1 /*- 2 * Copyright (c) 1999 Poul-Henning Kamp. 3 * Copyright (c) 2009-2012 James Gritton 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25 * SUCH DAMAGE. 26 */ 27 28 #include <sys/cdefs.h> 29 __FBSDID("$FreeBSD$"); 30 31 #include <sys/types.h> 32 #include <sys/stat.h> 33 #include <sys/socket.h> 34 #include <sys/sysctl.h> 35 36 #include <arpa/inet.h> 37 #include <netinet/in.h> 38 39 #include <err.h> 40 #include <errno.h> 41 #include <stdarg.h> 42 #include <stdio.h> 43 #include <stdlib.h> 44 #include <string.h> 45 #include <unistd.h> 46 47 #include "jailp.h" 48 49 #define JP_RDTUN(jp) (((jp)->jp_ctltype & CTLFLAG_RDTUN) == CTLFLAG_RDTUN) 50 51 struct permspec { 52 const char *name; 53 enum intparam ipnum; 54 int rev; 55 }; 56 57 const char *cfname; 58 int iflag; 59 int note_remove; 60 int verbose; 61 62 static void clear_persist(struct cfjail *j); 63 static int update_jail(struct cfjail *j); 64 static int rdtun_params(struct cfjail *j, int dofail); 65 static void running_jid(struct cfjail *j, int dflag); 66 static void jail_quoted_warnx(const struct cfjail *j, const char *name_msg, 67 const char *noname_msg); 68 static int jailparam_set_note(const struct cfjail *j, struct jailparam *jp, 69 unsigned njp, int flags); 70 static void print_jail(FILE *fp, struct cfjail *j, int oldcl); 71 static void print_param(FILE *fp, const struct cfparam *p, int sep, int doname); 72 static void quoted_print(FILE *fp, char *str); 73 static void usage(void); 74 75 static struct permspec perm_sysctl[] = { 76 { "security.jail.set_hostname_allowed", KP_ALLOW_SET_HOSTNAME, 0 }, 77 { "security.jail.sysvipc_allowed", KP_ALLOW_SYSVIPC, 0 }, 78 { "security.jail.allow_raw_sockets", KP_ALLOW_RAW_SOCKETS, 0 }, 79 { "security.jail.chflags_allowed", KP_ALLOW_CHFLAGS, 0 }, 80 { "security.jail.mount_allowed", KP_ALLOW_MOUNT, 0 }, 81 { "security.jail.socket_unixiproute_only", KP_ALLOW_SOCKET_AF, 1 }, 82 }; 83 84 static const enum intparam startcommands[] = { 85 IP__NULL, 86 #ifdef INET 87 IP__IP4_IFADDR, 88 #endif 89 #ifdef INET6 90 IP__IP6_IFADDR, 91 #endif 92 IP_MOUNT, 93 IP__MOUNT_FROM_FSTAB, 94 IP_MOUNT_DEVFS, 95 IP_EXEC_PRESTART, 96 IP__OP, 97 IP_VNET_INTERFACE, 98 IP_EXEC_START, 99 IP_COMMAND, 100 IP_EXEC_POSTSTART, 101 IP__NULL 102 }; 103 104 static const enum intparam stopcommands[] = { 105 IP__NULL, 106 IP_EXEC_PRESTOP, 107 IP_EXEC_STOP, 108 IP_STOP_TIMEOUT, 109 IP__OP, 110 IP_EXEC_POSTSTOP, 111 IP_MOUNT_DEVFS, 112 IP__MOUNT_FROM_FSTAB, 113 IP_MOUNT, 114 #ifdef INET6 115 IP__IP6_IFADDR, 116 #endif 117 #ifdef INET 118 IP__IP4_IFADDR, 119 #endif 120 IP__NULL 121 }; 122 123 int 124 main(int argc, char **argv) 125 { 126 struct stat st; 127 FILE *jfp; 128 struct cfjail *j; 129 char *JidFile; 130 size_t sysvallen; 131 unsigned op, pi; 132 int ch, docf, error, i, oldcl, sysval; 133 int dflag, Rflag; 134 char enforce_statfs[4]; 135 #if defined(INET) || defined(INET6) 136 char *cs, *ncs; 137 #endif 138 #if defined(INET) && defined(INET6) 139 struct