xref: /freebsd/usr.sbin/jail/jail.c (revision 09127a36371d5f5ac109ad1063e7fe53ee9bf356)
1 /*-
2  * Copyright (c) 1999 Poul-Henning Kamp.
3  * Copyright (c) 2009-2012 James Gritton
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25  * SUCH DAMAGE.
26  */
27 
28 #include <sys/cdefs.h>
29 __FBSDID("$FreeBSD$");
30 
31 #include <sys/types.h>
32 #include <sys/stat.h>
33 #include <sys/socket.h>
34 #include <sys/sysctl.h>
35 
36 #include <arpa/inet.h>
37 #include <netinet/in.h>
38 
39 #include <err.h>
40 #include <errno.h>
41 #include <stdarg.h>
42 #include <stdio.h>
43 #include <stdlib.h>
44 #include <string.h>
45 #include <unistd.h>
46 
47 #include "jailp.h"
48 
49 #define JP_RDTUN(jp)	(((jp)->jp_ctltype & CTLFLAG_RDTUN) == CTLFLAG_RDTUN)
50 
51 struct permspec {
52 	const char	*name;
53 	enum intparam	ipnum;
54 	int		rev;
55 };
56 
57 const char *cfname;
58 int iflag;
59 int note_remove;
60 int verbose;
61 
62 static void clear_persist(struct cfjail *j);
63 static int update_jail(struct cfjail *j);
64 static int rdtun_params(struct cfjail *j, int dofail);
65 static void running_jid(struct cfjail *j, int dflag);
66 static void jail_quoted_warnx(const struct cfjail *j, const char *name_msg,
67     const char *noname_msg);
68 static int jailparam_set_note(const struct cfjail *j, struct jailparam *jp,
69     unsigned njp, int flags);
70 static void print_jail(FILE *fp, struct cfjail *j, int oldcl);
71 static void print_param(FILE *fp, const struct cfparam *p, int sep, int doname);
72 static void quoted_print(FILE *fp, char *str);
73 static void usage(void);
74 
75 static struct permspec perm_sysctl[] = {
76     { "security.jail.set_hostname_allowed", KP_ALLOW_SET_HOSTNAME, 0 },
77     { "security.jail.sysvipc_allowed", KP_ALLOW_SYSVIPC, 0 },
78     { "security.jail.allow_raw_sockets", KP_ALLOW_RAW_SOCKETS, 0 },
79     { "security.jail.chflags_allowed", KP_ALLOW_CHFLAGS, 0 },
80     { "security.jail.mount_allowed", KP_ALLOW_MOUNT, 0 },
81     { "security.jail.socket_unixiproute_only", KP_ALLOW_SOCKET_AF, 1 },
82 };
83 
84 static const enum intparam startcommands[] = {
85     IP__NULL,
86 #ifdef INET
87     IP__IP4_IFADDR,
88 #endif
89 #ifdef INET6
90     IP__IP6_IFADDR,
91 #endif
92     IP_MOUNT,
93     IP__MOUNT_FROM_FSTAB,
94     IP_MOUNT_DEVFS,
95     IP_EXEC_PRESTART,
96     IP__OP,
97     IP_VNET_INTERFACE,
98     IP_EXEC_START,
99     IP_COMMAND,
100     IP_EXEC_POSTSTART,
101     IP__NULL
102 };
103 
104 static const enum intparam stopcommands[] = {
105     IP__NULL,
106     IP_EXEC_PRESTOP,
107     IP_EXEC_STOP,
108     IP_STOP_TIMEOUT,
109     IP__OP,
110     IP_EXEC_POSTSTOP,
111     IP_MOUNT_DEVFS,
112     IP__MOUNT_FROM_FSTAB,
113     IP_MOUNT,
114 #ifdef INET6
115     IP__IP6_IFADDR,
116 #endif
117 #ifdef INET
118     IP__IP4_IFADDR,
119 #endif
120     IP__NULL
121 };
122 
123 int
124 main(int argc, char **argv)
125 {
126 	struct stat st;
127 	FILE *jfp;
128 	struct cfjail *j;
129 	char *JidFile;
130 	size_t sysvallen;
131 	unsigned op, pi;
132 	int ch, docf, error, i, oldcl, sysval;
133 	int dflag, Rflag;
134 	char enforce_statfs[4];
135 #if defined(INET) || defined(INET6)
136 	char *cs, *ncs;
137 #endif
138 #if defined(INET) && defined(INET6)
139 	struct in6_addr addr6;
140 #endif
141 
142 	op = 0;
143 	dflag = Rflag = 0;
144 	docf = 1;
145 	cfname = CONF_FILE;
146 	JidFile = NULL;
147 
148 	while ((ch = getopt(argc, argv, "cdf:hiJ:lmn:p:qrRs:u:U:v")) != -1) {
