19454b2d8SWarner Losh /*- 24d846d26SWarner Losh * SPDX-License-Identifier: BSD-2-Clause 38a36da99SPedro F. Giffuni * 4413628a7SBjoern A. Zeeb * Copyright (c) 1999 Poul-Henning Kamp. 5413628a7SBjoern A. Zeeb * Copyright (c) 2008 Bjoern A. Zeeb. 6b38ff370SJamie Gritton * Copyright (c) 2009 James Gritton. 7413628a7SBjoern A. Zeeb * All rights reserved. 8b9f0b66cSBjoern A. Zeeb * 9b9f0b66cSBjoern A. Zeeb * Redistribution and use in source and binary forms, with or without 10b9f0b66cSBjoern A. Zeeb * modification, are permitted provided that the following conditions 11b9f0b66cSBjoern A. Zeeb * are met: 12b9f0b66cSBjoern A. Zeeb * 1. Redistributions of source code must retain the above copyright 13b9f0b66cSBjoern A. Zeeb * notice, this list of conditions and the following disclaimer. 14b9f0b66cSBjoern A. Zeeb * 2. Redistributions in binary form must reproduce the above copyright 15b9f0b66cSBjoern A. Zeeb * notice, this list of conditions and the following disclaimer in the 16b9f0b66cSBjoern A. Zeeb * documentation and/or other materials provided with the distribution. 17b9f0b66cSBjoern A. Zeeb * 18b9f0b66cSBjoern A. Zeeb * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 19b9f0b66cSBjoern A. Zeeb * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20b9f0b66cSBjoern A. Zeeb * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21b9f0b66cSBjoern A. Zeeb * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 22b9f0b66cSBjoern A. Zeeb * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23b9f0b66cSBjoern A. Zeeb * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24b9f0b66cSBjoern A. Zeeb * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25b9f0b66cSBjoern A. Zeeb * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26b9f0b66cSBjoern A. Zeeb * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27b9f0b66cSBjoern A. Zeeb * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28b9f0b66cSBjoern A. Zeeb * SUCH DAMAGE. 2907901f22SPoul-Henning Kamp */ 3075c13541SPoul-Henning Kamp 31677b542eSDavid E. O'Brien #include <sys/cdefs.h> 32413628a7SBjoern A. Zeeb #include "opt_ddb.h" 33413628a7SBjoern A. Zeeb #include "opt_inet.h" 34413628a7SBjoern A. Zeeb #include "opt_inet6.h" 35bba7a2e8SRick Macklem #include "opt_nfs.h" 3646e3b1cbSPawel Jakub Dawidek 3775c13541SPoul-Henning Kamp #include <sys/param.h> 3875c13541SPoul-Henning Kamp #include <sys/types.h> 3975c13541SPoul-Henning Kamp #include <sys/kernel.h> 4075c13541SPoul-Henning Kamp #include <sys/systm.h> 4175c13541SPoul-Henning Kamp #include <sys/errno.h> 4275c13541SPoul-Henning Kamp #include <sys/sysproto.h> 4375c13541SPoul-Henning Kamp #include <sys/malloc.h> 440304c731SJamie Gritton #include <sys/osd.h> 45800c9408SRobert Watson #include <sys/priv.h> 4675c13541SPoul-Henning Kamp #include <sys/proc.h> 47eb8dcdeaSGleb Smirnoff #include <sys/epoch.h> 48b3059e09SRobert Watson #include <sys/taskqueue.h> 4957b4252eSKonstantin Belousov #include <sys/fcntl.h> 5075c13541SPoul-Henning Kamp #include <sys/jail.h> 51c3188289SKyle Evans #include <sys/linker.h> 5201137630SRobert Watson #include <sys/lock.h> 537060da62SJamie Gritton #include <sys/mman.h> 5401137630SRobert Watson #include <sys/mutex.h> 55097055e2SEdward Tomasz Napierala #include <sys/racct.h> 56f87beb93SAndriy Gapon #include <sys/rctl.h> 57a7ad07bfSEdward Tomasz Napierala #include <sys/refcount.h> 58dc68a633SPawel Jakub Dawidek #include <sys/sx.h> 5976ca6f88SJamie Gritton #include <sys/sysent.h> 60fd7a8150SMike Barcroft #include <sys/namei.h> 61820a0de9SPawel Jakub Dawidek #include <sys/mount.h> 62fd7a8150SMike Barcroft #include <sys/queue.h> 6375c13541SPoul-Henning Kamp #include <sys/socket.h> 64fd7a8150SMike Barcroft #include <sys/syscallsubr.h> 6583f1e257SRobert Watson #include <sys/sysctl.h> 66c3188289SKyle Evans #include <sys/uuid.h> 67fd7a8150SMike Barcroft #include <sys/vnode.h> 68530c0060SRobert Watson 6975c13541SPoul-Henning Kamp #include <net/if.h> 70530c0060SRobert Watson #include <net/vnet.h> 71530c0060SRobert Watson 7275c13541SPoul-Henning Kamp #include <netinet/in.h> 73530c0060SRobert Watson 74413628a7SBjoern A. Zeeb #ifdef DDB 75413628a7SBjoern A. Zeeb #include <ddb/ddb.h> 76413628a7SBjoern A. Zeeb #endif /* DDB */ 7775c13541SPoul-Henning Kamp 78aed55708SRobert Watson #include <security/mac/mac_framework.h> 79aed55708SRobert Watson 80c3188289SKyle Evans #define PRISON0_HOSTUUID_MODULE "hostuuid" 818986e3a0SJamie Gritton 8275c13541SPoul-Henning Kamp MALLOC_DEFINE(M_PRISON, "prison", "Prison structures"); 83d745c852SEd Schouten static MALLOC_DEFINE(M_PRISON_RACCT, "prison_racct", "Prison racct structures"); 8475c13541SPoul-Henning Kamp 85592bcae8SBjoern A. Zeeb /* Keep struct prison prison0 and some code in kern_jail_set() readable. */ 86592bcae8SBjoern A. Zeeb #ifdef INET 87592bcae8SBjoern A. Zeeb #ifdef INET6 88592bcae8SBjoern A. Zeeb #define _PR_IP_SADDRSEL PR_IP4_SADDRSEL|PR_IP6_SADDRSEL 89592bcae8SBjoern A. Zeeb #else 90592bcae8SBjoern A. Zeeb #define _PR_IP_SADDRSEL PR_IP4_SADDRSEL 91592bcae8SBjoern A. Zeeb #endif 92592bcae8SBjoern A. Zeeb #else /* !INET */ 93592bcae8SBjoern A. Zeeb #ifdef INET6 94592bcae8SBjoern A. Zeeb #define _PR_IP_SADDRSEL PR_IP6_SADDRSEL 95592bcae8SBjoern A. Zeeb #else 96592bcae8SBjoern A. Zeeb #define _PR_IP_SADDRSEL 0 97592bcae8SBjoern A. Zeeb #endif 98592bcae8SBjoern A. Zeeb #endif 99592bcae8SBjoern A. Zeeb 1000304c731SJamie Gritton /* prison0 describes what is "real" about the system. */ 1010304c731SJamie Gritton struct prison prison0 = { 1020304c731SJamie Gritton .pr_id = 0, 1030304c731SJamie Gritton .pr_name = "0", 1040304c731SJamie Gritton .pr_ref = 1, 1050304c731SJamie Gritton .pr_uref = 1, 1060304c731SJamie Gritton .pr_path = "/", 1070304c731SJamie Gritton .pr_securelevel = -1, 1080cc207a6SMartin Matuska .pr_devfs_rsnum = 0, 1091158508aSJamie Gritton .pr_state = PRISON_STATE_ALIVE, 110b97457e2SJamie Gritton .pr_childmax = JAIL_MAX, 1118986e3a0SJamie Gritton .pr_hostuuid = DEFAULT_HOSTUUID, 11213e403fdSAntoine Brodin .pr_children = LIST_HEAD_INITIALIZER(prison0.pr_children), 113eb79e1c7SBjoern A. Zeeb #ifdef VIMAGE 114592bcae8SBjoern A. Zeeb .pr_flags = PR_HOST|PR_VNET|_PR_IP_SADDRSEL, 115eb79e1c7SBjoern A. Zeeb #else 116592bcae8SBjoern A. Zeeb .pr_flags = PR_HOST|_PR_IP_SADDRSEL, 117eb79e1c7SBjoern A. Zeeb #endif 1180e5c6bd4SJamie Gritton .pr_allow = PR_ALLOW_ALL_STATIC, 1190304c731SJamie Gritton }; 1200304c731SJamie Gritton MTX_SYSINIT(prison0, &prison0.pr_mtx, "jail mutex", MTX_DEF); 12183f1e257SRobert Watson 122672756aaSJamie Gritton struct bool_flags { 123672756aaSJamie Gritton const char *name; 124672756aaSJamie Gritton const char *noname; 1255d58f959SJamie Gritton volatile u_int flag; 126672756aaSJamie Gritton }; 127672756aaSJamie Gritton struct jailsys_flags { 128672756aaSJamie Gritton const char *name; 129672756aaSJamie Gritton unsigned disable; 130672756aaSJamie Gritton unsigned new; 131672756aaSJamie Gritton }; 132672756aaSJamie Gritton 133a7ad07bfSEdward Tomasz Napierala /* allprison, allprison_racct and lastprid are protected by allprison_lock. */ 134dc68a633SPawel Jakub Dawidek struct sx allprison_lock; 135b38ff370SJamie Gritton SX_SYSINIT(allprison_lock, &allprison_lock, "allprison"); 136b38ff370SJamie Gritton struct prisonlist allprison = TAILQ_HEAD_INITIALIZER(allprison); 137a7ad07bfSEdward Tomasz Napierala LIST_HEAD(, prison_racct) allprison_racct; 1382110d913SXin LI int lastprid = 0; 139ed31b3f4SJamie Gritton int lastdeadid = 0; 140fd7a8150SMike Barcroft 1417de883c8SJamie Gritton static int get_next_prid(struct prison **insprp); 142ed31b3f4SJamie Gritton static int get_next_deadid(struct prison **insprp); 143f7496dcaSJamie Gritton static int do_jail_attach(struct thread *td, struct prison *pr, int drflags); 144b3059e09SRobert Watson static void prison_complete(void *context, int pending); 145b38ff370SJamie Gritton static void prison_deref(struct prison *pr, int flags); 146c861373bSJamie Gritton static void prison_deref_kill(struct prison *pr, struct prisonlist *freeprison); 147f7496dcaSJamie Gritton static int prison_lock_xlock(struct prison *pr, int flags); 148a9f7455cSJamie Gritton static void prison_cleanup(struct prison *pr); 149f7496dcaSJamie Gritton static void prison_free_not_last(struct prison *pr); 150c861373bSJamie Gritton static void prison_proc_free_not_last(struct prison *pr); 1515ecb5444SMateusz Guzik static void prison_proc_relink(struct prison *opr, struct prison *npr, 1525ecb5444SMateusz Guzik struct proc *p); 1530fe74ae6SJamie Gritton static void prison_set_allow_locked(struct prison *pr, unsigned flag, 1540fe74ae6SJamie Gritton int enable); 1550304c731SJamie Gritton static char *prison_path(struct prison *pr1, struct prison *pr2); 156a7ad07bfSEdward Tomasz Napierala #ifdef RACCT 157a7ad07bfSEdward Tomasz Napierala static void prison_racct_attach(struct prison *pr); 158c34bbd2aSEdward Tomasz Napierala static void prison_racct_modify(struct prison *pr); 159a7ad07bfSEdward Tomasz Napierala static void prison_racct_detach(struct prison *pr); 160a7ad07bfSEdward Tomasz Napierala #endif 161fd7a8150SMike Barcroft 162b38ff370SJamie Gritton /* Flags for prison_deref */ 1632a4b2251SJamie Gritton #define PD_DEREF 0x01 /* Decrement pr_ref */ 1642a4b2251SJamie Gritton #define PD_DEUREF 0x02 /* Decrement pr_uref */ 165c861373bSJamie Gritton #define PD_KILL 0x04 /* Remove jail, kill processes, etc */ 166c861373bSJamie Gritton #define PD_LOCKED 0x10 /* pr_mtx is held */ 167c861373bSJamie Gritton #define PD_LIST_SLOCKED 0x20 /* allprison_lock is held shared */ 168c861373bSJamie Gritton #define PD_LIST_XLOCKED 0x40 /* allprison_lock is held exclusive */ 169589e4c1dSJamie Gritton #define PD_OP_FLAGS 0x07 /* Operation flags */ 170589e4c1dSJamie Gritton #define PD_LOCK_FLAGS 0x70 /* Lock status flags */ 171fd7a8150SMike Barcroft 1720304c731SJamie Gritton /* 1735cc70397SBjoern A. Zeeb * Parameter names corresponding to PR_* flag values. Size values are for kvm 1745cc70397SBjoern A. Zeeb * as we cannot figure out the size of a sparse array, or an array without a 1755cc70397SBjoern A. Zeeb * terminating entry. 1760304c731SJamie Gritton */ 177672756aaSJamie Gritton static struct bool_flags pr_flag_bool[] = { 178672756aaSJamie Gritton {"persist", "nopersist", PR_PERSIST}, 179592bcae8SBjoern A. Zeeb #ifdef INET 180672756aaSJamie Gritton {"ip4.saddrsel", "ip4.nosaddrsel", PR_IP4_SADDRSEL}, 181592bcae8SBjoern A. Zeeb #endif 182592bcae8SBjoern A. Zeeb #ifdef INET6 183672756aaSJamie Gritton {"ip6.saddrsel", "ip6.nosaddrsel", PR_IP6_SADDRSEL}, 184592bcae8SBjoern A. Zeeb #endif 1850304c731SJamie Gritton }; 186672756aaSJamie Gritton const size_t pr_flag_bool_size = sizeof(pr_flag_bool); 1870304c731SJamie Gritton 188672756aaSJamie Gritton static struct jailsys_flags pr_flag_jailsys[] = { 1897cbf7213SJamie Gritton {"host", 0, PR_HOST}, 1907cbf7213SJamie Gritton #ifdef VIMAGE 1917cbf7213SJamie Gritton {"vnet", 0, PR_VNET}, 1927cbf7213SJamie Gritton #endif 1930304c731SJamie Gritton #ifdef INET 1946a3f2779SJamie Gritton {"ip4", PR_IP4_USER, PR_IP4_USER}, 1950304c731SJamie Gritton #endif 1960304c731SJamie Gritton #ifdef INET6 1976a3f2779SJamie Gritton {"ip6", PR_IP6_USER, PR_IP6_USER}, 198679e1390SJamie Gritton #endif 1990304c731SJamie Gritton }; 2005cc70397SBjoern A. Zeeb const size_t pr_flag_jailsys_size = sizeof(pr_flag_jailsys); 2010304c731SJamie Gritton 2025d58f959SJamie Gritton /* 2035d58f959SJamie Gritton * Make this array full-size so dynamic parameters can be added. 2045d58f959SJamie Gritton * It is protected by prison0.mtx, but lockless reading is allowed 2055d58f959SJamie Gritton * with an atomic check of the flag values. 2065d58f959SJamie Gritton */ 2070e5c6bd4SJamie Gritton static struct bool_flags pr_flag_allow[NBBY * NBPW] = { 208672756aaSJamie Gritton {"allow.set_hostname", "allow.noset_hostname", PR_ALLOW_SET_HOSTNAME}, 209672756aaSJamie Gritton {"allow.sysvipc", "allow.nosysvipc", PR_ALLOW_SYSVIPC}, 210672756aaSJamie Gritton {"allow.raw_sockets", "allow.noraw_sockets", PR_ALLOW_RAW_SOCKETS}, 211672756aaSJamie Gritton {"allow.chflags", "allow.nochflags", PR_ALLOW_CHFLAGS}, 212672756aaSJamie Gritton {"allow.mount", "allow.nomount", PR_ALLOW_MOUNT}, 213672756aaSJamie Gritton {"allow.quotas", "allow.noquotas", PR_ALLOW_QUOTAS}, 214672756aaSJamie Gritton {"allow.socket_af", "allow.nosocket_af", PR_ALLOW_SOCKET_AF}, 215ccd6ac9fSAntoine Brodin {"allow.mlock", "allow.nomlock", PR_ALLOW_MLOCK}, 216672756aaSJamie Gritton {"allow.reserved_ports", "allow.noreserved_ports", 217672756aaSJamie Gritton PR_ALLOW_RESERVED_PORTS}, 218b19d66fdSJamie Gritton {"allow.read_msgbuf", "allow.noread_msgbuf", PR_ALLOW_READ_MSGBUF}, 219b3079544SJamie Gritton {"allow.unprivileged_proc_debug", "allow.nounprivileged_proc_debug", 220b3079544SJamie Gritton PR_ALLOW_UNPRIV_DEBUG}, 22105e1e482SMariusz Zaborski {"allow.suser", "allow.nosuser", PR_ALLOW_SUSER}, 222cbbb2203SRick Macklem #ifdef VIMAGE 223bba7a2e8SRick Macklem {"allow.nfsd", "allow.nonfsd", PR_ALLOW_NFSD}, 224bba7a2e8SRick Macklem #endif 225cb48780dSShawn Webb {"allow.extattr", "allow.noextattr", PR_ALLOW_EXTATTR}, 226d3bb35d4SMariusz Zaborski {"allow.adjtime", "allow.noadjtime", PR_ALLOW_ADJTIME}, 227d3bb35d4SMariusz Zaborski {"allow.settime", "allow.nosettime", PR_ALLOW_SETTIME}, 2280304c731SJamie Gritton }; 2295d58f959SJamie Gritton static unsigned pr_allow_all = PR_ALLOW_ALL_STATIC; 230672756aaSJamie Gritton const size_t pr_flag_allow_size = sizeof(pr_flag_allow); 2310304c731SJamie Gritton 232b3079544SJamie Gritton #define JAIL_DEFAULT_ALLOW (PR_ALLOW_SET_HOSTNAME | \ 233b3079544SJamie Gritton PR_ALLOW_RESERVED_PORTS | \ 23405e1e482SMariusz Zaborski PR_ALLOW_UNPRIV_DEBUG | \ 23505e1e482SMariusz Zaborski PR_ALLOW_SUSER) 23642bebd82SJamie Gritton #define JAIL_DEFAULT_ENFORCE_STATFS 2 237bf3db8aaSMartin Matuska #define JAIL_DEFAULT_DEVFS_RSNUM 0 2380304c731SJamie Gritton static unsigned jail_default_allow = JAIL_DEFAULT_ALLOW; 23942bebd82SJamie Gritton static int jail_default_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS; 2400cc207a6SMartin Matuska static int jail_default_devfs_rsnum = JAIL_DEFAULT_DEVFS_RSNUM; 2410304c731SJamie Gritton #if defined(INET) || defined(INET6) 242e92e0574SJamie Gritton static unsigned jail_max_af_ips = 255; 2430304c731SJamie Gritton #endif 2440304c731SJamie Gritton 245b96bd95bSIan Lepore /* 246b96bd95bSIan Lepore * Initialize the parts of prison0 that can't be static-initialized with 247b96bd95bSIan Lepore * constants. This is called from proc0_init() after creating thread0 cpuset. 248b96bd95bSIan Lepore */ 249b96bd95bSIan Lepore void 250b96bd95bSIan Lepore prison0_init(void) 251b96bd95bSIan Lepore { 252c3188289SKyle Evans uint8_t *file, *data; 253c3188289SKyle Evans size_t size; 254d2ef3774SJessica Clarke char buf[sizeof(prison0.pr_hostuuid)]; 255d2ef3774SJessica Clarke bool valid; 256b96bd95bSIan Lepore 257b96bd95bSIan Lepore prison0.pr_cpuset = cpuset_ref(thread0.td_cpuset); 258b96bd95bSIan Lepore prison0.pr_osreldate = osreldate; 259b96bd95bSIan Lepore strlcpy(prison0.pr_osrelease, osrelease, sizeof(prison0.pr_osrelease)); 260c3188289SKyle Evans 261c3188289SKyle Evans /* If we have a preloaded hostuuid, use it. */ 262c3188289SKyle Evans file = preload_search_by_type(PRISON0_HOSTUUID_MODULE); 263c3188289SKyle Evans if (file != NULL) { 264c3188289SKyle Evans data = preload_fetch_addr(file); 265c3188289SKyle Evans size = preload_fetch_size(file); 266c3188289SKyle Evans if (data != NULL) { 267c3188289SKyle Evans /* 268c3188289SKyle Evans * The preloaded data may include trailing whitespace, almost 269c3188289SKyle Evans * certainly a newline; skip over any whitespace or 270c3188289SKyle Evans * non-printable characters to be safe. 271c3188289SKyle Evans */ 272c3188289SKyle Evans while (size > 0 && data[size - 1] <= 0x20) { 273b6be9566SColin Percival size--; 274c3188289SKyle Evans } 275d2ef3774SJessica Clarke 276d2ef3774SJessica Clarke valid = false; 277d2ef3774SJessica Clarke 278d2ef3774SJessica Clarke /* 279d2ef3774SJessica Clarke * Not NUL-terminated when passed from loader, but 280d2ef3774SJessica Clarke * validate_uuid requires that due to using sscanf (as 281d2ef3774SJessica Clarke * does the subsequent strlcpy, since it still reads 282d2ef3774SJessica Clarke * past the given size to return the true length); 283d2ef3774SJessica Clarke * bounce to a temporary buffer to fix. 284d2ef3774SJessica Clarke */ 285d2ef3774SJessica Clarke if (size >= sizeof(buf)) 286d2ef3774SJessica Clarke goto done; 287d2ef3774SJessica Clarke 288d2ef3774SJessica Clarke memcpy(buf, data, size); 289d2ef3774SJessica Clarke buf[size] = '\0'; 290d2ef3774SJessica Clarke 291d2ef3774SJessica Clarke if (validate_uuid(buf, size, NULL, 0) != 0) 292d2ef3774SJessica Clarke goto done; 293d2ef3774SJessica Clarke 294d2ef3774SJessica Clarke valid = true; 295d2ef3774SJessica Clarke (void)strlcpy(prison0.pr_hostuuid, buf, 296d2ef3774SJessica Clarke sizeof(prison0.pr_hostuuid)); 297d2ef3774SJessica Clarke 298d2ef3774SJessica Clarke done: 299d2ef3774SJessica Clarke if (bootverbose && !valid) { 300330f110bSColin Percival printf("hostuuid: preload data malformed: '%.*s'\n", 301330f110bSColin Percival (int)size, data); 302c3188289SKyle Evans } 303c3188289SKyle Evans } 304c3188289SKyle Evans } 305c3188289SKyle Evans if (bootverbose) 306c3188289SKyle Evans printf("hostuuid: using %s\n", prison0.pr_hostuuid); 307b96bd95bSIan Lepore } 308b96bd95bSIan Lepore 309116734c4SMatthew Dillon /* 3109ddb7954SMike Barcroft * struct jail_args { 3119ddb7954SMike Barcroft * struct jail *jail; 3129ddb7954SMike Barcroft * }; 313116734c4SMatthew Dillon */ 31475c13541SPoul-Henning Kamp int 315c542c43eSJamie Gritton sys_jail(struct thread *td, struct jail_args *uap) 31675c13541SPoul-Henning Kamp { 317413628a7SBjoern A. Zeeb uint32_t version; 318413628a7SBjoern A. Zeeb int error; 3190304c731SJamie Gritton struct jail j; 320413628a7SBjoern A. Zeeb 321413628a7SBjoern A. Zeeb error = copyin(uap->jail, &version, sizeof(uint32_t)); 322413628a7SBjoern A. Zeeb if (error) 323413628a7SBjoern A. Zeeb return (error); 324413628a7SBjoern A. Zeeb 325413628a7SBjoern A. Zeeb switch (version) { 326413628a7SBjoern A. Zeeb case 0: 327413628a7SBjoern A. Zeeb { 328413628a7SBjoern A. Zeeb struct jail_v0 j0; 329413628a7SBjoern A. Zeeb 3300304c731SJamie Gritton /* FreeBSD single IPv4 jails. */ 3310304c731SJamie Gritton bzero(&j, sizeof(struct jail)); 332413628a7SBjoern A. Zeeb error = copyin(uap->jail, &j0, sizeof(struct jail_v0)); 333413628a7SBjoern A. Zeeb if (error) 334413628a7SBjoern A. Zeeb return (error); 3350304c731SJamie Gritton j.version = j0.version; 3360304c731SJamie Gritton j.path = j0.path; 3370304c731SJamie Gritton j.hostname = j0.hostname; 338b5019bc4SPeter Wemm j.ip4s = htonl(j0.ip_number); /* jail_v0 is host order */ 339413628a7SBjoern A. Zeeb break; 340413628a7SBjoern A. Zeeb } 341413628a7SBjoern A. Zeeb 342413628a7SBjoern A. Zeeb case 1: 343413628a7SBjoern A. Zeeb /* 344413628a7SBjoern A. Zeeb * Version 1 was used by multi-IPv4 jail implementations 345413628a7SBjoern A. Zeeb * that never made it into the official kernel. 346413628a7SBjoern A. Zeeb */ 347413628a7SBjoern A. Zeeb return (EINVAL); 348413628a7SBjoern A. Zeeb 349413628a7SBjoern A. Zeeb case 2: /* JAIL_API_VERSION */ 350413628a7SBjoern A. Zeeb /* FreeBSD multi-IPv4/IPv6,noIP jails. */ 351413628a7SBjoern A. Zeeb error = copyin(uap->jail, &j, sizeof(struct jail)); 352413628a7SBjoern A. Zeeb if (error) 353413628a7SBjoern A. Zeeb return (error); 3540304c731SJamie Gritton break; 3550304c731SJamie Gritton 3560304c731SJamie Gritton default: 3570304c731SJamie Gritton /* Sci-Fi jails are not supported, sorry. */ 3580304c731SJamie Gritton return (EINVAL); 3590304c731SJamie Gritton } 360c542c43eSJamie Gritton return (kern_jail(td, &j)); 3610304c731SJamie Gritton } 3620304c731SJamie Gritton 3630304c731SJamie Gritton int 364c542c43eSJamie Gritton kern_jail(struct thread *td, struct jail *j) 3650304c731SJamie Gritton { 366c542c43eSJamie Gritton struct iovec optiov[2 * (4 + nitems(pr_flag_allow) 367e92e0574SJamie Gritton #ifdef INET 368e92e0574SJamie Gritton + 1 369e92e0574SJamie Gritton #endif 370e92e0574SJamie Gritton #ifdef INET6 371e92e0574SJamie Gritton + 1 372e92e0574SJamie Gritton #endif 373e92e0574SJamie Gritton )]; 3740304c731SJamie Gritton struct uio opt; 3750304c731SJamie Gritton char *u_path, *u_hostname, *u_name; 376672756aaSJamie Gritton struct bool_flags *bf; 3770304c731SJamie Gritton #ifdef INET 378e92e0574SJamie Gritton uint32_t ip4s; 3790304c731SJamie Gritton struct in_addr *u_ip4; 3800304c731SJamie Gritton #endif 3810304c731SJamie Gritton #ifdef INET6 3820304c731SJamie Gritton struct in6_addr *u_ip6; 3830304c731SJamie Gritton #endif 3840304c731SJamie Gritton size_t tmplen; 385c542c43eSJamie Gritton int error, enforce_statfs; 3860304c731SJamie Gritton 3870304c731SJamie Gritton bzero(&optiov, sizeof(optiov)); 3880304c731SJamie Gritton opt.uio_iov = optiov; 3890304c731SJamie Gritton opt.uio_iovcnt = 0; 3900304c731SJamie Gritton opt.uio_offset = -1; 3910304c731SJamie Gritton opt.uio_resid = -1; 3920304c731SJamie Gritton opt.uio_segflg = UIO_SYSSPACE; 3930304c731SJamie Gritton opt.uio_rw = UIO_READ; 3940304c731SJamie Gritton opt.uio_td = td; 3950304c731SJamie Gritton 3960304c731SJamie Gritton /* Set permissions for top-level jails from sysctls. */ 3970304c731SJamie Gritton if (!jailed(td->td_ucred)) { 398672756aaSJamie Gritton for (bf = pr_flag_allow; 3990e5c6bd4SJamie Gritton bf < pr_flag_allow + nitems(pr_flag_allow) && 4005d58f959SJamie Gritton atomic_load_int(&bf->flag) != 0; 401672756aaSJamie Gritton bf++) { 402672756aaSJamie Gritton optiov[opt.uio_iovcnt].iov_base = __DECONST(char *, 403672756aaSJamie Gritton (jail_default_allow & bf->flag) 404672756aaSJamie Gritton ? bf->name : bf->noname); 4050304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = 4060304c731SJamie Gritton strlen(optiov[opt.uio_iovcnt].iov_base) + 1; 4070304c731SJamie Gritton opt.uio_iovcnt += 2; 4080304c731SJamie Gritton } 4090304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "enforce_statfs"; 4100304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("enforce_statfs"); 4110304c731SJamie Gritton opt.uio_iovcnt++; 4120304c731SJamie Gritton enforce_statfs = jail_default_enforce_statfs; 4130304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = &enforce_statfs; 4140304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof(enforce_statfs); 4150304c731SJamie Gritton opt.uio_iovcnt++; 4160304c731SJamie Gritton } 4170304c731SJamie Gritton 418b38ff370SJamie Gritton tmplen = MAXPATHLEN + MAXHOSTNAMELEN + MAXHOSTNAMELEN; 419b38ff370SJamie Gritton #ifdef INET 4200304c731SJamie Gritton ip4s = (j->version == 0) ? 1 : j->ip4s; 4210304c731SJamie Gritton if (ip4s > jail_max_af_ips) 422b38ff370SJamie Gritton return (EINVAL); 4230304c731SJamie Gritton tmplen += ip4s * sizeof(struct in_addr); 424b38ff370SJamie Gritton #else 4250304c731SJamie Gritton if (j->ip4s > 0) 426b38ff370SJamie Gritton return (EINVAL); 427b38ff370SJamie Gritton #endif 428b38ff370SJamie Gritton #ifdef INET6 4290304c731SJamie Gritton if (j->ip6s > jail_max_af_ips) 430b38ff370SJamie Gritton return (EINVAL); 4310304c731SJamie Gritton tmplen += j->ip6s * sizeof(struct in6_addr); 432b38ff370SJamie Gritton #else 4330304c731SJamie Gritton if (j->ip6s > 0) 434b38ff370SJamie Gritton return (EINVAL); 435b38ff370SJamie Gritton #endif 436b38ff370SJamie Gritton u_path = malloc(tmplen, M_TEMP, M_WAITOK); 437b38ff370SJamie Gritton u_hostname = u_path + MAXPATHLEN; 438b38ff370SJamie Gritton u_name = u_hostname + MAXHOSTNAMELEN; 439b38ff370SJamie Gritton #ifdef INET 440b38ff370SJamie Gritton u_ip4 = (struct in_addr *)(u_name + MAXHOSTNAMELEN); 441b38ff370SJamie Gritton #endif 442b38ff370SJamie Gritton #ifdef INET6 443b38ff370SJamie Gritton #ifdef INET 4440304c731SJamie Gritton u_ip6 = (struct in6_addr *)(u_ip4 + ip4s); 445b38ff370SJamie Gritton #else 446b38ff370SJamie Gritton u_ip6 = (struct in6_addr *)(u_name + MAXHOSTNAMELEN); 447b38ff370SJamie Gritton #endif 448b38ff370SJamie Gritton #endif 4490304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "path"; 4500304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("path"); 4510304c731SJamie Gritton opt.uio_iovcnt++; 4520304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = u_path; 4530304c731SJamie Gritton error = copyinstr(j->path, u_path, MAXPATHLEN, 4540304c731SJamie Gritton &optiov[opt.uio_iovcnt].iov_len); 455b38ff370SJamie Gritton if (error) { 456b38ff370SJamie Gritton free(u_path, M_TEMP); 457b38ff370SJamie Gritton return (error); 458b38ff370SJamie Gritton } 4590304c731SJamie Gritton opt.uio_iovcnt++; 4600304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "host.hostname"; 4610304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("host.hostname"); 4620304c731SJamie Gritton opt.uio_iovcnt++; 4630304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_base = u_hostname; 4640304c731SJamie Gritton error = copyinstr(j->hostname, u_hostname, MAXHOSTNAMELEN, 4650304c731SJamie Gritton &optiov[opt.uio_iovcnt].iov_len); 466b38ff370SJamie Gritton if (error) { 467b38ff370SJamie Gritton free(u_path, M_TEMP); 468b38ff370SJamie Gritton return (error); 469b38ff370SJamie Gritton } 4700304c731SJamie Gritton opt.uio_iovcnt++; 4710304c731SJamie Gritton if (j->jailname != NULL) { 472b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "name"; 473b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("name"); 474b38ff370SJamie Gritton opt.uio_iovcnt++; 475b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = u_name; 4760304c731SJamie Gritton error = copyinstr(j->jailname, u_name, MAXHOSTNAMELEN, 477b38ff370SJamie Gritton &optiov[opt.uio_iovcnt].iov_len); 478b38ff370SJamie Gritton if (error) { 479b38ff370SJamie Gritton free(u_path, M_TEMP); 480b38ff370SJamie Gritton return (error); 481b38ff370SJamie Gritton } 482b38ff370SJamie Gritton opt.uio_iovcnt++; 483b38ff370SJamie Gritton } 484b38ff370SJamie Gritton #ifdef INET 485b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "ip4.addr"; 486b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("ip4.addr"); 487b38ff370SJamie Gritton opt.uio_iovcnt++; 488b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = u_ip4; 4890304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = ip4s * sizeof(struct in_addr); 4900304c731SJamie Gritton if (j->version == 0) 4910304c731SJamie Gritton u_ip4->s_addr = j->ip4s; 4920304c731SJamie Gritton else { 4930304c731SJamie Gritton error = copyin(j->ip4, u_ip4, optiov[opt.uio_iovcnt].iov_len); 494b38ff370SJamie Gritton if (error) { 495b38ff370SJamie Gritton free(u_path, M_TEMP); 496b38ff370SJamie Gritton return (error); 497b38ff370SJamie Gritton } 4980304c731SJamie Gritton } 499b38ff370SJamie Gritton opt.uio_iovcnt++; 500b38ff370SJamie Gritton #endif 501b38ff370SJamie Gritton #ifdef INET6 502b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = "ip6.addr"; 503b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_len = sizeof("ip6.addr"); 504b38ff370SJamie Gritton opt.uio_iovcnt++; 505b38ff370SJamie Gritton optiov[opt.uio_iovcnt].iov_base = u_ip6; 5060304c731SJamie Gritton optiov[opt.uio_iovcnt].iov_len = j->ip6s * sizeof(struct in6_addr); 5070304c731SJamie Gritton error = copyin(j->ip6, u_ip6, optiov[opt.uio_iovcnt].iov_len); 508b38ff370SJamie Gritton if (error) { 509b38ff370SJamie Gritton free(u_path, M_TEMP); 510b38ff370SJamie Gritton return (error); 511b38ff370SJamie Gritton } 512b38ff370SJamie Gritton opt.uio_iovcnt++; 513b38ff370SJamie Gritton #endif 51402abd400SPedro F. Giffuni KASSERT(opt.uio_iovcnt <= nitems(optiov), 5150304c731SJamie Gritton ("kern_jail: too many iovecs (%d)", opt.uio_iovcnt)); 516b38ff370SJamie Gritton error = kern_jail_set(td, &opt, JAIL_CREATE | JAIL_ATTACH); 517b38ff370SJamie Gritton free(u_path, M_TEMP); 518b38ff370SJamie Gritton return (error); 519b38ff370SJamie Gritton } 520b38ff370SJamie Gritton 521b38ff370SJamie Gritton /* 522b38ff370SJamie Gritton * struct jail_set_args { 523b38ff370SJamie Gritton * struct iovec *iovp; 524b38ff370SJamie Gritton * unsigned int iovcnt; 525b38ff370SJamie Gritton * int flags; 526b38ff370SJamie Gritton * }; 527b38ff370SJamie Gritton */ 528b38ff370SJamie Gritton int 5298451d0ddSKip Macy sys_jail_set(struct thread *td, struct jail_set_args *uap) 530b38ff370SJamie Gritton { 531b38ff370SJamie Gritton struct uio *auio; 532b38ff370SJamie Gritton int error; 533b38ff370SJamie Gritton 534b38ff370SJamie Gritton /* Check that we have an even number of iovecs. */ 535b38ff370SJamie Gritton if (uap->iovcnt & 1) 536b38ff370SJamie Gritton return (EINVAL); 537b38ff370SJamie Gritton 538b38ff370SJamie Gritton error = copyinuio(uap->iovp, uap->iovcnt, &auio); 539b38ff370SJamie Gritton if (error) 540b38ff370SJamie Gritton return (error); 541b38ff370SJamie Gritton error = kern_jail_set(td, auio, uap->flags); 54261cc4830SAlfredo Mazzinghi freeuio(auio); 543b38ff370SJamie Gritton return (error); 544413628a7SBjoern A. Zeeb } 545413628a7SBjoern A. Zeeb 546eb8dcdeaSGleb Smirnoff #if defined(INET) || defined(INET6) 547eb8dcdeaSGleb Smirnoff typedef int prison_addr_cmp_t(const void *, const void *); 548eb8dcdeaSGleb Smirnoff typedef bool prison_addr_valid_t(const void *); 549eb8dcdeaSGleb Smirnoff static const struct pr_family { 550eb8dcdeaSGleb Smirnoff size_t size; 551eb8dcdeaSGleb Smirnoff prison_addr_cmp_t *cmp; 552eb8dcdeaSGleb Smirnoff prison_addr_valid_t *valid; 553eb8dcdeaSGleb Smirnoff int ip_flag; 554eb8dcdeaSGleb Smirnoff } pr_families[PR_FAMILY_MAX] = { 555eb8dcdeaSGleb Smirnoff #ifdef INET 556eb8dcdeaSGleb Smirnoff [PR_INET] = { 557eb8dcdeaSGleb Smirnoff .size = sizeof(struct in_addr), 558eb8dcdeaSGleb Smirnoff .cmp = prison_qcmp_v4, 559eb8dcdeaSGleb Smirnoff .valid = prison_valid_v4, 560eb8dcdeaSGleb Smirnoff .ip_flag = PR_IP4_USER, 561eb8dcdeaSGleb Smirnoff }, 562eb8dcdeaSGleb Smirnoff #endif 563eb8dcdeaSGleb Smirnoff #ifdef INET6 564eb8dcdeaSGleb Smirnoff [PR_INET6] = { 565eb8dcdeaSGleb Smirnoff .size = sizeof(struct in6_addr), 566eb8dcdeaSGleb Smirnoff .cmp = prison_qcmp_v6, 567eb8dcdeaSGleb Smirnoff .valid = prison_valid_v6, 568eb8dcdeaSGleb Smirnoff .ip_flag = PR_IP6_USER, 569eb8dcdeaSGleb Smirnoff }, 570eb8dcdeaSGleb Smirnoff #endif 571eb8dcdeaSGleb Smirnoff }; 572eb8dcdeaSGleb Smirnoff 573eb8dcdeaSGleb Smirnoff /* 574eb8dcdeaSGleb Smirnoff * Network address lists (pr_addrs) allocation for jails. The addresses 575eb8dcdeaSGleb Smirnoff * are accessed locklessly by the network stack, thus need to be protected by 576eb8dcdeaSGleb Smirnoff * the network epoch. 577eb8dcdeaSGleb Smirnoff */ 578eb8dcdeaSGleb Smirnoff struct prison_ip { 579eb8dcdeaSGleb Smirnoff struct epoch_context ctx; 580eb8dcdeaSGleb Smirnoff uint32_t ips; 581eb8dcdeaSGleb Smirnoff #ifdef FUTURE_C 582500f82d6SZhenlei Huang /* 583500f82d6SZhenlei Huang * XXX Variable-length automatic arrays in union may be 584500f82d6SZhenlei Huang * supported in future C. 585500f82d6SZhenlei Huang */ 586eb8dcdeaSGleb Smirnoff union { 587500f82d6SZhenlei Huang char pr_ip[]; 588eb8dcdeaSGleb Smirnoff struct in_addr pr_ip4[]; 589eb8dcdeaSGleb Smirnoff struct in6_addr pr_ip6[]; 590eb8dcdeaSGleb Smirnoff }; 591eb8dcdeaSGleb Smirnoff #else /* No future C :( */ 592500f82d6SZhenlei Huang char pr_ip[]; 593eb8dcdeaSGleb Smirnoff #endif 594eb8dcdeaSGleb Smirnoff }; 595eb8dcdeaSGleb Smirnoff 596500f82d6SZhenlei Huang static char * 597500f82d6SZhenlei Huang PR_IP(struct prison_ip *pip, const pr_family_t af, int idx) 598500f82d6SZhenlei Huang { 599500f82d6SZhenlei Huang MPASS(pip); 600500f82d6SZhenlei Huang MPASS(af < PR_FAMILY_MAX); 601500f82d6SZhenlei Huang MPASS(idx >= 0 && idx < pip->ips); 602500f82d6SZhenlei Huang 603500f82d6SZhenlei Huang return (pip->pr_ip + pr_families[af].size * idx); 604500f82d6SZhenlei Huang } 605500f82d6SZhenlei Huang 606eb8dcdeaSGleb Smirnoff static struct prison_ip * 607eb8dcdeaSGleb Smirnoff prison_ip_alloc(const pr_family_t af, uint32_t cnt, int flags) 608eb8dcdeaSGleb Smirnoff { 609eb8dcdeaSGleb Smirnoff struct prison_ip *pip; 610eb8dcdeaSGleb Smirnoff 611eb8dcdeaSGleb Smirnoff pip = malloc(sizeof(struct prison_ip) + cnt * pr_families[af].size, 612eb8dcdeaSGleb Smirnoff M_PRISON, flags); 613eb8dcdeaSGleb Smirnoff if (pip != NULL) 614eb8dcdeaSGleb Smirnoff pip->ips = cnt; 615eb8dcdeaSGleb Smirnoff return (pip); 616eb8dcdeaSGleb Smirnoff } 617eb8dcdeaSGleb Smirnoff 618eb8dcdeaSGleb Smirnoff /* 619eb8dcdeaSGleb Smirnoff * Allocate and copyin user supplied address list, sorting and validating. 620eb8dcdeaSGleb Smirnoff * kern_jail_set() helper. 