2005-01-06 23:35:40 +00:00
|
|
|
/*-
|
2017-11-27 15:20:12 +00:00
|
|
|
* SPDX-License-Identifier: BSD-2-Clause-FreeBSD
|
|
|
|
*
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
* Copyright (c) 1999 Poul-Henning Kamp.
|
|
|
|
* Copyright (c) 2008 Bjoern A. Zeeb.
|
2009-04-29 21:14:15 +00:00
|
|
|
* Copyright (c) 2009 James Gritton.
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
* All rights reserved.
|
2009-03-27 13:13:59 +00:00
|
|
|
*
|
2008-11-28 19:23:46 +00:00
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
* modification, are permitted provided that the following conditions
|
|
|
|
* are met:
|
|
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer.
|
|
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
|
|
* documentation and/or other materials provided with the distribution.
|
|
|
|
*
|
|
|
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
|
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
|
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
|
|
* SUCH DAMAGE.
|
1999-04-30 06:51:51 +00:00
|
|
|
*/
|
This Implements the mumbled about "Jail" feature.
This is a seriously beefed up chroot kind of thing. The process
is jailed along the same lines as a chroot does it, but with
additional tough restrictions imposed on what the superuser can do.
For all I know, it is safe to hand over the root bit inside a
prison to the customer living in that prison, this is what
it was developed for in fact: "real virtual servers".
Each prison has an ip number associated with it, which all IP
communications will be coerced to use and each prison has its own
hostname.
Needless to say, you need more RAM this way, but the advantage is
that each customer can run their own particular version of apache
and not stomp on the toes of their neighbors.
It generally does what one would expect, but setting up a jail
still takes a little knowledge.
A few notes:
I have no scripts for setting up a jail, don't ask me for them.
The IP number should be an alias on one of the interfaces.
mount a /proc in each jail, it will make ps more useable.
/proc/<pid>/status tells the hostname of the prison for
jailed processes.
Quotas are only sensible if you have a mountpoint per prison.
There are no privisions for stopping resource-hogging.
Some "#ifdef INET" and similar may be missing (send patches!)
If somebody wants to take it from here and develop it into
more of a "virtual machine" they should be most welcome!
Tools, comments, patches & documentation most welcome.
Have fun...
Sponsored by: http://www.rndassociates.com/
Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
|
|
|
|
2003-06-11 00:56:59 +00:00
|
|
|
#include <sys/cdefs.h>
|
|
|
|
__FBSDID("$FreeBSD$");
|
|
|
|
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
#include "opt_ddb.h"
|
|
|
|
#include "opt_inet.h"
|
|
|
|
#include "opt_inet6.h"
|
2022-12-17 21:43:49 +00:00
|
|
|
#include "opt_nfs.h"
|
2004-06-27 09:03:22 +00:00
|
|
|
|
This Implements the mumbled about "Jail" feature.
This is a seriously beefed up chroot kind of thing. The process
is jailed along the same lines as a chroot does it, but with
additional tough restrictions imposed on what the superuser can do.
For all I know, it is safe to hand over the root bit inside a
prison to the customer living in that prison, this is what
it was developed for in fact: "real virtual servers".
Each prison has an ip number associated with it, which all IP
communications will be coerced to use and each prison has its own
hostname.
Needless to say, you need more RAM this way, but the advantage is
that each customer can run their own particular version of apache
and not stomp on the toes of their neighbors.
It generally does what one would expect, but setting up a jail
still takes a little knowledge.
A few notes:
I have no scripts for setting up a jail, don't ask me for them.
The IP number should be an alias on one of the interfaces.
mount a /proc in each jail, it will make ps more useable.
/proc/<pid>/status tells the hostname of the prison for
jailed processes.
Quotas are only sensible if you have a mountpoint per prison.
There are no privisions for stopping resource-hogging.
Some "#ifdef INET" and similar may be missing (send patches!)
If somebody wants to take it from here and develop it into
more of a "virtual machine" they should be most welcome!
Tools, comments, patches & documentation most welcome.
Have fun...
Sponsored by: http://www.rndassociates.com/
Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
|
|
|
#include <sys/param.h>
|
|
|
|
#include <sys/types.h>
|
|
|
|
#include <sys/kernel.h>
|
|
|
|
#include <sys/systm.h>
|
|
|
|
#include <sys/errno.h>
|
|
|
|
#include <sys/sysproto.h>
|
|
|
|
#include <sys/malloc.h>
|
2009-05-27 14:11:23 +00:00
|
|
|
#include <sys/osd.h>
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
#include <sys/priv.h>
|
This Implements the mumbled about "Jail" feature.
This is a seriously beefed up chroot kind of thing. The process
is jailed along the same lines as a chroot does it, but with
additional tough restrictions imposed on what the superuser can do.
For all I know, it is safe to hand over the root bit inside a
prison to the customer living in that prison, this is what
it was developed for in fact: "real virtual servers".
Each prison has an ip number associated with it, which all IP
communications will be coerced to use and each prison has its own
hostname.
Needless to say, you need more RAM this way, but the advantage is
that each customer can run their own particular version of apache
and not stomp on the toes of their neighbors.
It generally does what one would expect, but setting up a jail
still takes a little knowledge.
A few notes:
I have no scripts for setting up a jail, don't ask me for them.
The IP number should be an alias on one of the interfaces.
mount a /proc in each jail, it will make ps more useable.
/proc/<pid>/status tells the hostname of the prison for
jailed processes.
Quotas are only sensible if you have a mountpoint per prison.
There are no privisions for stopping resource-hogging.
Some "#ifdef INET" and similar may be missing (send patches!)
If somebody wants to take it from here and develop it into
more of a "virtual machine" they should be most welcome!
Tools, comments, patches & documentation most welcome.
Have fun...
Sponsored by: http://www.rndassociates.com/
Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
|
|
|
#include <sys/proc.h>
|
2021-12-26 18:45:50 +00:00
|
|
|
#include <sys/epoch.h>
|
2004-01-23 20:44:26 +00:00
|
|
|
#include <sys/taskqueue.h>
|
2008-03-31 12:01:21 +00:00
|
|
|
#include <sys/fcntl.h>
|
This Implements the mumbled about "Jail" feature.
This is a seriously beefed up chroot kind of thing. The process
is jailed along the same lines as a chroot does it, but with
additional tough restrictions imposed on what the superuser can do.
For all I know, it is safe to hand over the root bit inside a
prison to the customer living in that prison, this is what
it was developed for in fact: "real virtual servers".
Each prison has an ip number associated with it, which all IP
communications will be coerced to use and each prison has its own
hostname.
Needless to say, you need more RAM this way, but the advantage is
that each customer can run their own particular version of apache
and not stomp on the toes of their neighbors.
It generally does what one would expect, but setting up a jail
still takes a little knowledge.
A few notes:
I have no scripts for setting up a jail, don't ask me for them.
The IP number should be an alias on one of the interfaces.
mount a /proc in each jail, it will make ps more useable.
/proc/<pid>/status tells the hostname of the prison for
jailed processes.
Quotas are only sensible if you have a mountpoint per prison.
There are no privisions for stopping resource-hogging.
Some "#ifdef INET" and similar may be missing (send patches!)
If somebody wants to take it from here and develop it into
more of a "virtual machine" they should be most welcome!
Tools, comments, patches & documentation most welcome.
Have fun...
Sponsored by: http://www.rndassociates.com/
Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
|
|
|
#include <sys/jail.h>
|
2020-04-16 00:54:06 +00:00
|
|
|
#include <sys/linker.h>
|
o Introduce pr_mtx into struct prison, providing protection for the
mutable contents of struct prison (hostname, securelevel, refcount,
pr_linux, ...)
o Generally introduce mtx_lock()/mtx_unlock() calls throughout kern/
so as to enforce these protections, in particular, in kern_mib.c
protection sysctl access to the hostname and securelevel, as well as
kern_prot.c access to the securelevel for access control purposes.
o Rewrite linux emulator abstractions for accessing per-jail linux
mib entries (osname, osrelease, osversion) so that they don't return
a pointer to the text in the struct linux_prison, rather, a copy
to an array passed into the calls. Likewise, update linprocfs to
use these primitives.
o Update in_pcb.c to always use prison_getip() rather than directly
accessing struct prison.
Reviewed by: jhb
2001-12-03 16:12:27 +00:00
|
|
|
#include <sys/lock.h>
|
2022-06-29 17:47:39 +00:00
|
|
|
#include <sys/mman.h>
|
o Introduce pr_mtx into struct prison, providing protection for the
mutable contents of struct prison (hostname, securelevel, refcount,
pr_linux, ...)
o Generally introduce mtx_lock()/mtx_unlock() calls throughout kern/
so as to enforce these protections, in particular, in kern_mib.c
protection sysctl access to the hostname and securelevel, as well as
kern_prot.c access to the securelevel for access control purposes.
o Rewrite linux emulator abstractions for accessing per-jail linux
mib entries (osname, osrelease, osversion) so that they don't return
a pointer to the text in the struct linux_prison, rather, a copy
to an array passed into the calls. Likewise, update linprocfs to
use these primitives.
o Update in_pcb.c to always use prison_getip() rather than directly
accessing struct prison.
Reviewed by: jhb
2001-12-03 16:12:27 +00:00
|
|
|
#include <sys/mutex.h>
|
2011-03-29 17:47:25 +00:00
|
|
|
#include <sys/racct.h>
|
2018-04-20 13:08:04 +00:00
|
|
|
#include <sys/rctl.h>
|
2011-05-03 07:32:58 +00:00
|
|
|
#include <sys/refcount.h>
|
2007-04-05 23:19:13 +00:00
|
|
|
#include <sys/sx.h>
|
2009-05-29 21:27:12 +00:00
|
|
|
#include <sys/sysent.h>
|
2003-04-09 02:55:18 +00:00
|
|
|
#include <sys/namei.h>
|
2005-06-09 18:49:19 +00:00
|
|
|
#include <sys/mount.h>
|
2003-04-09 02:55:18 +00:00
|
|
|
#include <sys/queue.h>
|
This Implements the mumbled about "Jail" feature.
This is a seriously beefed up chroot kind of thing. The process
is jailed along the same lines as a chroot does it, but with
additional tough restrictions imposed on what the superuser can do.
For all I know, it is safe to hand over the root bit inside a
prison to the customer living in that prison, this is what
it was developed for in fact: "real virtual servers".
Each prison has an ip number associated with it, which all IP
communications will be coerced to use and each prison has its own
hostname.
Needless to say, you need more RAM this way, but the advantage is
that each customer can run their own particular version of apache
and not stomp on the toes of their neighbors.
It generally does what one would expect, but setting up a jail
still takes a little knowledge.
A few notes:
I have no scripts for setting up a jail, don't ask me for them.
The IP number should be an alias on one of the interfaces.
mount a /proc in each jail, it will make ps more useable.
/proc/<pid>/status tells the hostname of the prison for
jailed processes.
Quotas are only sensible if you have a mountpoint per prison.
There are no privisions for stopping resource-hogging.
Some "#ifdef INET" and similar may be missing (send patches!)
If somebody wants to take it from here and develop it into
more of a "virtual machine" they should be most welcome!
Tools, comments, patches & documentation most welcome.
Have fun...
Sponsored by: http://www.rndassociates.com/
Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
|
|
|
#include <sys/socket.h>
|
2003-04-09 02:55:18 +00:00
|
|
|
#include <sys/syscallsubr.h>
|
2000-02-12 13:41:56 +00:00
|
|
|
#include <sys/sysctl.h>
|
2020-04-16 00:54:06 +00:00
|
|
|
#include <sys/uuid.h>
|
2003-04-09 02:55:18 +00:00
|
|
|
#include <sys/vnode.h>
|
2009-08-01 19:26:27 +00:00
|
|
|
|
This Implements the mumbled about "Jail" feature.
This is a seriously beefed up chroot kind of thing. The process
is jailed along the same lines as a chroot does it, but with
additional tough restrictions imposed on what the superuser can do.
For all I know, it is safe to hand over the root bit inside a
prison to the customer living in that prison, this is what
it was developed for in fact: "real virtual servers".
Each prison has an ip number associated with it, which all IP
communications will be coerced to use and each prison has its own
hostname.
Needless to say, you need more RAM this way, but the advantage is
that each customer can run their own particular version of apache
and not stomp on the toes of their neighbors.
It generally does what one would expect, but setting up a jail
still takes a little knowledge.
A few notes:
I have no scripts for setting up a jail, don't ask me for them.
The IP number should be an alias on one of the interfaces.
mount a /proc in each jail, it will make ps more useable.
/proc/<pid>/status tells the hostname of the prison for
jailed processes.
Quotas are only sensible if you have a mountpoint per prison.
There are no privisions for stopping resource-hogging.
Some "#ifdef INET" and similar may be missing (send patches!)
If somebody wants to take it from here and develop it into
more of a "virtual machine" they should be most welcome!
Tools, comments, patches & documentation most welcome.
Have fun...
Sponsored by: http://www.rndassociates.com/
Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
|
|
|
#include <net/if.h>
|
2009-08-01 19:26:27 +00:00
|
|
|
#include <net/vnet.h>
|
|
|
|
|
This Implements the mumbled about "Jail" feature.
This is a seriously beefed up chroot kind of thing. The process
is jailed along the same lines as a chroot does it, but with
additional tough restrictions imposed on what the superuser can do.
For all I know, it is safe to hand over the root bit inside a
prison to the customer living in that prison, this is what
it was developed for in fact: "real virtual servers".
Each prison has an ip number associated with it, which all IP
communications will be coerced to use and each prison has its own
hostname.
Needless to say, you need more RAM this way, but the advantage is
that each customer can run their own particular version of apache
and not stomp on the toes of their neighbors.
It generally does what one would expect, but setting up a jail
still takes a little knowledge.
A few notes:
I have no scripts for setting up a jail, don't ask me for them.
The IP number should be an alias on one of the interfaces.
mount a /proc in each jail, it will make ps more useable.
/proc/<pid>/status tells the hostname of the prison for
jailed processes.
Quotas are only sensible if you have a mountpoint per prison.
There are no privisions for stopping resource-hogging.
Some "#ifdef INET" and similar may be missing (send patches!)
If somebody wants to take it from here and develop it into
more of a "virtual machine" they should be most welcome!
Tools, comments, patches & documentation most welcome.
Have fun...
Sponsored by: http://www.rndassociates.com/
Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
|
|
|
#include <netinet/in.h>
|
2009-08-01 19:26:27 +00:00
|
|
|
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
#ifdef DDB
|
|
|
|
#include <ddb/ddb.h>
|
|
|
|
#endif /* DDB */
|
This Implements the mumbled about "Jail" feature.
This is a seriously beefed up chroot kind of thing. The process
is jailed along the same lines as a chroot does it, but with
additional tough restrictions imposed on what the superuser can do.
