xref: /freebsd/sys/kern/kern_jail.c (revision 4ce386ff25d77954b8cfa11534f632172e848244)
1 /*-
2  * Copyright (c) 1999 Poul-Henning Kamp.
3  * Copyright (c) 2008 Bjoern A. Zeeb.
4  * Copyright (c) 2009 James Gritton.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  */
28 
29 #include <sys/cdefs.h>
30 __FBSDID("$FreeBSD$");
31 
32 #include "opt_compat.h"
33 #include "opt_ddb.h"
34 #include "opt_inet.h"
35 #include "opt_inet6.h"
36 
37 #include <sys/param.h>
38 #include <sys/types.h>
39 #include <sys/kernel.h>
40 #include <sys/systm.h>
41 #include <sys/errno.h>
42 #include <sys/sysproto.h>
43 #include <sys/malloc.h>
44 #include <sys/osd.h>
45 #include <sys/priv.h>
46 #include <sys/proc.h>
47 #include <sys/taskqueue.h>
48 #include <sys/fcntl.h>
49 #include <sys/jail.h>
50 #include <sys/lock.h>
51 #include <sys/mutex.h>
52 #include <sys/racct.h>
53 #include <sys/refcount.h>
54 #include <sys/sx.h>
55 #include <sys/sysent.h>
56 #include <sys/namei.h>
57 #include <sys/mount.h>
58 #include <sys/queue.h>
59 #include <sys/socket.h>
60 #include <sys/syscallsubr.h>
61 #include <sys/sysctl.h>
62 #include <sys/vnode.h>
63 
64 #include <net/if.h>
65 #include <net/if_var.h>
66 #include <net/vnet.h>
67 
68 #include <netinet/in.h>
69 
70 #ifdef DDB
71 #include <ddb/ddb.h>
72 #ifdef INET6
73 #include <netinet6/in6_var.h>
74 #endif /* INET6 */
75 #endif /* DDB */
76 
77 #include <security/mac/mac_framework.h>
78 
79 #define	DEFAULT_HOSTUUID	"00000000-0000-0000-0000-000000000000"
80 
81 MALLOC_DEFINE(M_PRISON, "prison", "Prison structures");
82 static MALLOC_DEFINE(M_PRISON_RACCT, "prison_racct", "Prison racct structures");
83 
84 /* Keep struct prison prison0 and some code in kern_jail_set() readable. */
85 #ifdef INET
86 #ifdef INET6
87 #define	_PR_IP_SADDRSEL	PR_IP4_SADDRSEL|PR_IP6_SADDRSEL
88 #else
89 #define	_PR_IP_SADDRSEL	PR_IP4_SADDRSEL
90 #endif
91 #else /* !INET */
92 #ifdef INET6
93 #define	_PR_IP_SADDRSEL	PR_IP6_SADDRSEL
94 #else
95 #define	_PR_IP_SADDRSEL	0
96 #endif
97 #endif
98 
99 /* prison0 describes what is "real" about the system. */
100 struct prison prison0 = {
101 	.pr_id		= 0,
102 	.pr_name	= "0",
103 	.pr_ref		= 1,
104 	.pr_uref	= 1,
105 	.pr_path	= "/",
106 	.pr_securelevel	= -1,
107 	.pr_devfs_rsnum = 0,
108 	.pr_childmax	= JAIL_MAX,
109 	.pr_hostuuid	= DEFAULT_HOSTUUID,
110 	.pr_children	= LIST_HEAD_INITIALIZER(prison0.pr_children),
111 #ifdef VIMAGE
112 	.pr_flags	= PR_HOST|PR_VNET|_PR_IP_SADDRSEL,
113 #else
114 	.pr_flags	= PR_HOST|_PR_IP_SADDRSEL,
115 #endif
116 	.pr_allow	= PR_ALLOW_ALL,
117 };
118 MTX_SYSINIT(prison0, &prison0.pr_mtx, "jail mutex", MTX_DEF);
119 
120 /* allprison, allprison_racct and lastprid are protected by allprison_lock. */
121 struct	sx allprison_lock;
122 SX_SYSINIT(allprison_lock, &allprison_lock, "allprison");
123 struct	prisonlist allprison = TAILQ_HEAD_INITIALIZER(allprison);
124 LIST_HEAD(, prison_racct) allprison_racct;
125 int	lastprid = 0;
126 
127 static int do_jail_attach(struct thread *td, struct prison *pr);
128 static void prison_complete(void *context, int pending);
129 static void prison_deref(struct prison *pr, int flags);
130 static char *prison_path(struct prison *pr1, struct prison *pr2);
131 static void prison_remove_one(struct prison *pr);
132 #ifdef RACCT
133 static void prison_racct_attach(struct prison *pr);
134 static void prison_racct_modify(struct prison *pr);
135 static void prison_racct_detach(struct prison *pr);
136 #endif
137 #ifdef INET
138 static int _prison_check_ip4(const struct prison *, const struct in_addr *);
139 static int prison_restrict_ip4(struct prison *pr, struct in_addr *newip4);
140 #endif
141 #ifdef INET6
142 static int _prison_check_ip6(struct prison *pr, struct in6_addr *ia6);
143 static int prison_restrict_ip6(struct prison *pr, struct in6_addr *newip6);
144 #endif
145 
146 /* Flags for prison_deref */
147 #define	PD_DEREF	0x01
148 #define	PD_DEUREF	0x02
149 #define	PD_LOCKED	0x04
150 #define	PD_LIST_SLOCKED	0x08
151 #define	PD_LIST_XLOCKED	0x10
152 
153 /*
154  * Parameter names corresponding to PR_* flag values.  Size values are for kvm
155  * as we cannot figure out the size of a sparse array, or an array without a
156  * terminating entry.
157  */
158 static char *pr_flag_names[] = {
159 	[0] = "persist",
160 #ifdef INET
161 	[7] = "ip4.saddrsel",
162 #endif
163 #ifdef INET6
164 	[8] = "ip6.saddrsel",
165 #endif
166 };
167 const size_t pr_flag_names_size = sizeof(pr_flag_names);
168 
169 static char *pr_flag_nonames[] = {
170 	[0] = "nopersist",
171 #ifdef INET
172 	[7] = "ip4.nosaddrsel",
173 #endif
174 #ifdef INET6
175 	[8] = "ip6.nosaddrsel",
176 #endif
177 };
178 const size_t pr_flag_nonames_size = sizeof(pr_flag_nonames);
179 
180 struct jailsys_flags {
181 	const char	*name;
182 	unsigned	 disable;
183 	unsigned	 new;
184 } pr_flag_jailsys[] = {
185 	{ "host", 0, PR_HOST },
186 #ifdef VIMAGE
187 	{ "vnet", 0, PR_VNET },
188 #endif
189 #ifdef INET
190 	{ "ip4", PR_IP4_USER, PR_IP4_USER },
191 #endif
192 #ifdef INET6
193 	{ "ip6", PR_IP6_USER, PR_IP6_USER },
194 #endif
195 };
196 const size_t pr_flag_jailsys_size = sizeof(pr_flag_jailsys);
197 
198 static char *pr_allow_names[] = {
199 	"allow.set_hostname",
200 	"allow.sysvipc",
201 	"allow.raw_sockets",
202 	"allow.chflags",
203 	"allow.mount",
204 	"allow.quotas",
205 	"allow.socket_af",
206 	"allow.mount.devfs",
207 	"allow.mount.nullfs",
208 	"allow.mount.zfs",
209 	"allow.mount.procfs",
210 	"allow.mount.tmpfs",
211 	"allow.mount.fdescfs",
212 };
213 const size_t pr_allow_names_size = sizeof(pr_allow_names);
214 
215 static char *pr_allow_nonames[] = {
216 	"allow.noset_hostname",
217 	"allow.nosysvipc",
218 	"allow.noraw_sockets",
219 	"allow.nochflags",
220 	"allow.nomount",
221 	"allow.noquotas",
222 	"allow.nosocket_af",
223 	"allow.mount.nodevfs",
224 	"allow.mount.nonullfs",
225 	"allow.mount.nozfs",
226 	"allow.mount.noprocfs",
227 	"allow.mount.notmpfs",
228 	"allow.mount.nofdescfs",
229 };
230 const size_t pr_allow_nonames_size = sizeof(pr_allow_nonames);
231 
232 #define	JAIL_DEFAULT_ALLOW		PR_ALLOW_SET_HOSTNAME
233 #define	JAIL_DEFAULT_ENFORCE_STATFS	2
234 #define	JAIL_DEFAULT_DEVFS_RSNUM	0
235 static unsigned jail_default_allow = JAIL_DEFAULT_ALLOW;
236 static int jail_default_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS;
237 static int jail_default_devfs_rsnum = JAIL_DEFAULT_DEVFS_RSNUM;
238 #if defined(INET) || defined(INET6)
239 static unsigned jail_max_af_ips = 255;
240 #endif
241 
242 /*
243  * Initialize the parts of prison0 that can't be static-initialized with
244  * constants.  This is called from proc0_init() after creating thread0 cpuset.
245  */
246 void
247 prison0_init(void)
248 {
249 
250 	prison0.pr_cpuset = cpuset_ref(thread0.td_cpuset);
251 	prison0.pr_osreldate = osreldate;
252 	strlcpy(prison0.pr_osrelease, osrelease, sizeof(prison0.pr_osrelease));
253 }
254 
255 #ifdef INET
256 static int
257 qcmp_v4(const void *ip1, const void *ip2)
258 {
259 	in_addr_t iaa, iab;
260 
261 	/*
262 	 * We need to compare in HBO here to get the list sorted as expected
263 	 * by the result of the code.  Sorting NBO addresses gives you
264 	 * interesting results.  If you do not understand, do not try.
265 	 */
266 	iaa = ntohl(((const struct in_addr *)ip1)->s_addr);
267 	iab = ntohl(((const struct in_addr *)ip2)->s_addr);
268 
269 	/*
270 	 * Do not simply return the difference of the two numbers, the int is
271 	 * not wide enough.
272 	 */
273 	if (iaa > iab)
274 		return (1);
275 	else if (iaa < iab)
276 		return (-1);
277 	else
278 		return (0);
279 }
280 #endif
281 
282 #ifdef INET6
283 static int
284 qcmp_v6(const void *ip1, const void *ip2)
285 {
286 	const struct in6_addr *ia6a, *ia6b;
287 	int i, rc;
288 
289 	ia6a = (const struct in6_addr *)ip1;
290 	ia6b = (const struct in6_addr *)ip2;
291 
292 	rc = 0;
293 	for (i = 0; rc == 0 && i < sizeof(struct in6_addr); i++) {
294 		if (ia6a->s6_addr[i] > ia6b->s6_addr[i])
295 			rc = 1;
296 		else if (ia6a->s6_addr[i] < ia6b->s6_addr[i])
297 			rc = -1;
298 	}
299 	return (rc);
300 }
301 #endif
302 
303 /*
304  * struct jail_args {
305  *	struct jail *jail;
306  * };
307  */
308 int
309 sys_jail(struct thread *td, struct jail_args *uap)
310 {
311 	uint32_t version;
312 	int error;
313 	struct jail j;
314 
315 	error = copyin(uap->jail, &version, sizeof(uint32_t));
316 	if (error)
317 		return (error);
318 
319 	switch (version) {
320 	case 0:
321 	{
322 		struct jail_v0 j0;
323 
324 		/* FreeBSD single IPv4 jails. */
325 		bzero(&j, sizeof(struct jail));
326 		error = copyin(uap->jail, &j0, sizeof(struct jail_v0));
327 		if (error)
328 			return (error);
329 		j.version = j0.version;
330 		j.path = j0.path;
331 		j.hostname = j0.hostname;
332 		j.ip4s = htonl(j0.ip_number);	/* jail_v0 is host order */
333 		break;
334 	}
335 
336 	case 1:
337 		/*
338 		 * Version 1 was used by multi-IPv4 jail implementations
339 		 * that never made it into the official kernel.
340 		 */
341 		return (EINVAL);
342 
343 	case 2:	/* JAIL_API_VERSION */
344 		/* FreeBSD multi-IPv4/IPv6,noIP jails. */
345 		error = copyin(uap->jail, &j, sizeof(struct jail));
346 		if (error)
347 			return (error);
348 		break;
349 
350 	default:
351 		/* Sci-Fi jails are not supported, sorry. */
352 		return (EINVAL);
353 	}
354 	return (kern_jail(td, &j));
355 }
356 
357 int
358 kern_jail(struct thread *td, struct jail *j)
359 {
360 	struct iovec optiov[2 * (4
361 			    + sizeof(pr_allow_names) / sizeof(pr_allow_names[0])
362 #ifdef INET
363 			    + 1
364 #endif
365 #ifdef INET6
366 			    + 1
367 #endif
368 			    )];
369 	struct uio opt;
370 	char *u_path, *u_hostname, *u_name;
371 #ifdef INET
372 	uint32_t ip4s;
373 	struct in_addr *u_ip4;
374 #endif
375 #ifdef INET6
376 	struct in6_addr *u_ip6;
377 #endif
378 	size_t tmplen;
379 	int error, enforce_statfs, fi;
380 
381 	bzero(&optiov, sizeof(optiov));
382 	opt.uio_iov = optiov;
383 	opt.uio_iovcnt = 0;
384 	opt.uio_offset = -1;
385 	opt.uio_resid = -1;
386 	opt.uio_segflg = UIO_SYSSPACE;
387 	opt.uio_rw = UIO_READ;
388 	opt.uio_td = td;
389 
390 	/* Set permissions for top-level jails from sysctls. */
391 	if (!jailed(td->td_ucred)) {
392 		for (fi = 0; fi < sizeof(pr_allow_names) /
393 		     sizeof(pr_allow_names[0]); fi++) {
394 			optiov[opt.uio_iovcnt].iov_base =
395 			    (jail_default_allow & (1 << fi))
396 			    ? pr_allow_names[fi] : pr_allow_nonames[fi];
397 			optiov[opt.uio_iovcnt].iov_len =
398 			    strlen(optiov[opt.uio_iovcnt].iov_base) + 1;
399 			opt.uio_iovcnt += 2;
400 		}
401 		optiov[opt.uio_iovcnt].iov_base = "enforce_statfs";
402 		optiov[opt.uio_iovcnt].iov_len = sizeof("enforce_statfs");
403 		opt.uio_iovcnt++;
404 		enforce_statfs = jail_default_enforce_statfs;
405 		optiov[opt.uio_iovcnt].iov_base = &enforce_statfs;
406 		optiov[opt.uio_iovcnt].iov_len = sizeof(enforce_statfs);
407 		opt.uio_iovcnt++;
408 	}
409 
410 	tmplen = MAXPATHLEN + MAXHOSTNAMELEN + MAXHOSTNAMELEN;
411 #ifdef INET
412 	ip4s = (j->version == 0) ? 1 : j->ip4s;
413 	if (ip4s > jail_max_af_ips)
414 		return (EINVAL);
415 	tmplen += ip4s * sizeof(struct in_addr);
416 #else
417 	if (j->ip4s > 0)
418 		return (EINVAL);
419 #endif
420 #ifdef INET6
421 	if (j->ip6s > jail_max_af_ips)
422 		return (EINVAL);
423 	tmplen += j->ip6s * sizeof(struct in6_addr);
424 #else
425 	if (j->ip6s > 0)
426 		return (EINVAL);
427 #endif
428 	u_path = malloc(tmplen, M_TEMP, M_WAITOK);
429 	u_hostname = u_path + MAXPATHLEN;
430 	u_name = u_hostname + MAXHOSTNAMELEN;
431 #ifdef INET
432 	u_ip4 = (struct in_addr *)(u_name + MAXHOSTNAMELEN);
433 #endif
434 #ifdef INET6
435 #ifdef INET
436 	u_ip6 = (struct in6_addr *)(u_ip4 + ip4s);
437 #else
438 	u_ip6 = (struct in6_addr *)(u_name + MAXHOSTNAMELEN);
439 #endif
440 #endif
441 	optiov[opt.uio_iovcnt].iov_base = "path";
442 	optiov[opt.uio_iovcnt].iov_len = sizeof("path");
443 	opt.uio_iovcnt++;
444 	optiov[opt.uio_iovcnt].iov_base = u_path;
445 	error = copyinstr(j->path, u_path, MAXPATHLEN,
446 	    &optiov[opt.uio_iovcnt].iov_len);
447 	if (error) {
448 		free(u_path, M_TEMP);
449 		return (error);
450 	}
451 	opt.uio_iovcnt++;
452 	optiov[opt.uio_iovcnt].iov_base = "host.hostname";
453 	optiov[opt.uio_iovcnt].iov_len = sizeof("host.hostname");
454 	opt.uio_iovcnt++;
455 	optiov[opt.uio_iovcnt].iov_base = u_hostname;
456 	error = copyinstr(j->hostname, u_hostname, MAXHOSTNAMELEN,
457 	    &optiov[opt.uio_iovcnt].iov_len);
458 	if (error) {
459 		free(u_path, M_TEMP);
460 		return (error);
461 	}
462 	opt.uio_iovcnt++;
463 	if (j->jailname != NULL) {
464 		optiov[opt.uio_iovcnt].iov_base = "name";
465 		optiov[opt.uio_iovcnt].iov_len = sizeof("name");
466 		opt.uio_iovcnt++;
467 		optiov[opt.uio_iovcnt].iov_base = u_name;
468 		error = copyinstr(j->jailname, u_name, MAXHOSTNAMELEN,
469 		    &optiov[opt.uio_iovcnt].iov_len);
470 		if (error) {
471 			free(u_path, M_TEMP);
472 			return (error);
473 		}
474 		opt.uio_iovcnt++;
475 	}
476 #ifdef INET
477 	optiov[opt.uio_iovcnt].iov_base = "ip4.addr";
478 	optiov[opt.uio_iovcnt].iov_len = sizeof("ip4.addr");
479 	opt.uio_iovcnt++;
480 	optiov[opt.uio_iovcnt].iov_base = u_ip4;
481 	optiov[opt.uio_iovcnt].iov_len = ip4s * sizeof(struct in_addr);
482 	if (j->version == 0)
483 		u_ip4->s_addr = j->ip4s;
484 	else {
485 		error = copyin(j->ip4, u_ip4, optiov[opt.uio_iovcnt].iov_len);
486 		if (error) {
487 			free(u_path, M_TEMP);
488 			return (error);
489 		}
490 	}
491 	opt.uio_iovcnt++;
492 #endif
493 #ifdef INET6
494 	optiov[opt.uio_iovcnt].iov_base = "ip6.addr";
495 	optiov[opt.uio_iovcnt].iov_len = sizeof("ip6.addr");
496 	opt.uio_iovcnt++;
497 	optiov[opt.uio_iovcnt].iov_base = u_ip6;
498 	optiov[opt.uio_iovcnt].iov_len = j->ip6s * sizeof(struct in6_addr);
499 	error = copyin(j->ip6, u_ip6, optiov[opt.uio_iovcnt].iov_len);
500 	if (error) {
501 		free(u_path, M_TEMP);
502 		return (error);
503 	}
504 	opt.uio_iovcnt++;
505 #endif
506 	KASSERT(opt.uio_iovcnt <= sizeof(optiov) / sizeof(optiov[0]),
507 	    ("kern_jail: too many iovecs (%d)", opt.uio_iovcnt));
508 	error = kern_jail_set(td, &opt, JAIL_CREATE | JAIL_ATTACH);
509 	free(u_path, M_TEMP);
510 	return (error);
511 }
512 
513 
514 /*
515  * struct jail_set_args {
516  *	struct iovec *iovp;
517  *	unsigned int iovcnt;
518  *	int flags;
519  * };
520  */
521 int
522 sys_jail_set(struct thread *td, struct jail_set_args *uap)
523 {
524 	struct uio *auio;
525 	int error;
526 
527 	/* Check that we have an even number of iovecs. */
528 	if (uap->iovcnt & 1)
529 		return (EINVAL);
530 
531 	error = copyinuio(uap->iovp, uap->iovcnt, &auio);
532 	if (error)
533 		return (error);
534 	error = kern_jail_set(td, auio, uap->flags);
535 	free(auio, M_IOV);
536 	return (error);
537 }
538 
539 int
540 kern_jail_set(struct thread *td, struct uio *optuio, int flags)
541 {
542 	struct nameidata nd;
543 #ifdef INET
544 	struct in_addr *ip4;
545 #endif
546 #ifdef INET6
547 	struct in6_addr *ip6;
548 #endif
549 	struct vfsopt *opt;
550 	struct vfsoptlist *opts;
551 	struct prison *pr, *deadpr, *mypr, *ppr, *tpr;
552 	struct vnode *root;
553 	char *domain, *errmsg, *host, *name, *namelc, *p, *path, *uuid;
554 	char *g_path, *osrelstr;
555 #if defined(INET) || defined(INET6)
556 	struct prison *tppr;
557 	void *op;
558 #endif
559 	unsigned long hid;
560 	size_t namelen, onamelen;
561 	int created, cuflags, descend, enforce, error, errmsg_len, errmsg_pos;
562 	int gotchildmax, gotenforce, gothid, gotrsnum, gotslevel;
563 	int fi, jid, jsys, len, level;
564 	int childmax, osreldt, rsnum, slevel;
565 	int fullpath_disabled;
566 #if defined(INET) || defined(INET6)
567 	int ii, ij;
568 #endif
569 #ifdef INET
570 	int ip4s, redo_ip4;
571 #endif
572 #ifdef INET6
573 	int ip6s, redo_ip6;
574 #endif
575 	uint64_t pr_allow, ch_allow, pr_flags, ch_flags;
576 	unsigned tallow;
577 	char numbuf[12];
578 
579 	error = priv_check(td, PRIV_JAIL_SET);
580 	if (!error && (flags & JAIL_ATTACH))
581 		error = priv_check(td, PRIV_JAIL_ATTACH);
582 	if (error)
583 		return (error);
584 	mypr = ppr = td->td_ucred->cr_prison;
585 	if ((flags & JAIL_CREATE) && mypr->pr_childmax == 0)
586 		return (EPERM);
587 	if (flags & ~JAIL_SET_MASK)
588 		return (EINVAL);
589 
590 	/*
591 	 * Check all the parameters before committing to anything.  Not all
592 	 * errors can be caught early, but we may as well try.  Also, this
593 	 * takes care of some expensive stuff (path lookup) before getting
594 	 * the allprison lock.
595 	 *
596 	 * XXX Jails are not filesystems, and jail parameters are not mount
597 	 *     options.  But it makes more sense to re-use the vfsopt code
598 	 *     than duplicate it under a different name.
