1 /* 2 * ---------------------------------------------------------------------------- 3 * "THE BEER-WARE LICENSE" (Revision 42): 4 * <phk@FreeBSD.ORG> wrote this file. As long as you retain this notice you 5 * can do whatever you want with this stuff. If we meet some day, and you think 6 * this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp 7 * ---------------------------------------------------------------------------- 8 * 9 */ 10 /*- 11 * Copyright (c) 2006 Victor Balada Diaz <victor@bsdes.net> 12 * All rights reserved. 13 * 14 * Redistribution and use in source and binary forms, with or without 15 * modification, are permitted provided that the following conditions 16 * are met: 17 * 1. Redistributions of source code must retain the above copyright 18 * notice, this list of conditions and the following disclaimer. 19 * 2. Redistributions in binary form must reproduce the above copyright 20 * notice, this list of conditions and the following disclaimer in the 21 * documentation and/or other materials provided with the distribution. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 */ 35 36 37 /* 38 * $FreeBSD: src/sys/kern/kern_jail.c,v 1.6.2.3 2001/08/17 01:00:26 rwatson Exp $ 39 * $DragonFly: src/sys/kern/kern_jail.c,v 1.19 2008/05/17 18:20:33 dillon Exp $ 40 */ 41 42 #include "opt_inet6.h" 43 44 #include <sys/param.h> 45 #include <sys/types.h> 46 #include <sys/kernel.h> 47 #include <sys/systm.h> 48 #include <sys/errno.h> 49 #include <sys/sysproto.h> 50 #include <sys/malloc.h> 51 #include <sys/nlookup.h> 52 #include <sys/namecache.h> 53 #include <sys/proc.h> 54 #include <sys/priv.h> 55 #include <sys/jail.h> 56 #include <sys/socket.h> 57 #include <sys/sysctl.h> 58 #include <sys/kern_syscall.h> 59 #include <net/if.h> 60 #include <netinet/in.h> 61 #include <netinet6/in6_var.h> 62 63 static struct prison *prison_find(int); 64 static void prison_ipcache_init(struct prison *); 65 66 MALLOC_DEFINE(M_PRISON, "prison", "Prison structures"); 67 68 SYSCTL_NODE(, OID_AUTO, jail, CTLFLAG_RW, 0, 69 "Jail rules"); 70 71 int jail_set_hostname_allowed = 1; 72 SYSCTL_INT(_jail, OID_AUTO, set_hostname_allowed, CTLFLAG_RW, 73 &jail_set_hostname_allowed, 0, 74 "Processes in jail can set their hostnames"); 75 76 int jail_socket_unixiproute_only = 1; 77 SYSCTL_INT(_jail, OID_AUTO, socket_unixiproute_only, CTLFLAG_RW, 78 &jail_socket_unixiproute_only, 0, 79 "Processes in jail are limited to creating UNIX/IPv[46]/route sockets only"); 80 81 int jail_sysvipc_allowed = 0; 82 SYSCTL_INT(_jail, OID_AUTO, sysvipc_allowed, CTLFLAG_RW, 83 &jail_sysvipc_allowed, 0, 84 "Processes in jail can use System V IPC primitives"); 85 86 int jail_chflags_allowed = 0; 87 SYSCTL_INT(_jail, OID_AUTO, chflags_allowed, CTLFLAG_RW, 88 &jail_chflags_allowed, 0, 89 "Process in jail can set chflags(1)"); 90 91 int jail_allow_raw_sockets = 0; 92 SYSCTL_INT(_jail, OID_AUTO, allow_raw_sockets, CTLFLAG_RW, 93 &jail_allow_raw_sockets, 0, 94 "Process in jail can create raw sockets"); 95 96 int lastprid = 0; 97 int prisoncount = 0; 98 99 LIST_HEAD(prisonlist, prison); 100 struct prisonlist allprison = LIST_HEAD_INITIALIZER(&allprison); 101 102 static int 103 kern_jail_attach(int jid) 104 { 105 struct proc *p = curthread->td_proc; 106 struct prison *pr; 107 int error; 108 109 pr = prison_find(jid); 110 if (pr == NULL) 111 