watson 
3211800c9408SRobert Watson 		/*
32120304c731SJamie Gritton 		 * Jail operations within a jail work on child jails.
32130304c731SJamie Gritton 		 */
32140304c731SJamie Gritton 	case PRIV_JAIL_ATTACH:
32150304c731SJamie Gritton 	case PRIV_JAIL_SET:
32160304c731SJamie Gritton 	case PRIV_JAIL_REMOVE:
32170304c731SJamie Gritton 
32180304c731SJamie Gritton 		/*
3219800c9408SRobert Watson 		 * Jail implements its own inter-process limits, so allow
3220800c9408SRobert Watson 		 * root processes in jail to change scheduling on other
3221800c9408SRobert Watson 		 * processes in the same jail.  Likewise for signalling.
3222800c9408SRobert Watson 		 */
3223800c9408SRobert Watson 	case PRIV_SCHED_DIFFCRED:
3224413628a7SBjoern A. Zeeb 	case PRIV_SCHED_CPUSET:
3225800c9408SRobert Watson 	case PRIV_SIGNAL_DIFFCRED:
3226800c9408SRobert Watson 	case PRIV_SIGNAL_SUGID:
3227800c9408SRobert Watson 
3228800c9408SRobert Watson 		/*
3229800c9408SRobert Watson 		 * Allow jailed processes to write to sysctls marked as jail
3230800c9408SRobert Watson 		 * writable.
3231800c9408SRobert Watson 		 */
3232800c9408SRobert Watson 	case PRIV_SYSCTL_WRITEJAIL:
3233800c9408SRobert Watson 
3234800c9408SRobert Watson 		/*
3235800c9408SRobert Watson 		 * Allow root in jail to manage a variety of quota
3236e82d0201SRobert Watson 		 * properties.  These should likely be conditional on a
3237e82d0201SRobert Watson 		 * configuration option.
3238800c9408SRobert Watson 		 */
323995b091d2SRobert Watson 	case PRIV_VFS_GETQUOTA:
324095b091d2SRobert Watson 	case PRIV_VFS_SETQUOTA:
3241800c9408SRobert Watson 
3242800c9408SRobert Watson 		/*
3243800c9408SRobert Watson 		 * Since Jail relies on chroot() to implement file system
3244800c9408SRobert Watson 		 * protections, grant many VFS privileges to root in jail.
3245800c9408SRobert Watson 		 * Be careful to exclude mount-related and NFS-related
3246800c9408SRobert Watson 		 * privileges.
3247800c9408SRobert Watson 		 */
3248800c9408SRobert Watson 	case PRIV_VFS_READ:
3249800c9408SRobert Watson 	case PRIV_VFS_WRITE:
3250800c9408SRobert Watson 	case PRIV_VFS_ADMIN:
3251800c9408SRobert Watson 	case PRIV_VFS_EXEC:
3252800c9408SRobert Watson 	case PRIV_VFS_LOOKUP:
3253800c9408SRobert Watson 	case PRIV_VFS_BLOCKRESERVE:	/* XXXRW: Slightly surprising. */
3254800c9408SRobert Watson 	case PRIV_VFS_CHFLAGS_DEV:
3255800c9408SRobert Watson 	case PRIV_VFS_CHOWN:
3256800c9408SRobert Watson 	case PRIV_VFS_CHROOT:
3257bb531912SPawel Jakub Dawidek 	case PRIV_VFS_RETAINSUGID:
3258800c9408SRobert Watson 	case PRIV_VFS_FCHROOT:
3259800c9408SRobert Watson 	case PRIV_VFS_LINK:
3260800c9408SRobert Watson 	case PRIV_VFS_SETGID:
3261e41966dcSRobert Watson 	case PRIV_VFS_STAT:
3262800c9408SRobert Watson 	case PRIV_VFS_STICKYFILE:
3263bb56d716SJamie Gritton 
3264bb56d716SJamie Gritton 		/*
3265bb56d716SJamie Gritton 		 * As in the non-jail case, non-root users are expected to be
3266bb56d716SJamie Gritton 		 * able to read kernel/phyiscal memory (provided /dev/[k]mem
3267bb56d716SJamie Gritton 		 * exists in the jail and they have permission to access it).
3268bb56d716SJamie Gritton 		 */
3269bb56d716SJamie Gritton 	case PRIV_KMEM_READ:
3270800c9408SRobert Watson 		return (0);
3271800c9408SRobert Watson 
3272800c9408SRobert Watson 		/*
3273800c9408SRobert Watson 		 * Depending on the global setting, allow privilege of
3274800c9408SRobert Watson 		 * setting system flags.
3275800c9408SRobert Watson 		 */
3276800c9408SRobert Watson 	case PRIV_VFS_SYSFLAGS:
32770304c731SJamie Gritton 		if (cred->cr_prison->pr_allow & PR_ALLOW_CHFLAGS)
3278800c9408SRobert Watson 			return (0);
3279800c9408SRobert Watson 		else
3280800c9408SRobert Watson 			return (EPERM);
3281800c9408SRobert Watson 
3282800c9408SRobert Watson 		/*
3283f3a8d2f9SPawel Jakub Dawidek 		 * Depending on the global setting, allow privilege of
3284f3a8d2f9SPawel Jakub Dawidek 		 * mounting/unmounting file systems.
3285f3a8d2f9SPawel Jakub Dawidek 		 */
3286f3a8d2f9SPawel Jakub Dawidek 	case PRIV_VFS_MOUNT:
3287f3a8d2f9SPawel Jakub Dawidek 	case PRIV_VFS_UNMOUNT:
3288f3a8d2f9SPawel Jakub Dawidek 	case PRIV_VFS_MOUNT_NONUSER:
328924b0502eSPawel Jakub Dawidek 	case PRIV_VFS_MOUNT_OWNER:
3290435d4667SMartin Matuska 		if (cred->cr_prison->pr_allow & PR_ALLOW_MOUNT &&
3291435d4667SMartin Matuska 		    cred->cr_prison->pr_enforce_statfs < 2)
3292f3a8d2f9SPawel Jakub Dawidek 			return (0);
3293f3a8d2f9SPawel Jakub Dawidek 		else
3294f3a8d2f9SPawel Jakub Dawidek 			return (EPERM);
3295f3a8d2f9SPawel Jakub Dawidek 
3296f3a8d2f9SPawel Jakub Dawidek 		/*
3297*ccd6ac9fSAntoine Brodin 		 * Conditionnaly allow locking (unlocking) physical pages
3298*ccd6ac9fSAntoine Brodin 		 * in memory.
3299*ccd6ac9fSAntoine Brodin 		 */
3300*ccd6ac9fSAntoine Brodin 	case PRIV_VM_MLOCK:
3301*ccd6ac9fSAntoine Brodin 	case PRIV_VM_MUNLOCK:
3302*ccd6ac9fSAntoine Brodin 		if (cred->cr_prison->pr_allow & PR_ALLOW_MLOCK)
3303*ccd6ac9fSAntoine Brodin 			return (0);
3304*ccd6ac9fSAntoine Brodin 		else
3305*ccd6ac9fSAntoine Brodin 			return (EPERM);
3306*ccd6ac9fSAntoine Brodin 
3307*ccd6ac9fSAntoine Brodin 		/*
3308e28f9b7dSAllan Jude 		 * Conditionally allow jailed root to bind reserved ports.
3309800c9408SRobert Watson 		 */
3310800c9408SRobert Watson 	case PRIV_NETINET_RESERVEDPORT:
3311e28f9b7dSAllan Jude 		if (cred->cr_prison->pr_allow & PR_ALLOW_RESERVED_PORTS)
3312e28f9b7dSAllan Jude 			return (0);
3313e28f9b7dSAllan Jude 		else
3314e28f9b7dSAllan Jude 			return (EPERM);
3315e28f9b7dSAllan Jude 
3316e28f9b7dSAllan Jude 		/*
3317e28f9b7dSAllan Jude 		 * Allow jailed root to reuse in-use ports.
3318e28f9b7dSAllan Jude 		 */
33194b084056SRobert Watson 	case PRIV_NETINET_REUSEPORT:
3320800c9408SRobert Watson 		return (0);
3321800c9408SRobert Watson 
3322800c9408SRobert Watson 		/*
3323e3043798SPedro F. Giffuni 		 * Allow jailed root to set certain IPv4/6 (option) headers.
332479ba3952SBjoern A. Zeeb 		 */
332579ba3952SBjoern A. Zeeb 	case PRIV_NETINET_SETHDROPTS:
332679ba3952SBjoern A. Zeeb 		return (0);
332779ba3952SBjoern A. Zeeb 
332879ba3952SBjoern A. Zeeb 		/*
3329800c9408SRobert Watson 		 * Conditionally allow creating raw sockets in jail.
3330800c9408SRobert Watson 		 */
3331800c9408SRobert Watson 	case PRIV_NETINET_RAW:
33320304c731SJamie Gritton 		if (cred->cr_prison->pr_allow & PR_ALLOW_RAW_SOCKETS)
3333800c9408SRobert Watson 			return (0);
3334800c9408SRobert Watson 		else
3335800c9408SRobert Watson 			return (EPERM);
3336800c9408SRobert Watson 
3337800c9408SRobert Watson 		/*
3338800c9408SRobert Watson 		 * Since jail implements its own visibility limits on netstat
3339800c9408SRobert Watson 		 * sysctls, allow getcred.  This allows identd to work in
3340800c9408SRobert Watson 		 * jail.
