1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 3 * 4 * Copyright (c) 1999 Poul-Henning Kamp. 5 * Copyright (c) 2009-2012 James Gritton 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 */ 29 30 #include <sys/cdefs.h> 31 __FBSDID("$FreeBSD$"); 32 33 #include <sys/types.h> 34 #include <sys/stat.h> 35 #include <sys/socket.h> 36 #include <sys/sysctl.h> 37 38 #include <arpa/inet.h> 39 #include <netinet/in.h> 40 41 #include <err.h> 42 #include <errno.h> 43 #include <stdarg.h> 44 #include <stdio.h> 45 #include <stdlib.h> 46 #include <string.h> 47 #include <unistd.h> 48 49 #include "jailp.h" 50 51 #define JP_RDTUN(jp) (((jp)->jp_ctltype & CTLFLAG_RDTUN) == CTLFLAG_RDTUN) 52 53 struct permspec { 54 const char *name; 55 enum intparam ipnum; 56 int rev; 57 }; 58 59 const char *cfname; 60 int iflag; 61 int note_remove; 62 int verbose; 63 64 static void clear_persist(struct cfjail *j); 65 static int update_jail(struct cfjail *j); 66 static int rdtun_params(struct cfjail *j, int dofail); 67 static void running_jid(struct cfjail *j, int dflag); 68 static void jail_quoted_warnx(const struct cfjail *j, const char *name_msg, 69 const char *noname_msg); 70 static int jailparam_set_note(const struct cfjail *j, struct jailparam *jp, 71 unsigned njp, int flags); 72 static void print_jail(FILE *fp, struct cfjail *j, int oldcl); 73 static void print_param(FILE *fp, const struct cfparam *p, int sep, int doname); 74 static void quoted_print(FILE *fp, char *str); 75 static void usage(void); 76 77 static struct permspec perm_sysctl[] = { 78 { "security.jail.set_hostname_allowed", KP_ALLOW_SET_HOSTNAME, 0 }, 79 { "security.jail.sysvipc_allowed", KP_ALLOW_SYSVIPC, 0 }, 80 { "security.jail.allow_raw_sockets", KP_ALLOW_RAW_SOCKETS, 0 }, 81 { "security.jail.chflags_allowed", KP_ALLOW_CHFLAGS, 0 }, 82 { "security.jail.mount_allowed", KP_ALLOW_MOUNT, 0 }, 83 { "security.jail.socket_unixiproute_only", KP_ALLOW_SOCKET_AF, 1 }, 84 }; 85 86 static const enum intparam startcommands[] = { 87 IP__NULL, 88 #ifdef INET 89 IP__IP4_IFADDR, 90 #endif 91 #ifdef INET6 92 IP__IP6_IFADDR, 93 #endif 94 IP_MOUNT, 95 IP__MOUNT_FROM_FSTAB, 96 IP_MOUNT_DEVFS, 97 IP_MOUNT_FDESCFS, 98 IP_MOUNT_PROCFS, 99 IP_EXEC_PRESTART, 100 IP__OP, 101 IP_VNET_INTERFACE, 102 IP_EXEC_START, 103 IP_COMMAND, 104 IP_EXEC_POSTSTART, 105 IP__NULL 106 }; 107 108 static const enum intparam stopcommands[] = { 109 IP__NULL, 110 IP_EXEC_PRESTOP, 111 IP_EXEC_STOP, 112 IP_STOP_TIMEOUT, 113 IP__OP, 114 IP_EXEC_POSTSTOP, 115 IP_MOUNT_PROCFS, 116 IP_MOUNT_FDESCFS, 117 IP_MOUNT_DEVFS, 118 IP__MOUNT_FROM_FSTAB, 119 IP_MOUNT, 120 #ifdef INET6 121 IP__IP6_IFADDR, 122 #endif 123 #ifdef INET 124 IP__IP4_IFADDR, 125 #endif 126 IP__NULL 127 }; 128 129 int 130 main(int argc, char **argv) 131 { 132 struct stat st; 133 FILE *jfp; 134 struct cfjail *j; 135 char *JidFile; 136 size_t sysvallen; 137 unsigned op, pi; 138 int ch, docf, error, i, oldcl, sysval; 139 int dflag, Rflag; 140 char enforce_statfs[4]; 141 #if defined(INET) || defined(INET6) 142 char *cs, *ncs; 143 #endif 144 #if