1 /*- 2 * Copyright (c) 1999 Poul-Henning Kamp. 3 * Copyright (c) 2009-2012 James Gritton 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25 * SUCH DAMAGE. 26 */ 27 28 #include <sys/cdefs.h> 29 __FBSDID("$FreeBSD$"); 30 31 #include <sys/types.h> 32 #include <sys/stat.h> 33 #include <sys/socket.h> 34 #include <sys/sysctl.h> 35 36 #include <arpa/inet.h> 37 #include <netinet/in.h> 38 39 #include <err.h> 40 #include <errno.h> 41 #include <stdarg.h> 42 #include <stdio.h> 43 #include <stdlib.h> 44 #include <string.h> 45 #include <unistd.h> 46 47 #include "jailp.h" 48 49 #define JP_RDTUN(jp) (((jp)->jp_ctltype & CTLFLAG_RDTUN) == CTLFLAG_RDTUN) 50 51 struct permspec { 52 const char *name; 53 enum intparam ipnum; 54 int rev; 55 }; 56 57 const char *cfname; 58 int iflag; 59 int note_remove; 60 int verbose; 61 62 static void clear_persist(struct cfjail *j); 63 static int update_jail(struct cfjail *j); 64 static int rdtun_params(struct cfjail *j, int dofail); 65 static void running_jid(struct cfjail *j, int dflag); 66 static void jail_quoted_warnx(const struct cfjail *j, const char *name_msg, 67 const char *noname_msg); 68 static int jailparam_set_note(const struct cfjail *j, struct jailparam *jp, 69 unsigned njp, int flags); 70 static void print_jail(FILE *fp, struct cfjail *j, int oldcl); 71 static void print_param(FILE *fp, const struct cfparam *p, int sep, int doname); 72 static void quoted_print(FILE *fp, char *str); 73 static void usage(void); 74 75 static struct permspec perm_sysctl[] = { 76 { "security.jail.set_hostname_allowed", KP_ALLOW_SET_HOSTNAME, 0 }, 77 { "security.jail.sysvipc_allowed", KP_ALLOW_SYSVIPC, 0 }, 78 { "security.jail.allow_raw_sockets", KP_ALLOW_RAW_SOCKETS, 0 }, 79 { "security.jail.chflags_allowed", KP_ALLOW_CHFLAGS, 0 }, 80 { "security.jail.mount_allowed", KP_ALLOW_MOUNT, 0 }, 81 { "security.jail.socket_unixiproute_only", KP_ALLOW_SOCKET_AF, 1 }, 82 }; 83 84 static const enum intparam startcommands[] = { 85 IP__NULL, 86 #ifdef INET 87 IP__IP4_IFADDR, 88 #endif 89 #ifdef INET6 90 IP__IP6_IFADDR, 91 #endif 92 IP_MOUNT, 93 IP__MOUNT_FROM_FSTAB, 94 IP_MOUNT_DEVFS, 95 IP_EXEC_PRESTART, 96 IP__OP, 97 IP_VNET_INTERFACE, 98 IP_EXEC_START, 99 IP_COMMAND, 100 IP_EXEC_POSTSTART, 101 IP__NULL 102 }; 103 104 static const enum intparam stopcommands[] = { 105 IP__NULL, 106 IP_EXEC_PRESTOP, 107 IP_EXEC_STOP, 108 IP_STOP_TIMEOUT, 109 IP__OP, 110 IP_EXEC_POSTSTOP, 111 IP_MOUNT_DEVFS, 112 IP__MOUNT_FROM_FSTAB, 113 IP_MOUNT, 114 #ifdef INET6 115 IP__IP6_IFADDR, 116 #endif 117 #ifdef INET 118 IP__IP4_IFADDR, 119 #endif 120 IP__NULL 121 }; 122 123 int 124 main(int argc, char **argv) 125 { 126 struct stat st; 127 FILE *jfp; 128 struct cfjail *j; 129 char *JidFile; 130 size_t sysvallen; 131 unsigned op, pi; 132 int ch, docf, error, i, oldcl, sysval; 133 int dflag, Rflag; 134 char enforce_statfs[4]; 135 #if defined(INET) || defined(INET6) 136 char *cs, *ncs; 137 #endif 138 #if defined(INET) && defined(INET6) 139 struct in6_addr addr6; 140 #endif 141 142 op = 0; 143 dflag = Rflag = 0; 144 