xref: /freebsd/sys/kern/kern_jail.c (revision ddb3eb4efe55e57c206f3534263c77b837aff1dc)
19454b2d8SWarner Losh /*-
24d846d26SWarner Losh  * SPDX-License-Identifier: BSD-2-Clause
38a36da99SPedro F. Giffuni  *
4413628a7SBjoern A. Zeeb  * Copyright (c) 1999 Poul-Henning Kamp.
5413628a7SBjoern A. Zeeb  * Copyright (c) 2008 Bjoern A. Zeeb.
6b38ff370SJamie Gritton  * Copyright (c) 2009 James Gritton.
7413628a7SBjoern A. Zeeb  * All rights reserved.
8b9f0b66cSBjoern A. Zeeb  *
9b9f0b66cSBjoern A. Zeeb  * Redistribution and use in source and binary forms, with or without
10b9f0b66cSBjoern A. Zeeb  * modification, are permitted provided that the following conditions
11b9f0b66cSBjoern A. Zeeb  * are met:
12b9f0b66cSBjoern A. Zeeb  * 1. Redistributions of source code must retain the above copyright
13b9f0b66cSBjoern A. Zeeb  *    notice, this list of conditions and the following disclaimer.
14b9f0b66cSBjoern A. Zeeb  * 2. Redistributions in binary form must reproduce the above copyright
15b9f0b66cSBjoern A. Zeeb  *    notice, this list of conditions and the following disclaimer in the
16b9f0b66cSBjoern A. Zeeb  *    documentation and/or other materials provided with the distribution.
17b9f0b66cSBjoern A. Zeeb  *
18b9f0b66cSBjoern A. Zeeb  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19b9f0b66cSBjoern A. Zeeb  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20b9f0b66cSBjoern A. Zeeb  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21b9f0b66cSBjoern A. Zeeb  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22b9f0b66cSBjoern A. Zeeb  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23b9f0b66cSBjoern A. Zeeb  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24b9f0b66cSBjoern A. Zeeb  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25b9f0b66cSBjoern A. Zeeb  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26b9f0b66cSBjoern A. Zeeb  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27b9f0b66cSBjoern A. Zeeb  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28b9f0b66cSBjoern A. Zeeb  * SUCH DAMAGE.
2907901f22SPoul-Henning Kamp  */
3075c13541SPoul-Henning Kamp 
31677b542eSDavid E. O'Brien #include <sys/cdefs.h>
32413628a7SBjoern A. Zeeb #include "opt_ddb.h"
33413628a7SBjoern A. Zeeb #include "opt_inet.h"
34413628a7SBjoern A. Zeeb #include "opt_inet6.h"
35bba7a2e8SRick Macklem #include "opt_nfs.h"
3646e3b1cbSPawel Jakub Dawidek 
3775c13541SPoul-Henning Kamp #include <sys/param.h>
3875c13541SPoul-Henning Kamp #include <sys/types.h>
3975c13541SPoul-Henning Kamp #include <sys/kernel.h>
4075c13541SPoul-Henning Kamp #include <sys/systm.h>
4175c13541SPoul-Henning Kamp #include <sys/errno.h>
4275c13541SPoul-Henning Kamp #include <sys/sysproto.h>
4375c13541SPoul-Henning Kamp #include <sys/malloc.h>
440304c731SJamie Gritton #include <sys/osd.h>
45800c9408SRobert Watson #include <sys/priv.h>
4675c13541SPoul-Henning Kamp #include <sys/proc.h>
47eb8dcdeaSGleb Smirnoff #include <sys/epoch.h>
48b3059e09SRobert Watson #include <sys/taskqueue.h>
4957b4252eSKonstantin Belousov #include <sys/fcntl.h>
5075c13541SPoul-Henning Kamp #include <sys/jail.h>
51c3188289SKyle Evans #include <sys/linker.h>
5201137630SRobert Watson #include <sys/lock.h>
537060da62SJamie Gritton #include <sys/mman.h>
5401137630SRobert Watson #include <sys/mutex.h>
55097055e2SEdward Tomasz Napierala #include <sys/racct.h>
56f87beb93SAndriy Gapon #include <sys/rctl.h>
57a7ad07bfSEdward Tomasz Napierala #include <sys/refcount.h>
58dc68a633SPawel Jakub Dawidek #include <sys/sx.h>
5976ca6f88SJamie Gritton #include <sys/sysent.h>
60fd7a8150SMike Barcroft #include <sys/namei.h>
61820a0de9SPawel Jakub Dawidek #include <sys/mount.h>
62fd7a8150SMike Barcroft #include <sys/queue.h>
6375c13541SPoul-Henning Kamp #include <sys/socket.h>
64fd7a8150SMike Barcroft #include <sys/syscallsubr.h>
6583f1e257SRobert Watson #include <sys/sysctl.h>
66c3188289SKyle Evans #include <sys/uuid.h>
67fd7a8150SMike Barcroft #include <sys/vnode.h>
68530c0060SRobert Watson 
6975c13541SPoul-Henning Kamp #include <net/if.h>
70530c0060SRobert Watson #include <net/vnet.h>
71530c0060SRobert Watson 
7275c13541SPoul-Henning Kamp #include <netinet/in.h>
73530c0060SRobert Watson 
74413628a7SBjoern A. Zeeb #ifdef DDB
75413628a7SBjoern A. Zeeb #include <ddb/ddb.h>
76413628a7SBjoern A. Zeeb #endif /* DDB */
7775c13541SPoul-Henning Kamp 
78aed55708SRobert Watson #include <security/mac/mac_framework.h>
79aed55708SRobert Watson 
80c3188289SKyle Evans #define	PRISON0_HOSTUUID_MODULE	"hostuuid"
818986e3a0SJamie Gritton 
8275c13541SPoul-Henning Kamp MALLOC_DEFINE(M_PRISON, "prison", "Prison structures");
83d745c852SEd Schouten static MALLOC_DEFINE(M_PRISON_RACCT, "prison_racct", "Prison racct structures");
8475c13541SPoul-Henning Kamp 
85592bcae8SBjoern A. Zeeb /* Keep struct prison prison0 and some code in kern_jail_set() readable. */
86592bcae8SBjoern A. Zeeb #ifdef INET
87592bcae8SBjoern A. Zeeb #ifdef INET6
88592bcae8SBjoern A. Zeeb #define	_PR_IP_SADDRSEL	PR_IP4_SADDRSEL|PR_IP6_SADDRSEL
89592bcae8SBjoern A. Zeeb #else
90592bcae8SBjoern A. Zeeb #define	_PR_IP_SADDRSEL	PR_IP4_SADDRSEL
91592bcae8SBjoern A. Zeeb #endif
92592bcae8SBjoern A. Zeeb #else /* !INET */
93592bcae8SBjoern A. Zeeb #ifdef INET6
94592bcae8SBjoern A. Zeeb #define	_PR_IP_SADDRSEL	PR_IP6_SADDRSEL
95592bcae8SBjoern A. Zeeb #else
96592bcae8SBjoern A. Zeeb #define	_PR_IP_SADDRSEL	0
97592bcae8SBjoern A. Zeeb #endif
98592bcae8SBjoern A. Zeeb #endif
99592bcae8SBjoern A. Zeeb 
1000304c731SJamie Gritton /* prison0 describes what is "real" about the system. */
1010304c731SJamie Gritton struct prison prison0 = {
1020304c731SJamie Gritton 	.pr_id		= 0,
1030304c731SJamie Gritton 	.pr_name	= "0",
1040304c731SJamie Gritton 	.pr_ref		= 1,
1050304c731SJamie Gritton 	.pr_uref	= 1,
1060304c731SJamie Gritton 	.pr_path	= "/",
1070304c731SJamie Gritton 	.pr_securelevel	= -1,
1080cc207a6SMartin Matuska 	.pr_devfs_rsnum = 0,
1091158508aSJamie Gritton 	.pr_state	= PRISON_STATE_ALIVE,
110b97457e2SJamie Gritton 	.pr_childmax	= JAIL_MAX,
1118986e3a0SJamie Gritton 	.pr_hostuuid	= DEFAULT_HOSTUUID,
11213e403fdSAntoine Brodin 	.pr_children	= LIST_HEAD_INITIALIZER(prison0.pr_children),
113eb79e1c7SBjoern A. Zeeb #ifdef VIMAGE
114592bcae8SBjoern A. Zeeb 	.pr_flags	= PR_HOST|PR_VNET|_PR_IP_SADDRSEL,
115eb79e1c7SBjoern A. Zeeb #else
116592bcae8SBjoern A. Zeeb 	.pr_flags	= PR_HOST|_PR_IP_SADDRSEL,
117eb79e1c7SBjoern A. Zeeb #endif
1180e5c6bd4SJamie Gritton 	.pr_allow	= PR_ALLOW_ALL_STATIC,
1190304c731SJamie Gritton };
1200304c731SJamie Gritton MTX_SYSINIT(prison0, &prison0.pr_mtx, "jail mutex", MTX_DEF);
12183f1e257SRobert Watson 
122672756aaSJamie Gritton struct bool_flags {
123672756aaSJamie Gritton 	const char	*name;
124672756aaSJamie Gritton 	const char	*noname;
1255d58f959SJamie Gritton 	volatile u_int	 flag;
126672756aaSJamie Gritton };
127672756aaSJamie Gritton struct jailsys_flags {
128672756aaSJamie Gritton 	const char	*name;
129672756aaSJamie Gritton 	unsigned	 disable;
130672756aaSJamie Gritton 	unsigned	 new;
131672756aaSJamie Gritton };
132672756aaSJamie Gritton 
133a7ad07bfSEdward Tomasz Napierala /* allprison, allprison_racct and lastprid are protected by allprison_lock. */
134dc68a633SPawel Jakub Dawidek struct	sx allprison_lock;
135b38ff370SJamie Gritton SX_SYSINIT(allprison_lock, &allprison_lock, "allprison");
136b38ff370SJamie Gritton struct	prisonlist allprison = TAILQ_HEAD_INITIALIZER(allprison);
137a7ad07bfSEdward Tomasz Napierala LIST_HEAD(, prison_racct) allprison_racct;
1382110d913SXin LI int	lastprid = 0;
139ed31b3f4SJamie Gritton int	lastdeadid = 0;
140fd7a8150SMike Barcroft 
1417de883c8SJamie Gritton static int get_next_prid(struct prison **insprp);
142ed31b3f4SJamie Gritton static int get_next_deadid(struct prison **insprp);
143f7496dcaSJamie Gritton static int do_jail_attach(struct thread *td, struct prison *pr, int drflags);
144b3059e09SRobert Watson static void prison_complete(void *context, int pending);
145b38ff370SJamie Gritton static void prison_deref(struct prison *pr, int flags);
146c861373bSJamie Gritton static void prison_deref_kill(struct prison *pr, struct prisonlist *freeprison);
147f7496dcaSJamie Gritton static int prison_lock_xlock(struct prison *pr, int flags);
148a9f7455cSJamie Gritton static void prison_cleanup(struct prison *pr);
149f7496dcaSJamie Gritton static void prison_free_not_last(struct prison *pr);
150c861373bSJamie Gritton static void prison_proc_free_not_last(struct prison *pr);
1515ecb5444SMateusz Guzik static void prison_proc_relink(struct prison *opr, struct prison *npr,
1525ecb5444SMateusz Guzik     struct proc *p);
1530fe74ae6SJamie Gritton static void prison_set_allow_locked(struct prison *pr, unsigned flag,
1540fe74ae6SJamie Gritton     int enable);
1550304c731SJamie Gritton static char *prison_path(struct prison *pr1, struct prison *pr2);
156a7ad07bfSEdward Tomasz Napierala #ifdef RACCT
157a7ad07bfSEdward Tomasz Napierala static void prison_racct_attach(struct prison *pr);
158c34bbd2aSEdward Tomasz Napierala static void prison_racct_modify(struct prison *pr);
159a7ad07bfSEdward Tomasz Napierala static void prison_racct_detach(struct prison *pr);
160a7ad07bfSEdward Tomasz Napierala #endif
161fd7a8150SMike Barcroft 
162b38ff370SJamie Gritton /* Flags for prison_deref */
1632a4b2251SJamie Gritton #define	PD_DEREF	0x01	/* Decrement pr_ref */
1642a4b2251SJamie Gritton #define	PD_DEUREF	0x02	/* Decrement pr_uref */
165c861373bSJamie Gritton #define	PD_KILL		0x04	/* Remove jail, kill processes, etc */
166c861373bSJamie Gritton #define	PD_LOCKED	0x10	/* pr_mtx is held */
167c861373bSJamie Gritton #define	PD_LIST_SLOCKED	0x20	/* allprison_lock is held shared */
168c861373bSJamie Gritton #define	PD_LIST_XLOCKED	0x40	/* allprison_lock is held exclusive */
169589e4c1dSJamie Gritton #define PD_OP_FLAGS	0x07	/* Operation flags */
170589e4c1dSJamie Gritton #define PD_LOCK_FLAGS	0x70	/* Lock status flags */
171fd7a8150SMike Barcroft 
1720304c731SJamie Gritton /*
1735cc70397SBjoern A. Zeeb  * Parameter names corresponding to PR_* flag values.  Size values are for kvm
1745cc70397SBjoern A. Zeeb  * as we cannot figure out the size of a sparse array, or an array without a
1755cc70397SBjoern A. Zeeb  * terminating entry.
1760304c731SJamie Gritton  */
177672756aaSJamie Gritton static struct bool_flags pr_flag_bool[] = {
178672756aaSJamie Gritton 	{"persist", "nopersist", PR_PERSIST},
179592bcae8SBjoern A. Zeeb #ifdef INET
180672756aaSJamie Gritton 	{"ip4.saddrsel", "ip4.nosaddrsel", PR_IP4_SADDRSEL},
181592bcae8SBjoern A. Zeeb #endif
182592bcae8SBjoern A. Zeeb #ifdef INET6
183672756aaSJamie Gritton 	{"ip6.saddrsel", "ip6.nosaddrsel", PR_IP6_SADDRSEL},
184592bcae8SBjoern A. Zeeb #endif
1850304c731SJamie Gritton };
186672756aaSJamie Gritton const size_t pr_flag_bool_size = sizeof(pr_flag_bool);
1870304c731SJamie Gritton 
188672756aaSJamie Gritton static struct jailsys_flags pr_flag_jailsys[] = {
1897cbf7213SJamie Gritton 	{"host", 0, PR_HOST},
1907cbf7213SJamie Gritton #ifdef VIMAGE
1917cbf7213SJamie Gritton 	{"vnet", 0, PR_VNET},
1927cbf7213SJamie Gritton #endif
1930304c731SJamie Gritton #ifdef INET
1946a3f2779SJamie Gritton 	{"ip4", PR_IP4_USER, PR_IP4_USER},
1950304c731SJamie Gritton #endif
1960304c731SJamie Gritton #ifdef INET6
1976a3f2779SJamie Gritton 	{"ip6", PR_IP6_USER, PR_IP6_USER},
198679e1390SJamie Gritton #endif
1990304c731SJamie Gritton };
2005cc70397SBjoern A. Zeeb const size_t pr_flag_jailsys_size = sizeof(pr_flag_jailsys);
2010304c731SJamie Gritton 
2025d58f959SJamie Gritton /*
2035d58f959SJamie Gritton  * Make this array full-size so dynamic parameters can be added.
2045d58f959SJamie Gritton  * It is protected by prison0.mtx, but lockless reading is allowed
2055d58f959SJamie Gritton  * with an atomic check of the flag values.
2065d58f959SJamie Gritton  */
2070e5c6bd4SJamie Gritton static struct bool_flags pr_flag_allow[NBBY * NBPW] = {
208672756aaSJamie Gritton 	{"allow.set_hostname", "allow.noset_hostname", PR_ALLOW_SET_HOSTNAME},
209672756aaSJamie Gritton 	{"allow.sysvipc", "allow.nosysvipc", PR_ALLOW_SYSVIPC},
210672756aaSJamie Gritton 	{"allow.raw_sockets", "allow.noraw_sockets", PR_ALLOW_RAW_SOCKETS},
211672756aaSJamie Gritton 	{"allow.chflags", "allow.nochflags", PR_ALLOW_CHFLAGS},
212672756aaSJamie Gritton 	{"allow.mount", "allow.nomount", PR_ALLOW_MOUNT},
213672756aaSJamie Gritton 	{"allow.quotas", "allow.noquotas", PR_ALLOW_QUOTAS},
214672756aaSJamie Gritton 	{"allow.socket_af", "allow.nosocket_af", PR_ALLOW_SOCKET_AF},
215ccd6ac9fSAntoine Brodin 	{"allow.mlock", "allow.nomlock", PR_ALLOW_MLOCK},
216672756aaSJamie Gritton 	{"allow.reserved_ports", "allow.noreserved_ports",
217672756aaSJamie Gritton 	 PR_ALLOW_RESERVED_PORTS},
218b19d66fdSJamie Gritton 	{"allow.read_msgbuf", "allow.noread_msgbuf", PR_ALLOW_READ_MSGBUF},
219b3079544SJamie Gritton 	{"allow.unprivileged_proc_debug", "allow.nounprivileged_proc_debug",
220b3079544SJamie Gritton 	 PR_ALLOW_UNPRIV_DEBUG},
22105e1e482SMariusz Zaborski 	{"allow.suser", "allow.nosuser", PR_ALLOW_SUSER},
222cbbb2203SRick Macklem #ifdef VIMAGE
223bba7a2e8SRick Macklem 	{"allow.nfsd", "allow.nonfsd", PR_ALLOW_NFSD},
224bba7a2e8SRick Macklem #endif
225cb48780dSShawn Webb 	{"allow.extattr", "allow.noextattr", PR_ALLOW_EXTATTR},
226d3bb35d4SMariusz Zaborski 	{"allow.adjtime", "allow.noadjtime", PR_ALLOW_ADJTIME},
227d3bb35d4SMariusz Zaborski 	{"allow.settime", "allow.nosettime", PR_ALLOW_SETTIME},
2280304c731SJamie Gritton };
2295d58f959SJamie Gritton static unsigned pr_allow_all = PR_ALLOW_ALL_STATIC;
230672756aaSJamie Gritton const size_t pr_flag_allow_size = sizeof(pr_flag_allow);
2310304c731SJamie Gritton 
232b3079544SJamie Gritton #define	JAIL_DEFAULT_ALLOW		(PR_ALLOW_SET_HOSTNAME | \
233b3079544SJamie Gritton 					 PR_ALLOW_RESERVED_PORTS | \
23405e1e482SMariusz Zaborski 					 PR_ALLOW_UNPRIV_DEBUG | \
23505e1e482SMariusz Zaborski 					 PR_ALLOW_SUSER)
23642bebd82SJamie Gritton #define	JAIL_DEFAULT_ENFORCE_STATFS	2
237bf3db8aaSMartin Matuska #define	JAIL_DEFAULT_DEVFS_RSNUM	0
2380304c731SJamie Gritton static unsigned jail_default_allow = JAIL_DEFAULT_ALLOW;
23942bebd82SJamie Gritton static int jail_default_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS;
2400cc207a6SMartin Matuska static int jail_default_devfs_rsnum = JAIL_DEFAULT_DEVFS_RSNUM;
2410304c731SJamie Gritton #if defined(INET) || defined(INET6)
242e92e0574SJamie Gritton static unsigned jail_max_af_ips = 255;
2430304c731SJamie Gritton #endif
2440304c731SJamie Gritton 
245b96bd95bSIan Lepore /*
246b96bd95bSIan Lepore  * Initialize the parts of prison0 that can't be static-initialized with
247b96bd95bSIan Lepore  * constants.  This is called from proc0_init() after creating thread0 cpuset.
248b96bd95bSIan Lepore  */
249b96bd95bSIan Lepore void
250b96bd95bSIan Lepore prison0_init(void)
251b96bd95bSIan Lepore {
252c3188289SKyle Evans 	uint8_t *file, *data;
253c3188289SKyle Evans 	size_t size;
254d2ef3774SJessica Clarke 	char buf[sizeof(prison0.pr_hostuuid)];
255d2ef3774SJessica Clarke 	bool valid;
256b96bd95bSIan Lepore 
257b96bd95bSIan Lepore 	prison0.pr_cpuset = cpuset_ref(thread0.td_cpuset);
258b96bd95bSIan Lepore 	prison0.pr_osreldate = osreldate;
259b96bd95bSIan Lepore 	strlcpy(prison0.pr_osrelease, osrelease, sizeof(prison0.pr_osrelease));
260c3188289SKyle Evans 
261c3188289SKyle Evans 	/* If we have a preloaded hostuuid, use it. */
262c3188289SKyle Evans 	file = preload_search_by_type(PRISON0_HOSTUUID_MODULE);
263c3188289SKyle Evans 	if (file != NULL) {
264c3188289SKyle Evans 		data = preload_fetch_addr(file);
265c3188289SKyle Evans 		size = preload_fetch_size(file);
266c3188289SKyle Evans 		if (data != NULL) {
267c3188289SKyle Evans 			/*
268c3188289SKyle Evans 			 * The preloaded data may include trailing whitespace, almost
269c3188289SKyle Evans 			 * certainly a newline; skip over any whitespace or
270c3188289SKyle Evans 			 * non-printable characters to be safe.
271c3188289SKyle Evans 			 */
272c3188289SKyle Evans 			while (size > 0 && data[size - 1] <= 0x20) {
273b6be9566SColin Percival 				size--;
274c3188289SKyle Evans 			}
275d2ef3774SJessica Clarke 
276d2ef3774SJessica Clarke 			valid = false;
277d2ef3774SJessica Clarke 
278d2ef3774SJessica Clarke 			/*
279d2ef3774SJessica Clarke 			 * Not NUL-terminated when passed from loader, but
280d2ef3774SJessica Clarke 			 * validate_uuid requires that due to using sscanf (as
281d2ef3774SJessica Clarke 			 * does the subsequent strlcpy, since it still reads
282d2ef3774SJessica Clarke 			 * past the given size to return the true length);
283d2ef3774SJessica Clarke 			 * bounce to a temporary buffer to fix.
284d2ef3774SJessica Clarke 			 */
285d2ef3774SJessica Clarke 			if (size >= sizeof(buf))
286d2ef3774SJessica Clarke 				goto done;
287d2ef3774SJessica Clarke 
288d2ef3774SJessica Clarke 			memcpy(buf, data, size);
289d2ef3774SJessica Clarke 			buf[size] = '\0';
290d2ef3774SJessica Clarke 
291d2ef3774SJessica Clarke 			if (validate_uuid(buf, size, NULL, 0) != 0)
292d2ef3774SJessica Clarke 				goto done;
293d2ef3774SJessica Clarke 
294d2ef3774SJessica Clarke 			valid = true;
295d2ef3774SJessica Clarke 			(void)strlcpy(prison0.pr_hostuuid, buf,
296d2ef3774SJessica Clarke 			    sizeof(prison0.pr_hostuuid));
297d2ef3774SJessica Clarke 
298d2ef3774SJessica Clarke done:
299d2ef3774SJessica Clarke 			if (bootverbose && !valid) {
300330f110bSColin Percival 				printf("hostuuid: preload data malformed: '%.*s'\n",
301330f110bSColin Percival 				    (int)size, data);
302c3188289SKyle Evans 			}
303c3188289SKyle Evans 		}
304c3188289SKyle Evans 	}
305c3188289SKyle Evans 	if (bootverbose)
306c3188289SKyle Evans 		printf("hostuuid: using %s\n", prison0.pr_hostuuid);
307b96bd95bSIan Lepore }
308b96bd95bSIan Lepore 
309116734c4SMatthew Dillon /*
3109ddb7954SMike Barcroft  * struct jail_args {
3119ddb7954SMike Barcroft  *	struct jail *jail;
3129ddb7954SMike Barcroft  * };
313116734c4SMatthew Dillon  */
31475c13541SPoul-Henning Kamp int
315c542c43eSJamie Gritton sys_jail(struct thread *td, struct jail_args *uap)
31675c13541SPoul-Henning Kamp {
317413628a7SBjoern A. Zeeb 	uint32_t version;
318413628a7SBjoern A. Zeeb 	int error;
3190304c731SJamie Gritton 	struct jail j;
320413628a7SBjoern A. Zeeb 
321413628a7SBjoern A. Zeeb 	error = copyin(uap->jail, &version, sizeof(uint32_t));
322413628a7SBjoern A. Zeeb 	if (error)
323413628a7SBjoern A. Zeeb 		return (error);
324413628a7SBjoern A. Zeeb 
325413628a7SBjoern A. Zeeb 	switch (version) {
326413628a7SBjoern A. Zeeb 	case 0:
327413628a7SBjoern A. Zeeb 	{
328413628a7SBjoern A. Zeeb 		struct jail_v0 j0;
329413628a7SBjoern A. Zeeb 
3300304c731SJamie Gritton 		/* FreeBSD single IPv4 jails. */
3310304c731SJamie Gritton 		bzero(&j, sizeof(struct jail));
332413628a7SBjoern A. Zeeb 		error = copyin(uap->jail, &j0, sizeof(struct jail_v0));
333413628a7SBjoern A. Zeeb 		if (error)
334413628a7SBjoern A. Zeeb 			return (error);
3350304c731SJamie Gritton 		j.version = j0.version;
3360304c731SJamie Gritton 		j.path = j0.path;
3370304c731SJamie Gritton 		j.hostname = j0.hostname;
338b5019bc4SPeter Wemm 		j.ip4s = htonl(j0.ip_number);	/* jail_v0 is host order */
339413628a7SBjoern A. Zeeb 		break;
340413628a7SBjoern A. Zeeb 	}
341413628a7SBjoern A. Zeeb 
342413628a7SBjoern A. Zeeb 	case 1:
343413628a7SBjoern A. Zeeb 		/*
344413628a7SBjoern A. Zeeb 		 * Version 1 was used by multi-IPv4 jail implementations
345413628a7SBjoern A. Zeeb 		 * that never made it into the official kernel.
346413628a7SBjoern A. Zeeb 		 */
347413628a7SBjoern A. Zeeb 		return (EINVAL);
348413628a7SBjoern A. Zeeb 
349413628a7SBjoern A. Zeeb 	case 2:	/* JAIL_API_VERSION */
350413628a7SBjoern A. Zeeb 		/* FreeBSD multi-IPv4/IPv6,noIP jails. */
351413628a7SBjoern A. Zeeb 		error = copyin(uap->jail, &j, sizeof(struct jail));
352413628a7SBjoern A. Zeeb 		if (error)
353413628a7SBjoern A. Zeeb 			return (error);
3540304c731SJamie Gritton 		break;
3550304c731SJamie Gritton 
3560304c731SJamie Gritton 	default:
3570304c731SJamie Gritton 		/* Sci-Fi jails are not supported, sorry. */
3580304c731SJamie Gritton 		return (EINVAL);
3590304c731SJamie Gritton 	}
360c542c43eSJamie Gritton 	return (kern_jail(td, &j));
3610304c731SJamie Gritton }
3620304c731SJamie Gritton 
3630304c731SJamie Gritton int
364c542c43eSJamie Gritton kern_jail(struct thread *td, struct jail *j)
3650304c731SJamie Gritton {
366c542c43eSJamie Gritton 	struct iovec optiov[2 * (4 + nitems(pr_flag_allow)
367e92e0574SJamie Gritton #ifdef INET
368e92e0574SJamie Gritton 			    + 1
369e92e0574SJamie Gritton #endif
370e92e0574SJamie Gritton #ifdef INET6
371e92e0574SJamie Gritton 			    + 1
372e92e0574SJamie Gritton #endif
373e92e0574SJamie Gritton 			    )];
3740304c731SJamie Gritton 	struct uio opt;
3750304c731SJamie Gritton 	char *u_path, *u_hostname, *u_name;
376672756aaSJamie Gritton 	struct bool_flags *bf;
3770304c731SJamie Gritton #ifdef INET
378e92e0574SJamie Gritton 	uint32_t ip4s;
3790304c731SJamie Gritton 	struct in_addr *u_ip4;
3800304c731SJamie Gritton #endif
3810304c731SJamie Gritton #ifdef INET6
3820304c731SJamie Gritton 	struct in6_addr *u_ip6;
3830304c731SJamie Gritton #endif
3840304c731SJamie Gritton 	size_t tmplen;
385c542c43eSJamie Gritton 	int error, enforce_statfs;
3860304c731SJamie Gritton 
3870304c731SJamie Gritton 	bzero(&optiov, sizeof(optiov));
3880304c731SJamie Gritton 	opt.uio_iov = optiov;
3890304c731SJamie Gritton 	opt.uio_iovcnt = 0;
3900304c731SJamie Gritton 	opt.uio_offset = -1;
3910304c731SJamie Gritton 	opt.uio_resid = -1;
3920304c731SJamie Gritton 	opt.uio_segflg = UIO_SYSSPACE;
3930304c731SJamie Gritton 	opt.uio_rw = UIO_READ;
3940304c731SJamie Gritton 	opt.uio_td = td;
3950304c731SJamie Gritton 
3960304c731SJamie Gritton 	/* Set permissions for top-level jails from sysctls. */
3970304c731SJamie Gritton 	if (!jailed(td->td_ucred)) {
398672756aaSJamie Gritton 		for (bf = pr_flag_allow;
3990e5c6bd4SJamie Gritton 		     bf < pr_flag_allow + nitems(pr_flag_allow) &&
4005d58f959SJamie Gritton 			atomic_load_int(&bf->flag) != 0;
401672756aaSJamie Gritton 		     bf++) {
402672756aaSJamie Gritton 			optiov[opt.uio_iovcnt].iov_base = __DECONST(char *,
403672756aaSJamie Gritton 			    (jail_default_allow & bf->flag)
404672756aaSJamie Gritton 			    ? bf->name : bf->noname);
4050304c731SJamie Gritton 			optiov[opt.uio_iovcnt].iov_len =
4060304c731SJamie Gritton 			    strlen(optiov[opt.uio_iovcnt].iov_base) + 1;
4070304c731SJamie Gritton 			opt.uio_iovcnt += 2;
4080304c731SJamie Gritton 		}
4090304c731SJamie Gritton 		optiov[opt.uio_iovcnt].iov_base = "enforce_statfs";
4100304c731SJamie Gritton 		optiov[opt.uio_iovcnt].iov_len = sizeof("enforce_statfs");
4110304c731SJamie Gritton 		opt.uio_iovcnt++;
4120304c731SJamie Gritton 		enforce_statfs = jail_default_enforce_statfs;
4130304c731SJamie Gritton 		optiov[opt.uio_iovcnt].iov_base = &enforce_statfs;
4140304c731SJamie Gritton 		optiov[opt.uio_iovcnt].iov_len = sizeof(enforce_statfs);
4150304c731SJamie Gritton 		opt.uio_iovcnt++;
4160304c731SJamie Gritton 	}
4170304c731SJamie Gritton 
418b38ff370SJamie Gritton 	tmplen = MAXPATHLEN + MAXHOSTNAMELEN + MAXHOSTNAMELEN;
419b38ff370SJamie Gritton #ifdef INET
4200304c731SJamie Gritton 	ip4s = (j->version == 0) ? 1 : j->ip4s;
4210304c731SJamie Gritton 	if (ip4s > jail_max_af_ips)
422b38ff370SJamie Gritton 		return (EINVAL);
4230304c731SJamie Gritton 	tmplen += ip4s * sizeof(struct in_addr);
424b38ff370SJamie Gritton #else
4250304c731SJamie Gritton 	if (j->ip4s > 0)
426b38ff370SJamie Gritton 		return (EINVAL);
427b38ff370SJamie Gritton #endif
428b38ff370SJamie Gritton #ifdef INET6
4290304c731SJamie Gritton 	if (j->ip6s > jail_max_af_ips)
430b38ff370SJamie Gritton 		return (EINVAL);
4310304c731SJamie Gritton 	tmplen += j->ip6s * sizeof(struct in6_addr);
432b38ff370SJamie Gritton #else
4330304c731SJamie Gritton 	if (j->ip6s > 0)
434b38ff370SJamie Gritton 		return (EINVAL);
435b38ff370SJamie Gritton #endif
436b38ff370SJamie Gritton 	u_path = malloc(tmplen, M_TEMP, M_WAITOK);
437b38ff370SJamie Gritton 	u_hostname = u_path + MAXPATHLEN;
438b38ff370SJamie Gritton 	u_name = u_hostname + MAXHOSTNAMELEN;
439b38ff370SJamie Gritton #ifdef INET
440b38ff370SJamie Gritton 	u_ip4 = (struct in_addr *)(u_name + MAXHOSTNAMELEN);
441b38ff370SJamie Gritton #endif
442b38ff370SJamie Gritton #ifdef INET6
443b38ff370SJamie Gritton #ifdef INET
4440304c731SJamie Gritton 	u_ip6 = (struct in6_addr *)(u_ip4 + ip4s);
445b38ff370SJamie Gritton #else
446b38ff370SJamie Gritton 	u_ip6 = (struct in6_addr *)(u_name + MAXHOSTNAMELEN);
447b38ff370SJamie Gritton #endif
448b38ff370SJamie Gritton #endif
4490304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = "path";
4500304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = sizeof("path");
4510304c731SJamie Gritton 	opt.uio_iovcnt++;
4520304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = u_path;
4530304c731SJamie Gritton 	error = copyinstr(j->path, u_path, MAXPATHLEN,
4540304c731SJamie Gritton 	    &optiov[opt.uio_iovcnt].iov_len);
455b38ff370SJamie Gritton 	if (error) {
456b38ff370SJamie Gritton 		free(u_path, M_TEMP);
457b38ff370SJamie Gritton 		return (error);
458b38ff370SJamie Gritton 	}
4590304c731SJamie Gritton 	opt.uio_iovcnt++;
4600304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = "host.hostname";
4610304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = sizeof("host.hostname");
4620304c731SJamie Gritton 	opt.uio_iovcnt++;
4630304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = u_hostname;
4640304c731SJamie Gritton 	error = copyinstr(j->hostname, u_hostname, MAXHOSTNAMELEN,
4650304c731SJamie Gritton 	    &optiov[opt.uio_iovcnt].iov_len);
466b38ff370SJamie Gritton 	if (error) {
467b38ff370SJamie Gritton 		free(u_path, M_TEMP);
468b38ff370SJamie Gritton 		return (error);
469b38ff370SJamie Gritton 	}
4700304c731SJamie Gritton 	opt.uio_iovcnt++;
4710304c731SJamie Gritton 	if (j->jailname != NULL) {
472b38ff370SJamie Gritton 		optiov[opt.uio_iovcnt].iov_base = "name";
473b38ff370SJamie Gritton 		optiov[opt.uio_iovcnt].iov_len = sizeof("name");
474b38ff370SJamie Gritton 		opt.uio_iovcnt++;
475b38ff370SJamie Gritton 		optiov[opt.uio_iovcnt].iov_base = u_name;
4760304c731SJamie Gritton 		error = copyinstr(j->jailname, u_name, MAXHOSTNAMELEN,
477b38ff370SJamie Gritton 		    &optiov[opt.uio_iovcnt].iov_len);
478b38ff370SJamie Gritton 		if (error) {
479b38ff370SJamie Gritton 			free(u_path, M_TEMP);
480b38ff370SJamie Gritton 			return (error);
481b38ff370SJamie Gritton 		}
482b38ff370SJamie Gritton 		opt.uio_iovcnt++;
483b38ff370SJamie Gritton 	}
484b38ff370SJamie Gritton #ifdef INET
485b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = "ip4.addr";
486b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = sizeof("ip4.addr");
487b38ff370SJamie Gritton 	opt.uio_iovcnt++;
488b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = u_ip4;
4890304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = ip4s * sizeof(struct in_addr);
4900304c731SJamie Gritton 	if (j->version == 0)
4910304c731SJamie Gritton 		u_ip4->s_addr = j->ip4s;
4920304c731SJamie Gritton 	else {
4930304c731SJamie Gritton 		error = copyin(j->ip4, u_ip4, optiov[opt.uio_iovcnt].iov_len);
494b38ff370SJamie Gritton 		if (error) {
495b38ff370SJamie Gritton 			free(u_path, M_TEMP);
496b38ff370SJamie Gritton 			return (error);
497b38ff370SJamie Gritton 		}
4980304c731SJamie Gritton 	}
499b38ff370SJamie Gritton 	opt.uio_iovcnt++;
500b38ff370SJamie Gritton #endif
501b38ff370SJamie Gritton #ifdef INET6
502b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = "ip6.addr";
503b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = sizeof("ip6.addr");
504b38ff370SJamie Gritton 	opt.uio_iovcnt++;
505b38ff370SJamie Gritton 	optiov[opt.uio_iovcnt].iov_base = u_ip6;
5060304c731SJamie Gritton 	optiov[opt.uio_iovcnt].iov_len = j->ip6s * sizeof(struct in6_addr);
5070304c731SJamie Gritton 	error = copyin(j->ip6, u_ip6, optiov[opt.uio_iovcnt].iov_len);
508b38ff370SJamie Gritton 	if (error) {
509b38ff370SJamie Gritton 		free(u_path, M_TEMP);
510b38ff370SJamie Gritton 		return (error);
511b38ff370SJamie Gritton 	}
512b38ff370SJamie Gritton 	opt.uio_iovcnt++;
513b38ff370SJamie Gritton #endif
51402abd400SPedro F. Giffuni 	KASSERT(opt.uio_iovcnt <= nitems(optiov),
5150304c731SJamie Gritton 		("kern_jail: too many iovecs (%d)", opt.uio_iovcnt));
516b38ff370SJamie Gritton 	error = kern_jail_set(td, &opt, JAIL_CREATE | JAIL_ATTACH);
517b38ff370SJamie Gritton 	free(u_path, M_TEMP);
518b38ff370SJamie Gritton 	return (error);
519b38ff370SJamie Gritton }
520b38ff370SJamie Gritton 
521b38ff370SJamie Gritton /*
522b38ff370SJamie Gritton  * struct jail_set_args {
523b38ff370SJamie Gritton  *	struct iovec *iovp;
524b38ff370SJamie Gritton  *	unsigned int iovcnt;
525b38ff370SJamie Gritton  *	int flags;
526b38ff370SJamie Gritton  * };
527b38ff370SJamie Gritton  */
528b38ff370SJamie Gritton int
5298451d0ddSKip Macy sys_jail_set(struct thread *td, struct jail_set_args *uap)
530b38ff370SJamie Gritton {
531b38ff370SJamie Gritton 	struct uio *auio;
532b38ff370SJamie Gritton 	int error;
533b38ff370SJamie Gritton 
534b38ff370SJamie Gritton 	/* Check that we have an even number of iovecs. */
535b38ff370SJamie Gritton 	if (uap->iovcnt & 1)
536b38ff370SJamie Gritton 		return (EINVAL);
537b38ff370SJamie Gritton 
538b38ff370SJamie Gritton 	error = copyinuio(uap->iovp, uap->iovcnt, &auio);
539b38ff370SJamie Gritton 	if (error)
540b38ff370SJamie Gritton 		return (error);
541b38ff370SJamie Gritton 	error = kern_jail_set(td, auio, uap->flags);
54261cc4830SAlfredo Mazzinghi 	freeuio(auio);
543b38ff370SJamie Gritton 	return (error);
544413628a7SBjoern A. Zeeb }
545413628a7SBjoern A. Zeeb 
546eb8dcdeaSGleb Smirnoff #if defined(INET) || defined(INET6)
547eb8dcdeaSGleb Smirnoff typedef int prison_addr_cmp_t(const void *, const void *);
548eb8dcdeaSGleb Smirnoff typedef bool prison_addr_valid_t(const void *);
549eb8dcdeaSGleb Smirnoff static const struct pr_family {
550eb8dcdeaSGleb Smirnoff 	size_t			size;
551eb8dcdeaSGleb Smirnoff 	prison_addr_cmp_t	*cmp;
552eb8dcdeaSGleb Smirnoff 	prison_addr_valid_t	*valid;
553eb8dcdeaSGleb Smirnoff 	int			ip_flag;
554eb8dcdeaSGleb Smirnoff } pr_families[PR_FAMILY_MAX] = {
555eb8dcdeaSGleb Smirnoff #ifdef INET
556eb8dcdeaSGleb Smirnoff 	[PR_INET] = {
557eb8dcdeaSGleb Smirnoff 		.size = sizeof(struct in_addr),
558eb8dcdeaSGleb Smirnoff 		.cmp = prison_qcmp_v4,
559eb8dcdeaSGleb Smirnoff 		.valid = prison_valid_v4,
560eb8dcdeaSGleb Smirnoff 		.ip_flag = PR_IP4_USER,
561eb8dcdeaSGleb Smirnoff 	 },
562eb8dcdeaSGleb Smirnoff #endif
563eb8dcdeaSGleb Smirnoff #ifdef INET6
564eb8dcdeaSGleb Smirnoff 	[PR_INET6] = {
565eb8dcdeaSGleb Smirnoff 		.size = sizeof(struct in6_addr),
566eb8dcdeaSGleb Smirnoff 		.cmp = prison_qcmp_v6,
567eb8dcdeaSGleb Smirnoff 		.valid = prison_valid_v6,
568eb8dcdeaSGleb Smirnoff 		.ip_flag = PR_IP6_USER,
569eb8dcdeaSGleb Smirnoff 	},
570eb8dcdeaSGleb Smirnoff #endif
571eb8dcdeaSGleb Smirnoff };
572eb8dcdeaSGleb Smirnoff 
573eb8dcdeaSGleb Smirnoff /*
574eb8dcdeaSGleb Smirnoff  * Network address lists (pr_addrs) allocation for jails.  The addresses
575eb8dcdeaSGleb Smirnoff  * are accessed locklessly by the network stack, thus need to be protected by
576eb8dcdeaSGleb Smirnoff  * the network epoch.
577eb8dcdeaSGleb Smirnoff  */
578eb8dcdeaSGleb Smirnoff struct prison_ip {
579eb8dcdeaSGleb Smirnoff 	struct epoch_context ctx;
580eb8dcdeaSGleb Smirnoff 	uint32_t	ips;
581eb8dcdeaSGleb Smirnoff #ifdef FUTURE_C
582500f82d6SZhenlei Huang 	/*
583500f82d6SZhenlei Huang 	 * XXX Variable-length automatic arrays in union may be
584500f82d6SZhenlei Huang 	 * supported in future C.
585500f82d6SZhenlei Huang 	 */
586eb8dcdeaSGleb Smirnoff 	union {
587500f82d6SZhenlei Huang 		char pr_ip[];
588eb8dcdeaSGleb Smirnoff 		struct in_addr pr_ip4[];
589eb8dcdeaSGleb Smirnoff 		struct in6_addr pr_ip6[];
590eb8dcdeaSGleb Smirnoff 	};
591eb8dcdeaSGleb Smirnoff #else /* No future C :( */
592500f82d6SZhenlei Huang 	char pr_ip[];
593eb8dcdeaSGleb Smirnoff #endif
594eb8dcdeaSGleb Smirnoff };
595eb8dcdeaSGleb Smirnoff 
596500f82d6SZhenlei Huang static char *
597500f82d6SZhenlei Huang PR_IP(struct prison_ip *pip, const pr_family_t af, int idx)
598500f82d6SZhenlei Huang {
599500f82d6SZhenlei Huang 	MPASS(pip);
600500f82d6SZhenlei Huang 	MPASS(af < PR_FAMILY_MAX);
601500f82d6SZhenlei Huang 	MPASS(idx >= 0 && idx < pip->ips);
602500f82d6SZhenlei Huang 
603500f82d6SZhenlei Huang 	return (pip->pr_ip + pr_families[af].size * idx);
604500f82d6SZhenlei Huang }
605500f82d6SZhenlei Huang 
606eb8dcdeaSGleb Smirnoff static struct prison_ip *
607eb8dcdeaSGleb Smirnoff prison_ip_alloc(const pr_family_t af, uint32_t cnt, int flags)
608eb8dcdeaSGleb Smirnoff {
609eb8dcdeaSGleb Smirnoff 	struct prison_ip *pip;
610eb8dcdeaSGleb Smirnoff 
611eb8dcdeaSGleb Smirnoff 	pip = malloc(sizeof(struct prison_ip) + cnt * pr_families[af].size,
612eb8dcdeaSGleb Smirnoff 	    M_PRISON, flags);
613eb8dcdeaSGleb Smirnoff 	if (pip != NULL)
614eb8dcdeaSGleb Smirnoff 		pip->ips = cnt;
615eb8dcdeaSGleb Smirnoff 	return (pip);
616eb8dcdeaSGleb Smirnoff }
617eb8dcdeaSGleb Smirnoff 
618eb8dcdeaSGleb Smirnoff /*
619eb8dcdeaSGleb Smirnoff  * Allocate and copyin user supplied address list, sorting and validating.
620eb8dcdeaSGleb Smirnoff  * kern_jail_set() helper.
621eb8dcdeaSGleb Smirnoff  */
622eb8dcdeaSGleb Smirnoff static struct prison_ip *
623eb8dcdeaSGleb Smirnoff prison_ip_copyin(const pr_family_t af, void *op, uint32_t cnt)
624eb8dcdeaSGleb Smirnoff {
625eb8dcdeaSGleb Smirnoff 	prison_addr_cmp_t *const cmp = pr_families[af].cmp;
626eb8dcdeaSGleb Smirnoff 	const size_t size = pr_families[af].size;
627eb8dcdeaSGleb Smirnoff 	struct prison_ip *pip;
628eb8dcdeaSGleb Smirnoff 
629eb8dcdeaSGleb Smirnoff 	pip = prison_ip_alloc(af, cnt, M_WAITOK);
630500f82d6SZhenlei Huang 	bcopy(op, pip->pr_ip, cnt * size);
631eb8dcdeaSGleb Smirnoff 	/*
632eb8dcdeaSGleb Smirnoff 	 * IP addresses are all sorted but ip[0] to preserve
633eb8dcdeaSGleb Smirnoff 	 * the primary IP address as given from userland.
634eb8dcdeaSGleb Smirnoff 	 * This special IP is used for unbound outgoing
635eb8dcdeaSGleb Smirnoff 	 * connections as well for "loopback" traffic in case
636eb8dcdeaSGleb Smirnoff 	 * source address selection cannot find any more fitting
637eb8dcdeaSGleb Smirnoff 	 * address to connect from.