3341800c9408SRobert Watson 		 */
3342800c9408SRobert Watson 	case PRIV_NETINET_GETCRED:
3343800c9408SRobert Watson 		return (0);
3344800c9408SRobert Watson 
33452bfc50bcSEdward Tomasz Napierala 		/*
33462bfc50bcSEdward Tomasz Napierala 		 * Allow jailed root to set loginclass.
33472bfc50bcSEdward Tomasz Napierala 		 */
33482bfc50bcSEdward Tomasz Napierala 	case PRIV_PROC_SETLOGINCLASS:
33492bfc50bcSEdward Tomasz Napierala 		return (0);
33502bfc50bcSEdward Tomasz Napierala 
3351800c9408SRobert Watson 	default:
3352800c9408SRobert Watson 		/*
3353800c9408SRobert Watson 		 * In all remaining cases, deny the privilege request.  This
3354800c9408SRobert Watson 		 * includes almost all network privileges, many system
3355800c9408SRobert Watson 		 * configuration privileges.
3356800c9408SRobert Watson 		 */
3357800c9408SRobert Watson 		return (EPERM);
3358800c9408SRobert Watson 	}
3359800c9408SRobert Watson }
3360800c9408SRobert Watson 
33610304c731SJamie Gritton /*
33620304c731SJamie Gritton  * Return the part of pr2's name that is relative to pr1, or the whole name
33630304c731SJamie Gritton  * if it does not directly follow.
33640304c731SJamie Gritton  */
33650304c731SJamie Gritton 
33660304c731SJamie Gritton char *
33670304c731SJamie Gritton prison_name(struct prison *pr1, struct prison *pr2)
33680304c731SJamie Gritton {
33690304c731SJamie Gritton 	char *name;
33700304c731SJamie Gritton 
33710304c731SJamie Gritton 	/* Jails see themselves as "0" (if they see themselves at all). */
33720304c731SJamie Gritton 	if (pr1 == pr2)
33730304c731SJamie Gritton 		return "0";
33740304c731SJamie Gritton 	name = pr2->pr_name;
33750304c731SJamie Gritton 	if (prison_ischild(pr1, pr2)) {
33760304c731SJamie Gritton 		/*
33770304c731SJamie Gritton 		 * pr1 isn't locked (and allprison_lock may not be either)
33780304c731SJamie Gritton 		 * so its length can't be counted on.  But the number of dots
33790304c731SJamie Gritton 		 * can be counted on - and counted.
33800304c731SJamie Gritton 		 */
33810304c731SJamie Gritton 		for (; pr1 != &prison0; pr1 = pr1->pr_parent)
33820304c731SJamie Gritton 			name = strchr(name, '.') + 1;
33830304c731SJamie Gritton 	}
33840304c731SJamie Gritton 	return (name);
33850304c731SJamie Gritton }
33860304c731SJamie Gritton 
33870304c731SJamie Gritton /*
33880304c731SJamie Gritton  * Return the part of pr2's path that is relative to pr1, or the whole path
33890304c731SJamie Gritton  * if it does not directly follow.
33900304c731SJamie Gritton  */
33910304c731SJamie Gritton static char *
33920304c731SJamie Gritton prison_path(struct prison *pr1, struct prison *pr2)
33930304c731SJamie Gritton {
33940304c731SJamie Gritton 	char *path1, *path2;
33950304c731SJamie Gritton 	int len1;
33960304c731SJamie Gritton 
33970304c731SJamie Gritton 	path1 = pr1->pr_path;
33980304c731SJamie Gritton 	path2 = pr2->pr_path;
33990304c731SJamie Gritton 	if (!strcmp(path1, "/"))
34000304c731SJamie Gritton 		return (path2);
34010304c731SJamie Gritton 	len1 = strlen(path1);
34020304c731SJamie Gritton 	if (strncmp(path1, path2, len1))
34030304c731SJamie Gritton 		return (path2);
34040304c731SJamie Gritton 	if (path2[len1] == '\0')
34050304c731SJamie Gritton 		return "/";
34060304c731SJamie Gritton 	if (path2[len1] == '/')
34070304c731SJamie Gritton 		return (path2 + len1);
34080304c731SJamie Gritton 	return (path2);
34090304c731SJamie Gritton }
34100304c731SJamie Gritton 
34110304c731SJamie Gritton 
34120304c731SJamie Gritton /*
34130304c731SJamie Gritton  * Jail-related sysctls.
34140304c731SJamie Gritton  */
34156472ac3dSEd Schouten static SYSCTL_NODE(_security, OID_AUTO, jail, CTLFLAG_RW, 0,
34160304c731SJamie Gritton     "Jails");
34170304c731SJamie Gritton 
3418fd7a8150SMike Barcroft static int
3419fd7a8150SMike Barcroft sysctl_jail_list(SYSCTL_HANDLER_ARGS)
3420fd7a8150SMike Barcroft {
3421b38ff370SJamie Gritton 	struct xprison *xp;
34220304c731SJamie Gritton 	struct prison *pr, *cpr;
3423b38ff370SJamie Gritton #ifdef INET
3424b38ff370SJamie Gritton 	struct in_addr *ip4 = NULL;
3425b38ff370SJamie Gritton 	int ip4s = 0;
3426b38ff370SJamie Gritton #endif
3427b38ff370SJamie Gritton #ifdef INET6
34283beefaedSColin Percival 	struct in6_addr *ip6 = NULL;
3429b38ff370SJamie Gritton 	int ip6s = 0;
3430b38ff370SJamie Gritton #endif
34310304c731SJamie Gritton 	int descend, error;
3432fd7a8150SMike Barcroft 
3433b38ff370SJamie Gritton 	xp = malloc(sizeof(*xp), M_TEMP, M_WAITOK);
34340304c731SJamie Gritton 	pr = req->td->td_ucred->cr_prison;
3435b38ff370SJamie Gritton 	error = 0;
3436dc68a633SPawel Jakub Dawidek 	sx_slock(&allprison_lock);
34370304c731SJamie Gritton 	FOREACH_PRISON_DESCENDANT(pr, cpr, descend) {
34380304c731SJamie Gritton #if defined(INET) || defined(INET6)
3439b38ff370SJamie Gritton  again:
34400304c731SJamie Gritton #endif
34410304c731SJamie Gritton 		mtx_lock(&cpr->pr_mtx);
3442413628a7SBjoern A. Zeeb #ifdef INET
34430304c731SJamie Gritton 		if (cpr->pr_ip4s > 0) {
34440304c731SJamie Gritton 			if (ip4s < cpr->pr_ip4s) {
34450304c731SJamie Gritton 				ip4s = cpr->pr_ip4s;
34460304c731SJamie Gritton 				mtx_unlock(&cpr->pr_mtx);
3447b38ff370SJamie Gritton 				ip4 = realloc(ip4, ip4s *
3448b38ff370SJamie Gritton 				    sizeof(struct in_addr), M_TEMP, M_WAITOK);
3449b38ff370SJamie Gritton 				goto again;
3450b38ff370SJamie Gritton 			}
34510304c731SJamie Gritton 			bcopy(cpr->pr_ip4, ip4,
34520304c731SJamie Gritton 			    cpr->pr_ip4s * sizeof(struct in_addr));
3453b38ff370SJamie Gritton 		}
3454413628a7SBjoern A. Zeeb #endif
3455413628a7SBjoern A. Zeeb #ifdef INET6
34560304c731SJamie Gritton 		if (cpr->pr_ip6s > 0) {
34570304c731SJamie Gritton 			if (ip6s < cpr->pr_ip6s) {
34580304c731SJamie Gritton 				ip6s = cpr->pr_ip6s;
34590304c731SJamie Gritton 				mtx_unlock(&cpr->pr_mtx);
3460b38ff370SJamie Gritton 				ip6 = realloc(ip6, ip6s *
3461b38ff370SJamie Gritton 				    sizeof(struct in6_addr), M_TEMP, M_WAITOK);
3462b38ff370SJamie Gritton 				goto again;
3463413628a7SBjoern A. Zeeb 			}
34640304c731SJamie Gritton 			bcopy(cpr->pr_ip6, ip6,
34650304c731SJamie Gritton 			    cpr->pr_ip6s * sizeof(struct in6_addr));
3466b38ff370SJamie Gritton 		}
3467b38ff370SJamie Gritton #endif
34680304c731SJamie Gritton 		if (cpr->pr_ref == 0) {
34690304c731SJamie Gritton 			mtx_unlock(&cpr->pr_mtx);