docf = 1; 145 cfname = CONF_FILE; 146 JidFile = NULL; 147 148 while ((ch = getopt(argc, argv, "cdf:hiJ:lmn:p:qrRs:u:U:v")) != -1) { 149 switch (ch) { 150 case 'c': 151 op |= JF_START; 152 break; 153 case 'd': 154 dflag = 1; 155 break; 156 case 'f': 157 cfname = optarg; 158 break; 159 case 'h': 160 #if defined(INET) || defined(INET6) 161 add_param(NULL, NULL, IP_IP_HOSTNAME, NULL); 162 #endif 163 docf = 0; 164 break; 165 case 'i': 166 iflag = 1; 167 verbose = -1; 168 break; 169 case 'J': 170 JidFile = optarg; 171 break; 172 case 'l': 173 add_param(NULL, NULL, IP_EXEC_CLEAN, NULL); 174 docf = 0; 175 break; 176 case 'm': 177 op |= JF_SET; 178 break; 179 case 'n': 180 add_param(NULL, NULL, KP_NAME, optarg); 181 docf = 0; 182 break; 183 case 'p': 184 paralimit = strtol(optarg, NULL, 10); 185 if (paralimit == 0) 186 paralimit = -1; 187 break; 188 case 'q': 189 verbose = -1; 190 break; 191 case 'r': 192 op |= JF_STOP; 193 break; 194 case 'R': 195 op |= JF_STOP; 196 Rflag = 1; 197 break; 198 case 's': 199 add_param(NULL, NULL, KP_SECURELEVEL, optarg); 200 docf = 0; 201 break; 202 case 'u': 203 add_param(NULL, NULL, IP_EXEC_JAIL_USER, optarg); 204 add_param(NULL, NULL, IP_EXEC_SYSTEM_JAIL_USER, NULL); 205 docf = 0; 206 break; 207 case 'U': 208 add_param(NULL, NULL, IP_EXEC_JAIL_USER, optarg); 209 add_param(NULL, NULL, IP_EXEC_SYSTEM_JAIL_USER, 210 "false"); 211 docf = 0; 212 break; 213 case 'v': 214 verbose = 1; 215 break; 216 default: 217 usage(); 218 } 219 } 220 argc -= optind; 221 argv += optind; 222 223 /* Find out which of the four command line styles this is. */ 224 oldcl = 0; 225 if (!op) { 226 /* Old-style command line with four fixed parameters */ 227 if (argc < 4 || argv[0][0] != '/') 228 usage(); 229 op = JF_START; 230 docf = 0; 231 oldcl = 1; 232 add_param(NULL, NULL, KP_PATH, argv[0]); 233 add_param(NULL, NULL, KP_HOST_HOSTNAME, argv[1]); 234 #if defined(INET) || defined(INET6) 235 if (argv[2][0] != '\0') { 236 for (cs = argv[2];; cs = ncs + 1) { 237 ncs = strchr(cs, ','); 238 if (ncs) 239 *ncs = '\0'; 240 add_param(NULL, NULL, 241 #if defined(INET) && defined(INET6) 242 inet_pton(AF_INET6, cs, &addr6) == 1 243 ? KP_IP6_ADDR : KP_IP4_ADDR, 244 #elif defined(INET) 245 KP_IP4_ADDR, 246 #elif defined(INET6) 247 KP_IP6_ADDR, 248 #endif 249 cs); 250 if (!ncs) 251 break; 252 } 253 } 254 #endif 255 for (i = 3; i < argc; i++) 256 add_param(NULL, NULL, IP_COMMAND, argv[i]); 257 /* Emulate the defaults from security.jail.* sysctls. */ 258 sysvallen = sizeof(sysval); 259 if (sysctlbyname("security.jail.jailed", &sysval, &sysvallen, 260 NULL, 0) == 0 && sysval == 0) { 261 for (pi = 0; pi < sizeof(perm_sysctl) / 262 sizeof(perm_sysctl[0]); pi++) { 263 sysvallen = sizeof(sysval); 264 if (sysctlbyname(perm_sysctl[pi].name, 265 &sysval, &sysvallen, NULL, 0) == 0) 266 add_param(NULL, NULL, 267 perm_sysctl[pi].ipnum, 268 (sysval ? 