1 /*- 2 * ---------------------------------------------------------------------------- 3 * "THE BEER-WARE LICENSE" (Revision 42): 4 * <phk@FreeBSD.org> wrote this file. As long as you retain this notice you 5 * can do whatever you want with this stuff. If we meet some day, and you think 6 * this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp 7 * ---------------------------------------------------------------------------- 8 * 9 * $FreeBSD$ 10 * 11 */ 12 13 #ifndef _SYS_JAIL_H_ 14 #define _SYS_JAIL_H_ 15 16 struct jail { 17 u_int32_t version; 18 char *path; 19 char *hostname; 20 u_int32_t ip_number; 21 }; 22 23 struct xprison { 24 int pr_version; 25 int pr_id; 26 char pr_path[MAXPATHLEN]; 27 char pr_host[MAXHOSTNAMELEN]; 28 u_int32_t pr_ip; 29 }; 30 #define XPRISON_VERSION 1 31 32 #ifndef _KERNEL 33 34 int jail(struct jail *); 35 int jail_attach(int); 36 37 #else /* _KERNEL */ 38 39 #include <sys/queue.h> 40 #include <sys/_lock.h> 41 #include <sys/_mutex.h> 42 #include <sys/_task.h> 43 44 #define JAIL_MAX 999999 45 46 #ifdef MALLOC_DECLARE 47 MALLOC_DECLARE(M_PRISON); 48 #endif 49 #endif /* _KERNEL */ 50 51 /* 52 * This structure describes a prison. It is pointed to by all struct 53 * ucreds's of the inmates. pr_ref keeps track of them and is used to 54 * delete the struture when the last inmate is dead. 55 * 56 * Lock key: 57 * (a) allprison_mtx 58 * (p) locked by pr_mtx 59 * (c) set only during creation before the structure is shared, no mutex 60 * required to read 61 * (d) set only during destruction of jail, no mutex needed 62 */ 63 #if defined(_KERNEL) || defined(_WANT_PRISON) 64 struct prison { 65 LIST_ENTRY(prison) pr_list; /* (a) all prisons */ 66 int pr_id; /* (c) prison id */ 67 int pr_ref; /* (p) refcount */ 68 char pr_path[MAXPATHLEN]; /* (c) chroot path */ 69 struct vnode *pr_root; /* (c) vnode to rdir */ 70 char pr_host[MAXHOSTNAMELEN]; /* (p) jail hostname */ 71 u_int32_t pr_ip; /* (c) ip addr host */ 72 void *pr_linux; /* (p) linux abi */ 73 int pr_securelevel; /* (p) securelevel */ 74 struct task pr_task; /* (d) destroy task */ 75 struct mtx pr_mtx; 76 }; 77 #endif /* _KERNEL || _WANT_PRISON */ 78 79 #ifdef _KERNEL 80 /* 81 * Sysctl-set variables that determine global jail policy 82 * 83 * XXX MIB entries will need to be protected by a mutex. 84 */ 85 extern int jail_set_hostname_allowed; 86 extern int jail_socket_unixiproute_only; 87 extern int jail_sysvipc_allowed; 88 extern int jail_getfsstat_jailrootonly; 89 extern int jail_allow_raw_sockets; 90 extern int jail_chflags_allowed; 91 92 LIST_HEAD(prisonlist, prison); 93 extern struct prisonlist allprison; 94 95 /* 96 * Kernel support functions for jail(). 97 */ 98 struct ucred; 99 struct mount; 100 struct sockaddr; 101 struct statfs; 102 int jailed(struct ucred *cred); 103 void getcredhostname(struct ucred *cred, char *, size_t); 104 int prison_check(struct ucred *cred1, struct ucred *cred2); 105 int prison_canseemount(struct ucred *cred, struct mount *mp); 106 void prison_enforce_statfs(struct ucred *cred, struct mount *mp, 107 struct statfs *sp); 108 void prison_free(struct prison *pr); 109 u_int32_t prison_getip(struct ucred *cred); 110 void prison_hold(struct prison *pr); 111 int prison_if(struct ucred *cred, struct sockaddr *sa); 112 int prison_ip(struct ucred *cred, int flag, u_int32_t *ip); 113 int prison_priv_check(struct ucred *cred, int priv); 114 void prison_remote_ip(struct ucred *cred, int flags, u_int32_t *ip); 115 116 #endif /* _KERNEL */ 117 #endif /* !_SYS_JAIL_H_ */ 118