For all I know, it is safe to hand over the root bit inside a
prison to the customer living in that prison, this is what
it was developed for in fact: "real virtual servers".
Each prison has an ip number associated with it, which all IP
communications will be coerced to use and each prison has its own
hostname.
Needless to say, you need more RAM this way, but the advantage is
that each customer can run their own particular version of apache
and not stomp on the toes of their neighbors.
It generally does what one would expect, but setting up a jail
still takes a little knowledge.
A few notes:
I have no scripts for setting up a jail, don't ask me for them.
The IP number should be an alias on one of the interfaces.
mount a /proc in each jail, it will make ps more useable.
/proc/<pid>/status tells the hostname of the prison for
jailed processes.
Quotas are only sensible if you have a mountpoint per prison.
There are no privisions for stopping resource-hogging.
Some "#ifdef INET" and similar may be missing (send patches!)
If somebody wants to take it from here and develop it into
more of a "virtual machine" they should be most welcome!
Tools, comments, patches & documentation most welcome.
Have fun...
Sponsored by: http://www.rndassociates.com/
Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
|
|
|
|
2006-10-22 11:52:19 +00:00
|
|
|
#include <security/mac/mac_framework.h>
|
|
|
|
|
2020-04-16 00:54:06 +00:00
|
|
|
#define PRISON0_HOSTUUID_MODULE "hostuuid"
|
2009-07-29 16:41:02 +00:00
|
|
|
|
This Implements the mumbled about "Jail" feature.
This is a seriously beefed up chroot kind of thing. The process
is jailed along the same lines as a chroot does it, but with
additional tough restrictions imposed on what the superuser can do.
For all I know, it is safe to hand over the root bit inside a
prison to the customer living in that prison, this is what
it was developed for in fact: "real virtual servers".
Each prison has an ip number associated with it, which all IP
communications will be coerced to use and each prison has its own
hostname.
Needless to say, you need more RAM this way, but the advantage is
that each customer can run their own particular version of apache
and not stomp on the toes of their neighbors.
It generally does what one would expect, but setting up a jail
still takes a little knowledge.
A few notes:
I have no scripts for setting up a jail, don't ask me for them.
The IP number should be an alias on one of the interfaces.
mount a /proc in each jail, it will make ps more useable.
/proc/<pid>/status tells the hostname of the prison for
jailed processes.
Quotas are only sensible if you have a mountpoint per prison.
There are no privisions for stopping resource-hogging.
Some "#ifdef INET" and similar may be missing (send patches!)
If somebody wants to take it from here and develop it into
more of a "virtual machine" they should be most welcome!
Tools, comments, patches & documentation most welcome.
Have fun...
Sponsored by: http://www.rndassociates.com/
Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
|
|
|
MALLOC_DEFINE(M_PRISON, "prison", "Prison structures");
|
2011-11-07 06:44:47 +00:00
|
|
|
static MALLOC_DEFINE(M_PRISON_RACCT, "prison_racct", "Prison racct structures");
|
This Implements the mumbled about "Jail" feature.
This is a seriously beefed up chroot kind of thing. The process
is jailed along the same lines as a chroot does it, but with
additional tough restrictions imposed on what the superuser can do.
For all I know, it is safe to hand over the root bit inside a
prison to the customer living in that prison, this is what
it was developed for in fact: "real virtual servers".
Each prison has an ip number associated with it, which all IP
communications will be coerced to use and each prison has its own
hostname.
Needless to say, you need more RAM this way, but the advantage is
that each customer can run their own particular version of apache
and not stomp on the toes of their neighbors.
It generally does what one would expect, but setting up a jail
still takes a little knowledge.
A few notes:
I have no scripts for setting up a jail, don't ask me for them.
The IP number should be an alias on one of the interfaces.
mount a /proc in each jail, it will make ps more useable.
/proc/<pid>/status tells the hostname of the prison for
jailed processes.
Quotas are only sensible if you have a mountpoint per prison.
There are no privisions for stopping resource-hogging.
Some "#ifdef INET" and similar may be missing (send patches!)
If somebody wants to take it from here and develop it into
more of a "virtual machine" they should be most welcome!
Tools, comments, patches & documentation most welcome.
Have fun...
Sponsored by: http://www.rndassociates.com/
Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
|
|
|
|
2010-01-17 12:57:11 +00:00
|
|
|
/* Keep struct prison prison0 and some code in kern_jail_set() readable. */
|
|
|
|
#ifdef INET
|
|
|
|
#ifdef INET6
|
|
|
|
#define _PR_IP_SADDRSEL PR_IP4_SADDRSEL|PR_IP6_SADDRSEL
|
|
|
|
#else
|
|
|
|
#define _PR_IP_SADDRSEL PR_IP4_SADDRSEL
|
|
|
|
#endif
|
|
|
|
#else /* !INET */
|
|
|
|
#ifdef INET6
|
|
|
|
#define _PR_IP_SADDRSEL PR_IP6_SADDRSEL
|
|
|
|
#else
|
|
|
|
#define _PR_IP_SADDRSEL 0
|
|
|
|
#endif
|
|
|
|
#endif
|
|
|
|
|
2009-05-27 14:11:23 +00:00
|
|
|
/* prison0 describes what is "real" about the system. */
|
|
|
|
struct prison prison0 = {
|
|
|
|
.pr_id = 0,
|
|
|
|
.pr_name = "0",
|
|
|
|
.pr_ref = 1,
|
|
|
|
.pr_uref = 1,
|
|
|
|
.pr_path = "/",
|
|
|
|
.pr_securelevel = -1,
|
2012-02-09 10:22:08 +00:00
|
|
|
.pr_devfs_rsnum = 0,
|
2021-02-21 21:24:47 +00:00
|
|
|
.pr_state = PRISON_STATE_ALIVE,
|
2009-06-23 20:35:51 +00:00
|
|
|
.pr_childmax = JAIL_MAX,
|
2009-07-29 16:41:02 +00:00
|
|
|
.pr_hostuuid = DEFAULT_HOSTUUID,
|
2009-12-28 22:56:30 +00:00
|
|
|
.pr_children = LIST_HEAD_INITIALIZER(prison0.pr_children),
|
2009-08-13 10:26:34 +00:00
|
|
|
#ifdef VIMAGE
|
2010-01-17 12:57:11 +00:00
|
|
|
.pr_flags = PR_HOST|PR_VNET|_PR_IP_SADDRSEL,
|
2009-08-13 10:26:34 +00:00
|
|
|
#else
|
2010-01-17 12:57:11 +00:00
|
|
|
.pr_flags = PR_HOST|_PR_IP_SADDRSEL,
|
2009-08-13 10:26:34 +00:00
|
|
|
#endif
|
2018-05-04 20:54:27 +00:00
|
|
|
.pr_allow = PR_ALLOW_ALL_STATIC,
|
2009-05-27 14:11:23 +00:00
|
|
|
};
|
|
|
|
MTX_SYSINIT(prison0, &prison0.pr_mtx, "jail mutex", MTX_DEF);
|
|
|
|
|
2018-03-20 23:08:42 +00:00
|
|
|
struct bool_flags {
|
|
|
|
const char *name;
|
|
|
|
const char *noname;
|
2020-12-26 20:53:28 +00:00
|
|
|
volatile u_int flag;
|
2018-03-20 23:08:42 +00:00
|
|
|
};
|
|
|
|
struct jailsys_flags {
|
|
|
|
const char *name;
|
|
|
|
unsigned disable;
|
|
|
|
unsigned new;
|
|
|
|
};
|
|
|
|
|
2011-05-03 07:32:58 +00:00
|
|
|
/* allprison, allprison_racct and lastprid are protected by allprison_lock. */
|
2007-04-05 23:19:13 +00:00
|
|
|
struct sx allprison_lock;
|
2009-04-29 21:14:15 +00:00
|
|
|
SX_SYSINIT(allprison_lock, &allprison_lock, "allprison");
|
|
|
|
struct prisonlist allprison = TAILQ_HEAD_INITIALIZER(allprison);
|
2011-05-03 07:32:58 +00:00
|
|
|
LIST_HEAD(, prison_racct) allprison_racct;
|
2008-06-19 21:41:57 +00:00
|
|
|
int lastprid = 0;
|
2003-04-09 02:55:18 +00:00
|
|
|
|
2020-12-26 18:39:34 +00:00
|
|
|
static int get_next_prid(struct prison **insprp);
|
2021-02-21 18:55:44 +00:00
|
|
|
static int do_jail_attach(struct thread *td, struct prison *pr, int drflags);
|
2009-03-27 13:13:59 +00:00
|
|
|
static void prison_complete(void *context, int pending);
|
2009-04-29 21:14:15 +00:00
|
|
|
static void prison_deref(struct prison *pr, int flags);
|
2021-02-25 05:54:49 +00:00
|
|
|
static void prison_deref_kill(struct prison *pr, struct prisonlist *freeprison);
|
2021-02-21 18:55:44 +00:00
|
|
|
static int prison_lock_xlock(struct prison *pr, int flags);
|
2022-06-29 17:33:05 +00:00
|
|
|
static void prison_cleanup(struct prison *pr);
|
2021-02-21 18:55:44 +00:00
|
|
|
static void prison_free_not_last(struct prison *pr);
|
2021-02-25 05:54:49 +00:00
|
|
|
static void prison_proc_free_not_last(struct prison *pr);
|
2022-03-10 18:42:37 +00:00
|
|
|
static void prison_proc_relink(struct prison *opr, struct prison *npr,
|
|
|
|
struct proc *p);
|
2020-12-27 04:25:02 +00:00
|
|
|
static void prison_set_allow_locked(struct prison *pr, unsigned flag,
|
|
|
|
int enable);
|
2009-05-27 14:11:23 +00:00
|
|
|
static char *prison_path(struct prison *pr1, struct prison *pr2);
|
2011-05-03 07:32:58 +00:00
|
|
|
#ifdef RACCT
|
|
|
|
static void prison_racct_attach(struct prison *pr);
|
2012-03-06 11:05:50 +00:00
|
|
|
static void prison_racct_modify(struct prison *pr);
|
2011-05-03 07:32:58 +00:00
|
|
|
static void prison_racct_detach(struct prison *pr);
|
|
|
|
#endif
|
2003-04-09 02:55:18 +00:00
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
/* Flags for prison_deref */
|
2021-01-10 05:05:06 +00:00
|
|
|
#define PD_DEREF 0x01 /* Decrement pr_ref */
|
|
|
|
#define PD_DEUREF 0x02 /* Decrement pr_uref */
|
2021-02-25 05:54:49 +00:00
|
|
|
#define PD_KILL 0x04 /* Remove jail, kill processes, etc */
|
|
|
|
#define PD_LOCKED 0x10 /* pr_mtx is held */
|
|
|
|
#define PD_LIST_SLOCKED 0x20 /* allprison_lock is held shared */
|
|
|
|
#define PD_LIST_XLOCKED 0x40 /* allprison_lock is held exclusive */
|
2021-02-26 04:10:42 +00:00
|
|
|
#define PD_OP_FLAGS 0x07 /* Operation flags */
|
|
|
|
#define PD_LOCK_FLAGS 0x70 /* Lock status flags */
|
2003-04-09 02:55:18 +00:00
|
|
|
|
2009-05-27 14:11:23 +00:00
|
|
|
/*
|
2010-12-31 22:49:13 +00:00
|
|
|
* Parameter names corresponding to PR_* flag values. Size values are for kvm
|
|
|
|
* as we cannot figure out the size of a sparse array, or an array without a
|
|
|
|
* terminating entry.
|
2009-05-27 14:11:23 +00:00
|
|
|
*/
|
2018-03-20 23:08:42 +00:00
|
|
|
static struct bool_flags pr_flag_bool[] = {
|
|
|
|
{"persist", "nopersist", PR_PERSIST},
|
2010-01-17 12:57:11 +00:00
|
|
|
#ifdef INET
|
2018-03-20 23:08:42 +00:00
|
|
|
{"ip4.saddrsel", "ip4.nosaddrsel", PR_IP4_SADDRSEL},
|
2010-01-17 12:57:11 +00:00
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
2018-03-20 23:08:42 +00:00
|
|
|
{"ip6.saddrsel", "ip6.nosaddrsel", PR_IP6_SADDRSEL},
|
2010-01-17 12:57:11 +00:00
|
|
|
#endif
|
2009-07-25 14:48:57 +00:00
|
|
|
};
|
2018-03-20 23:08:42 +00:00
|
|
|
const size_t pr_flag_bool_size = sizeof(pr_flag_bool);
|
2009-07-25 14:48:57 +00:00
|
|
|
|
2018-03-20 23:08:42 +00:00
|
|
|
static struct jailsys_flags pr_flag_jailsys[] = {
|
|
|
|
{"host", 0, PR_HOST},
|
2009-07-25 14:48:57 +00:00
|
|
|
#ifdef VIMAGE
|
2018-03-20 23:08:42 +00:00
|
|
|
{"vnet", 0, PR_VNET},
|
2009-07-25 14:48:57 +00:00
|
|
|
#endif
|
2009-05-27 14:11:23 +00:00
|
|
|
#ifdef INET
|
2018-03-20 23:08:42 +00:00
|
|
|
{"ip4", PR_IP4_USER, PR_IP4_USER},
|
2009-05-27 14:11:23 +00:00
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
2018-03-20 23:08:42 +00:00
|
|
|
{"ip6", PR_IP6_USER, PR_IP6_USER},
|
2009-06-15 18:59:29 +00:00
|
|
|
#endif
|
2009-05-27 14:11:23 +00:00
|
|
|
};
|
2010-12-31 22:49:13 +00:00
|
|
|
const size_t pr_flag_jailsys_size = sizeof(pr_flag_jailsys);
|
2009-05-27 14:11:23 +00:00
|
|
|
|
2020-12-26 20:53:28 +00:00
|
|
|
/*
|
|
|
|
* Make this array full-size so dynamic parameters can be added.
|
|
|
|
* It is protected by prison0.mtx, but lockless reading is allowed
|
|
|
|
* with an atomic check of the flag values.