1 : 0) ^ 269 perm_sysctl[pi].rev 270 ? NULL : "false"); 271 } 272 sysvallen = sizeof(sysval); 273 if (sysctlbyname("security.jail.enforce_statfs", 274 &sysval, &sysvallen, NULL, 0) == 0) { 275 snprintf(enforce_statfs, 276 sizeof(enforce_statfs), "%d", sysval); 277 add_param(NULL, NULL, KP_ENFORCE_STATFS, 278 enforce_statfs); 279 } 280 } 281 } else if (op == JF_STOP) { 282 /* Jail remove, perhaps using the config file */ 283 if (!docf || argc == 0) 284 usage(); 285 if (!Rflag) 286 for (i = 0; i < argc; i++) 287 if (strchr(argv[i], '=')) 288 usage(); 289 if ((docf = !Rflag && 290 (!strcmp(cfname, "-") || stat(cfname, &st) == 0))) 291 load_config(); 292 note_remove = docf || argc > 1 || wild_jail_name(argv[0]); 293 } else if (argc > 1 || (argc == 1 && strchr(argv[0], '='))) { 294 /* Single jail specified on the command line */ 295 if (Rflag) 296 usage(); 297 docf = 0; 298 for (i = 0; i < argc; i++) { 299 if (!strncmp(argv[i], "command", 7) && 300 (argv[i][7] == '\0' || argv[i][7] == '=')) { 301 if (argv[i][7] == '=') 302 add_param(NULL, NULL, IP_COMMAND, 303 argv[i] + 8); 304 for (i++; i < argc; i++) 305 add_param(NULL, NULL, IP_COMMAND, 306 argv[i]); 307 } 308 #ifdef INET 309 else if (!strncmp(argv[i], "ip4.addr=", 9)) { 310 for (cs = argv[i] + 9;; cs = ncs + 1) { 311 ncs = strchr(cs, ','); 312 if (ncs) 313 *ncs = '\0'; 314 add_param(NULL, NULL, KP_IP4_ADDR, cs); 315 if (!ncs) 316 break; 317 } 318 } 319 #endif 320 #ifdef INET6 321 else if (!strncmp(argv[i], "ip6.addr=", 9)) { 322 for (cs = argv[i] + 9;; cs = ncs + 1) { 323 ncs = strchr(cs, ','); 324 if (ncs) 325 *ncs = '\0'; 326 add_param(NULL, NULL, KP_IP6_ADDR, cs); 327 if (!ncs) 328 break; 329 } 330 } 331 #endif 332 else 333 add_param(NULL, NULL, 0, argv[i]); 334 } 335 } else { 336 /* From the config file, perhaps with a specified jail */ 337 if (Rflag || !docf) 338 usage(); 339 load_config(); 340 } 341 342 /* Find out which jails will be run. */ 343 dep_setup(docf); 344 error = 0; 345 if (op == JF_STOP) { 346 for (i = 0; i < argc; i++) 347 if (start_state(argv[i], docf, op, Rflag) < 0) 348 error = 1; 349 } else { 350 if (start_state(argv[0], docf, op, 0) < 0) 351 exit(1); 352 } 353 354 jfp = NULL; 355 if (JidFile != NULL) { 356 jfp = fopen(JidFile, "w"); 357 if (jfp == NULL) 358 err(1, "open %s", JidFile); 359 setlinebuf(jfp); 360 } 361 setlinebuf(stdout); 362 363 /* 364 * The main loop: Get an available jail and perform the required 365 * operation on it. When that is done, the jail may be finished, 366 * or it may go back for the next step. 367 */ 368 while ((j = next_jail())) 369 { 370 if (j->flags & JF_FAILED) { 371 error = 1; 372 if (j->comparam == NULL) { 373 dep_done(j, 0); 374 continue; 375 } 376 } 377 if (!(j->flags & JF_PARAMS)) 378 { 379 j->flags |= JF_PARAMS; 380 if (dflag) 381 add_param(j, NULL, IP_ALLOW_DYING, NULL); 382 if (check_intparams(j) < 0) 383 continue; 384 if ((j->flags & (JF_START | JF_SET)) && 385 import_params(j) < 0) 386 continue; 387 } 388 if (!j->jid) 389 running_jid(j, 390 (j->flags & (JF_SET | JF_DEPEND)) == JF_SET 391 ? dflag || bool_param(j->intparams[IP_ALLOW_DYING]) 392 : 0); 393 if (finish_command(j)) 394 continue; 395 396 switch (j->flags & JF_OP_MASK) { 397 /* 398 * These operations just turn into a different op 399 * depending on the jail's current status. 