638eb8dcdeaSGleb Smirnoff 	 */
639eb8dcdeaSGleb Smirnoff 	if (cnt > 1)
6402c33b456SZhenlei Huang 		qsort(PR_IP(pip, af, 1), cnt - 1, size, cmp);
641eb8dcdeaSGleb Smirnoff 	/*
642eb8dcdeaSGleb Smirnoff 	 * Check for duplicate addresses and do some simple
643eb8dcdeaSGleb Smirnoff 	 * zero and broadcast checks. If users give other bogus
644eb8dcdeaSGleb Smirnoff 	 * addresses it is their problem.
645eb8dcdeaSGleb Smirnoff 	 */
646eb8dcdeaSGleb Smirnoff 	for (int i = 0; i < cnt; i++) {
647500f82d6SZhenlei Huang 		if (!pr_families[af].valid(PR_IP(pip, af, i))) {
648eb8dcdeaSGleb Smirnoff 			free(pip, M_PRISON);
649eb8dcdeaSGleb Smirnoff 			return (NULL);
650eb8dcdeaSGleb Smirnoff 		}
651eb8dcdeaSGleb Smirnoff 		if (i + 1 < cnt &&
652500f82d6SZhenlei Huang 		    (cmp(PR_IP(pip, af, 0), PR_IP(pip, af, i + 1)) == 0 ||
653500f82d6SZhenlei Huang 		     cmp(PR_IP(pip, af, i), PR_IP(pip, af, i + 1)) == 0)) {
654eb8dcdeaSGleb Smirnoff 			free(pip, M_PRISON);
655eb8dcdeaSGleb Smirnoff 			return (NULL);
656eb8dcdeaSGleb Smirnoff 		}
657eb8dcdeaSGleb Smirnoff 	}
658eb8dcdeaSGleb Smirnoff 
659eb8dcdeaSGleb Smirnoff 	return (pip);
660eb8dcdeaSGleb Smirnoff }
661eb8dcdeaSGleb Smirnoff 
662eb8dcdeaSGleb Smirnoff /*
663eb8dcdeaSGleb Smirnoff  * Allocate and dup parent prison address list.
664eb8dcdeaSGleb Smirnoff  * kern_jail_set() helper.
665eb8dcdeaSGleb Smirnoff  */
666eb8dcdeaSGleb Smirnoff static void
667eb8dcdeaSGleb Smirnoff prison_ip_dup(struct prison *ppr, struct prison *pr, const pr_family_t af)
668eb8dcdeaSGleb Smirnoff {
6692c33b456SZhenlei Huang 	const struct prison_ip *ppip = ppr->pr_addrs[af];
6702c33b456SZhenlei Huang 	struct prison_ip *pip;
671eb8dcdeaSGleb Smirnoff 
6722c33b456SZhenlei Huang 	if (ppip != NULL) {
6732c33b456SZhenlei Huang 		pip = prison_ip_alloc(af, ppip->ips, M_WAITOK);
6742c33b456SZhenlei Huang 		bcopy(ppip->pr_ip, pip->pr_ip, pip->ips * pr_families[af].size);
6752c33b456SZhenlei Huang 		pr->pr_addrs[af] = pip;
676eb8dcdeaSGleb Smirnoff 	}
677eb8dcdeaSGleb Smirnoff }
678eb8dcdeaSGleb Smirnoff 
679eb8dcdeaSGleb Smirnoff /*
680eb8dcdeaSGleb Smirnoff  * Make sure the new set of IP addresses is a subset of the parent's list.
681eb8dcdeaSGleb Smirnoff  * Don't worry about the parent being unlocked, as any setting is done with
682eb8dcdeaSGleb Smirnoff  * allprison_lock held.
683eb8dcdeaSGleb Smirnoff  * kern_jail_set() helper.
684eb8dcdeaSGleb Smirnoff  */
685eb8dcdeaSGleb Smirnoff static bool
686500f82d6SZhenlei Huang prison_ip_parent_match(struct prison_ip *ppip, struct prison_ip *pip,
687500f82d6SZhenlei Huang     const pr_family_t af)
688eb8dcdeaSGleb Smirnoff {
689eb8dcdeaSGleb Smirnoff 	prison_addr_cmp_t *const cmp = pr_families[af].cmp;
690eb8dcdeaSGleb Smirnoff 	int i, j;
691eb8dcdeaSGleb Smirnoff 
692eb8dcdeaSGleb Smirnoff 	if (ppip == NULL)
693eb8dcdeaSGleb Smirnoff 		return (false);
694eb8dcdeaSGleb Smirnoff 
695eb8dcdeaSGleb Smirnoff 	for (i = 0; i < ppip->ips; i++)
696500f82d6SZhenlei Huang 		if (cmp(PR_IP(pip, af, 0), PR_IP(ppip, af, i)) == 0)
697eb8dcdeaSGleb Smirnoff 			break;
698eb8dcdeaSGleb Smirnoff 
699eb8dcdeaSGleb Smirnoff 	if (i == ppip->ips)
700eb8dcdeaSGleb Smirnoff 		/* Main address not present in parent. */
701eb8dcdeaSGleb Smirnoff 		return (false);
702eb8dcdeaSGleb Smirnoff 
703eb8dcdeaSGleb Smirnoff 	if (pip->ips > 1) {
704eb8dcdeaSGleb Smirnoff 		for (i = j = 1; i < pip->ips; i++) {
705500f82d6SZhenlei Huang 			if (cmp(PR_IP(pip, af, i), PR_IP(ppip, af, 0)) == 0)
706eb8dcdeaSGleb Smirnoff 				/* Equals to parent primary address. */
707eb8dcdeaSGleb Smirnoff 				continue;
708eb8dcdeaSGleb Smirnoff 			for (; j < ppip->ips; j++)
709500f82d6SZhenlei Huang 				if (cmp(PR_IP(pip, af, i),
710500f82d6SZhenlei Huang 				    PR_IP(ppip, af, j)) == 0)
711eb8dcdeaSGleb Smirnoff 					break;
712eb8dcdeaSGleb Smirnoff 			if (j == ppip->ips)
713eb8dcdeaSGleb Smirnoff 				break;
714eb8dcdeaSGleb Smirnoff 		}
715eb8dcdeaSGleb Smirnoff 		if (j == ppip->ips)
716eb8dcdeaSGleb Smirnoff 			/* Address not present in parent. */
717eb8dcdeaSGleb Smirnoff 			return (false);
718eb8dcdeaSGleb Smirnoff 	}
719eb8dcdeaSGleb Smirnoff 	return (true);
720eb8dcdeaSGleb Smirnoff }
721eb8dcdeaSGleb Smirnoff 
722eb8dcdeaSGleb Smirnoff /*
723eb8dcdeaSGleb Smirnoff  * Check for conflicting IP addresses.  We permit them if there is no more
724eb8dcdeaSGleb Smirnoff  * than one IP on each jail.  If there is a duplicate on a jail with more
725eb8dcdeaSGleb Smirnoff  * than one IP stop checking and return error.
726eb8dcdeaSGleb Smirnoff  * kern_jail_set() helper.
727eb8dcdeaSGleb Smirnoff  */
728eb8dcdeaSGleb Smirnoff static bool
729eb8dcdeaSGleb Smirnoff prison_ip_conflict_check(const struct prison *ppr, const struct prison *pr,
730500f82d6SZhenlei Huang     struct prison_ip *pip, pr_family_t af)
731eb8dcdeaSGleb Smirnoff {
732eb8dcdeaSGleb Smirnoff 	const struct prison *tppr, *tpr;
733eb8dcdeaSGleb Smirnoff 	int descend;
734eb8dcdeaSGleb Smirnoff 
735eb8dcdeaSGleb Smirnoff #ifdef VIMAGE
736eb8dcdeaSGleb Smirnoff 	for (tppr = ppr; tppr != &prison0; tppr = tppr->pr_parent)
737eb8dcdeaSGleb Smirnoff 		if (tppr->pr_flags & PR_VNET)
738eb8dcdeaSGleb Smirnoff 			break;
739eb8dcdeaSGleb Smirnoff #else
740eb8dcdeaSGleb Smirnoff 	tppr = &prison0;
741eb8dcdeaSGleb Smirnoff #endif
742eb8dcdeaSGleb Smirnoff 	FOREACH_PRISON_DESCENDANT(tppr, tpr, descend) {
743eb8dcdeaSGleb Smirnoff 		if (tpr == pr ||
744eb8dcdeaSGleb Smirnoff #ifdef VIMAGE
745eb8dcdeaSGleb Smirnoff 		    (tpr != tppr && (tpr->pr_flags & PR_VNET)) ||
746eb8dcdeaSGleb Smirnoff #endif
747eb8dcdeaSGleb Smirnoff 		    !prison_isalive(tpr)) {
748eb8dcdeaSGleb Smirnoff 			descend = 0;
749eb8dcdeaSGleb Smirnoff 			continue;
750eb8dcdeaSGleb Smirnoff 		}
751eb8dcdeaSGleb Smirnoff 		if (!(tpr->pr_flags & pr_families[af].ip_flag))
752eb8dcdeaSGleb Smirnoff 			continue;
753eb8dcdeaSGleb Smirnoff 		descend = 0;
754eb8dcdeaSGleb Smirnoff 		if (tpr->pr_addrs[af] == NULL ||
755eb8dcdeaSGleb Smirnoff 		    (pip->ips == 1 && tpr->pr_addrs[af]->ips == 1))
756eb8dcdeaSGleb Smirnoff 			continue;
757eb8dcdeaSGleb Smirnoff 		for (int i = 0; i < pip->ips; i++)
758500f82d6SZhenlei Huang 			if (prison_ip_check(tpr, af, PR_IP(pip, af, i)) == 0)
759eb8dcdeaSGleb Smirnoff 				return (false);
760eb8dcdeaSGleb Smirnoff 	}
761eb8dcdeaSGleb Smirnoff 
762eb8dcdeaSGleb Smirnoff 	return (true);
763eb8dcdeaSGleb Smirnoff }
764eb8dcdeaSGleb Smirnoff 
765eb8dcdeaSGleb Smirnoff _Static_assert(offsetof(struct prison_ip, ctx) == 0,
766eb8dcdeaSGleb Smirnoff     "prison must start with epoch context");
767eb8dcdeaSGleb Smirnoff static void
768eb8dcdeaSGleb Smirnoff prison_ip_free_deferred(epoch_context_t ctx)
769eb8dcdeaSGleb Smirnoff {
770eb8dcdeaSGleb Smirnoff 
771eb8dcdeaSGleb Smirnoff 	free(ctx, M_PRISON);
772eb8dcdeaSGleb Smirnoff }
773eb8dcdeaSGleb Smirnoff 
774eb8dcdeaSGleb Smirnoff static void
775eb8dcdeaSGleb Smirnoff prison_ip_free(struct prison_ip *pip)
776eb8dcdeaSGleb Smirnoff {
777eb8dcdeaSGleb Smirnoff 
778eb8dcdeaSGleb Smirnoff 	if (pip != NULL)
779eb8dcdeaSGleb Smirnoff 		NET_EPOCH_CALL(prison_ip_free_deferred, &pip->ctx);
780eb8dcdeaSGleb Smirnoff }
781eb8dcdeaSGleb Smirnoff 
782eb8dcdeaSGleb Smirnoff static void
783eb8dcdeaSGleb Smirnoff prison_ip_set(struct prison *pr, const pr_family_t af, struct prison_ip *new)
784eb8dcdeaSGleb Smirnoff {
785eb8dcdeaSGleb Smirnoff 	struct prison_ip **mem, *old;
786eb8dcdeaSGleb Smirnoff 
787eb8dcdeaSGleb Smirnoff 	mtx_assert(&pr->pr_mtx, MA_OWNED);
788eb8dcdeaSGleb Smirnoff 
789eb8dcdeaSGleb Smirnoff 	mem = &pr->pr_addrs[af];
790eb8dcdeaSGleb Smirnoff 
791eb8dcdeaSGleb Smirnoff 	old = *mem;
79227202b98SMark Johnston 	atomic_store_ptr(mem, new);
793eb8dcdeaSGleb Smirnoff 	prison_ip_free(old);
794eb8dcdeaSGleb Smirnoff }
795eb8dcdeaSGleb Smirnoff 
796eb8dcdeaSGleb Smirnoff /*
797eb8dcdeaSGleb Smirnoff  * Restrict a prison's IP address list with its parent's, possibly replacing
7988bce8d28SZhenlei Huang  * it.  Return true if succeed, otherwise should redo.
799eb8dcdeaSGleb Smirnoff  * kern_jail_set() helper.
800eb8dcdeaSGleb Smirnoff  */
801eb8dcdeaSGleb Smirnoff static bool
802eb8dcdeaSGleb Smirnoff prison_ip_restrict(struct prison *pr, const pr_family_t af,
8038bce8d28SZhenlei Huang     struct prison_ip **newp)
804eb8dcdeaSGleb Smirnoff {
805500f82d6SZhenlei Huang 	struct prison_ip *ppip = pr->pr_parent->pr_addrs[af];
806500f82d6SZhenlei Huang 	struct prison_ip *pip = pr->pr_addrs[af];
807eb8dcdeaSGleb Smirnoff 	int (*const cmp)(const void *, const void *) = pr_families[af].cmp;
808eb8dcdeaSGleb Smirnoff 	const size_t size = pr_families[af].size;
8098bce8d28SZhenlei Huang 	struct prison_ip *new = newp != NULL ? *newp : NULL;
810eb8dcdeaSGleb Smirnoff 	uint32_t ips;
811eb8dcdeaSGleb Smirnoff 
812eb8dcdeaSGleb Smirnoff 	mtx_assert(&pr->pr_mtx, MA_OWNED);
813eb8dcdeaSGleb Smirnoff 
814eb8dcdeaSGleb Smirnoff 	/*
815eb8dcdeaSGleb Smirnoff 	 * Due to epoch-synchronized access to the IP address lists we always
816eb8dcdeaSGleb Smirnoff 	 * allocate a new list even if the old one has enough space.  We could
817eb8dcdeaSGleb Smirnoff 	 * atomically update an IPv4 address inside a list, but that would
818eb8dcdeaSGleb Smirnoff 	 * screw up sorting, and in case of IPv6 we can't even atomically write
819eb8dcdeaSGleb Smirnoff 	 * one.
820eb8dcdeaSGleb Smirnoff 	 */
82189ddfbbaSZhenlei Huang 	if (ppip == NULL) {
82289ddfbbaSZhenlei Huang 		if (pip != NULL)
823eb8dcdeaSGleb Smirnoff 			prison_ip_set(pr, af, NULL);
8248bce8d28SZhenlei Huang 		return (true);
825eb8dcdeaSGleb Smirnoff 	}
82689ddfbbaSZhenlei Huang 
827eb8dcdeaSGleb Smirnoff 	if (!(pr->pr_flags & pr_families[af].ip_flag)) {
82889ddfbbaSZhenlei Huang 		if (new == NULL) {
82989ddfbbaSZhenlei Huang 			new = prison_ip_alloc(af, ppip->ips, M_NOWAIT);
83089ddfbbaSZhenlei Huang 			if (new == NULL)
8318bce8d28SZhenlei Huang 				return (false); /* Redo */
8328bce8d28SZhenlei Huang 		}
833eb8dcdeaSGleb Smirnoff 		/* This has no user settings, so just copy the parent's list. */
83489ddfbbaSZhenlei Huang 		MPASS(new->ips == ppip->ips);
835500f82d6SZhenlei Huang 		bcopy(ppip->pr_ip, new->pr_ip, ppip->ips * size);
83689ddfbbaSZhenlei Huang 		prison_ip_set(pr, af, new);
8378bce8d28SZhenlei Huang 		if (newp != NULL)
8388bce8d28SZhenlei Huang 			*newp = NULL; /* Used */
83989ddfbbaSZhenlei Huang 	} else if (pip != NULL) {
840eb8dcdeaSGleb Smirnoff 		/* Remove addresses that aren't in the parent. */
841eb8dcdeaSGleb Smirnoff 		int i;
842eb8dcdeaSGleb Smirnoff 
843eb8dcdeaSGleb Smirnoff 		i = 0; /* index in pip */
844eb8dcdeaSGleb Smirnoff 		ips = 0; /* index in new */
845eb8dcdeaSGleb Smirnoff 
84689ddfbbaSZhenlei Huang 		if (new == NULL) {
84789ddfbbaSZhenlei Huang 			new = prison_ip_alloc(af, pip->ips, M_NOWAIT);
84889ddfbbaSZhenlei Huang 			if (new == NULL)
8498bce8d28SZhenlei Huang 				return (false); /* Redo */
85089ddfbbaSZhenlei Huang 		}
85189ddfbbaSZhenlei Huang 
852eb8dcdeaSGleb Smirnoff 		for (int pi = 0; pi < ppip->ips; pi++)
853500f82d6SZhenlei Huang 			if (cmp(PR_IP(pip, af, 0), PR_IP(ppip, af, pi)) == 0) {
854eb8dcdeaSGleb Smirnoff 				/* Found our primary address in parent. */
855500f82d6SZhenlei Huang 				bcopy(PR_IP(pip, af, i), PR_IP(new, af, ips),
856500f82d6SZhenlei Huang 				    size);
857eb8dcdeaSGleb Smirnoff 				i++;
858eb8dcdeaSGleb Smirnoff 				ips++;
859eb8dcdeaSGleb Smirnoff 				break;
860eb8dcdeaSGleb Smirnoff 			}
861eb8dcdeaSGleb Smirnoff 		for (int pi = 1; i < pip->ips; ) {
862eb8dcdeaSGleb Smirnoff 			/* Check against primary, which is unsorted. */
863500f82d6SZhenlei Huang 			if (cmp(PR_IP(pip, af, i), PR_IP(ppip, af, 0)) == 0) {
864eb8dcdeaSGleb Smirnoff 				/* Matches parent's primary address. */
865500f82d6SZhenlei Huang 				bcopy(PR_IP(pip, af, i), PR_IP(new, af, ips),
866500f82d6SZhenlei Huang 				    size);
867eb8dcdeaSGleb Smirnoff 				i++;
868eb8dcdeaSGleb Smirnoff 				ips++;
869eb8dcdeaSGleb Smirnoff 				continue;
870eb8dcdeaSGleb Smirnoff 			}
871eb8dcdeaSGleb Smirnoff 			/* The rest are sorted. */
872eb8dcdeaSGleb Smirnoff 			switch (pi >= ppip->ips ? -1 :
873500f82d6SZhenlei Huang 				cmp(PR_IP(pip, af, i), PR_IP(ppip, af, pi))) {
874eb8dcdeaSGleb Smirnoff 			case -1:
875eb8dcdeaSGleb Smirnoff 				i++;
876eb8dcdeaSGleb Smirnoff 				break;
877eb8dcdeaSGleb Smirnoff 			case 0:
878500f82d6SZhenlei Huang 				bcopy(PR_IP(pip, af, i), PR_IP(new, af, ips),
879500f82d6SZhenlei Huang 				    size);
880eb8dcdeaSGleb Smirnoff 				i++;
881eb8dcdeaSGleb Smirnoff 				pi++;
882eb8dcdeaSGleb Smirnoff 				ips++;
883eb8dcdeaSGleb Smirnoff 				break;
884eb8dcdeaSGleb Smirnoff 			case 1:
885eb8dcdeaSGleb Smirnoff 				pi++;
886eb8dcdeaSGleb Smirnoff 				break;
887eb8dcdeaSGleb Smirnoff 			}
888eb8dcdeaSGleb Smirnoff 		}
889eb8dcdeaSGleb Smirnoff 		if (ips == 0) {
8908bce8d28SZhenlei Huang 			if (newp == NULL || *newp == NULL)
891eb8dcdeaSGleb Smirnoff 				prison_ip_free(new);
892eb8dcdeaSGleb Smirnoff 			new = NULL;
89389ddfbbaSZhenlei Huang 		} else {
89489ddfbbaSZhenlei Huang 			/* Shrink to real size */
89589ddfbbaSZhenlei Huang 			KASSERT((new->ips >= ips),
89689ddfbbaSZhenlei Huang 			    ("Out-of-bounds write to prison_ip %p", new));
89789ddfbbaSZhenlei Huang 			new->ips = ips;
898eb8dcdeaSGleb Smirnoff 		}
899eb8dcdeaSGleb Smirnoff 		prison_ip_set(pr, af, new);
9008bce8d28SZhenlei Huang 		if (newp != NULL)
9018bce8d28SZhenlei Huang 			*newp = NULL; /* Used */
90289ddfbbaSZhenlei Huang 	}
9038bce8d28SZhenlei Huang 	return (true);
904eb8dcdeaSGleb Smirnoff }
905eb8dcdeaSGleb Smirnoff 
906eb8dcdeaSGleb Smirnoff /*
907eb8dcdeaSGleb Smirnoff  * Fast-path check if an address belongs to a prison.
908eb8dcdeaSGleb Smirnoff  */
909eb8dcdeaSGleb Smirnoff int
910eb8dcdeaSGleb Smirnoff prison_ip_check(const struct prison *pr, const pr_family_t af,
911eb8dcdeaSGleb Smirnoff     const void *addr)
912eb8dcdeaSGleb Smirnoff {
913eb8dcdeaSGleb Smirnoff 	int (*const cmp)(const void *, const void *) = pr_families[af].cmp;
914500f82d6SZhenlei Huang 	struct prison_ip *pip;
915eb8dcdeaSGleb Smirnoff 	int i, a, z, d;
916eb8dcdeaSGleb Smirnoff 
917eb8dcdeaSGleb Smirnoff 	MPASS(mtx_owned(&pr->pr_mtx) ||
918eb8dcdeaSGleb Smirnoff 	    in_epoch(net_epoch_preempt) ||
919eb8dcdeaSGleb Smirnoff 	    sx_xlocked(&allprison_lock));
920eb8dcdeaSGleb Smirnoff 
92127202b98SMark Johnston 	pip = atomic_load_ptr(&pr->pr_addrs[af]);
922eb8dcdeaSGleb Smirnoff 	if (__predict_false(pip == NULL))
923eb8dcdeaSGleb Smirnoff 		return (EAFNOSUPPORT);
924eb8dcdeaSGleb Smirnoff 
925eb8dcdeaSGleb Smirnoff 	/* Check the primary IP. */
926500f82d6SZhenlei Huang 	if (cmp(PR_IP(pip, af, 0), addr) == 0)
927eb8dcdeaSGleb Smirnoff 		return (0);
928eb8dcdeaSGleb Smirnoff 
929eb8dcdeaSGleb Smirnoff 	/*
930eb8dcdeaSGleb Smirnoff 	 * All the other IPs are sorted so we can do a binary search.
931eb8dcdeaSGleb Smirnoff 	 */
932eb8dcdeaSGleb Smirnoff 	a = 0;
933eb8dcdeaSGleb Smirnoff 	z = pip->ips - 2;
934eb8dcdeaSGleb Smirnoff 	while (a <= z) {
935eb8dcdeaSGleb Smirnoff 		i = (a + z) / 2;
936500f82d6SZhenlei Huang 		d = cmp(PR_IP(pip, af, i + 1), addr);
937eb8dcdeaSGleb Smirnoff 		if (d > 0)
938eb8dcdeaSGleb Smirnoff 			z = i - 1;
939eb8dcdeaSGleb Smirnoff 		else if (d < 0)
940eb8dcdeaSGleb Smirnoff 			a = i + 1;
941eb8dcdeaSGleb Smirnoff 		else
942eb8dcdeaSGleb Smirnoff 			return (0);
943eb8dcdeaSGleb Smirnoff 	}
944eb8dcdeaSGleb Smirnoff 
945eb8dcdeaSGleb Smirnoff 	return (EADDRNOTAVAIL);
946eb8dcdeaSGleb Smirnoff }
947eb8dcdeaSGleb Smirnoff 
948eb8dcdeaSGleb Smirnoff /*
949eb8dcdeaSGleb Smirnoff  * Grab primary IP.  Historically required mutex, but nothing prevents
950eb8dcdeaSGleb Smirnoff  * us to support epoch-protected access.  Is it used in fast path?
951eb8dcdeaSGleb Smirnoff  * in{6}_jail.c helper
952eb8dcdeaSGleb Smirnoff  */
953eb8dcdeaSGleb Smirnoff const void *
954eb8dcdeaSGleb Smirnoff prison_ip_get0(const struct prison *pr, const pr_family_t af)
955eb8dcdeaSGleb Smirnoff {
956eb8dcdeaSGleb Smirnoff 	const struct prison_ip *pip = pr->pr_addrs[af];
957eb8dcdeaSGleb Smirnoff 
958eb8dcdeaSGleb Smirnoff 	mtx_assert(&pr->pr_mtx, MA_OWNED);
959eb8dcdeaSGleb Smirnoff 	MPASS(pip);
960eb8dcdeaSGleb Smirnoff 
961500f82d6SZhenlei Huang 	return (pip->pr_ip);
962eb8dcdeaSGleb Smirnoff }
963eb8dcdeaSGleb Smirnoff 
964eb8dcdeaSGleb Smirnoff u_int
965eb8dcdeaSGleb Smirnoff prison_ip_cnt(const struct prison *pr, const pr_family_t af)
966eb8dcdeaSGleb Smirnoff {
967eb8dcdeaSGleb Smirnoff 
968eb8dcdeaSGleb Smirnoff 	return (pr->pr_addrs[af]->ips);
969eb8dcdeaSGleb Smirnoff }
970eb8dcdeaSGleb Smirnoff #endif	/* defined(INET) || defined(INET6) */
971eb8dcdeaSGleb Smirnoff 
972413628a7SBjoern A. Zeeb int
973b38ff370SJamie Gritton kern_jail_set(struct thread *td, struct uio *optuio, int flags)
974413628a7SBjoern A. Zeeb {
975fd7a8150SMike Barcroft 	struct nameidata nd;
976b38ff370SJamie Gritton #ifdef INET
977eb8dcdeaSGleb Smirnoff 	struct prison_ip *ip4;
978413628a7SBjoern A. Zeeb #endif
979b38ff370SJamie Gritton #ifdef INET6
980eb8dcdeaSGleb Smirnoff 	struct prison_ip *ip6;
981b38ff370SJamie Gritton #endif
982b38ff370SJamie Gritton 	struct vfsopt *opt;
983b38ff370SJamie Gritton 	struct vfsoptlist *opts;
984ed31b3f4SJamie Gritton 	struct prison *pr, *deadpr, *dinspr, *inspr, *mypr, *ppr, *tpr;
985b38ff370SJamie Gritton 	struct vnode *root;
986babbbb9cSJamie Gritton 	char *domain, *errmsg, *host, *name, *namelc, *p, *path, *uuid;
987b96bd95bSIan Lepore 	char *g_path, *osrelstr;
988672756aaSJamie Gritton 	struct bool_flags *bf;
989672756aaSJamie Gritton 	struct jailsys_flags *jsf;
9900304c731SJamie Gritton #if defined(INET) || defined(INET6)
991b38ff370SJamie Gritton 	void *op;
9920304c731SJamie Gritton #endif
99376ca6f88SJamie Gritton 	unsigned long hid;
994b6f47c23SJamie Gritton 	size_t namelen, onamelen, pnamelen;
995ed31b3f4SJamie Gritton 	int created, cuflags, descend, drflags, enforce;
996cc5fd8c7SJamie Gritton 	int error, errmsg_len, errmsg_pos;
9970cc207a6SMartin Matuska 	int gotchildmax, gotenforce, gothid, gotrsnum, gotslevel;
998ed31b3f4SJamie Gritton 	int deadid, jid, jsys, len, level;
999b96bd95bSIan Lepore 	int childmax, osreldt, rsnum, slevel;
1000413628a7SBjoern A. Zeeb #ifdef INET
10018bce8d28SZhenlei Huang 	int ip4s;
10028bce8d28SZhenlei Huang 	bool redo_ip4;
1003413628a7SBjoern A. Zeeb #endif
1004b38ff370SJamie Gritton #ifdef INET6
10058bce8d28SZhenlei Huang 	int ip6s;
10068bce8d28SZhenlei Huang 	bool redo_ip6;
1007b38ff370SJamie Gritton #endif
10086beb3bb4SKirk McKusick 	uint64_t pr_allow, ch_allow, pr_flags, ch_flags;
1009b3079544SJamie Gritton 	uint64_t pr_allow_diff;
10106beb3bb4SKirk McKusick 	unsigned tallow;
1011b38ff370SJamie Gritton 	char numbuf[12];
1012b38ff370SJamie Gritton 
1013b38ff370SJamie Gritton 	error = priv_check(td, PRIV_JAIL_SET);
1014b38ff370SJamie Gritton 	if (!error && (flags & JAIL_ATTACH))
1015b38ff370SJamie Gritton 		error = priv_check(td, PRIV_JAIL_ATTACH);
1016b38ff370SJamie Gritton 	if (error)
101775c13541SPoul-Henning Kamp 		return (error);
1018b6f47c23SJamie Gritton 	mypr = td->td_ucred->cr_prison;
1019b97457e2SJamie Gritton 	if ((flags & JAIL_CREATE) && mypr->pr_childmax == 0)
10200304c731SJamie Gritton 		return (EPERM);
1021b38ff370SJamie Gritton 	if (flags & ~JAIL_SET_MASK)
1022b38ff370SJamie Gritton 		return (EINVAL);
1023b38ff370SJamie Gritton 
1024b38ff370SJamie Gritton 	/*
1025b38ff370SJamie Gritton 	 * Check all the parameters before committing to anything.  Not all
1026b38ff370SJamie Gritton 	 * errors can be caught early, but we may as well try.  Also, this
1027b38ff370SJamie Gritton 	 * takes care of some expensive stuff (path lookup) before getting
1028b38ff370SJamie Gritton 	 * the allprison lock.
1029b38ff370SJamie Gritton 	 *
1030b38ff370SJamie Gritton 	 * XXX Jails are not filesystems, and jail parameters are not mount
1031b38ff370SJamie Gritton 	 *     options.  But it makes more sense to re-use the vfsopt code
1032b38ff370SJamie Gritton 	 *     than duplicate it under a different name.
1033b38ff370SJamie Gritton 	 */
1034b38ff370SJamie Gritton 	error = vfs_buildopts(optuio, &opts);
1035b38ff370SJamie Gritton 	if (error)
1036b38ff370SJamie Gritton 		return (error);
1037b38ff370SJamie Gritton #ifdef INET
1038b38ff370SJamie Gritton 	ip4 = NULL;
1039b38ff370SJamie Gritton #endif
1040b38ff370SJamie Gritton #ifdef INET6
1041b38ff370SJamie Gritton 	ip6 = NULL;
1042b38ff370SJamie Gritton #endif
10436dfe0a3dSMartin Matuska 	g_path = NULL;
1044b38ff370SJamie Gritton 
1045b6f47c23SJamie Gritton 	cuflags = flags & (JAIL_CREATE | JAIL_UPDATE);
1046b6f47c23SJamie Gritton 	if (!cuflags) {
1047b6f47c23SJamie Gritton 		error = EINVAL;
1048b6f47c23SJamie Gritton 		vfs_opterror(opts, "no valid operation (create or update)");
1049b6f47c23SJamie Gritton 		goto done_errmsg;
1050b6f47c23SJamie Gritton 	}
1051b6f47c23SJamie Gritton 
1052b38ff370SJamie Gritton 	error = vfs_copyopt(opts, "jid", &jid, sizeof(jid));
1053b38ff370SJamie Gritton 	if (error == ENOENT)
1054b38ff370SJamie Gritton 		jid = 0;
1055b38ff370SJamie Gritton 	else if (error != 0)
1056b38ff370SJamie Gritton 		goto done_free;
1057b38ff370SJamie Gritton 
1058b38ff370SJamie Gritton 	error = vfs_copyopt(opts, "securelevel", &slevel, sizeof(slevel));
1059b38ff370SJamie Gritton 	if (error == ENOENT)
1060b38ff370SJamie Gritton 		gotslevel = 0;
1061b38ff370SJamie Gritton 	else if (error != 0)
1062b38ff370SJamie Gritton 		goto done_free;
1063b38ff370SJamie Gritton 	else
1064b38ff370SJamie Gritton 		gotslevel = 1;
1065b38ff370SJamie Gritton 
1066b97457e2SJamie Gritton 	error =
1067b97457e2SJamie Gritton 	    vfs_copyopt(opts, "children.max", &childmax, sizeof(childmax));
1068b97457e2SJamie Gritton 	if (error == ENOENT)
1069b97457e2SJamie Gritton 		gotchildmax = 0;
1070b97457e2SJamie Gritton 	else if (error != 0)
1071b97457e2SJamie Gritton 		goto done_free;
1072b97457e2SJamie Gritton 	else
1073b97457e2SJamie Gritton 		gotchildmax = 1;
1074b97457e2SJamie Gritton 
10750304c731SJamie Gritton 	error = vfs_copyopt(opts, "enforce_statfs", &enforce, sizeof(enforce));
1076f337198dSJamie Gritton 	if (error == ENOENT)
1077f337198dSJamie Gritton 		gotenforce = 0;
1078f337198dSJamie Gritton 	else if (error != 0)
10790304c731SJamie Gritton 		goto done_free;
1080f337198dSJamie Gritton 	else if (enforce < 0 || enforce > 2) {
1081f337198dSJamie Gritton 		error = EINVAL;
1082f337198dSJamie Gritton 		goto done_free;
1083f337198dSJamie Gritton 	} else
1084f337198dSJamie Gritton 		gotenforce = 1;
10850304c731SJamie Gritton 
10860cc207a6SMartin Matuska 	error = vfs_copyopt(opts, "devfs_ruleset", &rsnum, sizeof(rsnum));
10870cc207a6SMartin Matuska 	if (error == ENOENT)
10880cc207a6SMartin Matuska 		gotrsnum = 0;
10890cc207a6SMartin Matuska 	else if (error != 0)
10900cc207a6SMartin Matuska 		goto done_free;
10910cc207a6SMartin Matuska 	else
10920cc207a6SMartin Matuska 		gotrsnum = 1;
10930cc207a6SMartin Matuska 
1094b38ff370SJamie Gritton 	pr_flags = ch_flags = 0;
1095672756aaSJamie Gritton 	for (bf = pr_flag_bool;
1096672756aaSJamie Gritton 	     bf < pr_flag_bool + nitems(pr_flag_bool);
1097672756aaSJamie Gritton 	     bf++) {
1098672756aaSJamie Gritton 		vfs_flagopt(opts, bf->name, &pr_flags, bf->flag);
1099672756aaSJamie Gritton 		vfs_flagopt(opts, bf->noname, &ch_flags, bf->flag);
11000304c731SJamie Gritton 	}
1101b38ff370SJamie Gritton 	ch_flags |= pr_flags;
1102672756aaSJamie Gritton 	for (jsf = pr_flag_jailsys;
1103672756aaSJamie Gritton 	     jsf < pr_flag_jailsys + nitems(pr_flag_jailsys);
1104672756aaSJamie Gritton 	     jsf++) {
1105672756aaSJamie Gritton 		error = vfs_copyopt(opts, jsf->name, &jsys, sizeof(jsys));
11067cbf7213SJamie Gritton 		if (error == ENOENT)
11077cbf7213SJamie Gritton 			continue;
11087cbf7213SJamie Gritton 		if (error != 0)
11097cbf7213SJamie Gritton 			goto done_free;
11107cbf7213SJamie Gritton 		switch (jsys) {
11117cbf7213SJamie Gritton 		case JAIL_SYS_DISABLE:
1112672756aaSJamie Gritton 			if (!jsf->disable) {
11137cbf7213SJamie Gritton 				error = EINVAL;
11147cbf7213SJamie Gritton 				goto done_free;
11157cbf7213SJamie Gritton 			}
1116672756aaSJamie Gritton 			pr_flags |= jsf->disable;
11177cbf7213SJamie Gritton 			break;
11187cbf7213SJamie Gritton 		case JAIL_SYS_NEW:
1119672756aaSJamie Gritton 			pr_flags |= jsf->new;
11207cbf7213SJamie Gritton 			break;
11217cbf7213SJamie Gritton 		case JAIL_SYS_INHERIT:
11227cbf7213SJamie Gritton 			break;
11237cbf7213SJamie Gritton 		default:
11247cbf7213SJamie Gritton 			error = EINVAL;
11257cbf7213SJamie Gritton 			goto done_free;
11267cbf7213SJamie Gritton 		}
1127672756aaSJamie Gritton 		ch_flags |= jsf->new | jsf->disable;
11287cbf7213SJamie Gritton 	}
11291158508aSJamie Gritton 	if ((flags & (JAIL_CREATE | JAIL_ATTACH)) == JAIL_CREATE
11304affa14cSJamie Gritton 	    && !(pr_flags & PR_PERSIST)) {
11314affa14cSJamie Gritton 		error = EINVAL;
11324affa14cSJamie Gritton 		vfs_opterror(opts, "new jail must persist or attach");
11334affa14cSJamie Gritton 		goto done_errmsg;
11344affa14cSJamie Gritton 	}
1135679e1390SJamie Gritton #ifdef VIMAGE
1136679e1390SJamie Gritton 	if ((flags & JAIL_UPDATE) && (ch_flags & PR_VNET)) {
1137679e1390SJamie Gritton 		error = EINVAL;
1138679e1390SJamie Gritton 		vfs_opterror(opts, "vnet cannot be changed after creation");
1139679e1390SJamie Gritton 		goto done_errmsg;
1140679e1390SJamie Gritton 	}
1141679e1390SJamie Gritton #endif
11422b0d6f81SJamie Gritton #ifdef INET
11432b0d6f81SJamie Gritton 	if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP4_USER)) {
11442b0d6f81SJamie Gritton 		error = EINVAL;
11452b0d6f81SJamie Gritton 		vfs_opterror(opts, "ip4 cannot be changed after creation");
11462b0d6f81SJamie Gritton 		goto done_errmsg;
11472b0d6f81SJamie Gritton 	}
11482b0d6f81SJamie Gritton #endif
11492b0d6f81SJamie Gritton #ifdef INET6
11502b0d6f81SJamie Gritton 	if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP6_USER)) {
11512b0d6f81SJamie Gritton 		error = EINVAL;
11522b0d6f81SJamie Gritton 		vfs_opterror(opts, "ip6 cannot be changed after creation");
11532b0d6f81SJamie Gritton 		goto done_errmsg;
11542b0d6f81SJamie Gritton 	}
11552b0d6f81SJamie Gritton #endif
1156b38ff370SJamie Gritton 
11570304c731SJamie Gritton 	pr_allow = ch_allow = 0;
1158672756aaSJamie Gritton 	for (bf = pr_flag_allow;
11595d58f959SJamie Gritton 	     bf < pr_flag_allow + nitems(pr_flag_allow) &&
11605d58f959SJamie Gritton 		atomic_load_int(&bf->flag) != 0;
1161672756aaSJamie Gritton 	     bf++) {
1162672756aaSJamie Gritton 		vfs_flagopt(opts, bf->name, &pr_allow, bf->flag);
1163672756aaSJamie Gritton 		vfs_flagopt(opts, bf->noname, &ch_allow, bf->flag);
11640304c731SJamie Gritton 	}
11650304c731SJamie Gritton 	ch_allow |= pr_allow;
11660304c731SJamie Gritton 
1167b38ff370SJamie Gritton 	error = vfs_getopt(opts, "name", (void **)&name, &len);
1168b38ff370SJamie Gritton 	if (error == ENOENT)
1169b38ff370SJamie Gritton 		name = NULL;
1170b38ff370SJamie Gritton 	else if (error != 0)
1171b38ff370SJamie Gritton 		goto done_free;
1172b38ff370SJamie Gritton 	else {
1173b38ff370SJamie Gritton 		if (len == 0 || name[len - 1] != '\0') {
1174b38ff370SJamie Gritton 			error = EINVAL;
1175b38ff370SJamie Gritton 			goto done_free;
1176b38ff370SJamie Gritton 		}
1177b38ff370SJamie Gritton 		if (len > MAXHOSTNAMELEN) {
1178b38ff370SJamie Gritton 			error = ENAMETOOLONG;
1179b38ff370SJamie Gritton 			goto done_free;
1180b38ff370SJamie Gritton 		}
1181b38ff370SJamie Gritton 	}
1182b38ff370SJamie Gritton 
1183b38ff370SJamie Gritton 	error = vfs_getopt(opts, "host.hostname", (void **)&host, &len);
1184b38ff370SJamie Gritton 	if (error == ENOENT)
1185b38ff370SJamie Gritton 		host = NULL;
1186b38ff370SJamie Gritton 	else if (error != 0)
1187b38ff370SJamie Gritton 		goto done_free;
1188b38ff370SJamie Gritton 	else {
118976ca6f88SJamie Gritton 		ch_flags |= PR_HOST;
119076ca6f88SJamie Gritton 		pr_flags |= PR_HOST;
1191b38ff370SJamie Gritton 		if (len == 0 || host[len - 1] != '\0') {
1192b38ff370SJamie Gritton 			error = EINVAL;
1193b38ff370SJamie Gritton 			goto done_free;
1194b38ff370SJamie Gritton 		}
1195b38ff370SJamie Gritton 		if (len > MAXHOSTNAMELEN) {
1196b38ff370SJamie Gritton 			error = ENAMETOOLONG;
1197b38ff370SJamie Gritton 			goto done_free;
1198b38ff370SJamie Gritton 		}
1199b38ff370SJamie Gritton 	}
1200b38ff370SJamie Gritton 
120176ca6f88SJamie Gritton 	error = vfs_getopt(opts, "host.domainname", (void **)&domain, &len);
120276ca6f88SJamie Gritton 	if (error == ENOENT)
120376ca6f88SJamie Gritton 		domain = NULL;
120476ca6f88SJamie Gritton 	else if (error != 0)
120576ca6f88SJamie Gritton 		goto done_free;
120676ca6f88SJamie Gritton 	else {
120776ca6f88SJamie Gritton 		ch_flags |= PR_HOST;
120876ca6f88SJamie Gritton 		pr_flags |= PR_HOST;
120976ca6f88SJamie Gritton 		if (len == 0 || domain[len - 1] != '\0') {
121076ca6f88SJamie Gritton 			error = EINVAL;
121176ca6f88SJamie Gritton 			goto done_free;
121276ca6f88SJamie Gritton 		}
121376ca6f88SJamie Gritton 		if (len > MAXHOSTNAMELEN) {
121476ca6f88SJamie Gritton 			error = ENAMETOOLONG;
121576ca6f88SJamie Gritton 			goto done_free;
121676ca6f88SJamie Gritton 		}
121776ca6f88SJamie Gritton 	}
121876ca6f88SJamie Gritton 
121976ca6f88SJamie Gritton 	error = vfs_getopt(opts, "host.hostuuid", (void **)&uuid, &len);
122076ca6f88SJamie Gritton 	if (error == ENOENT)
122176ca6f88SJamie Gritton 		uuid = NULL;
122276ca6f88SJamie Gritton 	else if (error != 0)
122376ca6f88SJamie Gritton 		goto done_free;
122476ca6f88SJamie Gritton 	else {
122576ca6f88SJamie Gritton 		ch_flags |= PR_HOST;
122676ca6f88SJamie Gritton 		pr_flags |= PR_HOST;
122776ca6f88SJamie Gritton 		if (len == 0 || uuid[len - 1] != '\0') {
122876ca6f88SJamie Gritton 			error = EINVAL;
122976ca6f88SJamie Gritton 			goto done_free;
123076ca6f88SJamie Gritton 		}
123176ca6f88SJamie Gritton 		if (len > HOSTUUIDLEN) {
123276ca6f88SJamie Gritton 			error = ENAMETOOLONG;
123376ca6f88SJamie Gritton 			goto done_free;
123476ca6f88SJamie Gritton 		}
123576ca6f88SJamie Gritton 	}
123676ca6f88SJamie Gritton 
1237841c0c7eSNathan Whitehorn #ifdef COMPAT_FREEBSD32
1238a5c1afadSDmitry Chagin 	if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) {
123976ca6f88SJamie Gritton 		uint32_t hid32;
124076ca6f88SJamie Gritton 
124176ca6f88SJamie Gritton 		error = vfs_copyopt(opts, "host.hostid", &hid32, sizeof(hid32));
124276ca6f88SJamie Gritton 		hid = hid32;
124376ca6f88SJamie Gritton 	} else
124476ca6f88SJamie Gritton #endif
124576ca6f88SJamie Gritton 		error = vfs_copyopt(opts, "host.hostid", &hid, sizeof(hid));
124676ca6f88SJamie Gritton 	if (error == ENOENT)
124776ca6f88SJamie Gritton 		gothid = 0;
124876ca6f88SJamie Gritton 	else if (error != 0)
124976ca6f88SJamie Gritton 		goto done_free;
125076ca6f88SJamie Gritton 	else {
125176ca6f88SJamie Gritton 		gothid = 1;
125276ca6f88SJamie Gritton 		ch_flags |= PR_HOST;
125376ca6f88SJamie Gritton 		pr_flags |= PR_HOST;
125476ca6f88SJamie Gritton 	}
125576ca6f88SJamie Gritton 
1256b38ff370SJamie Gritton #ifdef INET
1257b38ff370SJamie Gritton 	error = vfs_getopt(opts, "ip4.addr", &op, &ip4s);
1258b38ff370SJamie Gritton 	if (error == ENOENT)
12590e5e396eSJamie Gritton 		ip4s = 0;
1260b38ff370SJamie Gritton 	else if (error != 0)
1261b38ff370SJamie Gritton 		goto done_free;
1262eb8dcdeaSGleb Smirnoff 	else if (ip4s & (sizeof(struct in_addr) - 1)) {
1263b38ff370SJamie Gritton 		error = EINVAL;
1264b38ff370SJamie Gritton 		goto done_free;
12650304c731SJamie Gritton 	} else {
12666a3f2779SJamie Gritton 		ch_flags |= PR_IP4_USER;
12676a3f2779SJamie Gritton 		pr_flags |= PR_IP4_USER;
12686a3f2779SJamie Gritton 		if (ip4s > 0) {
1269eb8dcdeaSGleb Smirnoff 			ip4s /= sizeof(struct in_addr);
1270b38ff370SJamie Gritton 			if (ip4s > jail_max_af_ips) {
1271b38ff370SJamie Gritton 				error = EINVAL;
1272b38ff370SJamie Gritton 				vfs_opterror(opts, "too many IPv4 addresses");
1273b38ff370SJamie Gritton 				goto done_errmsg;
1274b38ff370SJamie Gritton 			}
1275eb8dcdeaSGleb Smirnoff 			ip4 = prison_ip_copyin(PR_INET, op, ip4s);
1276eb8dcdeaSGleb Smirnoff 			if (ip4 == NULL) {
1277b38ff370SJamie Gritton 				error = EINVAL;
1278b38ff370SJamie Gritton 				goto done_free;
1279b38ff370SJamie Gritton 			}
1280b38ff370SJamie Gritton 		}
12810304c731SJamie Gritton 	}
1282b38ff370SJamie Gritton #endif
1283b38ff370SJamie Gritton 
1284b38ff370SJamie Gritton #ifdef INET6
1285b38ff370SJamie Gritton 	error = vfs_getopt(opts, "ip6.addr", &op, &ip6s);
1286b38ff370SJamie Gritton 	if (error == ENOENT)
12870e5e396eSJamie Gritton 		ip6s = 0;
1288b38ff370SJamie Gritton 	else if (error != 0)
1289b38ff370SJamie Gritton 		goto done_free;
1290eb8dcdeaSGleb Smirnoff 	else if (ip6s & (sizeof(struct in6_addr) - 1)) {
1291b38ff370SJamie Gritton 		error = EINVAL;
1292b38ff370SJamie Gritton 		goto done_free;
12930304c731SJamie Gritton 	} else {
12946a3f2779SJamie Gritton 		ch_flags |= PR_IP6_USER;
12956a3f2779SJamie Gritton 		pr_flags |= PR_IP6_USER;
12966a3f2779SJamie Gritton 		if (ip6s > 0) {
1297eb8dcdeaSGleb Smirnoff 			ip6s /= sizeof(struct in6_addr);
1298b38ff370SJamie Gritton 			if (ip6s > jail_max_af_ips) {
1299b38ff370SJamie Gritton 				error = EINVAL;
1300b38ff370SJamie Gritton 				vfs_opterror(opts, "too many IPv6 addresses");
1301b38ff370SJamie Gritton 				goto done_errmsg;
1302b38ff370SJamie Gritton 			}
1303eb8dcdeaSGleb Smirnoff 			ip6 = prison_ip_copyin(PR_INET6, op, ip6s);
1304eb8dcdeaSGleb Smirnoff 			if (ip6 == NULL) {
1305b38ff370SJamie Gritton 				error = EINVAL;
1306b38ff370SJamie Gritton 				goto done_free;
1307b38ff370SJamie Gritton 			}
1308b38ff370SJamie Gritton 		}
13090304c731SJamie Gritton 	}
1310b38ff370SJamie Gritton #endif
1311b38ff370SJamie Gritton 
1312bdfc8cc4SJamie Gritton #if defined(VIMAGE) && (defined(INET) || defined(INET6))
1313bdfc8cc4SJamie Gritton 	if ((ch_flags & PR_VNET) && (ch_flags & (PR_IP4_USER | PR_IP6_USER))) {
1314bdfc8cc4SJamie Gritton 		error = EINVAL;
1315bdfc8cc4SJamie Gritton 		vfs_opterror(opts,
1316bdfc8cc4SJamie Gritton 		    "vnet jails cannot have IP address restrictions");
1317bdfc8cc4SJamie Gritton 		goto done_errmsg;
1318bdfc8cc4SJamie Gritton 	}
1319bdfc8cc4SJamie Gritton #endif
1320bdfc8cc4SJamie Gritton 
1321cf0313c6SJamie Gritton 	error = vfs_getopt(opts, "osrelease", (void **)&osrelstr, &len);
1322cf0313c6SJamie Gritton 	if (error == ENOENT)
1323cf0313c6SJamie Gritton 		osrelstr = NULL;
1324cf0313c6SJamie Gritton 	else if (error != 0)
1325cf0313c6SJamie Gritton 		goto done_free;
1326cf0313c6SJamie Gritton 	else {
1327cf0313c6SJamie Gritton 		if (flags & JAIL_UPDATE) {
1328cf0313c6SJamie Gritton 			error = EINVAL;
1329cf0313c6SJamie Gritton 			vfs_opterror(opts,
1330cf0313c6SJamie Gritton 			    "osrelease cannot be changed after creation");
1331cf0313c6SJamie Gritton 			goto done_errmsg;
1332cf0313c6SJamie Gritton 		}
13331b786d01SBjoern A. Zeeb 		if (len == 0 || osrelstr[len - 1] != '\0') {
1334cf0313c6SJamie Gritton 			error = EINVAL;
13351b786d01SBjoern A. Zeeb 			goto done_free;
13361b786d01SBjoern A. Zeeb 		}
13371b786d01SBjoern A. Zeeb 		if (len >= OSRELEASELEN) {
13381b786d01SBjoern A. Zeeb 			error = ENAMETOOLONG;
1339cf0313c6SJamie Gritton 			vfs_opterror(opts,
1340cf0313c6SJamie Gritton 			    "osrelease string must be 1-%d bytes long",
1341cf0313c6SJamie Gritton 			    OSRELEASELEN - 1);
1342cf0313c6SJamie Gritton 			goto done_errmsg;
1343cf0313c6SJamie Gritton 		}
1344cf0313c6SJamie Gritton 	}
1345cf0313c6SJamie Gritton 
1346cf0313c6SJamie Gritton 	error = vfs_copyopt(opts, "osreldate", &osreldt, sizeof(osreldt));
1347cf0313c6SJamie Gritton 	if (error == ENOENT)
1348cf0313c6SJamie Gritton 		osreldt = 0;
1349cf0313c6SJamie Gritton 	else if (error != 0)
1350cf0313c6SJamie Gritton 		goto done_free;
1351cf0313c6SJamie Gritton 	else {
1352cf0313c6SJamie Gritton 		if (flags & JAIL_UPDATE) {
1353cf0313c6SJamie Gritton 			error = EINVAL;
1354cf0313c6SJamie Gritton 			vfs_opterror(opts,
1355cf0313c6SJamie Gritton 			    "osreldate cannot be changed after creation");
1356cf0313c6SJamie Gritton 			goto done_errmsg;
1357cf0313c6SJamie Gritton 		}
1358cf0313c6SJamie Gritton 		if (osreldt == 0) {
1359cf0313c6SJamie Gritton 			error = EINVAL;
1360cf0313c6SJamie Gritton 			vfs_opterror(opts, "osreldate cannot be 0");
1361cf0313c6SJamie Gritton 			goto done_errmsg;
1362cf0313c6SJamie Gritton 		}
1363cf0313c6SJamie Gritton 	}
1364cf0313c6SJamie Gritton 
1365b38ff370SJamie Gritton 	root = NULL;
1366b38ff370SJamie Gritton 	error = vfs_getopt(opts, "path", (void **)&path, &len);
1367b38ff370SJamie Gritton 	if (error == ENOENT)
1368b38ff370SJamie Gritton 		path = NULL;
1369b38ff370SJamie Gritton 	else if (error != 0)
1370b38ff370SJamie Gritton 		goto done_free;
1371b38ff370SJamie Gritton 	else {
1372b38ff370SJamie Gritton 		if (flags & JAIL_UPDATE) {
1373b38ff370SJamie Gritton 			error = EINVAL;
1374b38ff370SJamie Gritton 			vfs_opterror(opts,
1375b38ff370SJamie Gritton 			    "path cannot be changed after creation");
1376b38ff370SJamie Gritton 			goto done_errmsg;
1377b38ff370SJamie Gritton 		}
1378b38ff370SJamie Gritton 		if (len == 0 || path[len - 1] != '\0') {
1379b38ff370SJamie Gritton 			error = EINVAL;
1380b38ff370SJamie Gritton 			goto done_free;
1381b38ff370SJamie Gritton 		}
13827e1d3eefSMateusz Guzik 		NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE, path);
1383b38ff370SJamie Gritton 		error = namei(&nd);
1384b38ff370SJamie Gritton 		if (error)
1385b38ff370SJamie Gritton 			goto done_free;
1386b38ff370SJamie Gritton 		root = nd.ni_vp;
1387bb92cd7bSMateusz Guzik 		NDFREE_PNBUF(&nd);
13886dfe0a3dSMartin Matuska 		g_path = malloc(MAXPATHLEN, M_TEMP, M_WAITOK);
13896dfe0a3dSMartin Matuska 		strlcpy(g_path, path, MAXPATHLEN);
13906dfe0a3dSMartin Matuska 		error = vn_path_to_global_path(td, root, g_path, MAXPATHLEN);
13913eb6b656SMateusz Guzik 		if (error == 0) {
13926dfe0a3dSMartin Matuska 			path = g_path;
13936dfe0a3dSMartin Matuska 		} else {
1394f6e633a9SMartin Matuska 			/* exit on other errors */
1395b38ff370SJamie Gritton 			goto done_free;
1396b38ff370SJamie Gritton 		}
1397f6e633a9SMartin Matuska 		if (root->v_type != VDIR) {
1398f6e633a9SMartin Matuska 			error = ENOTDIR;
1399f6e633a9SMartin Matuska 			vput(root);
1400f6e633a9SMartin Matuska 			goto done_free;
1401f6e633a9SMartin Matuska 		}
1402b249ce48SMateusz Guzik 		VOP_UNLOCK(root);
1403b38ff370SJamie Gritton 	}
1404b38ff370SJamie Gritton 
1405b38ff370SJamie Gritton 	/*
1406b6f47c23SJamie Gritton 	 * Find the specified jail, or at least its parent.