149 		switch (ch) {
150 		case 'c':
151 			op |= JF_START;
152 			break;
153 		case 'd':
154 			dflag = 1;
155 			break;
156 		case 'f':
157 			cfname = optarg;
158 			break;
159 		case 'h':
160 #if defined(INET) || defined(INET6)
161 			add_param(NULL, NULL, IP_IP_HOSTNAME, NULL);
162 #endif
163 			docf = 0;
164 			break;
165 		case 'i':
166 			iflag = 1;
167 			verbose = -1;
168 			break;
169 		case 'J':
170 			JidFile = optarg;
171 			break;
172 		case 'l':
173 			add_param(NULL, NULL, IP_EXEC_CLEAN, NULL);
174 			docf = 0;
175 			break;
176 		case 'm':
177 			op |= JF_SET;
178 			break;
179 		case 'n':
180 			add_param(NULL, NULL, KP_NAME, optarg);
181 			docf = 0;
182 			break;
183 		case 'p':
184 			paralimit = strtol(optarg, NULL, 10);
185 			if (paralimit == 0)
186 				paralimit = -1;
187 			break;
188 		case 'q':
189 			verbose = -1;
190 			break;
191 		case 'r':
192 			op |= JF_STOP;
193 			break;
194 		case 'R':
195 			op |= JF_STOP;
196 			Rflag = 1;
197 			break;
198 		case 's':
199 			add_param(NULL, NULL, KP_SECURELEVEL, optarg);
200 			docf = 0;
201 			break;
202 		case 'u':
203 			add_param(NULL, NULL, IP_EXEC_JAIL_USER, optarg);
204 			add_param(NULL, NULL, IP_EXEC_SYSTEM_JAIL_USER, NULL);
205 			docf = 0;
206 			break;
207 		case 'U':
208 			add_param(NULL, NULL, IP_EXEC_JAIL_USER, optarg);
209 			add_param(NULL, NULL, IP_EXEC_SYSTEM_JAIL_USER,
210 			    "false");
211 			docf = 0;
212 			break;
213 		case 'v':
214 			verbose = 1;
215 			break;
216 		default:
217 			usage();
218 		}
219 	}
220 	argc -= optind;
221 	argv += optind;
222 
223 	/* Find out which of the four command line styles this is. */
224 	oldcl = 0;
225 	if (!op) {
226 		/* Old-style command line with four fixed parameters */
227 		if (argc < 4 || argv[0][0] != '/')
228 			usage();
229 		op = JF_START;
230 		docf = 0;
231 		oldcl = 1;
232 		add_param(NULL, NULL, KP_PATH, argv[0]);
233 		add_param(NULL, NULL, KP_HOST_HOSTNAME, argv[1]);
234 #if defined(INET) || defined(INET6)
235 		if (argv[2][0] != '\0') {
236 			for (cs = argv[2];; cs = ncs + 1) {
237 				ncs = strchr(cs, ',');
238 				if (ncs)
239 					*ncs = '\0';
240 				add_param(NULL, NULL,
241 #if defined(INET) && defined(INET6)
242 				    inet_pton(AF_INET6, cs, &addr6) == 1
243 				    ? KP_IP6_ADDR : KP_IP4_ADDR,
244 #elif defined(INET)
245 				    KP_IP4_ADDR,
246 #elif defined(INET6)
247 				    KP_IP6_ADDR,
248 #endif
249 				    cs);
250 				if (!ncs)
251 					break;
252 			}
253 		}
254 #endif
255 		for (i = 3; i < argc; i++)
256 			add_param(NULL, NULL, IP_COMMAND, argv[i]);
257 		/* Emulate the defaults from security.jail.* sysctls. */
258 		sysvallen = sizeof(sysval);
259 		if (sysctlbyname("security.jail.jailed", &sysval, &sysvallen,
260 		    NULL, 0) == 0 && sysval == 0) {
261 			for (pi = 0; pi < sizeof(perm_sysctl) /
262 			     sizeof(perm_sysctl[0]); pi++) {
263 				sysvallen = sizeof(sysval);
264 				if (sysctlbyname(perm_sysctl[pi].name,
265 				    &sysval, &sysvallen, NULL, 0) == 0)
266 					add_param(NULL, NULL,
267 					    perm_sysctl[pi].ipnum,
268 					    (sysval ? 1 : 0) ^
269 					    perm_sysctl[pi].rev
270 					    ? NULL : "false");
271 			}
272 			sysvallen = sizeof(sysval);
273 			if (sysctlbyname("security.jail.enforce_statfs",
274 			    &sysval, &sysvallen, NULL, 0) == 0) {
275 				snprintf(enforce_statfs,
276 				    sizeof(enforce_statfs), "%d", sysval);
