xref: /freebsd/sys/kern/kern_jail.c (revision 9ecd54f24fe9fa373e07c9fd7c052deb2188f545)
1 /*-
2  * Copyright (c) 1999 Poul-Henning Kamp.
3  * Copyright (c) 2008 Bjoern A. Zeeb.
4  * Copyright (c) 2009 James Gritton.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  */
28 
29 #include <sys/cdefs.h>
30 __FBSDID("$FreeBSD$");
31 
32 #include "opt_compat.h"
33 #include "opt_ddb.h"
34 #include "opt_inet.h"
35 #include "opt_inet6.h"
36 
37 #include <sys/param.h>
38 #include <sys/types.h>
39 #include <sys/kernel.h>
40 #include <sys/systm.h>
41 #include <sys/errno.h>
42 #include <sys/sysproto.h>
43 #include <sys/malloc.h>
44 #include <sys/osd.h>
45 #include <sys/priv.h>
46 #include <sys/proc.h>
47 #include <sys/taskqueue.h>
48 #include <sys/fcntl.h>
49 #include <sys/jail.h>
50 #include <sys/lock.h>
51 #include <sys/mutex.h>
52 #include <sys/racct.h>
53 #include <sys/refcount.h>
54 #include <sys/sx.h>
55 #include <sys/sysent.h>
56 #include <sys/namei.h>
57 #include <sys/mount.h>
58 #include <sys/queue.h>
59 #include <sys/socket.h>
60 #include <sys/syscallsubr.h>
61 #include <sys/sysctl.h>
62 #include <sys/vnode.h>
63 
64 #include <net/if.h>
65 #include <net/if_var.h>
66 #include <net/vnet.h>
67 
68 #include <netinet/in.h>
69 
70 #ifdef DDB
71 #include <ddb/ddb.h>
72 #ifdef INET6
73 #include <netinet6/in6_var.h>
74 #endif /* INET6 */
75 #endif /* DDB */
76 
77 #include <security/mac/mac_framework.h>
78 
79 #define	DEFAULT_HOSTUUID	"00000000-0000-0000-0000-000000000000"
80 
81 MALLOC_DEFINE(M_PRISON, "prison", "Prison structures");
82 static MALLOC_DEFINE(M_PRISON_RACCT, "prison_racct", "Prison racct structures");
83 
84 /* Keep struct prison prison0 and some code in kern_jail_set() readable. */
85 #ifdef INET
86 #ifdef INET6
87 #define	_PR_IP_SADDRSEL	PR_IP4_SADDRSEL|PR_IP6_SADDRSEL
88 #else
89 #define	_PR_IP_SADDRSEL	PR_IP4_SADDRSEL
90 #endif
91 #else /* !INET */
92 #ifdef INET6
93 #define	_PR_IP_SADDRSEL	PR_IP6_SADDRSEL
94 #else
95 #define	_PR_IP_SADDRSEL	0
96 #endif
97 #endif
98 
99 /* prison0 describes what is "real" about the system. */
100 struct prison prison0 = {
101 	.pr_id		= 0,
102 	.pr_name	= "0",
103 	.pr_ref		= 1,
104 	.pr_uref	= 1,
105 	.pr_path	= "/",
106 	.pr_securelevel	= -1,
107 	.pr_devfs_rsnum = 0,
108 	.pr_childmax	= JAIL_MAX,
109 	.pr_hostuuid	= DEFAULT_HOSTUUID,
110 	.pr_children	= LIST_HEAD_INITIALIZER(prison0.pr_children),
111 #ifdef VIMAGE
112 	.pr_flags	= PR_HOST|PR_VNET|_PR_IP_SADDRSEL,
113 #else
114 	.pr_flags	= PR_HOST|_PR_IP_SADDRSEL,
115 #endif
116 	.pr_allow	= PR_ALLOW_ALL,
117 };
118 MTX_SYSINIT(prison0, &prison0.pr_mtx, "jail mutex", MTX_DEF);
119 
120 /* allprison, allprison_racct and lastprid are protected by allprison_lock. */
121 struct	sx allprison_lock;
122 SX_SYSINIT(allprison_lock, &allprison_lock, "allprison");
123 struct	prisonlist allprison = TAILQ_HEAD_INITIALIZER(allprison);
124 LIST_HEAD(, prison_racct) allprison_racct;
125 int	lastprid = 0;
126 
127 static int do_jail_attach(struct thread *td, struct prison *pr);
128 static void prison_complete(void *context, int pending);
129 static void prison_deref(struct prison *pr, int flags);
130 static char *prison_path(struct prison *pr1, struct prison *pr2);
131 static void prison_remove_one(struct prison *pr);
132 #ifdef RACCT
133 static void prison_racct_attach(struct prison *pr);
134 static void prison_racct_modify(struct prison *pr);
135 static void prison_racct_detach(struct prison *pr);
136 #endif
137 #ifdef INET
138 static int _prison_check_ip4(const struct prison *, const struct in_addr *);
139 static int prison_restrict_ip4(struct prison *pr, struct in_addr *newip4);
140 #endif
141 #ifdef INET6
142 static int _prison_check_ip6(struct prison *pr, struct in6_addr *ia6);
143 static int prison_restrict_ip6(struct prison *pr, struct in6_addr *newip6);
144 #endif
145 
146 /* Flags for prison_deref */
147 #define	PD_DEREF	0x01
148 #define	PD_DEUREF	0x02
149 #define	PD_LOCKED	0x04
150 #define	PD_LIST_SLOCKED	0x08
151 #define	PD_LIST_XLOCKED	0x10
152 
153 /*
154  * Parameter names corresponding to PR_* flag values.  Size values are for kvm
155  * as we cannot figure out the size of a sparse array, or an array without a
156  * terminating entry.
157  */
158 static char *pr_flag_names[] = {
159 	[0] = "persist",
160 #ifdef INET
161 	[7] = "ip4.saddrsel",
162 #endif
163 #ifdef INET6
164 	[8] = "ip6.saddrsel",
165 #endif
166 };
167 const size_t pr_flag_names_size = sizeof(pr_flag_names);
168 
169 static char *pr_flag_nonames[] = {
170 	[0] = "nopersist",
171 #ifdef INET
172 	[7] = "ip4.nosaddrsel",
173 #endif
174 #ifdef INET6
175 	[8] = "ip6.nosaddrsel",
176 #endif
177 };
178 const size_t pr_flag_nonames_size = sizeof(pr_flag_nonames);
179 
180 struct jailsys_flags {
181 	const char	*name;
182 	unsigned	 disable;
183 	unsigned	 new;
184 } pr_flag_jailsys[] = {
185 	{ "host", 0, PR_HOST },
186 #ifdef VIMAGE
187 	{ "vnet", 0, PR_VNET },
188 #endif
189 #ifdef INET
190 	{ "ip4", PR_IP4_USER | PR_IP4_DISABLE, PR_IP4_USER },
191 #endif
192 #ifdef INET6
193 	{ "ip6", PR_IP6_USER | PR_IP6_DISABLE, PR_IP6_USER },
194 #endif
195 };
196 const size_t pr_flag_jailsys_size = sizeof(pr_flag_jailsys);
197 
198 static char *pr_allow_names[] = {
199 	"allow.set_hostname",
200 	"allow.sysvipc",
201 	"allow.raw_sockets",
202 	"allow.chflags",
203 	"allow.mount",
204 	"allow.quotas",
205 	"allow.socket_af",
206 	"allow.mount.devfs",
207 	"allow.mount.nullfs",
208 	"allow.mount.zfs",
209 	"allow.mount.procfs",
210 	"allow.mount.tmpfs",
211 };
212 const size_t pr_allow_names_size = sizeof(pr_allow_names);
213 
214 static char *pr_allow_nonames[] = {
215 	"allow.noset_hostname",
216 	"allow.nosysvipc",
217 	"allow.noraw_sockets",
218 	"allow.nochflags",
219 	"allow.nomount",
220 	"allow.noquotas",
221 	"allow.nosocket_af",
222 	"allow.mount.nodevfs",
223 	"allow.mount.nonullfs",
224 	"allow.mount.nozfs",
225 	"allow.mount.noprocfs",
226 	"allow.mount.notmpfs",
227 };
228 const size_t pr_allow_nonames_size = sizeof(pr_allow_nonames);
229 
230 #define	JAIL_DEFAULT_ALLOW		PR_ALLOW_SET_HOSTNAME
231 #define	JAIL_DEFAULT_ENFORCE_STATFS	2
232 #define	JAIL_DEFAULT_DEVFS_RSNUM	0
233 static unsigned jail_default_allow = JAIL_DEFAULT_ALLOW;
234 static int jail_default_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS;
235 static int jail_default_devfs_rsnum = JAIL_DEFAULT_DEVFS_RSNUM;
236 #if defined(INET) || defined(INET6)
237 static unsigned jail_max_af_ips = 255;
238 #endif
239 
240 #ifdef INET
241 static int
242 qcmp_v4(const void *ip1, const void *ip2)
243 {
244 	in_addr_t iaa, iab;
245 
246 	/*
247 	 * We need to compare in HBO here to get the list sorted as expected
248 	 * by the result of the code.  Sorting NBO addresses gives you
249 	 * interesting results.  If you do not understand, do not try.
250 	 */
251 	iaa = ntohl(((const struct in_addr *)ip1)->s_addr);
252 	iab = ntohl(((const struct in_addr *)ip2)->s_addr);
253 
254 	/*
255 	 * Do not simply return the difference of the two numbers, the int is
256 	 * not wide enough.
257 	 */
258 	if (iaa > iab)
259 		return (1);
260 	else if (iaa < iab)
261 		return (-1);
262 	else
263 		return (0);
264 }
265 #endif
266 
267 #ifdef INET6
268 static int
269 qcmp_v6(const void *ip1, const void *ip2)
270 {
271 	const struct in6_addr *ia6a, *ia6b;
272 	int i, rc;
273 
274 	ia6a = (const struct in6_addr *)ip1;
275 	ia6b = (const struct in6_addr *)ip2;
276 
277 	rc = 0;
278 	for (i = 0; rc == 0 && i < sizeof(struct in6_addr); i++) {
279 		if (ia6a->s6_addr[i] > ia6b->s6_addr[i])
280 			rc = 1;
281 		else if (ia6a->s6_addr[i] < ia6b->s6_addr[i])
282 			rc = -1;
283 	}
284 	return (rc);
285 }
286 #endif
287 
288 /*
289  * struct jail_args {
290  *	struct jail *jail;
291  * };
292  */
293 int
294 sys_jail(struct thread *td, struct jail_args *uap)
295 {
296 	uint32_t version;
297 	int error;
298 	struct jail j;
299 
300 	error = copyin(uap->jail, &version, sizeof(uint32_t));
301 	if (error)
302 		return (error);
303 
304 	switch (version) {
305 	case 0:
306 	{
307 		struct jail_v0 j0;
308 
309 		/* FreeBSD single IPv4 jails. */
310 		bzero(&j, sizeof(struct jail));
311 		error = copyin(uap->jail, &j0, sizeof(struct jail_v0));
312 		if (error)
313 			return (error);
314 		j.version = j0.version;
315 		j.path = j0.path;
316 		j.hostname = j0.hostname;
317 		j.ip4s = htonl(j0.ip_number);	/* jail_v0 is host order */
318 		break;
319 	}
320 
321 	case 1:
322 		/*
323 		 * Version 1 was used by multi-IPv4 jail implementations
324 		 * that never made it into the official kernel.
325 		 */
326 		return (EINVAL);
327 
328 	case 2:	/* JAIL_API_VERSION */
329 		/* FreeBSD multi-IPv4/IPv6,noIP jails. */
330 		error = copyin(uap->jail, &j, sizeof(struct jail));
331 		if (error)
332 			return (error);
333 		break;
334 
335 	default:
336 		/* Sci-Fi jails are not supported, sorry. */
337 		return (EINVAL);
338 	}
339 	return (kern_jail(td, &j));
340 }
341 
342 int
343 kern_jail(struct thread *td, struct jail *j)
344 {
345 	struct iovec optiov[2 * (4
346 			    + sizeof(pr_allow_names) / sizeof(pr_allow_names[0])
347 #ifdef INET
348 			    + 1
349 #endif
350 #ifdef INET6
351 			    + 1
352 #endif
353 			    )];
354 	struct uio opt;
355 	char *u_path, *u_hostname, *u_name;
356 #ifdef INET
357 	uint32_t ip4s;
358 	struct in_addr *u_ip4;
359 #endif
360 #ifdef INET6
361 	struct in6_addr *u_ip6;
362 #endif
363 	size_t tmplen;
364 	int error, enforce_statfs, fi;
365 
366 	bzero(&optiov, sizeof(optiov));
367 	opt.uio_iov = optiov;
368 	opt.uio_iovcnt = 0;
369 	opt.uio_offset = -1;
370 	opt.uio_resid = -1;
371 	opt.uio_segflg = UIO_SYSSPACE;
372 	opt.uio_rw = UIO_READ;
373 	opt.uio_td = td;
374 
375 	/* Set permissions for top-level jails from sysctls. */
376 	if (!jailed(td->td_ucred)) {
377 		for (fi = 0; fi < sizeof(pr_allow_names) /
378 		     sizeof(pr_allow_names[0]); fi++) {
379 			optiov[opt.uio_iovcnt].iov_base =
380 			    (jail_default_allow & (1 << fi))
381 			    ? pr_allow_names[fi] : pr_allow_nonames[fi];
382 			optiov[opt.uio_iovcnt].iov_len =
383 			    strlen(optiov[opt.uio_iovcnt].iov_base) + 1;
384 			opt.uio_iovcnt += 2;
385 		}
386 		optiov[opt.uio_iovcnt].iov_base = "enforce_statfs";
387 		optiov[opt.uio_iovcnt].iov_len = sizeof("enforce_statfs");
388 		opt.uio_iovcnt++;
389 		enforce_statfs = jail_default_enforce_statfs;
390 		optiov[opt.uio_iovcnt].iov_base = &enforce_statfs;
391 		optiov[opt.uio_iovcnt].iov_len = sizeof(enforce_statfs);
392 		opt.uio_iovcnt++;
393 	}
394 
395 	tmplen = MAXPATHLEN + MAXHOSTNAMELEN + MAXHOSTNAMELEN;
396 #ifdef INET
397 	ip4s = (j->version == 0) ? 1 : j->ip4s;
398 	if (ip4s > jail_max_af_ips)
399 		return (EINVAL);
400 	tmplen += ip4s * sizeof(struct in_addr);
401 #else
402 	if (j->ip4s > 0)
403 		return (EINVAL);
404 #endif
405 #ifdef INET6
406 	if (j->ip6s > jail_max_af_ips)
407 		return (EINVAL);
408 	tmplen += j->ip6s * sizeof(struct in6_addr);
409 #else
410 	if (j->ip6s > 0)
411 		return (EINVAL);
412 #endif
413 	u_path = malloc(tmplen, M_TEMP, M_WAITOK);
414 	u_hostname = u_path + MAXPATHLEN;
415 	u_name = u_hostname + MAXHOSTNAMELEN;
416 #ifdef INET
417 	u_ip4 = (struct in_addr *)(u_name + MAXHOSTNAMELEN);
418 #endif
419 #ifdef INET6
420 #ifdef INET
421 	u_ip6 = (struct in6_addr *)(u_ip4 + ip4s);
422 #else
423 	u_ip6 = (struct in6_addr *)(u_name + MAXHOSTNAMELEN);
424 #endif
425 #endif
426 	optiov[opt.uio_iovcnt].iov_base = "path";
427 	optiov[opt.uio_iovcnt].iov_len = sizeof("path");
428 	opt.uio_iovcnt++;
429 	optiov[opt.uio_iovcnt].iov_base = u_path;
430 	error = copyinstr(j->path, u_path, MAXPATHLEN,
431 	    &optiov[opt.uio_iovcnt].iov_len);
432 	if (error) {
433 		free(u_path, M_TEMP);
434 		return (error);
435 	}
436 	opt.uio_iovcnt++;
437 	optiov[opt.uio_iovcnt].iov_base = "host.hostname";
438 	optiov[opt.uio_iovcnt].iov_len = sizeof("host.hostname");
439 	opt.uio_iovcnt++;
440 	optiov[opt.uio_iovcnt].iov_base = u_hostname;
441 	error = copyinstr(j->hostname, u_hostname, MAXHOSTNAMELEN,
442 	    &optiov[opt.uio_iovcnt].iov_len);
443 	if (error) {
444 		free(u_path, M_TEMP);
445 		return (error);
446 	}
447 	opt.uio_iovcnt++;
448 	if (j->jailname != NULL) {
449 		optiov[opt.uio_iovcnt].iov_base = "name";
450 		optiov[opt.uio_iovcnt].iov_len = sizeof("name");
451 		opt.uio_iovcnt++;
452 		optiov[opt.uio_iovcnt].iov_base = u_name;
453 		error = copyinstr(j->jailname, u_name, MAXHOSTNAMELEN,
454 		    &optiov[opt.uio_iovcnt].iov_len);
455 		if (error) {
456 			free(u_path, M_TEMP);
457 			return (error);
458 		}
459 		opt.uio_iovcnt++;
460 	}
461 #ifdef INET
462 	optiov[opt.uio_iovcnt].iov_base = "ip4.addr";
463 	optiov[opt.uio_iovcnt].iov_len = sizeof("ip4.addr");
464 	opt.uio_iovcnt++;
465 	optiov[opt.uio_iovcnt].iov_base = u_ip4;
466 	optiov[opt.uio_iovcnt].iov_len = ip4s * sizeof(struct in_addr);
467 	if (j->version == 0)
468 		u_ip4->s_addr = j->ip4s;
469 	else {
470 		error = copyin(j->ip4, u_ip4, optiov[opt.uio_iovcnt].iov_len);
471 		if (error) {
472 			free(u_path, M_TEMP);
473 			return (error);
474 		}
475 	}
476 	opt.uio_iovcnt++;
477 #endif
478 #ifdef INET6
479 	optiov[opt.uio_iovcnt].iov_base = "ip6.addr";
480 	optiov[opt.uio_iovcnt].iov_len = sizeof("ip6.addr");
481 	opt.uio_iovcnt++;
482 	optiov[opt.uio_iovcnt].iov_base = u_ip6;
483 	optiov[opt.uio_iovcnt].iov_len = j->ip6s * sizeof(struct in6_addr);
484 	error = copyin(j->ip6, u_ip6, optiov[opt.uio_iovcnt].iov_len);
485 	if (error) {
486 		free(u_path, M_TEMP);
487 		return (error);
488 	}
489 	opt.uio_iovcnt++;
490 #endif
491 	KASSERT(opt.uio_iovcnt <= sizeof(optiov) / sizeof(optiov[0]),
492 	    ("kern_jail: too many iovecs (%d)", opt.uio_iovcnt));
493 	error = kern_jail_set(td, &opt, JAIL_CREATE | JAIL_ATTACH);
494 	free(u_path, M_TEMP);
495 	return (error);
496 }
497 
498 
499 /*
500  * struct jail_set_args {
501  *	struct iovec *iovp;
502  *	unsigned int iovcnt;
503  *	int flags;
504  * };
505  */
506 int
507 sys_jail_set(struct thread *td, struct jail_set_args *uap)
508 {
509 	struct uio *auio;
510 	int error;
511 
512 	/* Check that we have an even number of iovecs. */
513 	if (uap->iovcnt & 1)
514 		return (EINVAL);
515 
516 	error = copyinuio(uap->iovp, uap->iovcnt, &auio);
517 	if (error)
518 		return (error);
519 	error = kern_jail_set(td, auio, uap->flags);
520 	free(auio, M_IOV);
521 	return (error);
522 }
523 
524 int
525 kern_jail_set(struct thread *td, struct uio *optuio, int flags)
526 {
527 	struct nameidata nd;
528 #ifdef INET
529 	struct in_addr *ip4;
530 #endif
531 #ifdef INET6
532 	struct in6_addr *ip6;
533 #endif
534 	struct vfsopt *opt;
535 	struct vfsoptlist *opts;
536 	struct prison *pr, *deadpr, *mypr, *ppr, *tpr;
537 	struct vnode *root;
538 	char *domain, *errmsg, *host, *name, *namelc, *p, *path, *uuid;
539 	char *g_path;
540 #if defined(INET) || defined(INET6)
541 	struct prison *tppr;
542 	void *op;
543 #endif
544 	unsigned long hid;
545 	size_t namelen, onamelen;
546 	int created, cuflags, descend, enforce, error, errmsg_len, errmsg_pos;
547 	int gotchildmax, gotenforce, gothid, gotrsnum, gotslevel;
548 	int fi, jid, jsys, len, level;
549 	int childmax, rsnum, slevel;
550 	int fullpath_disabled;
551 #if defined(INET) || defined(INET6)
552 	int ii, ij;
553 #endif
554 #ifdef INET
555 	int ip4s, redo_ip4;
556 #endif
557 #ifdef INET6
558 	int ip6s, redo_ip6;
559 #endif
560 	uint64_t pr_allow, ch_allow, pr_flags, ch_flags;
561 	unsigned tallow;
562 	char numbuf[12];
563 
564 	error = priv_check(td, PRIV_JAIL_SET);
565 	if (!error && (flags & JAIL_ATTACH))
566 		error = priv_check(td, PRIV_JAIL_ATTACH);
567 	if (error)
568 		return (error);
569 	mypr = ppr = td->td_ucred->cr_prison;
570 	if ((flags & JAIL_CREATE) && mypr->pr_childmax == 0)
571 		return (EPERM);
572 	if (flags & ~JAIL_SET_MASK)
573 		return (EINVAL);
574 
575 	/*
576 	 * Check all the parameters before committing to anything.  Not all
577 	 * errors can be caught early, but we may as well try.  Also, this
578 	 * takes care of some expensive stuff (path lookup) before getting
579 	 * the allprison lock.
580 	 *
581 	 * XXX Jails are not filesystems, and jail parameters are not mount
582 	 *     options.  But it makes more sense to re-use the vfsopt code
583 	 *     than duplicate it under a different name.