3470b38ff370SJamie Gritton 			continue;
3471b38ff370SJamie Gritton 		}
3472b38ff370SJamie Gritton 		bzero(xp, sizeof(*xp));
3473fd7a8150SMike Barcroft 		xp->pr_version = XPRISON_VERSION;
34740304c731SJamie Gritton 		xp->pr_id = cpr->pr_id;
34750304c731SJamie Gritton 		xp->pr_state = cpr->pr_uref > 0
3476b38ff370SJamie Gritton 		    ? PRISON_STATE_ALIVE : PRISON_STATE_DYING;
34770304c731SJamie Gritton 		strlcpy(xp->pr_path, prison_path(pr, cpr), sizeof(xp->pr_path));
3478c1f19219SJamie Gritton 		strlcpy(xp->pr_host, cpr->pr_hostname, sizeof(xp->pr_host));
34790304c731SJamie Gritton 		strlcpy(xp->pr_name, prison_name(pr, cpr), sizeof(xp->pr_name));
3480413628a7SBjoern A. Zeeb #ifdef INET
34810304c731SJamie Gritton 		xp->pr_ip4s = cpr->pr_ip4s;
3482413628a7SBjoern A. Zeeb #endif
3483413628a7SBjoern A. Zeeb #ifdef INET6
34840304c731SJamie Gritton 		xp->pr_ip6s = cpr->pr_ip6s;
3485413628a7SBjoern A. Zeeb #endif
34860304c731SJamie Gritton 		mtx_unlock(&cpr->pr_mtx);
3487b38ff370SJamie Gritton 		error = SYSCTL_OUT(req, xp, sizeof(*xp));
3488b38ff370SJamie Gritton 		if (error)
3489b38ff370SJamie Gritton 			break;
3490413628a7SBjoern A. Zeeb #ifdef INET
3491b38ff370SJamie Gritton 		if (xp->pr_ip4s > 0) {
3492b38ff370SJamie Gritton 			error = SYSCTL_OUT(req, ip4,
3493b38ff370SJamie Gritton 			    xp->pr_ip4s * sizeof(struct in_addr));
3494b38ff370SJamie Gritton 			if (error)
3495b38ff370SJamie Gritton 				break;
3496413628a7SBjoern A. Zeeb 		}
3497413628a7SBjoern A. Zeeb #endif
3498413628a7SBjoern A. Zeeb #ifdef INET6
3499b38ff370SJamie Gritton 		if (xp->pr_ip6s > 0) {
3500b38ff370SJamie Gritton 			error = SYSCTL_OUT(req, ip6,
3501b38ff370SJamie Gritton 			    xp->pr_ip6s * sizeof(struct in6_addr));
3502b38ff370SJamie Gritton 			if (error)
3503b38ff370SJamie Gritton 				break;
3504413628a7SBjoern A. Zeeb 		}
3505413628a7SBjoern A. Zeeb #endif
3506fd7a8150SMike Barcroft 	}
3507dc68a633SPawel Jakub Dawidek 	sx_sunlock(&allprison_lock);
3508b38ff370SJamie Gritton 	free(xp, M_TEMP);
3509b38ff370SJamie Gritton #ifdef INET
3510b38ff370SJamie Gritton 	free(ip4, M_TEMP);
3511b38ff370SJamie Gritton #endif
3512b38ff370SJamie Gritton #ifdef INET6
3513b38ff370SJamie Gritton 	free(ip6, M_TEMP);
3514b38ff370SJamie Gritton #endif
3515fd7a8150SMike Barcroft 	return (error);
3516fd7a8150SMike Barcroft }
3517fd7a8150SMike Barcroft 
3518f3b86a5fSEd Schouten SYSCTL_OID(_security_jail, OID_AUTO, list,
3519f3b86a5fSEd Schouten     CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
3520f3b86a5fSEd Schouten     sysctl_jail_list, "S", "List of active jails");
3521461167c2SPawel Jakub Dawidek 
3522461167c2SPawel Jakub Dawidek static int
3523461167c2SPawel Jakub Dawidek sysctl_jail_jailed(SYSCTL_HANDLER_ARGS)
3524461167c2SPawel Jakub Dawidek {
3525461167c2SPawel Jakub Dawidek 	int error, injail;
3526461167c2SPawel Jakub Dawidek 
3527461167c2SPawel Jakub Dawidek 	injail = jailed(req->td->td_ucred);
3528461167c2SPawel Jakub Dawidek 	error = SYSCTL_OUT(req, &injail, sizeof(injail));
3529461167c2SPawel Jakub Dawidek 
3530461167c2SPawel Jakub Dawidek 	return (error);
3531461167c2SPawel Jakub Dawidek }
35320304c731SJamie Gritton 
3533f3b86a5fSEd Schouten SYSCTL_PROC(_security_jail, OID_AUTO, jailed,
3534f3b86a5fSEd Schouten     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
3535f3b86a5fSEd Schouten     sysctl_jail_jailed, "I", "Process in jail?");
3536413628a7SBjoern A. Zeeb 
3537761d2bb5SJamie Gritton static int
3538761d2bb5SJamie Gritton sysctl_jail_vnet(SYSCTL_HANDLER_ARGS)
3539761d2bb5SJamie Gritton {
3540761d2bb5SJamie Gritton 	int error, havevnet;
3541761d2bb5SJamie Gritton #ifdef VIMAGE
3542761d2bb5SJamie Gritton 	struct ucred *cred = req->td->td_ucred;
3543761d2bb5SJamie Gritton 
3544761d2bb5SJamie Gritton 	havevnet = jailed(cred) && prison_owns_vnet(cred);
3545761d2bb5SJamie Gritton #else
3546761d2bb5SJamie Gritton 	havevnet = 0;
3547761d2bb5SJamie Gritton #endif
3548761d2bb5SJamie Gritton 	error = SYSCTL_OUT(req, &havevnet, sizeof(havevnet));
3549761d2bb5SJamie Gritton 
3550761d2bb5SJamie Gritton 	return (error);
3551761d2bb5SJamie Gritton }
3552761d2bb5SJamie Gritton 
3553761d2bb5SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, vnet,
3554761d2bb5SJamie Gritton     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
3555bb8f1623SBjoern A. Zeeb     sysctl_jail_vnet, "I", "Jail owns vnet?");
3556761d2bb5SJamie Gritton 
35570304c731SJamie Gritton #if defined(INET) || defined(INET6)
3558e92e0574SJamie Gritton SYSCTL_UINT(_security_jail, OID_AUTO, jail_max_af_ips, CTLFLAG_RW,
35590304c731SJamie Gritton     &jail_max_af_ips, 0,
3560ee8d6bd3SJamie Gritton     "Number of IP addresses a jail may have at most per address family (deprecated)");
35610304c731SJamie Gritton #endif
35620304c731SJamie Gritton 
35630304c731SJamie Gritton /*
3564e3043798SPedro F. Giffuni  * Default parameters for jail(2) compatibility.  For historical reasons,
35650304c731SJamie Gritton  * the sysctl names have varying similarity to the parameter names.  Prisons
35660304c731SJamie Gritton  * just see their own parameters, and can't change them.
35670304c731SJamie Gritton  */
35680304c731SJamie Gritton static int
35690304c731SJamie Gritton sysctl_jail_default_allow(SYSCTL_HANDLER_ARGS)
35700304c731SJamie Gritton {
35710304c731SJamie Gritton 	struct prison *pr;
35720304c731SJamie Gritton 	int allow, error, i;
35730304c731SJamie Gritton 
35740304c731SJamie Gritton 	pr = req->td->td_ucred->cr_prison;
35750304c731SJamie Gritton 	allow = (pr == &prison0) ? jail_default_allow : pr->pr_allow;
35760304c731SJamie Gritton 
35770304c731SJamie Gritton 	/* Get the current flag value, and convert it to a boolean. */
35780304c731SJamie Gritton 	i = (allow & arg2) ? 1 : 0;
35790304c731SJamie Gritton 	if (arg1 != NULL)
35800304c731SJamie Gritton 		i = !i;
35810304c731SJamie Gritton 	error = sysctl_handle_int(oidp, &i, 0, req);
35820304c731SJamie Gritton 	if (error || !req->newptr)
35830304c731SJamie Gritton 		return (error);
35840304c731SJamie Gritton 	i = i ? arg2 : 0;
35850304c731SJamie Gritton 	if (arg1 != NULL)
35860304c731SJamie Gritton 		i ^= arg2;
35870304c731SJamie Gritton 	/*
35880304c731SJamie Gritton 	 * The sysctls don't have CTLFLAGS_PRISON, so assume prison0
35890304c731SJamie Gritton 	 * for writing.
