1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 3 * 4 * Copyright (c) 1999 Poul-Henning Kamp. 5 * Copyright (c) 2009-2012 James Gritton 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 */ 29 30 #include <sys/cdefs.h> 31 __FBSDID("$FreeBSD$"); 32 33 #include <sys/types.h> 34 #include <sys/stat.h> 35 #include <sys/socket.h> 36 #include <sys/sysctl.h> 37 38 #include <arpa/inet.h> 39 #include <netinet/in.h> 40 41 #include <err.h> 42 #include <errno.h> 43 #include <stdarg.h> 44 #include <stdio.h> 45 #include <stdlib.h> 46 #include <string.h> 47 #include <unistd.h> 48 49 #include "jailp.h" 50 51 #define JP_RDTUN(jp) (((jp)->jp_ctltype & CTLFLAG_RDTUN) == CTLFLAG_RDTUN) 52 53 struct permspec { 54 const char *name; 55 enum intparam ipnum; 56 int rev; 57 }; 58 59 const char *cfname; 60 int iflag; 61 int note_remove; 62 int verbose; 63 const char *separator = "\t"; 64 65 static void clear_persist(struct cfjail *j); 66 static int update_jail(struct cfjail *j); 67 static int rdtun_params(struct cfjail *j, int dofail); 68 static void running_jid(struct cfjail *j, int dflag); 69 static void jail_quoted_warnx(const struct cfjail *j, const char *name_msg, 70 const char *noname_msg); 71 static int jailparam_set_note(const struct cfjail *j, struct jailparam *jp, 72 unsigned njp, int flags); 73 static void print_jail(FILE *fp, struct cfjail *j, int oldcl, int running); 74 static void print_param(FILE *fp, const struct cfparam *p, int sep, int doname); 75 static void show_jails(void); 76 static void quoted_print(FILE *fp, char *str); 77 static void usage(void); 78 79 static struct permspec perm_sysctl[] = { 80 { "security.jail.set_hostname_allowed", KP_ALLOW_SET_HOSTNAME, 0 }, 81 { "security.jail.sysvipc_allowed", KP_ALLOW_SYSVIPC, 0 }, 82 { "security.jail.allow_raw_sockets", KP_ALLOW_RAW_SOCKETS, 0 }, 83 { "security.jail.chflags_allowed", KP_ALLOW_CHFLAGS, 0 }, 84 { "security.jail.mount_allowed", KP_ALLOW_MOUNT, 0 }, 85 { "security.jail.socket_unixiproute_only", KP_ALLOW_SOCKET_AF, 1 }, 86 }; 87 88 static const enum intparam startcommands[] = { 89 IP__NULL, 90 IP_EXEC_PREPARE, 91 #ifdef INET 92 IP__IP4_IFADDR, 93 #endif 94 #ifdef INET6 95 IP__IP6_IFADDR, 96 #endif 97 IP_MOUNT, 98 IP__MOUNT_FROM_FSTAB, 99 IP_MOUNT_DEVFS, 100 IP_MOUNT_FDESCFS, 101 IP_MOUNT_PROCFS, 102 IP_EXEC_PRESTART, 103 IP__OP, 104 IP_EXEC_CREATED, 105 IP_VNET_INTERFACE, 106 IP_EXEC_START, 107 IP_COMMAND, 108 IP_EXEC_POSTSTART, 109 IP__NULL 110 }; 111 112 static const enum intparam stopcommands[] = { 113 IP__NULL, 114 IP_EXEC_PRESTOP, 115 IP_EXEC_STOP, 116 IP_STOP_TIMEOUT, 117 IP__OP, 118 IP_EXEC_POSTSTOP, 119 IP_MOUNT_PROCFS, 120 IP_MOUNT_FDESCFS, 121 IP_MOUNT_DEVFS, 122 IP__MOUNT_FROM_FSTAB, 123 IP_MOUNT, 124 #ifdef INET6 125 IP__IP6_IFADDR, 126 #endif 127 #ifdef INET 128 IP__IP4_IFADDR, 129 #endif 130 IP_EXEC_RELEASE, 131 IP__NULL 132 }; 133 134 int 135 main(int argc, char **argv) 136 { 137 struct stat st; 138 FILE *jfp; 139 struct cfjail *j; 140 char *JidFile; 141 size_t sysvallen; 142 unsigned op, pi; 143 int ch, docf, error, i, oldcl, sysval; 144 int dflag, Rflag; 145 #if defined(INET) || defined(INET6) 146 char *cs, *ncs; 147 #endif 148 #if