|
|
|
|
*/
|
2018-05-04 20:54:27 +00:00
|
|
|
static struct bool_flags pr_flag_allow[NBBY * NBPW] = {
|
2018-03-20 23:08:42 +00:00
|
|
|
{"allow.set_hostname", "allow.noset_hostname", PR_ALLOW_SET_HOSTNAME},
|
|
|
|
{"allow.sysvipc", "allow.nosysvipc", PR_ALLOW_SYSVIPC},
|
|
|
|
{"allow.raw_sockets", "allow.noraw_sockets", PR_ALLOW_RAW_SOCKETS},
|
|
|
|
{"allow.chflags", "allow.nochflags", PR_ALLOW_CHFLAGS},
|
|
|
|
{"allow.mount", "allow.nomount", PR_ALLOW_MOUNT},
|
|
|
|
{"allow.quotas", "allow.noquotas", PR_ALLOW_QUOTAS},
|
|
|
|
{"allow.socket_af", "allow.nosocket_af", PR_ALLOW_SOCKET_AF},
|
2018-07-29 12:41:56 +00:00
|
|
|
{"allow.mlock", "allow.nomlock", PR_ALLOW_MLOCK},
|
2018-03-20 23:08:42 +00:00
|
|
|
{"allow.reserved_ports", "allow.noreserved_ports",
|
|
|
|
PR_ALLOW_RESERVED_PORTS},
|
2018-10-17 16:11:43 +00:00
|
|
|
{"allow.read_msgbuf", "allow.noread_msgbuf", PR_ALLOW_READ_MSGBUF},
|
2018-11-27 17:51:50 +00:00
|
|
|
{"allow.unprivileged_proc_debug", "allow.nounprivileged_proc_debug",
|
|
|
|
PR_ALLOW_UNPRIV_DEBUG},
|
2020-11-18 21:07:08 +00:00
|
|
|
{"allow.suser", "allow.nosuser", PR_ALLOW_SUSER},
|
2023-03-02 21:13:24 +00:00
|
|
|
#ifdef VIMAGE
|
2022-12-17 21:43:49 +00:00
|
|
|
{"allow.nfsd", "allow.nonfsd", PR_ALLOW_NFSD},
|
|
|
|
#endif
|
2009-05-27 14:11:23 +00:00
|
|
|
};
|
2020-12-26 20:53:28 +00:00
|
|
|
static unsigned pr_allow_all = PR_ALLOW_ALL_STATIC;
|
2018-03-20 23:08:42 +00:00
|
|
|
const size_t pr_flag_allow_size = sizeof(pr_flag_allow);
|
2009-05-27 14:11:23 +00:00
|
|
|
|
2018-11-27 17:51:50 +00:00
|
|
|
#define JAIL_DEFAULT_ALLOW (PR_ALLOW_SET_HOSTNAME | \
|
|
|
|
PR_ALLOW_RESERVED_PORTS | \
|
2020-11-18 21:07:08 +00:00
|
|
|
PR_ALLOW_UNPRIV_DEBUG | \
|
|
|
|
PR_ALLOW_SUSER)
|
2009-07-31 16:00:41 +00:00
|
|
|
#define JAIL_DEFAULT_ENFORCE_STATFS 2
|
2012-02-23 18:51:24 +00:00
|
|
|
#define JAIL_DEFAULT_DEVFS_RSNUM 0
|
2009-05-27 14:11:23 +00:00
|
|
|
static unsigned jail_default_allow = JAIL_DEFAULT_ALLOW;
|
2009-07-31 16:00:41 +00:00
|
|
|
static int jail_default_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS;
|
2012-02-09 10:22:08 +00:00
|
|
|
static int jail_default_devfs_rsnum = JAIL_DEFAULT_DEVFS_RSNUM;
|
2009-05-27 14:11:23 +00:00
|
|
|
#if defined(INET) || defined(INET6)
|
2009-06-09 22:09:29 +00:00
|
|
|
static unsigned jail_max_af_ips = 255;
|
2009-05-27 14:11:23 +00:00
|
|
|
#endif
|
|
|
|
|
2015-02-27 16:28:55 +00:00
|
|
|
/*
|
|
|
|
* Initialize the parts of prison0 that can't be static-initialized with
|
|
|
|
* constants. This is called from proc0_init() after creating thread0 cpuset.
|
|
|
|
*/
|
|
|
|
void
|
|
|
|
prison0_init(void)
|
|
|
|
{
|
2020-04-16 00:54:06 +00:00
|
|
|
uint8_t *file, *data;
|
|
|
|
size_t size;
|
2021-12-22 16:47:23 +00:00
|
|
|
char buf[sizeof(prison0.pr_hostuuid)];
|
|
|
|
bool valid;
|
2015-02-27 16:28:55 +00:00
|
|
|
|
|
|
|
prison0.pr_cpuset = cpuset_ref(thread0.td_cpuset);
|
|
|
|
prison0.pr_osreldate = osreldate;
|
|
|
|
strlcpy(prison0.pr_osrelease, osrelease, sizeof(prison0.pr_osrelease));
|
2020-04-16 00:54:06 +00:00
|
|
|
|
|
|
|
/* If we have a preloaded hostuuid, use it. */
|
|
|
|
file = preload_search_by_type(PRISON0_HOSTUUID_MODULE);
|
|
|
|
if (file != NULL) {
|
|
|
|
data = preload_fetch_addr(file);
|
|
|
|
size = preload_fetch_size(file);
|
|
|
|
if (data != NULL) {
|
|
|
|
/*
|
|
|
|
* The preloaded data may include trailing whitespace, almost
|
|
|
|
* certainly a newline; skip over any whitespace or
|
|
|
|
* non-printable characters to be safe.
|
|
|
|
*/
|
|
|
|
while (size > 0 && data[size - 1] <= 0x20) {
|
2021-05-14 18:07:37 +00:00
|
|
|
size--;
|
2020-04-16 00:54:06 +00:00
|
|
|
}
|
2021-12-22 16:47:23 +00:00
|
|
|
|
|
|
|
valid = false;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Not NUL-terminated when passed from loader, but
|
|
|
|
* validate_uuid requires that due to using sscanf (as
|
|
|
|
* does the subsequent strlcpy, since it still reads
|
|
|
|
* past the given size to return the true length);
|
|
|
|
* bounce to a temporary buffer to fix.
|
|
|
|
*/
|
|
|
|
if (size >= sizeof(buf))
|
|
|
|
goto done;
|
|
|
|
|
|
|
|
memcpy(buf, data, size);
|
|
|
|
buf[size] = '\0';
|
|
|
|
|
|
|
|
if (validate_uuid(buf, size, NULL, 0) != 0)
|
|
|
|
goto done;
|
|
|
|
|
|
|
|
valid = true;
|
|
|
|
(void)strlcpy(prison0.pr_hostuuid, buf,
|
|
|
|
sizeof(prison0.pr_hostuuid));
|
|
|
|
|
|
|
|
done:
|
|
|
|
if (bootverbose && !valid) {
|
2021-05-15 05:57:38 +00:00
|
|
|
printf("hostuuid: preload data malformed: '%.*s'\n",
|
|
|
|
(int)size, data);
|
2020-04-16 00:54:06 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (bootverbose)
|
|
|
|
printf("hostuuid: using %s\n", prison0.pr_hostuuid);
|
2015-02-27 16:28:55 +00:00
|
|
|
}
|
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
/*
|
|
|
|
* struct jail_args {
|
|
|
|
* struct jail *jail;
|
|
|
|
* };
|
|
|
|
*/
|
|
|
|
int
|
2018-08-16 19:09:43 +00:00
|
|
|
sys_jail(struct thread *td, struct jail_args *uap)
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
{
|
2009-04-29 21:14:15 +00:00
|
|
|
uint32_t version;
|
|
|
|
int error;
|
2009-05-27 14:11:23 +00:00
|
|
|
struct jail j;
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
error = copyin(uap->jail, &version, sizeof(uint32_t));
|
|
|
|
if (error)
|
|
|
|
return (error);
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
switch (version) {
|
|
|
|
case 0:
|
|
|
|
{
|
|
|
|
struct jail_v0 j0;
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
|
2009-05-27 14:11:23 +00:00
|
|
|
/* FreeBSD single IPv4 jails. */
|
|
|
|
bzero(&j, sizeof(struct jail));
|
2009-04-29 21:14:15 +00:00
|
|
|
error = copyin(uap->jail, &j0, sizeof(struct jail_v0));
|
|
|
|
if (error)
|
|
|
|
return (error);
|
2009-05-27 14:11:23 +00:00
|
|
|
j.version = j0.version;
|
|
|
|
j.path = j0.path;
|
|
|
|
j.hostname = j0.hostname;
|
2013-11-28 19:40:33 +00:00
|
|
|
j.ip4s = htonl(j0.ip_number); /* jail_v0 is host order */
|
2009-04-29 21:14:15 +00:00
|
|
|
break;
|
|
|
|
}
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
case 1:
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
/*
|
2009-04-29 21:14:15 +00:00
|
|
|
* Version 1 was used by multi-IPv4 jail implementations
|
|
|
|
* that never made it into the official kernel.
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
*/
|
2009-04-29 21:14:15 +00:00
|
|
|
return (EINVAL);
|
|
|
|
|
|
|
|
case 2: /* JAIL_API_VERSION */
|
|
|
|
/* FreeBSD multi-IPv4/IPv6,noIP jails. */
|
|
|
|
error = copyin(uap->jail, &j, sizeof(struct jail));
|
|
|
|
if (error)
|
|
|
|
return (error);
|
2009-05-27 14:11:23 +00:00
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
/* Sci-Fi jails are not supported, sorry. */
|
|
|
|
return (EINVAL);
|
|
|
|
}
|
2018-08-16 19:09:43 +00:00
|
|
|
return (kern_jail(td, &j));
|
2009-05-27 14:11:23 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
int
|
2018-08-16 19:09:43 +00:00
|
|
|
kern_jail(struct thread *td, struct jail *j)
|
2009-05-27 14:11:23 +00:00
|
|
|
{
|
2018-08-16 19:09:43 +00:00
|
|
|
struct iovec optiov[2 * (4 + nitems(pr_flag_allow)
|
2009-06-09 22:09:29 +00:00
|
|
|
#ifdef INET
|
|
|
|
+ 1
|
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
|
|
|
+ 1
|
|
|
|
#endif
|
|
|
|
)];
|
2009-05-27 14:11:23 +00:00
|
|
|
struct uio opt;
|
|
|
|
char *u_path, *u_hostname, *u_name;
|
2018-03-20 23:08:42 +00:00
|
|
|
struct bool_flags *bf;
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
#ifdef INET
|
2009-06-09 22:09:29 +00:00
|
|
|
uint32_t ip4s;
|
2009-05-27 14:11:23 +00:00
|
|
|
struct in_addr *u_ip4;
|
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
|
|
|
struct in6_addr *u_ip6;
|
|
|
|
#endif
|
|
|
|
size_t tmplen;
|
2018-08-16 19:09:43 +00:00
|
|
|
int error, enforce_statfs;
|
2009-05-27 14:11:23 +00:00
|
|
|
|
|
|
|
bzero(&optiov, sizeof(optiov));
|
|
|
|
opt.uio_iov = optiov;
|
|
|
|
opt.uio_iovcnt = 0;
|
|
|
|
opt.uio_offset = -1;
|
|
|
|
opt.uio_resid = -1;
|
|
|
|
opt.uio_segflg = UIO_SYSSPACE;
|
|
|
|
opt.uio_rw = UIO_READ;
|
|
|
|
opt.uio_td = td;
|
|
|
|
|
|
|
|
/* Set permissions for top-level jails from sysctls. */
|
|
|
|
if (!jailed(td->td_ucred)) {
|
2018-03-20 23:08:42 +00:00
|
|
|
for (bf = pr_flag_allow;
|
2018-05-04 20:54:27 +00:00
|
|
|
bf < pr_flag_allow + nitems(pr_flag_allow) &&
|
2020-12-26 20:53:28 +00:00
|
|
|
atomic_load_int(&bf->flag) != 0;
|
2018-03-20 23:08:42 +00:00
|
|
|
bf++) {
|
|
|
|
optiov[opt.uio_iovcnt].iov_base = __DECONST(char *,
|
|
|
|
(jail_default_allow & bf->flag)
|
|
|
|
? bf->name : bf->noname);
|
2009-05-27 14:11:23 +00:00
|
|
|
optiov[opt.uio_iovcnt].iov_len =
|
|
|
|
strlen(optiov[opt.uio_iovcnt].iov_base) + 1;
|
|
|
|
opt.uio_iovcnt += 2;
|
|
|
|
}
|
|
|
|
optiov[opt.uio_iovcnt].iov_base = "enforce_statfs";
|
|
|
|
optiov[opt.uio_iovcnt].iov_len = sizeof("enforce_statfs");
|
|
|
|
opt.uio_iovcnt++;
|
|
|
|
enforce_statfs = jail_default_enforce_statfs;
|
|
|
|
optiov[opt.uio_iovcnt].iov_base = &enforce_statfs;
|
|
|
|
optiov[opt.uio_iovcnt].iov_len = sizeof(enforce_statfs);
|
|
|
|
opt.uio_iovcnt++;
|
|
|
|
}
|
|
|
|
|
|
|
|
tmplen = MAXPATHLEN + MAXHOSTNAMELEN + MAXHOSTNAMELEN;
|
|
|
|
#ifdef INET
|
|
|
|
ip4s = (j->version == 0) ? 1 : j->ip4s;
|
|
|
|
if (ip4s > jail_max_af_ips)
|
|
|
|
return (EINVAL);
|
|
|
|
tmplen += ip4s * sizeof(struct in_addr);
|
2009-04-29 21:14:15 +00:00
|
|
|
#else
|
2009-05-27 14:11:23 +00:00
|
|
|
if (j->ip4s > 0)
|
|
|
|
return (EINVAL);
|
2009-04-29 21:14:15 +00:00
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
2009-05-27 14:11:23 +00:00
|
|
|
if (j->ip6s > jail_max_af_ips)
|
|
|
|
return (EINVAL);
|
|
|
|
tmplen += j->ip6s * sizeof(struct in6_addr);
|
2009-04-29 21:14:15 +00:00
|
|
|
#else
|
2009-05-27 14:11:23 +00:00
|
|
|
if (j->ip6s > 0)
|
|
|
|
return (EINVAL);
|
2009-04-29 21:14:15 +00:00
|
|
|
#endif
|
2009-05-27 14:11:23 +00:00
|
|
|
u_path = malloc(tmplen, M_TEMP, M_WAITOK);
|
|
|
|
u_hostname = u_path + MAXPATHLEN;
|
|
|
|
u_name = u_hostname + MAXHOSTNAMELEN;
|
2009-04-29 21:14:15 +00:00
|
|
|
#ifdef INET
|
2009-05-27 14:11:23 +00:00
|
|
|
u_ip4 = (struct in_addr *)(u_name + MAXHOSTNAMELEN);
|
2009-04-29 21:14:15 +00:00
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
|
|
|
#ifdef INET
|
2009-05-27 14:11:23 +00:00
|
|
|
u_ip6 = (struct in6_addr *)(u_ip4 + ip4s);
|
2009-04-29 21:14:15 +00:00
|
|
|
#else
|
2009-05-27 14:11:23 +00:00
|
|
|
u_ip6 = (struct in6_addr *)(u_name + MAXHOSTNAMELEN);
