19454b2d8SWarner Losh /*- 28a36da99SPedro F. Giffuni * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 38a36da99SPedro F. Giffuni * 4413628a7SBjoern A. Zeeb * Copyright (c) 1999 Poul-Henning Kamp. 5413628a7SBjoern A. Zeeb * Copyright (c) 2008 Bjoern A. Zeeb. 6b38ff370SJamie Gritton * Copyright (c) 2009 James Gritton. 7413628a7SBjoern A. Zeeb * All rights reserved. 8b9f0b66cSBjoern A. Zeeb * 9b9f0b66cSBjoern A. Zeeb * Redistribution and use in source and binary forms, with or without 10b9f0b66cSBjoern A. Zeeb * modification, are permitted provided that the following conditions 11b9f0b66cSBjoern A. Zeeb * are met: 12b9f0b66cSBjoern A. Zeeb * 1. Redistributions of source code must retain the above copyright 13b9f0b66cSBjoern A. Zeeb * notice, this list of conditions and the following disclaimer. 14b9f0b66cSBjoern A. Zeeb * 2. Redistributions in binary form must reproduce the above copyright 15b9f0b66cSBjoern A. Zeeb * notice, this list of conditions and the following disclaimer in the 16b9f0b66cSBjoern A. Zeeb * documentation and/or other materials provided with the distribution. 17b9f0b66cSBjoern A. Zeeb * 18b9f0b66cSBjoern A. Zeeb * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 19b9f0b66cSBjoern A. Zeeb * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20b9f0b66cSBjoern A. Zeeb * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21b9f0b66cSBjoern A. Zeeb * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 22b9f0b66cSBjoern A. Zeeb * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23b9f0b66cSBjoern A. Zeeb * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24b9f0b66cSBjoern A. Zeeb * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25b9f0b66cSBjoern A. Zeeb * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26b9f0b66cSBjoern A. Zeeb * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27b9f0b66cSBjoern A. Zeeb * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28b9f0b66cSBjoern A. Zeeb * SUCH DAMAGE. 2907901f22SPoul-Henning Kamp */ 3075c13541SPoul-Henning Kamp 31677b542eSDavid E. O'Brien #include <sys/cdefs.h> 32677b542eSDavid E. O'Brien __FBSDID("$FreeBSD$"); 33677b542eSDavid E. O'Brien 34413628a7SBjoern A. Zeeb #include "opt_ddb.h" 35413628a7SBjoern A. Zeeb #include "opt_inet.h" 36413628a7SBjoern A. Zeeb #include "opt_inet6.h" 3746e3b1cbSPawel Jakub Dawidek 3875c13541SPoul-Henning Kamp #include <sys/param.h> 3975c13541SPoul-Henning Kamp #include <sys/types.h> 4075c13541SPoul-Henning Kamp #include <sys/kernel.h> 4175c13541SPoul-Henning Kamp #include <sys/systm.h> 4275c13541SPoul-Henning Kamp #include <sys/errno.h> 4375c13541SPoul-Henning Kamp #include <sys/sysproto.h> 4475c13541SPoul-Henning Kamp #include <sys/malloc.h> 450304c731SJamie Gritton #include <sys/osd.h> 46800c9408SRobert Watson #include <sys/priv.h> 4775c13541SPoul-Henning Kamp #include <sys/proc.h> 48b3059e09SRobert Watson #include <sys/taskqueue.h> 4957b4252eSKonstantin Belousov #include <sys/fcntl.h> 5075c13541SPoul-Henning Kamp #include <sys/jail.h> 5101137630SRobert Watson #include <sys/lock.h> 5201137630SRobert Watson #include <sys/mutex.h> 53097055e2SEdward Tomasz Napierala #include <sys/racct.h> 54f87beb93SAndriy Gapon #include <sys/rctl.h> 55a7ad07bfSEdward Tomasz Napierala #include <sys/refcount.h> 56dc68a633SPawel Jakub Dawidek #include <sys/sx.h> 5776ca6f88SJamie Gritton #include <sys/sysent.h> 58fd7a8150SMike Barcroft #include <sys/namei.h> 59820a0de9SPawel Jakub Dawidek #include <sys/mount.h> 60fd7a8150SMike Barcroft #include <sys/queue.h> 6175c13541SPoul-Henning Kamp #include <sys/socket.h> 62fd7a8150SMike Barcroft #include <sys/syscallsubr.h> 6383f1e257SRobert Watson #include <sys/sysctl.h> 64fd7a8150SMike Barcroft #include <sys/vnode.h> 65530c0060SRobert Watson 6675c13541SPoul-Henning Kamp #include <net/if.h> 67530c0060SRobert Watson #include <net/vnet.h> 68530c0060SRobert Watson 6975c13541SPoul-Henning Kamp #include <netinet/in.h> 70530c0060SRobert Watson 71413628a7SBjoern A. Zeeb #ifdef DDB 72413628a7SBjoern A. Zeeb #include <ddb/ddb.h> 73413628a7SBjoern A. Zeeb #endif /* DDB */ 7475c13541SPoul-Henning Kamp 75aed55708SRobert Watson #include <security/mac/mac_framework.h> 76aed55708SRobert Watson 778986e3a0SJamie Gritton #define DEFAULT_HOSTUUID "00000000-0000-0000-0000-000000000000" 788986e3a0SJamie Gritton 7975c13541SPoul-Henning Kamp MALLOC_DEFINE(M_PRISON, "prison", "Prison structures"); 80d745c852SEd Schouten static MALLOC_DEFINE(M_PRISON_RACCT, "prison_racct", "Prison racct structures"); 8175c13541SPoul-Henning Kamp 82592bcae8SBjoern A. Zeeb /* Keep struct prison prison0 and some code in kern_jail_set() readable. */ 83592bcae8SBjoern A. Zeeb #ifdef INET 84592bcae8SBjoern A. Zeeb #ifdef INET6 85592bcae8SBjoern A. Zeeb #define _PR_IP_SADDRSEL PR_IP4_SADDRSEL|PR_IP6_SADDRSEL 86592bcae8SBjoern A. Zeeb #else 87592bcae8SBjoern A. Zeeb #define _PR_IP_SADDRSEL PR_IP4_SADDRSEL 88592bcae8SBjoern A. Zeeb #endif 89592bcae8SBjoern A. Zeeb #else /* !INET */ 90592bcae8SBjoern A. Zeeb #ifdef INET6 91592bcae8SBjoern A. Zeeb #define _PR_IP_SADDRSEL PR_IP6_SADDRSEL 92592bcae8SBjoern A. Zeeb #else 93592bcae8SBjoern A. Zeeb #define _PR_IP_SADDRSEL 0 94592bcae8SBjoern A. Zeeb #endif 95592bcae8SBjoern A. Zeeb #endif 96592bcae8SBjoern A. Zeeb 970304c731SJamie Gritton /* prison0 describes what is "real" about the system. */ 980304c731SJamie Gritton struct prison prison0 = { 990304c731SJamie Gritton .pr_id = 0, 1000304c731SJamie Gritton .pr_name = "0", 1010304c731SJamie Gritton .pr_ref = 1, 1020304c731SJamie Gritton .pr_uref = 1, 1030304c731SJamie Gritton .pr_path = "/", 1040304c731SJamie Gritton .pr_securelevel = -1, 1050cc207a6SMartin Matuska .pr_devfs_rsnum = 0, 106b97457e2SJamie Gritton .pr_childmax = JAIL_MAX, 1078986e3a0SJamie Gritton .pr_hostuuid = DEFAULT_HOSTUUID, 10813e403fdSAntoine Brodin .pr_children = LIST_HEAD_INITIALIZER(prison0.pr_children), 109eb79e1c7SBjoern A. Zeeb #ifdef VIMAGE 110592bcae8SBjoern A. Zeeb .pr_flags = PR_HOST|PR_VNET|_PR_IP_SADDRSEL, 111eb79e1c7SBjoern A. Zeeb #else 112592bcae8SBjoern A. Zeeb .pr_flags = PR_HOST|_PR_IP_SADDRSEL, 113eb79e1c7SBjoern A. Zeeb #endif 1140e5c6bd4SJamie Gritton .pr_allow = PR_ALLOW_ALL_STATIC, 1150304c731SJamie Gritton }; 1160304c731SJamie Gritton MTX_SYSINIT(prison0, &prison0.pr_mtx, "jail mutex", MTX_DEF); 11783f1e257SRobert Watson 118672756aaSJamie Gritton struct bool_flags { 119672756aaSJamie Gritton const char *name; 120672756aaSJamie Gritton const char *noname; 121672756aaSJamie Gritton unsigned flag; 122672756aaSJamie Gritton }; 123672756aaSJamie Gritton struct jailsys_flags { 124672756aaSJamie Gritton const char *name; 125672756aaSJamie Gritton unsigned disable; 126672756aaSJamie Gritton unsigned new; 127672756aaSJamie Gritton }; 128672756aaSJamie Gritton 129a7ad07bfSEdward Tomasz Napierala /* allprison, allprison_racct and lastprid are protected by allprison_lock. */ 130dc68a633SPawel Jakub Dawidek struct sx allprison_lock; 131b38ff370SJamie Gritton SX_SYSINIT(allprison_lock, &allprison_lock, "allprison"); 132b38ff370SJamie Gritton struct prisonlist allprison = TAILQ_HEAD_INITIALIZER(allprison); 133a7ad07bfSEdward Tomasz Napierala LIST_HEAD(, prison_racct) allprison_racct; 1342110d913SXin LI int lastprid = 0; 135fd7a8150SMike Barcroft 136b38ff370SJamie Gritton static int do_jail_attach(struct thread *td, struct prison *pr); 137b3059e09SRobert Watson static void prison_complete(void *context, int pending); 138b38ff370SJamie Gritton static void prison_deref(struct prison *pr, int flags); 1390304c731SJamie Gritton static char *prison_path(struct prison *pr1, struct prison *pr2); 1400304c731SJamie Gritton static void prison_remove_one(struct prison *pr); 141a7ad07bfSEdward Tomasz Napierala #ifdef RACCT 142a7ad07bfSEdward Tomasz Napierala static void prison_racct_attach(struct prison *pr); 143c34bbd2aSEdward Tomasz Napierala static void prison_racct_modify(struct prison *pr); 144a7ad07bfSEdward Tomasz Napierala static void prison_racct_detach(struct prison *pr); 145a7ad07bfSEdward Tomasz Napierala #endif 146fd7a8150SMike Barcroft 147b38ff370SJamie Gritton /* Flags for prison_deref */ 148b38ff370SJamie Gritton #define PD_DEREF 0x01 149b38ff370SJamie Gritton #define PD_DEUREF 0x02 150b38ff370SJamie Gritton #define PD_LOCKED 0x04 151b38ff370SJamie Gritton #define PD_LIST_SLOCKED 0x08 152b38ff370SJamie Gritton #define PD_LIST_XLOCKED 0x10 153fd7a8150SMike Barcroft 1540304c731SJamie Gritton /* 1555cc70397SBjoern A. Zeeb * Parameter names corresponding to PR_* flag values. Size values are for kvm 1565cc70397SBjoern A. Zeeb * as we cannot figure out the size of a sparse array, or an array without a 1575cc70397SBjoern A. Zeeb * terminating entry. 1580304c731SJamie Gritton */ 159672756aaSJamie Gritton static struct bool_flags pr_flag_bool[] = { 160672756aaSJamie Gritton {"persist", "nopersist", PR_PERSIST}, 161592bcae8SBjoern A. Zeeb #ifdef INET 162672756aaSJamie Gritton {"ip4.saddrsel", "ip4.nosaddrsel", PR_IP4_SADDRSEL}, 163592bcae8SBjoern A. Zeeb #endif 164592bcae8SBjoern A. Zeeb #ifdef INET6 165672756aaSJamie Gritton {"ip6.saddrsel", "ip6.nosaddrsel", PR_IP6_SADDRSEL}, 166592bcae8SBjoern A. Zeeb #endif 1670304c731SJamie Gritton }; 168672756aaSJamie Gritton const size_t pr_flag_bool_size = sizeof(pr_flag_bool); 1690304c731SJamie Gritton 170672756aaSJamie Gritton static struct jailsys_flags pr_flag_jailsys[] = { 1717cbf7213SJamie Gritton {"host", 0, PR_HOST}, 1727cbf7213SJamie Gritton #ifdef VIMAGE 1737cbf7213SJamie Gritton {"vnet", 0, PR_VNET}, 1747cbf7213SJamie Gritton #endif 1750304c731SJamie Gritton #ifdef INET 1766a3f2779SJamie Gritton {"ip4", PR_IP4_USER, PR_IP4_USER}, 1770304c731SJamie Gritton #endif 1780304c731SJamie Gritton #ifdef INET6 1796a3f2779SJamie Gritton {"ip6", PR_IP6_USER, PR_IP6_USER}, 180679e1390SJamie Gritton #endif 1810304c731SJamie Gritton }; 1825cc70397SBjoern A. Zeeb const size_t pr_flag_jailsys_size = sizeof(pr_flag_jailsys); 1830304c731SJamie Gritton 1840e5c6bd4SJamie Gritton /* Make this array full-size so dynamic parameters can be added. */ 1850e5c6bd4SJamie Gritton static struct bool_flags pr_flag_allow[NBBY * NBPW] = { 186672756aaSJamie Gritton {"allow.set_hostname", "allow.noset_hostname", PR_ALLOW_SET_HOSTNAME}, 187672756aaSJamie Gritton {"allow.sysvipc", "allow.nosysvipc", PR_ALLOW_SYSVIPC}, 188672756aaSJamie Gritton {"allow.raw_sockets", "allow.noraw_sockets", PR_ALLOW_RAW_SOCKETS}, 189672756aaSJamie Gritton {"allow.chflags", "allow.nochflags", PR_ALLOW_CHFLAGS}, 190672756aaSJamie Gritton {"allow.mount", "allow.nomount", PR_ALLOW_MOUNT}, 191672756aaSJamie Gritton {"allow.quotas", "allow.noquotas", PR_ALLOW_QUOTAS}, 192672756aaSJamie Gritton {"allow.socket_af", "allow.nosocket_af", PR_ALLOW_SOCKET_AF}, 193*ccd6ac9fSAntoine Brodin {"allow.mlock", "allow.nomlock", PR_ALLOW_MLOCK}, 194672756aaSJamie Gritton {"allow.reserved_ports", "allow.noreserved_ports", 195672756aaSJamie Gritton PR_ALLOW_RESERVED_PORTS}, 1960304c731SJamie Gritton }; 197672756aaSJamie Gritton const size_t pr_flag_allow_size = sizeof(pr_flag_allow); 1980304c731SJamie Gritton 199e28f9b7dSAllan Jude #define JAIL_DEFAULT_ALLOW (PR_ALLOW_SET_HOSTNAME | PR_ALLOW_RESERVED_PORTS) 20042bebd82SJamie Gritton #define JAIL_DEFAULT_ENFORCE_STATFS 2 201bf3db8aaSMartin Matuska #define JAIL_DEFAULT_DEVFS_RSNUM 0 2020304c731SJamie Gritton static unsigned jail_default_allow = JAIL_DEFAULT_ALLOW; 20342bebd82SJamie Gritton static int jail_default_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS; 2040cc207a6SMartin Matuska static int jail_default_devfs_rsnum = JAIL_DEFAULT_DEVFS_RSNUM; 2050304c731SJamie Gritton #if defined(INET) || defined(INET6) 206e92e0574SJamie Gritton static unsigned jail_max_af_ips = 255; 2070304c731SJamie Gritton #endif 2080304c731SJamie Gritton 209b96bd95bSIan Lepore /* 210b96bd95bSIan Lepore * Initialize the parts of prison0 that can't be static-initialized with 211b96bd95bSIan Lepore * constants. This is called from proc0_init() after creating thread0 cpuset. 212b96bd95bSIan Lepore */ 213b96bd95bSIan Lepore void 214b96bd95bSIan Lepore prison0_init(void) 215b96bd95bSIan Lepore { 216b96bd95bSIan Lepore 217b96bd95bSIan Lepore prison0.pr_cpuset = cpuset_ref(thread0.td_cpuset); 218b96bd95bSIan Lepore prison0.pr_osreldate = osreldate; 219b96bd95bSIan Lepore strlcpy(prison0.pr_osrelease, osrelease, sizeof(prison0.pr_osrelease)); 220b96bd95bSIan Lepore } 221b96bd95bSIan Lepore 222116734c4SMatthew Dillon /* 2239ddb7954SMike Barcroft * struct jail_args { 2249ddb7954SMike Barcroft * struct jail *jail; 2259ddb7954SMike Barcroft * }; 226116734c4SMatthew Dillon */ 22775c13541SPoul-Henning Kamp int 2288451d0ddSKip Macy sys_jail(struct thread *td, struct jail_args *uap) 22975c13541SPoul-Henning Kamp { 230413628a7SBjoern A. Zeeb uint32_t version; 231413628a7SBjoern A. Zeeb int error; 2320304c731SJamie Gritton struct jail j; 233413628a7SBjoern A. Zeeb 234413628a7SBjoern A. Zeeb error = copyin(uap->jail, &version, sizeof(uint32_t)); 235413628a7SBjoern A. Zeeb if (error) 236413628a7SBjoern A. Zeeb return (error); 237413628a7SBjoern A. Zeeb 238413628a7SBjoern A. Zeeb switch (version) { 239413628a7SBjoern A. Zeeb case 0: 240413628a7SBjoern A. Zeeb { 241413628a7SBjoern A. Zeeb struct jail_v0 j0; 242413628a7SBjoern A. Zeeb 2430304c731SJamie Gritton /* FreeBSD single IPv4 jails. */ 2440304c731SJamie Gritton bzero(&j, sizeof(struct jail)); 245413628a7SBjoern A. Zeeb error = copyin(uap->jail, &j0, sizeof(struct jail_v0)); 246413628a7SBjoern A. Zeeb if (error) 247413628a7SBjoern A. Zeeb return (error); 2480304c731SJamie Gritton j.version = j0.version; 2490304c731SJamie Gritton j.path = j0.path; 2500304c731SJamie Gritton j.hostname = j0.hostname; 251b5019bc4SPeter Wemm j.ip4s = htonl(j0.ip_number); /* jail_v0 is host order */ 252413628a7SBjoern A. Zeeb break; 253413628a7SBjoern A. Zeeb } 254413628a7SBjoern A. Zeeb 255413628a7SBjoern A. Zeeb case 1: 256413628a7SBjoern A. Zeeb /* 257413628a7SBjoern A. Zeeb * Version 1 was used by multi-IPv4 jail implementations 258413628a7SBjoern A. Zeeb * that never made it into the official kernel. 259413628a7SBjoern A. Zeeb */ 260413628a7SBjoern A. Zeeb return (EINVAL); 261413628a7SBjoern A. Zeeb 262413628a7SBjoern A. Zeeb case 2: /* JAIL_API_VERSION */ 263413628a7SBjoern A. Zeeb /* FreeBSD multi-IPv4/IPv6,noIP jails. */ 264413628a7SBjoern A. Zeeb error = copyin(uap->jail, &j, sizeof(struct jail)); 265413628a7SBjoern A. Zeeb if (error) 266413628a7SBjoern A. Zeeb return (error); 2670304c731SJamie Gritton break; 2680304c731SJamie Gritton 2690304c731SJamie Gritton default: 2700304c731SJamie Gritton /* Sci-Fi jails are not supported, sorry. */ 2710304c731SJamie Gritton return (EINVAL); 2720304c731SJamie Gritton } 2730304c731SJamie Gritton return (kern_jail(td, &j)); 2740304c731SJamie Gritton } 2750304c731SJamie Gritton 2760304c731SJamie Gritton int 2770304c731SJamie Gritton kern_jail(struct thread *td, struct jail *j) 2780304c731SJamie Gritton { 279672756aaSJamie Gritton struct iovec optiov[2 * (4 + nitems(pr_flag_allow) 280e92e0574SJamie Gritton #ifdef INET 281e92e0574SJamie Gritton + 1 282e92e0574SJamie Gritton #endif 283e92e0574SJamie Gritton #ifdef INET6 284e92e0574SJamie Gritton + 1 285e92e0574SJamie Gritton #endif 286e92e0574SJamie Gritton )]; 2870304c731SJamie Gritton struct uio opt; 2880304c731SJamie Gritton char *u_path, *u_hostname, *u_name; 289672756aaSJamie Gritton struct bool_flags *bf; 2900304c731SJamie Gritton #ifdef INET 291e92e0574SJamie Gritton uint32_t ip4s; 2920304c731SJamie Gritton struct in_addr *u_ip4; 2930304c731SJamie Gritton #endif 2940304c731SJamie Gritton #ifdef INET6 2950304c731SJamie Gritton struct in6_addr *u_ip6; 2960304c731SJamie Gritton #endif 2970304c731SJamie Gritton size_t tmplen; 298672756aaSJamie Gritton int error, enforce_statfs; 2990304c731SJamie Gritton 3000304c731SJamie Gritton bzero(&optiov, sizeof(optiov)); 3010304c731SJamie Gritton opt.uio_iov = optiov; 3020304c731SJamie Gritton opt.uio_iovcnt = 0; 3030304c731SJamie Gritton opt.uio_offset = -1; 3040304c731SJamie Gritton opt.uio_resid = -1; 3050304c731SJamie Gritton opt.uio_segflg = UIO_SYSSPACE; 3060304c731SJamie Gritton opt.uio_rw = UIO_READ; 3070304c731SJamie Gritton opt.uio_td = td; 3080304c731SJamie Gritton 3090304c731SJamie Gritton /* Set permissions for top-level jails from sysctls. */ 3100304c731SJamie Gritton if (!jailed(td->td_ucred)) { 311672756aaSJamie Gritton for (bf = pr_flag_allow; 3120e5c6bd4SJamie Gritton bf < pr_flag_allow + nitems(pr_flag_allow) && 3130e5c6bd4SJamie Gritton bf->flag != 0; 314672756aaSJamie Gritton bf++) { 315672756aaSJamie Gritton optiov[opt.uio_iovcnt].iov_base = __DECONST(char *, 316672756aaSJamie Gritton (jail_default_allow & bf->flag) 317672756aaSJamie Gritton ? bf->name : bf->noname); 3180304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = 3190304c731SJamie Gritton strlen(optiov[opt.uio_iovcnt].iov_base) + 1; 3200304c731SJamie Gritton opt.uio_iovcnt += 2; 3210304c731SJamie Gritton } 3220304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "enforce_statfs"; 3230304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("enforce_statfs"); 3240304c731SJamie Gritton opt.uio_iovcnt++; 3250304c731SJamie Gritton enforce_statfs = jail_default_enforce_statfs; 3260304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = &enforce_statfs; 3270304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof(enforce_statfs); 3280304c731SJamie Gritton opt.uio_iovcnt++; 3290304c731SJamie Gritton } 3300304c731SJamie Gritton 331b38ff370SJamie Gritton tmplen = MAXPATHLEN + MAXHOSTNAMELEN + MAXHOSTNAMELEN; 332b38ff370SJamie Gritton #ifdef INET 3330304c731SJamie Gritton ip4s = (j->version == 0) ? 1 : j->ip4s; 3340304c731SJamie Gritton if (ip4s > jail_max_af_ips) 335b38ff370SJamie Gritton return (EINVAL); 3360304c731SJamie Gritton tmplen += ip4s * sizeof(struct in_addr); 337b38ff370SJamie Gritton #else 3380304c731SJamie Gritton if (j->ip4s > 0) 339b38ff370SJamie Gritton return (EINVAL); 340b38ff370SJamie Gritton #endif 341b38ff370SJamie Gritton #ifdef INET6 3420304c731SJamie Gritton if (j->ip6s > jail_max_af_ips) 343b38ff370SJamie Gritton return (EINVAL); 3440304c731SJamie Gritton tmplen += j->ip6s * sizeof(struct in6_addr); 345b38ff370SJamie Gritton #else 3460304c731SJamie Gritton if (j->ip6s > 0) 347b38ff370SJamie Gritton return (EINVAL); 348b38ff370SJamie Gritton #endif 349b38ff370SJamie Gritton u_path = malloc(tmplen, M_TEMP, M_WAITOK); 350b38ff370SJamie Gritton u_hostname = u_path + MAXPATHLEN; 351b38ff370SJamie Gritton u_name = u_hostname + MAXHOSTNAMELEN; 352b38ff370SJamie Gritton #ifdef INET 353b38ff370SJamie Gritton u_ip4 = (struct in_addr *)(u_name + MAXHOSTNAMELEN); 354b38ff370SJamie Gritton #endif 355b38ff370SJamie Gritton #ifdef INET6 356b38ff370SJamie Gritton #ifdef INET 3570304c731SJamie Gritton u_ip6 = (struct in6_addr *)(u_ip4 + ip4s); 358b38ff370SJamie Gritton #else 359b38ff370SJamie Gritton u_ip6 = (struct in6_addr *)(u_name + MAXHOSTNAMELEN); 360b38ff370SJamie Gritton #endif 361b38ff370SJamie Gritton #endif 3620304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "path"; 3630304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("path"); 3640304c731SJamie Gritton opt.uio_iovcnt++; 3650304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = u_path; 3660304c731SJamie Gritton error = copyinstr(j->path, u_path, MAXPATHLEN, 3670304c731SJamie Gritton &optiov[opt.uio_iovcnt].iov_len); 368b38ff370SJamie Gritton if (error) { 369b38ff370SJamie Gritton free(u_path, M_TEMP); 370b38ff370SJamie Gritton return (error); 371b38ff370SJamie Gritton } 3720304c731SJamie Gritton opt.uio_iovcnt++; 3730304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "host.hostname"; 3740304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("host.hostname"); 3750304c731SJamie Gritton opt.uio_iovcnt++; 3760304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = u_hostname; 3770304c731SJamie Gritton error = copyinstr(j->hostname, u_hostname, MAXHOSTNAMELEN, 3780304c731SJamie Gritton &optiov[opt.uio_iovcnt].iov_len); 379b38ff370SJamie Gritton if (error) { 380b38ff370SJamie Gritton free(u_path, M_TEMP); 381b38ff370SJamie Gritton return (error); 382b38ff370SJamie Gritton } 3830304c731SJamie Gritton opt.uio_iovcnt++; 3840304c731SJamie Gritton if (j->jailname != NULL) { 385b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "name"; 386b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("name"); 387b38ff370SJamie Gritton opt.uio_iovcnt++; 388b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = u_name; 3890304c731SJamie Gritton error = copyinstr(j->jailname, u_name, MAXHOSTNAMELEN, 390b38ff370SJamie Gritton &optiov[opt.uio_iovcnt].iov_len); 391b38ff370SJamie Gritton if (error) { 392b38ff370SJamie Gritton free(u_path, M_TEMP); 393b38ff370SJamie Gritton return (error); 394b38ff370SJamie Gritton } 395b38ff370SJamie Gritton opt.uio_iovcnt++; 396b38ff370SJamie Gritton } 397b38ff370SJamie Gritton #ifdef INET 398b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "ip4.addr"; 399b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("ip4.addr"); 400b38ff370SJamie Gritton opt.uio_iovcnt++; 401b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = u_ip4; 4020304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = ip4s * sizeof(struct in_addr); 4030304c731SJamie Gritton if (j->version == 0) 4040304c731SJamie Gritton u_ip4->s_addr = j->ip4s; 4050304c731SJamie Gritton else { 4060304c731SJamie Gritton error = copyin(j->ip4, u_ip4, optiov[opt.uio_iovcnt].iov_len); 407b38ff370SJamie Gritton if (error) { 408b38ff370SJamie Gritton free(u_path, M_TEMP); 409b38ff370SJamie Gritton return (error); 410b38ff370SJamie Gritton } 4110304c731SJamie Gritton } 412b38ff370SJamie Gritton opt.uio_iovcnt++; 413b38ff370SJamie Gritton #endif 414b38ff370SJamie Gritton #ifdef INET6 415b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "ip6.addr"; 416b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("ip6.addr"); 417b38ff370SJamie Gritton opt.uio_iovcnt++; 418b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = u_ip6; 4190304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = j->ip6s * sizeof(struct in6_addr); 4200304c731SJamie Gritton error = copyin(j->ip6, u_ip6, optiov[opt.uio_iovcnt].iov_len); 421b38ff370SJamie Gritton if (error) { 422b38ff370SJamie Gritton free(u_path, M_TEMP); 423b38ff370SJamie Gritton return (error); 424b38ff370SJamie Gritton } 425b38ff370SJamie Gritton opt.uio_iovcnt++; 426b38ff370SJamie Gritton #endif 42702abd400SPedro F. Giffuni KASSERT(opt.uio_iovcnt <= nitems(optiov), 4280304c731SJamie Gritton ("kern_jail: too many iovecs (%d)", opt.uio_iovcnt)); 429b38ff370SJamie Gritton error = kern_jail_set(td, &opt, JAIL_CREATE | JAIL_ATTACH); 430b38ff370SJamie Gritton free(u_path, M_TEMP); 431b38ff370SJamie Gritton return (error); 432b38ff370SJamie Gritton } 433b38ff370SJamie Gritton 4340304c731SJamie Gritton 435b38ff370SJamie Gritton /* 436b38ff370SJamie Gritton * struct jail_set_args { 437b38ff370SJamie Gritton * struct iovec *iovp; 438b38ff370SJamie Gritton * unsigned int iovcnt; 439b38ff370SJamie Gritton * int flags; 440b38ff370SJamie Gritton * }; 441b38ff370SJamie Gritton */ 442b38ff370SJamie Gritton int 4438451d0ddSKip Macy sys_jail_set(struct thread *td, struct jail_set_args *uap) 444b38ff370SJamie Gritton { 445b38ff370SJamie Gritton struct uio *auio; 446b38ff370SJamie Gritton int error; 447b38ff370SJamie Gritton 448b38ff370SJamie Gritton /* Check that we have an even number of iovecs. */ 449b38ff370SJamie Gritton if (uap->iovcnt & 1) 450b38ff370SJamie Gritton return (EINVAL); 451b38ff370SJamie Gritton 452b38ff370SJamie Gritton error = copyinuio(uap->iovp, uap->iovcnt, &auio); 453b38ff370SJamie Gritton if (error) 454b38ff370SJamie Gritton return (error); 455b38ff370SJamie Gritton error = kern_jail_set(td, auio, uap->flags); 456b38ff370SJamie Gritton free(auio, M_IOV); 457b38ff370SJamie Gritton return (error); 458413628a7SBjoern A. Zeeb } 459413628a7SBjoern A. Zeeb 460413628a7SBjoern A. Zeeb int 461b38ff370SJamie Gritton kern_jail_set(struct thread *td, struct uio *optuio, int flags) 462413628a7SBjoern A. Zeeb { 463fd7a8150SMike Barcroft struct nameidata nd; 464b38ff370SJamie Gritton #ifdef INET 465b38ff370SJamie Gritton struct in_addr *ip4; 466413628a7SBjoern A. Zeeb #endif 467b38ff370SJamie Gritton #ifdef INET6 468b38ff370SJamie Gritton struct in6_addr *ip6; 469b38ff370SJamie Gritton #endif 470b38ff370SJamie Gritton struct vfsopt *opt; 471b38ff370SJamie Gritton struct vfsoptlist *opts; 47257aea6dfSBjoern A. Zeeb struct prison *pr, *deadpr, *mypr, *ppr, *tpr; 473b38ff370SJamie Gritton struct vnode *root; 474babbbb9cSJamie Gritton char *domain, *errmsg, *host, *name, *namelc, *p, *path, *uuid; 475b96bd95bSIan Lepore char *g_path, *osrelstr; 476672756aaSJamie Gritton struct bool_flags *bf; 477672756aaSJamie Gritton struct jailsys_flags *jsf; 4780304c731SJamie Gritton #if defined(INET) || defined(INET6) 47957aea6dfSBjoern A. Zeeb struct prison *tppr; 480b38ff370SJamie Gritton void *op; 4810304c731SJamie Gritton #endif 48276ca6f88SJamie Gritton unsigned long hid; 483b6f47c23SJamie Gritton size_t namelen, onamelen, pnamelen; 484cc5fd8c7SJamie Gritton int born, created, cuflags, descend, enforce; 485cc5fd8c7SJamie Gritton int error, errmsg_len, errmsg_pos; 4860cc207a6SMartin Matuska int gotchildmax, gotenforce, gothid, gotrsnum, gotslevel; 487672756aaSJamie Gritton int jid, jsys, len, level; 488b96bd95bSIan Lepore int childmax, osreldt, rsnum, slevel; 489f6e633a9SMartin Matuska int fullpath_disabled; 490d465a41dSBjoern A. Zeeb #if defined(INET) || defined(INET6) 4910304c731SJamie Gritton int ii, ij; 492413628a7SBjoern A. Zeeb #endif 493413628a7SBjoern A. Zeeb #ifdef INET 4942b0d6f81SJamie Gritton int ip4s, redo_ip4; 495413628a7SBjoern A. Zeeb #endif 496b38ff370SJamie Gritton #ifdef INET6 4972b0d6f81SJamie Gritton int ip6s, redo_ip6; 498b38ff370SJamie Gritton #endif 4996beb3bb4SKirk McKusick uint64_t pr_allow, ch_allow, pr_flags, ch_flags; 5006beb3bb4SKirk McKusick unsigned tallow; 501b38ff370SJamie Gritton char numbuf[12]; 502b38ff370SJamie Gritton 503b38ff370SJamie Gritton error = priv_check(td, PRIV_JAIL_SET); 504b38ff370SJamie Gritton if (!error && (flags & JAIL_ATTACH)) 505b38ff370SJamie Gritton error = priv_check(td, PRIV_JAIL_ATTACH); 506b38ff370SJamie Gritton if (error) 50775c13541SPoul-Henning Kamp return (error); 508b6f47c23SJamie Gritton mypr = td->td_ucred->cr_prison; 509b97457e2SJamie Gritton if ((flags & JAIL_CREATE) && mypr->pr_childmax == 0) 5100304c731SJamie Gritton return (EPERM); 511b38ff370SJamie Gritton if (flags & ~JAIL_SET_MASK) 512b38ff370SJamie Gritton return (EINVAL); 513b38ff370SJamie Gritton 514b38ff370SJamie Gritton /* 515b38ff370SJamie Gritton * Check all the parameters before committing to anything. Not all 516b38ff370SJamie Gritton * errors can be caught