35900304c731SJamie Gritton 	 */
35910304c731SJamie Gritton 	mtx_lock(&prison0.pr_mtx);
35920304c731SJamie Gritton 	jail_default_allow = (jail_default_allow & ~arg2) | i;
35930304c731SJamie Gritton 	mtx_unlock(&prison0.pr_mtx);
35940304c731SJamie Gritton 	return (0);
35950304c731SJamie Gritton }
35960304c731SJamie Gritton 
35970304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, set_hostname_allowed,
35980304c731SJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
35990304c731SJamie Gritton     NULL, PR_ALLOW_SET_HOSTNAME, sysctl_jail_default_allow, "I",
3600ee8d6bd3SJamie Gritton     "Processes in jail can set their hostnames (deprecated)");
36010304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, socket_unixiproute_only,
36020304c731SJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
36030304c731SJamie Gritton     (void *)1, PR_ALLOW_SOCKET_AF, sysctl_jail_default_allow, "I",
3604ee8d6bd3SJamie Gritton     "Processes in jail are limited to creating UNIX/IP/route sockets only (deprecated)");
36050304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, sysvipc_allowed,
36060304c731SJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
36070304c731SJamie Gritton     NULL, PR_ALLOW_SYSVIPC, sysctl_jail_default_allow, "I",
3608ee8d6bd3SJamie Gritton     "Processes in jail can use System V IPC primitives (deprecated)");
36090304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, allow_raw_sockets,
36100304c731SJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
36110304c731SJamie Gritton     NULL, PR_ALLOW_RAW_SOCKETS, sysctl_jail_default_allow, "I",
3612ee8d6bd3SJamie Gritton     "Prison root can create raw sockets (deprecated)");
36130304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, chflags_allowed,
36140304c731SJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
36150304c731SJamie Gritton     NULL, PR_ALLOW_CHFLAGS, sysctl_jail_default_allow, "I",
3616ee8d6bd3SJamie Gritton     "Processes in jail can alter system file flags (deprecated)");
36170304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, mount_allowed,
36180304c731SJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
36190304c731SJamie Gritton     NULL, PR_ALLOW_MOUNT, sysctl_jail_default_allow, "I",
3620ee8d6bd3SJamie Gritton     "Processes in jail can mount/unmount jail-friendly file systems (deprecated)");
36210304c731SJamie Gritton 
36220304c731SJamie Gritton static int
36230304c731SJamie Gritton sysctl_jail_default_level(SYSCTL_HANDLER_ARGS)
36240304c731SJamie Gritton {
36250304c731SJamie Gritton 	struct prison *pr;
36260304c731SJamie Gritton 	int level, error;
36270304c731SJamie Gritton 
36280304c731SJamie Gritton 	pr = req->td->td_ucred->cr_prison;
36290304c731SJamie Gritton 	level = (pr == &prison0) ? *(int *)arg1 : *(int *)((char *)pr + arg2);
36300304c731SJamie Gritton 	error = sysctl_handle_int(oidp, &level, 0, req);
36310304c731SJamie Gritton 	if (error || !req->newptr)
36320304c731SJamie Gritton 		return (error);
36330304c731SJamie Gritton 	*(int *)arg1 = level;
36340304c731SJamie Gritton 	return (0);
36350304c731SJamie Gritton }
36360304c731SJamie Gritton 
36370304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, enforce_statfs,
36380304c731SJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
36390304c731SJamie Gritton     &jail_default_enforce_statfs, offsetof(struct prison, pr_enforce_statfs),
36400304c731SJamie Gritton     sysctl_jail_default_level, "I",
3641ee8d6bd3SJamie Gritton     "Processes in jail cannot see all mounted file systems (deprecated)");
36420304c731SJamie Gritton 
36430cc207a6SMartin Matuska SYSCTL_PROC(_security_jail, OID_AUTO, devfs_ruleset,
36440cc207a6SMartin Matuska     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE,
36450cc207a6SMartin Matuska     &jail_default_devfs_rsnum, offsetof(struct prison, pr_devfs_rsnum),
36460cc207a6SMartin Matuska     sysctl_jail_default_level, "I",
3647ee8d6bd3SJamie Gritton     "Ruleset for the devfs filesystem in jail (deprecated)");
36480cc207a6SMartin Matuska 
36490304c731SJamie Gritton /*
36500304c731SJamie Gritton  * Nodes to describe jail parameters.  Maximum length of string parameters
36510304c731SJamie Gritton  * is returned in the string itself, and the other parameters exist merely
36520304c731SJamie Gritton  * to make themselves and their types known.
36530304c731SJamie Gritton  */
36540304c731SJamie Gritton SYSCTL_NODE(_security_jail, OID_AUTO, param, CTLFLAG_RW, 0,
36550304c731SJamie Gritton     "Jail parameters");
36560304c731SJamie Gritton 
36570304c731SJamie Gritton int
36580304c731SJamie Gritton sysctl_jail_param(SYSCTL_HANDLER_ARGS)
36590304c731SJamie Gritton {
36600304c731SJamie Gritton 	int i;
36610304c731SJamie Gritton 	long l;
36620304c731SJamie Gritton 	size_t s;
36630304c731SJamie Gritton 	char numbuf[12];
36640304c731SJamie Gritton 
36650304c731SJamie Gritton 	switch (oidp->oid_kind & CTLTYPE)
36660304c731SJamie Gritton 	{
36670304c731SJamie Gritton 	case CTLTYPE_LONG:
36680304c731SJamie Gritton 	case CTLTYPE_ULONG:
36690304c731SJamie Gritton 		l = 0;
36700304c731SJamie Gritton #ifdef SCTL_MASK32
36710304c731SJamie Gritton 		if (!(req->flags & SCTL_MASK32))
36720304c731SJamie Gritton #endif
36730304c731SJamie Gritton 			return (SYSCTL_OUT(req, &l, sizeof(l)));
36740304c731SJamie Gritton 	case CTLTYPE_INT:
36750304c731SJamie Gritton 	case CTLTYPE_UINT:
36760304c731SJamie Gritton 		i = 0;
36770304c731SJamie Gritton 		return (SYSCTL_OUT(req, &i, sizeof(i)));
36780304c731SJamie Gritton 	case CTLTYPE_STRING:
3679e4cd31ddSJeff Roberson 		snprintf(numbuf, sizeof(numbuf), "%jd", (intmax_t)arg2);
36800304c731SJamie Gritton 		return
36810304c731SJamie Gritton 		    (sysctl_handle_string(oidp, numbuf, sizeof(numbuf), req));
36820304c731SJamie Gritton 	case CTLTYPE_STRUCT:
36830304c731SJamie Gritton 		s = (size_t)arg2;
36840304c731SJamie Gritton 		return (SYSCTL_OUT(req, &s, sizeof(s)));
36850304c731SJamie Gritton 	}
36860304c731SJamie Gritton 	return (0);
36870304c731SJamie Gritton }
36880304c731SJamie Gritton 
3689b96bd95bSIan Lepore /*
3690b96bd95bSIan Lepore  * CTLFLAG_RDTUN in the following indicates jail parameters that can be set at
3691b96bd95bSIan Lepore  * jail creation time but cannot be changed in an existing jail.
3692b96bd95bSIan Lepore  */
36930304c731SJamie Gritton SYSCTL_JAIL_PARAM(, jid, CTLTYPE_INT | CTLFLAG_RDTUN, "I", "Jail ID");
36940304c731SJamie Gritton SYSCTL_JAIL_PARAM(, parent, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail parent ID");
36950304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(, name, CTLFLAG_RW, MAXHOSTNAMELEN, "Jail name");
36960304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(, path, CTLFLAG_RDTUN, MAXPATHLEN, "Jail root path");
36970304c731SJamie Gritton SYSCTL_JAIL_PARAM(, securelevel, CTLTYPE_INT | CTLFLAG_RW,
36980304c731SJamie Gritton     "I", "Jail secure level");
3699b96bd95bSIan Lepore SYSCTL_JAIL_PARAM(, osreldate, CTLTYPE_INT | CTLFLAG_RDTUN, "I",
3700b96bd95bSIan Lepore     "Jail value for kern.osreldate and uname -K");
3701b96bd95bSIan Lepore SYSCTL_JAIL_PARAM_STRING(, osrelease, CTLFLAG_RDTUN, OSRELEASELEN,
3702b96bd95bSIan Lepore     "Jail value for kern.osrelease and uname -r");
37030304c731SJamie Gritton SYSCTL_JAIL_PARAM(, enforce_statfs, CTLTYPE_INT | CTLFLAG_RW,
37040304c731SJamie Gritton     "I", "Jail cannot see all mounted file systems");
37050cc207a6SMartin Matuska SYSCTL_JAIL_PARAM(, devfs_ruleset, CTLTYPE_INT | CTLFLAG_RW,
37060cc207a6SMartin Matuska     "I", "Ruleset for in-jail devfs mounts");
37070304c731SJamie Gritton SYSCTL_JAIL_PARAM(, persist, CTLTYPE_INT | CTLFLAG_RW,
37080304c731SJamie Gritton     "B", "Jail persistence");
3709679e1390SJamie Gritton #ifdef VIMAGE
3710679e1390SJamie Gritton SYSCTL_JAIL_PARAM(, vnet, CTLTYPE_INT | CTLFLAG_RDTUN,
37117cbf7213SJamie Gritton     "E,jailsys", "Virtual network stack");
3712679e1390SJamie Gritton #endif
37130304c731SJamie Gritton SYSCTL_JAIL_PARAM(, dying, CTLTYPE_INT | CTLFLAG_RD,
37140304c731SJamie Gritton     "B", "Jail is in the process of shutting down");
37150304c731SJamie Gritton 
3716b97457e2SJamie Gritton SYSCTL_JAIL_PARAM_NODE(children, "Number of child jails");
3717b97457e2SJamie Gritton SYSCTL_JAIL_PARAM(_children, cur, CTLTYPE_INT | CTLFLAG_RD,
3718b97457e2SJamie Gritton     "I", "Current number of child jails");