277 				add_param(NULL, NULL, KP_ENFORCE_STATFS,
278 				    enforce_statfs);
279 			}
280 		}
281 	} else if (op == JF_STOP) {
282 		/* Jail remove, perhaps using the config file */
283 		if (!docf || argc == 0)
284 			usage();
285 		if (!Rflag)
286 			for (i = 0; i < argc; i++)
287 				if (strchr(argv[i], '='))
288 					usage();
289 		if ((docf = !Rflag &&
290 		     (!strcmp(cfname, "-") || stat(cfname, &st) == 0)))
291 			load_config();
292 		note_remove = docf || argc > 1 || wild_jail_name(argv[0]);
293 	} else if (argc > 1 || (argc == 1 && strchr(argv[0], '='))) {
294 		/* Single jail specified on the command line */
295 		if (Rflag)
296 			usage();
297 		docf = 0;
298 		for (i = 0; i < argc; i++) {
299 			if (!strncmp(argv[i], "command", 7) &&
300 			    (argv[i][7] == '\0' || argv[i][7] == '=')) {
301 				if (argv[i][7]  == '=')
302 					add_param(NULL, NULL, IP_COMMAND,
303 					    argv[i] + 8);
304 				for (i++; i < argc; i++)
305 					add_param(NULL, NULL, IP_COMMAND,
306 					    argv[i]);
307 			}
308 #ifdef INET
309 			else if (!strncmp(argv[i], "ip4.addr=", 9)) {
310 				for (cs = argv[i] + 9;; cs = ncs + 1) {
311 					ncs = strchr(cs, ',');
312 					if (ncs)
313 						*ncs = '\0';
314 					add_param(NULL, NULL, KP_IP4_ADDR, cs);
315 					if (!ncs)
316 						break;
317 				}
318 			}
319 #endif
320 #ifdef INET6
321 			else if (!strncmp(argv[i], "ip6.addr=", 9)) {
322 				for (cs = argv[i] + 9;; cs = ncs + 1) {
323 					ncs = strchr(cs, ',');
324 					if (ncs)
325 						*ncs = '\0';
326 					add_param(NULL, NULL, KP_IP6_ADDR, cs);
327 					if (!ncs)
328 						break;
329 				}
330 			}
331 #endif
332 			else
333 				add_param(NULL, NULL, 0, argv[i]);
334 		}
335 	} else {
336 		/* From the config file, perhaps with a specified jail */
337 		if (Rflag || !docf)
338 			usage();
339 		load_config();
340 	}
341 
342 	/* Find out which jails will be run. */
343 	dep_setup(docf);
344 	error = 0;
345 	if (op == JF_STOP) {
346 		for (i = 0; i < argc; i++)
347 			if (start_state(argv[i], docf, op, Rflag) < 0)
348 				error = 1;
349 	} else {
350 		if (start_state(argv[0], docf, op, 0) < 0)
351 			exit(1);
352 	}
353 
354 	jfp = NULL;
355 	if (JidFile != NULL) {
356 		jfp = fopen(JidFile, "w");
357 		if (jfp == NULL)
358 			err(1, "open %s", JidFile);
359 		setlinebuf(jfp);
360 	}
361 	setlinebuf(stdout);
362 
363 	/*
364 	 * The main loop: Get an available jail and perform the required
365 	 * operation on it.  When that is done, the jail may be finished,
366 	 * or it may go back for the next step.
367 	 */
368 	while ((j = next_jail()))
369 	{
370 		if (j->flags & JF_FAILED) {
371 			error = 1;
372 			if (j->comparam == NULL) {
373 				dep_done(j, 0);
374 				continue;
375 			}
376 		}
377 		if (!(j->flags & JF_PARAMS))
378 		{
379 			j->flags |= JF_PARAMS;
380 			if (dflag)
381 				add_param(j, NULL, IP_ALLOW_DYING, NULL);
382 			if (check_intparams(j) < 0)
383 				continue;
384 			if ((j->flags & (JF_START | JF_SET)) &&
385 			    import_params(j) < 0)
386 				continue;
387 		}
388 		if (!j->jid)
389 			running_jid(j,
390 			    (j->flags & (JF_SET | JF_DEPEND)) == JF_SET
391 			    ? dflag || bool_param(j->intparams[IP_ALLOW_DYING])
392 			    : 0);
393 		if (finish_command(j))
394 			continue;
395 
396 		switch (j->flags & JF_OP_MASK) {
397 			/*
398 			 * These operations just turn into a different op
399 			 * depending on the jail's current status.