in6_addr addr6; 140 #endif 141 142 op = 0; 143 dflag = Rflag = 0; 144 docf = 1; 145 cfname = CONF_FILE; 146 JidFile = NULL; 147 148 while ((ch = getopt(argc, argv, "cdf:hiJ:lmn:p:qrRs:U:v")) != -1) { 149 switch (ch) { 150 case 'c': 151 op |= JF_START; 152 break; 153 case 'd': 154 dflag = 1; 155 break; 156 case 'f': 157 cfname = optarg; 158 break; 159 case 'h': 160 #if defined(INET) || defined(INET6) 161 add_param(NULL, NULL, IP_IP_HOSTNAME, NULL); 162 #endif 163 docf = 0; 164 break; 165 case 'i': 166 iflag = 1; 167 verbose = -1; 168 break; 169 case 'J': 170 JidFile = optarg; 171 break; 172 case 'l': 173 add_param(NULL, NULL, IP_EXEC_CLEAN, NULL); 174 docf = 0; 175 break; 176 case 'm': 177 op |= JF_SET; 178 break; 179 case 'n': 180 add_param(NULL, NULL, KP_NAME, optarg); 181 docf = 0; 182 break; 183 case 'p': 184 paralimit = strtol(optarg, NULL, 10); 185 if (paralimit == 0) 186 paralimit = -1; 187 break; 188 case 'q': 189 verbose = -1; 190 break; 191 case 'r': 192 op |= JF_STOP; 193 break; 194 case 'R': 195 op |= JF_STOP; 196 Rflag = 1; 197 break; 198 case 's': 199 add_param(NULL, NULL, KP_SECURELEVEL, optarg); 200 docf = 0; 201 break; 202 case 'u': 203 add_param(NULL, NULL, IP_EXEC_JAIL_USER, optarg); 204 add_param(NULL, NULL, IP_EXEC_SYSTEM_JAIL_USER, NULL); 205 docf = 0; 206 break; 207 case 'U': 208 add_param(NULL, NULL, IP_EXEC_JAIL_USER, optarg); 209 add_param(NULL, NULL, IP_EXEC_SYSTEM_JAIL_USER, 210 "false"); 211 docf = 0; 212 break; 213 case 'v': 214 verbose = 1; 215 break; 216 default: 217 usage(); 218 } 219 } 220 argc -= optind; 221 argv += optind; 222 223 /* Find out which of the four command line styles this is. */ 224 oldcl = 0; 225 if (!op) { 226 /* Old-style command line with four fixed parameters */ 227 if (argc < 4 || argv[0][0] != '/') 228 usage(); 229 op = JF_START; 230 docf = 0; 231 oldcl = 1; 232 add_param(NULL, NULL, KP_PATH, argv[0]); 233 add_param(NULL, NULL, KP_HOST_HOSTNAME, argv[1]); 234 #if defined(INET) || defined(INET6) 235 if (argv[2][0] != '\0') { 236 for (cs = argv[2];; cs = ncs + 1) { 237 ncs = strchr(cs, ','); 238 if (ncs) 239 *ncs = '\0'; 240 add_param(NULL, NULL, 241 #if defined(INET) && defined(INET6) 242 inet_pton(AF_INET6, cs, &addr6) == 1 243 ? KP_IP6_ADDR : KP_IP4_ADDR, 244 #elif defined(INET) 245 KP_IP4_ADDR, 246 #elif defined(INET6) 247 KP_IP6_ADDR, 248 #endif 249 cs); 250 if (!ncs) 251 break; 252 } 253 } 254 #endif 255 for (i = 3; i < argc; i++) 256 add_param(NULL, NULL, IP_COMMAND, argv[i]); 257 /* Emulate the defaults from security.jail.* sysctls. */ 258 sysvallen = sizeof(sysval); 259 if (sysctlbyname("security.jail.jailed", &sysval, &sysvallen, 260 NULL, 0) == 0 && sysval == 0) { 261 for (pi = 0; pi < sizeof(perm_sysctl) / 262 sizeof(perm_sysctl[0]); pi++) { 263 sysvallen = sizeof(sysval); 264 if (sysctlbyname(perm_sysctl[pi].name, 265 &sysval, &sysvallen, NULL, 0) == 0) 266 add_param(NULL, NULL, 267 perm_sysctl[pi].ipnum, 268 (sysval ? 