3719b97457e2SJamie Gritton SYSCTL_JAIL_PARAM(_children, max, CTLTYPE_INT | CTLFLAG_RW,
3720b97457e2SJamie Gritton     "I", "Maximum number of child jails");
3721b97457e2SJamie Gritton 
37227cbf7213SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(host, CTLFLAG_RW, "Jail host info");
37230304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, hostname, CTLFLAG_RW, MAXHOSTNAMELEN,
37240304c731SJamie Gritton     "Jail hostname");
372576ca6f88SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, domainname, CTLFLAG_RW, MAXHOSTNAMELEN,
372676ca6f88SJamie Gritton     "Jail NIS domainname");
372776ca6f88SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, hostuuid, CTLFLAG_RW, HOSTUUIDLEN,
372876ca6f88SJamie Gritton     "Jail host UUID");
372976ca6f88SJamie Gritton SYSCTL_JAIL_PARAM(_host, hostid, CTLTYPE_ULONG | CTLFLAG_RW,
373076ca6f88SJamie Gritton     "LU", "Jail host ID");
37310304c731SJamie Gritton 
37320304c731SJamie Gritton SYSCTL_JAIL_PARAM_NODE(cpuset, "Jail cpuset");
37330304c731SJamie Gritton SYSCTL_JAIL_PARAM(_cpuset, id, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail cpuset ID");
37340304c731SJamie Gritton 
37350304c731SJamie Gritton #ifdef INET
37362b0d6f81SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(ip4, CTLFLAG_RDTUN,
37372b0d6f81SJamie Gritton     "Jail IPv4 address virtualization");
37380304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRUCT(_ip4, addr, CTLFLAG_RW, sizeof(struct in_addr),
37390304c731SJamie Gritton     "S,in_addr,a", "Jail IPv4 addresses");
3740592bcae8SBjoern A. Zeeb SYSCTL_JAIL_PARAM(_ip4, saddrsel, CTLTYPE_INT | CTLFLAG_RW,
3741592bcae8SBjoern A. Zeeb     "B", "Do (not) use IPv4 source address selection rather than the "
3742592bcae8SBjoern A. Zeeb     "primary jail IPv4 address.");
37430304c731SJamie Gritton #endif
37440304c731SJamie Gritton #ifdef INET6
37452b0d6f81SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(ip6, CTLFLAG_RDTUN,
37462b0d6f81SJamie Gritton     "Jail IPv6 address virtualization");
37470304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRUCT(_ip6, addr, CTLFLAG_RW, sizeof(struct in6_addr),
37480304c731SJamie Gritton     "S,in6_addr,a", "Jail IPv6 addresses");
3749592bcae8SBjoern A. Zeeb SYSCTL_JAIL_PARAM(_ip6, saddrsel, CTLTYPE_INT | CTLFLAG_RW,
3750592bcae8SBjoern A. Zeeb     "B", "Do (not) use IPv6 source address selection rather than the "
3751592bcae8SBjoern A. Zeeb     "primary jail IPv6 address.");
37520304c731SJamie Gritton #endif
37530304c731SJamie Gritton 
37540304c731SJamie Gritton SYSCTL_JAIL_PARAM_NODE(allow, "Jail permission flags");
37550304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, set_hostname, CTLTYPE_INT | CTLFLAG_RW,
37560304c731SJamie Gritton     "B", "Jail may set hostname");
37570304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, sysvipc, CTLTYPE_INT | CTLFLAG_RW,
37580304c731SJamie Gritton     "B", "Jail may use SYSV IPC");
37590304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, raw_sockets, CTLTYPE_INT | CTLFLAG_RW,
37600304c731SJamie Gritton     "B", "Jail may create raw sockets");
37610304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, chflags, CTLTYPE_INT | CTLFLAG_RW,
37620304c731SJamie Gritton     "B", "Jail may alter system file flags");
37630304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, quotas, CTLTYPE_INT | CTLFLAG_RW,
37640304c731SJamie Gritton     "B", "Jail may set file quotas");
37650304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, socket_af, CTLTYPE_INT | CTLFLAG_RW,
37660304c731SJamie Gritton     "B", "Jail may create sockets other than just UNIX/IPv4/IPv6/route");
3767*ccd6ac9fSAntoine Brodin SYSCTL_JAIL_PARAM(_allow, mlock, CTLTYPE_INT | CTLFLAG_RW,
3768*ccd6ac9fSAntoine Brodin     "B", "Jail may lock (unlock) physical pages in memory");
3769e28f9b7dSAllan Jude SYSCTL_JAIL_PARAM(_allow, reserved_ports, CTLTYPE_INT | CTLFLAG_RW,
3770e28f9b7dSAllan Jude     "B", "Jail may bind sockets to reserved ports");
37710304c731SJamie Gritton 
3772bf3db8aaSMartin Matuska SYSCTL_JAIL_PARAM_SUBNODE(allow, mount, "Jail mount/unmount permission flags");
3773bf3db8aaSMartin Matuska SYSCTL_JAIL_PARAM(_allow_mount, , CTLTYPE_INT | CTLFLAG_RW,
3774bf3db8aaSMartin Matuska     "B", "Jail may mount/unmount jail-friendly file systems in general");
37750e5c6bd4SJamie Gritton 
37760e5c6bd4SJamie Gritton /*
37770a172404SJamie Gritton  * Add a dynamic parameter allow.<name>, or allow.<prefix>.<name>.  Return
37780a172404SJamie Gritton  * its associated bit in the pr_allow bitmask, or zero if the parameter was
37790a172404SJamie Gritton  * not created.
37800e5c6bd4SJamie Gritton  */
37810a172404SJamie Gritton unsigned
37820a172404SJamie Gritton prison_add_allow(const char *prefix, const char *name, const char *prefix_descr,
37830a172404SJamie Gritton     const char *descr)
37840e5c6bd4SJamie Gritton {
37850e5c6bd4SJamie Gritton 	struct bool_flags *bf;
37860a172404SJamie Gritton 	struct sysctl_oid *parent;
37870a172404SJamie Gritton 	char *allow_name, *allow_noname, *allowed;
37880e5c6bd4SJamie Gritton #ifndef NO_SYSCTL_DESCR
37890a172404SJamie Gritton 	char *descr_deprecated;
37900e5c6bd4SJamie Gritton #endif
37910e5c6bd4SJamie Gritton 	unsigned allow_flag;
37920e5c6bd4SJamie Gritton 
37930a172404SJamie Gritton 	if (prefix
37940a172404SJamie Gritton 	    ? asprintf(&allow_name, M_PRISON, "allow.%s.%s", prefix, name)
37950a172404SJamie Gritton 		< 0 ||
37960a172404SJamie Gritton 	      asprintf(&allow_noname, M_PRISON, "allow.%s.no%s", prefix, name)
37970a172404SJamie Gritton 		< 0
37980a172404SJamie Gritton 	    : asprintf(&allow_name, M_PRISON, "allow.%s", name) < 0 ||
37990a172404SJamie Gritton 	      asprintf(&allow_noname, M_PRISON, "allow.no%s", name) < 0) {
38000e5c6bd4SJamie Gritton 		free(allow_name, M_PRISON);
38010a172404SJamie Gritton 		return 0;
38020e5c6bd4SJamie Gritton 	}
38030e5c6bd4SJamie Gritton 
38040e5c6bd4SJamie Gritton 	/*
38050a172404SJamie Gritton 	 * See if this parameter has already beed added, i.e. a module was
38060a172404SJamie Gritton 	 * previously loaded/unloaded.
38070e5c6bd4SJamie Gritton 	 */
38080e5c6bd4SJamie Gritton 	mtx_lock(&prison0.pr_mtx);
38090e5c6bd4SJamie Gritton 	for (bf = pr_flag_allow;
38100e5c6bd4SJamie Gritton 	     bf < pr_flag_allow + nitems(pr_flag_allow) && bf->flag != 0;
38110e5c6bd4SJamie Gritton 	     bf++) {
38120e5c6bd4SJamie Gritton 		if (strcmp(bf->name, allow_name) == 0) {
38130a172404SJamie Gritton 			allow_flag = bf->flag;
38140e5c6bd4SJamie Gritton 			goto no_add;
38150e5c6bd4SJamie Gritton 		}
38160e5c6bd4SJamie Gritton 	}
38170e5c6bd4SJamie Gritton 
38180e5c6bd4SJamie Gritton 	/*
38190e5c6bd4SJamie Gritton 	 * Find a free bit in prison0's pr_allow, failing if there are none
38200e5c6bd4SJamie Gritton 	 * (which shouldn't happen as long as we keep track of how many
38210a172404SJamie Gritton 	 * potential dynamic flags exist).
38220e5c6bd4SJamie Gritton 	 */
38230e5c6bd4SJamie Gritton 	for (allow_flag = 1;; allow_flag <<= 1) {
38240e5c6bd4SJamie Gritton 		if (allow_flag == 0)
38250e5c6bd4SJamie Gritton 			goto no_add;
38260e5c6bd4SJamie Gritton 		if ((prison0.pr_allow & allow_flag) == 0)
38270e5c6bd4SJamie Gritton 			break;
38280e5c6bd4SJamie Gritton 	}
38290e5c6bd4SJamie Gritton 
38300e5c6bd4SJamie Gritton 	/*
38310e5c6bd4SJamie Gritton 	 * Note the parameter in the next open slot in pr_flag_allow.
38320e5c6bd4SJamie Gritton 	 * Set the flag last so code that checks pr_flag_allow can do so
38330e5c6bd4SJamie Gritton 	 * without locking.
38340e5c6bd4SJamie Gritton 	 */
38350e5c6bd4SJamie Gritton 	for (bf = pr_flag_allow; bf->flag != 0; bf++)
38360e5c6bd4SJamie Gritton 		if (bf == pr_flag_allow + nitems(pr_flag_allow)) {
38370e5c6bd4SJamie Gritton 			/* This should never happen, but is not fatal. */
38380a172404SJamie Gritton 			allow_flag = 0;
38390e5c6bd4SJamie Gritton 			goto no_add;
38400e5c6bd4SJamie Gritton 		}
38410e5c6bd4SJamie Gritton 	prison0.pr_allow |= allow_flag;
38420e5c6bd4SJamie Gritton 	bf->name = allow_name;
38430e5c6bd4SJamie Gritton 	bf->noname = allow_noname;
38440e5c6bd4SJamie Gritton 	bf->flag = allow_flag;
38450e5c6bd4SJamie Gritton 	mtx_unlock(&prison0.pr_mtx);
38460e5c6bd4SJamie Gritton 
38470e5c6bd4SJamie Gritton 	/*
38480e5c6bd4SJamie Gritton 	 * Create sysctls for the paramter, and the back-compat global
38490e5c6bd4SJamie Gritton 	 * permission.