599 	 */
600 	error = vfs_buildopts(optuio, &opts);
601 	if (error)
602 		return (error);
603 #ifdef INET
604 	ip4 = NULL;
605 #endif
606 #ifdef INET6
607 	ip6 = NULL;
608 #endif
609 	g_path = NULL;
610 
611 	error = vfs_copyopt(opts, "jid", &jid, sizeof(jid));
612 	if (error == ENOENT)
613 		jid = 0;
614 	else if (error != 0)
615 		goto done_free;
616 
617 	error = vfs_copyopt(opts, "securelevel", &slevel, sizeof(slevel));
618 	if (error == ENOENT)
619 		gotslevel = 0;
620 	else if (error != 0)
621 		goto done_free;
622 	else
623 		gotslevel = 1;
624 
625 	error =
626 	    vfs_copyopt(opts, "children.max", &childmax, sizeof(childmax));
627 	if (error == ENOENT)
628 		gotchildmax = 0;
629 	else if (error != 0)
630 		goto done_free;
631 	else
632 		gotchildmax = 1;
633 
634 	error = vfs_copyopt(opts, "enforce_statfs", &enforce, sizeof(enforce));
635 	if (error == ENOENT)
636 		gotenforce = 0;
637 	else if (error != 0)
638 		goto done_free;
639 	else if (enforce < 0 || enforce > 2) {
640 		error = EINVAL;
641 		goto done_free;
642 	} else
643 		gotenforce = 1;
644 
645 	error = vfs_copyopt(opts, "devfs_ruleset", &rsnum, sizeof(rsnum));
646 	if (error == ENOENT)
647 		gotrsnum = 0;
648 	else if (error != 0)
649 		goto done_free;
650 	else
651 		gotrsnum = 1;
652 
653 	pr_flags = ch_flags = 0;
654 	for (fi = 0; fi < sizeof(pr_flag_names) / sizeof(pr_flag_names[0]);
655 	    fi++) {
656 		if (pr_flag_names[fi] == NULL)
657 			continue;
658 		vfs_flagopt(opts, pr_flag_names[fi], &pr_flags, 1 << fi);
659 		vfs_flagopt(opts, pr_flag_nonames[fi], &ch_flags, 1 << fi);
660 	}
661 	ch_flags |= pr_flags;
662 	for (fi = 0; fi < sizeof(pr_flag_jailsys) / sizeof(pr_flag_jailsys[0]);
663 	    fi++) {
664 		error = vfs_copyopt(opts, pr_flag_jailsys[fi].name, &jsys,
665 		    sizeof(jsys));
666 		if (error == ENOENT)
667 			continue;
668 		if (error != 0)
669 			goto done_free;
670 		switch (jsys) {
671 		case JAIL_SYS_DISABLE:
672 			if (!pr_flag_jailsys[fi].disable) {
673 				error = EINVAL;
674 				goto done_free;
675 			}
676 			pr_flags |= pr_flag_jailsys[fi].disable;
677 			break;
678 		case JAIL_SYS_NEW:
679 			pr_flags |= pr_flag_jailsys[fi].new;
680 			break;
681 		case JAIL_SYS_INHERIT:
682 			break;
683 		default:
684 			error = EINVAL;
685 			goto done_free;
686 		}
687 		ch_flags |=
688 		    pr_flag_jailsys[fi].new | pr_flag_jailsys[fi].disable;
689 	}
690 	if ((flags & (JAIL_CREATE | JAIL_UPDATE | JAIL_ATTACH)) == JAIL_CREATE
691 	    && !(pr_flags & PR_PERSIST)) {
692 		error = EINVAL;
693 		vfs_opterror(opts, "new jail must persist or attach");
694 		goto done_errmsg;
695 	}
696 #ifdef VIMAGE
697 	if ((flags & JAIL_UPDATE) && (ch_flags & PR_VNET)) {
698 		error = EINVAL;
699 		vfs_opterror(opts, "vnet cannot be changed after creation");
700 		goto done_errmsg;
701 	}
702 #endif
703 #ifdef INET
704 	if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP4_USER)) {
705 		error = EINVAL;
706 		vfs_opterror(opts, "ip4 cannot be changed after creation");
707 		goto done_errmsg;
708 	}
709 #endif
710 #ifdef INET6
711 	if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP6_USER)) {
712 		error = EINVAL;
713 		vfs_opterror(opts, "ip6 cannot be changed after creation");
714 		goto done_errmsg;
715 	}
716 #endif
717 
718 	pr_allow = ch_allow = 0;
719 	for (fi = 0; fi < sizeof(pr_allow_names) / sizeof(pr_allow_names[0]);
720 	    fi++) {
721 		vfs_flagopt(opts, pr_allow_names[fi], &pr_allow, 1 << fi);
722 		vfs_flagopt(opts, pr_allow_nonames[fi], &ch_allow, 1 << fi);
723 	}
724 	ch_allow |= pr_allow;
725 
726 	error = vfs_getopt(opts, "name", (void **)&name, &len);
727 	if (error == ENOENT)
728 		name = NULL;
729 	else if (error != 0)
730 		goto done_free;
731 	else {
732 		if (len == 0 || name[len - 1] != '\0') {
733 			error = EINVAL;
734 			goto done_free;
735 		}
736 		if (len > MAXHOSTNAMELEN) {
737 			error = ENAMETOOLONG;
738 			goto done_free;
739 		}
740 	}
741 
742 	error = vfs_getopt(opts, "host.hostname", (void **)&host, &len);
743 	if (error == ENOENT)
744 		host = NULL;
745 	else if (error != 0)
746 		goto done_free;
747 	else {
748 		ch_flags |= PR_HOST;
749 		pr_flags |= PR_HOST;
750 		if (len == 0 || host[len - 1] != '\0') {
751 			error = EINVAL;
752 			goto done_free;
753 		}
754 		if (len > MAXHOSTNAMELEN) {
755 			error = ENAMETOOLONG;
756 			goto done_free;
757 		}
758 	}
759 
760 	error = vfs_getopt(opts, "host.domainname", (void **)&domain, &len);
761 	if (error == ENOENT)
762 		domain = NULL;
763 	else if (error != 0)
764 		goto done_free;
765 	else {
766 		ch_flags |= PR_HOST;
767 		pr_flags |= PR_HOST;
768 		if (len == 0 || domain[len - 1] != '\0') {
769 			error = EINVAL;
770 			goto done_free;
771 		}
772 		if (len > MAXHOSTNAMELEN) {
773 			error = ENAMETOOLONG;
774 			goto done_free;
775 		}
776 	}
777 
778 	error = vfs_getopt(opts, "host.hostuuid", (void **)&uuid, &len);
779 	if (error == ENOENT)
780 		uuid = NULL;
781 	else if (error != 0)
782 		goto done_free;
783 	else {
784 		ch_flags |= PR_HOST;
785 		pr_flags |= PR_HOST;
786 		if (len == 0 || uuid[len - 1] != '\0') {
787 			error = EINVAL;
788 			goto done_free;
789 		}
790 		if (len > HOSTUUIDLEN) {
791 			error = ENAMETOOLONG;
792 			goto done_free;
793 		}
794 	}
795 
796 #ifdef COMPAT_FREEBSD32
797 	if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) {
798 		uint32_t hid32;
799 
800 		error = vfs_copyopt(opts, "host.hostid", &hid32, sizeof(hid32));
801 		hid = hid32;
802 	} else
803 #endif
804 		error = vfs_copyopt(opts, "host.hostid", &hid, sizeof(hid));
805 	if (error == ENOENT)
806 		gothid = 0;
807 	else if (error != 0)
808 		goto done_free;
809 	else {
810 		gothid = 1;
811 		ch_flags |= PR_HOST;
812 		pr_flags |= PR_HOST;
813 	}
814 
815 #ifdef INET
816 	error = vfs_getopt(opts, "ip4.addr", &op, &ip4s);
817 	if (error == ENOENT)
818 		ip4s = 0;
819 	else if (error != 0)
820 		goto done_free;
821 	else if (ip4s & (sizeof(*ip4) - 1)) {
822 		error = EINVAL;
823 		goto done_free;
824 	} else {
825 		ch_flags |= PR_IP4_USER;
826 		pr_flags |= PR_IP4_USER;
827 		if (ip4s > 0) {
828 			ip4s /= sizeof(*ip4);
829 			if (ip4s > jail_max_af_ips) {
830 				error = EINVAL;
831 				vfs_opterror(opts, "too many IPv4 addresses");
832 				goto done_errmsg;
833 			}
834 			ip4 = malloc(ip4s * sizeof(*ip4), M_PRISON, M_WAITOK);
835 			bcopy(op, ip4, ip4s * sizeof(*ip4));
836 			/*
837 			 * IP addresses are all sorted but ip[0] to preserve
838 			 * the primary IP address as given from userland.
839 			 * This special IP is used for unbound outgoing
840 			 * connections as well for "loopback" traffic in case
841 			 * source address selection cannot find any more fitting
842 			 * address to connect from.
843 			 */
844 			if (ip4s > 1)
845 				qsort(ip4 + 1, ip4s - 1, sizeof(*ip4), qcmp_v4);
846 			/*
847 			 * Check for duplicate addresses and do some simple
848 			 * zero and broadcast checks. If users give other bogus
849 			 * addresses it is their problem.
850 			 *
851 			 * We do not have to care about byte order for these
852 			 * checks so we will do them in NBO.
853 			 */
854 			for (ii = 0; ii < ip4s; ii++) {
855 				if (ip4[ii].s_addr == INADDR_ANY ||
856 				    ip4[ii].s_addr == INADDR_BROADCAST) {
857 					error = EINVAL;
858 					goto done_free;
859 				}
860 				if ((ii+1) < ip4s &&
861 				    (ip4[0].s_addr == ip4[ii+1].s_addr ||
862 				     ip4[ii].s_addr == ip4[ii+1].s_addr)) {
863 					error = EINVAL;
864 					goto done_free;
865 				}
866 			}
867 		}
868 	}
869 #endif
870 
871 #ifdef INET6
872 	error = vfs_getopt(opts, "ip6.addr", &op, &ip6s);
873 	if (error == ENOENT)
874 		ip6s = 0;
875 	else if (error != 0)
876 		goto done_free;
877 	else if (ip6s & (sizeof(*ip6) - 1)) {
878 		error = EINVAL;
879 		goto done_free;
880 	} else {
881 		ch_flags |= PR_IP6_USER;
882 		pr_flags |= PR_IP6_USER;
883 		if (ip6s > 0) {
884 			ip6s /= sizeof(*ip6);
885 			if (ip6s > jail_max_af_ips) {
886 				error = EINVAL;
887 				vfs_opterror(opts, "too many IPv6 addresses");
888 				goto done_errmsg;
889 			}
890 			ip6 = malloc(ip6s * sizeof(*ip6), M_PRISON, M_WAITOK);
891 			bcopy(op, ip6, ip6s * sizeof(*ip6));
892 			if (ip6s > 1)
893 				qsort(ip6 + 1, ip6s - 1, sizeof(*ip6), qcmp_v6);
894 			for (ii = 0; ii < ip6s; ii++) {
895 				if (IN6_IS_ADDR_UNSPECIFIED(&ip6[ii])) {
896 					error = EINVAL;
897 					goto done_free;
898 				}
899 				if ((ii+1) < ip6s &&
900 				    (IN6_ARE_ADDR_EQUAL(&ip6[0], &ip6[ii+1]) ||
901 				     IN6_ARE_ADDR_EQUAL(&ip6[ii], &ip6[ii+1])))
902 				{
903 					error = EINVAL;
904 					goto done_free;
905 				}
906 			}
907 		}
908 	}
909 #endif
910 
911 #if defined(VIMAGE) && (defined(INET) || defined(INET6))
912 	if ((ch_flags & PR_VNET) && (ch_flags & (PR_IP4_USER | PR_IP6_USER))) {
913 		error = EINVAL;
914 		vfs_opterror(opts,
915 		    "vnet jails cannot have IP address restrictions");
916 		goto done_errmsg;
917 	}
918 #endif
919 
920 	fullpath_disabled = 0;
921 	root = NULL;
922 	error = vfs_getopt(opts, "path", (void **)&path, &len);
923 	if (error == ENOENT)
924 		path = NULL;
925 	else if (error != 0)
926 		goto done_free;
927 	else {
928 		if (flags & JAIL_UPDATE) {
929 			error = EINVAL;
930 			vfs_opterror(opts,
931 			    "path cannot be changed after creation");
932 			goto done_errmsg;
933 		}
934 		if (len == 0 || path[len - 1] != '\0') {
935 			error = EINVAL;
936 			goto done_free;
937 		}
938 		NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE,
939 		    path, td);
940 		error = namei(&nd);
941 		if (error)
942 			goto done_free;
943 		root = nd.ni_vp;
944 		NDFREE(&nd, NDF_ONLY_PNBUF);
945 		g_path = malloc(MAXPATHLEN, M_TEMP, M_WAITOK);
946 		strlcpy(g_path, path, MAXPATHLEN);
947 		error = vn_path_to_global_path(td, root, g_path, MAXPATHLEN);
948 		if (error == 0)
949 			path = g_path;
950 		else if (error == ENODEV) {
951 			/* proceed if sysctl debug.disablefullpath == 1 */
952 			fullpath_disabled = 1;
953 			if (len < 2 || (len == 2 && path[0] == '/'))
954 				path = NULL;
955 		} else {
956 			/* exit on other errors */
957 			goto done_free;
958 		}
959 		if (root->v_type != VDIR) {
960 			error = ENOTDIR;
961 			vput(root);
962 			goto done_free;
963 		}
964 		VOP_UNLOCK(root, 0);
965 		if (fullpath_disabled) {
966 			/* Leave room for a real-root full pathname. */
967 			if (len + (path[0] == '/' && strcmp(mypr->pr_path, "/")
968 			    ? strlen(mypr->pr_path) : 0) > MAXPATHLEN) {
969 				error = ENAMETOOLONG;
970 				goto done_free;
971 			}
972 		}
973 	}
974 
975 	error = vfs_getopt(opts, "osrelease", (void **)&osrelstr, &len);
976 	if (error == ENOENT)
977 		osrelstr = NULL;
978 	else if (error != 0)
979 		goto done_free;
980 	else {
981 		if (flags & JAIL_UPDATE) {
982 			error = EINVAL;
983 			vfs_opterror(opts,
984 			    "osrelease cannot be changed after creation");
985 			goto done_errmsg;
986 		}
987 		if (len == 0 || len >= OSRELEASELEN) {
988 			error = EINVAL;
989 			vfs_opterror(opts,
990 			    "osrelease string must be 1-%d bytes long",
991 			    OSRELEASELEN - 1);
992 			goto done_errmsg;
993 		}
994 	}
995 
996 	error = vfs_copyopt(opts, "osreldate", &osreldt, sizeof(osreldt));
997 	if (error == ENOENT)
998 		osreldt = 0;
999 	else if (error != 0)
1000 		goto done_free;
1001 	else {
1002 		if (flags & JAIL_UPDATE) {
1003 			error = EINVAL;
1004 			vfs_opterror(opts,
1005 			    "osreldate cannot be changed after creation");
1006 			goto done_errmsg;
1007 		}
1008 		if (osreldt == 0) {
1009 			error = EINVAL;
1010 			vfs_opterror(opts, "osreldate cannot be 0");
1011 			goto done_errmsg;
1012 		}
1013 	}
1014 
1015 	/*
1016 	 * Grab the allprison lock before letting modules check their
1017 	 * parameters.  Once we have it, do not let go so we'll have a
1018 	 * consistent view of the OSD list.
1019 	 */
1020 	sx_xlock(&allprison_lock);
1021 	error = osd_jail_call(NULL, PR_METHOD_CHECK, opts);
1022 	if (error)
1023 		goto done_unlock_list;
1024 
1025 	/* By now, all parameters should have been noted. */
1026 	TAILQ_FOREACH(opt, opts, link) {
1027 		if (!opt->seen && strcmp(opt->name, "errmsg")) {
1028 			error = EINVAL;
1029 			vfs_opterror(opts, "unknown parameter: %s", opt->name);
1030 			goto done_unlock_list;
1031 		}
1032 	}
1033 
1034 	/*
1035 	 * See if we are creating a new record or updating an existing one.
1036 	 * This abuses the file error codes ENOENT and EEXIST.
1037 	 */
1038 	cuflags = flags & (JAIL_CREATE | JAIL_UPDATE);
1039 	if (!cuflags) {
1040 		error = EINVAL;
1041 		vfs_opterror(opts, "no valid operation (create or update)");
1042 		goto done_unlock_list;
1043 	}
1044 	pr = NULL;
1045 	namelc = NULL;
1046 	if (cuflags == JAIL_CREATE && jid == 0 && name != NULL) {
1047 		namelc = strrchr(name, '.');
1048 		jid = strtoul(namelc != NULL ? namelc + 1 : name, &p, 10);
1049 		if (*p != '\0')
1050 			jid = 0;
1051 	}
1052 	if (jid != 0) {
1053 		/*
1054 		 * See if a requested jid already exists.  There is an
1055 		 * information leak here if the jid exists but is not within
1056 		 * the caller's jail hierarchy.  Jail creators will get EEXIST
1057 		 * even though they cannot see the jail, and CREATE | UPDATE
1058 		 * will return ENOENT which is not normally a valid error.
1059 		 */
1060 		if (jid < 0) {
1061 			error = EINVAL;
1062 			vfs_opterror(opts, "negative jid");
1063 			goto done_unlock_list;
1064 		}
1065 		pr = prison_find(jid);
1066 		if (pr != NULL) {
1067 			ppr = pr->pr_parent;
1068 			/* Create: jid must not exist. */
1069 			if (cuflags == JAIL_CREATE) {
1070 				mtx_unlock(&pr->pr_mtx);
1071 				error = EEXIST;
1072 				vfs_opterror(opts, "jail %d already exists",
1073 				    jid);
1074 				goto done_unlock_list;
1075 			}
1076 			if (!prison_ischild(mypr, pr)) {
1077 				mtx_unlock(&pr->pr_mtx);
1078 				pr = NULL;
1079 			} else if (pr->pr_uref == 0) {
1080 				if (!(flags & JAIL_DYING)) {
1081 					mtx_unlock(&pr->pr_mtx);
1082 					error = ENOENT;
1083 					vfs_opterror(opts, "jail %d is dying",
1084 					    jid);
1085 					goto done_unlock_list;
1086 				} else if ((flags & JAIL_ATTACH) ||
1087 				    (pr_flags & PR_PERSIST)) {
1088 					/*
1089 					 * A dying jail might be resurrected
1090 					 * (via attach or persist), but first
1091 					 * it must determine if another jail
1092 					 * has claimed its name.  Accomplish
1093 					 * this by implicitly re-setting the
1094 					 * name.
1095 					 */
1096 					if (name == NULL)
1097 						name = prison_name(mypr, pr);
1098 				}
1099 			}
1100 		}
1101 		if (pr == NULL) {
1102 			/* Update: jid must exist. */
1103 			if (cuflags == JAIL_UPDATE) {
1104 				error = ENOENT;
1105 				vfs_opterror(opts, "jail %d not found", jid);
1106 				goto done_unlock_list;
1107 			}
1108 		}
1109 	}
1110 	/*
1111 	 * If the caller provided a name, look for a jail by that name.
1112 	 * This has different semantics for creates and updates keyed by jid
1113 	 * (where the name must not already exist in a different jail),
1114 	 * and updates keyed by the name itself (where the name must exist
1115 	 * because that is the jail being updated).
1116 	 */
1117 	if (name != NULL) {
1118 		namelc = strrchr(name, '.');
1119 		if (namelc == NULL)
1120 			namelc = name;
1121 		else {
1122 			/*
1123 			 * This is a hierarchical name.  Split it into the
1124 			 * parent and child names, and make sure the parent
1125 			 * exists or matches an already found jail.
1126 			 */
1127 			*namelc = '\0';
1128 			if (pr != NULL) {
1129 				if (strncmp(name, ppr->pr_name, namelc - name)
1130 				    || ppr->pr_name[namelc - name] != '\0') {
1131 					mtx_unlock(&pr->pr_mtx);
1132 					error = EINVAL;
1133 					vfs_opterror(opts,
1134 					    "cannot change jail's parent");
1135 					goto done_unlock_list;
1136 				}
1137 			} else {
1138 				ppr = prison_find_name(mypr, name);
1139 				if (ppr == NULL) {
1140 					error = ENOENT;
1141 					vfs_opterror(opts,
1142 					    "jail \"%s\" not found", name);
1143 					goto done_unlock_list;
1144 				}
1145 				mtx_unlock(&ppr->pr_mtx);
1146 			}
1147 			name = ++namelc;
1148 		}
1149 		if (name[0] != '\0') {
1150 			namelen =
1151 			    (ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1;
1152  name_again:
1153 			deadpr = NULL;
1154 			FOREACH_PRISON_CHILD(ppr, tpr) {
1155 				if (tpr != pr && tpr->pr_ref > 0 &&
1156 				    !strcmp(tpr->pr_name + namelen, name)) {
1157 					if (pr == NULL &&
1158 					    cuflags != JAIL_CREATE) {
1159 						mtx_lock(&tpr->pr_mtx);
1160 						if (tpr->pr_ref > 0) {
1161 							/*
1162 							 * Use this jail
1163 							 * for updates.
1164 							 */
1165 							if (tpr->pr_uref > 0) {
1166 								pr = tpr;
1167 								break;
1168 							}
1169 							deadpr = tpr;
1170 						}
1171 						mtx_unlock(&tpr->pr_mtx);
1172 					} else if (tpr->pr_uref > 0) {
1173 						/*
1174 						 * Create, or update(jid):
1175 						 * name must not exist in an
1176 						 * active sibling jail.
1177 						 */
1178 						error = EEXIST;
1179 						if (pr != NULL)
1180 							mtx_unlock(&pr->pr_mtx);
1181 						vfs_opterror(opts,
1182 						   "jail \"%s\" already exists",
1183 						   name);
1184 						goto done_unlock_list;
1185 					}
1186 				}
1187 			}
1188 			/* If no active jail is found, use a dying one. */
1189 			if (deadpr != NULL && pr == NULL) {
1190 				if (flags & JAIL_DYING) {
1191 					mtx_lock(&deadpr->pr_mtx);
1192 					if (deadpr->pr_ref == 0) {
1193 						mtx_unlock(&deadpr->pr_mtx);
1194 						goto name_again;
1195 					}
1196 					pr = deadpr;
1197 				} else if (cuflags == JAIL_UPDATE) {
1198 					error = ENOENT;
1199 					vfs_opterror(opts,
1200 					    "jail \"%s\" is dying", name);
1201 					goto done_unlock_list;
1202 				}
1203 			}
1204 			/* Update: name must exist if no jid. */
1205 			else if (cuflags == JAIL_UPDATE && pr == NULL) {
1206 				error = ENOENT;
1207 				vfs_opterror(opts, "jail \"%s\" not found",
1208 				    name);
1209 				goto done_unlock_list;
1210 			}
1211 		}
1212 	}
1213 	/* Update: must provide a jid or name. */
1214 	else if (cuflags == JAIL_UPDATE && pr == NULL) {
1215 		error = ENOENT;
1216 		vfs_opterror(opts, "update specified no jail");
1217 		goto done_unlock_list;
1218 	}
1219 
1220 	/* If there's no prison to update, create a new one and link it in. */
1221 	if (pr == NULL) {
1222 		for (tpr = mypr; tpr != NULL; tpr = tpr->pr_parent)
1223 			if (tpr->pr_childcount >= tpr->pr_childmax) {
1224 				error = EPERM;
1225 				vfs_opterror(opts, "prison limit exceeded");
1226 				goto done_unlock_list;
1227 			}
1228 		created = 1;
1229 		mtx_lock(&ppr->pr_mtx);
1230 		if (ppr->pr_ref == 0 || (ppr->pr_flags & PR_REMOVE)) {
1231 			mtx_unlock(&ppr->pr_mtx);
1232 			error = ENOENT;
1233 			vfs_opterror(opts, "parent jail went away!");
1234 			goto done_unlock_list;
1235 		}
1236 		ppr->pr_ref++;
1237 		ppr->pr_uref++;
1238 		mtx_unlock(&ppr->pr_mtx);
1239 		pr = malloc(sizeof(*pr), M_PRISON, M_WAITOK | M_ZERO);
1240 		if (jid == 0) {
1241 			/* Find the next free jid. */
1242 			jid = lastprid + 1;
1243  findnext:
1244 			if (jid == JAIL_MAX)
1245 				jid = 1;
1246 			TAILQ_FOREACH(tpr, &allprison, pr_list) {
1247 				if (tpr->pr_id < jid)
1248 					continue;
1249 				if (tpr->pr_id > jid || tpr->pr_ref == 0) {
1250 					TAILQ_INSERT_BEFORE(tpr, pr, pr_list);
1251 					break;
1252 				}
1253 				if (jid == lastprid) {
1254 					error = EAGAIN;
1255 					vfs_opterror(opts,
1256 					    "no available jail IDs");
1257 					free(pr, M_PRISON);
1258 					prison_deref(ppr, PD_DEREF |
1259 					    PD_DEUREF | PD_LIST_XLOCKED);
1260 					goto done_releroot;
1261 				}
1262 				jid++;
1263 				goto findnext;
1264 			}
1265 			lastprid = jid;
1266 		} else {
1267 			/*
1268 			 * The jail already has a jid (that did not yet exist),
1269 			 * so just find where to insert it.