early, but we may as well try. Also, this 517b38ff370SJamie Gritton * takes care of some expensive stuff (path lookup) before getting 518b38ff370SJamie Gritton * the allprison lock. 519b38ff370SJamie Gritton * 520b38ff370SJamie Gritton * XXX Jails are not filesystems, and jail parameters are not mount 521b38ff370SJamie Gritton * options. But it makes more sense to re-use the vfsopt code 522b38ff370SJamie Gritton * than duplicate it under a different name. 523b38ff370SJamie Gritton */ 524b38ff370SJamie Gritton error = vfs_buildopts(optuio, &opts); 525b38ff370SJamie Gritton if (error) 526b38ff370SJamie Gritton return (error); 527b38ff370SJamie Gritton #ifdef INET 528b38ff370SJamie Gritton ip4 = NULL; 529b38ff370SJamie Gritton #endif 530b38ff370SJamie Gritton #ifdef INET6 531b38ff370SJamie Gritton ip6 = NULL; 532b38ff370SJamie Gritton #endif 5336dfe0a3dSMartin Matuska g_path = NULL; 534b38ff370SJamie Gritton 535b6f47c23SJamie Gritton cuflags = flags & (JAIL_CREATE | JAIL_UPDATE); 536b6f47c23SJamie Gritton if (!cuflags) { 537b6f47c23SJamie Gritton error = EINVAL; 538b6f47c23SJamie Gritton vfs_opterror(opts, "no valid operation (create or update)"); 539b6f47c23SJamie Gritton goto done_errmsg; 540b6f47c23SJamie Gritton } 541b6f47c23SJamie Gritton 542b38ff370SJamie Gritton error = vfs_copyopt(opts, "jid", &jid, sizeof(jid)); 543b38ff370SJamie Gritton if (error == ENOENT) 544b38ff370SJamie Gritton jid = 0; 545b38ff370SJamie Gritton else if (error != 0) 546b38ff370SJamie Gritton goto done_free; 547b38ff370SJamie Gritton 548b38ff370SJamie Gritton error = vfs_copyopt(opts, "securelevel", &slevel, sizeof(slevel)); 549b38ff370SJamie Gritton if (error == ENOENT) 550b38ff370SJamie Gritton gotslevel = 0; 551b38ff370SJamie Gritton else if (error != 0) 552b38ff370SJamie Gritton goto done_free; 553b38ff370SJamie Gritton else 554b38ff370SJamie Gritton gotslevel = 1; 555b38ff370SJamie Gritton 556b97457e2SJamie Gritton error = 557b97457e2SJamie Gritton vfs_copyopt(opts, "children.max", &childmax, sizeof(childmax)); 558b97457e2SJamie Gritton if (error == ENOENT) 559b97457e2SJamie Gritton gotchildmax = 0; 560b97457e2SJamie Gritton else if (error != 0) 561b97457e2SJamie Gritton goto done_free; 562b97457e2SJamie Gritton else 563b97457e2SJamie Gritton gotchildmax = 1; 564b97457e2SJamie Gritton 5650304c731SJamie Gritton error = vfs_copyopt(opts, "enforce_statfs", &enforce, sizeof(enforce)); 566f337198dSJamie Gritton if (error == ENOENT) 567f337198dSJamie Gritton gotenforce = 0; 568f337198dSJamie Gritton else if (error != 0) 5690304c731SJamie Gritton goto done_free; 570f337198dSJamie Gritton else if (enforce < 0 || enforce > 2) { 571f337198dSJamie Gritton error = EINVAL; 572f337198dSJamie Gritton goto done_free; 573f337198dSJamie Gritton } else 574f337198dSJamie Gritton gotenforce = 1; 5750304c731SJamie Gritton 5760cc207a6SMartin Matuska error = vfs_copyopt(opts, "devfs_ruleset", &rsnum, sizeof(rsnum)); 5770cc207a6SMartin Matuska if (error == ENOENT) 5780cc207a6SMartin Matuska gotrsnum = 0; 5790cc207a6SMartin Matuska else if (error != 0) 5800cc207a6SMartin Matuska goto done_free; 5810cc207a6SMartin Matuska else 5820cc207a6SMartin Matuska gotrsnum = 1; 5830cc207a6SMartin Matuska 584b38ff370SJamie Gritton pr_flags = ch_flags = 0; 585672756aaSJamie Gritton for (bf = pr_flag_bool; 586672756aaSJamie Gritton bf < pr_flag_bool + nitems(pr_flag_bool); 587672756aaSJamie Gritton bf++) { 588672756aaSJamie Gritton vfs_flagopt(opts, bf->name, &pr_flags, bf->flag); 589672756aaSJamie Gritton vfs_flagopt(opts, bf->noname, &ch_flags, bf->flag); 5900304c731SJamie Gritton } 591b38ff370SJamie Gritton ch_flags |= pr_flags; 592672756aaSJamie Gritton for (jsf = pr_flag_jailsys; 593672756aaSJamie Gritton jsf < pr_flag_jailsys + nitems(pr_flag_jailsys); 594672756aaSJamie Gritton jsf++) { 595672756aaSJamie Gritton error = vfs_copyopt(opts, jsf->name, &jsys, sizeof(jsys)); 5967cbf7213SJamie Gritton if (error == ENOENT) 5977cbf7213SJamie Gritton continue; 5987cbf7213SJamie Gritton if (error != 0) 5997cbf7213SJamie Gritton goto done_free; 6007cbf7213SJamie Gritton switch (jsys) { 6017cbf7213SJamie Gritton case JAIL_SYS_DISABLE: 602672756aaSJamie Gritton if (!jsf->disable) { 6037cbf7213SJamie Gritton error = EINVAL; 6047cbf7213SJamie Gritton goto done_free; 6057cbf7213SJamie Gritton } 606672756aaSJamie Gritton pr_flags |= jsf->disable; 6077cbf7213SJamie Gritton break; 6087cbf7213SJamie Gritton case JAIL_SYS_NEW: 609672756aaSJamie Gritton pr_flags |= jsf->new; 6107cbf7213SJamie Gritton break; 6117cbf7213SJamie Gritton case JAIL_SYS_INHERIT: 6127cbf7213SJamie Gritton break; 6137cbf7213SJamie Gritton default: 6147cbf7213SJamie Gritton error = EINVAL; 6157cbf7213SJamie Gritton goto done_free; 6167cbf7213SJamie Gritton } 617672756aaSJamie Gritton ch_flags |= jsf->new | jsf->disable; 6187cbf7213SJamie Gritton } 6194affa14cSJamie Gritton if ((flags & (JAIL_CREATE | JAIL_UPDATE | JAIL_ATTACH)) == JAIL_CREATE 6204affa14cSJamie Gritton && !(pr_flags & PR_PERSIST)) { 6214affa14cSJamie Gritton error = EINVAL; 6224affa14cSJamie Gritton vfs_opterror(opts, "new jail must persist or attach"); 6234affa14cSJamie Gritton goto done_errmsg; 6244affa14cSJamie Gritton } 625679e1390SJamie Gritton #ifdef VIMAGE 626679e1390SJamie Gritton if ((flags & JAIL_UPDATE) && (ch_flags & PR_VNET)) { 627679e1390SJamie Gritton error = EINVAL; 628679e1390SJamie Gritton vfs_opterror(opts, "vnet cannot be changed after creation"); 629679e1390SJamie Gritton goto done_errmsg; 630679e1390SJamie Gritton } 631679e1390SJamie Gritton #endif 6322b0d6f81SJamie Gritton #ifdef INET 6332b0d6f81SJamie Gritton if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP4_USER)) { 6342b0d6f81SJamie Gritton error = EINVAL; 6352b0d6f81SJamie Gritton vfs_opterror(opts, "ip4 cannot be changed after creation"); 6362b0d6f81SJamie Gritton goto done_errmsg; 6372b0d6f81SJamie Gritton } 6382b0d6f81SJamie Gritton #endif 6392b0d6f81SJamie Gritton #ifdef INET6 6402b0d6f81SJamie Gritton if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP6_USER)) { 6412b0d6f81SJamie Gritton error = EINVAL; 6422b0d6f81SJamie Gritton vfs_opterror(opts, "ip6 cannot be changed after creation"); 6432b0d6f81SJamie Gritton goto done_errmsg; 6442b0d6f81SJamie Gritton } 6452b0d6f81SJamie Gritton #endif 646b38ff370SJamie Gritton 6470304c731SJamie Gritton pr_allow = ch_allow = 0; 648672756aaSJamie Gritton for (bf = pr_flag_allow; 6490e5c6bd4SJamie Gritton bf < pr_flag_allow + nitems(pr_flag_allow) && bf->flag != 0; 650672756aaSJamie Gritton bf++) { 651672756aaSJamie Gritton vfs_flagopt(opts, bf->name, &pr_allow, bf->flag); 652672756aaSJamie Gritton vfs_flagopt(opts, bf->noname, &ch_allow, bf->flag); 6530304c731SJamie Gritton } 6540304c731SJamie Gritton ch_allow |= pr_allow; 6550304c731SJamie Gritton 656b38ff370SJamie Gritton error = vfs_getopt(opts, "name", (void **)&name, &len); 657b38ff370SJamie Gritton if (error == ENOENT) 658b38ff370SJamie Gritton name = NULL; 659b38ff370SJamie Gritton else if (error != 0) 660b38ff370SJamie Gritton goto done_free; 661b38ff370SJamie Gritton else { 662b38ff370SJamie Gritton if (len == 0 || name[len - 1] != '\0') { 663b38ff370SJamie Gritton error = EINVAL; 664b38ff370SJamie Gritton goto done_free; 665b38ff370SJamie Gritton } 666b38ff370SJamie Gritton if (len > MAXHOSTNAMELEN) { 667b38ff370SJamie Gritton error = ENAMETOOLONG; 668b38ff370SJamie Gritton goto done_free; 669b38ff370SJamie Gritton } 670b38ff370SJamie Gritton } 671b38ff370SJamie Gritton 672b38ff370SJamie Gritton error = vfs_getopt(opts, "host.hostname", (void **)&host, &len); 673b38ff370SJamie Gritton if (error == ENOENT) 674b38ff370SJamie Gritton host = NULL; 675b38ff370SJamie Gritton else if (error != 0) 676b38ff370SJamie Gritton goto done_free; 677b38ff370SJamie Gritton else { 67876ca6f88SJamie Gritton ch_flags |= PR_HOST; 67976ca6f88SJamie Gritton pr_flags |= PR_HOST; 680b38ff370SJamie Gritton if (len == 0 || host[len - 1] != '\0') { 681b38ff370SJamie Gritton error = EINVAL; 682b38ff370SJamie Gritton goto done_free; 683b38ff370SJamie Gritton } 684b38ff370SJamie Gritton if (len > MAXHOSTNAMELEN) { 685b38ff370SJamie Gritton error = ENAMETOOLONG; 686b38ff370SJamie Gritton goto done_free; 687b38ff370SJamie Gritton } 688b38ff370SJamie Gritton } 689b38ff370SJamie Gritton 69076ca6f88SJamie Gritton error = vfs_getopt(opts, "host.domainname", (void **)&domain, &len); 69176ca6f88SJamie Gritton if (error == ENOENT) 69276ca6f88SJamie Gritton domain = NULL; 69376ca6f88SJamie Gritton else if (error != 0) 69476ca6f88SJamie Gritton goto done_free; 69576ca6f88SJamie Gritton else { 69676ca6f88SJamie Gritton ch_flags |= PR_HOST; 69776ca6f88SJamie Gritton pr_flags |= PR_HOST; 69876ca6f88SJamie Gritton if (len == 0 || domain[len - 1] != '\0') { 69976ca6f88SJamie Gritton error = EINVAL; 70076ca6f88SJamie Gritton goto done_free; 70176ca6f88SJamie Gritton } 70276ca6f88SJamie Gritton if (len > MAXHOSTNAMELEN) { 70376ca6f88SJamie Gritton error = ENAMETOOLONG; 70476ca6f88SJamie Gritton goto done_free; 70576ca6f88SJamie Gritton } 70676ca6f88SJamie Gritton } 70776ca6f88SJamie Gritton 70876ca6f88SJamie Gritton error = vfs_getopt(opts, "host.hostuuid", (void **)&uuid, &len); 70976ca6f88SJamie Gritton if (error == ENOENT) 71076ca6f88SJamie Gritton uuid = NULL; 71176ca6f88SJamie Gritton else if (error != 0) 71276ca6f88SJamie Gritton goto done_free; 71376ca6f88SJamie Gritton else { 71476ca6f88SJamie Gritton ch_flags |= PR_HOST; 71576ca6f88SJamie Gritton pr_flags |= PR_HOST; 71676ca6f88SJamie Gritton if (len == 0 || uuid[len - 1] != '\0') { 71776ca6f88SJamie Gritton error = EINVAL; 71876ca6f88SJamie Gritton goto done_free; 71976ca6f88SJamie Gritton } 72076ca6f88SJamie Gritton if (len > HOSTUUIDLEN) { 72176ca6f88SJamie Gritton error = ENAMETOOLONG; 72276ca6f88SJamie Gritton goto done_free; 72376ca6f88SJamie Gritton } 72476ca6f88SJamie Gritton } 72576ca6f88SJamie Gritton 726841c0c7eSNathan Whitehorn #ifdef COMPAT_FREEBSD32 727a5c1afadSDmitry Chagin if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) { 72876ca6f88SJamie Gritton uint32_t hid32; 72976ca6f88SJamie Gritton 73076ca6f88SJamie Gritton error = vfs_copyopt(opts, "host.hostid", &hid32, sizeof(hid32)); 73176ca6f88SJamie Gritton hid = hid32; 73276ca6f88SJamie Gritton } else 73376ca6f88SJamie Gritton #endif 73476ca6f88SJamie Gritton error = vfs_copyopt(opts, "host.hostid", &hid, sizeof(hid)); 73576ca6f88SJamie Gritton if (error == ENOENT) 73676ca6f88SJamie Gritton gothid = 0; 73776ca6f88SJamie Gritton else if (error != 0) 73876ca6f88SJamie Gritton goto done_free; 73976ca6f88SJamie Gritton else { 74076ca6f88SJamie Gritton gothid = 1; 74176ca6f88SJamie Gritton ch_flags |= PR_HOST; 74276ca6f88SJamie Gritton pr_flags |= PR_HOST; 74376ca6f88SJamie Gritton } 74476ca6f88SJamie Gritton 745b38ff370SJamie Gritton #ifdef INET 746b38ff370SJamie Gritton error = vfs_getopt(opts, "ip4.addr", &op, &ip4s); 747b38ff370SJamie Gritton if (error == ENOENT) 7480e5e396eSJamie Gritton ip4s = 0; 749b38ff370SJamie Gritton else if (error != 0) 750b38ff370SJamie Gritton goto done_free; 751b38ff370SJamie Gritton else if (ip4s & (sizeof(*ip4) - 1)) { 752b38ff370SJamie Gritton error = EINVAL; 753b38ff370SJamie Gritton goto done_free; 7540304c731SJamie Gritton } else { 7556a3f2779SJamie Gritton ch_flags |= PR_IP4_USER; 7566a3f2779SJamie Gritton pr_flags |= PR_IP4_USER; 7576a3f2779SJamie Gritton if (ip4s > 0) { 758b38ff370SJamie Gritton ip4s /= sizeof(*ip4); 759b38ff370SJamie Gritton if (ip4s > jail_max_af_ips) { 760b38ff370SJamie Gritton error = EINVAL; 761b38ff370SJamie Gritton vfs_opterror(opts, "too many IPv4 addresses"); 762b38ff370SJamie Gritton goto done_errmsg; 763b38ff370SJamie Gritton } 7642b0d6f81SJamie Gritton ip4 = malloc(ip4s * sizeof(*ip4), M_PRISON, M_WAITOK); 765b38ff370SJamie Gritton bcopy(op, ip4, ip4s * sizeof(*ip4)); 766b38ff370SJamie Gritton /* 7670304c731SJamie Gritton * IP addresses are all sorted but ip[0] to preserve 7680304c731SJamie Gritton * the primary IP address as given from userland. 7690304c731SJamie Gritton * This special IP is used for unbound outgoing 770bef916f9SBjoern A. Zeeb * connections as well for "loopback" traffic in case 771bef916f9SBjoern A. Zeeb * source address selection cannot find any more fitting 772bef916f9SBjoern A. Zeeb * address to connect from. 773b38ff370SJamie Gritton */ 774b38ff370SJamie Gritton if (ip4s > 1) 7750ce1624dSStephen J. Kiernan qsort(ip4 + 1, ip4s - 1, sizeof(*ip4), 7760ce1624dSStephen J. Kiernan prison_qcmp_v4); 777b38ff370SJamie Gritton /* 7780304c731SJamie Gritton * Check for duplicate addresses and do some simple 7790304c731SJamie Gritton * zero and broadcast checks. If users give other bogus 7800304c731SJamie Gritton * addresses it is their problem. 781b38ff370SJamie Gritton * 7820304c731SJamie Gritton * We do not have to care about byte order for these 7830304c731SJamie Gritton * checks so we will do them in NBO. 784b38ff370SJamie Gritton */ 785b38ff370SJamie Gritton for (ii = 0; ii < ip4s; ii++) { 786b38ff370SJamie Gritton if (ip4[ii].s_addr == INADDR_ANY || 787b38ff370SJamie Gritton ip4[ii].s_addr == INADDR_BROADCAST) { 788b38ff370SJamie Gritton error = EINVAL; 789b38ff370SJamie Gritton goto done_free; 790b38ff370SJamie Gritton } 791b38ff370SJamie Gritton if ((ii+1) < ip4s && 792b38ff370SJamie Gritton (ip4[0].s_addr == ip4[ii+1].s_addr || 793b38ff370SJamie Gritton ip4[ii].s_addr == ip4[ii+1].s_addr)) { 794b38ff370SJamie Gritton error = EINVAL; 795b38ff370SJamie Gritton goto done_free; 796b38ff370SJamie Gritton } 797b38ff370SJamie Gritton } 798b38ff370SJamie Gritton } 7990304c731SJamie Gritton } 800b38ff370SJamie Gritton #endif 801b38ff370SJamie Gritton 802b38ff370SJamie Gritton #ifdef INET6 803b38ff370SJamie Gritton error = vfs_getopt(opts, "ip6.addr", &op, &ip6s); 804b38ff370SJamie Gritton if (error == ENOENT) 8050e5e396eSJamie Gritton ip6s = 0; 806b38ff370SJamie Gritton else if (error != 0) 807b38ff370SJamie Gritton goto done_free; 808b38ff370SJamie Gritton else if (ip6s & (sizeof(*ip6) - 1)) { 809b38ff370SJamie Gritton error = EINVAL; 810b38ff370SJamie Gritton goto done_free; 8110304c731SJamie Gritton } else { 8126a3f2779SJamie Gritton ch_flags |= PR_IP6_USER; 8136a3f2779SJamie Gritton pr_flags |= PR_IP6_USER; 8146a3f2779SJamie Gritton if (ip6s > 0) { 815b38ff370SJamie Gritton ip6s /= sizeof(*ip6); 816b38ff370SJamie Gritton if (ip6s > jail_max_af_ips) { 817b38ff370SJamie Gritton error = EINVAL; 818b38ff370SJamie Gritton vfs_opterror(opts, "too many IPv6 addresses"); 819b38ff370SJamie Gritton goto done_errmsg; 820b38ff370SJamie Gritton } 8212b0d6f81SJamie Gritton ip6 = malloc(ip6s * sizeof(*ip6), M_PRISON, M_WAITOK); 822b38ff370SJamie Gritton bcopy(op, ip6, ip6s * sizeof(*ip6)); 823b38ff370SJamie Gritton if (ip6s > 1) 8240ce1624dSStephen J. Kiernan qsort(ip6 + 1, ip6s - 1, sizeof(*ip6), 8250ce1624dSStephen J. Kiernan prison_qcmp_v6); 826b38ff370SJamie Gritton for (ii = 0; ii < ip6s; ii++) { 8270304c731SJamie Gritton if (IN6_IS_ADDR_UNSPECIFIED(&ip6[ii])) { 828b38ff370SJamie Gritton error = EINVAL; 829b38ff370SJamie Gritton goto done_free; 830b38ff370SJamie Gritton } 831b38ff370SJamie Gritton if ((ii+1) < ip6s && 832b38ff370SJamie Gritton (IN6_ARE_ADDR_EQUAL(&ip6[0], &ip6[ii+1]) || 833b38ff370SJamie Gritton IN6_ARE_ADDR_EQUAL(&ip6[ii], &ip6[ii+1]))) 834b38ff370SJamie Gritton { 835b38ff370SJamie Gritton error = EINVAL; 836b38ff370SJamie Gritton goto done_free; 837b38ff370SJamie Gritton } 838b38ff370SJamie Gritton } 839b38ff370SJamie Gritton } 8400304c731SJamie Gritton } 841b38ff370SJamie Gritton #endif 842b38ff370SJamie Gritton 843bdfc8cc4SJamie Gritton #if defined(VIMAGE) && (defined(INET) || defined(INET6)) 844bdfc8cc4SJamie Gritton if ((ch_flags & PR_VNET) && (ch_flags & (PR_IP4_USER | PR_IP6_USER))) { 845bdfc8cc4SJamie Gritton error = EINVAL; 846bdfc8cc4SJamie Gritton vfs_opterror(opts, 847bdfc8cc4SJamie Gritton "vnet jails cannot have IP address restrictions"); 848bdfc8cc4SJamie Gritton goto done_errmsg; 849bdfc8cc4SJamie Gritton } 850bdfc8cc4SJamie Gritton #endif 851bdfc8cc4SJamie Gritton 852cf0313c6SJamie Gritton error = vfs_getopt(opts, "osrelease", (void **)&osrelstr, &len); 853cf0313c6SJamie Gritton if (error == ENOENT) 854cf0313c6SJamie Gritton osrelstr = NULL; 855cf0313c6SJamie Gritton else if (error != 0) 856cf0313c6SJamie Gritton goto done_free; 857cf0313c6SJamie Gritton else { 858cf0313c6SJamie Gritton if (flags & JAIL_UPDATE) { 859cf0313c6SJamie Gritton error = EINVAL; 860cf0313c6SJamie Gritton vfs_opterror(opts, 861cf0313c6SJamie Gritton "osrelease cannot be changed after creation"); 862cf0313c6SJamie Gritton goto done_errmsg; 863cf0313c6SJamie Gritton } 864cf0313c6SJamie Gritton if (len == 0 || len >= OSRELEASELEN) { 865cf0313c6SJamie Gritton error = EINVAL; 866cf0313c6SJamie Gritton vfs_opterror(opts, 867cf0313c6SJamie Gritton "osrelease string must be 1-%d bytes long", 868cf0313c6SJamie Gritton OSRELEASELEN - 1); 869cf0313c6SJamie Gritton goto done_errmsg; 870cf0313c6SJamie Gritton } 871cf0313c6SJamie Gritton } 872cf0313c6SJamie Gritton 873cf0313c6SJamie Gritton error = vfs_copyopt(opts, "osreldate", &osreldt, sizeof(osreldt)); 874cf0313c6SJamie Gritton if (error == ENOENT) 875cf0313c6SJamie Gritton osreldt = 0; 876cf0313c6SJamie Gritton else if (error != 0) 877cf0313c6SJamie Gritton goto done_free; 878cf0313c6SJamie Gritton else { 879cf0313c6SJamie Gritton if (flags & JAIL_UPDATE) { 880cf0313c6SJamie Gritton error = EINVAL; 881cf0313c6SJamie Gritton vfs_opterror(opts, 882cf0313c6SJamie Gritton "osreldate cannot be changed after creation"); 883cf0313c6SJamie Gritton goto done_errmsg; 884cf0313c6SJamie Gritton } 885cf0313c6SJamie Gritton if (osreldt == 0) { 886cf0313c6SJamie Gritton error = EINVAL; 887cf0313c6SJamie Gritton vfs_opterror(opts, "osreldate cannot be 0"); 888cf0313c6SJamie Gritton goto done_errmsg; 889cf0313c6SJamie Gritton } 890cf0313c6SJamie Gritton } 891cf0313c6SJamie Gritton 8929cbe30e1SMartin Matuska fullpath_disabled = 0; 893b38ff370SJamie Gritton root = NULL; 894b38ff370SJamie Gritton error = vfs_getopt(opts, "path", (void **)&path, &len); 895b38ff370SJamie Gritton if (error == ENOENT) 896b38ff370SJamie Gritton path = NULL; 897b38ff370SJamie Gritton else if (error != 0) 898b38ff370SJamie Gritton goto done_free; 899b38ff370SJamie Gritton else { 900b38ff370SJamie Gritton if (flags & JAIL_UPDATE) { 901b38ff370SJamie Gritton error = EINVAL; 902b38ff370SJamie Gritton vfs_opterror(opts, 903b38ff370SJamie Gritton "path cannot be changed after creation"); 904b38ff370SJamie Gritton goto done_errmsg; 905b38ff370SJamie Gritton } 906b38ff370SJamie Gritton if (len == 0 || path[len - 1] != '\0') { 907b38ff370SJamie Gritton error = EINVAL; 908b38ff370SJamie Gritton goto done_free; 909b38ff370SJamie Gritton } 9105050aa86SKonstantin Belousov NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE, 911b38ff370SJamie Gritton path, td); 912b38ff370SJamie Gritton error = namei(&nd); 913b38ff370SJamie Gritton if (error) 914b38ff370SJamie Gritton goto done_free; 915b38ff370SJamie Gritton root = nd.ni_vp; 916b38ff370SJamie Gritton NDFREE(&nd, NDF_ONLY_PNBUF); 9176dfe0a3dSMartin Matuska g_path = malloc(MAXPATHLEN, M_TEMP, M_WAITOK); 9186dfe0a3dSMartin Matuska strlcpy(g_path, path, MAXPATHLEN); 9196dfe0a3dSMartin Matuska error = vn_path_to_global_path(td, root, g_path, MAXPATHLEN); 9206dfe0a3dSMartin Matuska if (error == 0) 9216dfe0a3dSMartin Matuska path = g_path; 9226dfe0a3dSMartin Matuska else if (error == ENODEV) { 923f6e633a9SMartin Matuska /* proceed if sysctl debug.disablefullpath == 1 */ 924f6e633a9SMartin Matuska fullpath_disabled = 1; 925f6e633a9SMartin Matuska if (len < 2 || (len == 2 && path[0] == '/')) 926f6e633a9SMartin Matuska path = NULL; 9276dfe0a3dSMartin Matuska } else { 928f6e633a9SMartin Matuska /* exit on other errors */ 929b38ff370SJamie Gritton goto done_free; 930b38ff370SJamie Gritton } 931f6e633a9SMartin Matuska if (root->v_type != VDIR) { 932f6e633a9SMartin Matuska error = ENOTDIR; 933f6e633a9SMartin Matuska vput(root); 934f6e633a9SMartin Matuska goto done_free; 935f6e633a9SMartin Matuska } 936f6e633a9SMartin Matuska VOP_UNLOCK(root, 0); 937f6e633a9SMartin Matuska if (fullpath_disabled) { 938f6e633a9SMartin Matuska /* Leave room for a real-root full pathname. */ 939f6e633a9SMartin Matuska if (len + (path[0] == '/' && strcmp(mypr->pr_path, "/") 940f6e633a9SMartin Matuska ? strlen(mypr->pr_path) : 0) > MAXPATHLEN) { 941f6e633a9SMartin Matuska error = ENAMETOOLONG; 942932a6e43SJamie Gritton vrele(root); 943f6e633a9SMartin Matuska goto done_free; 944f6e633a9SMartin Matuska } 945b38ff370SJamie Gritton } 946b38ff370SJamie Gritton } 947b38ff370SJamie Gritton 948b38ff370SJamie Gritton /* 949b6f47c23SJamie Gritton * Find the specified jail, or at least its parent. 950b38ff370SJamie Gritton * This abuses the file error codes ENOENT and EEXIST. 951b38ff370SJamie Gritton */ 952b38ff370SJamie Gritton pr = NULL; 953b6f47c23SJamie Gritton ppr = mypr; 954babbbb9cSJamie Gritton if (cuflags == JAIL_CREATE && jid == 0 && name != NULL) { 955babbbb9cSJamie Gritton namelc = strrchr(name, '.'); 956babbbb9cSJamie Gritton jid = strtoul(namelc != NULL ? namelc + 1 : name, &p, 10); 957babbbb9cSJamie Gritton if (*p != '\0') 958babbbb9cSJamie Gritton jid = 0; 959babbbb9cSJamie Gritton } 960b6f47c23SJamie Gritton sx_xlock(&allprison_lock); 961b38ff370SJamie Gritton if (jid != 0) { 9620304c731SJamie Gritton /* 9630304c731SJamie Gritton * See if a requested jid already exists. There is an 9640304c731SJamie Gritton * information leak here if the jid exists but is not within 9650304c731SJamie Gritton * the caller's jail hierarchy. Jail creators will get EEXIST 9660304c731SJamie Gritton * even though they cannot see the jail, and CREATE | UPDATE 9670304c731SJamie Gritton * will return ENOENT which is not normally a valid error. 9680304c731SJamie Gritton */ 969b38ff370SJamie Gritton if (jid < 0) { 970b38ff370SJamie Gritton error = EINVAL; 971b38ff370SJamie Gritton vfs_opterror(opts, "negative jid"); 972b38ff370SJamie Gritton goto done_unlock_list; 973b38ff370SJamie Gritton } 974b38ff370SJamie Gritton pr = prison_find(jid); 975b38ff370SJamie Gritton if (pr != NULL) { 9760304c731SJamie Gritton ppr = pr->pr_parent; 977b38ff370SJamie Gritton /* Create: jid must not exist. */ 978b38ff370SJamie Gritton if (cuflags == JAIL_CREATE) { 979b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 980b38ff370SJamie Gritton error = EEXIST; 981b38ff370SJamie Gritton vfs_opterror(opts, "jail %d already exists", 982b38ff370SJamie Gritton jid); 983b38ff370SJamie Gritton goto done_unlock_list; 984b38ff370SJamie Gritton } 9850304c731SJamie Gritton if (!prison_ischild(mypr, pr)) { 9860304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 9870304c731SJamie Gritton pr = NULL; 9880304c731SJamie Gritton } else if (pr->pr_uref == 0) { 989b38ff370SJamie Gritton if (!(flags & JAIL_DYING)) { 990b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 991b38ff370SJamie Gritton error = ENOENT; 992b38ff370SJamie Gritton vfs_opterror(opts, "jail %d is dying", 993b38ff370SJamie Gritton jid); 994b38ff370SJamie Gritton goto done_unlock_list; 995b38ff370SJamie Gritton } else if ((flags & JAIL_ATTACH) || 996b38ff370SJamie Gritton (pr_flags & PR_PERSIST)) { 997b38ff370SJamie Gritton /* 998b38ff370SJamie Gritton * A dying jail might be resurrected 999b38ff370SJamie Gritton * (via attach or persist), but first 1000b38ff370SJamie Gritton * it must determine if another jail 1001b38ff370SJamie Gritton * has claimed its name. Accomplish 1002b38ff370SJamie Gritton * this by implicitly re-setting the 1003b38ff370SJamie Gritton * name. 1004b38ff370SJamie Gritton */ 1005b38ff370SJamie Gritton if (name == NULL) 10060304c731SJamie Gritton name = prison_name(mypr, pr); 1007b38ff370SJamie Gritton } 1008b38ff370SJamie Gritton } 1009b38ff370SJamie Gritton } 1010b38ff370SJamie Gritton if (pr == NULL) { 1011b38ff370SJamie Gritton /* Update: jid must exist. */ 1012b38ff370SJamie Gritton if (cuflags == JAIL_UPDATE) { 1013b38ff370SJamie Gritton error = ENOENT; 1014b38ff370SJamie Gritton vfs_opterror(opts, "jail %d not found", jid); 1015b38ff370SJamie Gritton goto done_unlock_list; 1016b38ff370SJamie Gritton } 1017b38ff370SJamie Gritton } 1018b38ff370SJamie Gritton } 1019b38ff370SJamie Gritton /* 1020b38ff370SJamie Gritton * If the caller provided a name, look for a jail by that name. 1021b38ff370SJamie Gritton * This has different semantics for creates and updates keyed by jid 1022b38ff370SJamie Gritton * (where the name must not already exist in a different jail), 1023b38ff370SJamie Gritton * and updates keyed by the name itself (where the name must exist 1024b38ff370SJamie Gritton * because that is the jail being updated). 1025b38ff370SJamie Gritton */ 1026b6f47c23SJamie Gritton namelc = NULL; 1027b38ff370SJamie Gritton if (name != NULL) { 1028babbbb9cSJamie Gritton namelc = strrchr(name, '.'); 1029babbbb9cSJamie Gritton if (namelc == NULL) 1030babbbb9cSJamie Gritton namelc = name; 1031babbbb9cSJamie Gritton else { 10320304c731SJamie Gritton /* 10330304c731SJamie Gritton * This is a hierarchical name. Split it into the 10340304c731SJamie Gritton * parent and child names, and make sure the parent 10350304c731SJamie Gritton * exists or matches an already found jail. 10360304c731SJamie Gritton */ 10370304c731SJamie Gritton if (pr != NULL) { 1038babbbb9cSJamie Gritton if (strncmp(name, ppr->pr_name, namelc - name) 1039babbbb9cSJamie Gritton || ppr->pr_name[namelc - name] != '\0') { 10400304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 10410304c731SJamie Gritton error = EINVAL; 10420304c731SJamie Gritton vfs_opterror(opts, 10430304c731SJamie Gritton "cannot change jail's parent"); 10440304c731SJamie Gritton goto done_unlock_list; 10450304c731SJamie Gritton } 10460304c731SJamie Gritton } else { 1047b6f47c23SJamie Gritton *namelc = '\0'; 10480304c731SJamie Gritton ppr = prison_find_name(mypr, name); 10490304c731SJamie Gritton if (ppr == NULL) { 10500304c731SJamie Gritton error = ENOENT; 10510304c731SJamie Gritton vfs_opterror(opts, 10520304c731SJamie Gritton "jail \"%s\" not found", name); 10530304c731SJamie Gritton goto done_unlock_list; 10540304c731SJamie Gritton } 10550304c731SJamie Gritton mtx_unlock(&ppr->pr_mtx); 1056b6f47c23SJamie Gritton *namelc = '.'; 10570304c731SJamie Gritton } 1058b6f47c23SJamie Gritton namelc++; 10590304c731SJamie Gritton } 1060b6f47c23SJamie Gritton if (namelc[0] != '\0') { 1061b6f47c23SJamie Gritton pnamelen = 10620304c731SJamie Gritton (ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1; 1063b38ff370SJamie Gritton name_again: 10640304c731SJamie Gritton deadpr = NULL; 10650304c731SJamie Gritton FOREACH_PRISON_CHILD(ppr, tpr) { 1066b38ff370SJamie Gritton if (tpr != pr && tpr->pr_ref > 0 && 1067b6f47c23SJamie Gritton !strcmp(tpr->pr_name + pnamelen, namelc)) { 1068b38ff370SJamie Gritton if (pr == NULL && 1069b38ff370SJamie Gritton cuflags != JAIL_CREATE) { 1070b38ff370SJamie Gritton mtx_lock(&tpr->pr_mtx); 1071b38ff370SJamie Gritton if (tpr->pr_ref > 0) { 1072b38ff370SJamie Gritton /* 1073b38ff370SJamie Gritton * Use this jail 1074b38ff370SJamie Gritton * for updates. 