400 */ 401 case JF_START_SET: 402 j->flags = j->jid < 0 ? JF_START : JF_SET; 403 break; 404 case JF_SET_RESTART: 405 if (j->jid < 0) { 406 jail_quoted_warnx(j, "not found", 407 "no jail specified"); 408 failed(j); 409 continue; 410 } 411 j->flags = rdtun_params(j, 0) ? JF_RESTART : JF_SET; 412 if (j->flags == JF_RESTART) 413 dep_reset(j); 414 break; 415 case JF_START_SET_RESTART: 416 j->flags = j->jid < 0 ? JF_START 417 : rdtun_params(j, 0) ? JF_RESTART : JF_SET; 418 if (j->flags == JF_RESTART) 419 dep_reset(j); 420 } 421 422 switch (j->flags & JF_OP_MASK) { 423 case JF_START: 424 if (j->comparam == NULL) { 425 if (j->jid > 0 && 426 !(j->flags & (JF_DEPEND | JF_WILD))) { 427 jail_quoted_warnx(j, "already exists", 428 NULL); 429 failed(j); 430 continue; 431 } 432 if (dep_check(j)) 433 continue; 434 if (j->jid > 0) 435 goto jail_create_done; 436 j->comparam = startcommands; 437 j->comstring = NULL; 438 } 439 if (next_command(j)) 440 continue; 441 jail_create_done: 442 clear_persist(j); 443 if (jfp != NULL) 444 print_jail(jfp, j, oldcl); 445 dep_done(j, 0); 446 break; 447 448 case JF_SET: 449 if (j->jid < 0 && !(j->flags & JF_DEPEND)) { 450 jail_quoted_warnx(j, "not found", 451 "no jail specified"); 452 failed(j); 453 continue; 454 } 455 if (dep_check(j)) 456 continue; 457 if (!(j->flags & JF_DEPEND)) { 458 if (rdtun_params(j, 1) < 0 || 459 update_jail(j) < 0) 460 continue; 461 if (verbose >= 0 && (j->name || verbose > 0)) 462 jail_note(j, "updated\n"); 463 } 464 dep_done(j, 0); 465 break; 466 467 case JF_STOP: 468 case JF_RESTART: 469 if (j->comparam == NULL) { 470 if (dep_check(j)) 471 continue; 472 if (j->jid < 0) { 473 if (!(j->flags & (JF_DEPEND|JF_WILD))) { 474 if (verbose >= 0) 475 jail_quoted_warnx(j, 476 "not found", NULL); 477 failed(j); 478 } 479 goto jail_remove_done; 480 } 481 j->comparam = stopcommands; 482 j->comstring = NULL; 483 } else if ((j->flags & JF_FAILED) && j->jid > 0) 484 goto jail_remove_done; 485 if (next_command(j)) 486 continue; 487 jail_remove_done: 488 dep_done(j, 0); 489 if ((j->flags & (JF_START | JF_FAILED)) == JF_START) { 490 j->comparam = NULL; 491 j->flags &= ~JF_STOP; 492 dep_reset(j); 493 requeue(j, j->ndeps ? &depend : &ready); 494 } 495 break; 496 } 497 } 498 499 if (jfp != NULL) 500 fclose(jfp); 501 exit(error); 502 } 503 504 /* 505 * Mark a jail's failure for future handling. 506 */ 507 void 508 failed(struct cfjail *j) 509 { 510 j->flags |= JF_FAILED; 511 TAILQ_REMOVE(j->queue, j, tq); 512 TAILQ_INSERT_HEAD(&ready, j, tq); 513 j->queue = &ready; 514 } 515 516 /* 517 * Exit slightly more gracefully when out of memory. 518 */ 519 void * 520 emalloc(size_t size) 521 { 522 void *p; 523 524 p = malloc(size); 525 if (!p) 526 err(1, "malloc"); 527 return p; 528 } 529 530 void * 531 erealloc(void *ptr, size_t size) 532 { 533 void *p; 534 535 p = realloc(ptr, size); 536 if (!p) 537 err(1, "malloc"); 538 return p; 539 } 540 541 char * 542 estrdup(const char *str) 543 { 544 char *ns; 545 546 ns = strdup(str); 547 if (!ns) 548 err(1, "malloc"); 549 return ns; 550 } 551 552 /* 553 * Print a message including an optional jail name. 554 */ 555 void 556 jail_note(const struct cfjail *j, const char *fmt, ...) 