1270 			 */
1271 			TAILQ_FOREACH(tpr, &allprison, pr_list)
1272 				if (tpr->pr_id >= jid) {
1273 					TAILQ_INSERT_BEFORE(tpr, pr, pr_list);
1274 					break;
1275 				}
1276 		}
1277 		if (tpr == NULL)
1278 			TAILQ_INSERT_TAIL(&allprison, pr, pr_list);
1279 		LIST_INSERT_HEAD(&ppr->pr_children, pr, pr_sibling);
1280 		for (tpr = ppr; tpr != NULL; tpr = tpr->pr_parent)
1281 			tpr->pr_childcount++;
1282 
1283 		pr->pr_parent = ppr;
1284 		pr->pr_id = jid;
1285 
1286 		/* Set some default values, and inherit some from the parent. */
1287 		if (name == NULL)
1288 			name = "";
1289 		if (path == NULL) {
1290 			path = "/";
1291 			root = mypr->pr_root;
1292 			vref(root);
1293 		}
1294 		strlcpy(pr->pr_hostuuid, DEFAULT_HOSTUUID, HOSTUUIDLEN);
1295 		pr->pr_flags |= PR_HOST;
1296 #if defined(INET) || defined(INET6)
1297 #ifdef VIMAGE
1298 		if (!(pr_flags & PR_VNET))
1299 #endif
1300 		{
1301 #ifdef INET
1302 			if (!(ch_flags & PR_IP4_USER))
1303 				pr->pr_flags |= PR_IP4 | PR_IP4_USER;
1304 			else if (!(pr_flags & PR_IP4_USER)) {
1305 				pr->pr_flags |= ppr->pr_flags & PR_IP4;
1306 				if (ppr->pr_ip4 != NULL) {
1307 					pr->pr_ip4s = ppr->pr_ip4s;
1308 					pr->pr_ip4 = malloc(pr->pr_ip4s *
1309 					    sizeof(struct in_addr), M_PRISON,
1310 					    M_WAITOK);
1311 					bcopy(ppr->pr_ip4, pr->pr_ip4,
1312 					    pr->pr_ip4s * sizeof(*pr->pr_ip4));
1313 				}
1314 			}
1315 #endif
1316 #ifdef INET6
1317 			if (!(ch_flags & PR_IP6_USER))
1318 				pr->pr_flags |= PR_IP6 | PR_IP6_USER;
1319 			else if (!(pr_flags & PR_IP6_USER)) {
1320 				pr->pr_flags |= ppr->pr_flags & PR_IP6;
1321 				if (ppr->pr_ip6 != NULL) {
1322 					pr->pr_ip6s = ppr->pr_ip6s;
1323 					pr->pr_ip6 = malloc(pr->pr_ip6s *
1324 					    sizeof(struct in6_addr), M_PRISON,
1325 					    M_WAITOK);
1326 					bcopy(ppr->pr_ip6, pr->pr_ip6,
1327 					    pr->pr_ip6s * sizeof(*pr->pr_ip6));
1328 				}
1329 			}
1330 #endif
1331 		}
1332 #endif
1333 		/* Source address selection is always on by default. */
1334 		pr->pr_flags |= _PR_IP_SADDRSEL;
1335 
1336 		pr->pr_securelevel = ppr->pr_securelevel;
1337 		pr->pr_allow = JAIL_DEFAULT_ALLOW & ppr->pr_allow;
1338 		pr->pr_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS;
1339 		pr->pr_devfs_rsnum = ppr->pr_devfs_rsnum;
1340 
1341 		pr->pr_osreldate = osreldt ? osreldt : ppr->pr_osreldate;
1342 		if (osrelstr == NULL)
1343 		    strcpy(pr->pr_osrelease, ppr->pr_osrelease);
1344 		else
1345 		    strcpy(pr->pr_osrelease, osrelstr);
1346 
1347 		LIST_INIT(&pr->pr_children);
1348 		mtx_init(&pr->pr_mtx, "jail mutex", NULL, MTX_DEF | MTX_DUPOK);
1349 
1350 #ifdef VIMAGE
1351 		/* Allocate a new vnet if specified. */
1352 		pr->pr_vnet = (pr_flags & PR_VNET)
1353 		    ? vnet_alloc() : ppr->pr_vnet;
1354 #endif
1355 		/*
1356 		 * Allocate a dedicated cpuset for each jail.
1357 		 * Unlike other initial settings, this may return an erorr.
1358 		 */
1359 		error = cpuset_create_root(ppr, &pr->pr_cpuset);
1360 		if (error) {
1361 			prison_deref(pr, PD_LIST_XLOCKED);
1362 			goto done_releroot;
1363 		}
1364 
1365 		mtx_lock(&pr->pr_mtx);
1366 		/*
1367 		 * New prisons do not yet have a reference, because we do not
1368 		 * want other to see the incomplete prison once the
1369 		 * allprison_lock is downgraded.
1370 		 */
1371 	} else {
1372 		created = 0;
1373 		/*
1374 		 * Grab a reference for existing prisons, to ensure they
1375 		 * continue to exist for the duration of the call.
1376 		 */
1377 		pr->pr_ref++;
1378 #if defined(VIMAGE) && (defined(INET) || defined(INET6))
1379 		if ((pr->pr_flags & PR_VNET) &&
1380 		    (ch_flags & (PR_IP4_USER | PR_IP6_USER))) {
1381 			error = EINVAL;
1382 			vfs_opterror(opts,
1383 			    "vnet jails cannot have IP address restrictions");
1384 			goto done_deref_locked;
1385 		}
1386 #endif
1387 #ifdef INET
1388 		if (PR_IP4_USER & ch_flags & (pr_flags ^ pr->pr_flags)) {
1389 			error = EINVAL;
1390 			vfs_opterror(opts,
1391 			    "ip4 cannot be changed after creation");
1392 			goto done_deref_locked;
1393 		}
1394 #endif
1395 #ifdef INET6
1396 		if (PR_IP6_USER & ch_flags & (pr_flags ^ pr->pr_flags)) {
1397 			error = EINVAL;
1398 			vfs_opterror(opts,
1399 			    "ip6 cannot be changed after creation");
1400 			goto done_deref_locked;
1401 		}
1402 #endif
1403 	}
1404 
1405 	/* Do final error checking before setting anything. */
1406 	if (gotslevel) {
1407 		if (slevel < ppr->pr_securelevel) {
1408 			error = EPERM;
1409 			goto done_deref_locked;
1410 		}
1411 	}
1412 	if (gotchildmax) {
1413 		if (childmax >= ppr->pr_childmax) {
1414 			error = EPERM;
1415 			goto done_deref_locked;
1416 		}
1417 	}
1418 	if (gotenforce) {
1419 		if (enforce < ppr->pr_enforce_statfs) {
1420 			error = EPERM;
1421 			goto done_deref_locked;
1422 		}
1423 	}
1424 	if (gotrsnum) {
1425 		/*
1426 		 * devfs_rsnum is a uint16_t
1427 		 */
1428 		if (rsnum < 0 || rsnum > 65535) {
1429 			error = EINVAL;
1430 			goto done_deref_locked;
1431 		}
1432 		/*
1433 		 * Nested jails always inherit parent's devfs ruleset
1434 		 */
1435 		if (jailed(td->td_ucred)) {
1436 			if (rsnum > 0 && rsnum != ppr->pr_devfs_rsnum) {
1437 				error = EPERM;
1438 				goto done_deref_locked;
1439 			} else
1440 				rsnum = ppr->pr_devfs_rsnum;
1441 		}
1442 	}
1443 #ifdef INET
1444 	if (ip4s > 0) {
1445 		if (ppr->pr_flags & PR_IP4) {
1446 			/*
1447 			 * Make sure the new set of IP addresses is a
1448 			 * subset of the parent's list.  Don't worry
1449 			 * about the parent being unlocked, as any
1450 			 * setting is done with allprison_lock held.
1451 			 */
1452 			for (ij = 0; ij < ppr->pr_ip4s; ij++)
1453 				if (ip4[0].s_addr == ppr->pr_ip4[ij].s_addr)
1454 					break;
1455 			if (ij == ppr->pr_ip4s) {
1456 				error = EPERM;
1457 				goto done_deref_locked;
1458 			}
1459 			if (ip4s > 1) {
1460 				for (ii = ij = 1; ii < ip4s; ii++) {
1461 					if (ip4[ii].s_addr ==
1462 					    ppr->pr_ip4[0].s_addr)
1463 						continue;
1464 					for (; ij < ppr->pr_ip4s; ij++)
1465 						if (ip4[ii].s_addr ==
1466 						    ppr->pr_ip4[ij].s_addr)
1467 							break;
1468 					if (ij == ppr->pr_ip4s)
1469 						break;
1470 				}
1471 				if (ij == ppr->pr_ip4s) {
1472 					error = EPERM;
1473 					goto done_deref_locked;
1474 				}
1475 			}
1476 		}
1477 		/*
1478 		 * Check for conflicting IP addresses.  We permit them
1479 		 * if there is no more than one IP on each jail.  If
1480 		 * there is a duplicate on a jail with more than one
1481 		 * IP stop checking and return error.
1482 		 */
1483 		tppr = ppr;
1484 #ifdef VIMAGE
1485 		for (; tppr != &prison0; tppr = tppr->pr_parent)
1486 			if (tppr->pr_flags & PR_VNET)
1487 				break;
1488 #endif
1489 		FOREACH_PRISON_DESCENDANT(tppr, tpr, descend) {
1490 			if (tpr == pr ||
1491 #ifdef VIMAGE
1492 			    (tpr != tppr && (tpr->pr_flags & PR_VNET)) ||
1493 #endif
1494 			    tpr->pr_uref == 0) {
1495 				descend = 0;
1496 				continue;
1497 			}
1498 			if (!(tpr->pr_flags & PR_IP4_USER))
1499 				continue;
1500 			descend = 0;
1501 			if (tpr->pr_ip4 == NULL ||
1502 			    (ip4s == 1 && tpr->pr_ip4s == 1))
1503 				continue;
1504 			for (ii = 0; ii < ip4s; ii++) {
1505 				if (_prison_check_ip4(tpr, &ip4[ii]) == 0) {
1506 					error = EADDRINUSE;
1507 					vfs_opterror(opts,
1508 					    "IPv4 addresses clash");
1509 					goto done_deref_locked;
1510 				}
1511 			}
1512 		}
1513 	}
1514 #endif
1515 #ifdef INET6
1516 	if (ip6s > 0) {
1517 		if (ppr->pr_flags & PR_IP6) {
1518 			/*
1519 			 * Make sure the new set of IP addresses is a
1520 			 * subset of the parent's list.
1521 			 */
1522 			for (ij = 0; ij < ppr->pr_ip6s; ij++)
1523 				if (IN6_ARE_ADDR_EQUAL(&ip6[0],
1524 				    &ppr->pr_ip6[ij]))
1525 					break;
1526 			if (ij == ppr->pr_ip6s) {
1527 				error = EPERM;
1528 				goto done_deref_locked;
1529 			}
1530 			if (ip6s > 1) {
1531 				for (ii = ij = 1; ii < ip6s; ii++) {
1532 					if (IN6_ARE_ADDR_EQUAL(&ip6[ii],
1533 					     &ppr->pr_ip6[0]))
1534 						continue;
1535 					for (; ij < ppr->pr_ip6s; ij++)
1536 						if (IN6_ARE_ADDR_EQUAL(
1537 						    &ip6[ii], &ppr->pr_ip6[ij]))
1538 							break;
1539 					if (ij == ppr->pr_ip6s)
1540 						break;
1541 				}
1542 				if (ij == ppr->pr_ip6s) {
1543 					error = EPERM;
1544 					goto done_deref_locked;
1545 				}
1546 			}
1547 		}
1548 		/* Check for conflicting IP addresses. */
1549 		tppr = ppr;
1550 #ifdef VIMAGE
1551 		for (; tppr != &prison0; tppr = tppr->pr_parent)
1552 			if (tppr->pr_flags & PR_VNET)
1553 				break;
1554 #endif
1555 		FOREACH_PRISON_DESCENDANT(tppr, tpr, descend) {
1556 			if (tpr == pr ||
1557 #ifdef VIMAGE
1558 			    (tpr != tppr && (tpr->pr_flags & PR_VNET)) ||
1559 #endif
1560 			    tpr->pr_uref == 0) {
1561 				descend = 0;
1562 				continue;
1563 			}
1564 			if (!(tpr->pr_flags & PR_IP6_USER))
1565 				continue;
1566 			descend = 0;
1567 			if (tpr->pr_ip6 == NULL ||
1568 			    (ip6s == 1 && tpr->pr_ip6s == 1))
1569 				continue;
1570 			for (ii = 0; ii < ip6s; ii++) {
1571 				if (_prison_check_ip6(tpr, &ip6[ii]) == 0) {
1572 					error = EADDRINUSE;
1573 					vfs_opterror(opts,
1574 					    "IPv6 addresses clash");
1575 					goto done_deref_locked;
1576 				}
1577 			}
1578 		}
1579 	}
1580 #endif
1581 	onamelen = namelen = 0;
1582 	if (name != NULL) {
1583 		/* Give a default name of the jid. */
1584 		if (name[0] == '\0')
1585 			snprintf(name = numbuf, sizeof(numbuf), "%d", jid);
1586 		else if (*namelc == '0' || (strtoul(namelc, &p, 10) != jid &&
1587 		    *p == '\0')) {
1588 			error = EINVAL;
1589 			vfs_opterror(opts,
1590 			    "name cannot be numeric (unless it is the jid)");
1591 			goto done_deref_locked;
1592 		}
1593 		/*
1594 		 * Make sure the name isn't too long for the prison or its
1595 		 * children.
1596 		 */
1597 		onamelen = strlen(pr->pr_name);
1598 		namelen = strlen(name);
1599 		if (strlen(ppr->pr_name) + namelen + 2 > sizeof(pr->pr_name)) {
1600 			error = ENAMETOOLONG;
1601 			goto done_deref_locked;
1602 		}
1603 		FOREACH_PRISON_DESCENDANT(pr, tpr, descend) {
1604 			if (strlen(tpr->pr_name) + (namelen - onamelen) >=
1605 			    sizeof(pr->pr_name)) {
1606 				error = ENAMETOOLONG;
1607 				goto done_deref_locked;
1608 			}
1609 		}
1610 	}
1611 	if (pr_allow & ~ppr->pr_allow) {
1612 		error = EPERM;
1613 		goto done_deref_locked;
1614 	}
1615 
1616 	/* Set the parameters of the prison. */
1617 #ifdef INET
1618 	redo_ip4 = 0;
1619 	if (pr_flags & PR_IP4_USER) {
1620 		pr->pr_flags |= PR_IP4;
1621 		free(pr->pr_ip4, M_PRISON);
1622 		pr->pr_ip4s = ip4s;
1623 		pr->pr_ip4 = ip4;
1624 		ip4 = NULL;
1625 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1626 #ifdef VIMAGE
1627 			if (tpr->pr_flags & PR_VNET) {
1628 				descend = 0;
1629 				continue;
1630 			}
1631 #endif
1632 			if (prison_restrict_ip4(tpr, NULL)) {
1633 				redo_ip4 = 1;
1634 				descend = 0;
1635 			}
1636 		}
1637 	}
1638 #endif
1639 #ifdef INET6
1640 	redo_ip6 = 0;
1641 	if (pr_flags & PR_IP6_USER) {
1642 		pr->pr_flags |= PR_IP6;
1643 		free(pr->pr_ip6, M_PRISON);
1644 		pr->pr_ip6s = ip6s;
1645 		pr->pr_ip6 = ip6;
1646 		ip6 = NULL;
1647 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1648 #ifdef VIMAGE
1649 			if (tpr->pr_flags & PR_VNET) {
1650 				descend = 0;
1651 				continue;
1652 			}
1653 #endif
1654 			if (prison_restrict_ip6(tpr, NULL)) {
1655 				redo_ip6 = 1;
1656 				descend = 0;
1657 			}
1658 		}
1659 	}
1660 #endif
1661 	if (gotslevel) {
1662 		pr->pr_securelevel = slevel;
1663 		/* Set all child jails to be at least this level. */
1664 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
1665 			if (tpr->pr_securelevel < slevel)
1666 				tpr->pr_securelevel = slevel;
1667 	}
1668 	if (gotchildmax) {
1669 		pr->pr_childmax = childmax;
1670 		/* Set all child jails to under this limit. */
1671 		FOREACH_PRISON_DESCENDANT_LOCKED_LEVEL(pr, tpr, descend, level)
1672 			if (tpr->pr_childmax > childmax - level)
1673 				tpr->pr_childmax = childmax > level
1674 				    ? childmax - level : 0;
1675 	}
1676 	if (gotenforce) {
1677 		pr->pr_enforce_statfs = enforce;
1678 		/* Pass this restriction on to the children. */
1679 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
1680 			if (tpr->pr_enforce_statfs < enforce)
1681 				tpr->pr_enforce_statfs = enforce;
1682 	}
1683 	if (gotrsnum) {
1684 		pr->pr_devfs_rsnum = rsnum;
1685 		/* Pass this restriction on to the children. */
1686 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
1687 			tpr->pr_devfs_rsnum = rsnum;
1688 	}
1689 	if (name != NULL) {
1690 		if (ppr == &prison0)
1691 			strlcpy(pr->pr_name, name, sizeof(pr->pr_name));
1692 		else
1693 			snprintf(pr->pr_name, sizeof(pr->pr_name), "%s.%s",
1694 			    ppr->pr_name, name);
1695 		/* Change this component of child names. */
1696 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1697 			bcopy(tpr->pr_name + onamelen, tpr->pr_name + namelen,
1698 			    strlen(tpr->pr_name + onamelen) + 1);
1699 			bcopy(pr->pr_name, tpr->pr_name, namelen);
1700 		}
1701 	}
1702 	if (path != NULL) {
1703 		/* Try to keep a real-rooted full pathname. */
1704 		if (fullpath_disabled && path[0] == '/' &&
1705 		    strcmp(mypr->pr_path, "/"))
1706 			snprintf(pr->pr_path, sizeof(pr->pr_path), "%s%s",
1707 			    mypr->pr_path, path);
1708 		else
1709 			strlcpy(pr->pr_path, path, sizeof(pr->pr_path));
1710 		pr->pr_root = root;
1711 	}
1712 	if (PR_HOST & ch_flags & ~pr_flags) {
1713 		if (pr->pr_flags & PR_HOST) {
1714 			/*
1715 			 * Copy the parent's host info.  As with pr_ip4 above,
1716 			 * the lack of a lock on the parent is not a problem;
1717 			 * it is always set with allprison_lock at least
1718 			 * shared, and is held exclusively here.
1719 			 */
1720 			strlcpy(pr->pr_hostname, pr->pr_parent->pr_hostname,
1721 			    sizeof(pr->pr_hostname));
1722 			strlcpy(pr->pr_domainname, pr->pr_parent->pr_domainname,
1723 			    sizeof(pr->pr_domainname));
1724 			strlcpy(pr->pr_hostuuid, pr->pr_parent->pr_hostuuid,
1725 			    sizeof(pr->pr_hostuuid));
1726 			pr->pr_hostid = pr->pr_parent->pr_hostid;
1727 		}
1728 	} else if (host != NULL || domain != NULL || uuid != NULL || gothid) {
1729 		/* Set this prison, and any descendants without PR_HOST. */
1730 		if (host != NULL)
1731 			strlcpy(pr->pr_hostname, host, sizeof(pr->pr_hostname));
1732 		if (domain != NULL)
1733 			strlcpy(pr->pr_domainname, domain,
1734 			    sizeof(pr->pr_domainname));
1735 		if (uuid != NULL)
1736 			strlcpy(pr->pr_hostuuid, uuid, sizeof(pr->pr_hostuuid));
1737 		if (gothid)
1738 			pr->pr_hostid = hid;
1739 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1740 			if (tpr->pr_flags & PR_HOST)
1741 				descend = 0;
1742 			else {
1743 				if (host != NULL)
1744 					strlcpy(tpr->pr_hostname,
1745 					    pr->pr_hostname,
1746 					    sizeof(tpr->pr_hostname));
1747 				if (domain != NULL)
1748 					strlcpy(tpr->pr_domainname,
1749 					    pr->pr_domainname,
1750 					    sizeof(tpr->pr_domainname));
1751 				if (uuid != NULL)
1752 					strlcpy(tpr->pr_hostuuid,
1753 					    pr->pr_hostuuid,
1754 					    sizeof(tpr->pr_hostuuid));
1755 				if (gothid)
1756 					tpr->pr_hostid = hid;
1757 			}
1758 		}
1759 	}
1760 	if ((tallow = ch_allow & ~pr_allow)) {
1761 		/* Clear allow bits in all children. */
1762 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
1763 			tpr->pr_allow &= ~tallow;
1764 	}
1765 	pr->pr_allow = (pr->pr_allow & ~ch_allow) | pr_allow;
1766 	/*
1767 	 * Persistent prisons get an extra reference, and prisons losing their
1768 	 * persist flag lose that reference.  Only do this for existing prisons
1769 	 * for now, so new ones will remain unseen until after the module
1770 	 * handlers have completed.
1771 	 */
1772 	if (!created && (ch_flags & PR_PERSIST & (pr_flags ^ pr->pr_flags))) {
1773 		if (pr_flags & PR_PERSIST) {
1774 			pr->pr_ref++;
1775 			pr->pr_uref++;
1776 		} else {
1777 			pr->pr_ref--;
1778 			pr->pr_uref--;
1779 		}
1780 	}
1781 	pr->pr_flags = (pr->pr_flags & ~ch_flags) | pr_flags;
1782 	mtx_unlock(&pr->pr_mtx);
1783 
1784 #ifdef RACCT
1785 	if (created)
1786 		prison_racct_attach(pr);
1787 #endif
1788 
1789 	/* Locks may have prevented a complete restriction of child IP
1790 	 * addresses.  If so, allocate some more memory and try again.