400 			 */
401 		case JF_START_SET:
402 			j->flags = j->jid < 0 ? JF_START : JF_SET;
403 			break;
404 		case JF_SET_RESTART:
405 			if (j->jid < 0) {
406 				jail_quoted_warnx(j, "not found",
407 				    "no jail specified");
408 				failed(j);
409 				continue;
410 			}
411 			j->flags = rdtun_params(j, 0) ? JF_RESTART : JF_SET;
412 			if (j->flags == JF_RESTART)
413 				dep_reset(j);
414 			break;
415 		case JF_START_SET_RESTART:
416 			j->flags = j->jid < 0 ? JF_START
417 			    : rdtun_params(j, 0) ? JF_RESTART : JF_SET;
418 			if (j->flags == JF_RESTART)
419 				dep_reset(j);
420 		}
421 
422 		switch (j->flags & JF_OP_MASK) {
423 		case JF_START:
424 			if (j->comparam == NULL) {
425 				if (j->jid > 0 &&
426 				    !(j->flags & (JF_DEPEND | JF_WILD))) {
427 					jail_quoted_warnx(j, "already exists",
428 					    NULL);
429 					failed(j);
430 					continue;
431 				}
432 				if (dep_check(j))
433 					continue;
434 				if (j->jid > 0)
435 					goto jail_create_done;
436 				j->comparam = startcommands;
437 				j->comstring = NULL;
438 			}
439 			if (next_command(j))
440 				continue;
441 		jail_create_done:
442 			clear_persist(j);
443 			if (jfp != NULL)
444 				print_jail(jfp, j, oldcl);
445 			dep_done(j, 0);
446 			break;
447 
448 		case JF_SET:
449 			if (j->jid < 0 && !(j->flags & JF_DEPEND)) {
450 				jail_quoted_warnx(j, "not found",
451 				    "no jail specified");
452 				failed(j);
453 				continue;
454 			}
455 			if (dep_check(j))
456 				continue;
457 			if (!(j->flags & JF_DEPEND)) {
458 				if (rdtun_params(j, 1) < 0 ||
459 				    update_jail(j) < 0)
460 					continue;
461 				if (verbose >= 0 && (j->name || verbose > 0))
462 					jail_note(j, "updated\n");
463 			}
464 			dep_done(j, 0);
465 			break;
466 
467 		case JF_STOP:
468 		case JF_RESTART:
469 			if (j->comparam == NULL) {
470 				if (dep_check(j))
471 					continue;
472 				if (j->jid < 0) {
473 					if (!(j->flags & (JF_DEPEND|JF_WILD))) {
474 						if (verbose >= 0)
475 							jail_quoted_warnx(j,
476 							    "not found", NULL);
477 						failed(j);
478 					}
479 					goto jail_remove_done;
480 				}
481 				j->comparam = stopcommands;
482 				j->comstring = NULL;
483 			} else if ((j->flags & JF_FAILED) && j->jid > 0)
484 				goto jail_remove_done;
485 			if (next_command(j))
486 				continue;
487 		jail_remove_done:
488 			dep_done(j, 0);
489 			if ((j->flags & (JF_START | JF_FAILED)) == JF_START) {
490 				j->comparam = NULL;
491 				j->flags &= ~JF_STOP;
492 				dep_reset(j);
493 				requeue(j, j->ndeps ? &depend : &ready);
494 			}
495 			break;
496 		}
497 	}
498 
499 	if (jfp != NULL)
500 		fclose(jfp);
501 	exit(error);
502 }
503 
504 /*
505  * Mark a jail's failure for future handling.
506  */
507 void
508 failed(struct cfjail *j)
509 {
510 	j->flags |= JF_FAILED;
511 	TAILQ_REMOVE(j->queue, j, tq);
512 	TAILQ_INSERT_HEAD(&ready, j, tq);
513 	j->queue = &ready;
514 }
515 
516 /*
517  * Exit slightly more gracefully when out of memory.