defined(INET) && defined(INET6) 145 struct in6_addr addr6; 146 #endif 147 148 op = 0; 149 dflag = Rflag = 0; 150 docf = 1; 151 cfname = CONF_FILE; 152 JidFile = NULL; 153 154 while ((ch = getopt(argc, argv, "cdf:hiJ:lmn:p:qrRs:u:U:v")) != -1) { 155 switch (ch) { 156 case 'c': 157 op |= JF_START; 158 break; 159 case 'd': 160 dflag = 1; 161 break; 162 case 'f': 163 cfname = optarg; 164 break; 165 case 'h': 166 #if defined(INET) || defined(INET6) 167 add_param(NULL, NULL, IP_IP_HOSTNAME, NULL); 168 #endif 169 docf = 0; 170 break; 171 case 'i': 172 iflag = 1; 173 verbose = -1; 174 break; 175 case 'J': 176 JidFile = optarg; 177 break; 178 case 'l': 179 add_param(NULL, NULL, IP_EXEC_CLEAN, NULL); 180 docf = 0; 181 break; 182 case 'm': 183 op |= JF_SET; 184 break; 185 case 'n': 186 add_param(NULL, NULL, KP_NAME, optarg); 187 docf = 0; 188 break; 189 case 'p': 190 paralimit = strtol(optarg, NULL, 10); 191 if (paralimit == 0) 192 paralimit = -1; 193 break; 194 case 'q': 195 verbose = -1; 196 break; 197 case 'r': 198 op |= JF_STOP; 199 break; 200 case 'R': 201 op |= JF_STOP; 202 Rflag = 1; 203 break; 204 case 's': 205 add_param(NULL, NULL, KP_SECURELEVEL, optarg); 206 docf = 0; 207 break; 208 case 'u': 209 add_param(NULL, NULL, IP_EXEC_JAIL_USER, optarg); 210 add_param(NULL, NULL, IP_EXEC_SYSTEM_JAIL_USER, NULL); 211 docf = 0; 212 break; 213 case 'U': 214 add_param(NULL, NULL, IP_EXEC_JAIL_USER, optarg); 215 add_param(NULL, NULL, IP_EXEC_SYSTEM_JAIL_USER, 216 "false"); 217 docf = 0; 218 break; 219 case 'v': 220 verbose = 1; 221 break; 222 default: 223 usage(); 224 } 225 } 226 argc -= optind; 227 argv += optind; 228 229 /* Find out which of the four command line styles this is. */ 230 oldcl = 0; 231 if (!op) { 232 /* Old-style command line with four fixed parameters */ 233 if (argc < 4 || argv[0][0] != '/') 234 usage(); 235 op = JF_START; 236 docf = 0; 237 oldcl = 1; 238 add_param(NULL, NULL, KP_PATH, argv[0]); 239 add_param(NULL, NULL, KP_HOST_HOSTNAME, argv[1]); 240 #if defined(INET) || defined(INET6) 241 if (argv[2][0] != '\0') { 242 for (cs = argv[2];; cs = ncs + 1) { 243 ncs = strchr(cs, ','); 244 if (ncs) 245 *ncs = '\0'; 246 add_param(NULL, NULL, 247 #if defined(INET) && defined(INET6) 248 inet_pton(AF_INET6, cs, &addr6) == 1 249 ? KP_IP6_ADDR : KP_IP4_ADDR, 250 #elif defined(INET) 251 KP_IP4_ADDR, 252 #elif defined(INET6) 253 KP_IP6_ADDR, 254 #endif 255 cs); 256 if (!ncs) 257 break; 258 } 259 } 260 #endif 261 for (i = 3; i < argc; i++) 262 add_param(NULL, NULL, IP_COMMAND, argv[i]); 263 /* Emulate the defaults from security.jail.* sysctls. */ 264 sysvallen = sizeof(sysval); 265 if (sysctlbyname("security.jail.jailed", &sysval, &sysvallen, 266 NULL, 0) == 0 && sysval == 0) { 267 for (pi = 0; pi < sizeof(perm_sysctl) / 268 sizeof(perm_sysctl[0]); pi++) { 269 sysvallen = sizeof(sysval); 270 if (sysctlbyname(perm_sysctl[pi].name, 271 &sysval, &sysvallen, NULL, 0) == 0) 272 add_param(NULL, NULL, 273 perm_sysctl[pi].ipnum, 274 (sysval ? 