584 	 */
585 	error = vfs_buildopts(optuio, &opts);
586 	if (error)
587 		return (error);
588 #ifdef INET
589 	ip4 = NULL;
590 #endif
591 #ifdef INET6
592 	ip6 = NULL;
593 #endif
594 	g_path = NULL;
595 
596 	error = vfs_copyopt(opts, "jid", &jid, sizeof(jid));
597 	if (error == ENOENT)
598 		jid = 0;
599 	else if (error != 0)
600 		goto done_free;
601 
602 	error = vfs_copyopt(opts, "securelevel", &slevel, sizeof(slevel));
603 	if (error == ENOENT)
604 		gotslevel = 0;
605 	else if (error != 0)
606 		goto done_free;
607 	else
608 		gotslevel = 1;
609 
610 	error =
611 	    vfs_copyopt(opts, "children.max", &childmax, sizeof(childmax));
612 	if (error == ENOENT)
613 		gotchildmax = 0;
614 	else if (error != 0)
615 		goto done_free;
616 	else
617 		gotchildmax = 1;
618 
619 	error = vfs_copyopt(opts, "enforce_statfs", &enforce, sizeof(enforce));
620 	if (error == ENOENT)
621 		gotenforce = 0;
622 	else if (error != 0)
623 		goto done_free;
624 	else if (enforce < 0 || enforce > 2) {
625 		error = EINVAL;
626 		goto done_free;
627 	} else
628 		gotenforce = 1;
629 
630 	error = vfs_copyopt(opts, "devfs_ruleset", &rsnum, sizeof(rsnum));
631 	if (error == ENOENT)
632 		gotrsnum = 0;
633 	else if (error != 0)
634 		goto done_free;
635 	else
636 		gotrsnum = 1;
637 
638 	pr_flags = ch_flags = 0;
639 	for (fi = 0; fi < sizeof(pr_flag_names) / sizeof(pr_flag_names[0]);
640 	    fi++) {
641 		if (pr_flag_names[fi] == NULL)
642 			continue;
643 		vfs_flagopt(opts, pr_flag_names[fi], &pr_flags, 1 << fi);
644 		vfs_flagopt(opts, pr_flag_nonames[fi], &ch_flags, 1 << fi);
645 	}
646 	ch_flags |= pr_flags;
647 	for (fi = 0; fi < sizeof(pr_flag_jailsys) / sizeof(pr_flag_jailsys[0]);
648 	    fi++) {
649 		error = vfs_copyopt(opts, pr_flag_jailsys[fi].name, &jsys,
650 		    sizeof(jsys));
651 		if (error == ENOENT)
652 			continue;
653 		if (error != 0)
654 			goto done_free;
655 		switch (jsys) {
656 		case JAIL_SYS_DISABLE:
657 			if (!pr_flag_jailsys[fi].disable) {
658 				error = EINVAL;
659 				goto done_free;
660 			}
661 			pr_flags |= pr_flag_jailsys[fi].disable;
662 			break;
663 		case JAIL_SYS_NEW:
664 			pr_flags |= pr_flag_jailsys[fi].new;
665 			break;
666 		case JAIL_SYS_INHERIT:
667 			break;
668 		default:
669 			error = EINVAL;
670 			goto done_free;
671 		}
672 		ch_flags |=
673 		    pr_flag_jailsys[fi].new | pr_flag_jailsys[fi].disable;
674 	}
675 	if ((flags & (JAIL_CREATE | JAIL_UPDATE | JAIL_ATTACH)) == JAIL_CREATE
676 	    && !(pr_flags & PR_PERSIST)) {
677 		error = EINVAL;
678 		vfs_opterror(opts, "new jail must persist or attach");
679 		goto done_errmsg;
680 	}
681 #ifdef VIMAGE
682 	if ((flags & JAIL_UPDATE) && (ch_flags & PR_VNET)) {
683 		error = EINVAL;
684 		vfs_opterror(opts, "vnet cannot be changed after creation");
685 		goto done_errmsg;
686 	}
687 #endif
688 #ifdef INET
689 	if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP4_USER)) {
690 		error = EINVAL;
691 		vfs_opterror(opts, "ip4 cannot be changed after creation");
692 		goto done_errmsg;
693 	}
694 #endif
695 #ifdef INET6
696 	if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP6_USER)) {
697 		error = EINVAL;
698 		vfs_opterror(opts, "ip6 cannot be changed after creation");
699 		goto done_errmsg;
700 	}
701 #endif
702 
703 	pr_allow = ch_allow = 0;
704 	for (fi = 0; fi < sizeof(pr_allow_names) / sizeof(pr_allow_names[0]);
705 	    fi++) {
706 		vfs_flagopt(opts, pr_allow_names[fi], &pr_allow, 1 << fi);
707 		vfs_flagopt(opts, pr_allow_nonames[fi], &ch_allow, 1 << fi);
708 	}
709 	ch_allow |= pr_allow;
710 
711 	error = vfs_getopt(opts, "name", (void **)&name, &len);
712 	if (error == ENOENT)
713 		name = NULL;
714 	else if (error != 0)
715 		goto done_free;
716 	else {
717 		if (len == 0 || name[len - 1] != '\0') {
718 			error = EINVAL;
719 			goto done_free;
720 		}
721 		if (len > MAXHOSTNAMELEN) {
722 			error = ENAMETOOLONG;
723 			goto done_free;
724 		}
725 	}
726 
727 	error = vfs_getopt(opts, "host.hostname", (void **)&host, &len);
728 	if (error == ENOENT)
729 		host = NULL;
730 	else if (error != 0)
731 		goto done_free;
732 	else {
733 		ch_flags |= PR_HOST;
734 		pr_flags |= PR_HOST;
735 		if (len == 0 || host[len - 1] != '\0') {
736 			error = EINVAL;
737 			goto done_free;
738 		}
739 		if (len > MAXHOSTNAMELEN) {
740 			error = ENAMETOOLONG;
741 			goto done_free;
742 		}
743 	}
744 
745 	error = vfs_getopt(opts, "host.domainname", (void **)&domain, &len);
746 	if (error == ENOENT)
747 		domain = NULL;
748 	else if (error != 0)
749 		goto done_free;
750 	else {
751 		ch_flags |= PR_HOST;
752 		pr_flags |= PR_HOST;
753 		if (len == 0 || domain[len - 1] != '\0') {
754 			error = EINVAL;
755 			goto done_free;
756 		}
757 		if (len > MAXHOSTNAMELEN) {
758 			error = ENAMETOOLONG;
759 			goto done_free;
760 		}
761 	}
762 
763 	error = vfs_getopt(opts, "host.hostuuid", (void **)&uuid, &len);
764 	if (error == ENOENT)
765 		uuid = NULL;
766 	else if (error != 0)
767 		goto done_free;
768 	else {
769 		ch_flags |= PR_HOST;
770 		pr_flags |= PR_HOST;
771 		if (len == 0 || uuid[len - 1] != '\0') {
772 			error = EINVAL;
773 			goto done_free;
774 		}
775 		if (len > HOSTUUIDLEN) {
776 			error = ENAMETOOLONG;
777 			goto done_free;
778 		}
779 	}
780 
781 #ifdef COMPAT_FREEBSD32
782 	if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) {
783 		uint32_t hid32;
784 
785 		error = vfs_copyopt(opts, "host.hostid", &hid32, sizeof(hid32));
786 		hid = hid32;
787 	} else
788 #endif
789 		error = vfs_copyopt(opts, "host.hostid", &hid, sizeof(hid));
790 	if (error == ENOENT)
791 		gothid = 0;
792 	else if (error != 0)
793 		goto done_free;
794 	else {
795 		gothid = 1;
796 		ch_flags |= PR_HOST;
797 		pr_flags |= PR_HOST;
798 	}
799 
800 #ifdef INET
801 	error = vfs_getopt(opts, "ip4.addr", &op, &ip4s);
802 	if (error == ENOENT)
803 		ip4s = (pr_flags & PR_IP4_DISABLE) ? 0 : -1;
804 	else if (error != 0)
805 		goto done_free;
806 	else if (ip4s & (sizeof(*ip4) - 1)) {
807 		error = EINVAL;
808 		goto done_free;
809 	} else {
810 		ch_flags |= PR_IP4_USER | PR_IP4_DISABLE;
811 		if (ip4s == 0)
812 			pr_flags |= PR_IP4_USER | PR_IP4_DISABLE;
813 		else {
814 			pr_flags = (pr_flags & ~PR_IP4_DISABLE) | PR_IP4_USER;
815 			ip4s /= sizeof(*ip4);
816 			if (ip4s > jail_max_af_ips) {
817 				error = EINVAL;
818 				vfs_opterror(opts, "too many IPv4 addresses");
819 				goto done_errmsg;
820 			}
821 			ip4 = malloc(ip4s * sizeof(*ip4), M_PRISON, M_WAITOK);
822 			bcopy(op, ip4, ip4s * sizeof(*ip4));
823 			/*
824 			 * IP addresses are all sorted but ip[0] to preserve
825 			 * the primary IP address as given from userland.
826 			 * This special IP is used for unbound outgoing
827 			 * connections as well for "loopback" traffic in case
828 			 * source address selection cannot find any more fitting
829 			 * address to connect from.
830 			 */
831 			if (ip4s > 1)
832 				qsort(ip4 + 1, ip4s - 1, sizeof(*ip4), qcmp_v4);
833 			/*
834 			 * Check for duplicate addresses and do some simple
835 			 * zero and broadcast checks. If users give other bogus
836 			 * addresses it is their problem.
837 			 *
838 			 * We do not have to care about byte order for these
839 			 * checks so we will do them in NBO.
840 			 */
841 			for (ii = 0; ii < ip4s; ii++) {
842 				if (ip4[ii].s_addr == INADDR_ANY ||
843 				    ip4[ii].s_addr == INADDR_BROADCAST) {
844 					error = EINVAL;
845 					goto done_free;
846 				}
847 				if ((ii+1) < ip4s &&
848 				    (ip4[0].s_addr == ip4[ii+1].s_addr ||
849 				     ip4[ii].s_addr == ip4[ii+1].s_addr)) {
850 					error = EINVAL;
851 					goto done_free;
852 				}
853 			}
854 		}
855 	}
856 #endif
857 
858 #ifdef INET6
859 	error = vfs_getopt(opts, "ip6.addr", &op, &ip6s);
860 	if (error == ENOENT)
861 		ip6s = (pr_flags & PR_IP6_DISABLE) ? 0 : -1;
862 	else if (error != 0)
863 		goto done_free;
864 	else if (ip6s & (sizeof(*ip6) - 1)) {
865 		error = EINVAL;
866 		goto done_free;
867 	} else {
868 		ch_flags |= PR_IP6_USER | PR_IP6_DISABLE;
869 		if (ip6s == 0)
870 			pr_flags |= PR_IP6_USER | PR_IP6_DISABLE;
871 		else {
872 			pr_flags = (pr_flags & ~PR_IP6_DISABLE) | PR_IP6_USER;
873 			ip6s /= sizeof(*ip6);
874 			if (ip6s > jail_max_af_ips) {
875 				error = EINVAL;
876 				vfs_opterror(opts, "too many IPv6 addresses");
877 				goto done_errmsg;
878 			}
879 			ip6 = malloc(ip6s * sizeof(*ip6), M_PRISON, M_WAITOK);
880 			bcopy(op, ip6, ip6s * sizeof(*ip6));
881 			if (ip6s > 1)
882 				qsort(ip6 + 1, ip6s - 1, sizeof(*ip6), qcmp_v6);
883 			for (ii = 0; ii < ip6s; ii++) {
884 				if (IN6_IS_ADDR_UNSPECIFIED(&ip6[ii])) {
885 					error = EINVAL;
886 					goto done_free;
887 				}
888 				if ((ii+1) < ip6s &&
889 				    (IN6_ARE_ADDR_EQUAL(&ip6[0], &ip6[ii+1]) ||
890 				     IN6_ARE_ADDR_EQUAL(&ip6[ii], &ip6[ii+1])))
891 				{
892 					error = EINVAL;
893 					goto done_free;
894 				}
895 			}
896 		}
897 	}
898 #endif
899 
900 #if defined(VIMAGE) && (defined(INET) || defined(INET6))
901 	if ((ch_flags & PR_VNET) && (ch_flags & (PR_IP4_USER | PR_IP6_USER))) {
902 		error = EINVAL;
903 		vfs_opterror(opts,
904 		    "vnet jails cannot have IP address restrictions");
905 		goto done_errmsg;
906 	}
907 #endif
908 
909 	fullpath_disabled = 0;
910 	root = NULL;
911 	error = vfs_getopt(opts, "path", (void **)&path, &len);
912 	if (error == ENOENT)
913 		path = NULL;
914 	else if (error != 0)
915 		goto done_free;
916 	else {
917 		if (flags & JAIL_UPDATE) {
918 			error = EINVAL;
919 			vfs_opterror(opts,
920 			    "path cannot be changed after creation");
921 			goto done_errmsg;
922 		}
923 		if (len == 0 || path[len - 1] != '\0') {
924 			error = EINVAL;
925 			goto done_free;
926 		}
927 		NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE,
928 		    path, td);
929 		error = namei(&nd);
930 		if (error)
931 			goto done_free;
932 		root = nd.ni_vp;
933 		NDFREE(&nd, NDF_ONLY_PNBUF);
934 		g_path = malloc(MAXPATHLEN, M_TEMP, M_WAITOK);
935 		strlcpy(g_path, path, MAXPATHLEN);
936 		error = vn_path_to_global_path(td, root, g_path, MAXPATHLEN);
937 		if (error == 0)
938 			path = g_path;
939 		else if (error == ENODEV) {
940 			/* proceed if sysctl debug.disablefullpath == 1 */
941 			fullpath_disabled = 1;
942 			if (len < 2 || (len == 2 && path[0] == '/'))
943 				path = NULL;
944 		} else {
945 			/* exit on other errors */
946 			goto done_free;
947 		}
948 		if (root->v_type != VDIR) {
949 			error = ENOTDIR;
950 			vput(root);
951 			goto done_free;
952 		}
953 		VOP_UNLOCK(root, 0);
954 		if (fullpath_disabled) {
955 			/* Leave room for a real-root full pathname. */
956 			if (len + (path[0] == '/' && strcmp(mypr->pr_path, "/")
957 			    ? strlen(mypr->pr_path) : 0) > MAXPATHLEN) {
958 				error = ENAMETOOLONG;
959 				goto done_free;
960 			}
961 		}
962 	}
963 
964 	/*
965 	 * Grab the allprison lock before letting modules check their
966 	 * parameters.  Once we have it, do not let go so we'll have a
967 	 * consistent view of the OSD list.
968 	 */
969 	sx_xlock(&allprison_lock);
970 	error = osd_jail_call(NULL, PR_METHOD_CHECK, opts);
971 	if (error)
972 		goto done_unlock_list;
973 
974 	/* By now, all parameters should have been noted. */
975 	TAILQ_FOREACH(opt, opts, link) {
976 		if (!opt->seen && strcmp(opt->name, "errmsg")) {
977 			error = EINVAL;
978 			vfs_opterror(opts, "unknown parameter: %s", opt->name);
979 			goto done_unlock_list;
980 		}
981 	}
982 
983 	/*
984 	 * See if we are creating a new record or updating an existing one.
985 	 * This abuses the file error codes ENOENT and EEXIST.
986 	 */
987 	cuflags = flags & (JAIL_CREATE | JAIL_UPDATE);
988 	if (!cuflags) {
989 		error = EINVAL;
990 		vfs_opterror(opts, "no valid operation (create or update)");
991 		goto done_unlock_list;
992 	}
993 	pr = NULL;
994 	namelc = NULL;
995 	if (cuflags == JAIL_CREATE && jid == 0 && name != NULL) {
996 		namelc = strrchr(name, '.');
997 		jid = strtoul(namelc != NULL ? namelc + 1 : name, &p, 10);
998 		if (*p != '\0')
999 			jid = 0;
1000 	}
1001 	if (jid != 0) {
1002 		/*
1003 		 * See if a requested jid already exists.  There is an
1004 		 * information leak here if the jid exists but is not within
1005 		 * the caller's jail hierarchy.  Jail creators will get EEXIST
1006 		 * even though they cannot see the jail, and CREATE | UPDATE
1007 		 * will return ENOENT which is not normally a valid error.
1008 		 */
1009 		if (jid < 0) {
1010 			error = EINVAL;
1011 			vfs_opterror(opts, "negative jid");
1012 			goto done_unlock_list;
1013 		}
1014 		pr = prison_find(jid);
1015 		if (pr != NULL) {
1016 			ppr = pr->pr_parent;
1017 			/* Create: jid must not exist. */
1018 			if (cuflags == JAIL_CREATE) {
1019 				mtx_unlock(&pr->pr_mtx);
1020 				error = EEXIST;
1021 				vfs_opterror(opts, "jail %d already exists",
1022 				    jid);
1023 				goto done_unlock_list;
1024 			}
1025 			if (!prison_ischild(mypr, pr)) {
1026 				mtx_unlock(&pr->pr_mtx);
1027 				pr = NULL;
1028 			} else if (pr->pr_uref == 0) {
1029 				if (!(flags & JAIL_DYING)) {
1030 					mtx_unlock(&pr->pr_mtx);
1031 					error = ENOENT;
1032 					vfs_opterror(opts, "jail %d is dying",
1033 					    jid);
1034 					goto done_unlock_list;
1035 				} else if ((flags & JAIL_ATTACH) ||
1036 				    (pr_flags & PR_PERSIST)) {
1037 					/*
1038 					 * A dying jail might be resurrected
1039 					 * (via attach or persist), but first
1040 					 * it must determine if another jail
1041 					 * has claimed its name.  Accomplish
1042 					 * this by implicitly re-setting the
1043 					 * name.
1044 					 */
1045 					if (name == NULL)
1046 						name = prison_name(mypr, pr);
1047 				}
1048 			}
1049 		}
1050 		if (pr == NULL) {
1051 			/* Update: jid must exist. */
1052 			if (cuflags == JAIL_UPDATE) {
1053 				error = ENOENT;
1054 				vfs_opterror(opts, "jail %d not found", jid);
1055 				goto done_unlock_list;
1056 			}
1057 		}
1058 	}
1059 	/*
1060 	 * If the caller provided a name, look for a jail by that name.
1061 	 * This has different semantics for creates and updates keyed by jid
1062 	 * (where the name must not already exist in a different jail),
1063 	 * and updates keyed by the name itself (where the name must exist
1064 	 * because that is the jail being updated).
1065 	 */
1066 	if (name != NULL) {
1067 		namelc = strrchr(name, '.');
1068 		if (namelc == NULL)
1069 			namelc = name;
1070 		else {
1071 			/*
1072 			 * This is a hierarchical name.  Split it into the
1073 			 * parent and child names, and make sure the parent
1074 			 * exists or matches an already found jail.
1075 			 */
1076 			*namelc = '\0';
1077 			if (pr != NULL) {
1078 				if (strncmp(name, ppr->pr_name, namelc - name)
1079 				    || ppr->pr_name[namelc - name] != '\0') {
1080 					mtx_unlock(&pr->pr_mtx);
1081 					error = EINVAL;
1082 					vfs_opterror(opts,
1083 					    "cannot change jail's parent");
1084 					goto done_unlock_list;
1085 				}
1086 			} else {
1087 				ppr = prison_find_name(mypr, name);
1088 				if (ppr == NULL) {
1089 					error = ENOENT;
1090 					vfs_opterror(opts,
1091 					    "jail \"%s\" not found", name);
1092 					goto done_unlock_list;
1093 				}
1094 				mtx_unlock(&ppr->pr_mtx);
1095 			}
1096 			name = ++namelc;
1097 		}
1098 		if (name[0] != '\0') {
1099 			namelen =
1100 			    (ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1;
1101  name_again:
1102 			deadpr = NULL;
1103 			FOREACH_PRISON_CHILD(ppr, tpr) {
1104 				if (tpr != pr && tpr->pr_ref > 0 &&
1105 				    !strcmp(tpr->pr_name + namelen, name)) {
1106 					if (pr == NULL &&
1107 					    cuflags != JAIL_CREATE) {
1108 						mtx_lock(&tpr->pr_mtx);
1109 						if (tpr->pr_ref > 0) {
1110 							/*
1111 							 * Use this jail
1112 							 * for updates.
1113 							 */
1114 							if (tpr->pr_uref > 0) {
1115 								pr = tpr;
1116 								break;
1117 							}
1118 							deadpr = tpr;
1119 						}
1120 						mtx_unlock(&tpr->pr_mtx);
1121 					} else if (tpr->pr_uref > 0) {
1122 						/*
1123 						 * Create, or update(jid):
1124 						 * name must not exist in an
1125 						 * active sibling jail.
1126 						 */
1127 						error = EEXIST;
1128 						if (pr != NULL)
1129 							mtx_unlock(&pr->pr_mtx);
1130 						vfs_opterror(opts,
1131 						   "jail \"%s\" already exists",
1132 						   name);
1133 						goto done_unlock_list;
1134 					}
1135 				}
1136 			}
1137 			/* If no active jail is found, use a dying one. */
1138 			if (deadpr != NULL && pr == NULL) {
1139 				if (flags & JAIL_DYING) {
1140 					mtx_lock(&deadpr->pr_mtx);
1141 					if (deadpr->pr_ref == 0) {
1142 						mtx_unlock(&deadpr->pr_mtx);
1143 						goto name_again;
1144 					}
1145 					pr = deadpr;
1146 				} else if (cuflags == JAIL_UPDATE) {
1147 					error = ENOENT;
1148 					vfs_opterror(opts,
1149 					    "jail \"%s\" is dying", name);
1150 					goto done_unlock_list;
1151 				}
1152 			}
1153 			/* Update: name must exist if no jid. */
1154 			else if (cuflags == JAIL_UPDATE && pr == NULL) {
1155 				error = ENOENT;
1156 				vfs_opterror(opts, "jail \"%s\" not found",
1157 				    name);
1158 				goto done_unlock_list;
1159 			}
1160 		}
1161 	}
1162 	/* Update: must provide a jid or name. */
1163 	else if (cuflags == JAIL_UPDATE && pr == NULL) {
1164 		error = ENOENT;
1165 		vfs_opterror(opts, "update specified no jail");
1166 		goto done_unlock_list;
1167 	}
1168 
1169 	/* If there's no prison to update, create a new one and link it in. */
1170 	if (pr == NULL) {
1171 		for (tpr = mypr; tpr != NULL; tpr = tpr->pr_parent)
1172 			if (tpr->pr_childcount >= tpr->pr_childmax) {
1173 				error = EPERM;
1174 				vfs_opterror(opts, "prison limit exceeded");
1175 				goto done_unlock_list;
1176 			}
1177 		created = 1;
1178 		mtx_lock(&ppr->pr_mtx);
1179 		if (ppr->pr_ref == 0 || (ppr->pr_flags & PR_REMOVE)) {
1180 			mtx_unlock(&ppr->pr_mtx);
1181 			error = ENOENT;
1182 			vfs_opterror(opts, "parent jail went away!");
1183 			goto done_unlock_list;
1184 		}
1185 		ppr->pr_ref++;
1186 		ppr->pr_uref++;
1187 		mtx_unlock(&ppr->pr_mtx);
1188 		pr = malloc(sizeof(*pr), M_PRISON, M_WAITOK | M_ZERO);
1189 		if (jid == 0) {
1190 			/* Find the next free jid. */
1191 			jid = lastprid + 1;
1192  findnext:
1193 			if (jid == JAIL_MAX)
1194 				jid = 1;
1195 			TAILQ_FOREACH(tpr, &allprison, pr_list) {
1196 				if (tpr->pr_id < jid)
1197 					continue;
1198 				if (tpr->pr_id > jid || tpr->pr_ref == 0) {
1199 					TAILQ_INSERT_BEFORE(tpr, pr, pr_list);
1200 					break;
1201 				}
1202 				if (jid == lastprid) {
1203 					error = EAGAIN;
1204 					vfs_opterror(opts,
1205 					    "no available jail IDs");
1206 					free(pr, M_PRISON);
1207 					prison_deref(ppr, PD_DEREF |
1208 					    PD_DEUREF | PD_LIST_XLOCKED);
1209 					goto done_releroot;
1210 				}
1211 				jid++;
1212 				goto findnext;
1213 			}
1214 			lastprid = jid;
1215 		} else {
1216 			/*
1217 			 * The jail already has a jid (that did not yet exist),
1218 			 * so just find where to insert it.
