xref: /freebsd/sys/kern/kern_jail.c (revision 4d3fc8b0570b29fb0d6ee9525f104d52176ff0d4)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3  *
4  * Copyright (c) 1999 Poul-Henning Kamp.
5  * Copyright (c) 2008 Bjoern A. Zeeb.
6  * Copyright (c) 2009 James Gritton.
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28  * SUCH DAMAGE.
29  */
30 
31 #include <sys/cdefs.h>
32 __FBSDID("$FreeBSD$");
33 
34 #include "opt_ddb.h"
35 #include "opt_inet.h"
36 #include "opt_inet6.h"
37 #include "opt_nfs.h"
38 
39 #include <sys/param.h>
40 #include <sys/types.h>
41 #include <sys/kernel.h>
42 #include <sys/systm.h>
43 #include <sys/errno.h>
44 #include <sys/sysproto.h>
45 #include <sys/malloc.h>
46 #include <sys/osd.h>
47 #include <sys/priv.h>
48 #include <sys/proc.h>
49 #include <sys/epoch.h>
50 #include <sys/taskqueue.h>
51 #include <sys/fcntl.h>
52 #include <sys/jail.h>
53 #include <sys/linker.h>
54 #include <sys/lock.h>
55 #include <sys/mman.h>
56 #include <sys/mutex.h>
57 #include <sys/racct.h>
58 #include <sys/rctl.h>
59 #include <sys/refcount.h>
60 #include <sys/sx.h>
61 #include <sys/sysent.h>
62 #include <sys/namei.h>
63 #include <sys/mount.h>
64 #include <sys/queue.h>
65 #include <sys/socket.h>
66 #include <sys/syscallsubr.h>
67 #include <sys/sysctl.h>
68 #include <sys/uuid.h>
69 #include <sys/vnode.h>
70 
71 #include <net/if.h>
72 #include <net/vnet.h>
73 
74 #include <netinet/in.h>
75 
76 #ifdef DDB
77 #include <ddb/ddb.h>
78 #endif /* DDB */
79 
80 #include <security/mac/mac_framework.h>
81 
82 #define	PRISON0_HOSTUUID_MODULE	"hostuuid"
83 
84 MALLOC_DEFINE(M_PRISON, "prison", "Prison structures");
85 static MALLOC_DEFINE(M_PRISON_RACCT, "prison_racct", "Prison racct structures");
86 
87 /* Keep struct prison prison0 and some code in kern_jail_set() readable. */
88 #ifdef INET
89 #ifdef INET6
90 #define	_PR_IP_SADDRSEL	PR_IP4_SADDRSEL|PR_IP6_SADDRSEL
91 #else
92 #define	_PR_IP_SADDRSEL	PR_IP4_SADDRSEL
93 #endif
94 #else /* !INET */
95 #ifdef INET6
96 #define	_PR_IP_SADDRSEL	PR_IP6_SADDRSEL
97 #else
98 #define	_PR_IP_SADDRSEL	0
99 #endif
100 #endif
101 
102 /* prison0 describes what is "real" about the system. */
103 struct prison prison0 = {
104 	.pr_id		= 0,
105 	.pr_name	= "0",
106 	.pr_ref		= 1,
107 	.pr_uref	= 1,
108 	.pr_path	= "/",
109 	.pr_securelevel	= -1,
110 	.pr_devfs_rsnum = 0,
111 	.pr_state	= PRISON_STATE_ALIVE,
112 	.pr_childmax	= JAIL_MAX,
113 	.pr_hostuuid	= DEFAULT_HOSTUUID,
114 	.pr_children	= LIST_HEAD_INITIALIZER(prison0.pr_children),
115 #ifdef VIMAGE
116 	.pr_flags	= PR_HOST|PR_VNET|_PR_IP_SADDRSEL,
117 #else
118 	.pr_flags	= PR_HOST|_PR_IP_SADDRSEL,
119 #endif
120 	.pr_allow	= PR_ALLOW_ALL_STATIC,
121 };
122 MTX_SYSINIT(prison0, &prison0.pr_mtx, "jail mutex", MTX_DEF);
123 
124 struct bool_flags {
125 	const char	*name;
126 	const char	*noname;
127 	volatile u_int	 flag;
128 };
129 struct jailsys_flags {
130 	const char	*name;
131 	unsigned	 disable;
132 	unsigned	 new;
133 };
134 
135 /* allprison, allprison_racct and lastprid are protected by allprison_lock. */
136 struct	sx allprison_lock;
137 SX_SYSINIT(allprison_lock, &allprison_lock, "allprison");
138 struct	prisonlist allprison = TAILQ_HEAD_INITIALIZER(allprison);
139 LIST_HEAD(, prison_racct) allprison_racct;
140 int	lastprid = 0;
141 
142 static int get_next_prid(struct prison **insprp);
143 static int do_jail_attach(struct thread *td, struct prison *pr, int drflags);
144 static void prison_complete(void *context, int pending);
145 static void prison_deref(struct prison *pr, int flags);
146 static void prison_deref_kill(struct prison *pr, struct prisonlist *freeprison);
147 static int prison_lock_xlock(struct prison *pr, int flags);
148 static void prison_cleanup(struct prison *pr);
149 static void prison_free_not_last(struct prison *pr);
150 static void prison_proc_free_not_last(struct prison *pr);
151 static void prison_proc_relink(struct prison *opr, struct prison *npr,
152     struct proc *p);
153 static void prison_set_allow_locked(struct prison *pr, unsigned flag,
154     int enable);
155 static char *prison_path(struct prison *pr1, struct prison *pr2);
156 #ifdef RACCT
157 static void prison_racct_attach(struct prison *pr);
158 static void prison_racct_modify(struct prison *pr);
159 static void prison_racct_detach(struct prison *pr);
160 #endif
161 
162 /* Flags for prison_deref */
163 #define	PD_DEREF	0x01	/* Decrement pr_ref */
164 #define	PD_DEUREF	0x02	/* Decrement pr_uref */
165 #define	PD_KILL		0x04	/* Remove jail, kill processes, etc */
166 #define	PD_LOCKED	0x10	/* pr_mtx is held */
167 #define	PD_LIST_SLOCKED	0x20	/* allprison_lock is held shared */
168 #define	PD_LIST_XLOCKED	0x40	/* allprison_lock is held exclusive */
169 #define PD_OP_FLAGS	0x07	/* Operation flags */
170 #define PD_LOCK_FLAGS	0x70	/* Lock status flags */
171 
172 /*
173  * Parameter names corresponding to PR_* flag values.  Size values are for kvm
174  * as we cannot figure out the size of a sparse array, or an array without a
175  * terminating entry.
176  */
177 static struct bool_flags pr_flag_bool[] = {
178 	{"persist", "nopersist", PR_PERSIST},
179 #ifdef INET
180 	{"ip4.saddrsel", "ip4.nosaddrsel", PR_IP4_SADDRSEL},
181 #endif
182 #ifdef INET6
183 	{"ip6.saddrsel", "ip6.nosaddrsel", PR_IP6_SADDRSEL},
184 #endif
185 };
186 const size_t pr_flag_bool_size = sizeof(pr_flag_bool);
187 
188 static struct jailsys_flags pr_flag_jailsys[] = {
189 	{"host", 0, PR_HOST},
190 #ifdef VIMAGE
191 	{"vnet", 0, PR_VNET},
192 #endif
193 #ifdef INET
194 	{"ip4", PR_IP4_USER, PR_IP4_USER},
195 #endif
196 #ifdef INET6
197 	{"ip6", PR_IP6_USER, PR_IP6_USER},
198 #endif
199 };
200 const size_t pr_flag_jailsys_size = sizeof(pr_flag_jailsys);
201 
202 /*
203  * Make this array full-size so dynamic parameters can be added.
204  * It is protected by prison0.mtx, but lockless reading is allowed
205  * with an atomic check of the flag values.
206  */
207 static struct bool_flags pr_flag_allow[NBBY * NBPW] = {
208 	{"allow.set_hostname", "allow.noset_hostname", PR_ALLOW_SET_HOSTNAME},
209 	{"allow.sysvipc", "allow.nosysvipc", PR_ALLOW_SYSVIPC},
210 	{"allow.raw_sockets", "allow.noraw_sockets", PR_ALLOW_RAW_SOCKETS},
211 	{"allow.chflags", "allow.nochflags", PR_ALLOW_CHFLAGS},
212 	{"allow.mount", "allow.nomount", PR_ALLOW_MOUNT},
213 	{"allow.quotas", "allow.noquotas", PR_ALLOW_QUOTAS},
214 	{"allow.socket_af", "allow.nosocket_af", PR_ALLOW_SOCKET_AF},
215 	{"allow.mlock", "allow.nomlock", PR_ALLOW_MLOCK},
216 	{"allow.reserved_ports", "allow.noreserved_ports",
217 	 PR_ALLOW_RESERVED_PORTS},
218 	{"allow.read_msgbuf", "allow.noread_msgbuf", PR_ALLOW_READ_MSGBUF},
219 	{"allow.unprivileged_proc_debug", "allow.nounprivileged_proc_debug",
220 	 PR_ALLOW_UNPRIV_DEBUG},
221 	{"allow.suser", "allow.nosuser", PR_ALLOW_SUSER},
222 #ifdef VIMAGE
223 	{"allow.nfsd", "allow.nonfsd", PR_ALLOW_NFSD},
224 #endif
225 };
226 static unsigned pr_allow_all = PR_ALLOW_ALL_STATIC;
227 const size_t pr_flag_allow_size = sizeof(pr_flag_allow);
228 
229 #define	JAIL_DEFAULT_ALLOW		(PR_ALLOW_SET_HOSTNAME | \
230 					 PR_ALLOW_RESERVED_PORTS | \
231 					 PR_ALLOW_UNPRIV_DEBUG | \
232 					 PR_ALLOW_SUSER)
233 #define	JAIL_DEFAULT_ENFORCE_STATFS	2
234 #define	JAIL_DEFAULT_DEVFS_RSNUM	0
235 static unsigned jail_default_allow = JAIL_DEFAULT_ALLOW;
236 static int jail_default_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS;
237 static int jail_default_devfs_rsnum = JAIL_DEFAULT_DEVFS_RSNUM;
238 #if defined(INET) || defined(INET6)
239 static unsigned jail_max_af_ips = 255;
240 #endif
241 
242 /*
243  * Initialize the parts of prison0 that can't be static-initialized with
244  * constants.  This is called from proc0_init() after creating thread0 cpuset.
245  */
246 void
247 prison0_init(void)
248 {
249 	uint8_t *file, *data;
250 	size_t size;
251 	char buf[sizeof(prison0.pr_hostuuid)];
252 	bool valid;
253 
254 	prison0.pr_cpuset = cpuset_ref(thread0.td_cpuset);
255 	prison0.pr_osreldate = osreldate;
256 	strlcpy(prison0.pr_osrelease, osrelease, sizeof(prison0.pr_osrelease));
257 
258 	/* If we have a preloaded hostuuid, use it. */
259 	file = preload_search_by_type(PRISON0_HOSTUUID_MODULE);
260 	if (file != NULL) {
261 		data = preload_fetch_addr(file);
262 		size = preload_fetch_size(file);
263 		if (data != NULL) {
264 			/*
265 			 * The preloaded data may include trailing whitespace, almost
266 			 * certainly a newline; skip over any whitespace or
267 			 * non-printable characters to be safe.
268 			 */
269 			while (size > 0 && data[size - 1] <= 0x20) {
270 				size--;
271 			}
272 
273 			valid = false;
274 
275 			/*
276 			 * Not NUL-terminated when passed from loader, but
277 			 * validate_uuid requires that due to using sscanf (as
278 			 * does the subsequent strlcpy, since it still reads
279 			 * past the given size to return the true length);
280 			 * bounce to a temporary buffer to fix.
281 			 */
282 			if (size >= sizeof(buf))
283 				goto done;
284 
285 			memcpy(buf, data, size);
286 			buf[size] = '\0';
287 
288 			if (validate_uuid(buf, size, NULL, 0) != 0)
289 				goto done;
290 
291 			valid = true;
292 			(void)strlcpy(prison0.pr_hostuuid, buf,
293 			    sizeof(prison0.pr_hostuuid));
294 
295 done:
296 			if (bootverbose && !valid) {
297 				printf("hostuuid: preload data malformed: '%.*s'\n",
298 				    (int)size, data);
299 			}
300 		}
301 	}
302 	if (bootverbose)
303 		printf("hostuuid: using %s\n", prison0.pr_hostuuid);
304 }
305 
306 /*
307  * struct jail_args {
308  *	struct jail *jail;
309  * };
310  */
311 int
312 sys_jail(struct thread *td, struct jail_args *uap)
313 {
314 	uint32_t version;
315 	int error;
316 	struct jail j;
317 
318 	error = copyin(uap->jail, &version, sizeof(uint32_t));
319 	if (error)
320 		return (error);
321 
322 	switch (version) {
323 	case 0:
324 	{
325 		struct jail_v0 j0;
326 
327 		/* FreeBSD single IPv4 jails. */
328 		bzero(&j, sizeof(struct jail));
329 		error = copyin(uap->jail, &j0, sizeof(struct jail_v0));
330 		if (error)
331 			return (error);
332 		j.version = j0.version;
333 		j.path = j0.path;
334 		j.hostname = j0.hostname;
335 		j.ip4s = htonl(j0.ip_number);	/* jail_v0 is host order */
336 		break;
337 	}
338 
339 	case 1:
340 		/*
341 		 * Version 1 was used by multi-IPv4 jail implementations
342 		 * that never made it into the official kernel.
343 		 */
344 		return (EINVAL);
345 
346 	case 2:	/* JAIL_API_VERSION */
347 		/* FreeBSD multi-IPv4/IPv6,noIP jails. */
348 		error = copyin(uap->jail, &j, sizeof(struct jail));
349 		if (error)
350 			return (error);
351 		break;
352 
353 	default:
354 		/* Sci-Fi jails are not supported, sorry. */
355 		return (EINVAL);
356 	}
357 	return (kern_jail(td, &j));
358 }
359 
360 int
361 kern_jail(struct thread *td, struct jail *j)
362 {
363 	struct iovec optiov[2 * (4 + nitems(pr_flag_allow)
364 #ifdef INET
365 			    + 1
366 #endif
367 #ifdef INET6
368 			    + 1
369 #endif
370 			    )];
371 	struct uio opt;
372 	char *u_path, *u_hostname, *u_name;
373 	struct bool_flags *bf;
374 #ifdef INET
375 	uint32_t ip4s;
376 	struct in_addr *u_ip4;
377 #endif
378 #ifdef INET6
379 	struct in6_addr *u_ip6;
380 #endif
381 	size_t tmplen;
382 	int error, enforce_statfs;
383 
384 	bzero(&optiov, sizeof(optiov));
385 	opt.uio_iov = optiov;
386 	opt.uio_iovcnt = 0;
387 	opt.uio_offset = -1;
388 	opt.uio_resid = -1;
389 	opt.uio_segflg = UIO_SYSSPACE;
390 	opt.uio_rw = UIO_READ;
391 	opt.uio_td = td;
392 
393 	/* Set permissions for top-level jails from sysctls. */
394 	if (!jailed(td->td_ucred)) {
395 		for (bf = pr_flag_allow;
396 		     bf < pr_flag_allow + nitems(pr_flag_allow) &&
397 			atomic_load_int(&bf->flag) != 0;
398 		     bf++) {
399 			optiov[opt.uio_iovcnt].iov_base = __DECONST(char *,
400 			    (jail_default_allow & bf->flag)
401 			    ? bf->name : bf->noname);
402 			optiov[opt.uio_iovcnt].iov_len =
403 			    strlen(optiov[opt.uio_iovcnt].iov_base) + 1;
404 			opt.uio_iovcnt += 2;
405 		}
406 		optiov[opt.uio_iovcnt].iov_base = "enforce_statfs";
407 		optiov[opt.uio_iovcnt].iov_len = sizeof("enforce_statfs");
408 		opt.uio_iovcnt++;
409 		enforce_statfs = jail_default_enforce_statfs;
410 		optiov[opt.uio_iovcnt].iov_base = &enforce_statfs;
411 		optiov[opt.uio_iovcnt].iov_len = sizeof(enforce_statfs);
412 		opt.uio_iovcnt++;
413 	}
414 
415 	tmplen = MAXPATHLEN + MAXHOSTNAMELEN + MAXHOSTNAMELEN;
416 #ifdef INET
417 	ip4s = (j->version == 0) ? 1 : j->ip4s;
418 	if (ip4s > jail_max_af_ips)
419 		return (EINVAL);
420 	tmplen += ip4s * sizeof(struct in_addr);
421 #else
422 	if (j->ip4s > 0)
423 		return (EINVAL);
424 #endif
425 #ifdef INET6
426 	if (j->ip6s > jail_max_af_ips)
427 		return (EINVAL);
428 	tmplen += j->ip6s * sizeof(struct in6_addr);
429 #else
430 	if (j->ip6s > 0)
431 		return (EINVAL);
432 #endif
433 	u_path = malloc(tmplen, M_TEMP, M_WAITOK);
434 	u_hostname = u_path + MAXPATHLEN;
435 	u_name = u_hostname + MAXHOSTNAMELEN;
436 #ifdef INET
437 	u_ip4 = (struct in_addr *)(u_name + MAXHOSTNAMELEN);
438 #endif
439 #ifdef INET6
440 #ifdef INET
441 	u_ip6 = (struct in6_addr *)(u_ip4 + ip4s);
442 #else
443 	u_ip6 = (struct in6_addr *)(u_name + MAXHOSTNAMELEN);
444 #endif
445 #endif
446 	optiov[opt.uio_iovcnt].iov_base = "path";
447 	optiov[opt.uio_iovcnt].iov_len = sizeof("path");
448 	opt.uio_iovcnt++;
449 	optiov[opt.uio_iovcnt].iov_base = u_path;
450 	error = copyinstr(j->path, u_path, MAXPATHLEN,
451 	    &optiov[opt.uio_iovcnt].iov_len);
452 	if (error) {
453 		free(u_path, M_TEMP);
454 		return (error);
455 	}
456 	opt.uio_iovcnt++;
457 	optiov[opt.uio_iovcnt].iov_base = "host.hostname";
458 	optiov[opt.uio_iovcnt].iov_len = sizeof("host.hostname");
459 	opt.uio_iovcnt++;
460 	optiov[opt.uio_iovcnt].iov_base = u_hostname;
461 	error = copyinstr(j->hostname, u_hostname, MAXHOSTNAMELEN,
462 	    &optiov[opt.uio_iovcnt].iov_len);
463 	if (error) {
464 		free(u_path, M_TEMP);
465 		return (error);
466 	}
467 	opt.uio_iovcnt++;
468 	if (j->jailname != NULL) {
469 		optiov[opt.uio_iovcnt].iov_base = "name";
470 		optiov[opt.uio_iovcnt].iov_len = sizeof("name");
471 		opt.uio_iovcnt++;
472 		optiov[opt.uio_iovcnt].iov_base = u_name;
473 		error = copyinstr(j->jailname, u_name, MAXHOSTNAMELEN,
474 		    &optiov[opt.uio_iovcnt].iov_len);
475 		if (error) {
476 			free(u_path, M_TEMP);
477 			return (error);
478 		}
479 		opt.uio_iovcnt++;
480 	}
481 #ifdef INET
482 	optiov[opt.uio_iovcnt].iov_base = "ip4.addr";
483 	optiov[opt.uio_iovcnt].iov_len = sizeof("ip4.addr");
484 	opt.uio_iovcnt++;
485 	optiov[opt.uio_iovcnt].iov_base = u_ip4;
486 	optiov[opt.uio_iovcnt].iov_len = ip4s * sizeof(struct in_addr);
487 	if (j->version == 0)
488 		u_ip4->s_addr = j->ip4s;
489 	else {
490 		error = copyin(j->ip4, u_ip4, optiov[opt.uio_iovcnt].iov_len);
491 		if (error) {
492 			free(u_path, M_TEMP);
493 			return (error);
494 		}
495 	}
496 	opt.uio_iovcnt++;
497 #endif
498 #ifdef INET6
499 	optiov[opt.uio_iovcnt].iov_base = "ip6.addr";
500 	optiov[opt.uio_iovcnt].iov_len = sizeof("ip6.addr");
501 	opt.uio_iovcnt++;
502 	optiov[opt.uio_iovcnt].iov_base = u_ip6;
503 	optiov[opt.uio_iovcnt].iov_len = j->ip6s * sizeof(struct in6_addr);
504 	error = copyin(j->ip6, u_ip6, optiov[opt.uio_iovcnt].iov_len);
505 	if (error) {
506 		free(u_path, M_TEMP);
507 		return (error);
508 	}
509 	opt.uio_iovcnt++;
510 #endif
511 	KASSERT(opt.uio_iovcnt <= nitems(optiov),
512 		("kern_jail: too many iovecs (%d)", opt.uio_iovcnt));
513 	error = kern_jail_set(td, &opt, JAIL_CREATE | JAIL_ATTACH);
514 	free(u_path, M_TEMP);
515 	return (error);
516 }
517 
518 /*
519  * struct jail_set_args {
520  *	struct iovec *iovp;
521  *	unsigned int iovcnt;
522  *	int flags;
523  * };
524  */
525 int
526 sys_jail_set(struct thread *td, struct jail_set_args *uap)
527 {
528 	struct uio *auio;
529 	int error;
530 
531 	/* Check that we have an even number of iovecs. */
532 	if (uap->iovcnt & 1)
533 		return (EINVAL);
534 
535 	error = copyinuio(uap->iovp, uap->iovcnt, &auio);
536 	if (error)
537 		return (error);
538 	error = kern_jail_set(td, auio, uap->flags);
539 	free(auio, M_IOV);
540 	return (error);
541 }
542 
543 #if defined(INET) || defined(INET6)
544 typedef int prison_addr_cmp_t(const void *, const void *);
545 typedef bool prison_addr_valid_t(const void *);
546 static const struct pr_family {
547 	size_t			size;
548 	prison_addr_cmp_t	*cmp;
549 	prison_addr_valid_t	*valid;
550 	int			ip_flag;
551 } pr_families[PR_FAMILY_MAX] = {
552 #ifdef INET
553 	[PR_INET] = {
554 		.size = sizeof(struct in_addr),
555 		.cmp = prison_qcmp_v4,
556 		.valid = prison_valid_v4,
557 		.ip_flag = PR_IP4_USER,
558 	 },
559 #endif
560 #ifdef INET6
561 	[PR_INET6] = {
562 		.size = sizeof(struct in6_addr),
563 		.cmp = prison_qcmp_v6,
564 		.valid = prison_valid_v6,
565 		.ip_flag = PR_IP6_USER,
566 	},
567 #endif
568 };
569 
570 /*
571  * Network address lists (pr_addrs) allocation for jails.  The addresses
572  * are accessed locklessly by the network stack, thus need to be protected by
573  * the network epoch.
574  */
575 struct prison_ip {
576 	struct epoch_context ctx;
577 	uint32_t	ips;
578 #ifdef FUTURE_C
579 	/*
580 	 * XXX Variable-length automatic arrays in union may be
581 	 * supported in future C.
582 	 */
583 	union {
584 		char pr_ip[];
585 		struct in_addr pr_ip4[];
586 		struct in6_addr pr_ip6[];
587 	};
588 #else /* No future C :( */
589 	char pr_ip[];
590 #endif
591 };
592 
593 static char *
594 PR_IP(struct prison_ip *pip, const pr_family_t af, int idx)
595 {
596 	MPASS(pip);
597 	MPASS(af < PR_FAMILY_MAX);
598 	MPASS(idx >= 0 && idx < pip->ips);
599 
600 	return (pip->pr_ip + pr_families[af].size * idx);
601 }
602 
603 static struct prison_ip *
604 prison_ip_alloc(const pr_family_t af, uint32_t cnt, int flags)
605 {
606 	struct prison_ip *pip;
607 
608 	pip = malloc(sizeof(struct prison_ip) + cnt * pr_families[af].size,
609 	    M_PRISON, flags);
610 	if (pip != NULL)
611 		pip->ips = cnt;
612 	return (pip);
613 }
614 
615 /*
616  * Allocate and copyin user supplied address list, sorting and validating.
617  * kern_jail_set() helper.
618  */
619 static struct prison_ip *
620 prison_ip_copyin(const pr_family_t af, void *op, uint32_t cnt)
621 {
622 	prison_addr_cmp_t *const cmp = pr_families[af].cmp;
623 	const size_t size = pr_families[af].size;
624 	struct prison_ip *pip;
625 
626 	pip = prison_ip_alloc(af, cnt, M_WAITOK);
627 	bcopy(op, pip->pr_ip, cnt * size);
628 	/*
629 	 * IP addresses are all sorted but ip[0] to preserve
630 	 * the primary IP address as given from userland.