518  */
519 void *
520 emalloc(size_t size)
521 {
522 	void *p;
523 
524 	p = malloc(size);
525 	if (!p)
526 		err(1, "malloc");
527 	return p;
528 }
529 
530 void *
531 erealloc(void *ptr, size_t size)
532 {
533 	void *p;
534 
535 	p = realloc(ptr, size);
536 	if (!p)
537 		err(1, "malloc");
538 	return p;
539 }
540 
541 char *
542 estrdup(const char *str)
543 {
544 	char *ns;
545 
546 	ns = strdup(str);
547 	if (!ns)
548 		err(1, "malloc");
549 	return ns;
550 }
551 
552 /*
553  * Print a message including an optional jail name.
554  */
555 void
556 jail_note(const struct cfjail *j, const char *fmt, ...)
557 {
558 	va_list ap, tap;
559 	char *cs;
560 	size_t len;
561 
562 	va_start(ap, fmt);
563 	va_copy(tap, ap);
564 	len = vsnprintf(NULL, 0, fmt, tap);
565 	va_end(tap);
566 	cs = alloca(len + 1);
567 	(void)vsnprintf(cs, len + 1, fmt, ap);
568 	va_end(ap);
569 	if (j->name)
570 		printf("%s: %s", j->name, cs);
571 	else
572 		printf("%s", cs);
573 }
574 
575 /*
576  * Print a warning message including an optional jail name.
577  */
578 void
579 jail_warnx(const struct cfjail *j, const char *fmt, ...)
580 {
581 	va_list ap, tap;
582 	char *cs;
583 	size_t len;
584 
585 	va_start(ap, fmt);
586 	va_copy(tap, ap);
587 	len = vsnprintf(NULL, 0, fmt, tap);
588 	va_end(tap);
589 	cs = alloca(len + 1);
590 	(void)vsnprintf(cs, len + 1, fmt, ap);
591 	va_end(ap);
592 	if (j->name)
593 		warnx("%s: %s", j->name, cs);
594 	else
595 		warnx("%s", cs);
596 }
597 
598 /*
599  * Create a new jail.
600  */
601 int
602 create_jail(struct cfjail *j)
603 {
604 	struct iovec jiov[4];
605 	struct stat st;
606 	struct jailparam *jp, *setparams, *setparams2, *sjp;
607 	const char *path;
608 	int dopersist, ns, jid, dying, didfail;
609 
610 	/*
611 	 * Check the jail's path, with a better error message than jail_set
612 	 * gives.
613 	 */
614 	if ((path = string_param(j->intparams[KP_PATH]))) {
615 		if (j->name != NULL && path[0] != '/') {
616 			jail_warnx(j, "path %s: not an absolute pathname",
617 			    path);
618 			return -1;
619 		}
620 		if (stat(path, &st) < 0) {
621 			jail_warnx(j, "path %s: %s", path, strerror(errno));
622 			return -1;
623 		}
624 		if (!S_ISDIR(st.st_mode)) {
625 			jail_warnx(j, "path %s: %s", path, strerror(ENOTDIR));
626 			return -1;
627 		}
628 	}
629 
630 	/*
631 	 * Copy all the parameters, except that "persist" is always set when
632 	 * there are commands to run later.
633 	 */
634 	dopersist = !bool_param(j->intparams[KP_PERSIST]) &&
635 	    (j->intparams[IP_EXEC_START] || j->intparams[IP_COMMAND] ||
636 	     j->intparams[IP_EXEC_POSTSTART]);
637 	sjp = setparams =
638 	    alloca((j->njp + dopersist) * sizeof(struct jailparam));
639 	if (dopersist && jailparam_init(sjp++, "persist") < 0) {
640 		jail_warnx(j, "%s", jail_errmsg);
641 		return -1;
642 	}
643 	for (jp = j->jp; jp < j->jp + j->njp; jp++)
644 		if (!dopersist || !equalopts(jp->jp_name, "persist"))
645 			*sjp++ = *jp;
646 	ns = sjp - setparams;
647 
648 	didfail = 0;
649 	j->jid = jailparam_set_note(j, setparams, ns, JAIL_CREATE);
650 	if (j->jid < 0 && errno == EEXIST &&
651 	    bool_param(j->intparams[IP_ALLOW_DYING]) &&
652 	    int_param(j->intparams[KP_JID], &jid) && jid != 0) {
653 		/*
654 		 * The jail already exists, but may be dying.
655 		 * Make sure it is, in which case an update is appropriate.
656 		 */
657 		*(const void **)&jiov[0].iov_base = "jid";
658 		jiov[0].iov_len = sizeof("jid");
659 		jiov[1].iov_base = &jid;
660 		jiov[1].iov_len = sizeof(jid);
661 		*(const void **)&jiov[2].iov_base = "dying";
662 		jiov[2].iov_len = sizeof("dying");
663 		jiov[3].iov_base = &dying;
664 		jiov[3].iov_len = sizeof(dying);
665 		if (jail_get(jiov, 4, JAIL_DYING) < 0) {
666 			/*
667 			 * It could be that the jail just barely finished
668 			 * dying, or it could be that the jid never existed
669 			 * but the name does.  In either case, another try
670 			 * at creating the jail should do the right thing.