1219 			 */
1220 			TAILQ_FOREACH(tpr, &allprison, pr_list)
1221 				if (tpr->pr_id >= jid) {
1222 					TAILQ_INSERT_BEFORE(tpr, pr, pr_list);
1223 					break;
1224 				}
1225 		}
1226 		if (tpr == NULL)
1227 			TAILQ_INSERT_TAIL(&allprison, pr, pr_list);
1228 		LIST_INSERT_HEAD(&ppr->pr_children, pr, pr_sibling);
1229 		for (tpr = ppr; tpr != NULL; tpr = tpr->pr_parent)
1230 			tpr->pr_childcount++;
1231 
1232 		pr->pr_parent = ppr;
1233 		pr->pr_id = jid;
1234 
1235 		/* Set some default values, and inherit some from the parent. */
1236 		if (name == NULL)
1237 			name = "";
1238 		if (path == NULL) {
1239 			path = "/";
1240 			root = mypr->pr_root;
1241 			vref(root);
1242 		}
1243 		strlcpy(pr->pr_hostuuid, DEFAULT_HOSTUUID, HOSTUUIDLEN);
1244 		pr->pr_flags |= PR_HOST;
1245 #if defined(INET) || defined(INET6)
1246 #ifdef VIMAGE
1247 		if (!(pr_flags & PR_VNET))
1248 #endif
1249 		{
1250 #ifdef INET
1251 			if (!(ch_flags & PR_IP4_USER))
1252 				pr->pr_flags |=
1253 				    PR_IP4 | PR_IP4_USER | PR_IP4_DISABLE;
1254 			else if (!(pr_flags & PR_IP4_USER)) {
1255 				pr->pr_flags |= ppr->pr_flags & PR_IP4;
1256 				if (ppr->pr_ip4 != NULL) {
1257 					pr->pr_ip4s = ppr->pr_ip4s;
1258 					pr->pr_ip4 = malloc(pr->pr_ip4s *
1259 					    sizeof(struct in_addr), M_PRISON,
1260 					    M_WAITOK);
1261 					bcopy(ppr->pr_ip4, pr->pr_ip4,
1262 					    pr->pr_ip4s * sizeof(*pr->pr_ip4));
1263 				}
1264 			}
1265 #endif
1266 #ifdef INET6
1267 			if (!(ch_flags & PR_IP6_USER))
1268 				pr->pr_flags |=
1269 				    PR_IP6 | PR_IP6_USER | PR_IP6_DISABLE;
1270 			else if (!(pr_flags & PR_IP6_USER)) {
1271 				pr->pr_flags |= ppr->pr_flags & PR_IP6;
1272 				if (ppr->pr_ip6 != NULL) {
1273 					pr->pr_ip6s = ppr->pr_ip6s;
1274 					pr->pr_ip6 = malloc(pr->pr_ip6s *
1275 					    sizeof(struct in6_addr), M_PRISON,
1276 					    M_WAITOK);
1277 					bcopy(ppr->pr_ip6, pr->pr_ip6,
1278 					    pr->pr_ip6s * sizeof(*pr->pr_ip6));
1279 				}
1280 			}
1281 #endif
1282 		}
1283 #endif
1284 		/* Source address selection is always on by default. */
1285 		pr->pr_flags |= _PR_IP_SADDRSEL;
1286 
1287 		pr->pr_securelevel = ppr->pr_securelevel;
1288 		pr->pr_allow = JAIL_DEFAULT_ALLOW & ppr->pr_allow;
1289 		pr->pr_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS;
1290 		pr->pr_devfs_rsnum = ppr->pr_devfs_rsnum;
1291 
1292 		LIST_INIT(&pr->pr_children);
1293 		mtx_init(&pr->pr_mtx, "jail mutex", NULL, MTX_DEF | MTX_DUPOK);
1294 
1295 #ifdef VIMAGE
1296 		/* Allocate a new vnet if specified. */
1297 		pr->pr_vnet = (pr_flags & PR_VNET)
1298 		    ? vnet_alloc() : ppr->pr_vnet;
1299 #endif
1300 		/*
1301 		 * Allocate a dedicated cpuset for each jail.
1302 		 * Unlike other initial settings, this may return an erorr.
1303 		 */
1304 		error = cpuset_create_root(ppr, &pr->pr_cpuset);
1305 		if (error) {
1306 			prison_deref(pr, PD_LIST_XLOCKED);
1307 			goto done_releroot;
1308 		}
1309 
1310 		mtx_lock(&pr->pr_mtx);
1311 		/*
1312 		 * New prisons do not yet have a reference, because we do not
1313 		 * want other to see the incomplete prison once the
1314 		 * allprison_lock is downgraded.
1315 		 */
1316 	} else {
1317 		created = 0;
1318 		/*
1319 		 * Grab a reference for existing prisons, to ensure they
1320 		 * continue to exist for the duration of the call.
1321 		 */
1322 		pr->pr_ref++;
1323 #if defined(VIMAGE) && (defined(INET) || defined(INET6))
1324 		if ((pr->pr_flags & PR_VNET) &&
1325 		    (ch_flags & (PR_IP4_USER | PR_IP6_USER))) {
1326 			error = EINVAL;
1327 			vfs_opterror(opts,
1328 			    "vnet jails cannot have IP address restrictions");
1329 			goto done_deref_locked;
1330 		}
1331 #endif
1332 #ifdef INET
1333 		if (PR_IP4_USER & ch_flags & (pr_flags ^ pr->pr_flags)) {
1334 			error = EINVAL;
1335 			vfs_opterror(opts,
1336 			    "ip4 cannot be changed after creation");
1337 			goto done_deref_locked;
1338 		}
1339 #endif
1340 #ifdef INET6
1341 		if (PR_IP6_USER & ch_flags & (pr_flags ^ pr->pr_flags)) {
1342 			error = EINVAL;
1343 			vfs_opterror(opts,
1344 			    "ip6 cannot be changed after creation");
1345 			goto done_deref_locked;
1346 		}
1347 #endif
1348 	}
1349 
1350 	/* Do final error checking before setting anything. */
1351 	if (gotslevel) {
1352 		if (slevel < ppr->pr_securelevel) {
1353 			error = EPERM;
1354 			goto done_deref_locked;
1355 		}
1356 	}
1357 	if (gotchildmax) {
1358 		if (childmax >= ppr->pr_childmax) {
1359 			error = EPERM;
1360 			goto done_deref_locked;
1361 		}
1362 	}
1363 	if (gotenforce) {
1364 		if (enforce < ppr->pr_enforce_statfs) {
1365 			error = EPERM;
1366 			goto done_deref_locked;
1367 		}
1368 	}
1369 	if (gotrsnum) {
1370 		/*
1371 		 * devfs_rsnum is a uint16_t
1372 		 */
1373 		if (rsnum < 0 || rsnum > 65535) {
1374 			error = EINVAL;
1375 			goto done_deref_locked;
1376 		}
1377 		/*
1378 		 * Nested jails always inherit parent's devfs ruleset
1379 		 */
1380 		if (jailed(td->td_ucred)) {
1381 			if (rsnum > 0 && rsnum != ppr->pr_devfs_rsnum) {
1382 				error = EPERM;
1383 				goto done_deref_locked;
1384 			} else
1385 				rsnum = ppr->pr_devfs_rsnum;
1386 		}
1387 	}
1388 #ifdef INET
1389 	if (ip4s > 0) {
1390 		if (ppr->pr_flags & PR_IP4) {
1391 			/*
1392 			 * Make sure the new set of IP addresses is a
1393 			 * subset of the parent's list.  Don't worry
1394 			 * about the parent being unlocked, as any
1395 			 * setting is done with allprison_lock held.
1396 			 */
1397 			for (ij = 0; ij < ppr->pr_ip4s; ij++)
1398 				if (ip4[0].s_addr == ppr->pr_ip4[ij].s_addr)
1399 					break;
1400 			if (ij == ppr->pr_ip4s) {
1401 				error = EPERM;
1402 				goto done_deref_locked;
1403 			}
1404 			if (ip4s > 1) {
1405 				for (ii = ij = 1; ii < ip4s; ii++) {
1406 					if (ip4[ii].s_addr ==
1407 					    ppr->pr_ip4[0].s_addr)
1408 						continue;
1409 					for (; ij < ppr->pr_ip4s; ij++)
1410 						if (ip4[ii].s_addr ==
1411 						    ppr->pr_ip4[ij].s_addr)
1412 							break;
1413 					if (ij == ppr->pr_ip4s)
1414 						break;
1415 				}
1416 				if (ij == ppr->pr_ip4s) {
1417 					error = EPERM;
1418 					goto done_deref_locked;
1419 				}
1420 			}
1421 		}
1422 		/*
1423 		 * Check for conflicting IP addresses.  We permit them
1424 		 * if there is no more than one IP on each jail.  If
1425 		 * there is a duplicate on a jail with more than one
1426 		 * IP stop checking and return error.
1427 		 */
1428 		tppr = ppr;
1429 #ifdef VIMAGE
1430 		for (; tppr != &prison0; tppr = tppr->pr_parent)
1431 			if (tppr->pr_flags & PR_VNET)
1432 				break;
1433 #endif
1434 		FOREACH_PRISON_DESCENDANT(tppr, tpr, descend) {
1435 			if (tpr == pr ||
1436 #ifdef VIMAGE
1437 			    (tpr != tppr && (tpr->pr_flags & PR_VNET)) ||
1438 #endif
1439 			    tpr->pr_uref == 0) {
1440 				descend = 0;
1441 				continue;
1442 			}
1443 			if (!(tpr->pr_flags & PR_IP4_USER))
1444 				continue;
1445 			descend = 0;
1446 			if (tpr->pr_ip4 == NULL ||
1447 			    (ip4s == 1 && tpr->pr_ip4s == 1))
1448 				continue;
1449 			for (ii = 0; ii < ip4s; ii++) {
1450 				if (_prison_check_ip4(tpr, &ip4[ii]) == 0) {
1451 					error = EADDRINUSE;
1452 					vfs_opterror(opts,
1453 					    "IPv4 addresses clash");
1454 					goto done_deref_locked;
1455 				}
1456 			}
1457 		}
1458 	}
1459 #endif
1460 #ifdef INET6
1461 	if (ip6s > 0) {
1462 		if (ppr->pr_flags & PR_IP6) {
1463 			/*
1464 			 * Make sure the new set of IP addresses is a
1465 			 * subset of the parent's list.
1466 			 */
1467 			for (ij = 0; ij < ppr->pr_ip6s; ij++)
1468 				if (IN6_ARE_ADDR_EQUAL(&ip6[0],
1469 				    &ppr->pr_ip6[ij]))
1470 					break;
1471 			if (ij == ppr->pr_ip6s) {
1472 				error = EPERM;
1473 				goto done_deref_locked;
1474 			}
1475 			if (ip6s > 1) {
1476 				for (ii = ij = 1; ii < ip6s; ii++) {
1477 					if (IN6_ARE_ADDR_EQUAL(&ip6[ii],
1478 					     &ppr->pr_ip6[0]))
1479 						continue;
1480 					for (; ij < ppr->pr_ip6s; ij++)
1481 						if (IN6_ARE_ADDR_EQUAL(
1482 						    &ip6[ii], &ppr->pr_ip6[ij]))
1483 							break;
1484 					if (ij == ppr->pr_ip6s)
1485 						break;
1486 				}
1487 				if (ij == ppr->pr_ip6s) {
1488 					error = EPERM;
1489 					goto done_deref_locked;
1490 				}
1491 			}
1492 		}
1493 		/* Check for conflicting IP addresses. */
1494 		tppr = ppr;
1495 #ifdef VIMAGE
1496 		for (; tppr != &prison0; tppr = tppr->pr_parent)
1497 			if (tppr->pr_flags & PR_VNET)
1498 				break;
1499 #endif
1500 		FOREACH_PRISON_DESCENDANT(tppr, tpr, descend) {
1501 			if (tpr == pr ||
1502 #ifdef VIMAGE
1503 			    (tpr != tppr && (tpr->pr_flags & PR_VNET)) ||
1504 #endif
1505 			    tpr->pr_uref == 0) {
1506 				descend = 0;
1507 				continue;
1508 			}
1509 			if (!(tpr->pr_flags & PR_IP6_USER))
1510 				continue;
1511 			descend = 0;
1512 			if (tpr->pr_ip6 == NULL ||
1513 			    (ip6s == 1 && tpr->pr_ip6s == 1))
1514 				continue;
1515 			for (ii = 0; ii < ip6s; ii++) {
1516 				if (_prison_check_ip6(tpr, &ip6[ii]) == 0) {
1517 					error = EADDRINUSE;
1518 					vfs_opterror(opts,
1519 					    "IPv6 addresses clash");
1520 					goto done_deref_locked;
1521 				}
1522 			}
1523 		}
1524 	}
1525 #endif
1526 	onamelen = namelen = 0;
1527 	if (name != NULL) {
1528 		/* Give a default name of the jid. */
1529 		if (name[0] == '\0')
1530 			snprintf(name = numbuf, sizeof(numbuf), "%d", jid);
1531 		else if (*namelc == '0' || (strtoul(namelc, &p, 10) != jid &&
1532 		    *p == '\0')) {
1533 			error = EINVAL;
1534 			vfs_opterror(opts,
1535 			    "name cannot be numeric (unless it is the jid)");
1536 			goto done_deref_locked;
1537 		}
1538 		/*
1539 		 * Make sure the name isn't too long for the prison or its
1540 		 * children.
1541 		 */
1542 		onamelen = strlen(pr->pr_name);
1543 		namelen = strlen(name);
1544 		if (strlen(ppr->pr_name) + namelen + 2 > sizeof(pr->pr_name)) {
1545 			error = ENAMETOOLONG;
1546 			goto done_deref_locked;
1547 		}
1548 		FOREACH_PRISON_DESCENDANT(pr, tpr, descend) {
1549 			if (strlen(tpr->pr_name) + (namelen - onamelen) >=
1550 			    sizeof(pr->pr_name)) {
1551 				error = ENAMETOOLONG;
1552 				goto done_deref_locked;
1553 			}
1554 		}
1555 	}
1556 	if (pr_allow & ~ppr->pr_allow) {
1557 		error = EPERM;
1558 		goto done_deref_locked;
1559 	}
1560 
1561 	/* Set the parameters of the prison. */
1562 #ifdef INET
1563 	redo_ip4 = 0;
1564 	if (pr_flags & PR_IP4_USER) {
1565 		pr->pr_flags |= PR_IP4;
1566 		free(pr->pr_ip4, M_PRISON);
1567 		pr->pr_ip4s = ip4s;
1568 		pr->pr_ip4 = ip4;
1569 		ip4 = NULL;
1570 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1571 #ifdef VIMAGE
1572 			if (tpr->pr_flags & PR_VNET) {
1573 				descend = 0;
1574 				continue;
1575 			}
1576 #endif
1577 			if (prison_restrict_ip4(tpr, NULL)) {
1578 				redo_ip4 = 1;
1579 				descend = 0;
1580 			}
1581 		}
1582 	}
1583 #endif
1584 #ifdef INET6
1585 	redo_ip6 = 0;
1586 	if (pr_flags & PR_IP6_USER) {
1587 		pr->pr_flags |= PR_IP6;
1588 		free(pr->pr_ip6, M_PRISON);
1589 		pr->pr_ip6s = ip6s;
1590 		pr->pr_ip6 = ip6;
1591 		ip6 = NULL;
1592 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1593 #ifdef VIMAGE
1594 			if (tpr->pr_flags & PR_VNET) {
1595 				descend = 0;
1596 				continue;
1597 			}
1598 #endif
1599 			if (prison_restrict_ip6(tpr, NULL)) {
1600 				redo_ip6 = 1;
1601 				descend = 0;
1602 			}
1603 		}
1604 	}
1605 #endif
1606 	if (gotslevel) {
1607 		pr->pr_securelevel = slevel;
1608 		/* Set all child jails to be at least this level. */
1609 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
1610 			if (tpr->pr_securelevel < slevel)
1611 				tpr->pr_securelevel = slevel;
1612 	}
1613 	if (gotchildmax) {
1614 		pr->pr_childmax = childmax;
1615 		/* Set all child jails to under this limit. */
1616 		FOREACH_PRISON_DESCENDANT_LOCKED_LEVEL(pr, tpr, descend, level)
1617 			if (tpr->pr_childmax > childmax - level)
1618 				tpr->pr_childmax = childmax > level
1619 				    ? childmax - level : 0;
1620 	}
1621 	if (gotenforce) {
1622 		pr->pr_enforce_statfs = enforce;
1623 		/* Pass this restriction on to the children. */
1624 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
1625 			if (tpr->pr_enforce_statfs < enforce)
1626 				tpr->pr_enforce_statfs = enforce;
1627 	}
1628 	if (gotrsnum) {
1629 		pr->pr_devfs_rsnum = rsnum;
1630 		/* Pass this restriction on to the children. */
1631 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
1632 			tpr->pr_devfs_rsnum = rsnum;
1633 	}
1634 	if (name != NULL) {
1635 		if (ppr == &prison0)
1636 			strlcpy(pr->pr_name, name, sizeof(pr->pr_name));
1637 		else
1638 			snprintf(pr->pr_name, sizeof(pr->pr_name), "%s.%s",
1639 			    ppr->pr_name, name);
1640 		/* Change this component of child names. */
1641 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1642 			bcopy(tpr->pr_name + onamelen, tpr->pr_name + namelen,
1643 			    strlen(tpr->pr_name + onamelen) + 1);
1644 			bcopy(pr->pr_name, tpr->pr_name, namelen);
1645 		}
1646 	}
1647 	if (path != NULL) {
1648 		/* Try to keep a real-rooted full pathname. */
1649 		if (fullpath_disabled && path[0] == '/' &&
1650 		    strcmp(mypr->pr_path, "/"))
1651 			snprintf(pr->pr_path, sizeof(pr->pr_path), "%s%s",
1652 			    mypr->pr_path, path);
1653 		else
1654 			strlcpy(pr->pr_path, path, sizeof(pr->pr_path));
1655 		pr->pr_root = root;
1656 	}
1657 	if (PR_HOST & ch_flags & ~pr_flags) {
1658 		if (pr->pr_flags & PR_HOST) {
1659 			/*
1660 			 * Copy the parent's host info.  As with pr_ip4 above,
1661 			 * the lack of a lock on the parent is not a problem;
1662 			 * it is always set with allprison_lock at least
1663 			 * shared, and is held exclusively here.
1664 			 */
1665 			strlcpy(pr->pr_hostname, pr->pr_parent->pr_hostname,
1666 			    sizeof(pr->pr_hostname));
1667 			strlcpy(pr->pr_domainname, pr->pr_parent->pr_domainname,
1668 			    sizeof(pr->pr_domainname));
1669 			strlcpy(pr->pr_hostuuid, pr->pr_parent->pr_hostuuid,
1670 			    sizeof(pr->pr_hostuuid));
1671 			pr->pr_hostid = pr->pr_parent->pr_hostid;
1672 		}
1673 	} else if (host != NULL || domain != NULL || uuid != NULL || gothid) {
1674 		/* Set this prison, and any descendants without PR_HOST. */
1675 		if (host != NULL)
1676 			strlcpy(pr->pr_hostname, host, sizeof(pr->pr_hostname));
1677 		if (domain != NULL)
1678 			strlcpy(pr->pr_domainname, domain,
1679 			    sizeof(pr->pr_domainname));
1680 		if (uuid != NULL)
1681 			strlcpy(pr->pr_hostuuid, uuid, sizeof(pr->pr_hostuuid));
1682 		if (gothid)
1683 			pr->pr_hostid = hid;
1684 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1685 			if (tpr->pr_flags & PR_HOST)
1686 				descend = 0;
1687 			else {
1688 				if (host != NULL)
1689 					strlcpy(tpr->pr_hostname,
1690 					    pr->pr_hostname,
1691 					    sizeof(tpr->pr_hostname));
1692 				if (domain != NULL)
1693 					strlcpy(tpr->pr_domainname,
1694 					    pr->pr_domainname,
1695 					    sizeof(tpr->pr_domainname));
1696 				if (uuid != NULL)
1697 					strlcpy(tpr->pr_hostuuid,
1698 					    pr->pr_hostuuid,
1699 					    sizeof(tpr->pr_hostuuid));
1700 				if (gothid)
1701 					tpr->pr_hostid = hid;
1702 			}
1703 		}
1704 	}
1705 	if ((tallow = ch_allow & ~pr_allow)) {
1706 		/* Clear allow bits in all children. */
1707 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
1708 			tpr->pr_allow &= ~tallow;
1709 	}
1710 	pr->pr_allow = (pr->pr_allow & ~ch_allow) | pr_allow;
1711 	/*
1712 	 * Persistent prisons get an extra reference, and prisons losing their
1713 	 * persist flag lose that reference.  Only do this for existing prisons
1714 	 * for now, so new ones will remain unseen until after the module
1715 	 * handlers have completed.
1716 	 */
1717 	if (!created && (ch_flags & PR_PERSIST & (pr_flags ^ pr->pr_flags))) {
1718 		if (pr_flags & PR_PERSIST) {
1719 			pr->pr_ref++;
1720 			pr->pr_uref++;
1721 		} else {
1722 			pr->pr_ref--;
1723 			pr->pr_uref--;
1724 		}
1725 	}
1726 	pr->pr_flags = (pr->pr_flags & ~ch_flags) | pr_flags;
1727 	mtx_unlock(&pr->pr_mtx);
1728 
1729 #ifdef RACCT
1730 	if (created)
1731 		prison_racct_attach(pr);
1732 #endif
1733 
1734 	/* Locks may have prevented a complete restriction of child IP
1735 	 * addresses.  If so, allocate some more memory and try again.