631 	 * This special IP is used for unbound outgoing
632 	 * connections as well for "loopback" traffic in case
633 	 * source address selection cannot find any more fitting
634 	 * address to connect from.
635 	 */
636 	if (cnt > 1)
637 		qsort(PR_IP(pip, af, 1), cnt - 1, size, cmp);
638 	/*
639 	 * Check for duplicate addresses and do some simple
640 	 * zero and broadcast checks. If users give other bogus
641 	 * addresses it is their problem.
642 	 */
643 	for (int i = 0; i < cnt; i++) {
644 		if (!pr_families[af].valid(PR_IP(pip, af, i))) {
645 			free(pip, M_PRISON);
646 			return (NULL);
647 		}
648 		if (i + 1 < cnt &&
649 		    (cmp(PR_IP(pip, af, 0), PR_IP(pip, af, i + 1)) == 0 ||
650 		     cmp(PR_IP(pip, af, i), PR_IP(pip, af, i + 1)) == 0)) {
651 			free(pip, M_PRISON);
652 			return (NULL);
653 		}
654 	}
655 
656 	return (pip);
657 }
658 
659 /*
660  * Allocate and dup parent prison address list.
661  * kern_jail_set() helper.
662  */
663 static void
664 prison_ip_dup(struct prison *ppr, struct prison *pr, const pr_family_t af)
665 {
666 	const struct prison_ip *ppip = ppr->pr_addrs[af];
667 	struct prison_ip *pip;
668 
669 	if (ppip != NULL) {
670 		pip = prison_ip_alloc(af, ppip->ips, M_WAITOK);
671 		bcopy(ppip->pr_ip, pip->pr_ip, pip->ips * pr_families[af].size);
672 		pr->pr_addrs[af] = pip;
673 	}
674 }
675 
676 /*
677  * Make sure the new set of IP addresses is a subset of the parent's list.
678  * Don't worry about the parent being unlocked, as any setting is done with
679  * allprison_lock held.
680  * kern_jail_set() helper.
681  */
682 static bool
683 prison_ip_parent_match(struct prison_ip *ppip, struct prison_ip *pip,
684     const pr_family_t af)
685 {
686 	prison_addr_cmp_t *const cmp = pr_families[af].cmp;
687 	int i, j;
688 
689 	if (ppip == NULL)
690 		return (false);
691 
692 	for (i = 0; i < ppip->ips; i++)
693 		if (cmp(PR_IP(pip, af, 0), PR_IP(ppip, af, i)) == 0)
694 			break;
695 
696 	if (i == ppip->ips)
697 		/* Main address not present in parent. */
698 		return (false);
699 
700 	if (pip->ips > 1) {
701 		for (i = j = 1; i < pip->ips; i++) {
702 			if (cmp(PR_IP(pip, af, i), PR_IP(ppip, af, 0)) == 0)
703 				/* Equals to parent primary address. */
704 				continue;
705 			for (; j < ppip->ips; j++)
706 				if (cmp(PR_IP(pip, af, i),
707 				    PR_IP(ppip, af, j)) == 0)
708 					break;
709 			if (j == ppip->ips)
710 				break;
711 		}
712 		if (j == ppip->ips)
713 			/* Address not present in parent. */
714 			return (false);
715 	}
716 	return (true);
717 }
718 
719 /*
720  * Check for conflicting IP addresses.  We permit them if there is no more
721  * than one IP on each jail.  If there is a duplicate on a jail with more
722  * than one IP stop checking and return error.
723  * kern_jail_set() helper.
724  */
725 static bool
726 prison_ip_conflict_check(const struct prison *ppr, const struct prison *pr,
727     struct prison_ip *pip, pr_family_t af)
728 {
729 	const struct prison *tppr, *tpr;
730 	int descend;
731 
732 #ifdef VIMAGE
733 	for (tppr = ppr; tppr != &prison0; tppr = tppr->pr_parent)
734 		if (tppr->pr_flags & PR_VNET)
735 			break;
736 #else
737 	tppr = &prison0;
738 #endif
739 	FOREACH_PRISON_DESCENDANT(tppr, tpr, descend) {
740 		if (tpr == pr ||
741 #ifdef VIMAGE
742 		    (tpr != tppr && (tpr->pr_flags & PR_VNET)) ||
743 #endif
744 		    !prison_isalive(tpr)) {
745 			descend = 0;
746 			continue;
747 		}
748 		if (!(tpr->pr_flags & pr_families[af].ip_flag))
749 			continue;
750 		descend = 0;
751 		if (tpr->pr_addrs[af] == NULL ||
752 		    (pip->ips == 1 && tpr->pr_addrs[af]->ips == 1))
753 			continue;
754 		for (int i = 0; i < pip->ips; i++)
755 			if (prison_ip_check(tpr, af, PR_IP(pip, af, i)) == 0)
756 				return (false);
757 	}
758 
759 	return (true);
760 }
761 
762 _Static_assert(offsetof(struct prison_ip, ctx) == 0,
763     "prison must start with epoch context");
764 static void
765 prison_ip_free_deferred(epoch_context_t ctx)
766 {
767 
768 	free(ctx, M_PRISON);
769 }
770 
771 static void
772 prison_ip_free(struct prison_ip *pip)
773 {
774 
775 	if (pip != NULL)
776 		NET_EPOCH_CALL(prison_ip_free_deferred, &pip->ctx);
777 }
778 
779 static void
780 prison_ip_set(struct prison *pr, const pr_family_t af, struct prison_ip *new)
781 {
782 	struct prison_ip **mem, *old;
783 
784 	mtx_assert(&pr->pr_mtx, MA_OWNED);
785 
786 	mem = &pr->pr_addrs[af];
787 
788 	old = *mem;
789 	atomic_store_ptr(mem, new);
790 	prison_ip_free(old);
791 }
792 
793 /*
794  * Restrict a prison's IP address list with its parent's, possibly replacing
795  * it.  Return true if succeed, otherwise should redo.
796  * kern_jail_set() helper.
797  */
798 static bool
799 prison_ip_restrict(struct prison *pr, const pr_family_t af,
800     struct prison_ip **newp)
801 {
802 	struct prison_ip *ppip = pr->pr_parent->pr_addrs[af];
803 	struct prison_ip *pip = pr->pr_addrs[af];
804 	int (*const cmp)(const void *, const void *) = pr_families[af].cmp;
805 	const size_t size = pr_families[af].size;
806 	struct prison_ip *new = newp != NULL ? *newp : NULL;
807 	uint32_t ips;
808 
809 	mtx_assert(&pr->pr_mtx, MA_OWNED);
810 
811 	/*
812 	 * Due to epoch-synchronized access to the IP address lists we always
813 	 * allocate a new list even if the old one has enough space.  We could
814 	 * atomically update an IPv4 address inside a list, but that would
815 	 * screw up sorting, and in case of IPv6 we can't even atomically write
816 	 * one.
817 	 */
818 	if (ppip == NULL) {
819 		if (pip != NULL)
820 			prison_ip_set(pr, af, NULL);
821 		return (true);
822 	}
823 
824 	if (!(pr->pr_flags & pr_families[af].ip_flag)) {
825 		if (new == NULL) {
826 			new = prison_ip_alloc(af, ppip->ips, M_NOWAIT);
827 			if (new == NULL)
828 				return (false); /* Redo */
829 		}
830 		/* This has no user settings, so just copy the parent's list. */
831 		MPASS(new->ips == ppip->ips);
832 		bcopy(ppip->pr_ip, new->pr_ip, ppip->ips * size);
833 		prison_ip_set(pr, af, new);
834 		if (newp != NULL)
835 			*newp = NULL; /* Used */
836 	} else if (pip != NULL) {
837 		/* Remove addresses that aren't in the parent. */
838 		int i;
839 
840 		i = 0; /* index in pip */
841 		ips = 0; /* index in new */
842 
843 		if (new == NULL) {
844 			new = prison_ip_alloc(af, pip->ips, M_NOWAIT);
845 			if (new == NULL)
846 				return (false); /* Redo */
847 		}
848 
849 		for (int pi = 0; pi < ppip->ips; pi++)
850 			if (cmp(PR_IP(pip, af, 0), PR_IP(ppip, af, pi)) == 0) {
851 				/* Found our primary address in parent. */
852 				bcopy(PR_IP(pip, af, i), PR_IP(new, af, ips),
853 				    size);
854 				i++;
855 				ips++;
856 				break;
857 			}
858 		for (int pi = 1; i < pip->ips; ) {
859 			/* Check against primary, which is unsorted. */
860 			if (cmp(PR_IP(pip, af, i), PR_IP(ppip, af, 0)) == 0) {
861 				/* Matches parent's primary address. */
862 				bcopy(PR_IP(pip, af, i), PR_IP(new, af, ips),
863 				    size);
864 				i++;
865 				ips++;
866 				continue;
867 			}
868 			/* The rest are sorted. */
869 			switch (pi >= ppip->ips ? -1 :
870 				cmp(PR_IP(pip, af, i), PR_IP(ppip, af, pi))) {
871 			case -1:
872 				i++;
873 				break;
874 			case 0:
875 				bcopy(PR_IP(pip, af, i), PR_IP(new, af, ips),
876 				    size);
877 				i++;
878 				pi++;
879 				ips++;
880 				break;
881 			case 1:
882 				pi++;
883 				break;
884 			}
885 		}
886 		if (ips == 0) {
887 			if (newp == NULL || *newp == NULL)
888 				prison_ip_free(new);
889 			new = NULL;
890 		} else {
891 			/* Shrink to real size */
892 			KASSERT((new->ips >= ips),
893 			    ("Out-of-bounds write to prison_ip %p", new));
894 			new->ips = ips;
895 		}
896 		prison_ip_set(pr, af, new);
897 		if (newp != NULL)
898 			*newp = NULL; /* Used */
899 	}
900 	return (true);
901 }
902 
903 /*
904  * Fast-path check if an address belongs to a prison.
905  */
906 int
907 prison_ip_check(const struct prison *pr, const pr_family_t af,
908     const void *addr)
909 {
910 	int (*const cmp)(const void *, const void *) = pr_families[af].cmp;
911 	struct prison_ip *pip;
912 	int i, a, z, d;
913 
914 	MPASS(mtx_owned(&pr->pr_mtx) ||
915 	    in_epoch(net_epoch_preempt) ||
916 	    sx_xlocked(&allprison_lock));
917 
918 	pip = atomic_load_ptr(&pr->pr_addrs[af]);
919 	if (__predict_false(pip == NULL))
920 		return (EAFNOSUPPORT);
921 
922 	/* Check the primary IP. */
923 	if (cmp(PR_IP(pip, af, 0), addr) == 0)
924 		return (0);
925 
926 	/*
927 	 * All the other IPs are sorted so we can do a binary search.
928 	 */
929 	a = 0;
930 	z = pip->ips - 2;
931 	while (a <= z) {
932 		i = (a + z) / 2;
933 		d = cmp(PR_IP(pip, af, i + 1), addr);
934 		if (d > 0)
935 			z = i - 1;
936 		else if (d < 0)
937 			a = i + 1;
938 		else
939 			return (0);
940 	}
941 
942 	return (EADDRNOTAVAIL);
943 }
944 
945 /*
946  * Grab primary IP.  Historically required mutex, but nothing prevents
947  * us to support epoch-protected access.  Is it used in fast path?
948  * in{6}_jail.c helper
949  */
950 const void *
951 prison_ip_get0(const struct prison *pr, const pr_family_t af)
952 {
953 	const struct prison_ip *pip = pr->pr_addrs[af];
954 
955 	mtx_assert(&pr->pr_mtx, MA_OWNED);
956 	MPASS(pip);
957 
958 	return (pip->pr_ip);
959 }
960 
961 u_int
962 prison_ip_cnt(const struct prison *pr, const pr_family_t af)
963 {
964 
965 	return (pr->pr_addrs[af]->ips);
966 }
967 #endif	/* defined(INET) || defined(INET6) */
968 
969 int
970 kern_jail_set(struct thread *td, struct uio *optuio, int flags)
971 {
972 	struct nameidata nd;
973 #ifdef INET
974 	struct prison_ip *ip4;
975 #endif
976 #ifdef INET6
977 	struct prison_ip *ip6;
978 #endif
979 	struct vfsopt *opt;
980 	struct vfsoptlist *opts;
981 	struct prison *pr, *deadpr, *inspr, *mypr, *ppr, *tpr;
982 	struct vnode *root;
983 	char *domain, *errmsg, *host, *name, *namelc, *p, *path, *uuid;
984 	char *g_path, *osrelstr;
985 	struct bool_flags *bf;
986 	struct jailsys_flags *jsf;
987 #if defined(INET) || defined(INET6)
988 	void *op;
989 #endif
990 	unsigned long hid;
991 	size_t namelen, onamelen, pnamelen;
992 	int born, created, cuflags, descend, drflags, enforce;
993 	int error, errmsg_len, errmsg_pos;
994 	int gotchildmax, gotenforce, gothid, gotrsnum, gotslevel;
995 	int jid, jsys, len, level;
996 	int childmax, osreldt, rsnum, slevel;
997 #ifdef INET
998 	int ip4s;
999 	bool redo_ip4;
1000 #endif
1001 #ifdef INET6
1002 	int ip6s;
1003 	bool redo_ip6;
1004 #endif
1005 	uint64_t pr_allow, ch_allow, pr_flags, ch_flags;
1006 	uint64_t pr_allow_diff;
1007 	unsigned tallow;
1008 	char numbuf[12];
1009 
1010 	error = priv_check(td, PRIV_JAIL_SET);
1011 	if (!error && (flags & JAIL_ATTACH))
1012 		error = priv_check(td, PRIV_JAIL_ATTACH);
1013 	if (error)
1014 		return (error);
1015 	mypr = td->td_ucred->cr_prison;
1016 	if ((flags & JAIL_CREATE) && mypr->pr_childmax == 0)
1017 		return (EPERM);
1018 	if (flags & ~JAIL_SET_MASK)
1019 		return (EINVAL);
1020 
1021 	/*
1022 	 * Check all the parameters before committing to anything.  Not all
1023 	 * errors can be caught early, but we may as well try.  Also, this
1024 	 * takes care of some expensive stuff (path lookup) before getting
1025 	 * the allprison lock.
1026 	 *
1027 	 * XXX Jails are not filesystems, and jail parameters are not mount
1028 	 *     options.  But it makes more sense to re-use the vfsopt code
1029 	 *     than duplicate it under a different name.
1030 	 */
1031 	error = vfs_buildopts(optuio, &opts);
1032 	if (error)
1033 		return (error);
1034 #ifdef INET
1035 	ip4 = NULL;
1036 #endif
1037 #ifdef INET6
1038 	ip6 = NULL;
1039 #endif
1040 	g_path = NULL;
1041 
1042 	cuflags = flags & (JAIL_CREATE | JAIL_UPDATE);
1043 	if (!cuflags) {
1044 		error = EINVAL;
1045 		vfs_opterror(opts, "no valid operation (create or update)");
1046 		goto done_errmsg;
1047 	}
1048 
1049 	error = vfs_copyopt(opts, "jid", &jid, sizeof(jid));
1050 	if (error == ENOENT)
1051 		jid = 0;
1052 	else if (error != 0)
1053 		goto done_free;
1054 
1055 	error = vfs_copyopt(opts, "securelevel", &slevel, sizeof(slevel));
1056 	if (error == ENOENT)
1057 		gotslevel = 0;
1058 	else if (error != 0)
1059 		goto done_free;
1060 	else
1061 		gotslevel = 1;
1062 
1063 	error =
1064 	    vfs_copyopt(opts, "children.max", &childmax, sizeof(childmax));
1065 	if (error == ENOENT)
1066 		gotchildmax = 0;
1067 	else if (error != 0)
1068 		goto done_free;
1069 	else
1070 		gotchildmax = 1;
1071 
1072 	error = vfs_copyopt(opts, "enforce_statfs", &enforce, sizeof(enforce));
1073 	if (error == ENOENT)
1074 		gotenforce = 0;
1075 	else if (error != 0)
1076 		goto done_free;
1077 	else if (enforce < 0 || enforce > 2) {
1078 		error = EINVAL;
1079 		goto done_free;
1080 	} else
1081 		gotenforce = 1;
1082 
1083 	error = vfs_copyopt(opts, "devfs_ruleset", &rsnum, sizeof(rsnum));
1084 	if (error == ENOENT)
1085 		gotrsnum = 0;
1086 	else if (error != 0)
1087 		goto done_free;
1088 	else
1089 		gotrsnum = 1;
1090 
1091 	pr_flags = ch_flags = 0;
1092 	for (bf = pr_flag_bool;
1093 	     bf < pr_flag_bool + nitems(pr_flag_bool);
1094 	     bf++) {
1095 		vfs_flagopt(opts, bf->name, &pr_flags, bf->flag);
1096 		vfs_flagopt(opts, bf->noname, &ch_flags, bf->flag);
1097 	}
1098 	ch_flags |= pr_flags;
1099 	for (jsf = pr_flag_jailsys;
1100 	     jsf < pr_flag_jailsys + nitems(pr_flag_jailsys);
1101 	     jsf++) {
1102 		error = vfs_copyopt(opts, jsf->name, &jsys, sizeof(jsys));
1103 		if (error == ENOENT)
1104 			continue;
1105 		if (error != 0)
1106 			goto done_free;
1107 		switch (jsys) {
1108 		case JAIL_SYS_DISABLE:
1109 			if (!jsf->disable) {
1110 				error = EINVAL;
1111 				goto done_free;
1112 			}
1113 			pr_flags |= jsf->disable;
1114 			break;
1115 		case JAIL_SYS_NEW:
1116 			pr_flags |= jsf->new;
1117 			break;
1118 		case JAIL_SYS_INHERIT:
1119 			break;
1120 		default:
1121 			error = EINVAL;
1122 			goto done_free;
1123 		}
1124 		ch_flags |= jsf->new | jsf->disable;
1125 	}
1126 	if ((flags & (JAIL_CREATE | JAIL_ATTACH)) == JAIL_CREATE
1127 	    && !(pr_flags & PR_PERSIST)) {
1128 		error = EINVAL;
1129 		vfs_opterror(opts, "new jail must persist or attach");
1130 		goto done_errmsg;
1131 	}
1132 #ifdef VIMAGE
1133 	if ((flags & JAIL_UPDATE) && (ch_flags & PR_VNET)) {
1134 		error = EINVAL;
1135 		vfs_opterror(opts, "vnet cannot be changed after creation");
1136 		goto done_errmsg;
1137 	}
1138 #endif
1139 #ifdef INET
1140 	if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP4_USER)) {
1141 		error = EINVAL;
1142 		vfs_opterror(opts, "ip4 cannot be changed after creation");
1143 		goto done_errmsg;
1144 	}
1145 #endif
1146 #ifdef INET6
1147 	if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP6_USER)) {
1148 		error = EINVAL;
1149 		vfs_opterror(opts, "ip6 cannot be changed after creation");
1150 		goto done_errmsg;
1151 	}
1152 #endif
1153 
1154 	pr_allow = ch_allow = 0;
1155 	for (bf = pr_flag_allow;
1156 	     bf < pr_flag_allow + nitems(pr_flag_allow) &&
1157 		atomic_load_int(&bf->flag) != 0;
1158 	     bf++) {
1159 		vfs_flagopt(opts, bf->name, &pr_allow, bf->flag);
1160 		vfs_flagopt(opts, bf->noname, &ch_allow, bf->flag);
1161 	}
1162 	ch_allow |= pr_allow;
1163 
1164 	error = vfs_getopt(opts, "name", (void **)&name, &len);
1165 	if (error == ENOENT)
1166 		name = NULL;
1167 	else if (error != 0)
1168 		goto done_free;
1169 	else {
1170 		if (len == 0 || name[len - 1] != '\0') {
1171 			error = EINVAL;
1172 			goto done_free;
1173 		}
1174 		if (len > MAXHOSTNAMELEN) {
1175 			error = ENAMETOOLONG;
1176 			goto done_free;
1177 		}
1178 	}
1179 
1180 	error = vfs_getopt(opts, "host.hostname", (void **)&host, &len);
1181 	if (error == ENOENT)
1182 		host = NULL;
1183 	else if (error != 0)
1184 		goto done_free;
1185 	else {
1186 		ch_flags |= PR_HOST;
1187 		pr_flags |= PR_HOST;
1188 		if (len == 0 || host[len - 1] != '\0') {
1189 			error = EINVAL;
1190 			goto done_free;
1191 		}
1192 		if (len > MAXHOSTNAMELEN) {
1193 			error = ENAMETOOLONG;
1194 			goto done_free;
1195 		}
1196 	}
1197 
1198 	error = vfs_getopt(opts, "host.domainname", (void **)&domain, &len);
1199 	if (error == ENOENT)
1200 		domain = NULL;
1201 	else if (error != 0)
1202 		goto done_free;
1203 	else {
1204 		ch_flags |= PR_HOST;
1205 		pr_flags |= PR_HOST;
1206 		if (len == 0 || domain[len - 1] != '\0') {
1207 			error = EINVAL;
1208 			goto done_free;
1209 		}
1210 		if (len > MAXHOSTNAMELEN) {
1211 			error = ENAMETOOLONG;
1212 			goto done_free;
1213 		}
1214 	}
1215 
1216 	error = vfs_getopt(opts, "host.hostuuid", (void **)&uuid, &len);
1217 	if (error == ENOENT)
1218 		uuid = NULL;
1219 	else if (error != 0)
1220 		goto done_free;
1221 	else {
1222 		ch_flags |= PR_HOST;
1223 		pr_flags |= PR_HOST;
1224 		if (len == 0 || uuid[len - 1] != '\0') {
1225 			error = EINVAL;
1226 			goto done_free;
1227 		}
1228 		if (len > HOSTUUIDLEN) {
1229 			error = ENAMETOOLONG;
1230 			goto done_free;
1231 		}
1232 	}
1233 
1234 #ifdef COMPAT_FREEBSD32
1235 	if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) {
1236 		uint32_t hid32;
1237 
1238 		error = vfs_copyopt(opts, "host.hostid", &hid32, sizeof(hid32));
1239 		hid = hid32;
1240 	} else
1241 #endif
1242 		error = vfs_copyopt(opts, "host.hostid", &hid, sizeof(hid));
1243 	if (error == ENOENT)
1244 		gothid = 0;
1245 	else if (error != 0)
1246 		goto done_free;
1247 	else {
1248 		gothid = 1;
1249 		ch_flags |= PR_HOST;
1250 		pr_flags |= PR_HOST;
1251 	}
1252 
1253 #ifdef INET
1254 	error = vfs_getopt(opts, "ip4.addr", &op, &ip4s);
1255 	if (error == ENOENT)
1256 		ip4s = 0;
1257 	else if (error != 0)
1258 		goto done_free;
1259 	else if (ip4s & (sizeof(struct in_addr) - 1)) {
1260 		error = EINVAL;
1261 		goto done_free;
1262 	} else {
1263 		ch_flags |= PR_IP4_USER;
1264 		pr_flags |= PR_IP4_USER;
1265 		if (ip4s > 0) {
1266 			ip4s /= sizeof(struct in_addr);
1267 			if (ip4s > jail_max_af_ips) {
1268 				error = EINVAL;
1269 				vfs_opterror(opts, "too many IPv4 addresses");
1270 				goto done_errmsg;
1271 			}
1272 			ip4 = prison_ip_copyin(PR_INET, op, ip4s);
1273 			if (ip4 == NULL) {
1274 				error = EINVAL;
1275 				goto done_free;
1276 			}
1277 		}
1278 	}
1279 #endif
1280 
1281 #ifdef INET6
1282 	error = vfs_getopt(opts, "ip6.addr", &op, &ip6s);
1283 	if (error == ENOENT)
1284 		ip6s = 0;
1285 	else if (error != 0)
1286 		goto done_free;
1287 	else if (ip6s & (sizeof(struct in6_addr) - 1)) {
1288 		error = EINVAL;
1289 		goto done_free;
1290 	} else {
1291 		ch_flags |= PR_IP6_USER;
1292 		pr_flags |= PR_IP6_USER;
1293 		if (ip6s > 0) {
1294 			ip6s /= sizeof(struct in6_addr);
1295 			if (ip6s > jail_max_af_ips) {
1296 				error = EINVAL;
1297 				vfs_opterror(opts, "too many IPv6 addresses");
1298 				goto done_errmsg;
1299 			}
1300 			ip6 = prison_ip_copyin(PR_INET6, op, ip6s);
1301 			if (ip6 == NULL) {
1302 				error = EINVAL;
1303 				goto done_free;
1304 			}
1305 		}
1306 	}
1307 #endif
1308 
1309 #if defined(VIMAGE) && (defined(INET) || defined(INET6))
1310 	if ((ch_flags & PR_VNET) && (ch_flags & (PR_IP4_USER | PR_IP6_USER))) {
1311 		error = EINVAL;
1312 		vfs_opterror(opts,
1313 		    "vnet jails cannot have IP address restrictions");
1314 		goto done_errmsg;
1315 	}
1316 #endif
1317 
1318 	error = vfs_getopt(opts, "osrelease", (void **)&osrelstr, &len);
1319 	if (error == ENOENT)
1320 		osrelstr = NULL;
1321 	else if (error != 0)
1322 		goto done_free;
1323 	else {
1324 		if (flags & JAIL_UPDATE) {
1325 			error = EINVAL;
1326 			vfs_opterror(opts,
1327 			    "osrelease cannot be changed after creation");
1328 			goto done_errmsg;
1329 		}
1330 		if (len == 0 || osrelstr[len - 1] != '\0') {
1331 			error = EINVAL;
1332 			goto done_free;
1333 		}
1334 		if (len >= OSRELEASELEN) {
1335 			error = ENAMETOOLONG;
1336 			vfs_opterror(opts,
1337 			    "osrelease string must be 1-%d bytes long",
1338 			    OSRELEASELEN - 1);
1339 			goto done_errmsg;
1340 		}
1341 	}
1342 
1343 	error = vfs_copyopt(opts, "osreldate", &osreldt, sizeof(osreldt));
1344 	if (error == ENOENT)
1345 		osreldt = 0;
1346 	else if (error != 0)
1347 		goto done_free;
1348 	else {
1349 		if (flags & JAIL_UPDATE) {
1350 			error = EINVAL;
1351 			vfs_opterror(opts,
1352 			    "osreldate cannot be changed after creation");
1353 			goto done_errmsg;
1354 		}
1355 		if (osreldt == 0) {
1356 			error = EINVAL;
1357 			vfs_opterror(opts, "osreldate cannot be 0");
1358 			goto done_errmsg;
1359 		}
1360 	}
1361 
1362 	root = NULL;
1363 	error = vfs_getopt(opts, "path", (void **)&path, &len);
1364 	if (error == ENOENT)
1365 		path = NULL;
1366 	else if (error != 0)
1367 		goto done_free;
1368 	else {
1369 		if (flags & JAIL_UPDATE) {
1370 			error = EINVAL;
1371 			vfs_opterror(opts,
1372 			    "path cannot be changed after creation");
1373 			goto done_errmsg;
1374 		}
1375 		if (len == 0 || path[len - 1] != '\0') {
1376 			error = EINVAL;
1377 			goto done_free;
1378 		}
1379 		NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE, path);
1380 		error = namei(&nd);
1381 		if (error)
1382 			goto done_free;
1383 		root = nd.ni_vp;
1384 		NDFREE_PNBUF(&nd);
1385 		g_path = malloc(MAXPATHLEN, M_TEMP, M_WAITOK);
1386 		strlcpy(g_path, path, MAXPATHLEN);
1387 		error = vn_path_to_global_path(td, root, g_path, MAXPATHLEN);
1388 		if (error == 0) {
1389 			path = g_path;
1390 		} else {
1391 			/* exit on other errors */
1392 			goto done_free;
1393 		}
1394 		if (root->v_type != VDIR) {
1395 			error = ENOTDIR;
1396 			vput(root);
1397 			goto done_free;
1398 		}
1399 		VOP_UNLOCK(root);
1400 	}
1401 
1402 	/*
1403 	 * Find the specified jail, or at least its parent.