671 			 */
672 			if (errno == ENOENT)
673 				j->jid = jailparam_set_note(j, setparams, ns,
674 				    JAIL_CREATE);
675 		} else if (dying) {
676 			j->jid = jid;
677 			if (rdtun_params(j, 1) < 0) {
678 				j->jid = -1;
679 				didfail = 1;
680 			} else {
681 				sjp = setparams2 = alloca((j->njp + dopersist) *
682 				    sizeof(struct jailparam));
683 				for (jp = setparams; jp < setparams + ns; jp++)
684 					if (!JP_RDTUN(jp) ||
685 					    !strcmp(jp->jp_name, "jid"))
686 						*sjp++ = *jp;
687 				j->jid = jailparam_set_note(j, setparams2,
688 				    sjp - setparams2, JAIL_UPDATE | JAIL_DYING);
689 				/*
690 				 * Again, perhaps the jail just finished dying.
691 				 */
692 				if (j->jid < 0 && errno == ENOENT)
693 					j->jid = jailparam_set_note(j,
694 					    setparams, ns, JAIL_CREATE);
695 			}
696 		}
697 	}
698 	if (j->jid < 0 && !didfail) {
699 		jail_warnx(j, "%s", jail_errmsg);
700 		failed(j);
701 	}
702 	if (dopersist) {
703 		jailparam_free(setparams, 1);
704 		if (j->jid > 0)
705 			j->flags |= JF_PERSIST;
706 	}
707 	return j->jid;
708 }
709 
710 /*
711  * Remove a temporarily set "persist" parameter.
712  */
713 static void
714 clear_persist(struct cfjail *j)
715 {
716 	struct iovec jiov[4];
717 	int jid;
718 
719 	if (!(j->flags & JF_PERSIST))
720 		return;
721 	j->flags &= ~JF_PERSIST;
722 	*(const void **)&jiov[0].iov_base = "jid";
723 	jiov[0].iov_len = sizeof("jid");
724 	jiov[1].iov_base = &j->jid;
725 	jiov[1].iov_len = sizeof(j->jid);
726 	*(const void **)&jiov[2].iov_base = "nopersist";
727 	jiov[2].iov_len = sizeof("nopersist");
728 	jiov[3].iov_base = NULL;
729 	jiov[3].iov_len = 0;
730 	jid = jail_set(jiov, 4, JAIL_UPDATE);
731 	if (verbose > 0)
732 		jail_note(j, "jail_set(JAIL_UPDATE) jid=%d nopersist%s%s\n",
733 		    j->jid, jid < 0 ? ": " : "",
734 		    jid < 0 ? strerror(errno) : "");
735 }
736 
737 /*
738  * Set a jail's parameters.
739  */
740 static int
741 update_jail(struct cfjail *j)
742 {
743 	struct jailparam *jp, *setparams, *sjp;
744 	int ns, jid;
745 
746 	ns = 0;
747 	for (jp = j->jp; jp < j->jp + j->njp; jp++)
748 		if (!JP_RDTUN(jp))
749 			ns++;
750 	if (ns == 0)
751 		return 0;
752 	sjp = setparams = alloca(++ns * sizeof(struct jailparam));
753 	if (jailparam_init(sjp, "jid") < 0 ||
754 	    jailparam_import_raw(sjp, &j->jid, sizeof j->jid) < 0) {
755 		jail_warnx(j, "%s", jail_errmsg);
756 		failed(j);
757 		return -1;
758 	}
759 	for (jp = j->jp; jp < j->jp + j->njp; jp++)
760 		if (!JP_RDTUN(jp))
761 			*++sjp = *jp;
762 
763 	jid = jailparam_set_note(j, setparams, ns,
764 	    bool_param(j->intparams[IP_ALLOW_DYING])
765 	    ? JAIL_UPDATE | JAIL_DYING : JAIL_UPDATE);
766 	if (jid < 0) {
767 		jail_warnx(j, "%s", jail_errmsg);
768 		failed(j);
769 	}
770 	jailparam_free(setparams, 1);
771 	return jid;
772 }
773 
774 /*
775  * Return if a jail set would change any create-only parameters.