621eb8dcdeaSGleb Smirnoff */ 622eb8dcdeaSGleb Smirnoff static struct prison_ip * 623eb8dcdeaSGleb Smirnoff prison_ip_copyin(const pr_family_t af, void *op, uint32_t cnt) 624eb8dcdeaSGleb Smirnoff { 625eb8dcdeaSGleb Smirnoff prison_addr_cmp_t *const cmp = pr_families[af].cmp; 626eb8dcdeaSGleb Smirnoff const size_t size = pr_families[af].size; 627eb8dcdeaSGleb Smirnoff struct prison_ip *pip; 628eb8dcdeaSGleb Smirnoff 629eb8dcdeaSGleb Smirnoff pip = prison_ip_alloc(af, cnt, M_WAITOK); 630500f82d6SZhenlei Huang bcopy(op, pip->pr_ip, cnt * size); 631eb8dcdeaSGleb Smirnoff /* 632eb8dcdeaSGleb Smirnoff * IP addresses are all sorted but ip[0] to preserve 633eb8dcdeaSGleb Smirnoff * the primary IP address as given from userland. 634eb8dcdeaSGleb Smirnoff * This special IP is used for unbound outgoing 635eb8dcdeaSGleb Smirnoff * connections as well for "loopback" traffic in case 636eb8dcdeaSGleb Smirnoff * source address selection cannot find any more fitting 637eb8dcdeaSGleb Smirnoff * address to connect from. 638eb8dcdeaSGleb Smirnoff */ 639eb8dcdeaSGleb Smirnoff if (cnt > 1) 6402c33b456SZhenlei Huang qsort(PR_IP(pip, af, 1), cnt - 1, size, cmp); 641eb8dcdeaSGleb Smirnoff /* 642eb8dcdeaSGleb Smirnoff * Check for duplicate addresses and do some simple 643eb8dcdeaSGleb Smirnoff * zero and broadcast checks. If users give other bogus 644eb8dcdeaSGleb Smirnoff * addresses it is their problem. 645eb8dcdeaSGleb Smirnoff */ 646eb8dcdeaSGleb Smirnoff for (int i = 0; i < cnt; i++) { 647500f82d6SZhenlei Huang if (!pr_families[af].valid(PR_IP(pip, af, i))) { 648eb8dcdeaSGleb Smirnoff free(pip, M_PRISON); 649eb8dcdeaSGleb Smirnoff return (NULL); 650eb8dcdeaSGleb Smirnoff } 651eb8dcdeaSGleb Smirnoff if (i + 1 < cnt && 652500f82d6SZhenlei Huang (cmp(PR_IP(pip, af, 0), PR_IP(pip, af, i + 1)) == 0 || 653500f82d6SZhenlei Huang cmp(PR_IP(pip, af, i), PR_IP(pip, af, i + 1)) == 0)) { 654eb8dcdeaSGleb Smirnoff free(pip, M_PRISON); 655eb8dcdeaSGleb Smirnoff return (NULL); 656eb8dcdeaSGleb Smirnoff } 657eb8dcdeaSGleb Smirnoff } 658eb8dcdeaSGleb Smirnoff 659eb8dcdeaSGleb Smirnoff return (pip); 660eb8dcdeaSGleb Smirnoff } 661eb8dcdeaSGleb Smirnoff 662eb8dcdeaSGleb Smirnoff /* 663eb8dcdeaSGleb Smirnoff * Allocate and dup parent prison address list. 664eb8dcdeaSGleb Smirnoff * kern_jail_set() helper. 665eb8dcdeaSGleb Smirnoff */ 666eb8dcdeaSGleb Smirnoff static void 667eb8dcdeaSGleb Smirnoff prison_ip_dup(struct prison *ppr, struct prison *pr, const pr_family_t af) 668eb8dcdeaSGleb Smirnoff { 6692c33b456SZhenlei Huang const struct prison_ip *ppip = ppr->pr_addrs[af]; 6702c33b456SZhenlei Huang struct prison_ip *pip; 671eb8dcdeaSGleb Smirnoff 6722c33b456SZhenlei Huang if (ppip != NULL) { 6732c33b456SZhenlei Huang pip = prison_ip_alloc(af, ppip->ips, M_WAITOK); 6742c33b456SZhenlei Huang bcopy(ppip->pr_ip, pip->pr_ip, pip->ips * pr_families[af].size); 6752c33b456SZhenlei Huang pr->pr_addrs[af] = pip; 676eb8dcdeaSGleb Smirnoff } 677eb8dcdeaSGleb Smirnoff } 678eb8dcdeaSGleb Smirnoff 679eb8dcdeaSGleb Smirnoff /* 680eb8dcdeaSGleb Smirnoff * Make sure the new set of IP addresses is a subset of the parent's list. 681eb8dcdeaSGleb Smirnoff * Don't worry about the parent being unlocked, as any setting is done with 682eb8dcdeaSGleb Smirnoff * allprison_lock held. 683eb8dcdeaSGleb Smirnoff * kern_jail_set() helper. 684eb8dcdeaSGleb Smirnoff */ 685eb8dcdeaSGleb Smirnoff static bool 686500f82d6SZhenlei Huang prison_ip_parent_match(struct prison_ip *ppip, struct prison_ip *pip, 687500f82d6SZhenlei Huang const pr_family_t af) 688eb8dcdeaSGleb Smirnoff { 689eb8dcdeaSGleb Smirnoff prison_addr_cmp_t *const cmp = pr_families[af].cmp; 690eb8dcdeaSGleb Smirnoff int i, j; 691eb8dcdeaSGleb Smirnoff 692eb8dcdeaSGleb Smirnoff if (ppip == NULL) 693eb8dcdeaSGleb Smirnoff return (false); 694eb8dcdeaSGleb Smirnoff 695eb8dcdeaSGleb Smirnoff for (i = 0; i < ppip->ips; i++) 696500f82d6SZhenlei Huang if (cmp(PR_IP(pip, af, 0), PR_IP(ppip, af, i)) == 0) 697eb8dcdeaSGleb Smirnoff break; 698eb8dcdeaSGleb Smirnoff 699eb8dcdeaSGleb Smirnoff if (i == ppip->ips) 700eb8dcdeaSGleb Smirnoff /* Main address not present in parent. */ 701eb8dcdeaSGleb Smirnoff return (false); 702eb8dcdeaSGleb Smirnoff 703eb8dcdeaSGleb Smirnoff if (pip->ips > 1) { 704eb8dcdeaSGleb Smirnoff for (i = j = 1; i < pip->ips; i++) { 705500f82d6SZhenlei Huang if (cmp(PR_IP(pip, af, i), PR_IP(ppip, af, 0)) == 0) 706eb8dcdeaSGleb Smirnoff /* Equals to parent primary address. */ 707eb8dcdeaSGleb Smirnoff continue; 708eb8dcdeaSGleb Smirnoff for (; j < ppip->ips; j++) 709500f82d6SZhenlei Huang if (cmp(PR_IP(pip, af, i), 710500f82d6SZhenlei Huang PR_IP(ppip, af, j)) == 0) 711eb8dcdeaSGleb Smirnoff break; 712eb8dcdeaSGleb Smirnoff if (j == ppip->ips) 713eb8dcdeaSGleb Smirnoff break; 714eb8dcdeaSGleb Smirnoff } 715eb8dcdeaSGleb Smirnoff if (j == ppip->ips) 716eb8dcdeaSGleb Smirnoff /* Address not present in parent. */ 717eb8dcdeaSGleb Smirnoff return (false); 718eb8dcdeaSGleb Smirnoff } 719eb8dcdeaSGleb Smirnoff return (true); 720eb8dcdeaSGleb Smirnoff } 721eb8dcdeaSGleb Smirnoff 722eb8dcdeaSGleb Smirnoff /* 723eb8dcdeaSGleb Smirnoff * Check for conflicting IP addresses. We permit them if there is no more 724eb8dcdeaSGleb Smirnoff * than one IP on each jail. If there is a duplicate on a jail with more 725eb8dcdeaSGleb Smirnoff * than one IP stop checking and return error. 726eb8dcdeaSGleb Smirnoff * kern_jail_set() helper. 727eb8dcdeaSGleb Smirnoff */ 728eb8dcdeaSGleb Smirnoff static bool 729eb8dcdeaSGleb Smirnoff prison_ip_conflict_check(const struct prison *ppr, const struct prison *pr, 730500f82d6SZhenlei Huang struct prison_ip *pip, pr_family_t af) 731eb8dcdeaSGleb Smirnoff { 732eb8dcdeaSGleb Smirnoff const struct prison *tppr, *tpr; 733eb8dcdeaSGleb Smirnoff int descend; 734eb8dcdeaSGleb Smirnoff 735eb8dcdeaSGleb Smirnoff #ifdef VIMAGE 736eb8dcdeaSGleb Smirnoff for (tppr = ppr; tppr != &prison0; tppr = tppr->pr_parent) 737eb8dcdeaSGleb Smirnoff if (tppr->pr_flags & PR_VNET) 738eb8dcdeaSGleb Smirnoff break; 739eb8dcdeaSGleb Smirnoff #else 740eb8dcdeaSGleb Smirnoff tppr = &prison0; 741eb8dcdeaSGleb Smirnoff #endif 742eb8dcdeaSGleb Smirnoff FOREACH_PRISON_DESCENDANT(tppr, tpr, descend) { 743eb8dcdeaSGleb Smirnoff if (tpr == pr || 744eb8dcdeaSGleb Smirnoff #ifdef VIMAGE 745eb8dcdeaSGleb Smirnoff (tpr != tppr && (tpr->pr_flags & PR_VNET)) || 746eb8dcdeaSGleb Smirnoff #endif 747eb8dcdeaSGleb Smirnoff !prison_isalive(tpr)) { 748eb8dcdeaSGleb Smirnoff descend = 0; 749eb8dcdeaSGleb Smirnoff continue; 750eb8dcdeaSGleb Smirnoff } 751eb8dcdeaSGleb Smirnoff if (!(tpr->pr_flags & pr_families[af].ip_flag)) 752eb8dcdeaSGleb Smirnoff continue; 753eb8dcdeaSGleb Smirnoff descend = 0; 754eb8dcdeaSGleb Smirnoff if (tpr->pr_addrs[af] == NULL || 755eb8dcdeaSGleb Smirnoff (pip->ips == 1 && tpr->pr_addrs[af]->ips == 1)) 756eb8dcdeaSGleb Smirnoff continue; 757eb8dcdeaSGleb Smirnoff for (int i = 0; i < pip->ips; i++) 758500f82d6SZhenlei Huang if (prison_ip_check(tpr, af, PR_IP(pip, af, i)) == 0) 759eb8dcdeaSGleb Smirnoff return (false); 760eb8dcdeaSGleb Smirnoff } 761eb8dcdeaSGleb Smirnoff 762eb8dcdeaSGleb Smirnoff return (true); 763eb8dcdeaSGleb Smirnoff } 764eb8dcdeaSGleb Smirnoff 765eb8dcdeaSGleb Smirnoff _Static_assert(offsetof(struct prison_ip, ctx) == 0, 766eb8dcdeaSGleb Smirnoff "prison must start with epoch context"); 767eb8dcdeaSGleb Smirnoff static void 768eb8dcdeaSGleb Smirnoff prison_ip_free_deferred(epoch_context_t ctx) 769eb8dcdeaSGleb Smirnoff { 770eb8dcdeaSGleb Smirnoff 771eb8dcdeaSGleb Smirnoff free(ctx, M_PRISON); 772eb8dcdeaSGleb Smirnoff } 773eb8dcdeaSGleb Smirnoff 774eb8dcdeaSGleb Smirnoff static void 775eb8dcdeaSGleb Smirnoff prison_ip_free(struct prison_ip *pip) 776eb8dcdeaSGleb Smirnoff { 777eb8dcdeaSGleb Smirnoff 778eb8dcdeaSGleb Smirnoff if (pip != NULL) 779eb8dcdeaSGleb Smirnoff NET_EPOCH_CALL(prison_ip_free_deferred, &pip->ctx); 780eb8dcdeaSGleb Smirnoff } 781eb8dcdeaSGleb Smirnoff 782eb8dcdeaSGleb Smirnoff static void 783eb8dcdeaSGleb Smirnoff prison_ip_set(struct prison *pr, const pr_family_t af, struct prison_ip *new) 784eb8dcdeaSGleb Smirnoff { 785eb8dcdeaSGleb Smirnoff struct prison_ip **mem, *old; 786eb8dcdeaSGleb Smirnoff 787eb8dcdeaSGleb Smirnoff mtx_assert(&pr->pr_mtx, MA_OWNED); 788eb8dcdeaSGleb Smirnoff 789eb8dcdeaSGleb Smirnoff mem = &pr->pr_addrs[af]; 790eb8dcdeaSGleb Smirnoff 791eb8dcdeaSGleb Smirnoff old = *mem; 79227202b98SMark Johnston atomic_store_ptr(mem, new); 793eb8dcdeaSGleb Smirnoff prison_ip_free(old); 794eb8dcdeaSGleb Smirnoff } 795eb8dcdeaSGleb Smirnoff 796eb8dcdeaSGleb Smirnoff /* 797eb8dcdeaSGleb Smirnoff * Restrict a prison's IP address list with its parent's, possibly replacing 7988bce8d28SZhenlei Huang * it. Return true if succeed, otherwise should redo. 799eb8dcdeaSGleb Smirnoff * kern_jail_set() helper. 800eb8dcdeaSGleb Smirnoff */ 801eb8dcdeaSGleb Smirnoff static bool 802eb8dcdeaSGleb Smirnoff prison_ip_restrict(struct prison *pr, const pr_family_t af, 8038bce8d28SZhenlei Huang struct prison_ip **newp) 804eb8dcdeaSGleb Smirnoff { 805500f82d6SZhenlei Huang struct prison_ip *ppip = pr->pr_parent->pr_addrs[af]; 806500f82d6SZhenlei Huang struct prison_ip *pip = pr->pr_addrs[af]; 807eb8dcdeaSGleb Smirnoff int (*const cmp)(const void *, const void *) = pr_families[af].cmp; 808eb8dcdeaSGleb Smirnoff const size_t size = pr_families[af].size; 8098bce8d28SZhenlei Huang struct prison_ip *new = newp != NULL ? *newp : NULL; 810eb8dcdeaSGleb Smirnoff uint32_t ips; 811eb8dcdeaSGleb Smirnoff 812eb8dcdeaSGleb Smirnoff mtx_assert(&pr->pr_mtx, MA_OWNED); 813eb8dcdeaSGleb Smirnoff 814eb8dcdeaSGleb Smirnoff /* 815eb8dcdeaSGleb Smirnoff * Due to epoch-synchronized access to the IP address lists we always 816eb8dcdeaSGleb Smirnoff * allocate a new list even if the old one has enough space. We could 817eb8dcdeaSGleb Smirnoff * atomically update an IPv4 address inside a list, but that would 818eb8dcdeaSGleb Smirnoff * screw up sorting, and in case of IPv6 we can't even atomically write 819eb8dcdeaSGleb Smirnoff * one. 820eb8dcdeaSGleb Smirnoff */ 82189ddfbbaSZhenlei Huang if (ppip == NULL) { 82289ddfbbaSZhenlei Huang if (pip != NULL) 823eb8dcdeaSGleb Smirnoff prison_ip_set(pr, af, NULL); 8248bce8d28SZhenlei Huang return (true); 825eb8dcdeaSGleb Smirnoff } 82689ddfbbaSZhenlei Huang 827eb8dcdeaSGleb Smirnoff if (!(pr->pr_flags & pr_families[af].ip_flag)) { 82889ddfbbaSZhenlei Huang if (new == NULL) { 82989ddfbbaSZhenlei Huang new = prison_ip_alloc(af, ppip->ips, M_NOWAIT); 83089ddfbbaSZhenlei Huang if (new == NULL) 8318bce8d28SZhenlei Huang return (false); /* Redo */ 8328bce8d28SZhenlei Huang } 833eb8dcdeaSGleb Smirnoff /* This has no user settings, so just copy the parent's list. */ 83489ddfbbaSZhenlei Huang MPASS(new->ips == ppip->ips); 835500f82d6SZhenlei Huang bcopy(ppip->pr_ip, new->pr_ip, ppip->ips * size); 83689ddfbbaSZhenlei Huang prison_ip_set(pr, af, new); 8378bce8d28SZhenlei Huang if (newp != NULL) 8388bce8d28SZhenlei Huang *newp = NULL; /* Used */ 83989ddfbbaSZhenlei Huang } else if (pip != NULL) { 840eb8dcdeaSGleb Smirnoff /* Remove addresses that aren't in the parent. */ 841eb8dcdeaSGleb Smirnoff int i; 842eb8dcdeaSGleb Smirnoff 843eb8dcdeaSGleb Smirnoff i = 0; /* index in pip */ 844eb8dcdeaSGleb Smirnoff ips = 0; /* index in new */ 845eb8dcdeaSGleb Smirnoff 84689ddfbbaSZhenlei Huang if (new == NULL) { 84789ddfbbaSZhenlei Huang new = prison_ip_alloc(af, pip->ips, M_NOWAIT); 84889ddfbbaSZhenlei Huang if (new == NULL) 8498bce8d28SZhenlei Huang return (false); /* Redo */ 85089ddfbbaSZhenlei Huang } 85189ddfbbaSZhenlei Huang 852eb8dcdeaSGleb Smirnoff for (int pi = 0; pi < ppip->ips; pi++) 853500f82d6SZhenlei Huang if (cmp(PR_IP(pip, af, 0), PR_IP(ppip, af, pi)) == 0) { 854eb8dcdeaSGleb Smirnoff /* Found our primary address in parent. */ 855500f82d6SZhenlei Huang bcopy(PR_IP(pip, af, i), PR_IP(new, af, ips), 856500f82d6SZhenlei Huang size); 857eb8dcdeaSGleb Smirnoff i++; 858eb8dcdeaSGleb Smirnoff ips++; 859eb8dcdeaSGleb Smirnoff break; 860eb8dcdeaSGleb Smirnoff } 861eb8dcdeaSGleb Smirnoff for (int pi = 1; i < pip->ips; ) { 862eb8dcdeaSGleb Smirnoff /* Check against primary, which is unsorted. */ 863500f82d6SZhenlei Huang if (cmp(PR_IP(pip, af, i), PR_IP(ppip, af, 0)) == 0) { 864eb8dcdeaSGleb Smirnoff /* Matches parent's primary address. */ 865500f82d6SZhenlei Huang bcopy(PR_IP(pip, af, i), PR_IP(new, af, ips), 866500f82d6SZhenlei Huang size); 867eb8dcdeaSGleb Smirnoff i++; 868eb8dcdeaSGleb Smirnoff ips++; 869eb8dcdeaSGleb Smirnoff continue; 870eb8dcdeaSGleb Smirnoff } 871eb8dcdeaSGleb Smirnoff /* The rest are sorted. */ 872eb8dcdeaSGleb Smirnoff switch (pi >= ppip->ips ? -1 : 873500f82d6SZhenlei Huang cmp(PR_IP(pip, af, i), PR_IP(ppip, af, pi))) { 874eb8dcdeaSGleb Smirnoff case -1: 875eb8dcdeaSGleb Smirnoff i++; 876eb8dcdeaSGleb Smirnoff break; 877eb8dcdeaSGleb Smirnoff case 0: 878500f82d6SZhenlei Huang bcopy(PR_IP(pip, af, i), PR_IP(new, af, ips), 879500f82d6SZhenlei Huang size); 880eb8dcdeaSGleb Smirnoff i++; 881eb8dcdeaSGleb Smirnoff pi++; 882eb8dcdeaSGleb Smirnoff ips++; 883eb8dcdeaSGleb Smirnoff break; 884eb8dcdeaSGleb Smirnoff case 1: 885eb8dcdeaSGleb Smirnoff pi++; 886eb8dcdeaSGleb Smirnoff break; 887eb8dcdeaSGleb Smirnoff } 888eb8dcdeaSGleb Smirnoff } 889eb8dcdeaSGleb Smirnoff if (ips == 0) { 8908bce8d28SZhenlei Huang if (newp == NULL || *newp == NULL) 891eb8dcdeaSGleb Smirnoff prison_ip_free(new); 892eb8dcdeaSGleb Smirnoff new = NULL; 89389ddfbbaSZhenlei Huang } else { 89489ddfbbaSZhenlei Huang /* Shrink to real size */ 89589ddfbbaSZhenlei Huang KASSERT((new->ips >= ips), 89689ddfbbaSZhenlei Huang ("Out-of-bounds write to prison_ip %p", new)); 89789ddfbbaSZhenlei Huang new->ips = ips; 898eb8dcdeaSGleb Smirnoff } 899eb8dcdeaSGleb Smirnoff prison_ip_set(pr, af, new); 9008bce8d28SZhenlei Huang if (newp != NULL) 9018bce8d28SZhenlei Huang *newp = NULL; /* Used */ 90289ddfbbaSZhenlei Huang } 9038bce8d28SZhenlei Huang return (true); 904eb8dcdeaSGleb Smirnoff } 905eb8dcdeaSGleb Smirnoff 906eb8dcdeaSGleb Smirnoff /* 907eb8dcdeaSGleb Smirnoff * Fast-path check if an address belongs to a prison. 908eb8dcdeaSGleb Smirnoff */ 909eb8dcdeaSGleb Smirnoff int 910eb8dcdeaSGleb Smirnoff prison_ip_check(const struct prison *pr, const pr_family_t af, 911eb8dcdeaSGleb Smirnoff const void *addr) 912eb8dcdeaSGleb Smirnoff { 913eb8dcdeaSGleb Smirnoff int (*const cmp)(const void *, const void *) = pr_families[af].cmp; 914500f82d6SZhenlei Huang struct prison_ip *pip; 915eb8dcdeaSGleb Smirnoff int i, a, z, d; 916eb8dcdeaSGleb Smirnoff 917eb8dcdeaSGleb Smirnoff MPASS(mtx_owned(&pr->pr_mtx) || 918eb8dcdeaSGleb Smirnoff in_epoch(net_epoch_preempt) || 919eb8dcdeaSGleb Smirnoff sx_xlocked(&allprison_lock)); 920eb8dcdeaSGleb Smirnoff 92127202b98SMark Johnston pip = atomic_load_ptr(&pr->pr_addrs[af]); 922eb8dcdeaSGleb Smirnoff if (__predict_false(pip == NULL)) 923eb8dcdeaSGleb Smirnoff return (EAFNOSUPPORT); 924eb8dcdeaSGleb Smirnoff 925eb8dcdeaSGleb Smirnoff /* Check the primary IP. */ 926500f82d6SZhenlei Huang if (cmp(PR_IP(pip, af, 0), addr) == 0) 927eb8dcdeaSGleb Smirnoff return (0); 928eb8dcdeaSGleb Smirnoff 929eb8dcdeaSGleb Smirnoff /* 930eb8dcdeaSGleb Smirnoff * All the other IPs are sorted so we can do a binary search. 931eb8dcdeaSGleb Smirnoff */ 932eb8dcdeaSGleb Smirnoff a = 0; 933eb8dcdeaSGleb Smirnoff z = pip->ips - 2; 934eb8dcdeaSGleb Smirnoff while (a <= z) { 935eb8dcdeaSGleb Smirnoff i = (a + z) / 2; 936500f82d6SZhenlei Huang d = cmp(PR_IP(pip, af, i + 1), addr); 937eb8dcdeaSGleb Smirnoff if (d > 0) 938eb8dcdeaSGleb Smirnoff z = i - 1; 939eb8dcdeaSGleb Smirnoff else if (d < 0) 940eb8dcdeaSGleb Smirnoff a = i + 1; 941eb8dcdeaSGleb Smirnoff else 942eb8dcdeaSGleb Smirnoff return (0); 943eb8dcdeaSGleb Smirnoff } 944eb8dcdeaSGleb Smirnoff 945eb8dcdeaSGleb Smirnoff return (EADDRNOTAVAIL); 946eb8dcdeaSGleb Smirnoff } 947eb8dcdeaSGleb Smirnoff 948eb8dcdeaSGleb Smirnoff /* 949eb8dcdeaSGleb Smirnoff * Grab primary IP. Historically required mutex, but nothing prevents 950eb8dcdeaSGleb Smirnoff * us to support epoch-protected access. Is it used in fast path? 951eb8dcdeaSGleb Smirnoff * in{6}_jail.c helper 952eb8dcdeaSGleb Smirnoff */ 953eb8dcdeaSGleb Smirnoff const void * 954eb8dcdeaSGleb Smirnoff prison_ip_get0(const struct prison *pr, const pr_family_t af) 955eb8dcdeaSGleb Smirnoff { 956eb8dcdeaSGleb Smirnoff const struct prison_ip *pip = pr->pr_addrs[af]; 957eb8dcdeaSGleb Smirnoff 958eb8dcdeaSGleb Smirnoff mtx_assert(&pr->pr_mtx, MA_OWNED); 959eb8dcdeaSGleb Smirnoff MPASS(pip); 960eb8dcdeaSGleb Smirnoff 961500f82d6SZhenlei Huang return (pip->pr_ip); 962eb8dcdeaSGleb Smirnoff } 963eb8dcdeaSGleb Smirnoff 964eb8dcdeaSGleb Smirnoff u_int 965eb8dcdeaSGleb Smirnoff prison_ip_cnt(const struct prison *pr, const pr_family_t af) 966eb8dcdeaSGleb Smirnoff { 967eb8dcdeaSGleb Smirnoff 968eb8dcdeaSGleb Smirnoff return (pr->pr_addrs[af]->ips); 969eb8dcdeaSGleb Smirnoff } 970eb8dcdeaSGleb Smirnoff #endif /* defined(INET) || defined(INET6) */ 971eb8dcdeaSGleb Smirnoff 972413628a7SBjoern A. Zeeb int 973b38ff370SJamie Gritton kern_jail_set(struct thread *td, struct uio *optuio, int flags) 974413628a7SBjoern A. Zeeb { 975fd7a8150SMike Barcroft struct nameidata nd; 976b38ff370SJamie Gritton #ifdef INET 977eb8dcdeaSGleb Smirnoff struct prison_ip *ip4; 978413628a7SBjoern A. Zeeb #endif 979b38ff370SJamie Gritton #ifdef INET6 980eb8dcdeaSGleb Smirnoff struct prison_ip *ip6; 981b38ff370SJamie Gritton #endif 982b38ff370SJamie Gritton struct vfsopt *opt; 983b38ff370SJamie Gritton struct vfsoptlist *opts; 984ed31b3f4SJamie Gritton struct prison *pr, *deadpr, *dinspr, *inspr, *mypr, *ppr, *tpr; 985b38ff370SJamie Gritton struct vnode *root; 986babbbb9cSJamie Gritton char *domain, *errmsg, *host, *name, *namelc, *p, *path, *uuid; 987b96bd95bSIan Lepore char *g_path, *osrelstr; 988672756aaSJamie Gritton struct bool_flags *bf; 989672756aaSJamie Gritton struct jailsys_flags *jsf; 9900304c731SJamie Gritton #if defined(INET) || defined(INET6) 991b38ff370SJamie Gritton void *op; 9920304c731SJamie Gritton #endif 99376ca6f88SJamie Gritton unsigned long hid; 994b6f47c23SJamie Gritton size_t namelen, onamelen, pnamelen; 995ed31b3f4SJamie Gritton int created, cuflags, descend, drflags, enforce; 996cc5fd8c7SJamie Gritton int error, errmsg_len, errmsg_pos; 9970cc207a6SMartin Matuska int gotchildmax, gotenforce, gothid, gotrsnum, gotslevel; 998ed31b3f4SJamie Gritton int deadid, jid, jsys, len, level; 999b96bd95bSIan Lepore int childmax, osreldt, rsnum, slevel; 1000413628a7SBjoern A. Zeeb #ifdef INET 10018bce8d28SZhenlei Huang int ip4s; 10028bce8d28SZhenlei Huang bool redo_ip4; 1003413628a7SBjoern A. Zeeb #endif 1004b38ff370SJamie Gritton #ifdef INET6 10058bce8d28SZhenlei Huang int ip6s; 10068bce8d28SZhenlei Huang bool redo_ip6; 1007b38ff370SJamie Gritton #endif 10086beb3bb4SKirk McKusick uint64_t pr_allow, ch_allow, pr_flags, ch_flags; 1009b3079544SJamie Gritton uint64_t pr_allow_diff; 10106beb3bb4SKirk McKusick unsigned tallow; 1011b38ff370SJamie Gritton char numbuf[12]; 1012b38ff370SJamie Gritton 1013b38ff370SJamie Gritton error = priv_check(td, PRIV_JAIL_SET); 1014b38ff370SJamie Gritton if (!error && (flags & JAIL_ATTACH)) 1015b38ff370SJamie Gritton error = priv_check(td, PRIV_JAIL_ATTACH); 1016b38ff370SJamie Gritton if (error) 101775c13541SPoul-Henning Kamp return (error); 1018b6f47c23SJamie Gritton mypr = td->td_ucred->cr_prison; 1019b97457e2SJamie Gritton if ((flags & JAIL_CREATE) && mypr->pr_childmax == 0) 10200304c731SJamie Gritton return (EPERM); 1021b38ff370SJamie Gritton if (flags & ~JAIL_SET_MASK) 1022b38ff370SJamie Gritton return (EINVAL); 1023b38ff370SJamie Gritton 1024b38ff370SJamie Gritton /* 1025b38ff370SJamie Gritton * Check all the parameters before committing to anything. Not all 1026b38ff370SJamie Gritton * errors can be caught early, but we may as well try. Also, this 1027b38ff370SJamie Gritton * takes care of some expensive stuff (path lookup) before getting 1028b38ff370SJamie Gritton * the allprison lock. 1029b38ff370SJamie Gritton * 1030b38ff370SJamie Gritton * XXX Jails are not filesystems, and jail parameters are not mount 1031b38ff370SJamie Gritton * options. But it makes more sense to re-use the vfsopt code 1032b38ff370SJamie Gritton * than duplicate it under a different name. 1033b38ff370SJamie Gritton */ 1034b38ff370SJamie Gritton error = vfs_buildopts(optuio, &opts); 1035b38ff370SJamie Gritton if (error) 1036b38ff370SJamie Gritton return (error); 1037b38ff370SJamie Gritton #ifdef INET 1038b38ff370SJamie Gritton ip4 = NULL; 1039b38ff370SJamie Gritton #endif 1040b38ff370SJamie Gritton #ifdef INET6 1041b38ff370SJamie Gritton ip6 = NULL; 1042b38ff370SJamie Gritton #endif 10436dfe0a3dSMartin Matuska g_path = NULL; 1044b38ff370SJamie Gritton 1045b6f47c23SJamie Gritton cuflags = flags & (JAIL_CREATE | JAIL_UPDATE); 1046b6f47c23SJamie Gritton if (!cuflags) { 1047b6f47c23SJamie Gritton error = EINVAL; 1048b6f47c23SJamie Gritton vfs_opterror(opts, "no valid operation (create or update)"); 1049b6f47c23SJamie Gritton goto done_errmsg; 1050b6f47c23SJamie Gritton } 1051b6f47c23SJamie Gritton 1052b38ff370SJamie Gritton error = vfs_copyopt(opts, "jid", &jid, sizeof(jid)); 1053b38ff370SJamie Gritton if (error == ENOENT) 1054b38ff370SJamie Gritton jid = 0; 1055b38ff370SJamie Gritton else if (error != 0) 1056b38ff370SJamie Gritton goto done_free; 1057b38ff370SJamie Gritton 1058b38ff370SJamie Gritton error = vfs_copyopt(opts, "securelevel", &slevel, sizeof(slevel)); 1059b38ff370SJamie Gritton if (error == ENOENT) 1060b38ff370SJamie Gritton gotslevel = 0; 1061b38ff370SJamie Gritton else if (error != 0) 1062b38ff370SJamie Gritton goto done_free; 1063b38ff370SJamie Gritton else 1064b38ff370SJamie Gritton gotslevel = 1; 1065b38ff370SJamie Gritton 1066b97457e2SJamie Gritton error = 1067b97457e2SJamie Gritton vfs_copyopt(opts, "children.max", &childmax, sizeof(childmax)); 1068b97457e2SJamie Gritton if (error == ENOENT) 1069b97457e2SJamie Gritton gotchildmax = 0; 1070b97457e2SJamie Gritton else if (error != 0) 1071b97457e2SJamie Gritton goto done_free; 1072b97457e2SJamie Gritton else 1073b97457e2SJamie Gritton gotchildmax = 1; 1074b97457e2SJamie Gritton 10750304c731SJamie Gritton error = vfs_copyopt(opts, "enforce_statfs", &enforce, sizeof(enforce)); 1076f337198dSJamie Gritton if (error == ENOENT) 1077f337198dSJamie Gritton gotenforce = 0; 1078f337198dSJamie Gritton else if (error != 0) 10790304c731SJamie Gritton goto done_free; 1080f337198dSJamie Gritton else if (enforce < 0 || enforce > 2) { 1081f337198dSJamie Gritton error = EINVAL; 1082f337198dSJamie Gritton goto done_free; 1083f337198dSJamie Gritton } else 1084f337198dSJamie Gritton gotenforce = 1; 10850304c731SJamie Gritton 10860cc207a6SMartin Matuska error = vfs_copyopt(opts, "devfs_ruleset", &rsnum, sizeof(rsnum)); 10870cc207a6SMartin Matuska if (error == ENOENT) 10880cc207a6SMartin Matuska gotrsnum = 0; 10890cc207a6SMartin Matuska else if (error != 0) 10900cc207a6SMartin Matuska goto done_free; 10910cc207a6SMartin Matuska else 10920cc207a6SMartin Matuska gotrsnum = 1; 10930cc207a6SMartin Matuska 1094b38ff370SJamie Gritton pr_flags = ch_flags = 0; 1095672756aaSJamie Gritton for (bf = pr_flag_bool; 1096672756aaSJamie Gritton bf < pr_flag_bool + nitems(pr_flag_bool); 1097672756aaSJamie Gritton bf++) { 1098672756aaSJamie Gritton vfs_flagopt(opts, bf->name, &pr_flags, bf->flag); 1099672756aaSJamie Gritton vfs_flagopt(opts, bf->noname, &ch_flags, bf->flag); 11000304c731SJamie Gritton } 1101b38ff370SJamie Gritton ch_flags |= pr_flags; 1102672756aaSJamie Gritton for (jsf = pr_flag_jailsys; 1103672756aaSJamie Gritton jsf < pr_flag_jailsys + nitems(pr_flag_jailsys); 1104672756aaSJamie Gritton jsf++) { 1105672756aaSJamie Gritton error = vfs_copyopt(opts, jsf->name, &jsys, sizeof(jsys)); 11067cbf7213SJamie Gritton if (error == ENOENT) 11077cbf7213SJamie Gritton continue; 11087cbf7213SJamie Gritton if (error != 0) 11097cbf7213SJamie Gritton goto done_free; 11107cbf7213SJamie Gritton switch (jsys) { 11117cbf7213SJamie Gritton case JAIL_SYS_DISABLE: 1112672756aaSJamie Gritton if (!jsf->disable) { 11137cbf7213SJamie Gritton error = EINVAL; 11147cbf7213SJamie Gritton goto done_free; 11157cbf7213SJamie Gritton } 1116672756aaSJamie Gritton pr_flags |= jsf->disable; 11177cbf7213SJamie Gritton break; 11187cbf7213SJamie Gritton case JAIL_SYS_NEW: 1119672756aaSJamie Gritton pr_flags |= jsf->new; 11207cbf7213SJamie Gritton break; 11217cbf7213SJamie Gritton case JAIL_SYS_INHERIT: 11227cbf7213SJamie Gritton break; 11237cbf7213SJamie Gritton default: 11247cbf7213SJamie Gritton error = EINVAL; 11257cbf7213SJamie Gritton goto done_free; 11267cbf7213SJamie Gritton } 1127672756aaSJamie Gritton ch_flags |= jsf->new | jsf->disable; 11287cbf7213SJamie Gritton } 11291158508aSJamie Gritton if ((flags & (JAIL_CREATE | JAIL_ATTACH)) == JAIL_CREATE 11304affa14cSJamie Gritton && !(pr_flags & PR_PERSIST)) { 11314affa14cSJamie Gritton error = EINVAL; 11324affa14cSJamie Gritton vfs_opterror(opts, "new jail must persist or attach"); 11334affa14cSJamie Gritton goto done_errmsg; 11344affa14cSJamie Gritton } 1135679e1390SJamie Gritton #ifdef VIMAGE 1136679e1390SJamie Gritton if ((flags & JAIL_UPDATE) && (ch_flags & PR_VNET)) { 1137679e1390SJamie Gritton error = EINVAL; 1138679e1390SJamie Gritton vfs_opterror(opts, "vnet cannot be changed after creation"); 1139679e1390SJamie Gritton goto done_errmsg; 1140679e1390SJamie Gritton } 1141679e1390SJamie Gritton #endif 11422b0d6f81SJamie Gritton #ifdef INET 11432b0d6f81SJamie Gritton if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP4_USER)) { 11442b0d6f81SJamie Gritton error = EINVAL; 11452b0d6f81SJamie Gritton vfs_opterror(opts, "ip4 cannot be changed after creation"); 11462b0d6f81SJamie Gritton goto done_errmsg; 11472b0d6f81SJamie Gritton } 11482b0d6f81SJamie Gritton #endif 11492b0d6f81SJamie Gritton #ifdef INET6 11502b0d6f81SJamie Gritton if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP6_USER)) { 11512b0d6f81SJamie Gritton error = EINVAL; 11522b0d6f81SJamie Gritton vfs_opterror(opts, "ip6 cannot be changed after creation"); 11532b0d6f81SJamie Gritton goto done_errmsg; 11542b0d6f81SJamie Gritton } 11552b0d6f81SJamie Gritton #endif 1156b38ff370SJamie Gritton 11570304c731SJamie Gritton pr_allow = ch_allow = 0; 1158672756aaSJamie Gritton for (bf = pr_flag_allow; 11595d58f959SJamie Gritton bf < pr_flag_allow + nitems(pr_flag_allow) && 11605d58f959SJamie Gritton atomic_load_int(&bf->flag) != 0; 1161672756aaSJamie Gritton bf++) { 1162672756aaSJamie Gritton vfs_flagopt(opts, bf->name, &pr_allow, bf->flag); 1163672756aaSJamie Gritton vfs_flagopt(opts, bf->noname, &ch_allow, bf->flag); 11640304c731SJamie Gritton } 11650304c731SJamie Gritton ch_allow |= pr_allow; 11660304c731SJamie Gritton 1167b38ff370SJamie Gritton error = vfs_getopt(opts, "name", (void **)&name, &len); 1168b38ff370SJamie Gritton if (error == ENOENT) 1169b38ff370SJamie Gritton name = NULL; 1170b38ff370SJamie Gritton else if (error != 0) 1171b38ff370SJamie Gritton goto done_free; 1172b38ff370SJamie Gritton else { 1173b38ff370SJamie Gritton if (len == 0 || name[len - 1] != '\0') { 1174b38ff370SJamie Gritton error = EINVAL; 1175b38ff370SJamie Gritton goto done_free; 1176b38ff370SJamie Gritton } 1177b38ff370SJamie Gritton if (len > MAXHOSTNAMELEN) { 1178b38ff370SJamie Gritton error = ENAMETOOLONG; 1179b38ff370SJamie Gritton goto done_free; 1180b38ff370SJamie Gritton } 1181b38ff370SJamie Gritton } 1182b38ff370SJamie Gritton 1183b38ff370SJamie Gritton error = vfs_getopt(opts, "host.hostname", (void **)&host, &len); 1184b38ff370SJamie Gritton if (error == ENOENT) 1185b38ff370SJamie Gritton host = NULL; 1186b38ff370SJamie Gritton else if (error != 0) 1187b38ff370SJamie Gritton goto done_free; 1188b38ff370SJamie Gritton else { 118976ca6f88SJamie Gritton ch_flags |= PR_HOST; 119076ca6f88SJamie Gritton pr_flags |= PR_HOST; 1191b38ff370SJamie Gritton if (len == 0 || host[len - 1] != '\0') { 1192b38ff370SJamie Gritton error = EINVAL; 1193b38ff370SJamie Gritton goto done_free; 1194b38ff370SJamie Gritton } 1195b38ff370SJamie Gritton if (len > MAXHOSTNAMELEN) { 1196b38ff370SJamie Gritton error = ENAMETOOLONG; 1197b38ff370SJamie Gritton goto done_free; 1198b38ff370SJamie Gritton } 1199b38ff370SJamie Gritton } 1200b38ff370SJamie Gritton 120176ca6f88SJamie Gritton error = vfs_getopt(opts, "host.domainname", (void **)&domain, &len); 120276ca6f88SJamie Gritton if (error == ENOENT) 120376ca6f88SJamie Gritton domain = NULL; 120476ca6f88SJamie Gritton else if (error != 0) 120576ca6f88SJamie Gritton goto done_free; 120676ca6f88SJamie Gritton else { 120776ca6f88SJamie Gritton ch_flags |= PR_HOST; 120876ca6f88SJamie Gritton pr_flags |= PR_HOST; 120976ca6f88SJamie Gritton if (len == 0 || domain[len - 1] != '\0') { 121076ca6f88SJamie Gritton error = EINVAL; 121176ca6f88SJamie Gritton goto done_free; 121276ca6f88SJamie Gritton } 121376ca6f88SJamie Gritton if (len > MAXHOSTNAMELEN) { 121476ca6f88SJamie Gritton error = ENAMETOOLONG; 121576ca6f88SJamie Gritton goto done_free; 121676ca6f88SJamie Gritton } 121776ca6f88SJamie Gritton } 121876ca6f88SJamie Gritton 121976ca6f88SJamie Gritton error = vfs_getopt(opts, "host.hostuuid", (void **)&uuid, &len); 122076ca6f88SJamie Gritton if (error == ENOENT) 122176ca6f88SJamie Gritton uuid = NULL; 122276ca6f88SJamie Gritton else if (error != 0) 122376ca6f88SJamie Gritton goto done_free; 122476ca6f88SJamie Gritton else { 122576ca6f88SJamie Gritton ch_flags |= PR_HOST; 122676ca6f88SJamie Gritton pr_flags |= PR_HOST; 122776ca6f88SJamie Gritton if (len == 0 || uuid[len - 1] != '\0') { 122876ca6f88SJamie Gritton error = EINVAL; 122976ca6f88SJamie Gritton goto done_free; 123076ca6f88SJamie Gritton } 123176ca6f88SJamie Gritton if (len > HOSTUUIDLEN) { 123276ca6f88SJamie Gritton error = ENAMETOOLONG; 123376ca6f88SJamie Gritton goto done_free; 123476ca6f88SJamie Gritton } 123576ca6f88SJamie Gritton } 123676ca6f88SJamie Gritton 1237841c0c7eSNathan Whitehorn #ifdef COMPAT_FREEBSD32 1238a5c1afadSDmitry Chagin if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) { 123976ca6f88SJamie Gritton uint32_t hid32; 124076ca6f88SJamie Gritton 124176ca6f88SJamie Gritton error = vfs_copyopt(opts, "host.hostid", &hid32, sizeof(hid32)); 124276ca6f88SJamie Gritton hid = hid32; 124376ca6f88SJamie Gritton } else 124476ca6f88SJamie Gritton #endif 124576ca6f88SJamie Gritton error = vfs_copyopt(opts, "host.hostid", &hid, sizeof(hid)); 124676ca6f88SJamie Gritton if (error == ENOENT) 124776ca6f88SJamie Gritton gothid = 0; 124876ca6f88SJamie Gritton else if (error != 0) 124976ca6f88SJamie Gritton goto done_free; 125076ca6f88SJamie Gritton else { 125176ca6f88SJamie Gritton gothid = 1; 125276ca6f88SJamie Gritton ch_flags |= PR_HOST; 125376ca6f88SJamie Gritton pr_flags |= PR_HOST; 125476ca6f88SJamie Gritton } 125576ca6f88SJamie Gritton 1256b38ff370SJamie Gritton #ifdef INET 1257b38ff370SJamie Gritton error = vfs_getopt(opts, "ip4.addr", &op, &ip4s); 1258b38ff370SJamie Gritton if (error == ENOENT) 12590e5e396eSJamie Gritton ip4s = 0; 1260b38ff370SJamie Gritton else if (error != 0) 1261b38ff370SJamie Gritton goto done_free; 1262eb8dcdeaSGleb Smirnoff else if (ip4s & (sizeof(struct in_addr) - 1)) { 1263b38ff370SJamie Gritton error = EINVAL; 1264b38ff370SJamie Gritton goto done_free; 12650304c731SJamie Gritton } else { 12666a3f2779SJamie Gritton ch_flags |= PR_IP4_USER; 12676a3f2779SJamie Gritton pr_flags |= PR_IP4_USER; 12686a3f2779SJamie Gritton if (ip4s > 0) { 1269eb8dcdeaSGleb Smirnoff ip4s /= sizeof(struct in_addr); 1270b38ff370SJamie Gritton if (ip4s > jail_max_af_ips) { 1271b38ff370SJamie Gritton error = EINVAL; 1272b38ff370SJamie Gritton vfs_opterror(opts, "too many IPv4 addresses"); 1273b38ff370SJamie Gritton goto done_errmsg; 1274b38ff370SJamie Gritton } 1275eb8dcdeaSGleb Smirnoff ip4 = prison_ip_copyin(PR_INET, op, ip4s); 1276eb8dcdeaSGleb Smirnoff if (ip4 == NULL) { 1277b38ff370SJamie Gritton error = EINVAL; 1278b38ff370SJamie Gritton goto done_free; 1279b38ff370SJamie Gritton } 1280b38ff370SJamie Gritton } 12810304c731SJamie Gritton } 1282b38ff370SJamie Gritton #endif 1283b38ff370SJamie Gritton 1284b38ff370SJamie Gritton #ifdef INET6 1285b38ff370SJamie Gritton error = vfs_getopt(opts, "ip6.addr", &op, &ip6s); 1286b38ff370SJamie Gritton if (error == ENOENT) 12870e5e396eSJamie Gritton ip6s = 0; 1288b38ff370SJamie Gritton else if (error != 0) 1289b38ff370SJamie Gritton goto done_free; 1290eb8dcdeaSGleb Smirnoff else if (ip6s & (sizeof(struct in6_addr) - 1)) { 1291b38ff370SJamie Gritton error = EINVAL; 1292b38ff370SJamie Gritton goto done_free; 12930304c731SJamie Gritton } else { 12946a3f2779SJamie Gritton ch_flags |= PR_IP6_USER; 12956a3f2779SJamie Gritton pr_flags |= PR_IP6_USER; 12966a3f2779SJamie Gritton if (ip6s > 0) { 1297eb8dcdeaSGleb Smirnoff ip6s /= sizeof(struct in6_addr); 1298b38ff370SJamie Gritton if (ip6s > jail_max_af_ips) { 1299b38ff370SJamie Gritton error = EINVAL; 1300b38ff370SJamie Gritton vfs_opterror(opts, "too many IPv6 addresses"); 1301b38ff370SJamie Gritton goto done_errmsg; 1302b38ff370SJamie