1736 	 */
1737 #ifdef INET
1738 	while (redo_ip4) {
1739 		ip4s = pr->pr_ip4s;
1740 		ip4 = malloc(ip4s * sizeof(*ip4), M_PRISON, M_WAITOK);
1741 		mtx_lock(&pr->pr_mtx);
1742 		redo_ip4 = 0;
1743 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1744 #ifdef VIMAGE
1745 			if (tpr->pr_flags & PR_VNET) {
1746 				descend = 0;
1747 				continue;
1748 			}
1749 #endif
1750 			if (prison_restrict_ip4(tpr, ip4)) {
1751 				if (ip4 != NULL)
1752 					ip4 = NULL;
1753 				else
1754 					redo_ip4 = 1;
1755 			}
1756 		}
1757 		mtx_unlock(&pr->pr_mtx);
1758 	}
1759 #endif
1760 #ifdef INET6
1761 	while (redo_ip6) {
1762 		ip6s = pr->pr_ip6s;
1763 		ip6 = malloc(ip6s * sizeof(*ip6), M_PRISON, M_WAITOK);
1764 		mtx_lock(&pr->pr_mtx);
1765 		redo_ip6 = 0;
1766 		FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
1767 #ifdef VIMAGE
1768 			if (tpr->pr_flags & PR_VNET) {
1769 				descend = 0;
1770 				continue;
1771 			}
1772 #endif
1773 			if (prison_restrict_ip6(tpr, ip6)) {
1774 				if (ip6 != NULL)
1775 					ip6 = NULL;
1776 				else
1777 					redo_ip6 = 1;
1778 			}
1779 		}
1780 		mtx_unlock(&pr->pr_mtx);
1781 	}
1782 #endif
1783 
1784 	/* Let the modules do their work. */
1785 	sx_downgrade(&allprison_lock);
1786 	if (created) {
1787 		error = osd_jail_call(pr, PR_METHOD_CREATE, opts);
1788 		if (error) {
1789 			prison_deref(pr, PD_LIST_SLOCKED);
1790 			goto done_errmsg;
1791 		}
1792 	}
1793 	error = osd_jail_call(pr, PR_METHOD_SET, opts);
1794 	if (error) {
1795 		prison_deref(pr, created
1796 		    ? PD_LIST_SLOCKED
1797 		    : PD_DEREF | PD_LIST_SLOCKED);
1798 		goto done_errmsg;
1799 	}
1800 
1801 	/* Attach this process to the prison if requested. */
1802 	if (flags & JAIL_ATTACH) {
1803 		mtx_lock(&pr->pr_mtx);
1804 		error = do_jail_attach(td, pr);
1805 		if (error) {
1806 			vfs_opterror(opts, "attach failed");
1807 			if (!created)
1808 				prison_deref(pr, PD_DEREF);
1809 			goto done_errmsg;
1810 		}
1811 	}
1812 
1813 #ifdef RACCT
1814 	if (!created) {
1815 		sx_sunlock(&allprison_lock);
1816 		prison_racct_modify(pr);
1817 		sx_slock(&allprison_lock);
1818 	}
1819 #endif
1820 
1821 	td->td_retval[0] = pr->pr_id;
1822 
1823 	/*
1824 	 * Now that it is all there, drop the temporary reference from existing
1825 	 * prisons.  Or add a reference to newly created persistent prisons
1826 	 * (which was not done earlier so that the prison would not be publicly
1827 	 * visible).
1828 	 */
1829 	if (!created) {
1830 		prison_deref(pr, (flags & JAIL_ATTACH)
1831 		    ? PD_DEREF
1832 		    : PD_DEREF | PD_LIST_SLOCKED);
1833 	} else {
1834 		if (pr_flags & PR_PERSIST) {
1835 			mtx_lock(&pr->pr_mtx);
1836 			pr->pr_ref++;
1837 			pr->pr_uref++;
1838 			mtx_unlock(&pr->pr_mtx);
1839 		}
1840 		if (!(flags & JAIL_ATTACH))
1841 			sx_sunlock(&allprison_lock);
1842 	}
1843 
1844 	goto done_errmsg;
1845 
1846  done_deref_locked:
1847 	prison_deref(pr, created
1848 	    ? PD_LOCKED | PD_LIST_XLOCKED
1849 	    : PD_DEREF | PD_LOCKED | PD_LIST_XLOCKED);
1850 	goto done_releroot;
1851  done_unlock_list:
1852 	sx_xunlock(&allprison_lock);
1853  done_releroot:
1854 	if (root != NULL)
1855 		vrele(root);
1856  done_errmsg:
1857 	if (error) {
1858 		vfs_getopt(opts, "errmsg", (void **)&errmsg, &errmsg_len);
1859 		if (errmsg_len > 0) {
1860 			errmsg_pos = 2 * vfs_getopt_pos(opts, "errmsg") + 1;
1861 			if (errmsg_pos > 0) {
1862 				if (optuio->uio_segflg == UIO_SYSSPACE)
1863 					bcopy(errmsg,
1864 					   optuio->uio_iov[errmsg_pos].iov_base,
1865 					   errmsg_len);
1866 				else
1867 					copyout(errmsg,
1868 					   optuio->uio_iov[errmsg_pos].iov_base,
1869 					   errmsg_len);
1870 			}
1871 		}
1872 	}
1873  done_free:
1874 #ifdef INET
1875 	free(ip4, M_PRISON);
1876 #endif
1877 #ifdef INET6
1878 	free(ip6, M_PRISON);
1879 #endif
1880 	if (g_path != NULL)
1881 		free(g_path, M_TEMP);
1882 	vfs_freeopts(opts);
1883 	return (error);
1884 }
1885 
1886 
1887 /*
1888  * struct jail_get_args {
1889  *	struct iovec *iovp;
1890  *	unsigned int iovcnt;
1891  *	int flags;
1892  * };
1893  */
1894 int
1895 sys_jail_get(struct thread *td, struct jail_get_args *uap)
1896 {
1897 	struct uio *auio;
1898 	int error;
1899 
1900 	/* Check that we have an even number of iovecs. */
1901 	if (uap->iovcnt & 1)
1902 		return (EINVAL);
1903 
1904 	error = copyinuio(uap->iovp, uap->iovcnt, &auio);
1905 	if (error)
1906 		return (error);
1907 	error = kern_jail_get(td, auio, uap->flags);
1908 	if (error == 0)
1909 		error = copyout(auio->uio_iov, uap->iovp,
1910 		    uap->iovcnt * sizeof (struct iovec));
1911 	free(auio, M_IOV);
1912 	return (error);
1913 }
1914 
1915 int
1916 kern_jail_get(struct thread *td, struct uio *optuio, int flags)
1917 {
1918 	struct prison *pr, *mypr;
1919 	struct vfsopt *opt;
1920 	struct vfsoptlist *opts;
1921 	char *errmsg, *name;
1922 	int error, errmsg_len, errmsg_pos, fi, i, jid, len, locked, pos;
1923 
1924 	if (flags & ~JAIL_GET_MASK)
1925 		return (EINVAL);
1926 
1927 	/* Get the parameter list. */
1928 	error = vfs_buildopts(optuio, &opts);
1929 	if (error)
1930 		return (error);
1931 	errmsg_pos = vfs_getopt_pos(opts, "errmsg");
1932 	mypr = td->td_ucred->cr_prison;
1933 
1934 	/*
1935 	 * Find the prison specified by one of: lastjid, jid, name.
1936 	 */
1937 	sx_slock(&allprison_lock);
1938 	error = vfs_copyopt(opts, "lastjid", &jid, sizeof(jid));
1939 	if (error == 0) {
1940 		TAILQ_FOREACH(pr, &allprison, pr_list) {
1941 			if (pr->pr_id > jid && prison_ischild(mypr, pr)) {
1942 				mtx_lock(&pr->pr_mtx);
1943 				if (pr->pr_ref > 0 &&
1944 				    (pr->pr_uref > 0 || (flags & JAIL_DYING)))
1945 					break;
1946 				mtx_unlock(&pr->pr_mtx);
1947 			}
1948 		}
1949 		if (pr != NULL)
1950 			goto found_prison;
1951 		error = ENOENT;
1952 		vfs_opterror(opts, "no jail after %d", jid);
1953 		goto done_unlock_list;
1954 	} else if (error != ENOENT)
1955 		goto done_unlock_list;
1956 
1957 	error = vfs_copyopt(opts, "jid", &jid, sizeof(jid));
1958 	if (error == 0) {
1959 		if (jid != 0) {
1960 			pr = prison_find_child(mypr, jid);
1961 			if (pr != NULL) {
1962 				if (pr->pr_uref == 0 && !(flags & JAIL_DYING)) {
1963 					mtx_unlock(&pr->pr_mtx);
1964 					error = ENOENT;
1965 					vfs_opterror(opts, "jail %d is dying",
1966 					    jid);
1967 					goto done_unlock_list;
1968 				}
1969 				goto found_prison;
1970 			}
1971 			error = ENOENT;
1972 			vfs_opterror(opts, "jail %d not found", jid);
1973 			goto done_unlock_list;
1974 		}
1975 	} else if (error != ENOENT)
1976 		goto done_unlock_list;
1977 
1978 	error = vfs_getopt(opts, "name", (void **)&name, &len);
1979 	if (error == 0) {
1980 		if (len == 0 || name[len - 1] != '\0') {
1981 			error = EINVAL;
1982 			goto done_unlock_list;
1983 		}
1984 		pr = prison_find_name(mypr, name);
1985 		if (pr != NULL) {
1986 			if (pr->pr_uref == 0 && !(flags & JAIL_DYING)) {
1987 				mtx_unlock(&pr->pr_mtx);
1988 				error = ENOENT;
1989 				vfs_opterror(opts, "jail \"%s\" is dying",
1990 				    name);
1991 				goto done_unlock_list;
1992 			}
1993 			goto found_prison;
1994 		}
1995 		error = ENOENT;
1996 		vfs_opterror(opts, "jail \"%s\" not found", name);
1997 		goto done_unlock_list;
1998 	} else if (error != ENOENT)
1999 		goto done_unlock_list;
2000 
2001 	vfs_opterror(opts, "no jail specified");
2002 	error = ENOENT;
2003 	goto done_unlock_list;
2004 
2005  found_prison:
2006 	/* Get the parameters of the prison. */
2007 	pr->pr_ref++;
2008 	locked = PD_LOCKED;
2009 	td->td_retval[0] = pr->pr_id;
2010 	error = vfs_setopt(opts, "jid", &pr->pr_id, sizeof(pr->pr_id));
2011 	if (error != 0 && error != ENOENT)
2012 		goto done_deref;
2013 	i = (pr->pr_parent == mypr) ? 0 : pr->pr_parent->pr_id;
2014 	error = vfs_setopt(opts, "parent", &i, sizeof(i));
2015 	if (error != 0 && error != ENOENT)
2016 		goto done_deref;
2017 	error = vfs_setopts(opts, "name", prison_name(mypr, pr));
2018 	if (error != 0 && error != ENOENT)
2019 		goto done_deref;
2020 	error = vfs_setopt(opts, "cpuset.id", &pr->pr_cpuset->cs_id,
2021 	    sizeof(pr->pr_cpuset->cs_id));
2022 	if (error != 0 && error != ENOENT)
2023 		goto done_deref;
2024 	error = vfs_setopts(opts, "path", prison_path(mypr, pr));
2025 	if (error != 0 && error != ENOENT)
2026 		goto done_deref;
2027 #ifdef INET
2028 	error = vfs_setopt_part(opts, "ip4.addr", pr->pr_ip4,
2029 	    pr->pr_ip4s * sizeof(*pr->pr_ip4));
2030 	if (error != 0 && error != ENOENT)
2031 		goto done_deref;
2032 #endif
2033 #ifdef INET6
2034 	error = vfs_setopt_part(opts, "ip6.addr", pr->pr_ip6,
2035 	    pr->pr_ip6s * sizeof(*pr->pr_ip6));
2036 	if (error != 0 && error != ENOENT)
2037 		goto done_deref;
2038 #endif
2039 	error = vfs_setopt(opts, "securelevel", &pr->pr_securelevel,
2040 	    sizeof(pr->pr_securelevel));
2041 	if (error != 0 && error != ENOENT)
2042 		goto done_deref;
2043 	error = vfs_setopt(opts, "children.cur", &pr->pr_childcount,
2044 	    sizeof(pr->pr_childcount));
2045 	if (error != 0 && error != ENOENT)
2046 		goto done_deref;
2047 	error = vfs_setopt(opts, "children.max", &pr->pr_childmax,
2048 	    sizeof(pr->pr_childmax));
2049 	if (error != 0 && error != ENOENT)
2050 		goto done_deref;
2051 	error = vfs_setopts(opts, "host.hostname", pr->pr_hostname);
2052 	if (error != 0 && error != ENOENT)
2053 		goto done_deref;
2054 	error = vfs_setopts(opts, "host.domainname", pr->pr_domainname);
2055 	if (error != 0 && error != ENOENT)
2056 		goto done_deref;
2057 	error = vfs_setopts(opts, "host.hostuuid", pr->pr_hostuuid);
2058 	if (error != 0 && error != ENOENT)
2059 		goto done_deref;
2060 #ifdef COMPAT_FREEBSD32
2061 	if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) {
2062 		uint32_t hid32 = pr->pr_hostid;
2063 
2064 		error = vfs_setopt(opts, "host.hostid", &hid32, sizeof(hid32));
2065 	} else
2066 #endif
2067 	error = vfs_setopt(opts, "host.hostid", &pr->pr_hostid,
2068 	    sizeof(pr->pr_hostid));
2069 	if (error != 0 && error != ENOENT)
2070 		goto done_deref;
2071 	error = vfs_setopt(opts, "enforce_statfs", &pr->pr_enforce_statfs,
2072 	    sizeof(pr->pr_enforce_statfs));
2073 	if (error != 0 && error != ENOENT)
2074 		goto done_deref;
2075 	error = vfs_setopt(opts, "devfs_ruleset", &pr->pr_devfs_rsnum,
2076 	    sizeof(pr->pr_devfs_rsnum));
2077 	if (error != 0 && error != ENOENT)
2078 		goto done_deref;
2079 	for (fi = 0; fi < sizeof(pr_flag_names) / sizeof(pr_flag_names[0]);
2080 	    fi++) {
2081 		if (pr_flag_names[fi] == NULL)
2082 			continue;
2083 		i = (pr->pr_flags & (1 << fi)) ? 1 : 0;
2084 		error = vfs_setopt(opts, pr_flag_names[fi], &i, sizeof(i));
2085 		if (error != 0 && error != ENOENT)
2086 			goto done_deref;
2087 		i = !i;
2088 		error = vfs_setopt(opts, pr_flag_nonames[fi], &i, sizeof(i));
2089 		if (error != 0 && error != ENOENT)
2090 			goto done_deref;
2091 	}
2092 	for (fi = 0; fi < sizeof(pr_flag_jailsys) / sizeof(pr_flag_jailsys[0]);
2093 	    fi++) {
2094 		i = pr->pr_flags &
2095 		    (pr_flag_jailsys[fi].disable | pr_flag_jailsys[fi].new);
2096 		i = pr_flag_jailsys[fi].disable &&
2097 		      (i == pr_flag_jailsys[fi].disable) ? JAIL_SYS_DISABLE
2098 		    : (i == pr_flag_jailsys[fi].new) ? JAIL_SYS_NEW
2099 		    : JAIL_SYS_INHERIT;
2100 		error =
2101 		    vfs_setopt(opts, pr_flag_jailsys[fi].name, &i, sizeof(i));
2102 		if (error != 0 && error != ENOENT)
2103 			goto done_deref;
2104 	}
2105 	for (fi = 0; fi < sizeof(pr_allow_names) / sizeof(pr_allow_names[0]);
2106 	    fi++) {
2107 		if (pr_allow_names[fi] == NULL)
2108 			continue;
2109 		i = (pr->pr_allow & (1 << fi)) ? 1 : 0;
2110 		error = vfs_setopt(opts, pr_allow_names[fi], &i, sizeof(i));
2111 		if (error != 0 && error != ENOENT)
2112 			goto done_deref;
2113 		i = !i;
2114 		error = vfs_setopt(opts, pr_allow_nonames[fi], &i, sizeof(i));
2115 		if (error != 0 && error != ENOENT)
2116 			goto done_deref;
2117 	}
2118 	i = (pr->pr_uref == 0);
2119 	error = vfs_setopt(opts, "dying", &i, sizeof(i));
2120 	if (error != 0 && error != ENOENT)
2121 		goto done_deref;
2122 	i = !i;
2123 	error = vfs_setopt(opts, "nodying", &i, sizeof(i));
2124 	if (error != 0 && error != ENOENT)
2125 		goto done_deref;
2126 
2127 	/* Get the module parameters. */
2128 	mtx_unlock(&pr->pr_mtx);
2129 	locked = 0;
2130 	error = osd_jail_call(pr, PR_METHOD_GET, opts);
2131 	if (error)
2132 		goto done_deref;
2133 	prison_deref(pr, PD_DEREF | PD_LIST_SLOCKED);
2134 
2135 	/* By now, all parameters should have been noted. */
2136 	TAILQ_FOREACH(opt, opts, link) {
2137 		if (!opt->seen && strcmp(opt->name, "errmsg")) {
2138 			error = EINVAL;
2139 			vfs_opterror(opts, "unknown parameter: %s", opt->name);
2140 			goto done_errmsg;
2141 		}
2142 	}
2143 
2144 	/* Write the fetched parameters back to userspace. */
2145 	error = 0;
2146 	TAILQ_FOREACH(opt, opts, link) {
2147 		if (opt->pos >= 0 && opt->pos != errmsg_pos) {
2148 			pos = 2 * opt->pos + 1;
2149 			optuio->uio_iov[pos].iov_len = opt->len;
2150 			if (opt->value != NULL) {
2151 				if (optuio->uio_segflg == UIO_SYSSPACE) {
2152 					bcopy(opt->value,
2153 					    optuio->uio_iov[pos].iov_base,
2154 					    opt->len);
2155 				} else {
2156 					error = copyout(opt->value,
2157 					    optuio->uio_iov[pos].iov_base,
2158 					    opt->len);
2159 					if (error)
2160 						break;
2161 				}
2162 			}
2163 		}
2164 	}
2165 	goto done_errmsg;
2166 
2167  done_deref:
2168 	prison_deref(pr, locked | PD_DEREF | PD_LIST_SLOCKED);
2169 	goto done_errmsg;
2170 
2171  done_unlock_list:
2172 	sx_sunlock(&allprison_lock);
2173  done_errmsg:
2174 	if (error && errmsg_pos >= 0) {
2175 		vfs_getopt(opts, "errmsg", (void **)&errmsg, &errmsg_len);
2176 		errmsg_pos = 2 * errmsg_pos + 1;
2177 		if (errmsg_len > 0) {
2178 			if (optuio->uio_segflg == UIO_SYSSPACE)
2179 				bcopy(errmsg,
2180 				    optuio->uio_iov[errmsg_pos].iov_base,
2181 				    errmsg_len);
2182 			else
2183 				copyout(errmsg,
2184 				    optuio->uio_iov[errmsg_pos].iov_base,
2185 				    errmsg_len);
2186 		}
2187 	}
2188 	vfs_freeopts(opts);
2189 	return (error);
2190 }
2191 
2192 
2193 /*
2194  * struct jail_remove_args {
2195  *	int jid;
2196  * };
2197  */
2198 int
2199 sys_jail_remove(struct thread *td, struct jail_remove_args *uap)
2200 {
2201 	struct prison *pr, *cpr, *lpr, *tpr;
2202 	int descend, error;
2203 
2204 	error = priv_check(td, PRIV_JAIL_REMOVE);
2205 	if (error)
2206 		return (error);
2207 
2208 	sx_xlock(&allprison_lock);
2209 	pr = prison_find_child(td->td_ucred->cr_prison, uap->jid);
2210 	if (pr == NULL) {
2211 		sx_xunlock(&allprison_lock);
2212 		return (EINVAL);
2213 	}
2214 
2215 	/* Remove all descendants of this prison, then remove this prison. */
2216 	pr->pr_ref++;
2217 	pr->pr_flags |= PR_REMOVE;
2218 	if (!LIST_EMPTY(&pr->pr_children)) {
2219 		mtx_unlock(&pr->pr_mtx);
2220 		lpr = NULL;
2221 		FOREACH_PRISON_DESCENDANT(pr, cpr, descend) {
2222 			mtx_lock(&cpr->pr_mtx);
2223 			if (cpr->pr_ref > 0) {
2224 				tpr = cpr;
2225 				cpr->pr_ref++;
2226 				cpr->pr_flags |= PR_REMOVE;
2227 			} else {
2228 				/* Already removed - do not do it again. */
2229 				tpr = NULL;
2230 			}
2231 			mtx_unlock(&cpr->pr_mtx);
2232 			if (lpr != NULL) {
2233 				mtx_lock(&lpr->pr_mtx);
2234 				prison_remove_one(lpr);
2235 				sx_xlock(&allprison_lock);
2236 			}
2237 			lpr = tpr;
2238 		}
2239 		if (lpr != NULL) {
2240 			mtx_lock(&lpr->pr_mtx);
2241 			prison_remove_one(lpr);
2242 			sx_xlock(&allprison_lock);
2243 		}
2244 		mtx_lock(&pr->pr_mtx);
2245 	}
2246 	prison_remove_one(pr);
2247 	return (0);
2248 }
2249 
2250 static void
2251 prison_remove_one(struct prison *pr)
2252 {
2253 	struct proc *p;
2254 	int deuref;
2255 
2256 	/* If the prison was persistent, it is not anymore. */
2257 	deuref = 0;
2258 	if (pr->pr_flags & PR_PERSIST) {
2259 		pr->pr_ref--;
2260 		deuref = PD_DEUREF;
2261 		pr->pr_flags &= ~PR_PERSIST;
2262 	}
2263 
2264 	/*
2265 	 * jail_remove added a reference.  If that's the only one, remove
2266 	 * the prison now.
2267 	 */
2268 	KASSERT(pr->pr_ref > 0,
2269 	    ("prison_remove_one removing a dead prison (jid=%d)", pr->pr_id));
2270 	if (pr->pr_ref == 1) {
2271 		prison_deref(pr,
2272 		    deuref | PD_DEREF | PD_LOCKED | PD_LIST_XLOCKED);
2273 		return;
2274 	}
2275 
2276 	mtx_unlock(&pr->pr_mtx);
2277 	sx_xunlock(&allprison_lock);
2278 	/*
2279 	 * Kill all processes unfortunate enough to be attached to this prison.
2280 	 */
2281 	sx_slock(&allproc_lock);
2282 	LIST_FOREACH(p, &allproc, p_list) {
2283 		PROC_LOCK(p);
2284 		if (p->p_state != PRS_NEW && p->p_ucred &&
2285 		    p->p_ucred->cr_prison == pr)
2286 			kern_psignal(p, SIGKILL);
2287 		PROC_UNLOCK(p);
2288 	}
2289 	sx_sunlock(&allproc_lock);
2290 	/* Remove the temporary reference added by jail_remove. */
2291 	prison_deref(pr, deuref | PD_DEREF);
2292 }
2293 
2294 
2295 /*
2296  * struct jail_attach_args {
2297  *	int jid;
2298  * };
2299  */
2300 int
2301 sys_jail_attach(struct thread *td, struct jail_attach_args *uap)
2302 {
2303 	struct prison *pr;
2304 	int error;
2305 
2306 	error = priv_check(td, PRIV_JAIL_ATTACH);
2307 	if (error)
2308 		return (error);
2309 
2310 	sx_slock(&allprison_lock);
2311 	pr = prison_find_child(td->td_ucred->cr_prison, uap->jid);
2312 	if (pr == NULL) {
2313 		sx_sunlock(&allprison_lock);
2314 		return (EINVAL);
2315 	}
2316 
2317 	/*
2318 	 * Do not allow a process to attach to a prison that is not
2319 	 * considered to be "alive".
2320 	 */
2321 	if (pr->pr_uref == 0) {
2322 		mtx_unlock(&pr->pr_mtx);
2323 		sx_sunlock(&allprison_lock);
2324 		return (EINVAL);
2325 	}
2326 
2327 	return (do_jail_attach(td, pr));
2328 }
2329 
2330 static int
2331 do_jail_attach(struct thread *td, struct prison *pr)
2332 {
2333 	struct prison *ppr;
2334 	struct proc *p;
2335 	struct ucred *newcred, *oldcred;
2336 	int error;
2337 
2338 	/*
2339 	 * XXX: Note that there is a slight race here if two threads
2340 	 * in the same privileged process attempt to attach to two
2341 	 * different jails at the same time.  It is important for
2342 	 * user processes not to do this, or they might end up with
2343 	 * a process root from one prison, but attached to the jail
2344 	 * of another.