defined(INET) && defined(INET6) 149 struct in6_addr addr6; 150 #endif 151 152 op = 0; 153 dflag = Rflag = 0; 154 docf = 1; 155 cfname = CONF_FILE; 156 JidFile = NULL; 157 158 while ((ch = getopt(argc, argv, "cde:f:hiJ:lmn:p:qrRs:u:U:v")) != -1) { 159 switch (ch) { 160 case 'c': 161 op |= JF_START; 162 break; 163 case 'd': 164 dflag = 1; 165 break; 166 case 'e': 167 op |= JF_SHOW; 168 separator = optarg; 169 break; 170 case 'f': 171 cfname = optarg; 172 break; 173 case 'h': 174 #if defined(INET) || defined(INET6) 175 add_param(NULL, NULL, IP_IP_HOSTNAME, NULL); 176 #endif 177 docf = 0; 178 break; 179 case 'i': 180 iflag = 1; 181 verbose = -1; 182 break; 183 case 'J': 184 JidFile = optarg; 185 break; 186 case 'l': 187 add_param(NULL, NULL, IP_EXEC_CLEAN, NULL); 188 docf = 0; 189 break; 190 case 'm': 191 op |= JF_SET; 192 break; 193 case 'n': 194 add_param(NULL, NULL, KP_NAME, optarg); 195 docf = 0; 196 break; 197 case 'p': 198 paralimit = strtol(optarg, NULL, 10); 199 if (paralimit == 0) 200 paralimit = -1; 201 break; 202 case 'q': 203 verbose = -1; 204 break; 205 case 'r': 206 op |= JF_STOP; 207 break; 208 case 'R': 209 op |= JF_STOP; 210 Rflag = 1; 211 break; 212 case 's': 213 add_param(NULL, NULL, KP_SECURELEVEL, optarg); 214 docf = 0; 215 break; 216 case 'u': 217 add_param(NULL, NULL, IP_EXEC_JAIL_USER, optarg); 218 add_param(NULL, NULL, IP_EXEC_SYSTEM_JAIL_USER, NULL); 219 docf = 0; 220 break; 221 case 'U': 222 add_param(NULL, NULL, IP_EXEC_JAIL_USER, optarg); 223 add_param(NULL, NULL, IP_EXEC_SYSTEM_JAIL_USER, 224 "false"); 225 docf = 0; 226 break; 227 case 'v': 228 verbose = 1; 229 break; 230 default: 231 usage(); 232 } 233 } 234 argc -= optind; 235 argv += optind; 236 237 /* Find out which of the four command line styles this is. */ 238 oldcl = 0; 239 if (!op) { 240 /* Old-style command line with four fixed parameters */ 241 if (argc < 4 || argv[0][0] != '/') 242 usage(); 243 op = JF_START; 244 docf = 0; 245 oldcl = 1; 246 add_param(NULL, NULL, KP_PATH, argv[0]); 247 add_param(NULL, NULL, KP_HOST_HOSTNAME, argv[1]); 248 #if defined(INET) || defined(INET6) 249 if (argv[2][0] != '\0') { 250 for (cs = argv[2];; cs = ncs + 1) { 251 ncs = strchr(cs, ','); 252 if (ncs) 253 *ncs = '\0'; 254 add_param(NULL, NULL, 255 #if defined(INET) && defined(INET6) 256 inet_pton(AF_INET6, cs, &addr6) == 1 257 ? KP_IP6_ADDR : KP_IP4_ADDR, 258 #elif defined(INET) 259 KP_IP4_ADDR, 260 #elif defined(INET6) 261 KP_IP6_ADDR, 262 #endif 263 cs); 264 if (!ncs) 265 break; 266 } 267 } 268 #endif 269 for (i = 3; i < argc; i++) 270 add_param(NULL, NULL, IP_COMMAND, argv[i]); 271 /* Emulate the defaults from security.jail.* sysctls. */ 272 sysvallen = sizeof(sysval); 273 if (sysctlbyname("security.jail.jailed", &sysval, &sysvallen, 274 NULL, 0) == 0 && sysval == 0) { 275 for (pi = 0; pi < sizeof(perm_sysctl) / 276 sizeof(perm_sysctl[0]); pi++) { 277 sysvallen = sizeof(sysval); 278 if (sysctlbyname(perm_sysctl[pi].name, 279 &sysval, &sysvallen, NULL, 0) == 0) 280 add_param(NULL, NULL, 281 perm_sysctl[pi].ipnum, 282 (sysval ? 