1791 	 */
1792 #ifdef INET
1793 	while (redo_ip4) {
1794 		ip4s = pr->pr_ip4s;
1795 		ip4 = malloc(ip4s * sizeof(*ip4), M_PRISON, M_WAITOK);
1796 		mtx_lock(&pr->pr_mtx);
1797 		redo_ip4 = 0;
1798 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1799 #ifdef VIMAGE
1800 			if (tpr->pr_flags & PR_VNET) {
1801 				descend = 0;
1802 				continue;
1803 			}
1804 #endif
1805 			if (prison_restrict_ip4(tpr, ip4)) {
1806 				if (ip4 != NULL)
1807 					ip4 = NULL;
1808 				else
1809 					redo_ip4 = 1;
1810 			}
1811 		}
1812 		mtx_unlock(&pr->pr_mtx);
1813 	}
1814 #endif
1815 #ifdef INET6
1816 	while (redo_ip6) {
1817 		ip6s = pr->pr_ip6s;
1818 		ip6 = malloc(ip6s * sizeof(*ip6), M_PRISON, M_WAITOK);
1819 		mtx_lock(&pr->pr_mtx);
1820 		redo_ip6 = 0;
1821 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1822 #ifdef VIMAGE
1823 			if (tpr->pr_flags & PR_VNET) {
1824 				descend = 0;
1825 				continue;
1826 			}
1827 #endif
1828 			if (prison_restrict_ip6(tpr, ip6)) {
1829 				if (ip6 != NULL)
1830 					ip6 = NULL;
1831 				else
1832 					redo_ip6 = 1;
1833 			}
1834 		}
1835 		mtx_unlock(&pr->pr_mtx);
1836 	}
1837 #endif
1838 
1839 	/* Let the modules do their work. */
1840 	sx_downgrade(&allprison_lock);
1841 	if (created) {
1842 		error = osd_jail_call(pr, PR_METHOD_CREATE, opts);
1843 		if (error) {
1844 			prison_deref(pr, PD_LIST_SLOCKED);
1845 			goto done_errmsg;
1846 		}
1847 	}
1848 	error = osd_jail_call(pr, PR_METHOD_SET, opts);
1849 	if (error) {
1850 		prison_deref(pr, created
1851 		    ? PD_LIST_SLOCKED
1852 		    : PD_DEREF | PD_LIST_SLOCKED);
1853 		goto done_errmsg;
1854 	}
1855 
1856 	/* Attach this process to the prison if requested. */
1857 	if (flags & JAIL_ATTACH) {
1858 		mtx_lock(&pr->pr_mtx);
1859 		error = do_jail_attach(td, pr);
1860 		if (error) {
1861 			vfs_opterror(opts, "attach failed");
1862 			if (!created)
1863 				prison_deref(pr, PD_DEREF);
1864 			goto done_errmsg;
1865 		}
1866 	}
1867 
1868 #ifdef RACCT
1869 	if (!created) {
1870 		if (!(flags & JAIL_ATTACH))
1871 			sx_sunlock(&allprison_lock);
1872 		prison_racct_modify(pr);
1873 		if (!(flags & JAIL_ATTACH))
1874 			sx_slock(&allprison_lock);
1875 	}
1876 #endif
1877 
1878 	td->td_retval[0] = pr->pr_id;
1879 
1880 	/*
1881 	 * Now that it is all there, drop the temporary reference from existing
1882 	 * prisons.  Or add a reference to newly created persistent prisons
1883 	 * (which was not done earlier so that the prison would not be publicly
1884 	 * visible).
1885 	 */
1886 	if (!created) {
1887 		prison_deref(pr, (flags & JAIL_ATTACH)
1888 		    ? PD_DEREF
1889 		    : PD_DEREF | PD_LIST_SLOCKED);
1890 	} else {
1891 		if (pr_flags & PR_PERSIST) {
1892 			mtx_lock(&pr->pr_mtx);
1893 			pr->pr_ref++;
1894 			pr->pr_uref++;
1895 			mtx_unlock(&pr->pr_mtx);
1896 		}
1897 		if (!(flags & JAIL_ATTACH))
1898 			sx_sunlock(&allprison_lock);
1899 	}
1900 
1901 	goto done_errmsg;
1902 
1903  done_deref_locked:
1904 	prison_deref(pr, created
1905 	    ? PD_LOCKED | PD_LIST_XLOCKED
1906 	    : PD_DEREF | PD_LOCKED | PD_LIST_XLOCKED);
1907 	goto done_releroot;
1908  done_unlock_list:
1909 	sx_xunlock(&allprison_lock);
1910  done_releroot:
1911 	if (root != NULL)
1912 		vrele(root);
1913  done_errmsg:
1914 	if (error) {
1915 		vfs_getopt(opts, "errmsg", (void **)&errmsg, &errmsg_len);
1916 		if (errmsg_len > 0) {
1917 			errmsg_pos = 2 * vfs_getopt_pos(opts, "errmsg") + 1;
1918 			if (errmsg_pos > 0) {
1919 				if (optuio->uio_segflg == UIO_SYSSPACE)
1920 					bcopy(errmsg,
1921 					   optuio->uio_iov[errmsg_pos].iov_base,
1922 					   errmsg_len);
1923 				else
1924 					copyout(errmsg,
1925 					   optuio->uio_iov[errmsg_pos].iov_base,
1926 					   errmsg_len);
1927 			}
1928 		}
1929 	}
1930  done_free:
1931 #ifdef INET
1932 	free(ip4, M_PRISON);
1933 #endif
1934 #ifdef INET6
1935 	free(ip6, M_PRISON);
1936 #endif
1937 	if (g_path != NULL)
1938 		free(g_path, M_TEMP);
1939 	vfs_freeopts(opts);
1940 	return (error);
1941 }
1942 
1943 
1944 /*
1945  * struct jail_get_args {
1946  *	struct iovec *iovp;
1947  *	unsigned int iovcnt;
1948  *	int flags;
1949  * };
1950  */
1951 int
1952 sys_jail_get(struct thread *td, struct jail_get_args *uap)
1953 {
1954 	struct uio *auio;
1955 	int error;
1956 
1957 	/* Check that we have an even number of iovecs. */
1958 	if (uap->iovcnt & 1)
1959 		return (EINVAL);
1960 
1961 	error = copyinuio(uap->iovp, uap->iovcnt, &auio);
1962 	if (error)
1963 		return (error);
1964 	error = kern_jail_get(td, auio, uap->flags);
1965 	if (error == 0)
1966 		error = copyout(auio->uio_iov, uap->iovp,
1967 		    uap->iovcnt * sizeof (struct iovec));
1968 	free(auio, M_IOV);
1969 	return (error);
1970 }
1971 
1972 int
1973 kern_jail_get(struct thread *td, struct uio *optuio, int flags)
1974 {
1975 	struct prison *pr, *mypr;
1976 	struct vfsopt *opt;
1977 	struct vfsoptlist *opts;
1978 	char *errmsg, *name;
1979 	int error, errmsg_len, errmsg_pos, fi, i, jid, len, locked, pos;
1980 
1981 	if (flags & ~JAIL_GET_MASK)
1982 		return (EINVAL);
1983 
1984 	/* Get the parameter list. */
1985 	error = vfs_buildopts(optuio, &opts);
1986 	if (error)
1987 		return (error);
1988 	errmsg_pos = vfs_getopt_pos(opts, "errmsg");
1989 	mypr = td->td_ucred->cr_prison;
1990 
1991 	/*
1992 	 * Find the prison specified by one of: lastjid, jid, name.
1993 	 */
1994 	sx_slock(&allprison_lock);
1995 	error = vfs_copyopt(opts, "lastjid", &jid, sizeof(jid));
1996 	if (error == 0) {
1997 		TAILQ_FOREACH(pr, &allprison, pr_list) {
1998 			if (pr->pr_id > jid && prison_ischild(mypr, pr)) {
1999 				mtx_lock(&pr->pr_mtx);
2000 				if (pr->pr_ref > 0 &&
2001 				    (pr->pr_uref > 0 || (flags & JAIL_DYING)))
2002 					break;
2003 				mtx_unlock(&pr->pr_mtx);
2004 			}
2005 		}
2006 		if (pr != NULL)
2007 			goto found_prison;
2008 		error = ENOENT;
2009 		vfs_opterror(opts, "no jail after %d", jid);
2010 		goto done_unlock_list;
2011 	} else if (error != ENOENT)
2012 		goto done_unlock_list;
2013 
2014 	error = vfs_copyopt(opts, "jid", &jid, sizeof(jid));
2015 	if (error == 0) {
2016 		if (jid != 0) {
2017 			pr = prison_find_child(mypr, jid);
2018 			if (pr != NULL) {
2019 				if (pr->pr_uref == 0 && !(flags & JAIL_DYING)) {
2020 					mtx_unlock(&pr->pr_mtx);
2021 					error = ENOENT;
2022 					vfs_opterror(opts, "jail %d is dying",
2023 					    jid);
2024 					goto done_unlock_list;
2025 				}
2026 				goto found_prison;
2027 			}
2028 			error = ENOENT;
2029 			vfs_opterror(opts, "jail %d not found", jid);
2030 			goto done_unlock_list;
2031 		}
2032 	} else if (error != ENOENT)
2033 		goto done_unlock_list;
2034 
2035 	error = vfs_getopt(opts, "name", (void **)&name, &len);
2036 	if (error == 0) {
2037 		if (len == 0 || name[len - 1] != '\0') {
2038 			error = EINVAL;
2039 			goto done_unlock_list;
2040 		}
2041 		pr = prison_find_name(mypr, name);
2042 		if (pr != NULL) {
2043 			if (pr->pr_uref == 0 && !(flags & JAIL_DYING)) {
2044 				mtx_unlock(&pr->pr_mtx);
2045 				error = ENOENT;
2046 				vfs_opterror(opts, "jail \"%s\" is dying",
2047 				    name);
2048 				goto done_unlock_list;
2049 			}
2050 			goto found_prison;
2051 		}
2052 		error = ENOENT;
2053 		vfs_opterror(opts, "jail \"%s\" not found", name);
2054 		goto done_unlock_list;
2055 	} else if (error != ENOENT)
2056 		goto done_unlock_list;
2057 
2058 	vfs_opterror(opts, "no jail specified");
2059 	error = ENOENT;
2060 	goto done_unlock_list;
2061 
2062  found_prison:
2063 	/* Get the parameters of the prison. */
2064 	pr->pr_ref++;
2065 	locked = PD_LOCKED;
2066 	td->td_retval[0] = pr->pr_id;
2067 	error = vfs_setopt(opts, "jid", &pr->pr_id, sizeof(pr->pr_id));
2068 	if (error != 0 && error != ENOENT)
2069 		goto done_deref;
2070 	i = (pr->pr_parent == mypr) ? 0 : pr->pr_parent->pr_id;
2071 	error = vfs_setopt(opts, "parent", &i, sizeof(i));
2072 	if (error != 0 && error != ENOENT)
2073 		goto done_deref;
2074 	error = vfs_setopts(opts, "name", prison_name(mypr, pr));
2075 	if (error != 0 && error != ENOENT)
2076 		goto done_deref;
2077 	error = vfs_setopt(opts, "cpuset.id", &pr->pr_cpuset->cs_id,
2078 	    sizeof(pr->pr_cpuset->cs_id));
2079 	if (error != 0 && error != ENOENT)
2080 		goto done_deref;
2081 	error = vfs_setopts(opts, "path", prison_path(mypr, pr));
2082 	if (error != 0 && error != ENOENT)
2083 		goto done_deref;
2084 #ifdef INET
2085 	error = vfs_setopt_part(opts, "ip4.addr", pr->pr_ip4,
2086 	    pr->pr_ip4s * sizeof(*pr->pr_ip4));
2087 	if (error != 0 && error != ENOENT)
2088 		goto done_deref;
2089 #endif
2090 #ifdef INET6
2091 	error = vfs_setopt_part(opts, "ip6.addr", pr->pr_ip6,
2092 	    pr->pr_ip6s * sizeof(*pr->pr_ip6));
2093 	if (error != 0 && error != ENOENT)
2094 		goto done_deref;
2095 #endif
2096 	error = vfs_setopt(opts, "securelevel", &pr->pr_securelevel,
2097 	    sizeof(pr->pr_securelevel));
2098 	if (error != 0 && error != ENOENT)
2099 		goto done_deref;
2100 	error = vfs_setopt(opts, "children.cur", &pr->pr_childcount,
2101 	    sizeof(pr->pr_childcount));
2102 	if (error != 0 && error != ENOENT)
2103 		goto done_deref;
2104 	error = vfs_setopt(opts, "children.max", &pr->pr_childmax,
2105 	    sizeof(pr->pr_childmax));
2106 	if (error != 0 && error != ENOENT)
2107 		goto done_deref;
2108 	error = vfs_setopts(opts, "host.hostname", pr->pr_hostname);
2109 	if (error != 0 && error != ENOENT)
2110 		goto done_deref;
2111 	error = vfs_setopts(opts, "host.domainname", pr->pr_domainname);
2112 	if (error != 0 && error != ENOENT)
2113 		goto done_deref;
2114 	error = vfs_setopts(opts, "host.hostuuid", pr->pr_hostuuid);
2115 	if (error != 0 && error != ENOENT)
2116 		goto done_deref;
2117 #ifdef COMPAT_FREEBSD32
2118 	if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) {
2119 		uint32_t hid32 = pr->pr_hostid;
2120 
2121 		error = vfs_setopt(opts, "host.hostid", &hid32, sizeof(hid32));
2122 	} else
2123 #endif
2124 	error = vfs_setopt(opts, "host.hostid", &pr->pr_hostid,
2125 	    sizeof(pr->pr_hostid));
2126 	if (error != 0 && error != ENOENT)
2127 		goto done_deref;
2128 	error = vfs_setopt(opts, "enforce_statfs", &pr->pr_enforce_statfs,
2129 	    sizeof(pr->pr_enforce_statfs));
2130 	if (error != 0 && error != ENOENT)
2131 		goto done_deref;
2132 	error = vfs_setopt(opts, "devfs_ruleset", &pr->pr_devfs_rsnum,
2133 	    sizeof(pr->pr_devfs_rsnum));
2134 	if (error != 0 && error != ENOENT)
2135 		goto done_deref;
2136 	for (fi = 0; fi < sizeof(pr_flag_names) / sizeof(pr_flag_names[0]);
2137 	    fi++) {
2138 		if (pr_flag_names[fi] == NULL)
2139 			continue;
2140 		i = (pr->pr_flags & (1 << fi)) ? 1 : 0;
2141 		error = vfs_setopt(opts, pr_flag_names[fi], &i, sizeof(i));
2142 		if (error != 0 && error != ENOENT)
2143 			goto done_deref;
2144 		i = !i;
2145 		error = vfs_setopt(opts, pr_flag_nonames[fi], &i, sizeof(i));
2146 		if (error != 0 && error != ENOENT)
2147 			goto done_deref;
2148 	}
2149 	for (fi = 0; fi < sizeof(pr_flag_jailsys) / sizeof(pr_flag_jailsys[0]);
2150 	    fi++) {
2151 		i = pr->pr_flags &
2152 		    (pr_flag_jailsys[fi].disable | pr_flag_jailsys[fi].new);
2153 		i = pr_flag_jailsys[fi].disable &&
2154 		      (i == pr_flag_jailsys[fi].disable) ? JAIL_SYS_DISABLE
2155 		    : (i == pr_flag_jailsys[fi].new) ? JAIL_SYS_NEW
2156 		    : JAIL_SYS_INHERIT;
2157 		error =
2158 		    vfs_setopt(opts, pr_flag_jailsys[fi].name, &i, sizeof(i));
2159 		if (error != 0 && error != ENOENT)
2160 			goto done_deref;
2161 	}
2162 	for (fi = 0; fi < sizeof(pr_allow_names) / sizeof(pr_allow_names[0]);
2163 	    fi++) {
2164 		if (pr_allow_names[fi] == NULL)
2165 			continue;
2166 		i = (pr->pr_allow & (1 << fi)) ? 1 : 0;
2167 		error = vfs_setopt(opts, pr_allow_names[fi], &i, sizeof(i));
2168 		if (error != 0 && error != ENOENT)
2169 			goto done_deref;
2170 		i = !i;
2171 		error = vfs_setopt(opts, pr_allow_nonames[fi], &i, sizeof(i));
2172 		if (error != 0 && error != ENOENT)
2173 			goto done_deref;
2174 	}
2175 	i = (pr->pr_uref == 0);
2176 	error = vfs_setopt(opts, "dying", &i, sizeof(i));
2177 	if (error != 0 && error != ENOENT)
2178 		goto done_deref;
2179 	i = !i;
2180 	error = vfs_setopt(opts, "nodying", &i, sizeof(i));
2181 	if (error != 0 && error != ENOENT)
2182 		goto done_deref;
2183 	error = vfs_setopt(opts, "osreldate", &pr->pr_osreldate,
2184 	    sizeof(pr->pr_osreldate));
2185 	if (error != 0 && error != ENOENT)
2186 		goto done_deref;
2187 	error = vfs_setopts(opts, "osrelease", pr->pr_osrelease);
2188 	if (error != 0 && error != ENOENT)
2189 		goto done_deref;
2190 
2191 	/* Get the module parameters. */
2192 	mtx_unlock(&pr->pr_mtx);
2193 	locked = 0;
2194 	error = osd_jail_call(pr, PR_METHOD_GET, opts);
2195 	if (error)
2196 		goto done_deref;
2197 	prison_deref(pr, PD_DEREF | PD_LIST_SLOCKED);
2198 
2199 	/* By now, all parameters should have been noted. */
2200 	TAILQ_FOREACH(opt, opts, link) {
2201 		if (!opt->seen && strcmp(opt->name, "errmsg")) {
2202 			error = EINVAL;
2203 			vfs_opterror(opts, "unknown parameter: %s", opt->name);
2204 			goto done_errmsg;
2205 		}
2206 	}
2207 
2208 	/* Write the fetched parameters back to userspace. */
2209 	error = 0;
2210 	TAILQ_FOREACH(opt, opts, link) {
2211 		if (opt->pos >= 0 && opt->pos != errmsg_pos) {
2212 			pos = 2 * opt->pos + 1;
2213 			optuio->uio_iov[pos].iov_len = opt->len;
2214 			if (opt->value != NULL) {
2215 				if (optuio->uio_segflg == UIO_SYSSPACE) {
2216 					bcopy(opt->value,
2217 					    optuio->uio_iov[pos].iov_base,
2218 					    opt->len);
2219 				} else {
2220 					error = copyout(opt->value,
2221 					    optuio->uio_iov[pos].iov_base,
2222 					    opt->len);
2223 					if (error)
2224 						break;
2225 				}
2226 			}
2227 		}
2228 	}
2229 	goto done_errmsg;
2230 
2231  done_deref:
2232 	prison_deref(pr, locked | PD_DEREF | PD_LIST_SLOCKED);
2233 	goto done_errmsg;
2234 
2235  done_unlock_list:
2236 	sx_sunlock(&allprison_lock);
2237  done_errmsg:
2238 	if (error && errmsg_pos >= 0) {
2239 		vfs_getopt(opts, "errmsg", (void **)&errmsg, &errmsg_len);
2240 		errmsg_pos = 2 * errmsg_pos + 1;
2241 		if (errmsg_len > 0) {
2242 			if (optuio->uio_segflg == UIO_SYSSPACE)
2243 				bcopy(errmsg,
2244 				    optuio->uio_iov[errmsg_pos].iov_base,
2245 				    errmsg_len);
2246 			else
2247 				copyout(errmsg,
2248 				    optuio->uio_iov[errmsg_pos].iov_base,
2249 				    errmsg_len);
2250 		}
2251 	}
2252 	vfs_freeopts(opts);
2253 	return (error);
2254 }
2255 
2256 
2257 /*
2258  * struct jail_remove_args {
2259  *	int jid;
2260  * };
2261  */
2262 int
2263 sys_jail_remove(struct thread *td, struct jail_remove_args *uap)
2264 {
2265 	struct prison *pr, *cpr, *lpr, *tpr;
2266 	int descend, error;
2267 
2268 	error = priv_check(td, PRIV_JAIL_REMOVE);
2269 	if (error)
2270 		return (error);
2271 
2272 	sx_xlock(&allprison_lock);
2273 	pr = prison_find_child(td->td_ucred->cr_prison, uap->jid);
2274 	if (pr == NULL) {
2275 		sx_xunlock(&allprison_lock);
2276 		return (EINVAL);
2277 	}
2278 
2279 	/* Remove all descendants of this prison, then remove this prison. */
2280 	pr->pr_ref++;
2281 	pr->pr_flags |= PR_REMOVE;
2282 	if (!LIST_EMPTY(&pr->pr_children)) {
2283 		mtx_unlock(&pr->pr_mtx);
2284 		lpr = NULL;
2285 		FOREACH_PRISON_DESCENDANT(pr, cpr, descend) {
2286 			mtx_lock(&cpr->pr_mtx);
2287 			if (cpr->pr_ref > 0) {
2288 				tpr = cpr;
2289 				cpr->pr_ref++;
2290 				cpr->pr_flags |= PR_REMOVE;
2291 			} else {
2292 				/* Already removed - do not do it again. */
2293 				tpr = NULL;
2294 			}
2295 			mtx_unlock(&cpr->pr_mtx);
2296 			if (lpr != NULL) {
2297 				mtx_lock(&lpr->pr_mtx);
2298 				prison_remove_one(lpr);
2299 				sx_xlock(&allprison_lock);
2300 			}
2301 			lpr = tpr;
2302 		}
2303 		if (lpr != NULL) {
2304 			mtx_lock(&lpr->pr_mtx);
2305 			prison_remove_one(lpr);
2306 			sx_xlock(&allprison_lock);
2307 		}
2308 		mtx_lock(&pr->pr_mtx);
2309 	}
2310 	prison_remove_one(pr);
2311 	return (0);
2312 }
2313 
2314 static void
2315 prison_remove_one(struct prison *pr)
2316 {
2317 	struct proc *p;
2318 	int deuref;
2319 
2320 	/* If the prison was persistent, it is not anymore. */
2321 	deuref = 0;
2322 	if (pr->pr_flags & PR_PERSIST) {
2323 		pr->pr_ref--;
2324 		deuref = PD_DEUREF;
2325 		pr->pr_flags &= ~PR_PERSIST;
2326 	}
2327 
2328 	/*
2329 	 * jail_remove added a reference.  If that's the only one, remove
2330 	 * the prison now.
2331 	 */
2332 	KASSERT(pr->pr_ref > 0,
2333 	    ("prison_remove_one removing a dead prison (jid=%d)", pr->pr_id));
2334 	if (pr->pr_ref == 1) {
2335 		prison_deref(pr,
2336 		    deuref | PD_DEREF | PD_LOCKED | PD_LIST_XLOCKED);
2337 		return;
2338 	}
2339 
2340 	mtx_unlock(&pr->pr_mtx);
2341 	sx_xunlock(&allprison_lock);
2342 	/*
2343 	 * Kill all processes unfortunate enough to be attached to this prison.
2344 	 */
2345 	sx_slock(&allproc_lock);
2346 	LIST_FOREACH(p, &allproc, p_list) {
2347 		PROC_LOCK(p);
2348 		if (p->p_state != PRS_NEW && p->p_ucred &&
2349 		    p->p_ucred->cr_prison == pr)
2350 			kern_psignal(p, SIGKILL);
2351 		PROC_UNLOCK(p);
2352 	}
2353 	sx_sunlock(&allproc_lock);
2354 	/* Remove the temporary reference added by jail_remove. */
2355 	prison_deref(pr, deuref | PD_DEREF);
2356 }
2357 
2358 
2359 /*
2360  * struct jail_attach_args {
2361  *	int jid;
2362  * };
2363  */
2364 int
2365 sys_jail_attach(struct thread *td, struct jail_attach_args *uap)
2366 {
2367 	struct prison *pr;
2368 	int error;
2369 
2370 	error = priv_check(td, PRIV_JAIL_ATTACH);
2371 	if (error)
2372 		return (error);
2373 
2374 	sx_slock(&allprison_lock);
2375 	pr = prison_find_child(td->td_ucred->cr_prison, uap->jid);
2376 	if (pr == NULL) {
2377 		sx_sunlock(&allprison_lock);
2378 		return (EINVAL);
2379 	}
2380 
2381 	/*
2382 	 * Do not allow a process to attach to a prison that is not
2383 	 * considered to be "alive".