776  */
777 static int
778 rdtun_params(struct cfjail *j, int dofail)
779 {
780 	struct jailparam *jp, *rtparams, *rtjp;
781 	int nrt, rval;
782 
783 	if (j->flags & JF_RDTUN)
784 		return 0;
785 	j->flags |= JF_RDTUN;
786 	nrt = 0;
787 	for (jp = j->jp; jp < j->jp + j->njp; jp++)
788 		if (JP_RDTUN(jp) && strcmp(jp->jp_name, "jid"))
789 			nrt++;
790 	if (nrt == 0)
791 		return 0;
792 	rtjp = rtparams = alloca(++nrt * sizeof(struct jailparam));
793 	if (jailparam_init(rtjp, "jid") < 0 ||
794 	    jailparam_import_raw(rtjp, &j->jid, sizeof j->jid) < 0) {
795 		jail_warnx(j, "%s", jail_errmsg);
796 		exit(1);
797 	}
798 	for (jp = j->jp; jp < j->jp + j->njp; jp++)
799 		if (JP_RDTUN(jp) && strcmp(jp->jp_name, "jid"))
800 			*++rtjp = *jp;
801 	rval = 0;
802 	if (jailparam_get(rtparams, nrt,
803 	    bool_param(j->intparams[IP_ALLOW_DYING]) ? JAIL_DYING : 0) > 0) {
804 		rtjp = rtparams + 1;
805 		for (jp = j->jp, rtjp = rtparams + 1; rtjp < rtparams + nrt;
806 		     jp++) {
807 			if (JP_RDTUN(jp) && strcmp(jp->jp_name, "jid")) {
808 				if (!((jp->jp_flags & (JP_BOOL | JP_NOBOOL)) &&
809 				    jp->jp_valuelen == 0 &&
810 				    *(int *)jp->jp_value) &&
811 				    !(rtjp->jp_valuelen == jp->jp_valuelen &&
812 				    !memcmp(rtjp->jp_value, jp->jp_value,
813 				    jp->jp_valuelen))) {
814 					if (dofail) {
815 						jail_warnx(j, "%s cannot be "
816 						    "changed after creation",
817 						    jp->jp_name);
818 						failed(j);
819 						rval = -1;
820 					} else
821 						rval = 1;
822 					break;
823 				}
824 				rtjp++;
825 			}
826 		}
827 	}
828 	for (rtjp = rtparams + 1; rtjp < rtparams + nrt; rtjp++)
829 		rtjp->jp_name = NULL;
830 	jailparam_free(rtparams, nrt);
831 	return rval;
832 }
833 
834 /*
835  * Get the jail's jid if it is running.
836  */
837 static void
838 running_jid(struct cfjail *j, int dflag)
839 {
840 	struct iovec jiov[2];
841 	const char *pval;
842 	char *ep;
843 	int jid;
844 
845 	if ((pval = string_param(j->intparams[KP_JID]))) {
846 		if (!(jid = strtol(pval, &ep, 10)) || *ep) {
847 			j->jid = -1;
848 			return;
849 		}
850 		*(const void **)&jiov[0].iov_base = "jid";
851 		jiov[0].iov_len = sizeof("jid");
852 		jiov[1].iov_base = &jid;
853 		jiov[1].iov_len = sizeof(jid);
854 	} else if ((pval = string_param(j->intparams[KP_NAME]))) {
855 		*(const void **)&jiov[0].iov_base = "name";
856 		jiov[0].iov_len = sizeof("name");
857 		jiov[1].iov_len = strlen(pval) + 1;
858 		jiov[1].iov_base = alloca(jiov[1].iov_len);
859 		strcpy(jiov[1].iov_base, pval);
860 	} else {
861 		j->jid = -1;
862 		return;
863 	}
864 	j->jid = jail_get(jiov, 2, dflag ? JAIL_DYING : 0);
865 }
866 
867 static void
868 jail_quoted_warnx(const struct cfjail *j, const char *name_msg,
869     const char *noname_msg)
870 {
871 	const char *pval;
872 
873 	if ((pval = j->name) || (pval = string_param(j->intparams[KP_JID])) ||
874 	    (pval = string_param(j->intparams[KP_NAME])))
875 		warnx("\"%s\" %s", pval, name_msg);
876 	else
877 		warnx("%s", noname_msg);
878 }
879 
880 /*
881  * Set jail parameters and possible print them out.