1 : 0) ^ 283 perm_sysctl[pi].rev 284 ? NULL : "false"); 285 } 286 } 287 } else if (op == JF_STOP || op == JF_SHOW) { 288 /* Just print list of all configured non-wildcard jails */ 289 if (op == JF_SHOW) { 290 load_config(); 291 show_jails(); 292 exit(0); 293 } 294 /* Jail remove, perhaps using the config file */ 295 if (!docf || argc == 0) 296 usage(); 297 if (!Rflag) 298 for (i = 0; i < argc; i++) 299 if (strchr(argv[i], '=')) 300 usage(); 301 if ((docf = !Rflag && 302 (!strcmp(cfname, "-") || stat(cfname, &st) == 0))) 303 load_config(); 304 note_remove = docf || argc > 1 || wild_jail_name(argv[0]); 305 } else if (argc > 1 || (argc == 1 && strchr(argv[0], '='))) { 306 /* Single jail specified on the command line */ 307 if (Rflag) 308 usage(); 309 docf = 0; 310 for (i = 0; i < argc; i++) { 311 if (!strncmp(argv[i], "command", 7) && 312 (argv[i][7] == '\0' || argv[i][7] == '=')) { 313 if (argv[i][7] == '=') 314 add_param(NULL, NULL, IP_COMMAND, 315 argv[i] + 8); 316 for (i++; i < argc; i++) 317 add_param(NULL, NULL, IP_COMMAND, 318 argv[i]); 319 } 320 #ifdef INET 321 else if (!strncmp(argv[i], "ip4.addr=", 9)) { 322 for (cs = argv[i] + 9;; cs = ncs + 1) { 323 ncs = strchr(cs, ','); 324 if (ncs) 325 *ncs = '\0'; 326 add_param(NULL, NULL, KP_IP4_ADDR, cs); 327 if (!ncs) 328 break; 329 } 330 } 331 #endif 332 #ifdef INET6 333 else if (!strncmp(argv[i], "ip6.addr=", 9)) { 334 for (cs = argv[i] + 9;; cs = ncs + 1) { 335 ncs = strchr(cs, ','); 336 if (ncs) 337 *ncs = '\0'; 338 add_param(NULL, NULL, KP_IP6_ADDR, cs); 339 if (!ncs) 340 break; 341 } 342 } 343 #endif 344 else 345 add_param(NULL, NULL, 0, argv[i]); 346 } 347 } else { 348 /* From the config file, perhaps with a specified jail */ 349 if (Rflag || !docf) 350 usage(); 351 load_config(); 352 } 353 354 /* Find out which jails will be run. */ 355 dep_setup(docf); 356 error = 0; 357 if (op == JF_STOP) { 358 for (i = 0; i < argc; i++) 359 if (start_state(argv[i], docf, op, Rflag) < 0) 360 error = 1; 361 } else { 362 if (start_state(argv[0], docf, op, 0) < 0) 363 exit(1); 364 } 365 366 jfp = NULL; 367 if (JidFile != NULL) { 368 jfp = fopen(JidFile, "w"); 369 if (jfp == NULL) 370 err(1, "open %s", JidFile); 371 setlinebuf(jfp); 372 } 373 setlinebuf(stdout); 374 375 /* 376 * The main loop: Get an available jail and perform the required 377 * operation on it. When that is done, the jail may be finished, 378 * or it may go back for the next step. 379 */ 380 while ((j = next_jail())) 381 { 382 if (j->flags & JF_FAILED) { 383 error = 1; 384 if (j->comparam == NULL) { 385 dep_done(j, 0); 386 continue; 387 } 388 } 389 if (!(j->flags & JF_PARAMS)) 390 { 391 j->flags |= JF_PARAMS; 392 if (dflag) 393 add_param(j, NULL, IP_ALLOW_DYING, NULL); 394 if (check_intparams(j) < 0) 395 continue; 396 if ((j->flags & (JF_START | JF_SET)) && 397 import_params(j) < 0) 398 continue; 399 } 400 if (!j->jid) 401 running_jid(j, 402 (j->flags & (JF_SET | JF_DEPEND)) == JF_SET 403 ? dflag || bool_param(j->intparams[IP_ALLOW_DYING]) 404 : 0); 405 if (finish_command(j)) 406 continue; 407 408 switch (j->flags & JF_OP_MASK) { 409 /* 410 * These operations just turn into a different op 411 * depending on the jail's current status. 