return(EINVAL); 112 113 error = kern_chroot(&pr->pr_root); 114 if (error) 115 return(error); 116 117 prison_hold(pr); 118 cratom(&p->p_ucred); 119 p->p_ucred->cr_prison = pr; 120 p->p_flag |= P_JAILED; 121 122 return(0); 123 } 124 125 static int 126 assign_prison_id(struct prison *pr) 127 { 128 int tryprid; 129 struct prison *tpr; 130 131 tryprid = lastprid + 1; 132 if (tryprid == JAIL_MAX) 133 tryprid = 1; 134 next: 135 LIST_FOREACH(tpr, &allprison, pr_list) { 136 if (tpr->pr_id != tryprid) 137 continue; 138 tryprid++; 139 if (tryprid == JAIL_MAX) { 140 return (ERANGE); 141 } 142 goto next; 143 } 144 pr->pr_id = lastprid = tryprid; 145 146 return (0); 147 } 148 149 static int 150 kern_jail(struct prison *pr, struct jail *j) 151 { 152 int error; 153 struct nlookupdata nd; 154 155 error = nlookup_init(&nd, j->path, UIO_USERSPACE, NLC_FOLLOW); 156 if (error) { 157 nlookup_done(&nd); 158 return (error); 159 } 160 error = nlookup(&nd); 161 if (error) { 162 nlookup_done(&nd); 163 return (error); 164 } 165 cache_copy(&nd.nl_nch, &pr->pr_root); 166 167 varsymset_init(&pr->pr_varsymset, NULL); 168 prison_ipcache_init(pr); 169 170 error = assign_prison_id(pr); 171 if (error) { 172 varsymset_clean(&pr->pr_varsymset); 173 nlookup_done(&nd); 174 return (error); 175 } 176 177 LIST_INSERT_HEAD(&allprison, pr, pr_list); 178 prisoncount++; 179 180 error = kern_jail_attach(pr->pr_id); 181 if (error) { 182 LIST_REMOVE(pr, pr_list); 183 varsymset_clean(&pr->pr_varsymset); 184 } 185 nlookup_done(&nd); 186 return (error); 187 } 188 189 /* 190 * jail() 191 * 192 * jail_args(syscallarg(struct jail *) jail) 193 */ 194 int 195 sys_jail(struct jail_args *uap) 196 { 197 struct thread *td = curthread; 198 struct prison *pr; 199 struct jail_ip_storage *jip; 200 struct jail j; 201 int error; 202 uint32_t jversion; 203 204 uap->sysmsg_result = -1; 205 206 error = priv_check(td, PRIV_ROOT); 207 if (error) 208 return (error); 209 210 error = copyin(uap->jail, &jversion, sizeof(jversion)); 211 if (error) 212 return (error); 213 214 pr = kmalloc(sizeof(*pr), M_PRISON, M_WAITOK | M_ZERO); 215 SLIST_INIT(&pr->pr_ips); 216 217 switch (jversion) { 218 case 0: 219 /* Single IPv4 jails. */ 220 { 221 struct jail_v0 jv0; 222 struct sockaddr_in ip4addr; 223 224 error = copyin(uap->jail, &jv0, sizeof(jv0)); 225 if (error) 226 goto out; 227 228 j.path = jv0.path; 229 j.hostname = jv0.hostname; 230 231 jip = kmalloc(sizeof(*jip), M_PRISON, M_WAITOK | M_ZERO); 232 ip4addr.sin_family = AF_INET; 233 ip4addr.sin_addr.s_addr = htonl(jv0.ip_number); 234 memcpy(&jip->ip, &ip4addr, sizeof(ip4addr)); 235 SLIST_INSERT_HEAD(&pr->pr_ips, jip, entries); 236 break; 237 } 238 239 case 1: 240 /* 241 * DragonFly multi noIP/IPv4/IPv6 jails 242 * 243 * NOTE: This version is unsupported by FreeBSD 244 * (which uses version 2 instead). 245 */ 246 247 error = copyin(uap->jail, &j, sizeof(j)); 248 if (error) 249 goto out; 250 251 for (int i = 0; i < j.n_ips; i++) { 252 jip = kmalloc(sizeof(*jip), M_PRISON, 253 M_WAITOK | M_ZERO); 254 SLIST_INSERT_HEAD(&pr->pr_ips, jip, entries); 255 error = copyin(&j.ips[i], &jip->ip, 256 sizeof(struct sockaddr_storage)); 257 if (error) 258 goto out; 259 } 260 break; 261 default: 262 error = EINVAL; 263 goto out; 264 } 265 266 error = copyinstr(j.hostname, &pr->pr_host, sizeof(pr->pr_host), 0); 267 if (error) 268 goto out; 