1 : 0) ^ 269 perm_sysctl[pi].rev 270 ? NULL : "false"); 271 } 272 sysvallen = sizeof(sysval); 273 if (sysctlbyname("security.jail.enforce_statfs", 274 &sysval, &sysvallen, NULL, 0) == 0) { 275 snprintf(enforce_statfs, 276 sizeof(enforce_statfs), "%d", sysval); 277 add_param(NULL, NULL, KP_ENFORCE_STATFS, 278 enforce_statfs); 279 } 280 } 281 } else if (op == JF_STOP) { 282 /* Jail remove, perhaps using the config file */ 283 if (!docf || argc == 0) 284 usage(); 285 if (!Rflag) 286 for (i = 0; i < argc; i++) 287 if (strchr(argv[i], '=')) 288 usage(); 289 if ((docf = !Rflag && 290 (!strcmp(cfname, "-") || stat(cfname, &st) == 0))) 291 load_config(); 292 note_remove = docf || argc > 1 || wild_jail_name(argv[0]); 293 } else if (argc > 1 || (argc == 1 && strchr(argv[0], '='))) { 294 /* Single jail specified on the command line */ 295 if (Rflag) 296 usage(); 297 docf = 0; 298 for (i = 0; i < argc; i++) { 299 if (!strncmp(argv[i], "command", 7) && 300 (argv[i][7] == '\0' || argv[i][7] == '=')) { 301 if (argv[i][7] == '=') 302 add_param(NULL, NULL, IP_COMMAND, 303 argv[i] + 8); 304 for (i++; i < argc; i++) 305 add_param(NULL, NULL, IP_COMMAND, 306 argv[i]); 307 break; 308 } 309 add_param(NULL, NULL, 0, argv[i]); 310 } 311 } else { 312 /* From the config file, perhaps with a specified jail */ 313 if (Rflag || !docf) 314 usage(); 315 load_config(); 316 } 317 318 /* Find out which jails will be run. */ 319 dep_setup(docf); 320 error = 0; 321 if (op == JF_STOP) { 322 for (i = 0; i < argc; i++) 323 if (start_state(argv[i], docf, op, Rflag) < 0) 324 error = 1; 325 } else { 326 if (start_state(argv[0], docf, op, 0) < 0) 327 exit(1); 328 } 329 330 jfp = NULL; 331 if (JidFile != NULL) { 332 jfp = fopen(JidFile, "w"); 333 if (jfp == NULL) 334 err(1, "open %s", JidFile); 335 setlinebuf(jfp); 336 } 337 setlinebuf(stdout); 338 339 /* 340 * The main loop: Get an available jail and perform the required 341 * operation on it. When that is done, the jail may be finished, 342 * or it may go back for the next step. 343 */ 344 while ((j = next_jail())) 345 { 346 if (j->flags & JF_FAILED) { 347 error = 1; 348 if (j->comparam == NULL) { 349 dep_done(j, 0); 350 continue; 351 } 352 } 353 if (!(j->flags & JF_PARAMS)) 354 { 355 j->flags |= JF_PARAMS; 356 if (dflag) 357 add_param(j, NULL, IP_ALLOW_DYING, NULL); 358 if (check_intparams(j) < 0) 359 continue; 360 if ((j->flags & (JF_START | JF_SET)) && 361 import_params(j) < 0) 362 continue; 363 } 364 if (!j->jid) 365 running_jid(j, 366 (j->flags & (JF_SET | JF_DEPEND)) == JF_SET 367 ? dflag || bool_param(j->intparams[IP_ALLOW_DYING]) 368 : 0); 369 if (finish_command(j)) 370 continue; 371 372 switch (j->flags & JF_OP_MASK) { 373 /* 374 * These operations just turn into a different op 375 * depending on the jail's current status. 