412 */ 413 case JF_START_SET: 414 j->flags = j->jid < 0 ? JF_START : JF_SET; 415 break; 416 case JF_SET_RESTART: 417 if (j->jid < 0) { 418 jail_quoted_warnx(j, "not found", 419 "no jail specified"); 420 failed(j); 421 continue; 422 } 423 j->flags = rdtun_params(j, 0) ? JF_RESTART : JF_SET; 424 if (j->flags == JF_RESTART) 425 dep_reset(j); 426 break; 427 case JF_START_SET_RESTART: 428 j->flags = j->jid < 0 ? JF_START 429 : rdtun_params(j, 0) ? JF_RESTART : JF_SET; 430 if (j->flags == JF_RESTART) 431 dep_reset(j); 432 } 433 434 switch (j->flags & JF_OP_MASK) { 435 case JF_START: 436 if (j->comparam == NULL) { 437 if (j->jid > 0 && 438 !(j->flags & (JF_DEPEND | JF_WILD))) { 439 jail_quoted_warnx(j, "already exists", 440 NULL); 441 failed(j); 442 continue; 443 } 444 if (dep_check(j)) 445 continue; 446 if (j->jid > 0) 447 goto jail_create_done; 448 j->comparam = startcommands; 449 j->comstring = NULL; 450 } 451 if (next_command(j)) 452 continue; 453 jail_create_done: 454 clear_persist(j); 455 if (jfp != NULL) 456 print_jail(jfp, j, oldcl, 1); 457 dep_done(j, 0); 458 break; 459 460 case JF_SET: 461 if (j->jid < 0 && !(j->flags & JF_DEPEND)) { 462 jail_quoted_warnx(j, "not found", 463 "no jail specified"); 464 failed(j); 465 continue; 466 } 467 if (dep_check(j)) 468 continue; 469 if (!(j->flags & JF_DEPEND)) { 470 if (rdtun_params(j, 1) < 0 || 471 update_jail(j) < 0) 472 continue; 473 if (verbose >= 0 && (j->name || verbose > 0)) 474 jail_note(j, "updated\n"); 475 } 476 dep_done(j, 0); 477 break; 478 479 case JF_STOP: 480 case JF_RESTART: 481 if (j->comparam == NULL) { 482 if (dep_check(j)) 483 continue; 484 if (j->jid < 0) { 485 if (!(j->flags & (JF_DEPEND|JF_WILD))) { 486 if (verbose >= 0) 487 jail_quoted_warnx(j, 488 "not found", NULL); 489 failed(j); 490 } 491 goto jail_remove_done; 492 } 493 j->comparam = stopcommands; 494 j->comstring = NULL; 495 } else if ((j->flags & JF_FAILED) && j->jid > 0) 496 goto jail_remove_done; 497 if (next_command(j)) 498 continue; 499 jail_remove_done: 500 dep_done(j, 0); 501 if ((j->flags & (JF_START | JF_FAILED)) == JF_START) { 502 j->comparam = NULL; 503 j->flags &= ~JF_STOP; 504 dep_reset(j); 505 requeue(j, j->ndeps ? &depend : &ready); 506 } 507 break; 508 } 509 } 510 511 if (jfp != NULL) 512 fclose(jfp); 513 exit(error); 514 } 515 516 /* 517 * Mark a jail's failure for future handling. 518 */ 519 void 520 failed(struct cfjail *j) 521 { 522 j->flags |= JF_FAILED; 523 TAILQ_REMOVE(j->queue, j, tq); 524 TAILQ_INSERT_HEAD(&ready, j, tq); 525 j->queue = &ready; 526 } 527 528 /* 529 * Exit slightly more gracefully when out of memory. 530 */ 531 void * 532 emalloc(size_t size) 533 { 534 void *p; 535 536 p = malloc(size); 537 if (!p) 538 err(1, "malloc"); 539 return p; 540 } 541 542 void * 543 erealloc(void *ptr, size_t size) 544 { 545 void *p; 546 547 p = realloc(ptr, size); 548 if (!p) 549 err(1, "malloc"); 550 return p; 551 } 552 553 char * 554 estrdup(const char *str) 555 { 556 char *ns; 557 558 ns = strdup(str); 559 if (!ns) 560 err(1, "malloc"); 561 return ns; 562 } 563 564 /* 565 * Print a message including an optional jail name. 566 */ 567 void 568 jail_note(const struct cfjail *j, const char *fmt, ...) 