|
|
|
|
#endif
|
|
|
|
#endif
|
|
|
|
optiov[opt.uio_iovcnt].iov_base = "path";
|
|
|
|
optiov[opt.uio_iovcnt].iov_len = sizeof("path");
|
|
|
|
opt.uio_iovcnt++;
|
|
|
|
optiov[opt.uio_iovcnt].iov_base = u_path;
|
|
|
|
error = copyinstr(j->path, u_path, MAXPATHLEN,
|
|
|
|
&optiov[opt.uio_iovcnt].iov_len);
|
|
|
|
if (error) {
|
|
|
|
free(u_path, M_TEMP);
|
|
|
|
return (error);
|
|
|
|
}
|
|
|
|
opt.uio_iovcnt++;
|
|
|
|
optiov[opt.uio_iovcnt].iov_base = "host.hostname";
|
|
|
|
optiov[opt.uio_iovcnt].iov_len = sizeof("host.hostname");
|
|
|
|
opt.uio_iovcnt++;
|
|
|
|
optiov[opt.uio_iovcnt].iov_base = u_hostname;
|
|
|
|
error = copyinstr(j->hostname, u_hostname, MAXHOSTNAMELEN,
|
|
|
|
&optiov[opt.uio_iovcnt].iov_len);
|
|
|
|
if (error) {
|
|
|
|
free(u_path, M_TEMP);
|
|
|
|
return (error);
|
|
|
|
}
|
|
|
|
opt.uio_iovcnt++;
|
|
|
|
if (j->jailname != NULL) {
|
|
|
|
optiov[opt.uio_iovcnt].iov_base = "name";
|
|
|
|
optiov[opt.uio_iovcnt].iov_len = sizeof("name");
|
2009-04-29 21:14:15 +00:00
|
|
|
opt.uio_iovcnt++;
|
2009-05-27 14:11:23 +00:00
|
|
|
optiov[opt.uio_iovcnt].iov_base = u_name;
|
|
|
|
error = copyinstr(j->jailname, u_name, MAXHOSTNAMELEN,
|
|
|
|
&optiov[opt.uio_iovcnt].iov_len);
|
2009-04-29 21:14:15 +00:00
|
|
|
if (error) {
|
|
|
|
free(u_path, M_TEMP);
|
|
|
|
return (error);
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
}
|
2009-04-29 21:14:15 +00:00
|
|
|
opt.uio_iovcnt++;
|
2009-05-27 14:11:23 +00:00
|
|
|
}
|
|
|
|
#ifdef INET
|
|
|
|
optiov[opt.uio_iovcnt].iov_base = "ip4.addr";
|
|
|
|
optiov[opt.uio_iovcnt].iov_len = sizeof("ip4.addr");
|
|
|
|
opt.uio_iovcnt++;
|
|
|
|
optiov[opt.uio_iovcnt].iov_base = u_ip4;
|
|
|
|
optiov[opt.uio_iovcnt].iov_len = ip4s * sizeof(struct in_addr);
|
|
|
|
if (j->version == 0)
|
|
|
|
u_ip4->s_addr = j->ip4s;
|
|
|
|
else {
|
|
|
|
error = copyin(j->ip4, u_ip4, optiov[opt.uio_iovcnt].iov_len);
|
2009-04-29 21:14:15 +00:00
|
|
|
if (error) {
|
|
|
|
free(u_path, M_TEMP);
|
|
|
|
return (error);
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
}
|
|
|
|
}
|
2009-05-27 14:11:23 +00:00
|
|
|
opt.uio_iovcnt++;
|
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
|
|
|
optiov[opt.uio_iovcnt].iov_base = "ip6.addr";
|
|
|
|
optiov[opt.uio_iovcnt].iov_len = sizeof("ip6.addr");
|
|
|
|
opt.uio_iovcnt++;
|
|
|
|
optiov[opt.uio_iovcnt].iov_base = u_ip6;
|
|
|
|
optiov[opt.uio_iovcnt].iov_len = j->ip6s * sizeof(struct in6_addr);
|
|
|
|
error = copyin(j->ip6, u_ip6, optiov[opt.uio_iovcnt].iov_len);
|
|
|
|
if (error) {
|
|
|
|
free(u_path, M_TEMP);
|
|
|
|
return (error);
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
2009-05-27 14:11:23 +00:00
|
|
|
opt.uio_iovcnt++;
|
|
|
|
#endif
|
2016-04-19 23:48:27 +00:00
|
|
|
KASSERT(opt.uio_iovcnt <= nitems(optiov),
|
|
|
|
("kern_jail: too many iovecs (%d)", opt.uio_iovcnt));
|
2009-04-29 21:14:15 +00:00
|
|
|
error = kern_jail_set(td, &opt, JAIL_CREATE | JAIL_ATTACH);
|
|
|
|
free(u_path, M_TEMP);
|
|
|
|
return (error);
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
}
|
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
/*
|
|
|
|
* struct jail_set_args {
|
|
|
|
* struct iovec *iovp;
|
|
|
|
* unsigned int iovcnt;
|
|
|
|
* int flags;
|
|
|
|
* };
|
|
|
|
*/
|
|
|
|
int
|
2011-09-16 13:58:51 +00:00
|
|
|
sys_jail_set(struct thread *td, struct jail_set_args *uap)
|
2009-04-29 21:14:15 +00:00
|
|
|
{
|
|
|
|
struct uio *auio;
|
|
|
|
int error;
|
|
|
|
|
|
|
|
/* Check that we have an even number of iovecs. */
|
|
|
|
if (uap->iovcnt & 1)
|
|
|
|
return (EINVAL);
|
|
|
|
|
|
|
|
error = copyinuio(uap->iovp, uap->iovcnt, &auio);
|
|
|
|
if (error)
|
|
|
|
return (error);
|
|
|
|
error = kern_jail_set(td, auio, uap->flags);
|
|
|
|
free(auio, M_IOV);
|
|
|
|
return (error);
|
|
|
|
}
|
|
|
|
|
2021-12-26 18:45:50 +00:00
|
|
|
#if defined(INET) || defined(INET6)
|
|
|
|
typedef int prison_addr_cmp_t(const void *, const void *);
|
|
|
|
typedef bool prison_addr_valid_t(const void *);
|
|
|
|
static const struct pr_family {
|
|
|
|
size_t size;
|
|
|
|
prison_addr_cmp_t *cmp;
|
|
|
|
prison_addr_valid_t *valid;
|
|
|
|
int ip_flag;
|
|
|
|
} pr_families[PR_FAMILY_MAX] = {
|
|
|
|
#ifdef INET
|
|
|
|
[PR_INET] = {
|
|
|
|
.size = sizeof(struct in_addr),
|
|
|
|
.cmp = prison_qcmp_v4,
|
|
|
|
.valid = prison_valid_v4,
|
|
|
|
.ip_flag = PR_IP4_USER,
|
|
|
|
},
|
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
|
|
|
[PR_INET6] = {
|
|
|
|
.size = sizeof(struct in6_addr),
|
|
|
|
.cmp = prison_qcmp_v6,
|
|
|
|
.valid = prison_valid_v6,
|
|
|
|
.ip_flag = PR_IP6_USER,
|
|
|
|
},
|
|
|
|
#endif
|
|
|
|
};
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Network address lists (pr_addrs) allocation for jails. The addresses
|
|
|
|
* are accessed locklessly by the network stack, thus need to be protected by
|
|
|
|
* the network epoch.
|
|
|
|
*/
|
|
|
|
struct prison_ip {
|
|
|
|
struct epoch_context ctx;
|
|
|
|
uint32_t ips;
|
|
|
|
#ifdef FUTURE_C
|
2023-02-28 10:01:33 +00:00
|
|
|
/*
|
|
|
|
* XXX Variable-length automatic arrays in union may be
|
|
|
|
* supported in future C.
|
|
|
|
*/
|
2021-12-26 18:45:50 +00:00
|
|
|
union {
|
2023-02-28 10:01:33 +00:00
|
|
|
char pr_ip[];
|
2021-12-26 18:45:50 +00:00
|
|
|
struct in_addr pr_ip4[];
|
|
|
|
struct in6_addr pr_ip6[];
|
|
|
|
};
|
|
|
|
#else /* No future C :( */
|
2023-02-28 10:01:33 +00:00
|
|
|
char pr_ip[];
|
2021-12-26 18:45:50 +00:00
|
|
|
#endif
|
|
|
|
};
|
|
|
|
|
2023-02-28 10:01:33 +00:00
|
|
|
static char *
|
|
|
|
PR_IP(struct prison_ip *pip, const pr_family_t af, int idx)
|
|
|
|
{
|
|
|
|
MPASS(pip);
|
|
|
|
MPASS(af < PR_FAMILY_MAX);
|
|
|
|
MPASS(idx >= 0 && idx < pip->ips);
|
|
|
|
|
|
|
|
return (pip->pr_ip + pr_families[af].size * idx);
|
|
|
|
}
|
|
|
|
|
2021-12-26 18:45:50 +00:00
|
|
|
static struct prison_ip *
|
|
|
|
prison_ip_alloc(const pr_family_t af, uint32_t cnt, int flags)
|
|
|
|
{
|
|
|
|
struct prison_ip *pip;
|
|
|
|
|
|
|
|
pip = malloc(sizeof(struct prison_ip) + cnt * pr_families[af].size,
|
|
|
|
M_PRISON, flags);
|
|
|
|
if (pip != NULL)
|
|
|
|
pip->ips = cnt;
|
|
|
|
return (pip);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Allocate and copyin user supplied address list, sorting and validating.
|
|
|
|
* kern_jail_set() helper.
|
|
|
|
*/
|
|
|
|
static struct prison_ip *
|
|
|
|
prison_ip_copyin(const pr_family_t af, void *op, uint32_t cnt)
|
|
|
|
{
|
|
|
|
prison_addr_cmp_t *const cmp = pr_families[af].cmp;
|
|
|
|
const size_t size = pr_families[af].size;
|
|
|
|
struct prison_ip *pip;
|
|
|
|
|
|
|
|
pip = prison_ip_alloc(af, cnt, M_WAITOK);
|
2023-02-28 10:01:33 +00:00
|
|
|
bcopy(op, pip->pr_ip, cnt * size);
|
2021-12-26 18:45:50 +00:00
|
|
|
/*
|
|
|
|
* IP addresses are all sorted but ip[0] to preserve
|
|
|
|
* the primary IP address as given from userland.
|
|
|
|
* This special IP is used for unbound outgoing
|
|
|
|
* connections as well for "loopback" traffic in case
|
|
|
|
* source address selection cannot find any more fitting
|
|
|
|
* address to connect from.
|
|
|
|
*/
|
|
|
|
if (cnt > 1)
|
2023-02-28 10:14:07 +00:00
|
|
|
qsort(PR_IP(pip, af, 1), cnt - 1, size, cmp);
|
2021-12-26 18:45:50 +00:00
|
|
|
/*
|
|
|
|
* Check for duplicate addresses and do some simple
|
|
|
|
* zero and broadcast checks. If users give other bogus
|
|
|
|
* addresses it is their problem.
|
|
|
|
*/
|
|
|
|
for (int i = 0; i < cnt; i++) {
|
2023-02-28 10:01:33 +00:00
|
|
|
if (!pr_families[af].valid(PR_IP(pip, af, i))) {
|
2021-12-26 18:45:50 +00:00
|
|
|
free(pip, M_PRISON);
|
|
|
|
return (NULL);
|
|
|
|
}
|
|
|
|
if (i + 1 < cnt &&
|
2023-02-28 10:01:33 +00:00
|
|
|
(cmp(PR_IP(pip, af, 0), PR_IP(pip, af, i + 1)) == 0 ||
|
|
|
|
cmp(PR_IP(pip, af, i), PR_IP(pip, af, i + 1)) == 0)) {
|
2021-12-26 18:45:50 +00:00
|
|
|
free(pip, M_PRISON);
|
|
|
|
return (NULL);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return (pip);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Allocate and dup parent prison address list.
|
|
|
|
* kern_jail_set() helper.
|
|
|
|
*/
|
|
|
|
static void
|
|
|
|
prison_ip_dup(struct prison *ppr, struct prison *pr, const pr_family_t af)
|
|
|
|
{
|
2023-02-28 10:14:07 +00:00
|
|
|
const struct prison_ip *ppip = ppr->pr_addrs[af];
|
|
|
|
struct prison_ip *pip;
|
2021-12-26 18:45:50 +00:00
|
|
|
|
2023-02-28 10:14:07 +00:00
|
|
|
if (ppip != NULL) {
|
|
|
|
pip = prison_ip_alloc(af, ppip->ips, M_WAITOK);
|
|
|
|
bcopy(ppip->pr_ip, pip->pr_ip, pip->ips * pr_families[af].size);
|
|
|
|
pr->pr_addrs[af] = pip;
|
2021-12-26 18:45:50 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Make sure the new set of IP addresses is a subset of the parent's list.
|
|
|
|
* Don't worry about the parent being unlocked, as any setting is done with
|
|
|
|
* allprison_lock held.
|
|
|
|
* kern_jail_set() helper.
|
|
|
|
*/
|
|
|
|
static bool
|
2023-02-28 10:01:33 +00:00
|
|
|
prison_ip_parent_match(struct prison_ip *ppip, struct prison_ip *pip,
|
|
|
|
const pr_family_t af)
|
2021-12-26 18:45:50 +00:00
|
|
|
{
|
|
|
|
prison_addr_cmp_t *const cmp = pr_families[af].cmp;
|
|
|
|
int i, j;
|
|
|
|
|
|
|
|
if (ppip == NULL)
|
|
|
|
return (false);
|
|
|
|
|
|
|
|
for (i = 0; i < ppip->ips; i++)
|
2023-02-28 10:01:33 +00:00
|
|
|
if (cmp(PR_IP(pip, af, 0), PR_IP(ppip, af, i)) == 0)
|
2021-12-26 18:45:50 +00:00
|
|
|
break;
|
|
|
|
|
|
|
|
if (i == ppip->ips)
|
|
|
|
/* Main address not present in parent. */
|
|
|
|
return (false);
|
|
|
|
|
|
|
|
if (pip->ips > 1) {
|
|
|
|
for (i = j = 1; i < pip->ips; i++) {
|
2023-02-28 10:01:33 +00:00
|
|
|
if (cmp(PR_IP(pip, af, i), PR_IP(ppip, af, 0)) == 0)
|
2021-12-26 18:45:50 +00:00
|
|
|
/* Equals to parent primary address. */
|
|
|
|
continue;
|
|
|
|
for (; j < ppip->ips; j++)
|
2023-02-28 10:01:33 +00:00
|
|
|
if (cmp(PR_IP(pip, af, i),
|
|
|
|
PR_IP(ppip, af, j)) == 0)
|
2021-12-26 18:45:50 +00:00
|
|
|
break;
|
|
|
|
if (j == ppip->ips)
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
if (j == ppip->ips)
|
|
|
|
/* Address not present in parent. */
|
|
|
|
return (false);
|
|
|
|
}
|
|
|
|
return (true);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Check for conflicting IP addresses. We permit them if there is no more
|
|
|
|
* than one IP on each jail. If there is a duplicate on a jail with more
|
|
|
|
* than one IP stop checking and return error.