557 { 558 va_list ap, tap; 559 char *cs; 560 size_t len; 561 562 va_start(ap, fmt); 563 va_copy(tap, ap); 564 len = vsnprintf(NULL, 0, fmt, tap); 565 va_end(tap); 566 cs = alloca(len + 1); 567 (void)vsnprintf(cs, len + 1, fmt, ap); 568 va_end(ap); 569 if (j->name) 570 printf("%s: %s", j->name, cs); 571 else 572 printf("%s", cs); 573 } 574 575 /* 576 * Print a warning message including an optional jail name. 577 */ 578 void 579 jail_warnx(const struct cfjail *j, const char *fmt, ...) 580 { 581 va_list ap, tap; 582 char *cs; 583 size_t len; 584 585 va_start(ap, fmt); 586 va_copy(tap, ap); 587 len = vsnprintf(NULL, 0, fmt, tap); 588 va_end(tap); 589 cs = alloca(len + 1); 590 (void)vsnprintf(cs, len + 1, fmt, ap); 591 va_end(ap); 592 if (j->name) 593 warnx("%s: %s", j->name, cs); 594 else 595 warnx("%s", cs); 596 } 597 598 /* 599 * Create a new jail. 600 */ 601 int 602 create_jail(struct cfjail *j) 603 { 604 struct iovec jiov[4]; 605 struct stat st; 606 struct jailparam *jp, *setparams, *setparams2, *sjp; 607 const char *path; 608 int dopersist, ns, jid, dying, didfail; 609 610 /* 611 * Check the jail's path, with a better error message than jail_set 612 * gives. 613 */ 614 if ((path = string_param(j->intparams[KP_PATH]))) { 615 if (j->name != NULL && path[0] != '/') { 616 jail_warnx(j, "path %s: not an absolute pathname", 617 path); 618 return -1; 619 } 620 if (stat(path, &st) < 0) { 621 jail_warnx(j, "path %s: %s", path, strerror(errno)); 622 return -1; 623 } 624 if (!S_ISDIR(st.st_mode)) { 625 jail_warnx(j, "path %s: %s", path, strerror(ENOTDIR)); 626 return -1; 627 } 628 } 629 630 /* 631 * Copy all the parameters, except that "persist" is always set when 632 * there are commands to run later. 633 */ 634 dopersist = !bool_param(j->intparams[KP_PERSIST]) && 635 (j->intparams[IP_EXEC_START] || j->intparams[IP_COMMAND] || 636 j->intparams[IP_EXEC_POSTSTART]); 637 sjp = setparams = 638 alloca((j->njp + dopersist) * sizeof(struct jailparam)); 639 if (dopersist && jailparam_init(sjp++, "persist") < 0) { 640 jail_warnx(j, "%s", jail_errmsg); 641 return -1; 642 } 643 for (jp = j->jp; jp < j->jp + j->njp; jp++) 644 if (!dopersist || !equalopts(jp->jp_name, "persist")) 645 *sjp++ = *jp; 646 ns = sjp - setparams; 647 648 didfail = 0; 649 j->jid = jailparam_set_note(j, setparams, ns, JAIL_CREATE); 650 if (j->jid < 0 && errno == EEXIST && 651 bool_param(j->intparams[IP_ALLOW_DYING]) && 652 int_param(j->intparams[KP_JID], &jid) && jid != 0) { 653 /* 654 * The jail already exists, but may be dying. 655 * Make sure it is, in which case an update is appropriate. 