1407b38ff370SJamie Gritton 	 * This abuses the file error codes ENOENT and EEXIST.
1408b38ff370SJamie Gritton 	 */
1409b38ff370SJamie Gritton 	pr = NULL;
14107de883c8SJamie Gritton 	inspr = NULL;
1411ed31b3f4SJamie Gritton 	deadpr = NULL;
1412babbbb9cSJamie Gritton 	if (cuflags == JAIL_CREATE && jid == 0 && name != NULL) {
1413babbbb9cSJamie Gritton 		namelc = strrchr(name, '.');
1414babbbb9cSJamie Gritton 		jid = strtoul(namelc != NULL ? namelc + 1 : name, &p, 10);
1415babbbb9cSJamie Gritton 		if (*p != '\0')
1416babbbb9cSJamie Gritton 			jid = 0;
1417babbbb9cSJamie Gritton 	}
1418b6f47c23SJamie Gritton 	sx_xlock(&allprison_lock);
1419108a9384SJamie Gritton 	drflags = PD_LIST_XLOCKED;
14200a2a96f3SJamie Gritton 	ppr = mypr;
14210a2a96f3SJamie Gritton 	if (!prison_isalive(ppr)) {
14220a2a96f3SJamie Gritton 		/* This jail is dying.  This process will surely follow. */
14230a2a96f3SJamie Gritton 		error = EAGAIN;
14240a2a96f3SJamie Gritton 		goto done_deref;
14250a2a96f3SJamie Gritton 	}
1426b38ff370SJamie Gritton 	if (jid != 0) {
1427b38ff370SJamie Gritton 		if (jid < 0) {
1428b38ff370SJamie Gritton 			error = EINVAL;
1429b38ff370SJamie Gritton 			vfs_opterror(opts, "negative jid");
14302a4b2251SJamie Gritton 			goto done_deref;
1431b38ff370SJamie Gritton 		}
14327de883c8SJamie Gritton 		/*
14337de883c8SJamie Gritton 		 * See if a requested jid already exists.  Keep track of
14347de883c8SJamie Gritton 		 * where it can be inserted later.
14357de883c8SJamie Gritton 		 */
14367de883c8SJamie Gritton 		TAILQ_FOREACH(inspr, &allprison, pr_list) {
1437f7496dcaSJamie Gritton 			if (inspr->pr_id < jid)
1438f7496dcaSJamie Gritton 				continue;
1439f7496dcaSJamie Gritton 			if (inspr->pr_id > jid)
1440f7496dcaSJamie Gritton 				break;
1441ed31b3f4SJamie Gritton 			if (prison_isalive(inspr)) {
14427de883c8SJamie Gritton 				pr = inspr;
1443f7496dcaSJamie Gritton 				mtx_lock(&pr->pr_mtx);
14442a4b2251SJamie Gritton 				drflags |= PD_LOCKED;
1445ed31b3f4SJamie Gritton 			} else {
1446ed31b3f4SJamie Gritton 				/* Note a dying jail to handle later. */
1447ed31b3f4SJamie Gritton 				deadpr = inspr;
1448ed31b3f4SJamie Gritton 			}
14497de883c8SJamie Gritton 			inspr = NULL;
14507de883c8SJamie Gritton 			break;
14517de883c8SJamie Gritton 		}
1452ed31b3f4SJamie Gritton 		if (cuflags == JAIL_CREATE && pr != NULL) {
14537de883c8SJamie Gritton 			/*
14547de883c8SJamie Gritton 			 * Even creators that cannot see the jail will
14557de883c8SJamie Gritton 			 * get EEXIST.
14567de883c8SJamie Gritton 			 */
1457b38ff370SJamie Gritton 			error = EEXIST;
1458ed31b3f4SJamie Gritton 			vfs_opterror(opts, "jail %d already exists", jid);
14592a4b2251SJamie Gritton 			goto done_deref;
1460b38ff370SJamie Gritton 		}
1461ed31b3f4SJamie Gritton 		if ((pr == NULL)
1462ed31b3f4SJamie Gritton 		    ? cuflags == JAIL_UPDATE
1463ed31b3f4SJamie Gritton 		    : !prison_ischild(mypr, pr)) {
14647de883c8SJamie Gritton 			/*
1465ed31b3f4SJamie Gritton 			 * Updaters get ENOENT for nonexistent jails,
1466ed31b3f4SJamie Gritton 			 * or for jails they cannot see.  The latter
1467ed31b3f4SJamie Gritton 			 * case is true even for CREATE | UPDATE,
14687de883c8SJamie Gritton 			 * which normally cannot give this error.
14697de883c8SJamie Gritton 			 */
14702a4b2251SJamie Gritton 			error = ENOENT;
14712a4b2251SJamie Gritton 			vfs_opterror(opts, "jail %d not found", jid);
14722a4b2251SJamie Gritton 			goto done_deref;
1473f7496dcaSJamie Gritton 		}
1474b38ff370SJamie Gritton 	}
1475b38ff370SJamie Gritton 	/*
1476b38ff370SJamie Gritton 	 * If the caller provided a name, look for a jail by that name.
1477b38ff370SJamie Gritton 	 * This has different semantics for creates and updates keyed by jid
1478b38ff370SJamie Gritton 	 * (where the name must not already exist in a different jail),
1479b38ff370SJamie Gritton 	 * and updates keyed by the name itself (where the name must exist
1480b38ff370SJamie Gritton 	 * because that is the jail being updated).
1481b38ff370SJamie Gritton 	 */
1482b6f47c23SJamie Gritton 	namelc = NULL;
1483b38ff370SJamie Gritton 	if (name != NULL) {
1484babbbb9cSJamie Gritton 		namelc = strrchr(name, '.');
1485babbbb9cSJamie Gritton 		if (namelc == NULL)
1486babbbb9cSJamie Gritton 			namelc = name;
1487babbbb9cSJamie Gritton 		else {
14880304c731SJamie Gritton 			/*
14890304c731SJamie Gritton 			 * This is a hierarchical name.  Split it into the
14900304c731SJamie Gritton 			 * parent and child names, and make sure the parent
14910304c731SJamie Gritton 			 * exists or matches an already found jail.
14920304c731SJamie Gritton 			 */
14930304c731SJamie Gritton 			if (pr != NULL) {
1494babbbb9cSJamie Gritton 				if (strncmp(name, ppr->pr_name, namelc - name)
1495babbbb9cSJamie Gritton 				    || ppr->pr_name[namelc - name] != '\0') {
14960304c731SJamie Gritton 					error = EINVAL;
14970304c731SJamie Gritton 					vfs_opterror(opts,
14980304c731SJamie Gritton 					    "cannot change jail's parent");
14992a4b2251SJamie Gritton 					goto done_deref;
15000304c731SJamie Gritton 				}
15010304c731SJamie Gritton 			} else {
1502b6f47c23SJamie Gritton 				*namelc = '\0';
15030304c731SJamie Gritton 				ppr = prison_find_name(mypr, name);
15040304c731SJamie Gritton 				if (ppr == NULL) {
15050304c731SJamie Gritton 					error = ENOENT;
15060304c731SJamie Gritton 					vfs_opterror(opts,
15070304c731SJamie Gritton 					    "jail \"%s\" not found", name);
15082a4b2251SJamie Gritton 					goto done_deref;
15090304c731SJamie Gritton 				}
1510c050ea80SJamie Gritton 				mtx_unlock(&ppr->pr_mtx);
15110a2a96f3SJamie Gritton 				if (!prison_isalive(ppr)) {
1512c050ea80SJamie Gritton 					error = ENOENT;
1513c050ea80SJamie Gritton 					vfs_opterror(opts,
1514c050ea80SJamie Gritton 					    "jail \"%s\" is dying", name);
1515c050ea80SJamie Gritton 					goto done_deref;
1516c050ea80SJamie Gritton 				}
1517b6f47c23SJamie Gritton 				*namelc = '.';
15180304c731SJamie Gritton 			}
1519b6f47c23SJamie Gritton 			namelc++;
15200304c731SJamie Gritton 		}
1521b6f47c23SJamie Gritton 		if (namelc[0] != '\0') {
1522b6f47c23SJamie Gritton 			pnamelen =
15230304c731SJamie Gritton 			    (ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1;
15240304c731SJamie Gritton 			FOREACH_PRISON_CHILD(ppr, tpr) {
1525ed31b3f4SJamie Gritton 				if (tpr == pr || !prison_isalive(tpr) ||
1526ed31b3f4SJamie Gritton 				    strcmp(tpr->pr_name + pnamelen, namelc))
1527ed31b3f4SJamie Gritton 					continue;
1528ed31b3f4SJamie Gritton 				if (cuflags == JAIL_CREATE || pr != NULL) {
1529b38ff370SJamie Gritton 					/*
1530ed31b3f4SJamie Gritton 					 * Create, or update(jid): name must
1531ed31b3f4SJamie Gritton 					 * not exist in an active sibling jail.
1532b38ff370SJamie Gritton 					 */
1533ed31b3f4SJamie Gritton 					error = EEXIST;
1534ed31b3f4SJamie Gritton 					vfs_opterror(opts,
1535ed31b3f4SJamie Gritton 					    "jail \"%s\" already exists", name);
1536ed31b3f4SJamie Gritton 					goto done_deref;
1537ed31b3f4SJamie Gritton 				}
1538ed31b3f4SJamie Gritton 				/* Use this jail for updates. */
1539b38ff370SJamie Gritton 				pr = tpr;
1540f7496dcaSJamie Gritton 				mtx_lock(&pr->pr_mtx);
154183bc72a0SJamie Gritton 				drflags |= PD_LOCKED;
1542b38ff370SJamie Gritton 				break;
1543b38ff370SJamie Gritton 			}
1544b38ff370SJamie Gritton 			/*
1545ed31b3f4SJamie Gritton 			 * Update: name must exist if no jid is specified.
1546ed31b3f4SJamie Gritton 			 * As with the jid case, the jail must be currently
1547ed31b3f4SJamie Gritton 			 * visible, or else even CREATE | UPDATE will get
1548ed31b3f4SJamie Gritton 			 * an error.
1549b38ff370SJamie Gritton 			 */
1550ed31b3f4SJamie Gritton 			if ((pr == NULL)
1551ed31b3f4SJamie Gritton 			    ? cuflags == JAIL_UPDATE
1552ed31b3f4SJamie Gritton 			    : !prison_isalive(pr)) {
1553b38ff370SJamie Gritton 				error = ENOENT;
1554b38ff370SJamie Gritton 				vfs_opterror(opts, "jail \"%s\" not found",
1555b38ff370SJamie Gritton 				    name);
15562a4b2251SJamie Gritton 				goto done_deref;
1557b38ff370SJamie Gritton 			}
1558b38ff370SJamie Gritton 		}
1559b38ff370SJamie Gritton 	}
1560b38ff370SJamie Gritton 	/* Update: must provide a jid or name. */
1561b38ff370SJamie Gritton 	else if (cuflags == JAIL_UPDATE && pr == NULL) {
1562b38ff370SJamie Gritton 		error = ENOENT;
1563b38ff370SJamie Gritton 		vfs_opterror(opts, "update specified no jail");
15642a4b2251SJamie Gritton 		goto done_deref;
1565b38ff370SJamie Gritton 	}
1566b38ff370SJamie Gritton 
1567b38ff370SJamie Gritton 	/* If there's no prison to update, create a new one and link it in. */
15682a4b2251SJamie Gritton 	created = pr == NULL;
15692a4b2251SJamie Gritton 	if (created) {
1570b97457e2SJamie Gritton 		for (tpr = mypr; tpr != NULL; tpr = tpr->pr_parent)
1571b97457e2SJamie Gritton 			if (tpr->pr_childcount >= tpr->pr_childmax) {
1572b97457e2SJamie Gritton 				error = EPERM;
1573b97457e2SJamie Gritton 				vfs_opterror(opts, "prison limit exceeded");
15742a4b2251SJamie Gritton 				goto done_deref;
1575b97457e2SJamie Gritton 			}
1576ed31b3f4SJamie Gritton 
1577ed31b3f4SJamie Gritton 		if (deadpr != NULL) {
1578ed31b3f4SJamie Gritton 			/*
1579ed31b3f4SJamie Gritton 			 * The prison being created has the same ID as a dying
1580ed31b3f4SJamie Gritton 			 * one.  Handle this by giving the dying jail a new ID.
1581ed31b3f4SJamie Gritton 			 * This may cause some confusion to user space, but
1582ed31b3f4SJamie Gritton 			 * only to those listing dying jails.
1583ed31b3f4SJamie Gritton 			 */
1584ed31b3f4SJamie Gritton 			deadid = get_next_deadid(&dinspr);
1585ed31b3f4SJamie Gritton 			if (deadid == 0) {
1586ed31b3f4SJamie Gritton 				error = EAGAIN;
1587ed31b3f4SJamie Gritton 				vfs_opterror(opts, "no available jail IDs");
1588ed31b3f4SJamie Gritton 				goto done_deref;
1589ed31b3f4SJamie Gritton 			}
1590ed31b3f4SJamie Gritton 			mtx_lock(&deadpr->pr_mtx);
1591ed31b3f4SJamie Gritton 			deadpr->pr_id = deadid;
1592ed31b3f4SJamie Gritton 			mtx_unlock(&deadpr->pr_mtx);
1593ed31b3f4SJamie Gritton 			if (dinspr == deadpr)
1594ed31b3f4SJamie Gritton 				inspr = deadpr;
1595ed31b3f4SJamie Gritton 			else {
1596ed31b3f4SJamie Gritton 				inspr = TAILQ_NEXT(deadpr, pr_list);
1597ed31b3f4SJamie Gritton 				TAILQ_REMOVE(&allprison, deadpr, pr_list);
1598ed31b3f4SJamie Gritton 				if (dinspr != NULL)
1599ed31b3f4SJamie Gritton 					TAILQ_INSERT_AFTER(&allprison, dinspr,
1600ed31b3f4SJamie Gritton 					    deadpr, pr_list);
1601ed31b3f4SJamie Gritton 				else
1602ed31b3f4SJamie Gritton 					TAILQ_INSERT_HEAD(&allprison, deadpr,
1603ed31b3f4SJamie Gritton 					    pr_list);
1604ed31b3f4SJamie Gritton 			}
1605ed31b3f4SJamie Gritton 		}
16067de883c8SJamie Gritton 		if (jid == 0 && (jid = get_next_prid(&inspr)) == 0) {
1607b38ff370SJamie Gritton 			error = EAGAIN;
16087de883c8SJamie Gritton 			vfs_opterror(opts, "no available jail IDs");
16092a4b2251SJamie Gritton 			goto done_deref;
1610b38ff370SJamie Gritton 		}
16112a4b2251SJamie Gritton 
16122a4b2251SJamie Gritton 		pr = malloc(sizeof(*pr), M_PRISON, M_WAITOK | M_ZERO);
16131158508aSJamie Gritton 		pr->pr_state = PRISON_STATE_INVALID;
16141158508aSJamie Gritton 		refcount_init(&pr->pr_ref, 1);
1615f7496dcaSJamie Gritton 		refcount_init(&pr->pr_uref, 0);
16161158508aSJamie Gritton 		drflags |= PD_DEREF;
16172a4b2251SJamie Gritton 		LIST_INIT(&pr->pr_children);
16182a4b2251SJamie Gritton 		mtx_init(&pr->pr_mtx, "jail mutex", NULL, MTX_DEF | MTX_DUPOK);
16192a4b2251SJamie Gritton 		TASK_INIT(&pr->pr_task, 0, prison_complete, pr);
16202a4b2251SJamie Gritton 
16217de883c8SJamie Gritton 		pr->pr_id = jid;
16227de883c8SJamie Gritton 		if (inspr != NULL)
16237de883c8SJamie Gritton 			TAILQ_INSERT_BEFORE(inspr, pr, pr_list);
16247de883c8SJamie Gritton 		else
1625b38ff370SJamie Gritton 			TAILQ_INSERT_TAIL(&allprison, pr, pr_list);
16267de883c8SJamie Gritton 
16277de883c8SJamie Gritton 		pr->pr_parent = ppr;
16280a2a96f3SJamie Gritton 		prison_hold(ppr);
16290a2a96f3SJamie Gritton 		prison_proc_hold(ppr);
16300304c731SJamie Gritton 		LIST_INSERT_HEAD(&ppr->pr_children, pr, pr_sibling);
16310304c731SJamie Gritton 		for (tpr = ppr; tpr != NULL; tpr = tpr->pr_parent)
1632b97457e2SJamie Gritton 			tpr->pr_childcount++;
1633b38ff370SJamie Gritton 
16340304c731SJamie Gritton 		/* Set some default values, and inherit some from the parent. */
1635b6f47c23SJamie Gritton 		if (namelc == NULL)
1636b6f47c23SJamie Gritton 			namelc = "";
1637b38ff370SJamie Gritton 		if (path == NULL) {
1638b38ff370SJamie Gritton 			path = "/";
16390304c731SJamie Gritton 			root = mypr->pr_root;
1640b38ff370SJamie Gritton 			vref(root);
1641b38ff370SJamie Gritton 		}
16428986e3a0SJamie Gritton 		strlcpy(pr->pr_hostuuid, DEFAULT_HOSTUUID, HOSTUUIDLEN);
16438986e3a0SJamie Gritton 		pr->pr_flags |= PR_HOST;
1644bdfc8cc4SJamie Gritton #if defined(INET) || defined(INET6)
1645bdfc8cc4SJamie Gritton #ifdef VIMAGE
1646bdfc8cc4SJamie Gritton 		if (!(pr_flags & PR_VNET))
1647bdfc8cc4SJamie Gritton #endif
1648bdfc8cc4SJamie Gritton 		{
16490304c731SJamie Gritton #ifdef INET
16502b0d6f81SJamie Gritton 			if (!(ch_flags & PR_IP4_USER))
16516a3f2779SJamie Gritton 				pr->pr_flags |= PR_IP4 | PR_IP4_USER;
16522b0d6f81SJamie Gritton 			else if (!(pr_flags & PR_IP4_USER)) {
16532b0d6f81SJamie Gritton 				pr->pr_flags |= ppr->pr_flags & PR_IP4;
1654eb8dcdeaSGleb Smirnoff 				prison_ip_dup(ppr, pr, PR_INET);
16552b0d6f81SJamie Gritton 			}
16560304c731SJamie Gritton #endif
16570304c731SJamie Gritton #ifdef INET6
16582b0d6f81SJamie Gritton 			if (!(ch_flags & PR_IP6_USER))
16596a3f2779SJamie Gritton 				pr->pr_flags |= PR_IP6 | PR_IP6_USER;
16602b0d6f81SJamie Gritton 			else if (!(pr_flags & PR_IP6_USER)) {
16612b0d6f81SJamie Gritton 				pr->pr_flags |= ppr->pr_flags & PR_IP6;
1662eb8dcdeaSGleb Smirnoff 				prison_ip_dup(ppr, pr, PR_INET6);
16632b0d6f81SJamie Gritton 			}
16640304c731SJamie Gritton #endif
1665bdfc8cc4SJamie Gritton 		}
1666bdfc8cc4SJamie Gritton #endif
1667592bcae8SBjoern A. Zeeb 		/* Source address selection is always on by default. */
1668592bcae8SBjoern A. Zeeb 		pr->pr_flags |= _PR_IP_SADDRSEL;
1669592bcae8SBjoern A. Zeeb 
16700304c731SJamie Gritton 		pr->pr_securelevel = ppr->pr_securelevel;
16710304c731SJamie Gritton 		pr->pr_allow = JAIL_DEFAULT_ALLOW & ppr->pr_allow;
1672af10bf05SBjoern A. Zeeb 		pr->pr_enforce_statfs = jail_default_enforce_statfs;
1673bf3db8aaSMartin Matuska 		pr->pr_devfs_rsnum = ppr->pr_devfs_rsnum;
1674b38ff370SJamie Gritton 
1675b96bd95bSIan Lepore 		pr->pr_osreldate = osreldt ? osreldt : ppr->pr_osreldate;
1676b96bd95bSIan Lepore 		if (osrelstr == NULL)
16771b786d01SBjoern A. Zeeb 			strlcpy(pr->pr_osrelease, ppr->pr_osrelease,
16781b786d01SBjoern A. Zeeb 			    sizeof(pr->pr_osrelease));
1679b96bd95bSIan Lepore 		else
16801b786d01SBjoern A. Zeeb 			strlcpy(pr->pr_osrelease, osrelstr,
16811b786d01SBjoern A. Zeeb 			    sizeof(pr->pr_osrelease));
1682b96bd95bSIan Lepore 
1683679e1390SJamie Gritton #ifdef VIMAGE
1684679e1390SJamie Gritton 		/* Allocate a new vnet if specified. */
1685679e1390SJamie Gritton 		pr->pr_vnet = (pr_flags & PR_VNET)
1686679e1390SJamie Gritton 		    ? vnet_alloc() : ppr->pr_vnet;
1687679e1390SJamie Gritton #endif
1688b38ff370SJamie Gritton 		/*
1689b38ff370SJamie Gritton 		 * Allocate a dedicated cpuset for each jail.
16908771ff75SGordon Bergling 		 * Unlike other initial settings, this may return an error.
1691b38ff370SJamie Gritton 		 */
16920304c731SJamie Gritton 		error = cpuset_create_root(ppr, &pr->pr_cpuset);
16932a4b2251SJamie Gritton 		if (error)
16942a4b2251SJamie Gritton 			goto done_deref;
1695b38ff370SJamie Gritton 
1696b38ff370SJamie Gritton 		mtx_lock(&pr->pr_mtx);
16972a4b2251SJamie Gritton 		drflags |= PD_LOCKED;
1698b38ff370SJamie Gritton 	} else {
16992b0d6f81SJamie Gritton 		/*
17002b0d6f81SJamie Gritton 		 * Grab a reference for existing prisons, to ensure they
17012b0d6f81SJamie Gritton 		 * continue to exist for the duration of the call.
17022b0d6f81SJamie Gritton 		 */
17036754ae25SJamie Gritton 		prison_hold(pr);
17042a4b2251SJamie Gritton 		drflags |= PD_DEREF;
1705bdfc8cc4SJamie Gritton #if defined(VIMAGE) && (defined(INET) || defined(INET6))
1706bdfc8cc4SJamie Gritton 		if ((pr->pr_flags & PR_VNET) &&
1707bdfc8cc4SJamie Gritton 		    (ch_flags & (PR_IP4_USER | PR_IP6_USER))) {
1708bdfc8cc4SJamie Gritton 			error = EINVAL;
1709bdfc8cc4SJamie Gritton 			vfs_opterror(opts,
1710bdfc8cc4SJamie Gritton 			    "vnet jails cannot have IP address restrictions");
17112a4b2251SJamie Gritton 			goto done_deref;
1712bdfc8cc4SJamie Gritton 		}
1713bdfc8cc4SJamie Gritton #endif
17142b0d6f81SJamie Gritton #ifdef INET
17152b0d6f81SJamie Gritton 		if (PR_IP4_USER & ch_flags & (pr_flags ^ pr->pr_flags)) {
17162b0d6f81SJamie Gritton 			error = EINVAL;
17172b0d6f81SJamie Gritton 			vfs_opterror(opts,
17182b0d6f81SJamie Gritton 			    "ip4 cannot be changed after creation");
17192a4b2251SJamie Gritton 			goto done_deref;
17202b0d6f81SJamie Gritton 		}
17212b0d6f81SJamie Gritton #endif
17222b0d6f81SJamie Gritton #ifdef INET6
17232b0d6f81SJamie Gritton 		if (PR_IP6_USER & ch_flags & (pr_flags ^ pr->pr_flags)) {
17242b0d6f81SJamie Gritton 			error = EINVAL;
17252b0d6f81SJamie Gritton 			vfs_opterror(opts,
17262b0d6f81SJamie Gritton 			    "ip6 cannot be changed after creation");
17272a4b2251SJamie Gritton 			goto done_deref;
17282b0d6f81SJamie Gritton 		}
17292b0d6f81SJamie Gritton #endif
1730b38ff370SJamie Gritton 	}
1731b38ff370SJamie Gritton 
1732b38ff370SJamie Gritton 	/* Do final error checking before setting anything. */
17330304c731SJamie Gritton 	if (gotslevel) {
17340304c731SJamie Gritton 		if (slevel < ppr->pr_securelevel) {
17350304c731SJamie Gritton 			error = EPERM;
17362a4b2251SJamie Gritton 			goto done_deref;
17370304c731SJamie Gritton 		}
17380304c731SJamie Gritton 	}
1739b97457e2SJamie Gritton 	if (gotchildmax) {
1740b97457e2SJamie Gritton 		if (childmax >= ppr->pr_childmax) {
1741b97457e2SJamie Gritton 			error = EPERM;
17422a4b2251SJamie Gritton 			goto done_deref;
1743b97457e2SJamie Gritton 		}
1744b97457e2SJamie Gritton 	}
17450304c731SJamie Gritton 	if (gotenforce) {
17460304c731SJamie Gritton 		if (enforce < ppr->pr_enforce_statfs) {
17470304c731SJamie Gritton 			error = EPERM;
17482a4b2251SJamie Gritton 			goto done_deref;
17490304c731SJamie Gritton 		}
17500304c731SJamie Gritton 	}
17510cc207a6SMartin Matuska 	if (gotrsnum) {
17520cc207a6SMartin Matuska 		/*
17530cc207a6SMartin Matuska 		 * devfs_rsnum is a uint16_t
17540cc207a6SMartin Matuska 		 */
1755bf3db8aaSMartin Matuska 		if (rsnum < 0 || rsnum > 65535) {
17560cc207a6SMartin Matuska 			error = EINVAL;
17572a4b2251SJamie Gritton 			goto done_deref;
17580cc207a6SMartin Matuska 		}
17590cc207a6SMartin Matuska 		/*
1760bf3db8aaSMartin Matuska 		 * Nested jails always inherit parent's devfs ruleset
17610cc207a6SMartin Matuska 		 */
17620cc207a6SMartin Matuska 		if (jailed(td->td_ucred)) {
17630cc207a6SMartin Matuska 			if (rsnum > 0 && rsnum != ppr->pr_devfs_rsnum) {
17640cc207a6SMartin Matuska 				error = EPERM;
17652a4b2251SJamie Gritton 				goto done_deref;
1766bf3db8aaSMartin Matuska 			} else
17670cc207a6SMartin Matuska 				rsnum = ppr->pr_devfs_rsnum;
17680cc207a6SMartin Matuska 		}
17690cc207a6SMartin Matuska 	}
1770b38ff370SJamie Gritton #ifdef INET
17712b0d6f81SJamie Gritton 	if (ip4s > 0) {
1772eb8dcdeaSGleb Smirnoff 		if ((ppr->pr_flags & PR_IP4) &&
1773eb8dcdeaSGleb Smirnoff 		    !prison_ip_parent_match(ppr->pr_addrs[PR_INET], ip4,
1774eb8dcdeaSGleb Smirnoff 		    PR_INET)) {
17750304c731SJamie Gritton 			error = EPERM;
17762a4b2251SJamie Gritton 			goto done_deref;
17770304c731SJamie Gritton 		}
1778eb8dcdeaSGleb Smirnoff 		if (!prison_ip_conflict_check(ppr, pr, ip4, PR_INET)) {
17790304c731SJamie Gritton 			error = EADDRINUSE;
1780eb8dcdeaSGleb Smirnoff 			vfs_opterror(opts, "IPv4 addresses clash");
17812a4b2251SJamie Gritton 			goto done_deref;
1782b38ff370SJamie Gritton 		}
17830304c731SJamie Gritton 	}
1784b38ff370SJamie Gritton #endif
1785b38ff370SJamie Gritton #ifdef INET6
17862b0d6f81SJamie Gritton 	if (ip6s > 0) {
1787eb8dcdeaSGleb Smirnoff 		if ((ppr->pr_flags & PR_IP6) &&
1788eb8dcdeaSGleb Smirnoff 		    !prison_ip_parent_match(ppr->pr_addrs[PR_INET6], ip6,
1789eb8dcdeaSGleb Smirnoff 		    PR_INET6)) {
17900304c731SJamie Gritton 			error = EPERM;
17912a4b2251SJamie Gritton 			goto done_deref;
17920304c731SJamie Gritton 		}
1793eb8dcdeaSGleb Smirnoff 		if (!prison_ip_conflict_check(ppr, pr, ip6, PR_INET6)) {
17940304c731SJamie Gritton 			error = EADDRINUSE;
1795eb8dcdeaSGleb Smirnoff 			vfs_opterror(opts, "IPv6 addresses clash");
17962a4b2251SJamie Gritton 			goto done_deref;
1797b38ff370SJamie Gritton 		}
17980304c731SJamie Gritton 	}
1799b38ff370SJamie Gritton #endif
18000304c731SJamie Gritton 	onamelen = namelen = 0;
1801b6f47c23SJamie Gritton 	if (namelc != NULL) {
18026ab6058eSJamie Gritton 		/* Give a default name of the jid.  Also allow the name to be
18036ab6058eSJamie Gritton 		 * explicitly the jid - but not any other number, and only in
18046ab6058eSJamie Gritton 		 * normal form (no leading zero/etc).
18056ab6058eSJamie Gritton 		 */
1806b6f47c23SJamie Gritton 		if (namelc[0] == '\0')
1807b6f47c23SJamie Gritton 			snprintf(namelc = numbuf, sizeof(numbuf), "%d", jid);
18086ab6058eSJamie Gritton 		else if ((strtoul(namelc, &p, 10) != jid ||
18096ab6058eSJamie Gritton 			  namelc[0] < '1' || namelc[0] > '9') && *p == '\0') {
1810b38ff370SJamie Gritton 			error = EINVAL;
1811babbbb9cSJamie Gritton 			vfs_opterror(opts,
1812babbbb9cSJamie Gritton 			    "name cannot be numeric (unless it is the jid)");
18132a4b2251SJamie Gritton 			goto done_deref;
1814b38ff370SJamie Gritton 		}
1815b38ff370SJamie Gritton 		/*
18160304c731SJamie Gritton 		 * Make sure the name isn't too long for the prison or its
18170304c731SJamie Gritton 		 * children.
1818b38ff370SJamie Gritton 		 */
1819b6f47c23SJamie Gritton 		pnamelen = (ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1;
1820b6f47c23SJamie Gritton 		onamelen = strlen(pr->pr_name + pnamelen);
1821b6f47c23SJamie Gritton 		namelen = strlen(namelc);
1822b6f47c23SJamie Gritton 		if (pnamelen + namelen + 1 > sizeof(pr->pr_name)) {
18230304c731SJamie Gritton 			error = ENAMETOOLONG;
18242a4b2251SJamie Gritton 			goto done_deref;
18250304c731SJamie Gritton 		}
18260304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT(pr, tpr, descend) {
18270304c731SJamie Gritton 			if (strlen(tpr->pr_name) + (namelen - onamelen) >=
18280304c731SJamie Gritton 			    sizeof(pr->pr_name)) {
18290304c731SJamie Gritton 				error = ENAMETOOLONG;
18302a4b2251SJamie Gritton 				goto done_deref;
18310304c731SJamie Gritton 			}
18320304c731SJamie Gritton 		}
18330304c731SJamie Gritton 	}
1834b3079544SJamie Gritton 	pr_allow_diff = pr_allow & ~ppr->pr_allow;
1835b3079544SJamie Gritton 	if (pr_allow_diff & ~PR_ALLOW_DIFFERENCES) {
18360304c731SJamie Gritton 		error = EPERM;
18372a4b2251SJamie Gritton 		goto done_deref;
1838b38ff370SJamie Gritton 	}
1839b38ff370SJamie Gritton 
1840b6f47c23SJamie Gritton 	/*
1841b6f47c23SJamie Gritton 	 * Let modules check their parameters.  This requires unlocking and
1842b6f47c23SJamie Gritton 	 * then re-locking the prison, but this is still a valid state as long
1843b6f47c23SJamie Gritton 	 * as allprison_lock remains xlocked.
1844b6f47c23SJamie Gritton 	 */
1845b6f47c23SJamie Gritton 	mtx_unlock(&pr->pr_mtx);
18462a4b2251SJamie Gritton 	drflags &= ~PD_LOCKED;
1847b6f47c23SJamie Gritton 	error = osd_jail_call(pr, PR_METHOD_CHECK, opts);
18482a4b2251SJamie Gritton 	if (error != 0)
18492a4b2251SJamie Gritton 		goto done_deref;
1850b6f47c23SJamie Gritton 	mtx_lock(&pr->pr_mtx);
18512a4b2251SJamie Gritton 	drflags |= PD_LOCKED;
1852b6f47c23SJamie Gritton 
1853b6f47c23SJamie Gritton 	/* At this point, all valid parameters should have been noted. */
1854b6f47c23SJamie Gritton 	TAILQ_FOREACH(opt, opts, link) {
1855b6f47c23SJamie Gritton 		if (!opt->seen && strcmp(opt->name, "errmsg")) {
1856b6f47c23SJamie Gritton 			error = EINVAL;
1857b6f47c23SJamie Gritton 			vfs_opterror(opts, "unknown parameter: %s", opt->name);
18582a4b2251SJamie Gritton 			goto done_deref;
1859b6f47c23SJamie Gritton 		}
1860b6f47c23SJamie Gritton 	}
1861b6f47c23SJamie Gritton 
1862b38ff370SJamie Gritton 	/* Set the parameters of the prison. */
1863b38ff370SJamie Gritton #ifdef INET
18648bce8d28SZhenlei Huang 	redo_ip4 = false;
18650304c731SJamie Gritton 	if (pr_flags & PR_IP4_USER) {
18660304c731SJamie Gritton 		pr->pr_flags |= PR_IP4;
1867eb8dcdeaSGleb Smirnoff 		prison_ip_set(pr, PR_INET, ip4);
1868b38ff370SJamie Gritton 		ip4 = NULL;
18690304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1870bdfc8cc4SJamie Gritton #ifdef VIMAGE
1871bdfc8cc4SJamie Gritton 			if (tpr->pr_flags & PR_VNET) {
1872bdfc8cc4SJamie Gritton 				descend = 0;
1873bdfc8cc4SJamie Gritton 				continue;
1874bdfc8cc4SJamie Gritton 			}
1875bdfc8cc4SJamie Gritton #endif
18768bce8d28SZhenlei Huang 			if (!prison_ip_restrict(tpr, PR_INET, NULL)) {
18778bce8d28SZhenlei Huang 				redo_ip4 = true;
18780304c731SJamie Gritton 				descend = 0;
18790304c731SJamie Gritton 			}
18800304c731SJamie Gritton 		}
18810304c731SJamie Gritton 	}
1882b38ff370SJamie Gritton #endif
1883b38ff370SJamie Gritton #ifdef INET6
18848bce8d28SZhenlei Huang 	redo_ip6 = false;
18850304c731SJamie Gritton 	if (pr_flags & PR_IP6_USER) {
18860304c731SJamie Gritton 		pr->pr_flags |= PR_IP6;
1887eb8dcdeaSGleb Smirnoff 		prison_ip_set(pr, PR_INET6, ip6);
1888b38ff370SJamie Gritton 		ip6 = NULL;
18890304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1890bdfc8cc4SJamie Gritton #ifdef VIMAGE
1891bdfc8cc4SJamie Gritton 			if (tpr->pr_flags & PR_VNET) {
1892bdfc8cc4SJamie Gritton 				descend = 0;
1893bdfc8cc4SJamie Gritton 				continue;
1894bdfc8cc4SJamie Gritton 			}
1895bdfc8cc4SJamie Gritton #endif
18968bce8d28SZhenlei Huang 			if (!prison_ip_restrict(tpr, PR_INET6, NULL)) {
18978bce8d28SZhenlei Huang 				redo_ip6 = true;
18980304c731SJamie Gritton 				descend = 0;
18990304c731SJamie Gritton 			}
19000304c731SJamie Gritton 		}
19010304c731SJamie Gritton 	}
1902b38ff370SJamie Gritton #endif
19030304c731SJamie Gritton 	if (gotslevel) {
1904b38ff370SJamie Gritton 		pr->pr_securelevel = slevel;
19050304c731SJamie Gritton 		/* Set all child jails to be at least this level. */
19060304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
19070304c731SJamie Gritton 			if (tpr->pr_securelevel < slevel)
19080304c731SJamie Gritton 				tpr->pr_securelevel = slevel;
19090304c731SJamie Gritton 	}
1910b97457e2SJamie Gritton 	if (gotchildmax) {
1911b97457e2SJamie Gritton 		pr->pr_childmax = childmax;
1912b97457e2SJamie Gritton 		/* Set all child jails to under this limit. */
1913b97457e2SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED_LEVEL(pr, tpr, descend, level)
1914b97457e2SJamie Gritton 			if (tpr->pr_childmax > childmax - level)
1915b97457e2SJamie Gritton 				tpr->pr_childmax = childmax > level
1916b97457e2SJamie Gritton 				    ? childmax - level : 0;
1917b97457e2SJamie Gritton 	}
19180304c731SJamie Gritton 	if (gotenforce) {
19190304c731SJamie Gritton 		pr->pr_enforce_statfs = enforce;
19200304c731SJamie Gritton 		/* Pass this restriction on to the children. */
19210304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
19220304c731SJamie Gritton 			if (tpr->pr_enforce_statfs < enforce)
19230304c731SJamie Gritton 				tpr->pr_enforce_statfs = enforce;
19240304c731SJamie Gritton 	}
19250cc207a6SMartin Matuska 	if (gotrsnum) {
19260cc207a6SMartin Matuska 		pr->pr_devfs_rsnum = rsnum;
19270cc207a6SMartin Matuska 		/* Pass this restriction on to the children. */
19280cc207a6SMartin Matuska 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
19290cc207a6SMartin Matuska 			tpr->pr_devfs_rsnum = rsnum;
19300cc207a6SMartin Matuska 	}
1931b6f47c23SJamie Gritton 	if (namelc != NULL) {
19320304c731SJamie Gritton 		if (ppr == &prison0)
1933b6f47c23SJamie Gritton 			strlcpy(pr->pr_name, namelc, sizeof(pr->pr_name));
19340304c731SJamie Gritton 		else
19350304c731SJamie Gritton 			snprintf(pr->pr_name, sizeof(pr->pr_name), "%s.%s",
1936b6f47c23SJamie Gritton 			    ppr->pr_name, namelc);
19370304c731SJamie Gritton 		/* Change this component of child names. */
19380304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
19390304c731SJamie Gritton 			bcopy(tpr->pr_name + onamelen, tpr->pr_name + namelen,
19400304c731SJamie Gritton 			    strlen(tpr->pr_name + onamelen) + 1);
19410304c731SJamie Gritton 			bcopy(pr->pr_name, tpr->pr_name, namelen);
19420304c731SJamie Gritton 		}
19430304c731SJamie Gritton 	}
1944b38ff370SJamie Gritton 	if (path != NULL) {
19450304c731SJamie Gritton 		/* Try to keep a real-rooted full pathname. */
1946b38ff370SJamie Gritton 		strlcpy(pr->pr_path, path, sizeof(pr->pr_path));
1947b38ff370SJamie Gritton 		pr->pr_root = root;
19482a4b2251SJamie Gritton 		root = NULL;
1949b38ff370SJamie Gritton 	}
195076ca6f88SJamie Gritton 	if (PR_HOST & ch_flags & ~pr_flags) {
195176ca6f88SJamie Gritton 		if (pr->pr_flags & PR_HOST) {
195276ca6f88SJamie Gritton 			/*
195376ca6f88SJamie Gritton 			 * Copy the parent's host info.  As with pr_ip4 above,
195476ca6f88SJamie Gritton 			 * the lack of a lock on the parent is not a problem;
195576ca6f88SJamie Gritton 			 * it is always set with allprison_lock at least
195676ca6f88SJamie Gritton 			 * shared, and is held exclusively here.