1075b38ff370SJamie Gritton */ 1076b38ff370SJamie Gritton if (tpr->pr_uref > 0) { 1077b38ff370SJamie Gritton pr = tpr; 1078b38ff370SJamie Gritton break; 1079b38ff370SJamie Gritton } 1080b38ff370SJamie Gritton deadpr = tpr; 1081b38ff370SJamie Gritton } 1082b38ff370SJamie Gritton mtx_unlock(&tpr->pr_mtx); 1083b38ff370SJamie Gritton } else if (tpr->pr_uref > 0) { 1084b38ff370SJamie Gritton /* 1085b38ff370SJamie Gritton * Create, or update(jid): 1086b38ff370SJamie Gritton * name must not exist in an 10870304c731SJamie Gritton * active sibling jail. 1088b38ff370SJamie Gritton */ 1089b38ff370SJamie Gritton error = EEXIST; 1090b38ff370SJamie Gritton if (pr != NULL) 1091b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 1092b38ff370SJamie Gritton vfs_opterror(opts, 1093b38ff370SJamie Gritton "jail \"%s\" already exists", 1094b38ff370SJamie Gritton name); 1095b38ff370SJamie Gritton goto done_unlock_list; 1096b38ff370SJamie Gritton } 1097b38ff370SJamie Gritton } 1098b38ff370SJamie Gritton } 1099b38ff370SJamie Gritton /* If no active jail is found, use a dying one. */ 1100b38ff370SJamie Gritton if (deadpr != NULL && pr == NULL) { 1101b38ff370SJamie Gritton if (flags & JAIL_DYING) { 1102b38ff370SJamie Gritton mtx_lock(&deadpr->pr_mtx); 1103b38ff370SJamie Gritton if (deadpr->pr_ref == 0) { 1104b38ff370SJamie Gritton mtx_unlock(&deadpr->pr_mtx); 1105b38ff370SJamie Gritton goto name_again; 1106b38ff370SJamie Gritton } 1107b38ff370SJamie Gritton pr = deadpr; 1108b38ff370SJamie Gritton } else if (cuflags == JAIL_UPDATE) { 1109b38ff370SJamie Gritton error = ENOENT; 1110b38ff370SJamie Gritton vfs_opterror(opts, 1111b38ff370SJamie Gritton "jail \"%s\" is dying", name); 1112b38ff370SJamie Gritton goto done_unlock_list; 1113b38ff370SJamie Gritton } 1114b38ff370SJamie Gritton } 1115b38ff370SJamie Gritton /* Update: name must exist if no jid. */ 1116b38ff370SJamie Gritton else if (cuflags == JAIL_UPDATE && pr == NULL) { 1117b38ff370SJamie Gritton error = ENOENT; 1118b38ff370SJamie Gritton vfs_opterror(opts, "jail \"%s\" not found", 1119b38ff370SJamie Gritton name); 1120b38ff370SJamie Gritton goto done_unlock_list; 1121b38ff370SJamie Gritton } 1122b38ff370SJamie Gritton } 1123b38ff370SJamie Gritton } 1124b38ff370SJamie Gritton /* Update: must provide a jid or name. */ 1125b38ff370SJamie Gritton else if (cuflags == JAIL_UPDATE && pr == NULL) { 1126b38ff370SJamie Gritton error = ENOENT; 1127b38ff370SJamie Gritton vfs_opterror(opts, "update specified no jail"); 1128b38ff370SJamie Gritton goto done_unlock_list; 1129b38ff370SJamie Gritton } 1130b38ff370SJamie Gritton 1131b38ff370SJamie Gritton /* If there's no prison to update, create a new one and link it in. */ 1132b38ff370SJamie Gritton if (pr == NULL) { 1133b97457e2SJamie Gritton for (tpr = mypr; tpr != NULL; tpr = tpr->pr_parent) 1134b97457e2SJamie Gritton if (tpr->pr_childcount >= tpr->pr_childmax) { 1135b97457e2SJamie Gritton error = EPERM; 1136b97457e2SJamie Gritton vfs_opterror(opts, "prison limit exceeded"); 1137b97457e2SJamie Gritton goto done_unlock_list; 1138b97457e2SJamie Gritton } 1139b38ff370SJamie Gritton created = 1; 11400304c731SJamie Gritton mtx_lock(&ppr->pr_mtx); 11412a549507SJamie Gritton if (ppr->pr_ref == 0) { 11420304c731SJamie Gritton mtx_unlock(&ppr->pr_mtx); 11430304c731SJamie Gritton error = ENOENT; 1144b6f47c23SJamie Gritton vfs_opterror(opts, "jail \"%s\" not found", 1145b6f47c23SJamie Gritton prison_name(mypr, ppr)); 11460304c731SJamie Gritton goto done_unlock_list; 11470304c731SJamie Gritton } 11480304c731SJamie Gritton ppr->pr_ref++; 11490304c731SJamie Gritton ppr->pr_uref++; 11500304c731SJamie Gritton mtx_unlock(&ppr->pr_mtx); 1151b38ff370SJamie Gritton pr = malloc(sizeof(*pr), M_PRISON, M_WAITOK | M_ZERO); 1152b38ff370SJamie Gritton if (jid == 0) { 1153b38ff370SJamie Gritton /* Find the next free jid. */ 1154b38ff370SJamie Gritton jid = lastprid + 1; 1155b38ff370SJamie Gritton findnext: 1156b38ff370SJamie Gritton if (jid == JAIL_MAX) 1157b38ff370SJamie Gritton jid = 1; 1158b38ff370SJamie Gritton TAILQ_FOREACH(tpr, &allprison, pr_list) { 1159b38ff370SJamie Gritton if (tpr->pr_id < jid) 1160b38ff370SJamie Gritton continue; 1161b38ff370SJamie Gritton if (tpr->pr_id > jid || tpr->pr_ref == 0) { 1162b38ff370SJamie Gritton TAILQ_INSERT_BEFORE(tpr, pr, pr_list); 1163b38ff370SJamie Gritton break; 1164b38ff370SJamie Gritton } 1165b38ff370SJamie Gritton if (jid == lastprid) { 1166b38ff370SJamie Gritton error = EAGAIN; 1167b38ff370SJamie Gritton vfs_opterror(opts, 1168b38ff370SJamie Gritton "no available jail IDs"); 1169b38ff370SJamie Gritton free(pr, M_PRISON); 11700304c731SJamie Gritton prison_deref(ppr, PD_DEREF | 11710304c731SJamie Gritton PD_DEUREF | PD_LIST_XLOCKED); 11720304c731SJamie Gritton goto done_releroot; 1173b38ff370SJamie Gritton } 1174b38ff370SJamie Gritton jid++; 1175b38ff370SJamie Gritton goto findnext; 1176b38ff370SJamie Gritton } 1177b38ff370SJamie Gritton lastprid = jid; 1178b38ff370SJamie Gritton } else { 1179b38ff370SJamie Gritton /* 1180b38ff370SJamie Gritton * The jail already has a jid (that did not yet exist), 1181b38ff370SJamie Gritton * so just find where to insert it. 1182b38ff370SJamie Gritton */ 1183b38ff370SJamie Gritton TAILQ_FOREACH(tpr, &allprison, pr_list) 1184b38ff370SJamie Gritton if (tpr->pr_id >= jid) { 1185b38ff370SJamie Gritton TAILQ_INSERT_BEFORE(tpr, pr, pr_list); 1186b38ff370SJamie Gritton break; 1187b38ff370SJamie Gritton } 1188b38ff370SJamie Gritton } 1189b38ff370SJamie Gritton if (tpr == NULL) 1190b38ff370SJamie Gritton TAILQ_INSERT_TAIL(&allprison, pr, pr_list); 11910304c731SJamie Gritton LIST_INSERT_HEAD(&ppr->pr_children, pr, pr_sibling); 11920304c731SJamie Gritton for (tpr = ppr; tpr != NULL; tpr = tpr->pr_parent) 1193b97457e2SJamie Gritton tpr->pr_childcount++; 1194b38ff370SJamie Gritton 11950304c731SJamie Gritton pr->pr_parent = ppr; 1196b38ff370SJamie Gritton pr->pr_id = jid; 11970304c731SJamie Gritton 11980304c731SJamie Gritton /* Set some default values, and inherit some from the parent. */ 1199b6f47c23SJamie Gritton if (namelc == NULL) 1200b6f47c23SJamie Gritton namelc = ""; 1201b38ff370SJamie Gritton if (path == NULL) { 1202b38ff370SJamie Gritton path = "/"; 12030304c731SJamie Gritton root = mypr->pr_root; 1204b38ff370SJamie Gritton vref(root); 1205b38ff370SJamie Gritton } 12068986e3a0SJamie Gritton strlcpy(pr->pr_hostuuid, DEFAULT_HOSTUUID, HOSTUUIDLEN); 12078986e3a0SJamie Gritton pr->pr_flags |= PR_HOST; 1208bdfc8cc4SJamie Gritton #if defined(INET) || defined(INET6) 1209bdfc8cc4SJamie Gritton #ifdef VIMAGE 1210bdfc8cc4SJamie Gritton if (!(pr_flags & PR_VNET)) 1211bdfc8cc4SJamie Gritton #endif 1212bdfc8cc4SJamie Gritton { 12130304c731SJamie Gritton #ifdef INET 12142b0d6f81SJamie Gritton if (!(ch_flags & PR_IP4_USER)) 12156a3f2779SJamie Gritton pr->pr_flags |= PR_IP4 | PR_IP4_USER; 12162b0d6f81SJamie Gritton else if (!(pr_flags & PR_IP4_USER)) { 12172b0d6f81SJamie Gritton pr->pr_flags |= ppr->pr_flags & PR_IP4; 12182b0d6f81SJamie Gritton if (ppr->pr_ip4 != NULL) { 12192b0d6f81SJamie Gritton pr->pr_ip4s = ppr->pr_ip4s; 12202b0d6f81SJamie Gritton pr->pr_ip4 = malloc(pr->pr_ip4s * 12212b0d6f81SJamie Gritton sizeof(struct in_addr), M_PRISON, 12222b0d6f81SJamie Gritton M_WAITOK); 12232b0d6f81SJamie Gritton bcopy(ppr->pr_ip4, pr->pr_ip4, 12242b0d6f81SJamie Gritton pr->pr_ip4s * sizeof(*pr->pr_ip4)); 12252b0d6f81SJamie Gritton } 12262b0d6f81SJamie Gritton } 12270304c731SJamie Gritton #endif 12280304c731SJamie Gritton #ifdef INET6 12292b0d6f81SJamie Gritton if (!(ch_flags & PR_IP6_USER)) 12306a3f2779SJamie Gritton pr->pr_flags |= PR_IP6 | PR_IP6_USER; 12312b0d6f81SJamie Gritton else if (!(pr_flags & PR_IP6_USER)) { 12322b0d6f81SJamie Gritton pr->pr_flags |= ppr->pr_flags & PR_IP6; 12332b0d6f81SJamie Gritton if (ppr->pr_ip6 != NULL) { 12342b0d6f81SJamie Gritton pr->pr_ip6s = ppr->pr_ip6s; 12352b0d6f81SJamie Gritton pr->pr_ip6 = malloc(pr->pr_ip6s * 12362b0d6f81SJamie Gritton sizeof(struct in6_addr), M_PRISON, 12372b0d6f81SJamie Gritton M_WAITOK); 12382b0d6f81SJamie Gritton bcopy(ppr->pr_ip6, pr->pr_ip6, 12392b0d6f81SJamie Gritton pr->pr_ip6s * sizeof(*pr->pr_ip6)); 12402b0d6f81SJamie Gritton } 12412b0d6f81SJamie Gritton } 12420304c731SJamie Gritton #endif 1243bdfc8cc4SJamie Gritton } 1244bdfc8cc4SJamie Gritton #endif 1245592bcae8SBjoern A. Zeeb /* Source address selection is always on by default. */ 1246592bcae8SBjoern A. Zeeb pr->pr_flags |= _PR_IP_SADDRSEL; 1247592bcae8SBjoern A. Zeeb 12480304c731SJamie Gritton pr->pr_securelevel = ppr->pr_securelevel; 12490304c731SJamie Gritton pr->pr_allow = JAIL_DEFAULT_ALLOW & ppr->pr_allow; 1250af10bf05SBjoern A. Zeeb pr->pr_enforce_statfs = jail_default_enforce_statfs; 1251bf3db8aaSMartin Matuska pr->pr_devfs_rsnum = ppr->pr_devfs_rsnum; 1252b38ff370SJamie Gritton 1253b96bd95bSIan Lepore pr->pr_osreldate = osreldt ? osreldt : ppr->pr_osreldate; 1254b96bd95bSIan Lepore if (osrelstr == NULL) 1255b96bd95bSIan Lepore strcpy(pr->pr_osrelease, ppr->pr_osrelease); 1256b96bd95bSIan Lepore else 1257b96bd95bSIan Lepore strcpy(pr->pr_osrelease, osrelstr); 1258b96bd95bSIan Lepore 12590304c731SJamie Gritton LIST_INIT(&pr->pr_children); 12600304c731SJamie Gritton mtx_init(&pr->pr_mtx, "jail mutex", NULL, MTX_DEF | MTX_DUPOK); 126173d9e52dSJamie Gritton TASK_INIT(&pr->pr_task, 0, prison_complete, pr); 1262b38ff370SJamie Gritton 1263679e1390SJamie Gritton #ifdef VIMAGE 1264679e1390SJamie Gritton /* Allocate a new vnet if specified. */ 1265679e1390SJamie Gritton pr->pr_vnet = (pr_flags & PR_VNET) 1266679e1390SJamie Gritton ? vnet_alloc() : ppr->pr_vnet; 1267679e1390SJamie Gritton #endif 1268b38ff370SJamie Gritton /* 1269b38ff370SJamie Gritton * Allocate a dedicated cpuset for each jail. 1270b38ff370SJamie Gritton * Unlike other initial settings, this may return an erorr. 1271b38ff370SJamie Gritton */ 12720304c731SJamie Gritton error = cpuset_create_root(ppr, &pr->pr_cpuset); 1273b38ff370SJamie Gritton if (error) { 1274b38ff370SJamie Gritton prison_deref(pr, PD_LIST_XLOCKED); 1275b38ff370SJamie Gritton goto done_releroot; 1276b38ff370SJamie Gritton } 1277b38ff370SJamie Gritton 1278b38ff370SJamie Gritton mtx_lock(&pr->pr_mtx); 1279b38ff370SJamie Gritton /* 1280b38ff370SJamie Gritton * New prisons do not yet have a reference, because we do not 1281b6f47c23SJamie Gritton * want others to see the incomplete prison once the 1282b38ff370SJamie Gritton * allprison_lock is downgraded. 1283b38ff370SJamie Gritton */ 1284b38ff370SJamie Gritton } else { 1285b38ff370SJamie Gritton created = 0; 12862b0d6f81SJamie Gritton /* 12872b0d6f81SJamie Gritton * Grab a reference for existing prisons, to ensure they 12882b0d6f81SJamie Gritton * continue to exist for the duration of the call. 12892b0d6f81SJamie Gritton */ 12902b0d6f81SJamie Gritton pr->pr_ref++; 1291bdfc8cc4SJamie Gritton #if defined(VIMAGE) && (defined(INET) || defined(INET6)) 1292bdfc8cc4SJamie Gritton if ((pr->pr_flags & PR_VNET) && 1293bdfc8cc4SJamie Gritton (ch_flags & (PR_IP4_USER | PR_IP6_USER))) { 1294bdfc8cc4SJamie Gritton error = EINVAL; 1295bdfc8cc4SJamie Gritton vfs_opterror(opts, 1296bdfc8cc4SJamie Gritton "vnet jails cannot have IP address restrictions"); 1297bdfc8cc4SJamie Gritton goto done_deref_locked; 1298bdfc8cc4SJamie Gritton } 1299bdfc8cc4SJamie Gritton #endif 13002b0d6f81SJamie Gritton #ifdef INET 13012b0d6f81SJamie Gritton if (PR_IP4_USER & ch_flags & (pr_flags ^ pr->pr_flags)) { 13022b0d6f81SJamie Gritton error = EINVAL; 13032b0d6f81SJamie Gritton vfs_opterror(opts, 13042b0d6f81SJamie Gritton "ip4 cannot be changed after creation"); 13052b0d6f81SJamie Gritton goto done_deref_locked; 13062b0d6f81SJamie Gritton } 13072b0d6f81SJamie Gritton #endif 13082b0d6f81SJamie Gritton #ifdef INET6 13092b0d6f81SJamie Gritton if (PR_IP6_USER & ch_flags & (pr_flags ^ pr->pr_flags)) { 13102b0d6f81SJamie Gritton error = EINVAL; 13112b0d6f81SJamie Gritton vfs_opterror(opts, 13122b0d6f81SJamie Gritton "ip6 cannot be changed after creation"); 13132b0d6f81SJamie Gritton goto done_deref_locked; 13142b0d6f81SJamie Gritton } 13152b0d6f81SJamie Gritton #endif 1316b38ff370SJamie Gritton } 1317b38ff370SJamie Gritton 1318b38ff370SJamie Gritton /* Do final error checking before setting anything. */ 13190304c731SJamie Gritton if (gotslevel) { 13200304c731SJamie Gritton if (slevel < ppr->pr_securelevel) { 13210304c731SJamie Gritton error = EPERM; 13220304c731SJamie Gritton goto done_deref_locked; 13230304c731SJamie Gritton } 13240304c731SJamie Gritton } 1325b97457e2SJamie Gritton if (gotchildmax) { 1326b97457e2SJamie Gritton if (childmax >= ppr->pr_childmax) { 1327b97457e2SJamie Gritton error = EPERM; 1328b97457e2SJamie Gritton goto done_deref_locked; 1329b97457e2SJamie Gritton } 1330b97457e2SJamie Gritton } 13310304c731SJamie Gritton if (gotenforce) { 13320304c731SJamie Gritton if (enforce < ppr->pr_enforce_statfs) { 13330304c731SJamie Gritton error = EPERM; 13340304c731SJamie Gritton goto done_deref_locked; 13350304c731SJamie Gritton } 13360304c731SJamie Gritton } 13370cc207a6SMartin Matuska if (gotrsnum) { 13380cc207a6SMartin Matuska /* 13390cc207a6SMartin Matuska * devfs_rsnum is a uint16_t 13400cc207a6SMartin Matuska */ 1341bf3db8aaSMartin Matuska if (rsnum < 0 || rsnum > 65535) { 13420cc207a6SMartin Matuska error = EINVAL; 13430cc207a6SMartin Matuska goto done_deref_locked; 13440cc207a6SMartin Matuska } 13450cc207a6SMartin Matuska /* 1346bf3db8aaSMartin Matuska * Nested jails always inherit parent's devfs ruleset 13470cc207a6SMartin Matuska */ 13480cc207a6SMartin Matuska if (jailed(td->td_ucred)) { 13490cc207a6SMartin Matuska if (rsnum > 0 && rsnum != ppr->pr_devfs_rsnum) { 13500cc207a6SMartin Matuska error = EPERM; 13510cc207a6SMartin Matuska goto done_deref_locked; 1352bf3db8aaSMartin Matuska } else 13530cc207a6SMartin Matuska rsnum = ppr->pr_devfs_rsnum; 13540cc207a6SMartin Matuska } 13550cc207a6SMartin Matuska } 1356b38ff370SJamie Gritton #ifdef INET 13572b0d6f81SJamie Gritton if (ip4s > 0) { 13580304c731SJamie Gritton if (ppr->pr_flags & PR_IP4) { 13590304c731SJamie Gritton /* 13600304c731SJamie Gritton * Make sure the new set of IP addresses is a 13610304c731SJamie Gritton * subset of the parent's list. Don't worry 13620304c731SJamie Gritton * about the parent being unlocked, as any 13630304c731SJamie Gritton * setting is done with allprison_lock held. 13640304c731SJamie Gritton */ 13650304c731SJamie Gritton for (ij = 0; ij < ppr->pr_ip4s; ij++) 13662b0d6f81SJamie Gritton if (ip4[0].s_addr == ppr->pr_ip4[ij].s_addr) 13670304c731SJamie Gritton break; 13680304c731SJamie Gritton if (ij == ppr->pr_ip4s) { 13690304c731SJamie Gritton error = EPERM; 13700304c731SJamie Gritton goto done_deref_locked; 13710304c731SJamie Gritton } 13720304c731SJamie Gritton if (ip4s > 1) { 13730304c731SJamie Gritton for (ii = ij = 1; ii < ip4s; ii++) { 13740304c731SJamie Gritton if (ip4[ii].s_addr == 13750304c731SJamie Gritton ppr->pr_ip4[0].s_addr) 1376b38ff370SJamie Gritton continue; 13770304c731SJamie Gritton for (; ij < ppr->pr_ip4s; ij++) 13780304c731SJamie Gritton if (ip4[ii].s_addr == 13790304c731SJamie Gritton ppr->pr_ip4[ij].s_addr) 13800304c731SJamie Gritton break; 13810304c731SJamie Gritton if (ij == ppr->pr_ip4s) 13820304c731SJamie Gritton break; 13830304c731SJamie Gritton } 13840304c731SJamie Gritton if (ij == ppr->pr_ip4s) { 13850304c731SJamie Gritton error = EPERM; 13860304c731SJamie Gritton goto done_deref_locked; 13870304c731SJamie Gritton } 13880304c731SJamie Gritton } 13890304c731SJamie Gritton } 13900304c731SJamie Gritton /* 13910304c731SJamie Gritton * Check for conflicting IP addresses. We permit them 13920304c731SJamie Gritton * if there is no more than one IP on each jail. If 13930304c731SJamie Gritton * there is a duplicate on a jail with more than one 13940304c731SJamie Gritton * IP stop checking and return error. 13950304c731SJamie Gritton */ 1396bdfc8cc4SJamie Gritton tppr = ppr; 1397bdfc8cc4SJamie Gritton #ifdef VIMAGE 1398bdfc8cc4SJamie Gritton for (; tppr != &prison0; tppr = tppr->pr_parent) 1399bdfc8cc4SJamie Gritton if (tppr->pr_flags & PR_VNET) 1400bdfc8cc4SJamie Gritton break; 1401bdfc8cc4SJamie Gritton #endif 1402bdfc8cc4SJamie Gritton FOREACH_PRISON_DESCENDANT(tppr, tpr, descend) { 1403bdfc8cc4SJamie Gritton if (tpr == pr || 1404bdfc8cc4SJamie Gritton #ifdef VIMAGE 14052b0d6f81SJamie Gritton (tpr != tppr && (tpr->pr_flags & PR_VNET)) || 1406bdfc8cc4SJamie Gritton #endif 1407bdfc8cc4SJamie Gritton tpr->pr_uref == 0) { 14080304c731SJamie Gritton descend = 0; 14090304c731SJamie Gritton continue; 14100304c731SJamie Gritton } 14110304c731SJamie Gritton if (!(tpr->pr_flags & PR_IP4_USER)) 14120304c731SJamie Gritton continue; 14130304c731SJamie Gritton descend = 0; 14140304c731SJamie Gritton if (tpr->pr_ip4 == NULL || 14150304c731SJamie Gritton (ip4s == 1 && tpr->pr_ip4s == 1)) 14160304c731SJamie Gritton continue; 14170304c731SJamie Gritton for (ii = 0; ii < ip4s; ii++) { 14180ce1624dSStephen J. Kiernan if (prison_check_ip4_locked(tpr, &ip4[ii]) == 14190ce1624dSStephen J. Kiernan 0) { 14200304c731SJamie Gritton error = EADDRINUSE; 1421b38ff370SJamie Gritton vfs_opterror(opts, 1422b38ff370SJamie Gritton "IPv4 addresses clash"); 1423b38ff370SJamie Gritton goto done_deref_locked; 1424b38ff370SJamie Gritton } 14250304c731SJamie Gritton } 14260304c731SJamie Gritton } 14270304c731SJamie Gritton } 1428b38ff370SJamie Gritton #endif 1429b38ff370SJamie Gritton #ifdef INET6 14302b0d6f81SJamie Gritton if (ip6s > 0) { 14310304c731SJamie Gritton if (ppr->pr_flags & PR_IP6) { 14320304c731SJamie Gritton /* 14330304c731SJamie Gritton * Make sure the new set of IP addresses is a 14340304c731SJamie Gritton * subset of the parent's list. 14350304c731SJamie Gritton */ 14360304c731SJamie Gritton for (ij = 0; ij < ppr->pr_ip6s; ij++) 14370304c731SJamie Gritton if (IN6_ARE_ADDR_EQUAL(&ip6[0], 14380304c731SJamie Gritton &ppr->pr_ip6[ij])) 14390304c731SJamie Gritton break; 14400304c731SJamie Gritton if (ij == ppr->pr_ip6s) { 14410304c731SJamie Gritton error = EPERM; 14420304c731SJamie Gritton goto done_deref_locked; 14430304c731SJamie Gritton } 14440304c731SJamie Gritton if (ip6s > 1) { 14450304c731SJamie Gritton for (ii = ij = 1; ii < ip6s; ii++) { 14460304c731SJamie Gritton if (IN6_ARE_ADDR_EQUAL(&ip6[ii], 14470304c731SJamie Gritton &ppr->pr_ip6[0])) 14480304c731SJamie Gritton continue; 14490304c731SJamie Gritton for (; ij < ppr->pr_ip6s; ij++) 14500304c731SJamie Gritton if (IN6_ARE_ADDR_EQUAL( 14512b0d6f81SJamie Gritton &ip6[ii], &ppr->pr_ip6[ij])) 14520304c731SJamie Gritton break; 14530304c731SJamie Gritton if (ij == ppr->pr_ip6s) 14540304c731SJamie Gritton break; 14550304c731SJamie Gritton } 14560304c731SJamie Gritton if (ij == ppr->pr_ip6s) { 14570304c731SJamie Gritton error = EPERM; 14580304c731SJamie Gritton goto done_deref_locked; 14590304c731SJamie Gritton } 14600304c731SJamie Gritton } 14610304c731SJamie Gritton } 14620304c731SJamie Gritton /* Check for conflicting IP addresses. */ 1463bdfc8cc4SJamie Gritton tppr = ppr; 1464bdfc8cc4SJamie Gritton #ifdef VIMAGE 1465bdfc8cc4SJamie Gritton for (; tppr != &prison0; tppr = tppr->pr_parent) 1466bdfc8cc4SJamie Gritton if (tppr->pr_flags & PR_VNET) 1467bdfc8cc4SJamie Gritton break; 1468bdfc8cc4SJamie Gritton #endif 1469bdfc8cc4SJamie Gritton FOREACH_PRISON_DESCENDANT(tppr, tpr, descend) { 1470bdfc8cc4SJamie Gritton if (tpr == pr || 1471bdfc8cc4SJamie Gritton #ifdef VIMAGE 14722b0d6f81SJamie Gritton (tpr != tppr && (tpr->pr_flags & PR_VNET)) || 1473bdfc8cc4SJamie Gritton #endif 1474bdfc8cc4SJamie Gritton tpr->pr_uref == 0) { 14750304c731SJamie Gritton descend = 0; 14760304c731SJamie Gritton continue; 14770304c731SJamie Gritton } 14780304c731SJamie Gritton if (!(tpr->pr_flags & PR_IP6_USER)) 14790304c731SJamie Gritton continue; 14800304c731SJamie Gritton descend = 0; 14810304c731SJamie Gritton if (tpr->pr_ip6 == NULL || 14820304c731SJamie Gritton (ip6s == 1 && tpr->pr_ip6s == 1)) 14830304c731SJamie Gritton continue; 14840304c731SJamie Gritton for (ii = 0; ii < ip6s; ii++) { 14850ce1624dSStephen J. Kiernan if (prison_check_ip6_locked(tpr, &ip6[ii]) == 14860ce1624dSStephen J. Kiernan 0) { 14870304c731SJamie Gritton error = EADDRINUSE; 1488b38ff370SJamie Gritton vfs_opterror(opts, 1489b38ff370SJamie Gritton "IPv6 addresses clash"); 1490b38ff370SJamie Gritton goto done_deref_locked; 1491b38ff370SJamie Gritton } 14920304c731SJamie Gritton } 14930304c731SJamie Gritton } 14940304c731SJamie Gritton } 1495b38ff370SJamie Gritton #endif 14960304c731SJamie Gritton onamelen = namelen = 0; 1497b6f47c23SJamie Gritton if (namelc != NULL) { 14986ab6058eSJamie Gritton /* Give a default name of the jid. Also allow the name to be 14996ab6058eSJamie Gritton * explicitly the jid - but not any other number, and only in 15006ab6058eSJamie Gritton * normal form (no leading zero/etc). 15016ab6058eSJamie Gritton */ 1502b6f47c23SJamie Gritton if (namelc[0] == '\0') 1503b6f47c23SJamie Gritton snprintf(namelc = numbuf, sizeof(numbuf), "%d", jid); 15046ab6058eSJamie Gritton else if ((strtoul(namelc, &p, 10) != jid || 15056ab6058eSJamie Gritton namelc[0] < '1' || namelc[0] > '9') && *p == '\0') { 1506b38ff370SJamie Gritton error = EINVAL; 1507babbbb9cSJamie Gritton vfs_opterror(opts, 1508babbbb9cSJamie Gritton "name cannot be numeric (unless it is the jid)"); 15090304c731SJamie Gritton goto done_deref_locked; 1510b38ff370SJamie Gritton } 1511b38ff370SJamie Gritton /* 15120304c731SJamie Gritton * Make sure the name isn't too long for the prison or its 15130304c731SJamie Gritton * children. 1514b38ff370SJamie Gritton */ 1515b6f47c23SJamie Gritton pnamelen = (ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1; 1516b6f47c23SJamie Gritton onamelen = strlen(pr->pr_name + pnamelen); 1517b6f47c23SJamie Gritton namelen = strlen(namelc); 1518b6f47c23SJamie Gritton if (pnamelen + namelen + 1 > sizeof(pr->pr_name)) { 15190304c731SJamie Gritton error = ENAMETOOLONG; 15200304c731SJamie Gritton goto done_deref_locked; 15210304c731SJamie Gritton } 15220304c731SJamie Gritton FOREACH_PRISON_DESCENDANT(pr, tpr, descend) { 15230304c731SJamie Gritton if (strlen(tpr->pr_name) + (namelen - onamelen) >= 15240304c731SJamie Gritton sizeof(pr->pr_name)) { 15250304c731SJamie Gritton error = ENAMETOOLONG; 15260304c731SJamie Gritton goto done_deref_locked; 15270304c731SJamie Gritton } 15280304c731SJamie Gritton } 15290304c731SJamie Gritton } 15300304c731SJamie Gritton if (pr_allow & ~ppr->pr_allow) { 15310304c731SJamie Gritton error = EPERM; 15320304c731SJamie Gritton goto done_deref_locked; 1533b38ff370SJamie Gritton } 1534b38ff370SJamie Gritton 1535b6f47c23SJamie Gritton /* 1536b6f47c23SJamie Gritton * Let modules check their parameters. This requires unlocking and 1537b6f47c23SJamie Gritton * then re-locking the prison, but this is still a valid state as long 1538b6f47c23SJamie Gritton * as allprison_lock remains xlocked. 1539b6f47c23SJamie Gritton */ 1540b6f47c23SJamie Gritton mtx_unlock(&pr->pr_mtx); 1541b6f47c23SJamie Gritton error = osd_jail_call(pr, PR_METHOD_CHECK, opts); 1542b6f47c23SJamie Gritton if (error != 0) { 1543b6f47c23SJamie Gritton prison_deref(pr, created 1544b6f47c23SJamie Gritton ? PD_LIST_XLOCKED 1545b6f47c23SJamie Gritton : PD_DEREF | PD_LIST_XLOCKED); 1546b6f47c23SJamie Gritton goto done_releroot; 1547b6f47c23SJamie Gritton } 1548b6f47c23SJamie Gritton mtx_lock(&pr->pr_mtx); 1549b6f47c23SJamie Gritton 1550b6f47c23SJamie Gritton /* At this point, all valid parameters should have been noted. */ 1551b6f47c23SJamie Gritton TAILQ_FOREACH(opt, opts, link) { 1552b6f47c23SJamie Gritton if (!opt->seen && strcmp(opt->name, "errmsg")) { 1553b6f47c23SJamie Gritton error = EINVAL; 1554b6f47c23SJamie Gritton vfs_opterror(opts, "unknown parameter: %s", opt->name); 1555b6f47c23SJamie Gritton goto done_deref_locked; 1556b6f47c23SJamie Gritton } 1557b6f47c23SJamie Gritton } 1558b6f47c23SJamie Gritton 1559b38ff370SJamie Gritton /* Set the parameters of the prison. */ 1560b38ff370SJamie Gritton #ifdef INET 15610304c731SJamie Gritton redo_ip4 = 0; 15620304c731SJamie Gritton if (pr_flags & PR_IP4_USER) { 15630304c731SJamie Gritton pr->pr_flags |= PR_IP4; 1564b38ff370SJamie Gritton free(pr->pr_ip4, M_PRISON); 15650304c731SJamie Gritton pr->pr_ip4s = ip4s; 1566b38ff370SJamie Gritton pr->pr_ip4 = ip4; 1567b38ff370SJamie Gritton ip4 = NULL; 15680304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 1569bdfc8cc4SJamie Gritton #ifdef VIMAGE 1570bdfc8cc4SJamie Gritton if (tpr->pr_flags & PR_VNET) { 1571bdfc8cc4SJamie Gritton descend = 0; 1572bdfc8cc4SJamie Gritton continue; 1573bdfc8cc4SJamie Gritton } 1574bdfc8cc4SJamie Gritton #endif 15750304c731SJamie Gritton if (prison_restrict_ip4(tpr, NULL)) { 15760304c731SJamie Gritton redo_ip4 = 1; 15770304c731SJamie Gritton descend = 0; 15780304c731SJamie Gritton } 15790304c731SJamie Gritton } 15800304c731SJamie Gritton } 1581b38ff370SJamie Gritton #endif 1582b38ff370SJamie Gritton #ifdef INET6 15830304c731SJamie Gritton redo_ip6 = 0; 15840304c731SJamie Gritton if (pr_flags & PR_IP6_USER) { 15850304c731SJamie Gritton pr->pr_flags |= PR_IP6; 1586b38ff370SJamie Gritton free(pr->pr_ip6, M_PRISON); 15870304c731SJamie Gritton pr->pr_ip6s = ip6s; 1588b38ff370SJamie Gritton pr->pr_ip6 = ip6; 1589b38ff370SJamie Gritton ip6 = NULL; 15900304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 1591bdfc8cc4SJamie Gritton #ifdef VIMAGE 1592bdfc8cc4SJamie Gritton if (tpr->pr_flags & PR_VNET) { 1593bdfc8cc4SJamie Gritton descend = 0; 1594bdfc8cc4SJamie Gritton continue; 1595bdfc8cc4SJamie Gritton } 1596bdfc8cc4SJamie Gritton #endif 15970304c731SJamie Gritton if (prison_restrict_ip6(tpr, NULL)) { 15980304c731SJamie Gritton redo_ip6 = 1; 15990304c731SJamie Gritton descend = 0; 16000304c731SJamie Gritton } 16010304c731SJamie Gritton } 16020304c731SJamie Gritton } 1603b38ff370SJamie Gritton #endif 16040304c731SJamie Gritton if (gotslevel) { 1605b38ff370SJamie Gritton pr->pr_securelevel = slevel; 16060304c731SJamie Gritton /* Set all child jails to be at least this level. */ 16070304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) 16080304c731SJamie Gritton if (tpr->pr_securelevel < slevel) 16090304c731SJamie Gritton tpr->pr_securelevel = slevel; 16100304c731SJamie Gritton } 1611b97457e2SJamie Gritton if (gotchildmax) { 1612b97457e2SJamie Gritton pr->pr_childmax = childmax; 1613b97457e2SJamie Gritton /* Set all child jails to under this limit. */ 1614b97457e2SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED_LEVEL(pr, tpr, descend, level) 1615b97457e2SJamie Gritton if (tpr->pr_childmax > childmax - level) 1616b97457e2SJamie Gritton tpr->pr_childmax = childmax > level 1617b97457e2SJamie Gritton ? childmax - level : 0; 1618b97457e2SJamie Gritton } 16190304c731SJamie Gritton if (gotenforce) { 16200304c731SJamie Gritton pr->pr_enforce_statfs = enforce; 16210304c731SJamie Gritton /* Pass this restriction on to the children. */ 16220304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) 16230304c731SJamie Gritton if (tpr->pr_enforce_statfs < enforce) 16240304c731SJamie Gritton tpr->pr_enforce_statfs = enforce; 16250304c731SJamie Gritton } 16260cc207a6SMartin Matuska if (gotrsnum) { 16270cc207a6SMartin Matuska pr->pr_devfs_rsnum = rsnum; 16280cc207a6SMartin Matuska /* Pass this restriction on to the children. */ 16290cc207a6SMartin Matuska FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) 16300cc207a6SMartin Matuska tpr->pr_devfs_rsnum = rsnum; 16310cc207a6SMartin Matuska } 1632b6f47c23SJamie Gritton if (namelc != NULL) { 16330304c731SJamie Gritton if (ppr == &prison0) 1634b6f47c23SJamie Gritton strlcpy(pr->pr_name, namelc, sizeof(pr->pr_name)); 16350304c731SJamie Gritton else 16360304c731SJamie Gritton snprintf(pr->pr_name, sizeof(pr->pr_name), "%s.