269 270 error = kern_jail(pr, &j); 271 if (error) 272 goto out; 273 274 uap->sysmsg_result = pr->pr_id; 275 return (0); 276 277 out: 278 /* Delete all ips */ 279 while (!SLIST_EMPTY(&pr->pr_ips)) { 280 jip = SLIST_FIRST(&pr->pr_ips); 281 SLIST_REMOVE_HEAD(&pr->pr_ips, entries); 282 kfree(jip, M_PRISON); 283 } 284 kfree(pr, M_PRISON); 285 return (error); 286 } 287 288 /* 289 * int jail_attach(int jid); 290 */ 291 int 292 sys_jail_attach(struct jail_attach_args *uap) 293 { 294 struct thread *td = curthread; 295 int error; 296 297 error = priv_check(td, PRIV_ROOT); 298 if (error) 299 return(error); 300 301 return(kern_jail_attach(uap->jid)); 302 } 303 304 static void 305 prison_ipcache_init(struct prison *pr) 306 { 307 struct jail_ip_storage *jis; 308 struct sockaddr_in *ip4; 309 struct sockaddr_in6 *ip6; 310 311 SLIST_FOREACH(jis, &pr->pr_ips, entries) { 312 switch (jis->ip.ss_family) { 313 case AF_INET: 314 ip4 = (struct sockaddr_in *)&jis->ip; 315 if ((ntohl(ip4->sin_addr.s_addr) >> IN_CLASSA_NSHIFT) == 316 IN_LOOPBACKNET) { 317 /* loopback address */ 318 if (pr->local_ip4 == NULL) 319 pr->local_ip4 = ip4; 320 } else { 321 /* public address */ 322 if (pr->nonlocal_ip4 == NULL) 323 pr->nonlocal_ip4 = ip4; 324 } 325 break; 326 327 case AF_INET6: 328 ip6 = (struct sockaddr_in6 *)&jis->ip; 329 if (IN6_IS_ADDR_LOOPBACK(&ip6->sin6_addr)) { 330 /* loopback address */ 331 if (pr->local_ip6 == NULL) 332 pr->local_ip6 = ip6; 333 } else { 334 /* public address */ 335 if (pr->nonlocal_ip6 == NULL) 336 pr->nonlocal_ip6 = ip6; 337 } 338 break; 339 } 340 } 341 } 342 343 /* 344 * Changes INADDR_LOOPBACK for a valid jail address. 345 * ip is in network byte order. 346 * Returns 1 if the ip is among jail valid ips. 347 * Returns 0 if is not among jail valid ips or 348 * if couldn't replace INADDR_LOOPBACK for a valid 349 * IP. 350 */ 351 int 352 prison_replace_wildcards(struct thread *td, struct sockaddr *ip) 353 { 354 struct sockaddr_in *ip4 = (struct sockaddr_in *)ip; 355 struct sockaddr_in6 *ip6 = (struct sockaddr_in6 *)ip; 356 struct prison *pr; 357 358 if (td->td_proc == NULL) 359 return (1); 360 if ((pr = td->td_proc->p_ucred->cr_prison) == NULL) 361 return (1); 362 363 if ((ip->sa_family == AF_INET && 364 ip4->sin_addr.s_addr == htonl(INADDR_ANY)) || 365 (ip->sa_family == AF_INET6 && 366 IN6_IS_ADDR_UNSPECIFIED(&ip6->sin6_addr))) 367 return (1); 368 if ((ip->sa_family == AF_INET && 369 ip4->sin_addr.s_addr == htonl(INADDR_LOOPBACK)) || 370 (ip->sa_family == AF_INET6 && 371 IN6_IS_ADDR_LOOPBACK(&ip6->sin6_addr))) { 372 if (!prison_get_local(pr, ip->sa_family, ip) && 373 !prison_get_nonlocal(pr, ip->sa_family, ip)) 374 return(0); 375 else 376 return(1); 377 } 378 if (jailed_ip(pr, ip)) 379 return(1); 380 return(0); 381 } 382 383 int 384 prison_remote_ip(struct thread *td, struct sockaddr *ip) 385 { 386 struct sockaddr_in *ip4 = (struct sockaddr_in *)ip; 387 struct sockaddr_in6 *ip6 = (struct sockaddr_in6 *)ip; 388 struct prison *pr; 389 390 if (td == NULL || td->td_proc == NULL) 391 return(1); 392 if ((pr = td->td_proc->p_ucred->cr_prison) == NULL) 393 return(1); 394 if ((ip->sa_family == AF_INET && 395 ip4->sin_addr.s_addr == htonl(INADDR_LOOPBACK)) || 396 (ip->sa_family == AF_INET6 && 397 IN6_IS_ADDR_LOOPBACK(&ip6->sin6_addr))) { 398 if (!prison_get_local(pr, ip->sa_family, ip) && 399 !prison_get_nonlocal(pr, ip->sa_family, ip)) 400 return(0); 401 else 402 return(1); 403 } 404 return(1); 405 } 406 407 /* 408 * Prison get non loopback ip: 409 * - af is the address family of the ip we want (AF_INET|AF_INET6). 