Gritton } 1303eb8dcdeaSGleb Smirnoff ip6 = prison_ip_copyin(PR_INET6, op, ip6s); 1304eb8dcdeaSGleb Smirnoff if (ip6 == NULL) { 1305b38ff370SJamie Gritton error = EINVAL; 1306b38ff370SJamie Gritton goto done_free; 1307b38ff370SJamie Gritton } 1308b38ff370SJamie Gritton } 13090304c731SJamie Gritton } 1310b38ff370SJamie Gritton #endif 1311b38ff370SJamie Gritton 1312bdfc8cc4SJamie Gritton #if defined(VIMAGE) && (defined(INET) || defined(INET6)) 1313bdfc8cc4SJamie Gritton if ((ch_flags & PR_VNET) && (ch_flags & (PR_IP4_USER | PR_IP6_USER))) { 1314bdfc8cc4SJamie Gritton error = EINVAL; 1315bdfc8cc4SJamie Gritton vfs_opterror(opts, 1316bdfc8cc4SJamie Gritton "vnet jails cannot have IP address restrictions"); 1317bdfc8cc4SJamie Gritton goto done_errmsg; 1318bdfc8cc4SJamie Gritton } 1319bdfc8cc4SJamie Gritton #endif 1320bdfc8cc4SJamie Gritton 1321cf0313c6SJamie Gritton error = vfs_getopt(opts, "osrelease", (void **)&osrelstr, &len); 1322cf0313c6SJamie Gritton if (error == ENOENT) 1323cf0313c6SJamie Gritton osrelstr = NULL; 1324cf0313c6SJamie Gritton else if (error != 0) 1325cf0313c6SJamie Gritton goto done_free; 1326cf0313c6SJamie Gritton else { 1327cf0313c6SJamie Gritton if (flags & JAIL_UPDATE) { 1328cf0313c6SJamie Gritton error = EINVAL; 1329cf0313c6SJamie Gritton vfs_opterror(opts, 1330cf0313c6SJamie Gritton "osrelease cannot be changed after creation"); 1331cf0313c6SJamie Gritton goto done_errmsg; 1332cf0313c6SJamie Gritton } 13331b786d01SBjoern A. Zeeb if (len == 0 || osrelstr[len - 1] != '\0') { 1334cf0313c6SJamie Gritton error = EINVAL; 13351b786d01SBjoern A. Zeeb goto done_free; 13361b786d01SBjoern A. Zeeb } 13371b786d01SBjoern A. Zeeb if (len >= OSRELEASELEN) { 13381b786d01SBjoern A. Zeeb error = ENAMETOOLONG; 1339cf0313c6SJamie Gritton vfs_opterror(opts, 1340cf0313c6SJamie Gritton "osrelease string must be 1-%d bytes long", 1341cf0313c6SJamie Gritton OSRELEASELEN - 1); 1342cf0313c6SJamie Gritton goto done_errmsg; 1343cf0313c6SJamie Gritton } 1344cf0313c6SJamie Gritton } 1345cf0313c6SJamie Gritton 1346cf0313c6SJamie Gritton error = vfs_copyopt(opts, "osreldate", &osreldt, sizeof(osreldt)); 1347cf0313c6SJamie Gritton if (error == ENOENT) 1348cf0313c6SJamie Gritton osreldt = 0; 1349cf0313c6SJamie Gritton else if (error != 0) 1350cf0313c6SJamie Gritton goto done_free; 1351cf0313c6SJamie Gritton else { 1352cf0313c6SJamie Gritton if (flags & JAIL_UPDATE) { 1353cf0313c6SJamie Gritton error = EINVAL; 1354cf0313c6SJamie Gritton vfs_opterror(opts, 1355cf0313c6SJamie Gritton "osreldate cannot be changed after creation"); 1356cf0313c6SJamie Gritton goto done_errmsg; 1357cf0313c6SJamie Gritton } 1358cf0313c6SJamie Gritton if (osreldt == 0) { 1359cf0313c6SJamie Gritton error = EINVAL; 1360cf0313c6SJamie Gritton vfs_opterror(opts, "osreldate cannot be 0"); 1361cf0313c6SJamie Gritton goto done_errmsg; 1362cf0313c6SJamie Gritton } 1363cf0313c6SJamie Gritton } 1364cf0313c6SJamie Gritton 1365b38ff370SJamie Gritton root = NULL; 1366b38ff370SJamie Gritton error = vfs_getopt(opts, "path", (void **)&path, &len); 1367b38ff370SJamie Gritton if (error == ENOENT) 1368b38ff370SJamie Gritton path = NULL; 1369b38ff370SJamie Gritton else if (error != 0) 1370b38ff370SJamie Gritton goto done_free; 1371b38ff370SJamie Gritton else { 1372b38ff370SJamie Gritton if (flags & JAIL_UPDATE) { 1373b38ff370SJamie Gritton error = EINVAL; 1374b38ff370SJamie Gritton vfs_opterror(opts, 1375b38ff370SJamie Gritton "path cannot be changed after creation"); 1376b38ff370SJamie Gritton goto done_errmsg; 1377b38ff370SJamie Gritton } 1378b38ff370SJamie Gritton if (len == 0 || path[len - 1] != '\0') { 1379b38ff370SJamie Gritton error = EINVAL; 1380b38ff370SJamie Gritton goto done_free; 1381b38ff370SJamie Gritton } 13827e1d3eefSMateusz Guzik NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE, path); 1383b38ff370SJamie Gritton error = namei(&nd); 1384b38ff370SJamie Gritton if (error) 1385b38ff370SJamie Gritton goto done_free; 1386b38ff370SJamie Gritton root = nd.ni_vp; 1387bb92cd7bSMateusz Guzik NDFREE_PNBUF(&nd); 13886dfe0a3dSMartin Matuska g_path = malloc(MAXPATHLEN, M_TEMP, M_WAITOK); 13896dfe0a3dSMartin Matuska strlcpy(g_path, path, MAXPATHLEN); 13906dfe0a3dSMartin Matuska error = vn_path_to_global_path(td, root, g_path, MAXPATHLEN); 13913eb6b656SMateusz Guzik if (error == 0) { 13926dfe0a3dSMartin Matuska path = g_path; 13936dfe0a3dSMartin Matuska } else { 1394f6e633a9SMartin Matuska /* exit on other errors */ 1395b38ff370SJamie Gritton goto done_free; 1396b38ff370SJamie Gritton } 1397f6e633a9SMartin Matuska if (root->v_type != VDIR) { 1398f6e633a9SMartin Matuska error = ENOTDIR; 1399f6e633a9SMartin Matuska vput(root); 1400f6e633a9SMartin Matuska goto done_free; 1401f6e633a9SMartin Matuska } 1402b249ce48SMateusz Guzik VOP_UNLOCK(root); 1403b38ff370SJamie Gritton } 1404b38ff370SJamie Gritton 1405b38ff370SJamie Gritton /* 1406b6f47c23SJamie Gritton * Find the specified jail, or at least its parent. 1407b38ff370SJamie Gritton * This abuses the file error codes ENOENT and EEXIST. 1408b38ff370SJamie Gritton */ 1409b38ff370SJamie Gritton pr = NULL; 14107de883c8SJamie Gritton inspr = NULL; 1411ed31b3f4SJamie Gritton deadpr = NULL; 1412babbbb9cSJamie Gritton if (cuflags == JAIL_CREATE && jid == 0 && name != NULL) { 1413babbbb9cSJamie Gritton namelc = strrchr(name, '.'); 1414babbbb9cSJamie Gritton jid = strtoul(namelc != NULL ? namelc + 1 : name, &p, 10); 1415babbbb9cSJamie Gritton if (*p != '\0') 1416babbbb9cSJamie Gritton jid = 0; 1417babbbb9cSJamie Gritton } 1418b6f47c23SJamie Gritton sx_xlock(&allprison_lock); 1419108a9384SJamie Gritton drflags = PD_LIST_XLOCKED; 14200a2a96f3SJamie Gritton ppr = mypr; 14210a2a96f3SJamie Gritton if (!prison_isalive(ppr)) { 14220a2a96f3SJamie Gritton /* This jail is dying. This process will surely follow. */ 14230a2a96f3SJamie Gritton error = EAGAIN; 14240a2a96f3SJamie Gritton goto done_deref; 14250a2a96f3SJamie Gritton } 1426b38ff370SJamie Gritton if (jid != 0) { 1427b38ff370SJamie Gritton if (jid < 0) { 1428b38ff370SJamie Gritton error = EINVAL; 1429b38ff370SJamie Gritton vfs_opterror(opts, "negative jid"); 14302a4b2251SJamie Gritton goto done_deref; 1431b38ff370SJamie Gritton } 14327de883c8SJamie Gritton /* 14337de883c8SJamie Gritton * See if a requested jid already exists. Keep track of 14347de883c8SJamie Gritton * where it can be inserted later. 14357de883c8SJamie Gritton */ 14367de883c8SJamie Gritton TAILQ_FOREACH(inspr, &allprison, pr_list) { 1437f7496dcaSJamie Gritton if (inspr->pr_id < jid) 1438f7496dcaSJamie Gritton continue; 1439f7496dcaSJamie Gritton if (inspr->pr_id > jid) 1440f7496dcaSJamie Gritton break; 1441ed31b3f4SJamie Gritton if (prison_isalive(inspr)) { 14427de883c8SJamie Gritton pr = inspr; 1443f7496dcaSJamie Gritton mtx_lock(&pr->pr_mtx); 14442a4b2251SJamie Gritton drflags |= PD_LOCKED; 1445ed31b3f4SJamie Gritton } else { 1446ed31b3f4SJamie Gritton /* Note a dying jail to handle later. */ 1447ed31b3f4SJamie Gritton deadpr = inspr; 1448ed31b3f4SJamie Gritton } 14497de883c8SJamie Gritton inspr = NULL; 14507de883c8SJamie Gritton break; 14517de883c8SJamie Gritton } 1452ed31b3f4SJamie Gritton if (cuflags == JAIL_CREATE && pr != NULL) { 14537de883c8SJamie Gritton /* 14547de883c8SJamie Gritton * Even creators that cannot see the jail will 14557de883c8SJamie Gritton * get EEXIST. 14567de883c8SJamie Gritton */ 1457b38ff370SJamie Gritton error = EEXIST; 1458ed31b3f4SJamie Gritton vfs_opterror(opts, "jail %d already exists", jid); 14592a4b2251SJamie Gritton goto done_deref; 1460b38ff370SJamie Gritton } 1461ed31b3f4SJamie Gritton if ((pr == NULL) 1462ed31b3f4SJamie Gritton ? cuflags == JAIL_UPDATE 1463ed31b3f4SJamie Gritton : !prison_ischild(mypr, pr)) { 14647de883c8SJamie Gritton /* 1465ed31b3f4SJamie Gritton * Updaters get ENOENT for nonexistent jails, 1466ed31b3f4SJamie Gritton * or for jails they cannot see. The latter 1467ed31b3f4SJamie Gritton * case is true even for CREATE | UPDATE, 14687de883c8SJamie Gritton * which normally cannot give this error. 14697de883c8SJamie Gritton */ 14702a4b2251SJamie Gritton error = ENOENT; 14712a4b2251SJamie Gritton vfs_opterror(opts, "jail %d not found", jid); 14722a4b2251SJamie Gritton goto done_deref; 1473f7496dcaSJamie Gritton } 1474b38ff370SJamie Gritton } 1475b38ff370SJamie Gritton /* 1476b38ff370SJamie Gritton * If the caller provided a name, look for a jail by that name. 1477b38ff370SJamie Gritton * This has different semantics for creates and updates keyed by jid 1478b38ff370SJamie Gritton * (where the name must not already exist in a different jail), 1479b38ff370SJamie Gritton * and updates keyed by the name itself (where the name must exist 1480b38ff370SJamie Gritton * because that is the jail being updated). 1481b38ff370SJamie Gritton */ 1482b6f47c23SJamie Gritton namelc = NULL; 1483b38ff370SJamie Gritton if (name != NULL) { 1484babbbb9cSJamie Gritton namelc = strrchr(name, '.'); 1485babbbb9cSJamie Gritton if (namelc == NULL) 1486babbbb9cSJamie Gritton namelc = name; 1487babbbb9cSJamie Gritton else { 14880304c731SJamie Gritton /* 14890304c731SJamie Gritton * This is a hierarchical name. Split it into the 14900304c731SJamie Gritton * parent and child names, and make sure the parent 14910304c731SJamie Gritton * exists or matches an already found jail. 14920304c731SJamie Gritton */ 14930304c731SJamie Gritton if (pr != NULL) { 1494babbbb9cSJamie Gritton if (strncmp(name, ppr->pr_name, namelc - name) 1495babbbb9cSJamie Gritton || ppr->pr_name[namelc - name] != '\0') { 14960304c731SJamie Gritton error = EINVAL; 14970304c731SJamie Gritton vfs_opterror(opts, 14980304c731SJamie Gritton "cannot change jail's parent"); 14992a4b2251SJamie Gritton goto done_deref; 15000304c731SJamie Gritton } 15010304c731SJamie Gritton } else { 1502b6f47c23SJamie Gritton *namelc = '\0'; 15030304c731SJamie Gritton ppr = prison_find_name(mypr, name); 15040304c731SJamie Gritton if (ppr == NULL) { 15050304c731SJamie Gritton error = ENOENT; 15060304c731SJamie Gritton vfs_opterror(opts, 15070304c731SJamie Gritton "jail \"%s\" not found", name); 15082a4b2251SJamie Gritton goto done_deref; 15090304c731SJamie Gritton } 1510c050ea80SJamie Gritton mtx_unlock(&ppr->pr_mtx); 15110a2a96f3SJamie Gritton if (!prison_isalive(ppr)) { 1512c050ea80SJamie Gritton error = ENOENT; 1513c050ea80SJamie Gritton vfs_opterror(opts, 1514c050ea80SJamie Gritton "jail \"%s\" is dying", name); 1515c050ea80SJamie Gritton goto done_deref; 1516c050ea80SJamie Gritton } 1517b6f47c23SJamie Gritton *namelc = '.'; 15180304c731SJamie Gritton } 1519b6f47c23SJamie Gritton namelc++; 15200304c731SJamie Gritton } 1521b6f47c23SJamie Gritton if (namelc[0] != '\0') { 1522b6f47c23SJamie Gritton pnamelen = 15230304c731SJamie Gritton (ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1; 15240304c731SJamie Gritton FOREACH_PRISON_CHILD(ppr, tpr) { 1525ed31b3f4SJamie Gritton if (tpr == pr || !prison_isalive(tpr) || 1526ed31b3f4SJamie Gritton strcmp(tpr->pr_name + pnamelen, namelc)) 1527ed31b3f4SJamie Gritton continue; 1528ed31b3f4SJamie Gritton if (cuflags == JAIL_CREATE || pr != NULL) { 1529b38ff370SJamie Gritton /* 1530ed31b3f4SJamie Gritton * Create, or update(jid): name must 1531ed31b3f4SJamie Gritton * not exist in an active sibling jail. 1532b38ff370SJamie Gritton */ 1533ed31b3f4SJamie Gritton error = EEXIST; 1534ed31b3f4SJamie Gritton vfs_opterror(opts, 1535ed31b3f4SJamie Gritton "jail \"%s\" already exists", name); 1536ed31b3f4SJamie Gritton goto done_deref; 1537ed31b3f4SJamie Gritton } 1538ed31b3f4SJamie Gritton /* Use this jail for updates. */ 1539b38ff370SJamie Gritton pr = tpr; 1540f7496dcaSJamie Gritton mtx_lock(&pr->pr_mtx); 154183bc72a0SJamie Gritton drflags |= PD_LOCKED; 1542b38ff370SJamie Gritton break; 1543b38ff370SJamie Gritton } 1544b38ff370SJamie Gritton /* 1545ed31b3f4SJamie Gritton * Update: name must exist if no jid is specified. 1546ed31b3f4SJamie Gritton * As with the jid case, the jail must be currently 1547ed31b3f4SJamie Gritton * visible, or else even CREATE | UPDATE will get 1548ed31b3f4SJamie Gritton * an error. 1549b38ff370SJamie Gritton */ 1550ed31b3f4SJamie Gritton if ((pr == NULL) 1551ed31b3f4SJamie Gritton ? cuflags == JAIL_UPDATE 1552ed31b3f4SJamie Gritton : !prison_isalive(pr)) { 1553b38ff370SJamie Gritton error = ENOENT; 1554b38ff370SJamie Gritton vfs_opterror(opts, "jail \"%s\" not found", 1555b38ff370SJamie Gritton name); 15562a4b2251SJamie Gritton goto done_deref; 1557b38ff370SJamie Gritton } 1558b38ff370SJamie Gritton } 1559b38ff370SJamie Gritton } 1560b38ff370SJamie Gritton /* Update: must provide a jid or name. */ 1561b38ff370SJamie Gritton else if (cuflags == JAIL_UPDATE && pr == NULL) { 1562b38ff370SJamie Gritton error = ENOENT; 1563b38ff370SJamie Gritton vfs_opterror(opts, "update specified no jail"); 15642a4b2251SJamie Gritton goto done_deref; 1565b38ff370SJamie Gritton } 1566b38ff370SJamie Gritton 1567b38ff370SJamie Gritton /* If there's no prison to update, create a new one and link it in. */ 15682a4b2251SJamie Gritton created = pr == NULL; 15692a4b2251SJamie Gritton if (created) { 1570b97457e2SJamie Gritton for (tpr = mypr; tpr != NULL; tpr = tpr->pr_parent) 1571b97457e2SJamie Gritton if (tpr->pr_childcount >= tpr->pr_childmax) { 1572b97457e2SJamie Gritton error = EPERM; 1573b97457e2SJamie Gritton vfs_opterror(opts, "prison limit exceeded"); 15742a4b2251SJamie Gritton goto done_deref; 1575b97457e2SJamie Gritton } 1576ed31b3f4SJamie Gritton 1577ed31b3f4SJamie Gritton if (deadpr != NULL) { 1578ed31b3f4SJamie Gritton /* 1579ed31b3f4SJamie Gritton * The prison being created has the same ID as a dying 1580ed31b3f4SJamie Gritton * one. Handle this by giving the dying jail a new ID. 1581ed31b3f4SJamie Gritton * This may cause some confusion to user space, but 1582ed31b3f4SJamie Gritton * only to those listing dying jails. 1583ed31b3f4SJamie Gritton */ 1584ed31b3f4SJamie Gritton deadid = get_next_deadid(&dinspr); 1585ed31b3f4SJamie Gritton if (deadid == 0) { 1586ed31b3f4SJamie Gritton error = EAGAIN; 1587ed31b3f4SJamie Gritton vfs_opterror(opts, "no available jail IDs"); 1588ed31b3f4SJamie Gritton goto done_deref; 1589ed31b3f4SJamie Gritton } 1590ed31b3f4SJamie Gritton mtx_lock(&deadpr->pr_mtx); 1591ed31b3f4SJamie Gritton deadpr->pr_id = deadid; 1592ed31b3f4SJamie Gritton mtx_unlock(&deadpr->pr_mtx); 1593ed31b3f4SJamie Gritton if (dinspr == deadpr) 1594ed31b3f4SJamie Gritton inspr = deadpr; 1595ed31b3f4SJamie Gritton else { 1596ed31b3f4SJamie Gritton inspr = TAILQ_NEXT(deadpr, pr_list); 1597ed31b3f4SJamie Gritton TAILQ_REMOVE(&allprison, deadpr, pr_list); 1598ed31b3f4SJamie Gritton if (dinspr != NULL) 1599ed31b3f4SJamie Gritton TAILQ_INSERT_AFTER(&allprison, dinspr, 1600ed31b3f4SJamie Gritton deadpr, pr_list); 1601ed31b3f4SJamie Gritton else 1602ed31b3f4SJamie Gritton TAILQ_INSERT_HEAD(&allprison, deadpr, 1603ed31b3f4SJamie Gritton pr_list); 1604ed31b3f4SJamie Gritton } 1605ed31b3f4SJamie Gritton } 16067de883c8SJamie Gritton if (jid == 0 && (jid = get_next_prid(&inspr)) == 0) { 1607b38ff370SJamie Gritton error = EAGAIN; 16087de883c8SJamie Gritton vfs_opterror(opts, "no available jail IDs"); 16092a4b2251SJamie Gritton goto done_deref; 1610b38ff370SJamie Gritton } 16112a4b2251SJamie Gritton 16122a4b2251SJamie Gritton pr = malloc(sizeof(*pr), M_PRISON, M_WAITOK | M_ZERO); 16131158508aSJamie Gritton pr->pr_state = PRISON_STATE_INVALID; 16141158508aSJamie Gritton refcount_init(&pr->pr_ref, 1); 1615f7496dcaSJamie Gritton refcount_init(&pr->pr_uref, 0); 16161158508aSJamie Gritton drflags |= PD_DEREF; 16172a4b2251SJamie Gritton LIST_INIT(&pr->pr_children); 16182a4b2251SJamie Gritton mtx_init(&pr->pr_mtx, "jail mutex", NULL, MTX_DEF | MTX_DUPOK); 16192a4b2251SJamie Gritton TASK_INIT(&pr->pr_task, 0, prison_complete, pr); 16202a4b2251SJamie Gritton 16217de883c8SJamie Gritton pr->pr_id = jid; 16227de883c8SJamie Gritton if (inspr != NULL) 16237de883c8SJamie Gritton TAILQ_INSERT_BEFORE(inspr, pr, pr_list); 16247de883c8SJamie Gritton else 1625b38ff370SJamie Gritton TAILQ_INSERT_TAIL(&allprison, pr, pr_list); 16267de883c8SJamie Gritton 16277de883c8SJamie Gritton pr->pr_parent = ppr; 16280a2a96f3SJamie Gritton prison_hold(ppr); 16290a2a96f3SJamie Gritton prison_proc_hold(ppr); 16300304c731SJamie Gritton LIST_INSERT_HEAD(&ppr->pr_children, pr, pr_sibling); 16310304c731SJamie Gritton for (tpr = ppr; tpr != NULL; tpr = tpr->pr_parent) 1632b97457e2SJamie Gritton tpr->pr_childcount++; 1633b38ff370SJamie Gritton 16340304c731SJamie Gritton /* Set some default values, and inherit some from the parent. */ 1635b6f47c23SJamie Gritton if (namelc == NULL) 1636b6f47c23SJamie Gritton namelc = ""; 1637b38ff370SJamie Gritton if (path == NULL) { 1638b38ff370SJamie Gritton path = "/"; 16390304c731SJamie Gritton root = mypr->pr_root; 1640b38ff370SJamie Gritton vref(root); 1641b38ff370SJamie Gritton } 16428986e3a0SJamie Gritton strlcpy(pr->pr_hostuuid, DEFAULT_HOSTUUID, HOSTUUIDLEN); 16438986e3a0SJamie Gritton pr->pr_flags |= PR_HOST; 1644bdfc8cc4SJamie Gritton #if defined(INET) || defined(INET6) 1645bdfc8cc4SJamie Gritton #ifdef VIMAGE 1646bdfc8cc4SJamie Gritton if (!(pr_flags & PR_VNET)) 1647bdfc8cc4SJamie Gritton #endif 1648bdfc8cc4SJamie Gritton { 16490304c731SJamie Gritton #ifdef INET 16502b0d6f81SJamie Gritton if (!(ch_flags & PR_IP4_USER)) 16516a3f2779SJamie Gritton pr->pr_flags |= PR_IP4 | PR_IP4_USER; 16522b0d6f81SJamie Gritton else if (!(pr_flags & PR_IP4_USER)) { 16532b0d6f81SJamie Gritton pr->pr_flags |= ppr->pr_flags & PR_IP4; 1654eb8dcdeaSGleb Smirnoff prison_ip_dup(ppr, pr, PR_INET); 16552b0d6f81SJamie Gritton } 16560304c731SJamie Gritton #endif 16570304c731SJamie Gritton #ifdef INET6 16582b0d6f81SJamie Gritton if (!(ch_flags & PR_IP6_USER)) 16596a3f2779SJamie Gritton pr->pr_flags |= PR_IP6 | PR_IP6_USER; 16602b0d6f81SJamie Gritton else if (!(pr_flags & PR_IP6_USER)) { 16612b0d6f81SJamie Gritton pr->pr_flags |= ppr->pr_flags & PR_IP6; 1662eb8dcdeaSGleb Smirnoff prison_ip_dup(ppr, pr, PR_INET6); 16632b0d6f81SJamie Gritton } 16640304c731SJamie Gritton #endif 1665bdfc8cc4SJamie Gritton } 1666bdfc8cc4SJamie Gritton #endif 1667592bcae8SBjoern A. Zeeb /* Source address selection is always on by default. */ 1668592bcae8SBjoern A. Zeeb pr->pr_flags |= _PR_IP_SADDRSEL; 1669592bcae8SBjoern A. Zeeb 16700304c731SJamie Gritton pr->pr_securelevel = ppr->pr_securelevel; 16710304c731SJamie Gritton pr->pr_allow = JAIL_DEFAULT_ALLOW & ppr->pr_allow; 1672af10bf05SBjoern A. Zeeb pr->pr_enforce_statfs = jail_default_enforce_statfs; 1673bf3db8aaSMartin Matuska pr->pr_devfs_rsnum = ppr->pr_devfs_rsnum; 1674b38ff370SJamie Gritton 1675b96bd95bSIan Lepore pr->pr_osreldate = osreldt ? osreldt : ppr->pr_osreldate; 1676b96bd95bSIan Lepore if (osrelstr == NULL) 16771b786d01SBjoern A. Zeeb strlcpy(pr->pr_osrelease, ppr->pr_osrelease, 16781b786d01SBjoern A. Zeeb sizeof(pr->pr_osrelease)); 1679b96bd95bSIan Lepore else 16801b786d01SBjoern A. Zeeb strlcpy(pr->pr_osrelease, osrelstr, 16811b786d01SBjoern A. Zeeb sizeof(pr->pr_osrelease)); 1682b96bd95bSIan Lepore 1683679e1390SJamie Gritton #ifdef VIMAGE 1684679e1390SJamie Gritton /* Allocate a new vnet if specified. */ 1685679e1390SJamie Gritton pr->pr_vnet = (pr_flags & PR_VNET) 1686679e1390SJamie Gritton ? vnet_alloc() : ppr->pr_vnet; 1687679e1390SJamie Gritton #endif 1688b38ff370SJamie Gritton /* 1689b38ff370SJamie Gritton * Allocate a dedicated cpuset for each jail. 16908771ff75SGordon Bergling * Unlike other initial settings, this may return an error. 1691b38ff370SJamie Gritton */ 16920304c731SJamie Gritton error = cpuset_create_root(ppr, &pr->pr_cpuset); 16932a4b2251SJamie Gritton if (error) 16942a4b2251SJamie Gritton goto done_deref; 1695b38ff370SJamie Gritton 1696b38ff370SJamie Gritton mtx_lock(&pr->pr_mtx); 16972a4b2251SJamie Gritton drflags |= PD_LOCKED; 1698b38ff370SJamie Gritton } else { 16992b0d6f81SJamie Gritton /* 17002b0d6f81SJamie Gritton * Grab a reference for existing prisons, to ensure they 17012b0d6f81SJamie Gritton * continue to exist for the duration of the call. 17022b0d6f81SJamie Gritton */ 17036754ae25SJamie Gritton prison_hold(pr); 17042a4b2251SJamie Gritton drflags |= PD_DEREF; 1705bdfc8cc4SJamie Gritton #if defined(VIMAGE) && (defined(INET) || defined(INET6)) 1706bdfc8cc4SJamie Gritton if ((pr->pr_flags & PR_VNET) && 1707bdfc8cc4SJamie Gritton (ch_flags & (PR_IP4_USER | PR_IP6_USER))) { 1708bdfc8cc4SJamie Gritton error = EINVAL; 1709bdfc8cc4SJamie Gritton vfs_opterror(opts, 1710bdfc8cc4SJamie Gritton "vnet jails cannot have IP address restrictions"); 17112a4b2251SJamie Gritton goto done_deref; 1712bdfc8cc4SJamie Gritton } 1713bdfc8cc4SJamie Gritton #endif 17142b0d6f81SJamie Gritton #ifdef INET 17152b0d6f81SJamie Gritton if (PR_IP4_USER & ch_flags & (pr_flags ^ pr->pr_flags)) { 17162b0d6f81SJamie Gritton error = EINVAL; 17172b0d6f81SJamie Gritton vfs_opterror(opts, 17182b0d6f81SJamie Gritton "ip4 cannot be changed after creation"); 17192a4b2251SJamie Gritton goto done_deref; 17202b0d6f81SJamie Gritton } 17212b0d6f81SJamie Gritton #endif 17222b0d6f81SJamie Gritton #ifdef INET6 17232b0d6f81SJamie Gritton if (PR_IP6_USER & ch_flags & (pr_flags ^ pr->pr_flags)) { 17242b0d6f81SJamie Gritton error = EINVAL; 17252b0d6f81SJamie Gritton vfs_opterror(opts, 17262b0d6f81SJamie Gritton "ip6 cannot be changed after creation"); 17272a4b2251SJamie Gritton goto done_deref; 17282b0d6f81SJamie Gritton } 17292b0d6f81SJamie Gritton #endif 1730b38ff370SJamie Gritton } 1731b38ff370SJamie Gritton 1732b38ff370SJamie Gritton /* Do final error checking before setting anything. */ 17330304c731SJamie Gritton if (gotslevel) { 17340304c731SJamie Gritton if (slevel < ppr->pr_securelevel) { 17350304c731SJamie Gritton error = EPERM; 17362a4b2251SJamie Gritton goto done_deref; 17370304c731SJamie Gritton } 17380304c731SJamie Gritton } 1739b97457e2SJamie Gritton if (gotchildmax) { 1740b97457e2SJamie Gritton if (childmax >= ppr->pr_childmax) { 1741b97457e2SJamie Gritton error = EPERM; 17422a4b2251SJamie Gritton goto done_deref; 1743b97457e2SJamie Gritton } 1744b97457e2SJamie Gritton } 17450304c731SJamie Gritton if (gotenforce) { 17460304c731SJamie Gritton if (enforce < ppr->pr_enforce_statfs) { 17470304c731SJamie Gritton error = EPERM; 17482a4b2251SJamie Gritton goto done_deref; 17490304c731SJamie Gritton } 17500304c731SJamie Gritton } 17510cc207a6SMartin Matuska if (gotrsnum) { 17520cc207a6SMartin Matuska /* 17530cc207a6SMartin Matuska * devfs_rsnum is a uint16_t 17540cc207a6SMartin Matuska */ 1755bf3db8aaSMartin Matuska if (rsnum < 0 || rsnum > 65535) { 17560cc207a6SMartin Matuska error = EINVAL; 17572a4b2251SJamie Gritton goto done_deref; 17580cc207a6SMartin Matuska } 17590cc207a6SMartin Matuska /* 1760bf3db8aaSMartin Matuska * Nested jails always inherit parent's devfs ruleset 17610cc207a6SMartin Matuska */ 17620cc207a6SMartin Matuska if (jailed(td->td_ucred)) { 17630cc207a6SMartin Matuska if (rsnum > 0 && rsnum != ppr->pr_devfs_rsnum) { 17640cc207a6SMartin Matuska error = EPERM; 17652a4b2251SJamie Gritton goto done_deref; 1766bf3db8aaSMartin Matuska } else 17670cc207a6SMartin Matuska rsnum = ppr->pr_devfs_rsnum; 17680cc207a6SMartin Matuska } 17690cc207a6SMartin Matuska } 1770b38ff370SJamie Gritton #ifdef INET 17712b0d6f81SJamie Gritton if (ip4s > 0) { 1772eb8dcdeaSGleb Smirnoff if ((ppr->pr_flags & PR_IP4) && 1773eb8dcdeaSGleb Smirnoff !prison_ip_parent_match(ppr->pr_addrs[PR_INET], ip4, 1774eb8dcdeaSGleb Smirnoff PR_INET)) { 17750304c731SJamie Gritton error = EPERM; 17762a4b2251SJamie Gritton goto done_deref; 17770304c731SJamie Gritton } 1778eb8dcdeaSGleb Smirnoff if (!prison_ip_conflict_check(ppr, pr, ip4, PR_INET)) { 17790304c731SJamie Gritton error = EADDRINUSE; 1780eb8dcdeaSGleb Smirnoff vfs_opterror(opts, "IPv4 addresses clash"); 17812a4b2251SJamie Gritton goto done_deref; 1782b38ff370SJamie Gritton } 17830304c731SJamie Gritton } 1784b38ff370SJamie Gritton #endif 1785b38ff370SJamie Gritton #ifdef INET6 17862b0d6f81SJamie Gritton if (ip6s > 0) { 1787eb8dcdeaSGleb Smirnoff if ((ppr->pr_flags & PR_IP6) && 1788eb8dcdeaSGleb Smirnoff !prison_ip_parent_match(ppr->pr_addrs[PR_INET6], ip6, 1789eb8dcdeaSGleb Smirnoff PR_INET6)) { 17900304c731SJamie Gritton error = EPERM; 17912a4b2251SJamie Gritton goto done_deref; 17920304c731SJamie Gritton } 1793eb8dcdeaSGleb Smirnoff if (!prison_ip_conflict_check(ppr, pr, ip6, PR_INET6)) { 17940304c731SJamie Gritton error = EADDRINUSE; 1795eb8dcdeaSGleb Smirnoff vfs_opterror(opts, "IPv6 addresses clash"); 17962a4b2251SJamie Gritton goto done_deref; 1797b38ff370SJamie Gritton } 17980304c731SJamie Gritton } 1799b38ff370SJamie Gritton #endif 18000304c731SJamie Gritton onamelen = namelen = 0; 1801b6f47c23SJamie Gritton if (namelc != NULL) { 18026ab6058eSJamie Gritton /* Give a default name of the jid. Also allow the name to be 18036ab6058eSJamie Gritton * explicitly the jid - but not any other number, and only in 18046ab6058eSJamie Gritton * normal form (no leading zero/etc). 18056ab6058eSJamie Gritton */ 1806b6f47c23SJamie Gritton if (namelc[0] == '\0') 1807b6f47c23SJamie Gritton snprintf(namelc = numbuf, sizeof(numbuf), "%d", jid); 18086ab6058eSJamie Gritton else if ((strtoul(namelc, &p, 10) != jid || 18096ab6058eSJamie Gritton namelc[0] < '1' || namelc[0] > '9') && *p == '\0') { 1810b38ff370SJamie Gritton error = EINVAL; 1811babbbb9cSJamie Gritton vfs_opterror(opts, 1812babbbb9cSJamie Gritton "name cannot be numeric (unless it is the jid)"); 18132a4b2251SJamie Gritton goto done_deref; 1814b38ff370SJamie Gritton } 1815b38ff370SJamie Gritton /* 18160304c731SJamie Gritton * Make sure the name isn't too long for the prison or its 18170304c731SJamie Gritton * children. 1818b38ff370SJamie Gritton */ 1819b6f47c23SJamie Gritton pnamelen = (ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1; 1820b6f47c23SJamie Gritton onamelen = strlen(pr->pr_name + pnamelen); 1821b6f47c23SJamie Gritton namelen = strlen(namelc); 1822b6f47c23SJamie Gritton if (pnamelen + namelen + 1 > sizeof(pr->pr_name)) { 18230304c731SJamie Gritton error = ENAMETOOLONG; 18242a4b2251SJamie Gritton goto done_deref; 18250304c731SJamie Gritton } 18260304c731SJamie Gritton FOREACH_PRISON_DESCENDANT(pr, tpr, descend) { 18270304c731SJamie Gritton if (strlen(tpr->pr_name) + (namelen - onamelen) >= 18280304c731SJamie Gritton sizeof(pr->pr_name)) { 18290304c731SJamie Gritton error = ENAMETOOLONG; 18302a4b2251SJamie Gritton goto done_deref; 18310304c731SJamie Gritton } 18320304c731SJamie Gritton } 18330304c731SJamie Gritton } 1834b3079544SJamie Gritton pr_allow_diff = pr_allow & ~ppr->pr_allow; 1835b3079544SJamie Gritton if (pr_allow_diff & ~PR_ALLOW_DIFFERENCES) { 18360304c731SJamie Gritton error = EPERM; 18372a4b2251SJamie Gritton goto done_deref; 1838b38ff370SJamie Gritton } 1839b38ff370SJamie Gritton 1840b6f47c23SJamie Gritton /* 1841b6f47c23SJamie Gritton * Let modules check their parameters. This requires unlocking and 1842b6f47c23SJamie Gritton * then re-locking the prison, but this is still a valid state as long 1843b6f47c23SJamie Gritton * as allprison_lock remains xlocked. 1844b6f47c23SJamie Gritton */ 1845b6f47c23SJamie Gritton mtx_unlock(&pr->pr_mtx); 18462a4b2251SJamie Gritton drflags &= ~PD_LOCKED; 1847b6f47c23SJamie Gritton error = osd_jail_call(pr, PR_METHOD_CHECK, opts); 18482a4b2251SJamie Gritton if (error != 0) 18492a4b2251SJamie Gritton goto done_deref; 1850b6f47c23SJamie Gritton mtx_lock(&pr->pr_mtx); 18512a4b2251SJamie Gritton drflags |= PD_LOCKED; 1852b6f47c23SJamie Gritton 1853b6f47c23SJamie Gritton /* At this point, all valid parameters should have been noted. */ 1854b6f47c23SJamie Gritton TAILQ_FOREACH(opt, opts, link) { 1855b6f47c23SJamie Gritton if (!opt->seen && strcmp(opt->name, "errmsg")) { 1856b6f47c23SJamie Gritton error = EINVAL; 1857b6f47c23SJamie Gritton vfs_opterror(opts, "unknown parameter: %s", opt->name); 18582a4b2251SJamie Gritton goto done_deref; 1859b6f47c23SJamie Gritton } 1860b6f47c23SJamie Gritton } 1861b6f47c23SJamie Gritton 1862b38ff370SJamie Gritton /* Set the parameters of the prison. */ 1863b38ff370SJamie Gritton #ifdef INET 18648bce8d28SZhenlei Huang redo_ip4 = false; 18650304c731SJamie Gritton if (pr_flags & PR_IP4_USER) { 18660304c731SJamie Gritton pr->pr_flags |= PR_IP4; 1867eb8dcdeaSGleb Smirnoff prison_ip_set(pr, PR_INET, ip4); 1868b38ff370SJamie Gritton ip4 = NULL; 18690304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 1870bdfc8cc4SJamie Gritton #ifdef VIMAGE 1871bdfc8cc4SJamie Gritton if (tpr->pr_flags & PR_VNET) { 1872bdfc8cc4SJamie Gritton descend = 0; 1873bdfc8cc4SJamie Gritton continue; 1874bdfc8cc4SJamie Gritton } 1875bdfc8cc4SJamie Gritton #endif 18768bce8d28SZhenlei Huang if (!prison_ip_restrict(tpr, PR_INET, NULL)) { 18778bce8d28SZhenlei Huang redo_ip4 = true; 18780304c731SJamie Gritton descend = 0; 18790304c731SJamie Gritton } 18800304c731SJamie Gritton } 18810304c731SJamie Gritton } 1882b38ff370SJamie Gritton #endif 1883b38ff370SJamie Gritton #ifdef INET6 18848bce8d28SZhenlei Huang redo_ip6 = false; 18850304c731SJamie Gritton if (pr_flags & PR_IP6_USER) { 18860304c731SJamie Gritton pr->pr_flags |= PR_IP6; 1887eb8dcdeaSGleb Smirnoff prison_ip_set(pr, PR_INET6, ip6); 1888b38ff370SJamie Gritton ip6 = NULL; 18890304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 1890bdfc8cc4SJamie Gritton #ifdef VIMAGE 1891bdfc8cc4SJamie Gritton if (tpr->pr_flags & PR_VNET) { 1892bdfc8cc4SJamie Gritton descend = 0; 1893bdfc8cc4SJamie Gritton continue; 1894bdfc8cc4SJamie Gritton } 1895bdfc8cc4SJamie Gritton #endif 18968bce8d28SZhenlei Huang if (!prison_ip_restrict(tpr, PR_INET6, NULL)) { 18978bce8d28SZhenlei Huang redo_ip6 = true; 18980304c731SJamie Gritton descend = 0; 18990304c731SJamie Gritton } 19000304c731SJamie Gritton } 19010304c731SJamie Gritton } 1902b38ff370SJamie Gritton #endif 19030304c731SJamie Gritton if (gotslevel) { 1904b38ff370SJamie Gritton pr->pr_securelevel = slevel; 19050304c731SJamie Gritton /* Set all child jails to be at least this level. */ 19060304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) 19070304c731SJamie Gritton if (tpr->pr_securelevel < slevel) 19080304c731SJamie Gritton tpr->pr_securelevel = slevel; 19090304c731SJamie Gritton } 1910b97457e2SJamie Gritton if (gotchildmax) { 1911b97457e2SJamie Gritton pr->pr_childmax = childmax; 1912b97457e2SJamie Gritton /* Set all child jails to under this limit. */ 1913b97457e2SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED_LEVEL(pr, tpr, descend, level) 1914b97457e2SJamie Gritton if (tpr->pr_childmax > childmax - level) 1915b97457e2SJamie Gritton tpr->pr_childmax = childmax > level 1916b97457e2SJamie Gritton ? childmax - level : 0; 1917b97457e2SJamie Gritton } 19180304c731SJamie Gritton if (gotenforce) { 19190304c731SJamie Gritton pr->pr_enforce_statfs = enforce; 19200304c731SJamie Gritton /* Pass this restriction on to the children. */ 19210304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) 19220304c731SJamie Gritton if (tpr->pr_enforce_statfs < enforce) 19230304c731SJamie Gritton tpr->pr_enforce_statfs = enforce; 19240304c731SJamie Gritton } 19250cc207a6SMartin Matuska if (gotrsnum) { 19260cc207a6SMartin Matuska pr->pr_devfs_rsnum = rsnum; 19270cc207a6SMartin Matuska /* Pass this restriction on to the children. */ 19280cc207a6SMartin Matuska FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) 19290cc207a6SMartin Matuska tpr->pr_devfs_rsnum = rsnum; 19300cc207a6SMartin Matuska } 1931b6f47c23SJamie Gritton if (namelc != NULL) { 19320304c731SJamie Gritton if (ppr == &prison0) 1933b6f47c23SJamie Gritton strlcpy(pr->pr_name, namelc, sizeof(pr->pr_name)); 19340304c731SJamie Gritton else 19350304c731SJamie Gritton snprintf(pr->pr_name, sizeof(pr->pr_name), "%s.