656 */ 657 *(const void **)&jiov[0].iov_base = "jid"; 658 jiov[0].iov_len = sizeof("jid"); 659 jiov[1].iov_base = &jid; 660 jiov[1].iov_len = sizeof(jid); 661 *(const void **)&jiov[2].iov_base = "dying"; 662 jiov[2].iov_len = sizeof("dying"); 663 jiov[3].iov_base = &dying; 664 jiov[3].iov_len = sizeof(dying); 665 if (jail_get(jiov, 4, JAIL_DYING) < 0) { 666 /* 667 * It could be that the jail just barely finished 668 * dying, or it could be that the jid never existed 669 * but the name does. In either case, another try 670 * at creating the jail should do the right thing. 671 */ 672 if (errno == ENOENT) 673 j->jid = jailparam_set_note(j, setparams, ns, 674 JAIL_CREATE); 675 } else if (dying) { 676 j->jid = jid; 677 if (rdtun_params(j, 1) < 0) { 678 j->jid = -1; 679 didfail = 1; 680 } else { 681 sjp = setparams2 = alloca((j->njp + dopersist) * 682 sizeof(struct jailparam)); 683 for (jp = setparams; jp < setparams + ns; jp++) 684 if (!JP_RDTUN(jp) || 685 !strcmp(jp->jp_name, "jid")) 686 *sjp++ = *jp; 687 j->jid = jailparam_set_note(j, setparams2, 688 sjp - setparams2, JAIL_UPDATE | JAIL_DYING); 689 /* 690 * Again, perhaps the jail just finished dying. 691 */ 692 if (j->jid < 0 && errno == ENOENT) 693 j->jid = jailparam_set_note(j, 694 setparams, ns, JAIL_CREATE); 695 } 696 } 697 } 698 if (j->jid < 0 && !didfail) { 699 jail_warnx(j, "%s", jail_errmsg); 700 failed(j); 701 } 702 if (dopersist) { 703 jailparam_free(setparams, 1); 704 if (j->jid > 0) 705 j->flags |= JF_PERSIST; 706 } 707 return j->jid; 708 } 709 710 /* 711 * Remove a temporarily set "persist" parameter. 712 */ 713 static void 714 clear_persist(struct cfjail *j) 715 { 716 struct iovec jiov[4]; 717 int jid; 718 719 if (!(j->flags & JF_PERSIST)) 720 return; 721 j->flags &= ~JF_PERSIST; 722 *(const void **)&jiov[0].iov_base = "jid"; 723 jiov[0].iov_len = sizeof("jid"); 724 jiov[1].iov_base = &j->jid; 725 jiov[1].iov_len = sizeof(j->jid); 726 *(const void **)&jiov[2].iov_base = "nopersist"; 727 jiov[2].iov_len = sizeof("nopersist"); 728 jiov[3].iov_base = NULL; 729 jiov[3].iov_len = 0; 730 jid = jail_set(jiov, 4, JAIL_UPDATE); 731 if (verbose > 0) 732 jail_note(j, "jail_set(JAIL_UPDATE) jid=%d nopersist%s%s\n", 733 j->jid, jid < 0 ? ": " : "", 734 jid < 0 ? strerror(errno) : ""); 735 } 736 737 /* 738 * Set a jail's parameters. 739 */ 740 static int 741 update_jail(struct cfjail *j) 742 { 743 struct jailparam *jp, *setparams, *sjp; 744 int ns, jid; 745 746 ns = 0; 747 for (jp = j->jp; jp < j->jp + j->njp; jp++) 748 if (!JP_RDTUN(jp)) 749 ns++; 750 if (ns == 0) 751 return 0; 752 sjp = setparams = alloca(++ns * sizeof(struct jailparam)); 753 if (jailparam_init(sjp, "jid") < 0 || 754 jailparam_import_raw(sjp, &j->jid, sizeof j->jid) < 0) { 755 jail_warnx(j, "%s", jail_errmsg); 756 failed(j); 757 return -1; 758 } 759 for (jp = j->jp; jp < j->jp + j->njp; jp++) 760 if (!JP_RDTUN(jp)) 761 *++sjp = *jp; 762 763 jid = jailparam_set_note(j, setparams, ns, 764 bool_param(j->intparams[IP_ALLOW_DYING]) 765 ? JAIL_UPDATE | JAIL_DYING : JAIL_UPDATE); 766 if (jid < 0) { 767 jail_warnx(j, "%s", jail_errmsg); 768 failed(j); 769 } 770 jailparam_free(setparams, 1); 771 return jid; 772 } 773 774 /* 775 * Return if a jail set would change any create-only parameters. 