376 */ 377 case JF_START_SET: 378 j->flags = j->jid < 0 ? JF_START : JF_SET; 379 break; 380 case JF_SET_RESTART: 381 if (j->jid < 0) { 382 jail_quoted_warnx(j, "not found", 383 "no jail specified"); 384 failed(j); 385 continue; 386 } 387 j->flags = rdtun_params(j, 0) ? JF_RESTART : JF_SET; 388 if (j->flags == JF_RESTART) 389 dep_reset(j); 390 break; 391 case JF_START_SET_RESTART: 392 j->flags = j->jid < 0 ? JF_START 393 : rdtun_params(j, 0) ? JF_RESTART : JF_SET; 394 if (j->flags == JF_RESTART) 395 dep_reset(j); 396 } 397 398 switch (j->flags & JF_OP_MASK) { 399 case JF_START: 400 if (j->comparam == NULL) { 401 if (j->jid > 0 && 402 !(j->flags & (JF_DEPEND | JF_WILD))) { 403 jail_quoted_warnx(j, "already exists", 404 NULL); 405 failed(j); 406 continue; 407 } 408 if (dep_check(j)) 409 continue; 410 if (j->jid > 0) 411 goto jail_create_done; 412 j->comparam = startcommands; 413 j->comstring = NULL; 414 } 415 if (next_command(j)) 416 continue; 417 jail_create_done: 418 clear_persist(j); 419 if (jfp != NULL) 420 print_jail(jfp, j, oldcl); 421 dep_done(j, 0); 422 break; 423 424 case JF_SET: 425 if (j->jid < 0 && !(j->flags & JF_DEPEND)) { 426 jail_quoted_warnx(j, "not found", 427 "no jail specified"); 428 failed(j); 429 continue; 430 } 431 if (dep_check(j)) 432 continue; 433 if (!(j->flags & JF_DEPEND)) { 434 if (rdtun_params(j, 1) < 0 || 435 update_jail(j) < 0) 436 continue; 437 if (verbose >= 0 && (j->name || verbose > 0)) 438 jail_note(j, "updated\n"); 439 } 440 dep_done(j, 0); 441 break; 442 443 case JF_STOP: 444 case JF_RESTART: 445 if (j->comparam == NULL) { 446 if (dep_check(j)) 447 continue; 448 if (j->jid < 0) { 449 if (!(j->flags & (JF_DEPEND | JF_WILD)) 450 && verbose >= 0) 451 jail_quoted_warnx(j, 452 "not found", NULL); 453 goto jail_remove_done; 454 } 455 j->comparam = stopcommands; 456 j->comstring = NULL; 457 } else if ((j->flags & JF_FAILED) && j->jid > 0) 458 goto jail_remove_done; 459 if (next_command(j)) 460 continue; 461 jail_remove_done: 462 dep_done(j, 0); 463 if ((j->flags & (JF_START | JF_FAILED)) == JF_START) { 464 j->comparam = NULL; 465 j->flags &= ~JF_STOP; 466 dep_reset(j); 467 requeue(j, j->ndeps ? &depend : &ready); 468 } 469 break; 470 } 471 } 472 473 if (jfp != NULL) 474 fclose(jfp); 475 exit(error); 476 } 477 478 /* 479 * Mark a jail's failure for future handling. 480 */ 481 void 482 failed(struct cfjail *j) 483 { 484 j->flags |= JF_FAILED; 485 TAILQ_REMOVE(j->queue, j, tq); 486 TAILQ_INSERT_HEAD(&ready, j, tq); 487 j->queue = &ready; 488 } 489 490 /* 491 * Exit slightly more gracefully when out of memory. 492 */ 493 void * 494 emalloc(size_t size) 495 { 496 void *p; 497 498 p = malloc(size); 499 if (!p) 500 err(1, "malloc"); 501 return p; 502 } 503 504 void * 505 erealloc(void *ptr, size_t size) 506 { 507 void *p; 508 509 p = realloc(ptr, size); 510 if (!p) 511 err(1, "malloc"); 512 return p; 513 } 514 515 char * 516 estrdup(const char *str) 517 { 518 char *ns; 519 520 ns = strdup(str); 521 if (!ns) 522 err(1, "malloc"); 523 return ns; 524 } 525 526 /* 527 * Print a message including an optional jail name. 528 */ 529 void 530 jail_note(const struct cfjail *j, const char *fmt, ...) 