38500e5c6bd4SJamie Gritton 	 */
38510a172404SJamie Gritton 	parent = prefix
38520a172404SJamie Gritton 	    ? SYSCTL_ADD_NODE(NULL,
38530a172404SJamie Gritton 		  SYSCTL_CHILDREN(&sysctl___security_jail_param_allow),
38540a172404SJamie Gritton 		  OID_AUTO, prefix, 0, 0, prefix_descr)
38550a172404SJamie Gritton 	    : &sysctl___security_jail_param_allow;
38560a172404SJamie Gritton 	(void)SYSCTL_ADD_PROC(NULL, SYSCTL_CHILDREN(parent), OID_AUTO,
38570a172404SJamie Gritton 	    name, CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
38580e5c6bd4SJamie Gritton 	    NULL, 0, sysctl_jail_param, "B", descr);
38590a172404SJamie Gritton 	if ((prefix
38600a172404SJamie Gritton 	     ? asprintf(&allowed, M_TEMP, "%s_%s_allowed", prefix, name)
38610a172404SJamie Gritton 	     : asprintf(&allowed, M_TEMP, "%s_allowed", name)) >= 0) {
38620e5c6bd4SJamie Gritton #ifndef NO_SYSCTL_DESCR
38630a172404SJamie Gritton 		(void)asprintf(&descr_deprecated, M_TEMP, "%s (deprecated)",
38640a172404SJamie Gritton 		    descr);
38650e5c6bd4SJamie Gritton #endif
38660e5c6bd4SJamie Gritton 		(void)SYSCTL_ADD_PROC(NULL,
38670a172404SJamie Gritton 		    SYSCTL_CHILDREN(&sysctl___security_jail), OID_AUTO, allowed,
38680a172404SJamie Gritton 		    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, allow_flag,
38690a172404SJamie Gritton 		    sysctl_jail_default_allow, "I", descr_deprecated);
38700e5c6bd4SJamie Gritton #ifndef NO_SYSCTL_DESCR
38710a172404SJamie Gritton 		free(descr_deprecated, M_TEMP);
38720e5c6bd4SJamie Gritton #endif
38730a172404SJamie Gritton 		free(allowed, M_TEMP);
38740e5c6bd4SJamie Gritton 	}
38750a172404SJamie Gritton 	return allow_flag;
38760e5c6bd4SJamie Gritton 
38770e5c6bd4SJamie Gritton  no_add:
38780e5c6bd4SJamie Gritton 	mtx_unlock(&prison0.pr_mtx);
38790e5c6bd4SJamie Gritton 	free(allow_name, M_PRISON);
38800e5c6bd4SJamie Gritton 	free(allow_noname, M_PRISON);
38810a172404SJamie Gritton 	return allow_flag;
38820a172404SJamie Gritton }
38830a172404SJamie Gritton 
38840a172404SJamie Gritton /*
38850a172404SJamie Gritton  * The VFS system will register jail-aware filesystems here.  They each get
38860a172404SJamie Gritton  * a parameter allow.mount.xxxfs and a flag to check when a jailed user
38870a172404SJamie Gritton  * attempts to mount.
38880a172404SJamie Gritton  */
38890a172404SJamie Gritton void
38900a172404SJamie Gritton prison_add_vfs(struct vfsconf *vfsp)
38910a172404SJamie Gritton {
38920a172404SJamie Gritton #ifdef NO_SYSCTL_DESCR
38930a172404SJamie Gritton 
38940a172404SJamie Gritton 	vfsp->vfc_prison_flag = prison_add_allow("mount", vfsp->vfc_name,
38950a172404SJamie Gritton 	    NULL, NULL);
38960a172404SJamie Gritton #else
38970a172404SJamie Gritton 	char *descr;
38980a172404SJamie Gritton 
38990a172404SJamie Gritton 	(void)asprintf(&descr, M_TEMP, "Jail may mount the %s file system",
39000a172404SJamie Gritton 	    vfsp->vfc_name);
39010a172404SJamie Gritton 	vfsp->vfc_prison_flag = prison_add_allow("mount", vfsp->vfc_name,
39020a172404SJamie Gritton 	    NULL, descr);
39030a172404SJamie Gritton 	free(descr, M_TEMP);
39040a172404SJamie Gritton #endif
39050e5c6bd4SJamie Gritton }
3906bf3db8aaSMartin Matuska 
39074b5c9cf6SEdward Tomasz Napierala #ifdef RACCT
3908097055e2SEdward Tomasz Napierala void
3909097055e2SEdward Tomasz Napierala prison_racct_foreach(void (*callback)(struct racct *racct,
391015db3c07SEdward Tomasz Napierala     void *arg2, void *arg3), void (*pre)(void), void (*post)(void),
391115db3c07SEdward Tomasz Napierala     void *arg2, void *arg3)
3912097055e2SEdward Tomasz Napierala {
3913a7ad07bfSEdward Tomasz Napierala 	struct prison_racct *prr;
3914097055e2SEdward Tomasz Napierala 
39154b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
39164b5c9cf6SEdward Tomasz Napierala 
3917097055e2SEdward Tomasz Napierala 	sx_slock(&allprison_lock);
391815db3c07SEdward Tomasz Napierala 	if (pre != NULL)
391915db3c07SEdward Tomasz Napierala 		(pre)();
3920a7ad07bfSEdward Tomasz Napierala 	LIST_FOREACH(prr, &allprison_racct, prr_next)
3921a7ad07bfSEdward Tomasz Napierala 		(callback)(prr->prr_racct, arg2, arg3);
392215db3c07SEdward Tomasz Napierala 	if (post != NULL)
392315db3c07SEdward Tomasz Napierala 		(post)();
3924097055e2SEdward Tomasz Napierala 	sx_sunlock(&allprison_lock);
3925097055e2SEdward Tomasz Napierala }
39260304c731SJamie Gritton 
3927a7ad07bfSEdward Tomasz Napierala static struct prison_racct *
3928a7ad07bfSEdward Tomasz Napierala prison_racct_find_locked(const char *name)
3929a7ad07bfSEdward Tomasz Napierala {
3930a7ad07bfSEdward Tomasz Napierala 	struct prison_racct *prr;
3931a7ad07bfSEdward Tomasz Napierala 
39324b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
3933a7ad07bfSEdward Tomasz Napierala 	sx_assert(&allprison_lock, SA_XLOCKED);
3934a7ad07bfSEdward Tomasz Napierala 
3935a7ad07bfSEdward Tomasz Napierala 	if (name[0] == '\0' || strlen(name) >= MAXHOSTNAMELEN)
3936a7ad07bfSEdward Tomasz Napierala 		return (NULL);
3937a7ad07bfSEdward Tomasz Napierala 
3938a7ad07bfSEdward Tomasz Napierala 	LIST_FOREACH(prr, &allprison_racct, prr_next) {
3939a7ad07bfSEdward Tomasz Napierala 		if (strcmp(name, prr->prr_name) != 0)
3940a7ad07bfSEdward Tomasz Napierala 			continue;
3941a7ad07bfSEdward Tomasz Napierala 
3942a7ad07bfSEdward Tomasz Napierala 		/* Found prison_racct with a matching name? */
3943a7ad07bfSEdward Tomasz Napierala 		prison_racct_hold(prr);
3944a7ad07bfSEdward Tomasz Napierala 		return (prr);
3945a7ad07bfSEdward Tomasz Napierala 	}
3946a7ad07bfSEdward Tomasz Napierala 
3947a7ad07bfSEdward Tomasz Napierala 	/* Add new prison_racct. */
3948a7ad07bfSEdward Tomasz Napierala 	prr = malloc(sizeof(*prr), M_PRISON_RACCT, M_ZERO | M_WAITOK);
3949a7ad07bfSEdward Tomasz Napierala 	racct_create(&prr->prr_racct);
3950a7ad07bfSEdward Tomasz Napierala 
3951a7ad07bfSEdward Tomasz Napierala 	strcpy(prr->prr_name, name);
3952a7ad07bfSEdward Tomasz Napierala 	refcount_init(&prr->prr_refcount, 1);
3953a7ad07bfSEdward Tomasz Napierala 	LIST_INSERT_HEAD(&allprison_racct, prr, prr_next);