569 { 570 va_list ap, tap; 571 char *cs; 572 size_t len; 573 574 va_start(ap, fmt); 575 va_copy(tap, ap); 576 len = vsnprintf(NULL, 0, fmt, tap); 577 va_end(tap); 578 cs = alloca(len + 1); 579 (void)vsnprintf(cs, len + 1, fmt, ap); 580 va_end(ap); 581 if (j->name) 582 printf("%s: %s", j->name, cs); 583 else 584 printf("%s", cs); 585 } 586 587 /* 588 * Print a warning message including an optional jail name. 589 */ 590 void 591 jail_warnx(const struct cfjail *j, const char *fmt, ...) 592 { 593 va_list ap, tap; 594 char *cs; 595 size_t len; 596 597 va_start(ap, fmt); 598 va_copy(tap, ap); 599 len = vsnprintf(NULL, 0, fmt, tap); 600 va_end(tap); 601 cs = alloca(len + 1); 602 (void)vsnprintf(cs, len + 1, fmt, ap); 603 va_end(ap); 604 if (j->name) 605 warnx("%s: %s", j->name, cs); 606 else 607 warnx("%s", cs); 608 } 609 610 /* 611 * Create a new jail. 612 */ 613 int 614 create_jail(struct cfjail *j) 615 { 616 struct iovec jiov[4]; 617 struct stat st; 618 struct jailparam *jp, *setparams, *setparams2, *sjp; 619 const char *path; 620 int dopersist, ns, jid, dying, didfail; 621 622 /* 623 * Check the jail's path, with a better error message than jail_set 624 * gives. 625 */ 626 if ((path = string_param(j->intparams[KP_PATH]))) { 627 if (j->name != NULL && path[0] != '/') { 628 jail_warnx(j, "path %s: not an absolute pathname", 629 path); 630 return -1; 631 } 632 if (stat(path, &st) < 0) { 633 jail_warnx(j, "path %s: %s", path, strerror(errno)); 634 return -1; 635 } 636 if (!S_ISDIR(st.st_mode)) { 637 jail_warnx(j, "path %s: %s", path, strerror(ENOTDIR)); 638 return -1; 639 } 640 } 641 642 /* 643 * Copy all the parameters, except that "persist" is always set when 644 * there are commands to run later. 645 */ 646 dopersist = !bool_param(j->intparams[KP_PERSIST]) && 647 (j->intparams[IP_EXEC_START] || j->intparams[IP_COMMAND] || 648 j->intparams[IP_EXEC_POSTSTART]); 649 sjp = setparams = 650 alloca((j->njp + dopersist) * sizeof(struct jailparam)); 651 if (dopersist && jailparam_init(sjp++, "persist") < 0) { 652 jail_warnx(j, "%s", jail_errmsg); 653 return -1; 654 } 655 for (jp = j->jp; jp < j->jp + j->njp; jp++) 656 if (!dopersist || !equalopts(jp->jp_name, "persist")) 657 *sjp++ = *jp; 658 ns = sjp - setparams; 659 660 didfail = 0; 661 j->jid = jailparam_set_note(j, setparams, ns, JAIL_CREATE); 662 if (j->jid < 0 && errno == EEXIST && 663 bool_param(j->intparams[IP_ALLOW_DYING]) && 664 int_param(j->intparams[KP_JID], &jid) && jid != 0) { 665 /* 666 * The jail already exists, but may be dying. 667 * Make sure it is, in which case an update is appropriate. 668 */ 669 jiov[0].iov_base = __DECONST(char *, "jid"); 670 jiov[0].iov_len = sizeof("jid"); 671 jiov[1].iov_base = &jid; 672 jiov[1].iov_len = sizeof(jid); 673 jiov[2].iov_base = __DECONST(char *, "dying"); 674 jiov[2].iov_len = sizeof("dying"); 675 jiov[3].iov_base = &dying; 676 jiov[3].iov_len = sizeof(dying); 677 if (jail_get(jiov, 4, JAIL_DYING) < 0) { 678 /* 679 * It could be that the jail just barely finished 680 * dying, or it could be that the jid never existed 681 * but the name does. In either case, another try 682 * at creating the jail should do the right thing. 