%s", 1637b6f47c23SJamie Gritton ppr->pr_name, namelc); 16380304c731SJamie Gritton /* Change this component of child names. */ 16390304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 16400304c731SJamie Gritton bcopy(tpr->pr_name + onamelen, tpr->pr_name + namelen, 16410304c731SJamie Gritton strlen(tpr->pr_name + onamelen) + 1); 16420304c731SJamie Gritton bcopy(pr->pr_name, tpr->pr_name, namelen); 16430304c731SJamie Gritton } 16440304c731SJamie Gritton } 1645b38ff370SJamie Gritton if (path != NULL) { 16460304c731SJamie Gritton /* Try to keep a real-rooted full pathname. */ 1647f6e633a9SMartin Matuska if (fullpath_disabled && path[0] == '/' && 1648f6e633a9SMartin Matuska strcmp(mypr->pr_path, "/")) 16490304c731SJamie Gritton snprintf(pr->pr_path, sizeof(pr->pr_path), "%s%s", 16500304c731SJamie Gritton mypr->pr_path, path); 16510304c731SJamie Gritton else 1652b38ff370SJamie Gritton strlcpy(pr->pr_path, path, sizeof(pr->pr_path)); 1653b38ff370SJamie Gritton pr->pr_root = root; 1654b38ff370SJamie Gritton } 165576ca6f88SJamie Gritton if (PR_HOST & ch_flags & ~pr_flags) { 165676ca6f88SJamie Gritton if (pr->pr_flags & PR_HOST) { 165776ca6f88SJamie Gritton /* 165876ca6f88SJamie Gritton * Copy the parent's host info. As with pr_ip4 above, 165976ca6f88SJamie Gritton * the lack of a lock on the parent is not a problem; 166076ca6f88SJamie Gritton * it is always set with allprison_lock at least 166176ca6f88SJamie Gritton * shared, and is held exclusively here. 166276ca6f88SJamie Gritton */ 1663c1f19219SJamie Gritton strlcpy(pr->pr_hostname, pr->pr_parent->pr_hostname, 1664c1f19219SJamie Gritton sizeof(pr->pr_hostname)); 1665c1f19219SJamie Gritton strlcpy(pr->pr_domainname, pr->pr_parent->pr_domainname, 1666c1f19219SJamie Gritton sizeof(pr->pr_domainname)); 1667c1f19219SJamie Gritton strlcpy(pr->pr_hostuuid, pr->pr_parent->pr_hostuuid, 1668c1f19219SJamie Gritton sizeof(pr->pr_hostuuid)); 166976ca6f88SJamie Gritton pr->pr_hostid = pr->pr_parent->pr_hostid; 167076ca6f88SJamie Gritton } 167176ca6f88SJamie Gritton } else if (host != NULL || domain != NULL || uuid != NULL || gothid) { 167276ca6f88SJamie Gritton /* Set this prison, and any descendants without PR_HOST. */ 1673b38ff370SJamie Gritton if (host != NULL) 1674c1f19219SJamie Gritton strlcpy(pr->pr_hostname, host, sizeof(pr->pr_hostname)); 167576ca6f88SJamie Gritton if (domain != NULL) 1676c1f19219SJamie Gritton strlcpy(pr->pr_domainname, domain, 1677c1f19219SJamie Gritton sizeof(pr->pr_domainname)); 167876ca6f88SJamie Gritton if (uuid != NULL) 1679c1f19219SJamie Gritton strlcpy(pr->pr_hostuuid, uuid, sizeof(pr->pr_hostuuid)); 168076ca6f88SJamie Gritton if (gothid) 168176ca6f88SJamie Gritton pr->pr_hostid = hid; 168276ca6f88SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 168376ca6f88SJamie Gritton if (tpr->pr_flags & PR_HOST) 168476ca6f88SJamie Gritton descend = 0; 168576ca6f88SJamie Gritton else { 168676ca6f88SJamie Gritton if (host != NULL) 1687c1f19219SJamie Gritton strlcpy(tpr->pr_hostname, 1688c1f19219SJamie Gritton pr->pr_hostname, 1689c1f19219SJamie Gritton sizeof(tpr->pr_hostname)); 169076ca6f88SJamie Gritton if (domain != NULL) 1691c1f19219SJamie Gritton strlcpy(tpr->pr_domainname, 1692c1f19219SJamie Gritton pr->pr_domainname, 1693c1f19219SJamie Gritton sizeof(tpr->pr_domainname)); 169476ca6f88SJamie Gritton if (uuid != NULL) 1695c1f19219SJamie Gritton strlcpy(tpr->pr_hostuuid, 1696c1f19219SJamie Gritton pr->pr_hostuuid, 1697c1f19219SJamie Gritton sizeof(tpr->pr_hostuuid)); 169876ca6f88SJamie Gritton if (gothid) 169976ca6f88SJamie Gritton tpr->pr_hostid = hid; 170076ca6f88SJamie Gritton } 170176ca6f88SJamie Gritton } 170276ca6f88SJamie Gritton } 17030304c731SJamie Gritton if ((tallow = ch_allow & ~pr_allow)) { 17040304c731SJamie Gritton /* Clear allow bits in all children. */ 17050304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) 17060304c731SJamie Gritton tpr->pr_allow &= ~tallow; 17070304c731SJamie Gritton } 17080304c731SJamie Gritton pr->pr_allow = (pr->pr_allow & ~ch_allow) | pr_allow; 1709b38ff370SJamie Gritton /* 1710b38ff370SJamie Gritton * Persistent prisons get an extra reference, and prisons losing their 1711b38ff370SJamie Gritton * persist flag lose that reference. Only do this for existing prisons 1712b38ff370SJamie Gritton * for now, so new ones will remain unseen until after the module 1713b38ff370SJamie Gritton * handlers have completed. 1714b38ff370SJamie Gritton */ 1715cc5fd8c7SJamie Gritton born = pr->pr_uref == 0; 1716b38ff370SJamie Gritton if (!created && (ch_flags & PR_PERSIST & (pr_flags ^ pr->pr_flags))) { 1717b38ff370SJamie Gritton if (pr_flags & PR_PERSIST) { 1718b38ff370SJamie Gritton pr->pr_ref++; 1719b38ff370SJamie Gritton pr->pr_uref++; 1720b38ff370SJamie Gritton } else { 1721b38ff370SJamie Gritton pr->pr_ref--; 1722b38ff370SJamie Gritton pr->pr_uref--; 1723b38ff370SJamie Gritton } 1724b38ff370SJamie Gritton } 1725b38ff370SJamie Gritton pr->pr_flags = (pr->pr_flags & ~ch_flags) | pr_flags; 1726b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 1727b38ff370SJamie Gritton 1728a7ad07bfSEdward Tomasz Napierala #ifdef RACCT 17294b5c9cf6SEdward Tomasz Napierala if (racct_enable && created) 1730a7ad07bfSEdward Tomasz Napierala prison_racct_attach(pr); 1731a7ad07bfSEdward Tomasz Napierala #endif 1732a7ad07bfSEdward Tomasz Napierala 17330304c731SJamie Gritton /* Locks may have prevented a complete restriction of child IP 17340304c731SJamie Gritton * addresses. If so, allocate some more memory and try again. 17350304c731SJamie Gritton */ 17360304c731SJamie Gritton #ifdef INET 17370304c731SJamie Gritton while (redo_ip4) { 17380304c731SJamie Gritton ip4s = pr->pr_ip4s; 17390304c731SJamie Gritton ip4 = malloc(ip4s * sizeof(*ip4), M_PRISON, M_WAITOK); 17400304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 17410304c731SJamie Gritton redo_ip4 = 0; 17420304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 1743bdfc8cc4SJamie Gritton #ifdef VIMAGE 1744bdfc8cc4SJamie Gritton if (tpr->pr_flags & PR_VNET) { 1745bdfc8cc4SJamie Gritton descend = 0; 1746bdfc8cc4SJamie Gritton continue; 1747bdfc8cc4SJamie Gritton } 1748bdfc8cc4SJamie Gritton #endif 17490304c731SJamie Gritton if (prison_restrict_ip4(tpr, ip4)) { 17500304c731SJamie Gritton if (ip4 != NULL) 17510304c731SJamie Gritton ip4 = NULL; 17520304c731SJamie Gritton else 17530304c731SJamie Gritton redo_ip4 = 1; 17540304c731SJamie Gritton } 17550304c731SJamie Gritton } 17560304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 17570304c731SJamie Gritton } 17580304c731SJamie Gritton #endif 17590304c731SJamie Gritton #ifdef INET6 17600304c731SJamie Gritton while (redo_ip6) { 17610304c731SJamie Gritton ip6s = pr->pr_ip6s; 17620304c731SJamie Gritton ip6 = malloc(ip6s * sizeof(*ip6), M_PRISON, M_WAITOK); 17630304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 17640304c731SJamie Gritton redo_ip6 = 0; 17650304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 1766bdfc8cc4SJamie Gritton #ifdef VIMAGE 1767bdfc8cc4SJamie Gritton if (tpr->pr_flags & PR_VNET) { 1768bdfc8cc4SJamie Gritton descend = 0; 1769bdfc8cc4SJamie Gritton continue; 1770bdfc8cc4SJamie Gritton } 1771bdfc8cc4SJamie Gritton #endif 17720304c731SJamie Gritton if (prison_restrict_ip6(tpr, ip6)) { 17730304c731SJamie Gritton if (ip6 != NULL) 17740304c731SJamie Gritton ip6 = NULL; 17750304c731SJamie Gritton else 17760304c731SJamie Gritton redo_ip6 = 1; 17770304c731SJamie Gritton } 17780304c731SJamie Gritton } 17790304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 17800304c731SJamie Gritton } 17810304c731SJamie Gritton #endif 17820304c731SJamie Gritton 1783b38ff370SJamie Gritton /* Let the modules do their work. */ 1784b38ff370SJamie Gritton sx_downgrade(&allprison_lock); 1785cc5fd8c7SJamie Gritton if (born) { 1786b38ff370SJamie Gritton error = osd_jail_call(pr, PR_METHOD_CREATE, opts); 1787b38ff370SJamie Gritton if (error) { 1788cc5fd8c7SJamie Gritton (void)osd_jail_call(pr, PR_METHOD_REMOVE, NULL); 1789cc5fd8c7SJamie Gritton prison_deref(pr, created 1790cc5fd8c7SJamie Gritton ? PD_LIST_SLOCKED 1791cc5fd8c7SJamie Gritton : PD_DEREF | PD_LIST_SLOCKED); 1792b38ff370SJamie Gritton goto done_errmsg; 1793b38ff370SJamie Gritton } 1794b38ff370SJamie Gritton } 1795b38ff370SJamie Gritton error = osd_jail_call(pr, PR_METHOD_SET, opts); 1796b38ff370SJamie Gritton if (error) { 1797cc5fd8c7SJamie Gritton if (born) 1798cc5fd8c7SJamie Gritton (void)osd_jail_call(pr, PR_METHOD_REMOVE, NULL); 1799b38ff370SJamie Gritton prison_deref(pr, created 1800b38ff370SJamie Gritton ? PD_LIST_SLOCKED 1801b38ff370SJamie Gritton : PD_DEREF | PD_LIST_SLOCKED); 1802b38ff370SJamie Gritton goto done_errmsg; 1803b38ff370SJamie Gritton } 1804b38ff370SJamie Gritton 1805b38ff370SJamie Gritton /* Attach this process to the prison if requested. */ 1806b38ff370SJamie Gritton if (flags & JAIL_ATTACH) { 1807b38ff370SJamie Gritton mtx_lock(&pr->pr_mtx); 1808b38ff370SJamie Gritton error = do_jail_attach(td, pr); 1809b38ff370SJamie Gritton if (error) { 1810b38ff370SJamie Gritton vfs_opterror(opts, "attach failed"); 1811b38ff370SJamie Gritton if (!created) 1812b38ff370SJamie Gritton prison_deref(pr, PD_DEREF); 1813b38ff370SJamie Gritton goto done_errmsg; 1814b38ff370SJamie Gritton } 1815b38ff370SJamie Gritton } 1816b38ff370SJamie Gritton 18171fb24974SEdward Tomasz Napierala #ifdef RACCT 18184b5c9cf6SEdward Tomasz Napierala if (racct_enable && !created) { 1819f514b97bSEdward Tomasz Napierala if (!(flags & JAIL_ATTACH)) 18201fb24974SEdward Tomasz Napierala sx_sunlock(&allprison_lock); 18211fb24974SEdward Tomasz Napierala prison_racct_modify(pr); 1822f514b97bSEdward Tomasz Napierala if (!(flags & JAIL_ATTACH)) 18231fb24974SEdward Tomasz Napierala sx_slock(&allprison_lock); 18241fb24974SEdward Tomasz Napierala } 18251fb24974SEdward Tomasz Napierala #endif 18261fb24974SEdward Tomasz Napierala 18271fb24974SEdward Tomasz Napierala td->td_retval[0] = pr->pr_id; 18281fb24974SEdward Tomasz Napierala 1829b38ff370SJamie Gritton /* 1830b38ff370SJamie Gritton * Now that it is all there, drop the temporary reference from existing 1831b38ff370SJamie Gritton * prisons. Or add a reference to newly created persistent prisons 1832b38ff370SJamie Gritton * (which was not done earlier so that the prison would not be publicly 1833b38ff370SJamie Gritton * visible). 1834b38ff370SJamie Gritton */ 1835b38ff370SJamie Gritton if (!created) { 1836b38ff370SJamie Gritton prison_deref(pr, (flags & JAIL_ATTACH) 1837b38ff370SJamie Gritton ? PD_DEREF 1838b38ff370SJamie Gritton : PD_DEREF | PD_LIST_SLOCKED); 1839b38ff370SJamie Gritton } else { 1840b38ff370SJamie Gritton if (pr_flags & PR_PERSIST) { 1841b38ff370SJamie Gritton mtx_lock(&pr->pr_mtx); 1842b38ff370SJamie Gritton pr->pr_ref++; 1843b38ff370SJamie Gritton pr->pr_uref++; 1844b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 1845b38ff370SJamie Gritton } 1846b38ff370SJamie Gritton if (!(flags & JAIL_ATTACH)) 1847b38ff370SJamie Gritton sx_sunlock(&allprison_lock); 1848b38ff370SJamie Gritton } 1849c34bbd2aSEdward Tomasz Napierala 1850cc5fd8c7SJamie Gritton goto done_free; 1851b38ff370SJamie Gritton 18520304c731SJamie Gritton done_deref_locked: 18530304c731SJamie Gritton prison_deref(pr, created 18540304c731SJamie Gritton ? PD_LOCKED | PD_LIST_XLOCKED 18550304c731SJamie Gritton : PD_DEREF | PD_LOCKED | PD_LIST_XLOCKED); 18560304c731SJamie Gritton goto done_releroot; 1857b38ff370SJamie Gritton done_unlock_list: 1858b38ff370SJamie Gritton sx_xunlock(&allprison_lock); 1859b38ff370SJamie Gritton done_releroot: 18605050aa86SKonstantin Belousov if (root != NULL) 1861b38ff370SJamie Gritton vrele(root); 1862b38ff370SJamie Gritton done_errmsg: 1863b38ff370SJamie Gritton if (error) { 1864176ff3a0SJamie Gritton if (vfs_getopt(opts, "errmsg", (void **)&errmsg, 1865176ff3a0SJamie Gritton &errmsg_len) == 0 && errmsg_len > 0) { 1866b38ff370SJamie Gritton errmsg_pos = 2 * vfs_getopt_pos(opts, "errmsg") + 1; 1867b38ff370SJamie Gritton if (optuio->uio_segflg == UIO_SYSSPACE) 1868b38ff370SJamie Gritton bcopy(errmsg, 1869b38ff370SJamie Gritton optuio->uio_iov[errmsg_pos].iov_base, 1870b38ff370SJamie Gritton errmsg_len); 1871b38ff370SJamie Gritton else 1872b38ff370SJamie Gritton copyout(errmsg, 1873b38ff370SJamie Gritton optuio->uio_iov[errmsg_pos].iov_base, 1874b38ff370SJamie Gritton errmsg_len); 1875b38ff370SJamie Gritton } 1876b38ff370SJamie Gritton } 1877b38ff370SJamie Gritton done_free: 1878b38ff370SJamie Gritton #ifdef INET 1879b38ff370SJamie Gritton free(ip4, M_PRISON); 1880b38ff370SJamie Gritton #endif 1881b38ff370SJamie Gritton #ifdef INET6 1882b38ff370SJamie Gritton free(ip6, M_PRISON); 1883b38ff370SJamie Gritton #endif 18846dfe0a3dSMartin Matuska if (g_path != NULL) 18856dfe0a3dSMartin Matuska free(g_path, M_TEMP); 1886b38ff370SJamie Gritton vfs_freeopts(opts); 1887b38ff370SJamie Gritton return (error); 1888b38ff370SJamie Gritton } 1889b38ff370SJamie Gritton 1890b38ff370SJamie Gritton 1891b38ff370SJamie Gritton /* 1892b38ff370SJamie Gritton * struct jail_get_args { 1893b38ff370SJamie Gritton * struct iovec *iovp; 1894b38ff370SJamie Gritton * unsigned int iovcnt; 1895b38ff370SJamie Gritton * int flags; 1896b38ff370SJamie Gritton * }; 1897b38ff370SJamie Gritton */ 1898b38ff370SJamie Gritton int 18998451d0ddSKip Macy sys_jail_get(struct thread *td, struct jail_get_args *uap) 1900b38ff370SJamie Gritton { 1901b38ff370SJamie Gritton struct uio *auio; 1902b38ff370SJamie Gritton int error; 1903b38ff370SJamie Gritton 1904b38ff370SJamie Gritton /* Check that we have an even number of iovecs. */ 1905b38ff370SJamie Gritton if (uap->iovcnt & 1) 1906b38ff370SJamie Gritton return (EINVAL); 1907b38ff370SJamie Gritton 1908b38ff370SJamie Gritton error = copyinuio(uap->iovp, uap->iovcnt, &auio); 1909b38ff370SJamie Gritton if (error) 1910b38ff370SJamie Gritton return (error); 1911b38ff370SJamie Gritton error = kern_jail_get(td, auio, uap->flags); 1912b38ff370SJamie Gritton if (error == 0) 1913b38ff370SJamie Gritton error = copyout(auio->uio_iov, uap->iovp, 1914b38ff370SJamie Gritton uap->iovcnt * sizeof (struct iovec)); 1915b38ff370SJamie Gritton free(auio, M_IOV); 1916b38ff370SJamie Gritton return (error); 1917b38ff370SJamie Gritton } 1918b38ff370SJamie Gritton 1919b38ff370SJamie Gritton int 1920b38ff370SJamie Gritton kern_jail_get(struct thread *td, struct uio *optuio, int flags) 1921b38ff370SJamie Gritton { 1922672756aaSJamie Gritton struct bool_flags *bf; 1923672756aaSJamie Gritton struct jailsys_flags *jsf; 19240304c731SJamie Gritton struct prison *pr, *mypr; 1925b38ff370SJamie Gritton struct vfsopt *opt; 1926b38ff370SJamie Gritton struct vfsoptlist *opts; 1927b38ff370SJamie Gritton char *errmsg, *name; 1928672756aaSJamie Gritton int error, errmsg_len, errmsg_pos, i, jid, len, locked, pos; 1929672756aaSJamie Gritton unsigned f; 1930b38ff370SJamie Gritton 1931b38ff370SJamie Gritton if (flags & ~JAIL_GET_MASK) 1932b38ff370SJamie Gritton return (EINVAL); 1933b38ff370SJamie Gritton 1934b38ff370SJamie Gritton /* Get the parameter list. */ 1935b38ff370SJamie Gritton error = vfs_buildopts(optuio, &opts); 1936b38ff370SJamie Gritton if (error) 1937b38ff370SJamie Gritton return (error); 1938b38ff370SJamie Gritton errmsg_pos = vfs_getopt_pos(opts, "errmsg"); 19390304c731SJamie Gritton mypr = td->td_ucred->cr_prison; 19401e2a13e6SJamie Gritton 1941b38ff370SJamie Gritton /* 1942b38ff370SJamie Gritton * Find the prison specified by one of: lastjid, jid, name. 1943b38ff370SJamie Gritton */ 1944b38ff370SJamie Gritton sx_slock(&allprison_lock); 1945b38ff370SJamie Gritton error = vfs_copyopt(opts, "lastjid", &jid, sizeof(jid)); 1946b38ff370SJamie Gritton if (error == 0) { 1947b38ff370SJamie Gritton TAILQ_FOREACH(pr, &allprison, pr_list) { 19480304c731SJamie Gritton if (pr->pr_id > jid && prison_ischild(mypr, pr)) { 1949b38ff370SJamie Gritton mtx_lock(&pr->pr_mtx); 1950b38ff370SJamie Gritton if (pr->pr_ref > 0 && 1951b38ff370SJamie Gritton (pr->pr_uref > 0 || (flags & JAIL_DYING))) 1952b38ff370SJamie Gritton break; 1953b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 1954b38ff370SJamie Gritton } 1955b38ff370SJamie Gritton } 1956b38ff370SJamie Gritton if (pr != NULL) 1957b38ff370SJamie Gritton goto found_prison; 1958b38ff370SJamie Gritton error = ENOENT; 1959b38ff370SJamie Gritton vfs_opterror(opts, "no jail after %d", jid); 1960b38ff370SJamie Gritton goto done_unlock_list; 1961b38ff370SJamie Gritton } else if (error != ENOENT) 1962b38ff370SJamie Gritton goto done_unlock_list; 1963b38ff370SJamie Gritton 1964b38ff370SJamie Gritton error = vfs_copyopt(opts, "jid", &jid, sizeof(jid)); 1965b38ff370SJamie Gritton if (error == 0) { 1966b38ff370SJamie Gritton if (jid != 0) { 19670304c731SJamie Gritton pr = prison_find_child(mypr, jid); 1968b38ff370SJamie Gritton if (pr != NULL) { 1969b38ff370SJamie Gritton if (pr->pr_uref == 0 && !(flags & JAIL_DYING)) { 1970b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 1971b38ff370SJamie Gritton error = ENOENT; 1972b38ff370SJamie Gritton vfs_opterror(opts, "jail %d is dying", 1973b38ff370SJamie Gritton jid); 1974b38ff370SJamie Gritton goto done_unlock_list; 1975b38ff370SJamie Gritton } 1976b38ff370SJamie Gritton goto found_prison; 1977b38ff370SJamie Gritton } 1978b38ff370SJamie Gritton error = ENOENT; 1979b38ff370SJamie Gritton vfs_opterror(opts, "jail %d not found", jid); 1980b38ff370SJamie Gritton goto done_unlock_list; 1981b38ff370SJamie Gritton } 1982b38ff370SJamie Gritton } else if (error != ENOENT) 1983b38ff370SJamie Gritton goto done_unlock_list; 1984b38ff370SJamie Gritton 1985b38ff370SJamie Gritton error = vfs_getopt(opts, "name", (void **)&name, &len); 1986b38ff370SJamie Gritton if (error == 0) { 1987b38ff370SJamie Gritton if (len == 0 || name[len - 1] != '\0') { 1988b38ff370SJamie Gritton error = EINVAL; 1989b38ff370SJamie Gritton goto done_unlock_list; 1990b38ff370SJamie Gritton } 19910304c731SJamie Gritton pr = prison_find_name(mypr, name); 1992b38ff370SJamie Gritton if (pr != NULL) { 1993b38ff370SJamie Gritton if (pr->pr_uref == 0 && !(flags & JAIL_DYING)) { 1994b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 1995b38ff370SJamie Gritton error = ENOENT; 1996b38ff370SJamie Gritton vfs_opterror(opts, "jail \"%s\" is dying", 1997b38ff370SJamie Gritton name); 1998b38ff370SJamie Gritton goto done_unlock_list; 1999b38ff370SJamie Gritton } 2000b38ff370SJamie Gritton goto found_prison; 2001b38ff370SJamie Gritton } 2002b38ff370SJamie Gritton error = ENOENT; 2003b38ff370SJamie Gritton vfs_opterror(opts, "jail \"%s\" not found", name); 2004b38ff370SJamie Gritton goto done_unlock_list; 2005b38ff370SJamie Gritton } else if (error != ENOENT) 2006b38ff370SJamie Gritton goto done_unlock_list; 2007b38ff370SJamie Gritton 2008b38ff370SJamie Gritton vfs_opterror(opts, "no jail specified"); 2009b38ff370SJamie Gritton error = ENOENT; 2010b38ff370SJamie Gritton goto done_unlock_list; 2011b38ff370SJamie Gritton 2012b38ff370SJamie Gritton found_prison: 2013b38ff370SJamie Gritton /* Get the parameters of the prison. */ 2014b38ff370SJamie Gritton pr->pr_ref++; 2015b38ff370SJamie Gritton locked = PD_LOCKED; 2016b38ff370SJamie Gritton td->td_retval[0] = pr->pr_id; 2017b38ff370SJamie Gritton error = vfs_setopt(opts, "jid", &pr->pr_id, sizeof(pr->pr_id)); 2018b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 2019b38ff370SJamie Gritton goto done_deref; 20200304c731SJamie Gritton i = (pr->pr_parent == mypr) ? 0 : pr->pr_parent->pr_id; 20210304c731SJamie Gritton error = vfs_setopt(opts, "parent", &i, sizeof(i)); 2022b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 2023b38ff370SJamie Gritton goto done_deref; 20240304c731SJamie Gritton error = vfs_setopts(opts, "name", prison_name(mypr, pr)); 20250304c731SJamie Gritton if (error != 0 && error != ENOENT) 20260304c731SJamie Gritton goto done_deref; 20270304c731SJamie Gritton error = vfs_setopt(opts, "cpuset.id", &pr->pr_cpuset->cs_id, 2028b38ff370SJamie Gritton sizeof(pr->pr_cpuset->cs_id)); 2029b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 2030b38ff370SJamie Gritton goto done_deref; 20310304c731SJamie Gritton error = vfs_setopts(opts, "path", prison_path(mypr, pr)); 2032b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 2033b38ff370SJamie Gritton goto done_deref; 2034b38ff370SJamie Gritton #ifdef INET 2035b38ff370SJamie Gritton error = vfs_setopt_part(opts, "ip4.addr", pr->pr_ip4, 2036b38ff370SJamie Gritton pr->pr_ip4s * sizeof(*pr->pr_ip4)); 2037b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 2038b38ff370SJamie Gritton goto done_deref; 2039b38ff370SJamie Gritton #endif 2040b38ff370SJamie Gritton #ifdef INET6 2041b38ff370SJamie Gritton error = vfs_setopt_part(opts, "ip6.addr", pr->pr_ip6, 2042b38ff370SJamie Gritton pr->pr_ip6s * sizeof(*pr->pr_ip6)); 2043b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 2044b38ff370SJamie Gritton goto done_deref; 2045b38ff370SJamie Gritton #endif 2046b38ff370SJamie Gritton error = vfs_setopt(opts, "securelevel", &pr->pr_securelevel, 2047b38ff370SJamie Gritton sizeof(pr->pr_securelevel)); 2048b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 2049b38ff370SJamie Gritton goto done_deref; 2050b97457e2SJamie Gritton error = vfs_setopt(opts, "children.cur", &pr->pr_childcount, 2051b97457e2SJamie Gritton sizeof(pr->pr_childcount)); 2052b97457e2SJamie Gritton if (error != 0 && error != ENOENT) 2053b97457e2SJamie Gritton goto done_deref; 2054b97457e2SJamie Gritton error = vfs_setopt(opts, "children.max", &pr->pr_childmax, 2055b97457e2SJamie Gritton sizeof(pr->pr_childmax)); 2056b97457e2SJamie Gritton if (error != 0 && error != ENOENT) 2057b97457e2SJamie Gritton goto done_deref; 2058c1f19219SJamie Gritton error = vfs_setopts(opts, "host.hostname", pr->pr_hostname); 2059b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 2060b38ff370SJamie Gritton goto done_deref; 2061c1f19219SJamie Gritton error = vfs_setopts(opts, "host.domainname", pr->pr_domainname); 206276ca6f88SJamie Gritton if (error != 0 && error != ENOENT) 206376ca6f88SJamie Gritton goto done_deref; 2064c1f19219SJamie Gritton error = vfs_setopts(opts, "host.hostuuid", pr->pr_hostuuid); 206576ca6f88SJamie Gritton if (error != 0 && error != ENOENT) 206676ca6f88SJamie Gritton goto done_deref; 2067841c0c7eSNathan Whitehorn #ifdef COMPAT_FREEBSD32 2068a5c1afadSDmitry Chagin if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) { 206976ca6f88SJamie Gritton uint32_t hid32 = pr->pr_hostid; 207076ca6f88SJamie Gritton 207176ca6f88SJamie Gritton error = vfs_setopt(opts, "host.hostid", &hid32, sizeof(hid32)); 207276ca6f88SJamie Gritton } else 207376ca6f88SJamie Gritton #endif 207476ca6f88SJamie Gritton error = vfs_setopt(opts, "host.hostid", &pr->pr_hostid, 207576ca6f88SJamie Gritton sizeof(pr->pr_hostid)); 207676ca6f88SJamie Gritton if (error != 0 && error != ENOENT) 207776ca6f88SJamie Gritton goto done_deref; 20780304c731SJamie Gritton error = vfs_setopt(opts, "enforce_statfs", &pr->pr_enforce_statfs, 20790304c731SJamie Gritton sizeof(pr->pr_enforce_statfs)); 20800304c731SJamie Gritton if (error != 0 && error != ENOENT) 20810304c731SJamie Gritton goto done_deref; 20820cc207a6SMartin Matuska error = vfs_setopt(opts, "devfs_ruleset", &pr->pr_devfs_rsnum, 20830cc207a6SMartin Matuska sizeof(pr->pr_devfs_rsnum)); 20840cc207a6SMartin Matuska if (error != 0 && error != ENOENT) 20850cc207a6SMartin Matuska goto done_deref; 2086672756aaSJamie Gritton for (bf = pr_flag_bool; 2087672756aaSJamie Gritton bf < pr_flag_bool + nitems(pr_flag_bool); 2088672756aaSJamie Gritton bf++) { 2089672756aaSJamie Gritton i = (pr->pr_flags & bf->flag) ? 1 : 0; 2090672756aaSJamie Gritton error = vfs_setopt(opts, bf->name, &i, sizeof(i)); 2091b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 2092b38ff370SJamie Gritton goto done_deref; 2093b38ff370SJamie Gritton i = !i; 2094672756aaSJamie Gritton error = vfs_setopt(opts, bf->noname, &i, sizeof(i)); 2095b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 2096b38ff370SJamie Gritton goto done_deref; 20970304c731SJamie Gritton } 2098672756aaSJamie Gritton for (jsf = pr_flag_jailsys; 2099672756aaSJamie Gritton jsf < pr_flag_jailsys + nitems(pr_flag_jailsys); 2100672756aaSJamie Gritton jsf++) { 2101672756aaSJamie Gritton f = pr->pr_flags & (jsf->disable | jsf->new); 2102672756aaSJamie Gritton i = (f != 0 && f == jsf->disable) ? JAIL_SYS_DISABLE 2103672756aaSJamie Gritton : (f == jsf->new) ? JAIL_SYS_NEW 21047cbf7213SJamie Gritton : JAIL_SYS_INHERIT; 2105672756aaSJamie Gritton error = vfs_setopt(opts, jsf->name, &i, sizeof(i)); 21067cbf7213SJamie Gritton if (error != 0 && error != ENOENT) 21077cbf7213SJamie Gritton goto done_deref; 21087cbf7213SJamie Gritton } 2109672756aaSJamie Gritton for (bf = pr_flag_allow; 21100e5c6bd4SJamie Gritton bf < pr_flag_allow + nitems(pr_flag_allow) && bf->flag != 0; 2111672756aaSJamie Gritton bf++) { 2112672756aaSJamie Gritton i = (pr->pr_allow & bf->flag) ? 