410 * - If ip != NULL, put the first IP address that is not a loopback address 411 * into *ip. 412 * 413 * ip is in network by order and we don't touch it unless we find a valid ip. 414 * No matter if ip == NULL or not, we return either a valid struct sockaddr *, 415 * or NULL. This struct may not be modified. 416 */ 417 struct sockaddr * 418 prison_get_nonlocal(struct prison *pr, sa_family_t af, struct sockaddr *ip) 419 { 420 struct sockaddr_in *ip4 = (struct sockaddr_in *)ip; 421 struct sockaddr_in6 *ip6 = (struct sockaddr_in6 *)ip; 422 423 /* Check if it is cached */ 424 switch(af) { 425 case AF_INET: 426 if (ip4 != NULL && pr->nonlocal_ip4 != NULL) 427 ip4->sin_addr.s_addr = pr->nonlocal_ip4->sin_addr.s_addr; 428 return (struct sockaddr *)pr->nonlocal_ip4; 429 430 case AF_INET6: 431 if (ip6 != NULL && pr->nonlocal_ip6 != NULL) 432 ip6->sin6_addr = pr->nonlocal_ip6->sin6_addr; 433 return (struct sockaddr *)pr->nonlocal_ip6; 434 } 435 436 /* NOTREACHED */ 437 return NULL; 438 } 439 440 /* 441 * Prison get loopback ip. 442 * - af is the address family of the ip we want (AF_INET|AF_INET6). 443 * - If ip != NULL, put the first IP address that is not a loopback address 444 * into *ip. 445 * 446 * ip is in network by order and we don't touch it unless we find a valid ip. 447 * No matter if ip == NULL or not, we return either a valid struct sockaddr *, 448 * or NULL. This struct may not be modified. 449 */ 450 struct sockaddr * 451 prison_get_local(struct prison *pr, sa_family_t af, struct sockaddr *ip) 452 { 453 struct sockaddr_in *ip4 = (struct sockaddr_in *)ip; 454 struct sockaddr_in6 *ip6 = (struct sockaddr_in6 *)ip; 455 456 /* Check if it is cached */ 457 switch(af) { 458 case AF_INET: 459 if (ip4 != NULL && pr->local_ip4 != NULL) 460 ip4->sin_addr.s_addr = pr->local_ip4->sin_addr.s_addr; 461 return (struct sockaddr *)pr->local_ip4; 462 463 case AF_INET6: 464 if (ip6 != NULL && pr->local_ip6 != NULL) 465 ip6->sin6_addr = pr->local_ip6->sin6_addr; 466 return (struct sockaddr *)pr->local_ip6; 467 } 468 469 /* NOTREACHED */ 470 return NULL; 471 } 472 473 /* Check if the IP is among ours, if it is return 1, else 0 */ 474 int 475 jailed_ip(struct prison *pr, struct sockaddr *ip) 476 { 477 struct jail_ip_storage *jis; 478 struct sockaddr_in *jip4, *ip4; 479 struct sockaddr_in6 *jip6, *ip6; 480 481 if (pr == NULL) 482 return(0); 483 ip4 = (struct sockaddr_in *)ip; 484 ip6 = (struct sockaddr_in6 *)ip; 485 SLIST_FOREACH(jis, &pr->pr_ips, entries) { 486 switch (ip->sa_family) { 487 case AF_INET: 488 jip4 = (struct sockaddr_in *) &jis->ip; 489 if (jip4->sin_family == AF_INET && 490 ip4->sin_addr.s_addr == jip4->sin_addr.s_addr) 491 return(1); 492 break; 493 case AF_INET6: 494 jip6 = (struct sockaddr_in6 *) &jis->ip; 495 if (jip6->sin6_family == AF_INET6 && 496 IN6_ARE_ADDR_EQUAL(&ip6->sin6_addr, 497 &jip6->sin6_addr)) 498 return(1); 499 break; 500 } 501 } 502 /* Ip not in list */ 503 return(0); 504 } 505 506 int 507 prison_if(struct ucred *cred, struct sockaddr *sa) 508 { 509 struct prison *pr; 510 struct sockaddr_in *sai = (struct sockaddr_in*) sa; 511 512 pr = cred->cr_prison; 513 514 if (((sai->sin_family != AF_INET) && (sai->sin_family != AF_INET6)) 515 && jail_socket_unixiproute_only) 516 return(1); 517 else if ((sai->sin_family != AF_INET) && (sai->sin_family != AF_INET6)) 518 return(0); 519 else if (jailed_ip(pr, sa)) 520 return(0); 521 return(1); 522 } 523 524 /* 525 * Returns a prison instance, or NULL on failure. 