195776ca6f88SJamie Gritton 			 */
1958c1f19219SJamie Gritton 			strlcpy(pr->pr_hostname, pr->pr_parent->pr_hostname,
1959c1f19219SJamie Gritton 			    sizeof(pr->pr_hostname));
1960c1f19219SJamie Gritton 			strlcpy(pr->pr_domainname, pr->pr_parent->pr_domainname,
1961c1f19219SJamie Gritton 			    sizeof(pr->pr_domainname));
1962c1f19219SJamie Gritton 			strlcpy(pr->pr_hostuuid, pr->pr_parent->pr_hostuuid,
1963c1f19219SJamie Gritton 			    sizeof(pr->pr_hostuuid));
196476ca6f88SJamie Gritton 			pr->pr_hostid = pr->pr_parent->pr_hostid;
196576ca6f88SJamie Gritton 		}
196676ca6f88SJamie Gritton 	} else if (host != NULL || domain != NULL || uuid != NULL || gothid) {
196776ca6f88SJamie Gritton 		/* Set this prison, and any descendants without PR_HOST. */
1968b38ff370SJamie Gritton 		if (host != NULL)
1969c1f19219SJamie Gritton 			strlcpy(pr->pr_hostname, host, sizeof(pr->pr_hostname));
197076ca6f88SJamie Gritton 		if (domain != NULL)
1971c1f19219SJamie Gritton 			strlcpy(pr->pr_domainname, domain,
1972c1f19219SJamie Gritton 			    sizeof(pr->pr_domainname));
197376ca6f88SJamie Gritton 		if (uuid != NULL)
1974c1f19219SJamie Gritton 			strlcpy(pr->pr_hostuuid, uuid, sizeof(pr->pr_hostuuid));
197576ca6f88SJamie Gritton 		if (gothid)
197676ca6f88SJamie Gritton 			pr->pr_hostid = hid;
197776ca6f88SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
197876ca6f88SJamie Gritton 			if (tpr->pr_flags & PR_HOST)
197976ca6f88SJamie Gritton 				descend = 0;
198076ca6f88SJamie Gritton 			else {
198176ca6f88SJamie Gritton 				if (host != NULL)
1982c1f19219SJamie Gritton 					strlcpy(tpr->pr_hostname,
1983c1f19219SJamie Gritton 					    pr->pr_hostname,
1984c1f19219SJamie Gritton 					    sizeof(tpr->pr_hostname));
198576ca6f88SJamie Gritton 				if (domain != NULL)
1986c1f19219SJamie Gritton 					strlcpy(tpr->pr_domainname,
1987c1f19219SJamie Gritton 					    pr->pr_domainname,
1988c1f19219SJamie Gritton 					    sizeof(tpr->pr_domainname));
198976ca6f88SJamie Gritton 				if (uuid != NULL)
1990c1f19219SJamie Gritton 					strlcpy(tpr->pr_hostuuid,
1991c1f19219SJamie Gritton 					    pr->pr_hostuuid,
1992c1f19219SJamie Gritton 					    sizeof(tpr->pr_hostuuid));
199376ca6f88SJamie Gritton 				if (gothid)
199476ca6f88SJamie Gritton 					tpr->pr_hostid = hid;
199576ca6f88SJamie Gritton 			}
199676ca6f88SJamie Gritton 		}
199776ca6f88SJamie Gritton 	}
19980304c731SJamie Gritton 	pr->pr_allow = (pr->pr_allow & ~ch_allow) | pr_allow;
19990fe74ae6SJamie Gritton 	if ((tallow = ch_allow & ~pr_allow))
20000fe74ae6SJamie Gritton 		prison_set_allow_locked(pr, tallow, 0);
2001b38ff370SJamie Gritton 	/*
2002b38ff370SJamie Gritton 	 * Persistent prisons get an extra reference, and prisons losing their
20031158508aSJamie Gritton 	 * persist flag lose that reference.
2004b38ff370SJamie Gritton 	 */
20051158508aSJamie Gritton 	if (ch_flags & PR_PERSIST & (pr_flags ^ pr->pr_flags)) {
2006b38ff370SJamie Gritton 		if (pr_flags & PR_PERSIST) {
20076754ae25SJamie Gritton 			prison_hold(pr);
20081158508aSJamie Gritton 			/*
2009ed31b3f4SJamie Gritton 			 * This may be a new prison's first user reference,
2010ed31b3f4SJamie Gritton 			 * but wait to call it alive until after OSD calls
2011ed31b3f4SJamie Gritton 			 * have had a chance to run (and perhaps to fail).
20121158508aSJamie Gritton 			 */
20136754ae25SJamie Gritton 			refcount_acquire(&pr->pr_uref);
2014b38ff370SJamie Gritton 		} else {
201539c8ef90SJamie Gritton 			drflags |= PD_DEUREF;
2016f7496dcaSJamie Gritton 			prison_free_not_last(pr);
2017b38ff370SJamie Gritton 		}
2018b38ff370SJamie Gritton 	}
2019b38ff370SJamie Gritton 	pr->pr_flags = (pr->pr_flags & ~ch_flags) | pr_flags;
2020b38ff370SJamie Gritton 	mtx_unlock(&pr->pr_mtx);
20212a4b2251SJamie Gritton 	drflags &= ~PD_LOCKED;
2022c861373bSJamie Gritton 	/*
2023c861373bSJamie Gritton 	 * Any errors past this point will need to de-persist newly created
2024c861373bSJamie Gritton 	 * prisons, as well as call remove methods.
2025c861373bSJamie Gritton 	 */
2026ed31b3f4SJamie Gritton 	if (created)
2027c861373bSJamie Gritton 		drflags |= PD_KILL;
2028b38ff370SJamie Gritton 
2029a7ad07bfSEdward Tomasz Napierala #ifdef RACCT
20304b5c9cf6SEdward Tomasz Napierala 	if (racct_enable && created)
2031a7ad07bfSEdward Tomasz Napierala 		prison_racct_attach(pr);
2032a7ad07bfSEdward Tomasz Napierala #endif
2033a7ad07bfSEdward Tomasz Napierala 
20340304c731SJamie Gritton 	/* Locks may have prevented a complete restriction of child IP
20350304c731SJamie Gritton 	 * addresses.  If so, allocate some more memory and try again.
20360304c731SJamie Gritton 	 */
20370304c731SJamie Gritton #ifdef INET
20380304c731SJamie Gritton 	while (redo_ip4) {
2039eb8dcdeaSGleb Smirnoff 		ip4s = pr->pr_addrs[PR_INET]->ips;
20408bce8d28SZhenlei Huang 		MPASS(ip4 == NULL);
2041eb8dcdeaSGleb Smirnoff 		ip4 = prison_ip_alloc(PR_INET, ip4s, M_WAITOK);
20420304c731SJamie Gritton 		mtx_lock(&pr->pr_mtx);
20438bce8d28SZhenlei Huang 		redo_ip4 = false;
20440304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
2045bdfc8cc4SJamie Gritton #ifdef VIMAGE
2046bdfc8cc4SJamie Gritton 			if (tpr->pr_flags & PR_VNET) {
2047bdfc8cc4SJamie Gritton 				descend = 0;
2048bdfc8cc4SJamie Gritton 				continue;
2049bdfc8cc4SJamie Gritton 			}
2050bdfc8cc4SJamie Gritton #endif
2051b2d76b52SZhenlei Huang 			if (!prison_ip_restrict(tpr, PR_INET, &ip4))
2052b2d76b52SZhenlei Huang 				redo_ip4 = true;
20530304c731SJamie Gritton 		}
20540304c731SJamie Gritton 		mtx_unlock(&pr->pr_mtx);
20550304c731SJamie Gritton 	}
20560304c731SJamie Gritton #endif
20570304c731SJamie Gritton #ifdef INET6
20580304c731SJamie Gritton 	while (redo_ip6) {
2059eb8dcdeaSGleb Smirnoff 		ip6s = pr->pr_addrs[PR_INET6]->ips;
20608bce8d28SZhenlei Huang 		MPASS(ip6 == NULL);
2061eb8dcdeaSGleb Smirnoff 		ip6 = prison_ip_alloc(PR_INET6, ip6s, M_WAITOK);
20620304c731SJamie Gritton 		mtx_lock(&pr->pr_mtx);
20638bce8d28SZhenlei Huang 		redo_ip6 = false;
20640304c731SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
2065bdfc8cc4SJamie Gritton #ifdef VIMAGE
2066bdfc8cc4SJamie Gritton 			if (tpr->pr_flags & PR_VNET) {
2067bdfc8cc4SJamie Gritton 				descend = 0;
2068bdfc8cc4SJamie Gritton 				continue;
2069bdfc8cc4SJamie Gritton 			}
2070bdfc8cc4SJamie Gritton #endif
2071b2d76b52SZhenlei Huang 			if (!prison_ip_restrict(tpr, PR_INET6, &ip6))
2072b2d76b52SZhenlei Huang 				redo_ip6 = true;
20730304c731SJamie Gritton 		}
20740304c731SJamie Gritton 		mtx_unlock(&pr->pr_mtx);
20750304c731SJamie Gritton 	}
20760304c731SJamie Gritton #endif
20770304c731SJamie Gritton 
2078b38ff370SJamie Gritton 	/* Let the modules do their work. */
2079ed31b3f4SJamie Gritton 	if (created) {
2080b38ff370SJamie Gritton 		error = osd_jail_call(pr, PR_METHOD_CREATE, opts);
2081c861373bSJamie Gritton 		if (error)
20822a4b2251SJamie Gritton 			goto done_deref;
2083b38ff370SJamie Gritton 	}
2084b38ff370SJamie Gritton 	error = osd_jail_call(pr, PR_METHOD_SET, opts);
2085c861373bSJamie Gritton 	if (error)
20862a4b2251SJamie Gritton 		goto done_deref;
2087b38ff370SJamie Gritton 
20881158508aSJamie Gritton 	/*
20891158508aSJamie Gritton 	 * A new prison is now ready to be seen; either it has gained a user
20901158508aSJamie Gritton 	 * reference via persistence, or is about to gain one via attachment.
20911158508aSJamie Gritton 	 */
2092ed31b3f4SJamie Gritton 	if (created) {
20931158508aSJamie Gritton 		drflags = prison_lock_xlock(pr, drflags);
20941158508aSJamie Gritton 		pr->pr_state = PRISON_STATE_ALIVE;
20951158508aSJamie Gritton 	}
20961158508aSJamie Gritton 
2097b38ff370SJamie Gritton 	/* Attach this process to the prison if requested. */
2098b38ff370SJamie Gritton 	if (flags & JAIL_ATTACH) {
2099c861373bSJamie Gritton 		error = do_jail_attach(td, pr,
2100589e4c1dSJamie Gritton 		    prison_lock_xlock(pr, drflags & PD_LOCK_FLAGS));
2101f7496dcaSJamie Gritton 		drflags &= ~(PD_LOCKED | PD_LIST_XLOCKED);
2102b38ff370SJamie Gritton 		if (error) {
2103b38ff370SJamie Gritton 			vfs_opterror(opts, "attach failed");
21042a4b2251SJamie Gritton 			goto done_deref;
2105b38ff370SJamie Gritton 		}
2106b38ff370SJamie Gritton 	}
2107b38ff370SJamie Gritton 
21081fb24974SEdward Tomasz Napierala #ifdef RACCT
21094b5c9cf6SEdward Tomasz Napierala 	if (racct_enable && !created) {
2110701d6b50SJamie Gritton 		if (drflags & PD_LOCKED) {
2111701d6b50SJamie Gritton 			mtx_unlock(&pr->pr_mtx);
2112701d6b50SJamie Gritton 			drflags &= ~PD_LOCKED;
2113701d6b50SJamie Gritton 		}
2114f7496dcaSJamie Gritton 		if (drflags & PD_LIST_XLOCKED) {
2115f7496dcaSJamie Gritton 			sx_xunlock(&allprison_lock);
2116f7496dcaSJamie Gritton 			drflags &= ~PD_LIST_XLOCKED;
2117b4e87a63SJamie Gritton 		}
21181fb24974SEdward Tomasz Napierala 		prison_racct_modify(pr);
21191fb24974SEdward Tomasz Napierala 	}
21201fb24974SEdward Tomasz Napierala #endif
21211fb24974SEdward Tomasz Napierala 
2122ed31b3f4SJamie Gritton 	if (created && pr != &prison0 && (pr->pr_allow & PR_ALLOW_NFSD) != 0 &&
2123bba7a2e8SRick Macklem 	    (pr->pr_root->v_vflag & VV_ROOT) == 0)
2124bba7a2e8SRick Macklem 		printf("Warning jail jid=%d: mountd/nfsd requires a separate"
2125bba7a2e8SRick Macklem 		   " file system\n", pr->pr_id);
2126bba7a2e8SRick Macklem 
2127c861373bSJamie Gritton 	drflags &= ~PD_KILL;
21281fb24974SEdward Tomasz Napierala 	td->td_retval[0] = pr->pr_id;
21291fb24974SEdward Tomasz Napierala 
21302a4b2251SJamie Gritton  done_deref:
21312a4b2251SJamie Gritton 	/* Release any temporary prison holds and/or locks. */
21322a4b2251SJamie Gritton 	if (pr != NULL)
21332a4b2251SJamie Gritton 		prison_deref(pr, drflags);
21342a4b2251SJamie Gritton 	else if (drflags & PD_LIST_SLOCKED)
2135b38ff370SJamie Gritton 		sx_sunlock(&allprison_lock);
21362a4b2251SJamie Gritton 	else if (drflags & PD_LIST_XLOCKED)
2137b38ff370SJamie Gritton 		sx_xunlock(&allprison_lock);
21385050aa86SKonstantin Belousov 	if (root != NULL)
2139b38ff370SJamie Gritton 		vrele(root);
2140b38ff370SJamie Gritton  done_errmsg:
2141b38ff370SJamie Gritton 	if (error) {
21422a4b2251SJamie Gritton 		/* Write the error message back to userspace. */
2143176ff3a0SJamie Gritton 		if (vfs_getopt(opts, "errmsg", (void **)&errmsg,
2144176ff3a0SJamie Gritton 		    &errmsg_len) == 0 && errmsg_len > 0) {
2145b38ff370SJamie Gritton 			errmsg_pos = 2 * vfs_getopt_pos(opts, "errmsg") + 1;
2146b38ff370SJamie Gritton 			if (optuio->uio_segflg == UIO_SYSSPACE)
2147b38ff370SJamie Gritton 				bcopy(errmsg,
2148b38ff370SJamie Gritton 				    optuio->uio_iov[errmsg_pos].iov_base,
2149b38ff370SJamie Gritton 				    errmsg_len);
2150b38ff370SJamie Gritton 			else
2151abbc260fSMark Johnston 				(void)copyout(errmsg,
2152b38ff370SJamie Gritton 				    optuio->uio_iov[errmsg_pos].iov_base,
2153b38ff370SJamie Gritton 				    errmsg_len);
2154b38ff370SJamie Gritton 		}
2155b38ff370SJamie Gritton 	}
2156b38ff370SJamie Gritton  done_free:
2157b38ff370SJamie Gritton #ifdef INET
2158eb8dcdeaSGleb Smirnoff 	prison_ip_free(ip4);
2159b38ff370SJamie Gritton #endif
2160b38ff370SJamie Gritton #ifdef INET6
2161eb8dcdeaSGleb Smirnoff 	prison_ip_free(ip6);
2162b38ff370SJamie Gritton #endif
21636dfe0a3dSMartin Matuska 	if (g_path != NULL)
21646dfe0a3dSMartin Matuska 		free(g_path, M_TEMP);
2165b38ff370SJamie Gritton 	vfs_freeopts(opts);
2166b38ff370SJamie Gritton 	return (error);
2167b38ff370SJamie Gritton }
2168b38ff370SJamie Gritton 
2169b38ff370SJamie Gritton /*
21707de883c8SJamie Gritton  * Find the next available prison ID.  Return the ID on success, or zero
21717de883c8SJamie Gritton  * on failure.  Also set a pointer to the allprison list entry the prison
21727de883c8SJamie Gritton  * should be inserted before.
21737de883c8SJamie Gritton  */
21747de883c8SJamie Gritton static int
21757de883c8SJamie Gritton get_next_prid(struct prison **insprp)
21767de883c8SJamie Gritton {
21777de883c8SJamie Gritton 	struct prison *inspr;
21787de883c8SJamie Gritton 	int jid, maxid;
21797de883c8SJamie Gritton 
21807de883c8SJamie Gritton 	jid = lastprid % JAIL_MAX + 1;
21817de883c8SJamie Gritton 	if (TAILQ_EMPTY(&allprison) ||
21827de883c8SJamie Gritton 	    TAILQ_LAST(&allprison, prisonlist)->pr_id < jid) {
21837de883c8SJamie Gritton 		/*
21847de883c8SJamie Gritton 		 * A common case is for all jails to be implicitly numbered,
21857de883c8SJamie Gritton 		 * which means they'll go on the end of the list, at least
21867de883c8SJamie Gritton 		 * for the first JAIL_MAX times.
21877de883c8SJamie Gritton 		 */
21887de883c8SJamie Gritton 		inspr = NULL;
21897de883c8SJamie Gritton 	} else {
21907de883c8SJamie Gritton 		/*
21917de883c8SJamie Gritton 		 * Take two passes through the allprison list: first starting
21927de883c8SJamie Gritton 		 * with the proposed jid, then ending with it.
21937de883c8SJamie Gritton 		 */
21947de883c8SJamie Gritton 		for (maxid = JAIL_MAX; maxid != 0; ) {
21957de883c8SJamie Gritton 			TAILQ_FOREACH(inspr, &allprison, pr_list) {
21967de883c8SJamie Gritton 				if (inspr->pr_id < jid)
21977de883c8SJamie Gritton 					continue;
2198f7496dcaSJamie Gritton 				if (inspr->pr_id > jid) {
2199f7496dcaSJamie Gritton 					/* Found an opening. */
22007de883c8SJamie Gritton 					maxid = 0;
22017de883c8SJamie Gritton 					break;
22027de883c8SJamie Gritton 				}
22037de883c8SJamie Gritton 				if (++jid > maxid) {
22047de883c8SJamie Gritton 					if (lastprid == maxid || lastprid == 0)
22057de883c8SJamie Gritton 					{
22067de883c8SJamie Gritton 						/*
22077de883c8SJamie Gritton 						 * The entire legal range
22087de883c8SJamie Gritton 						 * has been traversed
22097de883c8SJamie Gritton 						 */
22107de883c8SJamie Gritton 						return 0;
22117de883c8SJamie Gritton 					}
22127de883c8SJamie Gritton 					/* Try again from the start. */
22137de883c8SJamie Gritton 					jid = 1;
22147de883c8SJamie Gritton 					maxid = lastprid;
22157de883c8SJamie Gritton 					break;
22167de883c8SJamie Gritton 				}
22177de883c8SJamie Gritton 			}
22187de883c8SJamie Gritton 			if (inspr == NULL) {
22197de883c8SJamie Gritton 				/* Found room at the end of the list. */
22207de883c8SJamie Gritton 				break;
22217de883c8SJamie Gritton 			}
22227de883c8SJamie Gritton 		}
22237de883c8SJamie Gritton 	}
22247de883c8SJamie Gritton 	*insprp = inspr;
22257de883c8SJamie Gritton 	lastprid = jid;
22267de883c8SJamie Gritton 	return (jid);
22277de883c8SJamie Gritton }
22287de883c8SJamie Gritton 
22297de883c8SJamie Gritton /*
2230ed31b3f4SJamie Gritton  * Find the next available ID for a renumbered dead prison.  This is the same
2231ed31b3f4SJamie Gritton  * as get_next_prid, but counting backward from the end of the range.
2232ed31b3f4SJamie Gritton  */
2233ed31b3f4SJamie Gritton static int
2234ed31b3f4SJamie Gritton get_next_deadid(struct prison **dinsprp)
2235ed31b3f4SJamie Gritton {
2236ed31b3f4SJamie Gritton 	struct prison *dinspr;
2237ed31b3f4SJamie Gritton 	int deadid, minid;
2238ed31b3f4SJamie Gritton 
2239ed31b3f4SJamie Gritton 	deadid = lastdeadid ? lastdeadid - 1 : JAIL_MAX;
2240ed31b3f4SJamie Gritton 	/*
2241ed31b3f4SJamie Gritton 	 * Take two reverse passes through the allprison list: first
2242ed31b3f4SJamie Gritton 	 * starting with the proposed deadid, then ending with it.
2243ed31b3f4SJamie Gritton 	 */
2244ed31b3f4SJamie Gritton 	for (minid = 1; minid != 0; ) {
2245ed31b3f4SJamie Gritton 		TAILQ_FOREACH_REVERSE(dinspr, &allprison, prisonlist, pr_list) {
2246ed31b3f4SJamie Gritton 			if (dinspr->pr_id > deadid)
2247ed31b3f4SJamie Gritton 				continue;
2248ed31b3f4SJamie Gritton 			if (dinspr->pr_id < deadid) {
2249ed31b3f4SJamie Gritton 				/* Found an opening. */
2250ed31b3f4SJamie Gritton 				minid = 0;
2251ed31b3f4SJamie Gritton 				break;
2252ed31b3f4SJamie Gritton 			}
2253ed31b3f4SJamie Gritton 			if (--deadid < minid) {
2254ed31b3f4SJamie Gritton 				if (lastdeadid == minid || lastdeadid == 0)
2255ed31b3f4SJamie Gritton 				{
2256ed31b3f4SJamie Gritton 					/*
2257ed31b3f4SJamie Gritton 					 * The entire legal range
2258ed31b3f4SJamie Gritton 					 * has been traversed
2259ed31b3f4SJamie Gritton 					 */
2260ed31b3f4SJamie Gritton 					return 0;
2261ed31b3f4SJamie Gritton 				}
2262ed31b3f4SJamie Gritton 				/* Try again from the end. */
2263ed31b3f4SJamie Gritton 				deadid = JAIL_MAX;
2264ed31b3f4SJamie Gritton 				minid = lastdeadid;
2265ed31b3f4SJamie Gritton 				break;
2266ed31b3f4SJamie Gritton 			}
2267ed31b3f4SJamie Gritton 		}
2268ed31b3f4SJamie Gritton 		if (dinspr == NULL) {
2269ed31b3f4SJamie Gritton 			/* Found room at the beginning of the list. */
2270ed31b3f4SJamie Gritton 			break;
2271ed31b3f4SJamie Gritton 		}
2272ed31b3f4SJamie Gritton 	}
2273ed31b3f4SJamie Gritton 	*dinsprp = dinspr;
2274ed31b3f4SJamie Gritton 	lastdeadid = deadid;
2275ed31b3f4SJamie Gritton 	return (deadid);
2276ed31b3f4SJamie Gritton }
2277ed31b3f4SJamie Gritton 
2278ed31b3f4SJamie Gritton /*
2279b38ff370SJamie Gritton  * struct jail_get_args {
2280b38ff370SJamie Gritton  *	struct iovec *iovp;
2281b38ff370SJamie Gritton  *	unsigned int iovcnt;
2282b38ff370SJamie Gritton  *	int flags;
2283b38ff370SJamie Gritton  * };
2284b38ff370SJamie Gritton  */
2285b38ff370SJamie Gritton int
22868451d0ddSKip Macy sys_jail_get(struct thread *td, struct jail_get_args *uap)
2287b38ff370SJamie Gritton {
2288b38ff370SJamie Gritton 	struct uio *auio;
2289b38ff370SJamie Gritton 	int error;
2290b38ff370SJamie Gritton 
2291b38ff370SJamie Gritton 	/* Check that we have an even number of iovecs. */
2292b38ff370SJamie Gritton 	if (uap->iovcnt & 1)
2293b38ff370SJamie Gritton 		return (EINVAL);
2294b38ff370SJamie Gritton 
2295b38ff370SJamie Gritton 	error = copyinuio(uap->iovp, uap->iovcnt, &auio);
2296b38ff370SJamie Gritton 	if (error)
2297b38ff370SJamie Gritton 		return (error);
2298b38ff370SJamie Gritton 	error = kern_jail_get(td, auio, uap->flags);
2299b38ff370SJamie Gritton 	if (error == 0)
2300b38ff370SJamie Gritton 		error = copyout(auio->uio_iov, uap->iovp,
2301b38ff370SJamie Gritton 		    uap->iovcnt * sizeof(struct iovec));
230261cc4830SAlfredo Mazzinghi 	freeuio(auio);
2303b38ff370SJamie Gritton 	return (error);
2304b38ff370SJamie Gritton }
2305b38ff370SJamie Gritton 
2306b38ff370SJamie Gritton int
2307b38ff370SJamie Gritton kern_jail_get(struct thread *td, struct uio *optuio, int flags)
2308b38ff370SJamie Gritton {
2309672756aaSJamie Gritton 	struct bool_flags *bf;
2310672756aaSJamie Gritton 	struct jailsys_flags *jsf;
23110304c731SJamie Gritton 	struct prison *pr, *mypr;
2312b38ff370SJamie Gritton 	struct vfsopt *opt;
2313b38ff370SJamie Gritton 	struct vfsoptlist *opts;
2314b38ff370SJamie Gritton 	char *errmsg, *name;
23152a4b2251SJamie Gritton 	int drflags, error, errmsg_len, errmsg_pos, i, jid, len, pos;
2316672756aaSJamie Gritton 	unsigned f;
2317b38ff370SJamie Gritton 
2318b38ff370SJamie Gritton 	if (flags & ~JAIL_GET_MASK)
2319b38ff370SJamie Gritton 		return (EINVAL);
2320b38ff370SJamie Gritton 
2321b38ff370SJamie Gritton 	/* Get the parameter list. */
2322b38ff370SJamie Gritton 	error = vfs_buildopts(optuio, &opts);
2323b38ff370SJamie Gritton 	if (error)
2324b38ff370SJamie Gritton 		return (error);
2325b38ff370SJamie Gritton 	errmsg_pos = vfs_getopt_pos(opts, "errmsg");
23260304c731SJamie Gritton 	mypr = td->td_ucred->cr_prison;
23272a4b2251SJamie Gritton 	pr = NULL;
23281e2a13e6SJamie Gritton 
2329b38ff370SJamie Gritton 	/*
2330b38ff370SJamie Gritton 	 * Find the prison specified by one of: lastjid, jid, name.
2331b38ff370SJamie Gritton 	 */
2332b38ff370SJamie Gritton 	sx_slock(&allprison_lock);
23332a4b2251SJamie Gritton 	drflags = PD_LIST_SLOCKED;
2334b38ff370SJamie Gritton 	error = vfs_copyopt(opts, "lastjid", &jid, sizeof(jid));
2335b38ff370SJamie Gritton 	if (error == 0) {
2336b38ff370SJamie Gritton 		TAILQ_FOREACH(pr, &allprison, pr_list) {
2337f7496dcaSJamie Gritton 			if (pr->pr_id > jid &&
2338f7496dcaSJamie Gritton 			    ((flags & JAIL_DYING) || prison_isalive(pr)) &&
2339f7496dcaSJamie Gritton 			    prison_ischild(mypr, pr)) {
2340b38ff370SJamie Gritton 				mtx_lock(&pr->pr_mtx);
23412a4b2251SJamie Gritton 				drflags |= PD_LOCKED;
2342b38ff370SJamie Gritton 				goto found_prison;
23432a4b2251SJamie Gritton 			}
2344f7496dcaSJamie Gritton 		}
2345b38ff370SJamie Gritton 		error = ENOENT;
2346b38ff370SJamie Gritton 		vfs_opterror(opts, "no jail after %d", jid);
23472a4b2251SJamie Gritton 		goto done;
2348b38ff370SJamie Gritton 	} else if (error != ENOENT)
23492a4b2251SJamie Gritton 		goto done;
2350b38ff370SJamie Gritton 
2351b38ff370SJamie Gritton 	error = vfs_copyopt(opts, "jid", &jid, sizeof(jid));
2352b38ff370SJamie Gritton 	if (error == 0) {
2353b38ff370SJamie Gritton 		if (jid != 0) {
23540304c731SJamie Gritton 			pr = prison_find_child(mypr, jid);
2355b38ff370SJamie Gritton 			if (pr != NULL) {
23562a4b2251SJamie Gritton 				drflags |= PD_LOCKED;
235776ad42abSJamie Gritton 				if (!(prison_isalive(pr) ||
235876ad42abSJamie Gritton 				    (flags & JAIL_DYING))) {
2359b38ff370SJamie Gritton 					error = ENOENT;
2360b38ff370SJamie Gritton 					vfs_opterror(opts, "jail %d is dying",
2361b38ff370SJamie Gritton 					    jid);
23622a4b2251SJamie Gritton 					goto done;
2363b38ff370SJamie Gritton 				}
2364b38ff370SJamie Gritton 				goto found_prison;
2365b38ff370SJamie Gritton 			}
2366b38ff370SJamie Gritton 			error = ENOENT;
2367b38ff370SJamie Gritton 			vfs_opterror(opts, "jail %d not found", jid);
23682a4b2251SJamie Gritton 			goto done;
2369b38ff370SJamie Gritton 		}
2370b38ff370SJamie Gritton 	} else if (error != ENOENT)
23712a4b2251SJamie Gritton 		goto done;
2372b38ff370SJamie Gritton 
2373b38ff370SJamie Gritton 	error = vfs_getopt(opts, "name", (void **)&name, &len);
2374b38ff370SJamie Gritton 	if (error == 0) {
2375b38ff370SJamie Gritton 		if (len == 0 || name[len - 1] != '\0') {
2376b38ff370SJamie Gritton 			error = EINVAL;
23772a4b2251SJamie Gritton 			goto done;
2378b38ff370SJamie Gritton 		}
23790304c731SJamie Gritton 		pr = prison_find_name(mypr, name);
2380b38ff370SJamie Gritton 		if (pr != NULL) {
23812a4b2251SJamie Gritton 			drflags |= PD_LOCKED;
238276ad42abSJamie Gritton 			if (!(prison_isalive(pr) || (flags & JAIL_DYING))) {
2383b38ff370SJamie Gritton 				error = ENOENT;
2384b38ff370SJamie Gritton 				vfs_opterror(opts, "jail \"%s\" is dying",
2385b38ff370SJamie Gritton 				    name);
23862a4b2251SJamie Gritton 				goto done;
2387b38ff370SJamie Gritton 			}
2388b38ff370SJamie Gritton 			goto found_prison;
2389b38ff370SJamie Gritton 		}
2390b38ff370SJamie Gritton 		error = ENOENT;
2391b38ff370SJamie Gritton 		vfs_opterror(opts, "jail \"%s\" not found", name);
23922a4b2251SJamie Gritton 		goto done;
2393b38ff370SJamie Gritton 	} else if (error != ENOENT)
23942a4b2251SJamie Gritton 		goto done;
2395b38ff370SJamie Gritton 
2396b38ff370SJamie Gritton 	vfs_opterror(opts, "no jail specified");
2397b38ff370SJamie Gritton 	error = ENOENT;
23982a4b2251SJamie Gritton 	goto done;
2399b38ff370SJamie Gritton 
2400b38ff370SJamie Gritton  found_prison:
2401b38ff370SJamie Gritton 	/* Get the parameters of the prison. */
24026754ae25SJamie Gritton 	prison_hold(pr);
24032a4b2251SJamie Gritton 	drflags |= PD_DEREF;
2404b38ff370SJamie Gritton 	td->td_retval[0] = pr->pr_id;
2405b38ff370SJamie Gritton 	error = vfs_setopt(opts, "jid", &pr->pr_id, sizeof(pr->pr_id));
2406b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
24072a4b2251SJamie Gritton 		goto done;
24080304c731SJamie Gritton 	i = (pr->pr_parent == mypr) ? 0 : pr->pr_parent->pr_id;
24090304c731SJamie Gritton 	error = vfs_setopt(opts, "parent", &i, sizeof(i));
2410b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
24112a4b2251SJamie Gritton 		goto done;
24120304c731SJamie Gritton 	error = vfs_setopts(opts, "name", prison_name(mypr, pr));
24130304c731SJamie Gritton 	if (error != 0 && error != ENOENT)
24142a4b2251SJamie Gritton 		goto done;
24150304c731SJamie Gritton 	error = vfs_setopt(opts, "cpuset.id", &pr->pr_cpuset->cs_id,
2416b38ff370SJamie Gritton 	    sizeof(pr->pr_cpuset->cs_id));
2417b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
24182a4b2251SJamie Gritton 		goto done;
24190304c731SJamie Gritton 	error = vfs_setopts(opts, "path", prison_path(mypr, pr));
2420b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
24212a4b2251SJamie Gritton 		goto done;
2422b38ff370SJamie Gritton #ifdef INET
2423500f82d6SZhenlei Huang 	error = vfs_setopt_part(opts, "ip4.addr", pr->pr_addrs[PR_INET]->pr_ip,
2424eb8dcdeaSGleb Smirnoff 	    pr->pr_addrs[PR_INET] ? pr->pr_addrs[PR_INET]->ips *
2425eb8dcdeaSGleb Smirnoff 	    pr_families[PR_INET].size : 0 );
2426b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
24272a4b2251SJamie Gritton 		goto done;
2428b38ff370SJamie Gritton #endif
2429b38ff370SJamie Gritton #ifdef INET6
2430500f82d6SZhenlei Huang 	error = vfs_setopt_part(opts, "ip6.addr", pr->pr_addrs[PR_INET6]->pr_ip,
2431eb8dcdeaSGleb Smirnoff 	    pr->pr_addrs[PR_INET6] ? pr->pr_addrs[PR_INET6]->ips *
2432eb8dcdeaSGleb Smirnoff 	    pr_families[PR_INET6].size : 0 );
2433b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
24342a4b2251SJamie Gritton 		goto done;
2435b38ff370SJamie Gritton #endif
2436b38ff370SJamie Gritton 	error = vfs_setopt(opts, "securelevel", &pr->pr_securelevel,
2437b38ff370SJamie Gritton 	    sizeof(pr->pr_securelevel));
2438b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
24392a4b2251SJamie Gritton 		goto done;
2440b97457e2SJamie Gritton 	error = vfs_setopt(opts, "children.cur", &pr->pr_childcount,
2441b97457e2SJamie Gritton 	    sizeof(pr->pr_childcount));
2442b97457e2SJamie Gritton 	if (error != 0 && error != ENOENT)
24432a4b2251SJamie Gritton 		goto done;
2444b97457e2SJamie Gritton 	error = vfs_setopt(opts, "children.max", &pr->pr_childmax,
2445b97457e2SJamie Gritton 	    sizeof(pr->pr_childmax));
2446b97457e2SJamie Gritton 	if (error != 0 && error != ENOENT)
24472a4b2251SJamie Gritton 		goto done;
2448c1f19219SJamie Gritton 	error = vfs_setopts(opts, "host.hostname", pr->pr_hostname);
2449b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
24502a4b2251SJamie Gritton 		goto done;
2451c1f19219SJamie Gritton 	error = vfs_setopts(opts, "host.domainname", pr->pr_domainname);
245276ca6f88SJamie Gritton 	if (error != 0 && error != ENOENT)
24532a4b2251SJamie Gritton 		goto done;
2454c1f19219SJamie Gritton 	error = vfs_setopts(opts, "host.hostuuid", pr->pr_hostuuid);
245576ca6f88SJamie Gritton 	if (error != 0 && error != ENOENT)
24562a4b2251SJamie Gritton 		goto done;
2457841c0c7eSNathan Whitehorn #ifdef COMPAT_FREEBSD32
2458a5c1afadSDmitry Chagin 	if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) {
245976ca6f88SJamie Gritton 		uint32_t hid32 = pr->pr_hostid;
246076ca6f88SJamie Gritton 
246176ca6f88SJamie Gritton 		error = vfs_setopt(opts, "host.hostid", &hid32, sizeof(hid32));
246276ca6f88SJamie Gritton 	} else
246376ca6f88SJamie Gritton #endif
246476ca6f88SJamie Gritton 	error = vfs_setopt(opts, "host.hostid", &pr->pr_hostid,
246576ca6f88SJamie Gritton 	    sizeof(pr->pr_hostid));
246676ca6f88SJamie Gritton 	if (error != 0 && error != ENOENT)
24672a4b2251SJamie Gritton 		goto done;
24680304c731SJamie Gritton 	error = vfs_setopt(opts, "enforce_statfs", &pr->pr_enforce_statfs,
24690304c731SJamie Gritton 	    sizeof(pr->pr_enforce_statfs));
24700304c731SJamie Gritton 	if (error != 0 && error != ENOENT)
24712a4b2251SJamie Gritton 		goto done;
24720cc207a6SMartin Matuska 	error = vfs_setopt(opts, "devfs_ruleset", &pr->pr_devfs_rsnum,
24730cc207a6SMartin Matuska 	    sizeof(pr->pr_devfs_rsnum));
24740cc207a6SMartin Matuska 	if (error != 0 && error != ENOENT)
24752a4b2251SJamie Gritton 		goto done;
2476672756aaSJamie Gritton 	for (bf = pr_flag_bool;
2477672756aaSJamie Gritton 	     bf < pr_flag_bool + nitems(pr_flag_bool);
2478672756aaSJamie Gritton 	     bf++) {
2479672756aaSJamie Gritton 		i = (pr->pr_flags & bf->flag) ? 1 : 0;
2480672756aaSJamie Gritton 		error = vfs_setopt(opts, bf->name, &i, sizeof(i));
2481b38ff370SJamie Gritton 		if (error != 0 && error != ENOENT)
24822a4b2251SJamie Gritton 			goto done;
2483b38ff370SJamie Gritton 		i = !i;
2484672756aaSJamie Gritton 		error = vfs_setopt(opts, bf->noname, &i, sizeof(i));
2485b38ff370SJamie Gritton 		if (error != 0 && error != ENOENT)
24862a4b2251SJamie Gritton 			goto done;
24870304c731SJamie Gritton 	}
2488672756aaSJamie Gritton 	for (jsf = pr_flag_jailsys;
2489672756aaSJamie Gritton 	     jsf < pr_flag_jailsys + nitems(pr_flag_jailsys);
2490672756aaSJamie Gritton 	     jsf++) {
2491672756aaSJamie Gritton 		f = pr->pr_flags & (jsf->disable | jsf->new);
2492672756aaSJamie Gritton 		i = (f != 0 && f == jsf->disable) ? JAIL_SYS_DISABLE
2493672756aaSJamie Gritton 		    : (f == jsf->new) ? JAIL_SYS_NEW
24947cbf7213SJamie Gritton 		    : JAIL_SYS_INHERIT;
2495672756aaSJamie Gritton 		error = vfs_setopt(opts, jsf->name, &i, sizeof(i));
24967cbf7213SJamie Gritton 		if (error != 0 && error != ENOENT)
24972a4b2251SJamie Gritton 			goto done;
24987cbf7213SJamie Gritton 	}
2499672756aaSJamie Gritton 	for (bf = pr_flag_allow;
25005d58f959SJamie Gritton 	     bf < pr_flag_allow + nitems(pr_flag_allow) &&
25015d58f959SJamie Gritton 		atomic_load_int(&bf->flag) != 0;
2502672756aaSJamie Gritton 	     bf++) {
2503672756aaSJamie Gritton 		i = (pr->pr_allow & bf->flag) ? 1 : 0;
2504672756aaSJamie Gritton 		error = vfs_setopt(opts, bf->name, &i, sizeof(i));
25050304c731SJamie Gritton 		if (error != 0 && error != ENOENT)
25062a4b2251SJamie Gritton 			goto done;
25070304c731SJamie Gritton 		i = !i;
2508672756aaSJamie Gritton 		error = vfs_setopt(opts, bf->noname, &i, sizeof(i));
25090304c731SJamie Gritton 		if (error != 0 && error != ENOENT)
25102a4b2251SJamie Gritton 			goto done;
25110304c731SJamie Gritton 	}
251276ad42abSJamie Gritton 	i = !prison_isalive(pr);
2513b38ff370SJamie Gritton 	error = vfs_setopt(opts, "dying", &i, sizeof(i));
2514b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
25152a4b2251SJamie Gritton 		goto done;
2516b38ff370SJamie Gritton 	i = !i;
2517b38ff370SJamie Gritton 	error = vfs_setopt(opts, "nodying", &i, sizeof(i));
2518b38ff370SJamie Gritton 	if (error != 0 && error != ENOENT)
25192a4b2251SJamie Gritton 		goto done;
2520bd96bd15SIan Lepore 	error = vfs_setopt(opts, "osreldate", &pr->pr_osreldate,
2521bd96bd15SIan Lepore 	    sizeof(pr->pr_osreldate));
2522a1a4c1b0SIan Lepore 	if (error != 0 && error != ENOENT)
25232a4b2251SJamie Gritton 		goto done;
2524a1a4c1b0SIan Lepore 	error = vfs_setopts(opts, "osrelease", pr->pr_osrelease);
2525a1a4c1b0SIan Lepore 	if (error != 0 && error != ENOENT)
25262a4b2251SJamie Gritton 		goto done;
2527b38ff370SJamie Gritton 
2528b38ff370SJamie Gritton 	/* Get the module parameters. */
2529b38ff370SJamie Gritton 	mtx_unlock(&pr->pr_mtx);
25302a4b2251SJamie Gritton 	drflags &= ~PD_LOCKED;
2531b38ff370SJamie Gritton 	error = osd_jail_call(pr, PR_METHOD_GET, opts);
2532b38ff370SJamie Gritton 	if (error)
25332a4b2251SJamie Gritton 		goto done;
25342a4b2251SJamie Gritton 	prison_deref(pr, drflags);
25352a4b2251SJamie Gritton 	pr = NULL;
25362a4b2251SJamie Gritton 	drflags = 0;
2537b38ff370SJamie Gritton 
2538b38ff370SJamie Gritton 	/* By now, all parameters should have been noted. */
2539b38ff370SJamie Gritton 	TAILQ_FOREACH(opt, opts, link) {
2540b38ff370SJamie Gritton 		if (!opt->seen && strcmp(opt->name, "errmsg")) {
2541b38ff370SJamie Gritton 			error = EINVAL;
2542b38ff370SJamie Gritton 			vfs_opterror(opts, "unknown parameter: %s", opt->name);
25432a4b2251SJamie Gritton 			goto done;
2544b38ff370SJamie Gritton 		}
2545b38ff370SJamie Gritton 	}
2546b38ff370SJamie Gritton 
2547b38ff370SJamie Gritton 	/* Write the fetched parameters back to userspace. */
2548b38ff370SJamie Gritton 	error = 0;
2549b38ff370SJamie Gritton 	TAILQ_FOREACH(opt, opts, link) {
2550b38ff370SJamie Gritton 		if (opt->pos >= 0 && opt->pos != errmsg_pos) {
2551b38ff370SJamie Gritton 			pos = 2 * opt->pos + 1;
2552b38ff370SJamie Gritton 			optuio->uio_iov[pos].iov_len = opt->len;
2553b38ff370SJamie Gritton 			if (opt->value != NULL) {
2554b38ff370SJamie Gritton 				if (optuio->uio_segflg == UIO_SYSSPACE) {
2555b38ff370SJamie Gritton 					bcopy(opt->value,
2556b38ff370SJamie Gritton 					    optuio->uio_iov[pos].iov_base,
2557b38ff370SJamie Gritton 					    opt->len);
2558b38ff370SJamie Gritton 				} else {
2559b38ff370SJamie Gritton 					error = copyout(opt->value,
2560b38ff370SJamie Gritton 					    optuio->uio_iov[pos].iov_base,
2561b38ff370SJamie Gritton 					    opt->len);
2562b38ff370SJamie Gritton 					if (error)
2563b38ff370SJamie Gritton 						break;
2564b38ff370SJamie Gritton 				}
2565b38ff370SJamie Gritton 			}
2566b38ff370SJamie Gritton 		}
2567b38ff370SJamie Gritton 	}
2568b38ff370SJamie Gritton 
25692a4b2251SJamie Gritton  done:
25702a4b2251SJamie Gritton 	/* Release any temporary prison holds and/or locks. */
25712a4b2251SJamie Gritton 	if (pr != NULL)
25722a4b2251SJamie Gritton 		prison_deref(pr, drflags);
25732a4b2251SJamie Gritton 	else if (drflags & PD_LIST_SLOCKED)
2574b38ff370SJamie Gritton 		sx_sunlock(&allprison_lock);
2575b38ff370SJamie Gritton 	if (error && errmsg_pos >= 0) {
25762a4b2251SJamie Gritton 		/* Write the error message back to userspace. */
2577b38ff370SJamie Gritton 		vfs_getopt(opts, "errmsg", (void **)&errmsg, &errmsg_len);
2578b38ff370SJamie Gritton 		errmsg_pos = 2 * errmsg_pos + 1;
2579b38ff370SJamie Gritton 		if (errmsg_len > 0) {
2580b38ff370SJamie Gritton 			if (optuio->uio_segflg == UIO_SYSSPACE)
2581b38ff370SJamie Gritton 				bcopy(errmsg,
2582b38ff370SJamie Gritton 				    optuio->uio_iov[errmsg_pos].iov_base,
2583b38ff370SJamie Gritton 				    errmsg_len);
2584b38ff370SJamie Gritton 			else
2585abbc260fSMark Johnston 				(void)copyout(errmsg,
2586b38ff370SJamie Gritton 				    optuio->uio_iov[errmsg_pos].iov_base,
2587b38ff370SJamie Gritton 				    errmsg_len);
2588b38ff370SJamie Gritton 		}
2589b38ff370SJamie Gritton 	}
2590b38ff370SJamie Gritton 	vfs_freeopts(opts);
2591b38ff370SJamie Gritton 	return (error);
2592b38ff370SJamie Gritton }
2593b38ff370SJamie Gritton 
2594b38ff370SJamie Gritton /*
2595b38ff370SJamie Gritton  * struct jail_remove_args {
2596b38ff370SJamie Gritton  *	int jid;
2597b38ff370SJamie Gritton  * };
2598b38ff370SJamie Gritton  */
2599b38ff370SJamie Gritton int
26008451d0ddSKip Macy sys_jail_remove(struct thread *td, struct jail_remove_args *uap)
2601b38ff370SJamie Gritton {
2602c861373bSJamie Gritton 	struct prison *pr;
2603c861373bSJamie Gritton 	int error;
2604b38ff370SJamie Gritton 
2605b38ff370SJamie Gritton 	error = priv_check(td, PRIV_JAIL_REMOVE);
2606b38ff370SJamie Gritton 	if (error)
2607b38ff370SJamie Gritton 		return (error);
2608b38ff370SJamie Gritton 
2609b38ff370SJamie Gritton 	sx_xlock(&allprison_lock);
26100304c731SJamie Gritton 	pr = prison_find_child(td->td_ucred->cr_prison, uap->jid);
2611b38ff370SJamie Gritton 	if (pr == NULL) {
2612b38ff370SJamie Gritton 		sx_xunlock(&allprison_lock);
2613b38ff370SJamie Gritton 		return (EINVAL);
2614b38ff370SJamie Gritton 	}
2615c861373bSJamie Gritton 	if (!prison_isalive(pr)) {
2616c861373bSJamie Gritton 		/* Silently ignore already-dying prisons. */
26170304c731SJamie Gritton 		mtx_unlock(&pr->pr_mtx);
2618c861373bSJamie Gritton 		sx_xunlock(&allprison_lock);
26190304c731SJamie Gritton 		return (0);
26200304c731SJamie Gritton 	}
2621c861373bSJamie Gritton 	prison_deref(pr, PD_KILL | PD_LOCKED | PD_LIST_XLOCKED);
2622c861373bSJamie Gritton 	return (0);
262375c13541SPoul-Henning Kamp }
262475c13541SPoul-Henning Kamp 
2625fd7a8150SMike Barcroft /*
26269ddb7954SMike Barcroft  * struct jail_attach_args {
26279ddb7954SMike Barcroft  *	int jid;
26289ddb7954SMike Barcroft  * };
2629fd7a8150SMike Barcroft  */
2630fd7a8150SMike Barcroft int
26318451d0ddSKip Macy sys_jail_attach(struct thread *td, struct jail_attach_args *uap)
2632fd7a8150SMike Barcroft {
2633b38ff370SJamie Gritton 	struct prison *pr;
2634b38ff370SJamie Gritton 	int error;
2635b38ff370SJamie Gritton 
2636b38ff370SJamie Gritton 	error = priv_check(td, PRIV_JAIL_ATTACH);
2637b38ff370SJamie Gritton 	if (error)
2638b38ff370SJamie Gritton 		return (error);
2639b38ff370SJamie Gritton 
2640f7496dcaSJamie Gritton 	sx_slock(&allprison_lock);
26410304c731SJamie Gritton 	pr = prison_find_child(td->td_ucred->cr_prison, uap->jid);
2642b38ff370SJamie Gritton 	if (pr == NULL) {
2643b38ff370SJamie Gritton 		sx_sunlock(&allprison_lock);
2644b38ff370SJamie Gritton 		return (EINVAL);
2645b38ff370SJamie Gritton 	}
2646b38ff370SJamie Gritton 
264776ad42abSJamie Gritton 	/* Do not allow a process to attach to a prison that is not alive. */
264876ad42abSJamie Gritton 	if (!prison_isalive(pr)) {
2649b38ff370SJamie Gritton 		mtx_unlock(&pr->pr_mtx);
2650b38ff370SJamie Gritton 		sx_sunlock(&allprison_lock);
2651b38ff370SJamie Gritton 		return (EINVAL);
2652b38ff370SJamie Gritton 	}
2653b38ff370SJamie Gritton 
2654f7496dcaSJamie Gritton 	return (do_jail_attach(td, pr, PD_LOCKED | PD_LIST_SLOCKED));
2655b38ff370SJamie Gritton }
2656b38ff370SJamie Gritton 
2657b38ff370SJamie Gritton static int
2658f7496dcaSJamie Gritton do_jail_attach(struct thread *td, struct prison *pr, int drflags)
2659b38ff370SJamie Gritton {
2660fd7a8150SMike Barcroft 	struct proc *p;
2661fd7a8150SMike Barcroft 	struct ucred *newcred, *oldcred;
26625050aa86SKonstantin Belousov 	int error;
2663fd7a8150SMike Barcroft 
2664f7496dcaSJamie Gritton 	mtx_assert(&pr->pr_mtx, MA_OWNED);
2665f7496dcaSJamie Gritton 	sx_assert(&allprison_lock, SX_LOCKED);
2666589e4c1dSJamie Gritton 	drflags &= PD_LOCK_FLAGS;
266757f22bd4SJacques Vidrine 	/*
266857f22bd4SJacques Vidrine 	 * XXX: Note that there is a slight race here if two threads
266957f22bd4SJacques Vidrine 	 * in the same privileged process attempt to attach to two
267057f22bd4SJacques Vidrine 	 * different jails at the same time.  It is important for
267157f22bd4SJacques Vidrine 	 * user processes not to do this, or they might end up with
267257f22bd4SJacques Vidrine 	 * a process root from one prison, but attached to the jail
267357f22bd4SJacques Vidrine 	 * of another.