683 */ 684 if (errno == ENOENT) 685 j->jid = jailparam_set_note(j, setparams, ns, 686 JAIL_CREATE); 687 } else if (dying) { 688 j->jid = jid; 689 if (rdtun_params(j, 1) < 0) { 690 j->jid = -1; 691 didfail = 1; 692 } else { 693 sjp = setparams2 = alloca((j->njp + dopersist) * 694 sizeof(struct jailparam)); 695 for (jp = setparams; jp < setparams + ns; jp++) 696 if (!JP_RDTUN(jp) || 697 !strcmp(jp->jp_name, "jid")) 698 *sjp++ = *jp; 699 j->jid = jailparam_set_note(j, setparams2, 700 sjp - setparams2, JAIL_UPDATE | JAIL_DYING); 701 /* 702 * Again, perhaps the jail just finished dying. 703 */ 704 if (j->jid < 0 && errno == ENOENT) 705 j->jid = jailparam_set_note(j, 706 setparams, ns, JAIL_CREATE); 707 } 708 } 709 } 710 if (j->jid < 0 && !didfail) { 711 jail_warnx(j, "%s", jail_errmsg); 712 failed(j); 713 } 714 if (dopersist) { 715 jailparam_free(setparams, 1); 716 if (j->jid > 0) 717 j->flags |= JF_PERSIST; 718 } 719 return j->jid; 720 } 721 722 /* 723 * Remove a temporarily set "persist" parameter. 724 */ 725 static void 726 clear_persist(struct cfjail *j) 727 { 728 struct iovec jiov[4]; 729 int jid; 730 731 if (!(j->flags & JF_PERSIST)) 732 return; 733 j->flags &= ~JF_PERSIST; 734 jiov[0].iov_base = __DECONST(char *, "jid"); 735 jiov[0].iov_len = sizeof("jid"); 736 jiov[1].iov_base = &j->jid; 737 jiov[1].iov_len = sizeof(j->jid); 738 jiov[2].iov_base = __DECONST(char *, "nopersist"); 739 jiov[2].iov_len = sizeof("nopersist"); 740 jiov[3].iov_base = NULL; 741 jiov[3].iov_len = 0; 742 jid = jail_set(jiov, 4, JAIL_UPDATE); 743 if (verbose > 0) 744 jail_note(j, "jail_set(JAIL_UPDATE) jid=%d nopersist%s%s\n", 745 j->jid, jid < 0 ? ": " : "", 746 jid < 0 ? strerror(errno) : ""); 747 } 748 749 /* 750 * Set a jail's parameters. 751 */ 752 static int 753 update_jail(struct cfjail *j) 754 { 755 struct jailparam *jp, *setparams, *sjp; 756 int ns, jid; 757 758 ns = 0; 759 for (jp = j->jp; jp < j->jp + j->njp; jp++) 760 if (!JP_RDTUN(jp)) 761 ns++; 762 if (ns == 0) 763 return 0; 764 sjp = setparams = alloca(++ns * sizeof(struct jailparam)); 765 if (jailparam_init(sjp, "jid") < 0 || 766 jailparam_import_raw(sjp, &j->jid, sizeof j->jid) < 0) { 767 jail_warnx(j, "%s", jail_errmsg); 768 failed(j); 769 return -1; 770 } 771 for (jp = j->jp; jp < j->jp + j->njp; jp++) 772 if (!JP_RDTUN(jp)) 773 *++sjp = *jp; 774 775 jid = jailparam_set_note(j, setparams, ns, 776 bool_param(j->intparams[IP_ALLOW_DYING]) 777 ? JAIL_UPDATE | JAIL_DYING : JAIL_UPDATE); 778 if (jid < 0) { 779 jail_warnx(j, "%s", jail_errmsg); 780 failed(j); 781 } 782 jailparam_free(setparams, 1); 783 return jid; 784 } 785 786 /* 787 * Return if a jail set would change any create-only parameters. 788 */ 789 static int 790 rdtun_params(struct cfjail *j, int dofail) 791 { 792 struct jailparam *jp, *rtparams, *rtjp; 793 const void *jp_value; 794 size_t jp_valuelen; 795 int nrt, rval, bool_true; 796 797 if (j->flags & JF_RDTUN) 798 return 0; 799 j->flags |= JF_RDTUN; 800 nrt = 0; 801 for (jp = j->jp; jp < j->jp + j->njp; jp++) 802 if (JP_RDTUN(jp) && strcmp(jp->jp_name, "jid")) 803 nrt++; 804 if (nrt == 0) 805 return 0; 806 rtjp = rtparams = alloca(++nrt * sizeof(struct jailparam)); 807 if (jailparam_init(rtjp, "jid") < 0 || 808 jailparam_import_raw(rtjp, &j->jid, sizeof j->jid) < 0) { 809 jail_warnx(j, "%s", jail_errmsg); 