2384 	 */
2385 	if (pr->pr_uref == 0) {
2386 		mtx_unlock(&pr->pr_mtx);
2387 		sx_sunlock(&allprison_lock);
2388 		return (EINVAL);
2389 	}
2390 
2391 	return (do_jail_attach(td, pr));
2392 }
2393 
2394 static int
2395 do_jail_attach(struct thread *td, struct prison *pr)
2396 {
2397 	struct prison *ppr;
2398 	struct proc *p;
2399 	struct ucred *newcred, *oldcred;
2400 	int error;
2401 
2402 	/*
2403 	 * XXX: Note that there is a slight race here if two threads
2404 	 * in the same privileged process attempt to attach to two
2405 	 * different jails at the same time.  It is important for
2406 	 * user processes not to do this, or they might end up with
2407 	 * a process root from one prison, but attached to the jail
2408 	 * of another.
2409 	 */
2410 	pr->pr_ref++;
2411 	pr->pr_uref++;
2412 	mtx_unlock(&pr->pr_mtx);
2413 
2414 	/* Let modules do whatever they need to prepare for attaching. */
2415 	error = osd_jail_call(pr, PR_METHOD_ATTACH, td);
2416 	if (error) {
2417 		prison_deref(pr, PD_DEREF | PD_DEUREF | PD_LIST_SLOCKED);
2418 		return (error);
2419 	}
2420 	sx_sunlock(&allprison_lock);
2421 
2422 	/*
2423 	 * Reparent the newly attached process to this jail.
2424 	 */
2425 	ppr = td->td_ucred->cr_prison;
2426 	p = td->td_proc;
2427 	error = cpuset_setproc_update_set(p, pr->pr_cpuset);
2428 	if (error)
2429 		goto e_revert_osd;
2430 
2431 	vn_lock(pr->pr_root, LK_EXCLUSIVE | LK_RETRY);
2432 	if ((error = change_dir(pr->pr_root, td)) != 0)
2433 		goto e_unlock;
2434 #ifdef MAC
2435 	if ((error = mac_vnode_check_chroot(td->td_ucred, pr->pr_root)))
2436 		goto e_unlock;
2437 #endif
2438 	VOP_UNLOCK(pr->pr_root, 0);
2439 	if ((error = change_root(pr->pr_root, td)))
2440 		goto e_revert_osd;
2441 
2442 	newcred = crget();
2443 	PROC_LOCK(p);
2444 	oldcred = p->p_ucred;
2445 	setsugid(p);
2446 	crcopy(newcred, oldcred);
2447 	newcred->cr_prison = pr;
2448 	p->p_ucred = newcred;
2449 	PROC_UNLOCK(p);
2450 #ifdef RACCT
2451 	racct_proc_ucred_changed(p, oldcred, newcred);
2452 #endif
2453 	crfree(oldcred);
2454 	prison_deref(ppr, PD_DEREF | PD_DEUREF);
2455 	return (0);
2456  e_unlock:
2457 	VOP_UNLOCK(pr->pr_root, 0);
2458  e_revert_osd:
2459 	/* Tell modules this thread is still in its old jail after all. */
2460 	(void)osd_jail_call(ppr, PR_METHOD_ATTACH, td);
2461 	prison_deref(pr, PD_DEREF | PD_DEUREF);
2462 	return (error);
2463 }
2464 
2465 
2466 /*
2467  * Returns a locked prison instance, or NULL on failure.
2468  */
2469 struct prison *
2470 prison_find(int prid)
2471 {
2472 	struct prison *pr;
2473 
2474 	sx_assert(&allprison_lock, SX_LOCKED);
2475 	TAILQ_FOREACH(pr, &allprison, pr_list) {
2476 		if (pr->pr_id == prid) {
2477 			mtx_lock(&pr->pr_mtx);
2478 			if (pr->pr_ref > 0)
2479 				return (pr);
2480 			mtx_unlock(&pr->pr_mtx);
2481 		}
2482 	}
2483 	return (NULL);
2484 }
2485 
2486 /*
2487  * Find a prison that is a descendant of mypr.  Returns a locked prison or NULL.
2488  */
2489 struct prison *
2490 prison_find_child(struct prison *mypr, int prid)
2491 {
2492 	struct prison *pr;
2493 	int descend;
2494 
2495 	sx_assert(&allprison_lock, SX_LOCKED);
2496 	FOREACH_PRISON_DESCENDANT(mypr, pr, descend) {
2497 		if (pr->pr_id == prid) {
2498 			mtx_lock(&pr->pr_mtx);
2499 			if (pr->pr_ref > 0)
2500 				return (pr);
2501 			mtx_unlock(&pr->pr_mtx);
2502 		}
2503 	}
2504 	return (NULL);
2505 }
2506 
2507 /*
2508  * Look for the name relative to mypr.  Returns a locked prison or NULL.
2509  */
2510 struct prison *
2511 prison_find_name(struct prison *mypr, const char *name)
2512 {
2513 	struct prison *pr, *deadpr;
2514 	size_t mylen;
2515 	int descend;
2516 
2517 	sx_assert(&allprison_lock, SX_LOCKED);
2518 	mylen = (mypr == &prison0) ? 0 : strlen(mypr->pr_name) + 1;
2519  again:
2520 	deadpr = NULL;
2521 	FOREACH_PRISON_DESCENDANT(mypr, pr, descend) {
2522 		if (!strcmp(pr->pr_name + mylen, name)) {
2523 			mtx_lock(&pr->pr_mtx);
2524 			if (pr->pr_ref > 0) {
2525 				if (pr->pr_uref > 0)
2526 					return (pr);
2527 				deadpr = pr;
2528 			}
2529 			mtx_unlock(&pr->pr_mtx);
2530 		}
2531 	}
2532 	/* There was no valid prison - perhaps there was a dying one. */
2533 	if (deadpr != NULL) {
2534 		mtx_lock(&deadpr->pr_mtx);
2535 		if (deadpr->pr_ref == 0) {
2536 			mtx_unlock(&deadpr->pr_mtx);
2537 			goto again;
2538 		}
2539 	}
2540 	return (deadpr);
2541 }
2542 
2543 /*
2544  * See if a prison has the specific flag set.
2545  */
2546 int
2547 prison_flag(struct ucred *cred, unsigned flag)
2548 {
2549 
2550 	/* This is an atomic read, so no locking is necessary. */
2551 	return (cred->cr_prison->pr_flags & flag);
2552 }
2553 
2554 int
2555 prison_allow(struct ucred *cred, unsigned flag)
2556 {
2557 
2558 	/* This is an atomic read, so no locking is necessary. */
2559 	return (cred->cr_prison->pr_allow & flag);
2560 }
2561 
2562 /*
2563  * Remove a prison reference.  If that was the last reference, remove the
2564  * prison itself - but not in this context in case there are locks held.
2565  */
2566 void
2567 prison_free_locked(struct prison *pr)
2568 {
2569 
2570 	mtx_assert(&pr->pr_mtx, MA_OWNED);
2571 	pr->pr_ref--;
2572 	if (pr->pr_ref == 0) {
2573 		mtx_unlock(&pr->pr_mtx);
2574 		TASK_INIT(&pr->pr_task, 0, prison_complete, pr);
2575 		taskqueue_enqueue(taskqueue_thread, &pr->pr_task);
2576 		return;
2577 	}
2578 	mtx_unlock(&pr->pr_mtx);
2579 }
2580 
2581 void
2582 prison_free(struct prison *pr)
2583 {
2584 
2585 	mtx_lock(&pr->pr_mtx);
2586 	prison_free_locked(pr);
2587 }
2588 
2589 static void
2590 prison_complete(void *context, int pending)
2591 {
2592 
2593 	prison_deref((struct prison *)context, 0);
2594 }
2595 
2596 /*
2597  * Remove a prison reference (usually).  This internal version assumes no
2598  * mutexes are held, except perhaps the prison itself.  If there are no more
2599  * references, release and delist the prison.  On completion, the prison lock
2600  * and the allprison lock are both unlocked.
2601  */
2602 static void
2603 prison_deref(struct prison *pr, int flags)
2604 {
2605 	struct prison *ppr, *tpr;
2606 
2607 	if (!(flags & PD_LOCKED))
2608 		mtx_lock(&pr->pr_mtx);
2609 	for (;;) {
2610 		if (flags & PD_DEUREF) {
2611 			pr->pr_uref--;
2612 			KASSERT(prison0.pr_uref != 0, ("prison0 pr_uref=0"));
2613 		}
2614 		if (flags & PD_DEREF)
2615 			pr->pr_ref--;
2616 		/* If the prison still has references, nothing else to do. */
2617 		if (pr->pr_ref > 0) {
2618 			mtx_unlock(&pr->pr_mtx);
2619 			if (flags & PD_LIST_SLOCKED)
2620 				sx_sunlock(&allprison_lock);
2621 			else if (flags & PD_LIST_XLOCKED)
2622 				sx_xunlock(&allprison_lock);
2623 			return;
2624 		}
2625 
2626 		mtx_unlock(&pr->pr_mtx);
2627 		if (flags & PD_LIST_SLOCKED) {
2628 			if (!sx_try_upgrade(&allprison_lock)) {
2629 				sx_sunlock(&allprison_lock);
2630 				sx_xlock(&allprison_lock);
2631 			}
2632 		} else if (!(flags & PD_LIST_XLOCKED))
2633 			sx_xlock(&allprison_lock);
2634 
2635 		TAILQ_REMOVE(&allprison, pr, pr_list);
2636 		LIST_REMOVE(pr, pr_sibling);
2637 		ppr = pr->pr_parent;
2638 		for (tpr = ppr; tpr != NULL; tpr = tpr->pr_parent)
2639 			tpr->pr_childcount--;
2640 		sx_xunlock(&allprison_lock);
2641 
2642 #ifdef VIMAGE
2643 		if (pr->pr_vnet != ppr->pr_vnet)
2644 			vnet_destroy(pr->pr_vnet);
2645 #endif
2646 		if (pr->pr_root != NULL)
2647 			vrele(pr->pr_root);
2648 		mtx_destroy(&pr->pr_mtx);
2649 #ifdef INET
2650 		free(pr->pr_ip4, M_PRISON);
2651 #endif
2652 #ifdef INET6
2653 		free(pr->pr_ip6, M_PRISON);
2654 #endif
2655 		if (pr->pr_cpuset != NULL)
2656 			cpuset_rel(pr->pr_cpuset);
2657 		osd_jail_exit(pr);
2658 #ifdef RACCT
2659 		prison_racct_detach(pr);
2660 #endif
2661 		free(pr, M_PRISON);
2662 
2663 		/* Removing a prison frees a reference on its parent. */
2664 		pr = ppr;
2665 		mtx_lock(&pr->pr_mtx);
2666 		flags = PD_DEREF | PD_DEUREF;
2667 	}
2668 }
2669 
2670 void
2671 prison_hold_locked(struct prison *pr)
2672 {
2673 
2674 	mtx_assert(&pr->pr_mtx, MA_OWNED);
2675 	KASSERT(pr->pr_ref > 0,
2676 	    ("Trying to hold dead prison (jid=%d).", pr->pr_id));
2677 	pr->pr_ref++;
2678 }
2679 
2680 void
2681 prison_hold(struct prison *pr)
2682 {
2683 
2684 	mtx_lock(&pr->pr_mtx);
2685 	prison_hold_locked(pr);
2686 	mtx_unlock(&pr->pr_mtx);
2687 }
2688 
2689 void
2690 prison_proc_hold(struct prison *pr)
2691 {
2692 
2693 	mtx_lock(&pr->pr_mtx);
2694 	KASSERT(pr->pr_uref > 0,
2695 	    ("Cannot add a process to a non-alive prison (jid=%d)", pr->pr_id));
2696 	pr->pr_uref++;
2697 	mtx_unlock(&pr->pr_mtx);
2698 }
2699 
2700 void
2701 prison_proc_free(struct prison *pr)
2702 {
2703 
2704 	mtx_lock(&pr->pr_mtx);
2705 	KASSERT(pr->pr_uref > 0,
2706 	    ("Trying to kill a process in a dead prison (jid=%d)", pr->pr_id));
2707 	prison_deref(pr, PD_DEUREF | PD_LOCKED);
2708 }
2709 
2710 
2711 #ifdef INET
2712 /*
2713  * Restrict a prison's IP address list with its parent's, possibly replacing
2714  * it.  Return true if the replacement buffer was used (or would have been).
2715  */
2716 static int
2717 prison_restrict_ip4(struct prison *pr, struct in_addr *newip4)
2718 {
2719 	int ii, ij, used;
2720 	struct prison *ppr;
2721 
2722 	ppr = pr->pr_parent;
2723 	if (!(pr->pr_flags & PR_IP4_USER)) {
2724 		/* This has no user settings, so just copy the parent's list. */
2725 		if (pr->pr_ip4s < ppr->pr_ip4s) {
2726 			/*
2727 			 * There's no room for the parent's list.  Use the
2728 			 * new list buffer, which is assumed to be big enough
2729 			 * (if it was passed).  If there's no buffer, try to
2730 			 * allocate one.
2731 			 */
2732 			used = 1;
2733 			if (newip4 == NULL) {
2734 				newip4 = malloc(ppr->pr_ip4s * sizeof(*newip4),
2735 				    M_PRISON, M_NOWAIT);
2736 				if (newip4 != NULL)
2737 					used = 0;
2738 			}
2739 			if (newip4 != NULL) {
2740 				bcopy(ppr->pr_ip4, newip4,
2741 				    ppr->pr_ip4s * sizeof(*newip4));
2742 				free(pr->pr_ip4, M_PRISON);
2743 				pr->pr_ip4 = newip4;
2744 				pr->pr_ip4s = ppr->pr_ip4s;
2745 			}
2746 			return (used);
2747 		}
2748 		pr->pr_ip4s = ppr->pr_ip4s;
2749 		if (pr->pr_ip4s > 0)
2750 			bcopy(ppr->pr_ip4, pr->pr_ip4,
2751 			    pr->pr_ip4s * sizeof(*newip4));
2752 		else if (pr->pr_ip4 != NULL) {
2753 			free(pr->pr_ip4, M_PRISON);
2754 			pr->pr_ip4 = NULL;
2755 		}
2756 	} else if (pr->pr_ip4s > 0) {
2757 		/* Remove addresses that aren't in the parent. */
2758 		for (ij = 0; ij < ppr->pr_ip4s; ij++)
2759 			if (pr->pr_ip4[0].s_addr == ppr->pr_ip4[ij].s_addr)
2760 				break;
2761 		if (ij < ppr->pr_ip4s)
2762 			ii = 1;
2763 		else {
2764 			bcopy(pr->pr_ip4 + 1, pr->pr_ip4,
2765 			    --pr->pr_ip4s * sizeof(*pr->pr_ip4));
2766 			ii = 0;
2767 		}
2768 		for (ij = 1; ii < pr->pr_ip4s; ) {
2769 			if (pr->pr_ip4[ii].s_addr == ppr->pr_ip4[0].s_addr) {
2770 				ii++;
2771 				continue;
2772 			}
2773 			switch (ij >= ppr->pr_ip4s ? -1 :
2774 				qcmp_v4(&pr->pr_ip4[ii], &ppr->pr_ip4[ij])) {
2775 			case -1:
2776 				bcopy(pr->pr_ip4 + ii + 1, pr->pr_ip4 + ii,
2777 				    (--pr->pr_ip4s - ii) * sizeof(*pr->pr_ip4));
2778 				break;
2779 			case 0:
2780 				ii++;
2781 				ij++;
2782 				break;
2783 			case 1:
2784 				ij++;
2785 				break;
2786 			}
2787 		}
2788 		if (pr->pr_ip4s == 0) {
2789 			free(pr->pr_ip4, M_PRISON);
2790 			pr->pr_ip4 = NULL;
2791 		}
2792 	}
2793 	return (0);
2794 }
2795 
2796 /*
2797  * Pass back primary IPv4 address of this jail.
2798  *
2799  * If not restricted return success but do not alter the address.  Caller has
2800  * to make sure to initialize it correctly (e.g. INADDR_ANY).
2801  *
2802  * Returns 0 on success, EAFNOSUPPORT if the jail doesn't allow IPv4.
2803  * Address returned in NBO.
2804  */
2805 int
2806 prison_get_ip4(struct ucred *cred, struct in_addr *ia)
2807 {
2808 	struct prison *pr;
2809 
2810 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
2811 	KASSERT(ia != NULL, ("%s: ia is NULL", __func__));
2812 
2813 	pr = cred->cr_prison;
2814 	if (!(pr->pr_flags & PR_IP4))
2815 		return (0);
2816 	mtx_lock(&pr->pr_mtx);
2817 	if (!(pr->pr_flags & PR_IP4)) {
2818 		mtx_unlock(&pr->pr_mtx);
2819 		return (0);
2820 	}
2821 	if (pr->pr_ip4 == NULL) {
2822 		mtx_unlock(&pr->pr_mtx);
2823 		return (EAFNOSUPPORT);
2824 	}
2825 
2826 	ia->s_addr = pr->pr_ip4[0].s_addr;
2827 	mtx_unlock(&pr->pr_mtx);
2828 	return (0);
2829 }
2830 
2831 /*
2832  * Return 1 if we should do proper source address selection or are not jailed.
2833  * We will return 0 if we should bypass source address selection in favour
2834  * of the primary jail IPv4 address. Only in this case *ia will be updated and
2835  * returned in NBO.
2836  * Return EAFNOSUPPORT, in case this jail does not allow IPv4.
2837  */
2838 int
2839 prison_saddrsel_ip4(struct ucred *cred, struct in_addr *ia)
2840 {
2841 	struct prison *pr;
2842 	struct in_addr lia;
2843 	int error;
2844 
2845 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
2846 	KASSERT(ia != NULL, ("%s: ia is NULL", __func__));
2847 
2848 	if (!jailed(cred))
2849 		return (1);
2850 
2851 	pr = cred->cr_prison;
2852 	if (pr->pr_flags & PR_IP4_SADDRSEL)
2853 		return (1);
2854 
2855 	lia.s_addr = INADDR_ANY;
2856 	error = prison_get_ip4(cred, &lia);
2857 	if (error)
2858 		return (error);
2859 	if (lia.s_addr == INADDR_ANY)
2860 		return (1);
2861 
2862 	ia->s_addr = lia.s_addr;
2863 	return (0);
2864 }
2865 
2866 /*
2867  * Return true if pr1 and pr2 have the same IPv4 address restrictions.
2868  */
2869 int
2870 prison_equal_ip4(struct prison *pr1, struct prison *pr2)
2871 {
2872 
2873 	if (pr1 == pr2)
2874 		return (1);
2875 
2876 	/*
2877 	 * No need to lock since the PR_IP4_USER flag can't be altered for
2878 	 * existing prisons.
2879 	 */
2880 	while (pr1 != &prison0 &&
2881 #ifdef VIMAGE
2882 	       !(pr1->pr_flags & PR_VNET) &&
2883 #endif
2884 	       !(pr1->pr_flags & PR_IP4_USER))
2885 		pr1 = pr1->pr_parent;
2886 	while (pr2 != &prison0 &&
2887 #ifdef VIMAGE
2888 	       !(pr2->pr_flags & PR_VNET) &&
2889 #endif
2890 	       !(pr2->pr_flags & PR_IP4_USER))
2891 		pr2 = pr2->pr_parent;
2892 	return (pr1 == pr2);
2893 }
2894 
2895 /*
2896  * Make sure our (source) address is set to something meaningful to this
2897  * jail.
2898  *
2899  * Returns 0 if jail doesn't restrict IPv4 or if address belongs to jail,
2900  * EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if the jail
2901  * doesn't allow IPv4.  Address passed in in NBO and returned in NBO.
2902  */
2903 int
2904 prison_local_ip4(struct ucred *cred, struct in_addr *ia)
2905 {
2906 	struct prison *pr;
2907 	struct in_addr ia0;
2908 	int error;
2909 
2910 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
2911 	KASSERT(ia != NULL, ("%s: ia is NULL", __func__));
2912 
2913 	pr = cred->cr_prison;
2914 	if (!(pr->pr_flags & PR_IP4))
2915 		return (0);
2916 	mtx_lock(&pr->pr_mtx);
2917 	if (!(pr->pr_flags & PR_IP4)) {
2918 		mtx_unlock(&pr->pr_mtx);
2919 		return (0);
2920 	}
2921 	if (pr->pr_ip4 == NULL) {
2922 		mtx_unlock(&pr->pr_mtx);
2923 		return (EAFNOSUPPORT);
2924 	}
2925 
2926 	ia0.s_addr = ntohl(ia->s_addr);
2927 	if (ia0.s_addr == INADDR_LOOPBACK) {
2928 		ia->s_addr = pr->pr_ip4[0].s_addr;
2929 		mtx_unlock(&pr->pr_mtx);
2930 		return (0);
2931 	}
2932 
2933 	if (ia0.s_addr == INADDR_ANY) {
2934 		/*
2935 		 * In case there is only 1 IPv4 address, bind directly.
2936 		 */
2937 		if (pr->pr_ip4s == 1)
2938 			ia->s_addr = pr->pr_ip4[0].s_addr;
2939 		mtx_unlock(&pr->pr_mtx);
2940 		return (0);
2941 	}
2942 
2943 	error = _prison_check_ip4(pr, ia);
2944 	mtx_unlock(&pr->pr_mtx);
2945 	return (error);
2946 }
2947 
2948 /*
2949  * Rewrite destination address in case we will connect to loopback address.
2950  *
2951  * Returns 0 on success, EAFNOSUPPORT if the jail doesn't allow IPv4.
2952  * Address passed in in NBO and returned in NBO.
2953  */
2954 int
2955 prison_remote_ip4(struct ucred *cred, struct in_addr *ia)
2956 {
2957 	struct prison *pr;
2958 
2959 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
2960 	KASSERT(ia != NULL, ("%s: ia is NULL", __func__));
2961 
2962 	pr = cred->cr_prison;
2963 	if (!(pr->pr_flags & PR_IP4))
2964 		return (0);
2965 	mtx_lock(&pr->pr_mtx);
2966 	if (!(pr->pr_flags & PR_IP4)) {
2967 		mtx_unlock(&pr->pr_mtx);
2968 		return (0);
2969 	}
2970 	if (pr->pr_ip4 == NULL) {
2971 		mtx_unlock(&pr->pr_mtx);
2972 		return (EAFNOSUPPORT);
2973 	}
2974 
2975 	if (ntohl(ia->s_addr) == INADDR_LOOPBACK) {
2976 		ia->s_addr = pr->pr_ip4[0].s_addr;
2977 		mtx_unlock(&pr->pr_mtx);
2978 		return (0);
2979 	}
2980 
2981 	/*
2982 	 * Return success because nothing had to be changed.
2983 	 */
2984 	mtx_unlock(&pr->pr_mtx);
2985 	return (0);
2986 }
2987 
2988 /*
2989  * Check if given address belongs to the jail referenced by cred/prison.
2990  *
2991  * Returns 0 if jail doesn't restrict IPv4 or if address belongs to jail,
2992  * EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if the jail
2993  * doesn't allow IPv4.  Address passed in in NBO.
2994  */
2995 static int
2996 _prison_check_ip4(const struct prison *pr, const struct in_addr *ia)
2997 {
2998 	int i, a, z, d;
2999 
3000 	/*
3001 	 * Check the primary IP.
3002 	 */
3003 	if (pr->pr_ip4[0].s_addr == ia->s_addr)
3004 		return (0);
3005 
3006 	/*
3007 	 * All the other IPs are sorted so we can do a binary search.