1 : 0) ^ 275 perm_sysctl[pi].rev 276 ? NULL : "false"); 277 } 278 sysvallen = sizeof(sysval); 279 if (sysctlbyname("security.jail.enforce_statfs", 280 &sysval, &sysvallen, NULL, 0) == 0) { 281 snprintf(enforce_statfs, 282 sizeof(enforce_statfs), "%d", sysval); 283 add_param(NULL, NULL, KP_ENFORCE_STATFS, 284 enforce_statfs); 285 } 286 } 287 } else if (op == JF_STOP) { 288 /* Jail remove, perhaps using the config file */ 289 if (!docf || argc == 0) 290 usage(); 291 if (!Rflag) 292 for (i = 0; i < argc; i++) 293 if (strchr(argv[i], '=')) 294 usage(); 295 if ((docf = !Rflag && 296 (!strcmp(cfname, "-") || stat(cfname, &st) == 0))) 297 load_config(); 298 note_remove = docf || argc > 1 || wild_jail_name(argv[0]); 299 } else if (argc > 1 || (argc == 1 && strchr(argv[0], '='))) { 300 /* Single jail specified on the command line */ 301 if (Rflag) 302 usage(); 303 docf = 0; 304 for (i = 0; i < argc; i++) { 305 if (!strncmp(argv[i], "command", 7) && 306 (argv[i][7] == '\0' || argv[i][7] == '=')) { 307 if (argv[i][7] == '=') 308 add_param(NULL, NULL, IP_COMMAND, 309 argv[i] + 8); 310 for (i++; i < argc; i++) 311 add_param(NULL, NULL, IP_COMMAND, 312 argv[i]); 313 } 314 #ifdef INET 315 else if (!strncmp(argv[i], "ip4.addr=", 9)) { 316 for (cs = argv[i] + 9;; cs = ncs + 1) { 317 ncs = strchr(cs, ','); 318 if (ncs) 319 *ncs = '\0'; 320 add_param(NULL, NULL, KP_IP4_ADDR, cs); 321 if (!ncs) 322 break; 323 } 324 } 325 #endif 326 #ifdef INET6 327 else if (!strncmp(argv[i], "ip6.addr=", 9)) { 328 for (cs = argv[i] + 9;; cs = ncs + 1) { 329 ncs = strchr(cs, ','); 330 if (ncs) 331 *ncs = '\0'; 332 add_param(NULL, NULL, KP_IP6_ADDR, cs); 333 if (!ncs) 334 break; 335 } 336 } 337 #endif 338 else 339 add_param(NULL, NULL, 0, argv[i]); 340 } 341 } else { 342 /* From the config file, perhaps with a specified jail */ 343 if (Rflag || !docf) 344 usage(); 345 load_config(); 346 } 347 348 /* Find out which jails will be run. */ 349 dep_setup(docf); 350 error = 0; 351 if (op == JF_STOP) { 352 for (i = 0; i < argc; i++) 353 if (start_state(argv[i], docf, op, Rflag) < 0) 354 error = 1; 355 } else { 356 if (start_state(argv[0], docf, op, 0) < 0) 357 exit(1); 358 } 359 360 jfp = NULL; 361 if (JidFile != NULL) { 362 jfp = fopen(JidFile, "w"); 363 if (jfp == NULL) 364 err(1, "open %s", JidFile); 365 setlinebuf(jfp); 366 } 367 setlinebuf(stdout); 368 369 /* 370 * The main loop: Get an available jail and perform the required 371 * operation on it. When that is done, the jail may be finished, 372 * or it may go back for the next step. 373 */ 374 while ((j = next_jail())) 375 { 376 if (j->flags & JF_FAILED) { 377 error = 1; 378 if (j->comparam == NULL) { 379 dep_done(j, 0); 380 continue; 381 } 382 } 383 if (!(j->flags & JF_PARAMS)) 384 { 385 j->flags |= JF_PARAMS; 386 if (dflag) 387 add_param(j, NULL, IP_ALLOW_DYING, NULL); 388 if (check_intparams(j) < 0) 389 continue; 390 if ((j->flags & (JF_START | JF_SET)) && 391 import_params(j) < 0) 392 continue; 393 } 394 if (!j->jid) 395 running_jid(j, 396 (j->flags & (JF_SET | JF_DEPEND)) == JF_SET 397 ? dflag || bool_param(j->intparams[IP_ALLOW_DYING]) 398 : 0); 399 if (finish_command(j)) 400 continue; 401 402 switch (j->flags & JF_OP_MASK) { 403 /* 404 * These operations just turn into a different op 405 * depending on the jail's current status. 