1 : 0; 2113672756aaSJamie Gritton error = vfs_setopt(opts, bf->name, &i, sizeof(i)); 21140304c731SJamie Gritton if (error != 0 && error != ENOENT) 21150304c731SJamie Gritton goto done_deref; 21160304c731SJamie Gritton i = !i; 2117672756aaSJamie Gritton error = vfs_setopt(opts, bf->noname, &i, sizeof(i)); 21180304c731SJamie Gritton if (error != 0 && error != ENOENT) 21190304c731SJamie Gritton goto done_deref; 21200304c731SJamie Gritton } 2121b38ff370SJamie Gritton i = (pr->pr_uref == 0); 2122b38ff370SJamie Gritton error = vfs_setopt(opts, "dying", &i, sizeof(i)); 2123b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 2124b38ff370SJamie Gritton goto done_deref; 2125b38ff370SJamie Gritton i = !i; 2126b38ff370SJamie Gritton error = vfs_setopt(opts, "nodying", &i, sizeof(i)); 2127b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 2128b38ff370SJamie Gritton goto done_deref; 2129bd96bd15SIan Lepore error = vfs_setopt(opts, "osreldate", &pr->pr_osreldate, 2130bd96bd15SIan Lepore sizeof(pr->pr_osreldate)); 2131a1a4c1b0SIan Lepore if (error != 0 && error != ENOENT) 2132a1a4c1b0SIan Lepore goto done_deref; 2133a1a4c1b0SIan Lepore error = vfs_setopts(opts, "osrelease", pr->pr_osrelease); 2134a1a4c1b0SIan Lepore if (error != 0 && error != ENOENT) 2135a1a4c1b0SIan Lepore goto done_deref; 2136b38ff370SJamie Gritton 2137b38ff370SJamie Gritton /* Get the module parameters. */ 2138b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 2139b38ff370SJamie Gritton locked = 0; 2140b38ff370SJamie Gritton error = osd_jail_call(pr, PR_METHOD_GET, opts); 2141b38ff370SJamie Gritton if (error) 2142b38ff370SJamie Gritton goto done_deref; 2143b38ff370SJamie Gritton prison_deref(pr, PD_DEREF | PD_LIST_SLOCKED); 2144b38ff370SJamie Gritton 2145b38ff370SJamie Gritton /* By now, all parameters should have been noted. */ 2146b38ff370SJamie Gritton TAILQ_FOREACH(opt, opts, link) { 2147b38ff370SJamie Gritton if (!opt->seen && strcmp(opt->name, "errmsg")) { 2148b38ff370SJamie Gritton error = EINVAL; 2149b38ff370SJamie Gritton vfs_opterror(opts, "unknown parameter: %s", opt->name); 2150b38ff370SJamie Gritton goto done_errmsg; 2151b38ff370SJamie Gritton } 2152b38ff370SJamie Gritton } 2153b38ff370SJamie Gritton 2154b38ff370SJamie Gritton /* Write the fetched parameters back to userspace. */ 2155b38ff370SJamie Gritton error = 0; 2156b38ff370SJamie Gritton TAILQ_FOREACH(opt, opts, link) { 2157b38ff370SJamie Gritton if (opt->pos >= 0 && opt->pos != errmsg_pos) { 2158b38ff370SJamie Gritton pos = 2 * opt->pos + 1; 2159b38ff370SJamie Gritton optuio->uio_iov[pos].iov_len = opt->len; 2160b38ff370SJamie Gritton if (opt->value != NULL) { 2161b38ff370SJamie Gritton if (optuio->uio_segflg == UIO_SYSSPACE) { 2162b38ff370SJamie Gritton bcopy(opt->value, 2163b38ff370SJamie Gritton optuio->uio_iov[pos].iov_base, 2164b38ff370SJamie Gritton opt->len); 2165b38ff370SJamie Gritton } else { 2166b38ff370SJamie Gritton error = copyout(opt->value, 2167b38ff370SJamie Gritton optuio->uio_iov[pos].iov_base, 2168b38ff370SJamie Gritton opt->len); 2169b38ff370SJamie Gritton if (error) 2170b38ff370SJamie Gritton break; 2171b38ff370SJamie Gritton } 2172b38ff370SJamie Gritton } 2173b38ff370SJamie Gritton } 2174b38ff370SJamie Gritton } 2175b38ff370SJamie Gritton goto done_errmsg; 2176b38ff370SJamie Gritton 2177b38ff370SJamie Gritton done_deref: 2178b38ff370SJamie Gritton prison_deref(pr, locked | PD_DEREF | PD_LIST_SLOCKED); 2179b38ff370SJamie Gritton goto done_errmsg; 2180b38ff370SJamie Gritton 2181b38ff370SJamie Gritton done_unlock_list: 2182b38ff370SJamie Gritton sx_sunlock(&allprison_lock); 2183b38ff370SJamie Gritton done_errmsg: 2184b38ff370SJamie Gritton if (error && errmsg_pos >= 0) { 2185b38ff370SJamie Gritton vfs_getopt(opts, "errmsg", (void **)&errmsg, &errmsg_len); 2186b38ff370SJamie Gritton errmsg_pos = 2 * errmsg_pos + 1; 2187b38ff370SJamie Gritton if (errmsg_len > 0) { 2188b38ff370SJamie Gritton if (optuio->uio_segflg == UIO_SYSSPACE) 2189b38ff370SJamie Gritton bcopy(errmsg, 2190b38ff370SJamie Gritton optuio->uio_iov[errmsg_pos].iov_base, 2191b38ff370SJamie Gritton errmsg_len); 2192b38ff370SJamie Gritton else 2193b38ff370SJamie Gritton copyout(errmsg, 2194b38ff370SJamie Gritton optuio->uio_iov[errmsg_pos].iov_base, 2195b38ff370SJamie Gritton errmsg_len); 2196b38ff370SJamie Gritton } 2197b38ff370SJamie Gritton } 2198b38ff370SJamie Gritton vfs_freeopts(opts); 2199b38ff370SJamie Gritton return (error); 2200b38ff370SJamie Gritton } 2201b38ff370SJamie Gritton 22020304c731SJamie Gritton 2203b38ff370SJamie Gritton /* 2204b38ff370SJamie Gritton * struct jail_remove_args { 2205b38ff370SJamie Gritton * int jid; 2206b38ff370SJamie Gritton * }; 2207b38ff370SJamie Gritton */ 2208b38ff370SJamie Gritton int 22098451d0ddSKip Macy sys_jail_remove(struct thread *td, struct jail_remove_args *uap) 2210b38ff370SJamie Gritton { 22110304c731SJamie Gritton struct prison *pr, *cpr, *lpr, *tpr; 22120304c731SJamie Gritton int descend, error; 2213b38ff370SJamie Gritton 2214b38ff370SJamie Gritton error = priv_check(td, PRIV_JAIL_REMOVE); 2215b38ff370SJamie Gritton if (error) 2216b38ff370SJamie Gritton return (error); 2217b38ff370SJamie Gritton 2218b38ff370SJamie Gritton sx_xlock(&allprison_lock); 22190304c731SJamie Gritton pr = prison_find_child(td->td_ucred->cr_prison, uap->jid); 2220b38ff370SJamie Gritton if (pr == NULL) { 2221b38ff370SJamie Gritton sx_xunlock(&allprison_lock); 2222b38ff370SJamie Gritton return (EINVAL); 2223b38ff370SJamie Gritton } 2224b38ff370SJamie Gritton 22250304c731SJamie Gritton /* Remove all descendants of this prison, then remove this prison. */ 22260304c731SJamie Gritton pr->pr_ref++; 22270304c731SJamie Gritton if (!LIST_EMPTY(&pr->pr_children)) { 22280304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 22290304c731SJamie Gritton lpr = NULL; 22300304c731SJamie Gritton FOREACH_PRISON_DESCENDANT(pr, cpr, descend) { 22310304c731SJamie Gritton mtx_lock(&cpr->pr_mtx); 22320304c731SJamie Gritton if (cpr->pr_ref > 0) { 22330304c731SJamie Gritton tpr = cpr; 22340304c731SJamie Gritton cpr->pr_ref++; 22350304c731SJamie Gritton } else { 22360304c731SJamie Gritton /* Already removed - do not do it again. */ 22370304c731SJamie Gritton tpr = NULL; 22380304c731SJamie Gritton } 22390304c731SJamie Gritton mtx_unlock(&cpr->pr_mtx); 22400304c731SJamie Gritton if (lpr != NULL) { 22410304c731SJamie Gritton mtx_lock(&lpr->pr_mtx); 22420304c731SJamie Gritton prison_remove_one(lpr); 22430304c731SJamie Gritton sx_xlock(&allprison_lock); 22440304c731SJamie Gritton } 22450304c731SJamie Gritton lpr = tpr; 22460304c731SJamie Gritton } 22470304c731SJamie Gritton if (lpr != NULL) { 22480304c731SJamie Gritton mtx_lock(&lpr->pr_mtx); 22490304c731SJamie Gritton prison_remove_one(lpr); 22500304c731SJamie Gritton sx_xlock(&allprison_lock); 22510304c731SJamie Gritton } 22520304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 22530304c731SJamie Gritton } 22540304c731SJamie Gritton prison_remove_one(pr); 22550304c731SJamie Gritton return (0); 22560304c731SJamie Gritton } 22570304c731SJamie Gritton 22580304c731SJamie Gritton static void 22590304c731SJamie Gritton prison_remove_one(struct prison *pr) 22600304c731SJamie Gritton { 22610304c731SJamie Gritton struct proc *p; 22620304c731SJamie Gritton int deuref; 22630304c731SJamie Gritton 2264b38ff370SJamie Gritton /* If the prison was persistent, it is not anymore. */ 2265b38ff370SJamie Gritton deuref = 0; 2266b38ff370SJamie Gritton if (pr->pr_flags & PR_PERSIST) { 2267b38ff370SJamie Gritton pr->pr_ref--; 2268b38ff370SJamie Gritton deuref = PD_DEUREF; 2269b38ff370SJamie Gritton pr->pr_flags &= ~PR_PERSIST; 2270b38ff370SJamie Gritton } 2271b38ff370SJamie Gritton 22720304c731SJamie Gritton /* 22730304c731SJamie Gritton * jail_remove added a reference. If that's the only one, remove 22740304c731SJamie Gritton * the prison now. 22750304c731SJamie Gritton */ 22760304c731SJamie Gritton KASSERT(pr->pr_ref > 0, 22770304c731SJamie Gritton ("prison_remove_one removing a dead prison (jid=%d)", pr->pr_id)); 22780304c731SJamie Gritton if (pr->pr_ref == 1) { 2279b38ff370SJamie Gritton prison_deref(pr, 2280b38ff370SJamie Gritton deuref | PD_DEREF | PD_LOCKED | PD_LIST_XLOCKED); 22810304c731SJamie Gritton return; 2282b38ff370SJamie Gritton } 2283b38ff370SJamie Gritton 2284b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 2285b38ff370SJamie Gritton sx_xunlock(&allprison_lock); 2286b38ff370SJamie Gritton /* 2287b38ff370SJamie Gritton * Kill all processes unfortunate enough to be attached to this prison. 2288b38ff370SJamie Gritton */ 2289b38ff370SJamie Gritton sx_slock(&allproc_lock); 22907938a442SBjoern A. Zeeb FOREACH_PROC_IN_SYSTEM(p) { 2291b38ff370SJamie Gritton PROC_LOCK(p); 2292b38ff370SJamie Gritton if (p->p_state != PRS_NEW && p->p_ucred && 2293b38ff370SJamie Gritton p->p_ucred->cr_prison == pr) 22948451d0ddSKip Macy kern_psignal(p, SIGKILL); 2295b38ff370SJamie Gritton PROC_UNLOCK(p); 2296b38ff370SJamie Gritton } 2297b38ff370SJamie Gritton sx_sunlock(&allproc_lock); 22980304c731SJamie Gritton /* Remove the temporary reference added by jail_remove. */ 2299b38ff370SJamie Gritton prison_deref(pr, deuref | PD_DEREF); 230075c13541SPoul-Henning Kamp } 230175c13541SPoul-Henning Kamp 23028571af59SJamie Gritton 2303fd7a8150SMike Barcroft /* 23049ddb7954SMike Barcroft * struct jail_attach_args { 23059ddb7954SMike Barcroft * int jid; 23069ddb7954SMike Barcroft * }; 2307fd7a8150SMike Barcroft */ 2308fd7a8150SMike Barcroft int 23098451d0ddSKip Macy sys_jail_attach(struct thread *td, struct jail_attach_args *uap) 2310fd7a8150SMike Barcroft { 2311b38ff370SJamie Gritton struct prison *pr; 2312b38ff370SJamie Gritton int error; 2313b38ff370SJamie Gritton 2314b38ff370SJamie Gritton error = priv_check(td, PRIV_JAIL_ATTACH); 2315b38ff370SJamie Gritton if (error) 2316b38ff370SJamie Gritton return (error); 2317b38ff370SJamie Gritton 2318ef0ddea3SJamie Gritton /* 2319ef0ddea3SJamie Gritton * Start with exclusive hold on allprison_lock to ensure that a possible 2320ef0ddea3SJamie Gritton * PR_METHOD_REMOVE call isn't concurrent with jail_set or jail_remove. 2321ef0ddea3SJamie Gritton * But then immediately downgrade it since we don't need to stop 2322ef0ddea3SJamie Gritton * readers. 2323ef0ddea3SJamie Gritton */ 2324ef0ddea3SJamie Gritton sx_xlock(&allprison_lock); 2325ef0ddea3SJamie Gritton sx_downgrade(&allprison_lock); 23260304c731SJamie Gritton pr = prison_find_child(td->td_ucred->cr_prison, uap->jid); 2327b38ff370SJamie Gritton if (pr == NULL) { 2328b38ff370SJamie Gritton sx_sunlock(&allprison_lock); 2329b38ff370SJamie Gritton return (EINVAL); 2330b38ff370SJamie Gritton } 2331b38ff370SJamie Gritton 2332b38ff370SJamie Gritton /* 2333b38ff370SJamie Gritton * Do not allow a process to attach to a prison that is not 2334b38ff370SJamie Gritton * considered to be "alive". 2335b38ff370SJamie Gritton */ 2336b38ff370SJamie Gritton if (pr->pr_uref == 0) { 2337b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 2338b38ff370SJamie Gritton sx_sunlock(&allprison_lock); 2339b38ff370SJamie Gritton return (EINVAL); 2340b38ff370SJamie Gritton } 2341b38ff370SJamie Gritton 2342b38ff370SJamie Gritton return (do_jail_attach(td, pr)); 2343b38ff370SJamie Gritton } 2344b38ff370SJamie Gritton 2345b38ff370SJamie Gritton static int 2346b38ff370SJamie Gritton do_jail_attach(struct thread *td, struct prison *pr) 2347b38ff370SJamie Gritton { 2348fd7a8150SMike Barcroft struct proc *p; 2349fd7a8150SMike Barcroft struct ucred *newcred, *oldcred; 23505050aa86SKonstantin Belousov int error; 2351fd7a8150SMike Barcroft 235257f22bd4SJacques Vidrine /* 235357f22bd4SJacques Vidrine * XXX: Note that there is a slight race here if two threads 235457f22bd4SJacques Vidrine * in the same privileged process attempt to attach to two 235557f22bd4SJacques Vidrine * different jails at the same time. It is important for 235657f22bd4SJacques Vidrine * user processes not to do this, or they might end up with 235757f22bd4SJacques Vidrine * a process root from one prison, but attached to the jail 235857f22bd4SJacques Vidrine * of another. 235957f22bd4SJacques Vidrine */ 2360fd7a8150SMike Barcroft pr->pr_ref++; 2361b38ff370SJamie Gritton pr->pr_uref++; 2362fd7a8150SMike Barcroft mtx_unlock(&pr->pr_mtx); 2363b38ff370SJamie Gritton 2364b38ff370SJamie Gritton /* Let modules do whatever they need to prepare for attaching. */ 2365b38ff370SJamie Gritton error = osd_jail_call(pr, PR_METHOD_ATTACH, td); 2366b38ff370SJamie Gritton if (error) { 2367b38ff370SJamie Gritton prison_deref(pr, PD_DEREF | PD_DEUREF | PD_LIST_SLOCKED); 2368b38ff370SJamie Gritton return (error); 2369b38ff370SJamie Gritton } 2370dc68a633SPawel Jakub Dawidek sx_sunlock(&allprison_lock); 2371fd7a8150SMike Barcroft 2372413628a7SBjoern A. Zeeb /* 2373413628a7SBjoern A. Zeeb * Reparent the newly attached process to this jail. 2374413628a7SBjoern A. Zeeb */ 2375b38ff370SJamie Gritton p = td->td_proc; 2376413628a7SBjoern A. Zeeb error = cpuset_setproc_update_set(p, pr->pr_cpuset); 2377413628a7SBjoern A. Zeeb if (error) 2378b38ff370SJamie Gritton goto e_revert_osd; 2379413628a7SBjoern A. Zeeb 2380cb05b60aSAttilio Rao vn_lock(pr->pr_root, LK_EXCLUSIVE | LK_RETRY); 2381fd7a8150SMike Barcroft if ((error = change_dir(pr->pr_root, td)) != 0) 2382fd7a8150SMike Barcroft goto e_unlock; 2383fd7a8150SMike Barcroft #ifdef MAC 238430d239bcSRobert Watson if ((error = mac_vnode_check_chroot(td->td_ucred, pr->pr_root))) 2385fd7a8150SMike Barcroft goto e_unlock; 2386fd7a8150SMike Barcroft #endif 238722db15c0SAttilio Rao VOP_UNLOCK(pr->pr_root, 0); 2388f0725a8eSMateusz Guzik if ((error = pwd_chroot(td, pr->pr_root))) 23895050aa86SKonstantin Belousov goto e_revert_osd; 2390fd7a8150SMike Barcroft 2391fd7a8150SMike Barcroft newcred = crget(); 2392fd7a8150SMike Barcroft PROC_LOCK(p); 23931fb6767dSJamie Gritton oldcred = crcopysafe(p, newcred); 239469c4ee54SJohn Baldwin newcred->cr_prison = pr; 2395daf63fd2SMateusz Guzik proc_set_cred(p, newcred); 23961fb6767dSJamie Gritton setsugid(p); 2397097055e2SEdward Tomasz Napierala #ifdef RACCT 2398097055e2SEdward Tomasz Napierala racct_proc_ucred_changed(p, oldcred, newcred); 2399f87beb93SAndriy Gapon crhold(newcred); 2400f87beb93SAndriy Gapon #endif 2401f87beb93SAndriy Gapon PROC_UNLOCK(p); 2402f87beb93SAndriy Gapon #ifdef RCTL 2403f87beb93SAndriy Gapon rctl_proc_ucred_changed(p, newcred); 2404f87beb93SAndriy Gapon crfree(newcred); 2405097055e2SEdward Tomasz Napierala #endif 24061fb6767dSJamie Gritton prison_deref(oldcred->cr_prison, PD_DEREF | PD_DEUREF); 2407fd7a8150SMike Barcroft crfree(oldcred); 2408fd7a8150SMike Barcroft return (0); 24091fb6767dSJamie Gritton 2410fd7a8150SMike Barcroft e_unlock: 241122db15c0SAttilio Rao VOP_UNLOCK(pr->pr_root, 0); 2412b38ff370SJamie Gritton e_revert_osd: 2413b38ff370SJamie Gritton /* Tell modules this thread is still in its old jail after all. */ 24141fb6767dSJamie Gritton (void)osd_jail_call(td->td_ucred->cr_prison, PR_METHOD_ATTACH, td); 2415b38ff370SJamie Gritton prison_deref(pr, PD_DEREF | PD_DEUREF); 2416fd7a8150SMike Barcroft return (error); 2417fd7a8150SMike Barcroft } 2418fd7a8150SMike Barcroft 24190304c731SJamie Gritton 2420fd7a8150SMike Barcroft /* 2421fd7a8150SMike Barcroft * Returns a locked prison instance, or NULL on failure. 2422fd7a8150SMike Barcroft */ 242354b369c1SPawel Jakub Dawidek struct prison * 2424fd7a8150SMike Barcroft prison_find(int prid) 2425fd7a8150SMike Barcroft { 2426fd7a8150SMike Barcroft struct prison *pr; 2427fd7a8150SMike Barcroft 2428dc68a633SPawel Jakub Dawidek sx_assert(&allprison_lock, SX_LOCKED); 2429b38ff370SJamie Gritton TAILQ_FOREACH(pr, &allprison, pr_list) { 2430fd7a8150SMike Barcroft if (pr->pr_id == prid) { 2431fd7a8150SMike Barcroft mtx_lock(&pr->pr_mtx); 2432b38ff370SJamie Gritton if (pr->pr_ref > 0) 2433fd7a8150SMike Barcroft return (pr); 2434b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 2435fd7a8150SMike Barcroft } 2436fd7a8150SMike Barcroft } 2437fd7a8150SMike Barcroft return (NULL); 2438fd7a8150SMike Barcroft } 2439fd7a8150SMike Barcroft 2440b38ff370SJamie Gritton /* 24410304c731SJamie Gritton * Find a prison that is a descendant of mypr. Returns a locked prison or NULL. 2442b38ff370SJamie Gritton */ 2443b38ff370SJamie Gritton struct prison * 24440304c731SJamie Gritton prison_find_child(struct prison *mypr, int prid) 2445b38ff370SJamie Gritton { 24460304c731SJamie Gritton struct prison *pr; 24470304c731SJamie Gritton int descend; 2448b38ff370SJamie Gritton 2449b38ff370SJamie Gritton sx_assert(&allprison_lock, SX_LOCKED); 24500304c731SJamie Gritton FOREACH_PRISON_DESCENDANT(mypr, pr, descend) { 24510304c731SJamie Gritton if (pr->pr_id == prid) { 24520304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 24530304c731SJamie Gritton if (pr->pr_ref > 0) 24540304c731SJamie Gritton return (pr); 24550304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 24560304c731SJamie Gritton } 24570304c731SJamie Gritton } 24580304c731SJamie Gritton return (NULL); 24590304c731SJamie Gritton } 24600304c731SJamie Gritton 24610304c731SJamie Gritton /* 24620304c731SJamie Gritton * Look for the name relative to mypr. Returns a locked prison or NULL. 24630304c731SJamie Gritton */ 24640304c731SJamie Gritton struct prison * 24650304c731SJamie Gritton prison_find_name(struct prison *mypr, const char *name) 24660304c731SJamie Gritton { 24670304c731SJamie Gritton struct prison *pr, *deadpr; 24680304c731SJamie Gritton size_t mylen; 24690304c731SJamie Gritton int descend; 24700304c731SJamie Gritton 24710304c731SJamie Gritton sx_assert(&allprison_lock, SX_LOCKED); 24720304c731SJamie Gritton mylen = (mypr == &prison0) ? 0 : strlen(mypr->pr_name) + 1; 2473b38ff370SJamie Gritton again: 2474b38ff370SJamie Gritton deadpr = NULL; 24750304c731SJamie Gritton FOREACH_PRISON_DESCENDANT(mypr, pr, descend) { 24760304c731SJamie Gritton if (!strcmp(pr->pr_name + mylen, name)) { 2477b38ff370SJamie Gritton mtx_lock(&pr->pr_mtx); 2478b38ff370SJamie Gritton if (pr->pr_ref > 0) { 2479b38ff370SJamie Gritton if (pr->pr_uref > 0) 2480b38ff370SJamie Gritton return (pr); 2481b38ff370SJamie Gritton deadpr = pr; 2482b38ff370SJamie Gritton } 2483b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 2484b38ff370SJamie Gritton } 2485b38ff370SJamie Gritton } 24860304c731SJamie Gritton /* There was no valid prison - perhaps there was a dying one. */ 2487b38ff370SJamie Gritton if (deadpr != NULL) { 2488b38ff370SJamie Gritton mtx_lock(&deadpr->pr_mtx); 2489b38ff370SJamie Gritton if (deadpr->pr_ref == 0) { 2490b38ff370SJamie Gritton mtx_unlock(&deadpr->pr_mtx); 2491b38ff370SJamie Gritton goto again; 2492b38ff370SJamie Gritton } 2493b38ff370SJamie Gritton } 2494b38ff370SJamie Gritton return (deadpr); 2495b38ff370SJamie Gritton } 2496b38ff370SJamie Gritton 2497b38ff370SJamie Gritton /* 24980304c731SJamie Gritton * See if a prison has the specific flag set. 24990304c731SJamie Gritton */ 25000304c731SJamie Gritton int 25010304c731SJamie Gritton prison_flag(struct ucred *cred, unsigned flag) 25020304c731SJamie Gritton { 25030304c731SJamie Gritton 25040304c731SJamie Gritton /* This is an atomic read, so no locking is necessary. */ 25050304c731SJamie Gritton return (cred->cr_prison->pr_flags & flag); 25060304c731SJamie Gritton } 25070304c731SJamie Gritton 25080304c731SJamie Gritton int 25090304c731SJamie Gritton prison_allow(struct ucred *cred, unsigned flag) 25100304c731SJamie Gritton { 25110304c731SJamie Gritton 25120304c731SJamie Gritton /* This is an atomic read, so no locking is necessary. */ 25130304c731SJamie Gritton return (cred->cr_prison->pr_allow & flag); 25140304c731SJamie Gritton } 25150304c731SJamie Gritton 25160304c731SJamie Gritton /* 2517b38ff370SJamie Gritton * Remove a prison reference. If that was the last reference, remove the 2518b38ff370SJamie Gritton * prison itself - but not in this context in case there are locks held. 2519b38ff370SJamie Gritton */ 252091421ba2SRobert Watson void 25211ba4a712SPawel Jakub Dawidek prison_free_locked(struct prison *pr) 252291421ba2SRobert Watson { 252373d9e52dSJamie Gritton int ref; 252491421ba2SRobert Watson 25251ba4a712SPawel Jakub Dawidek mtx_assert(&pr->pr_mtx, MA_OWNED); 252673d9e52dSJamie Gritton ref = --pr->pr_ref; 252701137630SRobert Watson mtx_unlock(&pr->pr_mtx); 252873d9e52dSJamie Gritton if (ref == 0) 2529c2cda609SPawel Jakub Dawidek taskqueue_enqueue(taskqueue_thread, &pr->pr_task); 2530c2cda609SPawel Jakub Dawidek } 2531c2cda609SPawel Jakub Dawidek 25321ba4a712SPawel Jakub Dawidek void 25331ba4a712SPawel Jakub Dawidek prison_free(struct prison *pr) 25341ba4a712SPawel Jakub Dawidek { 25351ba4a712SPawel Jakub Dawidek 25361ba4a712SPawel Jakub Dawidek mtx_lock(&pr->pr_mtx); 25371ba4a712SPawel Jakub Dawidek prison_free_locked(pr); 25381ba4a712SPawel Jakub Dawidek } 25391ba4a712SPawel Jakub Dawidek 254073d9e52dSJamie Gritton /* 254173d9e52dSJamie Gritton * Complete a call to either prison_free or prison_proc_free. 254273d9e52dSJamie Gritton */ 2543c2cda609SPawel Jakub Dawidek static void 2544c2cda609SPawel Jakub Dawidek prison_complete(void *context, int pending) 2545c2cda609SPawel Jakub Dawidek { 254673d9e52dSJamie Gritton struct prison *pr = context; 2547b38ff370SJamie Gritton 2548ef0ddea3SJamie Gritton sx_xlock(&allprison_lock); 254973d9e52dSJamie Gritton mtx_lock(&pr->pr_mtx); 255073d9e52dSJamie Gritton prison_deref(pr, pr->pr_uref 2551ef0ddea3SJamie Gritton ? PD_DEREF | PD_DEUREF | PD_LOCKED | PD_LIST_XLOCKED 2552ef0ddea3SJamie Gritton : PD_LOCKED | PD_LIST_XLOCKED); 2553b38ff370SJamie Gritton } 2554b38ff370SJamie Gritton 2555b38ff370SJamie Gritton /* 2556b38ff370SJamie Gritton * Remove a prison reference (usually). This internal version assumes no 2557b38ff370SJamie Gritton * mutexes are held, except perhaps the prison itself. If there are no more 2558b38ff370SJamie Gritton * references, release and delist the prison. On completion, the prison lock 2559b38ff370SJamie Gritton * and the allprison lock are both unlocked. 2560b38ff370SJamie Gritton */ 2561b38ff370SJamie Gritton static void 2562b38ff370SJamie Gritton prison_deref(struct prison *pr, int flags) 2563b38ff370SJamie Gritton { 25640304c731SJamie Gritton struct prison *ppr, *tpr; 2565cc5fd8c7SJamie Gritton int ref, lasturef; 2566c2cda609SPawel Jakub Dawidek 2567b38ff370SJamie Gritton if (!(flags & PD_LOCKED)) 2568b38ff370SJamie Gritton mtx_lock(&pr->pr_mtx); 25690304c731SJamie Gritton for (;;) { 2570e6d5cb63SJamie Gritton if (flags & PD_DEUREF) { 257173d9e52dSJamie Gritton KASSERT(pr->pr_uref > 0, 257273d9e52dSJamie Gritton ("prison_deref PD_DEUREF on a dead prison (jid=%d)", 257373d9e52dSJamie Gritton pr->pr_id)); 2574e6d5cb63SJamie Gritton pr->pr_uref--; 2575cc5fd8c7SJamie Gritton lasturef = pr->pr_uref == 0; 2576cc5fd8c7SJamie Gritton if (lasturef) 2577cc5fd8c7SJamie Gritton pr->pr_ref++; 2578e6d5cb63SJamie Gritton KASSERT(prison0.pr_uref != 0, ("prison0 pr_uref=0")); 2579cc5fd8c7SJamie Gritton } else 2580cc5fd8c7SJamie Gritton lasturef = 0; 258173d9e52dSJamie Gritton if (flags & PD_DEREF) { 258273d9e52dSJamie Gritton KASSERT(pr->pr_ref > 0, 258373d9e52dSJamie Gritton ("prison_deref PD_DEREF on a dead prison (jid=%d)", 258473d9e52dSJamie Gritton pr->pr_id)); 2585b38ff370SJamie Gritton pr->pr_ref--; 258673d9e52dSJamie Gritton } 2587cc5fd8c7SJamie Gritton ref = pr->pr_ref; 2588b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 2589cc5fd8c7SJamie Gritton 2590cc5fd8c7SJamie Gritton /* 2591cc5fd8c7SJamie Gritton * Tell the modules if the last user reference was removed 2592cc5fd8c7SJamie Gritton * (even it sticks around in dying state). 2593cc5fd8c7SJamie Gritton */ 2594cc5fd8c7SJamie Gritton if (lasturef) { 2595cc5fd8c7SJamie Gritton if (!(flags & (PD_LIST_SLOCKED | PD_LIST_XLOCKED))) { 2596cc5fd8c7SJamie Gritton sx_xlock(&allprison_lock); 2597cc5fd8c7SJamie Gritton flags |= PD_LIST_XLOCKED; 2598cc5fd8c7SJamie Gritton } 2599cc5fd8c7SJamie Gritton (void)osd_jail_call(pr, PR_METHOD_REMOVE, NULL); 2600cc5fd8c7SJamie Gritton mtx_lock(&pr->pr_mtx); 2601cc5fd8c7SJamie Gritton ref = --pr->pr_ref; 2602cc5fd8c7SJamie Gritton mtx_unlock(&pr->pr_mtx); 2603cc5fd8c7SJamie Gritton } 2604cc5fd8c7SJamie Gritton 2605cc5fd8c7SJamie Gritton /* If the prison still has references, nothing else to do. */ 2606cc5fd8c7SJamie Gritton if (ref > 0) { 2607b38ff370SJamie Gritton if (flags & PD_LIST_SLOCKED) 2608b38ff370SJamie Gritton sx_sunlock(&allprison_lock); 2609b38ff370SJamie Gritton else if (flags & PD_LIST_XLOCKED) 2610b38ff370SJamie Gritton sx_xunlock(&allprison_lock); 2611b38ff370SJamie Gritton return; 2612b38ff370SJamie Gritton } 2613c2cda609SPawel Jakub Dawidek 2614b38ff370SJamie Gritton if (flags & PD_LIST_SLOCKED) { 2615b38ff370SJamie Gritton if (!sx_try_upgrade(&allprison_lock)) { 2616b38ff370SJamie Gritton sx_sunlock(&allprison_lock); 2617c2cda609SPawel Jakub Dawidek sx_xlock(&allprison_lock); 2618b38ff370SJamie Gritton } 2619b38ff370SJamie Gritton } else if (!(flags & PD_LIST_XLOCKED)) 2620b38ff370SJamie Gritton sx_xlock(&allprison_lock); 2621b38ff370SJamie Gritton 2622b38ff370SJamie Gritton TAILQ_REMOVE(&allprison, pr, pr_list); 26230304c731SJamie Gritton LIST_REMOVE(pr, pr_sibling); 26240304c731SJamie Gritton ppr = pr->pr_parent; 26250304c731SJamie Gritton for (tpr = ppr; tpr != NULL; tpr = tpr->pr_parent) 2626b97457e2SJamie Gritton tpr->pr_childcount--; 2627c4884ffaSJamie Gritton sx_xunlock(&allprison_lock); 26281ba4a712SPawel Jakub Dawidek 2629679e1390SJamie Gritton #ifdef VIMAGE 26300cb8b6a9SMarko Zec if (pr->pr_vnet != ppr->pr_vnet) 2631679e1390SJamie Gritton vnet_destroy(pr->pr_vnet); 2632679e1390SJamie Gritton #endif 26335050aa86SKonstantin Belousov if (pr->pr_root != NULL) 2634b3059e09SRobert Watson vrele(pr->pr_root); 2635b3059e09SRobert Watson mtx_destroy(&pr->pr_mtx); 2636413628a7SBjoern A. Zeeb #ifdef INET 2637413628a7SBjoern A. Zeeb free(pr->pr_ip4, M_PRISON); 2638413628a7SBjoern A. Zeeb #endif 2639b38ff370SJamie Gritton #ifdef INET6 2640b38ff370SJamie Gritton free(pr->pr_ip6, M_PRISON); 2641b38ff370SJamie Gritton #endif 2642b38ff370SJamie Gritton if (pr->pr_cpuset != NULL) 2643b38ff370SJamie Gritton cpuset_rel(pr->pr_cpuset); 2644b38ff370SJamie Gritton osd_jail_exit(pr); 2645a7ad07bfSEdward Tomasz Napierala #ifdef RACCT 26464b5c9cf6SEdward Tomasz Napierala if (racct_enable) 2647a7ad07bfSEdward Tomasz Napierala prison_racct_detach(pr); 2648ec125fbbSEdward Tomasz Napierala #endif 26491ede983cSDag-Erling Smørgrav free(pr, M_PRISON); 26500304c731SJamie Gritton 26510304c731SJamie Gritton /* Removing a prison frees a reference on its parent. */ 26520304c731SJamie Gritton pr = ppr; 26530304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 2654e6d5cb63SJamie Gritton flags = PD_DEREF | PD_DEUREF; 26550304c731SJamie Gritton } 2656b3059e09SRobert Watson } 2657b3059e09SRobert Watson 265891421ba2SRobert Watson void 26591ba4a712SPawel Jakub Dawidek prison_hold_locked(struct prison *pr) 26601ba4a712SPawel Jakub Dawidek { 26611ba4a712SPawel Jakub Dawidek 26621ba4a712SPawel Jakub Dawidek mtx_assert(&pr->pr_mtx, MA_OWNED); 26631ba4a712SPawel Jakub Dawidek KASSERT(pr->pr_ref > 0, 266436b41cc3SBjoern A. Zeeb ("Trying to hold dead prison %p (jid=%d).", pr, pr->pr_id)); 26651ba4a712SPawel Jakub Dawidek pr->pr_ref++; 26661ba4a712SPawel Jakub Dawidek } 26671ba4a712SPawel Jakub Dawidek 26681ba4a712SPawel Jakub Dawidek void 266991421ba2SRobert Watson prison_hold(struct prison *pr) 267091421ba2SRobert Watson { 267191421ba2SRobert Watson 267201137630SRobert Watson mtx_lock(&pr->pr_mtx); 26731ba4a712SPawel Jakub Dawidek prison_hold_locked(pr); 267401137630SRobert Watson mtx_unlock(&pr->pr_mtx); 267501137630SRobert Watson } 267601137630SRobert Watson 2677413628a7SBjoern A. Zeeb void 2678413628a7SBjoern A. Zeeb prison_proc_hold(struct prison *pr) 267901137630SRobert Watson { 268001137630SRobert Watson 2681413628a7SBjoern A. Zeeb mtx_lock(&pr->pr_mtx); 2682b38ff370SJamie Gritton KASSERT(pr->pr_uref > 0, 2683b38ff370SJamie Gritton ("Cannot add a process to a non-alive prison (jid=%d)", pr->pr_id)); 2684b38ff370SJamie Gritton pr->pr_uref++; 2685413628a7SBjoern A. Zeeb mtx_unlock(&pr->pr_mtx); 268675c13541SPoul-Henning Kamp } 268775c13541SPoul-Henning Kamp 268875c13541SPoul-Henning Kamp void 2689413628a7SBjoern A. Zeeb prison_proc_free(struct prison *pr) 269075c13541SPoul-Henning Kamp { 2691413628a7SBjoern A. Zeeb 2692413628a7SBjoern A. Zeeb mtx_lock(&pr->pr_mtx); 2693b38ff370SJamie Gritton KASSERT(pr->pr_uref > 0, 2694b38ff370SJamie Gritton ("Trying to kill a process in a dead prison (jid=%d)", pr->pr_id)); 269573d9e52dSJamie Gritton if (pr->pr_uref > 1) 269673d9e52dSJamie Gritton pr->pr_uref--; 269773d9e52dSJamie Gritton else { 269873d9e52dSJamie Gritton /* 269973d9e52dSJamie Gritton * Don't remove the last user reference in this context, which 270073d9e52dSJamie Gritton * is expected to be a process that is not only locked, but 270173d9e52dSJamie Gritton * also half dead. 270273d9e52dSJamie Gritton */ 270373d9e52dSJamie Gritton pr->pr_ref++; 270473d9e52dSJamie Gritton mtx_unlock(&pr->pr_mtx); 270573d9e52dSJamie Gritton taskqueue_enqueue(taskqueue_thread, &pr->pr_task); 270673d9e52dSJamie Gritton return; 270773d9e52dSJamie Gritton } 270873d9e52dSJamie Gritton mtx_unlock(&pr->pr_mtx); 2709413628a7SBjoern A. Zeeb } 2710413628a7SBjoern A. Zeeb 2711413628a7SBjoern A. Zeeb /* 2712ca04ba64SJamie Gritton * Check if a jail supports the given address family. 