%s", 1936b6f47c23SJamie Gritton ppr->pr_name, namelc); 19370304c731SJamie Gritton /* Change this component of child names. */ 19380304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 19390304c731SJamie Gritton bcopy(tpr->pr_name + onamelen, tpr->pr_name + namelen, 19400304c731SJamie Gritton strlen(tpr->pr_name + onamelen) + 1); 19410304c731SJamie Gritton bcopy(pr->pr_name, tpr->pr_name, namelen); 19420304c731SJamie Gritton } 19430304c731SJamie Gritton } 1944b38ff370SJamie Gritton if (path != NULL) { 19450304c731SJamie Gritton /* Try to keep a real-rooted full pathname. */ 1946b38ff370SJamie Gritton strlcpy(pr->pr_path, path, sizeof(pr->pr_path)); 1947b38ff370SJamie Gritton pr->pr_root = root; 19482a4b2251SJamie Gritton root = NULL; 1949b38ff370SJamie Gritton } 195076ca6f88SJamie Gritton if (PR_HOST & ch_flags & ~pr_flags) { 195176ca6f88SJamie Gritton if (pr->pr_flags & PR_HOST) { 195276ca6f88SJamie Gritton /* 195376ca6f88SJamie Gritton * Copy the parent's host info. As with pr_ip4 above, 195476ca6f88SJamie Gritton * the lack of a lock on the parent is not a problem; 195576ca6f88SJamie Gritton * it is always set with allprison_lock at least 195676ca6f88SJamie Gritton * shared, and is held exclusively here. 195776ca6f88SJamie Gritton */ 1958c1f19219SJamie Gritton strlcpy(pr->pr_hostname, pr->pr_parent->pr_hostname, 1959c1f19219SJamie Gritton sizeof(pr->pr_hostname)); 1960c1f19219SJamie Gritton strlcpy(pr->pr_domainname, pr->pr_parent->pr_domainname, 1961c1f19219SJamie Gritton sizeof(pr->pr_domainname)); 1962c1f19219SJamie Gritton strlcpy(pr->pr_hostuuid, pr->pr_parent->pr_hostuuid, 1963c1f19219SJamie Gritton sizeof(pr->pr_hostuuid)); 196476ca6f88SJamie Gritton pr->pr_hostid = pr->pr_parent->pr_hostid; 196576ca6f88SJamie Gritton } 196676ca6f88SJamie Gritton } else if (host != NULL || domain != NULL || uuid != NULL || gothid) { 196776ca6f88SJamie Gritton /* Set this prison, and any descendants without PR_HOST. */ 1968b38ff370SJamie Gritton if (host != NULL) 1969c1f19219SJamie Gritton strlcpy(pr->pr_hostname, host, sizeof(pr->pr_hostname)); 197076ca6f88SJamie Gritton if (domain != NULL) 1971c1f19219SJamie Gritton strlcpy(pr->pr_domainname, domain, 1972c1f19219SJamie Gritton sizeof(pr->pr_domainname)); 197376ca6f88SJamie Gritton if (uuid != NULL) 1974c1f19219SJamie Gritton strlcpy(pr->pr_hostuuid, uuid, sizeof(pr->pr_hostuuid)); 197576ca6f88SJamie Gritton if (gothid) 197676ca6f88SJamie Gritton pr->pr_hostid = hid; 197776ca6f88SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 197876ca6f88SJamie Gritton if (tpr->pr_flags & PR_HOST) 197976ca6f88SJamie Gritton descend = 0; 198076ca6f88SJamie Gritton else { 198176ca6f88SJamie Gritton if (host != NULL) 1982c1f19219SJamie Gritton strlcpy(tpr->pr_hostname, 1983c1f19219SJamie Gritton pr->pr_hostname, 1984c1f19219SJamie Gritton sizeof(tpr->pr_hostname)); 198576ca6f88SJamie Gritton if (domain != NULL) 1986c1f19219SJamie Gritton strlcpy(tpr->pr_domainname, 1987c1f19219SJamie Gritton pr->pr_domainname, 1988c1f19219SJamie Gritton sizeof(tpr->pr_domainname)); 198976ca6f88SJamie Gritton if (uuid != NULL) 1990c1f19219SJamie Gritton strlcpy(tpr->pr_hostuuid, 1991c1f19219SJamie Gritton pr->pr_hostuuid, 1992c1f19219SJamie Gritton sizeof(tpr->pr_hostuuid)); 199376ca6f88SJamie Gritton if (gothid) 199476ca6f88SJamie Gritton tpr->pr_hostid = hid; 199576ca6f88SJamie Gritton } 199676ca6f88SJamie Gritton } 199776ca6f88SJamie Gritton } 19980304c731SJamie Gritton pr->pr_allow = (pr->pr_allow & ~ch_allow) | pr_allow; 19990fe74ae6SJamie Gritton if ((tallow = ch_allow & ~pr_allow)) 20000fe74ae6SJamie Gritton prison_set_allow_locked(pr, tallow, 0); 2001b38ff370SJamie Gritton /* 2002b38ff370SJamie Gritton * Persistent prisons get an extra reference, and prisons losing their 20031158508aSJamie Gritton * persist flag lose that reference. 2004b38ff370SJamie Gritton */ 20051158508aSJamie Gritton if (ch_flags & PR_PERSIST & (pr_flags ^ pr->pr_flags)) { 2006b38ff370SJamie Gritton if (pr_flags & PR_PERSIST) { 20076754ae25SJamie Gritton prison_hold(pr); 20081158508aSJamie Gritton /* 2009ed31b3f4SJamie Gritton * This may be a new prison's first user reference, 2010ed31b3f4SJamie Gritton * but wait to call it alive until after OSD calls 2011ed31b3f4SJamie Gritton * have had a chance to run (and perhaps to fail). 20121158508aSJamie Gritton */ 20136754ae25SJamie Gritton refcount_acquire(&pr->pr_uref); 2014b38ff370SJamie Gritton } else { 201539c8ef90SJamie Gritton drflags |= PD_DEUREF; 2016f7496dcaSJamie Gritton prison_free_not_last(pr); 2017b38ff370SJamie Gritton } 2018b38ff370SJamie Gritton } 2019b38ff370SJamie Gritton pr->pr_flags = (pr->pr_flags & ~ch_flags) | pr_flags; 2020b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 20212a4b2251SJamie Gritton drflags &= ~PD_LOCKED; 2022c861373bSJamie Gritton /* 2023c861373bSJamie Gritton * Any errors past this point will need to de-persist newly created 2024c861373bSJamie Gritton * prisons, as well as call remove methods. 2025c861373bSJamie Gritton */ 2026ed31b3f4SJamie Gritton if (created) 2027c861373bSJamie Gritton drflags |= PD_KILL; 2028b38ff370SJamie Gritton 2029a7ad07bfSEdward Tomasz Napierala #ifdef RACCT 20304b5c9cf6SEdward Tomasz Napierala if (racct_enable && created) 2031a7ad07bfSEdward Tomasz Napierala prison_racct_attach(pr); 2032a7ad07bfSEdward Tomasz Napierala #endif 2033a7ad07bfSEdward Tomasz Napierala 20340304c731SJamie Gritton /* Locks may have prevented a complete restriction of child IP 20350304c731SJamie Gritton * addresses. If so, allocate some more memory and try again. 20360304c731SJamie Gritton */ 20370304c731SJamie Gritton #ifdef INET 20380304c731SJamie Gritton while (redo_ip4) { 2039eb8dcdeaSGleb Smirnoff ip4s = pr->pr_addrs[PR_INET]->ips; 20408bce8d28SZhenlei Huang MPASS(ip4 == NULL); 2041eb8dcdeaSGleb Smirnoff ip4 = prison_ip_alloc(PR_INET, ip4s, M_WAITOK); 20420304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 20438bce8d28SZhenlei Huang redo_ip4 = false; 20440304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 2045bdfc8cc4SJamie Gritton #ifdef VIMAGE 2046bdfc8cc4SJamie Gritton if (tpr->pr_flags & PR_VNET) { 2047bdfc8cc4SJamie Gritton descend = 0; 2048bdfc8cc4SJamie Gritton continue; 2049bdfc8cc4SJamie Gritton } 2050bdfc8cc4SJamie Gritton #endif 2051b2d76b52SZhenlei Huang if (!prison_ip_restrict(tpr, PR_INET, &ip4)) 2052b2d76b52SZhenlei Huang redo_ip4 = true; 20530304c731SJamie Gritton } 20540304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 20550304c731SJamie Gritton } 20560304c731SJamie Gritton #endif 20570304c731SJamie Gritton #ifdef INET6 20580304c731SJamie Gritton while (redo_ip6) { 2059eb8dcdeaSGleb Smirnoff ip6s = pr->pr_addrs[PR_INET6]->ips; 20608bce8d28SZhenlei Huang MPASS(ip6 == NULL); 2061eb8dcdeaSGleb Smirnoff ip6 = prison_ip_alloc(PR_INET6, ip6s, M_WAITOK); 20620304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 20638bce8d28SZhenlei Huang redo_ip6 = false; 20640304c731SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) { 2065bdfc8cc4SJamie Gritton #ifdef VIMAGE 2066bdfc8cc4SJamie Gritton if (tpr->pr_flags & PR_VNET) { 2067bdfc8cc4SJamie Gritton descend = 0; 2068bdfc8cc4SJamie Gritton continue; 2069bdfc8cc4SJamie Gritton } 2070bdfc8cc4SJamie Gritton #endif 2071b2d76b52SZhenlei Huang if (!prison_ip_restrict(tpr, PR_INET6, &ip6)) 2072b2d76b52SZhenlei Huang redo_ip6 = true; 20730304c731SJamie Gritton } 20740304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 20750304c731SJamie Gritton } 20760304c731SJamie Gritton #endif 20770304c731SJamie Gritton 2078b38ff370SJamie Gritton /* Let the modules do their work. */ 2079ed31b3f4SJamie Gritton if (created) { 2080b38ff370SJamie Gritton error = osd_jail_call(pr, PR_METHOD_CREATE, opts); 2081c861373bSJamie Gritton if (error) 20822a4b2251SJamie Gritton goto done_deref; 2083b38ff370SJamie Gritton } 2084b38ff370SJamie Gritton error = osd_jail_call(pr, PR_METHOD_SET, opts); 2085c861373bSJamie Gritton if (error) 20862a4b2251SJamie Gritton goto done_deref; 2087b38ff370SJamie Gritton 20881158508aSJamie Gritton /* 20891158508aSJamie Gritton * A new prison is now ready to be seen; either it has gained a user 20901158508aSJamie Gritton * reference via persistence, or is about to gain one via attachment. 20911158508aSJamie Gritton */ 2092ed31b3f4SJamie Gritton if (created) { 20931158508aSJamie Gritton drflags = prison_lock_xlock(pr, drflags); 20941158508aSJamie Gritton pr->pr_state = PRISON_STATE_ALIVE; 20951158508aSJamie Gritton } 20961158508aSJamie Gritton 2097b38ff370SJamie Gritton /* Attach this process to the prison if requested. */ 2098b38ff370SJamie Gritton if (flags & JAIL_ATTACH) { 2099c861373bSJamie Gritton error = do_jail_attach(td, pr, 2100589e4c1dSJamie Gritton prison_lock_xlock(pr, drflags & PD_LOCK_FLAGS)); 2101f7496dcaSJamie Gritton drflags &= ~(PD_LOCKED | PD_LIST_XLOCKED); 2102b38ff370SJamie Gritton if (error) { 2103b38ff370SJamie Gritton vfs_opterror(opts, "attach failed"); 21042a4b2251SJamie Gritton goto done_deref; 2105b38ff370SJamie Gritton } 2106b38ff370SJamie Gritton } 2107b38ff370SJamie Gritton 21081fb24974SEdward Tomasz Napierala #ifdef RACCT 21094b5c9cf6SEdward Tomasz Napierala if (racct_enable && !created) { 2110701d6b50SJamie Gritton if (drflags & PD_LOCKED) { 2111701d6b50SJamie Gritton mtx_unlock(&pr->pr_mtx); 2112701d6b50SJamie Gritton drflags &= ~PD_LOCKED; 2113701d6b50SJamie Gritton } 2114f7496dcaSJamie Gritton if (drflags & PD_LIST_XLOCKED) { 2115f7496dcaSJamie Gritton sx_xunlock(&allprison_lock); 2116f7496dcaSJamie Gritton drflags &= ~PD_LIST_XLOCKED; 2117b4e87a63SJamie Gritton } 21181fb24974SEdward Tomasz Napierala prison_racct_modify(pr); 21191fb24974SEdward Tomasz Napierala } 21201fb24974SEdward Tomasz Napierala #endif 21211fb24974SEdward Tomasz Napierala 2122ed31b3f4SJamie Gritton if (created && pr != &prison0 && (pr->pr_allow & PR_ALLOW_NFSD) != 0 && 2123bba7a2e8SRick Macklem (pr->pr_root->v_vflag & VV_ROOT) == 0) 2124bba7a2e8SRick Macklem printf("Warning jail jid=%d: mountd/nfsd requires a separate" 2125bba7a2e8SRick Macklem " file system\n", pr->pr_id); 2126bba7a2e8SRick Macklem 2127c861373bSJamie Gritton drflags &= ~PD_KILL; 21281fb24974SEdward Tomasz Napierala td->td_retval[0] = pr->pr_id; 21291fb24974SEdward Tomasz Napierala 21302a4b2251SJamie Gritton done_deref: 21312a4b2251SJamie Gritton /* Release any temporary prison holds and/or locks. */ 21322a4b2251SJamie Gritton if (pr != NULL) 21332a4b2251SJamie Gritton prison_deref(pr, drflags); 21342a4b2251SJamie Gritton else if (drflags & PD_LIST_SLOCKED) 2135b38ff370SJamie Gritton sx_sunlock(&allprison_lock); 21362a4b2251SJamie Gritton else if (drflags & PD_LIST_XLOCKED) 2137b38ff370SJamie Gritton sx_xunlock(&allprison_lock); 21385050aa86SKonstantin Belousov if (root != NULL) 2139b38ff370SJamie Gritton vrele(root); 2140b38ff370SJamie Gritton done_errmsg: 2141b38ff370SJamie Gritton if (error) { 21422a4b2251SJamie Gritton /* Write the error message back to userspace. */ 2143176ff3a0SJamie Gritton if (vfs_getopt(opts, "errmsg", (void **)&errmsg, 2144176ff3a0SJamie Gritton &errmsg_len) == 0 && errmsg_len > 0) { 2145b38ff370SJamie Gritton errmsg_pos = 2 * vfs_getopt_pos(opts, "errmsg") + 1; 2146b38ff370SJamie Gritton if (optuio->uio_segflg == UIO_SYSSPACE) 2147b38ff370SJamie Gritton bcopy(errmsg, 2148b38ff370SJamie Gritton optuio->uio_iov[errmsg_pos].iov_base, 2149b38ff370SJamie Gritton errmsg_len); 2150b38ff370SJamie Gritton else 2151abbc260fSMark Johnston (void)copyout(errmsg, 2152b38ff370SJamie Gritton optuio->uio_iov[errmsg_pos].iov_base, 2153b38ff370SJamie Gritton errmsg_len); 2154b38ff370SJamie Gritton } 2155b38ff370SJamie Gritton } 2156b38ff370SJamie Gritton done_free: 2157b38ff370SJamie Gritton #ifdef INET 2158eb8dcdeaSGleb Smirnoff prison_ip_free(ip4); 2159b38ff370SJamie Gritton #endif 2160b38ff370SJamie Gritton #ifdef INET6 2161eb8dcdeaSGleb Smirnoff prison_ip_free(ip6); 2162b38ff370SJamie Gritton #endif 21636dfe0a3dSMartin Matuska if (g_path != NULL) 21646dfe0a3dSMartin Matuska free(g_path, M_TEMP); 2165b38ff370SJamie Gritton vfs_freeopts(opts); 2166b38ff370SJamie Gritton return (error); 2167b38ff370SJamie Gritton } 2168b38ff370SJamie Gritton 2169b38ff370SJamie Gritton /* 21707de883c8SJamie Gritton * Find the next available prison ID. Return the ID on success, or zero 21717de883c8SJamie Gritton * on failure. Also set a pointer to the allprison list entry the prison 21727de883c8SJamie Gritton * should be inserted before. 21737de883c8SJamie Gritton */ 21747de883c8SJamie Gritton static int 21757de883c8SJamie Gritton get_next_prid(struct prison **insprp) 21767de883c8SJamie Gritton { 21777de883c8SJamie Gritton struct prison *inspr; 21787de883c8SJamie Gritton int jid, maxid; 21797de883c8SJamie Gritton 21807de883c8SJamie Gritton jid = lastprid % JAIL_MAX + 1; 21817de883c8SJamie Gritton if (TAILQ_EMPTY(&allprison) || 21827de883c8SJamie Gritton TAILQ_LAST(&allprison, prisonlist)->pr_id < jid) { 21837de883c8SJamie Gritton /* 21847de883c8SJamie Gritton * A common case is for all jails to be implicitly numbered, 21857de883c8SJamie Gritton * which means they'll go on the end of the list, at least 21867de883c8SJamie Gritton * for the first JAIL_MAX times. 21877de883c8SJamie Gritton */ 21887de883c8SJamie Gritton inspr = NULL; 21897de883c8SJamie Gritton } else { 21907de883c8SJamie Gritton /* 21917de883c8SJamie Gritton * Take two passes through the allprison list: first starting 21927de883c8SJamie Gritton * with the proposed jid, then ending with it. 21937de883c8SJamie Gritton */ 21947de883c8SJamie Gritton for (maxid = JAIL_MAX; maxid != 0; ) { 21957de883c8SJamie Gritton TAILQ_FOREACH(inspr, &allprison, pr_list) { 21967de883c8SJamie Gritton if (inspr->pr_id < jid) 21977de883c8SJamie Gritton continue; 2198f7496dcaSJamie Gritton if (inspr->pr_id > jid) { 2199f7496dcaSJamie Gritton /* Found an opening. */ 22007de883c8SJamie Gritton maxid = 0; 22017de883c8SJamie Gritton break; 22027de883c8SJamie Gritton } 22037de883c8SJamie Gritton if (++jid > maxid) { 22047de883c8SJamie Gritton if (lastprid == maxid || lastprid == 0) 22057de883c8SJamie Gritton { 22067de883c8SJamie Gritton /* 22077de883c8SJamie Gritton * The entire legal range 22087de883c8SJamie Gritton * has been traversed 22097de883c8SJamie Gritton */ 22107de883c8SJamie Gritton return 0; 22117de883c8SJamie Gritton } 22127de883c8SJamie Gritton /* Try again from the start. */ 22137de883c8SJamie Gritton jid = 1; 22147de883c8SJamie Gritton maxid = lastprid; 22157de883c8SJamie Gritton break; 22167de883c8SJamie Gritton } 22177de883c8SJamie Gritton } 22187de883c8SJamie Gritton if (inspr == NULL) { 22197de883c8SJamie Gritton /* Found room at the end of the list. */ 22207de883c8SJamie Gritton break; 22217de883c8SJamie Gritton } 22227de883c8SJamie Gritton } 22237de883c8SJamie Gritton } 22247de883c8SJamie Gritton *insprp = inspr; 22257de883c8SJamie Gritton lastprid = jid; 22267de883c8SJamie Gritton return (jid); 22277de883c8SJamie Gritton } 22287de883c8SJamie Gritton 22297de883c8SJamie Gritton /* 2230ed31b3f4SJamie Gritton * Find the next available ID for a renumbered dead prison. This is the same 2231ed31b3f4SJamie Gritton * as get_next_prid, but counting backward from the end of the range. 2232ed31b3f4SJamie Gritton */ 2233ed31b3f4SJamie Gritton static int 2234ed31b3f4SJamie Gritton get_next_deadid(struct prison **dinsprp) 2235ed31b3f4SJamie Gritton { 2236ed31b3f4SJamie Gritton struct prison *dinspr; 2237ed31b3f4SJamie Gritton int deadid, minid; 2238ed31b3f4SJamie Gritton 2239ed31b3f4SJamie Gritton deadid = lastdeadid ? lastdeadid - 1 : JAIL_MAX; 2240ed31b3f4SJamie Gritton /* 2241ed31b3f4SJamie Gritton * Take two reverse passes through the allprison list: first 2242ed31b3f4SJamie Gritton * starting with the proposed deadid, then ending with it. 2243ed31b3f4SJamie Gritton */ 2244ed31b3f4SJamie Gritton for (minid = 1; minid != 0; ) { 2245ed31b3f4SJamie Gritton TAILQ_FOREACH_REVERSE(dinspr, &allprison, prisonlist, pr_list) { 2246ed31b3f4SJamie Gritton if (dinspr->pr_id > deadid) 2247ed31b3f4SJamie Gritton continue; 2248ed31b3f4SJamie Gritton if (dinspr->pr_id < deadid) { 2249ed31b3f4SJamie Gritton /* Found an opening. */ 2250ed31b3f4SJamie Gritton minid = 0; 2251ed31b3f4SJamie Gritton break; 2252ed31b3f4SJamie Gritton } 2253ed31b3f4SJamie Gritton if (--deadid < minid) { 2254ed31b3f4SJamie Gritton if (lastdeadid == minid || lastdeadid == 0) 2255ed31b3f4SJamie Gritton { 2256ed31b3f4SJamie Gritton /* 2257ed31b3f4SJamie Gritton * The entire legal range 2258ed31b3f4SJamie Gritton * has been traversed 2259ed31b3f4SJamie Gritton */ 2260ed31b3f4SJamie Gritton return 0; 2261ed31b3f4SJamie Gritton } 2262ed31b3f4SJamie Gritton /* Try again from the end. */ 2263ed31b3f4SJamie Gritton deadid = JAIL_MAX; 2264ed31b3f4SJamie Gritton minid = lastdeadid; 2265ed31b3f4SJamie Gritton break; 2266ed31b3f4SJamie Gritton } 2267ed31b3f4SJamie Gritton } 2268ed31b3f4SJamie Gritton if (dinspr == NULL) { 2269ed31b3f4SJamie Gritton /* Found room at the beginning of the list. */ 2270ed31b3f4SJamie Gritton break; 2271ed31b3f4SJamie Gritton } 2272ed31b3f4SJamie Gritton } 2273ed31b3f4SJamie Gritton *dinsprp = dinspr; 2274ed31b3f4SJamie Gritton lastdeadid = deadid; 2275ed31b3f4SJamie Gritton return (deadid); 2276ed31b3f4SJamie Gritton } 2277ed31b3f4SJamie Gritton 2278ed31b3f4SJamie Gritton /* 2279b38ff370SJamie Gritton * struct jail_get_args { 2280b38ff370SJamie Gritton * struct iovec *iovp; 2281b38ff370SJamie Gritton * unsigned int iovcnt; 2282b38ff370SJamie Gritton * int flags; 2283b38ff370SJamie Gritton * }; 2284b38ff370SJamie Gritton */ 2285b38ff370SJamie Gritton int 22868451d0ddSKip Macy sys_jail_get(struct thread *td, struct jail_get_args *uap) 2287b38ff370SJamie Gritton { 2288b38ff370SJamie Gritton struct uio *auio; 2289b38ff370SJamie Gritton int error; 2290b38ff370SJamie Gritton 2291b38ff370SJamie Gritton /* Check that we have an even number of iovecs. */ 2292b38ff370SJamie Gritton if (uap->iovcnt & 1) 2293b38ff370SJamie Gritton return (EINVAL); 2294b38ff370SJamie Gritton 2295b38ff370SJamie Gritton error = copyinuio(uap->iovp, uap->iovcnt, &auio); 2296b38ff370SJamie Gritton if (error) 2297b38ff370SJamie Gritton return (error); 2298b38ff370SJamie Gritton error = kern_jail_get(td, auio, uap->flags); 2299b38ff370SJamie Gritton if (error == 0) 2300b38ff370SJamie Gritton error = copyout(auio->uio_iov, uap->iovp, 2301b38ff370SJamie Gritton uap->iovcnt * sizeof(struct iovec)); 230261cc4830SAlfredo Mazzinghi freeuio(auio); 2303b38ff370SJamie Gritton return (error); 2304b38ff370SJamie Gritton } 2305b38ff370SJamie Gritton 2306b38ff370SJamie Gritton int 2307b38ff370SJamie Gritton kern_jail_get(struct thread *td, struct uio *optuio, int flags) 2308b38ff370SJamie Gritton { 2309672756aaSJamie Gritton struct bool_flags *bf; 2310672756aaSJamie Gritton struct jailsys_flags *jsf; 23110304c731SJamie Gritton struct prison *pr, *mypr; 2312b38ff370SJamie Gritton struct vfsopt *opt; 2313b38ff370SJamie Gritton struct vfsoptlist *opts; 2314b38ff370SJamie Gritton char *errmsg, *name; 23152a4b2251SJamie Gritton int drflags, error, errmsg_len, errmsg_pos, i, jid, len, pos; 2316672756aaSJamie Gritton unsigned f; 2317b38ff370SJamie Gritton 2318b38ff370SJamie Gritton if (flags & ~JAIL_GET_MASK) 2319b38ff370SJamie Gritton return (EINVAL); 2320b38ff370SJamie Gritton 2321b38ff370SJamie Gritton /* Get the parameter list. */ 2322b38ff370SJamie Gritton error = vfs_buildopts(optuio, &opts); 2323b38ff370SJamie Gritton if (error) 2324b38ff370SJamie Gritton return (error); 2325b38ff370SJamie Gritton errmsg_pos = vfs_getopt_pos(opts, "errmsg"); 23260304c731SJamie Gritton mypr = td->td_ucred->cr_prison; 23272a4b2251SJamie Gritton pr = NULL; 23281e2a13e6SJamie Gritton 2329b38ff370SJamie Gritton /* 2330b38ff370SJamie Gritton * Find the prison specified by one of: lastjid, jid, name. 2331b38ff370SJamie Gritton */ 2332b38ff370SJamie Gritton sx_slock(&allprison_lock); 23332a4b2251SJamie Gritton drflags = PD_LIST_SLOCKED; 2334b38ff370SJamie Gritton error = vfs_copyopt(opts, "lastjid", &jid, sizeof(jid)); 2335b38ff370SJamie Gritton if (error == 0) { 2336b38ff370SJamie Gritton TAILQ_FOREACH(pr, &allprison, pr_list) { 2337f7496dcaSJamie Gritton if (pr->pr_id > jid && 2338f7496dcaSJamie Gritton ((flags & JAIL_DYING) || prison_isalive(pr)) && 2339f7496dcaSJamie Gritton prison_ischild(mypr, pr)) { 2340b38ff370SJamie Gritton mtx_lock(&pr->pr_mtx); 23412a4b2251SJamie Gritton drflags |= PD_LOCKED; 2342b38ff370SJamie Gritton goto found_prison; 23432a4b2251SJamie Gritton } 2344f7496dcaSJamie Gritton } 2345b38ff370SJamie Gritton error = ENOENT; 2346b38ff370SJamie Gritton vfs_opterror(opts, "no jail after %d", jid); 23472a4b2251SJamie Gritton goto done; 2348b38ff370SJamie Gritton } else if (error != ENOENT) 23492a4b2251SJamie Gritton goto done; 2350b38ff370SJamie Gritton 2351b38ff370SJamie Gritton error = vfs_copyopt(opts, "jid", &jid, sizeof(jid)); 2352b38ff370SJamie Gritton if (error == 0) { 2353b38ff370SJamie Gritton if (jid != 0) { 23540304c731SJamie Gritton pr = prison_find_child(mypr, jid); 2355b38ff370SJamie Gritton if (pr != NULL) { 23562a4b2251SJamie Gritton drflags |= PD_LOCKED; 235776ad42abSJamie Gritton if (!(prison_isalive(pr) || 235876ad42abSJamie Gritton (flags & JAIL_DYING))) { 2359b38ff370SJamie Gritton error = ENOENT; 2360b38ff370SJamie Gritton vfs_opterror(opts, "jail %d is dying", 2361b38ff370SJamie Gritton jid); 23622a4b2251SJamie Gritton goto done; 2363b38ff370SJamie Gritton } 2364b38ff370SJamie Gritton goto found_prison; 2365b38ff370SJamie Gritton } 2366b38ff370SJamie Gritton error = ENOENT; 2367b38ff370SJamie Gritton vfs_opterror(opts, "jail %d not found", jid); 23682a4b2251SJamie Gritton goto done; 2369b38ff370SJamie Gritton } 2370b38ff370SJamie Gritton } else if (error != ENOENT) 23712a4b2251SJamie Gritton goto done; 2372b38ff370SJamie Gritton 2373b38ff370SJamie Gritton error = vfs_getopt(opts, "name", (void **)&name, &len); 2374b38ff370SJamie Gritton if (error == 0) { 2375b38ff370SJamie Gritton if (len == 0 || name[len - 1] != '\0') { 2376b38ff370SJamie Gritton error = EINVAL; 23772a4b2251SJamie Gritton goto done; 2378b38ff370SJamie Gritton } 23790304c731SJamie Gritton pr = prison_find_name(mypr, name); 2380b38ff370SJamie Gritton if (pr != NULL) { 23812a4b2251SJamie Gritton drflags |= PD_LOCKED; 238276ad42abSJamie Gritton if (!(prison_isalive(pr) || (flags & JAIL_DYING))) { 2383b38ff370SJamie Gritton error = ENOENT; 2384b38ff370SJamie Gritton vfs_opterror(opts, "jail \"%s\" is dying", 2385b38ff370SJamie Gritton name); 23862a4b2251SJamie Gritton goto done; 2387b38ff370SJamie Gritton } 2388b38ff370SJamie Gritton goto found_prison; 2389b38ff370SJamie Gritton } 2390b38ff370SJamie Gritton error = ENOENT; 2391b38ff370SJamie Gritton vfs_opterror(opts, "jail \"%s\" not found", name); 23922a4b2251SJamie Gritton goto done; 2393b38ff370SJamie Gritton } else if (error != ENOENT) 23942a4b2251SJamie Gritton goto done; 2395b38ff370SJamie Gritton 2396b38ff370SJamie Gritton vfs_opterror(opts, "no jail specified"); 2397b38ff370SJamie Gritton error = ENOENT; 23982a4b2251SJamie Gritton goto done; 2399b38ff370SJamie Gritton 2400b38ff370SJamie Gritton found_prison: 2401b38ff370SJamie Gritton /* Get the parameters of the prison. */ 24026754ae25SJamie Gritton prison_hold(pr); 24032a4b2251SJamie Gritton drflags |= PD_DEREF; 2404b38ff370SJamie Gritton td->td_retval[0] = pr->pr_id; 2405b38ff370SJamie Gritton error = vfs_setopt(opts, "jid", &pr->pr_id, sizeof(pr->pr_id)); 2406b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 24072a4b2251SJamie Gritton goto done; 24080304c731SJamie Gritton i = (pr->pr_parent == mypr) ? 0 : pr->pr_parent->pr_id; 24090304c731SJamie Gritton error = vfs_setopt(opts, "parent", &i, sizeof(i)); 2410b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 24112a4b2251SJamie Gritton goto done; 24120304c731SJamie Gritton error = vfs_setopts(opts, "name", prison_name(mypr, pr)); 24130304c731SJamie Gritton if (error != 0 && error != ENOENT) 24142a4b2251SJamie Gritton goto done; 24150304c731SJamie Gritton error = vfs_setopt(opts, "cpuset.id", &pr->pr_cpuset->cs_id, 2416b38ff370SJamie Gritton sizeof(pr->pr_cpuset->cs_id)); 2417b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 24182a4b2251SJamie Gritton goto done; 24190304c731SJamie Gritton error = vfs_setopts(opts, "path", prison_path(mypr, pr)); 2420b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 24212a4b2251SJamie Gritton goto done; 2422b38ff370SJamie Gritton #ifdef INET 2423500f82d6SZhenlei Huang error = vfs_setopt_part(opts, "ip4.addr", pr->pr_addrs[PR_INET]->pr_ip, 2424eb8dcdeaSGleb Smirnoff pr->pr_addrs[PR_INET] ? pr->pr_addrs[PR_INET]->ips * 2425eb8dcdeaSGleb Smirnoff pr_families[PR_INET].size : 0 ); 2426b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 24272a4b2251SJamie Gritton goto done; 2428b38ff370SJamie Gritton #endif 2429b38ff370SJamie Gritton #ifdef INET6 2430500f82d6SZhenlei Huang error = vfs_setopt_part(opts, "ip6.addr", pr->pr_addrs[PR_INET6]->pr_ip, 2431eb8dcdeaSGleb Smirnoff pr->pr_addrs[PR_INET6] ? pr->pr_addrs[PR_INET6]->ips * 2432eb8dcdeaSGleb Smirnoff pr_families[PR_INET6].size : 0 ); 2433b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 24342a4b2251SJamie Gritton goto done; 2435b38ff370SJamie Gritton #endif 2436b38ff370SJamie Gritton error = vfs_setopt(opts, "securelevel", &pr->pr_securelevel, 2437b38ff370SJamie Gritton sizeof(pr->pr_securelevel)); 2438b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 24392a4b2251SJamie Gritton goto done; 2440b97457e2SJamie Gritton error = vfs_setopt(opts, "children.cur", &pr->pr_childcount, 2441b97457e2SJamie Gritton sizeof(pr->pr_childcount)); 2442b97457e2SJamie Gritton if (error != 0 && error != ENOENT) 24432a4b2251SJamie Gritton goto done; 2444b97457e2SJamie Gritton error = vfs_setopt(opts, "children.max", &pr->pr_childmax, 2445b97457e2SJamie Gritton sizeof(pr->pr_childmax)); 2446b97457e2SJamie Gritton if (error != 0 && error != ENOENT) 24472a4b2251SJamie Gritton goto done; 2448c1f19219SJamie Gritton error = vfs_setopts(opts, "host.hostname", pr->pr_hostname); 2449b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 24502a4b2251SJamie Gritton goto done; 2451c1f19219SJamie Gritton error = vfs_setopts(opts, "host.domainname", pr->pr_domainname); 245276ca6f88SJamie Gritton if (error != 0 && error != ENOENT) 24532a4b2251SJamie Gritton goto done; 2454c1f19219SJamie Gritton error = vfs_setopts(opts, "host.hostuuid", pr->pr_hostuuid); 245576ca6f88SJamie Gritton if (error != 0 && error != ENOENT) 24562a4b2251SJamie Gritton goto done; 2457841c0c7eSNathan Whitehorn #ifdef COMPAT_FREEBSD32 2458a5c1afadSDmitry Chagin if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) { 245976ca6f88SJamie Gritton uint32_t hid32 = pr->pr_hostid; 246076ca6f88SJamie Gritton 246176ca6f88SJamie Gritton error = vfs_setopt(opts, "host.hostid", &hid32, sizeof(hid32)); 246276ca6f88SJamie Gritton } else 246376ca6f88SJamie Gritton #endif 246476ca6f88SJamie Gritton error = vfs_setopt(opts, "host.hostid", &pr->pr_hostid, 246576ca6f88SJamie Gritton sizeof(pr->pr_hostid)); 246676ca6f88SJamie Gritton if (error != 0 && error != ENOENT) 24672a4b2251SJamie Gritton goto done; 24680304c731SJamie Gritton error = vfs_setopt(opts, "enforce_statfs", &pr->pr_enforce_statfs, 24690304c731SJamie Gritton sizeof(pr->pr_enforce_statfs)); 24700304c731SJamie Gritton if (error != 0 && error != ENOENT) 24712a4b2251SJamie Gritton goto done; 24720cc207a6SMartin Matuska error = vfs_setopt(opts, "devfs_ruleset", &pr->pr_devfs_rsnum, 24730cc207a6SMartin Matuska sizeof(pr->pr_devfs_rsnum)); 24740cc207a6SMartin Matuska if (error != 0 && error != ENOENT) 24752a4b2251SJamie Gritton goto done; 2476672756aaSJamie Gritton for (bf = pr_flag_bool; 2477672756aaSJamie Gritton bf < pr_flag_bool + nitems(pr_flag_bool); 2478672756aaSJamie Gritton bf++) { 2479672756aaSJamie Gritton i = (pr->pr_flags & bf->flag) ? 1 : 0; 2480672756aaSJamie Gritton error = vfs_setopt(opts, bf->name, &i, sizeof(i)); 2481b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 24822a4b2251SJamie Gritton goto done; 2483b38ff370SJamie Gritton i = !i; 2484672756aaSJamie Gritton error = vfs_setopt(opts, bf->noname, &i, sizeof(i)); 2485b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 24862a4b2251SJamie Gritton goto done; 24870304c731SJamie Gritton } 2488672756aaSJamie Gritton for (jsf = pr_flag_jailsys; 2489672756aaSJamie Gritton jsf < pr_flag_jailsys + nitems(pr_flag_jailsys); 2490672756aaSJamie Gritton jsf++) { 2491672756aaSJamie Gritton f = pr->pr_flags & (jsf->disable | jsf->new); 2492672756aaSJamie Gritton i = (f != 0 && f == jsf->disable) ? JAIL_SYS_DISABLE 2493672756aaSJamie Gritton : (f == jsf->new) ? JAIL_SYS_NEW 24947cbf7213SJamie Gritton : JAIL_SYS_INHERIT; 2495672756aaSJamie Gritton error = vfs_setopt(opts, jsf->name, &i, sizeof(i)); 24967cbf7213SJamie Gritton if (error != 0 && error != ENOENT) 24972a4b2251SJamie Gritton goto done; 24987cbf7213SJamie Gritton } 2499672756aaSJamie Gritton for (bf = pr_flag_allow; 25005d58f959SJamie Gritton bf < pr_flag_allow + nitems(pr_flag_allow) && 25015d58f959SJamie Gritton atomic_load_int(&bf->flag) != 0; 2502672756aaSJamie Gritton bf++) { 2503672756aaSJamie Gritton i = (pr->pr_allow & bf->flag) ? 1 : 0; 2504672756aaSJamie Gritton error = vfs_setopt(opts, bf->name, &i, sizeof(i)); 25050304c731SJamie Gritton if (error != 0 && error != ENOENT) 25062a4b2251SJamie Gritton goto done; 25070304c731SJamie Gritton i = !i; 2508672756aaSJamie Gritton error = vfs_setopt(opts, bf->noname, &i, sizeof(i)); 25090304c731SJamie Gritton if (error != 0 && error != ENOENT) 25102a4b2251SJamie Gritton goto done; 25110304c731SJamie Gritton } 251276ad42abSJamie Gritton i = !prison_isalive(pr); 2513b38ff370SJamie Gritton error = vfs_setopt(opts, "dying", &i, sizeof(i)); 2514b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 25152a4b2251SJamie Gritton goto done; 2516b38ff370SJamie Gritton i = !i; 2517b38ff370SJamie Gritton error = vfs_setopt(opts, "nodying", &i, sizeof(i)); 2518b38ff370SJamie Gritton if (error != 0 && error != ENOENT) 25192a4b2251SJamie Gritton goto done; 2520bd96bd15SIan Lepore error = vfs_setopt(opts, "osreldate", &pr->pr_osreldate, 2521bd96bd15SIan Lepore sizeof(pr->pr_osreldate)); 2522a1a4c1b0SIan Lepore if (error != 0 && error != ENOENT) 25232a4b2251SJamie Gritton goto done; 2524a1a4c1b0SIan Lepore error = vfs_setopts(opts, "osrelease", pr->pr_osrelease); 2525a1a4c1b0SIan Lepore if (error != 0 && error != ENOENT) 25262a4b2251SJamie Gritton goto done; 2527b38ff370SJamie Gritton 2528b38ff370SJamie Gritton /* Get the module parameters. */ 2529b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 25302a4b2251SJamie Gritton drflags &= ~PD_LOCKED; 2531b38ff370SJamie Gritton error = osd_jail_call(pr, PR_METHOD_GET, opts); 2532b38ff370SJamie Gritton if (error) 25332a4b2251SJamie Gritton goto done; 25342a4b2251SJamie Gritton prison_deref(pr, drflags); 25352a4b2251SJamie Gritton pr = NULL; 25362a4b2251SJamie Gritton drflags = 0; 2537b38ff370SJamie Gritton 2538b38ff370SJamie Gritton /* By now, all parameters should have been noted. */ 2539b38ff370SJamie Gritton TAILQ_FOREACH(opt, opts, link) { 2540b38ff370SJamie Gritton if (!opt->seen && strcmp(opt->name, "errmsg")) { 2541b38ff370SJamie Gritton error = EINVAL; 2542b38ff370SJamie Gritton vfs_opterror(opts, "unknown parameter: %s", opt->name); 25432a4b2251SJamie Gritton goto done; 2544b38ff370SJamie Gritton } 2545b38ff370SJamie Gritton } 2546b38ff370SJamie Gritton 2547b38ff370SJamie Gritton /* Write the fetched parameters back to userspace. */ 2548b38ff370SJamie Gritton error = 0; 2549b38ff370SJamie Gritton TAILQ_FOREACH(opt, opts, link) { 2550b38ff370SJamie Gritton if (opt->pos >= 0 && opt->pos != errmsg_pos) { 2551b38ff370SJamie Gritton pos = 2 * opt->pos + 1; 2552b38ff370SJamie Gritton optuio->uio_iov[pos].iov_len = opt->len; 2553b38ff370SJamie Gritton if (opt->value != NULL) { 2554b38ff370SJamie Gritton if (optuio->uio_segflg == UIO_SYSSPACE) { 2555b38ff370SJamie Gritton bcopy(opt->value, 2556b38ff370SJamie Gritton optuio->uio_iov[pos].iov_base, 2557b38ff370SJamie Gritton opt->len); 2558b38ff370SJamie Gritton } else { 2559b38ff370SJamie Gritton error = copyout(opt->value, 2560b38ff370SJamie Gritton optuio->uio_iov[pos].iov_base, 2561b38ff370SJamie Gritton opt->len); 2562b38ff370SJamie Gritton if (error) 2563b38ff370SJamie Gritton break; 2564b38ff370SJamie Gritton } 2565b38ff370SJamie Gritton } 2566b38ff370SJamie Gritton } 2567b38ff370SJamie Gritton } 2568b38ff370SJamie Gritton 25692a4b2251SJamie Gritton done: 25702a4b2251SJamie Gritton /* Release any temporary prison holds and/or locks. */ 25712a4b2251SJamie Gritton if (pr != NULL) 25722a4b2251SJamie Gritton prison_deref(pr, drflags); 25732a4b2251SJamie Gritton else if (drflags & PD_LIST_SLOCKED) 2574b38ff370SJamie Gritton sx_sunlock(&allprison_lock); 2575b38ff370SJamie Gritton if (error && errmsg_pos >= 0) { 25762a4b2251SJamie Gritton /* Write the error message back to userspace. */ 2577b38ff370SJamie Gritton vfs_getopt(opts, "errmsg", (void **)&errmsg, &errmsg_len); 2578b38ff370SJamie Gritton errmsg_pos = 2 * errmsg_pos + 1; 2579b38ff370SJamie Gritton if (errmsg_len > 0) { 2580b38ff370SJamie Gritton if (optuio->uio_segflg == UIO_SYSSPACE) 2581b38ff370SJamie Gritton bcopy(errmsg, 2582b38ff370SJamie Gritton optuio->uio_iov[errmsg_pos].iov_base, 2583b38ff370SJamie Gritton errmsg_len); 2584b38ff370SJamie Gritton else 2585abbc260fSMark Johnston (void)copyout(errmsg, 2586b38ff370SJamie Gritton optuio->uio_iov[errmsg_pos].iov_base, 2587b38ff370SJamie Gritton errmsg_len); 2588b38ff370SJamie Gritton } 2589b38ff370SJamie Gritton } 2590b38ff370SJamie Gritton vfs_freeopts(opts); 2591b38ff370SJamie Gritton return (error); 2592b38ff370SJamie Gritton } 2593b38ff370SJamie Gritton 2594b38ff370SJamie Gritton /* 2595b38ff370SJamie Gritton * struct jail_remove_args { 2596b38ff370SJamie Gritton * int jid; 2597b38ff370SJamie Gritton * }; 2598b38ff370SJamie Gritton */ 2599b38ff370SJamie Gritton int 26008451d0ddSKip Macy sys_jail_remove(struct thread *td, struct jail_remove_args *uap) 2601b38ff370SJamie Gritton { 2602c861373bSJamie Gritton struct prison *pr; 2603c861373bSJamie Gritton int error; 2604b38ff370SJamie Gritton 2605b38ff370SJamie Gritton error = priv_check(td, PRIV_JAIL_REMOVE); 2606b38ff370SJamie Gritton if (error) 2607b38ff370SJamie Gritton return (error); 2608b38ff370SJamie Gritton 2609b38ff370SJamie Gritton sx_xlock(&allprison_lock); 26100304c731SJamie Gritton pr = prison_find_child(td->td_ucred->cr_prison, uap->jid); 2611b38ff370SJamie Gritton if (pr == NULL) { 2612b38ff370SJamie Gritton sx_xunlock(&allprison_lock); 2613b38ff370SJamie Gritton return (EINVAL); 2614b38ff370SJamie Gritton } 2615c861373bSJamie Gritton if (!prison_isalive(pr)) { 2616c861373bSJamie Gritton /* Silently ignore already-dying prisons. */ 26170304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 2618c861373bSJamie Gritton sx_xunlock(&allprison_lock); 26190304c731SJamie Gritton return (0); 26200304c731SJamie Gritton } 2621c861373bSJamie Gritton prison_deref(pr, PD_KILL | PD_LOCKED | PD_LIST_XLOCKED); 2622c861373bSJamie Gritton return (0); 262375c13541SPoul-Henning Kamp } 262475c13541SPoul-Henning Kamp 2625fd7a8150SMike Barcroft /* 26269ddb7954SMike Barcroft * struct jail_attach_args { 26279ddb7954SMike Barcroft * int jid; 26289ddb7954SMike Barcroft * }; 2629fd7a8150SMike Barcroft */ 2630fd7a8150SMike Barcroft int 26318451d0ddSKip Macy sys_jail_attach(struct thread *td, struct jail_attach_args *uap) 2632fd7a8150SMike Barcroft { 2633b38ff370SJamie Gritton struct prison *pr; 2634b38ff370SJamie Gritton int error; 2635b38ff370SJamie Gritton 2636b38ff370SJamie Gritton error = priv_check(td, PRIV_JAIL_ATTACH); 2637b38ff370SJamie Gritton if (error) 2638b38ff370SJamie Gritton return (error); 2639b38ff370SJamie Gritton 2640f7496dcaSJamie Gritton sx_slock(&allprison_lock); 26410304c731SJamie Gritton pr = prison_find_child(td->td_ucred->cr_prison, uap->jid); 2642b38ff370SJamie Gritton if (pr == NULL) { 2643b38ff370SJamie Gritton sx_sunlock(&allprison_lock); 2644b38ff370SJamie Gritton return (EINVAL); 2645b38ff370SJamie Gritton } 2646b38ff370SJamie Gritton 264776ad42abSJamie Gritton /* Do not allow a process to attach to a prison that is not alive. */ 264876ad42abSJamie Gritton if (!prison_isalive(pr)) { 2649b38ff370SJamie Gritton mtx_unlock(&pr->pr_mtx); 2650b38ff370SJamie Gritton sx_sunlock(&allprison_lock); 2651b38ff370SJamie Gritton return (EINVAL); 2652b38ff370SJamie Gritton } 2653b38ff370SJamie Gritton 2654f7496dcaSJamie Gritton return (do_jail_attach(td, pr, PD_LOCKED | PD_LIST_SLOCKED)); 2655b38ff370SJamie Gritton } 2656b38ff370SJamie Gritton 2657b38ff370SJamie Gritton static int 2658f7496dcaSJamie Gritton do_jail_attach(struct thread *td, struct prison *pr, int drflags) 2659b38ff370SJamie Gritton { 2660fd7a8150SMike Barcroft struct proc *p; 2661fd7a8150SMike Barcroft struct ucred *newcred, *oldcred; 26625050aa86SKonstantin Belousov int error; 2663fd7a8150SMike Barcroft 2664f7496dcaSJamie Gritton mtx_assert(&pr->pr_mtx, MA_OWNED); 2665f7496dcaSJamie Gritton sx_assert(&allprison_lock, SX_LOCKED); 2666589e4c1dSJamie Gritton drflags &= PD_LOCK_FLAGS; 266757f22bd4SJacques Vidrine /* 266857f22bd4SJacques Vidrine * XXX: Note that there is a slight race here if two threads 266957f22bd4SJacques Vidrine * in the same privileged process attempt to attach to two 267057f22bd4SJacques Vidrine * different jails at the same time. It is important for 267157f22bd4SJacques Vidrine * user processes not to do this, or they might end up with 267257f22bd4SJacques Vidrine * a process root from one prison, but attached to the jail 267357f22bd4SJacques Vidrine * of another. 