406 */ 407 case JF_START_SET: 408 j->flags = j->jid < 0 ? JF_START : JF_SET; 409 break; 410 case JF_SET_RESTART: 411 if (j->jid < 0) { 412 jail_quoted_warnx(j, "not found", 413 "no jail specified"); 414 failed(j); 415 continue; 416 } 417 j->flags = rdtun_params(j, 0) ? JF_RESTART : JF_SET; 418 if (j->flags == JF_RESTART) 419 dep_reset(j); 420 break; 421 case JF_START_SET_RESTART: 422 j->flags = j->jid < 0 ? JF_START 423 : rdtun_params(j, 0) ? JF_RESTART : JF_SET; 424 if (j->flags == JF_RESTART) 425 dep_reset(j); 426 } 427 428 switch (j->flags & JF_OP_MASK) { 429 case JF_START: 430 if (j->comparam == NULL) { 431 if (j->jid > 0 && 432 !(j->flags & (JF_DEPEND | JF_WILD))) { 433 jail_quoted_warnx(j, "already exists", 434 NULL); 435 failed(j); 436 continue; 437 } 438 if (dep_check(j)) 439 continue; 440 if (j->jid > 0) 441 goto jail_create_done; 442 j->comparam = startcommands; 443 j->comstring = NULL; 444 } 445 if (next_command(j)) 446 continue; 447 jail_create_done: 448 clear_persist(j); 449 if (jfp != NULL) 450 print_jail(jfp, j, oldcl); 451 dep_done(j, 0); 452 break; 453 454 case JF_SET: 455 if (j->jid < 0 && !(j->flags & JF_DEPEND)) { 456 jail_quoted_warnx(j, "not found", 457 "no jail specified"); 458 failed(j); 459 continue; 460 } 461 if (dep_check(j)) 462 continue; 463 if (!(j->flags & JF_DEPEND)) { 464 if (rdtun_params(j, 1) < 0 || 465 update_jail(j) < 0) 466 continue; 467 if (verbose >= 0 && (j->name || verbose > 0)) 468 jail_note(j, "updated\n"); 469 } 470 dep_done(j, 0); 471 break; 472 473 case JF_STOP: 474 case JF_RESTART: 475 if (j->comparam == NULL) { 476 if (dep_check(j)) 477 continue; 478 if (j->jid < 0) { 479 if (!(j->flags & (JF_DEPEND|JF_WILD))) { 480 if (verbose >= 0) 481 jail_quoted_warnx(j, 482 "not found", NULL); 483 failed(j); 484 } 485 goto jail_remove_done; 486 } 487 j->comparam = stopcommands; 488 j->comstring = NULL; 489 } else if ((j->flags & JF_FAILED) && j->jid > 0) 490 goto jail_remove_done; 491 if (next_command(j)) 492 continue; 493 jail_remove_done: 494 dep_done(j, 0); 495 if ((j->flags & (JF_START | JF_FAILED)) == JF_START) { 496 j->comparam = NULL; 497 j->flags &= ~JF_STOP; 498 dep_reset(j); 499 requeue(j, j->ndeps ? &depend : &ready); 500 } 501 break; 502 } 503 } 504 505 if (jfp != NULL) 506 fclose(jfp); 507 exit(error); 508 } 509 510 /* 511 * Mark a jail's failure for future handling. 512 */ 513 void 514 failed(struct cfjail *j) 515 { 516 j->flags |= JF_FAILED; 517 TAILQ_REMOVE(j->queue, j, tq); 518 TAILQ_INSERT_HEAD(&ready, j, tq); 519 j->queue = &ready; 520 } 521 522 /* 523 * Exit slightly more gracefully when out of memory. 