267457f22bd4SJacques Vidrine 	 */
26751158508aSJamie Gritton 	prison_hold(pr);
26766754ae25SJamie Gritton 	refcount_acquire(&pr->pr_uref);
2677f7496dcaSJamie Gritton 	drflags |= PD_DEREF | PD_DEUREF;
2678fd7a8150SMike Barcroft 	mtx_unlock(&pr->pr_mtx);
2679f7496dcaSJamie Gritton 	drflags &= ~PD_LOCKED;
2680b38ff370SJamie Gritton 
2681b38ff370SJamie Gritton 	/* Let modules do whatever they need to prepare for attaching. */
2682b38ff370SJamie Gritton 	error = osd_jail_call(pr, PR_METHOD_ATTACH, td);
2683b38ff370SJamie Gritton 	if (error) {
2684f7496dcaSJamie Gritton 		prison_deref(pr, drflags);
2685b38ff370SJamie Gritton 		return (error);
2686b38ff370SJamie Gritton 	}
2687f7496dcaSJamie Gritton 	sx_unlock(&allprison_lock);
2688f7496dcaSJamie Gritton 	drflags &= ~(PD_LIST_SLOCKED | PD_LIST_XLOCKED);
2689fd7a8150SMike Barcroft 
2690413628a7SBjoern A. Zeeb 	/*
2691413628a7SBjoern A. Zeeb 	 * Reparent the newly attached process to this jail.
2692413628a7SBjoern A. Zeeb 	 */
2693b38ff370SJamie Gritton 	p = td->td_proc;
2694413628a7SBjoern A. Zeeb 	error = cpuset_setproc_update_set(p, pr->pr_cpuset);
2695413628a7SBjoern A. Zeeb 	if (error)
2696b38ff370SJamie Gritton 		goto e_revert_osd;
2697413628a7SBjoern A. Zeeb 
2698cb05b60aSAttilio Rao 	vn_lock(pr->pr_root, LK_EXCLUSIVE | LK_RETRY);
2699fd7a8150SMike Barcroft 	if ((error = change_dir(pr->pr_root, td)) != 0)
2700fd7a8150SMike Barcroft 		goto e_unlock;
2701fd7a8150SMike Barcroft #ifdef MAC
270230d239bcSRobert Watson 	if ((error = mac_vnode_check_chroot(td->td_ucred, pr->pr_root)))
2703fd7a8150SMike Barcroft 		goto e_unlock;
2704fd7a8150SMike Barcroft #endif
2705b249ce48SMateusz Guzik 	VOP_UNLOCK(pr->pr_root);
2706d4380c0cSJamie Gritton 	if ((error = pwd_chroot_chdir(td, pr->pr_root)))
27075050aa86SKonstantin Belousov 		goto e_revert_osd;
2708fd7a8150SMike Barcroft 
2709fd7a8150SMike Barcroft 	newcred = crget();
2710fd7a8150SMike Barcroft 	PROC_LOCK(p);
27111fb6767dSJamie Gritton 	oldcred = crcopysafe(p, newcred);
271269c4ee54SJohn Baldwin 	newcred->cr_prison = pr;
2713daf63fd2SMateusz Guzik 	proc_set_cred(p, newcred);
27141fb6767dSJamie Gritton 	setsugid(p);
2715097055e2SEdward Tomasz Napierala #ifdef RACCT
2716097055e2SEdward Tomasz Napierala 	racct_proc_ucred_changed(p, oldcred, newcred);
2717f87beb93SAndriy Gapon 	crhold(newcred);
2718f87beb93SAndriy Gapon #endif
2719f87beb93SAndriy Gapon 	PROC_UNLOCK(p);
2720f87beb93SAndriy Gapon #ifdef RCTL
2721f87beb93SAndriy Gapon 	rctl_proc_ucred_changed(p, newcred);
2722f87beb93SAndriy Gapon 	crfree(newcred);
2723097055e2SEdward Tomasz Napierala #endif
27245ecb5444SMateusz Guzik 	prison_proc_relink(oldcred->cr_prison, pr, p);
2725f7496dcaSJamie Gritton 	prison_deref(oldcred->cr_prison, drflags);
2726fd7a8150SMike Barcroft 	crfree(oldcred);
2727cc7b7306SJamie Gritton 
2728cc7b7306SJamie Gritton 	/*
2729cc7b7306SJamie Gritton 	 * If the prison was killed while changing credentials, die along
2730cc7b7306SJamie Gritton 	 * with it.
2731cc7b7306SJamie Gritton 	 */
2732cc7b7306SJamie Gritton 	if (!prison_isalive(pr)) {
2733cc7b7306SJamie Gritton 		PROC_LOCK(p);
2734cc7b7306SJamie Gritton 		kern_psignal(p, SIGKILL);
2735cc7b7306SJamie Gritton 		PROC_UNLOCK(p);
2736cc7b7306SJamie Gritton 	}
2737cc7b7306SJamie Gritton 
2738fd7a8150SMike Barcroft 	return (0);
27391fb6767dSJamie Gritton 
2740fd7a8150SMike Barcroft  e_unlock:
2741b249ce48SMateusz Guzik 	VOP_UNLOCK(pr->pr_root);
2742b38ff370SJamie Gritton  e_revert_osd:
2743b38ff370SJamie Gritton 	/* Tell modules this thread is still in its old jail after all. */
27447f4e7248SJamie Gritton 	sx_slock(&allprison_lock);
2745f7496dcaSJamie Gritton 	drflags |= PD_LIST_SLOCKED;
27461fb6767dSJamie Gritton 	(void)osd_jail_call(td->td_ucred->cr_prison, PR_METHOD_ATTACH, td);
2747f7496dcaSJamie Gritton 	prison_deref(pr, drflags);
2748fd7a8150SMike Barcroft 	return (error);
2749fd7a8150SMike Barcroft }
2750fd7a8150SMike Barcroft 
2751fd7a8150SMike Barcroft /*
2752fd7a8150SMike Barcroft  * Returns a locked prison instance, or NULL on failure.
2753fd7a8150SMike Barcroft  */
275454b369c1SPawel Jakub Dawidek struct prison *
2755fd7a8150SMike Barcroft prison_find(int prid)
2756fd7a8150SMike Barcroft {
2757fd7a8150SMike Barcroft 	struct prison *pr;
2758fd7a8150SMike Barcroft 
2759dc68a633SPawel Jakub Dawidek 	sx_assert(&allprison_lock, SX_LOCKED);
2760b38ff370SJamie Gritton 	TAILQ_FOREACH(pr, &allprison, pr_list) {
2761f7496dcaSJamie Gritton 		if (pr->pr_id < prid)
2762f7496dcaSJamie Gritton 			continue;
27637de883c8SJamie Gritton 		if (pr->pr_id > prid)
27647de883c8SJamie Gritton 			break;
2765f7496dcaSJamie Gritton 		KASSERT(prison_isvalid(pr), ("Found invalid prison %p", pr));
2766f7496dcaSJamie Gritton 		mtx_lock(&pr->pr_mtx);
2767f7496dcaSJamie Gritton 		return (pr);
2768fd7a8150SMike Barcroft 	}
2769fd7a8150SMike Barcroft 	return (NULL);
2770fd7a8150SMike Barcroft }
2771fd7a8150SMike Barcroft 
2772b38ff370SJamie Gritton /*
27730304c731SJamie Gritton  * Find a prison that is a descendant of mypr.  Returns a locked prison or NULL.
2774b38ff370SJamie Gritton  */
2775b38ff370SJamie Gritton struct prison *
27760304c731SJamie Gritton prison_find_child(struct prison *mypr, int prid)
2777b38ff370SJamie Gritton {
27780304c731SJamie Gritton 	struct prison *pr;
27790304c731SJamie Gritton 	int descend;
2780b38ff370SJamie Gritton 
2781b38ff370SJamie Gritton 	sx_assert(&allprison_lock, SX_LOCKED);
27820304c731SJamie Gritton 	FOREACH_PRISON_DESCENDANT(mypr, pr, descend) {
27830304c731SJamie Gritton 		if (pr->pr_id == prid) {
2784f7496dcaSJamie Gritton 			KASSERT(prison_isvalid(pr),
2785f7496dcaSJamie Gritton 			    ("Found invalid prison %p", pr));
27860304c731SJamie Gritton 			mtx_lock(&pr->pr_mtx);
27870304c731SJamie Gritton 			return (pr);
27880304c731SJamie Gritton 		}
27890304c731SJamie Gritton 	}
27900304c731SJamie Gritton 	return (NULL);
27910304c731SJamie Gritton }
27920304c731SJamie Gritton 
27930304c731SJamie Gritton /*
27940304c731SJamie Gritton  * Look for the name relative to mypr.  Returns a locked prison or NULL.
27950304c731SJamie Gritton  */
27960304c731SJamie Gritton struct prison *
27970304c731SJamie Gritton prison_find_name(struct prison *mypr, const char *name)
27980304c731SJamie Gritton {
27990304c731SJamie Gritton 	struct prison *pr, *deadpr;
28000304c731SJamie Gritton 	size_t mylen;
28010304c731SJamie Gritton 	int descend;
28020304c731SJamie Gritton 
28030304c731SJamie Gritton 	sx_assert(&allprison_lock, SX_LOCKED);
28040304c731SJamie Gritton 	mylen = (mypr == &prison0) ? 0 : strlen(mypr->pr_name) + 1;
2805b38ff370SJamie Gritton 	deadpr = NULL;
28060304c731SJamie Gritton 	FOREACH_PRISON_DESCENDANT(mypr, pr, descend) {
28070304c731SJamie Gritton 		if (!strcmp(pr->pr_name + mylen, name)) {
2808f7496dcaSJamie Gritton 			KASSERT(prison_isvalid(pr),
2809f7496dcaSJamie Gritton 			    ("Found invalid prison %p", pr));
2810f7496dcaSJamie Gritton 			if (prison_isalive(pr)) {
2811b38ff370SJamie Gritton 				mtx_lock(&pr->pr_mtx);
2812b38ff370SJamie Gritton 				return (pr);
2813f7496dcaSJamie Gritton 			}
2814b38ff370SJamie Gritton 			deadpr = pr;
2815b38ff370SJamie Gritton 		}
2816b38ff370SJamie Gritton 	}
28170304c731SJamie Gritton 	/* There was no valid prison - perhaps there was a dying one. */
2818f7496dcaSJamie Gritton 	if (deadpr != NULL)
2819b38ff370SJamie Gritton 		mtx_lock(&deadpr->pr_mtx);
2820b38ff370SJamie Gritton 	return (deadpr);
2821b38ff370SJamie Gritton }
2822b38ff370SJamie Gritton 
2823b38ff370SJamie Gritton /*
28240fe74ae6SJamie Gritton  * See if a prison has the specific flag set.  The prison should be locked,
28250fe74ae6SJamie Gritton  * unless checking for flags that are only set at jail creation (such as
28260fe74ae6SJamie Gritton  * PR_IP4 and PR_IP6), or only the single bit is examined, without regard
28270fe74ae6SJamie Gritton  * to any other prison data.
28280304c731SJamie Gritton  */
28290b0ae2e4SMina Galić bool
28300304c731SJamie Gritton prison_flag(struct ucred *cred, unsigned flag)
28310304c731SJamie Gritton {
28320304c731SJamie Gritton 
28330b0ae2e4SMina Galić 	return ((cred->cr_prison->pr_flags & flag) != 0);
28340304c731SJamie Gritton }
28350304c731SJamie Gritton 
28360b0ae2e4SMina Galić /*
28370b0ae2e4SMina Galić  * See if a prison has the specific allow flag set.
28380b0ae2e4SMina Galić  * The prison *should* be locked, or only a single bit is examined, without
28390b0ae2e4SMina Galić  * regard to any other prison data.
28400b0ae2e4SMina Galić  */
28410b0ae2e4SMina Galić bool
28420304c731SJamie Gritton prison_allow(struct ucred *cred, unsigned flag)
28430304c731SJamie Gritton {
28440304c731SJamie Gritton 
28450fe74ae6SJamie Gritton 	return ((cred->cr_prison->pr_allow & flag) != 0);
28460304c731SJamie Gritton }
28470304c731SJamie Gritton 
28480304c731SJamie Gritton /*
2849effad35eSJamie Gritton  * Hold a prison reference, by incrementing pr_ref.  It is generally
2850effad35eSJamie Gritton  * an error to hold a prison that does not already have a reference.
2851effad35eSJamie Gritton  * A prison record will remain valid as long as it has at least one
2852effad35eSJamie Gritton  * reference, and will not be removed as long as either the prison
2853effad35eSJamie Gritton  * mutex or the allprison lock is held (allprison_lock may be shared).
2854effad35eSJamie Gritton  */
2855effad35eSJamie Gritton void
2856effad35eSJamie Gritton prison_hold_locked(struct prison *pr)
2857effad35eSJamie Gritton {
2858effad35eSJamie Gritton 
28596754ae25SJamie Gritton 	/* Locking is no longer required. */
28606754ae25SJamie Gritton 	prison_hold(pr);
2861effad35eSJamie Gritton }
2862effad35eSJamie Gritton 
2863effad35eSJamie Gritton void
2864effad35eSJamie Gritton prison_hold(struct prison *pr)
2865effad35eSJamie Gritton {
28666754ae25SJamie Gritton #ifdef INVARIANTS
28676754ae25SJamie Gritton 	int was_valid = refcount_acquire_if_not_zero(&pr->pr_ref);
2868effad35eSJamie Gritton 
28696754ae25SJamie Gritton 	KASSERT(was_valid,
28706754ae25SJamie Gritton 	    ("Trying to hold dead prison %p (jid=%d).", pr, pr->pr_id));
28716754ae25SJamie Gritton #else
28726754ae25SJamie Gritton 	refcount_acquire(&pr->pr_ref);
28736754ae25SJamie Gritton #endif
2874effad35eSJamie Gritton }
2875effad35eSJamie Gritton 
2876effad35eSJamie Gritton /*
2877effad35eSJamie Gritton  * Remove a prison reference.  If that was the last reference, the
2878f7496dcaSJamie Gritton  * prison will be removed (at a later time).
2879b38ff370SJamie Gritton  */
288091421ba2SRobert Watson void
28811ba4a712SPawel Jakub Dawidek prison_free_locked(struct prison *pr)
288291421ba2SRobert Watson {
288391421ba2SRobert Watson 
28841ba4a712SPawel Jakub Dawidek 	mtx_assert(&pr->pr_mtx, MA_OWNED);
2885effad35eSJamie Gritton 	/*
2886f7496dcaSJamie Gritton 	 * Locking is no longer required, but unlock because the caller
2887f7496dcaSJamie Gritton 	 * expects it.
2888effad35eSJamie Gritton 	 */
2889f7496dcaSJamie Gritton 	mtx_unlock(&pr->pr_mtx);
2890f7496dcaSJamie Gritton 	prison_free(pr);
2891effad35eSJamie Gritton }
2892c2cda609SPawel Jakub Dawidek 
28931ba4a712SPawel Jakub Dawidek void
28941ba4a712SPawel Jakub Dawidek prison_free(struct prison *pr)
28951ba4a712SPawel Jakub Dawidek {
28961ba4a712SPawel Jakub Dawidek 
28976754ae25SJamie Gritton 	KASSERT(refcount_load(&pr->pr_ref) > 0,
28986754ae25SJamie Gritton 	    ("Trying to free dead prison %p (jid=%d).",
28996754ae25SJamie Gritton 	     pr, pr->pr_id));
2900f7496dcaSJamie Gritton 	if (!refcount_release_if_not_last(&pr->pr_ref)) {
2901f7496dcaSJamie Gritton 		/*
2902f7496dcaSJamie Gritton 		 * Don't remove the last reference in this context,
2903f7496dcaSJamie Gritton 		 * in case there are locks held.
2904f7496dcaSJamie Gritton 		 */
2905f7496dcaSJamie Gritton 		taskqueue_enqueue(taskqueue_thread, &pr->pr_task);
2906f7496dcaSJamie Gritton 	}
2907f7496dcaSJamie Gritton }
2908f7496dcaSJamie Gritton 
2909f7496dcaSJamie Gritton static void
2910f7496dcaSJamie Gritton prison_free_not_last(struct prison *pr)
2911f7496dcaSJamie Gritton {
2912f7496dcaSJamie Gritton #ifdef INVARIANTS
2913f7496dcaSJamie Gritton 	int lastref;
2914f7496dcaSJamie Gritton 
2915f7496dcaSJamie Gritton 	KASSERT(refcount_load(&pr->pr_ref) > 0,
2916f7496dcaSJamie Gritton 	    ("Trying to free dead prison %p (jid=%d).",
2917f7496dcaSJamie Gritton 	     pr, pr->pr_id));
2918f7496dcaSJamie Gritton 	lastref = refcount_release(&pr->pr_ref);
2919f7496dcaSJamie Gritton 	KASSERT(!lastref,
2920f7496dcaSJamie Gritton 	    ("prison_free_not_last freed last ref on prison %p (jid=%d).",
2921f7496dcaSJamie Gritton 	     pr, pr->pr_id));
2922f7496dcaSJamie Gritton #else
2923ee9b37aeSMateusz Guzik 	refcount_release(&pr->pr_ref);
2924f7496dcaSJamie Gritton #endif
29251ba4a712SPawel Jakub Dawidek }
29261ba4a712SPawel Jakub Dawidek 
292773d9e52dSJamie Gritton /*
2928f171938cSGordon Bergling  * Hold a prison for user visibility, by incrementing pr_uref.
2929effad35eSJamie Gritton  * It is generally an error to hold a prison that isn't already
293049a033d8SGordon Bergling  * user-visible, except through the jail system calls.  It is also
2931effad35eSJamie Gritton  * an error to hold an invalid prison.  A prison record will remain
2932effad35eSJamie Gritton  * alive as long as it has at least one user reference, and will not
2933f7496dcaSJamie Gritton  * be set to the dying state until the prison mutex and allprison_lock
2934f7496dcaSJamie Gritton  * are both freed.
2935effad35eSJamie Gritton  */
2936effad35eSJamie Gritton void
2937effad35eSJamie Gritton prison_proc_hold(struct prison *pr)
2938effad35eSJamie Gritton {
29396754ae25SJamie Gritton #ifdef INVARIANTS
29406754ae25SJamie Gritton 	int was_alive = refcount_acquire_if_not_zero(&pr->pr_uref);
2941effad35eSJamie Gritton 
29426754ae25SJamie Gritton 	KASSERT(was_alive,
2943effad35eSJamie Gritton 	    ("Cannot add a process to a non-alive prison (jid=%d)", pr->pr_id));
29446754ae25SJamie Gritton #else
29456754ae25SJamie Gritton 	refcount_acquire(&pr->pr_uref);
29466754ae25SJamie Gritton #endif
2947effad35eSJamie Gritton }
2948effad35eSJamie Gritton 
2949effad35eSJamie Gritton /*
2950effad35eSJamie Gritton  * Remove a prison user reference.  If it was the last reference, the
2951effad35eSJamie Gritton  * prison will be considered "dying", and may be removed once all of
2952effad35eSJamie Gritton  * its references are dropped.
2953effad35eSJamie Gritton  */
2954effad35eSJamie Gritton void
2955effad35eSJamie Gritton prison_proc_free(struct prison *pr)
2956effad35eSJamie Gritton {
2957effad35eSJamie Gritton 
29586754ae25SJamie Gritton 	/*
29596754ae25SJamie Gritton 	 * Locking is only required when releasing the last reference.
29606754ae25SJamie Gritton 	 * This allows assurance that a locked prison will remain alive
29616754ae25SJamie Gritton 	 * until it is unlocked.
29626754ae25SJamie Gritton 	 */
29636754ae25SJamie Gritton 	KASSERT(refcount_load(&pr->pr_uref) > 0,
2964effad35eSJamie Gritton 	    ("Trying to kill a process in a dead prison (jid=%d)", pr->pr_id));
2965195cd6aeSJamie Gritton 	if (!refcount_release_if_not_last(&pr->pr_uref)) {
2966effad35eSJamie Gritton 		/*
2967effad35eSJamie Gritton 		 * Don't remove the last user reference in this context,
2968effad35eSJamie Gritton 		 * which is expected to be a process that is not only locked,
2969effad35eSJamie Gritton 		 * but also half dead.  Add a reference so any calls to
2970effad35eSJamie Gritton 		 * prison_free() won't re-submit the task.
2971effad35eSJamie Gritton 		 */
2972f7496dcaSJamie Gritton 		prison_hold(pr);
29731158508aSJamie Gritton 		mtx_lock(&pr->pr_mtx);
29741158508aSJamie Gritton 		KASSERT(!(pr->pr_flags & PR_COMPLETE_PROC),
29751158508aSJamie Gritton 		    ("Redundant last reference in prison_proc_free (jid=%d)",
29761158508aSJamie Gritton 		     pr->pr_id));
29771158508aSJamie Gritton 		pr->pr_flags |= PR_COMPLETE_PROC;
29781158508aSJamie Gritton 		mtx_unlock(&pr->pr_mtx);
2979effad35eSJamie Gritton 		taskqueue_enqueue(taskqueue_thread, &pr->pr_task);
2980effad35eSJamie Gritton 	}
2981effad35eSJamie Gritton }
2982effad35eSJamie Gritton 
2983c861373bSJamie Gritton static void
2984c861373bSJamie Gritton prison_proc_free_not_last(struct prison *pr)
2985c861373bSJamie Gritton {
2986c861373bSJamie Gritton #ifdef INVARIANTS
2987c861373bSJamie Gritton 	int lastref;
2988c861373bSJamie Gritton 
2989c861373bSJamie Gritton 	KASSERT(refcount_load(&pr->pr_uref) > 0,
2990c861373bSJamie Gritton 	    ("Trying to free dead prison %p (jid=%d).",
2991c861373bSJamie Gritton 	     pr, pr->pr_id));
2992c861373bSJamie Gritton 	lastref = refcount_release(&pr->pr_uref);
2993c861373bSJamie Gritton 	KASSERT(!lastref,
2994c861373bSJamie Gritton 	    ("prison_proc_free_not_last freed last uref on prison %p (jid=%d).",
2995c861373bSJamie Gritton 	     pr, pr->pr_id));
2996c861373bSJamie Gritton #else
2997c861373bSJamie Gritton 	refcount_release(&pr->pr_uref);
2998c861373bSJamie Gritton #endif
2999c861373bSJamie Gritton }
3000c861373bSJamie Gritton 
30015ecb5444SMateusz Guzik void
30025ecb5444SMateusz Guzik prison_proc_link(struct prison *pr, struct proc *p)
30035ecb5444SMateusz Guzik {
30045ecb5444SMateusz Guzik 
30055ecb5444SMateusz Guzik 	sx_assert(&allproc_lock, SA_XLOCKED);
30065ecb5444SMateusz Guzik 	LIST_INSERT_HEAD(&pr->pr_proclist, p, p_jaillist);
30075ecb5444SMateusz Guzik }
30085ecb5444SMateusz Guzik 
30095ecb5444SMateusz Guzik void
30105ecb5444SMateusz Guzik prison_proc_unlink(struct prison *pr, struct proc *p)
30115ecb5444SMateusz Guzik {
30125ecb5444SMateusz Guzik 
30135ecb5444SMateusz Guzik 	sx_assert(&allproc_lock, SA_XLOCKED);
30145ecb5444SMateusz Guzik 	LIST_REMOVE(p, p_jaillist);
30155ecb5444SMateusz Guzik }
30165ecb5444SMateusz Guzik 
30175ecb5444SMateusz Guzik static void
30185ecb5444SMateusz Guzik prison_proc_relink(struct prison *opr, struct prison *npr, struct proc *p)
30195ecb5444SMateusz Guzik {
30205ecb5444SMateusz Guzik 
30215ecb5444SMateusz Guzik 	sx_xlock(&allproc_lock);
30225ecb5444SMateusz Guzik 	prison_proc_unlink(opr, p);
30235ecb5444SMateusz Guzik 	prison_proc_link(npr, p);
30245ecb5444SMateusz Guzik 	sx_xunlock(&allproc_lock);
30255ecb5444SMateusz Guzik }
30265ecb5444SMateusz Guzik 
3027effad35eSJamie Gritton /*
302873d9e52dSJamie Gritton  * Complete a call to either prison_free or prison_proc_free.
302973d9e52dSJamie Gritton  */
3030c2cda609SPawel Jakub Dawidek static void
3031c2cda609SPawel Jakub Dawidek prison_complete(void *context, int pending)
3032c2cda609SPawel Jakub Dawidek {
303373d9e52dSJamie Gritton 	struct prison *pr = context;
3034f7496dcaSJamie Gritton 	int drflags;
3035b38ff370SJamie Gritton 
3036effad35eSJamie Gritton 	/*
30371158508aSJamie Gritton 	 * This could be called to release the last reference, or the last
30381158508aSJamie Gritton 	 * user reference (plus the reference held in prison_proc_free).
3039effad35eSJamie Gritton 	 */
3040f7496dcaSJamie Gritton 	drflags = prison_lock_xlock(pr, PD_DEREF);
30411158508aSJamie Gritton 	if (pr->pr_flags & PR_COMPLETE_PROC) {
30421158508aSJamie Gritton 		pr->pr_flags &= ~PR_COMPLETE_PROC;
3043f7496dcaSJamie Gritton 		drflags |= PD_DEUREF;
30441158508aSJamie Gritton 	}
3045f7496dcaSJamie Gritton 	prison_deref(pr, drflags);
3046b38ff370SJamie Gritton }
3047b38ff370SJamie Gritton 
30485ecb5444SMateusz Guzik static void
30495ecb5444SMateusz Guzik prison_kill_processes_cb(struct proc *p, void *arg __unused)
30505ecb5444SMateusz Guzik {
30515ecb5444SMateusz Guzik 
30525ecb5444SMateusz Guzik 	kern_psignal(p, SIGKILL);
30535ecb5444SMateusz Guzik }
30545ecb5444SMateusz Guzik 
30555ecb5444SMateusz Guzik /*
30565ecb5444SMateusz Guzik  * Note the iteration does not guarantee acting on all processes.
30575ecb5444SMateusz Guzik  * Most notably there may be fork or jail_attach in progress.
30585ecb5444SMateusz Guzik  */
30595ecb5444SMateusz Guzik void
30605ecb5444SMateusz Guzik prison_proc_iterate(struct prison *pr, void (*cb)(struct proc *, void *),
30615ecb5444SMateusz Guzik     void *cbarg)
30625ecb5444SMateusz Guzik {
30635ecb5444SMateusz Guzik 	struct prison *ppr;
30645ecb5444SMateusz Guzik 	struct proc *p;
30655ecb5444SMateusz Guzik 
30665ecb5444SMateusz Guzik 	if (atomic_load_int(&pr->pr_childcount) == 0) {
30675ecb5444SMateusz Guzik 		sx_slock(&allproc_lock);
30685ecb5444SMateusz Guzik 		LIST_FOREACH(p, &pr->pr_proclist, p_jaillist) {
30695ecb5444SMateusz Guzik 			if (p->p_state == PRS_NEW)
30705ecb5444SMateusz Guzik 				continue;
30715ecb5444SMateusz Guzik 			PROC_LOCK(p);
30725ecb5444SMateusz Guzik 			cb(p, cbarg);
30735ecb5444SMateusz Guzik 			PROC_UNLOCK(p);
30745ecb5444SMateusz Guzik 		}
30755ecb5444SMateusz Guzik 		sx_sunlock(&allproc_lock);
30765ecb5444SMateusz Guzik 		if (atomic_load_int(&pr->pr_childcount) == 0)
30775ecb5444SMateusz Guzik 			return;
30785ecb5444SMateusz Guzik 		/*
30795ecb5444SMateusz Guzik 		 * Some jails popped up during the iteration, fall through to a
30805ecb5444SMateusz Guzik 		 * system-wide search.
30815ecb5444SMateusz Guzik 		 */
30825ecb5444SMateusz Guzik 	}
30835ecb5444SMateusz Guzik 
30845ecb5444SMateusz Guzik 	sx_slock(&allproc_lock);
30855ecb5444SMateusz Guzik 	FOREACH_PROC_IN_SYSTEM(p) {
30865ecb5444SMateusz Guzik 		PROC_LOCK(p);
30875ecb5444SMateusz Guzik 		if (p->p_state != PRS_NEW && p->p_ucred != NULL) {
3088831531a8SKonstantin Belousov 			for (ppr = p->p_ucred->cr_prison; ppr != NULL;
30895ecb5444SMateusz Guzik 			    ppr = ppr->pr_parent) {
30905ecb5444SMateusz Guzik 				if (ppr == pr) {
30915ecb5444SMateusz Guzik 					cb(p, cbarg);
30925ecb5444SMateusz Guzik 					break;
30935ecb5444SMateusz Guzik 				}
30945ecb5444SMateusz Guzik 			}
30955ecb5444SMateusz Guzik 		}
30965ecb5444SMateusz Guzik 		PROC_UNLOCK(p);
30975ecb5444SMateusz Guzik 	}
30985ecb5444SMateusz Guzik 	sx_sunlock(&allproc_lock);
30995ecb5444SMateusz Guzik }
31005ecb5444SMateusz Guzik 
3101b38ff370SJamie Gritton /*
3102effad35eSJamie Gritton  * Remove a prison reference and/or user reference (usually).
3103effad35eSJamie Gritton  * This assumes context that allows sleeping (for allprison_lock),
3104effad35eSJamie Gritton  * with no non-sleeping locks held, except perhaps the prison itself.
3105effad35eSJamie Gritton  * If there are no more references, release and delist the prison.
3106effad35eSJamie Gritton  * On completion, the prison lock and the allprison lock are both
3107effad35eSJamie Gritton  * unlocked.
3108b38ff370SJamie Gritton  */
3109b38ff370SJamie Gritton static void
3110b38ff370SJamie Gritton prison_deref(struct prison *pr, int flags)
3111b38ff370SJamie Gritton {
31126e1d1bfcSJamie Gritton 	struct prisonlist freeprison;
3113c861373bSJamie Gritton 	struct prison *killpr, *rpr, *ppr, *tpr;
3114c2cda609SPawel Jakub Dawidek 
3115c861373bSJamie Gritton 	killpr = NULL;
31166e1d1bfcSJamie Gritton 	TAILQ_INIT(&freeprison);
31176e1d1bfcSJamie Gritton 	/*
31186e1d1bfcSJamie Gritton 	 * Release this prison as requested, which may cause its parent
31196e1d1bfcSJamie Gritton 	 * to be released, and then maybe its grandparent, etc.
31206e1d1bfcSJamie Gritton 	 */
31210304c731SJamie Gritton 	for (;;) {
3122c861373bSJamie Gritton 		if (flags & PD_KILL) {
3123c861373bSJamie Gritton 			/* Kill the prison and its descendents. */
3124589e4c1dSJamie Gritton 			KASSERT(pr != &prison0,
3125589e4c1dSJamie Gritton 			    ("prison_deref trying to kill prison0"));
3126c861373bSJamie Gritton 			if (!(flags & PD_DEREF)) {
3127c861373bSJamie Gritton 				prison_hold(pr);
3128c861373bSJamie Gritton 				flags |= PD_DEREF;
3129c861373bSJamie Gritton 			}
3130c861373bSJamie Gritton 			flags = prison_lock_xlock(pr, flags);
3131c861373bSJamie Gritton 			prison_deref_kill(pr, &freeprison);
3132c861373bSJamie Gritton 		}
3133e6d5cb63SJamie Gritton 		if (flags & PD_DEUREF) {
3134f7496dcaSJamie Gritton 			/* Drop a user reference. */
31356754ae25SJamie Gritton 			KASSERT(refcount_load(&pr->pr_uref) > 0,
313673d9e52dSJamie Gritton 			    ("prison_deref PD_DEUREF on a dead prison (jid=%d)",
313773d9e52dSJamie Gritton 			     pr->pr_id));
3138f7496dcaSJamie Gritton 			if (!refcount_release_if_not_last(&pr->pr_uref)) {
3139f7496dcaSJamie Gritton 				if (!(flags & PD_DEREF)) {
3140f7496dcaSJamie Gritton 					prison_hold(pr);
3141f7496dcaSJamie Gritton 					flags |= PD_DEREF;
3142f7496dcaSJamie Gritton 				}
3143f7496dcaSJamie Gritton 				flags = prison_lock_xlock(pr, flags);
31441158508aSJamie Gritton 				if (refcount_release(&pr->pr_uref) &&
31451158508aSJamie Gritton 				    pr->pr_state == PRISON_STATE_ALIVE) {
3146f7496dcaSJamie Gritton 					/*
3147f7496dcaSJamie Gritton 					 * When the last user references goes,
3148f7496dcaSJamie Gritton 					 * this becomes a dying prison.
3149f7496dcaSJamie Gritton 					 */
3150f7496dcaSJamie Gritton 					KASSERT(
3151f7496dcaSJamie Gritton 					    refcount_load(&prison0.pr_uref) > 0,
31526754ae25SJamie Gritton 					    ("prison0 pr_uref=0"));
31531158508aSJamie Gritton 					pr->pr_state = PRISON_STATE_DYING;
3154f7496dcaSJamie Gritton 					mtx_unlock(&pr->pr_mtx);
3155f7496dcaSJamie Gritton 					flags &= ~PD_LOCKED;
3156a9f7455cSJamie Gritton 					prison_cleanup(pr);
3157f7496dcaSJamie Gritton 				}
3158f7496dcaSJamie Gritton 			}
3159f7496dcaSJamie Gritton 		}
3160c861373bSJamie Gritton 		if (flags & PD_KILL) {
3161c861373bSJamie Gritton 			/*
3162c861373bSJamie Gritton 			 * Any remaining user references are probably processes
3163c861373bSJamie Gritton 			 * that need to be killed, either in this prison or its
3164c861373bSJamie Gritton 			 * descendants.
3165c861373bSJamie Gritton 			 */
3166c861373bSJamie Gritton 			if (refcount_load(&pr->pr_uref) > 0)
3167c861373bSJamie Gritton 				killpr = pr;
3168589e4c1dSJamie Gritton 			/* Make sure the parent prison doesn't get killed. */
3169589e4c1dSJamie Gritton 			flags &= ~PD_KILL;
3170c861373bSJamie Gritton 		}
317173d9e52dSJamie Gritton 		if (flags & PD_DEREF) {
3172f7496dcaSJamie Gritton 			/* Drop a reference. */
31736754ae25SJamie Gritton 			KASSERT(refcount_load(&pr->pr_ref) > 0,
317473d9e52dSJamie Gritton 			    ("prison_deref PD_DEREF on a dead prison (jid=%d)",
317573d9e52dSJamie Gritton 			     pr->pr_id));
3176f7496dcaSJamie Gritton 			if (!refcount_release_if_not_last(&pr->pr_ref)) {
3177f7496dcaSJamie Gritton 				flags = prison_lock_xlock(pr, flags);
3178f7496dcaSJamie Gritton 				if (refcount_release(&pr->pr_ref)) {
3179cc5fd8c7SJamie Gritton 					/*
3180f7496dcaSJamie Gritton 					 * When the last reference goes,
3181f7496dcaSJamie Gritton 					 * unlink the prison and set it aside.
3182cc5fd8c7SJamie Gritton 					 */
3183f7496dcaSJamie Gritton 					KASSERT(
3184f7496dcaSJamie Gritton 					    refcount_load(&pr->pr_uref) == 0,
3185f7496dcaSJamie Gritton 					    ("prison_deref: last ref, "
3186f7496dcaSJamie Gritton 					     "but still has %d urefs (jid=%d)",
3187f7496dcaSJamie Gritton 					     pr->pr_uref, pr->pr_id));
3188f7496dcaSJamie Gritton 					KASSERT(
3189f7496dcaSJamie Gritton 					    refcount_load(&prison0.pr_ref) != 0,
3190f7496dcaSJamie Gritton 					    ("prison0 pr_ref=0"));
31911158508aSJamie Gritton 					pr->pr_state = PRISON_STATE_INVALID;
3192b38ff370SJamie Gritton 					TAILQ_REMOVE(&allprison, pr, pr_list);
31930304c731SJamie Gritton 					LIST_REMOVE(pr, pr_sibling);
3194f7496dcaSJamie Gritton 					TAILQ_INSERT_TAIL(&freeprison, pr,
3195f7496dcaSJamie Gritton 					    pr_list);
3196f7496dcaSJamie Gritton 					for (ppr = pr->pr_parent;
3197f7496dcaSJamie Gritton 					     ppr != NULL;
3198f7496dcaSJamie Gritton 					     ppr = ppr->pr_parent)
3199f7496dcaSJamie Gritton 						ppr->pr_childcount--;
3200f7496dcaSJamie Gritton 					/*
3201f7496dcaSJamie Gritton 					 * Removing a prison frees references
3202f7496dcaSJamie Gritton 					 * from its parent.