267457f22bd4SJacques Vidrine */ 26751158508aSJamie Gritton prison_hold(pr); 26766754ae25SJamie Gritton refcount_acquire(&pr->pr_uref); 2677f7496dcaSJamie Gritton drflags |= PD_DEREF | PD_DEUREF; 2678fd7a8150SMike Barcroft mtx_unlock(&pr->pr_mtx); 2679f7496dcaSJamie Gritton drflags &= ~PD_LOCKED; 2680b38ff370SJamie Gritton 2681b38ff370SJamie Gritton /* Let modules do whatever they need to prepare for attaching. */ 2682b38ff370SJamie Gritton error = osd_jail_call(pr, PR_METHOD_ATTACH, td); 2683b38ff370SJamie Gritton if (error) { 2684f7496dcaSJamie Gritton prison_deref(pr, drflags); 2685b38ff370SJamie Gritton return (error); 2686b38ff370SJamie Gritton } 2687f7496dcaSJamie Gritton sx_unlock(&allprison_lock); 2688f7496dcaSJamie Gritton drflags &= ~(PD_LIST_SLOCKED | PD_LIST_XLOCKED); 2689fd7a8150SMike Barcroft 2690413628a7SBjoern A. Zeeb /* 2691413628a7SBjoern A. Zeeb * Reparent the newly attached process to this jail. 2692413628a7SBjoern A. Zeeb */ 2693b38ff370SJamie Gritton p = td->td_proc; 2694413628a7SBjoern A. Zeeb error = cpuset_setproc_update_set(p, pr->pr_cpuset); 2695413628a7SBjoern A. Zeeb if (error) 2696b38ff370SJamie Gritton goto e_revert_osd; 2697413628a7SBjoern A. Zeeb 2698cb05b60aSAttilio Rao vn_lock(pr->pr_root, LK_EXCLUSIVE | LK_RETRY); 2699fd7a8150SMike Barcroft if ((error = change_dir(pr->pr_root, td)) != 0) 2700fd7a8150SMike Barcroft goto e_unlock; 2701fd7a8150SMike Barcroft #ifdef MAC 270230d239bcSRobert Watson if ((error = mac_vnode_check_chroot(td->td_ucred, pr->pr_root))) 2703fd7a8150SMike Barcroft goto e_unlock; 2704fd7a8150SMike Barcroft #endif 2705b249ce48SMateusz Guzik VOP_UNLOCK(pr->pr_root); 2706d4380c0cSJamie Gritton if ((error = pwd_chroot_chdir(td, pr->pr_root))) 27075050aa86SKonstantin Belousov goto e_revert_osd; 2708fd7a8150SMike Barcroft 2709fd7a8150SMike Barcroft newcred = crget(); 2710fd7a8150SMike Barcroft PROC_LOCK(p); 27111fb6767dSJamie Gritton oldcred = crcopysafe(p, newcred); 271269c4ee54SJohn Baldwin newcred->cr_prison = pr; 2713daf63fd2SMateusz Guzik proc_set_cred(p, newcred); 27141fb6767dSJamie Gritton setsugid(p); 2715097055e2SEdward Tomasz Napierala #ifdef RACCT 2716097055e2SEdward Tomasz Napierala racct_proc_ucred_changed(p, oldcred, newcred); 2717f87beb93SAndriy Gapon crhold(newcred); 2718f87beb93SAndriy Gapon #endif 2719f87beb93SAndriy Gapon PROC_UNLOCK(p); 2720f87beb93SAndriy Gapon #ifdef RCTL 2721f87beb93SAndriy Gapon rctl_proc_ucred_changed(p, newcred); 2722f87beb93SAndriy Gapon crfree(newcred); 2723097055e2SEdward Tomasz Napierala #endif 27245ecb5444SMateusz Guzik prison_proc_relink(oldcred->cr_prison, pr, p); 2725f7496dcaSJamie Gritton prison_deref(oldcred->cr_prison, drflags); 2726fd7a8150SMike Barcroft crfree(oldcred); 2727cc7b7306SJamie Gritton 2728cc7b7306SJamie Gritton /* 2729cc7b7306SJamie Gritton * If the prison was killed while changing credentials, die along 2730cc7b7306SJamie Gritton * with it. 2731cc7b7306SJamie Gritton */ 2732cc7b7306SJamie Gritton if (!prison_isalive(pr)) { 2733cc7b7306SJamie Gritton PROC_LOCK(p); 2734cc7b7306SJamie Gritton kern_psignal(p, SIGKILL); 2735cc7b7306SJamie Gritton PROC_UNLOCK(p); 2736cc7b7306SJamie Gritton } 2737cc7b7306SJamie Gritton 2738fd7a8150SMike Barcroft return (0); 27391fb6767dSJamie Gritton 2740fd7a8150SMike Barcroft e_unlock: 2741b249ce48SMateusz Guzik VOP_UNLOCK(pr->pr_root); 2742b38ff370SJamie Gritton e_revert_osd: 2743b38ff370SJamie Gritton /* Tell modules this thread is still in its old jail after all. */ 27447f4e7248SJamie Gritton sx_slock(&allprison_lock); 2745f7496dcaSJamie Gritton drflags |= PD_LIST_SLOCKED; 27461fb6767dSJamie Gritton (void)osd_jail_call(td->td_ucred->cr_prison, PR_METHOD_ATTACH, td); 2747f7496dcaSJamie Gritton prison_deref(pr, drflags); 2748fd7a8150SMike Barcroft return (error); 2749fd7a8150SMike Barcroft } 2750fd7a8150SMike Barcroft 2751fd7a8150SMike Barcroft /* 2752fd7a8150SMike Barcroft * Returns a locked prison instance, or NULL on failure. 2753fd7a8150SMike Barcroft */ 275454b369c1SPawel Jakub Dawidek struct prison * 2755fd7a8150SMike Barcroft prison_find(int prid) 2756fd7a8150SMike Barcroft { 2757fd7a8150SMike Barcroft struct prison *pr; 2758fd7a8150SMike Barcroft 2759dc68a633SPawel Jakub Dawidek sx_assert(&allprison_lock, SX_LOCKED); 2760b38ff370SJamie Gritton TAILQ_FOREACH(pr, &allprison, pr_list) { 2761f7496dcaSJamie Gritton if (pr->pr_id < prid) 2762f7496dcaSJamie Gritton continue; 27637de883c8SJamie Gritton if (pr->pr_id > prid) 27647de883c8SJamie Gritton break; 2765f7496dcaSJamie Gritton KASSERT(prison_isvalid(pr), ("Found invalid prison %p", pr)); 2766f7496dcaSJamie Gritton mtx_lock(&pr->pr_mtx); 2767f7496dcaSJamie Gritton return (pr); 2768fd7a8150SMike Barcroft } 2769fd7a8150SMike Barcroft return (NULL); 2770fd7a8150SMike Barcroft } 2771fd7a8150SMike Barcroft 2772b38ff370SJamie Gritton /* 27730304c731SJamie Gritton * Find a prison that is a descendant of mypr. Returns a locked prison or NULL. 2774b38ff370SJamie Gritton */ 2775b38ff370SJamie Gritton struct prison * 27760304c731SJamie Gritton prison_find_child(struct prison *mypr, int prid) 2777b38ff370SJamie Gritton { 27780304c731SJamie Gritton struct prison *pr; 27790304c731SJamie Gritton int descend; 2780b38ff370SJamie Gritton 2781b38ff370SJamie Gritton sx_assert(&allprison_lock, SX_LOCKED); 27820304c731SJamie Gritton FOREACH_PRISON_DESCENDANT(mypr, pr, descend) { 27830304c731SJamie Gritton if (pr->pr_id == prid) { 2784f7496dcaSJamie Gritton KASSERT(prison_isvalid(pr), 2785f7496dcaSJamie Gritton ("Found invalid prison %p", pr)); 27860304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 27870304c731SJamie Gritton return (pr); 27880304c731SJamie Gritton } 27890304c731SJamie Gritton } 27900304c731SJamie Gritton return (NULL); 27910304c731SJamie Gritton } 27920304c731SJamie Gritton 27930304c731SJamie Gritton /* 27940304c731SJamie Gritton * Look for the name relative to mypr. Returns a locked prison or NULL. 27950304c731SJamie Gritton */ 27960304c731SJamie Gritton struct prison * 27970304c731SJamie Gritton prison_find_name(struct prison *mypr, const char *name) 27980304c731SJamie Gritton { 27990304c731SJamie Gritton struct prison *pr, *deadpr; 28000304c731SJamie Gritton size_t mylen; 28010304c731SJamie Gritton int descend; 28020304c731SJamie Gritton 28030304c731SJamie Gritton sx_assert(&allprison_lock, SX_LOCKED); 28040304c731SJamie Gritton mylen = (mypr == &prison0) ? 0 : strlen(mypr->pr_name) + 1; 2805b38ff370SJamie Gritton deadpr = NULL; 28060304c731SJamie Gritton FOREACH_PRISON_DESCENDANT(mypr, pr, descend) { 28070304c731SJamie Gritton if (!strcmp(pr->pr_name + mylen, name)) { 2808f7496dcaSJamie Gritton KASSERT(prison_isvalid(pr), 2809f7496dcaSJamie Gritton ("Found invalid prison %p", pr)); 2810f7496dcaSJamie Gritton if (prison_isalive(pr)) { 2811b38ff370SJamie Gritton mtx_lock(&pr->pr_mtx); 2812b38ff370SJamie Gritton return (pr); 2813f7496dcaSJamie Gritton } 2814b38ff370SJamie Gritton deadpr = pr; 2815b38ff370SJamie Gritton } 2816b38ff370SJamie Gritton } 28170304c731SJamie Gritton /* There was no valid prison - perhaps there was a dying one. */ 2818f7496dcaSJamie Gritton if (deadpr != NULL) 2819b38ff370SJamie Gritton mtx_lock(&deadpr->pr_mtx); 2820b38ff370SJamie Gritton return (deadpr); 2821b38ff370SJamie Gritton } 2822b38ff370SJamie Gritton 2823b38ff370SJamie Gritton /* 28240fe74ae6SJamie Gritton * See if a prison has the specific flag set. The prison should be locked, 28250fe74ae6SJamie Gritton * unless checking for flags that are only set at jail creation (such as 28260fe74ae6SJamie Gritton * PR_IP4 and PR_IP6), or only the single bit is examined, without regard 28270fe74ae6SJamie Gritton * to any other prison data. 28280304c731SJamie Gritton */ 28290b0ae2e4SMina Galić bool 28300304c731SJamie Gritton prison_flag(struct ucred *cred, unsigned flag) 28310304c731SJamie Gritton { 28320304c731SJamie Gritton 28330b0ae2e4SMina Galić return ((cred->cr_prison->pr_flags & flag) != 0); 28340304c731SJamie Gritton } 28350304c731SJamie Gritton 28360b0ae2e4SMina Galić /* 28370b0ae2e4SMina Galić * See if a prison has the specific allow flag set. 28380b0ae2e4SMina Galić * The prison *should* be locked, or only a single bit is examined, without 28390b0ae2e4SMina Galić * regard to any other prison data. 28400b0ae2e4SMina Galić */ 28410b0ae2e4SMina Galić bool 28420304c731SJamie Gritton prison_allow(struct ucred *cred, unsigned flag) 28430304c731SJamie Gritton { 28440304c731SJamie Gritton 28450fe74ae6SJamie Gritton return ((cred->cr_prison->pr_allow & flag) != 0); 28460304c731SJamie Gritton } 28470304c731SJamie Gritton 28480304c731SJamie Gritton /* 2849effad35eSJamie Gritton * Hold a prison reference, by incrementing pr_ref. It is generally 2850effad35eSJamie Gritton * an error to hold a prison that does not already have a reference. 2851effad35eSJamie Gritton * A prison record will remain valid as long as it has at least one 2852effad35eSJamie Gritton * reference, and will not be removed as long as either the prison 2853effad35eSJamie Gritton * mutex or the allprison lock is held (allprison_lock may be shared). 2854effad35eSJamie Gritton */ 2855effad35eSJamie Gritton void 2856effad35eSJamie Gritton prison_hold_locked(struct prison *pr) 2857effad35eSJamie Gritton { 2858effad35eSJamie Gritton 28596754ae25SJamie Gritton /* Locking is no longer required. */ 28606754ae25SJamie Gritton prison_hold(pr); 2861effad35eSJamie Gritton } 2862effad35eSJamie Gritton 2863effad35eSJamie Gritton void 2864effad35eSJamie Gritton prison_hold(struct prison *pr) 2865effad35eSJamie Gritton { 28666754ae25SJamie Gritton #ifdef INVARIANTS 28676754ae25SJamie Gritton int was_valid = refcount_acquire_if_not_zero(&pr->pr_ref); 2868effad35eSJamie Gritton 28696754ae25SJamie Gritton KASSERT(was_valid, 28706754ae25SJamie Gritton ("Trying to hold dead prison %p (jid=%d).", pr, pr->pr_id)); 28716754ae25SJamie Gritton #else 28726754ae25SJamie Gritton refcount_acquire(&pr->pr_ref); 28736754ae25SJamie Gritton #endif 2874effad35eSJamie Gritton } 2875effad35eSJamie Gritton 2876effad35eSJamie Gritton /* 2877effad35eSJamie Gritton * Remove a prison reference. If that was the last reference, the 2878f7496dcaSJamie Gritton * prison will be removed (at a later time). 2879b38ff370SJamie Gritton */ 288091421ba2SRobert Watson void 28811ba4a712SPawel Jakub Dawidek prison_free_locked(struct prison *pr) 288291421ba2SRobert Watson { 288391421ba2SRobert Watson 28841ba4a712SPawel Jakub Dawidek mtx_assert(&pr->pr_mtx, MA_OWNED); 2885effad35eSJamie Gritton /* 2886f7496dcaSJamie Gritton * Locking is no longer required, but unlock because the caller 2887f7496dcaSJamie Gritton * expects it. 2888effad35eSJamie Gritton */ 2889f7496dcaSJamie Gritton mtx_unlock(&pr->pr_mtx); 2890f7496dcaSJamie Gritton prison_free(pr); 2891effad35eSJamie Gritton } 2892c2cda609SPawel Jakub Dawidek 28931ba4a712SPawel Jakub Dawidek void 28941ba4a712SPawel Jakub Dawidek prison_free(struct prison *pr) 28951ba4a712SPawel Jakub Dawidek { 28961ba4a712SPawel Jakub Dawidek 28976754ae25SJamie Gritton KASSERT(refcount_load(&pr->pr_ref) > 0, 28986754ae25SJamie Gritton ("Trying to free dead prison %p (jid=%d).", 28996754ae25SJamie Gritton pr, pr->pr_id)); 2900f7496dcaSJamie Gritton if (!refcount_release_if_not_last(&pr->pr_ref)) { 2901f7496dcaSJamie Gritton /* 2902f7496dcaSJamie Gritton * Don't remove the last reference in this context, 2903f7496dcaSJamie Gritton * in case there are locks held. 2904f7496dcaSJamie Gritton */ 2905f7496dcaSJamie Gritton taskqueue_enqueue(taskqueue_thread, &pr->pr_task); 2906f7496dcaSJamie Gritton } 2907f7496dcaSJamie Gritton } 2908f7496dcaSJamie Gritton 2909f7496dcaSJamie Gritton static void 2910f7496dcaSJamie Gritton prison_free_not_last(struct prison *pr) 2911f7496dcaSJamie Gritton { 2912f7496dcaSJamie Gritton #ifdef INVARIANTS 2913f7496dcaSJamie Gritton int lastref; 2914f7496dcaSJamie Gritton 2915f7496dcaSJamie Gritton KASSERT(refcount_load(&pr->pr_ref) > 0, 2916f7496dcaSJamie Gritton ("Trying to free dead prison %p (jid=%d).", 2917f7496dcaSJamie Gritton pr, pr->pr_id)); 2918f7496dcaSJamie Gritton lastref = refcount_release(&pr->pr_ref); 2919f7496dcaSJamie Gritton KASSERT(!lastref, 2920f7496dcaSJamie Gritton ("prison_free_not_last freed last ref on prison %p (jid=%d).", 2921f7496dcaSJamie Gritton pr, pr->pr_id)); 2922f7496dcaSJamie Gritton #else 2923ee9b37aeSMateusz Guzik refcount_release(&pr->pr_ref); 2924f7496dcaSJamie Gritton #endif 29251ba4a712SPawel Jakub Dawidek } 29261ba4a712SPawel Jakub Dawidek 292773d9e52dSJamie Gritton /* 2928f171938cSGordon Bergling * Hold a prison for user visibility, by incrementing pr_uref. 2929effad35eSJamie Gritton * It is generally an error to hold a prison that isn't already 293049a033d8SGordon Bergling * user-visible, except through the jail system calls. It is also 2931effad35eSJamie Gritton * an error to hold an invalid prison. A prison record will remain 2932effad35eSJamie Gritton * alive as long as it has at least one user reference, and will not 2933f7496dcaSJamie Gritton * be set to the dying state until the prison mutex and allprison_lock 2934f7496dcaSJamie Gritton * are both freed. 2935effad35eSJamie Gritton */ 2936effad35eSJamie Gritton void 2937effad35eSJamie Gritton prison_proc_hold(struct prison *pr) 2938effad35eSJamie Gritton { 29396754ae25SJamie Gritton #ifdef INVARIANTS 29406754ae25SJamie Gritton int was_alive = refcount_acquire_if_not_zero(&pr->pr_uref); 2941effad35eSJamie Gritton 29426754ae25SJamie Gritton KASSERT(was_alive, 2943effad35eSJamie Gritton ("Cannot add a process to a non-alive prison (jid=%d)", pr->pr_id)); 29446754ae25SJamie Gritton #else 29456754ae25SJamie Gritton refcount_acquire(&pr->pr_uref); 29466754ae25SJamie Gritton #endif 2947effad35eSJamie Gritton } 2948effad35eSJamie Gritton 2949effad35eSJamie Gritton /* 2950effad35eSJamie Gritton * Remove a prison user reference. If it was the last reference, the 2951effad35eSJamie Gritton * prison will be considered "dying", and may be removed once all of 2952effad35eSJamie Gritton * its references are dropped. 2953effad35eSJamie Gritton */ 2954effad35eSJamie Gritton void 2955effad35eSJamie Gritton prison_proc_free(struct prison *pr) 2956effad35eSJamie Gritton { 2957effad35eSJamie Gritton 29586754ae25SJamie Gritton /* 29596754ae25SJamie Gritton * Locking is only required when releasing the last reference. 29606754ae25SJamie Gritton * This allows assurance that a locked prison will remain alive 29616754ae25SJamie Gritton * until it is unlocked. 29626754ae25SJamie Gritton */ 29636754ae25SJamie Gritton KASSERT(refcount_load(&pr->pr_uref) > 0, 2964effad35eSJamie Gritton ("Trying to kill a process in a dead prison (jid=%d)", pr->pr_id)); 2965195cd6aeSJamie Gritton if (!refcount_release_if_not_last(&pr->pr_uref)) { 2966effad35eSJamie Gritton /* 2967effad35eSJamie Gritton * Don't remove the last user reference in this context, 2968effad35eSJamie Gritton * which is expected to be a process that is not only locked, 2969effad35eSJamie Gritton * but also half dead. Add a reference so any calls to 2970effad35eSJamie Gritton * prison_free() won't re-submit the task. 2971effad35eSJamie Gritton */ 2972f7496dcaSJamie Gritton prison_hold(pr); 29731158508aSJamie Gritton mtx_lock(&pr->pr_mtx); 29741158508aSJamie Gritton KASSERT(!(pr->pr_flags & PR_COMPLETE_PROC), 29751158508aSJamie Gritton ("Redundant last reference in prison_proc_free (jid=%d)", 29761158508aSJamie Gritton pr->pr_id)); 29771158508aSJamie Gritton pr->pr_flags |= PR_COMPLETE_PROC; 29781158508aSJamie Gritton mtx_unlock(&pr->pr_mtx); 2979effad35eSJamie Gritton taskqueue_enqueue(taskqueue_thread, &pr->pr_task); 2980effad35eSJamie Gritton } 2981effad35eSJamie Gritton } 2982effad35eSJamie Gritton 2983c861373bSJamie Gritton static void 2984c861373bSJamie Gritton prison_proc_free_not_last(struct prison *pr) 2985c861373bSJamie Gritton { 2986c861373bSJamie Gritton #ifdef INVARIANTS 2987c861373bSJamie Gritton int lastref; 2988c861373bSJamie Gritton 2989c861373bSJamie Gritton KASSERT(refcount_load(&pr->pr_uref) > 0, 2990c861373bSJamie Gritton ("Trying to free dead prison %p (jid=%d).", 2991c861373bSJamie Gritton pr, pr->pr_id)); 2992c861373bSJamie Gritton lastref = refcount_release(&pr->pr_uref); 2993c861373bSJamie Gritton KASSERT(!lastref, 2994c861373bSJamie Gritton ("prison_proc_free_not_last freed last uref on prison %p (jid=%d).", 2995c861373bSJamie Gritton pr, pr->pr_id)); 2996c861373bSJamie Gritton #else 2997c861373bSJamie Gritton refcount_release(&pr->pr_uref); 2998c861373bSJamie Gritton #endif 2999c861373bSJamie Gritton } 3000c861373bSJamie Gritton 30015ecb5444SMateusz Guzik void 30025ecb5444SMateusz Guzik prison_proc_link(struct prison *pr, struct proc *p) 30035ecb5444SMateusz Guzik { 30045ecb5444SMateusz Guzik 30055ecb5444SMateusz Guzik sx_assert(&allproc_lock, SA_XLOCKED); 30065ecb5444SMateusz Guzik LIST_INSERT_HEAD(&pr->pr_proclist, p, p_jaillist); 30075ecb5444SMateusz Guzik } 30085ecb5444SMateusz Guzik 30095ecb5444SMateusz Guzik void 30105ecb5444SMateusz Guzik prison_proc_unlink(struct prison *pr, struct proc *p) 30115ecb5444SMateusz Guzik { 30125ecb5444SMateusz Guzik 30135ecb5444SMateusz Guzik sx_assert(&allproc_lock, SA_XLOCKED); 30145ecb5444SMateusz Guzik LIST_REMOVE(p, p_jaillist); 30155ecb5444SMateusz Guzik } 30165ecb5444SMateusz Guzik 30175ecb5444SMateusz Guzik static void 30185ecb5444SMateusz Guzik prison_proc_relink(struct prison *opr, struct prison *npr, struct proc *p) 30195ecb5444SMateusz Guzik { 30205ecb5444SMateusz Guzik 30215ecb5444SMateusz Guzik sx_xlock(&allproc_lock); 30225ecb5444SMateusz Guzik prison_proc_unlink(opr, p); 30235ecb5444SMateusz Guzik prison_proc_link(npr, p); 30245ecb5444SMateusz Guzik sx_xunlock(&allproc_lock); 30255ecb5444SMateusz Guzik } 30265ecb5444SMateusz Guzik 3027effad35eSJamie Gritton /* 302873d9e52dSJamie Gritton * Complete a call to either prison_free or prison_proc_free. 302973d9e52dSJamie Gritton */ 3030c2cda609SPawel Jakub Dawidek static void 3031c2cda609SPawel Jakub Dawidek prison_complete(void *context, int pending) 3032c2cda609SPawel Jakub Dawidek { 303373d9e52dSJamie Gritton struct prison *pr = context; 3034f7496dcaSJamie Gritton int drflags; 3035b38ff370SJamie Gritton 3036effad35eSJamie Gritton /* 30371158508aSJamie Gritton * This could be called to release the last reference, or the last 30381158508aSJamie Gritton * user reference (plus the reference held in prison_proc_free). 3039effad35eSJamie Gritton */ 3040f7496dcaSJamie Gritton drflags = prison_lock_xlock(pr, PD_DEREF); 30411158508aSJamie Gritton if (pr->pr_flags & PR_COMPLETE_PROC) { 30421158508aSJamie Gritton pr->pr_flags &= ~PR_COMPLETE_PROC; 3043f7496dcaSJamie Gritton drflags |= PD_DEUREF; 30441158508aSJamie Gritton } 3045f7496dcaSJamie Gritton prison_deref(pr, drflags); 3046b38ff370SJamie Gritton } 3047b38ff370SJamie Gritton 30485ecb5444SMateusz Guzik static void 30495ecb5444SMateusz Guzik prison_kill_processes_cb(struct proc *p, void *arg __unused) 30505ecb5444SMateusz Guzik { 30515ecb5444SMateusz Guzik 30525ecb5444SMateusz Guzik kern_psignal(p, SIGKILL); 30535ecb5444SMateusz Guzik } 30545ecb5444SMateusz Guzik 30555ecb5444SMateusz Guzik /* 30565ecb5444SMateusz Guzik * Note the iteration does not guarantee acting on all processes. 30575ecb5444SMateusz Guzik * Most notably there may be fork or jail_attach in progress. 30585ecb5444SMateusz Guzik */ 30595ecb5444SMateusz Guzik void 30605ecb5444SMateusz Guzik prison_proc_iterate(struct prison *pr, void (*cb)(struct proc *, void *), 30615ecb5444SMateusz Guzik void *cbarg) 30625ecb5444SMateusz Guzik { 30635ecb5444SMateusz Guzik struct prison *ppr; 30645ecb5444SMateusz Guzik struct proc *p; 30655ecb5444SMateusz Guzik 30665ecb5444SMateusz Guzik if (atomic_load_int(&pr->pr_childcount) == 0) { 30675ecb5444SMateusz Guzik sx_slock(&allproc_lock); 30685ecb5444SMateusz Guzik LIST_FOREACH(p, &pr->pr_proclist, p_jaillist) { 30695ecb5444SMateusz Guzik if (p->p_state == PRS_NEW) 30705ecb5444SMateusz Guzik continue; 30715ecb5444SMateusz Guzik PROC_LOCK(p); 30725ecb5444SMateusz Guzik cb(p, cbarg); 30735ecb5444SMateusz Guzik PROC_UNLOCK(p); 30745ecb5444SMateusz Guzik } 30755ecb5444SMateusz Guzik sx_sunlock(&allproc_lock); 30765ecb5444SMateusz Guzik if (atomic_load_int(&pr->pr_childcount) == 0) 30775ecb5444SMateusz Guzik return; 30785ecb5444SMateusz Guzik /* 30795ecb5444SMateusz Guzik * Some jails popped up during the iteration, fall through to a 30805ecb5444SMateusz Guzik * system-wide search. 30815ecb5444SMateusz Guzik */ 30825ecb5444SMateusz Guzik } 30835ecb5444SMateusz Guzik 30845ecb5444SMateusz Guzik sx_slock(&allproc_lock); 30855ecb5444SMateusz Guzik FOREACH_PROC_IN_SYSTEM(p) { 30865ecb5444SMateusz Guzik PROC_LOCK(p); 30875ecb5444SMateusz Guzik if (p->p_state != PRS_NEW && p->p_ucred != NULL) { 3088831531a8SKonstantin Belousov for (ppr = p->p_ucred->cr_prison; ppr != NULL; 30895ecb5444SMateusz Guzik ppr = ppr->pr_parent) { 30905ecb5444SMateusz Guzik if (ppr == pr) { 30915ecb5444SMateusz Guzik cb(p, cbarg); 30925ecb5444SMateusz Guzik break; 30935ecb5444SMateusz Guzik } 30945ecb5444SMateusz Guzik } 30955ecb5444SMateusz Guzik } 30965ecb5444SMateusz Guzik PROC_UNLOCK(p); 30975ecb5444SMateusz Guzik } 30985ecb5444SMateusz Guzik sx_sunlock(&allproc_lock); 30995ecb5444SMateusz Guzik } 31005ecb5444SMateusz Guzik 3101b38ff370SJamie Gritton /* 3102effad35eSJamie Gritton * Remove a prison reference and/or user reference (usually). 3103effad35eSJamie Gritton * This assumes context that allows sleeping (for allprison_lock), 3104effad35eSJamie Gritton * with no non-sleeping locks held, except perhaps the prison itself. 3105effad35eSJamie Gritton * If there are no more references, release and delist the prison. 3106effad35eSJamie Gritton * On completion, the prison lock and the allprison lock are both 3107effad35eSJamie Gritton * unlocked. 3108b38ff370SJamie Gritton */ 3109b38ff370SJamie Gritton static void 3110b38ff370SJamie Gritton prison_deref(struct prison *pr, int flags) 3111b38ff370SJamie Gritton { 31126e1d1bfcSJamie Gritton struct prisonlist freeprison; 3113c861373bSJamie Gritton struct prison *killpr, *rpr, *ppr, *tpr; 3114c2cda609SPawel Jakub Dawidek 3115c861373bSJamie Gritton killpr = NULL; 31166e1d1bfcSJamie Gritton TAILQ_INIT(&freeprison); 31176e1d1bfcSJamie Gritton /* 31186e1d1bfcSJamie Gritton * Release this prison as requested, which may cause its parent 31196e1d1bfcSJamie Gritton * to be released, and then maybe its grandparent, etc. 31206e1d1bfcSJamie Gritton */ 31210304c731SJamie Gritton for (;;) { 3122c861373bSJamie Gritton if (flags & PD_KILL) { 3123c861373bSJamie Gritton /* Kill the prison and its descendents. */ 3124589e4c1dSJamie Gritton KASSERT(pr != &prison0, 3125589e4c1dSJamie Gritton ("prison_deref trying to kill prison0")); 3126c861373bSJamie Gritton if (!(flags & PD_DEREF)) { 3127c861373bSJamie Gritton prison_hold(pr); 3128c861373bSJamie Gritton flags |= PD_DEREF; 3129c861373bSJamie Gritton } 3130c861373bSJamie Gritton flags = prison_lock_xlock(pr, flags); 3131c861373bSJamie Gritton prison_deref_kill(pr, &freeprison); 3132c861373bSJamie Gritton } 3133e6d5cb63SJamie Gritton if (flags & PD_DEUREF) { 3134f7496dcaSJamie Gritton /* Drop a user reference. */ 31356754ae25SJamie Gritton KASSERT(refcount_load(&pr->pr_uref) > 0, 313673d9e52dSJamie Gritton ("prison_deref PD_DEUREF on a dead prison (jid=%d)", 313773d9e52dSJamie Gritton pr->pr_id)); 3138f7496dcaSJamie Gritton if (!refcount_release_if_not_last(&pr->pr_uref)) { 3139f7496dcaSJamie Gritton if (!(flags & PD_DEREF)) { 3140f7496dcaSJamie Gritton prison_hold(pr); 3141f7496dcaSJamie Gritton flags |= PD_DEREF; 3142f7496dcaSJamie Gritton } 3143f7496dcaSJamie Gritton flags = prison_lock_xlock(pr, flags); 31441158508aSJamie Gritton if (refcount_release(&pr->pr_uref) && 31451158508aSJamie Gritton pr->pr_state == PRISON_STATE_ALIVE) { 3146f7496dcaSJamie Gritton /* 3147f7496dcaSJamie Gritton * When the last user references goes, 3148f7496dcaSJamie Gritton * this becomes a dying prison. 3149f7496dcaSJamie Gritton */ 3150f7496dcaSJamie Gritton KASSERT( 3151f7496dcaSJamie Gritton refcount_load(&prison0.pr_uref) > 0, 31526754ae25SJamie Gritton ("prison0 pr_uref=0")); 31531158508aSJamie Gritton pr->pr_state = PRISON_STATE_DYING; 3154f7496dcaSJamie Gritton mtx_unlock(&pr->pr_mtx); 3155f7496dcaSJamie Gritton flags &= ~PD_LOCKED; 3156a9f7455cSJamie Gritton prison_cleanup(pr); 3157f7496dcaSJamie Gritton } 3158f7496dcaSJamie Gritton } 3159f7496dcaSJamie Gritton } 3160c861373bSJamie Gritton if (flags & PD_KILL) { 3161c861373bSJamie Gritton /* 3162c861373bSJamie Gritton * Any remaining user references are probably processes 3163c861373bSJamie Gritton * that need to be killed, either in this prison or its 3164c861373bSJamie Gritton * descendants. 3165c861373bSJamie Gritton */ 3166c861373bSJamie Gritton if (refcount_load(&pr->pr_uref) > 0) 3167c861373bSJamie Gritton killpr = pr; 3168589e4c1dSJamie Gritton /* Make sure the parent prison doesn't get killed. */ 3169589e4c1dSJamie Gritton flags &= ~PD_KILL; 3170c861373bSJamie Gritton } 317173d9e52dSJamie Gritton if (flags & PD_DEREF) { 3172f7496dcaSJamie Gritton /* Drop a reference. */ 31736754ae25SJamie Gritton KASSERT(refcount_load(&pr->pr_ref) > 0, 317473d9e52dSJamie Gritton ("prison_deref PD_DEREF on a dead prison (jid=%d)", 317573d9e52dSJamie Gritton pr->pr_id)); 3176f7496dcaSJamie Gritton if (!refcount_release_if_not_last(&pr->pr_ref)) { 3177f7496dcaSJamie Gritton flags = prison_lock_xlock(pr, flags); 3178f7496dcaSJamie Gritton if (refcount_release(&pr->pr_ref)) { 3179cc5fd8c7SJamie Gritton /* 3180f7496dcaSJamie Gritton * When the last reference goes, 3181f7496dcaSJamie Gritton * unlink the prison and set it aside. 3182cc5fd8c7SJamie Gritton */ 3183f7496dcaSJamie Gritton KASSERT( 3184f7496dcaSJamie Gritton refcount_load(&pr->pr_uref) == 0, 3185f7496dcaSJamie Gritton ("prison_deref: last ref, " 3186f7496dcaSJamie Gritton "but still has %d urefs (jid=%d)", 3187f7496dcaSJamie Gritton pr->pr_uref, pr->pr_id)); 3188f7496dcaSJamie Gritton KASSERT( 3189f7496dcaSJamie Gritton refcount_load(&prison0.pr_ref) != 0, 3190f7496dcaSJamie Gritton ("prison0 pr_ref=0")); 31911158508aSJamie Gritton pr->pr_state = PRISON_STATE_INVALID; 3192b38ff370SJamie Gritton TAILQ_REMOVE(&allprison, pr, pr_list); 31930304c731SJamie Gritton LIST_REMOVE(pr, pr_sibling); 3194f7496dcaSJamie Gritton TAILQ_INSERT_TAIL(&freeprison, pr, 3195f7496dcaSJamie Gritton pr_list); 3196f7496dcaSJamie Gritton for (ppr = pr->pr_parent; 3197f7496dcaSJamie Gritton ppr != NULL; 3198f7496dcaSJamie Gritton ppr = ppr->pr_parent) 3199f7496dcaSJamie Gritton ppr->pr_childcount--; 3200f7496dcaSJamie Gritton /* 3201f7496dcaSJamie Gritton * Removing a prison frees references 3202f7496dcaSJamie Gritton * from its parent. 3203f7496dcaSJamie Gritton */ 3204f7496dcaSJamie Gritton mtx_unlock(&pr->pr_mtx); 3205f7496dcaSJamie Gritton flags &= ~PD_LOCKED; 32066e1d1bfcSJamie Gritton pr = pr->pr_parent; 32076e1d1bfcSJamie Gritton flags |= PD_DEREF | PD_DEUREF; 3208f7496dcaSJamie Gritton continue; 3209f7496dcaSJamie Gritton } 3210f7496dcaSJamie Gritton } 3211f7496dcaSJamie Gritton } 3212f7496dcaSJamie Gritton break; 32136e1d1bfcSJamie Gritton } 32146e1d1bfcSJamie Gritton 32156e1d1bfcSJamie Gritton /* Release all the prison locks. */ 3216f7496dcaSJamie Gritton if (flags & PD_LOCKED) 3217f7496dcaSJamie Gritton mtx_unlock(&pr->pr_mtx); 32186e1d1bfcSJamie Gritton if (flags & PD_LIST_SLOCKED) 32196e1d1bfcSJamie Gritton sx_sunlock(&allprison_lock); 32206e1d1bfcSJamie Gritton else if (flags & PD_LIST_XLOCKED) 32216e1d1bfcSJamie Gritton sx_xunlock(&allprison_lock); 32226e1d1bfcSJamie Gritton 3223c861373bSJamie Gritton /* Kill any processes attached to a killed prison. */ 32245ecb5444SMateusz Guzik if (killpr != NULL) 32255ecb5444SMateusz Guzik prison_proc_iterate(killpr, prison_kill_processes_cb, NULL); 3226c861373bSJamie Gritton 32276e1d1bfcSJamie Gritton /* 32286e1d1bfcSJamie Gritton * Finish removing any unreferenced prisons, which couldn't happen 32296e1d1bfcSJamie Gritton * while allprison_lock was held (to avoid a LOR on vrele). 32306e1d1bfcSJamie Gritton */ 32316e1d1bfcSJamie Gritton TAILQ_FOREACH_SAFE(rpr, &freeprison, pr_list, tpr) { 32326e1d1bfcSJamie Gritton #ifdef VIMAGE 32336e1d1bfcSJamie Gritton if (rpr->pr_vnet != rpr->pr_parent->pr_vnet) 32346e1d1bfcSJamie Gritton vnet_destroy(rpr->pr_vnet); 32356e1d1bfcSJamie Gritton #endif 32366e1d1bfcSJamie Gritton if (rpr->pr_root != NULL) 32376e1d1bfcSJamie Gritton vrele(rpr->pr_root); 32386e1d1bfcSJamie Gritton mtx_destroy(&rpr->pr_mtx); 32396e1d1bfcSJamie Gritton #ifdef INET 3240eb8dcdeaSGleb Smirnoff prison_ip_free(rpr->pr_addrs[PR_INET]); 32416e1d1bfcSJamie Gritton #endif 32426e1d1bfcSJamie Gritton #ifdef INET6 3243eb8dcdeaSGleb Smirnoff prison_ip_free(rpr->pr_addrs[PR_INET6]); 32446e1d1bfcSJamie Gritton #endif 32456e1d1bfcSJamie Gritton if (rpr->pr_cpuset != NULL) 32466e1d1bfcSJamie Gritton cpuset_rel(rpr->pr_cpuset); 32476e1d1bfcSJamie Gritton osd_jail_exit(rpr); 32486e1d1bfcSJamie Gritton #ifdef RACCT 32496e1d1bfcSJamie Gritton if (racct_enable) 32506e1d1bfcSJamie Gritton prison_racct_detach(rpr); 32516e1d1bfcSJamie Gritton #endif 3252f7496dcaSJamie Gritton TAILQ_REMOVE(&freeprison, rpr, pr_list); 32536e1d1bfcSJamie Gritton free(rpr, M_PRISON); 32540304c731SJamie Gritton } 3255b3059e09SRobert Watson } 3256b3059e09SRobert Watson 3257413628a7SBjoern A. Zeeb /* 3258c861373bSJamie Gritton * Kill the prison and its descendants. Mark them as dying, clear the 3259c861373bSJamie Gritton * persist flag, and call module remove methods. 