3954a7ad07bfSEdward Tomasz Napierala 
3955a7ad07bfSEdward Tomasz Napierala 	return (prr);
3956a7ad07bfSEdward Tomasz Napierala }
3957a7ad07bfSEdward Tomasz Napierala 
3958a7ad07bfSEdward Tomasz Napierala struct prison_racct *
3959a7ad07bfSEdward Tomasz Napierala prison_racct_find(const char *name)
3960a7ad07bfSEdward Tomasz Napierala {
3961a7ad07bfSEdward Tomasz Napierala 	struct prison_racct *prr;
3962a7ad07bfSEdward Tomasz Napierala 
39634b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
39644b5c9cf6SEdward Tomasz Napierala 
3965a7ad07bfSEdward Tomasz Napierala 	sx_xlock(&allprison_lock);
3966a7ad07bfSEdward Tomasz Napierala 	prr = prison_racct_find_locked(name);
3967a7ad07bfSEdward Tomasz Napierala 	sx_xunlock(&allprison_lock);
3968a7ad07bfSEdward Tomasz Napierala 	return (prr);
3969a7ad07bfSEdward Tomasz Napierala }
3970a7ad07bfSEdward Tomasz Napierala 
3971a7ad07bfSEdward Tomasz Napierala void
3972a7ad07bfSEdward Tomasz Napierala prison_racct_hold(struct prison_racct *prr)
3973a7ad07bfSEdward Tomasz Napierala {
3974a7ad07bfSEdward Tomasz Napierala 
39754b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
39764b5c9cf6SEdward Tomasz Napierala 
3977a7ad07bfSEdward Tomasz Napierala 	refcount_acquire(&prr->prr_refcount);
3978a7ad07bfSEdward Tomasz Napierala }
3979a7ad07bfSEdward Tomasz Napierala 
3980c34bbd2aSEdward Tomasz Napierala static void
3981c34bbd2aSEdward Tomasz Napierala prison_racct_free_locked(struct prison_racct *prr)
3982c34bbd2aSEdward Tomasz Napierala {
3983c34bbd2aSEdward Tomasz Napierala 
39844b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
3985c34bbd2aSEdward Tomasz Napierala 	sx_assert(&allprison_lock, SA_XLOCKED);
3986c34bbd2aSEdward Tomasz Napierala 
3987c34bbd2aSEdward Tomasz Napierala 	if (refcount_release(&prr->prr_refcount)) {
3988c34bbd2aSEdward Tomasz Napierala 		racct_destroy(&prr->prr_racct);
3989c34bbd2aSEdward Tomasz Napierala 		LIST_REMOVE(prr, prr_next);
3990c34bbd2aSEdward Tomasz Napierala 		free(prr, M_PRISON_RACCT);
3991c34bbd2aSEdward Tomasz Napierala 	}
3992c34bbd2aSEdward Tomasz Napierala }
3993c34bbd2aSEdward Tomasz Napierala 
3994a7ad07bfSEdward Tomasz Napierala void
3995a7ad07bfSEdward Tomasz Napierala prison_racct_free(struct prison_racct *prr)
3996a7ad07bfSEdward Tomasz Napierala {
3997a7ad07bfSEdward Tomasz Napierala 	int old;
3998a7ad07bfSEdward Tomasz Napierala 
39994b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
4000c34bbd2aSEdward Tomasz Napierala 	sx_assert(&allprison_lock, SA_UNLOCKED);
4001c34bbd2aSEdward Tomasz Napierala 
4002a7ad07bfSEdward Tomasz Napierala 	old = prr->prr_refcount;
4003a7ad07bfSEdward Tomasz Napierala 	if (old > 1 && atomic_cmpset_int(&prr->prr_refcount, old, old - 1))
4004a7ad07bfSEdward Tomasz Napierala 		return;
4005a7ad07bfSEdward Tomasz Napierala 
4006a7ad07bfSEdward Tomasz Napierala 	sx_xlock(&allprison_lock);
4007c34bbd2aSEdward Tomasz Napierala 	prison_racct_free_locked(prr);
4008a7ad07bfSEdward Tomasz Napierala 	sx_xunlock(&allprison_lock);
4009a7ad07bfSEdward Tomasz Napierala }
4010a7ad07bfSEdward Tomasz Napierala 
4011a7ad07bfSEdward Tomasz Napierala static void
4012a7ad07bfSEdward Tomasz Napierala prison_racct_attach(struct prison *pr)
4013a7ad07bfSEdward Tomasz Napierala {
4014a7ad07bfSEdward Tomasz Napierala 	struct prison_racct *prr;
4015a7ad07bfSEdward Tomasz Napierala 
40164b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
4017c34bbd2aSEdward Tomasz Napierala 	sx_assert(&allprison_lock, SA_XLOCKED);
4018c34bbd2aSEdward Tomasz Napierala 
4019a7ad07bfSEdward Tomasz Napierala 	prr = prison_racct_find_locked(pr->pr_name);
4020a7ad07bfSEdward Tomasz Napierala 	KASSERT(prr != NULL, ("cannot find prison_racct"));
4021a7ad07bfSEdward Tomasz Napierala 
4022a7ad07bfSEdward Tomasz Napierala 	pr->pr_prison_racct = prr;
4023a7ad07bfSEdward Tomasz Napierala }
4024a7ad07bfSEdward Tomasz Napierala 
4025c34bbd2aSEdward Tomasz Napierala /*
4026c34bbd2aSEdward Tomasz Napierala  * Handle jail renaming.  From the racct point of view, renaming means
4027c34bbd2aSEdward Tomasz Napierala  * moving from one prison_racct to another.
4028c34bbd2aSEdward Tomasz Napierala  */
4029c34bbd2aSEdward Tomasz Napierala static void
4030c34bbd2aSEdward Tomasz Napierala prison_racct_modify(struct prison *pr)
4031c34bbd2aSEdward Tomasz Napierala {
4032dbadb015SKonstantin Belousov #ifdef RCTL
4033c34bbd2aSEdward Tomasz Napierala 	struct proc *p;
4034c34bbd2aSEdward Tomasz Napierala 	struct ucred *cred;
4035dbadb015SKonstantin Belousov #endif
4036c34bbd2aSEdward Tomasz Napierala 	struct prison_racct *oldprr;
4037c34bbd2aSEdward Tomasz Napierala 
40384b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
40394b5c9cf6SEdward Tomasz Napierala 
4040c34bbd2aSEdward Tomasz Napierala 	sx_slock(&allproc_lock);
4041c34bbd2aSEdward Tomasz Napierala 	sx_xlock(&allprison_lock);
4042c34bbd2aSEdward Tomasz Napierala 
4043e30345e7SEdward Tomasz Napierala 	if (strcmp(pr->pr_name, pr->pr_prison_racct->prr_name) == 0) {
4044e30345e7SEdward Tomasz Napierala 		sx_xunlock(&allprison_lock);
4045e30345e7SEdward Tomasz Napierala 		sx_sunlock(&allproc_lock);
4046c34bbd2aSEdward Tomasz Napierala 		return;
4047e30345e7SEdward Tomasz Napierala 	}
4048c34bbd2aSEdward Tomasz Napierala 
4049c34bbd2aSEdward Tomasz Napierala 	oldprr = pr->pr_prison_racct;
4050c34bbd2aSEdward Tomasz Napierala 	pr->pr_prison_racct = NULL;
4051c34bbd2aSEdward Tomasz Napierala 
4052c34bbd2aSEdward Tomasz Napierala 	prison_racct_attach(pr);
4053c34bbd2aSEdward Tomasz Napierala 
4054c34bbd2aSEdward Tomasz Napierala 	/*
4055c34bbd2aSEdward Tomasz Napierala 	 * Move resource utilisation records.
4056c34bbd2aSEdward Tomasz Napierala 	 */
4057c34bbd2aSEdward Tomasz Napierala 	racct_move(pr->pr_prison_racct->prr_racct, oldprr->prr_racct);
4058c34bbd2aSEdward Tomasz Napierala 
4059f87beb93SAndriy Gapon #ifdef RCTL
4060c34bbd2aSEdward Tomasz Napierala 	/*
4061c34bbd2aSEdward Tomasz Napierala 	 * Force rctl to reattach rules to processes.