|
|
|
|
* kern_jail_set() helper.
|
|
|
|
*/
|
|
|
|
static bool
|
|
|
|
prison_ip_conflict_check(const struct prison *ppr, const struct prison *pr,
|
2023-02-28 10:01:33 +00:00
|
|
|
struct prison_ip *pip, pr_family_t af)
|
2021-12-26 18:45:50 +00:00
|
|
|
{
|
|
|
|
const struct prison *tppr, *tpr;
|
|
|
|
int descend;
|
|
|
|
|
|
|
|
#ifdef VIMAGE
|
|
|
|
for (tppr = ppr; tppr != &prison0; tppr = tppr->pr_parent)
|
|
|
|
if (tppr->pr_flags & PR_VNET)
|
|
|
|
break;
|
|
|
|
#else
|
|
|
|
tppr = &prison0;
|
|
|
|
#endif
|
|
|
|
FOREACH_PRISON_DESCENDANT(tppr, tpr, descend) {
|
|
|
|
if (tpr == pr ||
|
|
|
|
#ifdef VIMAGE
|
|
|
|
(tpr != tppr && (tpr->pr_flags & PR_VNET)) ||
|
|
|
|
#endif
|
|
|
|
!prison_isalive(tpr)) {
|
|
|
|
descend = 0;
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
if (!(tpr->pr_flags & pr_families[af].ip_flag))
|
|
|
|
continue;
|
|
|
|
descend = 0;
|
|
|
|
if (tpr->pr_addrs[af] == NULL ||
|
|
|
|
(pip->ips == 1 && tpr->pr_addrs[af]->ips == 1))
|
|
|
|
continue;
|
|
|
|
for (int i = 0; i < pip->ips; i++)
|
2023-02-28 10:01:33 +00:00
|
|
|
if (prison_ip_check(tpr, af, PR_IP(pip, af, i)) == 0)
|
2021-12-26 18:45:50 +00:00
|
|
|
return (false);
|
|
|
|
}
|
|
|
|
|
|
|
|
return (true);
|
|
|
|
}
|
|
|
|
|
|
|
|
_Static_assert(offsetof(struct prison_ip, ctx) == 0,
|
|
|
|
"prison must start with epoch context");
|
|
|
|
static void
|
|
|
|
prison_ip_free_deferred(epoch_context_t ctx)
|
|
|
|
{
|
|
|
|
|
|
|
|
free(ctx, M_PRISON);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
prison_ip_free(struct prison_ip *pip)
|
|
|
|
{
|
|
|
|
|
|
|
|
if (pip != NULL)
|
|
|
|
NET_EPOCH_CALL(prison_ip_free_deferred, &pip->ctx);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
prison_ip_set(struct prison *pr, const pr_family_t af, struct prison_ip *new)
|
|
|
|
{
|
|
|
|
struct prison_ip **mem, *old;
|
|
|
|
|
|
|
|
mtx_assert(&pr->pr_mtx, MA_OWNED);
|
|
|
|
|
|
|
|
mem = &pr->pr_addrs[af];
|
|
|
|
|
|
|
|
old = *mem;
|
2023-02-07 19:35:44 +00:00
|
|
|
atomic_store_ptr(mem, new);
|
2021-12-26 18:45:50 +00:00
|
|
|
prison_ip_free(old);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Restrict a prison's IP address list with its parent's, possibly replacing
|
2022-12-31 02:56:58 +00:00
|
|
|
* it. Return true if succeed, otherwise should redo.
|
2021-12-26 18:45:50 +00:00
|
|
|
* kern_jail_set() helper.
|
|
|
|
*/
|
|
|
|
static bool
|
|
|
|
prison_ip_restrict(struct prison *pr, const pr_family_t af,
|
2022-12-31 02:56:58 +00:00
|
|
|
struct prison_ip **newp)
|
2021-12-26 18:45:50 +00:00
|
|
|
{
|
2023-02-28 10:01:33 +00:00
|
|
|
struct prison_ip *ppip = pr->pr_parent->pr_addrs[af];
|
|
|
|
struct prison_ip *pip = pr->pr_addrs[af];
|
2021-12-26 18:45:50 +00:00
|
|
|
int (*const cmp)(const void *, const void *) = pr_families[af].cmp;
|
|
|
|
const size_t size = pr_families[af].size;
|
2022-12-31 02:56:58 +00:00
|
|
|
struct prison_ip *new = newp != NULL ? *newp : NULL;
|
2021-12-26 18:45:50 +00:00
|
|
|
uint32_t ips;
|
|
|
|
|
|
|
|
mtx_assert(&pr->pr_mtx, MA_OWNED);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Due to epoch-synchronized access to the IP address lists we always
|
|
|
|
* allocate a new list even if the old one has enough space. We could
|
|
|
|
* atomically update an IPv4 address inside a list, but that would
|
|
|
|
* screw up sorting, and in case of IPv6 we can't even atomically write
|
|
|
|
* one.
|
|
|
|
*/
|
2023-01-13 10:15:06 +00:00
|
|
|
if (ppip == NULL) {
|
|
|
|
if (pip != NULL)
|
|
|
|
prison_ip_set(pr, af, NULL);
|
2022-12-31 02:56:58 +00:00
|
|
|
return (true);
|
2021-12-26 18:45:50 +00:00
|
|
|
}
|
2023-01-13 10:15:06 +00:00
|
|
|
|
2021-12-26 18:45:50 +00:00
|
|
|
if (!(pr->pr_flags & pr_families[af].ip_flag)) {
|
2023-01-13 10:15:06 +00:00
|
|
|
if (new == NULL) {
|
|
|
|
new = prison_ip_alloc(af, ppip->ips, M_NOWAIT);
|
|
|
|
if (new == NULL)
|
2022-12-31 02:56:58 +00:00
|
|
|
return (false); /* Redo */
|
|
|
|
}
|
2021-12-26 18:45:50 +00:00
|
|
|
/* This has no user settings, so just copy the parent's list. */
|
2023-01-13 10:15:06 +00:00
|
|
|
MPASS(new->ips == ppip->ips);
|
2023-02-28 10:01:33 +00:00
|
|
|
bcopy(ppip->pr_ip, new->pr_ip, ppip->ips * size);
|
2023-01-13 10:15:06 +00:00
|
|
|
prison_ip_set(pr, af, new);
|
2022-12-31 02:56:58 +00:00
|
|
|
if (newp != NULL)
|
|
|
|
*newp = NULL; /* Used */
|
2023-01-13 10:15:06 +00:00
|
|
|
} else if (pip != NULL) {
|
2021-12-26 18:45:50 +00:00
|
|
|
/* Remove addresses that aren't in the parent. */
|
|
|
|
int i;
|
|
|
|
|
|
|
|
i = 0; /* index in pip */
|
|
|
|
ips = 0; /* index in new */
|
|
|
|
|
2023-01-13 10:15:06 +00:00
|
|
|
if (new == NULL) {
|
|
|
|
new = prison_ip_alloc(af, pip->ips, M_NOWAIT);
|
|
|
|
if (new == NULL)
|
2022-12-31 02:56:58 +00:00
|
|
|
return (false); /* Redo */
|
2023-01-13 10:15:06 +00:00
|
|
|
}
|
|
|
|
|
2021-12-26 18:45:50 +00:00
|
|
|
for (int pi = 0; pi < ppip->ips; pi++)
|
2023-02-28 10:01:33 +00:00
|
|
|
if (cmp(PR_IP(pip, af, 0), PR_IP(ppip, af, pi)) == 0) {
|
2021-12-26 18:45:50 +00:00
|
|
|
/* Found our primary address in parent. */
|
2023-02-28 10:01:33 +00:00
|
|
|
bcopy(PR_IP(pip, af, i), PR_IP(new, af, ips),
|
|
|
|
size);
|
2021-12-26 18:45:50 +00:00
|
|
|
i++;
|
|
|
|
ips++;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
for (int pi = 1; i < pip->ips; ) {
|
|
|
|
/* Check against primary, which is unsorted. */
|
2023-02-28 10:01:33 +00:00
|
|
|
if (cmp(PR_IP(pip, af, i), PR_IP(ppip, af, 0)) == 0) {
|
2021-12-26 18:45:50 +00:00
|
|
|
/* Matches parent's primary address. */
|
2023-02-28 10:01:33 +00:00
|
|
|
bcopy(PR_IP(pip, af, i), PR_IP(new, af, ips),
|
|
|
|
size);
|
2021-12-26 18:45:50 +00:00
|
|
|
i++;
|
|
|
|
ips++;
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
/* The rest are sorted. */
|
|
|
|
switch (pi >= ppip->ips ? -1 :
|
2023-02-28 10:01:33 +00:00
|
|
|
cmp(PR_IP(pip, af, i), PR_IP(ppip, af, pi))) {
|
2021-12-26 18:45:50 +00:00
|
|
|
case -1:
|
|
|
|
i++;
|
|
|
|
break;
|
|
|
|
case 0:
|
2023-02-28 10:01:33 +00:00
|
|
|
bcopy(PR_IP(pip, af, i), PR_IP(new, af, ips),
|
|
|
|
size);
|
2021-12-26 18:45:50 +00:00
|
|
|
i++;
|
|
|
|
pi++;
|
|
|
|
ips++;
|
|
|
|
break;
|
|
|
|
case 1:
|
|
|
|
pi++;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (ips == 0) {
|
2022-12-31 02:56:58 +00:00
|
|
|
if (newp == NULL || *newp == NULL)
|
2021-12-26 18:45:50 +00:00
|
|
|
prison_ip_free(new);
|
|
|
|
new = NULL;
|
2023-01-13 10:15:06 +00:00
|
|
|
} else {
|
|
|
|
/* Shrink to real size */
|
|
|
|
KASSERT((new->ips >= ips),
|
|
|
|
("Out-of-bounds write to prison_ip %p", new));
|
|
|
|
new->ips = ips;
|
2021-12-26 18:45:50 +00:00
|
|
|
}
|
2023-01-13 10:15:06 +00:00
|
|
|
prison_ip_set(pr, af, new);
|
2022-12-31 02:56:58 +00:00
|
|
|
if (newp != NULL)
|
|
|
|
*newp = NULL; /* Used */
|
2021-12-26 18:45:50 +00:00
|
|
|
}
|
2022-12-31 02:56:58 +00:00
|
|
|
return (true);
|
2021-12-26 18:45:50 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Fast-path check if an address belongs to a prison.
|
|
|
|
*/
|
|
|
|
int
|
|
|
|
prison_ip_check(const struct prison *pr, const pr_family_t af,
|
|
|
|
const void *addr)
|
|
|
|
{
|
|
|
|
int (*const cmp)(const void *, const void *) = pr_families[af].cmp;
|
2023-02-28 10:01:33 +00:00
|
|
|
struct prison_ip *pip;
|
2021-12-26 18:45:50 +00:00
|
|
|
int i, a, z, d;
|
|
|
|
|
|
|
|
MPASS(mtx_owned(&pr->pr_mtx) ||
|
|
|
|
in_epoch(net_epoch_preempt) ||
|
|
|
|
sx_xlocked(&allprison_lock));
|
|
|
|
|
2023-02-07 19:35:44 +00:00
|
|
|
pip = atomic_load_ptr(&pr->pr_addrs[af]);
|
2021-12-26 18:45:50 +00:00
|
|
|
if (__predict_false(pip == NULL))
|
|
|
|
return (EAFNOSUPPORT);
|
|
|
|
|
|
|
|
/* Check the primary IP. */
|
2023-02-28 10:01:33 +00:00
|
|
|
if (cmp(PR_IP(pip, af, 0), addr) == 0)
|
2021-12-26 18:45:50 +00:00
|
|
|
return (0);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* All the other IPs are sorted so we can do a binary search.
|
|
|
|
*/
|
|
|
|
a = 0;
|
|
|
|
z = pip->ips - 2;
|
|
|
|
while (a <= z) {
|
|
|
|
i = (a + z) / 2;
|
2023-02-28 10:01:33 +00:00
|
|
|
d = cmp(PR_IP(pip, af, i + 1), addr);
|
2021-12-26 18:45:50 +00:00
|
|
|
if (d > 0)
|
|
|
|
z = i - 1;
|
|
|
|
else if (d < 0)
|
|
|
|
a = i + 1;
|
|
|
|
else
|
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
|
|
|
return (EADDRNOTAVAIL);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Grab primary IP. Historically required mutex, but nothing prevents
|
|
|
|
* us to support epoch-protected access. Is it used in fast path?