2713ca04ba64SJamie Gritton * 2714ca04ba64SJamie Gritton * Returns 0 if not jailed or the address family is supported, EAFNOSUPPORT 2715ca04ba64SJamie Gritton * if not. 2716ca04ba64SJamie Gritton */ 2717ca04ba64SJamie Gritton int 2718ca04ba64SJamie Gritton prison_check_af(struct ucred *cred, int af) 2719ca04ba64SJamie Gritton { 27200304c731SJamie Gritton struct prison *pr; 2721ca04ba64SJamie Gritton int error; 2722ca04ba64SJamie Gritton 2723ca04ba64SJamie Gritton KASSERT(cred != NULL, ("%s: cred is NULL", __func__)); 2724ca04ba64SJamie Gritton 27250304c731SJamie Gritton pr = cred->cr_prison; 2726499650a0SJamie Gritton #ifdef VIMAGE 27276bb79563SJamie Gritton /* Prisons with their own network stack are not limited. */ 2728de0bd6f7SBjoern A. Zeeb if (prison_owns_vnet(cred)) 27296bb79563SJamie Gritton return (0); 2730499650a0SJamie Gritton #endif 27316bb79563SJamie Gritton 2732ca04ba64SJamie Gritton error = 0; 2733ca04ba64SJamie Gritton switch (af) 2734ca04ba64SJamie Gritton { 2735ca04ba64SJamie Gritton #ifdef INET 2736ca04ba64SJamie Gritton case AF_INET: 27370304c731SJamie Gritton if (pr->pr_flags & PR_IP4) 27380304c731SJamie Gritton { 27390304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 27400304c731SJamie Gritton if ((pr->pr_flags & PR_IP4) && pr->pr_ip4 == NULL) 2741ca04ba64SJamie Gritton error = EAFNOSUPPORT; 27420304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 27430304c731SJamie Gritton } 2744ca04ba64SJamie Gritton break; 2745ca04ba64SJamie Gritton #endif 2746ca04ba64SJamie Gritton #ifdef INET6 2747ca04ba64SJamie Gritton case AF_INET6: 27480304c731SJamie Gritton if (pr->pr_flags & PR_IP6) 27490304c731SJamie Gritton { 27500304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 27510304c731SJamie Gritton if ((pr->pr_flags & PR_IP6) && pr->pr_ip6 == NULL) 2752ca04ba64SJamie Gritton error = EAFNOSUPPORT; 27530304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 27540304c731SJamie Gritton } 2755ca04ba64SJamie Gritton break; 2756ca04ba64SJamie Gritton #endif 2757ca04ba64SJamie Gritton case AF_LOCAL: 2758ca04ba64SJamie Gritton case AF_ROUTE: 2759ca04ba64SJamie Gritton break; 2760ca04ba64SJamie Gritton default: 27610304c731SJamie Gritton if (!(pr->pr_allow & PR_ALLOW_SOCKET_AF)) 2762ca04ba64SJamie Gritton error = EAFNOSUPPORT; 2763ca04ba64SJamie Gritton } 2764ca04ba64SJamie Gritton return (error); 2765ca04ba64SJamie Gritton } 2766ca04ba64SJamie Gritton 2767ca04ba64SJamie Gritton /* 2768413628a7SBjoern A. Zeeb * Check if given address belongs to the jail referenced by cred (wrapper to 2769413628a7SBjoern A. Zeeb * prison_check_ip[46]). 2770413628a7SBjoern A. Zeeb * 27710304c731SJamie Gritton * Returns 0 if jail doesn't restrict the address family or if address belongs 27720304c731SJamie Gritton * to jail, EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if 27730304c731SJamie Gritton * the jail doesn't allow the address family. IPv4 Address passed in in NBO. 2774413628a7SBjoern A. Zeeb */ 2775413628a7SBjoern A. Zeeb int 277691421ba2SRobert Watson prison_if(struct ucred *cred, struct sockaddr *sa) 277775c13541SPoul-Henning Kamp { 2778413628a7SBjoern A. Zeeb #ifdef INET 27799ddb7954SMike Barcroft struct sockaddr_in *sai; 2780413628a7SBjoern A. Zeeb #endif 2781413628a7SBjoern A. Zeeb #ifdef INET6 2782413628a7SBjoern A. Zeeb struct sockaddr_in6 *sai6; 2783413628a7SBjoern A. Zeeb #endif 2784b89e82ddSJamie Gritton int error; 278575c13541SPoul-Henning Kamp 2786413628a7SBjoern A. Zeeb KASSERT(cred != NULL, ("%s: cred is NULL", __func__)); 2787413628a7SBjoern A. Zeeb KASSERT(sa != NULL, ("%s: sa is NULL", __func__)); 2788413628a7SBjoern A. Zeeb 2789de0bd6f7SBjoern A. Zeeb #ifdef VIMAGE 2790de0bd6f7SBjoern A. Zeeb if (prison_owns_vnet(cred)) 2791de0bd6f7SBjoern A. Zeeb return (0); 2792de0bd6f7SBjoern A. Zeeb #endif 2793de0bd6f7SBjoern A. Zeeb 2794b89e82ddSJamie Gritton error = 0; 2795413628a7SBjoern A. Zeeb switch (sa->sa_family) 2796413628a7SBjoern A. Zeeb { 2797413628a7SBjoern A. Zeeb #ifdef INET 2798413628a7SBjoern A. Zeeb case AF_INET: 27999ddb7954SMike Barcroft sai = (struct sockaddr_in *)sa; 2800b89e82ddSJamie Gritton error = prison_check_ip4(cred, &sai->sin_addr); 2801413628a7SBjoern A. Zeeb break; 2802413628a7SBjoern A. Zeeb #endif 2803413628a7SBjoern A. Zeeb #ifdef INET6 2804413628a7SBjoern A. Zeeb case AF_INET6: 2805413628a7SBjoern A. Zeeb sai6 = (struct sockaddr_in6 *)sa; 2806b89e82ddSJamie Gritton error = prison_check_ip6(cred, &sai6->sin6_addr); 2807413628a7SBjoern A. Zeeb break; 2808413628a7SBjoern A. Zeeb #endif 2809413628a7SBjoern A. Zeeb default: 28100304c731SJamie Gritton if (!(cred->cr_prison->pr_allow & PR_ALLOW_SOCKET_AF)) 2811b89e82ddSJamie Gritton error = EAFNOSUPPORT; 2812413628a7SBjoern A. Zeeb } 2813b89e82ddSJamie Gritton return (error); 281475c13541SPoul-Henning Kamp } 281591421ba2SRobert Watson 281691421ba2SRobert Watson /* 281791421ba2SRobert Watson * Return 0 if jails permit p1 to frob p2, otherwise ESRCH. 281891421ba2SRobert Watson */ 281991421ba2SRobert Watson int 28209ddb7954SMike Barcroft prison_check(struct ucred *cred1, struct ucred *cred2) 282191421ba2SRobert Watson { 282291421ba2SRobert Watson 28230304c731SJamie Gritton return ((cred1->cr_prison == cred2->cr_prison || 28240304c731SJamie Gritton prison_ischild(cred1->cr_prison, cred2->cr_prison)) ? 0 : ESRCH); 28250304c731SJamie Gritton } 282691421ba2SRobert Watson 28270304c731SJamie Gritton /* 28280304c731SJamie Gritton * Return 1 if p2 is a child of p1, otherwise 0. 28290304c731SJamie Gritton */ 28300304c731SJamie Gritton int 28310304c731SJamie Gritton prison_ischild(struct prison *pr1, struct prison *pr2) 28320304c731SJamie Gritton { 28330304c731SJamie Gritton 28340304c731SJamie Gritton for (pr2 = pr2->pr_parent; pr2 != NULL; pr2 = pr2->pr_parent) 28350304c731SJamie Gritton if (pr1 == pr2) 28360304c731SJamie Gritton return (1); 283791421ba2SRobert Watson return (0); 283891421ba2SRobert Watson } 283991421ba2SRobert Watson 284091421ba2SRobert Watson /* 284191421ba2SRobert Watson * Return 1 if the passed credential is in a jail, otherwise 0. 284291421ba2SRobert Watson */ 284391421ba2SRobert Watson int 28449ddb7954SMike Barcroft jailed(struct ucred *cred) 284591421ba2SRobert Watson { 284691421ba2SRobert Watson 28470304c731SJamie Gritton return (cred->cr_prison != &prison0); 284891421ba2SRobert Watson } 28499484d0c0SRobert Drehmel 28509484d0c0SRobert Drehmel /* 2851de0bd6f7SBjoern A. Zeeb * Return 1 if the passed credential is in a jail and that jail does not 2852de0bd6f7SBjoern A. Zeeb * have its own virtual network stack, otherwise 0. 2853de0bd6f7SBjoern A. Zeeb */ 2854de0bd6f7SBjoern A. Zeeb int 2855de0bd6f7SBjoern A. Zeeb jailed_without_vnet(struct ucred *cred) 2856de0bd6f7SBjoern A. Zeeb { 2857de0bd6f7SBjoern A. Zeeb 2858de0bd6f7SBjoern A. Zeeb if (!jailed(cred)) 2859de0bd6f7SBjoern A. Zeeb return (0); 2860de0bd6f7SBjoern A. Zeeb #ifdef VIMAGE 2861de0bd6f7SBjoern A. Zeeb if (prison_owns_vnet(cred)) 2862de0bd6f7SBjoern A. Zeeb return (0); 2863de0bd6f7SBjoern A. Zeeb #endif 2864de0bd6f7SBjoern A. Zeeb 2865de0bd6f7SBjoern A. Zeeb return (1); 2866de0bd6f7SBjoern A. Zeeb } 2867de0bd6f7SBjoern A. Zeeb 2868de0bd6f7SBjoern A. Zeeb /* 28697455b100SJamie Gritton * Return the correct hostname (domainname, et al) for the passed credential. 28709484d0c0SRobert Drehmel */ 2871ad1ff099SRobert Drehmel void 28729ddb7954SMike Barcroft getcredhostname(struct ucred *cred, char *buf, size_t size) 28739484d0c0SRobert Drehmel { 287476ca6f88SJamie Gritton struct prison *pr; 28759484d0c0SRobert Drehmel 28767455b100SJamie Gritton /* 28777455b100SJamie Gritton * A NULL credential can be used to shortcut to the physical 28787455b100SJamie Gritton * system's hostname. 28797455b100SJamie Gritton */ 288076ca6f88SJamie Gritton pr = (cred != NULL) ? cred->cr_prison : &prison0; 288176ca6f88SJamie Gritton mtx_lock(&pr->pr_mtx); 2882c1f19219SJamie Gritton strlcpy(buf, pr->pr_hostname, size); 288376ca6f88SJamie Gritton mtx_unlock(&pr->pr_mtx); 28849484d0c0SRobert Drehmel } 2885fd7a8150SMike Barcroft 28867455b100SJamie Gritton void 28877455b100SJamie Gritton getcreddomainname(struct ucred *cred, char *buf, size_t size) 28887455b100SJamie Gritton { 28897455b100SJamie Gritton 28907455b100SJamie Gritton mtx_lock(&cred->cr_prison->pr_mtx); 2891c1f19219SJamie Gritton strlcpy(buf, cred->cr_prison->pr_domainname, size); 28927455b100SJamie Gritton mtx_unlock(&cred->cr_prison->pr_mtx); 28937455b100SJamie Gritton } 28947455b100SJamie Gritton 28957455b100SJamie Gritton void 28967455b100SJamie Gritton getcredhostuuid(struct ucred *cred, char *buf, size_t size) 28977455b100SJamie Gritton { 28987455b100SJamie Gritton 28997455b100SJamie Gritton mtx_lock(&cred->cr_prison->pr_mtx); 2900c1f19219SJamie Gritton strlcpy(buf, cred->cr_prison->pr_hostuuid, size); 29017455b100SJamie Gritton mtx_unlock(&cred->cr_prison->pr_mtx); 29027455b100SJamie Gritton } 29037455b100SJamie Gritton 29047455b100SJamie Gritton void 29057455b100SJamie Gritton getcredhostid(struct ucred *cred, unsigned long *hostid) 29067455b100SJamie Gritton { 29077455b100SJamie Gritton 29087455b100SJamie Gritton mtx_lock(&cred->cr_prison->pr_mtx); 29097455b100SJamie Gritton *hostid = cred->cr_prison->pr_hostid; 29107455b100SJamie Gritton mtx_unlock(&cred->cr_prison->pr_mtx); 29117455b100SJamie Gritton } 29127455b100SJamie Gritton 2913eb79e1c7SBjoern A. Zeeb #ifdef VIMAGE 2914eb79e1c7SBjoern A. Zeeb /* 2915eb79e1c7SBjoern A. Zeeb * Determine whether the prison represented by cred owns 2916eb79e1c7SBjoern A. Zeeb * its vnet rather than having it inherited. 2917eb79e1c7SBjoern A. Zeeb * 2918eb79e1c7SBjoern A. Zeeb * Returns 1 in case the prison owns the vnet, 0 otherwise. 2919eb79e1c7SBjoern A. Zeeb */ 2920eb79e1c7SBjoern A. Zeeb int 2921eb79e1c7SBjoern A. Zeeb prison_owns_vnet(struct ucred *cred) 2922eb79e1c7SBjoern A. Zeeb { 2923eb79e1c7SBjoern A. Zeeb 2924eb79e1c7SBjoern A. Zeeb /* 2925eb79e1c7SBjoern A. Zeeb * vnets cannot be added/removed after jail creation, 2926eb79e1c7SBjoern A. Zeeb * so no need to lock here. 2927eb79e1c7SBjoern A. Zeeb */ 2928eb79e1c7SBjoern A. Zeeb return (cred->cr_prison->pr_flags & PR_VNET ? 1 : 0); 2929eb79e1c7SBjoern A. Zeeb } 2930eb79e1c7SBjoern A. Zeeb #endif 2931eb79e1c7SBjoern A. Zeeb 2932f08df373SRobert Watson /* 2933820a0de9SPawel Jakub Dawidek * Determine whether the subject represented by cred can "see" 2934820a0de9SPawel Jakub Dawidek * status of a mount point. 2935820a0de9SPawel Jakub Dawidek * Returns: 0 for permitted, ENOENT otherwise. 2936820a0de9SPawel Jakub Dawidek * XXX: This function should be called cr_canseemount() and should be 2937820a0de9SPawel Jakub Dawidek * placed in kern_prot.c. 2938f08df373SRobert Watson */ 2939f08df373SRobert Watson int 2940820a0de9SPawel Jakub Dawidek prison_canseemount(struct ucred *cred, struct mount *mp) 2941f08df373SRobert Watson { 2942820a0de9SPawel Jakub Dawidek struct prison *pr; 2943820a0de9SPawel Jakub Dawidek struct statfs *sp; 2944820a0de9SPawel Jakub Dawidek size_t len; 2945f08df373SRobert Watson 2946820a0de9SPawel Jakub Dawidek pr = cred->cr_prison; 29470304c731SJamie Gritton if (pr->pr_enforce_statfs == 0) 29480304c731SJamie Gritton return (0); 2949820a0de9SPawel Jakub Dawidek if (pr->pr_root->v_mount == mp) 2950820a0de9SPawel Jakub Dawidek return (0); 29510304c731SJamie Gritton if (pr->pr_enforce_statfs == 2) 2952820a0de9SPawel Jakub Dawidek return (ENOENT); 2953820a0de9SPawel Jakub Dawidek /* 2954820a0de9SPawel Jakub Dawidek * If jail's chroot directory is set to "/" we should be able to see 2955820a0de9SPawel Jakub Dawidek * all mount-points from inside a jail. 2956820a0de9SPawel Jakub Dawidek * This is ugly check, but this is the only situation when jail's 2957820a0de9SPawel Jakub Dawidek * directory ends with '/'. 2958820a0de9SPawel Jakub Dawidek */ 2959820a0de9SPawel Jakub Dawidek if (strcmp(pr->pr_path, "/") == 0) 2960820a0de9SPawel Jakub Dawidek return (0); 2961820a0de9SPawel Jakub Dawidek len = strlen(pr->pr_path); 2962820a0de9SPawel Jakub Dawidek sp = &mp->mnt_stat; 2963820a0de9SPawel Jakub Dawidek if (strncmp(pr->pr_path, sp->f_mntonname, len) != 0) 2964820a0de9SPawel Jakub Dawidek return (ENOENT); 2965820a0de9SPawel Jakub Dawidek /* 2966820a0de9SPawel Jakub Dawidek * Be sure that we don't have situation where jail's root directory 2967820a0de9SPawel Jakub Dawidek * is "/some/path" and mount point is "/some/pathpath". 2968820a0de9SPawel Jakub Dawidek */ 2969820a0de9SPawel Jakub Dawidek if (sp->f_mntonname[len] != '\0' && sp->f_mntonname[len] != '/') 2970820a0de9SPawel Jakub Dawidek return (ENOENT); 2971f08df373SRobert Watson return (0); 2972f08df373SRobert Watson } 2973820a0de9SPawel Jakub Dawidek 2974820a0de9SPawel Jakub Dawidek void 2975820a0de9SPawel Jakub Dawidek prison_enforce_statfs(struct ucred *cred, struct mount *mp, struct statfs *sp) 2976820a0de9SPawel Jakub Dawidek { 2977820a0de9SPawel Jakub Dawidek char jpath[MAXPATHLEN]; 2978820a0de9SPawel Jakub Dawidek struct prison *pr; 2979820a0de9SPawel Jakub Dawidek size_t len; 2980820a0de9SPawel Jakub Dawidek 2981820a0de9SPawel Jakub Dawidek pr = cred->cr_prison; 29820304c731SJamie Gritton if (pr->pr_enforce_statfs == 0) 29830304c731SJamie Gritton return; 2984820a0de9SPawel Jakub Dawidek if (prison_canseemount(cred, mp) != 0) { 2985820a0de9SPawel Jakub Dawidek bzero(sp->f_mntonname, sizeof(sp->f_mntonname)); 2986820a0de9SPawel Jakub Dawidek strlcpy(sp->f_mntonname, "[restricted]", 2987820a0de9SPawel Jakub Dawidek sizeof(sp->f_mntonname)); 2988820a0de9SPawel Jakub Dawidek return; 2989820a0de9SPawel Jakub Dawidek } 2990820a0de9SPawel Jakub Dawidek if (pr->pr_root->v_mount == mp) { 2991820a0de9SPawel Jakub Dawidek /* 2992820a0de9SPawel Jakub Dawidek * Clear current buffer data, so we are sure nothing from 2993820a0de9SPawel Jakub Dawidek * the valid path left there. 2994820a0de9SPawel Jakub Dawidek */ 2995820a0de9SPawel Jakub Dawidek bzero(sp->f_mntonname, sizeof(sp->f_mntonname)); 2996820a0de9SPawel Jakub Dawidek *sp->f_mntonname = '/'; 2997820a0de9SPawel Jakub Dawidek return; 2998820a0de9SPawel Jakub Dawidek } 2999820a0de9SPawel Jakub Dawidek /* 3000820a0de9SPawel Jakub Dawidek * If jail's chroot directory is set to "/" we should be able to see 3001820a0de9SPawel Jakub Dawidek * all mount-points from inside a jail. 3002820a0de9SPawel Jakub Dawidek */ 3003820a0de9SPawel Jakub Dawidek if (strcmp(pr->pr_path, "/") == 0) 3004820a0de9SPawel Jakub Dawidek return; 3005820a0de9SPawel Jakub Dawidek len = strlen(pr->pr_path); 3006820a0de9SPawel Jakub Dawidek strlcpy(jpath, sp->f_mntonname + len, sizeof(jpath)); 3007820a0de9SPawel Jakub Dawidek /* 3008820a0de9SPawel Jakub Dawidek * Clear current buffer data, so we are sure nothing from 3009820a0de9SPawel Jakub Dawidek * the valid path left there. 3010820a0de9SPawel Jakub Dawidek */ 3011820a0de9SPawel Jakub Dawidek bzero(sp->f_mntonname, sizeof(sp->f_mntonname)); 3012820a0de9SPawel Jakub Dawidek if (*jpath == '\0') { 3013820a0de9SPawel Jakub Dawidek /* Should never happen. */ 3014820a0de9SPawel Jakub Dawidek *sp->f_mntonname = '/'; 3015820a0de9SPawel Jakub Dawidek } else { 3016820a0de9SPawel Jakub Dawidek strlcpy(sp->f_mntonname, jpath, sizeof(sp->f_mntonname)); 3017820a0de9SPawel Jakub Dawidek } 3018f08df373SRobert Watson } 3019f08df373SRobert Watson 3020800c9408SRobert Watson /* 3021800c9408SRobert Watson * Check with permission for a specific privilege is granted within jail. We 3022800c9408SRobert Watson * have a specific list of accepted privileges; the rest are denied. 3023800c9408SRobert Watson */ 3024800c9408SRobert Watson int 3025800c9408SRobert Watson prison_priv_check(struct ucred *cred, int priv) 3026800c9408SRobert Watson { 3027800c9408SRobert Watson 3028800c9408SRobert Watson if (!jailed(cred)) 3029800c9408SRobert Watson return (0); 3030800c9408SRobert Watson 30316bb79563SJamie Gritton #ifdef VIMAGE 30326bb79563SJamie Gritton /* 30336bb79563SJamie Gritton * Privileges specific to prisons with a virtual network stack. 30346bb79563SJamie Gritton * There might be a duplicate entry here in case the privilege 30356bb79563SJamie Gritton * is only granted conditionally in the legacy jail case. 30366bb79563SJamie Gritton */ 30376bb79563SJamie Gritton switch (priv) { 30386bb79563SJamie Gritton #ifdef notyet 30396bb79563SJamie Gritton /* 30406bb79563SJamie Gritton * NFS-specific privileges. 30416bb79563SJamie Gritton */ 30426bb79563SJamie Gritton case PRIV_NFS_DAEMON: 30436bb79563SJamie Gritton case PRIV_NFS_LOCKD: 30446bb79563SJamie Gritton #endif 30456bb79563SJamie Gritton /* 30466bb79563SJamie Gritton * Network stack privileges. 30476bb79563SJamie Gritton */ 30486bb79563SJamie Gritton case PRIV_NET_BRIDGE: 30496bb79563SJamie Gritton case PRIV_NET_GRE: 30506bb79563SJamie Gritton case PRIV_NET_BPF: 30516bb79563SJamie Gritton case PRIV_NET_RAW: /* Dup, cond. in legacy jail case. */ 30526bb79563SJamie Gritton case PRIV_NET_ROUTE: 30536bb79563SJamie Gritton case PRIV_NET_TAP: 30546bb79563SJamie Gritton case PRIV_NET_SETIFMTU: 30556bb79563SJamie Gritton case PRIV_NET_SETIFFLAGS: 30566bb79563SJamie Gritton case PRIV_NET_SETIFCAP: 3057215940b3SXin LI case PRIV_NET_SETIFDESCR: 30586bb79563SJamie Gritton case PRIV_NET_SETIFNAME : 30596bb79563SJamie Gritton case PRIV_NET_SETIFMETRIC: 30606bb79563SJamie Gritton case PRIV_NET_SETIFPHYS: 30616bb79563SJamie Gritton case PRIV_NET_SETIFMAC: 30626bb79563SJamie Gritton case PRIV_NET_ADDMULTI: 30636bb79563SJamie Gritton case PRIV_NET_DELMULTI: 30646bb79563SJamie Gritton case PRIV_NET_HWIOCTL: 30656bb79563SJamie Gritton case PRIV_NET_SETLLADDR: 30666bb79563SJamie Gritton case PRIV_NET_ADDIFGROUP: 30676bb79563SJamie Gritton case PRIV_NET_DELIFGROUP: 30686bb79563SJamie Gritton case PRIV_NET_IFCREATE: 30696bb79563SJamie Gritton case PRIV_NET_IFDESTROY: 30706bb79563SJamie Gritton case PRIV_NET_ADDIFADDR: 30716bb79563SJamie Gritton case PRIV_NET_DELIFADDR: 30726bb79563SJamie Gritton case PRIV_NET_LAGG: 30736bb79563SJamie Gritton case PRIV_NET_GIF: 30746bb79563SJamie Gritton case PRIV_NET_SETIFVNET: 307535fd7bc0SBjoern A. Zeeb case PRIV_NET_SETIFFIB: 30766bb79563SJamie Gritton 30776bb79563SJamie Gritton /* 30786bb79563SJamie Gritton * 802.11-related privileges. 30796bb79563SJamie Gritton */ 30806bb79563SJamie Gritton case PRIV_NET80211_GETKEY: 30816bb79563SJamie Gritton #ifdef notyet 30826bb79563SJamie Gritton case PRIV_NET80211_MANAGE: /* XXX-BZ discuss with sam@ */ 30836bb79563SJamie Gritton #endif 30846bb79563SJamie Gritton 30856bb79563SJamie Gritton #ifdef notyet 30866bb79563SJamie Gritton /* 30876bb79563SJamie Gritton * ATM privileges. 30886bb79563SJamie Gritton */ 30896bb79563SJamie Gritton case PRIV_NETATM_CFG: 30906bb79563SJamie Gritton case PRIV_NETATM_ADD: 30916bb79563SJamie Gritton case PRIV_NETATM_DEL: 30926bb79563SJamie Gritton case PRIV_NETATM_SET: 30936bb79563SJamie Gritton 30946bb79563SJamie Gritton /* 30956bb79563SJamie Gritton * Bluetooth privileges. 30966bb79563SJamie Gritton */ 30976bb79563SJamie Gritton case PRIV_NETBLUETOOTH_RAW: 30986bb79563SJamie Gritton #endif 30996bb79563SJamie Gritton 31006bb79563SJamie Gritton /* 31016bb79563SJamie Gritton * Netgraph and netgraph module privileges. 31026bb79563SJamie Gritton */ 31036bb79563SJamie Gritton case PRIV_NETGRAPH_CONTROL: 31046bb79563SJamie Gritton #ifdef notyet 31056bb79563SJamie Gritton case PRIV_NETGRAPH_TTY: 31066bb79563SJamie Gritton #endif 31076bb79563SJamie Gritton 31086bb79563SJamie Gritton /* 31096bb79563SJamie Gritton * IPv4 and IPv6 privileges. 31106bb79563SJamie Gritton */ 31116bb79563SJamie Gritton case PRIV_NETINET_IPFW: 31126bb79563SJamie Gritton case PRIV_NETINET_DIVERT: 31136bb79563SJamie Gritton case PRIV_NETINET_PF: 31146bb79563SJamie Gritton case PRIV_NETINET_DUMMYNET: 31156bb79563SJamie Gritton case PRIV_NETINET_CARP: 31166bb79563SJamie Gritton case PRIV_NETINET_MROUTE: 31176bb79563SJamie Gritton case PRIV_NETINET_RAW: 31186bb79563SJamie Gritton case PRIV_NETINET_ADDRCTRL6: 31196bb79563SJamie Gritton case PRIV_NETINET_ND6: 31206bb79563SJamie Gritton case PRIV_NETINET_SCOPE6: 31216bb79563SJamie Gritton case PRIV_NETINET_ALIFETIME6: 31226bb79563SJamie Gritton case PRIV_NETINET_IPSEC: 31236bb79563SJamie Gritton case PRIV_NETINET_BINDANY: 31246bb79563SJamie Gritton 31256bb79563SJamie Gritton #ifdef notyet 31266bb79563SJamie Gritton /* 31276bb79563SJamie Gritton * NCP privileges. 31286bb79563SJamie Gritton */ 31296bb79563SJamie Gritton case PRIV_NETNCP: 31306bb79563SJamie Gritton 31316bb79563SJamie Gritton /* 31326bb79563SJamie Gritton * SMB privileges. 31336bb79563SJamie Gritton */ 31346bb79563SJamie Gritton case PRIV_NETSMB: 31356bb79563SJamie Gritton #endif 31366bb79563SJamie Gritton 31376bb79563SJamie Gritton /* 31386bb79563SJamie Gritton * No default: or deny here. 31396bb79563SJamie Gritton * In case of no permit fall through to next switch(). 31406bb79563SJamie Gritton */ 31416bb79563SJamie Gritton if (cred->cr_prison->pr_flags & PR_VNET) 31426bb79563SJamie Gritton return (0); 31436bb79563SJamie Gritton } 31446bb79563SJamie Gritton #endif /* VIMAGE */ 31456bb79563SJamie Gritton 3146800c9408SRobert Watson switch (priv) { 3147800c9408SRobert Watson 3148800c9408SRobert Watson /* 3149800c9408SRobert Watson * Allow ktrace privileges for root in jail. 3150800c9408SRobert Watson */ 3151800c9408SRobert Watson case PRIV_KTRACE: 3152800c9408SRobert Watson 3153c3c1b5e6SRobert Watson #if 0 3154800c9408SRobert Watson /* 3155800c9408SRobert Watson * Allow jailed processes to configure audit identity and 3156800c9408SRobert Watson * submit audit records (login, etc). In the future we may 3157800c9408SRobert Watson * want to further refine the relationship between audit and 3158800c9408SRobert Watson * jail. 3159800c9408SRobert Watson */ 3160800c9408SRobert Watson case PRIV_AUDIT_GETAUDIT: 3161800c9408SRobert Watson case PRIV_AUDIT_SETAUDIT: 3162800c9408SRobert Watson case PRIV_AUDIT_SUBMIT: 3163c3c1b5e6SRobert Watson #endif 3164800c9408SRobert Watson 3165800c9408SRobert Watson /* 3166800c9408SRobert Watson * Allow jailed processes to manipulate process UNIX 3167800c9408SRobert Watson * credentials in any way they see fit. 3168800c9408SRobert Watson */ 3169800c9408SRobert Watson case PRIV_CRED_SETUID: 3170800c9408SRobert Watson case PRIV_CRED_SETEUID: 3171800c9408SRobert Watson case PRIV_CRED_SETGID: 3172800c9408SRobert Watson case PRIV_CRED_SETEGID: 3173800c9408SRobert Watson case PRIV_CRED_SETGROUPS: 3174800c9408SRobert Watson case PRIV_CRED_SETREUID: 3175800c9408SRobert Watson case PRIV_CRED_SETREGID: 3176800c9408SRobert Watson case PRIV_CRED_SETRESUID: 3177800c9408SRobert Watson case PRIV_CRED_SETRESGID: 3178800c9408SRobert Watson 3179800c9408SRobert Watson /* 3180800c9408SRobert Watson * Jail implements visibility constraints already, so allow 3181800c9408SRobert Watson * jailed root to override uid/gid-based constraints. 3182800c9408SRobert Watson */ 3183800c9408SRobert Watson case PRIV_SEEOTHERGIDS: 3184800c9408SRobert Watson case PRIV_SEEOTHERUIDS: 3185800c9408SRobert Watson 3186800c9408SRobert Watson /* 3187800c9408SRobert Watson * Jail implements inter-process debugging limits already, so 3188800c9408SRobert Watson * allow jailed root various debugging privileges. 3189800c9408SRobert Watson */ 3190800c9408SRobert Watson case PRIV_DEBUG_DIFFCRED: 3191800c9408SRobert Watson case PRIV_DEBUG_SUGID: 3192800c9408SRobert Watson case PRIV_DEBUG_UNPRIV: 3193800c9408SRobert Watson 3194800c9408SRobert Watson /* 3195800c9408SRobert Watson * Allow jail to set various resource limits and login 3196800c9408SRobert Watson * properties, and for now, exceed process resource limits. 3197800c9408SRobert Watson */ 3198800c9408SRobert Watson case PRIV_PROC_LIMIT: 3199800c9408SRobert Watson case PRIV_PROC_SETLOGIN: 3200800c9408SRobert Watson case PRIV_PROC_SETRLIMIT: 3201800c9408SRobert Watson 3202800c9408SRobert Watson /* 3203800c9408SRobert Watson * System V and POSIX IPC privileges are granted in jail. 3204800c9408SRobert Watson */ 3205800c9408SRobert Watson case PRIV_IPC_READ: 3206800c9408SRobert Watson case PRIV_IPC_WRITE: 3207800c9408SRobert Watson case PRIV_IPC_ADMIN: 3208800c9408SRobert Watson case PRIV_IPC_MSGSIZE: 3209800c9408SRobert Watson case PRIV_MQ_ADMIN: 3210800c9408SRobert Watson 3211800c9408SRobert Watson /* 32120304c731SJamie Gritton * Jail operations within a jail work on child jails. 32130304c731SJamie Gritton */ 32140304c731SJamie Gritton case PRIV_JAIL_ATTACH: 32150304c731SJamie Gritton case PRIV_JAIL_SET: 32160304c731SJamie Gritton case PRIV_JAIL_REMOVE: 32170304c731SJamie Gritton 32180304c731SJamie Gritton /* 3219800c9408SRobert Watson * Jail implements its own inter-process limits, so allow 3220800c9408SRobert Watson * root processes in jail to change scheduling on other 3221800c9408SRobert Watson * processes in the same jail. Likewise for signalling. 3222800c9408SRobert Watson */ 3223800c9408SRobert Watson case PRIV_SCHED_DIFFCRED: 3224413628a7SBjoern A. Zeeb case PRIV_SCHED_CPUSET: 3225800c9408SRobert Watson case PRIV_SIGNAL_DIFFCRED: 3226800c9408SRobert Watson case PRIV_SIGNAL_SUGID: 3227800c9408SRobert Watson 3228800c9408SRobert Watson /* 3229800c9408SRobert Watson * Allow jailed processes to write to sysctls marked as jail 3230800c9408SRobert Watson * writable. 