3260c861373bSJamie Gritton */ 3261c861373bSJamie Gritton static void 3262c861373bSJamie Gritton prison_deref_kill(struct prison *pr, struct prisonlist *freeprison) 3263c861373bSJamie Gritton { 3264c861373bSJamie Gritton struct prison *cpr, *ppr, *rpr; 3265c861373bSJamie Gritton bool descend; 3266c861373bSJamie Gritton 3267c861373bSJamie Gritton /* 3268c861373bSJamie Gritton * Unlike the descendants, the target prison can be killed 3269c861373bSJamie Gritton * even if it is currently dying. This is useful for failed 3270c861373bSJamie Gritton * creation in jail_set(2). 3271c861373bSJamie Gritton */ 3272c861373bSJamie Gritton KASSERT(refcount_load(&pr->pr_ref) > 0, 3273c861373bSJamie Gritton ("Trying to kill dead prison %p (jid=%d).", 3274c861373bSJamie Gritton pr, pr->pr_id)); 3275c861373bSJamie Gritton refcount_acquire(&pr->pr_uref); 3276c861373bSJamie Gritton pr->pr_state = PRISON_STATE_DYING; 3277c861373bSJamie Gritton mtx_unlock(&pr->pr_mtx); 3278c861373bSJamie Gritton 3279c861373bSJamie Gritton rpr = NULL; 3280c861373bSJamie Gritton FOREACH_PRISON_DESCENDANT_PRE_POST(pr, cpr, descend) { 3281c861373bSJamie Gritton if (descend) { 3282c861373bSJamie Gritton if (!prison_isalive(cpr)) { 3283c861373bSJamie Gritton descend = false; 3284c861373bSJamie Gritton continue; 3285c861373bSJamie Gritton } 3286c861373bSJamie Gritton prison_hold(cpr); 3287c861373bSJamie Gritton prison_proc_hold(cpr); 3288c861373bSJamie Gritton mtx_lock(&cpr->pr_mtx); 3289c861373bSJamie Gritton cpr->pr_state = PRISON_STATE_DYING; 3290c861373bSJamie Gritton cpr->pr_flags |= PR_REMOVE; 3291c861373bSJamie Gritton mtx_unlock(&cpr->pr_mtx); 3292c861373bSJamie Gritton continue; 3293c861373bSJamie Gritton } 3294c861373bSJamie Gritton if (!(cpr->pr_flags & PR_REMOVE)) 3295c861373bSJamie Gritton continue; 3296a9f7455cSJamie Gritton prison_cleanup(cpr); 3297c861373bSJamie Gritton mtx_lock(&cpr->pr_mtx); 3298c861373bSJamie Gritton cpr->pr_flags &= ~PR_REMOVE; 3299c861373bSJamie Gritton if (cpr->pr_flags & PR_PERSIST) { 3300c861373bSJamie Gritton cpr->pr_flags &= ~PR_PERSIST; 3301c861373bSJamie Gritton prison_proc_free_not_last(cpr); 3302c861373bSJamie Gritton prison_free_not_last(cpr); 3303c861373bSJamie Gritton } 3304c861373bSJamie Gritton (void)refcount_release(&cpr->pr_uref); 3305c861373bSJamie Gritton if (refcount_release(&cpr->pr_ref)) { 3306c861373bSJamie Gritton /* 3307c861373bSJamie Gritton * When the last reference goes, unlink the prison 3308c861373bSJamie Gritton * and set it aside for prison_deref() to handle. 3309c861373bSJamie Gritton * Delay unlinking the sibling list to keep the loop 3310c861373bSJamie Gritton * safe. 3311c861373bSJamie Gritton */ 3312c861373bSJamie Gritton if (rpr != NULL) 3313c861373bSJamie Gritton LIST_REMOVE(rpr, pr_sibling); 3314c861373bSJamie Gritton rpr = cpr; 3315c861373bSJamie Gritton rpr->pr_state = PRISON_STATE_INVALID; 3316c861373bSJamie Gritton TAILQ_REMOVE(&allprison, rpr, pr_list); 3317c861373bSJamie Gritton TAILQ_INSERT_TAIL(freeprison, rpr, pr_list); 3318c861373bSJamie Gritton /* 3319c861373bSJamie Gritton * Removing a prison frees references from its parent. 3320c861373bSJamie Gritton */ 3321c861373bSJamie Gritton ppr = rpr->pr_parent; 3322c861373bSJamie Gritton prison_proc_free_not_last(ppr); 3323c861373bSJamie Gritton prison_free_not_last(ppr); 3324c861373bSJamie Gritton for (; ppr != NULL; ppr = ppr->pr_parent) 3325c861373bSJamie Gritton ppr->pr_childcount--; 3326c861373bSJamie Gritton } 3327c861373bSJamie Gritton mtx_unlock(&cpr->pr_mtx); 3328c861373bSJamie Gritton } 3329c861373bSJamie Gritton if (rpr != NULL) 3330c861373bSJamie Gritton LIST_REMOVE(rpr, pr_sibling); 3331c861373bSJamie Gritton 3332a9f7455cSJamie Gritton prison_cleanup(pr); 3333c861373bSJamie Gritton mtx_lock(&pr->pr_mtx); 3334c861373bSJamie Gritton if (pr->pr_flags & PR_PERSIST) { 3335c861373bSJamie Gritton pr->pr_flags &= ~PR_PERSIST; 3336c861373bSJamie Gritton prison_proc_free_not_last(pr); 3337c861373bSJamie Gritton prison_free_not_last(pr); 3338c861373bSJamie Gritton } 3339c861373bSJamie Gritton (void)refcount_release(&pr->pr_uref); 3340c861373bSJamie Gritton } 3341c861373bSJamie Gritton 3342c861373bSJamie Gritton /* 3343f7496dcaSJamie Gritton * Given the current locking state in the flags, make sure allprison_lock 3344f7496dcaSJamie Gritton * is held exclusive, and the prison is locked. Return flags indicating 3345f7496dcaSJamie Gritton * the new state. 3346f7496dcaSJamie Gritton */ 3347f7496dcaSJamie Gritton static int 3348f7496dcaSJamie Gritton prison_lock_xlock(struct prison *pr, int flags) 3349f7496dcaSJamie Gritton { 3350f7496dcaSJamie Gritton 3351f7496dcaSJamie Gritton if (!(flags & PD_LIST_XLOCKED)) { 3352f7496dcaSJamie Gritton /* 3353f7496dcaSJamie Gritton * Get allprison_lock, which may be an upgrade, 3354f7496dcaSJamie Gritton * and may require unlocking the prison. 3355f7496dcaSJamie Gritton */ 3356f7496dcaSJamie Gritton if (flags & PD_LOCKED) { 3357f7496dcaSJamie Gritton mtx_unlock(&pr->pr_mtx); 3358f7496dcaSJamie Gritton flags &= ~PD_LOCKED; 3359f7496dcaSJamie Gritton } 3360f7496dcaSJamie Gritton if (flags & PD_LIST_SLOCKED) { 3361f7496dcaSJamie Gritton if (!sx_try_upgrade(&allprison_lock)) { 3362f7496dcaSJamie Gritton sx_sunlock(&allprison_lock); 3363f7496dcaSJamie Gritton sx_xlock(&allprison_lock); 3364f7496dcaSJamie Gritton } 3365f7496dcaSJamie Gritton flags &= ~PD_LIST_SLOCKED; 3366f7496dcaSJamie Gritton } else 3367f7496dcaSJamie Gritton sx_xlock(&allprison_lock); 3368f7496dcaSJamie Gritton flags |= PD_LIST_XLOCKED; 3369f7496dcaSJamie Gritton } 3370f7496dcaSJamie Gritton if (!(flags & PD_LOCKED)) { 3371f7496dcaSJamie Gritton /* Lock the prison mutex. */ 3372f7496dcaSJamie Gritton mtx_lock(&pr->pr_mtx); 3373f7496dcaSJamie Gritton flags |= PD_LOCKED; 3374f7496dcaSJamie Gritton } 3375f7496dcaSJamie Gritton return flags; 3376f7496dcaSJamie Gritton } 3377f7496dcaSJamie Gritton 3378f7496dcaSJamie Gritton /* 3379a9f7455cSJamie Gritton * Release a prison's resources when it starts dying (when the last user 3380a9f7455cSJamie Gritton * reference is dropped, or when it is killed). 3381a9f7455cSJamie Gritton */ 3382a9f7455cSJamie Gritton static void 3383a9f7455cSJamie Gritton prison_cleanup(struct prison *pr) 3384a9f7455cSJamie Gritton { 3385a9f7455cSJamie Gritton sx_assert(&allprison_lock, SA_XLOCKED); 3386a9f7455cSJamie Gritton mtx_assert(&pr->pr_mtx, MA_NOTOWNED); 338788175af8SRick Macklem vfs_exjail_delete(pr); 33887060da62SJamie Gritton shm_remove_prison(pr); 3389a9f7455cSJamie Gritton (void)osd_jail_call(pr, PR_METHOD_REMOVE, NULL); 3390a9f7455cSJamie Gritton } 3391a9f7455cSJamie Gritton 3392a9f7455cSJamie Gritton /* 33930fe74ae6SJamie Gritton * Set or clear a permission bit in the pr_allow field, passing restrictions 33940fe74ae6SJamie Gritton * (cleared permission) down to child jails. 33950fe74ae6SJamie Gritton */ 33960fe74ae6SJamie Gritton void 33970fe74ae6SJamie Gritton prison_set_allow(struct ucred *cred, unsigned flag, int enable) 33980fe74ae6SJamie Gritton { 33990fe74ae6SJamie Gritton struct prison *pr; 34000fe74ae6SJamie Gritton 34010fe74ae6SJamie Gritton pr = cred->cr_prison; 34020fe74ae6SJamie Gritton sx_slock(&allprison_lock); 34030fe74ae6SJamie Gritton mtx_lock(&pr->pr_mtx); 34040fe74ae6SJamie Gritton prison_set_allow_locked(pr, flag, enable); 34050fe74ae6SJamie Gritton mtx_unlock(&pr->pr_mtx); 34060fe74ae6SJamie Gritton sx_sunlock(&allprison_lock); 34070fe74ae6SJamie Gritton } 34080fe74ae6SJamie Gritton 34090fe74ae6SJamie Gritton static void 34100fe74ae6SJamie Gritton prison_set_allow_locked(struct prison *pr, unsigned flag, int enable) 34110fe74ae6SJamie Gritton { 34120fe74ae6SJamie Gritton struct prison *cpr; 34130fe74ae6SJamie Gritton int descend; 34140fe74ae6SJamie Gritton 34150fe74ae6SJamie Gritton if (enable != 0) 34160fe74ae6SJamie Gritton pr->pr_allow |= flag; 34170fe74ae6SJamie Gritton else { 34180fe74ae6SJamie Gritton pr->pr_allow &= ~flag; 34190fe74ae6SJamie Gritton FOREACH_PRISON_DESCENDANT_LOCKED(pr, cpr, descend) 34200fe74ae6SJamie Gritton cpr->pr_allow &= ~flag; 34210fe74ae6SJamie Gritton } 34220fe74ae6SJamie Gritton } 34230fe74ae6SJamie Gritton 34240fe74ae6SJamie Gritton /* 3425ca04ba64SJamie Gritton * Check if a jail supports the given address family. 3426ca04ba64SJamie Gritton * 3427ca04ba64SJamie Gritton * Returns 0 if not jailed or the address family is supported, EAFNOSUPPORT 3428ca04ba64SJamie Gritton * if not. 3429ca04ba64SJamie Gritton */ 3430ca04ba64SJamie Gritton int 3431ca04ba64SJamie Gritton prison_check_af(struct ucred *cred, int af) 3432ca04ba64SJamie Gritton { 34330304c731SJamie Gritton struct prison *pr; 3434ca04ba64SJamie Gritton int error; 3435ca04ba64SJamie Gritton 3436ca04ba64SJamie Gritton KASSERT(cred != NULL, ("%s: cred is NULL", __func__)); 3437ca04ba64SJamie Gritton 34380304c731SJamie Gritton pr = cred->cr_prison; 3439499650a0SJamie Gritton #ifdef VIMAGE 34406bb79563SJamie Gritton /* Prisons with their own network stack are not limited. */ 3441de0bd6f7SBjoern A. Zeeb if (prison_owns_vnet(cred)) 34426bb79563SJamie Gritton return (0); 3443499650a0SJamie Gritton #endif 34446bb79563SJamie Gritton 3445ca04ba64SJamie Gritton error = 0; 3446ca04ba64SJamie Gritton switch (af) 3447ca04ba64SJamie Gritton { 3448ca04ba64SJamie Gritton #ifdef INET 3449ca04ba64SJamie Gritton case AF_INET: 34500304c731SJamie Gritton if (pr->pr_flags & PR_IP4) 34510304c731SJamie Gritton { 34520304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 3453eb8dcdeaSGleb Smirnoff if ((pr->pr_flags & PR_IP4) && 3454eb8dcdeaSGleb Smirnoff pr->pr_addrs[PR_INET] == NULL) 3455ca04ba64SJamie Gritton error = EAFNOSUPPORT; 34560304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 34570304c731SJamie Gritton } 3458ca04ba64SJamie Gritton break; 3459ca04ba64SJamie Gritton #endif 3460ca04ba64SJamie Gritton #ifdef INET6 3461ca04ba64SJamie Gritton case AF_INET6: 34620304c731SJamie Gritton if (pr->pr_flags & PR_IP6) 34630304c731SJamie Gritton { 34640304c731SJamie Gritton mtx_lock(&pr->pr_mtx); 3465eb8dcdeaSGleb Smirnoff if ((pr->pr_flags & PR_IP6) && 3466eb8dcdeaSGleb Smirnoff pr->pr_addrs[PR_INET6] == NULL) 3467ca04ba64SJamie Gritton error = EAFNOSUPPORT; 34680304c731SJamie Gritton mtx_unlock(&pr->pr_mtx); 34690304c731SJamie Gritton } 3470ca04ba64SJamie Gritton break; 3471ca04ba64SJamie Gritton #endif 3472ca04ba64SJamie Gritton case AF_LOCAL: 3473ca04ba64SJamie Gritton case AF_ROUTE: 347404f75b98SAlexander V. Chernikov case AF_NETLINK: 3475ca04ba64SJamie Gritton break; 3476ca04ba64SJamie Gritton default: 34770304c731SJamie Gritton if (!(pr->pr_allow & PR_ALLOW_SOCKET_AF)) 3478ca04ba64SJamie Gritton error = EAFNOSUPPORT; 3479ca04ba64SJamie Gritton } 3480ca04ba64SJamie Gritton return (error); 3481ca04ba64SJamie Gritton } 3482ca04ba64SJamie Gritton 3483ca04ba64SJamie Gritton /* 3484413628a7SBjoern A. Zeeb * Check if given address belongs to the jail referenced by cred (wrapper to 3485413628a7SBjoern A. Zeeb * prison_check_ip[46]). 3486413628a7SBjoern A. Zeeb * 34870304c731SJamie Gritton * Returns 0 if jail doesn't restrict the address family or if address belongs 34880304c731SJamie Gritton * to jail, EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if 34890304c731SJamie Gritton * the jail doesn't allow the address family. IPv4 Address passed in in NBO. 3490413628a7SBjoern A. Zeeb */ 3491413628a7SBjoern A. Zeeb int 3492c83dda36SAlexander V. Chernikov prison_if(struct ucred *cred, const struct sockaddr *sa) 349375c13541SPoul-Henning Kamp { 3494413628a7SBjoern A. Zeeb #ifdef INET 3495c83dda36SAlexander V. Chernikov const struct sockaddr_in *sai; 3496413628a7SBjoern A. Zeeb #endif 3497413628a7SBjoern A. Zeeb #ifdef INET6 3498c83dda36SAlexander V. Chernikov const struct sockaddr_in6 *sai6; 3499413628a7SBjoern A. Zeeb #endif 3500b89e82ddSJamie Gritton int error; 350175c13541SPoul-Henning Kamp 3502413628a7SBjoern A. Zeeb KASSERT(cred != NULL, ("%s: cred is NULL", __func__)); 3503413628a7SBjoern A. Zeeb KASSERT(sa != NULL, ("%s: sa is NULL", __func__)); 3504413628a7SBjoern A. Zeeb 3505de0bd6f7SBjoern A. Zeeb #ifdef VIMAGE 3506de0bd6f7SBjoern A. Zeeb if (prison_owns_vnet(cred)) 3507de0bd6f7SBjoern A. Zeeb return (0); 3508de0bd6f7SBjoern A. Zeeb #endif 3509de0bd6f7SBjoern A. Zeeb 3510b89e82ddSJamie Gritton error = 0; 3511413628a7SBjoern A. Zeeb switch (sa->sa_family) 3512413628a7SBjoern A. Zeeb { 3513413628a7SBjoern A. Zeeb #ifdef INET 3514413628a7SBjoern A. Zeeb case AF_INET: 3515c83dda36SAlexander V. Chernikov sai = (const struct sockaddr_in *)sa; 3516b89e82ddSJamie Gritton error = prison_check_ip4(cred, &sai->sin_addr); 3517413628a7SBjoern A. Zeeb break; 3518413628a7SBjoern A. Zeeb #endif 3519413628a7SBjoern A. Zeeb #ifdef INET6 3520413628a7SBjoern A. Zeeb case AF_INET6: 3521c83dda36SAlexander V. Chernikov sai6 = (const struct sockaddr_in6 *)sa; 3522b89e82ddSJamie Gritton error = prison_check_ip6(cred, &sai6->sin6_addr); 3523413628a7SBjoern A. Zeeb break; 3524413628a7SBjoern A. Zeeb #endif 3525413628a7SBjoern A. Zeeb default: 35260304c731SJamie Gritton if (!(cred->cr_prison->pr_allow & PR_ALLOW_SOCKET_AF)) 3527b89e82ddSJamie Gritton error = EAFNOSUPPORT; 3528413628a7SBjoern A. Zeeb } 3529b89e82ddSJamie Gritton return (error); 353075c13541SPoul-Henning Kamp } 353191421ba2SRobert Watson 353291421ba2SRobert Watson /* 353391421ba2SRobert Watson * Return 0 if jails permit p1 to frob p2, otherwise ESRCH. 353491421ba2SRobert Watson */ 353591421ba2SRobert Watson int 35369ddb7954SMike Barcroft prison_check(struct ucred *cred1, struct ucred *cred2) 353791421ba2SRobert Watson { 353891421ba2SRobert Watson 35390304c731SJamie Gritton return ((cred1->cr_prison == cred2->cr_prison || 35400304c731SJamie Gritton prison_ischild(cred1->cr_prison, cred2->cr_prison)) ? 0 : ESRCH); 35410304c731SJamie Gritton } 354291421ba2SRobert Watson 35430304c731SJamie Gritton /* 3544bba7a2e8SRick Macklem * For mountd/nfsd to run within a prison, it must be: 3545bba7a2e8SRick Macklem * - A vnet prison. 3546bba7a2e8SRick Macklem * - PR_ALLOW_NFSD must be set on it. 3547bba7a2e8SRick Macklem * - The root directory (pr_root) of the prison must be 3548bba7a2e8SRick Macklem * a file system mount point, so the mountd can hang 3549bba7a2e8SRick Macklem * export information on it. 355099187c3aSRick Macklem * - The prison's enforce_statfs cannot be 0, so that 355199187c3aSRick Macklem * mountd(8) can do exports. 3552bba7a2e8SRick Macklem */ 3553bba7a2e8SRick Macklem bool 3554bba7a2e8SRick Macklem prison_check_nfsd(struct ucred *cred) 3555bba7a2e8SRick Macklem { 3556bba7a2e8SRick Macklem 3557bba7a2e8SRick Macklem if (jailed_without_vnet(cred)) 3558bba7a2e8SRick Macklem return (false); 3559bba7a2e8SRick Macklem if (!prison_allow(cred, PR_ALLOW_NFSD)) 3560bba7a2e8SRick Macklem return (false); 3561bba7a2e8SRick Macklem if ((cred->cr_prison->pr_root->v_vflag & VV_ROOT) == 0) 3562bba7a2e8SRick Macklem return (false); 356399187c3aSRick Macklem if (cred->cr_prison->pr_enforce_statfs == 0) 356499187c3aSRick Macklem return (false); 3565bba7a2e8SRick Macklem return (true); 3566bba7a2e8SRick Macklem } 3567bba7a2e8SRick Macklem 3568bba7a2e8SRick Macklem /* 35690b0ae2e4SMina Galić * Return true if p2 is a child of p1, otherwise false. 35700304c731SJamie Gritton */ 35710b0ae2e4SMina Galić bool 35720304c731SJamie Gritton prison_ischild(struct prison *pr1, struct prison *pr2) 35730304c731SJamie Gritton { 35740304c731SJamie Gritton 35750304c731SJamie Gritton for (pr2 = pr2->pr_parent; pr2 != NULL; pr2 = pr2->pr_parent) 35760304c731SJamie Gritton if (pr1 == pr2) 35770b0ae2e4SMina Galić return (true); 35780b0ae2e4SMina Galić return (false); 357991421ba2SRobert Watson } 358091421ba2SRobert Watson 358191421ba2SRobert Watson /* 3582f7496dcaSJamie Gritton * Return true if the prison is currently alive. A prison is alive if it 3583f7496dcaSJamie Gritton * holds user references and it isn't being removed. 358476ad42abSJamie Gritton */ 358576ad42abSJamie Gritton bool 3586eb8dcdeaSGleb Smirnoff prison_isalive(const struct prison *pr) 358776ad42abSJamie Gritton { 358876ad42abSJamie Gritton 35891158508aSJamie Gritton if (__predict_false(pr->pr_state != PRISON_STATE_ALIVE)) 3590cc7b7306SJamie Gritton return (false); 359176ad42abSJamie Gritton return (true); 359276ad42abSJamie Gritton } 359376ad42abSJamie Gritton 359476ad42abSJamie Gritton /* 359576ad42abSJamie Gritton * Return true if the prison is currently valid. A prison is valid if it has 359676ad42abSJamie Gritton * been fully created, and is not being destroyed. Note that dying prisons 3597f7496dcaSJamie Gritton * are still considered valid. Invalid prisons won't be found under normal 3598f7496dcaSJamie Gritton * circumstances, as they're only put in that state by functions that have 3599f7496dcaSJamie Gritton * an exclusive hold on allprison_lock. 360076ad42abSJamie Gritton */ 360176ad42abSJamie Gritton bool 360276ad42abSJamie Gritton prison_isvalid(struct prison *pr) 360376ad42abSJamie Gritton { 360476ad42abSJamie Gritton 36051158508aSJamie Gritton if (__predict_false(pr->pr_state == PRISON_STATE_INVALID)) 36061158508aSJamie Gritton return (false); 36076754ae25SJamie Gritton if (__predict_false(refcount_load(&pr->pr_ref) == 0)) 360876ad42abSJamie Gritton return (false); 360976ad42abSJamie Gritton return (true); 361076ad42abSJamie Gritton } 361176ad42abSJamie Gritton 361276ad42abSJamie Gritton /* 36130b0ae2e4SMina Galić * Return true if the passed credential is in a jail and that jail does not 36140b0ae2e4SMina Galić * have its own virtual network stack, otherwise false. 3615de0bd6f7SBjoern A. Zeeb */ 36160b0ae2e4SMina Galić bool 3617de0bd6f7SBjoern A. Zeeb jailed_without_vnet(struct ucred *cred) 3618de0bd6f7SBjoern A. Zeeb { 3619de0bd6f7SBjoern A. Zeeb 3620de0bd6f7SBjoern A. Zeeb if (!jailed(cred)) 36210b0ae2e4SMina Galić return (false); 3622de0bd6f7SBjoern A. Zeeb #ifdef VIMAGE 3623de0bd6f7SBjoern A. Zeeb if (prison_owns_vnet(cred)) 36240b0ae2e4SMina Galić return (false); 3625de0bd6f7SBjoern A. Zeeb #endif 3626de0bd6f7SBjoern A. Zeeb 36270b0ae2e4SMina Galić return (true); 3628de0bd6f7SBjoern A. Zeeb } 3629de0bd6f7SBjoern A. Zeeb 3630de0bd6f7SBjoern A. Zeeb /* 36317455b100SJamie Gritton * Return the correct hostname (domainname, et al) for the passed credential. 36329484d0c0SRobert Drehmel */ 3633ad1ff099SRobert Drehmel void 36349ddb7954SMike Barcroft getcredhostname(struct ucred *cred, char *buf, size_t size) 36359484d0c0SRobert Drehmel { 363676ca6f88SJamie Gritton struct prison *pr; 36379484d0c0SRobert Drehmel 36387455b100SJamie Gritton /* 36397455b100SJamie Gritton * A NULL credential can be used to shortcut to the physical 36407455b100SJamie Gritton * system's hostname. 36417455b100SJamie Gritton */ 364276ca6f88SJamie Gritton pr = (cred != NULL) ? cred->cr_prison : &prison0; 364376ca6f88SJamie Gritton mtx_lock(&pr->pr_mtx); 3644c1f19219SJamie Gritton strlcpy(buf, pr->pr_hostname, size); 364576ca6f88SJamie Gritton mtx_unlock(&pr->pr_mtx); 36469484d0c0SRobert Drehmel } 3647fd7a8150SMike Barcroft 36487455b100SJamie Gritton void 36497455b100SJamie Gritton getcreddomainname(struct ucred *cred, char *buf, size_t size) 36507455b100SJamie Gritton { 36517455b100SJamie Gritton 36527455b100SJamie Gritton mtx_lock(&cred->cr_prison->pr_mtx); 3653c1f19219SJamie Gritton strlcpy(buf, cred->cr_prison->pr_domainname, size); 36547455b100SJamie Gritton mtx_unlock(&cred->cr_prison->pr_mtx); 36557455b100SJamie Gritton } 36567455b100SJamie Gritton 36577455b100SJamie Gritton void 36587455b100SJamie Gritton getcredhostuuid(struct ucred *cred, char *buf, size_t size) 36597455b100SJamie Gritton { 36607455b100SJamie Gritton 36617455b100SJamie Gritton mtx_lock(&cred->cr_prison->pr_mtx); 3662c1f19219SJamie Gritton strlcpy(buf, cred->cr_prison->pr_hostuuid, size); 36637455b100SJamie Gritton mtx_unlock(&cred->cr_prison->pr_mtx); 36647455b100SJamie Gritton } 36657455b100SJamie Gritton 36667455b100SJamie Gritton void 36677455b100SJamie Gritton getcredhostid(struct ucred *cred, unsigned long *hostid) 36687455b100SJamie Gritton { 36697455b100SJamie Gritton 36707455b100SJamie Gritton mtx_lock(&cred->cr_prison->pr_mtx); 36717455b100SJamie Gritton *hostid = cred->cr_prison->pr_hostid; 36727455b100SJamie Gritton mtx_unlock(&cred->cr_prison->pr_mtx); 36737455b100SJamie Gritton } 36747455b100SJamie Gritton 36753f8bc99cSKristof Provost void 36763f8bc99cSKristof Provost getjailname(struct ucred *cred, char *name, size_t len) 36773f8bc99cSKristof Provost { 36783f8bc99cSKristof Provost 36793f8bc99cSKristof Provost mtx_lock(&cred->cr_prison->pr_mtx); 36803f8bc99cSKristof Provost strlcpy(name, cred->cr_prison->pr_name, len); 36813f8bc99cSKristof Provost mtx_unlock(&cred->cr_prison->pr_mtx); 36823f8bc99cSKristof Provost } 36833f8bc99cSKristof Provost 3684eb79e1c7SBjoern A. Zeeb #ifdef VIMAGE 3685eb79e1c7SBjoern A. Zeeb /* 3686eb79e1c7SBjoern A. Zeeb * Determine whether the prison represented by cred owns 3687eb79e1c7SBjoern A. Zeeb * its vnet rather than having it inherited. 3688eb79e1c7SBjoern A. Zeeb * 36890b0ae2e4SMina Galić * Returns true in case the prison owns the vnet, false otherwise. 3690eb79e1c7SBjoern A. Zeeb */ 36910b0ae2e4SMina Galić bool 3692eb79e1c7SBjoern A. Zeeb prison_owns_vnet(struct ucred *cred) 3693eb79e1c7SBjoern A. Zeeb { 3694eb79e1c7SBjoern A. Zeeb 3695eb79e1c7SBjoern A. Zeeb /* 3696eb79e1c7SBjoern A. Zeeb * vnets cannot be added/removed after jail creation, 3697eb79e1c7SBjoern A. Zeeb * so no need to lock here. 3698eb79e1c7SBjoern A. Zeeb */ 36990b0ae2e4SMina Galić return ((cred->cr_prison->pr_flags & PR_VNET) != 0); 3700eb79e1c7SBjoern A. Zeeb } 3701eb79e1c7SBjoern A. Zeeb #endif 3702eb79e1c7SBjoern A. Zeeb 3703f08df373SRobert Watson /* 3704820a0de9SPawel Jakub Dawidek * Determine whether the subject represented by cred can "see" 3705820a0de9SPawel Jakub Dawidek * status of a mount point. 3706820a0de9SPawel Jakub Dawidek * Returns: 0 for permitted, ENOENT otherwise. 3707820a0de9SPawel Jakub Dawidek * XXX: This function should be called cr_canseemount() and should be 3708820a0de9SPawel Jakub Dawidek * placed in kern_prot.c. 3709f08df373SRobert Watson */ 3710f08df373SRobert Watson int 3711820a0de9SPawel Jakub Dawidek prison_canseemount(struct ucred *cred, struct mount *mp) 3712f08df373SRobert Watson { 3713820a0de9SPawel Jakub Dawidek struct prison *pr; 3714820a0de9SPawel Jakub Dawidek struct statfs *sp; 3715820a0de9SPawel Jakub Dawidek size_t len; 3716f08df373SRobert Watson 3717820a0de9SPawel Jakub Dawidek pr = cred->cr_prison; 37180304c731SJamie Gritton if (pr->pr_enforce_statfs == 0) 37190304c731SJamie Gritton return (0); 3720820a0de9SPawel Jakub Dawidek if (pr->pr_root->v_mount == mp) 3721820a0de9SPawel Jakub Dawidek return (0); 37220304c731SJamie Gritton if (pr->pr_enforce_statfs == 2) 3723820a0de9SPawel Jakub Dawidek return (ENOENT); 3724820a0de9SPawel Jakub Dawidek /* 3725820a0de9SPawel Jakub Dawidek * If jail's chroot directory is set to "/" we should be able to see 3726820a0de9SPawel Jakub Dawidek * all mount-points from inside a jail. 3727820a0de9SPawel Jakub Dawidek * This is ugly check, but this is the only situation when jail's 3728820a0de9SPawel Jakub Dawidek * directory ends with '/'. 3729820a0de9SPawel Jakub Dawidek */ 3730820a0de9SPawel Jakub Dawidek if (strcmp(pr->pr_path, "/") == 0) 3731820a0de9SPawel Jakub Dawidek return (0); 3732820a0de9SPawel Jakub Dawidek len = strlen(pr->pr_path); 3733820a0de9SPawel Jakub Dawidek sp = &mp->mnt_stat; 3734820a0de9SPawel Jakub Dawidek if (strncmp(pr->pr_path, sp->f_mntonname, len) != 0) 3735820a0de9SPawel Jakub Dawidek return (ENOENT); 3736820a0de9SPawel Jakub Dawidek /* 3737820a0de9SPawel Jakub Dawidek * Be sure that we don't have situation where jail's root directory 3738820a0de9SPawel Jakub Dawidek * is "/some/path" and mount point is "/some/pathpath". 3739820a0de9SPawel Jakub Dawidek */ 3740820a0de9SPawel Jakub Dawidek if (sp->f_mntonname[len] != '\0' && sp->f_mntonname[len] != '/') 3741820a0de9SPawel Jakub Dawidek return (ENOENT); 3742f08df373SRobert Watson return (0); 3743f08df373SRobert Watson } 3744820a0de9SPawel Jakub Dawidek 3745820a0de9SPawel Jakub Dawidek void 3746820a0de9SPawel Jakub Dawidek prison_enforce_statfs(struct ucred *cred, struct mount *mp, struct statfs *sp) 3747820a0de9SPawel Jakub Dawidek { 3748820a0de9SPawel Jakub Dawidek char jpath[MAXPATHLEN]; 3749820a0de9SPawel Jakub Dawidek struct prison *pr; 3750820a0de9SPawel Jakub Dawidek size_t len; 3751820a0de9SPawel Jakub Dawidek 3752820a0de9SPawel Jakub Dawidek pr = cred->cr_prison; 37530304c731SJamie Gritton if (pr->pr_enforce_statfs == 0) 37540304c731SJamie Gritton return; 3755820a0de9SPawel Jakub Dawidek if (prison_canseemount(cred, mp) != 0) { 3756820a0de9SPawel Jakub Dawidek bzero(sp->f_mntonname, sizeof(sp->f_mntonname)); 3757820a0de9SPawel Jakub Dawidek strlcpy(sp->f_mntonname, "[restricted]", 3758820a0de9SPawel Jakub Dawidek sizeof(sp->f_mntonname)); 3759820a0de9SPawel Jakub Dawidek return; 3760820a0de9SPawel Jakub Dawidek } 3761820a0de9SPawel Jakub Dawidek if (pr->pr_root->v_mount == mp) { 3762820a0de9SPawel Jakub Dawidek /* 3763820a0de9SPawel Jakub Dawidek * Clear current buffer data, so we are sure nothing from 3764820a0de9SPawel Jakub Dawidek * the valid path left there. 3765820a0de9SPawel Jakub Dawidek */ 3766820a0de9SPawel Jakub Dawidek bzero(sp->f_mntonname, sizeof(sp->f_mntonname)); 3767820a0de9SPawel Jakub Dawidek *sp->f_mntonname = '/'; 3768820a0de9SPawel Jakub Dawidek return; 3769820a0de9SPawel Jakub Dawidek } 3770820a0de9SPawel Jakub Dawidek /* 3771820a0de9SPawel Jakub Dawidek * If jail's chroot directory is set to "/" we should be able to see 3772820a0de9SPawel Jakub Dawidek * all mount-points from inside a jail. 3773820a0de9SPawel Jakub Dawidek */ 3774820a0de9SPawel Jakub Dawidek if (strcmp(pr->pr_path, "/") == 0) 3775820a0de9SPawel Jakub Dawidek return; 3776820a0de9SPawel Jakub Dawidek len = strlen(pr->pr_path); 3777820a0de9SPawel Jakub Dawidek strlcpy(jpath, sp->f_mntonname + len, sizeof(jpath)); 3778820a0de9SPawel Jakub Dawidek /* 3779820a0de9SPawel Jakub Dawidek * Clear current buffer data, so we are sure nothing from 3780820a0de9SPawel Jakub Dawidek * the valid path left there. 3781820a0de9SPawel Jakub Dawidek */ 3782820a0de9SPawel Jakub Dawidek bzero(sp->f_mntonname, sizeof(sp->f_mntonname)); 3783820a0de9SPawel Jakub Dawidek if (*jpath == '\0') { 3784820a0de9SPawel Jakub Dawidek /* Should never happen. */ 3785820a0de9SPawel Jakub Dawidek *sp->f_mntonname = '/'; 3786820a0de9SPawel Jakub Dawidek } else { 3787820a0de9SPawel Jakub Dawidek strlcpy(sp->f_mntonname, jpath, sizeof(sp->f_mntonname)); 3788820a0de9SPawel Jakub Dawidek } 3789f08df373SRobert Watson } 3790f08df373SRobert Watson 3791800c9408SRobert Watson /* 3792800c9408SRobert Watson * Check with permission for a specific privilege is granted within jail. We 3793800c9408SRobert Watson * have a specific list of accepted privileges; the rest are denied. 3794800c9408SRobert Watson */ 3795800c9408SRobert Watson int 3796800c9408SRobert Watson prison_priv_check(struct ucred *cred, int priv) 3797800c9408SRobert Watson { 37980fe74ae6SJamie Gritton struct prison *pr; 37990fe74ae6SJamie Gritton int error; 3800800c9408SRobert Watson 38017b2ff0dcSMateusz Guzik /* 38027b2ff0dcSMateusz Guzik * Some policies have custom handlers. This routine should not be 38037b2ff0dcSMateusz Guzik * called for them. See priv_check_cred(). 38047b2ff0dcSMateusz Guzik */ 38057b2ff0dcSMateusz Guzik switch (priv) { 3806a459a6cfSMateusz Guzik case PRIV_VFS_LOOKUP: 38077b2ff0dcSMateusz Guzik case PRIV_VFS_GENERATION: 38087b2ff0dcSMateusz Guzik KASSERT(0, ("prison_priv_check instead of a custom handler " 38097b2ff0dcSMateusz Guzik "called for %d\n", priv)); 38107b2ff0dcSMateusz Guzik } 38117b2ff0dcSMateusz Guzik 3812800c9408SRobert Watson if (!jailed(cred)) 3813800c9408SRobert Watson return (0); 3814800c9408SRobert Watson 38156bb79563SJamie Gritton #ifdef VIMAGE 38166bb79563SJamie Gritton /* 38176bb79563SJamie Gritton * Privileges specific to prisons with a virtual network stack. 38186bb79563SJamie Gritton * There might be a duplicate entry here in case the privilege 38196bb79563SJamie Gritton * is only granted conditionally in the legacy jail case. 38206bb79563SJamie Gritton */ 38216bb79563SJamie Gritton switch (priv) { 38226bb79563SJamie Gritton /* 38236bb79563SJamie Gritton * NFS-specific privileges. 38246bb79563SJamie Gritton */ 38256bb79563SJamie Gritton case PRIV_NFS_DAEMON: 3826bba7a2e8SRick Macklem case PRIV_VFS_GETFH: 3827bba7a2e8SRick Macklem case PRIV_VFS_MOUNT_EXPORTED: 3828bba7a2e8SRick Macklem if (!prison_check_nfsd(cred)) 3829bba7a2e8SRick Macklem return (EPERM); 3830bba7a2e8SRick Macklem #ifdef notyet 38316bb79563SJamie Gritton case PRIV_NFS_LOCKD: 38326bb79563SJamie Gritton #endif 38336bb79563SJamie Gritton /* 38346bb79563SJamie Gritton * Network stack privileges. 38356bb79563SJamie Gritton */ 38366bb79563SJamie Gritton case PRIV_NET_BRIDGE: 38376bb79563SJamie Gritton case PRIV_NET_GRE: 38386bb79563SJamie Gritton case PRIV_NET_BPF: 38396bb79563SJamie Gritton case PRIV_NET_RAW: /* Dup, cond. in legacy jail case. */ 38406bb79563SJamie Gritton case PRIV_NET_ROUTE: 38416bb79563SJamie Gritton case PRIV_NET_TAP: 38426bb79563SJamie Gritton case PRIV_NET_SETIFMTU: 38436bb79563SJamie Gritton case PRIV_NET_SETIFFLAGS: 38446bb79563SJamie Gritton case PRIV_NET_SETIFCAP: 3845215940b3SXin LI case PRIV_NET_SETIFDESCR: 38466bb79563SJamie Gritton case PRIV_NET_SETIFNAME : 38476bb79563SJamie Gritton case PRIV_NET_SETIFMETRIC: 38486bb79563SJamie Gritton case PRIV_NET_SETIFPHYS: 38496bb79563SJamie Gritton case PRIV_NET_SETIFMAC: 3850389474c1SKonstantin Belousov case PRIV_NET_SETLANPCP: 38516bb79563SJamie Gritton case PRIV_NET_ADDMULTI: 38526bb79563SJamie Gritton case PRIV_NET_DELMULTI: 38536bb79563SJamie Gritton case PRIV_NET_HWIOCTL: 38546bb79563SJamie Gritton case PRIV_NET_SETLLADDR: 38556bb79563SJamie Gritton case PRIV_NET_ADDIFGROUP: 38566bb79563SJamie Gritton case PRIV_NET_DELIFGROUP: 38576bb79563SJamie Gritton case PRIV_NET_IFCREATE: 38586bb79563SJamie Gritton case PRIV_NET_IFDESTROY: 38596bb79563SJamie Gritton case PRIV_NET_ADDIFADDR: 38606bb79563SJamie Gritton case PRIV_NET_DELIFADDR: 38616bb79563SJamie Gritton case PRIV_NET_LAGG: 38626bb79563SJamie Gritton case PRIV_NET_GIF: 38636bb79563SJamie Gritton case PRIV_NET_SETIFVNET: 386435fd7bc0SBjoern A. Zeeb case PRIV_NET_SETIFFIB: 3865ab91feabSKristof Provost case PRIV_NET_OVPN: 386643f8c763SZhenlei Huang case PRIV_NET_ME: 3867744bfb21SJohn Baldwin case PRIV_NET_WG: 38686bb79563SJamie Gritton 38696bb79563SJamie Gritton /* 38706bb79563SJamie Gritton * 802.11-related privileges. 38716bb79563SJamie Gritton */ 3872f7d38a13SAdrian Chadd case PRIV_NET80211_VAP_GETKEY: 3873f7d38a13SAdrian Chadd case PRIV_NET80211_VAP_MANAGE: 38746bb79563SJamie Gritton 38756bb79563SJamie Gritton #ifdef notyet 38766bb79563SJamie Gritton /* 38776bb79563SJamie Gritton * ATM privileges. 38786bb79563SJamie Gritton */ 38796bb79563SJamie Gritton case PRIV_NETATM_CFG: 38806bb79563SJamie Gritton case PRIV_NETATM_ADD: 38816bb79563SJamie Gritton case PRIV_NETATM_DEL: 38826bb79563SJamie Gritton case PRIV_NETATM_SET: 38836bb79563SJamie Gritton 38846bb79563SJamie Gritton /* 38856bb79563SJamie Gritton * Bluetooth privileges. 38866bb79563SJamie Gritton */ 38876bb79563SJamie Gritton case PRIV_NETBLUETOOTH_RAW: 38886bb79563SJamie Gritton #endif 38896bb79563SJamie Gritton 38906bb79563SJamie Gritton /* 38916bb79563SJamie Gritton * Netgraph and netgraph module privileges. 38926bb79563SJamie Gritton */ 38936bb79563SJamie Gritton case PRIV_NETGRAPH_CONTROL: 38946bb79563SJamie Gritton #ifdef notyet 38956bb79563SJamie Gritton case PRIV_NETGRAPH_TTY: 38966bb79563SJamie Gritton #endif 38976bb79563SJamie Gritton 38986bb79563SJamie Gritton /* 38996bb79563SJamie Gritton * IPv4 and IPv6 privileges. 39006bb79563SJamie Gritton */ 39016bb79563SJamie Gritton case PRIV_NETINET_IPFW: 39026bb79563SJamie Gritton case PRIV_NETINET_DIVERT: 39036bb79563SJamie Gritton case PRIV_NETINET_PF: 39046bb79563SJamie Gritton case PRIV_NETINET_DUMMYNET: 39056bb79563SJamie Gritton case PRIV_NETINET_CARP: 39066bb79563SJamie Gritton case PRIV_NETINET_MROUTE: 39076bb79563SJamie Gritton case PRIV_NETINET_RAW: 39086bb79563SJamie Gritton case PRIV_NETINET_ADDRCTRL6: 39096bb79563SJamie Gritton case PRIV_NETINET_ND6: 39106bb79563SJamie Gritton case PRIV_NETINET_SCOPE6: 39116bb79563SJamie Gritton case PRIV_NETINET_ALIFETIME6: 39126bb79563SJamie Gritton case PRIV_NETINET_IPSEC: 39136bb79563SJamie Gritton case PRIV_NETINET_BINDANY: 39146bb79563SJamie Gritton 39156bb79563SJamie Gritton #ifdef notyet 39166bb79563SJamie Gritton /* 39176bb79563SJamie Gritton * NCP privileges. 