810 exit(1); 811 } 812 for (jp = j->jp; jp < j->jp + j->njp; jp++) 813 if (JP_RDTUN(jp) && strcmp(jp->jp_name, "jid")) { 814 *++rtjp = *jp; 815 rtjp->jp_value = NULL; 816 } 817 rval = 0; 818 if (jailparam_get(rtparams, nrt, 819 bool_param(j->intparams[IP_ALLOW_DYING]) ? JAIL_DYING : 0) > 0) { 820 rtjp = rtparams + 1; 821 for (jp = j->jp; rtjp < rtparams + nrt; jp++) { 822 if (JP_RDTUN(jp) && strcmp(jp->jp_name, "jid")) { 823 jp_value = jp->jp_value; 824 jp_valuelen = jp->jp_valuelen; 825 if (jp_value == NULL && jp_valuelen > 0) { 826 if (jp->jp_flags & (JP_BOOL | 827 JP_NOBOOL | JP_JAILSYS)) { 828 bool_true = 1; 829 jp_value = &bool_true; 830 jp_valuelen = sizeof(bool_true); 831 } else if ((jp->jp_ctltype & CTLTYPE) == 832 CTLTYPE_STRING) 833 jp_value = ""; 834 else 835 jp_valuelen = 0; 836 } 837 if (rtjp->jp_valuelen != jp_valuelen || 838 (CTLTYPE_STRING ? strncmp(rtjp->jp_value, 839 jp_value, jp_valuelen) 840 : memcmp(rtjp->jp_value, jp_value, 841 jp_valuelen))) { 842 if (dofail) { 843 jail_warnx(j, "%s cannot be " 844 "changed after creation", 845 jp->jp_name); 846 failed(j); 847 rval = -1; 848 } else 849 rval = 1; 850 break; 851 } 852 rtjp++; 853 } 854 } 855 } 856 for (rtjp = rtparams + 1; rtjp < rtparams + nrt; rtjp++) 857 rtjp->jp_name = NULL; 858 jailparam_free(rtparams, nrt); 859 return rval; 860 } 861 862 /* 863 * Get the jail's jid if it is running. 864 */ 865 static void 866 running_jid(struct cfjail *j, int dflag) 867 { 868 struct iovec jiov[2]; 869 const char *pval; 870 char *ep; 871 int jid; 872 873 if ((pval = string_param(j->intparams[KP_JID]))) { 874 if (!(jid = strtol(pval, &ep, 10)) || *ep) { 875 j->jid = -1; 876 return; 877 } 878 jiov[0].iov_base = __DECONST(char *, "jid"); 879 jiov[0].iov_len = sizeof("jid"); 880 jiov[1].iov_base = &jid; 881 jiov[1].iov_len = sizeof(jid); 882 } else if ((pval = string_param(j->intparams[KP_NAME]))) { 883 jiov[0].iov_base = __DECONST(char *, "name"); 884 jiov[0].iov_len = sizeof("name"); 885 jiov[1].iov_len = strlen(pval) + 1; 886 jiov[1].iov_base = alloca(jiov[1].iov_len); 887 strcpy(jiov[1].iov_base, pval); 888 } else { 889 j->jid = -1; 890 return; 891 } 892 j->jid = jail_get(jiov, 2, dflag ? JAIL_DYING : 0); 893 } 894 895 static void 896 jail_quoted_warnx(const struct cfjail *j, const char *name_msg, 897 const char *noname_msg) 898 { 899 const char *pval; 900 901 if ((pval = j->name) || (pval = string_param(j->intparams[KP_JID])) || 902 (pval = string_param(j->intparams[KP_NAME]))) 903 warnx("\"%s\" %s", pval, name_msg); 904 else 905 warnx("%s", noname_msg); 906 } 907 908 /* 909 * Set jail parameters and possibly print them out. 910 */ 911 static int 912 jailparam_set_note(const struct cfjail *j, struct jailparam *jp, unsigned njp, 913 int flags) 914 { 915 char *value; 916 int jid; 917 unsigned i; 918 919 jid = jailparam_set(jp, njp, flags); 920 if (verbose > 0) { 921 jail_note(j, "jail_set(%s%s)", 922 (flags & (JAIL_CREATE | JAIL_UPDATE)) == JAIL_CREATE 923 ? "JAIL_CREATE" : "JAIL_UPDATE", 924 (flags & JAIL_DYING) ? " | JAIL_DYING" : ""); 925 for (i = 0; i < njp; i++) { 926 printf(" %s", jp[i].jp_name); 927 if (jp[i].jp_value == NULL) 928 continue; 929 putchar('='); 930 value = jailparam_export(jp + i); 931 if (value == NULL) 932 err(1, "jailparam_export"); 933 quoted_print(stdout, value); 934 free(value); 935 } 936 if (jid < 0) 937 printf(": %s", strerror(errno)); 938 printf("\n"); 939 } 940 return jid; 941 } 942 943 /* 944 * Print a jail record. 