3231800c9408SRobert Watson */ 3232800c9408SRobert Watson case PRIV_SYSCTL_WRITEJAIL: 3233800c9408SRobert Watson 3234800c9408SRobert Watson /* 3235800c9408SRobert Watson * Allow root in jail to manage a variety of quota 3236e82d0201SRobert Watson * properties. These should likely be conditional on a 3237e82d0201SRobert Watson * configuration option. 3238800c9408SRobert Watson */ 323995b091d2SRobert Watson case PRIV_VFS_GETQUOTA: 324095b091d2SRobert Watson case PRIV_VFS_SETQUOTA: 3241800c9408SRobert Watson 3242800c9408SRobert Watson /* 3243800c9408SRobert Watson * Since Jail relies on chroot() to implement file system 3244800c9408SRobert Watson * protections, grant many VFS privileges to root in jail. 3245800c9408SRobert Watson * Be careful to exclude mount-related and NFS-related 3246800c9408SRobert Watson * privileges. 3247800c9408SRobert Watson */ 3248800c9408SRobert Watson case PRIV_VFS_READ: 3249800c9408SRobert Watson case PRIV_VFS_WRITE: 3250800c9408SRobert Watson case PRIV_VFS_ADMIN: 3251800c9408SRobert Watson case PRIV_VFS_EXEC: 3252800c9408SRobert Watson case PRIV_VFS_LOOKUP: 3253800c9408SRobert Watson case PRIV_VFS_BLOCKRESERVE: /* XXXRW: Slightly surprising. */ 3254800c9408SRobert Watson case PRIV_VFS_CHFLAGS_DEV: 3255800c9408SRobert Watson case PRIV_VFS_CHOWN: 3256800c9408SRobert Watson case PRIV_VFS_CHROOT: 3257bb531912SPawel Jakub Dawidek case PRIV_VFS_RETAINSUGID: 3258800c9408SRobert Watson case PRIV_VFS_FCHROOT: 3259800c9408SRobert Watson case PRIV_VFS_LINK: 3260800c9408SRobert Watson case PRIV_VFS_SETGID: 3261e41966dcSRobert Watson case PRIV_VFS_STAT: 3262800c9408SRobert Watson case PRIV_VFS_STICKYFILE: 3263bb56d716SJamie Gritton 3264bb56d716SJamie Gritton /* 3265bb56d716SJamie Gritton * As in the non-jail case, non-root users are expected to be 3266bb56d716SJamie Gritton * able to read kernel/phyiscal memory (provided /dev/[k]mem 3267bb56d716SJamie Gritton * exists in the jail and they have permission to access it). 3268bb56d716SJamie Gritton */ 3269bb56d716SJamie Gritton case PRIV_KMEM_READ: 3270800c9408SRobert Watson return (0); 3271800c9408SRobert Watson 3272800c9408SRobert Watson /* 3273800c9408SRobert Watson * Depending on the global setting, allow privilege of 3274800c9408SRobert Watson * setting system flags. 3275800c9408SRobert Watson */ 3276800c9408SRobert Watson case PRIV_VFS_SYSFLAGS: 32770304c731SJamie Gritton if (cred->cr_prison->pr_allow & PR_ALLOW_CHFLAGS) 3278800c9408SRobert Watson return (0); 3279800c9408SRobert Watson else 3280800c9408SRobert Watson return (EPERM); 3281800c9408SRobert Watson 3282800c9408SRobert Watson /* 3283f3a8d2f9SPawel Jakub Dawidek * Depending on the global setting, allow privilege of 3284f3a8d2f9SPawel Jakub Dawidek * mounting/unmounting file systems. 3285f3a8d2f9SPawel Jakub Dawidek */ 3286f3a8d2f9SPawel Jakub Dawidek case PRIV_VFS_MOUNT: 3287f3a8d2f9SPawel Jakub Dawidek case PRIV_VFS_UNMOUNT: 3288f3a8d2f9SPawel Jakub Dawidek case PRIV_VFS_MOUNT_NONUSER: 328924b0502eSPawel Jakub Dawidek case PRIV_VFS_MOUNT_OWNER: 3290435d4667SMartin Matuska if (cred->cr_prison->pr_allow & PR_ALLOW_MOUNT && 3291435d4667SMartin Matuska cred->cr_prison->pr_enforce_statfs < 2) 3292f3a8d2f9SPawel Jakub Dawidek return (0); 3293f3a8d2f9SPawel Jakub Dawidek else 3294f3a8d2f9SPawel Jakub Dawidek return (EPERM); 3295f3a8d2f9SPawel Jakub Dawidek 3296f3a8d2f9SPawel Jakub Dawidek /* 3297*ccd6ac9fSAntoine Brodin * Conditionnaly allow locking (unlocking) physical pages 3298*ccd6ac9fSAntoine Brodin * in memory. 3299*ccd6ac9fSAntoine Brodin */ 3300*ccd6ac9fSAntoine Brodin case PRIV_VM_MLOCK: 3301*ccd6ac9fSAntoine Brodin case PRIV_VM_MUNLOCK: 3302*ccd6ac9fSAntoine Brodin if (cred->cr_prison->pr_allow & PR_ALLOW_MLOCK) 3303*ccd6ac9fSAntoine Brodin return (0); 3304*ccd6ac9fSAntoine Brodin else 3305*ccd6ac9fSAntoine Brodin return (EPERM); 3306*ccd6ac9fSAntoine Brodin 3307*ccd6ac9fSAntoine Brodin /* 3308e28f9b7dSAllan Jude * Conditionally allow jailed root to bind reserved ports. 3309800c9408SRobert Watson */ 3310800c9408SRobert Watson case PRIV_NETINET_RESERVEDPORT: 3311e28f9b7dSAllan Jude if (cred->cr_prison->pr_allow & PR_ALLOW_RESERVED_PORTS) 3312e28f9b7dSAllan Jude return (0); 3313e28f9b7dSAllan Jude else 3314e28f9b7dSAllan Jude return (EPERM); 3315e28f9b7dSAllan Jude 3316e28f9b7dSAllan Jude /* 3317e28f9b7dSAllan Jude * Allow jailed root to reuse in-use ports. 3318e28f9b7dSAllan Jude */ 33194b084056SRobert Watson case PRIV_NETINET_REUSEPORT: 3320800c9408SRobert Watson return (0); 3321800c9408SRobert Watson 3322800c9408SRobert Watson /* 3323e3043798SPedro F. Giffuni * Allow jailed root to set certain IPv4/6 (option) headers. 332479ba3952SBjoern A. Zeeb */ 332579ba3952SBjoern A. Zeeb case PRIV_NETINET_SETHDROPTS: 332679ba3952SBjoern A. Zeeb return (0); 332779ba3952SBjoern A. Zeeb 332879ba3952SBjoern A. Zeeb /* 3329800c9408SRobert Watson * Conditionally allow creating raw sockets in jail. 3330800c9408SRobert Watson */ 3331800c9408SRobert Watson case PRIV_NETINET_RAW: 33320304c731SJamie Gritton if (cred->cr_prison->pr_allow & PR_ALLOW_RAW_SOCKETS) 3333800c9408SRobert Watson return (0); 3334800c9408SRobert Watson else 3335800c9408SRobert Watson return (EPERM); 3336800c9408SRobert Watson 3337800c9408SRobert Watson /* 3338800c9408SRobert Watson * Since jail implements its own visibility limits on netstat 3339800c9408SRobert Watson * sysctls, allow getcred. This allows identd to work in 3340800c9408SRobert Watson * jail. 3341800c9408SRobert Watson */ 3342800c9408SRobert Watson case PRIV_NETINET_GETCRED: 3343800c9408SRobert Watson return (0); 3344800c9408SRobert Watson 33452bfc50bcSEdward Tomasz Napierala /* 33462bfc50bcSEdward Tomasz Napierala * Allow jailed root to set loginclass. 33472bfc50bcSEdward Tomasz Napierala */ 33482bfc50bcSEdward Tomasz Napierala case PRIV_PROC_SETLOGINCLASS: 33492bfc50bcSEdward Tomasz Napierala return (0); 33502bfc50bcSEdward Tomasz Napierala 3351800c9408SRobert Watson default: 3352800c9408SRobert Watson /* 3353800c9408SRobert Watson * In all remaining cases, deny the privilege request. This 3354800c9408SRobert Watson * includes almost all network privileges, many system 3355800c9408SRobert Watson * configuration privileges. 3356800c9408SRobert Watson */ 3357800c9408SRobert Watson return (EPERM); 3358800c9408SRobert Watson } 3359800c9408SRobert Watson } 3360800c9408SRobert Watson 33610304c731SJamie Gritton /* 33620304c731SJamie Gritton * Return the part of pr2's name that is relative to pr1, or the whole name 33630304c731SJamie Gritton * if it does not directly follow. 33640304c731SJamie Gritton */ 33650304c731SJamie Gritton 33660304c731SJamie Gritton char * 33670304c731SJamie Gritton prison_name(struct prison *pr1, struct prison *pr2) 33680304c731SJamie Gritton { 33690304c731SJamie Gritton char *name; 33700304c731SJamie Gritton 33710304c731SJamie Gritton /* Jails see themselves as "0" (if they see themselves at all). */ 33720304c731SJamie Gritton if (pr1 == pr2) 33730304c731SJamie Gritton return "0"; 33740304c731SJamie Gritton name = pr2->pr_name; 33750304c731SJamie Gritton if (prison_ischild(pr1, pr2)) { 33760304c731SJamie Gritton /* 33770304c731SJamie Gritton * pr1 isn't locked (and allprison_lock may not be either) 33780304c731SJamie Gritton * so its length can't be counted on. But the number of dots 33790304c731SJamie Gritton * can be counted on - and counted. 33800304c731SJamie Gritton */ 33810304c731SJamie Gritton for (; pr1 != &prison0; pr1 = pr1->pr_parent) 33820304c731SJamie Gritton name = strchr(name, '.') + 1; 33830304c731SJamie Gritton } 33840304c731SJamie Gritton return (name); 33850304c731SJamie Gritton } 33860304c731SJamie Gritton 33870304c731SJamie Gritton /* 33880304c731SJamie Gritton * Return the part of pr2's path that is relative to pr1, or the whole path 33890304c731SJamie Gritton * if it does not directly follow. 33900304c731SJamie Gritton */ 33910304c731SJamie Gritton static char * 33920304c731SJamie Gritton prison_path(struct prison *pr1, struct prison *pr2) 33930304c731SJamie Gritton { 33940304c731SJamie Gritton char *path1, *path2; 33950304c731SJamie Gritton int len1; 33960304c731SJamie Gritton 33970304c731SJamie Gritton path1 = pr1->pr_path; 33980304c731SJamie Gritton path2 = pr2->pr_path; 33990304c731SJamie Gritton if (!strcmp(path1, "/")) 34000304c731SJamie Gritton return (path2); 34010304c731SJamie Gritton len1 = strlen(path1); 34020304c731SJamie Gritton if (strncmp(path1, path2, len1)) 34030304c731SJamie Gritton return (path2); 34040304c731SJamie Gritton if (path2[len1] == '\0') 34050304c731SJamie Gritton return "/"; 34060304c731SJamie Gritton if (path2[len1] == '/') 34070304c731SJamie Gritton return (path2 + len1); 34080304c731SJamie Gritton return (path2); 34090304c731SJamie Gritton } 34100304c731SJamie Gritton 34110304c731SJamie Gritton 34120304c731SJamie Gritton /* 34130304c731SJamie Gritton * Jail-related sysctls. 34140304c731SJamie Gritton */ 34156472ac3dSEd Schouten static SYSCTL_NODE(_security, OID_AUTO, jail, CTLFLAG_RW, 0, 34160304c731SJamie Gritton "Jails"); 34170304c731SJamie Gritton 3418fd7a8150SMike Barcroft static int 3419fd7a8150SMike Barcroft sysctl_jail_list(SYSCTL_HANDLER_ARGS) 3420fd7a8150SMike Barcroft { 3421b38ff370SJamie Gritton struct xprison *xp; 34220304c731SJamie Gritton struct prison *pr, *cpr; 3423b38ff370SJamie Gritton #ifdef INET 3424b38ff370SJamie Gritton struct in_addr *ip4 = NULL; 3425b38ff370SJamie Gritton int ip4s = 0; 3426b38ff370SJamie Gritton #endif 3427b38ff370SJamie Gritton #ifdef INET6 34283beefaedSColin Percival struct in6_addr *ip6 = NULL; 3429b38ff370SJamie Gritton int ip6s = 0; 3430b38ff370SJamie Gritton #endif 34310304c731SJamie Gritton int descend, error; 3432fd7a8150SMike Barcroft 3433b38ff370SJamie Gritton xp = malloc(sizeof(*xp), M_TEMP, M_WAITOK); 34340304c731SJamie Gritton pr = req->td->td_ucred->cr_prison; 3435b38ff370SJamie Gritton error = 0; 3436dc68a633SPawel Jakub Dawidek sx_slock(&allprison_lock); 34370304c731SJamie Gritton FOREACH_PRISON_DESCENDANT(pr, cpr, descend) { 34380304c731SJamie Gritton #if defined(INET) || defined(INET6) 3439b38ff370SJamie Gritton again: 34400304c731SJamie Gritton #endif 34410304c731SJamie Gritton mtx_lock(&cpr->pr_mtx); 3442413628a7SBjoern A. Zeeb #ifdef INET 34430304c731SJamie Gritton if (cpr->pr_ip4s > 0) { 34440304c731SJamie Gritton if (ip4s < cpr->pr_ip4s) { 34450304c731SJamie Gritton ip4s = cpr->pr_ip4s; 34460304c731SJamie Gritton mtx_unlock(&cpr->pr_mtx); 3447b38ff370SJamie Gritton ip4 = realloc(ip4, ip4s * 3448b38ff370SJamie Gritton sizeof(struct in_addr), M_TEMP, M_WAITOK); 3449b38ff370SJamie Gritton goto again; 3450b38ff370SJamie Gritton } 34510304c731SJamie Gritton bcopy(cpr->pr_ip4, ip4, 34520304c731SJamie Gritton cpr->pr_ip4s * sizeof(struct in_addr)); 3453b38ff370SJamie Gritton } 3454413628a7SBjoern A. Zeeb #endif 3455413628a7SBjoern A. Zeeb #ifdef INET6 34560304c731SJamie Gritton if (cpr->pr_ip6s > 0) { 34570304c731SJamie Gritton if (ip6s < cpr->pr_ip6s) { 34580304c731SJamie Gritton ip6s = cpr->pr_ip6s; 34590304c731SJamie Gritton mtx_unlock(&cpr->pr_mtx); 3460b38ff370SJamie Gritton ip6 = realloc(ip6, ip6s * 3461b38ff370SJamie Gritton sizeof(struct in6_addr), M_TEMP, M_WAITOK); 3462b38ff370SJamie Gritton goto again; 3463413628a7SBjoern A. Zeeb } 34640304c731SJamie Gritton bcopy(cpr->pr_ip6, ip6, 34650304c731SJamie Gritton cpr->pr_ip6s * sizeof(struct in6_addr)); 3466b38ff370SJamie Gritton } 3467b38ff370SJamie Gritton #endif 34680304c731SJamie Gritton if (cpr->pr_ref == 0) { 34690304c731SJamie Gritton mtx_unlock(&cpr->pr_mtx); 3470b38ff370SJamie Gritton continue; 3471b38ff370SJamie Gritton } 3472b38ff370SJamie Gritton bzero(xp, sizeof(*xp)); 3473fd7a8150SMike Barcroft xp->pr_version = XPRISON_VERSION; 34740304c731SJamie Gritton xp->pr_id = cpr->pr_id; 34750304c731SJamie Gritton xp->pr_state = cpr->pr_uref > 0 3476b38ff370SJamie Gritton ? PRISON_STATE_ALIVE : PRISON_STATE_DYING; 34770304c731SJamie Gritton strlcpy(xp->pr_path, prison_path(pr, cpr), sizeof(xp->pr_path)); 3478c1f19219SJamie Gritton strlcpy(xp->pr_host, cpr->pr_hostname, sizeof(xp->pr_host)); 34790304c731SJamie Gritton strlcpy(xp->pr_name, prison_name(pr, cpr), sizeof(xp->pr_name)); 3480413628a7SBjoern A. Zeeb #ifdef INET 34810304c731SJamie Gritton xp->pr_ip4s = cpr->pr_ip4s; 3482413628a7SBjoern A. Zeeb #endif 3483413628a7SBjoern A. Zeeb #ifdef INET6 34840304c731SJamie Gritton xp->pr_ip6s = cpr->pr_ip6s; 3485413628a7SBjoern A. Zeeb #endif 34860304c731SJamie Gritton mtx_unlock(&cpr->pr_mtx); 3487b38ff370SJamie Gritton error = SYSCTL_OUT(req, xp, sizeof(*xp)); 3488b38ff370SJamie Gritton if (error) 3489b38ff370SJamie Gritton break; 3490413628a7SBjoern A. Zeeb #ifdef INET 3491b38ff370SJamie Gritton if (xp->pr_ip4s > 0) { 3492b38ff370SJamie Gritton error = SYSCTL_OUT(req, ip4, 3493b38ff370SJamie Gritton xp->pr_ip4s * sizeof(struct in_addr)); 3494b38ff370SJamie Gritton if (error) 3495b38ff370SJamie Gritton break; 3496413628a7SBjoern A. Zeeb } 3497413628a7SBjoern A. Zeeb #endif 3498413628a7SBjoern A. Zeeb #ifdef INET6 3499b38ff370SJamie Gritton if (xp->pr_ip6s > 0) { 3500b38ff370SJamie Gritton error = SYSCTL_OUT(req, ip6, 3501b38ff370SJamie Gritton xp->pr_ip6s * sizeof(struct in6_addr)); 3502b38ff370SJamie Gritton if (error) 3503b38ff370SJamie Gritton break; 3504413628a7SBjoern A. Zeeb } 3505413628a7SBjoern A. Zeeb #endif 3506fd7a8150SMike Barcroft } 3507dc68a633SPawel Jakub Dawidek sx_sunlock(&allprison_lock); 3508b38ff370SJamie Gritton free(xp, M_TEMP); 3509b38ff370SJamie Gritton #ifdef INET 3510b38ff370SJamie Gritton free(ip4, M_TEMP); 3511b38ff370SJamie Gritton #endif 3512b38ff370SJamie Gritton #ifdef INET6 3513b38ff370SJamie Gritton free(ip6, M_TEMP); 3514b38ff370SJamie Gritton #endif 3515fd7a8150SMike Barcroft return (error); 3516fd7a8150SMike Barcroft } 3517fd7a8150SMike Barcroft 3518f3b86a5fSEd Schouten SYSCTL_OID(_security_jail, OID_AUTO, list, 3519f3b86a5fSEd Schouten CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0, 3520f3b86a5fSEd Schouten sysctl_jail_list, "S", "List of active jails"); 3521461167c2SPawel Jakub Dawidek 3522461167c2SPawel Jakub Dawidek static int 3523461167c2SPawel Jakub Dawidek sysctl_jail_jailed(SYSCTL_HANDLER_ARGS) 3524461167c2SPawel Jakub Dawidek { 3525461167c2SPawel Jakub Dawidek int error, injail; 3526461167c2SPawel Jakub Dawidek 3527461167c2SPawel Jakub Dawidek injail = jailed(req->td->td_ucred); 3528461167c2SPawel Jakub Dawidek error = SYSCTL_OUT(req, &injail, sizeof(injail)); 3529461167c2SPawel Jakub Dawidek 3530461167c2SPawel Jakub Dawidek return (error); 3531461167c2SPawel Jakub Dawidek } 35320304c731SJamie Gritton 3533f3b86a5fSEd Schouten SYSCTL_PROC(_security_jail, OID_AUTO, jailed, 3534f3b86a5fSEd Schouten CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0, 3535f3b86a5fSEd Schouten sysctl_jail_jailed, "I", "Process in jail?"); 3536413628a7SBjoern A. Zeeb 3537761d2bb5SJamie Gritton static int 3538761d2bb5SJamie Gritton sysctl_jail_vnet(SYSCTL_HANDLER_ARGS) 3539761d2bb5SJamie Gritton { 3540761d2bb5SJamie Gritton int error, havevnet; 3541761d2bb5SJamie Gritton #ifdef VIMAGE 3542761d2bb5SJamie Gritton struct ucred *cred = req->td->td_ucred; 3543761d2bb5SJamie Gritton 3544761d2bb5SJamie Gritton havevnet = jailed(cred) && prison_owns_vnet(cred); 3545761d2bb5SJamie Gritton #else 3546761d2bb5SJamie Gritton havevnet = 0; 3547761d2bb5SJamie Gritton #endif 3548761d2bb5SJamie Gritton error = SYSCTL_OUT(req, &havevnet, sizeof(havevnet)); 3549761d2bb5SJamie Gritton 3550761d2bb5SJamie Gritton return (error); 3551761d2bb5SJamie Gritton } 3552761d2bb5SJamie Gritton 3553761d2bb5SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, vnet, 3554761d2bb5SJamie Gritton CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0, 3555bb8f1623SBjoern A. Zeeb sysctl_jail_vnet, "I", "Jail owns vnet?"); 3556761d2bb5SJamie Gritton 35570304c731SJamie Gritton #if defined(INET) || defined(INET6) 3558e92e0574SJamie Gritton SYSCTL_UINT(_security_jail, OID_AUTO, jail_max_af_ips, CTLFLAG_RW, 35590304c731SJamie Gritton &jail_max_af_ips, 0, 3560ee8d6bd3SJamie Gritton "Number of IP addresses a jail may have at most per address family (deprecated)"); 35610304c731SJamie Gritton #endif 35620304c731SJamie Gritton 35630304c731SJamie Gritton /* 3564e3043798SPedro F. Giffuni * Default parameters for jail(2) compatibility. For historical reasons, 35650304c731SJamie Gritton * the sysctl names have varying similarity to the parameter names. Prisons 35660304c731SJamie Gritton * just see their own parameters, and can't change them. 35670304c731SJamie Gritton */ 35680304c731SJamie Gritton static int 35690304c731SJamie Gritton sysctl_jail_default_allow(SYSCTL_HANDLER_ARGS) 35700304c731SJamie Gritton { 35710304c731SJamie Gritton struct prison *pr; 35720304c731SJamie Gritton int allow, error, i; 35730304c731SJamie Gritton 35740304c731SJamie Gritton pr = req->td->td_ucred->cr_prison; 35750304c731SJamie Gritton allow = (pr == &prison0) ? jail_default_allow : pr->pr_allow; 35760304c731SJamie Gritton 35770304c731SJamie Gritton /* Get the current flag value, and convert it to a boolean. */ 35780304c731SJamie Gritton i = (allow & arg2) ? 1 : 0; 35790304c731SJamie Gritton if (arg1 != NULL) 35800304c731SJamie Gritton i = !i; 35810304c731SJamie Gritton error = sysctl_handle_int(oidp, &i, 0, req); 35820304c731SJamie Gritton if (error || !req->newptr) 35830304c731SJamie Gritton return (error); 35840304c731SJamie Gritton i = i ? arg2 : 0; 35850304c731SJamie Gritton if (arg1 != NULL) 35860304c731SJamie Gritton i ^= arg2; 35870304c731SJamie Gritton /* 35880304c731SJamie Gritton * The sysctls don't have CTLFLAGS_PRISON, so assume prison0 35890304c731SJamie Gritton * for writing. 35900304c731SJamie Gritton */ 35910304c731SJamie Gritton mtx_lock(&prison0.pr_mtx); 35920304c731SJamie Gritton jail_default_allow = (jail_default_allow & ~arg2) | i; 35930304c731SJamie Gritton mtx_unlock(&prison0.pr_mtx); 35940304c731SJamie Gritton return (0); 35950304c731SJamie Gritton } 35960304c731SJamie Gritton 35970304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, set_hostname_allowed, 35980304c731SJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 35990304c731SJamie Gritton NULL, PR_ALLOW_SET_HOSTNAME, sysctl_jail_default_allow, "I", 3600ee8d6bd3SJamie Gritton "Processes in jail can set their hostnames (deprecated)"); 36010304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, socket_unixiproute_only, 36020304c731SJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 36030304c731SJamie Gritton (void *)1, PR_ALLOW_SOCKET_AF, sysctl_jail_default_allow, "I", 3604ee8d6bd3SJamie Gritton "Processes in jail are limited to creating UNIX/IP/route sockets only (deprecated)"); 36050304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, sysvipc_allowed, 36060304c731SJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 36070304c731SJamie Gritton NULL, PR_ALLOW_SYSVIPC, sysctl_jail_default_allow, "I", 3608ee8d6bd3SJamie Gritton "Processes in jail can use System V IPC primitives (deprecated)"); 36090304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, allow_raw_sockets, 36100304c731SJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 36110304c731SJamie Gritton NULL, PR_ALLOW_RAW_SOCKETS, sysctl_jail_default_allow, "I", 3612ee8d6bd3SJamie Gritton "Prison root can create raw sockets (deprecated)"); 36130304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, chflags_allowed, 36140304c731SJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 36150304c731SJamie Gritton NULL, PR_ALLOW_CHFLAGS, sysctl_jail_default_allow, "I", 3616ee8d6bd3SJamie Gritton "Processes in jail can alter system file flags (deprecated)"); 36170304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, mount_allowed, 36180304c731SJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 36190304c731SJamie Gritton NULL, PR_ALLOW_MOUNT, sysctl_jail_default_allow, "I", 3620ee8d6bd3SJamie Gritton "Processes in jail can mount/unmount jail-friendly file systems (deprecated)"); 36210304c731SJamie Gritton 36220304c731SJamie Gritton static int 36230304c731SJamie Gritton sysctl_jail_default_level(SYSCTL_HANDLER_ARGS) 36240304c731SJamie Gritton { 36250304c731SJamie Gritton struct prison *pr; 36260304c731SJamie Gritton int level, error; 36270304c731SJamie Gritton 36280304c731SJamie Gritton pr = req->td->td_ucred->cr_prison; 36290304c731SJamie Gritton level = (pr == &prison0) ? *(int *)arg1 : *(int *)((char *)pr + arg2); 36300304c731SJamie Gritton error = sysctl_handle_int(oidp, &level, 0, req); 36310304c731SJamie Gritton if (error || !req->newptr) 36320304c731SJamie Gritton return (error); 36330304c731SJamie Gritton *(int *)arg1 = level; 36340304c731SJamie Gritton return (0); 36350304c731SJamie Gritton } 36360304c731SJamie Gritton 36370304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, enforce_statfs, 36380304c731SJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 36390304c731SJamie Gritton &jail_default_enforce_statfs, offsetof(struct prison, pr_enforce_statfs), 36400304c731SJamie Gritton sysctl_jail_default_level, "I", 3641ee8d6bd3SJamie Gritton "Processes in jail cannot see all mounted file systems (deprecated)"); 36420304c731SJamie Gritton 36430cc207a6SMartin Matuska SYSCTL_PROC(_security_jail, OID_AUTO, devfs_ruleset, 36440cc207a6SMartin Matuska CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, 36450cc207a6SMartin Matuska &jail_default_devfs_rsnum, offsetof(struct prison, pr_devfs_rsnum), 36460cc207a6SMartin Matuska sysctl_jail_default_level, "I", 3647ee8d6bd3SJamie Gritton "Ruleset for the devfs filesystem in jail (deprecated)"); 36480cc207a6SMartin Matuska 36490304c731SJamie Gritton /* 36500304c731SJamie Gritton * Nodes to describe jail parameters. Maximum length of string parameters 36510304c731SJamie Gritton * is returned in the string itself, and the other parameters exist merely 36520304c731SJamie Gritton * to make themselves and their types known. 36530304c731SJamie Gritton */ 36540304c731SJamie Gritton SYSCTL_NODE(_security_jail, OID_AUTO, param, CTLFLAG_RW, 0, 36550304c731SJamie Gritton "Jail parameters"); 36560304c731SJamie Gritton 36570304c731SJamie Gritton int 36580304c731SJamie Gritton sysctl_jail_param(SYSCTL_HANDLER_ARGS) 36590304c731SJamie Gritton { 36600304c731SJamie Gritton int i; 36610304c731SJamie Gritton long l; 36620304c731SJamie Gritton size_t s; 36630304c731SJamie Gritton char numbuf[12]; 36640304c731SJamie Gritton 36650304c731SJamie Gritton switch (oidp->oid_kind & CTLTYPE) 36660304c731SJamie Gritton { 36670304c731SJamie Gritton case CTLTYPE_LONG: 36680304c731SJamie Gritton case CTLTYPE_ULONG: 36690304c731SJamie Gritton l = 0; 36700304c731SJamie Gritton #ifdef SCTL_MASK32 36710304c731SJamie Gritton if (!(req->flags & SCTL_MASK32)) 36720304c731SJamie Gritton #endif 36730304c731SJamie Gritton return (SYSCTL_OUT(req, &l, sizeof(l))); 36740304c731SJamie Gritton case CTLTYPE_INT: 36750304c731SJamie Gritton case CTLTYPE_UINT: 36760304c731SJamie Gritton i = 0; 36770304c731SJamie Gritton return (SYSCTL_OUT(req, &i, sizeof(i))); 36780304c731SJamie Gritton case CTLTYPE_STRING: 3679e4cd31ddSJeff Roberson snprintf(numbuf, sizeof(numbuf), "%jd", (intmax_t)arg2); 36800304c731SJamie Gritton return 36810304c731SJamie Gritton (sysctl_handle_string(oidp, numbuf, sizeof(numbuf), req)); 36820304c731SJamie Gritton case CTLTYPE_STRUCT: 36830304c731SJamie Gritton s = (size_t)arg2; 36840304c731SJamie Gritton return (SYSCTL_OUT(req, &s, sizeof(s))); 36850304c731SJamie Gritton } 36860304c731SJamie Gritton return (0); 36870304c731SJamie Gritton } 36880304c731SJamie Gritton 3689b96bd95bSIan Lepore /* 3690b96bd95bSIan Lepore * CTLFLAG_RDTUN in the following indicates jail parameters that can be set at 3691b96bd95bSIan Lepore * jail creation time but cannot be changed in an existing jail. 3692b96bd95bSIan Lepore */ 36930304c731SJamie Gritton SYSCTL_JAIL_PARAM(, jid, CTLTYPE_INT | CTLFLAG_RDTUN, "I", "Jail ID"); 36940304c731SJamie Gritton SYSCTL_JAIL_PARAM(, parent, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail parent ID"); 36950304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(, name, CTLFLAG_RW, MAXHOSTNAMELEN, "Jail name"); 36960304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(, path, CTLFLAG_RDTUN, MAXPATHLEN, "Jail root path"); 36970304c731SJamie Gritton SYSCTL_JAIL_PARAM(, securelevel, CTLTYPE_INT | CTLFLAG_RW, 36980304c731SJamie Gritton "I", "Jail secure level"); 3699b96bd95bSIan Lepore SYSCTL_JAIL_PARAM(, osreldate, CTLTYPE_INT | CTLFLAG_RDTUN, "I", 3700b96bd95bSIan Lepore "Jail value for kern.osreldate and uname -K"); 3701b96bd95bSIan Lepore SYSCTL_JAIL_PARAM_STRING(, osrelease, CTLFLAG_RDTUN, OSRELEASELEN, 3702b96bd95bSIan Lepore "Jail value for kern.osrelease and uname -r"); 37030304c731SJamie Gritton SYSCTL_JAIL_PARAM(, enforce_statfs, CTLTYPE_INT | CTLFLAG_RW, 37040304c731SJamie Gritton "I", "Jail cannot see all mounted file systems"); 37050cc207a6SMartin Matuska SYSCTL_JAIL_PARAM(, devfs_ruleset, CTLTYPE_INT | CTLFLAG_RW, 37060cc207a6SMartin Matuska "I", "Ruleset for in-jail devfs mounts"); 37070304c731SJamie Gritton SYSCTL_JAIL_PARAM(, persist, CTLTYPE_INT | CTLFLAG_RW, 37080304c731SJamie Gritton "B", "Jail persistence"); 3709679e1390SJamie Gritton #ifdef VIMAGE 3710679e1390SJamie Gritton SYSCTL_JAIL_PARAM(, vnet, CTLTYPE_INT | CTLFLAG_RDTUN, 37117cbf7213SJamie Gritton "E,jailsys", "Virtual network stack"); 3712679e1390SJamie Gritton #endif 37130304c731SJamie Gritton SYSCTL_JAIL_PARAM(, dying, CTLTYPE_INT | CTLFLAG_RD, 37140304c731SJamie Gritton "B", "Jail is in the process of shutting down"); 37150304c731SJamie Gritton 3716b97457e2SJamie Gritton SYSCTL_JAIL_PARAM_NODE(children, "Number of child jails"); 3717b97457e2SJamie Gritton SYSCTL_JAIL_PARAM(_children, cur, CTLTYPE_INT | CTLFLAG_RD, 3718b97457e2SJamie Gritton "I", "Current number of child jails"); 3719b97457e2SJamie Gritton SYSCTL_JAIL_PARAM(_children, max, CTLTYPE_INT | CTLFLAG_RW, 3720b97457e2SJamie Gritton "I", "Maximum number of child jails"); 3721b97457e2SJamie Gritton 37227cbf7213SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(host, CTLFLAG_RW, "Jail host info"); 37230304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, hostname, CTLFLAG_RW, MAXHOSTNAMELEN, 37240304c731SJamie Gritton "Jail hostname"); 372576ca6f88SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, domainname, CTLFLAG_RW, MAXHOSTNAMELEN, 372676ca6f88SJamie Gritton "Jail NIS domainname"); 372776ca6f88SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, hostuuid, CTLFLAG_RW, HOSTUUIDLEN, 372876ca6f88SJamie Gritton "Jail host UUID"); 372976ca6f88SJamie Gritton SYSCTL_JAIL_PARAM(_host, hostid, CTLTYPE_ULONG | CTLFLAG_RW, 373076ca6f88SJamie Gritton "LU", "Jail host ID"); 37310304c731SJamie Gritton 37320304c731SJamie Gritton SYSCTL_JAIL_PARAM_NODE(cpuset, "Jail cpuset"); 37330304c731SJamie Gritton SYSCTL_JAIL_PARAM(_cpuset, id, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail cpuset ID"); 37340304c731SJamie Gritton 37350304c731SJamie Gritton #ifdef INET 37362b0d6f81SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(ip4, CTLFLAG_RDTUN, 37372b0d6f81SJamie Gritton "Jail IPv4 address virtualization"); 37380304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRUCT(_ip4, addr, CTLFLAG_RW, sizeof(struct in_addr), 37390304c731SJamie Gritton "S,in_addr,a", "Jail IPv4 addresses"); 3740592bcae8SBjoern A. Zeeb SYSCTL_JAIL_PARAM(_ip4, saddrsel, CTLTYPE_INT | CTLFLAG_RW, 3741592bcae8SBjoern A. Zeeb "B", "Do (not) use IPv4 source address selection rather than the " 3742592bcae8SBjoern A. Zeeb "primary jail IPv4 address."); 37430304c731SJamie Gritton #endif 37440304c731SJamie Gritton #ifdef INET6 37452b0d6f81SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(ip6, CTLFLAG_RDTUN, 37462b0d6f81SJamie Gritton "Jail IPv6 address virtualization"); 37470304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRUCT(_ip6, addr, CTLFLAG_RW, sizeof(struct in6_addr), 37480304c731SJamie Gritton "S,in6_addr,a", "Jail IPv6 addresses"); 3749592bcae8SBjoern A. Zeeb SYSCTL_JAIL_PARAM(_ip6, saddrsel, CTLTYPE_INT | CTLFLAG_RW, 3750592bcae8SBjoern A. Zeeb "B", "Do (not) use IPv6 source address selection rather than the " 3751592bcae8SBjoern A. Zeeb "primary jail IPv6 address."); 37520304c731SJamie Gritton #endif 37530304c731SJamie Gritton 37540304c731SJamie Gritton SYSCTL_JAIL_PARAM_NODE(allow, "Jail permission flags"); 37550304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, set_hostname, CTLTYPE_INT | CTLFLAG_RW, 37560304c731SJamie Gritton "B", "Jail may set hostname"); 37570304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, sysvipc, CTLTYPE_INT | CTLFLAG_RW, 37580304c731SJamie Gritton "B", "Jail may use SYSV IPC"); 37590304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, raw_sockets, CTLTYPE_INT | CTLFLAG_RW, 37600304c731SJamie Gritton "B", "Jail may create raw sockets"); 37610304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, chflags, CTLTYPE_INT | CTLFLAG_RW, 37620304c731SJamie Gritton "B", "Jail may alter system file flags"); 37630304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, quotas, CTLTYPE_INT | CTLFLAG_RW, 37640304c731SJamie Gritton "B", "Jail may set file quotas"); 37650304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, socket_af, CTLTYPE_INT | CTLFLAG_RW, 37660304c731SJamie Gritton "B", "Jail may create sockets other than just UNIX/IPv4/IPv6/route"); 3767*ccd6ac9fSAntoine Brodin SYSCTL_JAIL_PARAM(_allow, mlock, CTLTYPE_INT | CTLFLAG_RW, 3768*ccd6ac9fSAntoine Brodin "B", "Jail may lock (unlock) physical pages in memory"); 3769e28f9b7dSAllan Jude SYSCTL_JAIL_PARAM(_allow, reserved_ports, CTLTYPE_INT | CTLFLAG_RW, 3770e28f9b7dSAllan Jude "B", "Jail may bind sockets to reserved ports"); 37710304c731SJamie Gritton 3772bf3db8aaSMartin Matuska SYSCTL_JAIL_PARAM_SUBNODE(allow, mount, "Jail mount/unmount permission flags"); 3773bf3db8aaSMartin Matuska SYSCTL_JAIL_PARAM(_allow_mount, , CTLTYPE_INT | CTLFLAG_RW, 3774bf3db8aaSMartin Matuska "B", "Jail may mount/unmount jail-friendly file systems in general"); 37750e5c6bd4SJamie Gritton 37760e5c6bd4SJamie Gritton /* 37770a172404SJamie Gritton * Add a dynamic parameter allow.