39186bb79563SJamie Gritton */ 39196bb79563SJamie Gritton case PRIV_NETNCP: 39206bb79563SJamie Gritton 39216bb79563SJamie Gritton /* 39226bb79563SJamie Gritton * SMB privileges. 39236bb79563SJamie Gritton */ 39246bb79563SJamie Gritton case PRIV_NETSMB: 39256bb79563SJamie Gritton #endif 39266bb79563SJamie Gritton 39276bb79563SJamie Gritton /* 39286bb79563SJamie Gritton * No default: or deny here. 39296bb79563SJamie Gritton * In case of no permit fall through to next switch(). 39306bb79563SJamie Gritton */ 39316bb79563SJamie Gritton if (cred->cr_prison->pr_flags & PR_VNET) 39326bb79563SJamie Gritton return (0); 39336bb79563SJamie Gritton } 39346bb79563SJamie Gritton #endif /* VIMAGE */ 39356bb79563SJamie Gritton 3936800c9408SRobert Watson switch (priv) { 3937800c9408SRobert Watson /* 3938800c9408SRobert Watson * Allow ktrace privileges for root in jail. 3939800c9408SRobert Watson */ 3940800c9408SRobert Watson case PRIV_KTRACE: 3941800c9408SRobert Watson 3942c3c1b5e6SRobert Watson #if 0 3943800c9408SRobert Watson /* 3944800c9408SRobert Watson * Allow jailed processes to configure audit identity and 3945800c9408SRobert Watson * submit audit records (login, etc). In the future we may 3946800c9408SRobert Watson * want to further refine the relationship between audit and 3947800c9408SRobert Watson * jail. 3948800c9408SRobert Watson */ 3949800c9408SRobert Watson case PRIV_AUDIT_GETAUDIT: 3950800c9408SRobert Watson case PRIV_AUDIT_SETAUDIT: 3951800c9408SRobert Watson case PRIV_AUDIT_SUBMIT: 3952c3c1b5e6SRobert Watson #endif 3953800c9408SRobert Watson 3954800c9408SRobert Watson /* 3955800c9408SRobert Watson * Allow jailed processes to manipulate process UNIX 3956800c9408SRobert Watson * credentials in any way they see fit. 3957800c9408SRobert Watson */ 3958*ddb3eb4eSOlivier Certner case PRIV_CRED_SETCRED: 3959800c9408SRobert Watson case PRIV_CRED_SETUID: 3960800c9408SRobert Watson case PRIV_CRED_SETEUID: 3961800c9408SRobert Watson case PRIV_CRED_SETGID: 3962800c9408SRobert Watson case PRIV_CRED_SETEGID: 3963800c9408SRobert Watson case PRIV_CRED_SETGROUPS: 3964800c9408SRobert Watson case PRIV_CRED_SETREUID: 3965800c9408SRobert Watson case PRIV_CRED_SETREGID: 3966800c9408SRobert Watson case PRIV_CRED_SETRESUID: 3967800c9408SRobert Watson case PRIV_CRED_SETRESGID: 3968800c9408SRobert Watson 3969800c9408SRobert Watson /* 3970800c9408SRobert Watson * Jail implements visibility constraints already, so allow 3971800c9408SRobert Watson * jailed root to override uid/gid-based constraints. 3972800c9408SRobert Watson */ 3973800c9408SRobert Watson case PRIV_SEEOTHERGIDS: 3974800c9408SRobert Watson case PRIV_SEEOTHERUIDS: 39757974ca1cSOlivier Certner case PRIV_SEEJAILPROC: 3976800c9408SRobert Watson 3977800c9408SRobert Watson /* 3978800c9408SRobert Watson * Jail implements inter-process debugging limits already, so 3979800c9408SRobert Watson * allow jailed root various debugging privileges. 3980800c9408SRobert Watson */ 3981800c9408SRobert Watson case PRIV_DEBUG_DIFFCRED: 3982800c9408SRobert Watson case PRIV_DEBUG_SUGID: 3983800c9408SRobert Watson case PRIV_DEBUG_UNPRIV: 3984800c9408SRobert Watson 3985800c9408SRobert Watson /* 3986800c9408SRobert Watson * Allow jail to set various resource limits and login 3987800c9408SRobert Watson * properties, and for now, exceed process resource limits. 3988800c9408SRobert Watson */ 3989800c9408SRobert Watson case PRIV_PROC_LIMIT: 3990800c9408SRobert Watson case PRIV_PROC_SETLOGIN: 3991800c9408SRobert Watson case PRIV_PROC_SETRLIMIT: 3992800c9408SRobert Watson 3993800c9408SRobert Watson /* 3994800c9408SRobert Watson * System V and POSIX IPC privileges are granted in jail. 3995800c9408SRobert Watson */ 3996800c9408SRobert Watson case PRIV_IPC_READ: 3997800c9408SRobert Watson case PRIV_IPC_WRITE: 3998800c9408SRobert Watson case PRIV_IPC_ADMIN: 3999800c9408SRobert Watson case PRIV_IPC_MSGSIZE: 4000800c9408SRobert Watson case PRIV_MQ_ADMIN: 4001800c9408SRobert Watson 4002800c9408SRobert Watson /* 40030304c731SJamie Gritton * Jail operations within a jail work on child jails. 40040304c731SJamie Gritton */ 40050304c731SJamie Gritton case PRIV_JAIL_ATTACH: 40060304c731SJamie Gritton case PRIV_JAIL_SET: 40070304c731SJamie Gritton case PRIV_JAIL_REMOVE: 40080304c731SJamie Gritton 40090304c731SJamie Gritton /* 4010800c9408SRobert Watson * Jail implements its own inter-process limits, so allow 4011800c9408SRobert Watson * root processes in jail to change scheduling on other 4012800c9408SRobert Watson * processes in the same jail. Likewise for signalling. 4013800c9408SRobert Watson */ 4014800c9408SRobert Watson case PRIV_SCHED_DIFFCRED: 4015413628a7SBjoern A. Zeeb case PRIV_SCHED_CPUSET: 4016800c9408SRobert Watson case PRIV_SIGNAL_DIFFCRED: 4017800c9408SRobert Watson case PRIV_SIGNAL_SUGID: 4018800c9408SRobert Watson 4019800c9408SRobert Watson /* 4020800c9408SRobert Watson * Allow jailed processes to write to sysctls marked as jail 4021800c9408SRobert Watson * writable. 4022800c9408SRobert Watson */ 4023800c9408SRobert Watson case PRIV_SYSCTL_WRITEJAIL: 4024800c9408SRobert Watson 4025800c9408SRobert Watson /* 4026800c9408SRobert Watson * Allow root in jail to manage a variety of quota 4027e82d0201SRobert Watson * properties. These should likely be conditional on a 4028e82d0201SRobert Watson * configuration option. 4029800c9408SRobert Watson */ 403095b091d2SRobert Watson case PRIV_VFS_GETQUOTA: 403195b091d2SRobert Watson case PRIV_VFS_SETQUOTA: 4032800c9408SRobert Watson 4033800c9408SRobert Watson /* 4034800c9408SRobert Watson * Since Jail relies on chroot() to implement file system 4035800c9408SRobert Watson * protections, grant many VFS privileges to root in jail. 4036800c9408SRobert Watson * Be careful to exclude mount-related and NFS-related 4037800c9408SRobert Watson * privileges. 4038800c9408SRobert Watson */ 4039800c9408SRobert Watson case PRIV_VFS_READ: 4040800c9408SRobert Watson case PRIV_VFS_WRITE: 4041800c9408SRobert Watson case PRIV_VFS_ADMIN: 4042800c9408SRobert Watson case PRIV_VFS_EXEC: 4043800c9408SRobert Watson case PRIV_VFS_BLOCKRESERVE: /* XXXRW: Slightly surprising. */ 4044800c9408SRobert Watson case PRIV_VFS_CHFLAGS_DEV: 4045800c9408SRobert Watson case PRIV_VFS_CHOWN: 4046800c9408SRobert Watson case PRIV_VFS_CHROOT: 4047bb531912SPawel Jakub Dawidek case PRIV_VFS_RETAINSUGID: 4048800c9408SRobert Watson case PRIV_VFS_FCHROOT: 4049800c9408SRobert Watson case PRIV_VFS_LINK: 4050800c9408SRobert Watson case PRIV_VFS_SETGID: 4051e41966dcSRobert Watson case PRIV_VFS_STAT: 4052800c9408SRobert Watson case PRIV_VFS_STICKYFILE: 4053bb56d716SJamie Gritton 4054bb56d716SJamie Gritton /* 4055bb56d716SJamie Gritton * As in the non-jail case, non-root users are expected to be 405670de1003SGordon Bergling * able to read kernel/physical memory (provided /dev/[k]mem 4057bb56d716SJamie Gritton * exists in the jail and they have permission to access it). 4058bb56d716SJamie Gritton */ 4059bb56d716SJamie Gritton case PRIV_KMEM_READ: 4060800c9408SRobert Watson return (0); 4061800c9408SRobert Watson 4062800c9408SRobert Watson /* 4063800c9408SRobert Watson * Depending on the global setting, allow privilege of 4064800c9408SRobert Watson * setting system flags. 4065800c9408SRobert Watson */ 4066800c9408SRobert Watson case PRIV_VFS_SYSFLAGS: 40670304c731SJamie Gritton if (cred->cr_prison->pr_allow & PR_ALLOW_CHFLAGS) 4068800c9408SRobert Watson return (0); 4069800c9408SRobert Watson else 4070800c9408SRobert Watson return (EPERM); 4071800c9408SRobert Watson 4072800c9408SRobert Watson /* 4073f3a8d2f9SPawel Jakub Dawidek * Depending on the global setting, allow privilege of 4074f3a8d2f9SPawel Jakub Dawidek * mounting/unmounting file systems. 4075f3a8d2f9SPawel Jakub Dawidek */ 4076f3a8d2f9SPawel Jakub Dawidek case PRIV_VFS_MOUNT: 4077f3a8d2f9SPawel Jakub Dawidek case PRIV_VFS_UNMOUNT: 4078f3a8d2f9SPawel Jakub Dawidek case PRIV_VFS_MOUNT_NONUSER: 407924b0502eSPawel Jakub Dawidek case PRIV_VFS_MOUNT_OWNER: 40800fe74ae6SJamie Gritton pr = cred->cr_prison; 40810fe74ae6SJamie Gritton prison_lock(pr); 40820fe74ae6SJamie Gritton if (pr->pr_allow & PR_ALLOW_MOUNT && pr->pr_enforce_statfs < 2) 40830fe74ae6SJamie Gritton error = 0; 4084f3a8d2f9SPawel Jakub Dawidek else 40850fe74ae6SJamie Gritton error = EPERM; 40860fe74ae6SJamie Gritton prison_unlock(pr); 40870fe74ae6SJamie Gritton return (error); 4088f3a8d2f9SPawel Jakub Dawidek 4089f3a8d2f9SPawel Jakub Dawidek /* 409063619b6dSKyle Evans * Jails should hold no disposition on the PRIV_VFS_READ_DIR 409163619b6dSKyle Evans * policy. priv_check_cred will not specifically allow it, and 409263619b6dSKyle Evans * we may want a MAC policy to allow it. 409363619b6dSKyle Evans */ 409463619b6dSKyle Evans case PRIV_VFS_READ_DIR: 409563619b6dSKyle Evans return (0); 409663619b6dSKyle Evans 409763619b6dSKyle Evans /* 4098cb48780dSShawn Webb * Conditionally allow privileged process in the jail to 4099cb48780dSShawn Webb * manipulate filesystem extended attributes in the system 4100cb48780dSShawn Webb * namespace. 4101cb48780dSShawn Webb */ 4102cb48780dSShawn Webb case PRIV_VFS_EXTATTR_SYSTEM: 4103cb48780dSShawn Webb if ((cred->cr_prison->pr_allow & PR_ALLOW_EXTATTR) != 0) 4104cb48780dSShawn Webb return (0); 4105cb48780dSShawn Webb else 4106cb48780dSShawn Webb return (EPERM); 4107cb48780dSShawn Webb 4108cb48780dSShawn Webb /* 4109ccd6ac9fSAntoine Brodin * Conditionnaly allow locking (unlocking) physical pages 4110ccd6ac9fSAntoine Brodin * in memory. 4111ccd6ac9fSAntoine Brodin */ 4112ccd6ac9fSAntoine Brodin case PRIV_VM_MLOCK: 4113ccd6ac9fSAntoine Brodin case PRIV_VM_MUNLOCK: 4114ccd6ac9fSAntoine Brodin if (cred->cr_prison->pr_allow & PR_ALLOW_MLOCK) 4115ccd6ac9fSAntoine Brodin return (0); 4116ccd6ac9fSAntoine Brodin else 4117ccd6ac9fSAntoine Brodin return (EPERM); 4118ccd6ac9fSAntoine Brodin 4119ccd6ac9fSAntoine Brodin /* 4120e28f9b7dSAllan Jude * Conditionally allow jailed root to bind reserved ports. 4121800c9408SRobert Watson */ 4122800c9408SRobert Watson case PRIV_NETINET_RESERVEDPORT: 4123e28f9b7dSAllan Jude if (cred->cr_prison->pr_allow & PR_ALLOW_RESERVED_PORTS) 4124e28f9b7dSAllan Jude return (0); 4125e28f9b7dSAllan Jude else 4126e28f9b7dSAllan Jude return (EPERM); 4127e28f9b7dSAllan Jude 4128e28f9b7dSAllan Jude /* 4129e28f9b7dSAllan Jude * Allow jailed root to reuse in-use ports. 4130e28f9b7dSAllan Jude */ 41314b084056SRobert Watson case PRIV_NETINET_REUSEPORT: 4132800c9408SRobert Watson return (0); 4133800c9408SRobert Watson 4134800c9408SRobert Watson /* 4135e3043798SPedro F. Giffuni * Allow jailed root to set certain IPv4/6 (option) headers. 413679ba3952SBjoern A. Zeeb */ 413779ba3952SBjoern A. Zeeb case PRIV_NETINET_SETHDROPTS: 413879ba3952SBjoern A. Zeeb return (0); 413979ba3952SBjoern A. Zeeb 414079ba3952SBjoern A. Zeeb /* 4141800c9408SRobert Watson * Conditionally allow creating raw sockets in jail. 4142800c9408SRobert Watson */ 4143800c9408SRobert Watson case PRIV_NETINET_RAW: 41440304c731SJamie Gritton if (cred->cr_prison->pr_allow & PR_ALLOW_RAW_SOCKETS) 4145800c9408SRobert Watson return (0); 4146800c9408SRobert Watson else 4147800c9408SRobert Watson return (EPERM); 4148800c9408SRobert Watson 4149800c9408SRobert Watson /* 4150800c9408SRobert Watson * Since jail implements its own visibility limits on netstat 4151800c9408SRobert Watson * sysctls, allow getcred. This allows identd to work in 4152800c9408SRobert Watson * jail. 4153800c9408SRobert Watson */ 4154800c9408SRobert Watson case PRIV_NETINET_GETCRED: 4155800c9408SRobert Watson return (0); 4156800c9408SRobert Watson 41572bfc50bcSEdward Tomasz Napierala /* 41582bfc50bcSEdward Tomasz Napierala * Allow jailed root to set loginclass. 41592bfc50bcSEdward Tomasz Napierala */ 41602bfc50bcSEdward Tomasz Napierala case PRIV_PROC_SETLOGINCLASS: 41612bfc50bcSEdward Tomasz Napierala return (0); 41622bfc50bcSEdward Tomasz Napierala 4163b19d66fdSJamie Gritton /* 41644520f617SJamie Gritton * Do not allow a process inside a jail to read the kernel 4165b19d66fdSJamie Gritton * message buffer unless explicitly permitted. 4166b19d66fdSJamie Gritton */ 4167b19d66fdSJamie Gritton case PRIV_MSGBUF: 4168b19d66fdSJamie Gritton if (cred->cr_prison->pr_allow & PR_ALLOW_READ_MSGBUF) 4169b19d66fdSJamie Gritton return (0); 4170b19d66fdSJamie Gritton return (EPERM); 4171b19d66fdSJamie Gritton 4172d3bb35d4SMariusz Zaborski /* 4173d3bb35d4SMariusz Zaborski * Conditionally allow privileged process in the jail adjust 4174d3bb35d4SMariusz Zaborski * machine time. 4175d3bb35d4SMariusz Zaborski */ 4176d3bb35d4SMariusz Zaborski case PRIV_ADJTIME: 4177d3bb35d4SMariusz Zaborski case PRIV_NTP_ADJTIME: 4178d3bb35d4SMariusz Zaborski if (cred->cr_prison->pr_allow & 4179d3bb35d4SMariusz Zaborski (PR_ALLOW_ADJTIME | PR_ALLOW_SETTIME)) { 4180d3bb35d4SMariusz Zaborski return (0); 4181d3bb35d4SMariusz Zaborski } 4182d3bb35d4SMariusz Zaborski return (EPERM); 4183d3bb35d4SMariusz Zaborski 4184d3bb35d4SMariusz Zaborski /* 4185d3bb35d4SMariusz Zaborski * Conditionally allow privileged process in the jail set 4186d3bb35d4SMariusz Zaborski * machine time. 4187d3bb35d4SMariusz Zaborski */ 4188d3bb35d4SMariusz Zaborski case PRIV_CLOCK_SETTIME: 4189d3bb35d4SMariusz Zaborski if (cred->cr_prison->pr_allow & PR_ALLOW_SETTIME) 4190d3bb35d4SMariusz Zaborski return (0); 4191d3bb35d4SMariusz Zaborski else 4192d3bb35d4SMariusz Zaborski return (EPERM); 4193d3bb35d4SMariusz Zaborski 4194800c9408SRobert Watson default: 4195800c9408SRobert Watson /* 4196800c9408SRobert Watson * In all remaining cases, deny the privilege request. This 4197800c9408SRobert Watson * includes almost all network privileges, many system 4198800c9408SRobert Watson * configuration privileges. 4199800c9408SRobert Watson */ 4200800c9408SRobert Watson return (EPERM); 4201800c9408SRobert Watson } 4202800c9408SRobert Watson } 4203800c9408SRobert Watson 42040304c731SJamie Gritton /* 42050304c731SJamie Gritton * Return the part of pr2's name that is relative to pr1, or the whole name 42060304c731SJamie Gritton * if it does not directly follow. 42070304c731SJamie Gritton */ 42080304c731SJamie Gritton 42090304c731SJamie Gritton char * 42100304c731SJamie Gritton prison_name(struct prison *pr1, struct prison *pr2) 42110304c731SJamie Gritton { 42120304c731SJamie Gritton char *name; 42130304c731SJamie Gritton 42140304c731SJamie Gritton /* Jails see themselves as "0" (if they see themselves at all). */ 42150304c731SJamie Gritton if (pr1 == pr2) 42160304c731SJamie Gritton return "0"; 42170304c731SJamie Gritton name = pr2->pr_name; 42180304c731SJamie Gritton if (prison_ischild(pr1, pr2)) { 42190304c731SJamie Gritton /* 42200304c731SJamie Gritton * pr1 isn't locked (and allprison_lock may not be either) 42210304c731SJamie Gritton * so its length can't be counted on. But the number of dots 42220304c731SJamie Gritton * can be counted on - and counted. 42230304c731SJamie Gritton */ 42240304c731SJamie Gritton for (; pr1 != &prison0; pr1 = pr1->pr_parent) 42250304c731SJamie Gritton name = strchr(name, '.') + 1; 42260304c731SJamie Gritton } 42270304c731SJamie Gritton return (name); 42280304c731SJamie Gritton } 42290304c731SJamie Gritton 42300304c731SJamie Gritton /* 42310304c731SJamie Gritton * Return the part of pr2's path that is relative to pr1, or the whole path 42320304c731SJamie Gritton * if it does not directly follow. 42330304c731SJamie Gritton */ 42340304c731SJamie Gritton static char * 42350304c731SJamie Gritton prison_path(struct prison *pr1, struct prison *pr2) 42360304c731SJamie Gritton { 42370304c731SJamie Gritton char *path1, *path2; 42380304c731SJamie Gritton int len1; 42390304c731SJamie Gritton 42400304c731SJamie Gritton path1 = pr1->pr_path; 42410304c731SJamie Gritton path2 = pr2->pr_path; 42420304c731SJamie Gritton if (!strcmp(path1, "/")) 42430304c731SJamie Gritton return (path2); 42440304c731SJamie Gritton len1 = strlen(path1); 42450304c731SJamie Gritton if (strncmp(path1, path2, len1)) 42460304c731SJamie Gritton return (path2); 42470304c731SJamie Gritton if (path2[len1] == '\0') 42480304c731SJamie Gritton return "/"; 42490304c731SJamie Gritton if (path2[len1] == '/') 42500304c731SJamie Gritton return (path2 + len1); 42510304c731SJamie Gritton return (path2); 42520304c731SJamie Gritton } 42530304c731SJamie Gritton 42540304c731SJamie Gritton /* 42550304c731SJamie Gritton * Jail-related sysctls. 42560304c731SJamie Gritton */ 42577029da5cSPawel Biernacki static SYSCTL_NODE(_security, OID_AUTO, jail, CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 42580304c731SJamie Gritton "Jails"); 42590304c731SJamie Gritton 4260eb8dcdeaSGleb Smirnoff #if defined(INET) || defined(INET6) 4261eb8dcdeaSGleb Smirnoff /* 4262eb8dcdeaSGleb Smirnoff * Copy address array to memory that would be then SYSCTL_OUT-ed. 4263eb8dcdeaSGleb Smirnoff * sysctl_jail_list() helper. 4264eb8dcdeaSGleb Smirnoff */ 4265eb8dcdeaSGleb Smirnoff static void 4266eb8dcdeaSGleb Smirnoff prison_ip_copyout(struct prison *pr, const pr_family_t af, void **out, int *len) 4267eb8dcdeaSGleb Smirnoff { 42682c33b456SZhenlei Huang const struct prison_ip *pip; 4269eb8dcdeaSGleb Smirnoff const size_t size = pr_families[af].size; 4270eb8dcdeaSGleb Smirnoff 4271eb8dcdeaSGleb Smirnoff again: 4272eb8dcdeaSGleb Smirnoff mtx_assert(&pr->pr_mtx, MA_OWNED); 42732c33b456SZhenlei Huang if ((pip = pr->pr_addrs[af]) != NULL) { 42742c33b456SZhenlei Huang if (*len < pip->ips) { 42752c33b456SZhenlei Huang *len = pip->ips; 4276eb8dcdeaSGleb Smirnoff mtx_unlock(&pr->pr_mtx); 4277eb8dcdeaSGleb Smirnoff *out = realloc(*out, *len * size, M_TEMP, M_WAITOK); 4278eb8dcdeaSGleb Smirnoff mtx_lock(&pr->pr_mtx); 4279eb8dcdeaSGleb Smirnoff goto again; 4280eb8dcdeaSGleb Smirnoff } 42812c33b456SZhenlei Huang bcopy(pip->pr_ip, *out, pip->ips * size); 4282eb8dcdeaSGleb Smirnoff } 4283eb8dcdeaSGleb Smirnoff } 4284eb8dcdeaSGleb Smirnoff #endif 4285eb8dcdeaSGleb Smirnoff 4286fd7a8150SMike Barcroft static int 4287fd7a8150SMike Barcroft sysctl_jail_list(SYSCTL_HANDLER_ARGS) 4288fd7a8150SMike Barcroft { 4289b38ff370SJamie Gritton struct xprison *xp; 42900304c731SJamie Gritton struct prison *pr, *cpr; 4291b38ff370SJamie Gritton #ifdef INET 4292b38ff370SJamie Gritton struct in_addr *ip4 = NULL; 4293b38ff370SJamie Gritton int ip4s = 0; 4294b38ff370SJamie Gritton #endif 4295b38ff370SJamie Gritton #ifdef INET6 42963beefaedSColin Percival struct in6_addr *ip6 = NULL; 4297b38ff370SJamie Gritton int ip6s = 0; 4298b38ff370SJamie Gritton #endif 42990304c731SJamie Gritton int descend, error; 4300fd7a8150SMike Barcroft 4301b38ff370SJamie Gritton xp = malloc(sizeof(*xp), M_TEMP, M_WAITOK); 43020304c731SJamie Gritton pr = req->td->td_ucred->cr_prison; 4303b38ff370SJamie Gritton error = 0; 4304dc68a633SPawel Jakub Dawidek sx_slock(&allprison_lock); 43050304c731SJamie Gritton FOREACH_PRISON_DESCENDANT(pr, cpr, descend) { 43060304c731SJamie Gritton mtx_lock(&cpr->pr_mtx); 4307413628a7SBjoern A. Zeeb #ifdef INET 4308eb8dcdeaSGleb Smirnoff prison_ip_copyout(cpr, PR_INET, (void **)&ip4, &ip4s); 4309413628a7SBjoern A. Zeeb #endif 4310413628a7SBjoern A. Zeeb #ifdef INET6 4311eb8dcdeaSGleb Smirnoff prison_ip_copyout(cpr, PR_INET6, (void **)&ip6, &ip6s); 4312b38ff370SJamie Gritton #endif 4313b38ff370SJamie Gritton bzero(xp, sizeof(*xp)); 4314fd7a8150SMike Barcroft xp->pr_version = XPRISON_VERSION; 43150304c731SJamie Gritton xp->pr_id = cpr->pr_id; 43161158508aSJamie Gritton xp->pr_state = cpr->pr_state; 43170304c731SJamie Gritton strlcpy(xp->pr_path, prison_path(pr, cpr), sizeof(xp->pr_path)); 4318c1f19219SJamie Gritton strlcpy(xp->pr_host, cpr->pr_hostname, sizeof(xp->pr_host)); 43190304c731SJamie Gritton strlcpy(xp->pr_name, prison_name(pr, cpr), sizeof(xp->pr_name)); 4320413628a7SBjoern A. Zeeb #ifdef INET 4321eb8dcdeaSGleb Smirnoff xp->pr_ip4s = ip4s; 4322413628a7SBjoern A. Zeeb #endif 4323413628a7SBjoern A. Zeeb #ifdef INET6 4324eb8dcdeaSGleb Smirnoff xp->pr_ip6s = ip6s; 4325413628a7SBjoern A. Zeeb #endif 43260304c731SJamie Gritton mtx_unlock(&cpr->pr_mtx); 4327b38ff370SJamie Gritton error = SYSCTL_OUT(req, xp, sizeof(*xp)); 4328b38ff370SJamie Gritton if (error) 4329b38ff370SJamie Gritton break; 4330413628a7SBjoern A. Zeeb #ifdef INET 4331b38ff370SJamie Gritton if (xp->pr_ip4s > 0) { 4332b38ff370SJamie Gritton error = SYSCTL_OUT(req, ip4, 4333b38ff370SJamie Gritton xp->pr_ip4s * sizeof(struct in_addr)); 4334b38ff370SJamie Gritton if (error) 4335b38ff370SJamie Gritton break; 4336413628a7SBjoern A. Zeeb } 4337413628a7SBjoern A. Zeeb #endif 4338413628a7SBjoern A. Zeeb #ifdef INET6 4339b38ff370SJamie Gritton if (xp->pr_ip6s > 0) { 4340b38ff370SJamie Gritton error = SYSCTL_OUT(req, ip6, 4341b38ff370SJamie Gritton xp->pr_ip6s * sizeof(struct in6_addr)); 4342b38ff370SJamie Gritton if (error) 4343b38ff370SJamie Gritton break; 4344413628a7SBjoern A. Zeeb } 4345413628a7SBjoern A. Zeeb #endif 4346fd7a8150SMike Barcroft } 4347dc68a633SPawel Jakub Dawidek sx_sunlock(&allprison_lock); 4348b38ff370SJamie Gritton free(xp, M_TEMP); 4349b38ff370SJamie Gritton #ifdef INET 4350b38ff370SJamie Gritton free(ip4, M_TEMP); 4351b38ff370SJamie Gritton #endif 4352b38ff370SJamie Gritton #ifdef INET6 4353b38ff370SJamie Gritton free(ip6, M_TEMP); 4354b38ff370SJamie Gritton #endif 4355fd7a8150SMike Barcroft return (error); 4356fd7a8150SMike Barcroft } 4357fd7a8150SMike Barcroft 4358f3b86a5fSEd Schouten SYSCTL_OID(_security_jail, OID_AUTO, list, 4359f3b86a5fSEd Schouten CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0, 4360f3b86a5fSEd Schouten sysctl_jail_list, "S", "List of active jails"); 4361461167c2SPawel Jakub Dawidek 4362461167c2SPawel Jakub Dawidek static int 4363461167c2SPawel Jakub Dawidek sysctl_jail_jailed(SYSCTL_HANDLER_ARGS) 4364461167c2SPawel Jakub Dawidek { 4365461167c2SPawel Jakub Dawidek int error, injail; 4366461167c2SPawel Jakub Dawidek 4367461167c2SPawel Jakub Dawidek injail = jailed(req->td->td_ucred); 4368461167c2SPawel Jakub Dawidek error = SYSCTL_OUT(req, &injail, sizeof(injail)); 4369461167c2SPawel Jakub Dawidek 4370461167c2SPawel Jakub Dawidek return (error); 4371461167c2SPawel Jakub Dawidek } 43720304c731SJamie Gritton 4373f3b86a5fSEd Schouten SYSCTL_PROC(_security_jail, OID_AUTO, jailed, 4374f3b86a5fSEd Schouten CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0, 4375f3b86a5fSEd Schouten sysctl_jail_jailed, "I", "Process in jail?"); 4376413628a7SBjoern A. Zeeb 4377761d2bb5SJamie Gritton static int 4378761d2bb5SJamie Gritton sysctl_jail_vnet(SYSCTL_HANDLER_ARGS) 4379761d2bb5SJamie Gritton { 4380761d2bb5SJamie Gritton int error, havevnet; 4381761d2bb5SJamie Gritton #ifdef VIMAGE 4382761d2bb5SJamie Gritton struct ucred *cred = req->td->td_ucred; 4383761d2bb5SJamie Gritton 4384761d2bb5SJamie Gritton havevnet = jailed(cred) && prison_owns_vnet(cred); 4385761d2bb5SJamie Gritton #else 4386761d2bb5SJamie Gritton havevnet = 0; 4387761d2bb5SJamie Gritton #endif 4388761d2bb5SJamie Gritton error = SYSCTL_OUT(req, &havevnet, sizeof(havevnet)); 4389761d2bb5SJamie Gritton 4390761d2bb5SJamie Gritton return (error); 4391761d2bb5SJamie Gritton } 4392761d2bb5SJamie Gritton 4393761d2bb5SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, vnet, 4394761d2bb5SJamie Gritton CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0, 4395bb8f1623SBjoern A. Zeeb sysctl_jail_vnet, "I", "Jail owns vnet?"); 4396761d2bb5SJamie Gritton 43970304c731SJamie Gritton #if defined(INET) || defined(INET6) 4398e92e0574SJamie Gritton SYSCTL_UINT(_security_jail, OID_AUTO, jail_max_af_ips, CTLFLAG_RW, 43990304c731SJamie Gritton &jail_max_af_ips, 0, 4400c542c43eSJamie Gritton "Number of IP addresses a jail may have at most per address family (deprecated)"); 44010304c731SJamie Gritton #endif 44020304c731SJamie Gritton 44030304c731SJamie Gritton /* 4404c542c43eSJamie Gritton * Default parameters for jail(2) compatibility. For historical reasons, 4405c542c43eSJamie Gritton * the sysctl names have varying similarity to the parameter names. Prisons 4406c542c43eSJamie Gritton * just see their own parameters, and can't change them. 44070304c731SJamie Gritton */ 44080304c731SJamie Gritton static int 44090304c731SJamie Gritton sysctl_jail_default_allow(SYSCTL_HANDLER_ARGS) 44100304c731SJamie Gritton { 44110fe74ae6SJamie Gritton int error, i; 44120304c731SJamie Gritton 44130304c731SJamie Gritton /* Get the current flag value, and convert it to a boolean. */ 44140fe74ae6SJamie Gritton if (req->td->td_ucred->cr_prison == &prison0) { 44150fe74ae6SJamie Gritton mtx_lock(&prison0.pr_mtx); 44160fe74ae6SJamie Gritton i = (jail_default_allow & arg2) != 0; 44170fe74ae6SJamie Gritton mtx_unlock(&prison0.pr_mtx); 44180fe74ae6SJamie Gritton } else 44190fe74ae6SJamie Gritton i = prison_allow(req->td->td_ucred, arg2); 44200fe74ae6SJamie Gritton 44210304c731SJamie Gritton if (arg1 != NULL) 44220304c731SJamie Gritton i = !i; 44230304c731SJamie Gritton error = sysctl_handle_int(oidp, &i, 0, req); 4424c542c43eSJamie Gritton if (error || !req->newptr) 44250304c731SJamie Gritton return (error); 44260304c731SJamie Gritton i = i ? arg2 : 0; 44270304c731SJamie Gritton if (arg1 != NULL) 44280304c731SJamie Gritton i ^= arg2; 44290304c731SJamie Gritton /* 44300304c731SJamie Gritton * The sysctls don't have CTLFLAGS_PRISON, so assume prison0 44310304c731SJamie Gritton * for writing. 44320304c731SJamie Gritton */ 44330304c731SJamie Gritton mtx_lock(&prison0.pr_mtx); 44340304c731SJamie Gritton jail_default_allow = (jail_default_allow & ~arg2) | i; 44350304c731SJamie Gritton mtx_unlock(&prison0.pr_mtx); 44360304c731SJamie Gritton return (0); 44370304c731SJamie Gritton } 44380304c731SJamie Gritton 44390304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, set_hostname_allowed, 4440c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 44410304c731SJamie Gritton NULL, PR_ALLOW_SET_HOSTNAME, sysctl_jail_default_allow, "I", 4442c542c43eSJamie Gritton "Processes in jail can set their hostnames (deprecated)"); 44430304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, socket_unixiproute_only, 4444c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 44450304c731SJamie Gritton (void *)1, PR_ALLOW_SOCKET_AF, sysctl_jail_default_allow, "I", 4446c542c43eSJamie Gritton "Processes in jail are limited to creating UNIX/IP/route sockets only (deprecated)"); 44470304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, sysvipc_allowed, 4448c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 44490304c731SJamie Gritton NULL, PR_ALLOW_SYSVIPC, sysctl_jail_default_allow, "I", 4450c542c43eSJamie Gritton "Processes in jail can use System V IPC primitives (deprecated)"); 44510304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, allow_raw_sockets, 4452c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 44530304c731SJamie Gritton NULL, PR_ALLOW_RAW_SOCKETS, sysctl_jail_default_allow, "I", 4454c542c43eSJamie Gritton "Prison root can create raw sockets (deprecated)"); 44550304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, chflags_allowed, 4456c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 44570304c731SJamie Gritton NULL, PR_ALLOW_CHFLAGS, sysctl_jail_default_allow, "I", 4458c542c43eSJamie Gritton "Processes in jail can alter system file flags (deprecated)"); 44590304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, mount_allowed, 4460c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 44610304c731SJamie Gritton NULL, PR_ALLOW_MOUNT, sysctl_jail_default_allow, "I", 4462c542c43eSJamie Gritton "Processes in jail can mount/unmount jail-friendly file systems (deprecated)"); 44639fd97868SBaptiste Daroussin SYSCTL_PROC(_security_jail, OID_AUTO, mlock_allowed, 44649fd97868SBaptiste Daroussin CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 44659fd97868SBaptiste Daroussin NULL, PR_ALLOW_MLOCK, sysctl_jail_default_allow, "I", 44669fd97868SBaptiste Daroussin "Processes in jail can lock/unlock physical pages in memory"); 44670304c731SJamie Gritton 44680304c731SJamie Gritton static int 44690304c731SJamie Gritton sysctl_jail_default_level(SYSCTL_HANDLER_ARGS) 44700304c731SJamie Gritton { 44710304c731SJamie Gritton struct prison *pr; 44720304c731SJamie Gritton int level, error; 44730304c731SJamie Gritton 44740304c731SJamie Gritton pr = req->td->td_ucred->cr_prison; 44750304c731SJamie Gritton level = (pr == &prison0) ? *(int *)arg1 : *(int *)((char *)pr + arg2); 44760304c731SJamie Gritton error = sysctl_handle_int(oidp, &level, 0, req); 4477c542c43eSJamie Gritton if (error || !req->newptr) 44780304c731SJamie Gritton return (error); 44790304c731SJamie Gritton *(int *)arg1 = level; 44800304c731SJamie Gritton return (0); 44810304c731SJamie Gritton } 44820304c731SJamie Gritton 44830304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, enforce_statfs, 4484c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 4485c542c43eSJamie Gritton &jail_default_enforce_statfs, offsetof(struct prison, pr_enforce_statfs), 44860304c731SJamie Gritton sysctl_jail_default_level, "I", 4487c542c43eSJamie Gritton "Processes in jail cannot see all mounted file systems (deprecated)"); 4488c542c43eSJamie Gritton 44890cc207a6SMartin Matuska SYSCTL_PROC(_security_jail, OID_AUTO, devfs_ruleset, 4490c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, 4491c542c43eSJamie Gritton &jail_default_devfs_rsnum, offsetof(struct prison, pr_devfs_rsnum), 44920cc207a6SMartin Matuska sysctl_jail_default_level, "I", 4493c542c43eSJamie Gritton "Ruleset for the devfs filesystem in jail (deprecated)"); 44940cc207a6SMartin Matuska 4495ab0841bdSJamie Gritton SYSCTL_NODE(_security_jail, OID_AUTO, children, CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 4496ab0841bdSJamie Gritton "Limits and stats of child jails"); 4497ab0841bdSJamie Gritton 4498ab0841bdSJamie Gritton static int 4499ab0841bdSJamie Gritton sysctl_jail_children(SYSCTL_HANDLER_ARGS) 4500ab0841bdSJamie Gritton { 4501ab0841bdSJamie Gritton struct prison *pr; 4502ab0841bdSJamie Gritton int i; 4503ab0841bdSJamie Gritton 4504ab0841bdSJamie Gritton pr = req->td->td_ucred->cr_prison; 4505ab0841bdSJamie Gritton 4506ab0841bdSJamie Gritton switch (oidp->oid_kind & CTLTYPE) { 4507ab0841bdSJamie Gritton case CTLTYPE_INT: 4508ab0841bdSJamie Gritton i = *(int *)((char *)pr + arg2); 4509ab0841bdSJamie Gritton return (SYSCTL_OUT(req, &i, sizeof(i))); 4510ab0841bdSJamie Gritton } 4511ab0841bdSJamie Gritton 4512ab0841bdSJamie Gritton return (0); 4513ab0841bdSJamie Gritton } 4514ab0841bdSJamie Gritton 4515ab0841bdSJamie Gritton SYSCTL_PROC(_security_jail_children, OID_AUTO, max, 4516ab0841bdSJamie Gritton CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, 4517ab0841bdSJamie Gritton NULL, offsetof(struct prison, pr_childmax), sysctl_jail_children, 4518ab0841bdSJamie Gritton "I", "Maximum number of child jails"); 4519ab0841bdSJamie Gritton SYSCTL_PROC(_security_jail_children, OID_AUTO, cur, 4520ab0841bdSJamie Gritton CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, 4521ab0841bdSJamie Gritton NULL, offsetof(struct prison, pr_childcount), sysctl_jail_children, 4522ab0841bdSJamie Gritton "I", "Current number of child jails"); 4523ab0841bdSJamie Gritton 45240304c731SJamie Gritton /* 45250304c731SJamie Gritton * Nodes to describe jail parameters. Maximum length of string parameters 45260304c731SJamie Gritton * is returned in the string itself, and the other parameters exist merely 45270304c731SJamie Gritton * to make themselves and their types known. 45280304c731SJamie Gritton */ 45297029da5cSPawel Biernacki SYSCTL_NODE(_security_jail, OID_AUTO, param, CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 45300304c731SJamie Gritton "Jail parameters"); 45310304c731SJamie Gritton 45320304c731SJamie Gritton int 45330304c731SJamie Gritton sysctl_jail_param(SYSCTL_HANDLER_ARGS) 45340304c731SJamie Gritton { 45350304c731SJamie Gritton int i; 45360304c731SJamie Gritton long l; 45370304c731SJamie Gritton size_t s; 45380304c731SJamie Gritton char numbuf[12]; 45390304c731SJamie Gritton 45400304c731SJamie Gritton switch (oidp->oid_kind & CTLTYPE) 45410304c731SJamie Gritton { 45420304c731SJamie Gritton case CTLTYPE_LONG: 45430304c731SJamie Gritton case CTLTYPE_ULONG: 45440304c731SJamie Gritton l = 0; 45450304c731SJamie Gritton #ifdef SCTL_MASK32 45460304c731SJamie Gritton if (!