2345 	 */
2346 	pr->pr_ref++;
2347 	pr->pr_uref++;
2348 	mtx_unlock(&pr->pr_mtx);
2349 
2350 	/* Let modules do whatever they need to prepare for attaching. */
2351 	error = osd_jail_call(pr, PR_METHOD_ATTACH, td);
2352 	if (error) {
2353 		prison_deref(pr, PD_DEREF | PD_DEUREF | PD_LIST_SLOCKED);
2354 		return (error);
2355 	}
2356 	sx_sunlock(&allprison_lock);
2357 
2358 	/*
2359 	 * Reparent the newly attached process to this jail.
2360 	 */
2361 	ppr = td->td_ucred->cr_prison;
2362 	p = td->td_proc;
2363 	error = cpuset_setproc_update_set(p, pr->pr_cpuset);
2364 	if (error)
2365 		goto e_revert_osd;
2366 
2367 	vn_lock(pr->pr_root, LK_EXCLUSIVE | LK_RETRY);
2368 	if ((error = change_dir(pr->pr_root, td)) != 0)
2369 		goto e_unlock;
2370 #ifdef MAC
2371 	if ((error = mac_vnode_check_chroot(td->td_ucred, pr->pr_root)))
2372 		goto e_unlock;
2373 #endif
2374 	VOP_UNLOCK(pr->pr_root, 0);
2375 	if ((error = change_root(pr->pr_root, td)))
2376 		goto e_revert_osd;
2377 
2378 	newcred = crget();
2379 	PROC_LOCK(p);
2380 	oldcred = p->p_ucred;
2381 	setsugid(p);
2382 	crcopy(newcred, oldcred);
2383 	newcred->cr_prison = pr;
2384 	p->p_ucred = newcred;
2385 	PROC_UNLOCK(p);
2386 #ifdef RACCT
2387 	racct_proc_ucred_changed(p, oldcred, newcred);
2388 #endif
2389 	crfree(oldcred);
2390 	prison_deref(ppr, PD_DEREF | PD_DEUREF);
2391 	return (0);
2392  e_unlock:
2393 	VOP_UNLOCK(pr->pr_root, 0);
2394  e_revert_osd:
2395 	/* Tell modules this thread is still in its old jail after all. */
2396 	(void)osd_jail_call(ppr, PR_METHOD_ATTACH, td);
2397 	prison_deref(pr, PD_DEREF | PD_DEUREF);
2398 	return (error);
2399 }
2400 
2401 
2402 /*
2403  * Returns a locked prison instance, or NULL on failure.
2404  */
2405 struct prison *
2406 prison_find(int prid)
2407 {
2408 	struct prison *pr;
2409 
2410 	sx_assert(&allprison_lock, SX_LOCKED);
2411 	TAILQ_FOREACH(pr, &allprison, pr_list) {
2412 		if (pr->pr_id == prid) {
2413 			mtx_lock(&pr->pr_mtx);
2414 			if (pr->pr_ref > 0)
2415 				return (pr);
2416 			mtx_unlock(&pr->pr_mtx);
2417 		}
2418 	}
2419 	return (NULL);
2420 }
2421 
2422 /*
2423  * Find a prison that is a descendant of mypr.  Returns a locked prison or NULL.
2424  */
2425 struct prison *
2426 prison_find_child(struct prison *mypr, int prid)
2427 {
2428 	struct prison *pr;
2429 	int descend;
2430 
2431 	sx_assert(&allprison_lock, SX_LOCKED);
2432 	FOREACH_PRISON_DESCENDANT(mypr, pr, descend) {
2433 		if (pr->pr_id == prid) {
2434 			mtx_lock(&pr->pr_mtx);
2435 			if (pr->pr_ref > 0)
2436 				return (pr);
2437 			mtx_unlock(&pr->pr_mtx);
2438 		}
2439 	}
2440 	return (NULL);
2441 }
2442 
2443 /*
2444  * Look for the name relative to mypr.  Returns a locked prison or NULL.
2445  */
2446 struct prison *
2447 prison_find_name(struct prison *mypr, const char *name)
2448 {
2449 	struct prison *pr, *deadpr;
2450 	size_t mylen;
2451 	int descend;
2452 
2453 	sx_assert(&allprison_lock, SX_LOCKED);
2454 	mylen = (mypr == &prison0) ? 0 : strlen(mypr->pr_name) + 1;
2455  again:
2456 	deadpr = NULL;
2457 	FOREACH_PRISON_DESCENDANT(mypr, pr, descend) {
2458 		if (!strcmp(pr->pr_name + mylen, name)) {
2459 			mtx_lock(&pr->pr_mtx);
2460 			if (pr->pr_ref > 0) {
2461 				if (pr->pr_uref > 0)
2462 					return (pr);
2463 				deadpr = pr;
2464 			}
2465 			mtx_unlock(&pr->pr_mtx);
2466 		}
2467 	}
2468 	/* There was no valid prison - perhaps there was a dying one. */
2469 	if (deadpr != NULL) {
2470 		mtx_lock(&deadpr->pr_mtx);
2471 		if (deadpr->pr_ref == 0) {
2472 			mtx_unlock(&deadpr->pr_mtx);
2473 			goto again;
2474 		}
2475 	}
2476 	return (deadpr);
2477 }
2478 
2479 /*
2480  * See if a prison has the specific flag set.
2481  */
2482 int
2483 prison_flag(struct ucred *cred, unsigned flag)
2484 {
2485 
2486 	/* This is an atomic read, so no locking is necessary. */
2487 	return (cred->cr_prison->pr_flags & flag);
2488 }
2489 
2490 int
2491 prison_allow(struct ucred *cred, unsigned flag)
2492 {
2493 
2494 	/* This is an atomic read, so no locking is necessary. */
2495 	return (cred->cr_prison->pr_allow & flag);
2496 }
2497 
2498 /*
2499  * Remove a prison reference.  If that was the last reference, remove the
2500  * prison itself - but not in this context in case there are locks held.
2501  */
2502 void
2503 prison_free_locked(struct prison *pr)
2504 {
2505 
2506 	mtx_assert(&pr->pr_mtx, MA_OWNED);
2507 	pr->pr_ref--;
2508 	if (pr->pr_ref == 0) {
2509 		mtx_unlock(&pr->pr_mtx);
2510 		TASK_INIT(&pr->pr_task, 0, prison_complete, pr);
2511 		taskqueue_enqueue(taskqueue_thread, &pr->pr_task);
2512 		return;
2513 	}
2514 	mtx_unlock(&pr->pr_mtx);
2515 }
2516 
2517 void
2518 prison_free(struct prison *pr)
2519 {
2520 
2521 	mtx_lock(&pr->pr_mtx);
2522 	prison_free_locked(pr);
2523 }
2524 
2525 static void
2526 prison_complete(void *context, int pending)
2527 {
2528 
2529 	prison_deref((struct prison *)context, 0);
2530 }
2531 
2532 /*
2533  * Remove a prison reference (usually).  This internal version assumes no
2534  * mutexes are held, except perhaps the prison itself.  If there are no more
2535  * references, release and delist the prison.  On completion, the prison lock
2536  * and the allprison lock are both unlocked.
2537  */
2538 static void
2539 prison_deref(struct prison *pr, int flags)
2540 {
2541 	struct prison *ppr, *tpr;
2542 
2543 	if (!(flags & PD_LOCKED))
2544 		mtx_lock(&pr->pr_mtx);
2545 	for (;;) {
2546 		if (flags & PD_DEUREF) {
2547 			pr->pr_uref--;
2548 			KASSERT(prison0.pr_uref != 0, ("prison0 pr_uref=0"));
2549 		}
2550 		if (flags & PD_DEREF)
2551 			pr->pr_ref--;
2552 		/* If the prison still has references, nothing else to do. */
2553 		if (pr->pr_ref > 0) {
2554 			mtx_unlock(&pr->pr_mtx);
2555 			if (flags & PD_LIST_SLOCKED)
2556 				sx_sunlock(&allprison_lock);
2557 			else if (flags & PD_LIST_XLOCKED)
2558 				sx_xunlock(&allprison_lock);
2559 			return;
2560 		}
2561 
2562 		mtx_unlock(&pr->pr_mtx);
2563 		if (flags & PD_LIST_SLOCKED) {
2564 			if (!sx_try_upgrade(&allprison_lock)) {
2565 				sx_sunlock(&allprison_lock);
2566 				sx_xlock(&allprison_lock);
2567 			}
2568 		} else if (!(flags & PD_LIST_XLOCKED))
2569 			sx_xlock(&allprison_lock);
2570 
2571 		TAILQ_REMOVE(&allprison, pr, pr_list);
2572 		LIST_REMOVE(pr, pr_sibling);
2573 		ppr = pr->pr_parent;
2574 		for (tpr = ppr; tpr != NULL; tpr = tpr->pr_parent)
2575 			tpr->pr_childcount--;
2576 		sx_xunlock(&allprison_lock);
2577 
2578 #ifdef VIMAGE
2579 		if (pr->pr_vnet != ppr->pr_vnet)
2580 			vnet_destroy(pr->pr_vnet);
2581 #endif
2582 		if (pr->pr_root != NULL)
2583 			vrele(pr->pr_root);
2584 		mtx_destroy(&pr->pr_mtx);
2585 #ifdef INET
2586 		free(pr->pr_ip4, M_PRISON);
2587 #endif
2588 #ifdef INET6
2589 		free(pr->pr_ip6, M_PRISON);
2590 #endif
2591 		if (pr->pr_cpuset != NULL)
2592 			cpuset_rel(pr->pr_cpuset);
2593 		osd_jail_exit(pr);
2594 #ifdef RACCT
2595 		prison_racct_detach(pr);
2596 #endif
2597 		free(pr, M_PRISON);
2598 
2599 		/* Removing a prison frees a reference on its parent. */
2600 		pr = ppr;
2601 		mtx_lock(&pr->pr_mtx);
2602 		flags = PD_DEREF | PD_DEUREF;
2603 	}
2604 }
2605 
2606 void
2607 prison_hold_locked(struct prison *pr)
2608 {
2609 
2610 	mtx_assert(&pr->pr_mtx, MA_OWNED);
2611 	KASSERT(pr->pr_ref > 0,
2612 	    ("Trying to hold dead prison (jid=%d).", pr->pr_id));
2613 	pr->pr_ref++;
2614 }
2615 
2616 void
2617 prison_hold(struct prison *pr)
2618 {
2619 
2620 	mtx_lock(&pr->pr_mtx);
2621 	prison_hold_locked(pr);
2622 	mtx_unlock(&pr->pr_mtx);
2623 }
2624 
2625 void
2626 prison_proc_hold(struct prison *pr)
2627 {
2628 
2629 	mtx_lock(&pr->pr_mtx);
2630 	KASSERT(pr->pr_uref > 0,
2631 	    ("Cannot add a process to a non-alive prison (jid=%d)", pr->pr_id));
2632 	pr->pr_uref++;
2633 	mtx_unlock(&pr->pr_mtx);
2634 }
2635 
2636 void
2637 prison_proc_free(struct prison *pr)
2638 {
2639 
2640 	mtx_lock(&pr->pr_mtx);
2641 	KASSERT(pr->pr_uref > 0,
2642 	    ("Trying to kill a process in a dead prison (jid=%d)", pr->pr_id));
2643 	prison_deref(pr, PD_DEUREF | PD_LOCKED);
2644 }
2645 
2646 
2647 #ifdef INET
2648 /*
2649  * Restrict a prison's IP address list with its parent's, possibly replacing
2650  * it.  Return true if the replacement buffer was used (or would have been).
2651  */
2652 static int
2653 prison_restrict_ip4(struct prison *pr, struct in_addr *newip4)
2654 {
2655 	int ii, ij, used;
2656 	struct prison *ppr;
2657 
2658 	ppr = pr->pr_parent;
2659 	if (!(pr->pr_flags & PR_IP4_USER)) {
2660 		/* This has no user settings, so just copy the parent's list. */
2661 		if (pr->pr_ip4s < ppr->pr_ip4s) {
2662 			/*
2663 			 * There's no room for the parent's list.  Use the
2664 			 * new list buffer, which is assumed to be big enough
2665 			 * (if it was passed).  If there's no buffer, try to
2666 			 * allocate one.
2667 			 */
2668 			used = 1;
2669 			if (newip4 == NULL) {
2670 				newip4 = malloc(ppr->pr_ip4s * sizeof(*newip4),
2671 				    M_PRISON, M_NOWAIT);
2672 				if (newip4 != NULL)
2673 					used = 0;
2674 			}
2675 			if (newip4 != NULL) {
2676 				bcopy(ppr->pr_ip4, newip4,
2677 				    ppr->pr_ip4s * sizeof(*newip4));
2678 				free(pr->pr_ip4, M_PRISON);
2679 				pr->pr_ip4 = newip4;
2680 				pr->pr_ip4s = ppr->pr_ip4s;
2681 			}
2682 			return (used);
2683 		}
2684 		pr->pr_ip4s = ppr->pr_ip4s;
2685 		if (pr->pr_ip4s > 0)
2686 			bcopy(ppr->pr_ip4, pr->pr_ip4,
2687 			    pr->pr_ip4s * sizeof(*newip4));
2688 		else if (pr->pr_ip4 != NULL) {
2689 			free(pr->pr_ip4, M_PRISON);
2690 			pr->pr_ip4 = NULL;
2691 		}
2692 	} else if (pr->pr_ip4s > 0) {
2693 		/* Remove addresses that aren't in the parent. */
2694 		for (ij = 0; ij < ppr->pr_ip4s; ij++)
2695 			if (pr->pr_ip4[0].s_addr == ppr->pr_ip4[ij].s_addr)
2696 				break;
2697 		if (ij < ppr->pr_ip4s)
2698 			ii = 1;
2699 		else {
2700 			bcopy(pr->pr_ip4 + 1, pr->pr_ip4,
2701 			    --pr->pr_ip4s * sizeof(*pr->pr_ip4));
2702 			ii = 0;
2703 		}
2704 		for (ij = 1; ii < pr->pr_ip4s; ) {
2705 			if (pr->pr_ip4[ii].s_addr == ppr->pr_ip4[0].s_addr) {
2706 				ii++;
2707 				continue;
2708 			}
2709 			switch (ij >= ppr->pr_ip4s ? -1 :
2710 				qcmp_v4(&pr->pr_ip4[ii], &ppr->pr_ip4[ij])) {
2711 			case -1:
2712 				bcopy(pr->pr_ip4 + ii + 1, pr->pr_ip4 + ii,
2713 				    (--pr->pr_ip4s - ii) * sizeof(*pr->pr_ip4));
2714 				break;
2715 			case 0:
2716 				ii++;
2717 				ij++;
2718 				break;
2719 			case 1:
2720 				ij++;
2721 				break;
2722 			}
2723 		}
2724 		if (pr->pr_ip4s == 0) {
2725 			pr->pr_flags |= PR_IP4_DISABLE;
2726 			free(pr->pr_ip4, M_PRISON);
2727 			pr->pr_ip4 = NULL;
2728 		}
2729 	}
2730 	return (0);
2731 }
2732 
2733 /*
2734  * Pass back primary IPv4 address of this jail.
2735  *
2736  * If not restricted return success but do not alter the address.  Caller has
2737  * to make sure to initialize it correctly (e.g. INADDR_ANY).
2738  *
2739  * Returns 0 on success, EAFNOSUPPORT if the jail doesn't allow IPv4.
2740  * Address returned in NBO.
2741  */
2742 int
2743 prison_get_ip4(struct ucred *cred, struct in_addr *ia)
2744 {
2745 	struct prison *pr;
2746 
2747 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
2748 	KASSERT(ia != NULL, ("%s: ia is NULL", __func__));
2749 
2750 	pr = cred->cr_prison;
2751 	if (!(pr->pr_flags & PR_IP4))
2752 		return (0);
2753 	mtx_lock(&pr->pr_mtx);
2754 	if (!(pr->pr_flags & PR_IP4)) {
2755 		mtx_unlock(&pr->pr_mtx);
2756 		return (0);
2757 	}
2758 	if (pr->pr_ip4 == NULL) {
2759 		mtx_unlock(&pr->pr_mtx);
2760 		return (EAFNOSUPPORT);
2761 	}
2762 
2763 	ia->s_addr = pr->pr_ip4[0].s_addr;
2764 	mtx_unlock(&pr->pr_mtx);
2765 	return (0);
2766 }
2767 
2768 /*
2769  * Return 1 if we should do proper source address selection or are not jailed.
2770  * We will return 0 if we should bypass source address selection in favour
2771  * of the primary jail IPv4 address. Only in this case *ia will be updated and
2772  * returned in NBO.
2773  * Return EAFNOSUPPORT, in case this jail does not allow IPv4.
2774  */
2775 int
2776 prison_saddrsel_ip4(struct ucred *cred, struct in_addr *ia)
2777 {
2778 	struct prison *pr;
2779 	struct in_addr lia;
2780 	int error;
2781 
2782 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
2783 	KASSERT(ia != NULL, ("%s: ia is NULL", __func__));
2784 
2785 	if (!jailed(cred))
2786 		return (1);
2787 
2788 	pr = cred->cr_prison;
2789 	if (pr->pr_flags & PR_IP4_SADDRSEL)
2790 		return (1);
2791 
2792 	lia.s_addr = INADDR_ANY;
2793 	error = prison_get_ip4(cred, &lia);
2794 	if (error)
2795 		return (error);
2796 	if (lia.s_addr == INADDR_ANY)
2797 		return (1);
2798 
2799 	ia->s_addr = lia.s_addr;
2800 	return (0);
2801 }
2802 
2803 /*
2804  * Return true if pr1 and pr2 have the same IPv4 address restrictions.
2805  */
2806 int
2807 prison_equal_ip4(struct prison *pr1, struct prison *pr2)
2808 {
2809 
2810 	if (pr1 == pr2)
2811 		return (1);
2812 
2813 	/*
2814 	 * No need to lock since the PR_IP4_USER flag can't be altered for
2815 	 * existing prisons.
2816 	 */
2817 	while (pr1 != &prison0 &&
2818 #ifdef VIMAGE
2819 	       !(pr1->pr_flags & PR_VNET) &&
2820 #endif
2821 	       !(pr1->pr_flags & PR_IP4_USER))
2822 		pr1 = pr1->pr_parent;
2823 	while (pr2 != &prison0 &&
2824 #ifdef VIMAGE
2825 	       !(pr2->pr_flags & PR_VNET) &&
2826 #endif
2827 	       !(pr2->pr_flags & PR_IP4_USER))
2828 		pr2 = pr2->pr_parent;
2829 	return (pr1 == pr2);
2830 }
2831 
2832 /*
2833  * Make sure our (source) address is set to something meaningful to this
2834  * jail.
2835  *
2836  * Returns 0 if jail doesn't restrict IPv4 or if address belongs to jail,
2837  * EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if the jail
2838  * doesn't allow IPv4.  Address passed in in NBO and returned in NBO.
2839  */
2840 int
2841 prison_local_ip4(struct ucred *cred, struct in_addr *ia)
2842 {
2843 	struct prison *pr;
2844 	struct in_addr ia0;
2845 	int error;
2846 
2847 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
2848 	KASSERT(ia != NULL, ("%s: ia is NULL", __func__));
2849 
2850 	pr = cred->cr_prison;
2851 	if (!(pr->pr_flags & PR_IP4))
2852 		return (0);
2853 	mtx_lock(&pr->pr_mtx);
2854 	if (!(pr->pr_flags & PR_IP4)) {
2855 		mtx_unlock(&pr->pr_mtx);
2856 		return (0);
2857 	}
2858 	if (pr->pr_ip4 == NULL) {
2859 		mtx_unlock(&pr->pr_mtx);
2860 		return (EAFNOSUPPORT);
2861 	}
2862 
2863 	ia0.s_addr = ntohl(ia->s_addr);
2864 	if (ia0.s_addr == INADDR_LOOPBACK) {
2865 		ia->s_addr = pr->pr_ip4[0].s_addr;
2866 		mtx_unlock(&pr->pr_mtx);
2867 		return (0);
2868 	}
2869 
2870 	if (ia0.s_addr == INADDR_ANY) {
2871 		/*
2872 		 * In case there is only 1 IPv4 address, bind directly.
2873 		 */
2874 		if (pr->pr_ip4s == 1)
2875 			ia->s_addr = pr->pr_ip4[0].s_addr;
2876 		mtx_unlock(&pr->pr_mtx);
2877 		return (0);
2878 	}
2879 
2880 	error = _prison_check_ip4(pr, ia);
2881 	mtx_unlock(&pr->pr_mtx);
2882 	return (error);
2883 }
2884 
2885 /*
2886  * Rewrite destination address in case we will connect to loopback address.
2887  *
2888  * Returns 0 on success, EAFNOSUPPORT if the jail doesn't allow IPv4.
2889  * Address passed in in NBO and returned in NBO.
2890  */
2891 int
2892 prison_remote_ip4(struct ucred *cred, struct in_addr *ia)
2893 {
2894 	struct prison *pr;
2895 
2896 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
2897 	KASSERT(ia != NULL, ("%s: ia is NULL", __func__));
2898 
2899 	pr = cred->cr_prison;
2900 	if (!(pr->pr_flags & PR_IP4))
2901 		return (0);
2902 	mtx_lock(&pr->pr_mtx);
2903 	if (!(pr->pr_flags & PR_IP4)) {
2904 		mtx_unlock(&pr->pr_mtx);
2905 		return (0);
2906 	}
2907 	if (pr->pr_ip4 == NULL) {
2908 		mtx_unlock(&pr->pr_mtx);
2909 		return (EAFNOSUPPORT);
2910 	}
2911 
2912 	if (ntohl(ia->s_addr) == INADDR_LOOPBACK) {
2913 		ia->s_addr = pr->pr_ip4[0].s_addr;
2914 		mtx_unlock(&pr->pr_mtx);
2915 		return (0);
2916 	}
2917 
2918 	/*
2919 	 * Return success because nothing had to be changed.
2920 	 */
2921 	mtx_unlock(&pr->pr_mtx);
2922 	return (0);
2923 }
2924 
2925 /*
2926  * Check if given address belongs to the jail referenced by cred/prison.
2927  *
2928  * Returns 0 if jail doesn't restrict IPv4 or if address belongs to jail,
2929  * EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if the jail
2930  * doesn't allow IPv4.  Address passed in in NBO.
2931  */
2932 static int
2933 _prison_check_ip4(const struct prison *pr, const struct in_addr *ia)
2934 {
2935 	int i, a, z, d;
2936 
2937 	/*
2938 	 * Check the primary IP.
2939 	 */
2940 	if (pr->pr_ip4[0].s_addr == ia->s_addr)
2941 		return (0);
2942 
2943 	/*
2944 	 * All the other IPs are sorted so we can do a binary search.