531 { 532 va_list ap, tap; 533 char *cs; 534 size_t len; 535 536 va_start(ap, fmt); 537 va_copy(tap, ap); 538 len = vsnprintf(NULL, 0, fmt, tap); 539 va_end(tap); 540 cs = alloca(len + 1); 541 (void)vsnprintf(cs, len + 1, fmt, ap); 542 va_end(ap); 543 if (j->name) 544 printf("%s: %s", j->name, cs); 545 else 546 printf("%s", cs); 547 } 548 549 /* 550 * Print a warning message including an optional jail name. 551 */ 552 void 553 jail_warnx(const struct cfjail *j, const char *fmt, ...) 554 { 555 va_list ap, tap; 556 char *cs; 557 size_t len; 558 559 va_start(ap, fmt); 560 va_copy(tap, ap); 561 len = vsnprintf(NULL, 0, fmt, tap); 562 va_end(tap); 563 cs = alloca(len + 1); 564 (void)vsnprintf(cs, len + 1, fmt, ap); 565 va_end(ap); 566 if (j->name) 567 warnx("%s: %s", j->name, cs); 568 else 569 warnx("%s", cs); 570 } 571 572 /* 573 * Create a new jail. 574 */ 575 int 576 create_jail(struct cfjail *j) 577 { 578 struct iovec jiov[4]; 579 struct stat st; 580 struct jailparam *jp, *setparams, *setparams2, *sjp; 581 const char *path; 582 int dopersist, ns, jid, dying, didfail; 583 584 /* 585 * Check the jail's path, with a better error message than jail_set 586 * gives. 587 */ 588 if ((path = string_param(j->intparams[KP_PATH]))) { 589 if (j->name != NULL && path[0] != '/') { 590 jail_warnx(j, "path %s: not an absolute pathname", 591 path); 592 return -1; 593 } 594 if (stat(path, &st) < 0) { 595 jail_warnx(j, "path %s: %s", path, strerror(errno)); 596 return -1; 597 } 598 if (!S_ISDIR(st.st_mode)) { 599 jail_warnx(j, "path %s: %s", path, strerror(ENOTDIR)); 600 return -1; 601 } 602 } 603 604 /* 605 * Copy all the parameters, except that "persist" is always set when 606 * there are commands to run later. 607 */ 608 dopersist = !bool_param(j->intparams[KP_PERSIST]) && 609 (j->intparams[IP_EXEC_START] || j->intparams[IP_COMMAND] || 610 j->intparams[IP_EXEC_POSTSTART]); 611 sjp = setparams = 612 alloca((j->njp + dopersist) * sizeof(struct jailparam)); 613 if (dopersist && jailparam_init(sjp++, "persist") < 0) { 614 jail_warnx(j, "%s", jail_errmsg); 615 return -1; 616 } 617 for (jp = j->jp; jp < j->jp + j->njp; jp++) 618 if (!dopersist || !equalopts(jp->jp_name, "persist")) 619 *sjp++ = *jp; 620 ns = sjp - setparams; 621 622 didfail = 0; 623 j->jid = jailparam_set_note(j, setparams, ns, JAIL_CREATE); 624 if (j->jid < 0 && errno == EEXIST && 625 bool_param(j->intparams[IP_ALLOW_DYING]) && 626 int_param(j->intparams[KP_JID], &jid) && jid != 0) { 627 /* 628 * The jail already exists, but may be dying. 629 * Make sure it is, in which case an update is appropriate. 630 */ 631 *(const void **)&jiov[0].iov_base = "jid"; 632 jiov[0].iov_len = sizeof("jid"); 633 jiov[1].iov_base = &jid; 634 jiov[1].iov_len = sizeof(jid); 635 *(const void **)&jiov[2].iov_base = "dying"; 636 jiov[2].iov_len = sizeof("dying"); 637 jiov[3].iov_base = &dying; 638 jiov[3].iov_len = sizeof(dying); 639 if (jail_get(jiov, 4, JAIL_DYING) < 0) { 640 /* 641 * It could be that the jail just barely finished 642 * dying, or it could be that the jid never existed 643 * but the name does. In either case, another try 644 * at creating the jail should do the right thing. 