1404 	 * This abuses the file error codes ENOENT and EEXIST.
1405 	 */
1406 	pr = NULL;
1407 	inspr = NULL;
1408 	if (cuflags == JAIL_CREATE && jid == 0 && name != NULL) {
1409 		namelc = strrchr(name, '.');
1410 		jid = strtoul(namelc != NULL ? namelc + 1 : name, &p, 10);
1411 		if (*p != '\0')
1412 			jid = 0;
1413 	}
1414 	sx_xlock(&allprison_lock);
1415 	drflags = PD_LIST_XLOCKED;
1416 	ppr = mypr;
1417 	if (!prison_isalive(ppr)) {
1418 		/* This jail is dying.  This process will surely follow. */
1419 		error = EAGAIN;
1420 		goto done_deref;
1421 	}
1422 	if (jid != 0) {
1423 		if (jid < 0) {
1424 			error = EINVAL;
1425 			vfs_opterror(opts, "negative jid");
1426 			goto done_deref;
1427 		}
1428 		/*
1429 		 * See if a requested jid already exists.  Keep track of
1430 		 * where it can be inserted later.
1431 		 */
1432 		TAILQ_FOREACH(inspr, &allprison, pr_list) {
1433 			if (inspr->pr_id < jid)
1434 				continue;
1435 			if (inspr->pr_id > jid)
1436 				break;
1437 			pr = inspr;
1438 			mtx_lock(&pr->pr_mtx);
1439 			drflags |= PD_LOCKED;
1440 			inspr = NULL;
1441 			break;
1442 		}
1443 		if (pr != NULL) {
1444 			/* Create: jid must not exist. */
1445 			if (cuflags == JAIL_CREATE) {
1446 				/*
1447 				 * Even creators that cannot see the jail will
1448 				 * get EEXIST.
1449 				 */
1450 				error = EEXIST;
1451 				vfs_opterror(opts, "jail %d already exists",
1452 				    jid);
1453 				goto done_deref;
1454 			}
1455 			if (!prison_ischild(mypr, pr)) {
1456 				/*
1457 				 * Updaters get ENOENT if they cannot see the
1458 				 * jail.  This is true even for CREATE | UPDATE,
1459 				 * which normally cannot give this error.
1460 				 */
1461 				error = ENOENT;
1462 				vfs_opterror(opts, "jail %d not found", jid);
1463 				goto done_deref;
1464 			}
1465 			ppr = pr->pr_parent;
1466 			if (!prison_isalive(ppr)) {
1467 				error = ENOENT;
1468 				vfs_opterror(opts, "jail %d is dying",
1469 				    ppr->pr_id);
1470 				goto done_deref;
1471 			}
1472 			if (!prison_isalive(pr)) {
1473 				if (!(flags & JAIL_DYING)) {
1474 					error = ENOENT;
1475 					vfs_opterror(opts, "jail %d is dying",
1476 					    jid);
1477 					goto done_deref;
1478 				}
1479 				if ((flags & JAIL_ATTACH) ||
1480 				    (pr_flags & PR_PERSIST)) {
1481 					/*
1482 					 * A dying jail might be resurrected
1483 					 * (via attach or persist), but first
1484 					 * it must determine if another jail
1485 					 * has claimed its name.  Accomplish
1486 					 * this by implicitly re-setting the
1487 					 * name.
1488 					 */
1489 					if (name == NULL)
1490 						name = prison_name(mypr, pr);
1491 				}
1492 			}
1493 		} else {
1494 			/* Update: jid must exist. */
1495 			if (cuflags == JAIL_UPDATE) {
1496 				error = ENOENT;
1497 				vfs_opterror(opts, "jail %d not found", jid);
1498 				goto done_deref;
1499 			}
1500 		}
1501 	}
1502 	/*
1503 	 * If the caller provided a name, look for a jail by that name.
1504 	 * This has different semantics for creates and updates keyed by jid
1505 	 * (where the name must not already exist in a different jail),
1506 	 * and updates keyed by the name itself (where the name must exist
1507 	 * because that is the jail being updated).
1508 	 */
1509 	namelc = NULL;
1510 	if (name != NULL) {
1511 		namelc = strrchr(name, '.');
1512 		if (namelc == NULL)
1513 			namelc = name;
1514 		else {
1515 			/*
1516 			 * This is a hierarchical name.  Split it into the
1517 			 * parent and child names, and make sure the parent
1518 			 * exists or matches an already found jail.
1519 			 */
1520 			if (pr != NULL) {
1521 				if (strncmp(name, ppr->pr_name, namelc - name)
1522 				    || ppr->pr_name[namelc - name] != '\0') {
1523 					error = EINVAL;
1524 					vfs_opterror(opts,
1525 					    "cannot change jail's parent");
1526 					goto done_deref;
1527 				}
1528 			} else {
1529 				*namelc = '\0';
1530 				ppr = prison_find_name(mypr, name);
1531 				if (ppr == NULL) {
1532 					error = ENOENT;
1533 					vfs_opterror(opts,
1534 					    "jail \"%s\" not found", name);
1535 					goto done_deref;
1536 				}
1537 				mtx_unlock(&ppr->pr_mtx);
1538 				if (!prison_isalive(ppr)) {
1539 					error = ENOENT;
1540 					vfs_opterror(opts,
1541 					    "jail \"%s\" is dying", name);
1542 					goto done_deref;
1543 				}
1544 				*namelc = '.';
1545 			}
1546 			namelc++;
1547 		}
1548 		if (namelc[0] != '\0') {
1549 			pnamelen =
1550 			    (ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1;
1551 			deadpr = NULL;
1552 			FOREACH_PRISON_CHILD(ppr, tpr) {
1553 				if (tpr != pr &&
1554 				    !strcmp(tpr->pr_name + pnamelen, namelc)) {
1555 					if (prison_isalive(tpr)) {
1556 						if (pr == NULL &&
1557 						    cuflags != JAIL_CREATE) {
1558 							/*
1559 							 * Use this jail
1560 							 * for updates.
1561 							 */
1562 							pr = tpr;
1563 							mtx_lock(&pr->pr_mtx);
1564 							drflags |= PD_LOCKED;
1565 							break;
1566 						}
1567 						/*
1568 						 * Create, or update(jid):
1569 						 * name must not exist in an
1570 						 * active sibling jail.
1571 						 */
1572 						error = EEXIST;
1573 						vfs_opterror(opts,
1574 						   "jail \"%s\" already exists",
1575 						   name);
1576 						goto done_deref;
1577 					}
1578 					if (pr == NULL &&
1579 					    cuflags != JAIL_CREATE) {
1580 						deadpr = tpr;
1581 					}
1582 				}
1583 			}
1584 			/* If no active jail is found, use a dying one. */
1585 			if (deadpr != NULL && pr == NULL) {
1586 				if (flags & JAIL_DYING) {
1587 					pr = deadpr;
1588 					mtx_lock(&pr->pr_mtx);
1589 					drflags |= PD_LOCKED;
1590 				} else if (cuflags == JAIL_UPDATE) {
1591 					error = ENOENT;
1592 					vfs_opterror(opts,
1593 					    "jail \"%s\" is dying", name);
1594 					goto done_deref;
1595 				}
1596 			}
1597 			/* Update: name must exist if no jid. */
1598 			else if (cuflags == JAIL_UPDATE && pr == NULL) {
1599 				error = ENOENT;
1600 				vfs_opterror(opts, "jail \"%s\" not found",
1601 				    name);
1602 				goto done_deref;
1603 			}
1604 		}
1605 	}
1606 	/* Update: must provide a jid or name. */
1607 	else if (cuflags == JAIL_UPDATE && pr == NULL) {
1608 		error = ENOENT;
1609 		vfs_opterror(opts, "update specified no jail");
1610 		goto done_deref;
1611 	}
1612 
1613 	/* If there's no prison to update, create a new one and link it in. */
1614 	created = pr == NULL;
1615 	if (created) {
1616 		for (tpr = mypr; tpr != NULL; tpr = tpr->pr_parent)
1617 			if (tpr->pr_childcount >= tpr->pr_childmax) {
1618 				error = EPERM;
1619 				vfs_opterror(opts, "prison limit exceeded");
1620 				goto done_deref;
1621 			}
1622 		if (jid == 0 && (jid = get_next_prid(&inspr)) == 0) {
1623 			error = EAGAIN;
1624 			vfs_opterror(opts, "no available jail IDs");
1625 			goto done_deref;
1626 		}
1627 
1628 		pr = malloc(sizeof(*pr), M_PRISON, M_WAITOK | M_ZERO);
1629 		pr->pr_state = PRISON_STATE_INVALID;
1630 		refcount_init(&pr->pr_ref, 1);
1631 		refcount_init(&pr->pr_uref, 0);
1632 		drflags |= PD_DEREF;
1633 		LIST_INIT(&pr->pr_children);
1634 		mtx_init(&pr->pr_mtx, "jail mutex", NULL, MTX_DEF | MTX_DUPOK);
1635 		TASK_INIT(&pr->pr_task, 0, prison_complete, pr);
1636 
1637 		pr->pr_id = jid;
1638 		if (inspr != NULL)
1639 			TAILQ_INSERT_BEFORE(inspr, pr, pr_list);
1640 		else
1641 			TAILQ_INSERT_TAIL(&allprison, pr, pr_list);
1642 
1643 		pr->pr_parent = ppr;
1644 		prison_hold(ppr);
1645 		prison_proc_hold(ppr);
1646 		LIST_INSERT_HEAD(&ppr->pr_children, pr, pr_sibling);
1647 		for (tpr = ppr; tpr != NULL; tpr = tpr->pr_parent)
1648 			tpr->pr_childcount++;
1649 
1650 		/* Set some default values, and inherit some from the parent. */
1651 		if (namelc == NULL)
1652 			namelc = "";
1653 		if (path == NULL) {
1654 			path = "/";
1655 			root = mypr->pr_root;
1656 			vref(root);
1657 		}
1658 		strlcpy(pr->pr_hostuuid, DEFAULT_HOSTUUID, HOSTUUIDLEN);
1659 		pr->pr_flags |= PR_HOST;
1660 #if defined(INET) || defined(INET6)
1661 #ifdef VIMAGE
1662 		if (!(pr_flags & PR_VNET))
1663 #endif
1664 		{
1665 #ifdef INET
1666 			if (!(ch_flags & PR_IP4_USER))
1667 				pr->pr_flags |= PR_IP4 | PR_IP4_USER;
1668 			else if (!(pr_flags & PR_IP4_USER)) {
1669 				pr->pr_flags |= ppr->pr_flags & PR_IP4;
1670 				prison_ip_dup(ppr, pr, PR_INET);
1671 			}
1672 #endif
1673 #ifdef INET6
1674 			if (!(ch_flags & PR_IP6_USER))
1675 				pr->pr_flags |= PR_IP6 | PR_IP6_USER;
1676 			else if (!(pr_flags & PR_IP6_USER)) {
1677 				pr->pr_flags |= ppr->pr_flags & PR_IP6;
1678 				prison_ip_dup(ppr, pr, PR_INET6);
1679 			}
1680 #endif
1681 		}
1682 #endif
1683 		/* Source address selection is always on by default. */
1684 		pr->pr_flags |= _PR_IP_SADDRSEL;
1685 
1686 		pr->pr_securelevel = ppr->pr_securelevel;
1687 		pr->pr_allow = JAIL_DEFAULT_ALLOW & ppr->pr_allow;
1688 		pr->pr_enforce_statfs = jail_default_enforce_statfs;
1689 		pr->pr_devfs_rsnum = ppr->pr_devfs_rsnum;
1690 
1691 		pr->pr_osreldate = osreldt ? osreldt : ppr->pr_osreldate;
1692 		if (osrelstr == NULL)
1693 			strlcpy(pr->pr_osrelease, ppr->pr_osrelease,
1694 			    sizeof(pr->pr_osrelease));
1695 		else
1696 			strlcpy(pr->pr_osrelease, osrelstr,
1697 			    sizeof(pr->pr_osrelease));
1698 
1699 #ifdef VIMAGE
1700 		/* Allocate a new vnet if specified. */
1701 		pr->pr_vnet = (pr_flags & PR_VNET)
1702 		    ? vnet_alloc() : ppr->pr_vnet;
1703 #endif
1704 		/*
1705 		 * Allocate a dedicated cpuset for each jail.
1706 		 * Unlike other initial settings, this may return an error.
1707 		 */
1708 		error = cpuset_create_root(ppr, &pr->pr_cpuset);
1709 		if (error)
1710 			goto done_deref;
1711 
1712 		mtx_lock(&pr->pr_mtx);
1713 		drflags |= PD_LOCKED;
1714 	} else {
1715 		/*
1716 		 * Grab a reference for existing prisons, to ensure they
1717 		 * continue to exist for the duration of the call.
1718 		 */
1719 		prison_hold(pr);
1720 		drflags |= PD_DEREF;
1721 #if defined(VIMAGE) && (defined(INET) || defined(INET6))
1722 		if ((pr->pr_flags & PR_VNET) &&
1723 		    (ch_flags & (PR_IP4_USER | PR_IP6_USER))) {
1724 			error = EINVAL;
1725 			vfs_opterror(opts,
1726 			    "vnet jails cannot have IP address restrictions");
1727 			goto done_deref;
1728 		}
1729 #endif
1730 #ifdef INET
1731 		if (PR_IP4_USER & ch_flags & (pr_flags ^ pr->pr_flags)) {
1732 			error = EINVAL;
1733 			vfs_opterror(opts,
1734 			    "ip4 cannot be changed after creation");
1735 			goto done_deref;
1736 		}
1737 #endif
1738 #ifdef INET6
1739 		if (PR_IP6_USER & ch_flags & (pr_flags ^ pr->pr_flags)) {
1740 			error = EINVAL;
1741 			vfs_opterror(opts,
1742 			    "ip6 cannot be changed after creation");
1743 			goto done_deref;
1744 		}
1745 #endif
1746 	}
1747 
1748 	/* Do final error checking before setting anything. */
1749 	if (gotslevel) {
1750 		if (slevel < ppr->pr_securelevel) {
1751 			error = EPERM;
1752 			goto done_deref;
1753 		}
1754 	}
1755 	if (gotchildmax) {
1756 		if (childmax >= ppr->pr_childmax) {
1757 			error = EPERM;
1758 			goto done_deref;
1759 		}
1760 	}
1761 	if (gotenforce) {
1762 		if (enforce < ppr->pr_enforce_statfs) {
1763 			error = EPERM;
1764 			goto done_deref;
1765 		}
1766 	}
1767 	if (gotrsnum) {
1768 		/*
1769 		 * devfs_rsnum is a uint16_t
1770 		 */
1771 		if (rsnum < 0 || rsnum > 65535) {
1772 			error = EINVAL;
1773 			goto done_deref;
1774 		}
1775 		/*
1776 		 * Nested jails always inherit parent's devfs ruleset
1777 		 */
1778 		if (jailed(td->td_ucred)) {
1779 			if (rsnum > 0 && rsnum != ppr->pr_devfs_rsnum) {
1780 				error = EPERM;
1781 				goto done_deref;
1782 			} else
1783 				rsnum = ppr->pr_devfs_rsnum;
1784 		}
1785 	}
1786 #ifdef INET
1787 	if (ip4s > 0) {
1788 		if ((ppr->pr_flags & PR_IP4) &&
1789 		    !prison_ip_parent_match(ppr->pr_addrs[PR_INET], ip4,
1790 		    PR_INET)) {
1791 			error = EPERM;
1792 			goto done_deref;
1793 		}
1794 		if (!prison_ip_conflict_check(ppr, pr, ip4, PR_INET)) {
1795 			error = EADDRINUSE;
1796 			vfs_opterror(opts, "IPv4 addresses clash");
1797 			goto done_deref;
1798 		}
1799 	}
1800 #endif
1801 #ifdef INET6
1802 	if (ip6s > 0) {
1803 		if ((ppr->pr_flags & PR_IP6) &&
1804 		    !prison_ip_parent_match(ppr->pr_addrs[PR_INET6], ip6,
1805 		    PR_INET6)) {
1806 			error = EPERM;
1807 			goto done_deref;
1808 		}
1809 		if (!prison_ip_conflict_check(ppr, pr, ip6, PR_INET6)) {
1810 			error = EADDRINUSE;
1811 			vfs_opterror(opts, "IPv6 addresses clash");
1812 			goto done_deref;
1813 		}
1814 	}
1815 #endif
1816 	onamelen = namelen = 0;
1817 	if (namelc != NULL) {
1818 		/* Give a default name of the jid.  Also allow the name to be
1819 		 * explicitly the jid - but not any other number, and only in
1820 		 * normal form (no leading zero/etc).
1821 		 */
1822 		if (namelc[0] == '\0')
1823 			snprintf(namelc = numbuf, sizeof(numbuf), "%d", jid);
1824 		else if ((strtoul(namelc, &p, 10) != jid ||
1825 			  namelc[0] < '1' || namelc[0] > '9') && *p == '\0') {
1826 			error = EINVAL;
1827 			vfs_opterror(opts,
1828 			    "name cannot be numeric (unless it is the jid)");
1829 			goto done_deref;
1830 		}
1831 		/*
1832 		 * Make sure the name isn't too long for the prison or its
1833 		 * children.
1834 		 */
1835 		pnamelen = (ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1;
1836 		onamelen = strlen(pr->pr_name + pnamelen);
1837 		namelen = strlen(namelc);
1838 		if (pnamelen + namelen + 1 > sizeof(pr->pr_name)) {
1839 			error = ENAMETOOLONG;
1840 			goto done_deref;
1841 		}
1842 		FOREACH_PRISON_DESCENDANT(pr, tpr, descend) {
1843 			if (strlen(tpr->pr_name) + (namelen - onamelen) >=
1844 			    sizeof(pr->pr_name)) {
1845 				error = ENAMETOOLONG;
1846 				goto done_deref;
1847 			}
1848 		}
1849 	}
1850 	pr_allow_diff = pr_allow & ~ppr->pr_allow;
1851 	if (pr_allow_diff & ~PR_ALLOW_DIFFERENCES) {
1852 		error = EPERM;
1853 		goto done_deref;
1854 	}
1855 
1856 	/*
1857 	 * Let modules check their parameters.  This requires unlocking and
1858 	 * then re-locking the prison, but this is still a valid state as long
1859 	 * as allprison_lock remains xlocked.
1860 	 */
1861 	mtx_unlock(&pr->pr_mtx);
1862 	drflags &= ~PD_LOCKED;
1863 	error = osd_jail_call(pr, PR_METHOD_CHECK, opts);
1864 	if (error != 0)
1865 		goto done_deref;
1866 	mtx_lock(&pr->pr_mtx);
1867 	drflags |= PD_LOCKED;
1868 
1869 	/* At this point, all valid parameters should have been noted. */
1870 	TAILQ_FOREACH(opt, opts, link) {
1871 		if (!opt->seen && strcmp(opt->name, "errmsg")) {
1872 			error = EINVAL;
1873 			vfs_opterror(opts, "unknown parameter: %s", opt->name);
1874 			goto done_deref;
1875 		}
1876 	}
1877 
1878 	/* Set the parameters of the prison. */
1879 #ifdef INET
1880 	redo_ip4 = false;
1881 	if (pr_flags & PR_IP4_USER) {
1882 		pr->pr_flags |= PR_IP4;
1883 		prison_ip_set(pr, PR_INET, ip4);
1884 		ip4 = NULL;
1885 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1886 #ifdef VIMAGE
1887 			if (tpr->pr_flags & PR_VNET) {
1888 				descend = 0;
1889 				continue;
1890 			}
1891 #endif
1892 			if (!prison_ip_restrict(tpr, PR_INET, NULL)) {
1893 				redo_ip4 = true;
1894 				descend = 0;
1895 			}
1896 		}
1897 	}
1898 #endif
1899 #ifdef INET6
1900 	redo_ip6 = false;
1901 	if (pr_flags & PR_IP6_USER) {
1902 		pr->pr_flags |= PR_IP6;
1903 		prison_ip_set(pr, PR_INET6, ip6);
1904 		ip6 = NULL;
1905 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1906 #ifdef VIMAGE
1907 			if (tpr->pr_flags & PR_VNET) {
1908 				descend = 0;
1909 				continue;
1910 			}
1911 #endif
1912 			if (!prison_ip_restrict(tpr, PR_INET6, NULL)) {
1913 				redo_ip6 = true;
1914 				descend = 0;
1915 			}
1916 		}
1917 	}
1918 #endif
1919 	if (gotslevel) {
1920 		pr->pr_securelevel = slevel;
1921 		/* Set all child jails to be at least this level. */
1922 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
1923 			if (tpr->pr_securelevel < slevel)
1924 				tpr->pr_securelevel = slevel;
1925 	}
1926 	if (gotchildmax) {
1927 		pr->pr_childmax = childmax;
1928 		/* Set all child jails to under this limit. */
1929 		FOREACH_PRISON_DESCENDANT_LOCKED_LEVEL(pr, tpr, descend, level)
1930 			if (tpr->pr_childmax > childmax - level)
1931 				tpr->pr_childmax = childmax > level
1932 				    ? childmax - level : 0;
1933 	}
1934 	if (gotenforce) {
1935 		pr->pr_enforce_statfs = enforce;
1936 		/* Pass this restriction on to the children. */
1937 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
1938 			if (tpr->pr_enforce_statfs < enforce)
1939 				tpr->pr_enforce_statfs = enforce;
1940 	}
1941 	if (gotrsnum) {
1942 		pr->pr_devfs_rsnum = rsnum;
1943 		/* Pass this restriction on to the children. */
1944 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
1945 			tpr->pr_devfs_rsnum = rsnum;
1946 	}
1947 	if (namelc != NULL) {
1948 		if (ppr == &prison0)
1949 			strlcpy(pr->pr_name, namelc, sizeof(pr->pr_name));
1950 		else
1951 			snprintf(pr->pr_name, sizeof(pr->pr_name), "%s.%s",
1952 			    ppr->pr_name, namelc);
1953 		/* Change this component of child names. */
1954 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1955 			bcopy(tpr->pr_name + onamelen, tpr->pr_name + namelen,
1956 			    strlen(tpr->pr_name + onamelen) + 1);
1957 			bcopy(pr->pr_name, tpr->pr_name, namelen);
1958 		}
1959 	}
1960 	if (path != NULL) {
1961 		/* Try to keep a real-rooted full pathname. */
1962 		strlcpy(pr->pr_path, path, sizeof(pr->pr_path));
1963 		pr->pr_root = root;
1964 		root = NULL;
1965 	}
1966 	if (PR_HOST & ch_flags & ~pr_flags) {
1967 		if (pr->pr_flags & PR_HOST) {
1968 			/*
1969 			 * Copy the parent's host info.  As with pr_ip4 above,
1970 			 * the lack of a lock on the parent is not a problem;
1971 			 * it is always set with allprison_lock at least
1972 			 * shared, and is held exclusively here.