3203f7496dcaSJamie Gritton 					 */
3204f7496dcaSJamie Gritton 					mtx_unlock(&pr->pr_mtx);
3205f7496dcaSJamie Gritton 					flags &= ~PD_LOCKED;
32066e1d1bfcSJamie Gritton 					pr = pr->pr_parent;
32076e1d1bfcSJamie Gritton 					flags |= PD_DEREF | PD_DEUREF;
3208f7496dcaSJamie Gritton 					continue;
3209f7496dcaSJamie Gritton 				}
3210f7496dcaSJamie Gritton 			}
3211f7496dcaSJamie Gritton 		}
3212f7496dcaSJamie Gritton 		break;
32136e1d1bfcSJamie Gritton 	}
32146e1d1bfcSJamie Gritton 
32156e1d1bfcSJamie Gritton 	/* Release all the prison locks. */
3216f7496dcaSJamie Gritton 	if (flags & PD_LOCKED)
3217f7496dcaSJamie Gritton 		mtx_unlock(&pr->pr_mtx);
32186e1d1bfcSJamie Gritton 	if (flags & PD_LIST_SLOCKED)
32196e1d1bfcSJamie Gritton 		sx_sunlock(&allprison_lock);
32206e1d1bfcSJamie Gritton 	else if (flags & PD_LIST_XLOCKED)
32216e1d1bfcSJamie Gritton 		sx_xunlock(&allprison_lock);
32226e1d1bfcSJamie Gritton 
3223c861373bSJamie Gritton 	/* Kill any processes attached to a killed prison. */
32245ecb5444SMateusz Guzik 	if (killpr != NULL)
32255ecb5444SMateusz Guzik 		prison_proc_iterate(killpr, prison_kill_processes_cb, NULL);
3226c861373bSJamie Gritton 
32276e1d1bfcSJamie Gritton 	/*
32286e1d1bfcSJamie Gritton 	 * Finish removing any unreferenced prisons, which couldn't happen
32296e1d1bfcSJamie Gritton 	 * while allprison_lock was held (to avoid a LOR on vrele).
32306e1d1bfcSJamie Gritton 	 */
32316e1d1bfcSJamie Gritton 	TAILQ_FOREACH_SAFE(rpr, &freeprison, pr_list, tpr) {
32326e1d1bfcSJamie Gritton #ifdef VIMAGE
32336e1d1bfcSJamie Gritton 		if (rpr->pr_vnet != rpr->pr_parent->pr_vnet)
32346e1d1bfcSJamie Gritton 			vnet_destroy(rpr->pr_vnet);
32356e1d1bfcSJamie Gritton #endif
32366e1d1bfcSJamie Gritton 		if (rpr->pr_root != NULL)
32376e1d1bfcSJamie Gritton 			vrele(rpr->pr_root);
32386e1d1bfcSJamie Gritton 		mtx_destroy(&rpr->pr_mtx);
32396e1d1bfcSJamie Gritton #ifdef INET
3240eb8dcdeaSGleb Smirnoff 		prison_ip_free(rpr->pr_addrs[PR_INET]);
32416e1d1bfcSJamie Gritton #endif
32426e1d1bfcSJamie Gritton #ifdef INET6
3243eb8dcdeaSGleb Smirnoff 		prison_ip_free(rpr->pr_addrs[PR_INET6]);
32446e1d1bfcSJamie Gritton #endif
32456e1d1bfcSJamie Gritton 		if (rpr->pr_cpuset != NULL)
32466e1d1bfcSJamie Gritton 			cpuset_rel(rpr->pr_cpuset);
32476e1d1bfcSJamie Gritton 		osd_jail_exit(rpr);
32486e1d1bfcSJamie Gritton #ifdef RACCT
32496e1d1bfcSJamie Gritton 		if (racct_enable)
32506e1d1bfcSJamie Gritton 			prison_racct_detach(rpr);
32516e1d1bfcSJamie Gritton #endif
3252f7496dcaSJamie Gritton 		TAILQ_REMOVE(&freeprison, rpr, pr_list);
32536e1d1bfcSJamie Gritton 		free(rpr, M_PRISON);
32540304c731SJamie Gritton 	}
3255b3059e09SRobert Watson }
3256b3059e09SRobert Watson 
3257413628a7SBjoern A. Zeeb /*
3258c861373bSJamie Gritton  * Kill the prison and its descendants.  Mark them as dying, clear the
3259c861373bSJamie Gritton  * persist flag, and call module remove methods.
3260c861373bSJamie Gritton  */
3261c861373bSJamie Gritton static void
3262c861373bSJamie Gritton prison_deref_kill(struct prison *pr, struct prisonlist *freeprison)
3263c861373bSJamie Gritton {
3264c861373bSJamie Gritton 	struct prison *cpr, *ppr, *rpr;
3265c861373bSJamie Gritton 	bool descend;
3266c861373bSJamie Gritton 
3267c861373bSJamie Gritton 	/*
3268c861373bSJamie Gritton 	 * Unlike the descendants, the target prison can be killed
3269c861373bSJamie Gritton 	 * even if it is currently dying.  This is useful for failed
3270c861373bSJamie Gritton 	 * creation in jail_set(2).
3271c861373bSJamie Gritton 	 */
3272c861373bSJamie Gritton 	KASSERT(refcount_load(&pr->pr_ref) > 0,
3273c861373bSJamie Gritton 	    ("Trying to kill dead prison %p (jid=%d).",
3274c861373bSJamie Gritton 	     pr, pr->pr_id));
3275c861373bSJamie Gritton 	refcount_acquire(&pr->pr_uref);
3276c861373bSJamie Gritton 	pr->pr_state = PRISON_STATE_DYING;
3277c861373bSJamie Gritton 	mtx_unlock(&pr->pr_mtx);
3278c861373bSJamie Gritton 
3279c861373bSJamie Gritton 	rpr = NULL;
3280c861373bSJamie Gritton 	FOREACH_PRISON_DESCENDANT_PRE_POST(pr, cpr, descend) {
3281c861373bSJamie Gritton 		if (descend) {
3282c861373bSJamie Gritton 			if (!prison_isalive(cpr)) {
3283c861373bSJamie Gritton 				descend = false;
3284c861373bSJamie Gritton 				continue;
3285c861373bSJamie Gritton 			}
3286c861373bSJamie Gritton 			prison_hold(cpr);
3287c861373bSJamie Gritton 			prison_proc_hold(cpr);
3288c861373bSJamie Gritton 			mtx_lock(&cpr->pr_mtx);
3289c861373bSJamie Gritton 			cpr->pr_state = PRISON_STATE_DYING;
3290c861373bSJamie Gritton 			cpr->pr_flags |= PR_REMOVE;
3291c861373bSJamie Gritton 			mtx_unlock(&cpr->pr_mtx);
3292c861373bSJamie Gritton 			continue;
3293c861373bSJamie Gritton 		}
3294c861373bSJamie Gritton 		if (!(cpr->pr_flags & PR_REMOVE))
3295c861373bSJamie Gritton 			continue;
3296a9f7455cSJamie Gritton 		prison_cleanup(cpr);
3297c861373bSJamie Gritton 		mtx_lock(&cpr->pr_mtx);
3298c861373bSJamie Gritton 		cpr->pr_flags &= ~PR_REMOVE;
3299c861373bSJamie Gritton 		if (cpr->pr_flags & PR_PERSIST) {
3300c861373bSJamie Gritton 			cpr->pr_flags &= ~PR_PERSIST;
3301c861373bSJamie Gritton 			prison_proc_free_not_last(cpr);
3302c861373bSJamie Gritton 			prison_free_not_last(cpr);
3303c861373bSJamie Gritton 		}
3304c861373bSJamie Gritton 		(void)refcount_release(&cpr->pr_uref);
3305c861373bSJamie Gritton 		if (refcount_release(&cpr->pr_ref)) {
3306c861373bSJamie Gritton 			/*
3307c861373bSJamie Gritton 			 * When the last reference goes, unlink the prison
3308c861373bSJamie Gritton 			 * and set it aside for prison_deref() to handle.
3309c861373bSJamie Gritton 			 * Delay unlinking the sibling list to keep the loop
3310c861373bSJamie Gritton 			 * safe.
3311c861373bSJamie Gritton 			 */
3312c861373bSJamie Gritton 			if (rpr != NULL)
3313c861373bSJamie Gritton 				LIST_REMOVE(rpr, pr_sibling);
3314c861373bSJamie Gritton 			rpr = cpr;
3315c861373bSJamie Gritton 			rpr->pr_state = PRISON_STATE_INVALID;
3316c861373bSJamie Gritton 			TAILQ_REMOVE(&allprison, rpr, pr_list);
3317c861373bSJamie Gritton 			TAILQ_INSERT_TAIL(freeprison, rpr, pr_list);
3318c861373bSJamie Gritton 			/*
3319c861373bSJamie Gritton 			 * Removing a prison frees references from its parent.
3320c861373bSJamie Gritton 			 */
3321c861373bSJamie Gritton 			ppr = rpr->pr_parent;
3322c861373bSJamie Gritton 			prison_proc_free_not_last(ppr);
3323c861373bSJamie Gritton 			prison_free_not_last(ppr);
3324c861373bSJamie Gritton 			for (; ppr != NULL; ppr = ppr->pr_parent)
3325c861373bSJamie Gritton 				ppr->pr_childcount--;
3326c861373bSJamie Gritton 		}
3327c861373bSJamie Gritton 		mtx_unlock(&cpr->pr_mtx);
3328c861373bSJamie Gritton 	}
3329c861373bSJamie Gritton 	if (rpr != NULL)
3330c861373bSJamie Gritton 		LIST_REMOVE(rpr, pr_sibling);
3331c861373bSJamie Gritton 
3332a9f7455cSJamie Gritton 	prison_cleanup(pr);
3333c861373bSJamie Gritton 	mtx_lock(&pr->pr_mtx);
3334c861373bSJamie Gritton 	if (pr->pr_flags & PR_PERSIST) {
3335c861373bSJamie Gritton 		pr->pr_flags &= ~PR_PERSIST;
3336c861373bSJamie Gritton 		prison_proc_free_not_last(pr);
3337c861373bSJamie Gritton 		prison_free_not_last(pr);
3338c861373bSJamie Gritton 	}
3339c861373bSJamie Gritton 	(void)refcount_release(&pr->pr_uref);
3340c861373bSJamie Gritton }
3341c861373bSJamie Gritton 
3342c861373bSJamie Gritton /*
3343f7496dcaSJamie Gritton  * Given the current locking state in the flags, make sure allprison_lock
3344f7496dcaSJamie Gritton  * is held exclusive, and the prison is locked.  Return flags indicating
3345f7496dcaSJamie Gritton  * the new state.
3346f7496dcaSJamie Gritton  */
3347f7496dcaSJamie Gritton static int
3348f7496dcaSJamie Gritton prison_lock_xlock(struct prison *pr, int flags)
3349f7496dcaSJamie Gritton {
3350f7496dcaSJamie Gritton 
3351f7496dcaSJamie Gritton 	if (!(flags & PD_LIST_XLOCKED)) {
3352f7496dcaSJamie Gritton 		/*
3353f7496dcaSJamie Gritton 		 * Get allprison_lock, which may be an upgrade,
3354f7496dcaSJamie Gritton 		 * and may require unlocking the prison.
3355f7496dcaSJamie Gritton 		 */
3356f7496dcaSJamie Gritton 		if (flags & PD_LOCKED) {
3357f7496dcaSJamie Gritton 			mtx_unlock(&pr->pr_mtx);
3358f7496dcaSJamie Gritton 			flags &= ~PD_LOCKED;
3359f7496dcaSJamie Gritton 		}
3360f7496dcaSJamie Gritton 		if (flags & PD_LIST_SLOCKED) {
3361f7496dcaSJamie Gritton 			if (!sx_try_upgrade(&allprison_lock)) {
3362f7496dcaSJamie Gritton 				sx_sunlock(&allprison_lock);
3363f7496dcaSJamie Gritton 				sx_xlock(&allprison_lock);
3364f7496dcaSJamie Gritton 			}
3365f7496dcaSJamie Gritton 			flags &= ~PD_LIST_SLOCKED;
3366f7496dcaSJamie Gritton 		} else
3367f7496dcaSJamie Gritton 			sx_xlock(&allprison_lock);
3368f7496dcaSJamie Gritton 		flags |= PD_LIST_XLOCKED;
3369f7496dcaSJamie Gritton 	}
3370f7496dcaSJamie Gritton 	if (!(flags & PD_LOCKED)) {
3371f7496dcaSJamie Gritton 		/* Lock the prison mutex. */
3372f7496dcaSJamie Gritton 		mtx_lock(&pr->pr_mtx);
3373f7496dcaSJamie Gritton 		flags |= PD_LOCKED;
3374f7496dcaSJamie Gritton 	}
3375f7496dcaSJamie Gritton 	return flags;
3376f7496dcaSJamie Gritton }
3377f7496dcaSJamie Gritton 
3378f7496dcaSJamie Gritton /*
3379a9f7455cSJamie Gritton  * Release a prison's resources when it starts dying (when the last user
3380a9f7455cSJamie Gritton  * reference is dropped, or when it is killed).
3381a9f7455cSJamie Gritton  */
3382a9f7455cSJamie Gritton static void
3383a9f7455cSJamie Gritton prison_cleanup(struct prison *pr)
3384a9f7455cSJamie Gritton {
3385a9f7455cSJamie Gritton 	sx_assert(&allprison_lock, SA_XLOCKED);
3386a9f7455cSJamie Gritton 	mtx_assert(&pr->pr_mtx, MA_NOTOWNED);
338788175af8SRick Macklem 	vfs_exjail_delete(pr);
33887060da62SJamie Gritton 	shm_remove_prison(pr);
3389a9f7455cSJamie Gritton 	(void)osd_jail_call(pr, PR_METHOD_REMOVE, NULL);
3390a9f7455cSJamie Gritton }
3391a9f7455cSJamie Gritton 
3392a9f7455cSJamie Gritton /*
33930fe74ae6SJamie Gritton  * Set or clear a permission bit in the pr_allow field, passing restrictions
33940fe74ae6SJamie Gritton  * (cleared permission) down to child jails.
33950fe74ae6SJamie Gritton  */
33960fe74ae6SJamie Gritton void
33970fe74ae6SJamie Gritton prison_set_allow(struct ucred *cred, unsigned flag, int enable)
33980fe74ae6SJamie Gritton {
33990fe74ae6SJamie Gritton 	struct prison *pr;
34000fe74ae6SJamie Gritton 
34010fe74ae6SJamie Gritton 	pr = cred->cr_prison;
34020fe74ae6SJamie Gritton 	sx_slock(&allprison_lock);
34030fe74ae6SJamie Gritton 	mtx_lock(&pr->pr_mtx);
34040fe74ae6SJamie Gritton 	prison_set_allow_locked(pr, flag, enable);
34050fe74ae6SJamie Gritton 	mtx_unlock(&pr->pr_mtx);
34060fe74ae6SJamie Gritton 	sx_sunlock(&allprison_lock);
34070fe74ae6SJamie Gritton }
34080fe74ae6SJamie Gritton 
34090fe74ae6SJamie Gritton static void
34100fe74ae6SJamie Gritton prison_set_allow_locked(struct prison *pr, unsigned flag, int enable)
34110fe74ae6SJamie Gritton {
34120fe74ae6SJamie Gritton 	struct prison *cpr;
34130fe74ae6SJamie Gritton 	int descend;
34140fe74ae6SJamie Gritton 
34150fe74ae6SJamie Gritton 	if (enable != 0)
34160fe74ae6SJamie Gritton 		pr->pr_allow |= flag;
34170fe74ae6SJamie Gritton 	else {
34180fe74ae6SJamie Gritton 		pr->pr_allow &= ~flag;
34190fe74ae6SJamie Gritton 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, cpr, descend)
34200fe74ae6SJamie Gritton 			cpr->pr_allow &= ~flag;
34210fe74ae6SJamie Gritton 	}
34220fe74ae6SJamie Gritton }
34230fe74ae6SJamie Gritton 
34240fe74ae6SJamie Gritton /*
3425ca04ba64SJamie Gritton  * Check if a jail supports the given address family.
3426ca04ba64SJamie Gritton  *
3427ca04ba64SJamie Gritton  * Returns 0 if not jailed or the address family is supported, EAFNOSUPPORT
3428ca04ba64SJamie Gritton  * if not.
3429ca04ba64SJamie Gritton  */
3430ca04ba64SJamie Gritton int
3431ca04ba64SJamie Gritton prison_check_af(struct ucred *cred, int af)
3432ca04ba64SJamie Gritton {
34330304c731SJamie Gritton 	struct prison *pr;
3434ca04ba64SJamie Gritton 	int error;
3435ca04ba64SJamie Gritton 
3436ca04ba64SJamie Gritton 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
3437ca04ba64SJamie Gritton 
34380304c731SJamie Gritton 	pr = cred->cr_prison;
3439499650a0SJamie Gritton #ifdef VIMAGE
34406bb79563SJamie Gritton 	/* Prisons with their own network stack are not limited. */
3441de0bd6f7SBjoern A. Zeeb 	if (prison_owns_vnet(cred))
34426bb79563SJamie Gritton 		return (0);
3443499650a0SJamie Gritton #endif
34446bb79563SJamie Gritton 
3445ca04ba64SJamie Gritton 	error = 0;
3446ca04ba64SJamie Gritton 	switch (af)
3447ca04ba64SJamie Gritton 	{
3448ca04ba64SJamie Gritton #ifdef INET
3449ca04ba64SJamie Gritton 	case AF_INET:
34500304c731SJamie Gritton 		if (pr->pr_flags & PR_IP4)
34510304c731SJamie Gritton 		{
34520304c731SJamie Gritton 			mtx_lock(&pr->pr_mtx);
3453eb8dcdeaSGleb Smirnoff 			if ((pr->pr_flags & PR_IP4) &&
3454eb8dcdeaSGleb Smirnoff 			    pr->pr_addrs[PR_INET] == NULL)
3455ca04ba64SJamie Gritton 				error = EAFNOSUPPORT;
34560304c731SJamie Gritton 			mtx_unlock(&pr->pr_mtx);
34570304c731SJamie Gritton 		}
3458ca04ba64SJamie Gritton 		break;
3459ca04ba64SJamie Gritton #endif
3460ca04ba64SJamie Gritton #ifdef INET6
3461ca04ba64SJamie Gritton 	case AF_INET6:
34620304c731SJamie Gritton 		if (pr->pr_flags & PR_IP6)
34630304c731SJamie Gritton 		{
34640304c731SJamie Gritton 			mtx_lock(&pr->pr_mtx);
3465eb8dcdeaSGleb Smirnoff 			if ((pr->pr_flags & PR_IP6) &&
3466eb8dcdeaSGleb Smirnoff 			    pr->pr_addrs[PR_INET6] == NULL)
3467ca04ba64SJamie Gritton 				error = EAFNOSUPPORT;
34680304c731SJamie Gritton 			mtx_unlock(&pr->pr_mtx);
34690304c731SJamie Gritton 		}
3470ca04ba64SJamie Gritton 		break;
3471ca04ba64SJamie Gritton #endif
3472ca04ba64SJamie Gritton 	case AF_LOCAL:
3473ca04ba64SJamie Gritton 	case AF_ROUTE:
347404f75b98SAlexander V. Chernikov 	case AF_NETLINK:
3475ca04ba64SJamie Gritton 		break;
3476ca04ba64SJamie Gritton 	default:
34770304c731SJamie Gritton 		if (!(pr->pr_allow & PR_ALLOW_SOCKET_AF))
3478ca04ba64SJamie Gritton 			error = EAFNOSUPPORT;
3479ca04ba64SJamie Gritton 	}
3480ca04ba64SJamie Gritton 	return (error);
3481ca04ba64SJamie Gritton }
3482ca04ba64SJamie Gritton 
3483ca04ba64SJamie Gritton /*
3484413628a7SBjoern A. Zeeb  * Check if given address belongs to the jail referenced by cred (wrapper to
3485413628a7SBjoern A. Zeeb  * prison_check_ip[46]).
3486413628a7SBjoern A. Zeeb  *
34870304c731SJamie Gritton  * Returns 0 if jail doesn't restrict the address family or if address belongs
34880304c731SJamie Gritton  * to jail, EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if
34890304c731SJamie Gritton  * the jail doesn't allow the address family.  IPv4 Address passed in in NBO.
3490413628a7SBjoern A. Zeeb  */
3491413628a7SBjoern A. Zeeb int
3492c83dda36SAlexander V. Chernikov prison_if(struct ucred *cred, const struct sockaddr *sa)
349375c13541SPoul-Henning Kamp {
3494413628a7SBjoern A. Zeeb #ifdef INET
3495c83dda36SAlexander V. Chernikov 	const struct sockaddr_in *sai;
3496413628a7SBjoern A. Zeeb #endif
3497413628a7SBjoern A. Zeeb #ifdef INET6
3498c83dda36SAlexander V. Chernikov 	const struct sockaddr_in6 *sai6;
3499413628a7SBjoern A. Zeeb #endif
3500b89e82ddSJamie Gritton 	int error;
350175c13541SPoul-Henning Kamp 
3502413628a7SBjoern A. Zeeb 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
3503413628a7SBjoern A. Zeeb 	KASSERT(sa != NULL, ("%s: sa is NULL", __func__));
3504413628a7SBjoern A. Zeeb 
3505de0bd6f7SBjoern A. Zeeb #ifdef VIMAGE
3506de0bd6f7SBjoern A. Zeeb 	if (prison_owns_vnet(cred))
3507de0bd6f7SBjoern A. Zeeb 		return (0);
3508de0bd6f7SBjoern A. Zeeb #endif
3509de0bd6f7SBjoern A. Zeeb 
3510b89e82ddSJamie Gritton 	error = 0;
3511413628a7SBjoern A. Zeeb 	switch (sa->sa_family)
3512413628a7SBjoern A. Zeeb 	{
3513413628a7SBjoern A. Zeeb #ifdef INET
3514413628a7SBjoern A. Zeeb 	case AF_INET:
3515c83dda36SAlexander V. Chernikov 		sai = (const struct sockaddr_in *)sa;
3516b89e82ddSJamie Gritton 		error = prison_check_ip4(cred, &sai->sin_addr);
3517413628a7SBjoern A. Zeeb 		break;
3518413628a7SBjoern A. Zeeb #endif
3519413628a7SBjoern A. Zeeb #ifdef INET6
3520413628a7SBjoern A. Zeeb 	case AF_INET6:
3521c83dda36SAlexander V. Chernikov 		sai6 = (const struct sockaddr_in6 *)sa;
3522b89e82ddSJamie Gritton 		error = prison_check_ip6(cred, &sai6->sin6_addr);
3523413628a7SBjoern A. Zeeb 		break;
3524413628a7SBjoern A. Zeeb #endif
3525413628a7SBjoern A. Zeeb 	default:
35260304c731SJamie Gritton 		if (!(cred->cr_prison->pr_allow & PR_ALLOW_SOCKET_AF))
3527b89e82ddSJamie Gritton 			error = EAFNOSUPPORT;
3528413628a7SBjoern A. Zeeb 	}
3529b89e82ddSJamie Gritton 	return (error);
353075c13541SPoul-Henning Kamp }
353191421ba2SRobert Watson 
353291421ba2SRobert Watson /*
353391421ba2SRobert Watson  * Return 0 if jails permit p1 to frob p2, otherwise ESRCH.
353491421ba2SRobert Watson  */
353591421ba2SRobert Watson int
35369ddb7954SMike Barcroft prison_check(struct ucred *cred1, struct ucred *cred2)
353791421ba2SRobert Watson {
353891421ba2SRobert Watson 
35390304c731SJamie Gritton 	return ((cred1->cr_prison == cred2->cr_prison ||
35400304c731SJamie Gritton 	    prison_ischild(cred1->cr_prison, cred2->cr_prison)) ? 0 : ESRCH);
35410304c731SJamie Gritton }
354291421ba2SRobert Watson 
35430304c731SJamie Gritton /*
3544bba7a2e8SRick Macklem  * For mountd/nfsd to run within a prison, it must be:
3545bba7a2e8SRick Macklem  * - A vnet prison.
3546bba7a2e8SRick Macklem  * - PR_ALLOW_NFSD must be set on it.
3547bba7a2e8SRick Macklem  * - The root directory (pr_root) of the prison must be
3548bba7a2e8SRick Macklem  *   a file system mount point, so the mountd can hang
3549bba7a2e8SRick Macklem  *   export information on it.
355099187c3aSRick Macklem  * - The prison's enforce_statfs cannot be 0, so that
355199187c3aSRick Macklem  *   mountd(8) can do exports.
3552bba7a2e8SRick Macklem  */
3553bba7a2e8SRick Macklem bool
3554bba7a2e8SRick Macklem prison_check_nfsd(struct ucred *cred)
3555bba7a2e8SRick Macklem {
3556bba7a2e8SRick Macklem 
3557bba7a2e8SRick Macklem 	if (jailed_without_vnet(cred))
3558bba7a2e8SRick Macklem 		return (false);
3559bba7a2e8SRick Macklem 	if (!prison_allow(cred, PR_ALLOW_NFSD))
3560bba7a2e8SRick Macklem 		return (false);
3561bba7a2e8SRick Macklem 	if ((cred->cr_prison->pr_root->v_vflag & VV_ROOT) == 0)
3562bba7a2e8SRick Macklem 		return (false);
356399187c3aSRick Macklem 	if (cred->cr_prison->pr_enforce_statfs == 0)
356499187c3aSRick Macklem 		return (false);
3565bba7a2e8SRick Macklem 	return (true);
3566bba7a2e8SRick Macklem }
3567bba7a2e8SRick Macklem 
3568bba7a2e8SRick Macklem /*
35690b0ae2e4SMina Galić  * Return true if p2 is a child of p1, otherwise false.
35700304c731SJamie Gritton  */
35710b0ae2e4SMina Galić bool
35720304c731SJamie Gritton prison_ischild(struct prison *pr1, struct prison *pr2)
35730304c731SJamie Gritton {
35740304c731SJamie Gritton 
35750304c731SJamie Gritton 	for (pr2 = pr2->pr_parent; pr2 != NULL; pr2 = pr2->pr_parent)
35760304c731SJamie Gritton 		if (pr1 == pr2)
35770b0ae2e4SMina Galić 			return (true);
35780b0ae2e4SMina Galić 	return (false);
357991421ba2SRobert Watson }
358091421ba2SRobert Watson 
358191421ba2SRobert Watson /*
3582f7496dcaSJamie Gritton  * Return true if the prison is currently alive.  A prison is alive if it
3583f7496dcaSJamie Gritton  * holds user references and it isn't being removed.
358476ad42abSJamie Gritton  */
358576ad42abSJamie Gritton bool
3586eb8dcdeaSGleb Smirnoff prison_isalive(const struct prison *pr)
358776ad42abSJamie Gritton {
358876ad42abSJamie Gritton 
35891158508aSJamie Gritton 	if (__predict_false(pr->pr_state != PRISON_STATE_ALIVE))
3590cc7b7306SJamie Gritton 		return (false);
359176ad42abSJamie Gritton 	return (true);
359276ad42abSJamie Gritton }
359376ad42abSJamie Gritton 
359476ad42abSJamie Gritton /*
359576ad42abSJamie Gritton  * Return true if the prison is currently valid.  A prison is valid if it has
359676ad42abSJamie Gritton  * been fully created, and is not being destroyed.  Note that dying prisons
3597f7496dcaSJamie Gritton  * are still considered valid.  Invalid prisons won't be found under normal
3598f7496dcaSJamie Gritton  * circumstances, as they're only put in that state by functions that have
3599f7496dcaSJamie Gritton  * an exclusive hold on allprison_lock.
360076ad42abSJamie Gritton  */
360176ad42abSJamie Gritton bool
360276ad42abSJamie Gritton prison_isvalid(struct prison *pr)
360376ad42abSJamie Gritton {
360476ad42abSJamie Gritton 
36051158508aSJamie Gritton 	if (__predict_false(pr->pr_state == PRISON_STATE_INVALID))
36061158508aSJamie Gritton 		return (false);
36076754ae25SJamie Gritton 	if (__predict_false(refcount_load(&pr->pr_ref) == 0))
360876ad42abSJamie Gritton 		return (false);
360976ad42abSJamie Gritton 	return (true);
361076ad42abSJamie Gritton }
361176ad42abSJamie Gritton 
361276ad42abSJamie Gritton /*
36130b0ae2e4SMina Galić  * Return true if the passed credential is in a jail and that jail does not
36140b0ae2e4SMina Galić  * have its own virtual network stack, otherwise false.
3615de0bd6f7SBjoern A. Zeeb  */
36160b0ae2e4SMina Galić bool
3617de0bd6f7SBjoern A. Zeeb jailed_without_vnet(struct ucred *cred)
3618de0bd6f7SBjoern A. Zeeb {
3619de0bd6f7SBjoern A. Zeeb 
3620de0bd6f7SBjoern A. Zeeb 	if (!jailed(cred))
36210b0ae2e4SMina Galić 		return (false);
3622de0bd6f7SBjoern A. Zeeb #ifdef VIMAGE
3623de0bd6f7SBjoern A. Zeeb 	if (prison_owns_vnet(cred))
36240b0ae2e4SMina Galić 		return (false);
3625de0bd6f7SBjoern A. Zeeb #endif
3626de0bd6f7SBjoern A. Zeeb 
36270b0ae2e4SMina Galić 	return (true);
3628de0bd6f7SBjoern A. Zeeb }
3629de0bd6f7SBjoern A. Zeeb 
3630de0bd6f7SBjoern A. Zeeb /*
36317455b100SJamie Gritton  * Return the correct hostname (domainname, et al) for the passed credential.
36329484d0c0SRobert Drehmel  */
3633ad1ff099SRobert Drehmel void
36349ddb7954SMike Barcroft getcredhostname(struct ucred *cred, char *buf, size_t size)
36359484d0c0SRobert Drehmel {
363676ca6f88SJamie Gritton 	struct prison *pr;
36379484d0c0SRobert Drehmel 
36387455b100SJamie Gritton 	/*
36397455b100SJamie Gritton 	 * A NULL credential can be used to shortcut to the physical
36407455b100SJamie Gritton 	 * system's hostname.
36417455b100SJamie Gritton 	 */
364276ca6f88SJamie Gritton 	pr = (cred != NULL) ? cred->cr_prison : &prison0;
364376ca6f88SJamie Gritton 	mtx_lock(&pr->pr_mtx);
3644c1f19219SJamie Gritton 	strlcpy(buf, pr->pr_hostname, size);
364576ca6f88SJamie Gritton 	mtx_unlock(&pr->pr_mtx);
36469484d0c0SRobert Drehmel }
3647fd7a8150SMike Barcroft 
36487455b100SJamie Gritton void
36497455b100SJamie Gritton getcreddomainname(struct ucred *cred, char *buf, size_t size)
36507455b100SJamie Gritton {
36517455b100SJamie Gritton 
36527455b100SJamie Gritton 	mtx_lock(&cred->cr_prison->pr_mtx);
3653c1f19219SJamie Gritton 	strlcpy(buf, cred->cr_prison->pr_domainname, size);
36547455b100SJamie Gritton 	mtx_unlock(&cred->cr_prison->pr_mtx);
36557455b100SJamie Gritton }
36567455b100SJamie Gritton 
36577455b100SJamie Gritton void
36587455b100SJamie Gritton getcredhostuuid(struct ucred *cred, char *buf, size_t size)
36597455b100SJamie Gritton {
36607455b100SJamie Gritton 
36617455b100SJamie Gritton 	mtx_lock(&cred->cr_prison->pr_mtx);
3662c1f19219SJamie Gritton 	strlcpy(buf, cred->cr_prison->pr_hostuuid, size);
36637455b100SJamie Gritton 	mtx_unlock(&cred->cr_prison->pr_mtx);
36647455b100SJamie Gritton }
36657455b100SJamie Gritton 
36667455b100SJamie Gritton void
36677455b100SJamie Gritton getcredhostid(struct ucred *cred, unsigned long *hostid)
36687455b100SJamie Gritton {
36697455b100SJamie Gritton 
36707455b100SJamie Gritton 	mtx_lock(&cred->cr_prison->pr_mtx);
36717455b100SJamie Gritton 	*hostid = cred->cr_prison->pr_hostid;
36727455b100SJamie Gritton 	mtx_unlock(&cred->cr_prison->pr_mtx);
36737455b100SJamie Gritton }
36747455b100SJamie Gritton 
36753f8bc99cSKristof Provost void
36763f8bc99cSKristof Provost getjailname(struct ucred *cred, char *name, size_t len)
36773f8bc99cSKristof Provost {
36783f8bc99cSKristof Provost 
36793f8bc99cSKristof Provost 	mtx_lock(&cred->cr_prison->pr_mtx);
36803f8bc99cSKristof Provost 	strlcpy(name, cred->cr_prison->pr_name, len);
36813f8bc99cSKristof Provost 	mtx_unlock(&cred->cr_prison->pr_mtx);
36823f8bc99cSKristof Provost }
36833f8bc99cSKristof Provost 
3684eb79e1c7SBjoern A. Zeeb #ifdef VIMAGE
3685eb79e1c7SBjoern A. Zeeb /*
3686eb79e1c7SBjoern A. Zeeb  * Determine whether the prison represented by cred owns
3687eb79e1c7SBjoern A. Zeeb  * its vnet rather than having it inherited.
3688eb79e1c7SBjoern A. Zeeb  *
36890b0ae2e4SMina Galić  * Returns true in case the prison owns the vnet, false otherwise.
3690eb79e1c7SBjoern A. Zeeb  */
36910b0ae2e4SMina Galić bool
3692eb79e1c7SBjoern A. Zeeb prison_owns_vnet(struct ucred *cred)
3693eb79e1c7SBjoern A. Zeeb {
3694eb79e1c7SBjoern A. Zeeb 
3695eb79e1c7SBjoern A. Zeeb 	/*
3696eb79e1c7SBjoern A. Zeeb 	 * vnets cannot be added/removed after jail creation,
3697eb79e1c7SBjoern A. Zeeb 	 * so no need to lock here.
3698eb79e1c7SBjoern A. Zeeb 	 */
36990b0ae2e4SMina Galić 	return ((cred->cr_prison->pr_flags & PR_VNET) != 0);
3700eb79e1c7SBjoern A. Zeeb }
3701eb79e1c7SBjoern A. Zeeb #endif
3702eb79e1c7SBjoern A. Zeeb 
3703f08df373SRobert Watson /*
3704820a0de9SPawel Jakub Dawidek  * Determine whether the subject represented by cred can "see"
3705820a0de9SPawel Jakub Dawidek  * status of a mount point.
3706820a0de9SPawel Jakub Dawidek  * Returns: 0 for permitted, ENOENT otherwise.
3707820a0de9SPawel Jakub Dawidek  * XXX: This function should be called cr_canseemount() and should be
3708820a0de9SPawel Jakub Dawidek  *      placed in kern_prot.c.
3709f08df373SRobert Watson  */
3710f08df373SRobert Watson int
3711820a0de9SPawel Jakub Dawidek prison_canseemount(struct ucred *cred, struct mount *mp)
3712f08df373SRobert Watson {
3713820a0de9SPawel Jakub Dawidek 	struct prison *pr;
3714820a0de9SPawel Jakub Dawidek 	struct statfs *sp;
3715820a0de9SPawel Jakub Dawidek 	size_t len;
3716f08df373SRobert Watson 
3717820a0de9SPawel Jakub Dawidek 	pr = cred->cr_prison;
37180304c731SJamie Gritton 	if (pr->pr_enforce_statfs == 0)
37190304c731SJamie Gritton 		return (0);
3720820a0de9SPawel Jakub Dawidek 	if (pr->pr_root->v_mount == mp)
3721820a0de9SPawel Jakub Dawidek 		return (0);
37220304c731SJamie Gritton 	if (pr->pr_enforce_statfs == 2)
3723820a0de9SPawel Jakub Dawidek 		return (ENOENT);
3724820a0de9SPawel Jakub Dawidek 	/*
3725820a0de9SPawel Jakub Dawidek 	 * If jail's chroot directory is set to "/" we should be able to see
3726820a0de9SPawel Jakub Dawidek 	 * all mount-points from inside a jail.
3727820a0de9SPawel Jakub Dawidek 	 * This is ugly check, but this is the only situation when jail's
3728820a0de9SPawel Jakub Dawidek 	 * directory ends with '/'.
3729820a0de9SPawel Jakub Dawidek 	 */
3730820a0de9SPawel Jakub Dawidek 	if (strcmp(pr->pr_path, "/") == 0)
3731820a0de9SPawel Jakub Dawidek 		return (0);
3732820a0de9SPawel Jakub Dawidek 	len = strlen(pr->pr_path);
3733820a0de9SPawel Jakub Dawidek 	sp = &mp->mnt_stat;
3734820a0de9SPawel Jakub Dawidek 	if (strncmp(pr->pr_path, sp->f_mntonname, len) != 0)
3735820a0de9SPawel Jakub Dawidek 		return (ENOENT);
3736820a0de9SPawel Jakub Dawidek 	/*
3737820a0de9SPawel Jakub Dawidek 	 * Be sure that we don't have situation where jail's root directory
3738820a0de9SPawel Jakub Dawidek 	 * is "/some/path" and mount point is "/some/pathpath".
3739820a0de9SPawel Jakub Dawidek 	 */
3740820a0de9SPawel Jakub Dawidek 	if (sp->f_mntonname[len] != '\0' && sp->f_mntonname[len] != '/')
3741820a0de9SPawel Jakub Dawidek 		return (ENOENT);
3742f08df373SRobert Watson 	return (0);
3743f08df373SRobert Watson }
3744820a0de9SPawel Jakub Dawidek 
3745820a0de9SPawel Jakub Dawidek void
3746820a0de9SPawel Jakub Dawidek prison_enforce_statfs(struct ucred *cred, struct mount *mp, struct statfs *sp)
3747820a0de9SPawel Jakub Dawidek {
3748820a0de9SPawel Jakub Dawidek 	char jpath[MAXPATHLEN];
3749820a0de9SPawel Jakub Dawidek 	struct prison *pr;
3750820a0de9SPawel Jakub Dawidek 	size_t len;
3751820a0de9SPawel Jakub Dawidek 
3752820a0de9SPawel Jakub Dawidek 	pr = cred->cr_prison;
37530304c731SJamie Gritton 	if (pr->pr_enforce_statfs == 0)
37540304c731SJamie Gritton 		return;
3755820a0de9SPawel Jakub Dawidek 	if (prison_canseemount(cred, mp) != 0) {
3756820a0de9SPawel Jakub Dawidek 		bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
3757820a0de9SPawel Jakub Dawidek 		strlcpy(sp->f_mntonname, "[restricted]",
3758820a0de9SPawel Jakub Dawidek 		    sizeof(sp->f_mntonname));
3759820a0de9SPawel Jakub Dawidek 		return;
3760820a0de9SPawel Jakub Dawidek 	}
3761820a0de9SPawel Jakub Dawidek 	if (pr->pr_root->v_mount == mp) {
3762820a0de9SPawel Jakub Dawidek 		/*
3763820a0de9SPawel Jakub Dawidek 		 * Clear current buffer data, so we are sure nothing from
3764820a0de9SPawel Jakub Dawidek 		 * the valid path left there.
3765820a0de9SPawel Jakub Dawidek 		 */
3766820a0de9SPawel Jakub Dawidek 		bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
3767820a0de9SPawel Jakub Dawidek 		*sp->f_mntonname = '/';
3768820a0de9SPawel Jakub Dawidek 		return;
3769820a0de9SPawel Jakub Dawidek 	}
3770820a0de9SPawel Jakub Dawidek 	/*
3771820a0de9SPawel Jakub Dawidek 	 * If jail's chroot directory is set to "/" we should be able to see
3772820a0de9SPawel Jakub Dawidek 	 * all mount-points from inside a jail.
3773820a0de9SPawel Jakub Dawidek 	 */
3774820a0de9SPawel Jakub Dawidek 	if (strcmp(pr->pr_path, "/") == 0)
3775820a0de9SPawel Jakub Dawidek 		return;
3776820a0de9SPawel Jakub Dawidek 	len = strlen(pr->pr_path);
3777820a0de9SPawel Jakub Dawidek 	strlcpy(jpath, sp->f_mntonname + len, sizeof(jpath));
3778820a0de9SPawel Jakub Dawidek 	/*
3779820a0de9SPawel Jakub Dawidek 	 * Clear current buffer data, so we are sure nothing from
3780820a0de9SPawel Jakub Dawidek 	 * the valid path left there.
3781820a0de9SPawel Jakub Dawidek 	 */
3782820a0de9SPawel Jakub Dawidek 	bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
3783820a0de9SPawel Jakub Dawidek 	if (*jpath == '\0') {
3784820a0de9SPawel Jakub Dawidek 		/* Should never happen. */
3785820a0de9SPawel Jakub Dawidek 		*sp->f_mntonname = '/';
3786820a0de9SPawel Jakub Dawidek 	} else {
3787820a0de9SPawel Jakub Dawidek 		strlcpy(sp->f_mntonname, jpath, sizeof(sp->f_mntonname));
3788820a0de9SPawel Jakub Dawidek 	}
3789f08df373SRobert Watson }
3790f08df373SRobert Watson 
3791800c9408SRobert Watson /*
3792800c9408SRobert Watson  * Check with permission for a specific privilege is granted within jail.  We
3793800c9408SRobert Watson  * have a specific list of accepted privileges; the rest are denied.
3794800c9408SRobert Watson  */
3795800c9408SRobert Watson int
3796800c9408SRobert Watson prison_priv_check(struct ucred *cred, int priv)
3797800c9408SRobert Watson {
37980fe74ae6SJamie Gritton 	struct prison *pr;
37990fe74ae6SJamie Gritton 	int error;
3800800c9408SRobert Watson 
38017b2ff0dcSMateusz Guzik 	/*
38027b2ff0dcSMateusz Guzik 	 * Some policies have custom handlers. This routine should not be
38037b2ff0dcSMateusz Guzik 	 * called for them. See priv_check_cred().
38047b2ff0dcSMateusz Guzik 	 */
38057b2ff0dcSMateusz Guzik 	switch (priv) {
3806a459a6cfSMateusz Guzik 	case PRIV_VFS_LOOKUP:
38077b2ff0dcSMateusz Guzik 	case PRIV_VFS_GENERATION:
38087b2ff0dcSMateusz Guzik 		KASSERT(0, ("prison_priv_check instead of a custom handler "
38097b2ff0dcSMateusz Guzik 		    "called for %d\n", priv));
38107b2ff0dcSMateusz Guzik 	}
38117b2ff0dcSMateusz Guzik 
3812800c9408SRobert Watson 	if (!jailed(cred))
3813800c9408SRobert Watson 		return (0);
3814800c9408SRobert Watson 
38156bb79563SJamie Gritton #ifdef VIMAGE
38166bb79563SJamie Gritton 	/*
38176bb79563SJamie Gritton 	 * Privileges specific to prisons with a virtual network stack.
38186bb79563SJamie Gritton 	 * There might be a duplicate entry here in case the privilege
38196bb79563SJamie Gritton 	 * is only granted conditionally in the legacy jail case.
38206bb79563SJamie Gritton 	 */
38216bb79563SJamie Gritton 	switch (priv) {
38226bb79563SJamie Gritton 		/*
38236bb79563SJamie Gritton 		 * NFS-specific privileges.
38246bb79563SJamie Gritton 		 */
38256bb79563SJamie Gritton 	case PRIV_NFS_DAEMON:
3826bba7a2e8SRick Macklem 	case PRIV_VFS_GETFH:
3827bba7a2e8SRick Macklem 	case PRIV_VFS_MOUNT_EXPORTED:
3828bba7a2e8SRick Macklem 		if (!prison_check_nfsd(cred))
3829bba7a2e8SRick Macklem 			return (EPERM);
3830bba7a2e8SRick Macklem #ifdef notyet
38316bb79563SJamie Gritton 	case PRIV_NFS_LOCKD:
38326bb79563SJamie Gritton #endif
38336bb79563SJamie Gritton 		/*
38346bb79563SJamie Gritton 		 * Network stack privileges.
38356bb79563SJamie Gritton 		 */
38366bb79563SJamie Gritton 	case PRIV_NET_BRIDGE:
38376bb79563SJamie Gritton 	case PRIV_NET_GRE:
38386bb79563SJamie Gritton 	case PRIV_NET_BPF:
38396bb79563SJamie Gritton 	case PRIV_NET_RAW:		/* Dup, cond. in legacy jail case. */
38406bb79563SJamie Gritton 	case PRIV_NET_ROUTE:
38416bb79563SJamie Gritton 	case PRIV_NET_TAP:
38426bb79563SJamie Gritton 	case PRIV_NET_SETIFMTU:
38436bb79563SJamie Gritton 	case PRIV_NET_SETIFFLAGS:
38446bb79563SJamie Gritton 	case PRIV_NET_SETIFCAP:
3845215940b3SXin LI 	case PRIV_NET_SETIFDESCR:
38466bb79563SJamie Gritton 	case PRIV_NET_SETIFNAME	:
38476bb79563SJamie Gritton 	case PRIV_NET_SETIFMETRIC:
38486bb79563SJamie Gritton 	case PRIV_NET_SETIFPHYS:
38496bb79563SJamie Gritton 	case PRIV_NET_SETIFMAC:
3850389474c1SKonstantin Belousov 	case PRIV_NET_SETLANPCP:
38516bb79563SJamie Gritton 	case PRIV_NET_ADDMULTI:
38526bb79563SJamie Gritton 	case PRIV_NET_DELMULTI:
38536bb79563SJamie Gritton 	case PRIV_NET_HWIOCTL:
38546bb79563SJamie Gritton 	case PRIV_NET_SETLLADDR:
38556bb79563SJamie Gritton 	case PRIV_NET_ADDIFGROUP:
38566bb79563SJamie Gritton 	case PRIV_NET_DELIFGROUP:
38576bb79563SJamie Gritton 	case PRIV_NET_IFCREATE:
38586bb79563SJamie Gritton 	case PRIV_NET_IFDESTROY:
38596bb79563SJamie Gritton 	case PRIV_NET_ADDIFADDR:
38606bb79563SJamie Gritton 	case PRIV_NET_DELIFADDR:
38616bb79563SJamie Gritton 	case PRIV_NET_LAGG:
38626bb79563SJamie Gritton 	case PRIV_NET_GIF:
38636bb79563SJamie Gritton 	case PRIV_NET_SETIFVNET:
386435fd7bc0SBjoern A. Zeeb 	case PRIV_NET_SETIFFIB:
3865ab91feabSKristof Provost 	case PRIV_NET_OVPN:
386643f8c763SZhenlei Huang 	case PRIV_NET_ME:
3867744bfb21SJohn Baldwin 	case PRIV_NET_WG:
38686bb79563SJamie Gritton 
38696bb79563SJamie Gritton 		/*
38706bb79563SJamie Gritton 		 * 802.11-related privileges.