4062c34bbd2aSEdward Tomasz Napierala 	 */
4063c34bbd2aSEdward Tomasz Napierala 	FOREACH_PROC_IN_SYSTEM(p) {
4064c34bbd2aSEdward Tomasz Napierala 		PROC_LOCK(p);
4065c34bbd2aSEdward Tomasz Napierala 		cred = crhold(p->p_ucred);
4066c34bbd2aSEdward Tomasz Napierala 		PROC_UNLOCK(p);
4067f87beb93SAndriy Gapon 		rctl_proc_ucred_changed(p, cred);
4068c34bbd2aSEdward Tomasz Napierala 		crfree(cred);
4069c34bbd2aSEdward Tomasz Napierala 	}
4070f87beb93SAndriy Gapon #endif
4071c34bbd2aSEdward Tomasz Napierala 
4072c34bbd2aSEdward Tomasz Napierala 	sx_sunlock(&allproc_lock);
4073c34bbd2aSEdward Tomasz Napierala 	prison_racct_free_locked(oldprr);
4074c34bbd2aSEdward Tomasz Napierala 	sx_xunlock(&allprison_lock);
4075c34bbd2aSEdward Tomasz Napierala }
4076c34bbd2aSEdward Tomasz Napierala 
4077a7ad07bfSEdward Tomasz Napierala static void
4078a7ad07bfSEdward Tomasz Napierala prison_racct_detach(struct prison *pr)
4079a7ad07bfSEdward Tomasz Napierala {
4080c34bbd2aSEdward Tomasz Napierala 
40814b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
4082c34bbd2aSEdward Tomasz Napierala 	sx_assert(&allprison_lock, SA_UNLOCKED);
4083c34bbd2aSEdward Tomasz Napierala 
4084af3c786cSMateusz Guzik 	if (pr->pr_prison_racct == NULL)
4085af3c786cSMateusz Guzik 		return;
4086a7ad07bfSEdward Tomasz Napierala 	prison_racct_free(pr->pr_prison_racct);
4087a7ad07bfSEdward Tomasz Napierala 	pr->pr_prison_racct = NULL;
4088a7ad07bfSEdward Tomasz Napierala }
4089a7ad07bfSEdward Tomasz Napierala #endif /* RACCT */
4090a7ad07bfSEdward Tomasz Napierala 
4091413628a7SBjoern A. Zeeb #ifdef DDB
4092b38ff370SJamie Gritton 
4093b38ff370SJamie Gritton static void
4094b38ff370SJamie Gritton db_show_prison(struct prison *pr)
4095413628a7SBjoern A. Zeeb {
4096672756aaSJamie Gritton 	struct bool_flags *bf;
4097672756aaSJamie Gritton 	struct jailsys_flags *jsf;
4098b38ff370SJamie Gritton #if defined(INET) || defined(INET6)
4099b38ff370SJamie Gritton 	int ii;
4100413628a7SBjoern A. Zeeb #endif
4101672756aaSJamie Gritton 	unsigned f;
41028144690aSEric van Gyzen #ifdef INET
41038144690aSEric van Gyzen 	char ip4buf[INET_ADDRSTRLEN];
41048144690aSEric van Gyzen #endif
4105413628a7SBjoern A. Zeeb #ifdef INET6
4106413628a7SBjoern A. Zeeb 	char ip6buf[INET6_ADDRSTRLEN];
4107413628a7SBjoern A. Zeeb #endif
4108413628a7SBjoern A. Zeeb 
4109b38ff370SJamie Gritton 	db_printf("prison %p:\n", pr);
4110b38ff370SJamie Gritton 	db_printf(" jid             = %d\n", pr->pr_id);
4111b38ff370SJamie Gritton 	db_printf(" name            = %s\n", pr->pr_name);
41120304c731SJamie Gritton 	db_printf(" parent          = %p\n", pr->pr_parent);
4113b38ff370SJamie Gritton 	db_printf(" ref             = %d\n", pr->pr_ref);
4114b38ff370SJamie Gritton 	db_printf(" uref            = %d\n", pr->pr_uref);
4115b38ff370SJamie Gritton 	db_printf(" path            = %s\n", pr->pr_path);
4116b38ff370SJamie Gritton 	db_printf(" cpuset          = %d\n", pr->pr_cpuset
4117b38ff370SJamie Gritton 	    ? pr->pr_cpuset->cs_id : -1);
4118679e1390SJamie Gritton #ifdef VIMAGE
4119679e1390SJamie Gritton 	db_printf(" vnet            = %p\n", pr->pr_vnet);
4120679e1390SJamie Gritton #endif
4121b38ff370SJamie Gritton 	db_printf(" root            = %p\n", pr->pr_root);
4122b38ff370SJamie Gritton 	db_printf(" securelevel     = %d\n", pr->pr_securelevel);
41230cc207a6SMartin Matuska 	db_printf(" devfs_rsnum     = %d\n", pr->pr_devfs_rsnum);
4124fe0518e9SBjoern A. Zeeb 	db_printf(" children.max    = %d\n", pr->pr_childmax);
4125fe0518e9SBjoern A. Zeeb 	db_printf(" children.cur    = %d\n", pr->pr_childcount);
41260304c731SJamie Gritton 	db_printf(" child           = %p\n", LIST_FIRST(&pr->pr_children));
41270304c731SJamie Gritton 	db_printf(" sibling         = %p\n", LIST_NEXT(pr, pr_sibling));
4128fe0518e9SBjoern A. Zeeb 	db_printf(" flags           = 0x%x", pr->pr_flags);
4129672756aaSJamie Gritton 	for (bf = pr_flag_bool; bf < pr_flag_bool + nitems(pr_flag_bool); bf++)
4130672756aaSJamie Gritton 		if (pr->pr_flags & bf->flag)
4131672756aaSJamie Gritton 			db_printf(" %s", bf->name);
4132672756aaSJamie Gritton 	for (jsf = pr_flag_jailsys;
4133672756aaSJamie Gritton 	     jsf < pr_flag_jailsys + nitems(pr_flag_jailsys);
4134672756aaSJamie Gritton 	     jsf++) {
4135672756aaSJamie Gritton 		f = pr->pr_flags & (jsf->disable | jsf->new);
4136672756aaSJamie Gritton 		db_printf(" %-16s= %s\n", jsf->name,
4137672756aaSJamie Gritton 		    (f != 0 && f == jsf->disable) ? "disable"
4138672756aaSJamie Gritton 		    : (f == jsf->new) ? "new"
41397cbf7213SJamie Gritton 		    : "inherit");
41407cbf7213SJamie Gritton 	}
4141fe0518e9SBjoern A. Zeeb 	db_printf(" allow           = 0x%x", pr->pr_allow);
4142672756aaSJamie Gritton 	for (bf = pr_flag_allow;
41430e5c6bd4SJamie Gritton 	     bf < pr_flag_allow + nitems(pr_flag_allow) && bf->flag != 0;
4144672756aaSJamie Gritton 	     bf++)
4145672756aaSJamie Gritton 		if (pr->pr_allow & bf->flag)
4146672756aaSJamie Gritton 			db_printf(" %s", bf->name);
4147b38ff370SJamie Gritton 	db_printf("\n");
41480304c731SJamie Gritton 	db_printf(" enforce_statfs  = %d\n", pr->pr_enforce_statfs);
4149c1f19219SJamie Gritton 	db_printf(" host.hostname   = %s\n", pr->pr_hostname);
4150c1f19219SJamie Gritton 	db_printf(" host.domainname = %s\n", pr->pr_domainname);
4151c1f19219SJamie Gritton 	db_printf(" host.hostuuid   = %s\n", pr->pr_hostuuid);
415276ca6f88SJamie Gritton 	db_printf(" host.hostid     = %lu\n", pr->pr_hostid);
4153413628a7SBjoern A. Zeeb #ifdef INET
4154b38ff370SJamie Gritton 	db_printf(" ip4s            = %d\n", pr->pr_ip4s);
4155b38ff370SJamie Gritton 	for (ii = 0; ii < pr->pr_ip4s; ii++)
4156b38ff370SJamie Gritton 		db_printf(" %s %s\n",
4157fe0518e9SBjoern A. Zeeb 		    ii == 0 ? "ip4.addr        =" : "                 ",
41588144690aSEric van Gyzen 		    inet_ntoa_r(pr->pr_ip4[ii], ip4buf));
4159413628a7SBjoern A. Zeeb #endif
4160413628a7SBjoern A. Zeeb #ifdef INET6
4161b38ff370SJamie Gritton 	db_printf(" ip6s            = %d\n", pr->pr_ip6s);
4162b38ff370SJamie Gritton 	for (ii = 0; ii < pr->pr_ip6s; ii++)
4163b38ff370SJamie Gritton 		db_printf(" %s %s\n",
4164fe0518e9SBjoern A. Zeeb 		    ii == 0 ? "ip6.addr        =" : "                 ",
4165b38ff370SJamie Gritton 		    ip6_sprintf(ip6buf, &pr->pr_ip6[ii]));
4166b38ff370SJamie Gritton #endif
4167b38ff370SJamie Gritton }
4168b38ff370SJamie Gritton 
4169b38ff370SJamie Gritton DB_SHOW_COMMAND(prison, db_show_prison_command)
4170b38ff370SJamie Gritton {
4171b38ff370SJamie Gritton 	struct prison *pr;
4172b38ff370SJamie Gritton 
4173b38ff370SJamie Gritton 	if (!have_addr) {
41740304c731SJamie Gritton 		/*
41750304c731SJamie Gritton 		 * Show all prisons in the list, and prison0 which is not
41760304c731SJamie Gritton 		 * listed.
41770304c731SJamie Gritton 		 */
41780304c731SJamie Gritton 		db_show_prison(&prison0);
41790304c731SJamie Gritton 		if (!db_pager_quit) {
4180b38ff370SJamie Gritton 			TAILQ_FOREACH(pr, &allprison, pr_list) {
4181b38ff370SJamie Gritton 				db_show_prison(pr);
4182413628a7SBjoern A. Zeeb 				if (db_pager_quit)
4183413628a7SBjoern A. Zeeb 					break;
4184413628a7SBjoern A. Zeeb 			}
41850304c731SJamie Gritton 		}
4186b38ff370SJamie Gritton 		return;
4187413628a7SBjoern A. Zeeb 	}
4188b38ff370SJamie Gritton 
41890304c731SJamie Gritton 	if (addr == 0)
41900304c731SJamie Gritton 		pr = &prison0;
41910304c731SJamie Gritton 	else {
4192b38ff370SJamie Gritton 		/* Look for a prison with the ID and with references. */
4193b38ff370SJamie Gritton 		TAILQ_FOREACH(pr, &allprison, pr_list)
4194b38ff370SJamie Gritton 			if (pr->pr_id == addr && pr->pr_ref > 0)
4195b38ff370SJamie Gritton 				break;
4196b38ff370SJamie Gritton 		if (pr == NULL)
4197b38ff370SJamie Gritton 			/* Look again, without requiring a reference. */
4198b38ff370SJamie Gritton 			TAILQ_FOREACH(pr, &allprison, pr_list)
4199b38ff370SJamie Gritton 				if (pr->pr_id == addr)
4200b38ff370SJamie Gritton 					break;
4201b38ff370SJamie Gritton 		if (pr == NULL)
4202b38ff370SJamie Gritton 			/* Assume address points to a valid prison. */
4203b38ff370SJamie Gritton 			pr = (struct prison *)addr;
42040304c731SJamie Gritton 	}
4205b38ff370SJamie Gritton 	db_show_prison(pr);
4206b38ff370SJamie Gritton }
4207b38ff370SJamie Gritton 
4208413628a7SBjoern A. Zeeb #endif /* DDB */
4209