776 */ 777 static int 778 rdtun_params(struct cfjail *j, int dofail) 779 { 780 struct jailparam *jp, *rtparams, *rtjp; 781 int nrt, rval; 782 783 if (j->flags & JF_RDTUN) 784 return 0; 785 j->flags |= JF_RDTUN; 786 nrt = 0; 787 for (jp = j->jp; jp < j->jp + j->njp; jp++) 788 if (JP_RDTUN(jp) && strcmp(jp->jp_name, "jid")) 789 nrt++; 790 if (nrt == 0) 791 return 0; 792 rtjp = rtparams = alloca(++nrt * sizeof(struct jailparam)); 793 if (jailparam_init(rtjp, "jid") < 0 || 794 jailparam_import_raw(rtjp, &j->jid, sizeof j->jid) < 0) { 795 jail_warnx(j, "%s", jail_errmsg); 796 exit(1); 797 } 798 for (jp = j->jp; jp < j->jp + j->njp; jp++) 799 if (JP_RDTUN(jp) && strcmp(jp->jp_name, "jid")) 800 *++rtjp = *jp; 801 rval = 0; 802 if (jailparam_get(rtparams, nrt, 803 bool_param(j->intparams[IP_ALLOW_DYING]) ? JAIL_DYING : 0) > 0) { 804 rtjp = rtparams + 1; 805 for (jp = j->jp, rtjp = rtparams + 1; rtjp < rtparams + nrt; 806 jp++) { 807 if (JP_RDTUN(jp) && strcmp(jp->jp_name, "jid")) { 808 if (!((jp->jp_flags & (JP_BOOL | JP_NOBOOL)) && 809 jp->jp_valuelen == 0 && 810 *(int *)jp->jp_value) && 811 !(rtjp->jp_valuelen == jp->jp_valuelen && 812 !memcmp(rtjp->jp_value, jp->jp_value, 813 jp->jp_valuelen))) { 814 if (dofail) { 815 jail_warnx(j, "%s cannot be " 816 "changed after creation", 817 jp->jp_name); 818 failed(j); 819 rval = -1; 820 } else 821 rval = 1; 822 break; 823 } 824 rtjp++; 825 } 826 } 827 } 828 for (rtjp = rtparams + 1; rtjp < rtparams + nrt; rtjp++) 829 rtjp->jp_name = NULL; 830 jailparam_free(rtparams, nrt); 831 return rval; 832 } 833 834 /* 835 * Get the jail's jid if it is running. 836 */ 837 static void 838 running_jid(struct cfjail *j, int dflag) 839 { 840 struct iovec jiov[2]; 841 const char *pval; 842 char *ep; 843 int jid; 844 845 if ((pval = string_param(j->intparams[KP_JID]))) { 846 if (!(jid = strtol(pval, &ep, 10)) || *ep) { 847 j->jid = -1; 848 return; 849 } 850 *(const void **)&jiov[0].iov_base = "jid"; 851 jiov[0].iov_len = sizeof("jid"); 852 jiov[1].iov_base = &jid; 853 jiov[1].iov_len = sizeof(jid); 854 } else if ((pval = string_param(j->intparams[KP_NAME]))) { 855 *(const void **)&jiov[0].iov_base = "name"; 856 jiov[0].iov_len = sizeof("name"); 857 jiov[1].iov_len = strlen(pval) + 1; 858 jiov[1].iov_base = alloca(jiov[1].iov_len); 859 strcpy(jiov[1].iov_base, pval); 860 } else { 861 j->jid = -1; 862 return; 863 } 864 j->jid = jail_get(jiov, 2, dflag ? JAIL_DYING : 0); 865 } 866 867 static void 868 jail_quoted_warnx(const struct cfjail *j, const char *name_msg, 869 const char *noname_msg) 870 { 871 const char *pval; 872 873 if ((pval = j->name) || (pval = string_param(j->intparams[KP_JID])) || 874 (pval = string_param(j->intparams[KP_NAME]))) 875 warnx("\"%s\" %s", pval, name_msg); 876 else 877 warnx("%s", noname_msg); 878 } 879 880 /* 881 * Set jail parameters and possible print them out. 882 */ 883 static int 884 jailparam_set_note(const struct cfjail *j, struct jailparam *jp, unsigned njp, 885 int flags) 886 { 887 char *value; 888 int jid; 889 unsigned i; 890 891 