645 */ 646 if (errno == ENOENT) 647 j->jid = jailparam_set_note(j, setparams, ns, 648 JAIL_CREATE); 649 } else if (dying) { 650 j->jid = jid; 651 if (rdtun_params(j, 1) < 0) { 652 j->jid = -1; 653 didfail = 1; 654 } else { 655 sjp = setparams2 = alloca((j->njp + dopersist) * 656 sizeof(struct jailparam)); 657 for (jp = setparams; jp < setparams + ns; jp++) 658 if (!JP_RDTUN(jp) || 659 !strcmp(jp->jp_name, "jid")) 660 *sjp++ = *jp; 661 j->jid = jailparam_set_note(j, setparams2, 662 sjp - setparams2, JAIL_UPDATE | JAIL_DYING); 663 /* 664 * Again, perhaps the jail just finished dying. 665 */ 666 if (j->jid < 0 && errno == ENOENT) 667 j->jid = jailparam_set_note(j, 668 setparams, ns, JAIL_CREATE); 669 } 670 } 671 } 672 if (j->jid < 0 && !didfail) { 673 jail_warnx(j, "%s", jail_errmsg); 674 failed(j); 675 } 676 if (dopersist) { 677 jailparam_free(setparams, 1); 678 if (j->jid > 0) 679 j->flags |= JF_PERSIST; 680 } 681 return j->jid; 682 } 683 684 /* 685 * Remove a temporarily set "persist" parameter. 686 */ 687 static void 688 clear_persist(struct cfjail *j) 689 { 690 struct iovec jiov[4]; 691 int jid; 692 693 if (!(j->flags & JF_PERSIST)) 694 return; 695 j->flags &= ~JF_PERSIST; 696 *(const void **)&jiov[0].iov_base = "jid"; 697 jiov[0].iov_len = sizeof("jid"); 698 jiov[1].iov_base = &j->jid; 699 jiov[1].iov_len = sizeof(j->jid); 700 *(const void **)&jiov[2].iov_base = "nopersist"; 701 jiov[2].iov_len = sizeof("nopersist"); 702 jiov[3].iov_base = NULL; 703 jiov[3].iov_len = 0; 704 jid = jail_set(jiov, 4, JAIL_UPDATE); 705 if (verbose > 0) 706 jail_note(j, "jail_set(JAIL_UPDATE) jid=%d nopersist%s%s\n", 707 j->jid, jid < 0 ? ": " : "", 708 jid < 0 ? strerror(errno) : ""); 709 } 710 711 /* 712 * Set a jail's parameters. 713 */ 714 static int 715 update_jail(struct cfjail *j) 716 { 717 struct jailparam *jp, *setparams, *sjp; 718 int ns, jid; 719 720 ns = 0; 721 for (jp = j->jp; jp < j->jp + j->njp; jp++) 722 if (!JP_RDTUN(jp)) 723 ns++; 724 if (ns == 0) 725 return 0; 726 sjp = setparams = alloca(++ns * sizeof(struct jailparam)); 727 if (jailparam_init(sjp, "jid") < 0 || 728 jailparam_import_raw(sjp, &j->jid, sizeof j->jid) < 0) { 729 jail_warnx(j, "%s", jail_errmsg); 730 failed(j); 731 return -1; 732 } 733 for (jp = j->jp; jp < j->jp + j->njp; jp++) 734 if (!JP_RDTUN(jp)) 735 *++sjp = *jp; 736 737 jid = jailparam_set_note(j, setparams, ns, 738 bool_param(j->intparams[IP_ALLOW_DYING]) 739 ? JAIL_UPDATE | JAIL_DYING : JAIL_UPDATE); 740 if (jid < 0) { 741 jail_warnx(j, "%s", jail_errmsg); 742 failed(j); 743 } 744 jailparam_free(setparams, 1); 745 return jid; 746 } 747 748 /* 749 * Return if a jail set would change any create-only parameters. 