524 */ 525 void * 526 emalloc(size_t size) 527 { 528 void *p; 529 530 p = malloc(size); 531 if (!p) 532 err(1, "malloc"); 533 return p; 534 } 535 536 void * 537 erealloc(void *ptr, size_t size) 538 { 539 void *p; 540 541 p = realloc(ptr, size); 542 if (!p) 543 err(1, "malloc"); 544 return p; 545 } 546 547 char * 548 estrdup(const char *str) 549 { 550 char *ns; 551 552 ns = strdup(str); 553 if (!ns) 554 err(1, "malloc"); 555 return ns; 556 } 557 558 /* 559 * Print a message including an optional jail name. 560 */ 561 void 562 jail_note(const struct cfjail *j, const char *fmt, ...) 563 { 564 va_list ap, tap; 565 char *cs; 566 size_t len; 567 568 va_start(ap, fmt); 569 va_copy(tap, ap); 570 len = vsnprintf(NULL, 0, fmt, tap); 571 va_end(tap); 572 cs = alloca(len + 1); 573 (void)vsnprintf(cs, len + 1, fmt, ap); 574 va_end(ap); 575 if (j->name) 576 printf("%s: %s", j->name, cs); 577 else 578 printf("%s", cs); 579 } 580 581 /* 582 * Print a warning message including an optional jail name. 583 */ 584 void 585 jail_warnx(const struct cfjail *j, const char *fmt, ...) 586 { 587 va_list ap, tap; 588 char *cs; 589 size_t len; 590 591 va_start(ap, fmt); 592 va_copy(tap, ap); 593 len = vsnprintf(NULL, 0, fmt, tap); 594 va_end(tap); 595 cs = alloca(len + 1); 596 (void)vsnprintf(cs, len + 1, fmt, ap); 597 va_end(ap); 598 if (j->name) 599 warnx("%s: %s", j->name, cs); 600 else 601 warnx("%s", cs); 602 } 603 604 /* 605 * Create a new jail. 606 */ 607 int 608 create_jail(struct cfjail *j) 609 { 610 struct iovec jiov[4]; 611 struct stat st; 612 struct jailparam *jp, *setparams, *setparams2, *sjp; 613 const char *path; 614 int dopersist, ns, jid, dying, didfail; 615 616 /* 617 * Check the jail's path, with a better error message than jail_set 618 * gives. 619 */ 620 if ((path = string_param(j->intparams[KP_PATH]))) { 621 if (j->name != NULL && path[0] != '/') { 622 jail_warnx(j, "path %s: not an absolute pathname", 623 path); 624 return -1; 625 } 626 if (stat(path, &st) < 0) { 627 jail_warnx(j, "path %s: %s", path, strerror(errno)); 628 return -1; 629 } 630 if (!S_ISDIR(st.st_mode)) { 631 jail_warnx(j, "path %s: %s", path, strerror(ENOTDIR)); 632 return -1; 633 } 634 } 635 636 /* 637 * Copy all the parameters, except that "persist" is always set when 638 * there are commands to run later. 639 */ 640 dopersist = !bool_param(j->intparams[KP_PERSIST]) && 641 (j->intparams[IP_EXEC_START] || j->intparams[IP_COMMAND] || 642 j->intparams[IP_EXEC_POSTSTART]); 643 sjp = setparams = 644 alloca((j->njp + dopersist) * sizeof(struct jailparam)); 645 if (dopersist && jailparam_init(sjp++, "persist") < 0) { 646 jail_warnx(j, "%s", jail_errmsg); 647 return -1; 648 } 649 for (jp = j->jp; jp < j->jp + j->njp; jp++) 650 if (!dopersist || !equalopts(jp->jp_name, "persist")) 651 *sjp++ = *jp; 652 ns = sjp - setparams; 653 654 didfail = 0; 655 j->jid = jailparam_set_note(j, setparams, ns, JAIL_CREATE); 656 if (j->jid < 0 && errno == EEXIST && 657 bool_param(j->intparams[IP_ALLOW_DYING]) && 658 int_param(j->intparams[KP_JID], &jid) && jid != 0) { 659 /* 660 * The jail already exists, but may be dying. 661 * Make sure it is, in which case an update is appropriate. 