3008 	 */
3009 	a = 0;
3010 	z = pr->pr_ip4s - 2;
3011 	while (a <= z) {
3012 		i = (a + z) / 2;
3013 		d = qcmp_v4(&pr->pr_ip4[i+1], ia);
3014 		if (d > 0)
3015 			z = i - 1;
3016 		else if (d < 0)
3017 			a = i + 1;
3018 		else
3019 			return (0);
3020 	}
3021 
3022 	return (EADDRNOTAVAIL);
3023 }
3024 
3025 int
3026 prison_check_ip4(const struct ucred *cred, const struct in_addr *ia)
3027 {
3028 	struct prison *pr;
3029 	int error;
3030 
3031 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
3032 	KASSERT(ia != NULL, ("%s: ia is NULL", __func__));
3033 
3034 	pr = cred->cr_prison;
3035 	if (!(pr->pr_flags & PR_IP4))
3036 		return (0);
3037 	mtx_lock(&pr->pr_mtx);
3038 	if (!(pr->pr_flags & PR_IP4)) {
3039 		mtx_unlock(&pr->pr_mtx);
3040 		return (0);
3041 	}
3042 	if (pr->pr_ip4 == NULL) {
3043 		mtx_unlock(&pr->pr_mtx);
3044 		return (EAFNOSUPPORT);
3045 	}
3046 
3047 	error = _prison_check_ip4(pr, ia);
3048 	mtx_unlock(&pr->pr_mtx);
3049 	return (error);
3050 }
3051 #endif
3052 
3053 #ifdef INET6
3054 static int
3055 prison_restrict_ip6(struct prison *pr, struct in6_addr *newip6)
3056 {
3057 	int ii, ij, used;
3058 	struct prison *ppr;
3059 
3060 	ppr = pr->pr_parent;
3061 	if (!(pr->pr_flags & PR_IP6_USER)) {
3062 		/* This has no user settings, so just copy the parent's list. */
3063 		if (pr->pr_ip6s < ppr->pr_ip6s) {
3064 			/*
3065 			 * There's no room for the parent's list.  Use the
3066 			 * new list buffer, which is assumed to be big enough
3067 			 * (if it was passed).  If there's no buffer, try to
3068 			 * allocate one.
3069 			 */
3070 			used = 1;
3071 			if (newip6 == NULL) {
3072 				newip6 = malloc(ppr->pr_ip6s * sizeof(*newip6),
3073 				    M_PRISON, M_NOWAIT);
3074 				if (newip6 != NULL)
3075 					used = 0;
3076 			}
3077 			if (newip6 != NULL) {
3078 				bcopy(ppr->pr_ip6, newip6,
3079 				    ppr->pr_ip6s * sizeof(*newip6));
3080 				free(pr->pr_ip6, M_PRISON);
3081 				pr->pr_ip6 = newip6;
3082 				pr->pr_ip6s = ppr->pr_ip6s;
3083 			}
3084 			return (used);
3085 		}
3086 		pr->pr_ip6s = ppr->pr_ip6s;
3087 		if (pr->pr_ip6s > 0)
3088 			bcopy(ppr->pr_ip6, pr->pr_ip6,
3089 			    pr->pr_ip6s * sizeof(*newip6));
3090 		else if (pr->pr_ip6 != NULL) {
3091 			free(pr->pr_ip6, M_PRISON);
3092 			pr->pr_ip6 = NULL;
3093 		}
3094 	} else if (pr->pr_ip6s > 0) {
3095 		/* Remove addresses that aren't in the parent. */
3096 		for (ij = 0; ij < ppr->pr_ip6s; ij++)
3097 			if (IN6_ARE_ADDR_EQUAL(&pr->pr_ip6[0],
3098 			    &ppr->pr_ip6[ij]))
3099 				break;
3100 		if (ij < ppr->pr_ip6s)
3101 			ii = 1;
3102 		else {
3103 			bcopy(pr->pr_ip6 + 1, pr->pr_ip6,
3104 			    --pr->pr_ip6s * sizeof(*pr->pr_ip6));
3105 			ii = 0;
3106 		}
3107 		for (ij = 1; ii < pr->pr_ip6s; ) {
3108 			if (IN6_ARE_ADDR_EQUAL(&pr->pr_ip6[ii],
3109 			    &ppr->pr_ip6[0])) {
3110 				ii++;
3111 				continue;
3112 			}
3113 			switch (ij >= ppr->pr_ip6s ? -1 :
3114 				qcmp_v6(&pr->pr_ip6[ii], &ppr->pr_ip6[ij])) {
3115 			case -1:
3116 				bcopy(pr->pr_ip6 + ii + 1, pr->pr_ip6 + ii,
3117 				    (--pr->pr_ip6s - ii) * sizeof(*pr->pr_ip6));
3118 				break;
3119 			case 0:
3120 				ii++;
3121 				ij++;
3122 				break;
3123 			case 1:
3124 				ij++;
3125 				break;
3126 			}
3127 		}
3128 		if (pr->pr_ip6s == 0) {
3129 			free(pr->pr_ip6, M_PRISON);
3130 			pr->pr_ip6 = NULL;
3131 		}
3132 	}
3133 	return 0;
3134 }
3135 
3136 /*
3137  * Pass back primary IPv6 address for this jail.
3138  *
3139  * If not restricted return success but do not alter the address.  Caller has
3140  * to make sure to initialize it correctly (e.g. IN6ADDR_ANY_INIT).
3141  *
3142  * Returns 0 on success, EAFNOSUPPORT if the jail doesn't allow IPv6.
3143  */
3144 int
3145 prison_get_ip6(struct ucred *cred, struct in6_addr *ia6)
3146 {
3147 	struct prison *pr;
3148 
3149 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
3150 	KASSERT(ia6 != NULL, ("%s: ia6 is NULL", __func__));
3151 
3152 	pr = cred->cr_prison;
3153 	if (!(pr->pr_flags & PR_IP6))
3154 		return (0);
3155 	mtx_lock(&pr->pr_mtx);
3156 	if (!(pr->pr_flags & PR_IP6)) {
3157 		mtx_unlock(&pr->pr_mtx);
3158 		return (0);
3159 	}
3160 	if (pr->pr_ip6 == NULL) {
3161 		mtx_unlock(&pr->pr_mtx);
3162 		return (EAFNOSUPPORT);
3163 	}
3164 
3165 	bcopy(&pr->pr_ip6[0], ia6, sizeof(struct in6_addr));
3166 	mtx_unlock(&pr->pr_mtx);
3167 	return (0);
3168 }
3169 
3170 /*
3171  * Return 1 if we should do proper source address selection or are not jailed.
3172  * We will return 0 if we should bypass source address selection in favour
3173  * of the primary jail IPv6 address. Only in this case *ia will be updated and
3174  * returned in NBO.
3175  * Return EAFNOSUPPORT, in case this jail does not allow IPv6.
3176  */
3177 int
3178 prison_saddrsel_ip6(struct ucred *cred, struct in6_addr *ia6)
3179 {
3180 	struct prison *pr;
3181 	struct in6_addr lia6;
3182 	int error;
3183 
3184 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
3185 	KASSERT(ia6 != NULL, ("%s: ia6 is NULL", __func__));
3186 
3187 	if (!jailed(cred))
3188 		return (1);
3189 
3190 	pr = cred->cr_prison;
3191 	if (pr->pr_flags & PR_IP6_SADDRSEL)
3192 		return (1);
3193 
3194 	lia6 = in6addr_any;
3195 	error = prison_get_ip6(cred, &lia6);
3196 	if (error)
3197 		return (error);
3198 	if (IN6_IS_ADDR_UNSPECIFIED(&lia6))
3199 		return (1);
3200 
3201 	bcopy(&lia6, ia6, sizeof(struct in6_addr));
3202 	return (0);
3203 }
3204 
3205 /*
3206  * Return true if pr1 and pr2 have the same IPv6 address restrictions.
3207  */
3208 int
3209 prison_equal_ip6(struct prison *pr1, struct prison *pr2)
3210 {
3211 
3212 	if (pr1 == pr2)
3213 		return (1);
3214 
3215 	while (pr1 != &prison0 &&
3216 #ifdef VIMAGE
3217 	       !(pr1->pr_flags & PR_VNET) &&
3218 #endif
3219 	       !(pr1->pr_flags & PR_IP6_USER))
3220 		pr1 = pr1->pr_parent;
3221 	while (pr2 != &prison0 &&
3222 #ifdef VIMAGE
3223 	       !(pr2->pr_flags & PR_VNET) &&
3224 #endif
3225 	       !(pr2->pr_flags & PR_IP6_USER))
3226 		pr2 = pr2->pr_parent;
3227 	return (pr1 == pr2);
3228 }
3229 
3230 /*
3231  * Make sure our (source) address is set to something meaningful to this jail.
3232  *
3233  * v6only should be set based on (inp->inp_flags & IN6P_IPV6_V6ONLY != 0)
3234  * when needed while binding.
3235  *
3236  * Returns 0 if jail doesn't restrict IPv6 or if address belongs to jail,
3237  * EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if the jail
3238  * doesn't allow IPv6.
3239  */
3240 int
3241 prison_local_ip6(struct ucred *cred, struct in6_addr *ia6, int v6only)
3242 {
3243 	struct prison *pr;
3244 	int error;
3245 
3246 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
3247 	KASSERT(ia6 != NULL, ("%s: ia6 is NULL", __func__));
3248 
3249 	pr = cred->cr_prison;
3250 	if (!(pr->pr_flags & PR_IP6))
3251 		return (0);
3252 	mtx_lock(&pr->pr_mtx);
3253 	if (!(pr->pr_flags & PR_IP6)) {
3254 		mtx_unlock(&pr->pr_mtx);
3255 		return (0);
3256 	}
3257 	if (pr->pr_ip6 == NULL) {
3258 		mtx_unlock(&pr->pr_mtx);
3259 		return (EAFNOSUPPORT);
3260 	}
3261 
3262 	if (IN6_IS_ADDR_LOOPBACK(ia6)) {
3263 		bcopy(&pr->pr_ip6[0], ia6, sizeof(struct in6_addr));
3264 		mtx_unlock(&pr->pr_mtx);
3265 		return (0);
3266 	}
3267 
3268 	if (IN6_IS_ADDR_UNSPECIFIED(ia6)) {
3269 		/*
3270 		 * In case there is only 1 IPv6 address, and v6only is true,
3271 		 * then bind directly.
3272 		 */
3273 		if (v6only != 0 && pr->pr_ip6s == 1)
3274 			bcopy(&pr->pr_ip6[0], ia6, sizeof(struct in6_addr));
3275 		mtx_unlock(&pr->pr_mtx);
3276 		return (0);
3277 	}
3278 
3279 	error = _prison_check_ip6(pr, ia6);
3280 	mtx_unlock(&pr->pr_mtx);
3281 	return (error);
3282 }
3283 
3284 /*
3285  * Rewrite destination address in case we will connect to loopback address.
3286  *
3287  * Returns 0 on success, EAFNOSUPPORT if the jail doesn't allow IPv6.
3288  */
3289 int
3290 prison_remote_ip6(struct ucred *cred, struct in6_addr *ia6)
3291 {
3292 	struct prison *pr;
3293 
3294 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
3295 	KASSERT(ia6 != NULL, ("%s: ia6 is NULL", __func__));
3296 
3297 	pr = cred->cr_prison;
3298 	if (!(pr->pr_flags & PR_IP6))
3299 		return (0);
3300 	mtx_lock(&pr->pr_mtx);
3301 	if (!(pr->pr_flags & PR_IP6)) {
3302 		mtx_unlock(&pr->pr_mtx);
3303 		return (0);
3304 	}
3305 	if (pr->pr_ip6 == NULL) {
3306 		mtx_unlock(&pr->pr_mtx);
3307 		return (EAFNOSUPPORT);
3308 	}
3309 
3310 	if (IN6_IS_ADDR_LOOPBACK(ia6)) {
3311 		bcopy(&pr->pr_ip6[0], ia6, sizeof(struct in6_addr));
3312 		mtx_unlock(&pr->pr_mtx);
3313 		return (0);
3314 	}
3315 
3316 	/*
3317 	 * Return success because nothing had to be changed.
3318 	 */
3319 	mtx_unlock(&pr->pr_mtx);
3320 	return (0);
3321 }
3322 
3323 /*
3324  * Check if given address belongs to the jail referenced by cred/prison.
3325  *
3326  * Returns 0 if jail doesn't restrict IPv6 or if address belongs to jail,
3327  * EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if the jail
3328  * doesn't allow IPv6.
3329  */
3330 static int
3331 _prison_check_ip6(struct prison *pr, struct in6_addr *ia6)
3332 {
3333 	int i, a, z, d;
3334 
3335 	/*
3336 	 * Check the primary IP.
3337 	 */
3338 	if (IN6_ARE_ADDR_EQUAL(&pr->pr_ip6[0], ia6))
3339 		return (0);
3340 
3341 	/*
3342 	 * All the other IPs are sorted so we can do a binary search.
3343 	 */
3344 	a = 0;
3345 	z = pr->pr_ip6s - 2;
3346 	while (a <= z) {
3347 		i = (a + z) / 2;
3348 		d = qcmp_v6(&pr->pr_ip6[i+1], ia6);
3349 		if (d > 0)
3350 			z = i - 1;
3351 		else if (d < 0)
3352 			a = i + 1;
3353 		else
3354 			return (0);
3355 	}
3356 
3357 	return (EADDRNOTAVAIL);
3358 }
3359 
3360 int
3361 prison_check_ip6(struct ucred *cred, struct in6_addr *ia6)
3362 {
3363 	struct prison *pr;
3364 	int error;
3365 
3366 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
3367 	KASSERT(ia6 != NULL, ("%s: ia6 is NULL", __func__));
3368 
3369 	pr = cred->cr_prison;
3370 	if (!(pr->pr_flags & PR_IP6))
3371 		return (0);
3372 	mtx_lock(&pr->pr_mtx);
3373 	if (!(pr->pr_flags & PR_IP6)) {
3374 		mtx_unlock(&pr->pr_mtx);
3375 		return (0);
3376 	}
3377 	if (pr->pr_ip6 == NULL) {
3378 		mtx_unlock(&pr->pr_mtx);
3379 		return (EAFNOSUPPORT);
3380 	}
3381 
3382 	error = _prison_check_ip6(pr, ia6);
3383 	mtx_unlock(&pr->pr_mtx);
3384 	return (error);
3385 }
3386 #endif
3387 
3388 /*
3389  * Check if a jail supports the given address family.
3390  *
3391  * Returns 0 if not jailed or the address family is supported, EAFNOSUPPORT
3392  * if not.
3393  */
3394 int
3395 prison_check_af(struct ucred *cred, int af)
3396 {
3397 	struct prison *pr;
3398 	int error;
3399 
3400 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
3401 
3402 	pr = cred->cr_prison;
3403 #ifdef VIMAGE
3404 	/* Prisons with their own network stack are not limited. */
3405 	if (prison_owns_vnet(cred))
3406 		return (0);
3407 #endif
3408 
3409 	error = 0;
3410 	switch (af)
3411 	{
3412 #ifdef INET
3413 	case AF_INET:
3414 		if (pr->pr_flags & PR_IP4)
3415 		{
3416 			mtx_lock(&pr->pr_mtx);
3417 			if ((pr->pr_flags & PR_IP4) && pr->pr_ip4 == NULL)
3418 				error = EAFNOSUPPORT;
3419 			mtx_unlock(&pr->pr_mtx);
3420 		}
3421 		break;
3422 #endif
3423 #ifdef INET6
3424 	case AF_INET6:
3425 		if (pr->pr_flags & PR_IP6)
3426 		{
3427 			mtx_lock(&pr->pr_mtx);
3428 			if ((pr->pr_flags & PR_IP6) && pr->pr_ip6 == NULL)
3429 				error = EAFNOSUPPORT;
3430 			mtx_unlock(&pr->pr_mtx);
3431 		}
3432 		break;
3433 #endif
3434 	case AF_LOCAL:
3435 	case AF_ROUTE:
3436 		break;
3437 	default:
3438 		if (!(pr->pr_allow & PR_ALLOW_SOCKET_AF))
3439 			error = EAFNOSUPPORT;
3440 	}
3441 	return (error);
3442 }
3443 
3444 /*
3445  * Check if given address belongs to the jail referenced by cred (wrapper to
3446  * prison_check_ip[46]).
3447  *
3448  * Returns 0 if jail doesn't restrict the address family or if address belongs
3449  * to jail, EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if
3450  * the jail doesn't allow the address family.  IPv4 Address passed in in NBO.
3451  */
3452 int
3453 prison_if(struct ucred *cred, struct sockaddr *sa)
3454 {
3455 #ifdef INET
3456 	struct sockaddr_in *sai;
3457 #endif
3458 #ifdef INET6
3459 	struct sockaddr_in6 *sai6;
3460 #endif
3461 	int error;
3462 
3463 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
3464 	KASSERT(sa != NULL, ("%s: sa is NULL", __func__));
3465 
3466 #ifdef VIMAGE
3467 	if (prison_owns_vnet(cred))
3468 		return (0);
3469 #endif
3470 
3471 	error = 0;
3472 	switch (sa->sa_family)
3473 	{
3474 #ifdef INET
3475 	case AF_INET:
3476 		sai = (struct sockaddr_in *)sa;
3477 		error = prison_check_ip4(cred, &sai->sin_addr);
3478 		break;
3479 #endif
3480 #ifdef INET6
3481 	case AF_INET6:
3482 		sai6 = (struct sockaddr_in6 *)sa;
3483 		error = prison_check_ip6(cred, &sai6->sin6_addr);
3484 		break;
3485 #endif
3486 	default:
3487 		if (!(cred->cr_prison->pr_allow & PR_ALLOW_SOCKET_AF))
3488 			error = EAFNOSUPPORT;
3489 	}
3490 	return (error);
3491 }
3492 
3493 /*
3494  * Return 0 if jails permit p1 to frob p2, otherwise ESRCH.
3495  */
3496 int
3497 prison_check(struct ucred *cred1, struct ucred *cred2)
3498 {
3499 
3500 	return ((cred1->cr_prison == cred2->cr_prison ||
3501 	    prison_ischild(cred1->cr_prison, cred2->cr_prison)) ? 0 : ESRCH);
3502 }
3503 
3504 /*
3505  * Return 1 if p2 is a child of p1, otherwise 0.
3506  */
3507 int
3508 prison_ischild(struct prison *pr1, struct prison *pr2)
3509 {
3510 
3511 	for (pr2 = pr2->pr_parent; pr2 != NULL; pr2 = pr2->pr_parent)
3512 		if (pr1 == pr2)
3513 			return (1);
3514 	return (0);
3515 }
3516 
3517 /*
3518  * Return 1 if the passed credential is in a jail, otherwise 0.
3519  */
3520 int
3521 jailed(struct ucred *cred)
3522 {
3523 
3524 	return (cred->cr_prison != &prison0);
3525 }
3526 
3527 /*
3528  * Return 1 if the passed credential is in a jail and that jail does not
3529  * have its own virtual network stack, otherwise 0.
3530  */
3531 int
3532 jailed_without_vnet(struct ucred *cred)
3533 {
3534 
3535 	if (!jailed(cred))
3536 		return (0);
3537 #ifdef VIMAGE
3538 	if (prison_owns_vnet(cred))
3539 		return (0);
3540 #endif
3541 
3542 	return (1);
3543 }
3544 
3545 /*
3546  * Return the correct hostname (domainname, et al) for the passed credential.
3547  */
3548 void
3549 getcredhostname(struct ucred *cred, char *buf, size_t size)
3550 {
3551 	struct prison *pr;
3552 
3553 	/*
3554 	 * A NULL credential can be used to shortcut to the physical
3555 	 * system's hostname.
3556 	 */
3557 	pr = (cred != NULL) ? cred->cr_prison : &prison0;
3558 	mtx_lock(&pr->pr_mtx);
3559 	strlcpy(buf, pr->pr_hostname, size);
3560 	mtx_unlock(&pr->pr_mtx);
3561 }
3562 
3563 void
3564 getcreddomainname(struct ucred *cred, char *buf, size_t size)
3565 {
3566 
3567 	mtx_lock(&cred->cr_prison->pr_mtx);
3568 	strlcpy(buf, cred->cr_prison->pr_domainname, size);
3569 	mtx_unlock(&cred->cr_prison->pr_mtx);
3570 }
3571 
3572 void
3573 getcredhostuuid(struct ucred *cred, char *buf, size_t size)
3574 {
3575 
3576 	mtx_lock(&cred->cr_prison->pr_mtx);
3577 	strlcpy(buf, cred->cr_prison->pr_hostuuid, size);
3578 	mtx_unlock(&cred->cr_prison->pr_mtx);
3579 }
3580 
3581 void
3582 getcredhostid(struct ucred *cred, unsigned long *hostid)
3583 {
3584 
3585 	mtx_lock(&cred->cr_prison->pr_mtx);
3586 	*hostid = cred->cr_prison->pr_hostid;
3587 	mtx_unlock(&cred->cr_prison->pr_mtx);
3588 }
3589 
3590 #ifdef VIMAGE
3591 /*
3592  * Determine whether the prison represented by cred owns
3593  * its vnet rather than having it inherited.
3594  *
3595  * Returns 1 in case the prison owns the vnet, 0 otherwise.
3596  */
3597 int
3598 prison_owns_vnet(struct ucred *cred)
3599 {
3600 
3601 	/*
3602 	 * vnets cannot be added/removed after jail creation,
3603 	 * so no need to lock here.
3604 	 */
3605 	return (cred->cr_prison->pr_flags & PR_VNET ? 1 : 0);
3606 }
3607 #endif
3608 
3609 /*
3610  * Determine whether the subject represented by cred can "see"
3611  * status of a mount point.
3612  * Returns: 0 for permitted, ENOENT otherwise.
3613  * XXX: This function should be called cr_canseemount() and should be
3614  *      placed in kern_prot.c.
3615  */
3616 int
3617 prison_canseemount(struct ucred *cred, struct mount *mp)
3618 {
3619 	struct prison *pr;
3620 	struct statfs *sp;
3621 	size_t len;
3622 
3623 	pr = cred->cr_prison;
3624 	if (pr->pr_enforce_statfs == 0)
3625 		return (0);
3626 	if (pr->pr_root->v_mount == mp)
3627 		return (0);
3628 	if (pr->pr_enforce_statfs == 2)
3629 		return (ENOENT);
3630 	/*
3631 	 * If jail's chroot directory is set to "/" we should be able to see
3632 	 * all mount-points from inside a jail.
3633 	 * This is ugly check, but this is the only situation when jail's
3634 	 * directory ends with '/'.
3635 	 */
3636 	if (strcmp(pr->pr_path, "/") == 0)
3637 		return (0);
3638 	len = strlen(pr->pr_path);
3639 	sp = &mp->mnt_stat;
3640 	if (strncmp(pr->pr_path, sp->f_mntonname, len) != 0)
3641 		return (ENOENT);
3642 	/*
3643 	 * Be sure that we don't have situation where jail's root directory
3644 	 * is "/some/path" and mount point is "/some/pathpath".
3645 	 */
3646 	if (sp->f_mntonname[len] != '\0' && sp->f_mntonname[len] != '/')
3647 		return (ENOENT);
3648 	return (0);
3649 }
3650 
3651 void
3652 prison_enforce_statfs(struct ucred *cred, struct mount *mp, struct statfs *sp)
3653 {
3654 	char jpath[MAXPATHLEN];
3655 	struct prison *pr;
3656 	size_t len;
3657 
3658 	pr = cred->cr_prison;
3659 	if (pr->pr_enforce_statfs == 0)
3660 		return;
3661 	if (prison_canseemount(cred, mp) != 0) {
3662 		bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
3663 		strlcpy(sp->f_mntonname, "[restricted]",
3664 		    sizeof(sp->f_mntonname));
3665 		return;
3666 	}
3667 	if (pr->pr_root->v_mount == mp) {
3668 		/*
3669 		 * Clear current buffer data, so we are sure nothing from
3670 		 * the valid path left there.