38716bb79563SJamie Gritton 		 */
3872f7d38a13SAdrian Chadd 	case PRIV_NET80211_VAP_GETKEY:
3873f7d38a13SAdrian Chadd 	case PRIV_NET80211_VAP_MANAGE:
38746bb79563SJamie Gritton 
38756bb79563SJamie Gritton #ifdef notyet
38766bb79563SJamie Gritton 		/*
38776bb79563SJamie Gritton 		 * ATM privileges.
38786bb79563SJamie Gritton 		 */
38796bb79563SJamie Gritton 	case PRIV_NETATM_CFG:
38806bb79563SJamie Gritton 	case PRIV_NETATM_ADD:
38816bb79563SJamie Gritton 	case PRIV_NETATM_DEL:
38826bb79563SJamie Gritton 	case PRIV_NETATM_SET:
38836bb79563SJamie Gritton 
38846bb79563SJamie Gritton 		/*
38856bb79563SJamie Gritton 		 * Bluetooth privileges.
38866bb79563SJamie Gritton 		 */
38876bb79563SJamie Gritton 	case PRIV_NETBLUETOOTH_RAW:
38886bb79563SJamie Gritton #endif
38896bb79563SJamie Gritton 
38906bb79563SJamie Gritton 		/*
38916bb79563SJamie Gritton 		 * Netgraph and netgraph module privileges.
38926bb79563SJamie Gritton 		 */
38936bb79563SJamie Gritton 	case PRIV_NETGRAPH_CONTROL:
38946bb79563SJamie Gritton #ifdef notyet
38956bb79563SJamie Gritton 	case PRIV_NETGRAPH_TTY:
38966bb79563SJamie Gritton #endif
38976bb79563SJamie Gritton 
38986bb79563SJamie Gritton 		/*
38996bb79563SJamie Gritton 		 * IPv4 and IPv6 privileges.
39006bb79563SJamie Gritton 		 */
39016bb79563SJamie Gritton 	case PRIV_NETINET_IPFW:
39026bb79563SJamie Gritton 	case PRIV_NETINET_DIVERT:
39036bb79563SJamie Gritton 	case PRIV_NETINET_PF:
39046bb79563SJamie Gritton 	case PRIV_NETINET_DUMMYNET:
39056bb79563SJamie Gritton 	case PRIV_NETINET_CARP:
39066bb79563SJamie Gritton 	case PRIV_NETINET_MROUTE:
39076bb79563SJamie Gritton 	case PRIV_NETINET_RAW:
39086bb79563SJamie Gritton 	case PRIV_NETINET_ADDRCTRL6:
39096bb79563SJamie Gritton 	case PRIV_NETINET_ND6:
39106bb79563SJamie Gritton 	case PRIV_NETINET_SCOPE6:
39116bb79563SJamie Gritton 	case PRIV_NETINET_ALIFETIME6:
39126bb79563SJamie Gritton 	case PRIV_NETINET_IPSEC:
39136bb79563SJamie Gritton 	case PRIV_NETINET_BINDANY:
39146bb79563SJamie Gritton 
39156bb79563SJamie Gritton #ifdef notyet
39166bb79563SJamie Gritton 		/*
39176bb79563SJamie Gritton 		 * NCP privileges.
39186bb79563SJamie Gritton 		 */
39196bb79563SJamie Gritton 	case PRIV_NETNCP:
39206bb79563SJamie Gritton 
39216bb79563SJamie Gritton 		/*
39226bb79563SJamie Gritton 		 * SMB privileges.
39236bb79563SJamie Gritton 		 */
39246bb79563SJamie Gritton 	case PRIV_NETSMB:
39256bb79563SJamie Gritton #endif
39266bb79563SJamie Gritton 
39276bb79563SJamie Gritton 	/*
39286bb79563SJamie Gritton 	 * No default: or deny here.
39296bb79563SJamie Gritton 	 * In case of no permit fall through to next switch().
39306bb79563SJamie Gritton 	 */
39316bb79563SJamie Gritton 		if (cred->cr_prison->pr_flags & PR_VNET)
39326bb79563SJamie Gritton 			return (0);
39336bb79563SJamie Gritton 	}
39346bb79563SJamie Gritton #endif /* VIMAGE */
39356bb79563SJamie Gritton 
3936800c9408SRobert Watson 	switch (priv) {
3937800c9408SRobert Watson 		/*
3938800c9408SRobert Watson 		 * Allow ktrace privileges for root in jail.
3939800c9408SRobert Watson 		 */
3940800c9408SRobert Watson 	case PRIV_KTRACE:
3941800c9408SRobert Watson 
3942c3c1b5e6SRobert Watson #if 0
3943800c9408SRobert Watson 		/*
3944800c9408SRobert Watson 		 * Allow jailed processes to configure audit identity and
3945800c9408SRobert Watson 		 * submit audit records (login, etc).  In the future we may
3946800c9408SRobert Watson 		 * want to further refine the relationship between audit and
3947800c9408SRobert Watson 		 * jail.
3948800c9408SRobert Watson 		 */
3949800c9408SRobert Watson 	case PRIV_AUDIT_GETAUDIT:
3950800c9408SRobert Watson 	case PRIV_AUDIT_SETAUDIT:
3951800c9408SRobert Watson 	case PRIV_AUDIT_SUBMIT:
3952c3c1b5e6SRobert Watson #endif
3953800c9408SRobert Watson 
3954800c9408SRobert Watson 		/*
3955800c9408SRobert Watson 		 * Allow jailed processes to manipulate process UNIX
3956800c9408SRobert Watson 		 * credentials in any way they see fit.
3957800c9408SRobert Watson 		 */
3958*ddb3eb4eSOlivier Certner 	case PRIV_CRED_SETCRED:
3959800c9408SRobert Watson 	case PRIV_CRED_SETUID:
3960800c9408SRobert Watson 	case PRIV_CRED_SETEUID:
3961800c9408SRobert Watson 	case PRIV_CRED_SETGID:
3962800c9408SRobert Watson 	case PRIV_CRED_SETEGID:
3963800c9408SRobert Watson 	case PRIV_CRED_SETGROUPS:
3964800c9408SRobert Watson 	case PRIV_CRED_SETREUID:
3965800c9408SRobert Watson 	case PRIV_CRED_SETREGID:
3966800c9408SRobert Watson 	case PRIV_CRED_SETRESUID:
3967800c9408SRobert Watson 	case PRIV_CRED_SETRESGID:
3968800c9408SRobert Watson 
3969800c9408SRobert Watson 		/*
3970800c9408SRobert Watson 		 * Jail implements visibility constraints already, so allow
3971800c9408SRobert Watson 		 * jailed root to override uid/gid-based constraints.
3972800c9408SRobert Watson 		 */
3973800c9408SRobert Watson 	case PRIV_SEEOTHERGIDS:
3974800c9408SRobert Watson 	case PRIV_SEEOTHERUIDS:
39757974ca1cSOlivier Certner 	case PRIV_SEEJAILPROC:
3976800c9408SRobert Watson 
3977800c9408SRobert Watson 		/*
3978800c9408SRobert Watson 		 * Jail implements inter-process debugging limits already, so
3979800c9408SRobert Watson 		 * allow jailed root various debugging privileges.
3980800c9408SRobert Watson 		 */
3981800c9408SRobert Watson 	case PRIV_DEBUG_DIFFCRED:
3982800c9408SRobert Watson 	case PRIV_DEBUG_SUGID:
3983800c9408SRobert Watson 	case PRIV_DEBUG_UNPRIV:
3984800c9408SRobert Watson 
3985800c9408SRobert Watson 		/*
3986800c9408SRobert Watson 		 * Allow jail to set various resource limits and login
3987800c9408SRobert Watson 		 * properties, and for now, exceed process resource limits.
3988800c9408SRobert Watson 		 */
3989800c9408SRobert Watson 	case PRIV_PROC_LIMIT:
3990800c9408SRobert Watson 	case PRIV_PROC_SETLOGIN:
3991800c9408SRobert Watson 	case PRIV_PROC_SETRLIMIT:
3992800c9408SRobert Watson 
3993800c9408SRobert Watson 		/*
3994800c9408SRobert Watson 		 * System V and POSIX IPC privileges are granted in jail.
3995800c9408SRobert Watson 		 */
3996800c9408SRobert Watson 	case PRIV_IPC_READ:
3997800c9408SRobert Watson 	case PRIV_IPC_WRITE:
3998800c9408SRobert Watson 	case PRIV_IPC_ADMIN:
3999800c9408SRobert Watson 	case PRIV_IPC_MSGSIZE:
4000800c9408SRobert Watson 	case PRIV_MQ_ADMIN:
4001800c9408SRobert Watson 
4002800c9408SRobert Watson 		/*
40030304c731SJamie Gritton 		 * Jail operations within a jail work on child jails.
40040304c731SJamie Gritton 		 */
40050304c731SJamie Gritton 	case PRIV_JAIL_ATTACH:
40060304c731SJamie Gritton 	case PRIV_JAIL_SET:
40070304c731SJamie Gritton 	case PRIV_JAIL_REMOVE:
40080304c731SJamie Gritton 
40090304c731SJamie Gritton 		/*
4010800c9408SRobert Watson 		 * Jail implements its own inter-process limits, so allow
4011800c9408SRobert Watson 		 * root processes in jail to change scheduling on other
4012800c9408SRobert Watson 		 * processes in the same jail.  Likewise for signalling.
4013800c9408SRobert Watson 		 */
4014800c9408SRobert Watson 	case PRIV_SCHED_DIFFCRED:
4015413628a7SBjoern A. Zeeb 	case PRIV_SCHED_CPUSET:
4016800c9408SRobert Watson 	case PRIV_SIGNAL_DIFFCRED:
4017800c9408SRobert Watson 	case PRIV_SIGNAL_SUGID:
4018800c9408SRobert Watson 
4019800c9408SRobert Watson 		/*
4020800c9408SRobert Watson 		 * Allow jailed processes to write to sysctls marked as jail
4021800c9408SRobert Watson 		 * writable.
4022800c9408SRobert Watson 		 */
4023800c9408SRobert Watson 	case PRIV_SYSCTL_WRITEJAIL:
4024800c9408SRobert Watson 
4025800c9408SRobert Watson 		/*
4026800c9408SRobert Watson 		 * Allow root in jail to manage a variety of quota
4027e82d0201SRobert Watson 		 * properties.  These should likely be conditional on a
4028e82d0201SRobert Watson 		 * configuration option.
4029800c9408SRobert Watson 		 */
403095b091d2SRobert Watson 	case PRIV_VFS_GETQUOTA:
403195b091d2SRobert Watson 	case PRIV_VFS_SETQUOTA:
4032800c9408SRobert Watson 
4033800c9408SRobert Watson 		/*
4034800c9408SRobert Watson 		 * Since Jail relies on chroot() to implement file system
4035800c9408SRobert Watson 		 * protections, grant many VFS privileges to root in jail.
4036800c9408SRobert Watson 		 * Be careful to exclude mount-related and NFS-related
4037800c9408SRobert Watson 		 * privileges.
4038800c9408SRobert Watson 		 */
4039800c9408SRobert Watson 	case PRIV_VFS_READ:
4040800c9408SRobert Watson 	case PRIV_VFS_WRITE:
4041800c9408SRobert Watson 	case PRIV_VFS_ADMIN:
4042800c9408SRobert Watson 	case PRIV_VFS_EXEC:
4043800c9408SRobert Watson 	case PRIV_VFS_BLOCKRESERVE:	/* XXXRW: Slightly surprising. */
4044800c9408SRobert Watson 	case PRIV_VFS_CHFLAGS_DEV:
4045800c9408SRobert Watson 	case PRIV_VFS_CHOWN:
4046800c9408SRobert Watson 	case PRIV_VFS_CHROOT:
4047bb531912SPawel Jakub Dawidek 	case PRIV_VFS_RETAINSUGID:
4048800c9408SRobert Watson 	case PRIV_VFS_FCHROOT:
4049800c9408SRobert Watson 	case PRIV_VFS_LINK:
4050800c9408SRobert Watson 	case PRIV_VFS_SETGID:
4051e41966dcSRobert Watson 	case PRIV_VFS_STAT:
4052800c9408SRobert Watson 	case PRIV_VFS_STICKYFILE:
4053bb56d716SJamie Gritton 
4054bb56d716SJamie Gritton 		/*
4055bb56d716SJamie Gritton 		 * As in the non-jail case, non-root users are expected to be
405670de1003SGordon Bergling 		 * able to read kernel/physical memory (provided /dev/[k]mem
4057bb56d716SJamie Gritton 		 * exists in the jail and they have permission to access it).
4058bb56d716SJamie Gritton 		 */
4059bb56d716SJamie Gritton 	case PRIV_KMEM_READ:
4060800c9408SRobert Watson 		return (0);
4061800c9408SRobert Watson 
4062800c9408SRobert Watson 		/*
4063800c9408SRobert Watson 		 * Depending on the global setting, allow privilege of
4064800c9408SRobert Watson 		 * setting system flags.
4065800c9408SRobert Watson 		 */
4066800c9408SRobert Watson 	case PRIV_VFS_SYSFLAGS:
40670304c731SJamie Gritton 		if (cred->cr_prison->pr_allow & PR_ALLOW_CHFLAGS)
4068800c9408SRobert Watson 			return (0);
4069800c9408SRobert Watson 		else
4070800c9408SRobert Watson 			return (EPERM);
4071800c9408SRobert Watson 
4072800c9408SRobert Watson 		/*
4073f3a8d2f9SPawel Jakub Dawidek 		 * Depending on the global setting, allow privilege of
4074f3a8d2f9SPawel Jakub Dawidek 		 * mounting/unmounting file systems.
4075f3a8d2f9SPawel Jakub Dawidek 		 */
4076f3a8d2f9SPawel Jakub Dawidek 	case PRIV_VFS_MOUNT:
4077f3a8d2f9SPawel Jakub Dawidek 	case PRIV_VFS_UNMOUNT:
4078f3a8d2f9SPawel Jakub Dawidek 	case PRIV_VFS_MOUNT_NONUSER:
407924b0502eSPawel Jakub Dawidek 	case PRIV_VFS_MOUNT_OWNER:
40800fe74ae6SJamie Gritton 		pr = cred->cr_prison;
40810fe74ae6SJamie Gritton 		prison_lock(pr);
40820fe74ae6SJamie Gritton 		if (pr->pr_allow & PR_ALLOW_MOUNT && pr->pr_enforce_statfs < 2)
40830fe74ae6SJamie Gritton 			error = 0;
4084f3a8d2f9SPawel Jakub Dawidek 		else
40850fe74ae6SJamie Gritton 			error = EPERM;
40860fe74ae6SJamie Gritton 		prison_unlock(pr);
40870fe74ae6SJamie Gritton 		return (error);
4088f3a8d2f9SPawel Jakub Dawidek 
4089f3a8d2f9SPawel Jakub Dawidek 		/*
409063619b6dSKyle Evans 		 * Jails should hold no disposition on the PRIV_VFS_READ_DIR
409163619b6dSKyle Evans 		 * policy.  priv_check_cred will not specifically allow it, and
409263619b6dSKyle Evans 		 * we may want a MAC policy to allow it.
409363619b6dSKyle Evans 		 */
409463619b6dSKyle Evans 	case PRIV_VFS_READ_DIR:
409563619b6dSKyle Evans 		return (0);
409663619b6dSKyle Evans 
409763619b6dSKyle Evans 		/*
4098cb48780dSShawn Webb 		 * Conditionally allow privileged process in the jail to
4099cb48780dSShawn Webb 		 * manipulate filesystem extended attributes in the system
4100cb48780dSShawn Webb 		 * namespace.
4101cb48780dSShawn Webb 		 */
4102cb48780dSShawn Webb 	case PRIV_VFS_EXTATTR_SYSTEM:
4103cb48780dSShawn Webb 		if ((cred->cr_prison->pr_allow & PR_ALLOW_EXTATTR) != 0)
4104cb48780dSShawn Webb 			return (0);
4105cb48780dSShawn Webb 		else
4106cb48780dSShawn Webb 			return (EPERM);
4107cb48780dSShawn Webb 
4108cb48780dSShawn Webb 		/*
4109ccd6ac9fSAntoine Brodin 		 * Conditionnaly allow locking (unlocking) physical pages
4110ccd6ac9fSAntoine Brodin 		 * in memory.
4111ccd6ac9fSAntoine Brodin 		 */
4112ccd6ac9fSAntoine Brodin 	case PRIV_VM_MLOCK:
4113ccd6ac9fSAntoine Brodin 	case PRIV_VM_MUNLOCK:
4114ccd6ac9fSAntoine Brodin 		if (cred->cr_prison->pr_allow & PR_ALLOW_MLOCK)
4115ccd6ac9fSAntoine Brodin 			return (0);
4116ccd6ac9fSAntoine Brodin 		else
4117ccd6ac9fSAntoine Brodin 			return (EPERM);
4118ccd6ac9fSAntoine Brodin 
4119ccd6ac9fSAntoine Brodin 		/*
4120e28f9b7dSAllan Jude 		 * Conditionally allow jailed root to bind reserved ports.
4121800c9408SRobert Watson 		 */
4122800c9408SRobert Watson 	case PRIV_NETINET_RESERVEDPORT:
4123e28f9b7dSAllan Jude 		if (cred->cr_prison->pr_allow & PR_ALLOW_RESERVED_PORTS)
4124e28f9b7dSAllan Jude 			return (0);
4125e28f9b7dSAllan Jude 		else
4126e28f9b7dSAllan Jude 			return (EPERM);
4127e28f9b7dSAllan Jude 
4128e28f9b7dSAllan Jude 		/*
4129e28f9b7dSAllan Jude 		 * Allow jailed root to reuse in-use ports.
4130e28f9b7dSAllan Jude 		 */
41314b084056SRobert Watson 	case PRIV_NETINET_REUSEPORT:
4132800c9408SRobert Watson 		return (0);
4133800c9408SRobert Watson 
4134800c9408SRobert Watson 		/*
4135e3043798SPedro F. Giffuni 		 * Allow jailed root to set certain IPv4/6 (option) headers.
413679ba3952SBjoern A. Zeeb 		 */
413779ba3952SBjoern A. Zeeb 	case PRIV_NETINET_SETHDROPTS:
413879ba3952SBjoern A. Zeeb 		return (0);
413979ba3952SBjoern A. Zeeb 
414079ba3952SBjoern A. Zeeb 		/*
4141800c9408SRobert Watson 		 * Conditionally allow creating raw sockets in jail.
4142800c9408SRobert Watson 		 */
4143800c9408SRobert Watson 	case PRIV_NETINET_RAW:
41440304c731SJamie Gritton 		if (cred->cr_prison->pr_allow & PR_ALLOW_RAW_SOCKETS)
4145800c9408SRobert Watson 			return (0);
4146800c9408SRobert Watson 		else
4147800c9408SRobert Watson 			return (EPERM);
4148800c9408SRobert Watson 
4149800c9408SRobert Watson 		/*
4150800c9408SRobert Watson 		 * Since jail implements its own visibility limits on netstat
4151800c9408SRobert Watson 		 * sysctls, allow getcred.  This allows identd to work in
4152800c9408SRobert Watson 		 * jail.
4153800c9408SRobert Watson 		 */
4154800c9408SRobert Watson 	case PRIV_NETINET_GETCRED:
4155800c9408SRobert Watson 		return (0);
4156800c9408SRobert Watson 
41572bfc50bcSEdward Tomasz Napierala 		/*
41582bfc50bcSEdward Tomasz Napierala 		 * Allow jailed root to set loginclass.
41592bfc50bcSEdward Tomasz Napierala 		 */
41602bfc50bcSEdward Tomasz Napierala 	case PRIV_PROC_SETLOGINCLASS:
41612bfc50bcSEdward Tomasz Napierala 		return (0);
41622bfc50bcSEdward Tomasz Napierala 
4163b19d66fdSJamie Gritton 		/*
41644520f617SJamie Gritton 		 * Do not allow a process inside a jail to read the kernel
4165b19d66fdSJamie Gritton 		 * message buffer unless explicitly permitted.
4166b19d66fdSJamie Gritton 		 */
4167b19d66fdSJamie Gritton 	case PRIV_MSGBUF:
4168b19d66fdSJamie Gritton 		if (cred->cr_prison->pr_allow & PR_ALLOW_READ_MSGBUF)
4169b19d66fdSJamie Gritton 			return (0);
4170b19d66fdSJamie Gritton 		return (EPERM);
4171b19d66fdSJamie Gritton 
4172d3bb35d4SMariusz Zaborski 		/*
4173d3bb35d4SMariusz Zaborski 		 * Conditionally allow privileged process in the jail adjust
4174d3bb35d4SMariusz Zaborski 		 * machine time.
4175d3bb35d4SMariusz Zaborski 		 */
4176d3bb35d4SMariusz Zaborski 	case PRIV_ADJTIME:
4177d3bb35d4SMariusz Zaborski 	case PRIV_NTP_ADJTIME:
4178d3bb35d4SMariusz Zaborski 		if (cred->cr_prison->pr_allow &
4179d3bb35d4SMariusz Zaborski 		    (PR_ALLOW_ADJTIME | PR_ALLOW_SETTIME)) {
4180d3bb35d4SMariusz Zaborski 			return (0);
4181d3bb35d4SMariusz Zaborski 		}
4182d3bb35d4SMariusz Zaborski 		return (EPERM);
4183d3bb35d4SMariusz Zaborski 
4184d3bb35d4SMariusz Zaborski 		/*
4185d3bb35d4SMariusz Zaborski 		 * Conditionally allow privileged process in the jail set
4186d3bb35d4SMariusz Zaborski 		 * machine time.
4187d3bb35d4SMariusz Zaborski 		 */
4188d3bb35d4SMariusz Zaborski 	case PRIV_CLOCK_SETTIME:
4189d3bb35d4SMariusz Zaborski 		if (cred->cr_prison->pr_allow & PR_ALLOW_SETTIME)
4190d3bb35d4SMariusz Zaborski 			return (0);
4191d3bb35d4SMariusz Zaborski 		else
4192d3bb35d4SMariusz Zaborski 			return (EPERM);
4193d3bb35d4SMariusz Zaborski 
4194800c9408SRobert Watson 	default:
4195800c9408SRobert Watson 		/*
4196800c9408SRobert Watson 		 * In all remaining cases, deny the privilege request.  This
4197800c9408SRobert Watson 		 * includes almost all network privileges, many system
4198800c9408SRobert Watson 		 * configuration privileges.
4199800c9408SRobert Watson 		 */
4200800c9408SRobert Watson 		return (EPERM);
4201800c9408SRobert Watson 	}
4202800c9408SRobert Watson }
4203800c9408SRobert Watson 
42040304c731SJamie Gritton /*
42050304c731SJamie Gritton  * Return the part of pr2's name that is relative to pr1, or the whole name
42060304c731SJamie Gritton  * if it does not directly follow.
42070304c731SJamie Gritton  */
42080304c731SJamie Gritton 
42090304c731SJamie Gritton char *
42100304c731SJamie Gritton prison_name(struct prison *pr1, struct prison *pr2)
42110304c731SJamie Gritton {
42120304c731SJamie Gritton 	char *name;
42130304c731SJamie Gritton 
42140304c731SJamie Gritton 	/* Jails see themselves as "0" (if they see themselves at all). */
42150304c731SJamie Gritton 	if (pr1 == pr2)
42160304c731SJamie Gritton 		return "0";
42170304c731SJamie Gritton 	name = pr2->pr_name;
42180304c731SJamie Gritton 	if (prison_ischild(pr1, pr2)) {
42190304c731SJamie Gritton 		/*
42200304c731SJamie Gritton 		 * pr1 isn't locked (and allprison_lock may not be either)
42210304c731SJamie Gritton 		 * so its length can't be counted on.  But the number of dots
42220304c731SJamie Gritton 		 * can be counted on - and counted.
42230304c731SJamie Gritton 		 */
42240304c731SJamie Gritton 		for (; pr1 != &prison0; pr1 = pr1->pr_parent)
42250304c731SJamie Gritton 			name = strchr(name, '.') + 1;
42260304c731SJamie Gritton 	}
42270304c731SJamie Gritton 	return (name);
42280304c731SJamie Gritton }
42290304c731SJamie Gritton 
42300304c731SJamie Gritton /*
42310304c731SJamie Gritton  * Return the part of pr2's path that is relative to pr1, or the whole path
42320304c731SJamie Gritton  * if it does not directly follow.
42330304c731SJamie Gritton  */
42340304c731SJamie Gritton static char *
42350304c731SJamie Gritton prison_path(struct prison *pr1, struct prison *pr2)
42360304c731SJamie Gritton {
42370304c731SJamie Gritton 	char *path1, *path2;
42380304c731SJamie Gritton 	int len1;
42390304c731SJamie Gritton 
42400304c731SJamie Gritton 	path1 = pr1->pr_path;
42410304c731SJamie Gritton 	path2 = pr2->pr_path;
42420304c731SJamie Gritton 	if (!strcmp(path1, "/"))
42430304c731SJamie Gritton 		return (path2);
42440304c731SJamie Gritton 	len1 = strlen(path1);
42450304c731SJamie Gritton 	if (strncmp(path1, path2, len1))
42460304c731SJamie Gritton 		return (path2);
42470304c731SJamie Gritton 	if (path2[len1] == '\0')
42480304c731SJamie Gritton 		return "/";
42490304c731SJamie Gritton 	if (path2[len1] == '/')
42500304c731SJamie Gritton 		return (path2 + len1);
42510304c731SJamie Gritton 	return (path2);
42520304c731SJamie Gritton }
42530304c731SJamie Gritton 
42540304c731SJamie Gritton /*
42550304c731SJamie Gritton  * Jail-related sysctls.
42560304c731SJamie Gritton  */
42577029da5cSPawel Biernacki static SYSCTL_NODE(_security, OID_AUTO, jail, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
42580304c731SJamie Gritton     "Jails");
42590304c731SJamie Gritton 
4260eb8dcdeaSGleb Smirnoff #if defined(INET) || defined(INET6)
4261eb8dcdeaSGleb Smirnoff /*
4262eb8dcdeaSGleb Smirnoff  * Copy address array to memory that would be then SYSCTL_OUT-ed.
4263eb8dcdeaSGleb Smirnoff  * sysctl_jail_list() helper.
4264eb8dcdeaSGleb Smirnoff  */
4265eb8dcdeaSGleb Smirnoff static void
4266eb8dcdeaSGleb Smirnoff prison_ip_copyout(struct prison *pr, const pr_family_t af, void **out, int *len)
4267eb8dcdeaSGleb Smirnoff {
42682c33b456SZhenlei Huang 	const struct prison_ip *pip;
4269eb8dcdeaSGleb Smirnoff 	const size_t size = pr_families[af].size;
4270eb8dcdeaSGleb Smirnoff 
4271eb8dcdeaSGleb Smirnoff  again:
4272eb8dcdeaSGleb Smirnoff 	mtx_assert(&pr->pr_mtx, MA_OWNED);
42732c33b456SZhenlei Huang 	if ((pip = pr->pr_addrs[af]) != NULL) {
42742c33b456SZhenlei Huang 		if (*len < pip->ips) {
42752c33b456SZhenlei Huang 			*len = pip->ips;
4276eb8dcdeaSGleb Smirnoff 			mtx_unlock(&pr->pr_mtx);
4277eb8dcdeaSGleb Smirnoff 			*out = realloc(*out, *len * size, M_TEMP, M_WAITOK);
4278eb8dcdeaSGleb Smirnoff 			mtx_lock(&pr->pr_mtx);
4279eb8dcdeaSGleb Smirnoff 			goto again;
4280eb8dcdeaSGleb Smirnoff 		}
42812c33b456SZhenlei Huang 		bcopy(pip->pr_ip, *out, pip->ips * size);
4282eb8dcdeaSGleb Smirnoff 	}
4283eb8dcdeaSGleb Smirnoff }
4284eb8dcdeaSGleb Smirnoff #endif
4285eb8dcdeaSGleb Smirnoff 
4286fd7a8150SMike Barcroft static int
4287fd7a8150SMike Barcroft sysctl_jail_list(SYSCTL_HANDLER_ARGS)
4288fd7a8150SMike Barcroft {
4289b38ff370SJamie Gritton 	struct xprison *xp;
42900304c731SJamie Gritton 	struct prison *pr, *cpr;
4291b38ff370SJamie Gritton #ifdef INET
4292b38ff370SJamie Gritton 	struct in_addr *ip4 = NULL;
4293b38ff370SJamie Gritton 	int ip4s = 0;
4294b38ff370SJamie Gritton #endif
4295b38ff370SJamie Gritton #ifdef INET6
42963beefaedSColin Percival 	struct in6_addr *ip6 = NULL;
4297b38ff370SJamie Gritton 	int ip6s = 0;
4298b38ff370SJamie Gritton #endif
42990304c731SJamie Gritton 	int descend, error;
4300fd7a8150SMike Barcroft 
4301b38ff370SJamie Gritton 	xp = malloc(sizeof(*xp), M_TEMP, M_WAITOK);
43020304c731SJamie Gritton 	pr = req->td->td_ucred->cr_prison;
4303b38ff370SJamie Gritton 	error = 0;
4304dc68a633SPawel Jakub Dawidek 	sx_slock(&allprison_lock);
43050304c731SJamie Gritton 	FOREACH_PRISON_DESCENDANT(pr, cpr, descend) {
43060304c731SJamie Gritton 		mtx_lock(&cpr->pr_mtx);
4307413628a7SBjoern A. Zeeb #ifdef INET
4308eb8dcdeaSGleb Smirnoff 		prison_ip_copyout(cpr, PR_INET, (void **)&ip4, &ip4s);
4309413628a7SBjoern A. Zeeb #endif
4310413628a7SBjoern A. Zeeb #ifdef INET6
4311eb8dcdeaSGleb Smirnoff 		prison_ip_copyout(cpr, PR_INET6, (void **)&ip6, &ip6s);
4312b38ff370SJamie Gritton #endif
4313b38ff370SJamie Gritton 		bzero(xp, sizeof(*xp));
4314fd7a8150SMike Barcroft 		xp->pr_version = XPRISON_VERSION;
43150304c731SJamie Gritton 		xp->pr_id = cpr->pr_id;
43161158508aSJamie Gritton 		xp->pr_state = cpr->pr_state;
43170304c731SJamie Gritton 		strlcpy(xp->pr_path, prison_path(pr, cpr), sizeof(xp->pr_path));
4318c1f19219SJamie Gritton 		strlcpy(xp->pr_host, cpr->pr_hostname, sizeof(xp->pr_host));
43190304c731SJamie Gritton 		strlcpy(xp->pr_name, prison_name(pr, cpr), sizeof(xp->pr_name));
4320413628a7SBjoern A. Zeeb #ifdef INET
4321eb8dcdeaSGleb Smirnoff 		xp->pr_ip4s = ip4s;
4322413628a7SBjoern A. Zeeb #endif
4323413628a7SBjoern A. Zeeb #ifdef INET6
4324eb8dcdeaSGleb Smirnoff 		xp->pr_ip6s = ip6s;
4325413628a7SBjoern A. Zeeb #endif
43260304c731SJamie Gritton 		mtx_unlock(&cpr->pr_mtx);
4327b38ff370SJamie Gritton 		error = SYSCTL_OUT(req, xp, sizeof(*xp));
4328b38ff370SJamie Gritton 		if (error)
4329b38ff370SJamie Gritton 			break;
4330413628a7SBjoern A. Zeeb #ifdef INET
4331b38ff370SJamie Gritton 		if (xp->pr_ip4s > 0) {
4332b38ff370SJamie Gritton 			error = SYSCTL_OUT(req, ip4,
4333b38ff370SJamie Gritton 			    xp->pr_ip4s * sizeof(struct in_addr));
4334b38ff370SJamie Gritton 			if (error)
4335b38ff370SJamie Gritton 				break;
4336413628a7SBjoern A. Zeeb 		}
4337413628a7SBjoern A. Zeeb #endif
4338413628a7SBjoern A. Zeeb #ifdef INET6
4339b38ff370SJamie Gritton 		if (xp->pr_ip6s > 0) {
4340b38ff370SJamie Gritton 			error = SYSCTL_OUT(req, ip6,
4341b38ff370SJamie Gritton 			    xp->pr_ip6s * sizeof(struct in6_addr));
4342b38ff370SJamie Gritton 			if (error)
4343b38ff370SJamie Gritton 				break;
4344413628a7SBjoern A. Zeeb 		}
4345413628a7SBjoern A. Zeeb #endif
4346fd7a8150SMike Barcroft 	}
4347dc68a633SPawel Jakub Dawidek 	sx_sunlock(&allprison_lock);
4348b38ff370SJamie Gritton 	free(xp, M_TEMP);
4349b38ff370SJamie Gritton #ifdef INET
4350b38ff370SJamie Gritton 	free(ip4, M_TEMP);
4351b38ff370SJamie Gritton #endif
4352b38ff370SJamie Gritton #ifdef INET6
4353b38ff370SJamie Gritton 	free(ip6, M_TEMP);
4354b38ff370SJamie Gritton #endif
4355fd7a8150SMike Barcroft 	return (error);
4356fd7a8150SMike Barcroft }
4357fd7a8150SMike Barcroft 
4358f3b86a5fSEd Schouten SYSCTL_OID(_security_jail, OID_AUTO, list,
4359f3b86a5fSEd Schouten     CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
4360f3b86a5fSEd Schouten     sysctl_jail_list, "S", "List of active jails");
4361461167c2SPawel Jakub Dawidek 
4362461167c2SPawel Jakub Dawidek static int
4363461167c2SPawel Jakub Dawidek sysctl_jail_jailed(SYSCTL_HANDLER_ARGS)
4364461167c2SPawel Jakub Dawidek {
4365461167c2SPawel Jakub Dawidek 	int error, injail;
4366461167c2SPawel Jakub Dawidek 
4367461167c2SPawel Jakub Dawidek 	injail = jailed(req->td->td_ucred);
4368461167c2SPawel Jakub Dawidek 	error = SYSCTL_OUT(req, &injail, sizeof(injail));
4369461167c2SPawel Jakub Dawidek 
4370461167c2SPawel Jakub Dawidek 	return (error);
4371461167c2SPawel Jakub Dawidek }
43720304c731SJamie Gritton 
4373f3b86a5fSEd Schouten SYSCTL_PROC(_security_jail, OID_AUTO, jailed,
4374f3b86a5fSEd Schouten     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
4375f3b86a5fSEd Schouten     sysctl_jail_jailed, "I", "Process in jail?");
4376413628a7SBjoern A. Zeeb 
4377761d2bb5SJamie Gritton static int
4378761d2bb5SJamie Gritton sysctl_jail_vnet(SYSCTL_HANDLER_ARGS)
4379761d2bb5SJamie Gritton {
4380761d2bb5SJamie Gritton 	int error, havevnet;
4381761d2bb5SJamie Gritton #ifdef VIMAGE
4382761d2bb5SJamie Gritton 	struct ucred *cred = req->td->td_ucred;
4383761d2bb5SJamie Gritton 
4384761d2bb5SJamie Gritton 	havevnet = jailed(cred) && prison_owns_vnet(cred);
4385761d2bb5SJamie Gritton #else
4386761d2bb5SJamie Gritton 	havevnet = 0;
4387761d2bb5SJamie Gritton #endif
4388761d2bb5SJamie Gritton 	error = SYSCTL_OUT(req, &havevnet, sizeof(havevnet));
4389761d2bb5SJamie Gritton 
4390761d2bb5SJamie Gritton 	return (error);
4391761d2bb5SJamie Gritton }
4392761d2bb5SJamie Gritton 
4393761d2bb5SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, vnet,
4394761d2bb5SJamie Gritton     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
4395bb8f1623SBjoern A. Zeeb     sysctl_jail_vnet, "I", "Jail owns vnet?");
4396761d2bb5SJamie Gritton 
43970304c731SJamie Gritton #if defined(INET) || defined(INET6)
4398e92e0574SJamie Gritton SYSCTL_UINT(_security_jail, OID_AUTO, jail_max_af_ips, CTLFLAG_RW,
43990304c731SJamie Gritton     &jail_max_af_ips, 0,
4400c542c43eSJamie Gritton     "Number of IP addresses a jail may have at most per address family (deprecated)");
44010304c731SJamie Gritton #endif
44020304c731SJamie Gritton 
44030304c731SJamie Gritton /*
4404c542c43eSJamie Gritton  * Default parameters for jail(2) compatibility.  For historical reasons,
4405c542c43eSJamie Gritton  * the sysctl names have varying similarity to the parameter names.  Prisons
4406c542c43eSJamie Gritton  * just see their own parameters, and can't change them.
44070304c731SJamie Gritton  */
44080304c731SJamie Gritton static int
44090304c731SJamie Gritton sysctl_jail_default_allow(SYSCTL_HANDLER_ARGS)
44100304c731SJamie Gritton {
44110fe74ae6SJamie Gritton 	int error, i;
44120304c731SJamie Gritton 
44130304c731SJamie Gritton 	/* Get the current flag value, and convert it to a boolean. */
44140fe74ae6SJamie Gritton 	if (req->td->td_ucred->cr_prison == &prison0) {
44150fe74ae6SJamie Gritton 		mtx_lock(&prison0.pr_mtx);
44160fe74ae6SJamie Gritton 		i = (jail_default_allow & arg2) != 0;
44170fe74ae6SJamie Gritton 		mtx_unlock(&prison0.pr_mtx);
44180fe74ae6SJamie Gritton 	} else
44190fe74ae6SJamie Gritton 		i = prison_allow(req->td->td_ucred, arg2);
44200fe74ae6SJamie Gritton 
44210304c731SJamie Gritton 	if (arg1 != NULL)
44220304c731SJamie Gritton 		i = !i;
44230304c731SJamie Gritton 	error = sysctl_handle_int(oidp, &i, 0, req);
4424c542c43eSJamie Gritton 	if (error || !req->newptr)
44250304c731SJamie Gritton 		return (error);
44260304c731SJamie Gritton 	i = i ? arg2 : 0;
44270304c731SJamie Gritton 	if (arg1 != NULL)
44280304c731SJamie Gritton 		i ^= arg2;
44290304c731SJamie Gritton 	/*
44300304c731SJamie Gritton 	 * The sysctls don't have CTLFLAGS_PRISON, so assume prison0
44310304c731SJamie Gritton 	 * for writing.
44320304c731SJamie Gritton 	 */
44330304c731SJamie Gritton 	mtx_lock(&prison0.pr_mtx);
44340304c731SJamie Gritton 	jail_default_allow = (jail_default_allow & ~arg2) | i;
44350304c731SJamie Gritton 	mtx_unlock(&prison0.pr_mtx);
44360304c731SJamie Gritton 	return (0);
44370304c731SJamie Gritton }
44380304c731SJamie Gritton 
44390304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, set_hostname_allowed,
4440c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
44410304c731SJamie Gritton     NULL, PR_ALLOW_SET_HOSTNAME, sysctl_jail_default_allow, "I",
4442c542c43eSJamie Gritton     "Processes in jail can set their hostnames (deprecated)");
44430304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, socket_unixiproute_only,
4444c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
44450304c731SJamie Gritton     (void *)1, PR_ALLOW_SOCKET_AF, sysctl_jail_default_allow, "I",
4446c542c43eSJamie Gritton     "Processes in jail are limited to creating UNIX/IP/route sockets only (deprecated)");
44470304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, sysvipc_allowed,
4448c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
44490304c731SJamie Gritton     NULL, PR_ALLOW_SYSVIPC, sysctl_jail_default_allow, "I",
4450c542c43eSJamie Gritton     "Processes in jail can use System V IPC primitives (deprecated)");
44510304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, allow_raw_sockets,
4452c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
44530304c731SJamie Gritton     NULL, PR_ALLOW_RAW_SOCKETS, sysctl_jail_default_allow, "I",
4454c542c43eSJamie Gritton     "Prison root can create raw sockets (deprecated)");
44550304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, chflags_allowed,
4456c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
44570304c731SJamie Gritton     NULL, PR_ALLOW_CHFLAGS, sysctl_jail_default_allow, "I",
4458c542c43eSJamie Gritton     "Processes in jail can alter system file flags (deprecated)");
44590304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, mount_allowed,
4460c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
44610304c731SJamie Gritton     NULL, PR_ALLOW_MOUNT, sysctl_jail_default_allow, "I",
4462c542c43eSJamie Gritton     "Processes in jail can mount/unmount jail-friendly file systems (deprecated)");
44639fd97868SBaptiste Daroussin SYSCTL_PROC(_security_jail, OID_AUTO, mlock_allowed,
44649fd97868SBaptiste Daroussin     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
44659fd97868SBaptiste Daroussin     NULL, PR_ALLOW_MLOCK, sysctl_jail_default_allow, "I",
44669fd97868SBaptiste Daroussin     "Processes in jail can lock/unlock physical pages in memory");
44670304c731SJamie Gritton 
44680304c731SJamie Gritton static int
44690304c731SJamie Gritton sysctl_jail_default_level(SYSCTL_HANDLER_ARGS)
44700304c731SJamie Gritton {
44710304c731SJamie Gritton 	struct prison *pr;
44720304c731SJamie Gritton 	int level, error;
44730304c731SJamie Gritton 
44740304c731SJamie Gritton 	pr = req->td->td_ucred->cr_prison;
44750304c731SJamie Gritton 	level = (pr == &prison0) ? *(int *)arg1 : *(int *)((char *)pr + arg2);
44760304c731SJamie Gritton 	error = sysctl_handle_int(oidp, &level, 0, req);
4477c542c43eSJamie Gritton 	if (error || !req->newptr)
44780304c731SJamie Gritton 		return (error);
44790304c731SJamie Gritton 	*(int *)arg1 = level;
44800304c731SJamie Gritton 	return (0);
44810304c731SJamie Gritton }
44820304c731SJamie Gritton 
44830304c731SJamie Gritton SYSCTL_PROC(_security_jail, OID_AUTO, enforce_statfs,
4484c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4485c542c43eSJamie Gritton     &jail_default_enforce_statfs, offsetof(struct prison, pr_enforce_statfs),
44860304c731SJamie Gritton     sysctl_jail_default_level, "I",
4487c542c43eSJamie Gritton     "Processes in jail cannot see all mounted file systems (deprecated)");
4488c542c43eSJamie Gritton 
44890cc207a6SMartin Matuska SYSCTL_PROC(_security_jail, OID_AUTO, devfs_ruleset,
4490c542c43eSJamie Gritton     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE,
4491c542c43eSJamie Gritton     &jail_default_devfs_rsnum, offsetof(struct prison, pr_devfs_rsnum),
44920cc207a6SMartin Matuska     sysctl_jail_default_level, "I",
4493c542c43eSJamie Gritton     "Ruleset for the devfs filesystem in jail (deprecated)");
44940cc207a6SMartin Matuska 
4495ab0841bdSJamie Gritton SYSCTL_NODE(_security_jail, OID_AUTO, children, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
4496ab0841bdSJamie Gritton     "Limits and stats of child jails");
4497ab0841bdSJamie Gritton 
4498ab0841bdSJamie Gritton static int
4499ab0841bdSJamie Gritton sysctl_jail_children(SYSCTL_HANDLER_ARGS)
4500ab0841bdSJamie Gritton {
4501ab0841bdSJamie Gritton 	struct prison *pr;
4502ab0841bdSJamie Gritton 	int i;
4503ab0841bdSJamie Gritton 
4504ab0841bdSJamie Gritton 	pr = req->td->td_ucred->cr_prison;
4505ab0841bdSJamie Gritton 
4506ab0841bdSJamie Gritton 	switch (oidp->oid_kind & CTLTYPE) {
4507ab0841bdSJamie Gritton 	case CTLTYPE_INT:
4508ab0841bdSJamie Gritton 		i = *(int *)((char *)pr + arg2);
4509ab0841bdSJamie Gritton 		return (SYSCTL_OUT(req, &i, sizeof(i)));
4510ab0841bdSJamie Gritton 	}
4511ab0841bdSJamie Gritton 
4512ab0841bdSJamie Gritton 	return (0);
4513ab0841bdSJamie Gritton }
4514ab0841bdSJamie Gritton 
4515ab0841bdSJamie Gritton SYSCTL_PROC(_security_jail_children, OID_AUTO, max,
4516ab0841bdSJamie Gritton     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE,
4517ab0841bdSJamie Gritton     NULL, offsetof(struct prison, pr_childmax), sysctl_jail_children,
4518ab0841bdSJamie Gritton     "I", "Maximum number of child jails");
4519ab0841bdSJamie Gritton SYSCTL_PROC(_security_jail_children, OID_AUTO, cur,
4520ab0841bdSJamie Gritton     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE,
4521ab0841bdSJamie Gritton     NULL, offsetof(struct prison, pr_childcount), sysctl_jail_children,
4522ab0841bdSJamie Gritton     "I", "Current number of child jails");
4523ab0841bdSJamie Gritton 
45240304c731SJamie Gritton /*
45250304c731SJamie Gritton  * Nodes to describe jail parameters.  Maximum length of string parameters
45260304c731SJamie Gritton  * is returned in the string itself, and the other parameters exist merely
45270304c731SJamie Gritton  * to make themselves and their types known.