662 */ 663 jiov[0].iov_base = __DECONST(char *, "jid"); 664 jiov[0].iov_len = sizeof("jid"); 665 jiov[1].iov_base = &jid; 666 jiov[1].iov_len = sizeof(jid); 667 jiov[2].iov_base = __DECONST(char *, "dying"); 668 jiov[2].iov_len = sizeof("dying"); 669 jiov[3].iov_base = &dying; 670 jiov[3].iov_len = sizeof(dying); 671 if (jail_get(jiov, 4, JAIL_DYING) < 0) { 672 /* 673 * It could be that the jail just barely finished 674 * dying, or it could be that the jid never existed 675 * but the name does. In either case, another try 676 * at creating the jail should do the right thing. 677 */ 678 if (errno == ENOENT) 679 j->jid = jailparam_set_note(j, setparams, ns, 680 JAIL_CREATE); 681 } else if (dying) { 682 j->jid = jid; 683 if (rdtun_params(j, 1) < 0) { 684 j->jid = -1; 685 didfail = 1; 686 } else { 687 sjp = setparams2 = alloca((j->njp + dopersist) * 688 sizeof(struct jailparam)); 689 for (jp = setparams; jp < setparams + ns; jp++) 690 if (!JP_RDTUN(jp) || 691 !strcmp(jp->jp_name, "jid")) 692 *sjp++ = *jp; 693 j->jid = jailparam_set_note(j, setparams2, 694 sjp - setparams2, JAIL_UPDATE | JAIL_DYING); 695 /* 696 * Again, perhaps the jail just finished dying. 697 */ 698 if (j->jid < 0 && errno == ENOENT) 699 j->jid = jailparam_set_note(j, 700 setparams, ns, JAIL_CREATE); 701 } 702 } 703 } 704 if (j->jid < 0 && !didfail) { 705 jail_warnx(j, "%s", jail_errmsg); 706 failed(j); 707 } 708 if (dopersist) { 709 jailparam_free(setparams, 1); 710 if (j->jid > 0) 711 j->flags |= JF_PERSIST; 712 } 713 return j->jid; 714 } 715 716 /* 717 * Remove a temporarily set "persist" parameter. 718 */ 719 static void 720 clear_persist(struct cfjail *j) 721 { 722 struct iovec jiov[4]; 723 int jid; 724 725 if (!(j->flags & JF_PERSIST)) 726 return; 727 j->flags &= ~JF_PERSIST; 728 jiov[0].iov_base = __DECONST(char *, "jid"); 729 jiov[0].iov_len = sizeof("jid"); 730 jiov[1].iov_base = &j->jid; 731 jiov[1].iov_len = sizeof(j->jid); 732 jiov[2].iov_base = __DECONST(char *, "nopersist"); 733 jiov[2].iov_len = sizeof("nopersist"); 734 jiov[3].iov_base = NULL; 735 jiov[3].iov_len = 0; 736 jid = jail_set(jiov, 4, JAIL_UPDATE); 737 if (verbose > 0) 738 jail_note(j, "jail_set(JAIL_UPDATE) jid=%d nopersist%s%s\n", 739 j->jid, jid < 0 ? ": " : "", 740 jid < 0 ? strerror(errno) : ""); 741 } 742 743 /* 744 * Set a jail's parameters. 745 */ 746 static int 747 update_jail(struct cfjail *j) 748 { 749 struct jailparam *jp, *setparams, *sjp; 750 int ns, jid; 751 752 ns = 0; 753 for (jp = j->jp; jp < j->jp + j->njp; jp++) 754 if (!JP_RDTUN(jp)) 755 ns++; 756 if (ns == 0) 757 return 0; 758 sjp = setparams = alloca(++ns * sizeof(struct jailparam)); 759 if (jailparam_init(sjp, "jid") < 0 || 760 jailparam_import_raw(sjp, &j->jid, sizeof j->jid) < 0) { 761 jail_warnx(j, "%s", jail_errmsg); 762 failed(j); 763 return -1; 764 } 765 for (jp = j->jp; jp < j->jp + j->njp; jp++) 766 if (!JP_RDTUN(jp)) 767 *++sjp = *jp; 768 769 jid = jailparam_set_note(j, setparams, ns, 770 bool_param(j->intparams[IP_ALLOW_DYING]) 771 ? JAIL_UPDATE | JAIL_DYING : JAIL_UPDATE); 772 if (jid < 0) { 773 jail_warnx(j, "%s", jail_errmsg); 774 failed(j); 775 } 776 jailparam_free(setparams, 1); 777 return jid; 778 } 779 780 /* 781 * Return if a jail set would change any create-only parameters. 