jid = jailparam_set(jp, njp, flags); 892 if (verbose > 0) { 893 jail_note(j, "jail_set(%s%s)", 894 (flags & (JAIL_CREATE | JAIL_UPDATE)) == JAIL_CREATE 895 ? "JAIL_CREATE" : "JAIL_UPDATE", 896 (flags & JAIL_DYING) ? " | JAIL_DYING" : ""); 897 for (i = 0; i < njp; i++) { 898 printf(" %s", jp[i].jp_name); 899 if (jp[i].jp_value == NULL) 900 continue; 901 putchar('='); 902 value = jailparam_export(jp + i); 903 if (value == NULL) 904 err(1, "jailparam_export"); 905 quoted_print(stdout, value); 906 free(value); 907 } 908 if (jid < 0) 909 printf(": %s", strerror(errno)); 910 printf("\n"); 911 } 912 return jid; 913 } 914 915 /* 916 * Print a jail record. 917 */ 918 static void 919 print_jail(FILE *fp, struct cfjail *j, int oldcl) 920 { 921 struct cfparam *p; 922 923 if (oldcl) { 924 fprintf(fp, "%d\t", j->jid); 925 print_param(fp, j->intparams[KP_PATH], ',', 0); 926 putc('\t', fp); 927 print_param(fp, j->intparams[KP_HOST_HOSTNAME], ',', 0); 928 putc('\t', fp); 929 #ifdef INET 930 print_param(fp, j->intparams[KP_IP4_ADDR], ',', 0); 931 #ifdef INET6 932 if (j->intparams[KP_IP4_ADDR] && 933 !TAILQ_EMPTY(&j->intparams[KP_IP4_ADDR]->val) && 934 j->intparams[KP_IP6_ADDR] && 935 !TAILQ_EMPTY(&j->intparams[KP_IP6_ADDR]->val)) 936 putc(',', fp); 937 #endif 938 #endif 939 #ifdef INET6 940 print_param(fp, j->intparams[KP_IP6_ADDR], ',', 0); 941 #endif 942 putc('\t', fp); 943 print_param(fp, j->intparams[IP_COMMAND], ' ', 0); 944 } else { 945 fprintf(fp, "jid=%d", j->jid); 946 TAILQ_FOREACH(p, &j->params, tq) 947 if (strcmp(p->name, "jid")) { 948 putc(' ', fp); 949 print_param(fp, p, ',', 1); 950 } 951 } 952 putc('\n', fp); 953 } 954 955 /* 956 * Print a parameter value, or a name=value pair. 957 */ 958 static void 959 print_param(FILE *fp, const struct cfparam *p, int sep, int doname) 960 { 961 const struct cfstring *s, *ts; 962 963 if (doname) 964 fputs(p->name, fp); 965 if (p == NULL || TAILQ_EMPTY(&p->val)) 966 return; 967 if (doname) 968 putc('=', fp); 969 TAILQ_FOREACH_SAFE(s, &p->val, tq, ts) { 970 quoted_print(fp, s->s); 971 if (ts != NULL) 972 putc(sep, fp); 973 } 974 } 975 976 /* 977 * Print a string with quotes around spaces. 978 */ 979 static void 980 quoted_print(FILE *fp, char *str) 981 { 982 int c, qc; 983 char *p = str; 984 985 qc = !*p ? '"' 986 : strchr(p, '\'') ? '"' 987 : strchr(p, '"') ? '\'' 988 : strchr(p, ' ') || strchr(p, '\t') ? '"' 989 : 0; 990 if (qc) 991 putc(qc, fp); 992 while ((c = *p++)) { 993 if (c == '\\' || c == qc) 994 putc('\\', fp); 995 putc(c, fp); 996 } 997 if (qc) 998 putc(qc, fp); 999 } 1000 1001 static void 1002 usage(void) 1003 { 1004 1005 (void)fprintf(stderr, 1006 "usage: jail [-dhilqv] [-J jid_file] [-u username] [-U username]\n" 1007 " -[cmr] param=value ... [command=command ...]\n" 1008 " jail [-dqv] [-f file] -[cmr] [jail]\n" 1009 " jail [-qv] [-f file] -[rR] ['*' | jail ...]\n" 1010 " jail [-dhilqv] [-J jid_file] [-u username] [-U username]\n" 1011 " [-n jailname] [-s securelevel]\n" 1012 " path hostname [ip[,...]] command ...\n"); 1013 exit(1); 1014 } 1015