2945 	 */
2946 	a = 0;
2947 	z = pr->pr_ip4s - 2;
2948 	while (a <= z) {
2949 		i = (a + z) / 2;
2950 		d = qcmp_v4(&pr->pr_ip4[i+1], ia);
2951 		if (d > 0)
2952 			z = i - 1;
2953 		else if (d < 0)
2954 			a = i + 1;
2955 		else
2956 			return (0);
2957 	}
2958 
2959 	return (EADDRNOTAVAIL);
2960 }
2961 
2962 int
2963 prison_check_ip4(const struct ucred *cred, const struct in_addr *ia)
2964 {
2965 	struct prison *pr;
2966 	int error;
2967 
2968 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
2969 	KASSERT(ia != NULL, ("%s: ia is NULL", __func__));
2970 
2971 	pr = cred->cr_prison;
2972 	if (!(pr->pr_flags & PR_IP4))
2973 		return (0);
2974 	mtx_lock(&pr->pr_mtx);
2975 	if (!(pr->pr_flags & PR_IP4)) {
2976 		mtx_unlock(&pr->pr_mtx);
2977 		return (0);
2978 	}
2979 	if (pr->pr_ip4 == NULL) {
2980 		mtx_unlock(&pr->pr_mtx);
2981 		return (EAFNOSUPPORT);
2982 	}
2983 
2984 	error = _prison_check_ip4(pr, ia);
2985 	mtx_unlock(&pr->pr_mtx);
2986 	return (error);
2987 }
2988 #endif
2989 
2990 #ifdef INET6
2991 static int
2992 prison_restrict_ip6(struct prison *pr, struct in6_addr *newip6)
2993 {
2994 	int ii, ij, used;
2995 	struct prison *ppr;
2996 
2997 	ppr = pr->pr_parent;
2998 	if (!(pr->pr_flags & PR_IP6_USER)) {
2999 		/* This has no user settings, so just copy the parent's list. */
3000 		if (pr->pr_ip6s < ppr->pr_ip6s) {
3001 			/*
3002 			 * There's no room for the parent's list.  Use the
3003 			 * new list buffer, which is assumed to be big enough
3004 			 * (if it was passed).  If there's no buffer, try to
3005 			 * allocate one.
3006 			 */
3007 			used = 1;
3008 			if (newip6 == NULL) {
3009 				newip6 = malloc(ppr->pr_ip6s * sizeof(*newip6),
3010 				    M_PRISON, M_NOWAIT);
3011 				if (newip6 != NULL)
3012 					used = 0;
3013 			}
3014 			if (newip6 != NULL) {
3015 				bcopy(ppr->pr_ip6, newip6,
3016 				    ppr->pr_ip6s * sizeof(*newip6));
3017 				free(pr->pr_ip6, M_PRISON);
3018 				pr->pr_ip6 = newip6;
3019 				pr->pr_ip6s = ppr->pr_ip6s;
3020 			}
3021 			return (used);
3022 		}
3023 		pr->pr_ip6s = ppr->pr_ip6s;
3024 		if (pr->pr_ip6s > 0)
3025 			bcopy(ppr->pr_ip6, pr->pr_ip6,
3026 			    pr->pr_ip6s * sizeof(*newip6));
3027 		else if (pr->pr_ip6 != NULL) {
3028 			free(pr->pr_ip6, M_PRISON);
3029 			pr->pr_ip6 = NULL;
3030 		}
3031 	} else if (pr->pr_ip6s > 0) {
3032 		/* Remove addresses that aren't in the parent. */
3033 		for (ij = 0; ij < ppr->pr_ip6s; ij++)
3034 			if (IN6_ARE_ADDR_EQUAL(&pr->pr_ip6[0],
3035 			    &ppr->pr_ip6[ij]))
3036 				break;
3037 		if (ij < ppr->pr_ip6s)
3038 			ii = 1;
3039 		else {
3040 			bcopy(pr->pr_ip6 + 1, pr->pr_ip6,
3041 			    --pr->pr_ip6s * sizeof(*pr->pr_ip6));
3042 			ii = 0;
3043 		}
3044 		for (ij = 1; ii < pr->pr_ip6s; ) {
3045 			if (IN6_ARE_ADDR_EQUAL(&pr->pr_ip6[ii],
3046 			    &ppr->pr_ip6[0])) {
3047 				ii++;
3048 				continue;
3049 			}
3050 			switch (ij >= ppr->pr_ip6s ? -1 :
3051 				qcmp_v6(&pr->pr_ip6[ii], &ppr->pr_ip6[ij])) {
3052 			case -1:
3053 				bcopy(pr->pr_ip6 + ii + 1, pr->pr_ip6 + ii,
3054 				    (--pr->pr_ip6s - ii) * sizeof(*pr->pr_ip6));
3055 				break;
3056 			case 0:
3057 				ii++;
3058 				ij++;
3059 				break;
3060 			case 1:
3061 				ij++;
3062 				break;
3063 			}
3064 		}
3065 		if (pr->pr_ip6s == 0) {
3066 			pr->pr_flags |= PR_IP6_DISABLE;
3067 			free(pr->pr_ip6, M_PRISON);
3068 			pr->pr_ip6 = NULL;
3069 		}
3070 	}
3071 	return 0;
3072 }
3073 
3074 /*
3075  * Pass back primary IPv6 address for this jail.
3076  *
3077  * If not restricted return success but do not alter the address.  Caller has
3078  * to make sure to initialize it correctly (e.g. IN6ADDR_ANY_INIT).
3079  *
3080  * Returns 0 on success, EAFNOSUPPORT if the jail doesn't allow IPv6.
3081  */
3082 int
3083 prison_get_ip6(struct ucred *cred, struct in6_addr *ia6)
3084 {
3085 	struct prison *pr;
3086 
3087 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
3088 	KASSERT(ia6 != NULL, ("%s: ia6 is NULL", __func__));
3089 
3090 	pr = cred->cr_prison;
3091 	if (!(pr->pr_flags & PR_IP6))
3092 		return (0);
3093 	mtx_lock(&pr->pr_mtx);
3094 	if (!(pr->pr_flags & PR_IP6)) {
3095 		mtx_unlock(&pr->pr_mtx);
3096 		return (0);
3097 	}
3098 	if (pr->pr_ip6 == NULL) {
3099 		mtx_unlock(&pr->pr_mtx);
3100 		return (EAFNOSUPPORT);
3101 	}
3102 
3103 	bcopy(&pr->pr_ip6[0], ia6, sizeof(struct in6_addr));
3104 	mtx_unlock(&pr->pr_mtx);
3105 	return (0);
3106 }
3107 
3108 /*
3109  * Return 1 if we should do proper source address selection or are not jailed.
3110  * We will return 0 if we should bypass source address selection in favour
3111  * of the primary jail IPv6 address. Only in this case *ia will be updated and
3112  * returned in NBO.
3113  * Return EAFNOSUPPORT, in case this jail does not allow IPv6.
3114  */
3115 int
3116 prison_saddrsel_ip6(struct ucred *cred, struct in6_addr *ia6)
3117 {
3118 	struct prison *pr;
3119 	struct in6_addr lia6;
3120 	int error;
3121 
3122 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
3123 	KASSERT(ia6 != NULL, ("%s: ia6 is NULL", __func__));
3124 
3125 	if (!jailed(cred))
3126 		return (1);
3127 
3128 	pr = cred->cr_prison;
3129 	if (pr->pr_flags & PR_IP6_SADDRSEL)
3130 		return (1);
3131 
3132 	lia6 = in6addr_any;
3133 	error = prison_get_ip6(cred, &lia6);
3134 	if (error)
3135 		return (error);
3136 	if (IN6_IS_ADDR_UNSPECIFIED(&lia6))
3137 		return (1);
3138 
3139 	bcopy(&lia6, ia6, sizeof(struct in6_addr));
3140 	return (0);
3141 }
3142 
3143 /*
3144  * Return true if pr1 and pr2 have the same IPv6 address restrictions.
3145  */
3146 int
3147 prison_equal_ip6(struct prison *pr1, struct prison *pr2)
3148 {
3149 
3150 	if (pr1 == pr2)
3151 		return (1);
3152 
3153 	while (pr1 != &prison0 &&
3154 #ifdef VIMAGE
3155 	       !(pr1->pr_flags & PR_VNET) &&
3156 #endif
3157 	       !(pr1->pr_flags & PR_IP6_USER))
3158 		pr1 = pr1->pr_parent;
3159 	while (pr2 != &prison0 &&
3160 #ifdef VIMAGE
3161 	       !(pr2->pr_flags & PR_VNET) &&
3162 #endif
3163 	       !(pr2->pr_flags & PR_IP6_USER))
3164 		pr2 = pr2->pr_parent;
3165 	return (pr1 == pr2);
3166 }
3167 
3168 /*
3169  * Make sure our (source) address is set to something meaningful to this jail.
3170  *
3171  * v6only should be set based on (inp->inp_flags & IN6P_IPV6_V6ONLY != 0)
3172  * when needed while binding.
3173  *
3174  * Returns 0 if jail doesn't restrict IPv6 or if address belongs to jail,
3175  * EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if the jail
3176  * doesn't allow IPv6.
3177  */
3178 int
3179 prison_local_ip6(struct ucred *cred, struct in6_addr *ia6, int v6only)
3180 {
3181 	struct prison *pr;
3182 	int error;
3183 
3184 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
3185 	KASSERT(ia6 != NULL, ("%s: ia6 is NULL", __func__));
3186 
3187 	pr = cred->cr_prison;
3188 	if (!(pr->pr_flags & PR_IP6))
3189 		return (0);
3190 	mtx_lock(&pr->pr_mtx);
3191 	if (!(pr->pr_flags & PR_IP6)) {
3192 		mtx_unlock(&pr->pr_mtx);
3193 		return (0);
3194 	}
3195 	if (pr->pr_ip6 == NULL) {
3196 		mtx_unlock(&pr->pr_mtx);
3197 		return (EAFNOSUPPORT);
3198 	}
3199 
3200 	if (IN6_IS_ADDR_LOOPBACK(ia6)) {
3201 		bcopy(&pr->pr_ip6[0], ia6, sizeof(struct in6_addr));
3202 		mtx_unlock(&pr->pr_mtx);
3203 		return (0);
3204 	}
3205 
3206 	if (IN6_IS_ADDR_UNSPECIFIED(ia6)) {
3207 		/*
3208 		 * In case there is only 1 IPv6 address, and v6only is true,
3209 		 * then bind directly.
3210 		 */
3211 		if (v6only != 0 && pr->pr_ip6s == 1)
3212 			bcopy(&pr->pr_ip6[0], ia6, sizeof(struct in6_addr));
3213 		mtx_unlock(&pr->pr_mtx);
3214 		return (0);
3215 	}
3216 
3217 	error = _prison_check_ip6(pr, ia6);
3218 	mtx_unlock(&pr->pr_mtx);
3219 	return (error);
3220 }
3221 
3222 /*
3223  * Rewrite destination address in case we will connect to loopback address.
3224  *
3225  * Returns 0 on success, EAFNOSUPPORT if the jail doesn't allow IPv6.
3226  */
3227 int
3228 prison_remote_ip6(struct ucred *cred, struct in6_addr *ia6)
3229 {
3230 	struct prison *pr;
3231 
3232 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
3233 	KASSERT(ia6 != NULL, ("%s: ia6 is NULL", __func__));
3234 
3235 	pr = cred->cr_prison;
3236 	if (!(pr->pr_flags & PR_IP6))
3237 		return (0);
3238 	mtx_lock(&pr->pr_mtx);
3239 	if (!(pr->pr_flags & PR_IP6)) {
3240 		mtx_unlock(&pr->pr_mtx);
3241 		return (0);
3242 	}
3243 	if (pr->pr_ip6 == NULL) {
3244 		mtx_unlock(&pr->pr_mtx);
3245 		return (EAFNOSUPPORT);
3246 	}
3247 
3248 	if (IN6_IS_ADDR_LOOPBACK(ia6)) {
3249 		bcopy(&pr->pr_ip6[0], ia6, sizeof(struct in6_addr));
3250 		mtx_unlock(&pr->pr_mtx);
3251 		return (0);
3252 	}
3253 
3254 	/*
3255 	 * Return success because nothing had to be changed.
3256 	 */
3257 	mtx_unlock(&pr->pr_mtx);
3258 	return (0);
3259 }
3260 
3261 /*
3262  * Check if given address belongs to the jail referenced by cred/prison.
3263  *
3264  * Returns 0 if jail doesn't restrict IPv6 or if address belongs to jail,
3265  * EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if the jail
3266  * doesn't allow IPv6.
3267  */
3268 static int
3269 _prison_check_ip6(struct prison *pr, struct in6_addr *ia6)
3270 {
3271 	int i, a, z, d;
3272 
3273 	/*
3274 	 * Check the primary IP.
3275 	 */
3276 	if (IN6_ARE_ADDR_EQUAL(&pr->pr_ip6[0], ia6))
3277 		return (0);
3278 
3279 	/*
3280 	 * All the other IPs are sorted so we can do a binary search.
3281 	 */
3282 	a = 0;
3283 	z = pr->pr_ip6s - 2;
3284 	while (a <= z) {
3285 		i = (a + z) / 2;
3286 		d = qcmp_v6(&pr->pr_ip6[i+1], ia6);
3287 		if (d > 0)
3288 			z = i - 1;
3289 		else if (d < 0)
3290 			a = i + 1;
3291 		else
3292 			return (0);
3293 	}
3294 
3295 	return (EADDRNOTAVAIL);
3296 }
3297 
3298 int
3299 prison_check_ip6(struct ucred *cred, struct in6_addr *ia6)
3300 {
3301 	struct prison *pr;
3302 	int error;
3303 
3304 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
3305 	KASSERT(ia6 != NULL, ("%s: ia6 is NULL", __func__));
3306 
3307 	pr = cred->cr_prison;
3308 	if (!(pr->pr_flags & PR_IP6))
3309 		return (0);
3310 	mtx_lock(&pr->pr_mtx);
3311 	if (!(pr->pr_flags & PR_IP6)) {
3312 		mtx_unlock(&pr->pr_mtx);
3313 		return (0);
3314 	}
3315 	if (pr->pr_ip6 == NULL) {
3316 		mtx_unlock(&pr->pr_mtx);
3317 		return (EAFNOSUPPORT);
3318 	}
3319 
3320 	error = _prison_check_ip6(pr, ia6);
3321 	mtx_unlock(&pr->pr_mtx);
3322 	return (error);
3323 }
3324 #endif
3325 
3326 /*
3327  * Check if a jail supports the given address family.
3328  *
3329  * Returns 0 if not jailed or the address family is supported, EAFNOSUPPORT
3330  * if not.
3331  */
3332 int
3333 prison_check_af(struct ucred *cred, int af)
3334 {
3335 	struct prison *pr;
3336 	int error;
3337 
3338 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
3339 
3340 	pr = cred->cr_prison;
3341 #ifdef VIMAGE
3342 	/* Prisons with their own network stack are not limited. */
3343 	if (prison_owns_vnet(cred))
3344 		return (0);
3345 #endif
3346 
3347 	error = 0;
3348 	switch (af)
3349 	{
3350 #ifdef INET
3351 	case AF_INET:
3352 		if (pr->pr_flags & PR_IP4)
3353 		{
3354 			mtx_lock(&pr->pr_mtx);
3355 			if ((pr->pr_flags & PR_IP4) && pr->pr_ip4 == NULL)
3356 				error = EAFNOSUPPORT;
3357 			mtx_unlock(&pr->pr_mtx);
3358 		}
3359 		break;
3360 #endif
3361 #ifdef INET6
3362 	case AF_INET6:
3363 		if (pr->pr_flags & PR_IP6)
3364 		{
3365 			mtx_lock(&pr->pr_mtx);
3366 			if ((pr->pr_flags & PR_IP6) && pr->pr_ip6 == NULL)
3367 				error = EAFNOSUPPORT;
3368 			mtx_unlock(&pr->pr_mtx);
3369 		}
3370 		break;
3371 #endif
3372 	case AF_LOCAL:
3373 	case AF_ROUTE:
3374 		break;
3375 	default:
3376 		if (!(pr->pr_allow & PR_ALLOW_SOCKET_AF))
3377 			error = EAFNOSUPPORT;
3378 	}
3379 	return (error);
3380 }
3381 
3382 /*
3383  * Check if given address belongs to the jail referenced by cred (wrapper to
3384  * prison_check_ip[46]).
3385  *
3386  * Returns 0 if jail doesn't restrict the address family or if address belongs
3387  * to jail, EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if
3388  * the jail doesn't allow the address family.  IPv4 Address passed in in NBO.
3389  */
3390 int
3391 prison_if(struct ucred *cred, struct sockaddr *sa)
3392 {
3393 #ifdef INET
3394 	struct sockaddr_in *sai;
3395 #endif
3396 #ifdef INET6
3397 	struct sockaddr_in6 *sai6;
3398 #endif
3399 	int error;
3400 
3401 	KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
3402 	KASSERT(sa != NULL, ("%s: sa is NULL", __func__));
3403 
3404 #ifdef VIMAGE
3405 	if (prison_owns_vnet(cred))
3406 		return (0);
3407 #endif
3408 
3409 	error = 0;
3410 	switch (sa->sa_family)
3411 	{
3412 #ifdef INET
3413 	case AF_INET:
3414 		sai = (struct sockaddr_in *)sa;
3415 		error = prison_check_ip4(cred, &sai->sin_addr);
3416 		break;
3417 #endif
3418 #ifdef INET6
3419 	case AF_INET6:
3420 		sai6 = (struct sockaddr_in6 *)sa;
3421 		error = prison_check_ip6(cred, &sai6->sin6_addr);
3422 		break;
3423 #endif
3424 	default:
3425 		if (!(cred->cr_prison->pr_allow & PR_ALLOW_SOCKET_AF))
3426 			error = EAFNOSUPPORT;
3427 	}
3428 	return (error);
3429 }
3430 
3431 /*
3432  * Return 0 if jails permit p1 to frob p2, otherwise ESRCH.
3433  */
3434 int
3435 prison_check(struct ucred *cred1, struct ucred *cred2)
3436 {
3437 
3438 	return ((cred1->cr_prison == cred2->cr_prison ||
3439 	    prison_ischild(cred1->cr_prison, cred2->cr_prison)) ? 0 : ESRCH);
3440 }
3441 
3442 /*
3443  * Return 1 if p2 is a child of p1, otherwise 0.
3444  */
3445 int
3446 prison_ischild(struct prison *pr1, struct prison *pr2)
3447 {
3448 
3449 	for (pr2 = pr2->pr_parent; pr2 != NULL; pr2 = pr2->pr_parent)
3450 		if (pr1 == pr2)
3451 			return (1);
3452 	return (0);
3453 }
3454 
3455 /*
3456  * Return 1 if the passed credential is in a jail, otherwise 0.
3457  */
3458 int
3459 jailed(struct ucred *cred)
3460 {
3461 
3462 	return (cred->cr_prison != &prison0);
3463 }
3464 
3465 /*
3466  * Return 1 if the passed credential is in a jail and that jail does not
3467  * have its own virtual network stack, otherwise 0.
3468  */
3469 int
3470 jailed_without_vnet(struct ucred *cred)
3471 {
3472 
3473 	if (!jailed(cred))
3474 		return (0);
3475 #ifdef VIMAGE
3476 	if (prison_owns_vnet(cred))
3477 		return (0);
3478 #endif
3479 
3480 	return (1);
3481 }
3482 
3483 /*
3484  * Return the correct hostname (domainname, et al) for the passed credential.
3485  */
3486 void
3487 getcredhostname(struct ucred *cred, char *buf, size_t size)
3488 {
3489 	struct prison *pr;
3490 
3491 	/*
3492 	 * A NULL credential can be used to shortcut to the physical
3493 	 * system's hostname.
3494 	 */
3495 	pr = (cred != NULL) ? cred->cr_prison : &prison0;
3496 	mtx_lock(&pr->pr_mtx);
3497 	strlcpy(buf, pr->pr_hostname, size);
3498 	mtx_unlock(&pr->pr_mtx);
3499 }
3500 
3501 void
3502 getcreddomainname(struct ucred *cred, char *buf, size_t size)
3503 {
3504 
3505 	mtx_lock(&cred->cr_prison->pr_mtx);
3506 	strlcpy(buf, cred->cr_prison->pr_domainname, size);
3507 	mtx_unlock(&cred->cr_prison->pr_mtx);
3508 }
3509 
3510 void
3511 getcredhostuuid(struct ucred *cred, char *buf, size_t size)
3512 {
3513 
3514 	mtx_lock(&cred->cr_prison->pr_mtx);
3515 	strlcpy(buf, cred->cr_prison->pr_hostuuid, size);
3516 	mtx_unlock(&cred->cr_prison->pr_mtx);
3517 }
3518 
3519 void
3520 getcredhostid(struct ucred *cred, unsigned long *hostid)
3521 {
3522 
3523 	mtx_lock(&cred->cr_prison->pr_mtx);
3524 	*hostid = cred->cr_prison->pr_hostid;
3525 	mtx_unlock(&cred->cr_prison->pr_mtx);
3526 }
3527 
3528 #ifdef VIMAGE
3529 /*
3530  * Determine whether the prison represented by cred owns
3531  * its vnet rather than having it inherited.
3532  *
3533  * Returns 1 in case the prison owns the vnet, 0 otherwise.
3534  */
3535 int
3536 prison_owns_vnet(struct ucred *cred)
3537 {
3538 
3539 	/*
3540 	 * vnets cannot be added/removed after jail creation,
3541 	 * so no need to lock here.
3542 	 */
3543 	return (cred->cr_prison->pr_flags & PR_VNET ? 1 : 0);
3544 }
3545 #endif
3546 
3547 /*
3548  * Determine whether the subject represented by cred can "see"
3549  * status of a mount point.
3550  * Returns: 0 for permitted, ENOENT otherwise.
3551  * XXX: This function should be called cr_canseemount() and should be
3552  *      placed in kern_prot.c.
3553  */
3554 int
3555 prison_canseemount(struct ucred *cred, struct mount *mp)
3556 {
3557 	struct prison *pr;
3558 	struct statfs *sp;
3559 	size_t len;
3560 
3561 	pr = cred->cr_prison;
3562 	if (pr->pr_enforce_statfs == 0)
3563 		return (0);
3564 	if (pr->pr_root->v_mount == mp)
3565 		return (0);
3566 	if (pr->pr_enforce_statfs == 2)
3567 		return (ENOENT);
3568 	/*
3569 	 * If jail's chroot directory is set to "/" we should be able to see
3570 	 * all mount-points from inside a jail.
3571 	 * This is ugly check, but this is the only situation when jail's
3572 	 * directory ends with '/'.
3573 	 */
3574 	if (strcmp(pr->pr_path, "/") == 0)
3575 		return (0);
3576 	len = strlen(pr->pr_path);
3577 	sp = &mp->mnt_stat;
3578 	if (strncmp(pr->pr_path, sp->f_mntonname, len) != 0)
3579 		return (ENOENT);
3580 	/*
3581 	 * Be sure that we don't have situation where jail's root directory
3582 	 * is "/some/path" and mount point is "/some/pathpath".
3583 	 */
3584 	if (sp->f_mntonname[len] != '\0' && sp->f_mntonname[len] != '/')
3585 		return (ENOENT);
3586 	return (0);
3587 }
3588 
3589 void
3590 prison_enforce_statfs(struct ucred *cred, struct mount *mp, struct statfs *sp)
3591 {
3592 	char jpath[MAXPATHLEN];
3593 	struct prison *pr;
3594 	size_t len;
3595 
3596 	pr = cred->cr_prison;
3597 	if (pr->pr_enforce_statfs == 0)
3598 		return;
3599 	if (prison_canseemount(cred, mp) != 0) {
3600 		bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
3601 		strlcpy(sp->f_mntonname, "[restricted]",
3602 		    sizeof(sp->f_mntonname));
3603 		return;
3604 	}
3605 	if (pr->pr_root->v_mount == mp) {
3606 		/*
3607 		 * Clear current buffer data, so we are sure nothing from
3608 		 * the valid path left there.
