1 /* 2 * ---------------------------------------------------------------------------- 3 * "THE BEER-WARE LICENSE" (Revision 42): 4 * <phk@FreeBSD.ORG> wrote this file. As long as you retain this notice you 5 * can do whatever you want with this stuff. If we meet some day, and you think 6 * this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp 7 * ---------------------------------------------------------------------------- 8 * 9 * $FreeBSD: src/sys/kern/kern_jail.c,v 1.6.2.3 2001/08/17 01:00:26 rwatson Exp $ 10 * $DragonFly: src/sys/kern/kern_jail.c,v 1.8 2005/07/20 20:31:18 dillon Exp $ 11 * 12 */ 13 14 #include <sys/param.h> 15 #include <sys/types.h> 16 #include <sys/kernel.h> 17 #include <sys/kinfo.h> 18 #include <sys/systm.h> 19 #include <sys/errno.h> 20 #include <sys/sysproto.h> 21 #include <sys/malloc.h> 22 #include <sys/nlookup.h> 23 #include <sys/namecache.h> 24 #include <sys/proc.h> 25 #include <sys/jail.h> 26 #include <sys/socket.h> 27 #include <sys/sysctl.h> 28 #include <sys/kern_syscall.h> 29 #include <net/if.h> 30 #include <netinet/in.h> 31 32 static struct prison *prison_find(int); 33 34 MALLOC_DEFINE(M_PRISON, "prison", "Prison structures"); 35 36 SYSCTL_NODE(, OID_AUTO, jail, CTLFLAG_RW, 0, 37 "Jail rules"); 38 39 int jail_set_hostname_allowed = 1; 40 SYSCTL_INT(_jail, OID_AUTO, set_hostname_allowed, CTLFLAG_RW, 41 &jail_set_hostname_allowed, 0, 42 "Processes in jail can set their hostnames"); 43 44 int jail_socket_unixiproute_only = 1; 45 SYSCTL_INT(_jail, OID_AUTO, socket_unixiproute_only, CTLFLAG_RW, 46 &jail_socket_unixiproute_only, 0, 47 "Processes in jail are limited to creating UNIX/IPv4/route sockets only"); 48 49 int jail_sysvipc_allowed = 0; 50 SYSCTL_INT(_jail, OID_AUTO, sysvipc_allowed, CTLFLAG_RW, 51 &jail_sysvipc_allowed, 0, 52 "Processes in jail can use System V IPC primitives"); 53 54 int jail_chflags_allowed = 0; 55 SYSCTL_INT(_jail, OID_AUTO, chflags_allowed, CTLFLAG_RW, 56 &jail_chflags_allowed, 0, 57 "Process in jail can set chflags(1)"); 58 59 int lastprid = 0; 60 int prisoncount = 0; 61 62 LIST_HEAD(prisonlist, prison); 63 struct prisonlist allprison = LIST_HEAD_INITIALIZER(&allprison); 64 65 static int 66 kern_jail_attach(int jid) 67 { 68 struct proc *p = curthread->td_proc; 69 struct prison *pr; 70 int error; 71 72 pr = prison_find(jid); 73 if (pr == NULL) 74 return(EINVAL); 75 76 error = kern_chroot(pr->pr_root); 77 if (error) 78 return(error); 79 80 prison_hold(pr); 81 cratom(&p->p_ucred); 82 p->p_ucred->cr_prison = pr; 83 p->p_flag |= P_JAILED; 84 85 return(0); 86 } 87 88 /* 89 * jail() 90 * 91 * jail_args(syscallarg(struct jail *) jail) 92 */ 93 int 94 jail(struct jail_args *uap) 95 { 96 struct prison *pr, *tpr; 97 struct jail j; 98 struct thread *td = curthread; 99 int error, tryprid; 100 struct nlookupdata nd; 101 102 error = suser(td); 103 if (error) 104 return(error); 105 error = copyin(uap->jail, &j, sizeof j); 106 if (error) 107 return(error); 108 if (j.version != 0) 109 return(EINVAL); 110 MALLOC(pr, struct prison *, sizeof *pr , M_PRISON, M_WAITOK | M_ZERO); 111 112 error = copyinstr(j.hostname, &pr->pr_host, sizeof pr->pr_host, 0); 113 if (error) 114 goto bail; 115 error = nlookup_init(&nd, j.path, UIO_USERSPACE, NLC_FOLLOW); 116 if (error) 117 goto nlookup_init_clean; 118 error = nlookup(&nd); 119 if (error) 120 goto nlookup_init_clean; 121 pr->pr_root = cache_hold(nd.nl_ncp); 122 123 pr->pr_ip = j.ip_number; 124 varsymset_init(&pr->pr_varsymset, NULL); 125 126 tryprid = lastprid + 1; 127 if (tryprid == JAIL_MAX) 128 tryprid = 1; 129 next: 130 LIST_FOREACH(tpr, &allprison, pr_list) { 131 if (tpr->pr_id != tryprid) 132 continue; 133 tryprid++; 134 if (tryprid == JAIL_MAX) { 135 error = EAGAIN; 136 goto varsym_clean; 137 } 138 goto next; 139 } 140 pr->pr_id = lastprid = tryprid; 141 LIST_INSERT_HEAD(&allprison, pr, pr_list); 142 prisoncount++; 143 144 error = kern_jail_attach(pr->pr_id); 145 if (error) 146 goto jail_attach_clean; 147 148 nlookup_done(&nd); 149 