45280304c731SJamie Gritton  */
45297029da5cSPawel Biernacki SYSCTL_NODE(_security_jail, OID_AUTO, param, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
45300304c731SJamie Gritton     "Jail parameters");
45310304c731SJamie Gritton 
45320304c731SJamie Gritton int
45330304c731SJamie Gritton sysctl_jail_param(SYSCTL_HANDLER_ARGS)
45340304c731SJamie Gritton {
45350304c731SJamie Gritton 	int i;
45360304c731SJamie Gritton 	long l;
45370304c731SJamie Gritton 	size_t s;
45380304c731SJamie Gritton 	char numbuf[12];
45390304c731SJamie Gritton 
45400304c731SJamie Gritton 	switch (oidp->oid_kind & CTLTYPE)
45410304c731SJamie Gritton 	{
45420304c731SJamie Gritton 	case CTLTYPE_LONG:
45430304c731SJamie Gritton 	case CTLTYPE_ULONG:
45440304c731SJamie Gritton 		l = 0;
45450304c731SJamie Gritton #ifdef SCTL_MASK32
45460304c731SJamie Gritton 		if (!(req->flags & SCTL_MASK32))
45470304c731SJamie Gritton #endif
45480304c731SJamie Gritton 			return (SYSCTL_OUT(req, &l, sizeof(l)));
45490304c731SJamie Gritton 	case CTLTYPE_INT:
45500304c731SJamie Gritton 	case CTLTYPE_UINT:
45510304c731SJamie Gritton 		i = 0;
45520304c731SJamie Gritton 		return (SYSCTL_OUT(req, &i, sizeof(i)));
45530304c731SJamie Gritton 	case CTLTYPE_STRING:
4554e4cd31ddSJeff Roberson 		snprintf(numbuf, sizeof(numbuf), "%jd", (intmax_t)arg2);
45550304c731SJamie Gritton 		return
45560304c731SJamie Gritton 		    (sysctl_handle_string(oidp, numbuf, sizeof(numbuf), req));
45570304c731SJamie Gritton 	case CTLTYPE_STRUCT:
45580304c731SJamie Gritton 		s = (size_t)arg2;
45590304c731SJamie Gritton 		return (SYSCTL_OUT(req, &s, sizeof(s)));
45600304c731SJamie Gritton 	}
45610304c731SJamie Gritton 	return (0);
45620304c731SJamie Gritton }
45630304c731SJamie Gritton 
4564b96bd95bSIan Lepore /*
4565b96bd95bSIan Lepore  * CTLFLAG_RDTUN in the following indicates jail parameters that can be set at
4566b96bd95bSIan Lepore  * jail creation time but cannot be changed in an existing jail.
4567b96bd95bSIan Lepore  */
45680304c731SJamie Gritton SYSCTL_JAIL_PARAM(, jid, CTLTYPE_INT | CTLFLAG_RDTUN, "I", "Jail ID");
45690304c731SJamie Gritton SYSCTL_JAIL_PARAM(, parent, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail parent ID");
45700304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(, name, CTLFLAG_RW, MAXHOSTNAMELEN, "Jail name");
45710304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(, path, CTLFLAG_RDTUN, MAXPATHLEN, "Jail root path");
45720304c731SJamie Gritton SYSCTL_JAIL_PARAM(, securelevel, CTLTYPE_INT | CTLFLAG_RW,
45730304c731SJamie Gritton     "I", "Jail secure level");
4574b96bd95bSIan Lepore SYSCTL_JAIL_PARAM(, osreldate, CTLTYPE_INT | CTLFLAG_RDTUN, "I",
4575b96bd95bSIan Lepore     "Jail value for kern.osreldate and uname -K");
4576b96bd95bSIan Lepore SYSCTL_JAIL_PARAM_STRING(, osrelease, CTLFLAG_RDTUN, OSRELEASELEN,
4577b96bd95bSIan Lepore     "Jail value for kern.osrelease and uname -r");
45780304c731SJamie Gritton SYSCTL_JAIL_PARAM(, enforce_statfs, CTLTYPE_INT | CTLFLAG_RW,
45790304c731SJamie Gritton     "I", "Jail cannot see all mounted file systems");
45800cc207a6SMartin Matuska SYSCTL_JAIL_PARAM(, devfs_ruleset, CTLTYPE_INT | CTLFLAG_RW,
45810cc207a6SMartin Matuska     "I", "Ruleset for in-jail devfs mounts");
45820304c731SJamie Gritton SYSCTL_JAIL_PARAM(, persist, CTLTYPE_INT | CTLFLAG_RW,
45830304c731SJamie Gritton     "B", "Jail persistence");
4584679e1390SJamie Gritton #ifdef VIMAGE
4585679e1390SJamie Gritton SYSCTL_JAIL_PARAM(, vnet, CTLTYPE_INT | CTLFLAG_RDTUN,
45867cbf7213SJamie Gritton     "E,jailsys", "Virtual network stack");
4587679e1390SJamie Gritton #endif
45880304c731SJamie Gritton SYSCTL_JAIL_PARAM(, dying, CTLTYPE_INT | CTLFLAG_RD,
45890304c731SJamie Gritton     "B", "Jail is in the process of shutting down");
45900304c731SJamie Gritton 
4591b97457e2SJamie Gritton SYSCTL_JAIL_PARAM_NODE(children, "Number of child jails");
4592b97457e2SJamie Gritton SYSCTL_JAIL_PARAM(_children, cur, CTLTYPE_INT | CTLFLAG_RD,
4593b97457e2SJamie Gritton     "I", "Current number of child jails");
4594b97457e2SJamie Gritton SYSCTL_JAIL_PARAM(_children, max, CTLTYPE_INT | CTLFLAG_RW,
4595b97457e2SJamie Gritton     "I", "Maximum number of child jails");
4596b97457e2SJamie Gritton 
45977cbf7213SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(host, CTLFLAG_RW, "Jail host info");
45980304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, hostname, CTLFLAG_RW, MAXHOSTNAMELEN,
45990304c731SJamie Gritton     "Jail hostname");
460076ca6f88SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, domainname, CTLFLAG_RW, MAXHOSTNAMELEN,
460176ca6f88SJamie Gritton     "Jail NIS domainname");
460276ca6f88SJamie Gritton SYSCTL_JAIL_PARAM_STRING(_host, hostuuid, CTLFLAG_RW, HOSTUUIDLEN,
460376ca6f88SJamie Gritton     "Jail host UUID");
460476ca6f88SJamie Gritton SYSCTL_JAIL_PARAM(_host, hostid, CTLTYPE_ULONG | CTLFLAG_RW,
460576ca6f88SJamie Gritton     "LU", "Jail host ID");
46060304c731SJamie Gritton 
46070304c731SJamie Gritton SYSCTL_JAIL_PARAM_NODE(cpuset, "Jail cpuset");
46080304c731SJamie Gritton SYSCTL_JAIL_PARAM(_cpuset, id, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail cpuset ID");
46090304c731SJamie Gritton 
46100304c731SJamie Gritton #ifdef INET
46112b0d6f81SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(ip4, CTLFLAG_RDTUN,
46122b0d6f81SJamie Gritton     "Jail IPv4 address virtualization");
46130304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRUCT(_ip4, addr, CTLFLAG_RW, sizeof(struct in_addr),
46140304c731SJamie Gritton     "S,in_addr,a", "Jail IPv4 addresses");
4615592bcae8SBjoern A. Zeeb SYSCTL_JAIL_PARAM(_ip4, saddrsel, CTLTYPE_INT | CTLFLAG_RW,
4616592bcae8SBjoern A. Zeeb     "B", "Do (not) use IPv4 source address selection rather than the "
4617592bcae8SBjoern A. Zeeb     "primary jail IPv4 address.");
46180304c731SJamie Gritton #endif
46190304c731SJamie Gritton #ifdef INET6
46202b0d6f81SJamie Gritton SYSCTL_JAIL_PARAM_SYS_NODE(ip6, CTLFLAG_RDTUN,
46212b0d6f81SJamie Gritton     "Jail IPv6 address virtualization");
46220304c731SJamie Gritton SYSCTL_JAIL_PARAM_STRUCT(_ip6, addr, CTLFLAG_RW, sizeof(struct in6_addr),
46230304c731SJamie Gritton     "S,in6_addr,a", "Jail IPv6 addresses");
4624592bcae8SBjoern A. Zeeb SYSCTL_JAIL_PARAM(_ip6, saddrsel, CTLTYPE_INT | CTLFLAG_RW,
4625592bcae8SBjoern A. Zeeb     "B", "Do (not) use IPv6 source address selection rather than the "
4626592bcae8SBjoern A. Zeeb     "primary jail IPv6 address.");
46270304c731SJamie Gritton #endif
46280304c731SJamie Gritton 
46290304c731SJamie Gritton SYSCTL_JAIL_PARAM_NODE(allow, "Jail permission flags");
46300304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, set_hostname, CTLTYPE_INT | CTLFLAG_RW,
46310304c731SJamie Gritton     "B", "Jail may set hostname");
46320304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, sysvipc, CTLTYPE_INT | CTLFLAG_RW,
46330304c731SJamie Gritton     "B", "Jail may use SYSV IPC");
46340304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, raw_sockets, CTLTYPE_INT | CTLFLAG_RW,
46350304c731SJamie Gritton     "B", "Jail may create raw sockets");
46360304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, chflags, CTLTYPE_INT | CTLFLAG_RW,
46370304c731SJamie Gritton     "B", "Jail may alter system file flags");
46380304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, quotas, CTLTYPE_INT | CTLFLAG_RW,
46390304c731SJamie Gritton     "B", "Jail may set file quotas");
46400304c731SJamie Gritton SYSCTL_JAIL_PARAM(_allow, socket_af, CTLTYPE_INT | CTLFLAG_RW,
46410304c731SJamie Gritton     "B", "Jail may create sockets other than just UNIX/IPv4/IPv6/route");
4642ccd6ac9fSAntoine Brodin SYSCTL_JAIL_PARAM(_allow, mlock, CTLTYPE_INT | CTLFLAG_RW,
4643ccd6ac9fSAntoine Brodin     "B", "Jail may lock (unlock) physical pages in memory");
4644e28f9b7dSAllan Jude SYSCTL_JAIL_PARAM(_allow, reserved_ports, CTLTYPE_INT | CTLFLAG_RW,
4645e28f9b7dSAllan Jude     "B", "Jail may bind sockets to reserved ports");
4646b19d66fdSJamie Gritton SYSCTL_JAIL_PARAM(_allow, read_msgbuf, CTLTYPE_INT | CTLFLAG_RW,
4647b19d66fdSJamie Gritton     "B", "Jail may read the kernel message buffer");
4648b3079544SJamie Gritton SYSCTL_JAIL_PARAM(_allow, unprivileged_proc_debug, CTLTYPE_INT | CTLFLAG_RW,
4649b3079544SJamie Gritton     "B", "Unprivileged processes may use process debugging facilities");
465005e1e482SMariusz Zaborski SYSCTL_JAIL_PARAM(_allow, suser, CTLTYPE_INT | CTLFLAG_RW,
465105e1e482SMariusz Zaborski     "B", "Processes in jail with uid 0 have privilege");
4652cbbb2203SRick Macklem #ifdef VIMAGE
4653bba7a2e8SRick Macklem SYSCTL_JAIL_PARAM(_allow, nfsd, CTLTYPE_INT | CTLFLAG_RW,
4654bba7a2e8SRick Macklem     "B", "Mountd/nfsd may run in the jail");
4655bba7a2e8SRick Macklem #endif
4656cb48780dSShawn Webb SYSCTL_JAIL_PARAM(_allow, extattr, CTLTYPE_INT | CTLFLAG_RW,
4657cb48780dSShawn Webb     "B", "Jail may set system-level filesystem extended attributes");
4658d3bb35d4SMariusz Zaborski SYSCTL_JAIL_PARAM(_allow, adjtime, CTLTYPE_INT | CTLFLAG_RW,
4659d3bb35d4SMariusz Zaborski     "B", "Jail may adjust system time");
4660d3bb35d4SMariusz Zaborski SYSCTL_JAIL_PARAM(_allow, settime, CTLTYPE_INT | CTLFLAG_RW,
4661d3bb35d4SMariusz Zaborski     "B", "Jail may set system time");
46620304c731SJamie Gritton 
4663bf3db8aaSMartin Matuska SYSCTL_JAIL_PARAM_SUBNODE(allow, mount, "Jail mount/unmount permission flags");
4664bf3db8aaSMartin Matuska SYSCTL_JAIL_PARAM(_allow_mount, , CTLTYPE_INT | CTLFLAG_RW,
4665bf3db8aaSMartin Matuska     "B", "Jail may mount/unmount jail-friendly file systems in general");
46660e5c6bd4SJamie Gritton 
46670e5c6bd4SJamie Gritton /*
46680a172404SJamie Gritton  * Add a dynamic parameter allow.<name>, or allow.<prefix>.<name>.  Return
46690a172404SJamie Gritton  * its associated bit in the pr_allow bitmask, or zero if the parameter was
46700a172404SJamie Gritton  * not created.
46710e5c6bd4SJamie Gritton  */
46720a172404SJamie Gritton unsigned
46730a172404SJamie Gritton prison_add_allow(const char *prefix, const char *name, const char *prefix_descr,
46740a172404SJamie Gritton     const char *descr)
46750e5c6bd4SJamie Gritton {
46760e5c6bd4SJamie Gritton 	struct bool_flags *bf;
46770a172404SJamie Gritton 	struct sysctl_oid *parent;
46780a172404SJamie Gritton 	char *allow_name, *allow_noname, *allowed;
4679c542c43eSJamie Gritton #ifndef NO_SYSCTL_DESCR
4680c542c43eSJamie Gritton 	char *descr_deprecated;
4681c542c43eSJamie Gritton #endif
46825d58f959SJamie Gritton 	u_int allow_flag;
46830e5c6bd4SJamie Gritton 
46840a172404SJamie Gritton 	if (prefix
46850a172404SJamie Gritton 	    ? asprintf(&allow_name, M_PRISON, "allow.%s.%s", prefix, name)
46860a172404SJamie Gritton 		< 0 ||
46870a172404SJamie Gritton 	      asprintf(&allow_noname, M_PRISON, "allow.%s.no%s", prefix, name)
46880a172404SJamie Gritton 		< 0
46890a172404SJamie Gritton 	    : asprintf(&allow_name, M_PRISON, "allow.%s", name) < 0 ||
46900a172404SJamie Gritton 	      asprintf(&allow_noname, M_PRISON, "allow.no%s", name) < 0) {
46910e5c6bd4SJamie Gritton 		free(allow_name, M_PRISON);
46920a172404SJamie Gritton 		return 0;
46930e5c6bd4SJamie Gritton 	}
46940e5c6bd4SJamie Gritton 
46950e5c6bd4SJamie Gritton 	/*
46960a172404SJamie Gritton 	 * See if this parameter has already beed added, i.e. a module was
46970a172404SJamie Gritton 	 * previously loaded/unloaded.
46980e5c6bd4SJamie Gritton 	 */
46990e5c6bd4SJamie Gritton 	mtx_lock(&prison0.pr_mtx);
47000e5c6bd4SJamie Gritton 	for (bf = pr_flag_allow;
47015d58f959SJamie Gritton 	     bf < pr_flag_allow + nitems(pr_flag_allow) &&
47025d58f959SJamie Gritton 		atomic_load_int(&bf->flag) != 0;
47030e5c6bd4SJamie Gritton 	     bf++) {
47040e5c6bd4SJamie Gritton 		if (strcmp(bf->name, allow_name) == 0) {
47050a172404SJamie Gritton 			allow_flag = bf->flag;
47060e5c6bd4SJamie Gritton 			goto no_add;
47070e5c6bd4SJamie Gritton 		}
47080e5c6bd4SJamie Gritton 	}
47090e5c6bd4SJamie Gritton 
47100e5c6bd4SJamie Gritton 	/*
47115d58f959SJamie Gritton 	 * Find a free bit in pr_allow_all, failing if there are none
47120e5c6bd4SJamie Gritton 	 * (which shouldn't happen as long as we keep track of how many
47130a172404SJamie Gritton 	 * potential dynamic flags exist).
47140e5c6bd4SJamie Gritton 	 */
47150e5c6bd4SJamie Gritton 	for (allow_flag = 1;; allow_flag <<= 1) {
47160e5c6bd4SJamie Gritton 		if (allow_flag == 0)
47170e5c6bd4SJamie Gritton 			goto no_add;
47185d58f959SJamie Gritton 		if ((pr_allow_all & allow_flag) == 0)
47190e5c6bd4SJamie Gritton 			break;
47200e5c6bd4SJamie Gritton 	}
47210e5c6bd4SJamie Gritton 
47225d58f959SJamie Gritton 	/* Note the parameter in the next open slot in pr_flag_allow. */
47235d58f959SJamie Gritton 	for (bf = pr_flag_allow; ; bf++) {
47240e5c6bd4SJamie Gritton 		if (bf == pr_flag_allow + nitems(pr_flag_allow)) {
47250e5c6bd4SJamie Gritton 			/* This should never happen, but is not fatal. */
47260a172404SJamie Gritton 			allow_flag = 0;
47270e5c6bd4SJamie Gritton 			goto no_add;
47280e5c6bd4SJamie Gritton 		}
47295d58f959SJamie Gritton 		if (atomic_load_int(&bf->flag) == 0)
47305d58f959SJamie Gritton 			break;
47315d58f959SJamie Gritton 	}
47320e5c6bd4SJamie Gritton 	bf->name = allow_name;
47330e5c6bd4SJamie Gritton 	bf->noname = allow_noname;
47345d58f959SJamie Gritton 	pr_allow_all |= allow_flag;
47355d58f959SJamie Gritton 	/*
47365d58f959SJamie Gritton 	 * prison0 always has permission for the new parameter.
47375d58f959SJamie Gritton 	 * Other jails must have it granted to them.
47385d58f959SJamie Gritton 	 */
47395d58f959SJamie Gritton 	prison0.pr_allow |= allow_flag;
47405d58f959SJamie Gritton 	/* The flag indicates a valid entry, so make sure it is set last. */
47415d58f959SJamie Gritton 	atomic_store_rel_int(&bf->flag, allow_flag);
47420e5c6bd4SJamie Gritton 	mtx_unlock(&prison0.pr_mtx);
47430e5c6bd4SJamie Gritton 
4744c542c43eSJamie Gritton 	/*
47454771011bSGordon Bergling 	 * Create sysctls for the parameter, and the back-compat global
4746c542c43eSJamie Gritton 	 * permission.
4747c542c43eSJamie Gritton 	 */
47480a172404SJamie Gritton 	parent = prefix
47490a172404SJamie Gritton 	    ? SYSCTL_ADD_NODE(NULL,
47500a172404SJamie Gritton 		  SYSCTL_CHILDREN(&sysctl___security_jail_param_allow),
47517029da5cSPawel Biernacki 		  OID_AUTO, prefix, CTLFLAG_MPSAFE, 0, prefix_descr)
47520a172404SJamie Gritton 	    : &sysctl___security_jail_param_allow;
47530a172404SJamie Gritton 	(void)SYSCTL_ADD_PROC(NULL, SYSCTL_CHILDREN(parent), OID_AUTO,
47540a172404SJamie Gritton 	    name, CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
47550e5c6bd4SJamie Gritton 	    NULL, 0, sysctl_jail_param, "B", descr);
47560a172404SJamie Gritton 	if ((prefix
47570a172404SJamie Gritton 	     ? asprintf(&allowed, M_TEMP, "%s_%s_allowed", prefix, name)
47580a172404SJamie Gritton 	     : asprintf(&allowed, M_TEMP, "%s_allowed", name)) >= 0) {
4759c542c43eSJamie Gritton #ifndef NO_SYSCTL_DESCR
4760c542c43eSJamie Gritton 		(void)asprintf(&descr_deprecated, M_TEMP, "%s (deprecated)",
4761c542c43eSJamie Gritton 		    descr);
4762c542c43eSJamie Gritton #endif
47630e5c6bd4SJamie Gritton 		(void)SYSCTL_ADD_PROC(NULL,
47640a172404SJamie Gritton 		    SYSCTL_CHILDREN(&sysctl___security_jail), OID_AUTO, allowed,
4765c542c43eSJamie Gritton 		    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, allow_flag,
4766c542c43eSJamie Gritton 		    sysctl_jail_default_allow, "I", descr_deprecated);
4767c542c43eSJamie Gritton #ifndef NO_SYSCTL_DESCR
4768c542c43eSJamie Gritton 		free(descr_deprecated, M_TEMP);
4769c542c43eSJamie Gritton #endif
47700a172404SJamie Gritton 		free(allowed, M_TEMP);
47710e5c6bd4SJamie Gritton 	}
47720a172404SJamie Gritton 	return allow_flag;
47730e5c6bd4SJamie Gritton 
47740e5c6bd4SJamie Gritton  no_add:
47750e5c6bd4SJamie Gritton 	mtx_unlock(&prison0.pr_mtx);
47760e5c6bd4SJamie Gritton 	free(allow_name, M_PRISON);
47770e5c6bd4SJamie Gritton 	free(allow_noname, M_PRISON);
47780a172404SJamie Gritton 	return allow_flag;
47790a172404SJamie Gritton }
47800a172404SJamie Gritton 
47810a172404SJamie Gritton /*
47820a172404SJamie Gritton  * The VFS system will register jail-aware filesystems here.  They each get
47830a172404SJamie Gritton  * a parameter allow.mount.xxxfs and a flag to check when a jailed user
47840a172404SJamie Gritton  * attempts to mount.
47850a172404SJamie Gritton  */
47860a172404SJamie Gritton void
47870a172404SJamie Gritton prison_add_vfs(struct vfsconf *vfsp)
47880a172404SJamie Gritton {
47890a172404SJamie Gritton #ifdef NO_SYSCTL_DESCR
47900a172404SJamie Gritton 
47910a172404SJamie Gritton 	vfsp->vfc_prison_flag = prison_add_allow("mount", vfsp->vfc_name,
47920a172404SJamie Gritton 	    NULL, NULL);
47930a172404SJamie Gritton #else
47940a172404SJamie Gritton 	char *descr;
47950a172404SJamie Gritton 
47960a172404SJamie Gritton 	(void)asprintf(&descr, M_TEMP, "Jail may mount the %s file system",
47970a172404SJamie Gritton 	    vfsp->vfc_name);
47980a172404SJamie Gritton 	vfsp->vfc_prison_flag = prison_add_allow("mount", vfsp->vfc_name,
47990a172404SJamie Gritton 	    NULL, descr);
48000a172404SJamie Gritton 	free(descr, M_TEMP);
48010a172404SJamie Gritton #endif
48020e5c6bd4SJamie Gritton }
4803bf3db8aaSMartin Matuska 
48044b5c9cf6SEdward Tomasz Napierala #ifdef RACCT
4805097055e2SEdward Tomasz Napierala void
4806097055e2SEdward Tomasz Napierala prison_racct_foreach(void (*callback)(struct racct *racct,
480715db3c07SEdward Tomasz Napierala     void *arg2, void *arg3), void (*pre)(void), void (*post)(void),
480815db3c07SEdward Tomasz Napierala     void *arg2, void *arg3)
4809097055e2SEdward Tomasz Napierala {
4810a7ad07bfSEdward Tomasz Napierala 	struct prison_racct *prr;
4811097055e2SEdward Tomasz Napierala 
48124b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
48134b5c9cf6SEdward Tomasz Napierala 
4814097055e2SEdward Tomasz Napierala 	sx_slock(&allprison_lock);
481515db3c07SEdward Tomasz Napierala 	if (pre != NULL)
481615db3c07SEdward Tomasz Napierala 		(pre)();
4817a7ad07bfSEdward Tomasz Napierala 	LIST_FOREACH(prr, &allprison_racct, prr_next)
4818a7ad07bfSEdward Tomasz Napierala 		(callback)(prr->prr_racct, arg2, arg3);
481915db3c07SEdward Tomasz Napierala 	if (post != NULL)
482015db3c07SEdward Tomasz Napierala 		(post)();
4821097055e2SEdward Tomasz Napierala 	sx_sunlock(&allprison_lock);
4822097055e2SEdward Tomasz Napierala }
48230304c731SJamie Gritton 
4824a7ad07bfSEdward Tomasz Napierala static struct prison_racct *
4825a7ad07bfSEdward Tomasz Napierala prison_racct_find_locked(const char *name)
4826a7ad07bfSEdward Tomasz Napierala {
4827a7ad07bfSEdward Tomasz Napierala 	struct prison_racct *prr;
4828a7ad07bfSEdward Tomasz Napierala 
48294b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
4830a7ad07bfSEdward Tomasz Napierala 	sx_assert(&allprison_lock, SA_XLOCKED);
4831a7ad07bfSEdward Tomasz Napierala 
4832a7ad07bfSEdward Tomasz Napierala 	if (name[0] == '\0' || strlen(name) >= MAXHOSTNAMELEN)
4833a7ad07bfSEdward Tomasz Napierala 		return (NULL);
4834a7ad07bfSEdward Tomasz Napierala 
4835a7ad07bfSEdward Tomasz Napierala 	LIST_FOREACH(prr, &allprison_racct, prr_next) {
4836a7ad07bfSEdward Tomasz Napierala 		if (strcmp(name, prr->prr_name) != 0)
4837a7ad07bfSEdward Tomasz Napierala 			continue;
4838a7ad07bfSEdward Tomasz Napierala 
4839a7ad07bfSEdward Tomasz Napierala 		/* Found prison_racct with a matching name? */
4840a7ad07bfSEdward Tomasz Napierala 		prison_racct_hold(prr);
4841a7ad07bfSEdward Tomasz Napierala 		return (prr);
4842a7ad07bfSEdward Tomasz Napierala 	}
4843a7ad07bfSEdward Tomasz Napierala 
4844a7ad07bfSEdward Tomasz Napierala 	/* Add new prison_racct. */
4845a7ad07bfSEdward Tomasz Napierala 	prr = malloc(sizeof(*prr), M_PRISON_RACCT, M_ZERO | M_WAITOK);
4846a7ad07bfSEdward Tomasz Napierala 	racct_create(&prr->prr_racct);
4847a7ad07bfSEdward Tomasz Napierala 
4848a7ad07bfSEdward Tomasz Napierala 	strcpy(prr->prr_name, name);
4849a7ad07bfSEdward Tomasz Napierala 	refcount_init(&prr->prr_refcount, 1);
4850a7ad07bfSEdward Tomasz Napierala 	LIST_INSERT_HEAD(&allprison_racct, prr, prr_next);
4851a7ad07bfSEdward Tomasz Napierala 
4852a7ad07bfSEdward Tomasz Napierala 	return (prr);
4853a7ad07bfSEdward Tomasz Napierala }
4854a7ad07bfSEdward Tomasz Napierala 
4855a7ad07bfSEdward Tomasz Napierala struct prison_racct *
4856a7ad07bfSEdward Tomasz Napierala prison_racct_find(const char *name)
4857a7ad07bfSEdward Tomasz Napierala {
4858a7ad07bfSEdward Tomasz Napierala 	struct prison_racct *prr;
4859a7ad07bfSEdward Tomasz Napierala 
48604b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
48614b5c9cf6SEdward Tomasz Napierala 
4862a7ad07bfSEdward Tomasz Napierala 	sx_xlock(&allprison_lock);
4863a7ad07bfSEdward Tomasz Napierala 	prr = prison_racct_find_locked(name);
4864a7ad07bfSEdward Tomasz Napierala 	sx_xunlock(&allprison_lock);
4865a7ad07bfSEdward Tomasz Napierala 	return (prr);
4866a7ad07bfSEdward Tomasz Napierala }
4867a7ad07bfSEdward Tomasz Napierala 
4868a7ad07bfSEdward Tomasz Napierala void
4869a7ad07bfSEdward Tomasz Napierala prison_racct_hold(struct prison_racct *prr)
4870a7ad07bfSEdward Tomasz Napierala {
4871a7ad07bfSEdward Tomasz Napierala 
48724b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
48734b5c9cf6SEdward Tomasz Napierala 
4874a7ad07bfSEdward Tomasz Napierala 	refcount_acquire(&prr->prr_refcount);
4875a7ad07bfSEdward Tomasz Napierala }
4876a7ad07bfSEdward Tomasz Napierala 
4877c34bbd2aSEdward Tomasz Napierala static void
4878c34bbd2aSEdward Tomasz Napierala prison_racct_free_locked(struct prison_racct *prr)
4879c34bbd2aSEdward Tomasz Napierala {
4880c34bbd2aSEdward Tomasz Napierala 
48814b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
4882c34bbd2aSEdward Tomasz Napierala 	sx_assert(&allprison_lock, SA_XLOCKED);
4883c34bbd2aSEdward Tomasz Napierala 
4884c34bbd2aSEdward Tomasz Napierala 	if (refcount_release(&prr->prr_refcount)) {
4885c34bbd2aSEdward Tomasz Napierala 		racct_destroy(&prr->prr_racct);
4886c34bbd2aSEdward Tomasz Napierala 		LIST_REMOVE(prr, prr_next);
4887c34bbd2aSEdward Tomasz Napierala 		free(prr, M_PRISON_RACCT);
4888c34bbd2aSEdward Tomasz Napierala 	}
4889c34bbd2aSEdward Tomasz Napierala }
4890c34bbd2aSEdward Tomasz Napierala 
4891a7ad07bfSEdward Tomasz Napierala void
4892a7ad07bfSEdward Tomasz Napierala prison_racct_free(struct prison_racct *prr)
4893a7ad07bfSEdward Tomasz Napierala {
4894a7ad07bfSEdward Tomasz Napierala 
48954b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
4896c34bbd2aSEdward Tomasz Napierala 	sx_assert(&allprison_lock, SA_UNLOCKED);
4897c34bbd2aSEdward Tomasz Napierala 
48986ff4688bSMateusz Guzik 	if (refcount_release_if_not_last(&prr->prr_refcount))
4899a7ad07bfSEdward Tomasz Napierala 		return;
4900a7ad07bfSEdward Tomasz Napierala 
4901a7ad07bfSEdward Tomasz Napierala 	sx_xlock(&allprison_lock);
4902c34bbd2aSEdward Tomasz Napierala 	prison_racct_free_locked(prr);
4903a7ad07bfSEdward Tomasz Napierala 	sx_xunlock(&allprison_lock);
4904a7ad07bfSEdward Tomasz Napierala }
4905a7ad07bfSEdward Tomasz Napierala 
4906a7ad07bfSEdward Tomasz Napierala static void
4907a7ad07bfSEdward Tomasz Napierala prison_racct_attach(struct prison *pr)
4908a7ad07bfSEdward Tomasz Napierala {
4909a7ad07bfSEdward Tomasz Napierala 	struct prison_racct *prr;
4910a7ad07bfSEdward Tomasz Napierala 
49114b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
4912c34bbd2aSEdward Tomasz Napierala 	sx_assert(&allprison_lock, SA_XLOCKED);
4913c34bbd2aSEdward Tomasz Napierala 
4914a7ad07bfSEdward Tomasz Napierala 	prr = prison_racct_find_locked(pr->pr_name);
4915a7ad07bfSEdward Tomasz Napierala 	KASSERT(prr != NULL, ("cannot find prison_racct"));
4916a7ad07bfSEdward Tomasz Napierala 
4917a7ad07bfSEdward Tomasz Napierala 	pr->pr_prison_racct = prr;
4918a7ad07bfSEdward Tomasz Napierala }
4919a7ad07bfSEdward Tomasz Napierala 
4920c34bbd2aSEdward Tomasz Napierala /*
4921c34bbd2aSEdward Tomasz Napierala  * Handle jail renaming.  From the racct point of view, renaming means
4922c34bbd2aSEdward Tomasz Napierala  * moving from one prison_racct to another.
4923c34bbd2aSEdward Tomasz Napierala  */
4924c34bbd2aSEdward Tomasz Napierala static void
4925c34bbd2aSEdward Tomasz Napierala prison_racct_modify(struct prison *pr)
4926c34bbd2aSEdward Tomasz Napierala {
4927dbadb015SKonstantin Belousov #ifdef RCTL
4928c34bbd2aSEdward Tomasz Napierala 	struct proc *p;
4929c34bbd2aSEdward Tomasz Napierala 	struct ucred *cred;
4930dbadb015SKonstantin Belousov #endif
4931c34bbd2aSEdward Tomasz Napierala 	struct prison_racct *oldprr;
4932c34bbd2aSEdward Tomasz Napierala 
49334b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
49344b5c9cf6SEdward Tomasz Napierala 
4935c34bbd2aSEdward Tomasz Napierala 	sx_slock(&allproc_lock);
4936c34bbd2aSEdward Tomasz Napierala 	sx_xlock(&allprison_lock);
4937c34bbd2aSEdward Tomasz Napierala 
4938e30345e7SEdward Tomasz Napierala 	if (strcmp(pr->pr_name, pr->pr_prison_racct->prr_name) == 0) {
4939e30345e7SEdward Tomasz Napierala 		sx_xunlock(&allprison_lock);
4940e30345e7SEdward Tomasz Napierala 		sx_sunlock(&allproc_lock);
4941c34bbd2aSEdward Tomasz Napierala 		return;
4942e30345e7SEdward Tomasz Napierala 	}
4943c34bbd2aSEdward Tomasz Napierala 
4944c34bbd2aSEdward Tomasz Napierala 	oldprr = pr->pr_prison_racct;
4945c34bbd2aSEdward Tomasz Napierala 	pr->pr_prison_racct = NULL;
4946c34bbd2aSEdward Tomasz Napierala 
4947c34bbd2aSEdward Tomasz Napierala 	prison_racct_attach(pr);
4948c34bbd2aSEdward Tomasz Napierala 
4949c34bbd2aSEdward Tomasz Napierala 	/*
4950c34bbd2aSEdward Tomasz Napierala 	 * Move resource utilisation records.
4951c34bbd2aSEdward Tomasz Napierala 	 */
4952c34bbd2aSEdward Tomasz Napierala 	racct_move(pr->pr_prison_racct->prr_racct, oldprr->prr_racct);
4953c34bbd2aSEdward Tomasz Napierala 
4954f87beb93SAndriy Gapon #ifdef RCTL
4955c34bbd2aSEdward Tomasz Napierala 	/*
4956c34bbd2aSEdward Tomasz Napierala 	 * Force rctl to reattach rules to processes.
4957c34bbd2aSEdward Tomasz Napierala 	 */
4958c34bbd2aSEdward Tomasz Napierala 	FOREACH_PROC_IN_SYSTEM(p) {
4959c34bbd2aSEdward Tomasz Napierala 		PROC_LOCK(p);
4960c34bbd2aSEdward Tomasz Napierala 		cred = crhold(p->p_ucred);
4961c34bbd2aSEdward Tomasz Napierala 		PROC_UNLOCK(p);
4962f87beb93SAndriy Gapon 		rctl_proc_ucred_changed(p, cred);
4963c34bbd2aSEdward Tomasz Napierala 		crfree(cred);
4964c34bbd2aSEdward Tomasz Napierala 	}
4965f87beb93SAndriy Gapon #endif
4966c34bbd2aSEdward Tomasz Napierala 
4967c34bbd2aSEdward Tomasz Napierala 	sx_sunlock(&allproc_lock);
4968c34bbd2aSEdward Tomasz Napierala 	prison_racct_free_locked(oldprr);
4969c34bbd2aSEdward Tomasz Napierala 	sx_xunlock(&allprison_lock);
4970c34bbd2aSEdward Tomasz Napierala }
4971c34bbd2aSEdward Tomasz Napierala 
4972a7ad07bfSEdward Tomasz Napierala static void
4973a7ad07bfSEdward Tomasz Napierala prison_racct_detach(struct prison *pr)
4974a7ad07bfSEdward Tomasz Napierala {
4975c34bbd2aSEdward Tomasz Napierala 
49764b5c9cf6SEdward Tomasz Napierala 	ASSERT_RACCT_ENABLED();
4977c34bbd2aSEdward Tomasz Napierala 	sx_assert(&allprison_lock, SA_UNLOCKED);
4978c34bbd2aSEdward Tomasz Napierala 
4979af3c786cSMateusz Guzik 	if (pr->pr_prison_racct == NULL)
4980af3c786cSMateusz Guzik 		return;
4981a7ad07bfSEdward Tomasz Napierala 	prison_racct_free(pr->pr_prison_racct);
4982a7ad07bfSEdward Tomasz Napierala 	pr->pr_prison_racct = NULL;
4983a7ad07bfSEdward Tomasz Napierala }
4984a7ad07bfSEdward Tomasz Napierala #endif /* RACCT */
4985a7ad07bfSEdward Tomasz Napierala 
4986413628a7SBjoern A. Zeeb #ifdef DDB
4987b38ff370SJamie Gritton 
4988b38ff370SJamie Gritton static void
4989b38ff370SJamie Gritton db_show_prison(struct prison *pr)
4990413628a7SBjoern A. Zeeb {
4991672756aaSJamie Gritton 	struct bool_flags *bf;
4992672756aaSJamie Gritton 	struct jailsys_flags *jsf;
4993b38ff370SJamie Gritton #if defined(INET) || defined(INET6)
4994b38ff370SJamie Gritton 	int ii;
4995500f82d6SZhenlei Huang 	struct prison_ip *pip;
4996413628a7SBjoern A. Zeeb #endif
4997672756aaSJamie Gritton 	unsigned f;
49988144690aSEric van Gyzen #ifdef INET
49998144690aSEric van Gyzen 	char ip4buf[INET_ADDRSTRLEN];
50008144690aSEric van Gyzen #endif
5001413628a7SBjoern A. Zeeb #ifdef INET6
5002413628a7SBjoern A. Zeeb 	char ip6buf[INET6_ADDRSTRLEN];
5003413628a7SBjoern A. Zeeb #endif
5004413628a7SBjoern A. Zeeb 
5005b38ff370SJamie Gritton 	db_printf("prison %p:\n", pr);
5006b38ff370SJamie Gritton 	db_printf(" jid             = %d\n", pr->pr_id);
5007b38ff370SJamie Gritton 	db_printf(" name            = %s\n", pr->pr_name);
50080304c731SJamie Gritton 	db_printf(" parent          = %p\n", pr->pr_parent);
5009b38ff370SJamie Gritton 	db_printf(" ref             = %d\n", pr->pr_ref);
5010b38ff370SJamie Gritton 	db_printf(" uref            = %d\n", pr->pr_uref);
50111158508aSJamie Gritton 	db_printf(" state           = %s\n",
50121158508aSJamie Gritton 	    pr->pr_state == PRISON_STATE_ALIVE ? "alive" :
50131158508aSJamie Gritton 	    pr->pr_state == PRISON_STATE_DYING ? "dying" :
50141158508aSJamie Gritton 	    "invalid");
5015b38ff370SJamie Gritton 	db_printf(" path            = %s\n", pr->pr_path);
5016b38ff370SJamie Gritton 	db_printf(" cpuset          = %d\n", pr->pr_cpuset
5017b38ff370SJamie Gritton 	    ? pr->pr_cpuset->cs_id : -1);
5018679e1390SJamie Gritton #ifdef VIMAGE
5019679e1390SJamie Gritton 	db_printf(" vnet            = %p\n", pr->pr_vnet);
5020679e1390SJamie Gritton #endif
5021b38ff370SJamie Gritton 	db_printf(" root            = %p\n", pr->pr_root);
5022b38ff370SJamie Gritton 	db_printf(" securelevel     = %d\n", pr->pr_securelevel);
50230cc207a6SMartin Matuska 	db_printf(" devfs_rsnum     = %d\n", pr->pr_devfs_rsnum);
5024fe0518e9SBjoern A. Zeeb 	db_printf(" children.max    = %d\n", pr->pr_childmax);
5025fe0518e9SBjoern A. Zeeb 	db_printf(" children.cur    = %d\n", pr->pr_childcount);
50260304c731SJamie Gritton 	db_printf(" child           = %p\n", LIST_FIRST(&pr->pr_children));
50270304c731SJamie Gritton 	db_printf(" sibling         = %p\n", LIST_NEXT(pr, pr_sibling));
5028fe0518e9SBjoern A. Zeeb 	db_printf(" flags           = 0x%x", pr->pr_flags);
5029672756aaSJamie Gritton 	for (bf = pr_flag_bool; bf < pr_flag_bool + nitems(pr_flag_bool); bf++)
5030672756aaSJamie Gritton 		if (pr->pr_flags & bf->flag)
5031672756aaSJamie Gritton 			db_printf(" %s", bf->name);
5032672756aaSJamie Gritton 	for (jsf = pr_flag_jailsys;
5033672756aaSJamie Gritton 	     jsf < pr_flag_jailsys + nitems(pr_flag_jailsys);
5034672756aaSJamie Gritton 	     jsf++) {
5035672756aaSJamie Gritton 		f = pr->pr_flags & (jsf->disable | jsf->new);
5036672756aaSJamie Gritton 		db_printf(" %-16s= %s\n", jsf->name,
5037672756aaSJamie Gritton 		    (f != 0 && f == jsf->disable) ? "disable"
5038672756aaSJamie Gritton 		    : (f == jsf->new) ? "new"
50397cbf7213SJamie Gritton 		    : "inherit");
50407cbf7213SJamie Gritton 	}
5041fe0518e9SBjoern A. Zeeb 	db_printf(" allow           = 0x%x", pr->pr_allow);
5042672756aaSJamie Gritton 	for (bf = pr_flag_allow;
50435d58f959SJamie Gritton 	     bf < pr_flag_allow + nitems(pr_flag_allow) &&
50445d58f959SJamie Gritton 		atomic_load_int(&bf->flag) != 0;
5045672756aaSJamie Gritton 	     bf++)
5046672756aaSJamie Gritton 		if (pr->pr_allow & bf->flag)
5047672756aaSJamie Gritton 			db_printf(" %s", bf->name);
5048b38ff370SJamie Gritton 	db_printf("\n");
50490304c731SJamie Gritton 	db_printf(" enforce_statfs  = %d\n", pr->pr_enforce_statfs);
5050c1f19219SJamie Gritton 	db_printf(" host.hostname   = %s\n", pr->pr_hostname);
5051c1f19219SJamie Gritton 	db_printf(" host.domainname = %s\n", pr->pr_domainname);
5052c1f19219SJamie Gritton 	db_printf(" host.hostuuid   = %s\n", pr->pr_hostuuid);
505376ca6f88SJamie Gritton 	db_printf(" host.hostid     = %lu\n", pr->pr_hostid);
5054413628a7SBjoern A. Zeeb #ifdef INET
5055500f82d6SZhenlei Huang 	if ((pip = pr->pr_addrs[PR_INET]) != NULL) {
5056500f82d6SZhenlei Huang 		db_printf(" ip4s            = %d\n", pip->ips);
5057500f82d6SZhenlei Huang 		for (ii = 0; ii < pip->ips; ii++)
5058b38ff370SJamie Gritton 			db_printf(" %s %s\n",
5059fe0518e9SBjoern A. Zeeb 			    ii == 0 ? "ip4.addr        =" : "                 ",
5060eb8dcdeaSGleb Smirnoff 			    inet_ntoa_r(
5061500f82d6SZhenlei Huang 			    *(const struct in_addr *)PR_IP(pip, PR_INET, ii),
5062eb8dcdeaSGleb Smirnoff 			    ip4buf));
5063eb8dcdeaSGleb Smirnoff 	}
5064413628a7SBjoern A. Zeeb #endif
5065413628a7SBjoern A. Zeeb #ifdef INET6
5066500f82d6SZhenlei Huang 	if ((pip = pr->pr_addrs[PR_INET6]) != NULL) {
5067500f82d6SZhenlei Huang 		db_printf(" ip6s            = %d\n", pip->ips);
5068500f82d6SZhenlei Huang 		for (ii = 0; ii < pip->ips; ii++)
5069b38ff370SJamie Gritton 			db_printf(" %s %s\n",
5070fe0518e9SBjoern A. Zeeb 			    ii == 0 ? "ip6.addr        =" : "                 ",
5071eb8dcdeaSGleb Smirnoff 			    ip6_sprintf(ip6buf,
5072500f82d6SZhenlei Huang 			    (const struct in6_addr *)PR_IP(pip, PR_INET6, ii)));
5073eb8dcdeaSGleb Smirnoff 	}
5074b38ff370SJamie Gritton #endif
5075b38ff370SJamie Gritton }
5076b38ff370SJamie Gritton 
5077b38ff370SJamie Gritton DB_SHOW_COMMAND(prison, db_show_prison_command)
5078b38ff370SJamie Gritton {
5079b38ff370SJamie Gritton 	struct prison *pr;
5080b38ff370SJamie Gritton 
5081b38ff370SJamie Gritton 	if (!have_addr) {
50820304c731SJamie Gritton 		/*
50830304c731SJamie Gritton 		 * Show all prisons in the list, and prison0 which is not
50840304c731SJamie Gritton 		 * listed.
50850304c731SJamie Gritton 		 */
50860304c731SJamie Gritton 		db_show_prison(&prison0);
50870304c731SJamie Gritton 		if (!db_pager_quit) {
5088b38ff370SJamie Gritton 			TAILQ_FOREACH(pr, &allprison, pr_list) {
5089b38ff370SJamie Gritton 				db_show_prison(pr);
5090413628a7SBjoern A. Zeeb 				if (db_pager_quit)
5091413628a7SBjoern A. Zeeb 					break;
5092413628a7SBjoern A. Zeeb 			}
50930304c731SJamie Gritton 		}
5094b38ff370SJamie Gritton 		return;
5095413628a7SBjoern A. Zeeb 	}
5096b38ff370SJamie Gritton 
50970304c731SJamie Gritton 	if (addr == 0)
50980304c731SJamie Gritton 		pr = &prison0;
50990304c731SJamie Gritton 	else {
5100b38ff370SJamie Gritton 		/* Look for a prison with the ID and with references. */
5101b38ff370SJamie Gritton 		TAILQ_FOREACH(pr, &allprison, pr_list)
5102b38ff370SJamie Gritton 			if (pr->pr_id == addr && pr->pr_ref > 0)
5103b38ff370SJamie Gritton 				break;
5104b38ff370SJamie Gritton 		if (pr == NULL)
5105b38ff370SJamie Gritton 			/* Look again, without requiring a reference. */
5106b38ff370SJamie Gritton 			TAILQ_FOREACH(pr, &allprison, pr_list)
5107b38ff370SJamie Gritton 				if (pr->pr_id == addr)
5108b38ff370SJamie Gritton 					break;
5109b38ff370SJamie Gritton 		if (pr == NULL)
5110b38ff370SJamie Gritton 			/* Assume address points to a valid prison. */
5111b38ff370SJamie Gritton 			pr = (struct prison *)addr;
51120304c731SJamie Gritton 	}
5113b38ff370SJamie Gritton 	db_show_prison(pr);
5114b38ff370SJamie Gritton }
5115b38ff370SJamie Gritton 
5116413628a7SBjoern A. Zeeb #endif /* DDB */
5117