|
|
|
|
* in{6}_jail.c helper
|
|
|
|
*/
|
|
|
|
const void *
|
|
|
|
prison_ip_get0(const struct prison *pr, const pr_family_t af)
|
|
|
|
{
|
|
|
|
const struct prison_ip *pip = pr->pr_addrs[af];
|
|
|
|
|
|
|
|
mtx_assert(&pr->pr_mtx, MA_OWNED);
|
|
|
|
MPASS(pip);
|
|
|
|
|
2023-02-28 10:01:33 +00:00
|
|
|
return (pip->pr_ip);
|
2021-12-26 18:45:50 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
u_int
|
|
|
|
prison_ip_cnt(const struct prison *pr, const pr_family_t af)
|
|
|
|
{
|
|
|
|
|
|
|
|
return (pr->pr_addrs[af]->ips);
|
|
|
|
}
|
|
|
|
#endif /* defined(INET) || defined(INET6) */
|
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
int
|
|
|
|
kern_jail_set(struct thread *td, struct uio *optuio, int flags)
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
{
|
2009-04-29 21:14:15 +00:00
|
|
|
struct nameidata nd;
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
#ifdef INET
|
2021-12-26 18:45:50 +00:00
|
|
|
struct prison_ip *ip4;
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
2021-12-26 18:45:50 +00:00
|
|
|
struct prison_ip *ip6;
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
#endif
|
2009-04-29 21:14:15 +00:00
|
|
|
struct vfsopt *opt;
|
|
|
|
struct vfsoptlist *opts;
|
2020-12-26 18:39:34 +00:00
|
|
|
struct prison *pr, *deadpr, *inspr, *mypr, *ppr, *tpr;
|
2009-04-29 21:14:15 +00:00
|
|
|
struct vnode *root;
|
2009-09-04 19:00:48 +00:00
|
|
|
char *domain, *errmsg, *host, *name, *namelc, *p, *path, *uuid;
|
2015-02-27 16:28:55 +00:00
|
|
|
char *g_path, *osrelstr;
|
2018-03-20 23:08:42 +00:00
|
|
|
struct bool_flags *bf;
|
|
|
|
struct jailsys_flags *jsf;
|
2009-05-27 14:11:23 +00:00
|
|
|
#if defined(INET) || defined(INET6)
|
2009-04-29 21:14:15 +00:00
|
|
|
void *op;
|
2009-05-27 14:11:23 +00:00
|
|
|
#endif
|
2009-05-29 21:27:12 +00:00
|
|
|
unsigned long hid;
|
2016-04-25 04:27:58 +00:00
|
|
|
size_t namelen, onamelen, pnamelen;
|
2021-01-10 05:05:06 +00:00
|
|
|
int born, created, cuflags, descend, drflags, enforce;
|
2016-04-25 04:24:00 +00:00
|
|
|
int error, errmsg_len, errmsg_pos;
|
2012-02-09 10:22:08 +00:00
|
|
|
int gotchildmax, gotenforce, gothid, gotrsnum, gotslevel;
|
2018-03-20 23:08:42 +00:00
|
|
|
int jid, jsys, len, level;
|
2015-02-27 16:28:55 +00:00
|
|
|
int childmax, osreldt, rsnum, slevel;
|
2009-04-29 21:14:15 +00:00
|
|
|
#ifdef INET
|
2022-12-31 02:56:58 +00:00
|
|
|
int ip4s;
|
|
|
|
bool redo_ip4;
|
2009-04-29 21:14:15 +00:00
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
2022-12-31 02:56:58 +00:00
|
|
|
int ip6s;
|
|
|
|
bool redo_ip6;
|
2009-04-29 21:14:15 +00:00
|
|
|
#endif
|
2011-07-24 17:43:09 +00:00
|
|
|
uint64_t pr_allow, ch_allow, pr_flags, ch_flags;
|
2018-11-27 17:51:50 +00:00
|
|
|
uint64_t pr_allow_diff;
|
2011-07-24 17:43:09 +00:00
|
|
|
unsigned tallow;
|
2009-04-29 21:14:15 +00:00
|
|
|
char numbuf[12];
|
|
|
|
|
|
|
|
error = priv_check(td, PRIV_JAIL_SET);
|
|
|
|
if (!error && (flags & JAIL_ATTACH))
|
|
|
|
error = priv_check(td, PRIV_JAIL_ATTACH);
|
|
|
|
if (error)
|
|
|
|
return (error);
|
2016-04-25 04:27:58 +00:00
|
|
|
mypr = td->td_ucred->cr_prison;
|
2009-06-23 20:35:51 +00:00
|
|
|
if ((flags & JAIL_CREATE) && mypr->pr_childmax == 0)
|
2009-05-27 14:11:23 +00:00
|
|
|
return (EPERM);
|
2009-04-29 21:14:15 +00:00
|
|
|
if (flags & ~JAIL_SET_MASK)
|
|
|
|
return (EINVAL);
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
|
|
|
|
/*
|
2009-04-29 21:14:15 +00:00
|
|
|
* Check all the parameters before committing to anything. Not all
|
|
|
|
* errors can be caught early, but we may as well try. Also, this
|
|
|
|
* takes care of some expensive stuff (path lookup) before getting
|
|
|
|
* the allprison lock.
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
*
|
2009-04-29 21:14:15 +00:00
|
|
|
* XXX Jails are not filesystems, and jail parameters are not mount
|
|
|
|
* options. But it makes more sense to re-use the vfsopt code
|
|
|
|
* than duplicate it under a different name.
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
*/
|
2009-04-29 21:14:15 +00:00
|
|
|
error = vfs_buildopts(optuio, &opts);
|
|
|
|
if (error)
|
|
|
|
return (error);
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
#ifdef INET
|
|
|
|
ip4 = NULL;
|
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
|
|
|
ip6 = NULL;
|
|
|
|
#endif
|
2012-01-21 00:06:21 +00:00
|
|
|
g_path = NULL;
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
|
2016-04-25 04:27:58 +00:00
|
|
|
cuflags = flags & (JAIL_CREATE | JAIL_UPDATE);
|
|
|
|
if (!cuflags) {
|
|
|
|
error = EINVAL;
|
|
|
|
vfs_opterror(opts, "no valid operation (create or update)");
|
|
|
|
goto done_errmsg;
|
|
|
|
}
|
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
error = vfs_copyopt(opts, "jid", &jid, sizeof(jid));
|
|
|
|
if (error == ENOENT)
|
|
|
|
jid = 0;
|
|
|
|
else if (error != 0)
|
|
|
|
goto done_free;
|
|
|
|
|
|
|
|
error = vfs_copyopt(opts, "securelevel", &slevel, sizeof(slevel));
|
|
|
|
if (error == ENOENT)
|
|
|
|
gotslevel = 0;
|
|
|
|
else if (error != 0)
|
|
|
|
goto done_free;
|
|
|
|
else
|
|
|
|
gotslevel = 1;
|
|
|
|
|
2009-06-23 20:35:51 +00:00
|
|
|
error =
|
|
|
|
vfs_copyopt(opts, "children.max", &childmax, sizeof(childmax));
|
|
|
|
if (error == ENOENT)
|
|
|
|
gotchildmax = 0;
|
|
|
|
else if (error != 0)
|
|
|
|
goto done_free;
|
|
|
|
else
|
|
|
|
gotchildmax = 1;
|
|
|
|
|
2009-05-27 14:11:23 +00:00
|
|
|
error = vfs_copyopt(opts, "enforce_statfs", &enforce, sizeof(enforce));
|
2010-09-10 21:45:42 +00:00
|
|
|
if (error == ENOENT)
|
|
|
|
gotenforce = 0;
|
|
|
|
else if (error != 0)
|
|
|
|
goto done_free;
|
|
|
|
else if (enforce < 0 || enforce > 2) {
|
|
|
|
error = EINVAL;
|
2009-05-27 14:11:23 +00:00
|
|
|
goto done_free;
|
2010-09-10 21:45:42 +00:00
|
|
|
} else
|
|
|
|
gotenforce = 1;
|
2009-05-27 14:11:23 +00:00
|
|
|
|
2012-02-09 10:22:08 +00:00
|
|
|
error = vfs_copyopt(opts, "devfs_ruleset", &rsnum, sizeof(rsnum));
|
|
|
|
if (error == ENOENT)
|
|
|
|
gotrsnum = 0;
|
|
|
|
else if (error != 0)
|
|
|
|
goto done_free;
|
|
|
|
else
|
|
|
|
gotrsnum = 1;
|
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
pr_flags = ch_flags = 0;
|
2018-03-20 23:08:42 +00:00
|
|
|
for (bf = pr_flag_bool;
|
|
|
|
bf < pr_flag_bool + nitems(pr_flag_bool);
|
|
|
|
bf++) {
|
|
|
|
vfs_flagopt(opts, bf->name, &pr_flags, bf->flag);
|
|
|
|
vfs_flagopt(opts, bf->noname, &ch_flags, bf->flag);
|
2009-05-27 14:11:23 +00:00
|
|
|
}
|
2009-04-29 21:14:15 +00:00
|
|
|
ch_flags |= pr_flags;
|
2018-03-20 23:08:42 +00:00
|
|
|
for (jsf = pr_flag_jailsys;
|
|
|
|
jsf < pr_flag_jailsys + nitems(pr_flag_jailsys);
|
|
|
|
jsf++) {
|
|
|
|
error = vfs_copyopt(opts, jsf->name, &jsys, sizeof(jsys));
|
2009-07-25 14:48:57 +00:00
|
|
|
if (error == ENOENT)
|
|
|
|
continue;
|
|
|
|
if (error != 0)
|
|
|
|
goto done_free;
|
|
|
|
switch (jsys) {
|
|
|
|
case JAIL_SYS_DISABLE:
|
2018-03-20 23:08:42 +00:00
|
|
|
if (!jsf->disable) {
|
2009-07-25 14:48:57 +00:00
|
|
|
error = EINVAL;
|
|
|
|
goto done_free;
|
|
|
|
}
|
2018-03-20 23:08:42 +00:00
|
|
|
pr_flags |= jsf->disable;
|
2009-07-25 14:48:57 +00:00
|
|
|
break;
|
|
|
|
case JAIL_SYS_NEW:
|
2018-03-20 23:08:42 +00:00
|
|
|
pr_flags |= jsf->new;
|
2009-07-25 14:48:57 +00:00
|
|
|
break;
|
|
|
|
case JAIL_SYS_INHERIT:
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
error = EINVAL;
|
|
|
|
goto done_free;
|
|
|
|
}
|
2018-03-20 23:08:42 +00:00
|
|
|
ch_flags |= jsf->new | jsf->disable;
|
2009-07-25 14:48:57 +00:00
|
|
|
}
|
2021-02-21 21:24:47 +00:00
|
|
|
if ((flags & (JAIL_CREATE | JAIL_ATTACH)) == JAIL_CREATE
|
2010-08-08 23:22:55 +00:00
|
|
|
&& !(pr_flags & PR_PERSIST)) {
|
|
|
|
error = EINVAL;
|
|
|
|
vfs_opterror(opts, "new jail must persist or attach");
|
|
|
|
goto done_errmsg;
|
|
|
|
}
|
2009-06-15 18:59:29 +00:00
|
|
|
#ifdef VIMAGE
|
|
|
|
if ((flags & JAIL_UPDATE) && (ch_flags & PR_VNET)) {
|
|
|
|
error = EINVAL;
|
|
|
|
vfs_opterror(opts, "vnet cannot be changed after creation");
|
|
|
|
goto done_errmsg;
|
|
|
|
}
|
|
|
|
#endif
|
2009-07-30 14:28:56 +00:00
|
|
|
#ifdef INET
|
|
|
|
if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP4_USER)) {
|
|
|
|
error = EINVAL;
|
|
|
|
vfs_opterror(opts, "ip4 cannot be changed after creation");
|
|
|
|
goto done_errmsg;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
|
|
|
if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP6_USER)) {
|
|
|
|
error = EINVAL;
|
|
|
|
vfs_opterror(opts, "ip6 cannot be changed after creation");
|
|
|
|
goto done_errmsg;
|
|
|
|
}
|
|
|
|
#endif
|
2009-04-29 21:14:15 +00:00
|
|
|
|
2009-05-27 14:11:23 +00:00
|
|
|
pr_allow = ch_allow = 0;
|
2018-03-20 23:08:42 +00:00
|
|
|
for (bf = pr_flag_allow;
|
2020-12-26 20:53:28 +00:00
|
|
|
bf < pr_flag_allow + nitems(pr_flag_allow) &&
|
|
|
|
atomic_load_int(&bf->flag) != 0;
|
2018-03-20 23:08:42 +00:00
|
|
|
bf++) {
|
|
|
|
vfs_flagopt(opts, bf->name, &pr_allow, bf->flag);
|
|
|
|
vfs_flagopt(opts, bf->noname, &ch_allow, bf->flag);
|
2009-05-27 14:11:23 +00:00
|
|
|
}
|
|
|
|
ch_allow |= pr_allow;
|
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
error = vfs_getopt(opts, "name", (void **)&name, &len);
|
|
|
|
if (error == ENOENT)
|
|
|
|
name = NULL;
|
|
|
|
else if (error != 0)
|
|
|
|
goto done_free;
|
|
|
|
else {
|
|
|
|
if (len == 0 || name[len - 1] != '\0') {
|
|
|
|
error = EINVAL;
|
|
|
|
goto done_free;
|
|
|
|
}
|
|
|
|
if (len > MAXHOSTNAMELEN) {
|
|
|
|
error = ENAMETOOLONG;
|
|
|
|
goto done_free;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
error = vfs_getopt(opts, "host.hostname", (void **)&host, &len);
|
|
|
|
if (error == ENOENT)
|
|
|
|
host = NULL;
|
|
|
|
else if (error != 0)
|
|
|
|
goto done_free;
|
|
|
|
else {
|
2009-05-29 21:27:12 +00:00
|
|
|
ch_flags |= PR_HOST;
|
|
|
|
pr_flags |= PR_HOST;
|
2009-04-29 21:14:15 +00:00
|
|
|
if (len == 0 || host[len - 1] != '\0') {
|
|
|
|
error = EINVAL;
|
|
|
|
goto done_free;
|
|
|
|
}
|
|
|
|
if (len > MAXHOSTNAMELEN) {
|
|
|
|
error = ENAMETOOLONG;
|
|
|
|
goto done_free;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2009-05-29 21:27:12 +00:00
|
|
|
error = vfs_getopt(opts, "host.domainname", (void **)&domain, &len);
|
|
|
|
if (error == ENOENT)
|
|
|
|
domain = NULL;
|
|
|
|
else if (error != 0)
|
|
|
|
goto done_free;
|
|
|
|
else {
|
|
|
|
ch_flags |= PR_HOST;
|
|
|
|
pr_flags |= PR_HOST;
|
|
|
|
if (len == 0 || domain[len - 1] != '\0') {
|
|
|
|
error = EINVAL;
|
|
|
|
goto done_free;
|
|
|
|
}
|
|
|
|
if (len > MAXHOSTNAMELEN) {
|
|
|
|
error = ENAMETOOLONG;
|
|
|
|
goto done_free;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
error = vfs_getopt(opts, "host.hostuuid", (void **)&uuid, &len);
|
|
|
|
if (error == ENOENT)
|
|
|
|
uuid = NULL;
|
|
|
|
else if (error != 0)
|
|
|
|
goto done_free;
|
|
|
|
else {
|
|
|
|
ch_flags |= PR_HOST;
|
|
|
|
pr_flags |= PR_HOST;
|
|
|
|
if (len == 0 || uuid[len - 1] != '\0') {
|
|
|
|