return (0); 150 151 jail_attach_clean: 152 LIST_REMOVE(pr, pr_list); 153 varsym_clean: 154 varsymset_clean(&pr->pr_varsymset); 155 nlookup_init_clean: 156 nlookup_done(&nd); 157 bail: 158 FREE(pr, M_PRISON); 159 return(error); 160 } 161 162 /* 163 * int jail_attach(int jid); 164 */ 165 int 166 jail_attach(struct jail_attach_args *uap) 167 { 168 struct thread *td = curthread; 169 int error; 170 171 error = suser(td); 172 if (error) 173 return(error); 174 175 return(kern_jail_attach(uap->jid)); 176 } 177 178 int 179 prison_ip(struct thread *td, int flag, u_int32_t *ip) 180 { 181 u_int32_t tmp; 182 struct prison *pr; 183 184 if (td->td_proc == NULL) 185 return (0); 186 if ((pr = td->td_proc->p_ucred->cr_prison) == NULL) 187 return (0); 188 if (flag) 189 tmp = *ip; 190 else 191 tmp = ntohl(*ip); 192 if (tmp == INADDR_ANY) { 193 if (flag) 194 *ip = pr->pr_ip; 195 else 196 *ip = htonl(pr->pr_ip); 197 return (0); 198 } 199 if (tmp == INADDR_LOOPBACK) { 200 if (flag) 201 *ip = pr->pr_ip; 202 else 203 *ip = htonl(pr->pr_ip); 204 return (0); 205 } 206 if (pr->pr_ip != tmp) 207 return (1); 208 return (0); 209 } 210 211 void 212 prison_remote_ip(struct thread *td, int flag, u_int32_t *ip) 213 { 214 u_int32_t tmp; 215 struct prison *pr; 216 217 if (td == NULL || td->td_proc == NULL) 218 return; 219 if ((pr = td->td_proc->p_ucred->cr_prison) == NULL) 220 return; 221 if (flag) 222 tmp = *ip; 223 else 224 tmp = ntohl(*ip); 225 if (tmp == INADDR_LOOPBACK) { 226 if (flag) 227 *ip = pr->pr_ip; 228 else 229 *ip = htonl(pr->pr_ip); 230 } 231 return; 232 } 233 234 int 235 prison_if(struct thread *td, struct sockaddr *sa) 236 { 237 struct prison *pr; 238 struct sockaddr_in *sai = (struct sockaddr_in*) sa; 239 int ok; 240 241 if (td->td_proc == NULL) 242 return(0); 243 pr = td->td_proc->p_ucred->cr_prison; 244 245 if ((sai->sin_family != AF_INET) && jail_socket_unixiproute_only) 246 ok = 1; 247 else if (sai->sin_family != AF_INET) 248 ok = 0; 249 else if (pr->pr_ip != ntohl(sai->sin_addr.s_addr)) 250 ok = 1; 251 else 252 ok = 0; 253 return (ok); 254 } 255 256 /* 257 * Returns a prison instance, or NULL on failure. 258 */ 259 static struct prison * 260 prison_find(int prid) 261 { 262 struct prison *pr; 263 264 LIST_FOREACH(pr, &allprison, pr_list) { 265 if (pr->pr_id == prid) 266 break; 267 } 268 return(pr); 269 } 270 271 static int 272 sysctl_jail_list(SYSCTL_HANDLER_ARGS) 273 { 274 struct proc *p; 275 struct kinfo_prison *xp, *sxp; 276 struct prison *pr; 277 int count, error; 278 279 p = curthread->td_proc; 280 281 if (jailed(p->p_ucred)) 282 return (0); 283 retry: 284 count = prisoncount; 285 286 if (count == 0) 287 return(0); 288 289 sxp = xp = malloc(sizeof(*xp) * count, M_TEMP, M_WAITOK | M_ZERO); 290 if (count < prisoncount) { 291 free(sxp, M_TEMP); 292 goto retry; 293 } 294 count = prisoncount; 295 296 LIST_FOREACH(pr, &allprison, pr_list) { 297 char *fullpath, *freepath; 298 xp->pr_version = KINFO_PRISON_VERSION; 299 xp->pr_id = pr->pr_id; 300 error = cache_fullpath(p, pr->pr_root, &fullpath, &freepath); 301 if (error == 0) { 302 strlcpy(xp->pr_path, fullpath, sizeof(xp->pr_path)); 303 free(freepath, M_TEMP); 304 } else { 305 bzero(xp->pr_path, sizeof(xp->pr_path)); 306 } 307 strlcpy(xp->pr_host, pr->pr_host, sizeof(xp->pr_host)); 308 xp->pr_ip = pr->pr_ip; 309 xp++; 310 } 311 312 error = SYSCTL_OUT(req, sxp, sizeof(*sxp) * count); 313 free(sxp, M_TEMP); 314 return(error); 315 } 316 317 SYSCTL_OID(_jail, OID_AUTO, list, CTLTYPE_STRUCT | CTLFLAG_RD, NULL, 0, 318 sysctl_jail_list, "S", "List of active jails"); 319 320 void 321 prison_hold(struct prison *pr) 322 { 323 pr->pr_ref++; 324 } 325 326 void 327 prison_free(struct prison *pr) 328 { 329 KKASSERT(pr->pr_ref >= 1); 330 331 if (--pr->pr_ref > 0) 332 return; 333 334 LIST_REMOVE(pr, pr_list); 335 prisoncount--; 336 337 if (pr->pr_linux != NULL) 338 free(pr->pr_linux, M_PRISON); 339 varsymset_clean(&pr->pr_varsymset); 340 cache_drop(pr->pr_root); 341 free(pr, M_PRISON); 342 } 343