750 */ 751 static int 752 rdtun_params(struct cfjail *j, int dofail) 753 { 754 struct jailparam *jp, *rtparams, *rtjp; 755 int nrt, rval; 756 757 if (j->flags & JF_RDTUN) 758 return 0; 759 j->flags |= JF_RDTUN; 760 nrt = 0; 761 for (jp = j->jp; jp < j->jp + j->njp; jp++) 762 if (JP_RDTUN(jp) && strcmp(jp->jp_name, "jid")) 763 nrt++; 764 if (nrt == 0) 765 return 0; 766 rtjp = rtparams = alloca(++nrt * sizeof(struct jailparam)); 767 if (jailparam_init(rtjp, "jid") < 0 || 768 jailparam_import_raw(rtjp, &j->jid, sizeof j->jid) < 0) { 769 jail_warnx(j, "%s", jail_errmsg); 770 exit(1); 771 } 772 for (jp = j->jp; jp < j->jp + j->njp; jp++) 773 if (JP_RDTUN(jp) && strcmp(jp->jp_name, "jid")) 774 *++rtjp = *jp; 775 rval = 0; 776 if (jailparam_get(rtparams, nrt, 777 bool_param(j->intparams[IP_ALLOW_DYING]) ? JAIL_DYING : 0) > 0) { 778 rtjp = rtparams + 1; 779 for (jp = j->jp, rtjp = rtparams + 1; rtjp < rtparams + nrt; 780 jp++) { 781 if (JP_RDTUN(jp) && strcmp(jp->jp_name, "jid")) { 782 if (!((jp->jp_flags & (JP_BOOL | JP_NOBOOL)) && 783 jp->jp_valuelen == 0 && 784 *(int *)jp->jp_value) && 785 !(rtjp->jp_valuelen == jp->jp_valuelen && 786 !memcmp(rtjp->jp_value, jp->jp_value, 787 jp->jp_valuelen))) { 788 if (dofail) { 789 jail_warnx(j, "%s cannot be " 790 "changed after creation", 791 jp->jp_name); 792 failed(j); 793 rval = -1; 794 } else 795 rval = 1; 796 break; 797 } 798 rtjp++; 799 } 800 } 801 } 802 for (rtjp = rtparams + 1; rtjp < rtparams + nrt; rtjp++) 803 rtjp->jp_name = NULL; 804 jailparam_free(rtparams, nrt); 805 return rval; 806 } 807 808 /* 809 * Get the jail's jid if it is running. 810 */ 811 static void 812 running_jid(struct cfjail *j, int dflag) 813 { 814 struct iovec jiov[2]; 815 const char *pval; 816 char *ep; 817 int jid; 818 819 if ((pval = string_param(j->intparams[KP_JID]))) { 820 if (!(jid = strtol(pval, &ep, 10)) || *ep) { 821 j->jid = -1; 822 return; 823 } 824 *(const void **)&jiov[0].iov_base = "jid"; 825 jiov[0].iov_len = sizeof("jid"); 826 jiov[1].iov_base = &jid; 827 jiov[1].iov_len = sizeof(jid); 828 } else if ((pval = string_param(j->intparams[KP_NAME]))) { 829 *(const void **)&jiov[0].iov_base = "name"; 830 jiov[0].iov_len = sizeof("name"); 831 jiov[1].iov_len = strlen(pval) + 1; 832 jiov[1].iov_base = alloca(jiov[1].iov_len); 833 strcpy(jiov[1].iov_base, pval); 834 } else { 835 j->jid = -1; 836 return; 837 } 838 j->jid = jail_get(jiov, 2, dflag ? JAIL_DYING : 0); 839 } 840 841 static void 842 jail_quoted_warnx(const struct cfjail *j, const char *name_msg, 843 const char *noname_msg) 844 { 845 const char *pval; 846 847 if ((pval = j->name) || (pval = string_param(j->intparams[KP_JID])) || 848 (pval = string_param(j->intparams[KP_NAME]))) 849 warnx("\"%s\" %s", pval, name_msg); 850 else 851 warnx("%s", noname_msg); 852 } 853 854 /* 855 * Set jail parameters and possible print them out. 856 */ 857 static int 858 jailparam_set_note(const struct cfjail *j, struct jailparam *jp, unsigned njp, 859 int flags) 860 { 861 char *value; 862 int jid; 863 unsigned i; 864 865 jid = jailparam_set(jp, njp, flags); 866 if (verbose > 