error = EINVAL;
|
|
|
|
goto done_free;
|
|
|
|
}
|
|
|
|
if (len > HOSTUUIDLEN) {
|
|
|
|
error = ENAMETOOLONG;
|
|
|
|
goto done_free;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2010-03-11 14:49:06 +00:00
|
|
|
#ifdef COMPAT_FREEBSD32
|
2011-01-26 20:03:58 +00:00
|
|
|
if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) {
|
2009-05-29 21:27:12 +00:00
|
|
|
uint32_t hid32;
|
|
|
|
|
|
|
|
error = vfs_copyopt(opts, "host.hostid", &hid32, sizeof(hid32));
|
|
|
|
hid = hid32;
|
|
|
|
} else
|
|
|
|
#endif
|
|
|
|
error = vfs_copyopt(opts, "host.hostid", &hid, sizeof(hid));
|
|
|
|
if (error == ENOENT)
|
|
|
|
gothid = 0;
|
|
|
|
else if (error != 0)
|
|
|
|
goto done_free;
|
|
|
|
else {
|
|
|
|
gothid = 1;
|
|
|
|
ch_flags |= PR_HOST;
|
|
|
|
pr_flags |= PR_HOST;
|
|
|
|
}
|
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
#ifdef INET
|
|
|
|
error = vfs_getopt(opts, "ip4.addr", &op, &ip4s);
|
|
|
|
if (error == ENOENT)
|
2015-01-14 03:52:41 +00:00
|
|
|
ip4s = 0;
|
2009-04-29 21:14:15 +00:00
|
|
|
else if (error != 0)
|
|
|
|
goto done_free;
|
2021-12-26 18:45:50 +00:00
|
|
|
else if (ip4s & (sizeof(struct in_addr) - 1)) {
|
2009-04-29 21:14:15 +00:00
|
|
|
error = EINVAL;
|
|
|
|
goto done_free;
|
2009-05-27 14:11:23 +00:00
|
|
|
} else {
|
2015-01-14 04:50:28 +00:00
|
|
|
ch_flags |= PR_IP4_USER;
|
|
|
|
pr_flags |= PR_IP4_USER;
|
|
|
|
if (ip4s > 0) {
|
2021-12-26 18:45:50 +00:00
|
|
|
ip4s /= sizeof(struct in_addr);
|
2009-05-27 14:11:23 +00:00
|
|
|
if (ip4s > jail_max_af_ips) {
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
error = EINVAL;
|
2009-05-27 14:11:23 +00:00
|
|
|
vfs_opterror(opts, "too many IPv4 addresses");
|
|
|
|
goto done_errmsg;
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
}
|
2021-12-26 18:45:50 +00:00
|
|
|
ip4 = prison_ip_copyin(PR_INET, op, ip4s);
|
|
|
|
if (ip4 == NULL) {
|
|
|
|
error = EINVAL;
|
|
|
|
goto done_free;
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
}
|
|
|
|
}
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
#endif
|
2009-04-29 21:14:15 +00:00
|
|
|
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
#ifdef INET6
|
2009-04-29 21:14:15 +00:00
|
|
|
error = vfs_getopt(opts, "ip6.addr", &op, &ip6s);
|
|
|
|
if (error == ENOENT)
|
2015-01-14 03:52:41 +00:00
|
|
|
ip6s = 0;
|
2009-04-29 21:14:15 +00:00
|
|
|
else if (error != 0)
|
|
|
|
goto done_free;
|
2021-12-26 18:45:50 +00:00
|
|
|
else if (ip6s & (sizeof(struct in6_addr) - 1)) {
|
2009-04-29 21:14:15 +00:00
|
|
|
error = EINVAL;
|
|
|
|
goto done_free;
|
2009-05-27 14:11:23 +00:00
|
|
|
} else {
|
2015-01-14 04:50:28 +00:00
|
|
|
ch_flags |= PR_IP6_USER;
|
|
|
|
pr_flags |= PR_IP6_USER;
|
|
|
|
if (ip6s > 0) {
|
2021-12-26 18:45:50 +00:00
|
|
|
ip6s /= sizeof(struct in6_addr);
|
2009-05-27 14:11:23 +00:00
|
|
|
if (ip6s > jail_max_af_ips) {
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
error = EINVAL;
|
2009-05-27 14:11:23 +00:00
|
|
|
vfs_opterror(opts, "too many IPv6 addresses");
|
|
|
|
goto done_errmsg;
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
}
|
2021-12-26 18:45:50 +00:00
|
|
|
ip6 = prison_ip_copyin(PR_INET6, op, ip6s);
|
|
|
|
if (ip6 == NULL) {
|
|
|
|
error = EINVAL;
|
|
|
|
goto done_free;
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
}
|
|
|
|
}
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
#endif
|
|
|
|
|
2009-07-29 16:46:59 +00:00
|
|
|
#if defined(VIMAGE) && (defined(INET) || defined(INET6))
|
|
|
|
if ((ch_flags & PR_VNET) && (ch_flags & (PR_IP4_USER | PR_IP6_USER))) {
|
|
|
|
error = EINVAL;
|
|
|
|
vfs_opterror(opts,
|
|
|
|
"vnet jails cannot have IP address restrictions");
|
|
|
|
goto done_errmsg;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2016-06-09 20:43:14 +00:00
|
|
|
error = vfs_getopt(opts, "osrelease", (void **)&osrelstr, &len);
|
|
|
|
if (error == ENOENT)
|
|
|
|
osrelstr = NULL;
|
|
|
|
else if (error != 0)
|
|
|
|
goto done_free;
|
|
|
|
else {
|
|
|
|
if (flags & JAIL_UPDATE) {
|
|
|
|
error = EINVAL;
|
|
|
|
vfs_opterror(opts,
|
|
|
|
"osrelease cannot be changed after creation");
|
|
|
|
goto done_errmsg;
|
|
|
|
}
|
2020-03-14 14:04:55 +00:00
|
|
|
if (len == 0 || osrelstr[len - 1] != '\0') {
|
2016-06-09 20:43:14 +00:00
|
|
|
error = EINVAL;
|
2020-03-14 14:04:55 +00:00
|
|
|
goto done_free;
|
|
|
|
}
|
|
|
|
if (len >= OSRELEASELEN) {
|
|
|
|
error = ENAMETOOLONG;
|
2016-06-09 20:43:14 +00:00
|
|
|
vfs_opterror(opts,
|
|
|
|
"osrelease string must be 1-%d bytes long",
|
|
|
|
OSRELEASELEN - 1);
|
|
|
|
goto done_errmsg;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
error = vfs_copyopt(opts, "osreldate", &osreldt, sizeof(osreldt));
|
|
|
|
if (error == ENOENT)
|
|
|
|
osreldt = 0;
|
|
|
|
else if (error != 0)
|
|
|
|
goto done_free;
|
|
|
|
else {
|
|
|
|
if (flags & JAIL_UPDATE) {
|
|
|
|
error = EINVAL;
|
|
|
|
vfs_opterror(opts,
|
|
|
|
"osreldate cannot be changed after creation");
|
|
|
|
goto done_errmsg;
|
|
|
|
}
|
|
|
|
if (osreldt == 0) {
|
|
|
|
error = EINVAL;
|
|
|
|
vfs_opterror(opts, "osreldate cannot be 0");
|
|
|
|
goto done_errmsg;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
root = NULL;
|
|
|
|
error = vfs_getopt(opts, "path", (void **)&path, &len);
|
|
|
|
if (error == ENOENT)
|
|
|
|
path = NULL;
|
|
|
|
else if (error != 0)
|
|
|
|
goto done_free;
|
|
|
|
else {
|
|
|
|
if (flags & JAIL_UPDATE) {
|
|
|
|
error = EINVAL;
|
|
|
|
vfs_opterror(opts,
|
|
|
|
"path cannot be changed after creation");
|
|
|
|
goto done_errmsg;
|
|
|
|
}
|
|
|
|
if (len == 0 || path[len - 1] != '\0') {
|
|
|
|
error = EINVAL;
|
|
|
|
goto done_free;
|
|
|
|
}
|
2021-11-25 21:43:06 +00:00
|
|
|
NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE, path);
|
2012-01-15 12:08:20 +00:00
|
|
|
error = namei(&nd);
|
|
|
|
if (error)
|
|
|
|
goto done_free;
|
|
|
|
root = nd.ni_vp;
|
2022-03-24 10:10:03 +00:00
|
|
|
NDFREE_PNBUF(&nd);
|
2012-01-21 00:06:21 +00:00
|
|
|
g_path = malloc(MAXPATHLEN, M_TEMP, M_WAITOK);
|
|
|
|
strlcpy(g_path, path, MAXPATHLEN);
|
|
|
|
error = vn_path_to_global_path(td, root, g_path, MAXPATHLEN);
|
2020-02-08 15:51:08 +00:00
|
|
|
if (error == 0) {
|
2012-01-21 00:06:21 +00:00
|
|
|
path = g_path;
|
|
|
|
} else {
|
2012-01-15 12:08:20 +00:00
|
|
|
/* exit on other errors */
|
|
|
|
goto done_free;
|
|
|
|
}
|
|
|
|
if (root->v_type != VDIR) {
|
|
|
|
error = ENOTDIR;
|
|
|
|
vput(root);
|
|
|
|
goto done_free;
|
|
|
|
}
|
2020-01-03 22:29:58 +00:00
|
|
|
VOP_UNLOCK(root);
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
/*
|
2016-04-25 04:27:58 +00:00
|
|
|
* Find the specified jail, or at least its parent.
|
2009-04-29 21:14:15 +00:00
|
|
|
* This abuses the file error codes ENOENT and EEXIST.
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
*/
|
2009-04-29 21:14:15 +00:00
|
|
|
pr = NULL;
|
2020-12-26 18:39:34 +00:00
|
|
|
inspr = NULL;
|
2009-09-04 19:00:48 +00:00
|
|
|
if (cuflags == JAIL_CREATE && jid == 0 && name != NULL) {
|
|
|
|
namelc = strrchr(name, '.');
|
|
|
|
jid = strtoul(namelc != NULL ? namelc + 1 : name, &p, 10);
|
|
|
|
if (*p != '\0')
|
|
|
|
jid = 0;
|
|
|
|
}
|
2016-04-25 04:27:58 +00:00
|
|
|
sx_xlock(&allprison_lock);
|
2021-02-26 03:52:58 +00:00
|
|
|
drflags = PD_LIST_XLOCKED;
|
2021-02-23 01:04:06 +00:00
|
|
|
ppr = mypr;
|
|
|
|
if (!prison_isalive(ppr)) {
|
|
|
|
/* This jail is dying. This process will surely follow. */
|
|
|
|
error = EAGAIN;
|
|
|
|
goto done_deref;
|
|
|
|
}
|
2009-04-29 21:14:15 +00:00
|
|
|
if (jid != 0) {
|
|
|
|
if (jid < 0) {
|
|
|
|
error = EINVAL;
|
|
|
|
vfs_opterror(opts, "negative jid");
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done_deref;
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
2020-12-26 18:39:34 +00:00
|
|
|
/*
|
|
|
|
* See if a requested jid already exists. Keep track of
|
|
|
|
* where it can be inserted later.
|
|
|
|
*/
|
|
|
|
TAILQ_FOREACH(inspr, &allprison, pr_list) {
|
2021-02-21 18:55:44 +00:00
|
|
|
if (inspr->pr_id < jid)
|
|
|
|
continue;
|
2020-12-26 18:39:34 +00:00
|
|
|
if (inspr->pr_id > jid)
|
|
|
|
break;
|
2021-02-21 18:55:44 +00:00
|
|
|
pr = inspr;
|
|
|
|
mtx_lock(&pr->pr_mtx);
|
|
|
|
drflags |= PD_LOCKED;
|
|
|
|
inspr = NULL;
|
|
|
|
break;
|
2020-12-26 18:39:34 +00:00
|
|
|
}
|
2009-04-29 21:14:15 +00:00
|
|
|
if (pr != NULL) {
|
|
|
|
/* Create: jid must not exist. */
|
|
|
|
if (cuflags == JAIL_CREATE) {
|
2020-12-26 18:39:34 +00:00
|
|
|
/*
|
|
|
|
* Even creators that cannot see the jail will
|
|
|
|
* get EEXIST.
|
|
|
|
*/
|
2009-04-29 21:14:15 +00:00
|
|
|
error = EEXIST;
|
|
|
|
vfs_opterror(opts, "jail %d already exists",
|
|
|
|
jid);
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done_deref;
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
2009-05-27 14:11:23 +00:00
|
|
|
if (!prison_ischild(mypr, pr)) {
|
2020-12-26 18:39:34 +00:00
|
|
|
/*
|
|
|
|
* Updaters get ENOENT if they cannot see the
|
|
|
|
* jail. This is true even for CREATE | UPDATE,
|
|
|
|
* which normally cannot give this error.
|
|
|
|
*/
|
2021-01-10 05:05:06 +00:00
|
|
|
error = ENOENT;
|
|
|
|
vfs_opterror(opts, "jail %d not found", jid);
|
|
|
|
goto done_deref;
|
2021-02-21 18:55:44 +00:00
|
|
|
}
|
2021-02-23 01:04:06 +00:00
|
|
|
ppr = pr->pr_parent;
|
|
|
|
if (!prison_isalive(ppr)) {
|
|
|
|
error = ENOENT;
|
|
|
|
vfs_opterror(opts, "jail %d is dying",
|
|
|
|
ppr->pr_id);
|
|
|
|
goto done_deref;
|
|
|
|
}
|
2021-02-21 18:55:44 +00:00
|
|
|
if (!prison_isalive(pr)) {
|
2009-04-29 21:14:15 +00:00
|
|
|
if (!(flags & JAIL_DYING)) {
|
|
|
|
error = ENOENT;
|
|
|
|
vfs_opterror(opts, "jail %d is dying",
|
|
|
|
jid);
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done_deref;
|
2021-02-21 18:55:44 +00:00
|
|
|
}
|
|
|
|
if ((flags & JAIL_ATTACH) ||
|
2009-04-29 21:14:15 +00:00
|
|
|
(pr_flags & PR_PERSIST)) {
|
|
|
|
/*
|
|
|
|
* A dying jail might be resurrected
|
|
|
|
* (via attach or persist), but first
|
|
|
|
* it must determine if another jail
|
|
|
|
* has claimed its name. Accomplish
|
|
|
|
* this by implicitly re-setting the
|
|
|
|
* name.
|
|
|
|
*/
|
|
|
|
if (name == NULL)
|
2009-05-27 14:11:23 +00:00
|
|
|
name = prison_name(mypr, pr);
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
|
|
|
}
|
2021-01-10 05:05:06 +00:00
|
|
|
} else {
|
2009-04-29 21:14:15 +00:00
|
|
|
/* Update: jid must exist. */
|
|
|
|
if (cuflags == JAIL_UPDATE) {
|
|
|
|
error = ENOENT;
|
|
|
|
vfs_opterror(opts, "jail %d not found", jid);
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done_deref;
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
/*
|
|
|
|
* If the caller provided a name, look for a jail by that name.
|
|
|
|
* This has different semantics for creates and updates keyed by jid
|
|
|
|
* (where the name must not already exist in a different jail),
|
|
|
|
* and updates keyed by the name itself (where the name must exist
|
|
|
|
* because that is the jail being updated).