(req->flags & SCTL_MASK32)) 45470304c731SJamie Gritton #endif 45480304c731SJamie Gritton return (SYSCTL_OUT(req, &l, sizeof(l))); 45490304c731SJamie Gritton case CTLTYPE_INT: 45500304c731SJamie Gritton case CTLTYPE_UINT: 45510304c731SJamie Gritton i = 0; 45520304c731SJamie Gritton return (SYSCTL_OUT(req, &i, sizeof(i))); 45530304c731SJamie Gritton case CTLTYPE_STRING: 4554e4cd31ddSJeff Roberson snprintf(numbuf, sizeof(numbuf), "%jd", (intmax_t)arg2); 45550304c731SJamie Gritton return 45560304c731SJamie Gritton (sysctl_handle_string(oidp, numbuf, sizeof(numbuf), req)); 45570304c731SJamie Gritton case CTLTYPE_STRUCT: 45580304c731SJamie Gritton s = (size_t)arg2; 45590304c731SJamie Gritton return (SYSCTL_OUT(req, &s, sizeof(s))); 45600304c731SJamie Gritton } 45610304c731SJamie Gritton return (0); 45620304c731SJamie Gritton } 45630304c731SJamie Gritton 4564b96bd95bSIan Lepore /* 4565b96bd95bSIan Lepore * CTLFLAG_RDTUN in the following indicates jail parameters that can be set at 4566b96bd95bSIan Lepore * jail creation time but cannot be changed in an existing jail. 4567b96bd95bSIan Lepore */ 45680304c731SJamie Gritton SYSCTL_JAIL_PARAM(, jid, CTLTYPE_INT | CTLFLAG_RDTUN, "I", "Jail ID"); 45690304c731SJamie Gritton SYSCTL_JAIL_PARAM(, parent, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail parent ID"); 45700304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(, name, CTLFLAG_RW, MAXHOSTNAMELEN, "Jail name"); 45710304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(, path, CTLFLAG_RDTUN, MAXPATHLEN, "Jail root path"); 45720304c731SJamie Gritton SYSCTL_JAIL_PARAM(, securelevel, CTLTYPE_INT | CTLFLAG_RW, 45730304c731SJamie Gritton "I", "Jail secure level"); 4574b96bd95bSIan Lepore SYSCTL_JAIL_PARAM(, osreldate, CTLTYPE_INT | CTLFLAG_RDTUN, "I", 4575b96bd95bSIan Lepore "Jail value for kern.osreldate and uname -K"); 4576b96bd95bSIan Lepore SYSCTL_JAIL_PARAM_STRING(, osrelease, CTLFLAG_RDTUN, OSRELEASELEN, 4577b96bd95bSIan Lepore "Jail value for kern.osrelease and uname -r"); 45780304c731SJamie Gritton SYSCTL_JAIL_PARAM(, enforce_statfs, CTLTYPE_INT | CTLFLAG_RW, 45790304c731SJamie Gritton "I", "Jail cannot see all mounted file systems"); 45800cc207a6SMartin Matuska SYSCTL_JAIL_PARAM(, devfs_ruleset, CTLTYPE_INT | CTLFLAG_RW, 45810cc207a6SMartin Matuska "I", "Ruleset for in-jail devfs mounts"); 45820304c731SJamie Gritton SYSCTL_JAIL_PARAM(, persist, CTLTYPE_INT | CTLFLAG_RW, 45830304c731SJamie Gritton "B", "Jail persistence"); 4584679e1390SJamie Gritton #ifdef VIMAGE 4585679e1390SJamie Gritton SYSCTL_JAIL_PARAM(, vnet, CTLTYPE_INT | CTLFLAG_RDTUN, 45867cbf7213SJamie Gritton "E,jailsys", "Virtual network stack"); 4587679e1390SJamie Gritton #endif 45880304c731SJamie Gritton SYSCTL_JAIL_PARAM(, dying, CTLTYPE_INT | CTLFLAG_RD, 45890304c731SJamie Gritton "B", "Jail is in the process of shutting down"); 45900304c731SJamie Gritton 4591b97457e2SJamie Gritton SYSCTL_JAIL_PARAM_NODE(children, "Number of child jails"); 4592b97457e2SJamie Gritton SYSCTL_JAIL_PARAM(_children, cur, CTLTYPE_INT | CTLFLAG_RD, 4593b97457e2SJamie Gritton "I", "Current number of child jails"); 4594b97457e2SJamie Gritton SYSCTL_JAIL_PARAM(_children, max, CTLTYPE_INT | CTLFLAG_RW, 4595b97457e2SJamie Gritton "I", "Maximum number of child jails"); 4596b97457e2SJamie Gritton 45977cbf7213SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(host, CTLFLAG_RW, "Jail host info"); 45980304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, hostname, CTLFLAG_RW, MAXHOSTNAMELEN, 45990304c731SJamie Gritton "Jail hostname"); 460076ca6f88SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, domainname, CTLFLAG_RW, MAXHOSTNAMELEN, 460176ca6f88SJamie Gritton "Jail NIS domainname"); 460276ca6f88SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, hostuuid, CTLFLAG_RW, HOSTUUIDLEN, 460376ca6f88SJamie Gritton "Jail host UUID"); 460476ca6f88SJamie Gritton SYSCTL_JAIL_PARAM(_host, hostid, CTLTYPE_ULONG | CTLFLAG_RW, 460576ca6f88SJamie Gritton "LU", "Jail host ID"); 46060304c731SJamie Gritton 46070304c731SJamie Gritton SYSCTL_JAIL_PARAM_NODE(cpuset, "Jail cpuset"); 46080304c731SJamie Gritton SYSCTL_JAIL_PARAM(_cpuset, id, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail cpuset ID"); 46090304c731SJamie Gritton 46100304c731SJamie Gritton #ifdef INET 46112b0d6f81SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(ip4, CTLFLAG_RDTUN, 46122b0d6f81SJamie Gritton "Jail IPv4 address virtualization"); 46130304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRUCT(_ip4, addr, CTLFLAG_RW, sizeof(struct in_addr), 46140304c731SJamie Gritton "S,in_addr,a", "Jail IPv4 addresses"); 4615592bcae8SBjoern A. Zeeb SYSCTL_JAIL_PARAM(_ip4, saddrsel, CTLTYPE_INT | CTLFLAG_RW, 4616592bcae8SBjoern A. Zeeb "B", "Do (not) use IPv4 source address selection rather than the " 4617592bcae8SBjoern A. Zeeb "primary jail IPv4 address."); 46180304c731SJamie Gritton #endif 46190304c731SJamie Gritton #ifdef INET6 46202b0d6f81SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(ip6, CTLFLAG_RDTUN, 46212b0d6f81SJamie Gritton "Jail IPv6 address virtualization"); 46220304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRUCT(_ip6, addr, CTLFLAG_RW, sizeof(struct in6_addr), 46230304c731SJamie Gritton "S,in6_addr,a", "Jail IPv6 addresses"); 4624592bcae8SBjoern A. Zeeb SYSCTL_JAIL_PARAM(_ip6, saddrsel, CTLTYPE_INT | CTLFLAG_RW, 4625592bcae8SBjoern A. Zeeb "B", "Do (not) use IPv6 source address selection rather than the " 4626592bcae8SBjoern A. Zeeb "primary jail IPv6 address."); 46270304c731SJamie Gritton #endif 46280304c731SJamie Gritton 46290304c731SJamie Gritton SYSCTL_JAIL_PARAM_NODE(allow, "Jail permission flags"); 46300304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, set_hostname, CTLTYPE_INT | CTLFLAG_RW, 46310304c731SJamie Gritton "B", "Jail may set hostname"); 46320304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, sysvipc, CTLTYPE_INT | CTLFLAG_RW, 46330304c731SJamie Gritton "B", "Jail may use SYSV IPC"); 46340304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, raw_sockets, CTLTYPE_INT | CTLFLAG_RW, 46350304c731SJamie Gritton "B", "Jail may create raw sockets"); 46360304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, chflags, CTLTYPE_INT | CTLFLAG_RW, 46370304c731SJamie Gritton "B", "Jail may alter system file flags"); 46380304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, quotas, CTLTYPE_INT | CTLFLAG_RW, 46390304c731SJamie Gritton "B", "Jail may set file quotas"); 46400304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, socket_af, CTLTYPE_INT | CTLFLAG_RW, 46410304c731SJamie Gritton "B", "Jail may create sockets other than just UNIX/IPv4/IPv6/route"); 4642ccd6ac9fSAntoine Brodin SYSCTL_JAIL_PARAM(_allow, mlock, CTLTYPE_INT | CTLFLAG_RW, 4643ccd6ac9fSAntoine Brodin "B", "Jail may lock (unlock) physical pages in memory"); 4644e28f9b7dSAllan Jude SYSCTL_JAIL_PARAM(_allow, reserved_ports, CTLTYPE_INT | CTLFLAG_RW, 4645e28f9b7dSAllan Jude "B", "Jail may bind sockets to reserved ports"); 4646b19d66fdSJamie Gritton SYSCTL_JAIL_PARAM(_allow, read_msgbuf, CTLTYPE_INT | CTLFLAG_RW, 4647b19d66fdSJamie Gritton "B", "Jail may read the kernel message buffer"); 4648b3079544SJamie Gritton SYSCTL_JAIL_PARAM(_allow, unprivileged_proc_debug, CTLTYPE_INT | CTLFLAG_RW, 4649b3079544SJamie Gritton "B", "Unprivileged processes may use process debugging facilities"); 465005e1e482SMariusz Zaborski SYSCTL_JAIL_PARAM(_allow, suser, CTLTYPE_INT | CTLFLAG_RW, 465105e1e482SMariusz Zaborski "B", "Processes in jail with uid 0 have privilege"); 4652cbbb2203SRick Macklem #ifdef VIMAGE 4653bba7a2e8SRick Macklem SYSCTL_JAIL_PARAM(_allow, nfsd, CTLTYPE_INT | CTLFLAG_RW, 4654bba7a2e8SRick Macklem "B", "Mountd/nfsd may run in the jail"); 4655bba7a2e8SRick Macklem #endif 4656cb48780dSShawn Webb SYSCTL_JAIL_PARAM(_allow, extattr, CTLTYPE_INT | CTLFLAG_RW, 4657cb48780dSShawn Webb "B", "Jail may set system-level filesystem extended attributes"); 4658d3bb35d4SMariusz Zaborski SYSCTL_JAIL_PARAM(_allow, adjtime, CTLTYPE_INT | CTLFLAG_RW, 4659d3bb35d4SMariusz Zaborski "B", "Jail may adjust system time"); 4660d3bb35d4SMariusz Zaborski SYSCTL_JAIL_PARAM(_allow, settime, CTLTYPE_INT | CTLFLAG_RW, 4661d3bb35d4SMariusz Zaborski "B", "Jail may set system time"); 46620304c731SJamie Gritton 4663bf3db8aaSMartin Matuska SYSCTL_JAIL_PARAM_SUBNODE(allow, mount, "Jail mount/unmount permission flags"); 4664bf3db8aaSMartin Matuska SYSCTL_JAIL_PARAM(_allow_mount, , CTLTYPE_INT | CTLFLAG_RW, 4665bf3db8aaSMartin Matuska "B", "Jail may mount/unmount jail-friendly file systems in general"); 46660e5c6bd4SJamie Gritton 46670e5c6bd4SJamie Gritton /* 46680a172404SJamie Gritton * Add a dynamic parameter allow.<name>, or allow.<prefix>.<name>. Return 46690a172404SJamie Gritton * its associated bit in the pr_allow bitmask, or zero if the parameter was 46700a172404SJamie Gritton * not created. 46710e5c6bd4SJamie Gritton */ 46720a172404SJamie Gritton unsigned 46730a172404SJamie Gritton prison_add_allow(const char *prefix, const char *name, const char *prefix_descr, 46740a172404SJamie Gritton const char *descr) 46750e5c6bd4SJamie Gritton { 46760e5c6bd4SJamie Gritton struct bool_flags *bf; 46770a172404SJamie Gritton struct sysctl_oid *parent; 46780a172404SJamie Gritton char *allow_name, *allow_noname, *allowed; 4679c542c43eSJamie Gritton #ifndef NO_SYSCTL_DESCR 4680c542c43eSJamie Gritton char *descr_deprecated; 4681c542c43eSJamie Gritton #endif 46825d58f959SJamie Gritton u_int allow_flag; 46830e5c6bd4SJamie Gritton 46840a172404SJamie Gritton if (prefix 46850a172404SJamie Gritton ? asprintf(&allow_name, M_PRISON, "allow.%s.%s", prefix, name) 46860a172404SJamie Gritton < 0 || 46870a172404SJamie Gritton asprintf(&allow_noname, M_PRISON, "allow.%s.no%s", prefix, name) 46880a172404SJamie Gritton < 0 46890a172404SJamie Gritton : asprintf(&allow_name, M_PRISON, "allow.%s", name) < 0 || 46900a172404SJamie Gritton asprintf(&allow_noname, M_PRISON, "allow.no%s", name) < 0) { 46910e5c6bd4SJamie Gritton free(allow_name, M_PRISON); 46920a172404SJamie Gritton return 0; 46930e5c6bd4SJamie Gritton } 46940e5c6bd4SJamie Gritton 46950e5c6bd4SJamie Gritton /* 46960a172404SJamie Gritton * See if this parameter has already beed added, i.e. a module was 46970a172404SJamie Gritton * previously loaded/unloaded. 46980e5c6bd4SJamie Gritton */ 46990e5c6bd4SJamie Gritton mtx_lock(&prison0.pr_mtx); 47000e5c6bd4SJamie Gritton for (bf = pr_flag_allow; 47015d58f959SJamie Gritton bf < pr_flag_allow + nitems(pr_flag_allow) && 47025d58f959SJamie Gritton atomic_load_int(&bf->flag) != 0; 47030e5c6bd4SJamie Gritton bf++) { 47040e5c6bd4SJamie Gritton if (strcmp(bf->name, allow_name) == 0) { 47050a172404SJamie Gritton allow_flag = bf->flag; 47060e5c6bd4SJamie Gritton goto no_add; 47070e5c6bd4SJamie Gritton } 47080e5c6bd4SJamie Gritton } 47090e5c6bd4SJamie Gritton 47100e5c6bd4SJamie Gritton /* 47115d58f959SJamie Gritton * Find a free bit in pr_allow_all, failing if there are none 47120e5c6bd4SJamie Gritton * (which shouldn't happen as long as we keep track of how many 47130a172404SJamie Gritton * potential dynamic flags exist). 47140e5c6bd4SJamie Gritton */ 47150e5c6bd4SJamie Gritton for (allow_flag = 1;; allow_flag <<= 1) { 47160e5c6bd4SJamie Gritton if (allow_flag == 0) 47170e5c6bd4SJamie Gritton goto no_add; 47185d58f959SJamie Gritton if ((pr_allow_all & allow_flag) == 0) 47190e5c6bd4SJamie Gritton break; 47200e5c6bd4SJamie Gritton } 47210e5c6bd4SJamie Gritton 47225d58f959SJamie Gritton /* Note the parameter in the next open slot in pr_flag_allow. */ 47235d58f959SJamie Gritton for (bf = pr_flag_allow; ; bf++) { 47240e5c6bd4SJamie Gritton if (bf == pr_flag_allow + nitems(pr_flag_allow)) { 47250e5c6bd4SJamie Gritton /* This should never happen, but is not fatal. */ 47260a172404SJamie Gritton allow_flag = 0; 47270e5c6bd4SJamie Gritton goto no_add; 47280e5c6bd4SJamie Gritton } 47295d58f959SJamie Gritton if (atomic_load_int(&bf->flag) == 0) 47305d58f959SJamie Gritton break; 47315d58f959SJamie Gritton } 47320e5c6bd4SJamie Gritton bf->name = allow_name; 47330e5c6bd4SJamie Gritton bf->noname = allow_noname; 47345d58f959SJamie Gritton pr_allow_all |= allow_flag; 47355d58f959SJamie Gritton /* 47365d58f959SJamie Gritton * prison0 always has permission for the new parameter. 47375d58f959SJamie Gritton * Other jails must have it granted to them. 47385d58f959SJamie Gritton */ 47395d58f959SJamie Gritton prison0.pr_allow |= allow_flag; 47405d58f959SJamie Gritton /* The flag indicates a valid entry, so make sure it is set last. */ 47415d58f959SJamie Gritton atomic_store_rel_int(&bf->flag, allow_flag); 47420e5c6bd4SJamie Gritton mtx_unlock(&prison0.pr_mtx); 47430e5c6bd4SJamie Gritton 4744c542c43eSJamie Gritton /* 47454771011bSGordon Bergling * Create sysctls for the parameter, and the back-compat global 4746c542c43eSJamie Gritton * permission. 4747c542c43eSJamie Gritton */ 47480a172404SJamie Gritton parent = prefix 47490a172404SJamie Gritton ? SYSCTL_ADD_NODE(NULL, 47500a172404SJamie Gritton SYSCTL_CHILDREN(&sysctl___security_jail_param_allow), 47517029da5cSPawel Biernacki OID_AUTO, prefix, CTLFLAG_MPSAFE, 0, prefix_descr) 47520a172404SJamie Gritton : &sysctl___security_jail_param_allow; 47530a172404SJamie Gritton (void)SYSCTL_ADD_PROC(NULL, SYSCTL_CHILDREN(parent), OID_AUTO, 47540a172404SJamie Gritton name, CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, 47550e5c6bd4SJamie Gritton NULL, 0, sysctl_jail_param, "B", descr); 47560a172404SJamie Gritton if ((prefix 47570a172404SJamie Gritton ? asprintf(&allowed, M_TEMP, "%s_%s_allowed", prefix, name) 47580a172404SJamie Gritton : asprintf(&allowed, M_TEMP, "%s_allowed", name)) >= 0) { 4759c542c43eSJamie Gritton #ifndef NO_SYSCTL_DESCR 4760c542c43eSJamie Gritton (void)asprintf(&descr_deprecated, M_TEMP, "%s (deprecated)", 4761c542c43eSJamie Gritton descr); 4762c542c43eSJamie Gritton #endif 47630e5c6bd4SJamie Gritton (void)SYSCTL_ADD_PROC(NULL, 47640a172404SJamie Gritton SYSCTL_CHILDREN(&sysctl___security_jail), OID_AUTO, allowed, 4765c542c43eSJamie Gritton CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, allow_flag, 4766c542c43eSJamie Gritton sysctl_jail_default_allow, "I", descr_deprecated); 4767c542c43eSJamie Gritton #ifndef NO_SYSCTL_DESCR 4768c542c43eSJamie Gritton free(descr_deprecated, M_TEMP); 4769c542c43eSJamie Gritton #endif 47700a172404SJamie Gritton free(allowed, M_TEMP); 47710e5c6bd4SJamie Gritton } 47720a172404SJamie Gritton return allow_flag; 47730e5c6bd4SJamie Gritton 47740e5c6bd4SJamie Gritton no_add: 47750e5c6bd4SJamie Gritton mtx_unlock(&prison0.pr_mtx); 47760e5c6bd4SJamie Gritton free(allow_name, M_PRISON); 47770e5c6bd4SJamie Gritton free(allow_noname, M_PRISON); 47780a172404SJamie Gritton return allow_flag; 47790a172404SJamie Gritton } 47800a172404SJamie Gritton 47810a172404SJamie Gritton /* 47820a172404SJamie Gritton * The VFS system will register jail-aware filesystems here. They each get 47830a172404SJamie Gritton * a parameter allow.mount.xxxfs and a flag to check when a jailed user 47840a172404SJamie Gritton * attempts to mount. 47850a172404SJamie Gritton */ 47860a172404SJamie Gritton void 47870a172404SJamie Gritton prison_add_vfs(struct vfsconf *vfsp) 47880a172404SJamie Gritton { 47890a172404SJamie Gritton #ifdef NO_SYSCTL_DESCR 47900a172404SJamie Gritton 47910a172404SJamie Gritton vfsp->vfc_prison_flag = prison_add_allow("mount", vfsp->vfc_name, 47920a172404SJamie Gritton NULL, NULL); 47930a172404SJamie Gritton #else 47940a172404SJamie Gritton char *descr; 47950a172404SJamie Gritton 47960a172404SJamie Gritton (void)asprintf(&descr, M_TEMP, "Jail may mount the %s file system", 47970a172404SJamie Gritton vfsp->vfc_name); 47980a172404SJamie Gritton vfsp->vfc_prison_flag = prison_add_allow("mount", vfsp->vfc_name, 47990a172404SJamie Gritton NULL, descr); 48000a172404SJamie Gritton free(descr, M_TEMP); 48010a172404SJamie Gritton #endif 48020e5c6bd4SJamie Gritton } 4803bf3db8aaSMartin Matuska 48044b5c9cf6SEdward Tomasz Napierala #ifdef RACCT 4805097055e2SEdward Tomasz Napierala void 4806097055e2SEdward Tomasz Napierala prison_racct_foreach(void (*callback)(struct racct *racct, 480715db3c07SEdward Tomasz Napierala void *arg2, void *arg3), void (*pre)(void), void (*post)(void), 480815db3c07SEdward Tomasz Napierala void *arg2, void *arg3) 4809097055e2SEdward Tomasz Napierala { 4810a7ad07bfSEdward Tomasz Napierala struct prison_racct *prr; 4811097055e2SEdward Tomasz Napierala 48124b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 48134b5c9cf6SEdward Tomasz Napierala 4814097055e2SEdward Tomasz Napierala sx_slock(&allprison_lock); 481515db3c07SEdward Tomasz Napierala if (pre != NULL) 481615db3c07SEdward Tomasz Napierala (pre)(); 4817a7ad07bfSEdward Tomasz Napierala LIST_FOREACH(prr, &allprison_racct, prr_next) 4818a7ad07bfSEdward Tomasz Napierala (callback)(prr->prr_racct, arg2, arg3); 481915db3c07SEdward Tomasz Napierala if (post != NULL) 482015db3c07SEdward Tomasz Napierala (post)(); 4821097055e2SEdward Tomasz Napierala sx_sunlock(&allprison_lock); 4822097055e2SEdward Tomasz Napierala } 48230304c731SJamie Gritton 4824a7ad07bfSEdward Tomasz Napierala static struct prison_racct * 4825a7ad07bfSEdward Tomasz Napierala prison_racct_find_locked(const char *name) 4826a7ad07bfSEdward Tomasz Napierala { 4827a7ad07bfSEdward Tomasz Napierala struct prison_racct *prr; 4828a7ad07bfSEdward Tomasz Napierala 48294b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 4830a7ad07bfSEdward Tomasz Napierala sx_assert(&allprison_lock, SA_XLOCKED); 4831a7ad07bfSEdward Tomasz Napierala 4832a7ad07bfSEdward Tomasz Napierala if (name[0] == '\0' || strlen(name) >= MAXHOSTNAMELEN) 4833a7ad07bfSEdward Tomasz Napierala return (NULL); 4834a7ad07bfSEdward Tomasz Napierala 4835a7ad07bfSEdward Tomasz Napierala LIST_FOREACH(prr, &allprison_racct, prr_next) { 4836a7ad07bfSEdward Tomasz Napierala if (strcmp(name, prr->prr_name) != 0) 4837a7ad07bfSEdward Tomasz Napierala continue; 4838a7ad07bfSEdward Tomasz Napierala 4839a7ad07bfSEdward Tomasz Napierala /* Found prison_racct with a matching name? */ 4840a7ad07bfSEdward Tomasz Napierala prison_racct_hold(prr); 4841a7ad07bfSEdward Tomasz Napierala return (prr); 4842a7ad07bfSEdward Tomasz Napierala } 4843a7ad07bfSEdward Tomasz Napierala 4844a7ad07bfSEdward Tomasz Napierala /* Add new prison_racct. */ 4845a7ad07bfSEdward Tomasz Napierala prr = malloc(sizeof(*prr), M_PRISON_RACCT, M_ZERO | M_WAITOK); 4846a7ad07bfSEdward Tomasz Napierala racct_create(&prr->prr_racct); 4847a7ad07bfSEdward Tomasz Napierala 4848a7ad07bfSEdward Tomasz Napierala strcpy(prr->prr_name, name); 4849a7ad07bfSEdward Tomasz Napierala refcount_init(&prr->prr_refcount, 1); 4850a7ad07bfSEdward Tomasz Napierala LIST_INSERT_HEAD(&allprison_racct, prr, prr_next); 4851a7ad07bfSEdward Tomasz Napierala 4852a7ad07bfSEdward Tomasz Napierala return (prr); 4853a7ad07bfSEdward Tomasz Napierala } 4854a7ad07bfSEdward Tomasz Napierala 4855a7ad07bfSEdward Tomasz Napierala struct prison_racct * 4856a7ad07bfSEdward Tomasz Napierala prison_racct_find(const char *name) 4857a7ad07bfSEdward Tomasz Napierala { 4858a7ad07bfSEdward Tomasz Napierala struct prison_racct *prr; 4859a7ad07bfSEdward Tomasz Napierala 48604b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 48614b5c9cf6SEdward Tomasz Napierala 4862a7ad07bfSEdward Tomasz Napierala sx_xlock(&allprison_lock); 4863a7ad07bfSEdward Tomasz Napierala prr = prison_racct_find_locked(name); 4864a7ad07bfSEdward Tomasz Napierala sx_xunlock(&allprison_lock); 4865a7ad07bfSEdward Tomasz Napierala return (prr); 4866a7ad07bfSEdward Tomasz Napierala } 4867a7ad07bfSEdward Tomasz Napierala 4868a7ad07bfSEdward Tomasz Napierala void 4869a7ad07bfSEdward Tomasz Napierala prison_racct_hold(struct prison_racct *prr) 4870a7ad07bfSEdward Tomasz Napierala { 4871a7ad07bfSEdward Tomasz Napierala 48724b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 48734b5c9cf6SEdward Tomasz Napierala 4874a7ad07bfSEdward Tomasz Napierala refcount_acquire(&prr->prr_refcount); 4875a7ad07bfSEdward Tomasz Napierala } 4876a7ad07bfSEdward Tomasz Napierala 4877c34bbd2aSEdward Tomasz Napierala static void 4878c34bbd2aSEdward Tomasz Napierala prison_racct_free_locked(struct prison_racct *prr) 4879c34bbd2aSEdward Tomasz Napierala { 4880c34bbd2aSEdward Tomasz Napierala 48814b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 4882c34bbd2aSEdward Tomasz Napierala sx_assert(&allprison_lock, SA_XLOCKED); 4883c34bbd2aSEdward Tomasz Napierala 4884c34bbd2aSEdward Tomasz Napierala if (refcount_release(&prr->prr_refcount)) { 4885c34bbd2aSEdward Tomasz Napierala racct_destroy(&prr->prr_racct); 4886c34bbd2aSEdward Tomasz Napierala LIST_REMOVE(prr, prr_next); 4887c34bbd2aSEdward Tomasz Napierala free(prr, M_PRISON_RACCT); 4888c34bbd2aSEdward Tomasz Napierala } 4889c34bbd2aSEdward Tomasz Napierala } 4890c34bbd2aSEdward Tomasz Napierala 4891a7ad07bfSEdward Tomasz Napierala void 4892a7ad07bfSEdward Tomasz Napierala prison_racct_free(struct prison_racct *prr) 4893a7ad07bfSEdward Tomasz Napierala { 4894a7ad07bfSEdward Tomasz Napierala 48954b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 4896c34bbd2aSEdward Tomasz Napierala sx_assert(&allprison_lock, SA_UNLOCKED); 4897c34bbd2aSEdward Tomasz Napierala 48986ff4688bSMateusz Guzik if (refcount_release_if_not_last(&prr->prr_refcount)) 4899a7ad07bfSEdward Tomasz Napierala return; 4900a7ad07bfSEdward Tomasz Napierala 4901a7ad07bfSEdward Tomasz Napierala sx_xlock(&allprison_lock); 4902c34bbd2aSEdward Tomasz Napierala prison_racct_free_locked(prr); 4903a7ad07bfSEdward Tomasz Napierala sx_xunlock(&allprison_lock); 4904a7ad07bfSEdward Tomasz Napierala } 4905a7ad07bfSEdward Tomasz Napierala 4906a7ad07bfSEdward Tomasz Napierala static void 4907a7ad07bfSEdward Tomasz Napierala prison_racct_attach(struct prison *pr) 4908a7ad07bfSEdward Tomasz Napierala { 4909a7ad07bfSEdward Tomasz Napierala struct prison_racct *prr; 4910a7ad07bfSEdward Tomasz Napierala 49114b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 4912c34bbd2aSEdward Tomasz Napierala sx_assert(&allprison_lock, SA_XLOCKED); 4913c34bbd2aSEdward Tomasz Napierala 4914a7ad07bfSEdward Tomasz Napierala prr = prison_racct_find_locked(pr->pr_name); 4915a7ad07bfSEdward Tomasz Napierala KASSERT(prr != NULL, ("cannot find prison_racct")); 4916a7ad07bfSEdward Tomasz Napierala 4917a7ad07bfSEdward Tomasz Napierala pr->pr_prison_racct = prr; 4918a7ad07bfSEdward Tomasz Napierala } 4919a7ad07bfSEdward Tomasz Napierala 4920c34bbd2aSEdward Tomasz Napierala /* 4921c34bbd2aSEdward Tomasz Napierala * Handle jail renaming. From the racct point of view, renaming means 4922c34bbd2aSEdward Tomasz Napierala * moving from one prison_racct to another. 4923c34bbd2aSEdward Tomasz Napierala */ 4924c34bbd2aSEdward Tomasz Napierala static void 4925c34bbd2aSEdward Tomasz Napierala prison_racct_modify(struct prison *pr) 4926c34bbd2aSEdward Tomasz Napierala { 4927dbadb015SKonstantin Belousov #ifdef RCTL 4928c34bbd2aSEdward Tomasz Napierala struct proc *p; 4929c34bbd2aSEdward Tomasz Napierala struct ucred *cred; 4930dbadb015SKonstantin Belousov #endif 4931c34bbd2aSEdward Tomasz Napierala struct prison_racct *oldprr; 4932c34bbd2aSEdward Tomasz Napierala 49334b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 49344b5c9cf6SEdward Tomasz Napierala 4935c34bbd2aSEdward Tomasz Napierala sx_slock(&allproc_lock); 4936c34bbd2aSEdward Tomasz Napierala sx_xlock(&allprison_lock); 4937c34bbd2aSEdward Tomasz Napierala 4938e30345e7SEdward Tomasz Napierala if (strcmp(pr->pr_name, pr->pr_prison_racct->prr_name) == 0) { 4939e30345e7SEdward Tomasz Napierala sx_xunlock(&allprison_lock); 4940e30345e7SEdward Tomasz Napierala sx_sunlock(&allproc_lock); 4941c34bbd2aSEdward Tomasz Napierala return; 4942e30345e7SEdward Tomasz Napierala } 4943c34bbd2aSEdward Tomasz Napierala 4944c34bbd2aSEdward Tomasz Napierala oldprr = pr->pr_prison_racct; 4945c34bbd2aSEdward Tomasz Napierala pr->pr_prison_racct = NULL; 4946c34bbd2aSEdward Tomasz Napierala 4947c34bbd2aSEdward Tomasz Napierala prison_racct_attach(pr); 4948c34bbd2aSEdward Tomasz Napierala 4949c34bbd2aSEdward Tomasz Napierala /* 4950c34bbd2aSEdward Tomasz Napierala * Move resource utilisation records. 4951c34bbd2aSEdward Tomasz Napierala */ 4952c34bbd2aSEdward Tomasz Napierala racct_move(pr->pr_prison_racct->prr_racct, oldprr->prr_racct); 4953c34bbd2aSEdward Tomasz Napierala 4954f87beb93SAndriy Gapon #ifdef RCTL 4955c34bbd2aSEdward Tomasz Napierala /* 4956c34bbd2aSEdward Tomasz Napierala * Force rctl to reattach rules to processes. 4957c34bbd2aSEdward Tomasz Napierala */ 4958c34bbd2aSEdward Tomasz Napierala FOREACH_PROC_IN_SYSTEM(p) { 4959c34bbd2aSEdward Tomasz Napierala PROC_LOCK(p); 4960c34bbd2aSEdward Tomasz Napierala cred = crhold(p->p_ucred); 4961c34bbd2aSEdward Tomasz Napierala PROC_UNLOCK(p); 4962f87beb93SAndriy Gapon rctl_proc_ucred_changed(p, cred); 4963c34bbd2aSEdward Tomasz Napierala crfree(cred); 4964c34bbd2aSEdward Tomasz Napierala } 4965f87beb93SAndriy Gapon #endif 4966c34bbd2aSEdward Tomasz Napierala 4967c34bbd2aSEdward Tomasz Napierala sx_sunlock(&allproc_lock); 4968c34bbd2aSEdward Tomasz Napierala prison_racct_free_locked(oldprr); 4969c34bbd2aSEdward Tomasz Napierala sx_xunlock(&allprison_lock); 4970c34bbd2aSEdward Tomasz Napierala } 4971c34bbd2aSEdward Tomasz Napierala 4972a7ad07bfSEdward Tomasz Napierala static void 4973a7ad07bfSEdward Tomasz Napierala prison_racct_detach(struct prison *pr) 4974a7ad07bfSEdward Tomasz Napierala { 4975c34bbd2aSEdward Tomasz Napierala 49764b5c9cf6SEdward Tomasz Napierala ASSERT_RACCT_ENABLED(); 4977c34bbd2aSEdward Tomasz Napierala sx_assert(&allprison_lock, SA_UNLOCKED); 4978c34bbd2aSEdward Tomasz Napierala 4979af3c786cSMateusz Guzik if (pr->pr_prison_racct == NULL) 4980af3c786cSMateusz Guzik return; 4981a7ad07bfSEdward Tomasz Napierala prison_racct_free(pr->pr_prison_racct); 4982a7ad07bfSEdward Tomasz Napierala pr->pr_prison_racct = NULL; 4983a7ad07bfSEdward Tomasz Napierala } 4984a7ad07bfSEdward Tomasz Napierala #endif /* RACCT */ 4985a7ad07bfSEdward Tomasz Napierala 4986413628a7SBjoern A. Zeeb #ifdef DDB 4987b38ff370SJamie Gritton 4988b38ff370SJamie Gritton static void 4989b38ff370SJamie Gritton db_show_prison(struct prison *pr) 4990413628a7SBjoern A. Zeeb { 4991672756aaSJamie Gritton struct bool_flags *bf; 4992672756aaSJamie Gritton struct jailsys_flags *jsf; 4993b38ff370SJamie Gritton #if defined(INET) || defined(INET6) 4994b38ff370SJamie Gritton int ii; 4995500f82d6SZhenlei Huang struct prison_ip *pip; 4996413628a7SBjoern A. Zeeb #endif 4997672756aaSJamie Gritton unsigned f; 49988144690aSEric van Gyzen #ifdef INET 49998144690aSEric van Gyzen char ip4buf[INET_ADDRSTRLEN]; 50008144690aSEric van Gyzen #endif 5001413628a7SBjoern A. Zeeb #ifdef INET6 5002413628a7SBjoern A. Zeeb char ip6buf[INET6_ADDRSTRLEN]; 5003413628a7SBjoern A. Zeeb #endif 5004413628a7SBjoern A. Zeeb 5005b38ff370SJamie Gritton db_printf("prison %p:\n", pr); 5006b38ff370SJamie Gritton db_printf(" jid = %d\n", pr->pr_id); 5007b38ff370SJamie Gritton db_printf(" name = %s\n", pr->pr_name); 50080304c731SJamie Gritton db_printf(" parent = %p\n", pr->pr_parent); 5009b38ff370SJamie Gritton db_printf(" ref = %d\n", pr->pr_ref); 5010b38ff370SJamie Gritton db_printf(" uref = %d\n", pr->pr_uref); 50111158508aSJamie Gritton db_printf(" state = %s\n", 50121158508aSJamie Gritton pr->pr_state == PRISON_STATE_ALIVE ? "alive" : 50131158508aSJamie Gritton pr->pr_state == PRISON_STATE_DYING ? "dying" : 50141158508aSJamie Gritton "invalid"); 5015b38ff370SJamie Gritton db_printf(" path = %s\n", pr->pr_path); 5016b38ff370SJamie Gritton db_printf(" cpuset = %d\n", pr->pr_cpuset 5017b38ff370SJamie Gritton ? pr->pr_cpuset->cs_id : -1); 5018679e1390SJamie Gritton #ifdef VIMAGE 5019679e1390SJamie Gritton db_printf(" vnet = %p\n", pr->pr_vnet); 5020679e1390SJamie Gritton #endif 5021b38ff370SJamie Gritton db_printf(" root = %p\n", pr->pr_root); 5022b38ff370SJamie Gritton db_printf(" securelevel = %d\n", pr->pr_securelevel); 50230cc207a6SMartin Matuska db_printf(" devfs_rsnum = %d\n", pr->pr_devfs_rsnum); 5024fe0518e9SBjoern A. Zeeb db_printf(" children.max = %d\n", pr->pr_childmax); 5025fe0518e9SBjoern A. Zeeb db_printf(" children.cur = %d\n", pr->pr_childcount); 50260304c731SJamie Gritton db_printf(" child = %p\n", LIST_FIRST(&pr->pr_children)); 50270304c731SJamie Gritton db_printf(" sibling = %p\n", LIST_NEXT(pr, pr_sibling)); 5028fe0518e9SBjoern A. Zeeb db_printf(" flags = 0x%x", pr->pr_flags); 5029672756aaSJamie Gritton for (bf = pr_flag_bool; bf < pr_flag_bool + nitems(pr_flag_bool); bf++) 5030672756aaSJamie Gritton if (pr->pr_flags & bf->flag) 5031672756aaSJamie Gritton db_printf(" %s", bf->name); 5032672756aaSJamie Gritton for (jsf = pr_flag_jailsys; 5033672756aaSJamie Gritton jsf < pr_flag_jailsys + nitems(pr_flag_jailsys); 5034672756aaSJamie Gritton jsf++) { 5035672756aaSJamie Gritton f = pr->pr_flags & (jsf->disable | jsf->new); 5036672756aaSJamie Gritton db_printf(" %-16s= %s\n", jsf->name, 5037672756aaSJamie Gritton (f != 0 && f == jsf->disable) ? "disable" 5038672756aaSJamie Gritton : (f == jsf->new) ? "new" 50397cbf7213SJamie Gritton : "inherit"); 50407cbf7213SJamie Gritton } 5041fe0518e9SBjoern A. Zeeb db_printf(" allow = 0x%x", pr->pr_allow); 5042672756aaSJamie Gritton for (bf = pr_flag_allow; 50435d58f959SJamie Gritton bf < pr_flag_allow + nitems(pr_flag_allow) && 50445d58f959SJamie Gritton atomic_load_int(&bf->flag) != 0; 5045672756aaSJamie Gritton bf++) 5046672756aaSJamie Gritton if (pr->pr_allow & bf->flag) 5047672756aaSJamie Gritton db_printf(" %s", bf->name); 5048b38ff370SJamie Gritton db_printf("\n"); 50490304c731SJamie Gritton db_printf(" enforce_statfs = %d\n", pr->pr_enforce_statfs); 5050c1f19219SJamie Gritton db_printf(" host.hostname = %s\n", pr->pr_hostname); 5051c1f19219SJamie Gritton db_printf(" host.domainname = %s\n", pr->pr_domainname); 5052c1f19219SJamie Gritton db_printf(" host.hostuuid = %s\n", pr->pr_hostuuid); 505376ca6f88SJamie Gritton db_printf(" host.hostid = %lu\n", pr->pr_hostid); 5054413628a7SBjoern A. Zeeb #ifdef INET 5055500f82d6SZhenlei Huang if ((pip = pr->pr_addrs[PR_INET]) != NULL) { 5056500f82d6SZhenlei Huang db_printf(" ip4s = %d\n", pip->ips); 5057500f82d6SZhenlei Huang for (ii = 0; ii < pip->ips; ii++) 5058b38ff370SJamie Gritton db_printf(" %s %s\n", 5059fe0518e9SBjoern A. Zeeb ii == 0 ? "ip4.addr =" : " ", 5060eb8dcdeaSGleb Smirnoff inet_ntoa_r( 5061500f82d6SZhenlei Huang *(const struct in_addr *)PR_IP(pip, PR_INET, ii), 5062eb8dcdeaSGleb Smirnoff ip4buf)); 5063eb8dcdeaSGleb Smirnoff } 5064413628a7SBjoern A. Zeeb #endif 5065413628a7SBjoern A. Zeeb #ifdef INET6 5066500f82d6SZhenlei Huang if ((pip = pr->pr_addrs[PR_INET6]) != NULL) { 5067500f82d6SZhenlei Huang db_printf(" ip6s = %d\n", pip->ips); 5068500f82d6SZhenlei Huang for (ii = 0; ii < pip->ips; ii++) 5069b38ff370SJamie Gritton db_printf(" %s %s\n", 5070fe0518e9SBjoern A. Zeeb ii == 0 ? "ip6.addr =" : " ", 5071eb8dcdeaSGleb Smirnoff ip6_sprintf(ip6buf, 5072500f82d6SZhenlei Huang (const struct in6_addr *)PR_IP(pip, PR_INET6, ii))); 5073eb8dcdeaSGleb Smirnoff } 5074b38ff370SJamie Gritton #endif 5075b38ff370SJamie Gritton } 5076b38ff370SJamie Gritton 5077b38ff370SJamie Gritton DB_SHOW_COMMAND(prison, db_show_prison_command) 5078b38ff370SJamie Gritton { 5079b38ff370SJamie Gritton struct prison *pr; 5080b38ff370SJamie Gritton 5081b38ff370SJamie Gritton if (!have_addr) { 50820304c731SJamie Gritton /* 50830304c731SJamie Gritton * Show all prisons in the list, and prison0 which is not 50840304c731SJamie Gritton * listed. 50850304c731SJamie Gritton */ 50860304c731SJamie Gritton db_show_prison(&prison0); 50870304c731SJamie Gritton if (!db_pager_quit) { 5088b38ff370SJamie Gritton TAILQ_FOREACH(pr, &allprison, pr_list) { 5089b38ff370SJamie Gritton db_show_prison(pr); 5090413628a7SBjoern A. Zeeb if (db_pager_quit) 5091413628a7SBjoern A. Zeeb break; 5092413628a7SBjoern A. Zeeb } 50930304c731SJamie Gritton } 5094b38ff370SJamie Gritton return; 5095413628a7SBjoern A. Zeeb } 5096b38ff370SJamie Gritton 50970304c731SJamie Gritton if (addr == 0) 50980304c731SJamie Gritton pr = &prison0; 50990304c731SJamie Gritton else { 5100b38ff370SJamie Gritton /* Look for a prison with the ID and with references. */ 5101b38ff370SJamie Gritton TAILQ_FOREACH(pr, &allprison, pr_list) 5102b38ff370SJamie Gritton if (pr->pr_id == addr && pr->pr_ref > 0) 5103b38ff370SJamie Gritton break; 5104b38ff370SJamie Gritton if (pr == NULL) 5105b38ff370SJamie Gritton /* Look again, without requiring a reference. */ 5106b38ff370SJamie Gritton TAILQ_FOREACH(pr, &allprison, pr_list) 5107b38ff370SJamie Gritton if (pr->pr_id == addr) 5108b38ff370SJamie Gritton break; 5109b38ff370SJamie Gritton if (pr == NULL) 5110b38ff370SJamie Gritton /* Assume address points to a valid prison. */ 5111b38ff370SJamie Gritton pr = (struct prison *)addr; 51120304c731SJamie Gritton } 5113b38ff370SJamie Gritton db_show_prison(pr); 5114b38ff370SJamie Gritton } 5115b38ff370SJamie Gritton 5116413628a7SBjoern A. Zeeb #endif /* DDB */ 5117