1 /* 2 * ---------------------------------------------------------------------------- 3 * "THE BEER-WARE LICENSE" (Revision 42): 4 * <phk@FreeBSD.ORG> wrote this file. As long as you retain this notice you 5 * can do whatever you want with this stuff. If we meet some day, and you think 6 * this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp 7 * ---------------------------------------------------------------------------- 8 * 9 * $FreeBSD: src/sys/kern/kern_jail.c,v 1.6.2.3 2001/08/17 01:00:26 rwatson Exp $ 10 * $DragonFly: src/sys/kern/kern_jail.c,v 1.7 2005/01/31 22:29:59 joerg Exp $ 11 * 12 */ 13 14 #include <sys/param.h> 15 #include <sys/types.h> 16 #include <sys/kernel.h> 17 #include <sys/kinfo.h> 18 #include <sys/systm.h> 19 #include <sys/errno.h> 20 #include <sys/sysproto.h> 21 #include <sys/malloc.h> 22 #include <sys/nlookup.h> 23 #include <sys/namecache.h> 24 #include <sys/proc.h> 25 #include <sys/jail.h> 26 #include <sys/socket.h> 27 #include <sys/sysctl.h> 28 #include <sys/kern_syscall.h> 29 #include <net/if.h> 30 #include <netinet/in.h> 31 32 static struct prison *prison_find(int); 33 34 MALLOC_DEFINE(M_PRISON, "prison", "Prison structures"); 35 36 SYSCTL_NODE(, OID_AUTO, jail, CTLFLAG_RW, 0, 37 "Jail rules"); 38 39 int jail_set_hostname_allowed = 1; 40 SYSCTL_INT(_jail, OID_AUTO, set_hostname_allowed, CTLFLAG_RW, 41 &jail_set_hostname_allowed, 0, 42 "Processes in jail can set their hostnames"); 43 44 int jail_socket_unixiproute_only = 1; 45 SYSCTL_INT(_jail, OID_AUTO, socket_unixiproute_only, CTLFLAG_RW, 46 &jail_socket_unixiproute_only, 0, 47 "Processes in jail are limited to creating UNIX/IPv4/route sockets only"); 48 49 int jail_sysvipc_allowed = 0; 50 SYSCTL_INT(_jail, OID_AUTO, sysvipc_allowed, CTLFLAG_RW, 51 &jail_sysvipc_allowed, 0, 52 "Processes in jail can use System V IPC primitives"); 53 54 int lastprid = 0; 55 int prisoncount = 0; 56 57 LIST_HEAD(prisonlist, prison); 58 struct prisonlist allprison = LIST_HEAD_INITIALIZER(&allprison); 59 60 static int 61 kern_jail_attach(int jid) 62 { 63 struct proc *p = curthread->td_proc; 64 struct prison *pr; 65 int error; 66 67 pr = prison_find(jid); 68 if (pr == NULL) 69 return(EINVAL); 70 71 error = kern_chroot(pr->pr_root); 72 if (error) 73 return(error); 74 75 prison_hold(pr); 76 cratom(&p->p_ucred); 77 p->p_ucred->cr_prison = pr; 78 p->p_flag |= P_JAILED; 79 80 return(0); 81 } 82 83 /* 84 * jail() 85 * 86 * jail_args(syscallarg(struct jail *) jail) 87 */ 88 int 89 jail(struct jail_args *uap) 90 { 91 struct prison *pr, *tpr; 92 struct jail j; 93 struct thread *td = curthread; 94 int error, tryprid; 95 struct nlookupdata nd; 96 97 error = suser(td); 98 if (error) 99 return(error); 100 error = copyin(uap->jail, &j, sizeof j); 101 if (error) 102 return(error); 103 if (j.version != 0) 104 return(EINVAL); 105 MALLOC(pr, struct prison *, sizeof *pr , M_PRISON, M_WAITOK | M_ZERO); 106 107 error = copyinstr(j.hostname, &pr->pr_host, sizeof pr->pr_host, 0); 108 if (error) 109 goto bail; 110 error = nlookup_init(&nd, j.path, UIO_USERSPACE, NLC_FOLLOW); 111 if (error) 112 goto nlookup_init_clean; 113 error = nlookup(&nd); 114 if (error) 115 goto nlookup_init_clean; 116 pr->pr_root = cache_hold(nd.nl_ncp); 117 118 pr->pr_ip = j.ip_number; 119 varsymset_init(&pr->pr_varsymset, NULL); 120 121 tryprid = lastprid + 1; 122 if (tryprid == JAIL_MAX) 123 tryprid = 1; 124 next: 125 LIST_FOREACH(tpr, &allprison, pr_list) { 126 if (tpr->pr_id != tryprid) 127 continue; 128 tryprid++; 129 if (tryprid == JAIL_MAX) { 130 error = EAGAIN; 131 goto varsym_clean; 132 } 133 goto next; 134 } 135 pr->pr_id = lastprid = tryprid; 136 LIST_INSERT_HEAD(&allprison, pr, pr_list); 137 prisoncount++; 138 139 error = kern_jail_attach(pr->pr_id); 140 if (error) 141 goto jail_attach_clean; 142 143 nlookup_done(&nd); 144 return (0); 145 146 jail_attach_clean: 147 LIST_REMOVE(pr, pr_list); 148 varsym_clean: 