1973 			 */
1974 			strlcpy(pr->pr_hostname, pr->pr_parent->pr_hostname,
1975 			    sizeof(pr->pr_hostname));
1976 			strlcpy(pr->pr_domainname, pr->pr_parent->pr_domainname,
1977 			    sizeof(pr->pr_domainname));
1978 			strlcpy(pr->pr_hostuuid, pr->pr_parent->pr_hostuuid,
1979 			    sizeof(pr->pr_hostuuid));
1980 			pr->pr_hostid = pr->pr_parent->pr_hostid;
1981 		}
1982 	} else if (host != NULL || domain != NULL || uuid != NULL || gothid) {
1983 		/* Set this prison, and any descendants without PR_HOST. */
1984 		if (host != NULL)
1985 			strlcpy(pr->pr_hostname, host, sizeof(pr->pr_hostname));
1986 		if (domain != NULL)
1987 			strlcpy(pr->pr_domainname, domain,
1988 			    sizeof(pr->pr_domainname));
1989 		if (uuid != NULL)
1990 			strlcpy(pr->pr_hostuuid, uuid, sizeof(pr->pr_hostuuid));
1991 		if (gothid)
1992 			pr->pr_hostid = hid;
1993 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1994 			if (tpr->pr_flags & PR_HOST)
1995 				descend = 0;
1996 			else {
1997 				if (host != NULL)
1998 					strlcpy(tpr->pr_hostname,
1999 					    pr->pr_hostname,
2000 					    sizeof(tpr->pr_hostname));
2001 				if (domain != NULL)
2002 					strlcpy(tpr->pr_domainname,
2003 					    pr->pr_domainname,
2004 					    sizeof(tpr->pr_domainname));
2005 				if (uuid != NULL)
2006 					strlcpy(tpr->pr_hostuuid,
2007 					    pr->pr_hostuuid,
2008 					    sizeof(tpr->pr_hostuuid));
2009 				if (gothid)
2010 					tpr->pr_hostid = hid;
2011 			}
2012 		}
2013 	}
2014 	pr->pr_allow = (pr->pr_allow & ~ch_allow) | pr_allow;
2015 	if ((tallow = ch_allow & ~pr_allow))
2016 		prison_set_allow_locked(pr, tallow, 0);
2017 	/*
2018 	 * Persistent prisons get an extra reference, and prisons losing their
2019 	 * persist flag lose that reference.
2020 	 */
2021 	born = !prison_isalive(pr);
2022 	if (ch_flags & PR_PERSIST & (pr_flags ^ pr->pr_flags)) {
2023 		if (pr_flags & PR_PERSIST) {
2024 			prison_hold(pr);
2025 			/*
2026 			 * This may make a dead prison alive again, but wait
2027 			 * to label it as such until after OSD calls have had
2028 			 * a chance to run (and perhaps to fail).
2029 			 */
2030 			refcount_acquire(&pr->pr_uref);
2031 		} else {
2032 			drflags |= PD_DEUREF;
2033 			prison_free_not_last(pr);
2034 		}
2035 	}
2036 	pr->pr_flags = (pr->pr_flags & ~ch_flags) | pr_flags;
2037 	mtx_unlock(&pr->pr_mtx);
2038 	drflags &= ~PD_LOCKED;
2039 	/*
2040 	 * Any errors past this point will need to de-persist newly created
2041 	 * prisons, as well as call remove methods.
2042 	 */
2043 	if (born)
2044 		drflags |= PD_KILL;
2045 
2046 #ifdef RACCT
2047 	if (racct_enable && created)
2048 		prison_racct_attach(pr);
2049 #endif
2050 
2051 	/* Locks may have prevented a complete restriction of child IP
2052 	 * addresses.  If so, allocate some more memory and try again.
2053 	 */
2054 #ifdef INET
2055 	while (redo_ip4) {
2056 		ip4s = pr->pr_addrs[PR_INET]->ips;
2057 		MPASS(ip4 == NULL);
2058 		ip4 = prison_ip_alloc(PR_INET, ip4s, M_WAITOK);
2059 		mtx_lock(&pr->pr_mtx);
2060 		redo_ip4 = false;
2061 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
2062 #ifdef VIMAGE
2063 			if (tpr->pr_flags & PR_VNET) {
2064 				descend = 0;
2065 				continue;
2066 			}
2067 #endif
2068 			if (!prison_ip_restrict(tpr, PR_INET, &ip4))
2069 				redo_ip4 = true;
2070 		}
2071 		mtx_unlock(&pr->pr_mtx);
2072 	}
2073 #endif
2074 #ifdef INET6
2075 	while (redo_ip6) {
2076 		ip6s = pr->pr_addrs[PR_INET6]->ips;
2077 		MPASS(ip6 == NULL);
2078 		ip6 = prison_ip_alloc(PR_INET6, ip6s, M_WAITOK);
2079 		mtx_lock(&pr->pr_mtx);
2080 		redo_ip6 = false;
2081 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
2082 #ifdef VIMAGE
2083 			if (tpr->pr_flags & PR_VNET) {
2084 				descend = 0;
2085 				continue;
2086 			}
2087 #endif
2088 			if (!prison_ip_restrict(tpr, PR_INET6, &ip6))
2089 				redo_ip6 = true;
2090 		}
2091 		mtx_unlock(&pr->pr_mtx);
2092 	}
2093 #endif
2094 
2095 	/* Let the modules do their work. */
2096 	if (born) {
2097 		error = osd_jail_call(pr, PR_METHOD_CREATE, opts);
2098 		if (error)
2099 			goto done_deref;
2100 	}
2101 	error = osd_jail_call(pr, PR_METHOD_SET, opts);
2102 	if (error)
2103 		goto done_deref;
2104 
2105 	/*
2106 	 * A new prison is now ready to be seen; either it has gained a user
2107 	 * reference via persistence, or is about to gain one via attachment.
2108 	 */
2109 	if (born) {
2110 		drflags = prison_lock_xlock(pr, drflags);
2111 		pr->pr_state = PRISON_STATE_ALIVE;
2112 	}
2113 
2114 	/* Attach this process to the prison if requested. */
2115 	if (flags & JAIL_ATTACH) {
2116 		error = do_jail_attach(td, pr,
2117 		    prison_lock_xlock(pr, drflags & PD_LOCK_FLAGS));
2118 		drflags &= ~(PD_LOCKED | PD_LIST_XLOCKED);
2119 		if (error) {
2120 			vfs_opterror(opts, "attach failed");
2121 			goto done_deref;
2122 		}
2123 	}
2124 
2125 #ifdef RACCT
2126 	if (racct_enable && !created) {
2127 		if (drflags & PD_LOCKED) {
2128 			mtx_unlock(&pr->pr_mtx);
2129 			drflags &= ~PD_LOCKED;
2130 		}
2131 		if (drflags & PD_LIST_XLOCKED) {
2132 			sx_xunlock(&allprison_lock);
2133 			drflags &= ~PD_LIST_XLOCKED;
2134 		}
2135 		prison_racct_modify(pr);
2136 	}
2137 #endif
2138 
2139 	if (born && pr != &prison0 && (pr->pr_allow & PR_ALLOW_NFSD) != 0 &&
2140 	    (pr->pr_root->v_vflag & VV_ROOT) == 0)
2141 		printf("Warning jail jid=%d: mountd/nfsd requires a separate"
2142 		   " file system\n", pr->pr_id);
2143 
2144 	drflags &= ~PD_KILL;
2145 	td->td_retval[0] = pr->pr_id;
2146 
2147  done_deref:
2148 	/* Release any temporary prison holds and/or locks. */
2149 	if (pr != NULL)
2150 		prison_deref(pr, drflags);
2151 	else if (drflags & PD_LIST_SLOCKED)
2152 		sx_sunlock(&allprison_lock);
2153 	else if (drflags & PD_LIST_XLOCKED)
2154 		sx_xunlock(&allprison_lock);
2155 	if (root != NULL)
2156 		vrele(root);
2157  done_errmsg:
2158 	if (error) {
2159 		/* Write the error message back to userspace. */
2160 		if (vfs_getopt(opts, "errmsg", (void **)&errmsg,
2161 		    &errmsg_len) == 0 && errmsg_len > 0) {
2162 			errmsg_pos = 2 * vfs_getopt_pos(opts, "errmsg") + 1;
2163 			if (optuio->uio_segflg == UIO_SYSSPACE)
2164 				bcopy(errmsg,
2165 				    optuio->uio_iov[errmsg_pos].iov_base,
2166 				    errmsg_len);
2167 			else
2168 				copyout(errmsg,
2169 				    optuio->uio_iov[errmsg_pos].iov_base,
2170 				    errmsg_len);
2171 		}
2172 	}
2173  done_free:
2174 #ifdef INET
2175 	prison_ip_free(ip4);
2176 #endif
2177 #ifdef INET6
2178 	prison_ip_free(ip6);
2179 #endif
2180 	if (g_path != NULL)
2181 		free(g_path, M_TEMP);
2182 	vfs_freeopts(opts);
2183 	return (error);
2184 }
2185 
2186 /*
2187  * Find the next available prison ID.  Return the ID on success, or zero
2188  * on failure.  Also set a pointer to the allprison list entry the prison
2189  * should be inserted before.
2190  */
2191 static int
2192 get_next_prid(struct prison **insprp)
2193 {
2194 	struct prison *inspr;
2195 	int jid, maxid;
2196 
2197 	jid = lastprid % JAIL_MAX + 1;
2198 	if (TAILQ_EMPTY(&allprison) ||
2199 	    TAILQ_LAST(&allprison, prisonlist)->pr_id < jid) {
2200 		/*
2201 		 * A common case is for all jails to be implicitly numbered,
2202 		 * which means they'll go on the end of the list, at least
2203 		 * for the first JAIL_MAX times.
2204 		 */
2205 		inspr = NULL;
2206 	} else {
2207 		/*
2208 		 * Take two passes through the allprison list: first starting
2209 		 * with the proposed jid, then ending with it.
2210 		 */
2211 		for (maxid = JAIL_MAX; maxid != 0; ) {
2212 			TAILQ_FOREACH(inspr, &allprison, pr_list) {
2213 				if (inspr->pr_id < jid)
2214 					continue;
2215 				if (inspr->pr_id > jid) {
2216 					/* Found an opening. */
2217 					maxid = 0;
2218 					break;
2219 				}
2220 				if (++jid > maxid) {
2221 					if (lastprid == maxid || lastprid == 0)
2222 					{
2223 						/*
2224 						 * The entire legal range
2225 						 * has been traversed
2226 						 */
2227 						return 0;
2228 					}
2229 					/* Try again from the start. */
2230 					jid = 1;
2231 					maxid = lastprid;
2232 					break;
2233 				}
2234 			}
2235 			if (inspr == NULL) {
2236 				/* Found room at the end of the list. */
2237 				break;
2238 			}
2239 		}
2240 	}
2241 	*insprp = inspr;
2242 	lastprid = jid;
2243 	return (jid);
2244 }
2245 
2246 /*
2247  * struct jail_get_args {
2248  *	struct iovec *iovp;
2249  *	unsigned int iovcnt;
2250  *	int flags;
2251  * };
2252  */
2253 int
2254 sys_jail_get(struct thread *td, struct jail_get_args *uap)
2255 {
2256 	struct uio *auio;
2257 	int error;
2258 
2259 	/* Check that we have an even number of iovecs. */
2260 	if (uap->iovcnt & 1)
2261 		return (EINVAL);
2262 
2263 	error = copyinuio(uap->iovp, uap->iovcnt, &auio);
2264 	if (error)
2265 		return (error);
2266 	error = kern_jail_get(td, auio, uap->flags);
2267 	if (error == 0)
2268 		error = copyout(auio->uio_iov, uap->iovp,
2269 		    uap->iovcnt * sizeof (struct iovec));
2270 	free(auio, M_IOV);
2271 	return (error);
2272 }
2273 
2274 int
2275 kern_jail_get(struct thread *td, struct uio *optuio, int flags)
2276 {
2277 	struct bool_flags *bf;
2278 	struct jailsys_flags *jsf;
2279 	struct prison *pr, *mypr;
2280 	struct vfsopt *opt;
2281 	struct vfsoptlist *opts;
2282 	char *errmsg, *name;
2283 	int drflags, error, errmsg_len, errmsg_pos, i, jid, len, pos;
2284 	unsigned f;
2285 
2286 	if (flags & ~JAIL_GET_MASK)
2287 		return (EINVAL);
2288 
2289 	/* Get the parameter list. */
2290 	error = vfs_buildopts(optuio, &opts);
2291 	if (error)
2292 		return (error);
2293 	errmsg_pos = vfs_getopt_pos(opts, "errmsg");
2294 	mypr = td->td_ucred->cr_prison;
2295 	pr = NULL;
2296 
2297 	/*
2298 	 * Find the prison specified by one of: lastjid, jid, name.
2299 	 */
2300 	sx_slock(&allprison_lock);
2301 	drflags = PD_LIST_SLOCKED;
2302 	error = vfs_copyopt(opts, "lastjid", &jid, sizeof(jid));
2303 	if (error == 0) {
2304 		TAILQ_FOREACH(pr, &allprison, pr_list) {
2305 			if (pr->pr_id > jid &&
2306 			    ((flags & JAIL_DYING) || prison_isalive(pr)) &&
2307 			    prison_ischild(mypr, pr)) {
2308 				mtx_lock(&pr->pr_mtx);
2309 				drflags |= PD_LOCKED;
2310 				goto found_prison;
2311 			}
2312 		}
2313 		error = ENOENT;
2314 		vfs_opterror(opts, "no jail after %d", jid);
2315 		goto done;
2316 	} else if (error != ENOENT)
2317 		goto done;
2318 
2319 	error = vfs_copyopt(opts, "jid", &jid, sizeof(jid));
2320 	if (error == 0) {
2321 		if (jid != 0) {
2322 			pr = prison_find_child(mypr, jid);
2323 			if (pr != NULL) {
2324 				drflags |= PD_LOCKED;
2325 				if (!(prison_isalive(pr) ||
2326 				    (flags & JAIL_DYING))) {
2327 					error = ENOENT;
2328 					vfs_opterror(opts, "jail %d is dying",
2329 					    jid);
2330 					goto done;
2331 				}
2332 				goto found_prison;
2333 			}
2334 			error = ENOENT;
2335 			vfs_opterror(opts, "jail %d not found", jid);
2336 			goto done;
2337 		}
2338 	} else if (error != ENOENT)
2339 		goto done;
2340 
2341 	error = vfs_getopt(opts, "name", (void **)&name, &len);
2342 	if (error == 0) {
2343 		if (len == 0 || name[len - 1] != '\0') {
2344 			error = EINVAL;
2345 			goto done;
2346 		}
2347 		pr = prison_find_name(mypr, name);
2348 		if (pr != NULL) {
2349 			drflags |= PD_LOCKED;
2350 			if (!(prison_isalive(pr) || (flags & JAIL_DYING))) {
2351 				error = ENOENT;
2352 				vfs_opterror(opts, "jail \"%s\" is dying",
2353 				    name);
2354 				goto done;
2355 			}
2356 			goto found_prison;
2357 		}
2358 		error = ENOENT;
2359 		vfs_opterror(opts, "jail \"%s\" not found", name);
2360 		goto done;
2361 	} else if (error != ENOENT)
2362 		goto done;
2363 
2364 	vfs_opterror(opts, "no jail specified");
2365 	error = ENOENT;
2366 	goto done;
2367 
2368  found_prison:
2369 	/* Get the parameters of the prison. */
2370 	prison_hold(pr);
2371 	drflags |= PD_DEREF;
2372 	td->td_retval[0] = pr->pr_id;
2373 	error = vfs_setopt(opts, "jid", &pr->pr_id, sizeof(pr->pr_id));
2374 	if (error != 0 && error != ENOENT)
2375 		goto done;
2376 	i = (pr->pr_parent == mypr) ? 0 : pr->pr_parent->pr_id;
2377 	error = vfs_setopt(opts, "parent", &i, sizeof(i));
2378 	if (error != 0 && error != ENOENT)
2379 		goto done;
2380 	error = vfs_setopts(opts, "name", prison_name(mypr, pr));
2381 	if (error != 0 && error != ENOENT)
2382 		goto done;
2383 	error = vfs_setopt(opts, "cpuset.id", &pr->pr_cpuset->cs_id,
2384 	    sizeof(pr->pr_cpuset->cs_id));
2385 	if (error != 0 && error != ENOENT)
2386 		goto done;
2387 	error = vfs_setopts(opts, "path", prison_path(mypr, pr));
2388 	if (error != 0 && error != ENOENT)
2389 		goto done;
2390 #ifdef INET
2391 	error = vfs_setopt_part(opts, "ip4.addr", pr->pr_addrs[PR_INET]->pr_ip,
2392 	    pr->pr_addrs[PR_INET] ? pr->pr_addrs[PR_INET]->ips *
2393 	    pr_families[PR_INET].size : 0 );
2394 	if (error != 0 && error != ENOENT)
2395 		goto done;
2396 #endif
2397 #ifdef INET6
2398 	error = vfs_setopt_part(opts, "ip6.addr", pr->pr_addrs[PR_INET6]->pr_ip,
2399 	    pr->pr_addrs[PR_INET6] ? pr->pr_addrs[PR_INET6]->ips *
2400 	    pr_families[PR_INET6].size : 0 );
2401 	if (error != 0 && error != ENOENT)
2402 		goto done;
2403 #endif
2404 	error = vfs_setopt(opts, "securelevel", &pr->pr_securelevel,
2405 	    sizeof(pr->pr_securelevel));
2406 	if (error != 0 && error != ENOENT)
2407 		goto done;
2408 	error = vfs_setopt(opts, "children.cur", &pr->pr_childcount,
2409 	    sizeof(pr->pr_childcount));
2410 	if (error != 0 && error != ENOENT)
2411 		goto done;
2412 	error = vfs_setopt(opts, "children.max", &pr->pr_childmax,
2413 	    sizeof(pr->pr_childmax));
2414 	if (error != 0 && error != ENOENT)
2415 		goto done;
2416 	error = vfs_setopts(opts, "host.hostname", pr->pr_hostname);
2417 	if (error != 0 && error != ENOENT)
2418 		goto done;
2419 	error = vfs_setopts(opts, "host.domainname", pr->pr_domainname);
2420 	if (error != 0 && error != ENOENT)
2421 		goto done;
2422 	error = vfs_setopts(opts, "host.hostuuid", pr->pr_hostuuid);
2423 	if (error != 0 && error != ENOENT)
2424 		goto done;
2425 #ifdef COMPAT_FREEBSD32
2426 	if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) {
2427 		uint32_t hid32 = pr->pr_hostid;
2428 
2429 		error = vfs_setopt(opts, "host.hostid", &hid32, sizeof(hid32));
2430 	} else
2431 #endif
2432 	error = vfs_setopt(opts, "host.hostid", &pr->pr_hostid,
2433 	    sizeof(pr->pr_hostid));
2434 	if (error != 0 && error != ENOENT)
2435 		goto done;
2436 	error = vfs_setopt(opts, "enforce_statfs", &pr->pr_enforce_statfs,
2437 	    sizeof(pr->pr_enforce_statfs));
2438 	if (error != 0 && error != ENOENT)
2439 		goto done;
2440 	error = vfs_setopt(opts, "devfs_ruleset", &pr->pr_devfs_rsnum,
2441 	    sizeof(pr->pr_devfs_rsnum));
2442 	if (error != 0 && error != ENOENT)
2443 		goto done;
2444 	for (bf = pr_flag_bool;
2445 	     bf < pr_flag_bool + nitems(pr_flag_bool);
2446 	     bf++) {
2447 		i = (pr->pr_flags & bf->flag) ? 1 : 0;
2448 		error = vfs_setopt(opts, bf->name, &i, sizeof(i));
2449 		if (error != 0 && error != ENOENT)
2450 			goto done;
2451 		i = !i;
2452 		error = vfs_setopt(opts, bf->noname, &i, sizeof(i));
2453 		if (error != 0 && error != ENOENT)
2454 			goto done;
2455 	}
2456 	for (jsf = pr_flag_jailsys;
2457 	     jsf < pr_flag_jailsys + nitems(pr_flag_jailsys);
2458 	     jsf++) {
2459 		f = pr->pr_flags & (jsf->disable | jsf->new);
2460 		i = (f != 0 && f == jsf->disable) ? JAIL_SYS_DISABLE
2461 		    : (f == jsf->new) ? JAIL_SYS_NEW
2462 		    : JAIL_SYS_INHERIT;
2463 		error = vfs_setopt(opts, jsf->name, &i, sizeof(i));
2464 		if (error != 0 && error != ENOENT)
2465 			goto done;
2466 	}
2467 	for (bf = pr_flag_allow;
2468 	     bf < pr_flag_allow + nitems(pr_flag_allow) &&
2469 		atomic_load_int(&bf->flag) != 0;
2470 	     bf++) {
2471 		i = (pr->pr_allow & bf->flag) ? 1 : 0;
2472 		error = vfs_setopt(opts, bf->name, &i, sizeof(i));
2473 		if (error != 0 && error != ENOENT)
2474 			goto done;
2475 		i = !i;
2476 		error = vfs_setopt(opts, bf->noname, &i, sizeof(i));
2477 		if (error != 0 && error != ENOENT)
2478 			goto done;
2479 	}
2480 	i = !prison_isalive(pr);
2481 	error = vfs_setopt(opts, "dying", &i, sizeof(i));
2482 	if (error != 0 && error != ENOENT)
2483 		goto done;
2484 	i = !i;
2485 	error = vfs_setopt(opts, "nodying", &i, sizeof(i));
2486 	if (error != 0 && error != ENOENT)
2487 		goto done;
2488 	error = vfs_setopt(opts, "osreldate", &pr->pr_osreldate,
2489 	    sizeof(pr->pr_osreldate));
2490 	if (error != 0 && error != ENOENT)
2491 		goto done;
2492 	error = vfs_setopts(opts, "osrelease", pr->pr_osrelease);
2493 	if (error != 0 && error != ENOENT)
2494 		goto done;
2495 
2496 	/* Get the module parameters. */
2497 	mtx_unlock(&pr->pr_mtx);
2498 	drflags &= ~PD_LOCKED;
2499 	error = osd_jail_call(pr, PR_METHOD_GET, opts);
2500 	if (error)
2501 		goto done;
2502 	prison_deref(pr, drflags);
2503 	pr = NULL;
2504 	drflags = 0;
2505 
2506 	/* By now, all parameters should have been noted. */
2507 	TAILQ_FOREACH(opt, opts, link) {
2508 		if (!opt->seen && strcmp(opt->name, "errmsg")) {
2509 			error = EINVAL;
2510 			vfs_opterror(opts, "unknown parameter: %s", opt->name);
2511 			goto done;
2512 		}
2513 	}
2514 
2515 	/* Write the fetched parameters back to userspace. */
2516 	error = 0;
2517 	TAILQ_FOREACH(opt, opts, link) {
2518 		if (opt->pos >= 0 && opt->pos != errmsg_pos) {
2519 			pos = 2 * opt->pos + 1;
2520 			optuio->uio_iov[pos].iov_len = opt->len;
2521 			if (opt->value != NULL) {
2522 				if (optuio->uio_segflg == UIO_SYSSPACE) {
2523 					bcopy(opt->value,
2524 					    optuio->uio_iov[pos].iov_base,
2525 					    opt->len);
2526 				} else {
2527 					error = copyout(opt->value,
2528 					    optuio->uio_iov[pos].iov_base,
2529 					    opt->len);
2530 					if (error)
2531 						break;
2532 				}
2533 			}
2534 		}
2535 	}
2536 
2537  done:
2538 	/* Release any temporary prison holds and/or locks. */
2539 	if (pr != NULL)
2540 		prison_deref(pr, drflags);
2541 	else if (drflags & PD_LIST_SLOCKED)
2542 		sx_sunlock(&allprison_lock);
2543 	if (error && errmsg_pos >= 0) {
2544 		/* Write the error message back to userspace. */
2545 		vfs_getopt(opts, "errmsg", (void **)&errmsg, &errmsg_len);
2546 		errmsg_pos = 2 * errmsg_pos + 1;
2547 		if (errmsg_len > 0) {
2548 			if (optuio->uio_segflg == UIO_SYSSPACE)
2549 				bcopy(errmsg,
2550 				    optuio->uio_iov[errmsg_pos].iov_base,
2551 				    errmsg_len);
2552 			else
2553 				copyout(errmsg,
2554 				    optuio->uio_iov[errmsg_pos].iov_base,
2555 				    errmsg_len);
2556 		}
2557 	}
2558 	vfs_freeopts(opts);
2559 	return (error);
2560 }
2561 
2562 /*
2563  * struct jail_remove_args {
2564  *	int jid;
2565  * };
2566  */
2567 int
2568 sys_jail_remove(struct thread *td, struct jail_remove_args *uap)
2569 {
2570 	struct prison *pr;
2571 	int error;
2572 
2573 	error = priv_check(td, PRIV_JAIL_REMOVE);
2574 	if (error)
2575 		return (error);
2576 
2577 	sx_xlock(&allprison_lock);
2578 	pr = prison_find_child(td->td_ucred->cr_prison, uap->jid);
2579 	if (pr == NULL) {
2580 		sx_xunlock(&allprison_lock);
2581 		return (EINVAL);
2582 	}
2583 	if (!prison_isalive(pr)) {
2584 		/* Silently ignore already-dying prisons. */
2585 		mtx_unlock(&pr->pr_mtx);
2586 		sx_xunlock(&allprison_lock);
2587 		return (0);
2588 	}
2589 	prison_deref(pr, PD_KILL | PD_LOCKED | PD_LIST_XLOCKED);
2590 	return (0);
2591 }
2592 
2593 /*
2594  * struct jail_attach_args {
2595  *	int jid;
2596  * };
2597  */
2598 int
2599 sys_jail_attach(struct thread *td, struct jail_attach_args *uap)
2600 {
2601 	struct prison *pr;
2602 	int error;
2603 
2604 	error = priv_check(td, PRIV_JAIL_ATTACH);
2605 	if (error)
2606 		return (error);
2607 
2608 	sx_slock(&allprison_lock);
2609 	pr = prison_find_child(td->td_ucred->cr_prison, uap->jid);
2610 	if (pr == NULL) {
2611 		sx_sunlock(&allprison_lock);
2612 		return (EINVAL);
2613 	}
2614 
2615 	/* Do not allow a process to attach to a prison that is not alive. */
2616 	if (!prison_isalive(pr)) {
2617 		mtx_unlock(&pr->pr_mtx);
2618 		sx_sunlock(&allprison_lock);
2619 		return (EINVAL);
2620 	}
2621 
2622 	return (do_jail_attach(td, pr, PD_LOCKED | PD_LIST_SLOCKED));
2623 }
2624 
2625 static int
2626 do_jail_attach(struct thread *td, struct prison *pr, int drflags)
2627 {
2628 	struct proc *p;
2629 	struct ucred *newcred, *oldcred;
2630 	int error;
2631 
2632 	mtx_assert(&pr->pr_mtx, MA_OWNED);
2633 	sx_assert(&allprison_lock, SX_LOCKED);
2634 	drflags &= PD_LOCK_FLAGS;
2635 	/*
2636 	 * XXX: Note that there is a slight race here if two threads
2637 	 * in the same privileged process attempt to attach to two
2638 	 * different jails at the same time.  It is important for
2639 	 * user processes not to do this, or they might end up with
2640 	 * a process root from one prison, but attached to the jail
2641 	 * of another.