782 */ 783 static int 784 rdtun_params(struct cfjail *j, int dofail) 785 { 786 struct jailparam *jp, *rtparams, *rtjp; 787 int nrt, rval; 788 789 if (j->flags & JF_RDTUN) 790 return 0; 791 j->flags |= JF_RDTUN; 792 nrt = 0; 793 for (jp = j->jp; jp < j->jp + j->njp; jp++) 794 if (JP_RDTUN(jp) && strcmp(jp->jp_name, "jid")) 795 nrt++; 796 if (nrt == 0) 797 return 0; 798 rtjp = rtparams = alloca(++nrt * sizeof(struct jailparam)); 799 if (jailparam_init(rtjp, "jid") < 0 || 800 jailparam_import_raw(rtjp, &j->jid, sizeof j->jid) < 0) { 801 jail_warnx(j, "%s", jail_errmsg); 802 exit(1); 803 } 804 for (jp = j->jp; jp < j->jp + j->njp; jp++) 805 if (JP_RDTUN(jp) && strcmp(jp->jp_name, "jid")) 806 *++rtjp = *jp; 807 rval = 0; 808 if (jailparam_get(rtparams, nrt, 809 bool_param(j->intparams[IP_ALLOW_DYING]) ? JAIL_DYING : 0) > 0) { 810 rtjp = rtparams + 1; 811 for (jp = j->jp; rtjp < rtparams + nrt; jp++) { 812 if (JP_RDTUN(jp) && strcmp(jp->jp_name, "jid")) { 813 if (!((jp->jp_flags & (JP_BOOL | JP_NOBOOL)) && 814 jp->jp_valuelen == 0 && 815 *(int *)jp->jp_value) && 816 !(rtjp->jp_valuelen == jp->jp_valuelen && 817 !memcmp(rtjp->jp_value, jp->jp_value, 818 jp->jp_valuelen))) { 819 if (dofail) { 820 jail_warnx(j, "%s cannot be " 821 "changed after creation", 822 jp->jp_name); 823 failed(j); 824 rval = -1; 825 } else 826 rval = 1; 827 break; 828 } 829 rtjp++; 830 } 831 } 832 } 833 for (rtjp = rtparams + 1; rtjp < rtparams + nrt; rtjp++) 834 rtjp->jp_name = NULL; 835 jailparam_free(rtparams, nrt); 836 return rval; 837 } 838 839 /* 840 * Get the jail's jid if it is running. 841 */ 842 static void 843 running_jid(struct cfjail *j, int dflag) 844 { 845 struct iovec jiov[2]; 846 const char *pval; 847 char *ep; 848 int jid; 849 850 if ((pval = string_param(j->intparams[KP_JID]))) { 851 if (!(jid = strtol(pval, &ep, 10)) || *ep) { 852 j->jid = -1; 853 return; 854 } 855 jiov[0].iov_base = __DECONST(char *, "jid"); 856 jiov[0].iov_len = sizeof("jid"); 857 jiov[1].iov_base = &jid; 858 jiov[1].iov_len = sizeof(jid); 859 } else if ((pval = string_param(j->intparams[KP_NAME]))) { 860 jiov[0].iov_base = __DECONST(char *, "name"); 861 jiov[0].iov_len = sizeof("name"); 862 jiov[1].iov_len = strlen(pval) + 1; 863 jiov[1].iov_base = alloca(jiov[1].iov_len); 864 strcpy(jiov[1].iov_base, pval); 865 } else { 866 j->jid = -1; 867 return; 868 } 869 j->jid = jail_get(jiov, 2, dflag ? JAIL_DYING : 0); 870 } 871 872 static void 873 jail_quoted_warnx(const struct cfjail *j, const char *name_msg, 874 const char *noname_msg) 875 { 876 const char *pval; 877 878 if ((pval = j->name) || (pval = string_param(j->intparams[KP_JID])) || 879 (pval = string_param(j->intparams[KP_NAME]))) 880 warnx("\"%s\" %s", pval, name_msg); 881 else 882 warnx("%s", noname_msg); 883 } 884 885 /* 886 * Set jail parameters and possibly print them out. 887 */ 888 static int 889 jailparam_set_note(const struct cfjail *j, struct jailparam *jp, unsigned njp, 890 int flags) 891 { 892 char *value; 893 int jid; 894 unsigned i; 