149 varsymset_clean(&pr->pr_varsymset); 150 nlookup_init_clean: 151 nlookup_done(&nd); 152 bail: 153 FREE(pr, M_PRISON); 154 return(error); 155 } 156 157 /* 158 * int jail_attach(int jid); 159 */ 160 int 161 jail_attach(struct jail_attach_args *uap) 162 { 163 struct thread *td = curthread; 164 int error; 165 166 error = suser(td); 167 if (error) 168 return(error); 169 170 return(kern_jail_attach(uap->jid)); 171 } 172 173 int 174 prison_ip(struct thread *td, int flag, u_int32_t *ip) 175 { 176 u_int32_t tmp; 177 struct prison *pr; 178 179 if (td->td_proc == NULL) 180 return (0); 181 if ((pr = td->td_proc->p_ucred->cr_prison) == NULL) 182 return (0); 183 if (flag) 184 tmp = *ip; 185 else 186 tmp = ntohl(*ip); 187 if (tmp == INADDR_ANY) { 188 if (flag) 189 *ip = pr->pr_ip; 190 else 191 *ip = htonl(pr->pr_ip); 192 return (0); 193 } 194 if (tmp == INADDR_LOOPBACK) { 195 if (flag) 196 *ip = pr->pr_ip; 197 else 198 *ip = htonl(pr->pr_ip); 199 return (0); 200 } 201 if (pr->pr_ip != tmp) 202 return (1); 203 return (0); 204 } 205 206 void 207 prison_remote_ip(struct thread *td, int flag, u_int32_t *ip) 208 { 209 u_int32_t tmp; 210 struct prison *pr; 211 212 if (td == NULL || td->td_proc == NULL) 213 return; 214 if ((pr = td->td_proc->p_ucred->cr_prison) == NULL) 215 return; 216 if (flag) 217 tmp = *ip; 218 else 219 tmp = ntohl(*ip); 220 if (tmp == INADDR_LOOPBACK) { 221 if (flag) 222 *ip = pr->pr_ip; 223 else 224 *ip = htonl(pr->pr_ip); 225 } 226 return; 227 } 228 229 int 230 prison_if(struct thread *td, struct sockaddr *sa) 231 { 232 struct prison *pr; 233 struct sockaddr_in *sai = (struct sockaddr_in*) sa; 234 int ok; 235 236 if (td->td_proc == NULL) 237 return(0); 238 pr = td->td_proc->p_ucred->cr_prison; 239 240 if ((sai->sin_family != AF_INET) && jail_socket_unixiproute_only) 241 ok = 1; 242 else if (sai->sin_family != AF_INET) 243 ok = 0; 244 else if (pr->pr_ip != ntohl(sai->sin_addr.s_addr)) 245 ok = 1; 246 else 247 ok = 0; 248 return (ok); 249 } 250 251 /* 252 * Returns a prison instance, or NULL on failure. 253 */ 254 static struct prison * 255 prison_find(int prid) 256 { 257 struct prison *pr; 258 259 LIST_FOREACH(pr, &allprison, pr_list) { 260 if (pr->pr_id == prid) 261 break; 262 } 263 return(pr); 264 } 265 266 static int 267 sysctl_jail_list(SYSCTL_HANDLER_ARGS) 268 { 269 struct proc *p; 270 struct kinfo_prison *xp, *sxp; 271 struct prison *pr; 272 int count, error; 273 274 p = curthread->td_proc; 275 276 if (jailed(p->p_ucred)) 277 return (0); 278 retry: 279 count = prisoncount; 280 281 if (count == 0) 282 return(0); 283 284 sxp = xp = malloc(sizeof(*xp) * count, M_TEMP, M_WAITOK | M_ZERO); 285 if (count < prisoncount) { 286 free(sxp, M_TEMP); 287 goto retry; 288 } 289 count = prisoncount; 290 291 LIST_FOREACH(pr, &allprison, pr_list) { 292 char *fullpath, *freepath; 293 xp->pr_version = KINFO_PRISON_VERSION; 294 xp->pr_id = pr->pr_id; 295 error = cache_fullpath(p, pr->pr_root, &fullpath, &freepath); 296 if (error == 0) { 297 strlcpy(xp->pr_path, fullpath, sizeof(xp->pr_path)); 298 free(freepath, M_TEMP); 299 } else { 300 bzero(xp->pr_path, sizeof(xp->pr_path)); 301 } 302 strlcpy(xp->pr_host, pr->pr_host, sizeof(xp->pr_host)); 303 xp->pr_ip = pr->pr_ip; 304 xp++; 305 } 306 307 error = SYSCTL_OUT(req, sxp, sizeof(*sxp) * count); 308 free(sxp, M_TEMP); 309 return(error); 310 } 311 312 SYSCTL_OID(_jail, OID_AUTO, list, CTLTYPE_STRUCT | CTLFLAG_RD, NULL, 0, 313 sysctl_jail_list, "S", "List of active jails"); 314 315 void 316 prison_hold(struct prison *pr) 317 { 318 pr->pr_ref++; 319 } 320 321 void 322 prison_free(struct prison *pr) 323 { 324 KKASSERT(pr->pr_ref >= 1); 325 326 if (--pr->pr_ref > 0) 327 return; 328 329 LIST_REMOVE(pr, pr_list); 330 prisoncount--; 331 332 if (pr->pr_linux != NULL) 333 free(pr->pr_linux, M_PRISON); 334 varsymset_clean(&pr->pr_varsymset); 335 cache_drop(pr->pr_root); 336 free(pr, M_PRISON); 337 } 338