2642 	 */
2643 	prison_hold(pr);
2644 	refcount_acquire(&pr->pr_uref);
2645 	drflags |= PD_DEREF | PD_DEUREF;
2646 	mtx_unlock(&pr->pr_mtx);
2647 	drflags &= ~PD_LOCKED;
2648 
2649 	/* Let modules do whatever they need to prepare for attaching. */
2650 	error = osd_jail_call(pr, PR_METHOD_ATTACH, td);
2651 	if (error) {
2652 		prison_deref(pr, drflags);
2653 		return (error);
2654 	}
2655 	sx_unlock(&allprison_lock);
2656 	drflags &= ~(PD_LIST_SLOCKED | PD_LIST_XLOCKED);
2657 
2658 	/*
2659 	 * Reparent the newly attached process to this jail.
2660 	 */
2661 	p = td->td_proc;
2662 	error = cpuset_setproc_update_set(p, pr->pr_cpuset);
2663 	if (error)
2664 		goto e_revert_osd;
2665 
2666 	vn_lock(pr->pr_root, LK_EXCLUSIVE | LK_RETRY);
2667 	if ((error = change_dir(pr->pr_root, td)) != 0)
2668 		goto e_unlock;
2669 #ifdef MAC
2670 	if ((error = mac_vnode_check_chroot(td->td_ucred, pr->pr_root)))
2671 		goto e_unlock;
2672 #endif
2673 	VOP_UNLOCK(pr->pr_root);
2674 	if ((error = pwd_chroot_chdir(td, pr->pr_root)))
2675 		goto e_revert_osd;
2676 
2677 	newcred = crget();
2678 	PROC_LOCK(p);
2679 	oldcred = crcopysafe(p, newcred);
2680 	newcred->cr_prison = pr;
2681 	proc_set_cred(p, newcred);
2682 	setsugid(p);
2683 #ifdef RACCT
2684 	racct_proc_ucred_changed(p, oldcred, newcred);
2685 	crhold(newcred);
2686 #endif
2687 	PROC_UNLOCK(p);
2688 #ifdef RCTL
2689 	rctl_proc_ucred_changed(p, newcred);
2690 	crfree(newcred);
2691 #endif
2692 	prison_proc_relink(oldcred->cr_prison, pr, p);
2693 	prison_deref(oldcred->cr_prison, drflags);
2694 	crfree(oldcred);
2695 
2696 	/*
2697 	 * If the prison was killed while changing credentials, die along
2698 	 * with it.
2699 	 */
2700 	if (!prison_isalive(pr)) {
2701 		PROC_LOCK(p);
2702 		kern_psignal(p, SIGKILL);
2703 		PROC_UNLOCK(p);
2704 	}
2705 
2706 	return (0);
2707 
2708  e_unlock:
2709 	VOP_UNLOCK(pr->pr_root);
2710  e_revert_osd:
2711 	/* Tell modules this thread is still in its old jail after all. */
2712 	sx_slock(&allprison_lock);
2713 	drflags |= PD_LIST_SLOCKED;
2714 	(void)osd_jail_call(td->td_ucred->cr_prison, PR_METHOD_ATTACH, td);
2715 	prison_deref(pr, drflags);
2716 	return (error);
2717 }
2718 
2719 /*
2720  * Returns a locked prison instance, or NULL on failure.
2721  */
2722 struct prison *
2723 prison_find(int prid)
2724 {
2725 	struct prison *pr;
2726 
2727 	sx_assert(&allprison_lock, SX_LOCKED);
2728 	TAILQ_FOREACH(pr, &allprison, pr_list) {
2729 		if (pr->pr_id < prid)
2730 			continue;
2731 		if (pr->pr_id > prid)
2732 			break;
2733 		KASSERT(prison_isvalid(pr), ("Found invalid prison %p", pr));
2734 		mtx_lock(&pr->pr_mtx);
2735 		return (pr);
2736 	}
2737 	return (NULL);
2738 }
2739 
2740 /*
2741  * Find a prison that is a descendant of mypr.  Returns a locked prison or NULL.
2742  */
2743 struct prison *
2744 prison_find_child(struct prison *mypr, int prid)
2745 {
2746 	struct prison *pr;
2747 	int descend;
2748 
2749 	sx_assert(&allprison_lock, SX_LOCKED);
2750 	FOREACH_PRISON_DESCENDANT(mypr, pr, descend) {
2751 		if (pr->pr_id == prid) {
2752 			KASSERT(prison_isvalid(pr),
2753 			    ("Found invalid prison %p", pr));
2754 			mtx_lock(&pr->pr_mtx);
2755 			return (pr);
2756 		}
2757 	}
2758 	return (NULL);
2759 }
2760 
2761 /*
2762  * Look for the name relative to mypr.  Returns a locked prison or NULL.
2763  */
2764 struct prison *
2765 prison_find_name(struct prison *mypr, const char *name)
2766 {
2767 	struct prison *pr, *deadpr;
2768 	size_t mylen;
2769 	int descend;
2770 
2771 	sx_assert(&allprison_lock, SX_LOCKED);
2772 	mylen = (mypr == &prison0) ? 0 : strlen(mypr->pr_name) + 1;
2773 	deadpr = NULL;
2774 	FOREACH_PRISON_DESCENDANT(mypr, pr, descend) {
2775 		if (!strcmp(pr->pr_name + mylen, name)) {
2776 			KASSERT(prison_isvalid(pr),
2777 			    ("Found invalid prison %p", pr));
2778 			if (prison_isalive(pr)) {
2779 				mtx_lock(&pr->pr_mtx);
2780 				return (pr);
2781 			}
2782 			deadpr = pr;
2783 		}
2784 	}
2785 	/* There was no valid prison - perhaps there was a dying one. */
2786 	if (deadpr != NULL)
2787 		mtx_lock(&deadpr->pr_mtx);
2788 	return (deadpr);
2789 }
2790 
2791 /*
2792  * See if a prison has the specific flag set.  The prison should be locked,
2793  * unless checking for flags that are only set at jail creation (such as
2794  * PR_IP4 and PR_IP6), or only the single bit is examined, without regard
2795  * to any other prison data.
2796  */
2797 bool
2798 prison_flag(struct ucred *cred, unsigned flag)
2799 {
2800 
2801 	return ((cred->cr_prison->pr_flags & flag) != 0);
2802 }
2803 
2804 /*
2805  * See if a prison has the specific allow flag set.
2806  * The prison *should* be locked, or only a single bit is examined, without
2807  * regard to any other prison data.
2808  */
2809 bool
2810 prison_allow(struct ucred *cred, unsigned flag)
2811 {
2812 
2813 	return ((cred->cr_prison->pr_allow & flag) != 0);
2814 }
2815 
2816 /*
2817  * Hold a prison reference, by incrementing pr_ref.  It is generally
2818  * an error to hold a prison that does not already have a reference.
2819  * A prison record will remain valid as long as it has at least one
2820  * reference, and will not be removed as long as either the prison
2821  * mutex or the allprison lock is held (allprison_lock may be shared).
2822  */
2823 void
2824 prison_hold_locked(struct prison *pr)
2825 {
2826 
2827 	/* Locking is no longer required. */
2828 	prison_hold(pr);
2829 }
2830 
2831 void
2832 prison_hold(struct prison *pr)
2833 {
2834 #ifdef INVARIANTS
2835 	int was_valid = refcount_acquire_if_not_zero(&pr->pr_ref);
2836 
2837 	KASSERT(was_valid,
2838 	    ("Trying to hold dead prison %p (jid=%d).", pr, pr->pr_id));
2839 #else
2840 	refcount_acquire(&pr->pr_ref);
2841 #endif
2842 }
2843 
2844 /*
2845  * Remove a prison reference.  If that was the last reference, the
2846  * prison will be removed (at a later time).
2847  */
2848 void
2849 prison_free_locked(struct prison *pr)
2850 {
2851 
2852 	mtx_assert(&pr->pr_mtx, MA_OWNED);
2853 	/*
2854 	 * Locking is no longer required, but unlock because the caller
2855 	 * expects it.
2856 	 */
2857 	mtx_unlock(&pr->pr_mtx);
2858 	prison_free(pr);
2859 }
2860 
2861 void
2862 prison_free(struct prison *pr)
2863 {
2864 
2865 	KASSERT(refcount_load(&pr->pr_ref) > 0,
2866 	    ("Trying to free dead prison %p (jid=%d).",
2867 	     pr, pr->pr_id));
2868 	if (!refcount_release_if_not_last(&pr->pr_ref)) {
2869 		/*
2870 		 * Don't remove the last reference in this context,
2871 		 * in case there are locks held.
2872 		 */
2873 		taskqueue_enqueue(taskqueue_thread, &pr->pr_task);
2874 	}
2875 }
2876 
2877 static void
2878 prison_free_not_last(struct prison *pr)
2879 {
2880 #ifdef INVARIANTS
2881 	int lastref;
2882 
2883 	KASSERT(refcount_load(&pr->pr_ref) > 0,
2884 	    ("Trying to free dead prison %p (jid=%d).",
2885 	     pr, pr->pr_id));
2886 	lastref = refcount_release(&pr->pr_ref);
2887 	KASSERT(!lastref,
2888 	    ("prison_free_not_last freed last ref on prison %p (jid=%d).",
2889 	     pr, pr->pr_id));
2890 #else
2891 	refcount_release(&pr->pr_ref);
2892 #endif
2893 }
2894 
2895 /*
2896  * Hold a prison for user visibility, by incrementing pr_uref.
2897  * It is generally an error to hold a prison that isn't already
2898  * user-visible, except through the jail system calls.  It is also
2899  * an error to hold an invalid prison.  A prison record will remain
2900  * alive as long as it has at least one user reference, and will not
2901  * be set to the dying state until the prison mutex and allprison_lock
2902  * are both freed.
2903  */
2904 void
2905 prison_proc_hold(struct prison *pr)
2906 {
2907 #ifdef INVARIANTS
2908 	int was_alive = refcount_acquire_if_not_zero(&pr->pr_uref);
2909 
2910 	KASSERT(was_alive,
2911 	    ("Cannot add a process to a non-alive prison (jid=%d)", pr->pr_id));
2912 #else
2913 	refcount_acquire(&pr->pr_uref);
2914 #endif
2915 }
2916 
2917 /*
2918  * Remove a prison user reference.  If it was the last reference, the
2919  * prison will be considered "dying", and may be removed once all of
2920  * its references are dropped.
2921  */
2922 void
2923 prison_proc_free(struct prison *pr)
2924 {
2925 
2926 	/*
2927 	 * Locking is only required when releasing the last reference.
2928 	 * This allows assurance that a locked prison will remain alive
2929 	 * until it is unlocked.
2930 	 */
2931 	KASSERT(refcount_load(&pr->pr_uref) > 0,
2932 	    ("Trying to kill a process in a dead prison (jid=%d)", pr->pr_id));
2933 	if (!refcount_release_if_not_last(&pr->pr_uref)) {
2934 		/*
2935 		 * Don't remove the last user reference in this context,
2936 		 * which is expected to be a process that is not only locked,
2937 		 * but also half dead.  Add a reference so any calls to
2938 		 * prison_free() won't re-submit the task.
2939 		 */
2940 		prison_hold(pr);
2941 		mtx_lock(&pr->pr_mtx);
2942 		KASSERT(!(pr->pr_flags & PR_COMPLETE_PROC),
2943 		    ("Redundant last reference in prison_proc_free (jid=%d)",
2944 		     pr->pr_id));
2945 		pr->pr_flags |= PR_COMPLETE_PROC;
2946 		mtx_unlock(&pr->pr_mtx);
2947 		taskqueue_enqueue(taskqueue_thread, &pr->pr_task);
2948 	}
2949 }
2950 
2951 static void
2952 prison_proc_free_not_last(struct prison *pr)
2953 {
2954 #ifdef INVARIANTS
2955 	int lastref;
2956 
2957 	KASSERT(refcount_load(&pr->pr_uref) > 0,
2958 	    ("Trying to free dead prison %p (jid=%d).",
2959 	     pr, pr->pr_id));
2960 	lastref = refcount_release(&pr->pr_uref);
2961 	KASSERT(!lastref,
2962 	    ("prison_proc_free_not_last freed last uref on prison %p (jid=%d).",
2963 	     pr, pr->pr_id));
2964 #else
2965 	refcount_release(&pr->pr_uref);
2966 #endif
2967 }
2968 
2969 void
2970 prison_proc_link(struct prison *pr, struct proc *p)
2971 {
2972 
2973 	sx_assert(&allproc_lock, SA_XLOCKED);
2974 	LIST_INSERT_HEAD(&pr->pr_proclist, p, p_jaillist);
2975 }
2976 
2977 void
2978 prison_proc_unlink(struct prison *pr, struct proc *p)
2979 {
2980 
2981 	sx_assert(&allproc_lock, SA_XLOCKED);
2982 	LIST_REMOVE(p, p_jaillist);
2983 }
2984 
2985 static void
2986 prison_proc_relink(struct prison *opr, struct prison *npr, struct proc *p)
2987 {
2988 
2989 	sx_xlock(&allproc_lock);
2990 	prison_proc_unlink(opr, p);
2991 	prison_proc_link(npr, p);
2992 	sx_xunlock(&allproc_lock);
2993 }
2994 
2995 /*
2996  * Complete a call to either prison_free or prison_proc_free.
2997  */
2998 static void
2999 prison_complete(void *context, int pending)
3000 {
3001 	struct prison *pr = context;
3002 	int drflags;
3003 
3004 	/*
3005 	 * This could be called to release the last reference, or the last
3006 	 * user reference (plus the reference held in prison_proc_free).
3007 	 */
3008 	drflags = prison_lock_xlock(pr, PD_DEREF);
3009 	if (pr->pr_flags & PR_COMPLETE_PROC) {
3010 		pr->pr_flags &= ~PR_COMPLETE_PROC;
3011 		drflags |= PD_DEUREF;
3012 	}
3013 	prison_deref(pr, drflags);
3014 }
3015 
3016 static void
3017 prison_kill_processes_cb(struct proc *p, void *arg __unused)
3018 {
3019 
3020 	kern_psignal(p, SIGKILL);
3021 }
3022 
3023 /*
3024  * Note the iteration does not guarantee acting on all processes.
3025  * Most notably there may be fork or jail_attach in progress.
3026  */
3027 void
3028 prison_proc_iterate(struct prison *pr, void (*cb)(struct proc *, void *),
3029     void *cbarg)
3030 {
3031 	struct prison *ppr;
3032 	struct proc *p;
3033 
3034 	if (atomic_load_int(&pr->pr_childcount) == 0) {
3035 		sx_slock(&allproc_lock);
3036 		LIST_FOREACH(p, &pr->pr_proclist, p_jaillist) {
3037 			if (p->p_state == PRS_NEW)
3038 				continue;
3039 			PROC_LOCK(p);
3040 			cb(p, cbarg);
3041 			PROC_UNLOCK(p);
3042 		}
3043 		sx_sunlock(&allproc_lock);
3044 		if (atomic_load_int(&pr->pr_childcount) == 0)
3045 			return;
3046 		/*
3047 		 * Some jails popped up during the iteration, fall through to a
3048 		 * system-wide search.
3049 		 */
3050 	}
3051 
3052 	sx_slock(&allproc_lock);
3053 	FOREACH_PROC_IN_SYSTEM(p) {
3054 		PROC_LOCK(p);
3055 		if (p->p_state != PRS_NEW && p->p_ucred != NULL) {
3056 			for (ppr = p->p_ucred->cr_prison;
3057 			    ppr != &prison0;
3058 			    ppr = ppr->pr_parent) {
3059 				if (ppr == pr) {
3060 					cb(p, cbarg);
3061 					break;
3062 				}
3063 			}
3064 		}
3065 		PROC_UNLOCK(p);
3066 	}
3067 	sx_sunlock(&allproc_lock);
3068 }
3069 
3070 /*
3071  * Remove a prison reference and/or user reference (usually).
3072  * This assumes context that allows sleeping (for allprison_lock),
3073  * with no non-sleeping locks held, except perhaps the prison itself.
3074  * If there are no more references, release and delist the prison.
3075  * On completion, the prison lock and the allprison lock are both
3076  * unlocked.
3077  */
3078 static void
3079 prison_deref(struct prison *pr, int flags)
3080 {
3081 	struct prisonlist freeprison;
3082 	struct prison *killpr, *rpr, *ppr, *tpr;
3083 
3084 	killpr = NULL;
3085 	TAILQ_INIT(&freeprison);
3086 	/*
3087 	 * Release this prison as requested, which may cause its parent
3088 	 * to be released, and then maybe its grandparent, etc.
3089 	 */
3090 	for (;;) {
3091 		if (flags & PD_KILL) {
3092 			/* Kill the prison and its descendents. */
3093 			KASSERT(pr != &prison0,
3094 			    ("prison_deref trying to kill prison0"));
3095 			if (!(flags & PD_DEREF)) {
3096 				prison_hold(pr);
3097 				flags |= PD_DEREF;
3098 			}
3099 			flags = prison_lock_xlock(pr, flags);
3100 			prison_deref_kill(pr, &freeprison);
3101 		}
3102 		if (flags & PD_DEUREF) {
3103 			/* Drop a user reference. */
3104 			KASSERT(refcount_load(&pr->pr_uref) > 0,
3105 			    ("prison_deref PD_DEUREF on a dead prison (jid=%d)",
3106 			     pr->pr_id));
3107 			if (!refcount_release_if_not_last(&pr->pr_uref)) {
3108 				if (!(flags & PD_DEREF)) {
3109 					prison_hold(pr);
3110 					flags |= PD_DEREF;
3111 				}
3112 				flags = prison_lock_xlock(pr, flags);
3113 				if (refcount_release(&pr->pr_uref) &&
3114 				    pr->pr_state == PRISON_STATE_ALIVE) {
3115 					/*
3116 					 * When the last user references goes,
3117 					 * this becomes a dying prison.
3118 					 */
3119 					KASSERT(
3120 					    refcount_load(&prison0.pr_uref) > 0,
3121 					    ("prison0 pr_uref=0"));
3122 					pr->pr_state = PRISON_STATE_DYING;
3123 					mtx_unlock(&pr->pr_mtx);
3124 					flags &= ~PD_LOCKED;
3125 					prison_cleanup(pr);
3126 				}
3127 			}
3128 		}
3129 		if (flags & PD_KILL) {
3130 			/*
3131 			 * Any remaining user references are probably processes
3132 			 * that need to be killed, either in this prison or its
3133 			 * descendants.
3134 			 */
3135 			if (refcount_load(&pr->pr_uref) > 0)
3136 				killpr = pr;
3137 			/* Make sure the parent prison doesn't get killed. */
3138 			flags &= ~PD_KILL;
3139 		}
3140 		if (flags & PD_DEREF) {
3141 			/* Drop a reference. */
3142 			KASSERT(refcount_load(&pr->pr_ref) > 0,
3143 			    ("prison_deref PD_DEREF on a dead prison (jid=%d)",
3144 			     pr->pr_id));
3145 			if (!refcount_release_if_not_last(&pr->pr_ref)) {
3146 				flags = prison_lock_xlock(pr, flags);
3147 				if (refcount_release(&pr->pr_ref)) {
3148 					/*
3149 					 * When the last reference goes,
3150 					 * unlink the prison and set it aside.
3151 					 */
3152 					KASSERT(
3153 					    refcount_load(&pr->pr_uref) == 0,
3154 					    ("prison_deref: last ref, "
3155 					     "but still has %d urefs (jid=%d)",
3156 					     pr->pr_uref, pr->pr_id));
3157 					KASSERT(
3158 					    refcount_load(&prison0.pr_ref) != 0,
3159 					    ("prison0 pr_ref=0"));
3160 					pr->pr_state = PRISON_STATE_INVALID;
3161 					TAILQ_REMOVE(&allprison, pr, pr_list);
3162 					LIST_REMOVE(pr, pr_sibling);
3163 					TAILQ_INSERT_TAIL(&freeprison, pr,
3164 					    pr_list);
3165 					for (ppr = pr->pr_parent;
3166 					     ppr != NULL;
3167 					     ppr = ppr->pr_parent)
3168 						ppr->pr_childcount--;
3169 					/*
3170 					 * Removing a prison frees references
3171 					 * from its parent.
3172 					 */
3173 					mtx_unlock(&pr->pr_mtx);
3174 					flags &= ~PD_LOCKED;
3175 					pr = pr->pr_parent;
3176 					flags |= PD_DEREF | PD_DEUREF;
3177 					continue;
3178 				}
3179 			}
3180 		}
3181 		break;
3182 	}
3183 
3184 	/* Release all the prison locks. */
3185 	if (flags & PD_LOCKED)
3186 		mtx_unlock(&pr->pr_mtx);
3187 	if (flags & PD_LIST_SLOCKED)
3188 		sx_sunlock(&allprison_lock);
3189 	else if (flags & PD_LIST_XLOCKED)
3190 		sx_xunlock(&allprison_lock);
3191 
3192 	/* Kill any processes attached to a killed prison. */
3193 	if (killpr != NULL)
3194 		prison_proc_iterate(killpr, prison_kill_processes_cb, NULL);
3195 
3196 	/*
3197 	 * Finish removing any unreferenced prisons, which couldn't happen
3198 	 * while allprison_lock was held (to avoid a LOR on vrele).