<name>, or allow.<prefix>.<name>. Return 37780a172404SJamie Gritton * its associated bit in the pr_allow bitmask, or zero if the parameter was 37790a172404SJamie Gritton * not created. 37800e5c6bd4SJamie Gritton */ 37810a172404SJamie Gritton unsigned 37820a172404SJamie Gritton prison_add_allow(const char *prefix, const char *name, const char *prefix_descr, 37830a172404SJamie Gritton const char *descr) 37840e5c6bd4SJamie Gritton { 37850e5c6bd4SJamie Gritton struct bool_flags *bf; 37860a172404SJamie Gritton struct sysctl_oid *parent; 37870a172404SJamie Gritton char *allow_name, *allow_noname, *allowed; 37880e5c6bd4SJamie Gritton #ifndef NO_SYSCTL_DESCR 37890a172404SJamie Gritton char *descr_deprecated; 37900e5c6bd4SJamie Gritton #endif 37910e5c6bd4SJamie Gritton unsigned allow_flag; 37920e5c6bd4SJamie Gritton 37930a172404SJamie Gritton if (prefix 37940a172404SJamie Gritton ? asprintf(&allow_name, M_PRISON, "allow.%s.%s", prefix, name) 37950a172404SJamie Gritton < 0 || 37960a172404SJamie Gritton asprintf(&allow_noname, M_PRISON, "allow.%s.no%s", prefix, name) 37970a172404SJamie Gritton < 0 37980a172404SJamie Gritton : asprintf(&allow_name, M_PRISON, "allow.%s", name) < 0 || 37990a172404SJamie Gritton asprintf(&allow_noname, M_PRISON, "allow.no%s", name) < 0) { 38000e5c6bd4SJamie Gritton free(allow_name, M_PRISON); 38010a172404SJamie Gritton return 0; 38020e5c6bd4SJamie Gritton } 38030e5c6bd4SJamie Gritton 38040e5c6bd4SJamie Gritton /* 38050a172404SJamie Gritton * See if this parameter has already beed added, i.e. a module was 38060a172404SJamie Gritton * previously loaded/unloaded. 38070e5c6bd4SJamie Gritton */ 38080e5c6bd4SJamie Gritton mtx_lock(&prison0.pr_mtx); 38090e5c6bd4SJamie Gritton for (bf = pr_flag_allow; 38100e5c6bd4SJamie Gritton bf < pr_flag_allow + nitems(pr_flag_allow) && bf->flag != 0; 38110e5c6bd4SJamie Gritton bf++) { 38120e5c6bd4SJamie Gritton if (strcmp(bf->name, allow_name) == 0) { 38130a172404SJamie Gritton allow_flag = bf->flag; 38140e5c6bd4SJamie Gritton goto no_add; 38150e5c6bd4SJamie Gritton } 38160e5c6bd4SJamie Gritton } 38170e5c6bd4SJamie Gritton 38180e5c6bd4SJamie Gritton /* 38190e5c6bd4SJamie Gritton * Find a free bit in prison0's pr_allow, failing if there are none 38200e5c6bd4SJamie Gritton * (which shouldn't happen as long as we keep track of how many 38210a172404SJamie Gritton * potential dynamic flags exist). 38220e5c6bd4SJamie Gritton */ 38230e5c6bd4SJamie Gritton for (allow_flag = 1;; allow_flag <<= 1) { 38240e5c6bd4SJamie Gritton if (allow_flag == 0) 38250e5c6bd4SJamie Gritton goto no_add; 38260e5c6bd4SJamie Gritton if ((prison0.pr_allow & allow_flag) == 0) 38270e5c6bd4SJamie Gritton break; 38280e5c6bd4SJamie Gritton } 38290e5c6bd4SJamie Gritton 38300e5c6bd4SJamie Gritton /* 38310e5c6bd4SJamie Gritton * Note the parameter in the next open slot in pr_flag_allow. 38320e5c6bd4SJamie Gritton * Set the flag last so code that checks pr_flag_allow can do so 38330e5c6bd4SJamie Gritton * without locking. 38340e5c6bd4SJamie Gritton */ 38350e5c6bd4SJamie Gritton for (bf = pr_flag_allow; bf->flag != 0; bf++) 38360e5c6bd4SJamie Gritton if (bf == pr_flag_allow + nitems(pr_flag_allow)) { 38370e5c6bd4SJamie Gritton /* This should never happen, but is not fatal. */ 38380a172404SJamie Gritton allow_flag = 0; 38390e5c6bd4SJamie Gritton goto no_add; 38400e5c6bd4SJamie Gritton } 38410e5c6bd4SJamie Gritton prison0.pr_allow |= allow_flag; 38420e5c6bd4SJamie Gritton bf->name = allow_name; 38430e5c6bd4SJamie Gritton bf->noname = allow_noname; 38440e5c6bd4SJamie Gritton bf->flag = allow_flag; 38450e5c6bd4SJamie Gritton mtx_unlock(&prison0.pr_mtx); 38460e5c6bd4SJamie Gritton 38470e5c6bd4SJamie Gritton /* 38480e5c6bd4SJamie Gritton * Create sysctls for the paramter, and the back-compat global 38490e5c6bd4SJamie Gritton * permission. 38500e5c6bd4SJamie Gritton */ 38510a172404SJamie Gritton parent = prefix 38520a172404SJamie Gritton ? SYSCTL_ADD_NODE(NULL, 38530a172404SJamie Gritton SYSCTL_CHILDREN(&sysctl___security_jail_param_allow), 38540a172404SJamie Gritton OID_AUTO, prefix, 0, 0, prefix_descr) 38550a172404SJamie Gritton : &sysctl___security_jail_param_allow; 38560a172404SJamie Gritton (void)SYSCTL_ADD_PROC(NULL, SYSCTL_CHILDREN(parent), OID_AUTO, 38570a172404SJamie Gritton name, CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 38580e5c6bd4SJamie Gritton NULL, 0, sysctl_jail_param, "B", descr); 38590a172404SJamie Gritton if ((prefix 38600a172404SJamie Gritton ? asprintf(&allowed, M_TEMP, "%s_%s_allowed", prefix, name) 38610a172404SJamie Gritton : asprintf(&allowed, M_TEMP, "%s_allowed", name)) >= 0) { 38620e5c6bd4SJamie Gritton #ifndef NO_SYSCTL_DESCR 38630a172404SJamie Gritton (void)asprintf(&descr_deprecated, M_TEMP, "%s (deprecated)", 38640a172404SJamie Gritton descr); 38650e5c6bd4SJamie Gritton #endif 38660e5c6bd4SJamie Gritton (void)SYSCTL_ADD_PROC(NULL, 38670a172404SJamie Gritton SYSCTL_CHILDREN(&sysctl___security_jail), OID_AUTO, allowed, 38680a172404SJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, allow_flag, 38690a172404SJamie Gritton sysctl_jail_default_allow, "I", descr_deprecated); 38700e5c6bd4SJamie Gritton #ifndef NO_SYSCTL_DESCR 38710a172404SJamie Gritton free(descr_deprecated, M_TEMP); 38720e5c6bd4SJamie Gritton #endif 38730a172404SJamie Gritton free(allowed, M_TEMP); 38740e5c6bd4SJamie Gritton } 38750a172404SJamie Gritton return allow_flag; 38760e5c6bd4SJamie Gritton 38770e5c6bd4SJamie Gritton no_add: 38780e5c6bd4SJamie Gritton mtx_unlock(&prison0.pr_mtx); 38790e5c6bd4SJamie Gritton free(allow_name, M_PRISON); 38800e5c6bd4SJamie Gritton free(allow_noname, M_PRISON); 38810a172404SJamie Gritton return allow_flag; 38820a172404SJamie Gritton } 38830a172404SJamie Gritton 38840a172404SJamie Gritton /* 38850a172404SJamie Gritton * The VFS system will register jail-aware filesystems here. They each get 38860a172404SJamie Gritton * a parameter allow.mount.xxxfs and a flag to check when a jailed user 38870a172404SJamie Gritton * attempts to mount. 38880a172404SJamie Gritton */ 38890a172404SJamie Gritton void 38900a172404SJamie Gritton prison_add_vfs(struct vfsconf *vfsp) 38910a172404SJamie Gritton { 38920a172404SJamie Gritton #ifdef NO_SYSCTL_DESCR 38930a172404SJamie Gritton 38940a172404SJamie Gritton vfsp->vfc_prison_flag = prison_add_allow("mount", vfsp->vfc_name, 38950a172404SJamie Gritton NULL, NULL); 38960a172404SJamie Gritton #else 38970a172404SJamie Gritton char *descr; 38980a172404SJamie Gritton 38990a172404SJamie Gritton (void)asprintf(&descr, M_TEMP, "Jail may mount the %s file system", 39000a172404SJamie Gritton vfsp->vfc_name); 39010a172404SJamie Gritton vfsp->vfc_prison_flag = prison_add_allow("mount", vfsp->vfc_name, 39020a172404SJamie Gritton NULL, descr); 39030a172404SJamie Gritton free(descr, M_TEMP); 39040a172404SJamie Gritton #endif 39050e5c6bd4SJamie Gritton } 3906bf3db8aaSMartin Matuska 39074b5c9cf6SEdward Tomasz Napierala #ifdef RACCT 3908097055e2SEdward Tomasz Napierala void 3909097055e2SEdward Tomasz Napierala prison_racct_foreach(void (*callback)(struct racct *racct, 391015db3c07SEdward Tomasz Napierala void *arg2, void *arg3), void (*pre)(void), void (*post)(void), 391115db3c07SEdward Tomasz Napierala void *arg2, void *arg3) 3912097055e2SEdward Tomasz Napierala { 3913a7ad07bfSEdward Tomasz Napierala struct prison_racct *prr; 3914097055e2SEdward Tomasz Napierala 39154b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 39164b5c9cf6SEdward Tomasz Napierala 3917097055e2SEdward Tomasz Napierala sx_slock(&allprison_lock); 391815db3c07SEdward Tomasz Napierala if (pre != NULL) 391915db3c07SEdward Tomasz Napierala (pre)(); 3920a7ad07bfSEdward Tomasz Napierala LIST_FOREACH(prr, &allprison_racct, prr_next) 3921a7ad07bfSEdward Tomasz Napierala (callback)(prr->prr_racct, arg2, arg3); 392215db3c07SEdward Tomasz Napierala if (post != NULL) 392315db3c07SEdward Tomasz Napierala (post)(); 3924097055e2SEdward Tomasz Napierala sx_sunlock(&allprison_lock); 3925097055e2SEdward Tomasz Napierala } 39260304c731SJamie Gritton 3927a7ad07bfSEdward Tomasz Napierala static struct prison_racct * 3928a7ad07bfSEdward Tomasz Napierala prison_racct_find_locked(const char *name) 3929a7ad07bfSEdward Tomasz Napierala { 3930a7ad07bfSEdward Tomasz Napierala struct prison_racct *prr; 3931a7ad07bfSEdward Tomasz Napierala 39324b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 3933a7ad07bfSEdward Tomasz Napierala sx_assert(&allprison_lock, SA_XLOCKED); 3934a7ad07bfSEdward Tomasz Napierala 3935a7ad07bfSEdward Tomasz Napierala if (name[0] == '\0' || strlen(name) >= MAXHOSTNAMELEN) 3936a7ad07bfSEdward Tomasz Napierala return (NULL); 3937a7ad07bfSEdward Tomasz Napierala 3938a7ad07bfSEdward Tomasz Napierala LIST_FOREACH(prr, &allprison_racct, prr_next) { 3939a7ad07bfSEdward Tomasz Napierala if (strcmp(name, prr->prr_name) != 0) 3940a7ad07bfSEdward Tomasz Napierala continue; 3941a7ad07bfSEdward Tomasz Napierala 3942a7ad07bfSEdward Tomasz Napierala /* Found prison_racct with a matching name? */ 3943a7ad07bfSEdward Tomasz Napierala prison_racct_hold(prr); 3944a7ad07bfSEdward Tomasz Napierala return (prr); 3945a7ad07bfSEdward Tomasz Napierala } 3946a7ad07bfSEdward Tomasz Napierala 3947a7ad07bfSEdward Tomasz Napierala /* Add new prison_racct. */ 3948a7ad07bfSEdward Tomasz Napierala prr = malloc(sizeof(*prr), M_PRISON_RACCT, M_ZERO | M_WAITOK); 3949a7ad07bfSEdward Tomasz Napierala racct_create(&prr->prr_racct); 3950a7ad07bfSEdward Tomasz Napierala 3951a7ad07bfSEdward Tomasz Napierala strcpy(prr->prr_name, name); 3952a7ad07bfSEdward Tomasz Napierala refcount_init(&prr->prr_refcount, 1); 3953a7ad07bfSEdward Tomasz Napierala LIST_INSERT_HEAD(&allprison_racct, prr, prr_next); 3954a7ad07bfSEdward Tomasz Napierala 3955a7ad07bfSEdward Tomasz Napierala return (prr); 3956a7ad07bfSEdward Tomasz Napierala } 3957a7ad07bfSEdward Tomasz Napierala 3958a7ad07bfSEdward Tomasz Napierala struct prison_racct * 3959a7ad07bfSEdward Tomasz Napierala prison_racct_find(const char *name) 3960a7ad07bfSEdward Tomasz Napierala { 3961a7ad07bfSEdward Tomasz Napierala struct prison_racct *prr; 3962a7ad07bfSEdward Tomasz Napierala 39634b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 39644b5c9cf6SEdward Tomasz Napierala 3965a7ad07bfSEdward Tomasz Napierala sx_xlock(&allprison_lock); 3966a7ad07bfSEdward Tomasz Napierala prr = prison_racct_find_locked(name); 3967a7ad07bfSEdward Tomasz Napierala sx_xunlock(&allprison_lock); 3968a7ad07bfSEdward Tomasz Napierala return (prr); 3969a7ad07bfSEdward Tomasz Napierala } 3970a7ad07bfSEdward Tomasz Napierala 3971a7ad07bfSEdward Tomasz Napierala void 3972a7ad07bfSEdward Tomasz Napierala prison_racct_hold(struct prison_racct *prr) 3973a7ad07bfSEdward Tomasz Napierala { 3974a7ad07bfSEdward Tomasz Napierala 39754b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 39764b5c9cf6SEdward Tomasz Napierala 3977a7ad07bfSEdward Tomasz Napierala refcount_acquire(&prr->prr_refcount); 3978a7ad07bfSEdward Tomasz Napierala } 3979a7ad07bfSEdward Tomasz Napierala 3980c34bbd2aSEdward Tomasz Napierala static void 3981c34bbd2aSEdward Tomasz Napierala prison_racct_free_locked(struct prison_racct *prr) 3982c34bbd2aSEdward Tomasz Napierala { 3983c34bbd2aSEdward Tomasz Napierala 39844b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 3985c34bbd2aSEdward Tomasz Napierala sx_assert(&allprison_lock, SA_XLOCKED); 3986c34bbd2aSEdward Tomasz Napierala 3987c34bbd2aSEdward Tomasz Napierala if (refcount_release(&prr->prr_refcount)) { 3988c34bbd2aSEdward Tomasz Napierala racct_destroy(&prr->prr_racct); 3989c34bbd2aSEdward Tomasz Napierala LIST_REMOVE(prr, prr_next); 3990c34bbd2aSEdward Tomasz Napierala free(prr, M_PRISON_RACCT); 3991c34bbd2aSEdward Tomasz Napierala } 3992c34bbd2aSEdward Tomasz Napierala } 3993c34bbd2aSEdward Tomasz Napierala 3994a7ad07bfSEdward Tomasz Napierala void 3995a7ad07bfSEdward Tomasz Napierala prison_racct_free(struct prison_racct *prr) 3996a7ad07bfSEdward Tomasz Napierala { 3997a7ad07bfSEdward Tomasz Napierala int old; 3998a7ad07bfSEdward Tomasz Napierala 39994b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 4000c34bbd2aSEdward Tomasz Napierala sx_assert(&allprison_lock, SA_UNLOCKED); 4001c34bbd2aSEdward Tomasz Napierala 4002a7ad07bfSEdward Tomasz Napierala old = prr->prr_refcount; 4003a7ad07bfSEdward Tomasz Napierala if (old > 1 && atomic_cmpset_int(&prr->prr_refcount, old, old - 1)) 4004a7ad07bfSEdward Tomasz Napierala return; 4005a7ad07bfSEdward Tomasz Napierala 4006a7ad07bfSEdward Tomasz Napierala sx_xlock(&allprison_lock); 4007c34bbd2aSEdward Tomasz Napierala prison_racct_free_locked(prr); 4008a7ad07bfSEdward Tomasz Napierala sx_xunlock(&allprison_lock); 4009a7ad07bfSEdward Tomasz Napierala } 4010a7ad07bfSEdward Tomasz Napierala 4011a7ad07bfSEdward Tomasz Napierala static void 4012a7ad07bfSEdward Tomasz Napierala prison_racct_attach(struct prison *pr) 4013a7ad07bfSEdward Tomasz Napierala { 4014a7ad07bfSEdward Tomasz Napierala struct prison_racct *prr; 4015a7ad07bfSEdward Tomasz Napierala 40164b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 4017c34bbd2aSEdward Tomasz Napierala sx_assert(&allprison_lock, SA_XLOCKED); 4018c34bbd2aSEdward Tomasz Napierala 4019a7ad07bfSEdward Tomasz Napierala prr = prison_racct_find_locked(pr->pr_name); 4020a7ad07bfSEdward Tomasz Napierala KASSERT(prr != NULL, ("cannot find prison_racct")); 4021a7ad07bfSEdward Tomasz Napierala 4022a7ad07bfSEdward Tomasz Napierala pr->pr_prison_racct = prr; 4023a7ad07bfSEdward Tomasz Napierala } 4024a7ad07bfSEdward Tomasz Napierala 4025c34bbd2aSEdward Tomasz Napierala /* 4026c34bbd2aSEdward Tomasz Napierala * Handle jail renaming. From the racct point of view, renaming means 4027c34bbd2aSEdward Tomasz Napierala * moving from one prison_racct to another. 4028c34bbd2aSEdward Tomasz Napierala */ 4029c34bbd2aSEdward Tomasz Napierala static void 4030c34bbd2aSEdward Tomasz Napierala prison_racct_modify(struct prison *pr) 4031c34bbd2aSEdward Tomasz Napierala { 4032dbadb015SKonstantin Belousov #ifdef RCTL 4033c34bbd2aSEdward Tomasz Napierala struct proc *p; 4034c34bbd2aSEdward Tomasz Napierala struct ucred *cred; 4035dbadb015SKonstantin Belousov #endif 4036c34bbd2aSEdward Tomasz Napierala struct prison_racct *oldprr; 4037c34bbd2aSEdward Tomasz Napierala 40384b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 40394b5c9cf6SEdward Tomasz Napierala 4040c34bbd2aSEdward Tomasz Napierala sx_slock(&allproc_lock); 4041c34bbd2aSEdward Tomasz Napierala sx_xlock(&allprison_lock); 4042c34bbd2aSEdward Tomasz Napierala 4043e30345e7SEdward Tomasz Napierala if (strcmp(pr->pr_name, pr->pr_prison_racct->prr_name) == 0) { 4044e30345e7SEdward Tomasz Napierala sx_xunlock(&allprison_lock); 4045e30345e7SEdward Tomasz Napierala sx_sunlock(&allproc_lock); 4046c34bbd2aSEdward Tomasz Napierala return; 4047e30345e7SEdward Tomasz Napierala } 4048c34bbd2aSEdward Tomasz Napierala 4049c34bbd2aSEdward Tomasz Napierala oldprr = pr->pr_prison_racct; 4050c34bbd2aSEdward Tomasz Napierala pr->pr_prison_racct = NULL; 4051c34bbd2aSEdward Tomasz Napierala 4052c34bbd2aSEdward Tomasz Napierala prison_racct_attach(pr); 4053c34bbd2aSEdward Tomasz Napierala 4054c34bbd2aSEdward Tomasz Napierala /* 4055c34bbd2aSEdward Tomasz Napierala * Move resource utilisation records. 4056c34bbd2aSEdward Tomasz Napierala */ 4057c34bbd2aSEdward Tomasz Napierala racct_move(pr->pr_prison_racct->prr_racct, oldprr->prr_racct); 4058c34bbd2aSEdward Tomasz Napierala 4059f87beb93SAndriy Gapon #ifdef RCTL 4060c34bbd2aSEdward Tomasz Napierala /* 4061c34bbd2aSEdward Tomasz Napierala * Force rctl to reattach rules to processes. 4062c34bbd2aSEdward Tomasz Napierala */ 4063c34bbd2aSEdward Tomasz Napierala FOREACH_PROC_IN_SYSTEM(p) { 4064c34bbd2aSEdward Tomasz Napierala PROC_LOCK(p); 4065c34bbd2aSEdward Tomasz Napierala cred = crhold(p->p_ucred); 4066c34bbd2aSEdward Tomasz Napierala PROC_UNLOCK(p); 4067f87beb93SAndriy Gapon rctl_proc_ucred_changed(p, cred); 4068c34bbd2aSEdward Tomasz Napierala crfree(cred); 4069c34bbd2aSEdward Tomasz Napierala } 4070f87beb93SAndriy Gapon #endif 4071c34bbd2aSEdward Tomasz Napierala 4072c34bbd2aSEdward Tomasz Napierala sx_sunlock(&allproc_lock); 4073c34bbd2aSEdward Tomasz Napierala prison_racct_free_locked(oldprr); 4074c34bbd2aSEdward Tomasz Napierala sx_xunlock(&allprison_lock); 4075c34bbd2aSEdward Tomasz Napierala } 4076c34bbd2aSEdward Tomasz Napierala 4077a7ad07bfSEdward Tomasz Napierala static void 4078a7ad07bfSEdward Tomasz Napierala prison_racct_detach(struct prison *pr) 4079a7ad07bfSEdward Tomasz Napierala { 4080c34bbd2aSEdward Tomasz Napierala 40814b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 4082c34bbd2aSEdward Tomasz Napierala sx_assert(&allprison_lock, SA_UNLOCKED); 4083c34bbd2aSEdward Tomasz Napierala 4084af3c786cSMateusz Guzik if (pr->pr_prison_racct == NULL) 4085af3c786cSMateusz Guzik return; 4086a7ad07bfSEdward Tomasz Napierala prison_racct_free(pr->pr_prison_racct); 4087a7ad07bfSEdward Tomasz Napierala pr->pr_prison_racct = NULL; 4088a7ad07bfSEdward Tomasz Napierala } 4089a7ad07bfSEdward Tomasz Napierala #endif /* RACCT */ 4090a7ad07bfSEdward Tomasz Napierala 4091413628a7SBjoern A. Zeeb #ifdef DDB 4092b38ff370SJamie Gritton 4093b38ff370SJamie Gritton static void 4094b38ff370SJamie Gritton db_show_prison(struct prison *pr) 4095413628a7SBjoern A. Zeeb { 4096672756aaSJamie Gritton struct bool_flags *bf; 4097672756aaSJamie Gritton struct jailsys_flags *jsf; 4098b38ff370SJamie Gritton #if defined(INET) || defined(INET6) 4099b38ff370SJamie Gritton int ii; 4100413628a7SBjoern A. Zeeb #endif 4101672756aaSJamie Gritton unsigned f; 41028144690aSEric van Gyzen #ifdef INET 41038144690aSEric van Gyzen char ip4buf[INET_ADDRSTRLEN]; 41048144690aSEric van Gyzen #endif 4105413628a7SBjoern A. Zeeb #ifdef INET6 4106413628a7SBjoern A. Zeeb char ip6buf[INET6_ADDRSTRLEN]; 4107413628a7SBjoern A. Zeeb #endif 4108413628a7SBjoern A. Zeeb 4109b38ff370SJamie Gritton db_printf("prison %p:\n", pr); 4110b38ff370SJamie Gritton db_printf(" jid = %d\n", pr->pr_id); 4111b38ff370SJamie Gritton db_printf(" name = %s\n", pr->pr_name); 41120304c731SJamie Gritton db_printf(" parent = %p\n", pr->pr_parent); 4113b38ff370SJamie Gritton db_printf(" ref = %d\n", pr->pr_ref); 4114b38ff370SJamie Gritton db_printf(" uref = %d\n", pr->pr_uref); 4115b38ff370SJamie Gritton db_printf(" path = %s\n", pr->pr_path); 4116b38ff370SJamie Gritton db_printf(" cpuset = %d\n", pr->pr_cpuset 4117b38ff370SJamie Gritton ? pr->pr_cpuset->cs_id : -1); 4118679e1390SJamie Gritton #ifdef VIMAGE 4119679e1390SJamie Gritton db_printf(" vnet = %p\n", pr->pr_vnet); 4120679e1390SJamie Gritton #endif 4121b38ff370SJamie Gritton db_printf(" root = %p\n", pr->pr_root); 4122b38ff370SJamie Gritton db_printf(" securelevel = %d\n", pr->pr_securelevel); 41230cc207a6SMartin Matuska db_printf(" devfs_rsnum = %d\n", pr->pr_devfs_rsnum); 4124fe0518e9SBjoern A. Zeeb db_printf(" children.max = %d\n", pr->pr_childmax); 4125fe0518e9SBjoern A. Zeeb db_printf(" children.cur = %d\n", pr->pr_childcount); 41260304c731SJamie Gritton db_printf(" child = %p\n", LIST_FIRST(&pr->pr_children)); 41270304c731SJamie Gritton db_printf(" sibling = %p\n", LIST_NEXT(pr, pr_sibling)); 4128fe0518e9SBjoern A. Zeeb db_printf(" flags = 0x%x", pr->pr_flags); 4129672756aaSJamie Gritton for (bf = pr_flag_bool; bf < pr_flag_bool + nitems(pr_flag_bool); bf++) 4130672756aaSJamie Gritton if (pr->pr_flags & bf->flag) 4131672756aaSJamie Gritton db_printf(" %s", bf->name); 4132672756aaSJamie Gritton for (jsf = pr_flag_jailsys; 4133672756aaSJamie Gritton jsf < pr_flag_jailsys + nitems(pr_flag_jailsys); 4134672756aaSJamie Gritton jsf++) { 4135672756aaSJamie Gritton f = pr->pr_flags & (jsf->disable | jsf->new); 4136672756aaSJamie Gritton db_printf(" %-16s= %s\n", jsf->name, 4137672756aaSJamie Gritton (f != 0 && f == jsf->disable) ? "disable" 4138672756aaSJamie Gritton : (f == jsf->new) ? "new" 41397cbf7213SJamie Gritton : "inherit"); 41407cbf7213SJamie Gritton } 4141fe0518e9SBjoern A. Zeeb db_printf(" allow = 0x%x", pr->pr_allow); 4142672756aaSJamie Gritton for (bf = pr_flag_allow; 41430e5c6bd4SJamie Gritton bf < pr_flag_allow + nitems(pr_flag_allow) && bf->flag != 0; 4144672756aaSJamie Gritton bf++) 4145672756aaSJamie Gritton if (pr->pr_allow & bf->flag) 4146672756aaSJamie Gritton db_printf(" %s", bf->name); 4147b38ff370SJamie Gritton db_printf("\n"); 41480304c731SJamie Gritton db_printf(" enforce_statfs = %d\n", pr->pr_enforce_statfs); 4149c1f19219SJamie Gritton db_printf(" host.hostname = %s\n", pr->pr_hostname); 4150c1f19219SJamie Gritton db_printf(" host.domainname = %s\n", pr->pr_domainname); 4151c1f19219SJamie Gritton db_printf(" host.hostuuid = %s\n", pr->pr_hostuuid); 415276ca6f88SJamie Gritton db_printf(" host.hostid = %lu\n", pr->pr_hostid); 4153413628a7SBjoern A. Zeeb #ifdef INET 4154b38ff370SJamie Gritton db_printf(" ip4s = %d\n", pr->pr_ip4s); 4155b38ff370SJamie Gritton for (ii = 0; ii < pr->pr_ip4s; ii++) 4156b38ff370SJamie Gritton db_printf(" %s %s\n", 4157fe0518e9SBjoern A. Zeeb ii == 0 ? "ip4.addr =" : " ", 41588144690aSEric van Gyzen inet_ntoa_r(pr->pr_ip4[ii], ip4buf)); 4159413628a7SBjoern A. Zeeb #endif 4160413628a7SBjoern A. Zeeb #ifdef INET6 4161b38ff370SJamie Gritton db_printf(" ip6s = %d\n", pr->pr_ip6s); 4162b38ff370SJamie Gritton for (ii = 0; ii < pr->pr_ip6s; ii++) 4163b38ff370SJamie Gritton db_printf(" %s %s\n", 4164fe0518e9SBjoern A. Zeeb ii == 0 ? "ip6.addr =" : " ", 4165b38ff370SJamie Gritton ip6_sprintf(ip6buf, &pr->pr_ip6[ii])); 4166b38ff370SJamie Gritton #endif 4167b38ff370SJamie Gritton } 4168b38ff370SJamie Gritton 4169b38ff370SJamie Gritton DB_SHOW_COMMAND(prison, db_show_prison_command) 4170b38ff370SJamie Gritton { 4171b38ff370SJamie Gritton struct prison *pr; 4172b38ff370SJamie Gritton 4173b38ff370SJamie Gritton if (!have_addr) { 41740304c731SJamie Gritton /* 41750304c731SJamie Gritton * Show all prisons in the list, and prison0 which is not 41760304c731SJamie Gritton * listed. 41770304c731SJamie Gritton */ 41780304c731SJamie Gritton db_show_prison(&prison0); 41790304c731SJamie Gritton if (!db_pager_quit) { 4180b38ff370SJamie Gritton TAILQ_FOREACH(pr, &allprison, pr_list) { 4181b38ff370SJamie Gritton db_show_prison(pr); 4182413628a7SBjoern A. Zeeb if (db_pager_quit) 4183413628a7SBjoern A. Zeeb break; 4184413628a7SBjoern A. Zeeb } 41850304c731SJamie Gritton } 4186b38ff370SJamie Gritton return; 4187413628a7SBjoern A. Zeeb } 4188b38ff370SJamie Gritton 41890304c731SJamie Gritton if (addr == 0) 41900304c731SJamie Gritton pr = &prison0; 41910304c731SJamie Gritton else { 4192b38ff370SJamie Gritton /* Look for a prison with the ID and with references. */ 4193b38ff370SJamie Gritton TAILQ_FOREACH(pr, &allprison, pr_list) 4194b38ff370SJamie Gritton if (pr->pr_id == addr && pr->pr_ref > 0) 4195b38ff370SJamie Gritton break; 4196b38ff370SJamie Gritton if (pr == NULL) 4197b38ff370SJamie Gritton /* Look again, without requiring a reference. */ 4198b38ff370SJamie Gritton TAILQ_FOREACH(pr, &allprison, pr_list) 4199b38ff370SJamie Gritton if (pr->pr_id == addr) 4200b38ff370SJamie Gritton break; 4201b38ff370SJamie Gritton if (pr == NULL) 4202b38ff370SJamie Gritton /* Assume address points to a valid prison. */ 4203b38ff370SJamie Gritton pr = (struct prison *)addr; 42040304c731SJamie Gritton } 4205b38ff370SJamie Gritton db_show_prison(pr); 4206b38ff370SJamie Gritton } 4207b38ff370SJamie Gritton 4208413628a7SBjoern A. Zeeb #endif /* DDB */ 4209