3609 		 */
3610 		bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
3611 		*sp->f_mntonname = '/';
3612 		return;
3613 	}
3614 	/*
3615 	 * If jail's chroot directory is set to "/" we should be able to see
3616 	 * all mount-points from inside a jail.
3617 	 */
3618 	if (strcmp(pr->pr_path, "/") == 0)
3619 		return;
3620 	len = strlen(pr->pr_path);
3621 	strlcpy(jpath, sp->f_mntonname + len, sizeof(jpath));
3622 	/*
3623 	 * Clear current buffer data, so we are sure nothing from
3624 	 * the valid path left there.
3625 	 */
3626 	bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
3627 	if (*jpath == '\0') {
3628 		/* Should never happen. */
3629 		*sp->f_mntonname = '/';
3630 	} else {
3631 		strlcpy(sp->f_mntonname, jpath, sizeof(sp->f_mntonname));
3632 	}
3633 }
3634 
3635 /*
3636  * Check with permission for a specific privilege is granted within jail.  We
3637  * have a specific list of accepted privileges; the rest are denied.
3638  */
3639 int
3640 prison_priv_check(struct ucred *cred, int priv)
3641 {
3642 
3643 	if (!jailed(cred))
3644 		return (0);
3645 
3646 #ifdef VIMAGE
3647 	/*
3648 	 * Privileges specific to prisons with a virtual network stack.
3649 	 * There might be a duplicate entry here in case the privilege
3650 	 * is only granted conditionally in the legacy jail case.
3651 	 */
3652 	switch (priv) {
3653 #ifdef notyet
3654 		/*
3655 		 * NFS-specific privileges.
3656 		 */
3657 	case PRIV_NFS_DAEMON:
3658 	case PRIV_NFS_LOCKD:
3659 #endif
3660 		/*
3661 		 * Network stack privileges.
3662 		 */
3663 	case PRIV_NET_BRIDGE:
3664 	case PRIV_NET_GRE:
3665 	case PRIV_NET_BPF:
3666 	case PRIV_NET_RAW:		/* Dup, cond. in legacy jail case. */
3667 	case PRIV_NET_ROUTE:
3668 	case PRIV_NET_TAP:
3669 	case PRIV_NET_SETIFMTU:
3670 	case PRIV_NET_SETIFFLAGS:
3671 	case PRIV_NET_SETIFCAP:
3672 	case PRIV_NET_SETIFDESCR:
3673 	case PRIV_NET_SETIFNAME	:
3674 	case PRIV_NET_SETIFMETRIC:
3675 	case PRIV_NET_SETIFPHYS:
3676 	case PRIV_NET_SETIFMAC:
3677 	case PRIV_NET_ADDMULTI:
3678 	case PRIV_NET_DELMULTI:
3679 	case PRIV_NET_HWIOCTL:
3680 	case PRIV_NET_SETLLADDR:
3681 	case PRIV_NET_ADDIFGROUP:
3682 	case PRIV_NET_DELIFGROUP:
3683 	case PRIV_NET_IFCREATE:
3684 	case PRIV_NET_IFDESTROY:
3685 	case PRIV_NET_ADDIFADDR:
3686 	case PRIV_NET_DELIFADDR:
3687 	case PRIV_NET_LAGG:
3688 	case PRIV_NET_GIF:
3689 	case PRIV_NET_SETIFVNET:
3690 	case PRIV_NET_SETIFFIB:
3691 
3692 		/*
3693 		 * 802.11-related privileges.
3694 		 */
3695 	case PRIV_NET80211_GETKEY:
3696 #ifdef notyet
3697 	case PRIV_NET80211_MANAGE:		/* XXX-BZ discuss with sam@ */
3698 #endif
3699 
3700 #ifdef notyet
3701 		/*
3702 		 * ATM privileges.
3703 		 */
3704 	case PRIV_NETATM_CFG:
3705 	case PRIV_NETATM_ADD:
3706 	case PRIV_NETATM_DEL:
3707 	case PRIV_NETATM_SET:
3708 
3709 		/*
3710 		 * Bluetooth privileges.
3711 		 */
3712 	case PRIV_NETBLUETOOTH_RAW:
3713 #endif
3714 
3715 		/*
3716 		 * Netgraph and netgraph module privileges.
3717 		 */
3718 	case PRIV_NETGRAPH_CONTROL:
3719 #ifdef notyet
3720 	case PRIV_NETGRAPH_TTY:
3721 #endif
3722 
3723 		/*
3724 		 * IPv4 and IPv6 privileges.
3725 		 */
3726 	case PRIV_NETINET_IPFW:
3727 	case PRIV_NETINET_DIVERT:
3728 	case PRIV_NETINET_PF:
3729 	case PRIV_NETINET_DUMMYNET:
3730 	case PRIV_NETINET_CARP:
3731 	case PRIV_NETINET_MROUTE:
3732 	case PRIV_NETINET_RAW:
3733 	case PRIV_NETINET_ADDRCTRL6:
3734 	case PRIV_NETINET_ND6:
3735 	case PRIV_NETINET_SCOPE6:
3736 	case PRIV_NETINET_ALIFETIME6:
3737 	case PRIV_NETINET_IPSEC:
3738 	case PRIV_NETINET_BINDANY:
3739 
3740 #ifdef notyet
3741 		/*
3742 		 * NCP privileges.
3743 		 */
3744 	case PRIV_NETNCP:
3745 
3746 		/*
3747 		 * SMB privileges.
3748 		 */
3749 	case PRIV_NETSMB:
3750 #endif
3751 
3752 	/*
3753 	 * No default: or deny here.
3754 	 * In case of no permit fall through to next switch().
3755 	 */
3756 		if (cred->cr_prison->pr_flags & PR_VNET)
3757 			return (0);
3758 	}
3759 #endif /* VIMAGE */
3760 
3761 	switch (priv) {
3762 
3763 		/*
3764 		 * Allow ktrace privileges for root in jail.
3765 		 */
3766 	case PRIV_KTRACE:
3767 
3768 #if 0
3769 		/*
3770 		 * Allow jailed processes to configure audit identity and
3771 		 * submit audit records (login, etc).  In the future we may
3772 		 * want to further refine the relationship between audit and
3773 		 * jail.
3774 		 */
3775 	case PRIV_AUDIT_GETAUDIT:
3776 	case PRIV_AUDIT_SETAUDIT:
3777 	case PRIV_AUDIT_SUBMIT:
3778 #endif
3779 
3780 		/*
3781 		 * Allow jailed processes to manipulate process UNIX
3782 		 * credentials in any way they see fit.
3783 		 */
3784 	case PRIV_CRED_SETUID:
3785 	case PRIV_CRED_SETEUID:
3786 	case PRIV_CRED_SETGID:
3787 	case PRIV_CRED_SETEGID:
3788 	case PRIV_CRED_SETGROUPS:
3789 	case PRIV_CRED_SETREUID:
3790 	case PRIV_CRED_SETREGID:
3791 	case PRIV_CRED_SETRESUID:
3792 	case PRIV_CRED_SETRESGID:
3793 
3794 		/*
3795 		 * Jail implements visibility constraints already, so allow
3796 		 * jailed root to override uid/gid-based constraints.
3797 		 */
3798 	case PRIV_SEEOTHERGIDS:
3799 	case PRIV_SEEOTHERUIDS:
3800 
3801 		/*
3802 		 * Jail implements inter-process debugging limits already, so
3803 		 * allow jailed root various debugging privileges.
3804 		 */
3805 	case PRIV_DEBUG_DIFFCRED:
3806 	case PRIV_DEBUG_SUGID:
3807 	case PRIV_DEBUG_UNPRIV:
3808 
3809 		/*
3810 		 * Allow jail to set various resource limits and login
3811 		 * properties, and for now, exceed process resource limits.
3812 		 */
3813 	case PRIV_PROC_LIMIT:
3814 	case PRIV_PROC_SETLOGIN:
3815 	case PRIV_PROC_SETRLIMIT:
3816 
3817 		/*
3818 		 * System V and POSIX IPC privileges are granted in jail.
3819 		 */
3820 	case PRIV_IPC_READ:
3821 	case PRIV_IPC_WRITE:
3822 	case PRIV_IPC_ADMIN:
3823 	case PRIV_IPC_MSGSIZE:
3824 	case PRIV_MQ_ADMIN:
3825 
3826 		/*
3827 		 * Jail operations within a jail work on child jails.
3828 		 */
3829 	case PRIV_JAIL_ATTACH:
3830 	case PRIV_JAIL_SET:
3831 	case PRIV_JAIL_REMOVE:
3832 
3833 		/*
3834 		 * Jail implements its own inter-process limits, so allow
3835 		 * root processes in jail to change scheduling on other
3836 		 * processes in the same jail.  Likewise for signalling.
3837 		 */
3838 	case PRIV_SCHED_DIFFCRED:
3839 	case PRIV_SCHED_CPUSET:
3840 	case PRIV_SIGNAL_DIFFCRED:
3841 	case PRIV_SIGNAL_SUGID:
3842 
3843 		/*
3844 		 * Allow jailed processes to write to sysctls marked as jail
3845 		 * writable.
3846 		 */
3847 	case PRIV_SYSCTL_WRITEJAIL:
3848 
3849 		/*
3850 		 * Allow root in jail to manage a variety of quota
3851 		 * properties.  These should likely be conditional on a
3852 		 * configuration option.
3853 		 */
3854 	case PRIV_VFS_GETQUOTA:
3855 	case PRIV_VFS_SETQUOTA:
3856 
3857 		/*
3858 		 * Since Jail relies on chroot() to implement file system
3859 		 * protections, grant many VFS privileges to root in jail.
3860 		 * Be careful to exclude mount-related and NFS-related
3861 		 * privileges.
3862 		 */
3863 	case PRIV_VFS_READ:
3864 	case PRIV_VFS_WRITE:
3865 	case PRIV_VFS_ADMIN:
3866 	case PRIV_VFS_EXEC:
3867 	case PRIV_VFS_LOOKUP:
3868 	case PRIV_VFS_BLOCKRESERVE:	/* XXXRW: Slightly surprising. */
3869 	case PRIV_VFS_CHFLAGS_DEV:
3870 	case PRIV_VFS_CHOWN:
3871 	case PRIV_VFS_CHROOT:
3872 	case PRIV_VFS_RETAINSUGID:
3873 	case PRIV_VFS_FCHROOT:
3874 	case PRIV_VFS_LINK:
3875 	case PRIV_VFS_SETGID:
3876 	case PRIV_VFS_STAT:
3877 	case PRIV_VFS_STICKYFILE:
3878 
3879 		/*
3880 		 * As in the non-jail case, non-root users are expected to be
3881 		 * able to read kernel/phyiscal memory (provided /dev/[k]mem
3882 		 * exists in the jail and they have permission to access it).
3883 		 */
3884 	case PRIV_KMEM_READ:
3885 		return (0);
3886 
3887 		/*
3888 		 * Depending on the global setting, allow privilege of
3889 		 * setting system flags.
3890 		 */
3891 	case PRIV_VFS_SYSFLAGS:
3892 		if (cred->cr_prison->pr_allow & PR_ALLOW_CHFLAGS)
3893 			return (0);
3894 		else
3895 			return (EPERM);
3896 
3897 		/*
3898 		 * Depending on the global setting, allow privilege of
3899 		 * mounting/unmounting file systems.
3900 		 */
3901 	case PRIV_VFS_MOUNT:
3902 	case PRIV_VFS_UNMOUNT:
3903 	case PRIV_VFS_MOUNT_NONUSER:
3904 	case PRIV_VFS_MOUNT_OWNER:
3905 		if (cred->cr_prison->pr_allow & PR_ALLOW_MOUNT &&
3906 		    cred->cr_prison->pr_enforce_statfs < 2)
3907 			return (0);
3908 		else
3909 			return (EPERM);
3910 
3911 		/*
3912 		 * Allow jailed root to bind reserved ports and reuse in-use
3913 		 * ports.
3914 		 */
3915 	case PRIV_NETINET_RESERVEDPORT:
3916 	case PRIV_NETINET_REUSEPORT:
3917 		return (0);
3918 
3919 		/*
3920 		 * Allow jailed root to set certian IPv4/6 (option) headers.
3921 		 */
3922 	case PRIV_NETINET_SETHDROPTS:
3923 		return (0);
3924 
3925 		/*
3926 		 * Conditionally allow creating raw sockets in jail.
3927 		 */
3928 	case PRIV_NETINET_RAW:
3929 		if (cred->cr_prison->pr_allow & PR_ALLOW_RAW_SOCKETS)
3930 			return (0);
3931 		else
3932 			return (EPERM);
3933 
3934 		/*
3935 		 * Since jail implements its own visibility limits on netstat
3936 		 * sysctls, allow getcred.  This allows identd to work in
3937 		 * jail.
3938 		 */
3939 	case PRIV_NETINET_GETCRED:
3940 		return (0);
3941 
3942 		/*
3943 		 * Allow jailed root to set loginclass.
3944 		 */
3945 	case PRIV_PROC_SETLOGINCLASS:
3946 		return (0);
3947 
3948 	default:
3949 		/*
3950 		 * In all remaining cases, deny the privilege request.  This
3951 		 * includes almost all network privileges, many system
3952 		 * configuration privileges.
3953 		 */
3954 		return (EPERM);
3955 	}
3956 }
3957 
3958 /*
3959  * Return the part of pr2's name that is relative to pr1, or the whole name
3960  * if it does not directly follow.
3961  */
3962 
3963 char *
3964 prison_name(struct prison *pr1, struct prison *pr2)
3965 {
3966 	char *name;
3967 
3968 	/* Jails see themselves as "0" (if they see themselves at all). */
3969 	if (pr1 == pr2)
3970 		return "0";
3971 	name = pr2->pr_name;
3972 	if (prison_ischild(pr1, pr2)) {
3973 		/*
3974 		 * pr1 isn't locked (and allprison_lock may not be either)
3975 		 * so its length can't be counted on.  But the number of dots
3976 		 * can be counted on - and counted.
3977 		 */
3978 		for (; pr1 != &prison0; pr1 = pr1->pr_parent)
3979 			name = strchr(name, '.') + 1;
3980 	}
3981 	return (name);
3982 }
3983 
3984 /*
3985  * Return the part of pr2's path that is relative to pr1, or the whole path
3986  * if it does not directly follow.
3987  */
3988 static char *
3989 prison_path(struct prison *pr1, struct prison *pr2)
3990 {
3991 	char *path1, *path2;
3992 	int len1;
3993 
3994 	path1 = pr1->pr_path;
3995 	path2 = pr2->pr_path;
3996 	if (!strcmp(path1, "/"))
3997 		return (path2);
3998 	len1 = strlen(path1);
3999 	if (strncmp(path1, path2, len1))
4000 		return (path2);
4001 	if (path2[len1] == '\0')
4002 		return "/";
4003 	if (path2[len1] == '/')
4004 		return (path2 + len1);
4005 	return (path2);
4006 }
4007 
4008 
4009 /*
4010  * Jail-related sysctls.
4011  */
4012 static SYSCTL_NODE(_security, OID_AUTO, jail, CTLFLAG_RW, 0,
4013     "Jails");
4014 
4015 static int
4016 sysctl_jail_list(SYSCTL_HANDLER_ARGS)
4017 {
4018 	struct xprison *xp;
4019 	struct prison *pr, *cpr;
4020 #ifdef INET
4021 	struct in_addr *ip4 = NULL;
4022 	int ip4s = 0;
4023 #endif
4024 #ifdef INET6
4025 	struct in6_addr *ip6 = NULL;
4026 	int ip6s = 0;
4027 #endif
4028 	int descend, error;
4029 
4030 	xp = malloc(sizeof(*xp), M_TEMP, M_WAITOK);
4031 	pr = req->td->td_ucred->cr_prison;
4032 	error = 0;
4033 	sx_slock(&allprison_lock);
4034 	FOREACH_PRISON_DESCENDANT(pr, cpr, descend) {
4035 #if defined(INET) || defined(INET6)
4036  again:
4037 #endif
4038 		mtx_lock(&cpr->pr_mtx);
4039 #ifdef INET
4040 		if (cpr->pr_ip4s > 0) {
4041 			if (ip4s < cpr->pr_ip4s) {
4042 				ip4s = cpr->pr_ip4s;
4043 				mtx_unlock(&cpr->pr_mtx);
4044 				ip4 = realloc(ip4, ip4s *
4045 				    sizeof(struct in_addr), M_TEMP, M_WAITOK);
4046 				goto again;
4047 			}
4048 			bcopy(cpr->pr_ip4, ip4,
4049 			    cpr->pr_ip4s * sizeof(struct in_addr));
4050 		}
4051 #endif
4052 #ifdef INET6
4053 		if (cpr->pr_ip6s > 0) {
4054 			if (ip6s < cpr->pr_ip6s) {
4055 				ip6s = cpr->pr_ip6s;
4056 				mtx_unlock(&cpr->pr_mtx);
4057 				ip6 = realloc(ip6, ip6s *
4058 				    sizeof(struct in6_addr), M_TEMP, M_WAITOK);
4059 				goto again;
4060 			}
4061 			bcopy(cpr->pr_ip6, ip6,
4062 			    cpr->pr_ip6s * sizeof(struct in6_addr));
4063 		}
4064 #endif
4065 		if (cpr->pr_ref == 0) {
4066 			mtx_unlock(&cpr->pr_mtx);
4067 			continue;
4068 		}
4069 		bzero(xp, sizeof(*xp));
4070 		xp->pr_version = XPRISON_VERSION;
4071 		xp->pr_id = cpr->pr_id;
4072 		xp->pr_state = cpr->pr_uref > 0
4073 		    ? PRISON_STATE_ALIVE : PRISON_STATE_DYING;
4074 		strlcpy(xp->pr_path, prison_path(pr, cpr), sizeof(xp->pr_path));
4075 		strlcpy(xp->pr_host, cpr->pr_hostname, sizeof(xp->pr_host));
4076 		strlcpy(xp->pr_name, prison_name(pr, cpr), sizeof(xp->pr_name));
4077 #ifdef INET
4078 		xp->pr_ip4s = cpr->pr_ip4s;
4079 #endif
4080 #ifdef INET6
4081 		xp->pr_ip6s = cpr->pr_ip6s;
4082 #endif
4083 		mtx_unlock(&cpr->pr_mtx);
4084 		error = SYSCTL_OUT(req, xp, sizeof(*xp));
4085 		if (error)
4086 			break;
4087 #ifdef INET
4088 		if (xp->pr_ip4s > 0) {
4089 			error = SYSCTL_OUT(req, ip4,
4090 			    xp->pr_ip4s * sizeof(struct in_addr));
4091 			if (error)
4092 				break;
4093 		}
4094 #endif
4095 #ifdef INET6
4096 		if (xp->pr_ip6s > 0) {
4097 			error = SYSCTL_OUT(req, ip6,
4098 			    xp->pr_ip6s * sizeof(struct in6_addr));
4099 			if (error)
4100 				break;
4101 		}
4102 #endif
4103 	}
4104 	sx_sunlock(&allprison_lock);
4105 	free(xp, M_TEMP);
4106 #ifdef INET
4107 	free(ip4, M_TEMP);
4108 #endif
4109 #ifdef INET6
4110 	free(ip6, M_TEMP);
4111 #endif
4112 	return (error);
4113 }
4114 
4115 SYSCTL_OID(_security_jail, OID_AUTO, list,
4116     CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
4117     sysctl_jail_list, "S", "List of active jails");
4118 
4119 static int
4120 sysctl_jail_jailed(SYSCTL_HANDLER_ARGS)
4121 {
4122 	int error, injail;
4123 
4124 	injail = jailed(req->td->td_ucred);
4125 	error = SYSCTL_OUT(req, &injail, sizeof(injail));
4126 
4127 	return (error);
4128 }
4129 
4130 SYSCTL_PROC(_security_jail, OID_AUTO, jailed,
4131     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
4132     sysctl_jail_jailed, "I", "Process in jail?");
4133 
4134 static int
4135 sysctl_jail_vnet(SYSCTL_HANDLER_ARGS)
4136 {
4137 	int error, havevnet;
4138 #ifdef VIMAGE
4139 	struct ucred *cred = req->td->td_ucred;
4140 
4141 	havevnet = jailed(cred) && prison_owns_vnet(cred);
4142 #else
4143 	havevnet = 0;
4144 #endif
4145 	error = SYSCTL_OUT(req, &havevnet, sizeof(havevnet));
4146 
4147 	return (error);
4148 }
4149 
4150 SYSCTL_PROC(_security_jail, OID_AUTO, vnet,
4151     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
4152     sysctl_jail_vnet, "I", "Jail owns VNET?");
4153 
4154 #if defined(INET) || defined(INET6)
4155 SYSCTL_UINT(_security_jail, OID_AUTO, jail_max_af_ips, CTLFLAG_RW,
4156     &jail_max_af_ips, 0,
4157     "Number of IP addresses a jail may have at most per address family");
4158 #endif
4159 
4160 /*
4161  * Default parameters for jail(2) compatability.  For historical reasons,
4162  * the sysctl names have varying similarity to the parameter names.  Prisons
4163  * just see their own parameters, and can't change them.
4164  */
4165 static int
4166 sysctl_jail_default_allow(SYSCTL_HANDLER_ARGS)
4167 {
4168 	struct prison *pr;
4169 	int allow, error, i;
4170 
4171 	pr = req->td->td_ucred->cr_prison;
4172 	allow = (pr == &prison0) ? jail_default_allow : pr->pr_allow;
4173 
4174 	/* Get the current flag value, and convert it to a boolean. */
4175 	i = (allow & arg2) ? 1 : 0;
4176 	if (arg1 != NULL)
4177 		i = !i;
4178 	error = sysctl_handle_int(oidp, &i, 0, req);
4179 	if (error || !req->newptr)
4180 		return (error);
4181 	i = i ? arg2 : 0;
4182 	if (arg1 != NULL)
4183 		i ^= arg2;
4184 	/*
4185 	 * The sysctls don't have CTLFLAGS_PRISON, so assume prison0
4186 	 * for writing.