3199 	 */
3200 	TAILQ_FOREACH_SAFE(rpr, &freeprison, pr_list, tpr) {
3201 #ifdef VIMAGE
3202 		if (rpr->pr_vnet != rpr->pr_parent->pr_vnet)
3203 			vnet_destroy(rpr->pr_vnet);
3204 #endif
3205 		if (rpr->pr_root != NULL)
3206 			vrele(rpr->pr_root);
3207 		mtx_destroy(&rpr->pr_mtx);
3208 #ifdef INET
3209 		prison_ip_free(rpr->pr_addrs[PR_INET]);
3210 #endif
3211 #ifdef INET6
3212 		prison_ip_free(rpr->pr_addrs[PR_INET6]);
3213 #endif
3214 		if (rpr->pr_cpuset != NULL)
3215 			cpuset_rel(rpr->pr_cpuset);
3216 		osd_jail_exit(rpr);
3217 #ifdef RACCT
3218 		if (racct_enable)
3219 			prison_racct_detach(rpr);
3220 #endif
3221 		TAILQ_REMOVE(&freeprison, rpr, pr_list);
3222 		free(rpr, M_PRISON);
3223 	}
3224 }
3225 
3226 /*
3227  * Kill the prison and its descendants.  Mark them as dying, clear the
3228  * persist flag, and call module remove methods.
3229  */
3230 static void
3231 prison_deref_kill(struct prison *pr, struct prisonlist *freeprison)
3232 {
3233 	struct prison *cpr, *ppr, *rpr;
3234 	bool descend;
3235 
3236 	/*
3237 	 * Unlike the descendants, the target prison can be killed
3238 	 * even if it is currently dying.  This is useful for failed
3239 	 * creation in jail_set(2).
3240 	 */
3241 	KASSERT(refcount_load(&pr->pr_ref) > 0,
3242 	    ("Trying to kill dead prison %p (jid=%d).",
3243 	     pr, pr->pr_id));
3244 	refcount_acquire(&pr->pr_uref);
3245 	pr->pr_state = PRISON_STATE_DYING;
3246 	mtx_unlock(&pr->pr_mtx);
3247 
3248 	rpr = NULL;
3249 	FOREACH_PRISON_DESCENDANT_PRE_POST(pr, cpr, descend) {
3250 		if (descend) {
3251 			if (!prison_isalive(cpr)) {
3252 				descend = false;
3253 				continue;
3254 			}
3255 			prison_hold(cpr);
3256 			prison_proc_hold(cpr);
3257 			mtx_lock(&cpr->pr_mtx);
3258 			cpr->pr_state = PRISON_STATE_DYING;
3259 			cpr->pr_flags |= PR_REMOVE;
3260 			mtx_unlock(&cpr->pr_mtx);
3261 			continue;
3262 		}
3263 		if (!(cpr->pr_flags & PR_REMOVE))
3264 			continue;
3265 		prison_cleanup(cpr);
3266 		mtx_lock(&cpr->pr_mtx);
3267 		cpr->pr_flags &= ~PR_REMOVE;
3268 		if (cpr->pr_flags & PR_PERSIST) {
3269 			cpr->pr_flags &= ~PR_PERSIST;
3270 			prison_proc_free_not_last(cpr);
3271 			prison_free_not_last(cpr);
3272 		}
3273 		(void)refcount_release(&cpr->pr_uref);
3274 		if (refcount_release(&cpr->pr_ref)) {
3275 			/*
3276 			 * When the last reference goes, unlink the prison
3277 			 * and set it aside for prison_deref() to handle.
3278 			 * Delay unlinking the sibling list to keep the loop
3279 			 * safe.
3280 			 */
3281 			if (rpr != NULL)
3282 				LIST_REMOVE(rpr, pr_sibling);
3283 			rpr = cpr;
3284 			rpr->pr_state = PRISON_STATE_INVALID;
3285 			TAILQ_REMOVE(&allprison, rpr, pr_list);
3286 			TAILQ_INSERT_TAIL(freeprison, rpr, pr_list);
3287 			/*
3288 			 * Removing a prison frees references from its parent.
3289 			 */
3290 			ppr = rpr->pr_parent;
3291 			prison_proc_free_not_last(ppr);
3292 			prison_free_not_last(ppr);
3293 			for (; ppr != NULL; ppr = ppr->pr_parent)
3294 				ppr->pr_childcount--;
3295 		}
3296 		mtx_unlock(&cpr->pr_mtx);
3297 	}
3298 	if (rpr != NULL)
3299 		LIST_REMOVE(rpr, pr_sibling);
3300 
3301 	prison_cleanup(pr);
3302 	mtx_lock(&pr->pr_mtx);
3303 	if (pr->pr_flags & PR_PERSIST) {
3304 		pr->pr_flags &= ~PR_PERSIST;
3305 		prison_proc_free_not_last(pr);
3306 		prison_free_not_last(pr);
3307 	}
3308 	(void)refcount_release(&pr->pr_uref);
3309 }
3310 
3311 /*
3312  * Given the current locking state in the flags, make sure allprison_lock
3313  * is held exclusive, and the prison is locked.  Return flags indicating
3314  * the new state.
3315  */
3316 static int
3317 prison_lock_xlock(struct prison *pr, int flags)
3318 {
3319 
3320 	if (!(flags & PD_LIST_XLOCKED)) {
3321 		/*
3322 		 * Get allprison_lock, which may be an upgrade,
3323 		 * and may require unlocking the prison.
3324 		 */
3325 		if (flags & PD_LOCKED) {
3326 			mtx_unlock(&pr->pr_mtx);
3327 			flags &= ~PD_LOCKED;
3328 		}
3329 		if (flags & PD_LIST_SLOCKED) {
3330 			if (!sx_try_upgrade(&allprison_lock)) {
3331 				sx_sunlock(&allprison_lock);
3332 				sx_xlock(&allprison_lock);
3333 			}
3334 			flags &= ~PD_LIST_SLOCKED;
3335 		} else
3336 			sx_xlock(&allprison_lock);
3337 		flags |= PD_LIST_XLOCKED;
3338 	}
3339 	if (!(flags & PD_LOCKED)) {
3340 		/* Lock the prison mutex. */
3341 		mtx_lock(&pr->pr_mtx);
3342 		flags |= PD_LOCKED;
3343 	}
3344 	return flags;
3345 }
3346 
3347 /*
3348  * Release a prison's resources when it starts dying (when the last user
3349  * reference is dropped, or when it is killed).
3350  */
3351 static void
3352 prison_cleanup(struct prison *pr)
3353 {
3354 	sx_assert(&allprison_lock, SA_XLOCKED);
3355 	mtx_assert(&pr->pr_mtx, MA_NOTOWNED);
3356 	vfs_exjail_delete(pr);
3357 	shm_remove_prison(pr);
3358 	(void)osd_jail_call(pr, PR_METHOD_REMOVE, NULL);
3359 }
3360 
3361 /*
3362  * Set or clear a permission bit in the pr_allow field, passing restrictions
3363  * (cleared permission) down to child jails.
3364  */
3365 void
3366 prison_set_allow(struct ucred *cred, unsigned flag, int enable)
3367 {
3368 	struct prison *pr;
3369 
3370 	pr = cred->cr_prison;
3371 	sx_slock(&allprison_lock);
3372 	mtx_lock(&pr->pr_mtx);
3373 	prison_set_allow_locked(pr, flag, enable);
3374 	mtx_unlock(&pr->pr_mtx);
3375 	sx_sunlock(&allprison_lock);
3376 }
3377 
3378 static void
3379 prison_set_allow_locked(struct prison *pr, unsigned flag, int enable)
3380 {
3381 	struct prison *cpr;
3382 	int descend;
3383 
3384 	if (enable != 0)
3385 		pr->pr_allow |= flag;
3386 	else {
3387 		pr->pr_allow &= ~flag;
3388 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, cpr, descend)
3389 			cpr->pr_allow &= ~flag;
3390 	}
3391 }
3392 
3393 /*
3394  * Check if a jail supports the given address family.
3395  *
3396  * Returns 0 if not jailed or the address family is supported, EAFNOSUPPORT
3397  * if not.
3398  */
3399 int
3400 prison_check_af(struct ucred *cred, int af)
3401 {
3402 	struct prison *pr;
3403 	int error;
3404 
3405 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
3406 
3407 	pr = cred->cr_prison;
3408 #ifdef VIMAGE
3409 	/* Prisons with their own network stack are not limited. */
3410 	if (prison_owns_vnet(cred))
3411 		return (0);
3412 #endif
3413 
3414 	error = 0;
3415 	switch (af)
3416 	{
3417 #ifdef INET
3418 	case AF_INET:
3419 		if (pr->pr_flags & PR_IP4)
3420 		{
3421 			mtx_lock(&pr->pr_mtx);
3422 			if ((pr->pr_flags & PR_IP4) &&
3423 			    pr->pr_addrs[PR_INET] == NULL)
3424 				error = EAFNOSUPPORT;
3425 			mtx_unlock(&pr->pr_mtx);
3426 		}
3427 		break;
3428 #endif
3429 #ifdef INET6
3430 	case AF_INET6:
3431 		if (pr->pr_flags & PR_IP6)
3432 		{
3433 			mtx_lock(&pr->pr_mtx);
3434 			if ((pr->pr_flags & PR_IP6) &&
3435 			    pr->pr_addrs[PR_INET6] == NULL)
3436 				error = EAFNOSUPPORT;
3437 			mtx_unlock(&pr->pr_mtx);
3438 		}
3439 		break;
3440 #endif
3441 	case AF_LOCAL:
3442 	case AF_ROUTE:
3443 		break;
3444 	default:
3445 		if (!(pr->pr_allow & PR_ALLOW_SOCKET_AF))
3446 			error = EAFNOSUPPORT;
3447 	}
3448 	return (error);
3449 }
3450 
3451 /*
3452  * Check if given address belongs to the jail referenced by cred (wrapper to
3453  * prison_check_ip[46]).
3454  *
3455  * Returns 0 if jail doesn't restrict the address family or if address belongs
3456  * to jail, EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if
3457  * the jail doesn't allow the address family.  IPv4 Address passed in in NBO.
3458  */
3459 int
3460 prison_if(struct ucred *cred, const struct sockaddr *sa)
3461 {
3462 #ifdef INET
3463 	const struct sockaddr_in *sai;
3464 #endif
3465 #ifdef INET6
3466 	const struct sockaddr_in6 *sai6;
3467 #endif
3468 	int error;
3469 
3470 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
3471 	KASSERT(sa != NULL, ("%s: sa is NULL", __func__));
3472 
3473 #ifdef VIMAGE
3474 	if (prison_owns_vnet(cred))
3475 		return (0);
3476 #endif
3477 
3478 	error = 0;
3479 	switch (sa->sa_family)
3480 	{
3481 #ifdef INET
3482 	case AF_INET:
3483 		sai = (const struct sockaddr_in *)sa;
3484 		error = prison_check_ip4(cred, &sai->sin_addr);
3485 		break;
3486 #endif
3487 #ifdef INET6
3488 	case AF_INET6:
3489 		sai6 = (const struct sockaddr_in6 *)sa;
3490 		error = prison_check_ip6(cred, &sai6->sin6_addr);
3491 		break;
3492 #endif
3493 	default:
3494 		if (!(cred->cr_prison->pr_allow & PR_ALLOW_SOCKET_AF))
3495 			error = EAFNOSUPPORT;
3496 	}
3497 	return (error);
3498 }
3499 
3500 /*
3501  * Return 0 if jails permit p1 to frob p2, otherwise ESRCH.
3502  */
3503 int
3504 prison_check(struct ucred *cred1, struct ucred *cred2)
3505 {
3506 
3507 	return ((cred1->cr_prison == cred2->cr_prison ||
3508 	    prison_ischild(cred1->cr_prison, cred2->cr_prison)) ? 0 : ESRCH);
3509 }
3510 
3511 /*
3512  * For mountd/nfsd to run within a prison, it must be:
3513  * - A vnet prison.
3514  * - PR_ALLOW_NFSD must be set on it.
3515  * - The root directory (pr_root) of the prison must be
3516  *   a file system mount point, so the mountd can hang
3517  *   export information on it.
3518  * - The prison's enforce_statfs cannot be 0, so that
3519  *   mountd(8) can do exports.
3520  */
3521 bool
3522 prison_check_nfsd(struct ucred *cred)
3523 {
3524 
3525 	if (jailed_without_vnet(cred))
3526 		return (false);
3527 	if (!prison_allow(cred, PR_ALLOW_NFSD))
3528 		return (false);
3529 	if ((cred->cr_prison->pr_root->v_vflag & VV_ROOT) == 0)
3530 		return (false);
3531 	if (cred->cr_prison->pr_enforce_statfs == 0)
3532 		return (false);
3533 	return (true);
3534 }
3535 
3536 /*
3537  * Return true if p2 is a child of p1, otherwise false.
3538  */
3539 bool
3540 prison_ischild(struct prison *pr1, struct prison *pr2)
3541 {
3542 
3543 	for (pr2 = pr2->pr_parent; pr2 != NULL; pr2 = pr2->pr_parent)
3544 		if (pr1 == pr2)
3545 			return (true);
3546 	return (false);
3547 }
3548 
3549 /*
3550  * Return true if the prison is currently alive.  A prison is alive if it
3551  * holds user references and it isn't being removed.
3552  */
3553 bool
3554 prison_isalive(const struct prison *pr)
3555 {
3556 
3557 	if (__predict_false(pr->pr_state != PRISON_STATE_ALIVE))
3558 		return (false);
3559 	return (true);
3560 }
3561 
3562 /*
3563  * Return true if the prison is currently valid.  A prison is valid if it has
3564  * been fully created, and is not being destroyed.  Note that dying prisons
3565  * are still considered valid.  Invalid prisons won't be found under normal
3566  * circumstances, as they're only put in that state by functions that have
3567  * an exclusive hold on allprison_lock.
3568  */
3569 bool
3570 prison_isvalid(struct prison *pr)
3571 {
3572 
3573 	if (__predict_false(pr->pr_state == PRISON_STATE_INVALID))
3574 		return (false);
3575 	if (__predict_false(refcount_load(&pr->pr_ref) == 0))
3576 		return (false);
3577 	return (true);
3578 }
3579 
3580 /*
3581  * Return true if the passed credential is in a jail and that jail does not
3582  * have its own virtual network stack, otherwise false.
3583  */
3584 bool
3585 jailed_without_vnet(struct ucred *cred)
3586 {
3587 
3588 	if (!jailed(cred))
3589 		return (false);
3590 #ifdef VIMAGE
3591 	if (prison_owns_vnet(cred))
3592 		return (false);
3593 #endif
3594 
3595 	return (true);
3596 }
3597 
3598 /*
3599  * Return the correct hostname (domainname, et al) for the passed credential.
3600  */
3601 void
3602 getcredhostname(struct ucred *cred, char *buf, size_t size)
3603 {
3604 	struct prison *pr;
3605 
3606 	/*
3607 	 * A NULL credential can be used to shortcut to the physical
3608 	 * system's hostname.
3609 	 */
3610 	pr = (cred != NULL) ? cred->cr_prison : &prison0;
3611 	mtx_lock(&pr->pr_mtx);
3612 	strlcpy(buf, pr->pr_hostname, size);
3613 	mtx_unlock(&pr->pr_mtx);
3614 }
3615 
3616 void
3617 getcreddomainname(struct ucred *cred, char *buf, size_t size)
3618 {
3619 
3620 	mtx_lock(&cred->cr_prison->pr_mtx);
3621 	strlcpy(buf, cred->cr_prison->pr_domainname, size);
3622 	mtx_unlock(&cred->cr_prison->pr_mtx);
3623 }
3624 
3625 void
3626 getcredhostuuid(struct ucred *cred, char *buf, size_t size)
3627 {
3628 
3629 	mtx_lock(&cred->cr_prison->pr_mtx);
3630 	strlcpy(buf, cred->cr_prison->pr_hostuuid, size);
3631 	mtx_unlock(&cred->cr_prison->pr_mtx);
3632 }
3633 
3634 void
3635 getcredhostid(struct ucred *cred, unsigned long *hostid)
3636 {
3637 
3638 	mtx_lock(&cred->cr_prison->pr_mtx);
3639 	*hostid = cred->cr_prison->pr_hostid;
3640 	mtx_unlock(&cred->cr_prison->pr_mtx);
3641 }
3642 
3643 void
3644 getjailname(struct ucred *cred, char *name, size_t len)
3645 {
3646 
3647 	mtx_lock(&cred->cr_prison->pr_mtx);
3648 	strlcpy(name, cred->cr_prison->pr_name, len);
3649 	mtx_unlock(&cred->cr_prison->pr_mtx);
3650 }
3651 
3652 #ifdef VIMAGE
3653 /*
3654  * Determine whether the prison represented by cred owns
3655  * its vnet rather than having it inherited.
3656  *
3657  * Returns true in case the prison owns the vnet, false otherwise.
3658  */
3659 bool
3660 prison_owns_vnet(struct ucred *cred)
3661 {
3662 
3663 	/*
3664 	 * vnets cannot be added/removed after jail creation,
3665 	 * so no need to lock here.
3666 	 */
3667 	return ((cred->cr_prison->pr_flags & PR_VNET) != 0);
3668 }
3669 #endif
3670 
3671 /*
3672  * Determine whether the subject represented by cred can "see"
3673  * status of a mount point.
3674  * Returns: 0 for permitted, ENOENT otherwise.
3675  * XXX: This function should be called cr_canseemount() and should be
3676  *      placed in kern_prot.c.
3677  */
3678 int
3679 prison_canseemount(struct ucred *cred, struct mount *mp)
3680 {
3681 	struct prison *pr;
3682 	struct statfs *sp;
3683 	size_t len;
3684 
3685 	pr = cred->cr_prison;
3686 	if (pr->pr_enforce_statfs == 0)
3687 		return (0);
3688 	if (pr->pr_root->v_mount == mp)
3689 		return (0);
3690 	if (pr->pr_enforce_statfs == 2)
3691 		return (ENOENT);
3692 	/*
3693 	 * If jail's chroot directory is set to "/" we should be able to see
3694 	 * all mount-points from inside a jail.
3695 	 * This is ugly check, but this is the only situation when jail's
3696 	 * directory ends with '/'.
3697 	 */
3698 	if (strcmp(pr->pr_path, "/") == 0)
3699 		return (0);
3700 	len = strlen(pr->pr_path);
3701 	sp = &mp->mnt_stat;
3702 	if (strncmp(pr->pr_path, sp->f_mntonname, len) != 0)
3703 		return (ENOENT);
3704 	/*
3705 	 * Be sure that we don't have situation where jail's root directory
3706 	 * is "/some/path" and mount point is "/some/pathpath".
3707 	 */
3708 	if (sp->f_mntonname[len] != '\0' && sp->f_mntonname[len] != '/')
3709 		return (ENOENT);
3710 	return (0);
3711 }
3712 
3713 void
3714 prison_enforce_statfs(struct ucred *cred, struct mount *mp, struct statfs *sp)
3715 {
3716 	char jpath[MAXPATHLEN];
3717 	struct prison *pr;
3718 	size_t len;
3719 
3720 	pr = cred->cr_prison;
3721 	if (pr->pr_enforce_statfs == 0)
3722 		return;
3723 	if (prison_canseemount(cred, mp) != 0) {
3724 		bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
3725 		strlcpy(sp->f_mntonname, "[restricted]",
3726 		    sizeof(sp->f_mntonname));
3727 		return;
3728 	}
3729 	if (pr->pr_root->v_mount == mp) {
3730 		/*
3731 		 * Clear current buffer data, so we are sure nothing from
3732 		 * the valid path left there.
3733 		 */
3734 		bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
3735 		*sp->f_mntonname = '/';
3736 		return;
3737 	}
3738 	/*
3739 	 * If jail's chroot directory is set to "/" we should be able to see
3740 	 * all mount-points from inside a jail.
3741 	 */
3742 	if (strcmp(pr->pr_path, "/") == 0)
3743 		return;
3744 	len = strlen(pr->pr_path);
3745 	strlcpy(jpath, sp->f_mntonname + len, sizeof(jpath));
3746 	/*
3747 	 * Clear current buffer data, so we are sure nothing from
3748 	 * the valid path left there.
3749 	 */
3750 	bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
3751 	if (*jpath == '\0') {
3752 		/* Should never happen. */
3753 		*sp->f_mntonname = '/';
3754 	} else {
3755 		strlcpy(sp->f_mntonname, jpath, sizeof(sp->f_mntonname));
3756 	}
3757 }
3758 
3759 /*
3760  * Check with permission for a specific privilege is granted within jail.  We
3761  * have a specific list of accepted privileges; the rest are denied.
3762  */
3763 int
3764 prison_priv_check(struct ucred *cred, int priv)
3765 {
3766 	struct prison *pr;
3767 	int error;
3768 
3769 	/*
3770 	 * Some policies have custom handlers. This routine should not be
3771 	 * called for them. See priv_check_cred().
3772 	 */
3773 	switch (priv) {
3774 	case PRIV_VFS_LOOKUP:
3775 	case PRIV_VFS_GENERATION:
3776 		KASSERT(0, ("prison_priv_check instead of a custom handler "
3777 		    "called for %d\n", priv));
3778 	}
3779 
3780 	if (!jailed(cred))
3781 		return (0);
3782 
3783 #ifdef VIMAGE
3784 	/*
3785 	 * Privileges specific to prisons with a virtual network stack.
3786 	 * There might be a duplicate entry here in case the privilege
3787 	 * is only granted conditionally in the legacy jail case.
3788 	 */
3789 	switch (priv) {
3790 		/*
3791 		 * NFS-specific privileges.
3792 		 */
3793 	case PRIV_NFS_DAEMON:
3794 	case PRIV_VFS_GETFH:
3795 	case PRIV_VFS_MOUNT_EXPORTED:
3796 		if (!prison_check_nfsd(cred))
3797 			return (EPERM);
3798 #ifdef notyet
3799 	case PRIV_NFS_LOCKD:
3800 #endif
3801 		/*
3802 		 * Network stack privileges.
3803 		 */
3804 	case PRIV_NET_BRIDGE:
3805 	case PRIV_NET_GRE:
3806 	case PRIV_NET_BPF:
3807 	case PRIV_NET_RAW:		/* Dup, cond. in legacy jail case. */
3808 	case PRIV_NET_ROUTE:
3809 	case PRIV_NET_TAP:
3810 	case PRIV_NET_SETIFMTU:
3811 	case PRIV_NET_SETIFFLAGS:
3812 	case PRIV_NET_SETIFCAP:
3813 	case PRIV_NET_SETIFDESCR:
3814 	case PRIV_NET_SETIFNAME	:
3815 	case PRIV_NET_SETIFMETRIC:
3816 	case PRIV_NET_SETIFPHYS:
3817 	case PRIV_NET_SETIFMAC:
3818 	case PRIV_NET_SETLANPCP:
3819 	case PRIV_NET_ADDMULTI:
3820 	case PRIV_NET_DELMULTI:
3821 	case PRIV_NET_HWIOCTL:
3822 	case PRIV_NET_SETLLADDR:
3823 	case PRIV_NET_ADDIFGROUP:
3824 	case PRIV_NET_DELIFGROUP:
3825 	case PRIV_NET_IFCREATE:
3826 	case PRIV_NET_IFDESTROY:
3827 	case PRIV_NET_ADDIFADDR:
3828 	case PRIV_NET_DELIFADDR:
3829 	case PRIV_NET_LAGG:
3830 	case PRIV_NET_GIF:
3831 	case PRIV_NET_SETIFVNET:
3832 	case PRIV_NET_SETIFFIB:
3833 	case PRIV_NET_OVPN:
3834 	case PRIV_NET_ME:
3835 	case PRIV_NET_WG:
3836 
3837 		/*
3838 		 * 802.11-related privileges.
3839 		 */
3840 	case PRIV_NET80211_VAP_GETKEY:
3841 	case PRIV_NET80211_VAP_MANAGE:
3842 
3843 #ifdef notyet
3844 		/*
3845 		 * ATM privileges.
3846 		 */
3847 	case PRIV_NETATM_CFG:
3848 	case PRIV_NETATM_ADD:
3849 	case PRIV_NETATM_DEL:
3850 	case PRIV_NETATM_SET:
3851 
3852 		/*
3853 		 * Bluetooth privileges.
3854 		 */
3855 	case PRIV_NETBLUETOOTH_RAW:
3856 #endif
3857 
3858 		/*
3859 		 * Netgraph and netgraph module privileges.