526 */ 527 static struct prison * 528 prison_find(int prid) 529 { 530 struct prison *pr; 531 532 LIST_FOREACH(pr, &allprison, pr_list) { 533 if (pr->pr_id == prid) 534 break; 535 } 536 return(pr); 537 } 538 539 static int 540 sysctl_jail_list(SYSCTL_HANDLER_ARGS) 541 { 542 struct jail_ip_storage *jip; 543 #ifdef INET6 544 struct sockaddr_in6 *jsin6; 545 #endif 546 struct sockaddr_in *jsin; 547 struct proc *p; 548 struct prison *pr; 549 unsigned int jlssize, jlsused; 550 int count, error; 551 char *jls; /* Jail list */ 552 char *oip; /* Output ip */ 553 char *fullpath, *freepath; 554 555 jlsused = 0; 556 p = curthread->td_proc; 557 558 if (jailed(p->p_ucred)) 559 return (0); 560 retry: 561 count = prisoncount; 562 563 if (count == 0) 564 return(0); 565 566 jlssize = (count * 1024); 567 jls = kmalloc(jlssize + 1, M_TEMP, M_WAITOK | M_ZERO); 568 if (count < prisoncount) { 569 kfree(jls, M_TEMP); 570 goto retry; 571 } 572 count = prisoncount; 573 574 LIST_FOREACH(pr, &allprison, pr_list) { 575 error = cache_fullpath(p, &pr->pr_root, &fullpath, &freepath); 576 if (error) 577 continue; 578 if (jlsused && jlsused < jlssize) 579 jls[jlsused++] = '\n'; 580 count = ksnprintf(jls + jlsused, (jlssize - jlsused), 581 "%d %s %s", 582 pr->pr_id, pr->pr_host, fullpath); 583 kfree(freepath, M_TEMP); 584 if (count < 0) 585 goto end; 586 jlsused += count; 587 588 /* Copy the IPS */ 589 SLIST_FOREACH(jip, &pr->pr_ips, entries) { 590 jsin = (struct sockaddr_in *)&jip->ip; 591 592 switch(jsin->sin_family) { 593 case AF_INET: 594 oip = inet_ntoa(jsin->sin_addr); 595 break; 596 #ifdef INET6 597 case AF_INET6: 598 jsin6 = (struct sockaddr_in6 *)&jip->ip; 599 oip = ip6_sprintf(&jsin6->sin6_addr); 600 break; 601 #endif 602 default: 603 oip = "?family?"; 604 break; 605 } 606 607 if ((jlssize - jlsused) < (strlen(oip) + 1)) { 608 error = ERANGE; 609 goto end; 610 } 611 count = ksnprintf(jls + jlsused, (jlssize - jlsused), 612 " %s", oip); 613 if (count < 0) 614 goto end; 615 jlsused += count; 616 } 617 } 618 619 /* 620 * The format is: 621 * pr_id <SPC> hostname1 <SPC> PATH1 <SPC> IP1 <SPC> IP2\npr_id... 622 */ 623 error = SYSCTL_OUT(req, jls, jlsused); 624 end: 625 kfree(jls, M_TEMP); 626 return(error); 627 } 628 629 SYSCTL_OID(_jail, OID_AUTO, list, CTLTYPE_STRING | CTLFLAG_RD, NULL, 0, 630 sysctl_jail_list, "A", "List of active jails"); 631 632 void 633 prison_hold(struct prison *pr) 634 { 635 pr->pr_ref++; 636 } 637 638 void 639 prison_free(struct prison *pr) 640 { 641 struct jail_ip_storage *jls; 642 KKASSERT(pr->pr_ref >= 1); 643 644 if (--pr->pr_ref > 0) 645 return; 646 647 /* Delete all ips */ 648 while (!SLIST_EMPTY(&pr->pr_ips)) { 649 jls = SLIST_FIRST(&pr->pr_ips); 650 SLIST_REMOVE_HEAD(&pr->pr_ips, entries); 651 kfree(jls, M_PRISON); 652 } 653 LIST_REMOVE(pr, pr_list); 654 prisoncount--; 655 656 if (pr->pr_linux != NULL) 657 kfree(pr->pr_linux, M_PRISON); 658 varsymset_clean(&pr->pr_varsymset); 659 cache_drop(&pr->pr_root); 660 kfree(pr, M_PRISON); 661 } 662