3671 		 */
3672 		bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
3673 		*sp->f_mntonname = '/';
3674 		return;
3675 	}
3676 	/*
3677 	 * If jail's chroot directory is set to "/" we should be able to see
3678 	 * all mount-points from inside a jail.
3679 	 */
3680 	if (strcmp(pr->pr_path, "/") == 0)
3681 		return;
3682 	len = strlen(pr->pr_path);
3683 	strlcpy(jpath, sp->f_mntonname + len, sizeof(jpath));
3684 	/*
3685 	 * Clear current buffer data, so we are sure nothing from
3686 	 * the valid path left there.
3687 	 */
3688 	bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
3689 	if (*jpath == '\0') {
3690 		/* Should never happen. */
3691 		*sp->f_mntonname = '/';
3692 	} else {
3693 		strlcpy(sp->f_mntonname, jpath, sizeof(sp->f_mntonname));
3694 	}
3695 }
3696 
3697 /*
3698  * Check with permission for a specific privilege is granted within jail.  We
3699  * have a specific list of accepted privileges; the rest are denied.
3700  */
3701 int
3702 prison_priv_check(struct ucred *cred, int priv)
3703 {
3704 
3705 	if (!jailed(cred))
3706 		return (0);
3707 
3708 #ifdef VIMAGE
3709 	/*
3710 	 * Privileges specific to prisons with a virtual network stack.
3711 	 * There might be a duplicate entry here in case the privilege
3712 	 * is only granted conditionally in the legacy jail case.
3713 	 */
3714 	switch (priv) {
3715 #ifdef notyet
3716 		/*
3717 		 * NFS-specific privileges.
3718 		 */
3719 	case PRIV_NFS_DAEMON:
3720 	case PRIV_NFS_LOCKD:
3721 #endif
3722 		/*
3723 		 * Network stack privileges.
3724 		 */
3725 	case PRIV_NET_BRIDGE:
3726 	case PRIV_NET_GRE:
3727 	case PRIV_NET_BPF:
3728 	case PRIV_NET_RAW:		/* Dup, cond. in legacy jail case. */
3729 	case PRIV_NET_ROUTE:
3730 	case PRIV_NET_TAP:
3731 	case PRIV_NET_SETIFMTU:
3732 	case PRIV_NET_SETIFFLAGS:
3733 	case PRIV_NET_SETIFCAP:
3734 	case PRIV_NET_SETIFDESCR:
3735 	case PRIV_NET_SETIFNAME	:
3736 	case PRIV_NET_SETIFMETRIC:
3737 	case PRIV_NET_SETIFPHYS:
3738 	case PRIV_NET_SETIFMAC:
3739 	case PRIV_NET_ADDMULTI:
3740 	case PRIV_NET_DELMULTI:
3741 	case PRIV_NET_HWIOCTL:
3742 	case PRIV_NET_SETLLADDR:
3743 	case PRIV_NET_ADDIFGROUP:
3744 	case PRIV_NET_DELIFGROUP:
3745 	case PRIV_NET_IFCREATE:
3746 	case PRIV_NET_IFDESTROY:
3747 	case PRIV_NET_ADDIFADDR:
3748 	case PRIV_NET_DELIFADDR:
3749 	case PRIV_NET_LAGG:
3750 	case PRIV_NET_GIF:
3751 	case PRIV_NET_SETIFVNET:
3752 	case PRIV_NET_SETIFFIB:
3753 
3754 		/*
3755 		 * 802.11-related privileges.
3756 		 */
3757 	case PRIV_NET80211_GETKEY:
3758 #ifdef notyet
3759 	case PRIV_NET80211_MANAGE:		/* XXX-BZ discuss with sam@ */
3760 #endif
3761 
3762 #ifdef notyet
3763 		/*
3764 		 * ATM privileges.
3765 		 */
3766 	case PRIV_NETATM_CFG:
3767 	case PRIV_NETATM_ADD:
3768 	case PRIV_NETATM_DEL:
3769 	case PRIV_NETATM_SET:
3770 
3771 		/*
3772 		 * Bluetooth privileges.
3773 		 */
3774 	case PRIV_NETBLUETOOTH_RAW:
3775 #endif
3776 
3777 		/*
3778 		 * Netgraph and netgraph module privileges.
3779 		 */
3780 	case PRIV_NETGRAPH_CONTROL:
3781 #ifdef notyet
3782 	case PRIV_NETGRAPH_TTY:
3783 #endif
3784 
3785 		/*
3786 		 * IPv4 and IPv6 privileges.
3787 		 */
3788 	case PRIV_NETINET_IPFW:
3789 	case PRIV_NETINET_DIVERT:
3790 	case PRIV_NETINET_PF:
3791 	case PRIV_NETINET_DUMMYNET:
3792 	case PRIV_NETINET_CARP:
3793 	case PRIV_NETINET_MROUTE:
3794 	case PRIV_NETINET_RAW:
3795 	case PRIV_NETINET_ADDRCTRL6:
3796 	case PRIV_NETINET_ND6:
3797 	case PRIV_NETINET_SCOPE6:
3798 	case PRIV_NETINET_ALIFETIME6:
3799 	case PRIV_NETINET_IPSEC:
3800 	case PRIV_NETINET_BINDANY:
3801 
3802 #ifdef notyet
3803 		/*
3804 		 * NCP privileges.
3805 		 */
3806 	case PRIV_NETNCP:
3807 
3808 		/*
3809 		 * SMB privileges.
3810 		 */
3811 	case PRIV_NETSMB:
3812 #endif
3813 
3814 	/*
3815 	 * No default: or deny here.
3816 	 * In case of no permit fall through to next switch().
3817 	 */
3818 		if (cred->cr_prison->pr_flags & PR_VNET)
3819 			return (0);
3820 	}
3821 #endif /* VIMAGE */
3822 
3823 	switch (priv) {
3824 
3825 		/*
3826 		 * Allow ktrace privileges for root in jail.
3827 		 */
3828 	case PRIV_KTRACE:
3829 
3830 #if 0
3831 		/*
3832 		 * Allow jailed processes to configure audit identity and
3833 		 * submit audit records (login, etc).  In the future we may
3834 		 * want to further refine the relationship between audit and
3835 		 * jail.
3836 		 */
3837 	case PRIV_AUDIT_GETAUDIT:
3838 	case PRIV_AUDIT_SETAUDIT:
3839 	case PRIV_AUDIT_SUBMIT:
3840 #endif
3841 
3842 		/*
3843 		 * Allow jailed processes to manipulate process UNIX
3844 		 * credentials in any way they see fit.
3845 		 */
3846 	case PRIV_CRED_SETUID:
3847 	case PRIV_CRED_SETEUID:
3848 	case PRIV_CRED_SETGID:
3849 	case PRIV_CRED_SETEGID:
3850 	case PRIV_CRED_SETGROUPS:
3851 	case PRIV_CRED_SETREUID:
3852 	case PRIV_CRED_SETREGID:
3853 	case PRIV_CRED_SETRESUID:
3854 	case PRIV_CRED_SETRESGID:
3855 
3856 		/*
3857 		 * Jail implements visibility constraints already, so allow
3858 		 * jailed root to override uid/gid-based constraints.
3859 		 */
3860 	case PRIV_SEEOTHERGIDS:
3861 	case PRIV_SEEOTHERUIDS:
3862 
3863 		/*
3864 		 * Jail implements inter-process debugging limits already, so
3865 		 * allow jailed root various debugging privileges.
3866 		 */
3867 	case PRIV_DEBUG_DIFFCRED:
3868 	case PRIV_DEBUG_SUGID:
3869 	case PRIV_DEBUG_UNPRIV:
3870 
3871 		/*
3872 		 * Allow jail to set various resource limits and login
3873 		 * properties, and for now, exceed process resource limits.
3874 		 */
3875 	case PRIV_PROC_LIMIT:
3876 	case PRIV_PROC_SETLOGIN:
3877 	case PRIV_PROC_SETRLIMIT:
3878 
3879 		/*
3880 		 * System V and POSIX IPC privileges are granted in jail.
3881 		 */
3882 	case PRIV_IPC_READ:
3883 	case PRIV_IPC_WRITE:
3884 	case PRIV_IPC_ADMIN:
3885 	case PRIV_IPC_MSGSIZE:
3886 	case PRIV_MQ_ADMIN:
3887 
3888 		/*
3889 		 * Jail operations within a jail work on child jails.
3890 		 */
3891 	case PRIV_JAIL_ATTACH:
3892 	case PRIV_JAIL_SET:
3893 	case PRIV_JAIL_REMOVE:
3894 
3895 		/*
3896 		 * Jail implements its own inter-process limits, so allow
3897 		 * root processes in jail to change scheduling on other
3898 		 * processes in the same jail.  Likewise for signalling.
3899 		 */
3900 	case PRIV_SCHED_DIFFCRED:
3901 	case PRIV_SCHED_CPUSET:
3902 	case PRIV_SIGNAL_DIFFCRED:
3903 	case PRIV_SIGNAL_SUGID:
3904 
3905 		/*
3906 		 * Allow jailed processes to write to sysctls marked as jail
3907 		 * writable.
3908 		 */
3909 	case PRIV_SYSCTL_WRITEJAIL:
3910 
3911 		/*
3912 		 * Allow root in jail to manage a variety of quota
3913 		 * properties.  These should likely be conditional on a
3914 		 * configuration option.
3915 		 */
3916 	case PRIV_VFS_GETQUOTA:
3917 	case PRIV_VFS_SETQUOTA:
3918 
3919 		/*
3920 		 * Since Jail relies on chroot() to implement file system
3921 		 * protections, grant many VFS privileges to root in jail.
3922 		 * Be careful to exclude mount-related and NFS-related
3923 		 * privileges.
3924 		 */
3925 	case PRIV_VFS_READ:
3926 	case PRIV_VFS_WRITE:
3927 	case PRIV_VFS_ADMIN:
3928 	case PRIV_VFS_EXEC:
3929 	case PRIV_VFS_LOOKUP:
3930 	case PRIV_VFS_BLOCKRESERVE:	/* XXXRW: Slightly surprising. */
3931 	case PRIV_VFS_CHFLAGS_DEV:
3932 	case PRIV_VFS_CHOWN:
3933 	case PRIV_VFS_CHROOT:
3934 	case PRIV_VFS_RETAINSUGID:
3935 	case PRIV_VFS_FCHROOT:
3936 	case PRIV_VFS_LINK:
3937 	case PRIV_VFS_SETGID:
3938 	case PRIV_VFS_STAT:
3939 	case PRIV_VFS_STICKYFILE:
3940 
3941 		/*
3942 		 * As in the non-jail case, non-root users are expected to be
3943 		 * able to read kernel/phyiscal memory (provided /dev/[k]mem
3944 		 * exists in the jail and they have permission to access it).
3945 		 */
3946 	case PRIV_KMEM_READ:
3947 		return (0);
3948 
3949 		/*
3950 		 * Depending on the global setting, allow privilege of
3951 		 * setting system flags.
3952 		 */
3953 	case PRIV_VFS_SYSFLAGS:
3954 		if (cred->cr_prison->pr_allow & PR_ALLOW_CHFLAGS)
3955 			return (0);
3956 		else
3957 			return (EPERM);
3958 
3959 		/*
3960 		 * Depending on the global setting, allow privilege of
3961 		 * mounting/unmounting file systems.
3962 		 */
3963 	case PRIV_VFS_MOUNT:
3964 	case PRIV_VFS_UNMOUNT:
3965 	case PRIV_VFS_MOUNT_NONUSER:
3966 	case PRIV_VFS_MOUNT_OWNER:
3967 		if (cred->cr_prison->pr_allow & PR_ALLOW_MOUNT &&
3968 		    cred->cr_prison->pr_enforce_statfs < 2)
3969 			return (0);
3970 		else
3971 			return (EPERM);
3972 
3973 		/*
3974 		 * Allow jailed root to bind reserved ports and reuse in-use
3975 		 * ports.
3976 		 */
3977 	case PRIV_NETINET_RESERVEDPORT:
3978 	case PRIV_NETINET_REUSEPORT:
3979 		return (0);
3980 
3981 		/*
3982 		 * Allow jailed root to set certian IPv4/6 (option) headers.
3983 		 */
3984 	case PRIV_NETINET_SETHDROPTS:
3985 		return (0);
3986 
3987 		/*
3988 		 * Conditionally allow creating raw sockets in jail.
3989 		 */
3990 	case PRIV_NETINET_RAW:
3991 		if (cred->cr_prison->pr_allow & PR_ALLOW_RAW_SOCKETS)
3992 			return (0);
3993 		else
3994 			return (EPERM);
3995 
3996 		/*
3997 		 * Since jail implements its own visibility limits on netstat
3998 		 * sysctls, allow getcred.  This allows identd to work in
3999 		 * jail.
4000 		 */
4001 	case PRIV_NETINET_GETCRED:
4002 		return (0);
4003 
4004 		/*
4005 		 * Allow jailed root to set loginclass.
4006 		 */
4007 	case PRIV_PROC_SETLOGINCLASS:
4008 		return (0);
4009 
4010 	default:
4011 		/*
4012 		 * In all remaining cases, deny the privilege request.  This
4013 		 * includes almost all network privileges, many system
4014 		 * configuration privileges.
4015 		 */
4016 		return (EPERM);
4017 	}
4018 }
4019 
4020 /*
4021  * Return the part of pr2's name that is relative to pr1, or the whole name
4022  * if it does not directly follow.
4023  */
4024 
4025 char *
4026 prison_name(struct prison *pr1, struct prison *pr2)
4027 {
4028 	char *name;
4029 
4030 	/* Jails see themselves as "0" (if they see themselves at all). */
4031 	if (pr1 == pr2)
4032 		return "0";
4033 	name = pr2->pr_name;
4034 	if (prison_ischild(pr1, pr2)) {
4035 		/*
4036 		 * pr1 isn't locked (and allprison_lock may not be either)
4037 		 * so its length can't be counted on.  But the number of dots
4038 		 * can be counted on - and counted.
4039 		 */
4040 		for (; pr1 != &prison0; pr1 = pr1->pr_parent)
4041 			name = strchr(name, '.') + 1;
4042 	}
4043 	return (name);
4044 }
4045 
4046 /*
4047  * Return the part of pr2's path that is relative to pr1, or the whole path
4048  * if it does not directly follow.
4049  */
4050 static char *
4051 prison_path(struct prison *pr1, struct prison *pr2)
4052 {
4053 	char *path1, *path2;
4054 	int len1;
4055 
4056 	path1 = pr1->pr_path;
4057 	path2 = pr2->pr_path;
4058 	if (!strcmp(path1, "/"))
4059 		return (path2);
4060 	len1 = strlen(path1);
4061 	if (strncmp(path1, path2, len1))
4062 		return (path2);
4063 	if (path2[len1] == '\0')
4064 		return "/";
4065 	if (path2[len1] == '/')
4066 		return (path2 + len1);
4067 	return (path2);
4068 }
4069 
4070 
4071 /*
4072  * Jail-related sysctls.
4073  */
4074 static SYSCTL_NODE(_security, OID_AUTO, jail, CTLFLAG_RW, 0,
4075     "Jails");
4076 
4077 static int
4078 sysctl_jail_list(SYSCTL_HANDLER_ARGS)
4079 {
4080 	struct xprison *xp;
4081 	struct prison *pr, *cpr;
4082 #ifdef INET
4083 	struct in_addr *ip4 = NULL;
4084 	int ip4s = 0;
4085 #endif
4086 #ifdef INET6
4087 	struct in6_addr *ip6 = NULL;
4088 	int ip6s = 0;
4089 #endif
4090 	int descend, error;
4091 
4092 	xp = malloc(sizeof(*xp), M_TEMP, M_WAITOK);
4093 	pr = req->td->td_ucred->cr_prison;
4094 	error = 0;
4095 	sx_slock(&allprison_lock);
4096 	FOREACH_PRISON_DESCENDANT(pr, cpr, descend) {
4097 #if defined(INET) || defined(INET6)
4098  again:
4099 #endif
4100 		mtx_lock(&cpr->pr_mtx);
4101 #ifdef INET
4102 		if (cpr->pr_ip4s > 0) {
4103 			if (ip4s < cpr->pr_ip4s) {
4104 				ip4s = cpr->pr_ip4s;
4105 				mtx_unlock(&cpr->pr_mtx);
4106 				ip4 = realloc(ip4, ip4s *
4107 				    sizeof(struct in_addr), M_TEMP, M_WAITOK);
4108 				goto again;
4109 			}
4110 			bcopy(cpr->pr_ip4, ip4,
4111 			    cpr->pr_ip4s * sizeof(struct in_addr));
4112 		}
4113 #endif
4114 #ifdef INET6
4115 		if (cpr->pr_ip6s > 0) {
4116 			if (ip6s < cpr->pr_ip6s) {
4117 				ip6s = cpr->pr_ip6s;
4118 				mtx_unlock(&cpr->pr_mtx);
4119 				ip6 = realloc(ip6, ip6s *
4120 				    sizeof(struct in6_addr), M_TEMP, M_WAITOK);
4121 				goto again;
4122 			}
4123 			bcopy(cpr->pr_ip6, ip6,
4124 			    cpr->pr_ip6s * sizeof(struct in6_addr));
4125 		}
4126 #endif
4127 		if (cpr->pr_ref == 0) {
4128 			mtx_unlock(&cpr->pr_mtx);
4129 			continue;
4130 		}
4131 		bzero(xp, sizeof(*xp));
4132 		xp->pr_version = XPRISON_VERSION;
4133 		xp->pr_id = cpr->pr_id;
4134 		xp->pr_state = cpr->pr_uref > 0
4135 		    ? PRISON_STATE_ALIVE : PRISON_STATE_DYING;
4136 		strlcpy(xp->pr_path, prison_path(pr, cpr), sizeof(xp->pr_path));
4137 		strlcpy(xp->pr_host, cpr->pr_hostname, sizeof(xp->pr_host));
4138 		strlcpy(xp->pr_name, prison_name(pr, cpr), sizeof(xp->pr_name));
4139 #ifdef INET
4140 		xp->pr_ip4s = cpr->pr_ip4s;
4141 #endif
4142 #ifdef INET6
4143 		xp->pr_ip6s = cpr->pr_ip6s;
4144 #endif
4145 		mtx_unlock(&cpr->pr_mtx);
4146 		error = SYSCTL_OUT(req, xp, sizeof(*xp));
4147 		if (error)
4148 			break;
4149 #ifdef INET
4150 		if (xp->pr_ip4s > 0) {
4151 			error = SYSCTL_OUT(req, ip4,
4152 			    xp->pr_ip4s * sizeof(struct in_addr));
4153 			if (error)
4154 				break;
4155 		}
4156 #endif
4157 #ifdef INET6
4158 		if (xp->pr_ip6s > 0) {
4159 			error = SYSCTL_OUT(req, ip6,
4160 			    xp->pr_ip6s * sizeof(struct in6_addr));
4161 			if (error)
4162 				break;
4163 		}
4164 #endif
4165 	}
4166 	sx_sunlock(&allprison_lock);
4167 	free(xp, M_TEMP);
4168 #ifdef INET
4169 	free(ip4, M_TEMP);
4170 #endif
4171 #ifdef INET6
4172 	free(ip6, M_TEMP);
4173 #endif
4174 	return (error);
4175 }
4176 
4177 SYSCTL_OID(_security_jail, OID_AUTO, list,
4178     CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
4179     sysctl_jail_list, "S", "List of active jails");
4180 
4181 static int
4182 sysctl_jail_jailed(SYSCTL_HANDLER_ARGS)
4183 {
4184 	int error, injail;
4185 
4186 	injail = jailed(req->td->td_ucred);
4187 	error = SYSCTL_OUT(req, &injail, sizeof(injail));
4188 
4189 	return (error);
4190 }
4191 
4192 SYSCTL_PROC(_security_jail, OID_AUTO, jailed,
4193     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
4194     sysctl_jail_jailed, "I", "Process in jail?");
4195 
4196 static int
4197 sysctl_jail_vnet(SYSCTL_HANDLER_ARGS)
4198 {
4199 	int error, havevnet;
4200 #ifdef VIMAGE
4201 	struct ucred *cred = req->td->td_ucred;
4202 
4203 	havevnet = jailed(cred) && prison_owns_vnet(cred);
4204 #else
4205 	havevnet = 0;
4206 #endif
4207 	error = SYSCTL_OUT(req, &havevnet, sizeof(havevnet));
4208 
4209 	return (error);
4210 }
4211 
4212 SYSCTL_PROC(_security_jail, OID_AUTO, vnet,
4213     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
4214     sysctl_jail_vnet, "I", "Jail owns VNET?");
4215 
4216 #if defined(INET) || defined(INET6)
4217 SYSCTL_UINT(_security_jail, OID_AUTO, jail_max_af_ips, CTLFLAG_RW,
4218     &jail_max_af_ips, 0,
4219     "Number of IP addresses a jail may have at most per address family");
4220 #endif
4221 
4222 /*
4223  * Default parameters for jail(2) compatability.  For historical reasons,
4224  * the sysctl names have varying similarity to the parameter names.  Prisons
4225  * just see their own parameters, and can't change them.
4226  */
4227 static int
4228 sysctl_jail_default_allow(SYSCTL_HANDLER_ARGS)
4229 {
4230 	struct prison *pr;
4231 	int allow, error, i;
4232 
4233 	pr = req->td->td_ucred->cr_prison;
4234 	allow = (pr == &prison0) ? jail_default_allow : pr->pr_allow;
4235 
4236 	/* Get the current flag value, and convert it to a boolean. */
4237 	i = (allow & arg2) ? 1 : 0;
4238 	if (arg1 != NULL)
4239 		i = !i;
4240 	error = sysctl_handle_int(oidp, &i, 0, req);
4241 	if (error || !req->newptr)
4242 		return (error);
4243 	i = i ? arg2 : 0;
4244 	if (arg1 != NULL)
4245 		i ^= arg2;
4246 	/*
4247 	 * The sysctls don't have CTLFLAGS_PRISON, so assume prison0
4248 	 * for writing.