3860 		 */
3861 	case PRIV_NETGRAPH_CONTROL:
3862 #ifdef notyet
3863 	case PRIV_NETGRAPH_TTY:
3864 #endif
3865 
3866 		/*
3867 		 * IPv4 and IPv6 privileges.
3868 		 */
3869 	case PRIV_NETINET_IPFW:
3870 	case PRIV_NETINET_DIVERT:
3871 	case PRIV_NETINET_PF:
3872 	case PRIV_NETINET_DUMMYNET:
3873 	case PRIV_NETINET_CARP:
3874 	case PRIV_NETINET_MROUTE:
3875 	case PRIV_NETINET_RAW:
3876 	case PRIV_NETINET_ADDRCTRL6:
3877 	case PRIV_NETINET_ND6:
3878 	case PRIV_NETINET_SCOPE6:
3879 	case PRIV_NETINET_ALIFETIME6:
3880 	case PRIV_NETINET_IPSEC:
3881 	case PRIV_NETINET_BINDANY:
3882 
3883 #ifdef notyet
3884 		/*
3885 		 * NCP privileges.
3886 		 */
3887 	case PRIV_NETNCP:
3888 
3889 		/*
3890 		 * SMB privileges.
3891 		 */
3892 	case PRIV_NETSMB:
3893 #endif
3894 
3895 	/*
3896 	 * No default: or deny here.
3897 	 * In case of no permit fall through to next switch().
3898 	 */
3899 		if (cred->cr_prison->pr_flags & PR_VNET)
3900 			return (0);
3901 	}
3902 #endif /* VIMAGE */
3903 
3904 	switch (priv) {
3905 		/*
3906 		 * Allow ktrace privileges for root in jail.
3907 		 */
3908 	case PRIV_KTRACE:
3909 
3910 #if 0
3911 		/*
3912 		 * Allow jailed processes to configure audit identity and
3913 		 * submit audit records (login, etc).  In the future we may
3914 		 * want to further refine the relationship between audit and
3915 		 * jail.
3916 		 */
3917 	case PRIV_AUDIT_GETAUDIT:
3918 	case PRIV_AUDIT_SETAUDIT:
3919 	case PRIV_AUDIT_SUBMIT:
3920 #endif
3921 
3922 		/*
3923 		 * Allow jailed processes to manipulate process UNIX
3924 		 * credentials in any way they see fit.
3925 		 */
3926 	case PRIV_CRED_SETUID:
3927 	case PRIV_CRED_SETEUID:
3928 	case PRIV_CRED_SETGID:
3929 	case PRIV_CRED_SETEGID:
3930 	case PRIV_CRED_SETGROUPS:
3931 	case PRIV_CRED_SETREUID:
3932 	case PRIV_CRED_SETREGID:
3933 	case PRIV_CRED_SETRESUID:
3934 	case PRIV_CRED_SETRESGID:
3935 
3936 		/*
3937 		 * Jail implements visibility constraints already, so allow
3938 		 * jailed root to override uid/gid-based constraints.
3939 		 */
3940 	case PRIV_SEEOTHERGIDS:
3941 	case PRIV_SEEOTHERUIDS:
3942 
3943 		/*
3944 		 * Jail implements inter-process debugging limits already, so
3945 		 * allow jailed root various debugging privileges.
3946 		 */
3947 	case PRIV_DEBUG_DIFFCRED:
3948 	case PRIV_DEBUG_SUGID:
3949 	case PRIV_DEBUG_UNPRIV:
3950 
3951 		/*
3952 		 * Allow jail to set various resource limits and login
3953 		 * properties, and for now, exceed process resource limits.
3954 		 */
3955 	case PRIV_PROC_LIMIT:
3956 	case PRIV_PROC_SETLOGIN:
3957 	case PRIV_PROC_SETRLIMIT:
3958 
3959 		/*
3960 		 * System V and POSIX IPC privileges are granted in jail.
3961 		 */
3962 	case PRIV_IPC_READ:
3963 	case PRIV_IPC_WRITE:
3964 	case PRIV_IPC_ADMIN:
3965 	case PRIV_IPC_MSGSIZE:
3966 	case PRIV_MQ_ADMIN:
3967 
3968 		/*
3969 		 * Jail operations within a jail work on child jails.
3970 		 */
3971 	case PRIV_JAIL_ATTACH:
3972 	case PRIV_JAIL_SET:
3973 	case PRIV_JAIL_REMOVE:
3974 
3975 		/*
3976 		 * Jail implements its own inter-process limits, so allow
3977 		 * root processes in jail to change scheduling on other
3978 		 * processes in the same jail.  Likewise for signalling.
3979 		 */
3980 	case PRIV_SCHED_DIFFCRED:
3981 	case PRIV_SCHED_CPUSET:
3982 	case PRIV_SIGNAL_DIFFCRED:
3983 	case PRIV_SIGNAL_SUGID:
3984 
3985 		/*
3986 		 * Allow jailed processes to write to sysctls marked as jail
3987 		 * writable.
3988 		 */
3989 	case PRIV_SYSCTL_WRITEJAIL:
3990 
3991 		/*
3992 		 * Allow root in jail to manage a variety of quota
3993 		 * properties.  These should likely be conditional on a
3994 		 * configuration option.
3995 		 */
3996 	case PRIV_VFS_GETQUOTA:
3997 	case PRIV_VFS_SETQUOTA:
3998 
3999 		/*
4000 		 * Since Jail relies on chroot() to implement file system
4001 		 * protections, grant many VFS privileges to root in jail.
4002 		 * Be careful to exclude mount-related and NFS-related
4003 		 * privileges.
4004 		 */
4005 	case PRIV_VFS_READ:
4006 	case PRIV_VFS_WRITE:
4007 	case PRIV_VFS_ADMIN:
4008 	case PRIV_VFS_EXEC:
4009 	case PRIV_VFS_BLOCKRESERVE:	/* XXXRW: Slightly surprising. */
4010 	case PRIV_VFS_CHFLAGS_DEV:
4011 	case PRIV_VFS_CHOWN:
4012 	case PRIV_VFS_CHROOT:
4013 	case PRIV_VFS_RETAINSUGID:
4014 	case PRIV_VFS_FCHROOT:
4015 	case PRIV_VFS_LINK:
4016 	case PRIV_VFS_SETGID:
4017 	case PRIV_VFS_STAT:
4018 	case PRIV_VFS_STICKYFILE:
4019 
4020 		/*
4021 		 * As in the non-jail case, non-root users are expected to be
4022 		 * able to read kernel/physical memory (provided /dev/[k]mem
4023 		 * exists in the jail and they have permission to access it).
4024 		 */
4025 	case PRIV_KMEM_READ:
4026 		return (0);
4027 
4028 		/*
4029 		 * Depending on the global setting, allow privilege of
4030 		 * setting system flags.
4031 		 */
4032 	case PRIV_VFS_SYSFLAGS:
4033 		if (cred->cr_prison->pr_allow & PR_ALLOW_CHFLAGS)
4034 			return (0);
4035 		else
4036 			return (EPERM);
4037 
4038 		/*
4039 		 * Depending on the global setting, allow privilege of
4040 		 * mounting/unmounting file systems.
4041 		 */
4042 	case PRIV_VFS_MOUNT:
4043 	case PRIV_VFS_UNMOUNT:
4044 	case PRIV_VFS_MOUNT_NONUSER:
4045 	case PRIV_VFS_MOUNT_OWNER:
4046 		pr = cred->cr_prison;
4047 		prison_lock(pr);
4048 		if (pr->pr_allow & PR_ALLOW_MOUNT && pr->pr_enforce_statfs < 2)
4049 			error = 0;
4050 		else
4051 			error = EPERM;
4052 		prison_unlock(pr);
4053 		return (error);
4054 
4055 		/*
4056 		 * Jails should hold no disposition on the PRIV_VFS_READ_DIR
4057 		 * policy.  priv_check_cred will not specifically allow it, and
4058 		 * we may want a MAC policy to allow it.
4059 		 */
4060 	case PRIV_VFS_READ_DIR:
4061 		return (0);
4062 
4063 		/*
4064 		 * Conditionnaly allow locking (unlocking) physical pages
4065 		 * in memory.
4066 		 */
4067 	case PRIV_VM_MLOCK:
4068 	case PRIV_VM_MUNLOCK:
4069 		if (cred->cr_prison->pr_allow & PR_ALLOW_MLOCK)
4070 			return (0);
4071 		else
4072 			return (EPERM);
4073 
4074 		/*
4075 		 * Conditionally allow jailed root to bind reserved ports.
4076 		 */
4077 	case PRIV_NETINET_RESERVEDPORT:
4078 		if (cred->cr_prison->pr_allow & PR_ALLOW_RESERVED_PORTS)
4079 			return (0);
4080 		else
4081 			return (EPERM);
4082 
4083 		/*
4084 		 * Allow jailed root to reuse in-use ports.
4085 		 */
4086 	case PRIV_NETINET_REUSEPORT:
4087 		return (0);
4088 
4089 		/*
4090 		 * Allow jailed root to set certain IPv4/6 (option) headers.
4091 		 */
4092 	case PRIV_NETINET_SETHDROPTS:
4093 		return (0);
4094 
4095 		/*
4096 		 * Conditionally allow creating raw sockets in jail.
4097 		 */
4098 	case PRIV_NETINET_RAW:
4099 		if (cred->cr_prison->pr_allow & PR_ALLOW_RAW_SOCKETS)
4100 			return (0);
4101 		else
4102 			return (EPERM);
4103 
4104 		/*
4105 		 * Since jail implements its own visibility limits on netstat
4106 		 * sysctls, allow getcred.  This allows identd to work in
4107 		 * jail.
4108 		 */
4109 	case PRIV_NETINET_GETCRED:
4110 		return (0);
4111 
4112 		/*
4113 		 * Allow jailed root to set loginclass.
4114 		 */
4115 	case PRIV_PROC_SETLOGINCLASS:
4116 		return (0);
4117 
4118 		/*
4119 		 * Do not allow a process inside a jail to read the kernel
4120 		 * message buffer unless explicitly permitted.
4121 		 */
4122 	case PRIV_MSGBUF:
4123 		if (cred->cr_prison->pr_allow & PR_ALLOW_READ_MSGBUF)
4124 			return (0);
4125 		return (EPERM);
4126 
4127 	default:
4128 		/*
4129 		 * In all remaining cases, deny the privilege request.  This
4130 		 * includes almost all network privileges, many system
4131 		 * configuration privileges.
4132 		 */
4133 		return (EPERM);
4134 	}
4135 }
4136 
4137 /*
4138  * Return the part of pr2's name that is relative to pr1, or the whole name
4139  * if it does not directly follow.
4140  */
4141 
4142 char *
4143 prison_name(struct prison *pr1, struct prison *pr2)
4144 {
4145 	char *name;
4146 
4147 	/* Jails see themselves as "0" (if they see themselves at all). */
4148 	if (pr1 == pr2)
4149 		return "0";
4150 	name = pr2->pr_name;
4151 	if (prison_ischild(pr1, pr2)) {
4152 		/*
4153 		 * pr1 isn't locked (and allprison_lock may not be either)
4154 		 * so its length can't be counted on.  But the number of dots
4155 		 * can be counted on - and counted.
4156 		 */
4157 		for (; pr1 != &prison0; pr1 = pr1->pr_parent)
4158 			name = strchr(name, '.') + 1;
4159 	}
4160 	return (name);
4161 }
4162 
4163 /*
4164  * Return the part of pr2's path that is relative to pr1, or the whole path
4165  * if it does not directly follow.
4166  */
4167 static char *
4168 prison_path(struct prison *pr1, struct prison *pr2)
4169 {
4170 	char *path1, *path2;
4171 	int len1;
4172 
4173 	path1 = pr1->pr_path;
4174 	path2 = pr2->pr_path;
4175 	if (!strcmp(path1, "/"))
4176 		return (path2);
4177 	len1 = strlen(path1);
4178 	if (strncmp(path1, path2, len1))
4179 		return (path2);
4180 	if (path2[len1] == '\0')
4181 		return "/";
4182 	if (path2[len1] == '/')
4183 		return (path2 + len1);
4184 	return (path2);
4185 }
4186 
4187 /*
4188  * Jail-related sysctls.
4189  */
4190 static SYSCTL_NODE(_security, OID_AUTO, jail, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
4191     "Jails");
4192 
4193 #if defined(INET) || defined(INET6)
4194 /*
4195  * Copy address array to memory that would be then SYSCTL_OUT-ed.
4196  * sysctl_jail_list() helper.
4197  */
4198 static void
4199 prison_ip_copyout(struct prison *pr, const pr_family_t af, void **out, int *len)
4200 {
4201 	const struct prison_ip *pip;
4202 	const size_t size = pr_families[af].size;
4203 
4204  again:
4205 	mtx_assert(&pr->pr_mtx, MA_OWNED);
4206 	if ((pip = pr->pr_addrs[af]) != NULL) {
4207 		if (*len < pip->ips) {
4208 			*len = pip->ips;
4209 			mtx_unlock(&pr->pr_mtx);
4210 			*out = realloc(*out, *len * size, M_TEMP, M_WAITOK);
4211 			mtx_lock(&pr->pr_mtx);
4212 			goto again;
4213 		}
4214 		bcopy(pip->pr_ip, *out, pip->ips * size);
4215 	}
4216 }
4217 #endif
4218 
4219 static int
4220 sysctl_jail_list(SYSCTL_HANDLER_ARGS)
4221 {
4222 	struct xprison *xp;
4223 	struct prison *pr, *cpr;
4224 #ifdef INET
4225 	struct in_addr *ip4 = NULL;
4226 	int ip4s = 0;
4227 #endif
4228 #ifdef INET6
4229 	struct in6_addr *ip6 = NULL;
4230 	int ip6s = 0;
4231 #endif
4232 	int descend, error;
4233 
4234 	xp = malloc(sizeof(*xp), M_TEMP, M_WAITOK);
4235 	pr = req->td->td_ucred->cr_prison;
4236 	error = 0;
4237 	sx_slock(&allprison_lock);
4238 	FOREACH_PRISON_DESCENDANT(pr, cpr, descend) {
4239 		mtx_lock(&cpr->pr_mtx);
4240 #ifdef INET
4241 		prison_ip_copyout(cpr, PR_INET, (void **)&ip4, &ip4s);
4242 #endif
4243 #ifdef INET6
4244 		prison_ip_copyout(cpr, PR_INET6, (void **)&ip6, &ip6s);
4245 #endif
4246 		bzero(xp, sizeof(*xp));
4247 		xp->pr_version = XPRISON_VERSION;
4248 		xp->pr_id = cpr->pr_id;
4249 		xp->pr_state = cpr->pr_state;
4250 		strlcpy(xp->pr_path, prison_path(pr, cpr), sizeof(xp->pr_path));
4251 		strlcpy(xp->pr_host, cpr->pr_hostname, sizeof(xp->pr_host));
4252 		strlcpy(xp->pr_name, prison_name(pr, cpr), sizeof(xp->pr_name));
4253 #ifdef INET
4254 		xp->pr_ip4s = ip4s;
4255 #endif
4256 #ifdef INET6
4257 		xp->pr_ip6s = ip6s;
4258 #endif
4259 		mtx_unlock(&cpr->pr_mtx);
4260 		error = SYSCTL_OUT(req, xp, sizeof(*xp));
4261 		if (error)
4262 			break;
4263 #ifdef INET
4264 		if (xp->pr_ip4s > 0) {
4265 			error = SYSCTL_OUT(req, ip4,
4266 			    xp->pr_ip4s * sizeof(struct in_addr));
4267 			if (error)
4268 				break;
4269 		}
4270 #endif
4271 #ifdef INET6
4272 		if (xp->pr_ip6s > 0) {
4273 			error = SYSCTL_OUT(req, ip6,
4274 			    xp->pr_ip6s * sizeof(struct in6_addr));
4275 			if (error)
4276 				break;
4277 		}
4278 #endif
4279 	}
4280 	sx_sunlock(&allprison_lock);
4281 	free(xp, M_TEMP);
4282 #ifdef INET
4283 	free(ip4, M_TEMP);
4284 #endif
4285 #ifdef INET6
4286 	free(ip6, M_TEMP);
4287 #endif
4288 	return (error);
4289 }
4290 
4291 SYSCTL_OID(_security_jail, OID_AUTO, list,
4292     CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
4293     sysctl_jail_list, "S", "List of active jails");
4294 
4295 static int
4296 sysctl_jail_jailed(SYSCTL_HANDLER_ARGS)
4297 {
4298 	int error, injail;
4299 
4300 	injail = jailed(req->td->td_ucred);
4301 	error = SYSCTL_OUT(req, &injail, sizeof(injail));
4302 
4303 	return (error);
4304 }
4305 
4306 SYSCTL_PROC(_security_jail, OID_AUTO, jailed,
4307     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
4308     sysctl_jail_jailed, "I", "Process in jail?");
4309 
4310 static int
4311 sysctl_jail_vnet(SYSCTL_HANDLER_ARGS)
4312 {
4313 	int error, havevnet;
4314 #ifdef VIMAGE
4315 	struct ucred *cred = req->td->td_ucred;
4316 
4317 	havevnet = jailed(cred) && prison_owns_vnet(cred);
4318 #else
4319 	havevnet = 0;
4320 #endif
4321 	error = SYSCTL_OUT(req, &havevnet, sizeof(havevnet));
4322 
4323 	return (error);
4324 }
4325 
4326 SYSCTL_PROC(_security_jail, OID_AUTO, vnet,
4327     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
4328     sysctl_jail_vnet, "I", "Jail owns vnet?");
4329 
4330 #if defined(INET) || defined(INET6)
4331 SYSCTL_UINT(_security_jail, OID_AUTO, jail_max_af_ips, CTLFLAG_RW,
4332     &jail_max_af_ips, 0,
4333     "Number of IP addresses a jail may have at most per address family (deprecated)");
4334 #endif
4335 
4336 /*
4337  * Default parameters for jail(2) compatibility.  For historical reasons,
4338  * the sysctl names have varying similarity to the parameter names.  Prisons
4339  * just see their own parameters, and can't change them.
4340  */
4341 static int
4342 sysctl_jail_default_allow(SYSCTL_HANDLER_ARGS)
4343 {
4344 	int error, i;
4345 
4346 	/* Get the current flag value, and convert it to a boolean. */
4347 	if (req->td->td_ucred->cr_prison == &prison0) {
4348 		mtx_lock(&prison0.pr_mtx);
4349 		i = (jail_default_allow & arg2) != 0;
4350 		mtx_unlock(&prison0.pr_mtx);
4351 	} else
4352 		i = prison_allow(req->td->td_ucred, arg2);
4353 
4354 	if (arg1 != NULL)
4355 		i = !i;
4356 	error = sysctl_handle_int(oidp, &i, 0, req);
4357 	if (error || !req->newptr)
4358 		return (error);
4359 	i = i ? arg2 : 0;
4360 	if (arg1 != NULL)
4361 		i ^= arg2;
4362 	/*
4363 	 * The sysctls don't have CTLFLAGS_PRISON, so assume prison0
4364 	 * for writing.
4365 	 */
4366 	mtx_lock(&prison0.pr_mtx);
4367 	jail_default_allow = (jail_default_allow & ~arg2) | i;
4368 	mtx_unlock(&prison0.pr_mtx);
4369 	return (0);
4370 }
4371 
4372 SYSCTL_PROC(_security_jail, OID_AUTO, set_hostname_allowed,
4373     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4374     NULL, PR_ALLOW_SET_HOSTNAME, sysctl_jail_default_allow, "I",
4375     "Processes in jail can set their hostnames (deprecated)");
4376 SYSCTL_PROC(_security_jail, OID_AUTO, socket_unixiproute_only,
4377     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4378     (void *)1, PR_ALLOW_SOCKET_AF, sysctl_jail_default_allow, "I",
4379     "Processes in jail are limited to creating UNIX/IP/route sockets only (deprecated)");
4380 SYSCTL_PROC(_security_jail, OID_AUTO, sysvipc_allowed,
4381     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4382     NULL, PR_ALLOW_SYSVIPC, sysctl_jail_default_allow, "I",
4383     "Processes in jail can use System V IPC primitives (deprecated)");
4384 SYSCTL_PROC(_security_jail, OID_AUTO, allow_raw_sockets,
4385     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4386     NULL, PR_ALLOW_RAW_SOCKETS, sysctl_jail_default_allow, "I",
4387     "Prison root can create raw sockets (deprecated)");
4388 SYSCTL_PROC(_security_jail, OID_AUTO, chflags_allowed,
4389     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4390     NULL, PR_ALLOW_CHFLAGS, sysctl_jail_default_allow, "I",
4391     "Processes in jail can alter system file flags (deprecated)");
4392 SYSCTL_PROC(_security_jail, OID_AUTO, mount_allowed,
4393     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4394     NULL, PR_ALLOW_MOUNT, sysctl_jail_default_allow, "I",
4395     "Processes in jail can mount/unmount jail-friendly file systems (deprecated)");
4396 
4397 static int
4398 sysctl_jail_default_level(SYSCTL_HANDLER_ARGS)
4399 {
4400 	struct prison *pr;
4401 	int level, error;
4402 
4403 	pr = req->td->td_ucred->cr_prison;
4404 	level = (pr == &prison0) ? *(int *)arg1 : *(int *)((char *)pr + arg2);
4405 	error = sysctl_handle_int(oidp, &level, 0, req);
4406 	if (error || !req->newptr)
4407 		return (error);
4408 	*(int *)arg1 = level;
4409 	return (0);
4410 }
4411 
4412 SYSCTL_PROC(_security_jail, OID_AUTO, enforce_statfs,
4413     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4414     &jail_default_enforce_statfs, offsetof(struct prison, pr_enforce_statfs),
4415     sysctl_jail_default_level, "I",
4416     "Processes in jail cannot see all mounted file systems (deprecated)");
4417 
4418 SYSCTL_PROC(_security_jail, OID_AUTO, devfs_ruleset,
4419     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE,
4420     &jail_default_devfs_rsnum, offsetof(struct prison, pr_devfs_rsnum),
4421     sysctl_jail_default_level, "I",
4422     "Ruleset for the devfs filesystem in jail (deprecated)");
4423 
4424 /*
4425  * Nodes to describe jail parameters.  Maximum length of string parameters
4426  * is returned in the string itself, and the other parameters exist merely
4427  * to make themselves and their types known.
4428  */
4429 SYSCTL_NODE(_security_jail, OID_AUTO, param, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
4430     "Jail parameters");
4431 
4432 int
4433 sysctl_jail_param(SYSCTL_HANDLER_ARGS)
4434 {
4435 	int i;
4436 	long l;
4437 	size_t s;
4438 	char numbuf[12];
4439 
4440 	switch (oidp->oid_kind & CTLTYPE)
4441 	{
4442 	case CTLTYPE_LONG:
4443 	case CTLTYPE_ULONG:
4444 		l = 0;
4445 #ifdef SCTL_MASK32
4446 		if (!(req->flags & SCTL_MASK32))
4447 #endif
4448 			return (SYSCTL_OUT(req, &l, sizeof(l)));
4449 	case CTLTYPE_INT:
4450 	case CTLTYPE_UINT:
4451 		i = 0;
4452 		return (SYSCTL_OUT(req, &i, sizeof(i)));
4453 	case CTLTYPE_STRING:
4454 		snprintf(numbuf, sizeof(numbuf), "%jd", (intmax_t)arg2);
4455 		return
4456 		    (sysctl_handle_string(oidp, numbuf, sizeof(numbuf), req));
4457 	case CTLTYPE_STRUCT:
4458 		s = (size_t)arg2;
4459 		return (SYSCTL_OUT(req, &s, sizeof(s)));
4460 	}
4461 	return (0);
4462 }
4463 
4464 /*
4465  * CTLFLAG_RDTUN in the following indicates jail parameters that can be set at
4466  * jail creation time but cannot be changed in an existing jail.