4187 	 */
4188 	mtx_lock(&prison0.pr_mtx);
4189 	jail_default_allow = (jail_default_allow & ~arg2) | i;
4190 	mtx_unlock(&prison0.pr_mtx);
4191 	return (0);
4192 }
4193 
4194 SYSCTL_PROC(_security_jail, OID_AUTO, set_hostname_allowed,
4195     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4196     NULL, PR_ALLOW_SET_HOSTNAME, sysctl_jail_default_allow, "I",
4197     "Processes in jail can set their hostnames");
4198 SYSCTL_PROC(_security_jail, OID_AUTO, socket_unixiproute_only,
4199     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4200     (void *)1, PR_ALLOW_SOCKET_AF, sysctl_jail_default_allow, "I",
4201     "Processes in jail are limited to creating UNIX/IP/route sockets only");
4202 SYSCTL_PROC(_security_jail, OID_AUTO, sysvipc_allowed,
4203     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4204     NULL, PR_ALLOW_SYSVIPC, sysctl_jail_default_allow, "I",
4205     "Processes in jail can use System V IPC primitives");
4206 SYSCTL_PROC(_security_jail, OID_AUTO, allow_raw_sockets,
4207     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4208     NULL, PR_ALLOW_RAW_SOCKETS, sysctl_jail_default_allow, "I",
4209     "Prison root can create raw sockets");
4210 SYSCTL_PROC(_security_jail, OID_AUTO, chflags_allowed,
4211     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4212     NULL, PR_ALLOW_CHFLAGS, sysctl_jail_default_allow, "I",
4213     "Processes in jail can alter system file flags");
4214 SYSCTL_PROC(_security_jail, OID_AUTO, mount_allowed,
4215     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4216     NULL, PR_ALLOW_MOUNT, sysctl_jail_default_allow, "I",
4217     "Processes in jail can mount/unmount jail-friendly file systems");
4218 SYSCTL_PROC(_security_jail, OID_AUTO, mount_devfs_allowed,
4219     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4220     NULL, PR_ALLOW_MOUNT_DEVFS, sysctl_jail_default_allow, "I",
4221     "Processes in jail can mount the devfs file system");
4222 SYSCTL_PROC(_security_jail, OID_AUTO, mount_nullfs_allowed,
4223     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4224     NULL, PR_ALLOW_MOUNT_NULLFS, sysctl_jail_default_allow, "I",
4225     "Processes in jail can mount the nullfs file system");
4226 SYSCTL_PROC(_security_jail, OID_AUTO, mount_procfs_allowed,
4227     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4228     NULL, PR_ALLOW_MOUNT_PROCFS, sysctl_jail_default_allow, "I",
4229     "Processes in jail can mount the procfs file system");
4230 SYSCTL_PROC(_security_jail, OID_AUTO, mount_tmpfs_allowed,
4231     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4232     NULL, PR_ALLOW_MOUNT_TMPFS, sysctl_jail_default_allow, "I",
4233     "Processes in jail can mount the tmpfs file system");
4234 SYSCTL_PROC(_security_jail, OID_AUTO, mount_zfs_allowed,
4235     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4236     NULL, PR_ALLOW_MOUNT_ZFS, sysctl_jail_default_allow, "I",
4237     "Processes in jail can mount the zfs file system");
4238 
4239 static int
4240 sysctl_jail_default_level(SYSCTL_HANDLER_ARGS)
4241 {
4242 	struct prison *pr;
4243 	int level, error;
4244 
4245 	pr = req->td->td_ucred->cr_prison;
4246 	level = (pr == &prison0) ? *(int *)arg1 : *(int *)((char *)pr + arg2);
4247 	error = sysctl_handle_int(oidp, &level, 0, req);
4248 	if (error || !req->newptr)
4249 		return (error);
4250 	*(int *)arg1 = level;
4251 	return (0);
4252 }
4253 
4254 SYSCTL_PROC(_security_jail, OID_AUTO, enforce_statfs,
4255     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
4256     &jail_default_enforce_statfs, offsetof(struct prison, pr_enforce_statfs),
4257     sysctl_jail_default_level, "I",
4258     "Processes in jail cannot see all mounted file systems");
4259 
4260 SYSCTL_PROC(_security_jail, OID_AUTO, devfs_ruleset,
4261     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE,
4262     &jail_default_devfs_rsnum, offsetof(struct prison, pr_devfs_rsnum),
4263     sysctl_jail_default_level, "I",
4264     "Ruleset for the devfs filesystem in jail");
4265 
4266 /*
4267  * Nodes to describe jail parameters.  Maximum length of string parameters
4268  * is returned in the string itself, and the other parameters exist merely
4269  * to make themselves and their types known.
4270  */
4271 SYSCTL_NODE(_security_jail, OID_AUTO, param, CTLFLAG_RW, 0,
4272     "Jail parameters");
4273 
4274 int
4275 sysctl_jail_param(SYSCTL_HANDLER_ARGS)
4276 {
4277 	int i;
4278 	long l;
4279 	size_t s;
4280 	char numbuf[12];
4281 
4282 	switch (oidp->oid_kind & CTLTYPE)
4283 	{
4284 	case CTLTYPE_LONG:
4285 	case CTLTYPE_ULONG:
4286 		l = 0;
4287 #ifdef SCTL_MASK32
4288 		if (!(req->flags & SCTL_MASK32))
4289 #endif
4290 			return (SYSCTL_OUT(req, &l, sizeof(l)));
4291 	case CTLTYPE_INT:
4292 	case CTLTYPE_UINT:
4293 		i = 0;
4294 		return (SYSCTL_OUT(req, &i, sizeof(i)));
4295 	case CTLTYPE_STRING:
4296 		snprintf(numbuf, sizeof(numbuf), "%jd", (intmax_t)arg2);
4297 		return
4298 		    (sysctl_handle_string(oidp, numbuf, sizeof(numbuf), req));
4299 	case CTLTYPE_STRUCT:
4300 		s = (size_t)arg2;
4301 		return (SYSCTL_OUT(req, &s, sizeof(s)));
4302 	}
4303 	return (0);
4304 }
4305 
4306 SYSCTL_JAIL_PARAM(, jid, CTLTYPE_INT | CTLFLAG_RDTUN, "I", "Jail ID");
4307 SYSCTL_JAIL_PARAM(, parent, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail parent ID");
4308 SYSCTL_JAIL_PARAM_STRING(, name, CTLFLAG_RW, MAXHOSTNAMELEN, "Jail name");
4309 SYSCTL_JAIL_PARAM_STRING(, path, CTLFLAG_RDTUN, MAXPATHLEN, "Jail root path");
4310 SYSCTL_JAIL_PARAM(, securelevel, CTLTYPE_INT | CTLFLAG_RW,
4311     "I", "Jail secure level");
4312 SYSCTL_JAIL_PARAM(, enforce_statfs, CTLTYPE_INT | CTLFLAG_RW,
4313     "I", "Jail cannot see all mounted file systems");
4314 SYSCTL_JAIL_PARAM(, devfs_ruleset, CTLTYPE_INT | CTLFLAG_RW,
4315     "I", "Ruleset for in-jail devfs mounts");
4316 SYSCTL_JAIL_PARAM(, persist, CTLTYPE_INT | CTLFLAG_RW,
4317     "B", "Jail persistence");
4318 #ifdef VIMAGE
4319 SYSCTL_JAIL_PARAM(, vnet, CTLTYPE_INT | CTLFLAG_RDTUN,
4320     "E,jailsys", "Virtual network stack");
4321 #endif
4322 SYSCTL_JAIL_PARAM(, dying, CTLTYPE_INT | CTLFLAG_RD,
4323     "B", "Jail is in the process of shutting down");
4324 
4325 SYSCTL_JAIL_PARAM_NODE(children, "Number of child jails");
4326 SYSCTL_JAIL_PARAM(_children, cur, CTLTYPE_INT | CTLFLAG_RD,
4327     "I", "Current number of child jails");
4328 SYSCTL_JAIL_PARAM(_children, max, CTLTYPE_INT | CTLFLAG_RW,
4329     "I", "Maximum number of child jails");
4330 
4331 SYSCTL_JAIL_PARAM_SYS_NODE(host, CTLFLAG_RW, "Jail host info");
4332 SYSCTL_JAIL_PARAM_STRING(_host, hostname, CTLFLAG_RW, MAXHOSTNAMELEN,
4333     "Jail hostname");
4334 SYSCTL_JAIL_PARAM_STRING(_host, domainname, CTLFLAG_RW, MAXHOSTNAMELEN,
4335     "Jail NIS domainname");
4336 SYSCTL_JAIL_PARAM_STRING(_host, hostuuid, CTLFLAG_RW, HOSTUUIDLEN,
4337     "Jail host UUID");
4338 SYSCTL_JAIL_PARAM(_host, hostid, CTLTYPE_ULONG | CTLFLAG_RW,
4339     "LU", "Jail host ID");
4340 
4341 SYSCTL_JAIL_PARAM_NODE(cpuset, "Jail cpuset");
4342 SYSCTL_JAIL_PARAM(_cpuset, id, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail cpuset ID");
4343 
4344 #ifdef INET
4345 SYSCTL_JAIL_PARAM_SYS_NODE(ip4, CTLFLAG_RDTUN,
4346     "Jail IPv4 address virtualization");
4347 SYSCTL_JAIL_PARAM_STRUCT(_ip4, addr, CTLFLAG_RW, sizeof(struct in_addr),
4348     "S,in_addr,a", "Jail IPv4 addresses");
4349 SYSCTL_JAIL_PARAM(_ip4, saddrsel, CTLTYPE_INT | CTLFLAG_RW,
4350     "B", "Do (not) use IPv4 source address selection rather than the "
4351     "primary jail IPv4 address.");
4352 #endif
4353 #ifdef INET6
4354 SYSCTL_JAIL_PARAM_SYS_NODE(ip6, CTLFLAG_RDTUN,
4355     "Jail IPv6 address virtualization");
4356 SYSCTL_JAIL_PARAM_STRUCT(_ip6, addr, CTLFLAG_RW, sizeof(struct in6_addr),
4357     "S,in6_addr,a", "Jail IPv6 addresses");
4358 SYSCTL_JAIL_PARAM(_ip6, saddrsel, CTLTYPE_INT | CTLFLAG_RW,
4359     "B", "Do (not) use IPv6 source address selection rather than the "
4360     "primary jail IPv6 address.");
4361 #endif
4362 
4363 SYSCTL_JAIL_PARAM_NODE(allow, "Jail permission flags");
4364 SYSCTL_JAIL_PARAM(_allow, set_hostname, CTLTYPE_INT | CTLFLAG_RW,
4365     "B", "Jail may set hostname");
4366 SYSCTL_JAIL_PARAM(_allow, sysvipc, CTLTYPE_INT | CTLFLAG_RW,
4367     "B", "Jail may use SYSV IPC");
4368 SYSCTL_JAIL_PARAM(_allow, raw_sockets, CTLTYPE_INT | CTLFLAG_RW,
4369     "B", "Jail may create raw sockets");
4370 SYSCTL_JAIL_PARAM(_allow, chflags, CTLTYPE_INT | CTLFLAG_RW,
4371     "B", "Jail may alter system file flags");
4372 SYSCTL_JAIL_PARAM(_allow, quotas, CTLTYPE_INT | CTLFLAG_RW,
4373     "B", "Jail may set file quotas");
4374 SYSCTL_JAIL_PARAM(_allow, socket_af, CTLTYPE_INT | CTLFLAG_RW,
4375     "B", "Jail may create sockets other than just UNIX/IPv4/IPv6/route");
4376 
4377 SYSCTL_JAIL_PARAM_SUBNODE(allow, mount, "Jail mount/unmount permission flags");
4378 SYSCTL_JAIL_PARAM(_allow_mount, , CTLTYPE_INT | CTLFLAG_RW,
4379     "B", "Jail may mount/unmount jail-friendly file systems in general");
4380 SYSCTL_JAIL_PARAM(_allow_mount, devfs, CTLTYPE_INT | CTLFLAG_RW,
4381     "B", "Jail may mount the devfs file system");
4382 SYSCTL_JAIL_PARAM(_allow_mount, nullfs, CTLTYPE_INT | CTLFLAG_RW,
4383     "B", "Jail may mount the nullfs file system");
4384 SYSCTL_JAIL_PARAM(_allow_mount, procfs, CTLTYPE_INT | CTLFLAG_RW,
4385     "B", "Jail may mount the procfs file system");
4386 SYSCTL_JAIL_PARAM(_allow_mount, tmpfs, CTLTYPE_INT | CTLFLAG_RW,
4387     "B", "Jail may mount the tmpfs file system");
4388 SYSCTL_JAIL_PARAM(_allow_mount, zfs, CTLTYPE_INT | CTLFLAG_RW,
4389     "B", "Jail may mount the zfs file system");
4390 
4391 void
4392 prison_racct_foreach(void (*callback)(struct racct *racct,
4393     void *arg2, void *arg3), void *arg2, void *arg3)
4394 {
4395 	struct prison_racct *prr;
4396 
4397 	sx_slock(&allprison_lock);
4398 	LIST_FOREACH(prr, &allprison_racct, prr_next)
4399 		(callback)(prr->prr_racct, arg2, arg3);
4400 	sx_sunlock(&allprison_lock);
4401 }
4402 
4403 static struct prison_racct *
4404 prison_racct_find_locked(const char *name)
4405 {
4406 	struct prison_racct *prr;
4407 
4408 	sx_assert(&allprison_lock, SA_XLOCKED);
4409 
4410 	if (name[0] == '\0' || strlen(name) >= MAXHOSTNAMELEN)
4411 		return (NULL);
4412 
4413 	LIST_FOREACH(prr, &allprison_racct, prr_next) {
4414 		if (strcmp(name, prr->prr_name) != 0)
4415 			continue;
4416 
4417 		/* Found prison_racct with a matching name? */
4418 		prison_racct_hold(prr);
4419 		return (prr);
4420 	}
4421 
4422 	/* Add new prison_racct. */
4423 	prr = malloc(sizeof(*prr), M_PRISON_RACCT, M_ZERO | M_WAITOK);
4424 	racct_create(&prr->prr_racct);
4425 
4426 	strcpy(prr->prr_name, name);
4427 	refcount_init(&prr->prr_refcount, 1);
4428 	LIST_INSERT_HEAD(&allprison_racct, prr, prr_next);
4429 
4430 	return (prr);
4431 }
4432 
4433 struct prison_racct *
4434 prison_racct_find(const char *name)
4435 {
4436 	struct prison_racct *prr;
4437 
4438 	sx_xlock(&allprison_lock);
4439 	prr = prison_racct_find_locked(name);
4440 	sx_xunlock(&allprison_lock);
4441 	return (prr);
4442 }
4443 
4444 void
4445 prison_racct_hold(struct prison_racct *prr)
4446 {
4447 
4448 	refcount_acquire(&prr->prr_refcount);
4449 }
4450 
4451 static void
4452 prison_racct_free_locked(struct prison_racct *prr)
4453 {
4454 
4455 	sx_assert(&allprison_lock, SA_XLOCKED);
4456 
4457 	if (refcount_release(&prr->prr_refcount)) {
4458 		racct_destroy(&prr->prr_racct);
4459 		LIST_REMOVE(prr, prr_next);
4460 		free(prr, M_PRISON_RACCT);
4461 	}
4462 }
4463 
4464 void
4465 prison_racct_free(struct prison_racct *prr)
4466 {
4467 	int old;
4468 
4469 	sx_assert(&allprison_lock, SA_UNLOCKED);
4470 
4471 	old = prr->prr_refcount;
4472 	if (old > 1 && atomic_cmpset_int(&prr->prr_refcount, old, old - 1))
4473 		return;
4474 
4475 	sx_xlock(&allprison_lock);
4476 	prison_racct_free_locked(prr);
4477 	sx_xunlock(&allprison_lock);
4478 }
4479 
4480 #ifdef RACCT
4481 static void
4482 prison_racct_attach(struct prison *pr)
4483 {
4484 	struct prison_racct *prr;
4485 
4486 	sx_assert(&allprison_lock, SA_XLOCKED);
4487 
4488 	prr = prison_racct_find_locked(pr->pr_name);
4489 	KASSERT(prr != NULL, ("cannot find prison_racct"));
4490 
4491 	pr->pr_prison_racct = prr;
4492 }
4493 
4494 /*
4495  * Handle jail renaming.  From the racct point of view, renaming means
4496  * moving from one prison_racct to another.
4497  */
4498 static void
4499 prison_racct_modify(struct prison *pr)
4500 {
4501 	struct proc *p;
4502 	struct ucred *cred;
4503 	struct prison_racct *oldprr;
4504 
4505 	sx_slock(&allproc_lock);
4506 	sx_xlock(&allprison_lock);
4507 
4508 	if (strcmp(pr->pr_name, pr->pr_prison_racct->prr_name) == 0) {
4509 		sx_xunlock(&allprison_lock);
4510 		sx_sunlock(&allproc_lock);
4511 		return;
4512 	}
4513 
4514 	oldprr = pr->pr_prison_racct;
4515 	pr->pr_prison_racct = NULL;
4516 
4517 	prison_racct_attach(pr);
4518 
4519 	/*
4520 	 * Move resource utilisation records.
4521 	 */
4522 	racct_move(pr->pr_prison_racct->prr_racct, oldprr->prr_racct);
4523 
4524 	/*
4525 	 * Force rctl to reattach rules to processes.
4526 	 */
4527 	FOREACH_PROC_IN_SYSTEM(p) {
4528 		PROC_LOCK(p);
4529 		cred = crhold(p->p_ucred);
4530 		PROC_UNLOCK(p);
4531 		racct_proc_ucred_changed(p, cred, cred);
4532 		crfree(cred);
4533 	}
4534 
4535 	sx_sunlock(&allproc_lock);
4536 	prison_racct_free_locked(oldprr);
4537 	sx_xunlock(&allprison_lock);
4538 }
4539 
4540 static void
4541 prison_racct_detach(struct prison *pr)
4542 {
4543 
4544 	sx_assert(&allprison_lock, SA_UNLOCKED);
4545 
4546 	if (pr->pr_prison_racct == NULL)
4547 		return;
4548 	prison_racct_free(pr->pr_prison_racct);
4549 	pr->pr_prison_racct = NULL;
4550 }
4551 #endif /* RACCT */
4552 
4553 #ifdef DDB
4554 
4555 static void
4556 db_show_prison(struct prison *pr)
4557 {
4558 	int fi;
4559 #if defined(INET) || defined(INET6)
4560 	int ii;
4561 #endif
4562 	unsigned jsf;
4563 #ifdef INET6
4564 	char ip6buf[INET6_ADDRSTRLEN];
4565 #endif
4566 
4567 	db_printf("prison %p:\n", pr);
4568 	db_printf(" jid             = %d\n", pr->pr_id);
4569 	db_printf(" name            = %s\n", pr->pr_name);
4570 	db_printf(" parent          = %p\n", pr->pr_parent);
4571 	db_printf(" ref             = %d\n", pr->pr_ref);
4572 	db_printf(" uref            = %d\n", pr->pr_uref);
4573 	db_printf(" path            = %s\n", pr->pr_path);
4574 	db_printf(" cpuset          = %d\n", pr->pr_cpuset
4575 	    ? pr->pr_cpuset->cs_id : -1);
4576 #ifdef VIMAGE
4577 	db_printf(" vnet            = %p\n", pr->pr_vnet);
4578 #endif
4579 	db_printf(" root            = %p\n", pr->pr_root);
4580 	db_printf(" securelevel     = %d\n", pr->pr_securelevel);
4581 	db_printf(" devfs_rsnum     = %d\n", pr->pr_devfs_rsnum);
4582 	db_printf(" children.max    = %d\n", pr->pr_childmax);
4583 	db_printf(" children.cur    = %d\n", pr->pr_childcount);
4584 	db_printf(" child           = %p\n", LIST_FIRST(&pr->pr_children));
4585 	db_printf(" sibling         = %p\n", LIST_NEXT(pr, pr_sibling));
4586 	db_printf(" flags           = 0x%x", pr->pr_flags);
4587 	for (fi = 0; fi < sizeof(pr_flag_names) / sizeof(pr_flag_names[0]);
4588 	    fi++)
4589 		if (pr_flag_names[fi] != NULL && (pr->pr_flags & (1 << fi)))
4590 			db_printf(" %s", pr_flag_names[fi]);
4591 	for (fi = 0; fi < sizeof(pr_flag_jailsys) / sizeof(pr_flag_jailsys[0]);
4592 	    fi++) {
4593 		jsf = pr->pr_flags &
4594 		    (pr_flag_jailsys[fi].disable | pr_flag_jailsys[fi].new);
4595 		db_printf(" %-16s= %s\n", pr_flag_jailsys[fi].name,
4596 		    pr_flag_jailsys[fi].disable &&
4597 		      (jsf == pr_flag_jailsys[fi].disable) ? "disable"
4598 		    : (jsf == pr_flag_jailsys[fi].new) ? "new"
4599 		    : "inherit");
4600 	}
4601 	db_printf(" allow           = 0x%x", pr->pr_allow);
4602 	for (fi = 0; fi < sizeof(pr_allow_names) / sizeof(pr_allow_names[0]);
4603 	    fi++)
4604 		if (pr_allow_names[fi] != NULL && (pr->pr_allow & (1 << fi)))
4605 			db_printf(" %s", pr_allow_names[fi]);
4606 	db_printf("\n");
4607 	db_printf(" enforce_statfs  = %d\n", pr->pr_enforce_statfs);
4608 	db_printf(" host.hostname   = %s\n", pr->pr_hostname);
4609 	db_printf(" host.domainname = %s\n", pr->pr_domainname);
4610 	db_printf(" host.hostuuid   = %s\n", pr->pr_hostuuid);
4611 	db_printf(" host.hostid     = %lu\n", pr->pr_hostid);
4612 #ifdef INET
4613 	db_printf(" ip4s            = %d\n", pr->pr_ip4s);
4614 	for (ii = 0; ii < pr->pr_ip4s; ii++)
4615 		db_printf(" %s %s\n",
4616 		    ii == 0 ? "ip4.addr        =" : "                 ",
4617 		    inet_ntoa(pr->pr_ip4[ii]));
4618 #endif
4619 #ifdef INET6
4620 	db_printf(" ip6s            = %d\n", pr->pr_ip6s);
4621 	for (ii = 0; ii < pr->pr_ip6s; ii++)
4622 		db_printf(" %s %s\n",
4623 		    ii == 0 ? "ip6.addr        =" : "                 ",
4624 		    ip6_sprintf(ip6buf, &pr->pr_ip6[ii]));
4625 #endif
4626 }
4627 
4628 DB_SHOW_COMMAND(prison, db_show_prison_command)
4629 {
4630 	struct prison *pr;
4631 
4632 	if (!have_addr) {
4633 		/*
4634 		 * Show all prisons in the list, and prison0 which is not
4635 		 * listed.
4636 		 */
4637 		db_show_prison(&prison0);
4638 		if (!db_pager_quit) {
4639 			TAILQ_FOREACH(pr, &allprison, pr_list) {
4640 				db_show_prison(pr);
4641 				if (db_pager_quit)
4642 					break;
4643 			}
4644 		}
4645 		return;
4646 	}
4647 
4648 	if (addr == 0)
4649 		pr = &prison0;
4650 	else {
4651 		/* Look for a prison with the ID and with references. */
4652 		TAILQ_FOREACH(pr, &allprison, pr_list)
4653 			if (pr->pr_id == addr && pr->pr_ref > 0)
4654 				break;
4655 		if (pr == NULL)
4656 			/* Look again, without requiring a reference. */
4657 			TAILQ_FOREACH(pr, &allprison, pr_list)
4658 				if (pr->pr_id == addr)
4659 					break;
4660 		if (pr == NULL)
4661 			/* Assume address points to a valid prison. */
4662 			pr = (struct prison *)addr;
4663 	}
4664 	db_show_prison(pr);
4665 }
4666 
4667 #endif /* DDB */
4668