895 896 jid = jailparam_set(jp, njp, flags); 897 if (verbose > 0) { 898 jail_note(j, "jail_set(%s%s)", 899 (flags & (JAIL_CREATE | JAIL_UPDATE)) == JAIL_CREATE 900 ? "JAIL_CREATE" : "JAIL_UPDATE", 901 (flags & JAIL_DYING) ? " | JAIL_DYING" : ""); 902 for (i = 0; i < njp; i++) { 903 printf(" %s", jp[i].jp_name); 904 if (jp[i].jp_value == NULL) 905 continue; 906 putchar('='); 907 value = jailparam_export(jp + i); 908 if (value == NULL) 909 err(1, "jailparam_export"); 910 quoted_print(stdout, value); 911 free(value); 912 } 913 if (jid < 0) 914 printf(": %s", strerror(errno)); 915 printf("\n"); 916 } 917 return jid; 918 } 919 920 /* 921 * Print a jail record. 922 */ 923 static void 924 print_jail(FILE *fp, struct cfjail *j, int oldcl) 925 { 926 struct cfparam *p; 927 928 if (oldcl) { 929 fprintf(fp, "%d\t", j->jid); 930 print_param(fp, j->intparams[KP_PATH], ',', 0); 931 putc('\t', fp); 932 print_param(fp, j->intparams[KP_HOST_HOSTNAME], ',', 0); 933 putc('\t', fp); 934 #ifdef INET 935 print_param(fp, j->intparams[KP_IP4_ADDR], ',', 0); 936 #ifdef INET6 937 if (j->intparams[KP_IP4_ADDR] && 938 !TAILQ_EMPTY(&j->intparams[KP_IP4_ADDR]->val) && 939 j->intparams[KP_IP6_ADDR] && 940 !TAILQ_EMPTY(&j->intparams[KP_IP6_ADDR]->val)) 941 putc(',', fp); 942 #endif 943 #endif 944 #ifdef INET6 945 print_param(fp, j->intparams[KP_IP6_ADDR], ',', 0); 946 #endif 947 putc('\t', fp); 948 print_param(fp, j->intparams[IP_COMMAND], ' ', 0); 949 } else { 950 fprintf(fp, "jid=%d", j->jid); 951 TAILQ_FOREACH(p, &j->params, tq) 952 if (strcmp(p->name, "jid")) { 953 putc(' ', fp); 954 print_param(fp, p, ',', 1); 955 } 956 } 957 putc('\n', fp); 958 } 959 960 /* 961 * Print a parameter value, or a name=value pair. 962 */ 963 static void 964 print_param(FILE *fp, const struct cfparam *p, int sep, int doname) 965 { 966 const struct cfstring *s, *ts; 967 968 if (doname) 969 fputs(p->name, fp); 970 if (p == NULL || TAILQ_EMPTY(&p->val)) 971 return; 972 if (doname) 973 putc('=', fp); 974 TAILQ_FOREACH_SAFE(s, &p->val, tq, ts) { 975 quoted_print(fp, s->s); 976 if (ts != NULL) 977 putc(sep, fp); 978 } 979 } 980 981 /* 982 * Print a string with quotes around spaces. 983 */ 984 static void 985 quoted_print(FILE *fp, char *str) 986 { 987 int c, qc; 988 char *p = str; 989 990 qc = !*p ? '"' 991 : strchr(p, '\'') ? '"' 992 : strchr(p, '"') ? '\'' 993 : strchr(p, ' ') || strchr(p, '\t') ? '"' 994 : 0; 995 if (qc) 996 putc(qc, fp); 997 while ((c = *p++)) { 998 if (c == '\\' || c == qc) 999 putc('\\', fp); 1000 putc(c, fp); 1001 } 1002 if (qc) 1003 putc(qc, fp); 1004 } 1005 1006 static void 1007 usage(void) 1008 { 1009 1010 (void)fprintf(stderr, 1011 "usage: jail [-dhilqv] [-J jid_file] [-u username] [-U username]\n" 1012 " -[cmr] param=value ... [command=command ...]\n" 1013 " jail [-dqv] [-f file] -[cmr] [jail]\n" 1014 " jail [-qv] [-f file] -[rR] ['*' | jail ...]\n" 1015 " jail [-dhilqv] [-J jid_file] [-u username] [-U username]\n" 1016 " [-n jailname] [-s securelevel]\n" 1017 " path hostname [ip[,...]] command ...\n"); 1018 exit(1); 1019 } 1020