882  */
883 static int
884 jailparam_set_note(const struct cfjail *j, struct jailparam *jp, unsigned njp,
885     int flags)
886 {
887 	char *value;
888 	int jid;
889 	unsigned i;
890 
891 	jid = jailparam_set(jp, njp, flags);
892 	if (verbose > 0) {
893 		jail_note(j, "jail_set(%s%s)",
894 		    (flags & (JAIL_CREATE | JAIL_UPDATE)) == JAIL_CREATE
895 		    ? "JAIL_CREATE" : "JAIL_UPDATE",
896 		    (flags & JAIL_DYING) ? " | JAIL_DYING" : "");
897 		for (i = 0; i < njp; i++) {
898 			printf(" %s", jp[i].jp_name);
899 			if (jp[i].jp_value == NULL)
900 				continue;
901 			putchar('=');
902 			value = jailparam_export(jp + i);
903 			if (value == NULL)
904 				err(1, "jailparam_export");
905 			quoted_print(stdout, value);
906 			free(value);
907 		}
908 		if (jid < 0)
909 			printf(": %s", strerror(errno));
910 		printf("\n");
911 	}
912 	return jid;
913 }
914 
915 /*
916  * Print a jail record.
917  */
918 static void
919 print_jail(FILE *fp, struct cfjail *j, int oldcl)
920 {
921 	struct cfparam *p;
922 
923 	if (oldcl) {
924 		fprintf(fp, "%d\t", j->jid);
925 		print_param(fp, j->intparams[KP_PATH], ',', 0);
926 		putc('\t', fp);
927 		print_param(fp, j->intparams[KP_HOST_HOSTNAME], ',', 0);
928 		putc('\t', fp);
929 #ifdef INET
930 		print_param(fp, j->intparams[KP_IP4_ADDR], ',', 0);
931 #ifdef INET6
932 		if (j->intparams[KP_IP4_ADDR] &&
933 		    !TAILQ_EMPTY(&j->intparams[KP_IP4_ADDR]->val) &&
934 		    j->intparams[KP_IP6_ADDR] &&
935 		    !TAILQ_EMPTY(&j->intparams[KP_IP6_ADDR]->val))
936 		    putc(',', fp);
937 #endif
938 #endif
939 #ifdef INET6
940 		print_param(fp, j->intparams[KP_IP6_ADDR], ',', 0);
941 #endif
942 		putc('\t', fp);
943 		print_param(fp, j->intparams[IP_COMMAND], ' ', 0);
944 	} else {
945 		fprintf(fp, "jid=%d", j->jid);
946 		TAILQ_FOREACH(p, &j->params, tq)
947 			if (strcmp(p->name, "jid")) {
948 				putc(' ', fp);
949 				print_param(fp, p, ',', 1);
950 			}
951 	}
952 	putc('\n', fp);
953 }
954 
955 /*
956  * Print a parameter value, or a name=value pair.
957  */
958 static void
959 print_param(FILE *fp, const struct cfparam *p, int sep, int doname)
960 {
961 	const struct cfstring *s, *ts;
962 
963 	if (doname)
964 		fputs(p->name, fp);
965 	if (p == NULL || TAILQ_EMPTY(&p->val))
966 		return;
967 	if (doname)
968 		putc('=', fp);
969 	TAILQ_FOREACH_SAFE(s, &p->val, tq, ts) {
970 		quoted_print(fp, s->s);
971 		if (ts != NULL)
972 			putc(sep, fp);
973 	}
974 }
975 
976 /*
977  * Print a string with quotes around spaces.
978  */
979 static void
980 quoted_print(FILE *fp, char *str)
981 {
982 	int c, qc;
983 	char *p = str;
984 
985 	qc = !*p ? '"'
986 	    : strchr(p, '\'') ? '"'
987 	    : strchr(p, '"') ? '\''
988 	    : strchr(p, ' ') || strchr(p, '\t') ? '"'
989 	    : 0;
990 	if (qc)
991 		putc(qc, fp);
992 	while ((c = *p++)) {
993 		if (c == '\\' || c == qc)
994 			putc('\\', fp);
995 		putc(c, fp);
996 	}
997 	if (qc)
998 		putc(qc, fp);
999 }
1000 
1001 static void
1002 usage(void)
1003 {
1004 
1005 	(void)fprintf(stderr,
1006 	    "usage: jail [-dhilqv] [-J jid_file] [-u username] [-U username]\n"
1007 	    "            -[cmr] param=value ... [command=command ...]\n"
1008 	    "       jail [-dqv] [-f file] -[cmr] [jail]\n"
1009 	    "       jail [-qv] [-f file] -[rR] ['*' | jail ...]\n"
1010 	    "       jail [-dhilqv] [-J jid_file] [-u username] [-U username]\n"
1011 	    "            [-n jailname] [-s securelevel]\n"
1012 	    "            path hostname [ip[,...]] command ...\n");
1013 	exit(1);
1014 }
1015