0) { 867 jail_note(j, "jail_set(%s%s)", 868 (flags & (JAIL_CREATE | JAIL_UPDATE)) == JAIL_CREATE 869 ? "JAIL_CREATE" : "JAIL_UPDATE", 870 (flags & JAIL_DYING) ? " | JAIL_DYING" : ""); 871 for (i = 0; i < njp; i++) { 872 printf(" %s", jp[i].jp_name); 873 if (jp[i].jp_value == NULL) 874 continue; 875 putchar('='); 876 value = jailparam_export(jp + i); 877 if (value == NULL) 878 err(1, "jailparam_export"); 879 quoted_print(stdout, value); 880 free(value); 881 } 882 if (jid < 0) 883 printf(": %s", strerror(errno)); 884 printf("\n"); 885 } 886 return jid; 887 } 888 889 /* 890 * Print a jail record. 891 */ 892 static void 893 print_jail(FILE *fp, struct cfjail *j, int oldcl) 894 { 895 struct cfparam *p; 896 897 if (oldcl) { 898 fprintf(fp, "%d\t", j->jid); 899 print_param(fp, j->intparams[KP_PATH], ',', 0); 900 putc('\t', fp); 901 print_param(fp, j->intparams[KP_HOST_HOSTNAME], ',', 0); 902 putc('\t', fp); 903 #ifdef INET 904 print_param(fp, j->intparams[KP_IP4_ADDR], ',', 0); 905 #ifdef INET6 906 if (j->intparams[KP_IP4_ADDR] && 907 !TAILQ_EMPTY(&j->intparams[KP_IP4_ADDR]->val) && 908 j->intparams[KP_IP6_ADDR] && 909 !TAILQ_EMPTY(&j->intparams[KP_IP6_ADDR]->val)) 910 putc(',', fp); 911 #endif 912 #endif 913 #ifdef INET6 914 print_param(fp, j->intparams[KP_IP6_ADDR], ',', 0); 915 #endif 916 putc('\t', fp); 917 print_param(fp, j->intparams[IP_COMMAND], ' ', 0); 918 } else { 919 fprintf(fp, "jid=%d", j->jid); 920 TAILQ_FOREACH(p, &j->params, tq) 921 if (strcmp(p->name, "jid")) { 922 putc(' ', fp); 923 print_param(fp, p, ',', 1); 924 } 925 } 926 putc('\n', fp); 927 } 928 929 /* 930 * Print a parameter value, or a name=value pair. 931 */ 932 static void 933 print_param(FILE *fp, const struct cfparam *p, int sep, int doname) 934 { 935 const struct cfstring *s, *ts; 936 937 if (doname) 938 fputs(p->name, fp); 939 if (p == NULL || TAILQ_EMPTY(&p->val)) 940 return; 941 if (doname) 942 putc('=', fp); 943 TAILQ_FOREACH_SAFE(s, &p->val, tq, ts) { 944 quoted_print(fp, s->s); 945 if (ts != NULL) 946 putc(sep, fp); 947 } 948 } 949 950 /* 951 * Print a string with quotes around spaces. 952 */ 953 static void 954 quoted_print(FILE *fp, char *str) 955 { 956 int c, qc; 957 char *p = str; 958 959 qc = !*p ? '"' 960 : strchr(p, '\'') ? '"' 961 : strchr(p, '"') ? '\'' 962 : strchr(p, ' ') || strchr(p, '\t') ? '"' 963 : 0; 964 if (qc) 965 putc(qc, fp); 966 while ((c = *p++)) { 967 if (c == '\\' || c == qc) 968 putc('\\', fp); 969 putc(c, fp); 970 } 971 if (qc) 972 putc(qc, fp); 973 } 974 975 static void 976 usage(void) 977 { 978 979 (void)fprintf(stderr, 980 "usage: jail [-dhilqv] [-J jid_file] [-u username] [-U username]\n" 981 " -[cmr] param=value ... [command=command ...]\n" 982 " jail [-dqv] [-f file] -[cmr] [jail]\n" 983 " jail [-qv] [-f file] -[rR] ['*' | jail ...]\n" 984 " jail [-dhilqv] [-J jid_file] [-u username] [-U username]\n" 985 " [-n jailname] [-s securelevel]\n" 986 " path hostname [ip[,...]] command ...\n"); 987 exit(1); 988 } 989