4249 	 */
4250 	mtx_lock(&prison0.pr_mtx);
4251 	jail_default_allow = (jail_default_allow & ~arg2) | i;
4252 	mtx_unlock(&prison0.pr_mtx);
4253 	return (0);
4254 }
4255 
4256 SYSCTL_PROC(_security_jail, OID_AUTO, set_hostname_allowed,
4257     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4258     NULL, PR_ALLOW_SET_HOSTNAME, sysctl_jail_default_allow, "I",
4259     "Processes in jail can set their hostnames");
4260 SYSCTL_PROC(_security_jail, OID_AUTO, socket_unixiproute_only,
4261     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4262     (void *)1, PR_ALLOW_SOCKET_AF, sysctl_jail_default_allow, "I",
4263     "Processes in jail are limited to creating UNIX/IP/route sockets only");
4264 SYSCTL_PROC(_security_jail, OID_AUTO, sysvipc_allowed,
4265     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4266     NULL, PR_ALLOW_SYSVIPC, sysctl_jail_default_allow, "I",
4267     "Processes in jail can use System V IPC primitives");
4268 SYSCTL_PROC(_security_jail, OID_AUTO, allow_raw_sockets,
4269     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4270     NULL, PR_ALLOW_RAW_SOCKETS, sysctl_jail_default_allow, "I",
4271     "Prison root can create raw sockets");
4272 SYSCTL_PROC(_security_jail, OID_AUTO, chflags_allowed,
4273     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4274     NULL, PR_ALLOW_CHFLAGS, sysctl_jail_default_allow, "I",
4275     "Processes in jail can alter system file flags");
4276 SYSCTL_PROC(_security_jail, OID_AUTO, mount_allowed,
4277     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4278     NULL, PR_ALLOW_MOUNT, sysctl_jail_default_allow, "I",
4279     "Processes in jail can mount/unmount jail-friendly file systems");
4280 SYSCTL_PROC(_security_jail, OID_AUTO, mount_devfs_allowed,
4281     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4282     NULL, PR_ALLOW_MOUNT_DEVFS, sysctl_jail_default_allow, "I",
4283     "Processes in jail can mount the devfs file system");
4284 SYSCTL_PROC(_security_jail, OID_AUTO, mount_fdescfs_allowed,
4285     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4286     NULL, PR_ALLOW_MOUNT_FDESCFS, sysctl_jail_default_allow, "I",
4287     "Processes in jail can mount the fdescfs file system");
4288 SYSCTL_PROC(_security_jail, OID_AUTO, mount_nullfs_allowed,
4289     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4290     NULL, PR_ALLOW_MOUNT_NULLFS, sysctl_jail_default_allow, "I",
4291     "Processes in jail can mount the nullfs file system");
4292 SYSCTL_PROC(_security_jail, OID_AUTO, mount_procfs_allowed,
4293     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4294     NULL, PR_ALLOW_MOUNT_PROCFS, sysctl_jail_default_allow, "I",
4295     "Processes in jail can mount the procfs file system");
4296 SYSCTL_PROC(_security_jail, OID_AUTO, mount_tmpfs_allowed,
4297     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4298     NULL, PR_ALLOW_MOUNT_TMPFS, sysctl_jail_default_allow, "I",
4299     "Processes in jail can mount the tmpfs file system");
4300 SYSCTL_PROC(_security_jail, OID_AUTO, mount_zfs_allowed,
4301     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4302     NULL, PR_ALLOW_MOUNT_ZFS, sysctl_jail_default_allow, "I",
4303     "Processes in jail can mount the zfs file system");
4304 
4305 static int
4306 sysctl_jail_default_level(SYSCTL_HANDLER_ARGS)
4307 {
4308 	struct prison *pr;
4309 	int level, error;
4310 
4311 	pr = req->td->td_ucred->cr_prison;
4312 	level = (pr == &prison0) ? *(int *)arg1 : *(int *)((char *)pr + arg2);
4313 	error = sysctl_handle_int(oidp, &level, 0, req);
4314 	if (error || !req->newptr)
4315 		return (error);
4316 	*(int *)arg1 = level;
4317 	return (0);
4318 }
4319 
4320 SYSCTL_PROC(_security_jail, OID_AUTO, enforce_statfs,
4321     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4322     &jail_default_enforce_statfs, offsetof(struct prison, pr_enforce_statfs),
4323     sysctl_jail_default_level, "I",
4324     "Processes in jail cannot see all mounted file systems");
4325 
4326 SYSCTL_PROC(_security_jail, OID_AUTO, devfs_ruleset,
4327     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE,
4328     &jail_default_devfs_rsnum, offsetof(struct prison, pr_devfs_rsnum),
4329     sysctl_jail_default_level, "I",
4330     "Ruleset for the devfs filesystem in jail");
4331 
4332 /*
4333  * Nodes to describe jail parameters.  Maximum length of string parameters
4334  * is returned in the string itself, and the other parameters exist merely
4335  * to make themselves and their types known.
4336  */
4337 SYSCTL_NODE(_security_jail, OID_AUTO, param, CTLFLAG_RW, 0,
4338     "Jail parameters");
4339 
4340 int
4341 sysctl_jail_param(SYSCTL_HANDLER_ARGS)
4342 {
4343 	int i;
4344 	long l;
4345 	size_t s;
4346 	char numbuf[12];
4347 
4348 	switch (oidp->oid_kind & CTLTYPE)
4349 	{
4350 	case CTLTYPE_LONG:
4351 	case CTLTYPE_ULONG:
4352 		l = 0;
4353 #ifdef SCTL_MASK32
4354 		if (!(req->flags & SCTL_MASK32))
4355 #endif
4356 			return (SYSCTL_OUT(req, &l, sizeof(l)));
4357 	case CTLTYPE_INT:
4358 	case CTLTYPE_UINT:
4359 		i = 0;
4360 		return (SYSCTL_OUT(req, &i, sizeof(i)));
4361 	case CTLTYPE_STRING:
4362 		snprintf(numbuf, sizeof(numbuf), "%jd", (intmax_t)arg2);
4363 		return
4364 		    (sysctl_handle_string(oidp, numbuf, sizeof(numbuf), req));
4365 	case CTLTYPE_STRUCT:
4366 		s = (size_t)arg2;
4367 		return (SYSCTL_OUT(req, &s, sizeof(s)));
4368 	}
4369 	return (0);
4370 }
4371 
4372 /*
4373  * CTLFLAG_RDTUN in the following indicates jail parameters that can be set at
4374  * jail creation time but cannot be changed in an existing jail.
4375  */
4376 SYSCTL_JAIL_PARAM(, jid, CTLTYPE_INT | CTLFLAG_RDTUN, "I", "Jail ID");
4377 SYSCTL_JAIL_PARAM(, parent, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail parent ID");
4378 SYSCTL_JAIL_PARAM_STRING(, name, CTLFLAG_RW, MAXHOSTNAMELEN, "Jail name");
4379 SYSCTL_JAIL_PARAM_STRING(, path, CTLFLAG_RDTUN, MAXPATHLEN, "Jail root path");
4380 SYSCTL_JAIL_PARAM(, securelevel, CTLTYPE_INT | CTLFLAG_RW,
4381     "I", "Jail secure level");
4382 SYSCTL_JAIL_PARAM(, osreldate, CTLTYPE_INT | CTLFLAG_RDTUN, "I",
4383     "Jail value for kern.osreldate and uname -K");
4384 SYSCTL_JAIL_PARAM_STRING(, osrelease, CTLFLAG_RDTUN, OSRELEASELEN,
4385     "Jail value for kern.osrelease and uname -r");
4386 SYSCTL_JAIL_PARAM(, enforce_statfs, CTLTYPE_INT | CTLFLAG_RW,
4387     "I", "Jail cannot see all mounted file systems");
4388 SYSCTL_JAIL_PARAM(, devfs_ruleset, CTLTYPE_INT | CTLFLAG_RW,
4389     "I", "Ruleset for in-jail devfs mounts");
4390 SYSCTL_JAIL_PARAM(, persist, CTLTYPE_INT | CTLFLAG_RW,
4391     "B", "Jail persistence");
4392 #ifdef VIMAGE
4393 SYSCTL_JAIL_PARAM(, vnet, CTLTYPE_INT | CTLFLAG_RDTUN,
4394     "E,jailsys", "Virtual network stack");
4395 #endif
4396 SYSCTL_JAIL_PARAM(, dying, CTLTYPE_INT | CTLFLAG_RD,
4397     "B", "Jail is in the process of shutting down");
4398 
4399 SYSCTL_JAIL_PARAM_NODE(children, "Number of child jails");
4400 SYSCTL_JAIL_PARAM(_children, cur, CTLTYPE_INT | CTLFLAG_RD,
4401     "I", "Current number of child jails");
4402 SYSCTL_JAIL_PARAM(_children, max, CTLTYPE_INT | CTLFLAG_RW,
4403     "I", "Maximum number of child jails");
4404 
4405 SYSCTL_JAIL_PARAM_SYS_NODE(host, CTLFLAG_RW, "Jail host info");
4406 SYSCTL_JAIL_PARAM_STRING(_host, hostname, CTLFLAG_RW, MAXHOSTNAMELEN,
4407     "Jail hostname");
4408 SYSCTL_JAIL_PARAM_STRING(_host, domainname, CTLFLAG_RW, MAXHOSTNAMELEN,
4409     "Jail NIS domainname");
4410 SYSCTL_JAIL_PARAM_STRING(_host, hostuuid, CTLFLAG_RW, HOSTUUIDLEN,
4411     "Jail host UUID");
4412 SYSCTL_JAIL_PARAM(_host, hostid, CTLTYPE_ULONG | CTLFLAG_RW,
4413     "LU", "Jail host ID");
4414 
4415 SYSCTL_JAIL_PARAM_NODE(cpuset, "Jail cpuset");
4416 SYSCTL_JAIL_PARAM(_cpuset, id, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail cpuset ID");
4417 
4418 #ifdef INET
4419 SYSCTL_JAIL_PARAM_SYS_NODE(ip4, CTLFLAG_RDTUN,
4420     "Jail IPv4 address virtualization");
4421 SYSCTL_JAIL_PARAM_STRUCT(_ip4, addr, CTLFLAG_RW, sizeof(struct in_addr),
4422     "S,in_addr,a", "Jail IPv4 addresses");
4423 SYSCTL_JAIL_PARAM(_ip4, saddrsel, CTLTYPE_INT | CTLFLAG_RW,
4424     "B", "Do (not) use IPv4 source address selection rather than the "
4425     "primary jail IPv4 address.");
4426 #endif
4427 #ifdef INET6
4428 SYSCTL_JAIL_PARAM_SYS_NODE(ip6, CTLFLAG_RDTUN,
4429     "Jail IPv6 address virtualization");
4430 SYSCTL_JAIL_PARAM_STRUCT(_ip6, addr, CTLFLAG_RW, sizeof(struct in6_addr),
4431     "S,in6_addr,a", "Jail IPv6 addresses");
4432 SYSCTL_JAIL_PARAM(_ip6, saddrsel, CTLTYPE_INT | CTLFLAG_RW,
4433     "B", "Do (not) use IPv6 source address selection rather than the "
4434     "primary jail IPv6 address.");
4435 #endif
4436 
4437 SYSCTL_JAIL_PARAM_NODE(allow, "Jail permission flags");
4438 SYSCTL_JAIL_PARAM(_allow, set_hostname, CTLTYPE_INT | CTLFLAG_RW,
4439     "B", "Jail may set hostname");
4440 SYSCTL_JAIL_PARAM(_allow, sysvipc, CTLTYPE_INT | CTLFLAG_RW,
4441     "B", "Jail may use SYSV IPC");
4442 SYSCTL_JAIL_PARAM(_allow, raw_sockets, CTLTYPE_INT | CTLFLAG_RW,
4443     "B", "Jail may create raw sockets");
4444 SYSCTL_JAIL_PARAM(_allow, chflags, CTLTYPE_INT | CTLFLAG_RW,
4445     "B", "Jail may alter system file flags");
4446 SYSCTL_JAIL_PARAM(_allow, quotas, CTLTYPE_INT | CTLFLAG_RW,
4447     "B", "Jail may set file quotas");
4448 SYSCTL_JAIL_PARAM(_allow, socket_af, CTLTYPE_INT | CTLFLAG_RW,
4449     "B", "Jail may create sockets other than just UNIX/IPv4/IPv6/route");
4450 
4451 SYSCTL_JAIL_PARAM_SUBNODE(allow, mount, "Jail mount/unmount permission flags");
4452 SYSCTL_JAIL_PARAM(_allow_mount, , CTLTYPE_INT | CTLFLAG_RW,
4453     "B", "Jail may mount/unmount jail-friendly file systems in general");
4454 SYSCTL_JAIL_PARAM(_allow_mount, devfs, CTLTYPE_INT | CTLFLAG_RW,
4455     "B", "Jail may mount the devfs file system");
4456 SYSCTL_JAIL_PARAM(_allow_mount, fdescfs, CTLTYPE_INT | CTLFLAG_RW,
4457     "B", "Jail may mount the fdescfs file system");
4458 SYSCTL_JAIL_PARAM(_allow_mount, nullfs, CTLTYPE_INT | CTLFLAG_RW,
4459     "B", "Jail may mount the nullfs file system");
4460 SYSCTL_JAIL_PARAM(_allow_mount, procfs, CTLTYPE_INT | CTLFLAG_RW,
4461     "B", "Jail may mount the procfs file system");
4462 SYSCTL_JAIL_PARAM(_allow_mount, tmpfs, CTLTYPE_INT | CTLFLAG_RW,
4463     "B", "Jail may mount the tmpfs file system");
4464 SYSCTL_JAIL_PARAM(_allow_mount, zfs, CTLTYPE_INT | CTLFLAG_RW,
4465     "B", "Jail may mount the zfs file system");
4466 
4467 void
4468 prison_racct_foreach(void (*callback)(struct racct *racct,
4469     void *arg2, void *arg3), void *arg2, void *arg3)
4470 {
4471 	struct prison_racct *prr;
4472 
4473 	sx_slock(&allprison_lock);
4474 	LIST_FOREACH(prr, &allprison_racct, prr_next)
4475 		(callback)(prr->prr_racct, arg2, arg3);
4476 	sx_sunlock(&allprison_lock);
4477 }
4478 
4479 static struct prison_racct *
4480 prison_racct_find_locked(const char *name)
4481 {
4482 	struct prison_racct *prr;
4483 
4484 	sx_assert(&allprison_lock, SA_XLOCKED);
4485 
4486 	if (name[0] == '\0' || strlen(name) >= MAXHOSTNAMELEN)
4487 		return (NULL);
4488 
4489 	LIST_FOREACH(prr, &allprison_racct, prr_next) {
4490 		if (strcmp(name, prr->prr_name) != 0)
4491 			continue;
4492 
4493 		/* Found prison_racct with a matching name? */
4494 		prison_racct_hold(prr);
4495 		return (prr);
4496 	}
4497 
4498 	/* Add new prison_racct. */
4499 	prr = malloc(sizeof(*prr), M_PRISON_RACCT, M_ZERO | M_WAITOK);
4500 	racct_create(&prr->prr_racct);
4501 
4502 	strcpy(prr->prr_name, name);
4503 	refcount_init(&prr->prr_refcount, 1);
4504 	LIST_INSERT_HEAD(&allprison_racct, prr, prr_next);
4505 
4506 	return (prr);
4507 }
4508 
4509 struct prison_racct *
4510 prison_racct_find(const char *name)
4511 {
4512 	struct prison_racct *prr;
4513 
4514 	sx_xlock(&allprison_lock);
4515 	prr = prison_racct_find_locked(name);
4516 	sx_xunlock(&allprison_lock);
4517 	return (prr);
4518 }
4519 
4520 void
4521 prison_racct_hold(struct prison_racct *prr)
4522 {
4523 
4524 	refcount_acquire(&prr->prr_refcount);
4525 }
4526 
4527 static void
4528 prison_racct_free_locked(struct prison_racct *prr)
4529 {
4530 
4531 	sx_assert(&allprison_lock, SA_XLOCKED);
4532 
4533 	if (refcount_release(&prr->prr_refcount)) {
4534 		racct_destroy(&prr->prr_racct);
4535 		LIST_REMOVE(prr, prr_next);
4536 		free(prr, M_PRISON_RACCT);
4537 	}
4538 }
4539 
4540 void
4541 prison_racct_free(struct prison_racct *prr)
4542 {
4543 	int old;
4544 
4545 	sx_assert(&allprison_lock, SA_UNLOCKED);
4546 
4547 	old = prr->prr_refcount;
4548 	if (old > 1 && atomic_cmpset_int(&prr->prr_refcount, old, old - 1))
4549 		return;
4550 
4551 	sx_xlock(&allprison_lock);
4552 	prison_racct_free_locked(prr);
4553 	sx_xunlock(&allprison_lock);
4554 }
4555 
4556 #ifdef RACCT
4557 static void
4558 prison_racct_attach(struct prison *pr)
4559 {
4560 	struct prison_racct *prr;
4561 
4562 	sx_assert(&allprison_lock, SA_XLOCKED);
4563 
4564 	prr = prison_racct_find_locked(pr->pr_name);
4565 	KASSERT(prr != NULL, ("cannot find prison_racct"));
4566 
4567 	pr->pr_prison_racct = prr;
4568 }
4569 
4570 /*
4571  * Handle jail renaming.  From the racct point of view, renaming means
4572  * moving from one prison_racct to another.
4573  */
4574 static void
4575 prison_racct_modify(struct prison *pr)
4576 {
4577 	struct proc *p;
4578 	struct ucred *cred;
4579 	struct prison_racct *oldprr;
4580 
4581 	sx_slock(&allproc_lock);
4582 	sx_xlock(&allprison_lock);
4583 
4584 	if (strcmp(pr->pr_name, pr->pr_prison_racct->prr_name) == 0) {
4585 		sx_xunlock(&allprison_lock);
4586 		sx_sunlock(&allproc_lock);
4587 		return;
4588 	}
4589 
4590 	oldprr = pr->pr_prison_racct;
4591 	pr->pr_prison_racct = NULL;
4592 
4593 	prison_racct_attach(pr);
4594 
4595 	/*
4596 	 * Move resource utilisation records.
4597 	 */
4598 	racct_move(pr->pr_prison_racct->prr_racct, oldprr->prr_racct);
4599 
4600 	/*
4601 	 * Force rctl to reattach rules to processes.
4602 	 */
4603 	FOREACH_PROC_IN_SYSTEM(p) {
4604 		PROC_LOCK(p);
4605 		cred = crhold(p->p_ucred);
4606 		PROC_UNLOCK(p);
4607 		racct_proc_ucred_changed(p, cred, cred);
4608 		crfree(cred);
4609 	}
4610 
4611 	sx_sunlock(&allproc_lock);
4612 	prison_racct_free_locked(oldprr);
4613 	sx_xunlock(&allprison_lock);
4614 }
4615 
4616 static void
4617 prison_racct_detach(struct prison *pr)
4618 {
4619 
4620 	sx_assert(&allprison_lock, SA_UNLOCKED);
4621 
4622 	if (pr->pr_prison_racct == NULL)
4623 		return;
4624 	prison_racct_free(pr->pr_prison_racct);
4625 	pr->pr_prison_racct = NULL;
4626 }
4627 #endif /* RACCT */
4628 
4629 #ifdef DDB
4630 
4631 static void
4632 db_show_prison(struct prison *pr)
4633 {
4634 	int fi;
4635 #if defined(INET) || defined(INET6)
4636 	int ii;
4637 #endif
4638 	unsigned jsf;
4639 #ifdef INET6
4640 	char ip6buf[INET6_ADDRSTRLEN];
4641 #endif
4642 
4643 	db_printf("prison %p:\n", pr);
4644 	db_printf(" jid             = %d\n", pr->pr_id);
4645 	db_printf(" name            = %s\n", pr->pr_name);
4646 	db_printf(" parent          = %p\n", pr->pr_parent);
4647 	db_printf(" ref             = %d\n", pr->pr_ref);
4648 	db_printf(" uref            = %d\n", pr->pr_uref);
4649 	db_printf(" path            = %s\n", pr->pr_path);
4650 	db_printf(" cpuset          = %d\n", pr->pr_cpuset
4651 	    ? pr->pr_cpuset->cs_id : -1);
4652 #ifdef VIMAGE
4653 	db_printf(" vnet            = %p\n", pr->pr_vnet);
4654 #endif
4655 	db_printf(" root            = %p\n", pr->pr_root);
4656 	db_printf(" securelevel     = %d\n", pr->pr_securelevel);
4657 	db_printf(" devfs_rsnum     = %d\n", pr->pr_devfs_rsnum);
4658 	db_printf(" children.max    = %d\n", pr->pr_childmax);
4659 	db_printf(" children.cur    = %d\n", pr->pr_childcount);
4660 	db_printf(" child           = %p\n", LIST_FIRST(&pr->pr_children));
4661 	db_printf(" sibling         = %p\n", LIST_NEXT(pr, pr_sibling));
4662 	db_printf(" flags           = 0x%x", pr->pr_flags);
4663 	for (fi = 0; fi < sizeof(pr_flag_names) / sizeof(pr_flag_names[0]);
4664 	    fi++)
4665 		if (pr_flag_names[fi] != NULL && (pr->pr_flags & (1 << fi)))
4666 			db_printf(" %s", pr_flag_names[fi]);
4667 	for (fi = 0; fi < sizeof(pr_flag_jailsys) / sizeof(pr_flag_jailsys[0]);
4668 	    fi++) {
4669 		jsf = pr->pr_flags &
4670 		    (pr_flag_jailsys[fi].disable | pr_flag_jailsys[fi].new);
4671 		db_printf(" %-16s= %s\n", pr_flag_jailsys[fi].name,
4672 		    pr_flag_jailsys[fi].disable &&
4673 		      (jsf == pr_flag_jailsys[fi].disable) ? "disable"
4674 		    : (jsf == pr_flag_jailsys[fi].new) ? "new"
4675 		    : "inherit");
4676 	}
4677 	db_printf(" allow           = 0x%x", pr->pr_allow);
4678 	for (fi = 0; fi < sizeof(pr_allow_names) / sizeof(pr_allow_names[0]);
4679 	    fi++)
4680 		if (pr_allow_names[fi] != NULL && (pr->pr_allow & (1 << fi)))
4681 			db_printf(" %s", pr_allow_names[fi]);
4682 	db_printf("\n");
4683 	db_printf(" enforce_statfs  = %d\n", pr->pr_enforce_statfs);
4684 	db_printf(" host.hostname   = %s\n", pr->pr_hostname);
4685 	db_printf(" host.domainname = %s\n", pr->pr_domainname);
4686 	db_printf(" host.hostuuid   = %s\n", pr->pr_hostuuid);
4687 	db_printf(" host.hostid     = %lu\n", pr->pr_hostid);
4688 #ifdef INET
4689 	db_printf(" ip4s            = %d\n", pr->pr_ip4s);
4690 	for (ii = 0; ii < pr->pr_ip4s; ii++)
4691 		db_printf(" %s %s\n",
4692 		    ii == 0 ? "ip4.addr        =" : "                 ",
4693 		    inet_ntoa(pr->pr_ip4[ii]));
4694 #endif
4695 #ifdef INET6
4696 	db_printf(" ip6s            = %d\n", pr->pr_ip6s);
4697 	for (ii = 0; ii < pr->pr_ip6s; ii++)
4698 		db_printf(" %s %s\n",
4699 		    ii == 0 ? "ip6.addr        =" : "                 ",
4700 		    ip6_sprintf(ip6buf, &pr->pr_ip6[ii]));
4701 #endif
4702 }
4703 
4704 DB_SHOW_COMMAND(prison, db_show_prison_command)
4705 {
4706 	struct prison *pr;
4707 
4708 	if (!have_addr) {
4709 		/*
4710 		 * Show all prisons in the list, and prison0 which is not
4711 		 * listed.
4712 		 */
4713 		db_show_prison(&prison0);
4714 		if (!db_pager_quit) {
4715 			TAILQ_FOREACH(pr, &allprison, pr_list) {
4716 				db_show_prison(pr);
4717 				if (db_pager_quit)
4718 					break;
4719 			}
4720 		}
4721 		return;
4722 	}
4723 
4724 	if (addr == 0)
4725 		pr = &prison0;
4726 	else {
4727 		/* Look for a prison with the ID and with references. */
4728 		TAILQ_FOREACH(pr, &allprison, pr_list)
4729 			if (pr->pr_id == addr && pr->pr_ref > 0)
4730 				break;
4731 		if (pr == NULL)
4732 			/* Look again, without requiring a reference. */
4733 			TAILQ_FOREACH(pr, &allprison, pr_list)
4734 				if (pr->pr_id == addr)
4735 					break;
4736 		if (pr == NULL)
4737 			/* Assume address points to a valid prison. */
4738 			pr = (struct prison *)addr;
4739 	}
4740 	db_show_prison(pr);
4741 }
4742 
4743 #endif /* DDB */
4744