4467  */
4468 SYSCTL_JAIL_PARAM(, jid, CTLTYPE_INT | CTLFLAG_RDTUN, "I", "Jail ID");
4469 SYSCTL_JAIL_PARAM(, parent, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail parent ID");
4470 SYSCTL_JAIL_PARAM_STRING(, name, CTLFLAG_RW, MAXHOSTNAMELEN, "Jail name");
4471 SYSCTL_JAIL_PARAM_STRING(, path, CTLFLAG_RDTUN, MAXPATHLEN, "Jail root path");
4472 SYSCTL_JAIL_PARAM(, securelevel, CTLTYPE_INT | CTLFLAG_RW,
4473     "I", "Jail secure level");
4474 SYSCTL_JAIL_PARAM(, osreldate, CTLTYPE_INT | CTLFLAG_RDTUN, "I",
4475     "Jail value for kern.osreldate and uname -K");
4476 SYSCTL_JAIL_PARAM_STRING(, osrelease, CTLFLAG_RDTUN, OSRELEASELEN,
4477     "Jail value for kern.osrelease and uname -r");
4478 SYSCTL_JAIL_PARAM(, enforce_statfs, CTLTYPE_INT | CTLFLAG_RW,
4479     "I", "Jail cannot see all mounted file systems");
4480 SYSCTL_JAIL_PARAM(, devfs_ruleset, CTLTYPE_INT | CTLFLAG_RW,
4481     "I", "Ruleset for in-jail devfs mounts");
4482 SYSCTL_JAIL_PARAM(, persist, CTLTYPE_INT | CTLFLAG_RW,
4483     "B", "Jail persistence");
4484 #ifdef VIMAGE
4485 SYSCTL_JAIL_PARAM(, vnet, CTLTYPE_INT | CTLFLAG_RDTUN,
4486     "E,jailsys", "Virtual network stack");
4487 #endif
4488 SYSCTL_JAIL_PARAM(, dying, CTLTYPE_INT | CTLFLAG_RD,
4489     "B", "Jail is in the process of shutting down");
4490 
4491 SYSCTL_JAIL_PARAM_NODE(children, "Number of child jails");
4492 SYSCTL_JAIL_PARAM(_children, cur, CTLTYPE_INT | CTLFLAG_RD,
4493     "I", "Current number of child jails");
4494 SYSCTL_JAIL_PARAM(_children, max, CTLTYPE_INT | CTLFLAG_RW,
4495     "I", "Maximum number of child jails");
4496 
4497 SYSCTL_JAIL_PARAM_SYS_NODE(host, CTLFLAG_RW, "Jail host info");
4498 SYSCTL_JAIL_PARAM_STRING(_host, hostname, CTLFLAG_RW, MAXHOSTNAMELEN,
4499     "Jail hostname");
4500 SYSCTL_JAIL_PARAM_STRING(_host, domainname, CTLFLAG_RW, MAXHOSTNAMELEN,
4501     "Jail NIS domainname");
4502 SYSCTL_JAIL_PARAM_STRING(_host, hostuuid, CTLFLAG_RW, HOSTUUIDLEN,
4503     "Jail host UUID");
4504 SYSCTL_JAIL_PARAM(_host, hostid, CTLTYPE_ULONG | CTLFLAG_RW,
4505     "LU", "Jail host ID");
4506 
4507 SYSCTL_JAIL_PARAM_NODE(cpuset, "Jail cpuset");
4508 SYSCTL_JAIL_PARAM(_cpuset, id, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail cpuset ID");
4509 
4510 #ifdef INET
4511 SYSCTL_JAIL_PARAM_SYS_NODE(ip4, CTLFLAG_RDTUN,
4512     "Jail IPv4 address virtualization");
4513 SYSCTL_JAIL_PARAM_STRUCT(_ip4, addr, CTLFLAG_RW, sizeof(struct in_addr),
4514     "S,in_addr,a", "Jail IPv4 addresses");
4515 SYSCTL_JAIL_PARAM(_ip4, saddrsel, CTLTYPE_INT | CTLFLAG_RW,
4516     "B", "Do (not) use IPv4 source address selection rather than the "
4517     "primary jail IPv4 address.");
4518 #endif
4519 #ifdef INET6
4520 SYSCTL_JAIL_PARAM_SYS_NODE(ip6, CTLFLAG_RDTUN,
4521     "Jail IPv6 address virtualization");
4522 SYSCTL_JAIL_PARAM_STRUCT(_ip6, addr, CTLFLAG_RW, sizeof(struct in6_addr),
4523     "S,in6_addr,a", "Jail IPv6 addresses");
4524 SYSCTL_JAIL_PARAM(_ip6, saddrsel, CTLTYPE_INT | CTLFLAG_RW,
4525     "B", "Do (not) use IPv6 source address selection rather than the "
4526     "primary jail IPv6 address.");
4527 #endif
4528 
4529 SYSCTL_JAIL_PARAM_NODE(allow, "Jail permission flags");
4530 SYSCTL_JAIL_PARAM(_allow, set_hostname, CTLTYPE_INT | CTLFLAG_RW,
4531     "B", "Jail may set hostname");
4532 SYSCTL_JAIL_PARAM(_allow, sysvipc, CTLTYPE_INT | CTLFLAG_RW,
4533     "B", "Jail may use SYSV IPC");
4534 SYSCTL_JAIL_PARAM(_allow, raw_sockets, CTLTYPE_INT | CTLFLAG_RW,
4535     "B", "Jail may create raw sockets");
4536 SYSCTL_JAIL_PARAM(_allow, chflags, CTLTYPE_INT | CTLFLAG_RW,
4537     "B", "Jail may alter system file flags");
4538 SYSCTL_JAIL_PARAM(_allow, quotas, CTLTYPE_INT | CTLFLAG_RW,
4539     "B", "Jail may set file quotas");
4540 SYSCTL_JAIL_PARAM(_allow, socket_af, CTLTYPE_INT | CTLFLAG_RW,
4541     "B", "Jail may create sockets other than just UNIX/IPv4/IPv6/route");
4542 SYSCTL_JAIL_PARAM(_allow, mlock, CTLTYPE_INT | CTLFLAG_RW,
4543     "B", "Jail may lock (unlock) physical pages in memory");
4544 SYSCTL_JAIL_PARAM(_allow, reserved_ports, CTLTYPE_INT | CTLFLAG_RW,
4545     "B", "Jail may bind sockets to reserved ports");
4546 SYSCTL_JAIL_PARAM(_allow, read_msgbuf, CTLTYPE_INT | CTLFLAG_RW,
4547     "B", "Jail may read the kernel message buffer");
4548 SYSCTL_JAIL_PARAM(_allow, unprivileged_proc_debug, CTLTYPE_INT | CTLFLAG_RW,
4549     "B", "Unprivileged processes may use process debugging facilities");
4550 SYSCTL_JAIL_PARAM(_allow, suser, CTLTYPE_INT | CTLFLAG_RW,
4551     "B", "Processes in jail with uid 0 have privilege");
4552 #ifdef VIMAGE
4553 SYSCTL_JAIL_PARAM(_allow, nfsd, CTLTYPE_INT | CTLFLAG_RW,
4554     "B", "Mountd/nfsd may run in the jail");
4555 #endif
4556 
4557 SYSCTL_JAIL_PARAM_SUBNODE(allow, mount, "Jail mount/unmount permission flags");
4558 SYSCTL_JAIL_PARAM(_allow_mount, , CTLTYPE_INT | CTLFLAG_RW,
4559     "B", "Jail may mount/unmount jail-friendly file systems in general");
4560 
4561 /*
4562  * Add a dynamic parameter allow.<name>, or allow.<prefix>.<name>.  Return
4563  * its associated bit in the pr_allow bitmask, or zero if the parameter was
4564  * not created.
4565  */
4566 unsigned
4567 prison_add_allow(const char *prefix, const char *name, const char *prefix_descr,
4568     const char *descr)
4569 {
4570 	struct bool_flags *bf;
4571 	struct sysctl_oid *parent;
4572 	char *allow_name, *allow_noname, *allowed;
4573 #ifndef NO_SYSCTL_DESCR
4574 	char *descr_deprecated;
4575 #endif
4576 	u_int allow_flag;
4577 
4578 	if (prefix
4579 	    ? asprintf(&allow_name, M_PRISON, "allow.%s.%s", prefix, name)
4580 		< 0 ||
4581 	      asprintf(&allow_noname, M_PRISON, "allow.%s.no%s", prefix, name)
4582 		< 0
4583 	    : asprintf(&allow_name, M_PRISON, "allow.%s", name) < 0 ||
4584 	      asprintf(&allow_noname, M_PRISON, "allow.no%s", name) < 0) {
4585 		free(allow_name, M_PRISON);
4586 		return 0;
4587 	}
4588 
4589 	/*
4590 	 * See if this parameter has already beed added, i.e. a module was
4591 	 * previously loaded/unloaded.
4592 	 */
4593 	mtx_lock(&prison0.pr_mtx);
4594 	for (bf = pr_flag_allow;
4595 	     bf < pr_flag_allow + nitems(pr_flag_allow) &&
4596 		atomic_load_int(&bf->flag) != 0;
4597 	     bf++) {
4598 		if (strcmp(bf->name, allow_name) == 0) {
4599 			allow_flag = bf->flag;
4600 			goto no_add;
4601 		}
4602 	}
4603 
4604 	/*
4605 	 * Find a free bit in pr_allow_all, failing if there are none
4606 	 * (which shouldn't happen as long as we keep track of how many
4607 	 * potential dynamic flags exist).
4608 	 */
4609 	for (allow_flag = 1;; allow_flag <<= 1) {
4610 		if (allow_flag == 0)
4611 			goto no_add;
4612 		if ((pr_allow_all & allow_flag) == 0)
4613 			break;
4614 	}
4615 
4616 	/* Note the parameter in the next open slot in pr_flag_allow. */
4617 	for (bf = pr_flag_allow; ; bf++) {
4618 		if (bf == pr_flag_allow + nitems(pr_flag_allow)) {
4619 			/* This should never happen, but is not fatal. */
4620 			allow_flag = 0;
4621 			goto no_add;
4622 		}
4623 		if (atomic_load_int(&bf->flag) == 0)
4624 			break;
4625 	}
4626 	bf->name = allow_name;
4627 	bf->noname = allow_noname;
4628 	pr_allow_all |= allow_flag;
4629 	/*
4630 	 * prison0 always has permission for the new parameter.
4631 	 * Other jails must have it granted to them.
4632 	 */
4633 	prison0.pr_allow |= allow_flag;
4634 	/* The flag indicates a valid entry, so make sure it is set last. */
4635 	atomic_store_rel_int(&bf->flag, allow_flag);
4636 	mtx_unlock(&prison0.pr_mtx);
4637 
4638 	/*
4639 	 * Create sysctls for the parameter, and the back-compat global
4640 	 * permission.
4641 	 */
4642 	parent = prefix
4643 	    ? SYSCTL_ADD_NODE(NULL,
4644 		  SYSCTL_CHILDREN(&sysctl___security_jail_param_allow),
4645 		  OID_AUTO, prefix, CTLFLAG_MPSAFE, 0, prefix_descr)
4646 	    : &sysctl___security_jail_param_allow;
4647 	(void)SYSCTL_ADD_PROC(NULL, SYSCTL_CHILDREN(parent), OID_AUTO,
4648 	    name, CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4649 	    NULL, 0, sysctl_jail_param, "B", descr);
4650 	if ((prefix
4651 	     ? asprintf(&allowed, M_TEMP, "%s_%s_allowed", prefix, name)
4652 	     : asprintf(&allowed, M_TEMP, "%s_allowed", name)) >= 0) {
4653 #ifndef NO_SYSCTL_DESCR
4654 		(void)asprintf(&descr_deprecated, M_TEMP, "%s (deprecated)",
4655 		    descr);
4656 #endif
4657 		(void)SYSCTL_ADD_PROC(NULL,
4658 		    SYSCTL_CHILDREN(&sysctl___security_jail), OID_AUTO, allowed,
4659 		    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, allow_flag,
4660 		    sysctl_jail_default_allow, "I", descr_deprecated);
4661 #ifndef NO_SYSCTL_DESCR
4662 		free(descr_deprecated, M_TEMP);
4663 #endif
4664 		free(allowed, M_TEMP);
4665 	}
4666 	return allow_flag;
4667 
4668  no_add:
4669 	mtx_unlock(&prison0.pr_mtx);
4670 	free(allow_name, M_PRISON);
4671 	free(allow_noname, M_PRISON);
4672 	return allow_flag;
4673 }
4674 
4675 /*
4676  * The VFS system will register jail-aware filesystems here.  They each get
4677  * a parameter allow.mount.xxxfs and a flag to check when a jailed user
4678  * attempts to mount.
4679  */
4680 void
4681 prison_add_vfs(struct vfsconf *vfsp)
4682 {
4683 #ifdef NO_SYSCTL_DESCR
4684 
4685 	vfsp->vfc_prison_flag = prison_add_allow("mount", vfsp->vfc_name,
4686 	    NULL, NULL);
4687 #else
4688 	char *descr;
4689 
4690 	(void)asprintf(&descr, M_TEMP, "Jail may mount the %s file system",
4691 	    vfsp->vfc_name);
4692 	vfsp->vfc_prison_flag = prison_add_allow("mount", vfsp->vfc_name,
4693 	    NULL, descr);
4694 	free(descr, M_TEMP);
4695 #endif
4696 }
4697 
4698 #ifdef RACCT
4699 void
4700 prison_racct_foreach(void (*callback)(struct racct *racct,
4701     void *arg2, void *arg3), void (*pre)(void), void (*post)(void),
4702     void *arg2, void *arg3)
4703 {
4704 	struct prison_racct *prr;
4705 
4706 	ASSERT_RACCT_ENABLED();
4707 
4708 	sx_slock(&allprison_lock);
4709 	if (pre != NULL)
4710 		(pre)();
4711 	LIST_FOREACH(prr, &allprison_racct, prr_next)
4712 		(callback)(prr->prr_racct, arg2, arg3);
4713 	if (post != NULL)
4714 		(post)();
4715 	sx_sunlock(&allprison_lock);
4716 }
4717 
4718 static struct prison_racct *
4719 prison_racct_find_locked(const char *name)
4720 {
4721 	struct prison_racct *prr;
4722 
4723 	ASSERT_RACCT_ENABLED();
4724 	sx_assert(&allprison_lock, SA_XLOCKED);
4725 
4726 	if (name[0] == '\0' || strlen(name) >= MAXHOSTNAMELEN)
4727 		return (NULL);
4728 
4729 	LIST_FOREACH(prr, &allprison_racct, prr_next) {
4730 		if (strcmp(name, prr->prr_name) != 0)
4731 			continue;
4732 
4733 		/* Found prison_racct with a matching name? */
4734 		prison_racct_hold(prr);
4735 		return (prr);
4736 	}
4737 
4738 	/* Add new prison_racct. */
4739 	prr = malloc(sizeof(*prr), M_PRISON_RACCT, M_ZERO | M_WAITOK);
4740 	racct_create(&prr->prr_racct);
4741 
4742 	strcpy(prr->prr_name, name);
4743 	refcount_init(&prr->prr_refcount, 1);
4744 	LIST_INSERT_HEAD(&allprison_racct, prr, prr_next);
4745 
4746 	return (prr);
4747 }
4748 
4749 struct prison_racct *
4750 prison_racct_find(const char *name)
4751 {
4752 	struct prison_racct *prr;
4753 
4754 	ASSERT_RACCT_ENABLED();
4755 
4756 	sx_xlock(&allprison_lock);
4757 	prr = prison_racct_find_locked(name);
4758 	sx_xunlock(&allprison_lock);
4759 	return (prr);
4760 }
4761 
4762 void
4763 prison_racct_hold(struct prison_racct *prr)
4764 {
4765 
4766 	ASSERT_RACCT_ENABLED();
4767 
4768 	refcount_acquire(&prr->prr_refcount);
4769 }
4770 
4771 static void
4772 prison_racct_free_locked(struct prison_racct *prr)
4773 {
4774 
4775 	ASSERT_RACCT_ENABLED();
4776 	sx_assert(&allprison_lock, SA_XLOCKED);
4777 
4778 	if (refcount_release(&prr->prr_refcount)) {
4779 		racct_destroy(&prr->prr_racct);
4780 		LIST_REMOVE(prr, prr_next);
4781 		free(prr, M_PRISON_RACCT);
4782 	}
4783 }
4784 
4785 void
4786 prison_racct_free(struct prison_racct *prr)
4787 {
4788 
4789 	ASSERT_RACCT_ENABLED();
4790 	sx_assert(&allprison_lock, SA_UNLOCKED);
4791 
4792 	if (refcount_release_if_not_last(&prr->prr_refcount))
4793 		return;
4794 
4795 	sx_xlock(&allprison_lock);
4796 	prison_racct_free_locked(prr);
4797 	sx_xunlock(&allprison_lock);
4798 }
4799 
4800 static void
4801 prison_racct_attach(struct prison *pr)
4802 {
4803 	struct prison_racct *prr;
4804 
4805 	ASSERT_RACCT_ENABLED();
4806 	sx_assert(&allprison_lock, SA_XLOCKED);
4807 
4808 	prr = prison_racct_find_locked(pr->pr_name);
4809 	KASSERT(prr != NULL, ("cannot find prison_racct"));
4810 
4811 	pr->pr_prison_racct = prr;
4812 }
4813 
4814 /*
4815  * Handle jail renaming.  From the racct point of view, renaming means
4816  * moving from one prison_racct to another.
4817  */
4818 static void
4819 prison_racct_modify(struct prison *pr)
4820 {
4821 #ifdef RCTL
4822 	struct proc *p;
4823 	struct ucred *cred;
4824 #endif
4825 	struct prison_racct *oldprr;
4826 
4827 	ASSERT_RACCT_ENABLED();
4828 
4829 	sx_slock(&allproc_lock);
4830 	sx_xlock(&allprison_lock);
4831 
4832 	if (strcmp(pr->pr_name, pr->pr_prison_racct->prr_name) == 0) {
4833 		sx_xunlock(&allprison_lock);
4834 		sx_sunlock(&allproc_lock);
4835 		return;
4836 	}
4837 
4838 	oldprr = pr->pr_prison_racct;
4839 	pr->pr_prison_racct = NULL;
4840 
4841 	prison_racct_attach(pr);
4842 
4843 	/*
4844 	 * Move resource utilisation records.
4845 	 */
4846 	racct_move(pr->pr_prison_racct->prr_racct, oldprr->prr_racct);
4847 
4848 #ifdef RCTL
4849 	/*
4850 	 * Force rctl to reattach rules to processes.
4851 	 */
4852 	FOREACH_PROC_IN_SYSTEM(p) {
4853 		PROC_LOCK(p);
4854 		cred = crhold(p->p_ucred);
4855 		PROC_UNLOCK(p);
4856 		rctl_proc_ucred_changed(p, cred);
4857 		crfree(cred);
4858 	}
4859 #endif
4860 
4861 	sx_sunlock(&allproc_lock);
4862 	prison_racct_free_locked(oldprr);
4863 	sx_xunlock(&allprison_lock);
4864 }
4865 
4866 static void
4867 prison_racct_detach(struct prison *pr)
4868 {
4869 
4870 	ASSERT_RACCT_ENABLED();
4871 	sx_assert(&allprison_lock, SA_UNLOCKED);
4872 
4873 	if (pr->pr_prison_racct == NULL)
4874 		return;
4875 	prison_racct_free(pr->pr_prison_racct);
4876 	pr->pr_prison_racct = NULL;
4877 }
4878 #endif /* RACCT */
4879 
4880 #ifdef DDB
4881 
4882 static void
4883 db_show_prison(struct prison *pr)
4884 {
4885 	struct bool_flags *bf;
4886 	struct jailsys_flags *jsf;
4887 #if defined(INET) || defined(INET6)
4888 	int ii;
4889 	struct prison_ip *pip;
4890 #endif
4891 	unsigned f;
4892 #ifdef INET
4893 	char ip4buf[INET_ADDRSTRLEN];
4894 #endif
4895 #ifdef INET6
4896 	char ip6buf[INET6_ADDRSTRLEN];
4897 #endif
4898 
4899 	db_printf("prison %p:\n", pr);
4900 	db_printf(" jid             = %d\n", pr->pr_id);
4901 	db_printf(" name            = %s\n", pr->pr_name);
4902 	db_printf(" parent          = %p\n", pr->pr_parent);
4903 	db_printf(" ref             = %d\n", pr->pr_ref);
4904 	db_printf(" uref            = %d\n", pr->pr_uref);
4905 	db_printf(" state           = %s\n",
4906 	    pr->pr_state == PRISON_STATE_ALIVE ? "alive" :
4907 	    pr->pr_state == PRISON_STATE_DYING ? "dying" :
4908 	    "invalid");
4909 	db_printf(" path            = %s\n", pr->pr_path);
4910 	db_printf(" cpuset          = %d\n", pr->pr_cpuset
4911 	    ? pr->pr_cpuset->cs_id : -1);
4912 #ifdef VIMAGE
4913 	db_printf(" vnet            = %p\n", pr->pr_vnet);
4914 #endif
4915 	db_printf(" root            = %p\n", pr->pr_root);
4916 	db_printf(" securelevel     = %d\n", pr->pr_securelevel);
4917 	db_printf(" devfs_rsnum     = %d\n", pr->pr_devfs_rsnum);
4918 	db_printf(" children.max    = %d\n", pr->pr_childmax);
4919 	db_printf(" children.cur    = %d\n", pr->pr_childcount);
4920 	db_printf(" child           = %p\n", LIST_FIRST(&pr->pr_children));
4921 	db_printf(" sibling         = %p\n", LIST_NEXT(pr, pr_sibling));
4922 	db_printf(" flags           = 0x%x", pr->pr_flags);
4923 	for (bf = pr_flag_bool; bf < pr_flag_bool + nitems(pr_flag_bool); bf++)
4924 		if (pr->pr_flags & bf->flag)
4925 			db_printf(" %s", bf->name);
4926 	for (jsf = pr_flag_jailsys;
4927 	     jsf < pr_flag_jailsys + nitems(pr_flag_jailsys);
4928 	     jsf++) {
4929 		f = pr->pr_flags & (jsf->disable | jsf->new);
4930 		db_printf(" %-16s= %s\n", jsf->name,
4931 		    (f != 0 && f == jsf->disable) ? "disable"
4932 		    : (f == jsf->new) ? "new"
4933 		    : "inherit");
4934 	}
4935 	db_printf(" allow           = 0x%x", pr->pr_allow);
4936 	for (bf = pr_flag_allow;
4937 	     bf < pr_flag_allow + nitems(pr_flag_allow) &&
4938 		atomic_load_int(&bf->flag) != 0;
4939 	     bf++)
4940 		if (pr->pr_allow & bf->flag)
4941 			db_printf(" %s", bf->name);
4942 	db_printf("\n");
4943 	db_printf(" enforce_statfs  = %d\n", pr->pr_enforce_statfs);
4944 	db_printf(" host.hostname   = %s\n", pr->pr_hostname);
4945 	db_printf(" host.domainname = %s\n", pr->pr_domainname);
4946 	db_printf(" host.hostuuid   = %s\n", pr->pr_hostuuid);
4947 	db_printf(" host.hostid     = %lu\n", pr->pr_hostid);
4948 #ifdef INET
4949 	if ((pip = pr->pr_addrs[PR_INET]) != NULL) {
4950 		db_printf(" ip4s            = %d\n", pip->ips);
4951 		for (ii = 0; ii < pip->ips; ii++)
4952 			db_printf(" %s %s\n",
4953 			    ii == 0 ? "ip4.addr        =" : "                 ",
4954 			    inet_ntoa_r(
4955 			    *(const struct in_addr *)PR_IP(pip, PR_INET, ii),
4956 			    ip4buf));
4957 	}
4958 #endif
4959 #ifdef INET6
4960 	if ((pip = pr->pr_addrs[PR_INET6]) != NULL) {
4961 		db_printf(" ip6s            = %d\n", pip->ips);
4962 		for (ii = 0; ii < pip->ips; ii++)
4963 			db_printf(" %s %s\n",
4964 			    ii == 0 ? "ip6.addr        =" : "                 ",
4965 			    ip6_sprintf(ip6buf,
4966 			    (const struct in6_addr *)PR_IP(pip, PR_INET6, ii)));
4967 	}
4968 #endif
4969 }
4970 
4971 DB_SHOW_COMMAND(prison, db_show_prison_command)
4972 {
4973 	struct prison *pr;
4974 
4975 	if (!have_addr) {
4976 		/*
4977 		 * Show all prisons in the list, and prison0 which is not
4978 		 * listed.
4979 		 */
4980 		db_show_prison(&prison0);
4981 		if (!db_pager_quit) {
4982 			TAILQ_FOREACH(pr, &allprison, pr_list) {
4983 				db_show_prison(pr);
4984 				if (db_pager_quit)
4985 					break;
4986 			}
4987 		}
4988 		return;
4989 	}
4990 
4991 	if (addr == 0)
4992 		pr = &prison0;
4993 	else {
4994 		/* Look for a prison with the ID and with references. */
4995 		TAILQ_FOREACH(pr, &allprison, pr_list)
4996 			if (pr->pr_id == addr && pr->pr_ref > 0)
4997 				break;
4998 		if (pr == NULL)
4999 			/* Look again, without requiring a reference. */
5000 			TAILQ_FOREACH(pr, &allprison, pr_list)
5001 				if (pr->pr_id == addr)
5002 					break;
5003 		if (pr == NULL)
5004 			/* Assume address points to a valid prison. */
5005 			pr = (struct prison *)addr;
5006 	}
5007 	db_show_prison(pr);
5008 }
5009 
5010 #endif /* DDB */
5011