945 */ 946 static void 947 print_jail(FILE *fp, struct cfjail *j, int oldcl, int running) 948 { 949 struct cfparam *p; 950 int printsep; 951 952 if (oldcl) { 953 if (running) 954 fprintf(fp, "%d%s", j->jid, separator); 955 print_param(fp, j->intparams[KP_PATH], ',', 0); 956 fputs(separator, fp); 957 print_param(fp, j->intparams[KP_HOST_HOSTNAME], ',', 0); 958 fputs(separator, fp); 959 #ifdef INET 960 print_param(fp, j->intparams[KP_IP4_ADDR], ',', 0); 961 #ifdef INET6 962 if (j->intparams[KP_IP4_ADDR] && 963 !TAILQ_EMPTY(&j->intparams[KP_IP4_ADDR]->val) && 964 j->intparams[KP_IP6_ADDR] && 965 !TAILQ_EMPTY(&j->intparams[KP_IP6_ADDR]->val)) 966 putc(',', fp); 967 #endif 968 #endif 969 #ifdef INET6 970 print_param(fp, j->intparams[KP_IP6_ADDR], ',', 0); 971 #endif 972 fputs(separator, fp); 973 print_param(fp, j->intparams[IP_COMMAND], ' ', 0); 974 } else { 975 printsep = 0; 976 if (running) { 977 fprintf(fp, "jid=%d", j->jid); 978 printsep = 1; 979 } 980 TAILQ_FOREACH(p, &j->params, tq) 981 if (strcmp(p->name, "jid")) { 982 if (printsep) 983 fputs(separator, fp); 984 else 985 printsep = 1; 986 print_param(fp, p, ',', 1); 987 } 988 } 989 putc('\n', fp); 990 } 991 992 /* 993 * Exhibit list of all configured non-wildcard jails 994 */ 995 static void 996 show_jails(void) 997 { 998 struct cfjail *j; 999 1000 TAILQ_FOREACH(j, &cfjails, tq) 1001 print_jail(stdout, j, 0, 0); 1002 } 1003 1004 /* 1005 * Print a parameter value, or a name=value pair. 1006 */ 1007 static void 1008 print_param(FILE *fp, const struct cfparam *p, int sep, int doname) 1009 { 1010 const struct cfstring *s, *ts; 1011 1012 if (doname) 1013 fputs(p->name, fp); 1014 if (p == NULL || TAILQ_EMPTY(&p->val)) 1015 return; 1016 if (doname) 1017 putc('=', fp); 1018 TAILQ_FOREACH_SAFE(s, &p->val, tq, ts) { 1019 quoted_print(fp, s->s); 1020 if (ts != NULL) 1021 putc(sep, fp); 1022 } 1023 } 1024 1025 /* 1026 * Print a string with quotes around spaces. 1027 */ 1028 static void 1029 quoted_print(FILE *fp, char *str) 1030 { 1031 int c, qc; 1032 char *p = str; 1033 1034 qc = !*p ? '"' 1035 : strchr(p, '\'') ? '"' 1036 : strchr(p, '"') ? '\'' 1037 : strchr(p, ' ') || strchr(p, '\t') ? '"' 1038 : 0; 1039 if (qc) 1040 putc(qc, fp); 1041 while ((c = *p++)) { 1042 if (c == '\\' || c == qc) 1043 putc('\\', fp); 1044 putc(c, fp); 1045 } 1046 if (qc) 1047 putc(qc, fp); 1048 } 1049 1050 static void 1051 usage(void) 1052 { 1053 1054 (void)fprintf(stderr, 1055 "usage: jail [-dhilqv] [-J jid_file] [-u username] [-U username]\n" 1056 " -[cmr] param=value ... [command=command ...]\n" 1057 " jail [-dqv] [-f file] -[cmr] [jail]\n" 1058 " jail [-qv] [-f file] -[rR] ['*' | jail ...]\n" 1059 " jail [-dhilqv] [-J jid_file] [-u username] [-U username]\n" 1060 " [-n jailname] [-s securelevel]\n" 1061 " path hostname ip[,...] command ...\n" 1062 " jail [-f file] -e separator\n"); 1063 exit(1); 1064 } 1065