|
|
|
|
*/
|
2016-04-25 04:27:58 +00:00
|
|
|
namelc = NULL;
|
2009-04-29 21:14:15 +00:00
|
|
|
if (name != NULL) {
|
2009-09-04 19:00:48 +00:00
|
|
|
namelc = strrchr(name, '.');
|
|
|
|
if (namelc == NULL)
|
|
|
|
namelc = name;
|
|
|
|
else {
|
2009-05-27 14:11:23 +00:00
|
|
|
/*
|
|
|
|
* This is a hierarchical name. Split it into the
|
|
|
|
* parent and child names, and make sure the parent
|
|
|
|
* exists or matches an already found jail.
|
|
|
|
*/
|
|
|
|
if (pr != NULL) {
|
2009-09-04 19:00:48 +00:00
|
|
|
if (strncmp(name, ppr->pr_name, namelc - name)
|
|
|
|
|| ppr->pr_name[namelc - name] != '\0') {
|
2009-05-27 14:11:23 +00:00
|
|
|
error = EINVAL;
|
|
|
|
vfs_opterror(opts,
|
|
|
|
"cannot change jail's parent");
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done_deref;
|
2009-05-27 14:11:23 +00:00
|
|
|
}
|
|
|
|
} else {
|
2016-04-25 04:27:58 +00:00
|
|
|
*namelc = '\0';
|
2009-05-27 14:11:23 +00:00
|
|
|
ppr = prison_find_name(mypr, name);
|
|
|
|
if (ppr == NULL) {
|
|
|
|
error = ENOENT;
|
|
|
|
vfs_opterror(opts,
|
|
|
|
"jail \"%s\" not found", name);
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done_deref;
|
2009-05-27 14:11:23 +00:00
|
|
|
}
|
2021-02-23 01:04:06 +00:00
|
|
|
mtx_unlock(&ppr->pr_mtx);
|
|
|
|
if (!prison_isalive(ppr)) {
|
2021-01-29 05:51:09 +00:00
|
|
|
error = ENOENT;
|
|
|
|
vfs_opterror(opts,
|
|
|
|
"jail \"%s\" is dying", name);
|
|
|
|
goto done_deref;
|
|
|
|
}
|
2016-04-25 04:27:58 +00:00
|
|
|
*namelc = '.';
|
2009-05-27 14:11:23 +00:00
|
|
|
}
|
2016-04-25 04:27:58 +00:00
|
|
|
namelc++;
|
2009-05-27 14:11:23 +00:00
|
|
|
}
|
2016-04-25 04:27:58 +00:00
|
|
|
if (namelc[0] != '\0') {
|
|
|
|
pnamelen =
|
2009-05-27 14:11:23 +00:00
|
|
|
(ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1;
|
|
|
|
deadpr = NULL;
|
|
|
|
FOREACH_PRISON_CHILD(ppr, tpr) {
|
2021-01-20 23:08:27 +00:00
|
|
|
if (tpr != pr &&
|
2016-04-25 04:27:58 +00:00
|
|
|
!strcmp(tpr->pr_name + pnamelen, namelc)) {
|
jail: Add prison_isvalid() and prison_isalive()
prison_isvalid() checks if a prison record can be used at all, i.e.
pr_ref > 0. This filters out prisons that aren't fully created, and
those that are either in the process of being dismantled, or will be
at the next opportunity. While the check for pr_ref > 0 is simple
enough to make without a convenience function, this prepares the way
for other measures of prison validity.
prison_isalive() checks not only validity as far as the useablity of
the prison structure, but also whether the prison is visible to user
space. It replaces a test for pr_uref > 0, which is currently only
used within kern_jail.c, and not often there.
Both of these functions also assert that either the prison mutex or
allprison_lock is held, since it's generally the case that unlocked
prisons aren't guaranteed to remain useable for any length of time.
This isn't entirely true, for example a thread can assume its own
prison is good, but most exceptions will exist inside of kern_jail.c.
2021-01-18 18:56:20 +00:00
|
|
|
if (prison_isalive(tpr)) {
|
|
|
|
if (pr == NULL &&
|
|
|
|
cuflags != JAIL_CREATE) {
|
2009-04-29 21:14:15 +00:00
|
|
|
/*
|
|
|
|
* Use this jail
|
|
|
|
* for updates.
|
|
|
|
*/
|
jail: Add prison_isvalid() and prison_isalive()
prison_isvalid() checks if a prison record can be used at all, i.e.
pr_ref > 0. This filters out prisons that aren't fully created, and
those that are either in the process of being dismantled, or will be
at the next opportunity. While the check for pr_ref > 0 is simple
enough to make without a convenience function, this prepares the way
for other measures of prison validity.
prison_isalive() checks not only validity as far as the useablity of
the prison structure, but also whether the prison is visible to user
space. It replaces a test for pr_uref > 0, which is currently only
used within kern_jail.c, and not often there.
Both of these functions also assert that either the prison mutex or
allprison_lock is held, since it's generally the case that unlocked
prisons aren't guaranteed to remain useable for any length of time.
This isn't entirely true, for example a thread can assume its own
prison is good, but most exceptions will exist inside of kern_jail.c.
2021-01-18 18:56:20 +00:00
|
|
|
pr = tpr;
|
2021-02-21 18:55:44 +00:00
|
|
|
mtx_lock(&pr->pr_mtx);
|
2021-01-18 23:47:09 +00:00
|
|
|
drflags |= PD_LOCKED;
|
jail: Add prison_isvalid() and prison_isalive()
prison_isvalid() checks if a prison record can be used at all, i.e.
pr_ref > 0. This filters out prisons that aren't fully created, and
those that are either in the process of being dismantled, or will be
at the next opportunity. While the check for pr_ref > 0 is simple
enough to make without a convenience function, this prepares the way
for other measures of prison validity.
prison_isalive() checks not only validity as far as the useablity of
the prison structure, but also whether the prison is visible to user
space. It replaces a test for pr_uref > 0, which is currently only
used within kern_jail.c, and not often there.
Both of these functions also assert that either the prison mutex or
allprison_lock is held, since it's generally the case that unlocked
prisons aren't guaranteed to remain useable for any length of time.
This isn't entirely true, for example a thread can assume its own
prison is good, but most exceptions will exist inside of kern_jail.c.
2021-01-18 18:56:20 +00:00
|
|
|
break;
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
|
|
|
/*
|
|
|
|
* Create, or update(jid):
|
|
|
|
* name must not exist in an
|
2009-05-27 14:11:23 +00:00
|
|
|
* active sibling jail.
|
2009-04-29 21:14:15 +00:00
|
|
|
*/
|
|
|
|
error = EEXIST;
|
|
|
|
vfs_opterror(opts,
|
|
|
|
"jail \"%s\" already exists",
|
|
|
|
name);
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done_deref;
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
jail: Add prison_isvalid() and prison_isalive()
prison_isvalid() checks if a prison record can be used at all, i.e.
pr_ref > 0. This filters out prisons that aren't fully created, and
those that are either in the process of being dismantled, or will be
at the next opportunity. While the check for pr_ref > 0 is simple
enough to make without a convenience function, this prepares the way
for other measures of prison validity.
prison_isalive() checks not only validity as far as the useablity of
the prison structure, but also whether the prison is visible to user
space. It replaces a test for pr_uref > 0, which is currently only
used within kern_jail.c, and not often there.
Both of these functions also assert that either the prison mutex or
allprison_lock is held, since it's generally the case that unlocked
prisons aren't guaranteed to remain useable for any length of time.
This isn't entirely true, for example a thread can assume its own
prison is good, but most exceptions will exist inside of kern_jail.c.
2021-01-18 18:56:20 +00:00
|
|
|
if (pr == NULL &&
|
2021-02-21 18:55:44 +00:00
|
|
|
cuflags != JAIL_CREATE) {
|
jail: Add prison_isvalid() and prison_isalive()
prison_isvalid() checks if a prison record can be used at all, i.e.
pr_ref > 0. This filters out prisons that aren't fully created, and
those that are either in the process of being dismantled, or will be
at the next opportunity. While the check for pr_ref > 0 is simple
enough to make without a convenience function, this prepares the way
for other measures of prison validity.
prison_isalive() checks not only validity as far as the useablity of
the prison structure, but also whether the prison is visible to user
space. It replaces a test for pr_uref > 0, which is currently only
used within kern_jail.c, and not often there.
Both of these functions also assert that either the prison mutex or
allprison_lock is held, since it's generally the case that unlocked
prisons aren't guaranteed to remain useable for any length of time.
This isn't entirely true, for example a thread can assume its own
prison is good, but most exceptions will exist inside of kern_jail.c.
2021-01-18 18:56:20 +00:00
|
|
|
deadpr = tpr;
|
2021-02-21 18:55:44 +00:00
|
|
|
}
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
/* If no active jail is found, use a dying one. */
|
|
|
|
if (deadpr != NULL && pr == NULL) {
|
|
|
|
if (flags & JAIL_DYING) {
|
|
|
|
pr = deadpr;
|
2021-02-21 18:55:44 +00:00
|
|
|
mtx_lock(&pr->pr_mtx);
|
2021-01-10 05:05:06 +00:00
|
|
|
drflags |= PD_LOCKED;
|
2009-04-29 21:14:15 +00:00
|
|
|
} else if (cuflags == JAIL_UPDATE) {
|
|
|
|
error = ENOENT;
|
|
|
|
vfs_opterror(opts,
|
|
|
|
"jail \"%s\" is dying", name);
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done_deref;
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
/* Update: name must exist if no jid. */
|
|
|
|
else if (cuflags == JAIL_UPDATE && pr == NULL) {
|
|
|
|
error = ENOENT;
|
|
|
|
vfs_opterror(opts, "jail \"%s\" not found",
|
|
|
|
name);
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done_deref;
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
/* Update: must provide a jid or name. */
|
|
|
|
else if (cuflags == JAIL_UPDATE && pr == NULL) {
|
|
|
|
error = ENOENT;
|
|
|
|
vfs_opterror(opts, "update specified no jail");
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done_deref;
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
/* If there's no prison to update, create a new one and link it in. */
|
2021-01-10 05:05:06 +00:00
|
|
|
created = pr == NULL;
|
|
|
|
if (created) {
|
2009-06-23 20:35:51 +00:00
|
|
|
for (tpr = mypr; tpr != NULL; tpr = tpr->pr_parent)
|
|
|
|
if (tpr->pr_childcount >= tpr->pr_childmax) {
|
|
|
|
error = EPERM;
|
|
|
|
vfs_opterror(opts, "prison limit exceeded");
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done_deref;
|
2009-06-23 20:35:51 +00:00
|
|
|
}
|
2020-12-26 18:39:34 +00:00
|
|
|
if (jid == 0 && (jid = get_next_prid(&inspr)) == 0) {
|
|
|
|
error = EAGAIN;
|
|
|
|
vfs_opterror(opts, "no available jail IDs");
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done_deref;
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
2021-01-10 05:05:06 +00:00
|
|
|
|
|
|
|
pr = malloc(sizeof(*pr), M_PRISON, M_WAITOK | M_ZERO);
|
2021-02-21 21:24:47 +00:00
|
|
|
pr->pr_state = PRISON_STATE_INVALID;
|
|
|
|
refcount_init(&pr->pr_ref, 1);
|
2021-02-21 18:55:44 +00:00
|
|
|
refcount_init(&pr->pr_uref, 0);
|
2021-02-21 21:24:47 +00:00
|
|
|
drflags |= PD_DEREF;
|
2021-01-10 05:05:06 +00:00
|
|
|
LIST_INIT(&pr->pr_children);
|
|
|
|
mtx_init(&pr->pr_mtx, "jail mutex", NULL, MTX_DEF | MTX_DUPOK);
|
|
|
|
TASK_INIT(&pr->pr_task, 0, prison_complete, pr);
|
|
|
|
|
2020-12-26 18:39:34 +00:00
|
|
|
pr->pr_id = jid;
|
|
|
|
if (inspr != NULL)
|
|
|
|
TAILQ_INSERT_BEFORE(inspr, pr, pr_list);
|
|
|
|
else
|
2009-04-29 21:14:15 +00:00
|
|
|
TAILQ_INSERT_TAIL(&allprison, pr, pr_list);
|
2020-12-26 18:39:34 +00:00
|
|
|
|
|
|
|
pr->pr_parent = ppr;
|
2021-02-23 01:04:06 +00:00
|
|
|
prison_hold(ppr);
|
|
|
|
prison_proc_hold(ppr);
|
2009-05-27 14:11:23 +00:00
|
|
|
LIST_INSERT_HEAD(&ppr->pr_children, pr, pr_sibling);
|
|
|
|
for (tpr = ppr; tpr != NULL; tpr = tpr->pr_parent)
|
2009-06-23 20:35:51 +00:00
|
|
|
tpr->pr_childcount++;
|
2009-04-29 21:14:15 +00:00
|
|
|
|
2009-05-27 14:11:23 +00:00
|
|
|
/* Set some default values, and inherit some from the parent. */
|
2016-04-25 04:27:58 +00:00
|
|
|
if (namelc == NULL)
|
|
|
|
namelc = "";
|
2009-04-29 21:14:15 +00:00
|
|
|
if (path == NULL) {
|
|
|
|
path = "/";
|
2009-05-27 14:11:23 +00:00
|
|
|
root = mypr->pr_root;
|
2009-04-29 21:14:15 +00:00
|
|
|
vref(root);
|
|
|
|
}
|
2009-07-29 16:41:02 +00:00
|
|
|
strlcpy(pr->pr_hostuuid, DEFAULT_HOSTUUID, HOSTUUIDLEN);
|
|
|
|
pr->pr_flags |= PR_HOST;
|
2009-07-29 16:46:59 +00:00
|
|
|
#if defined(INET) || defined(INET6)
|
|
|
|
#ifdef VIMAGE
|
|
|
|
if (!(pr_flags & PR_VNET))
|
|
|
|
#endif
|
|
|
|
{
|
2009-05-27 14:11:23 +00:00
|
|
|
#ifdef INET
|
2009-07-30 14:28:56 +00:00
|
|
|
if (!(ch_flags & PR_IP4_USER))
|
2015-01-14 04:50:28 +00:00
|
|
|
pr->pr_flags |= PR_IP4 | PR_IP4_USER;
|
2009-07-30 14:28:56 +00:00
|
|
|
else if (!(pr_flags & PR_IP4_USER)) {
|
|
|
|
pr->pr_flags |= ppr->pr_flags & PR_IP4;
|
2021-12-26 18:45:50 +00:00
|
|
|
prison_ip_dup(ppr, pr, PR_INET);
|
2009-07-30 14:28:56 +00:00
|
|
|
}
|
2009-05-27 14:11:23 +00:00
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
2009-07-30 14:28:56 +00:00
|
|
|
if (!(ch_flags & PR_IP6_USER))
|
2015-01-14 04:50:28 +00:00
|
|
|
pr->pr_flags |= PR_IP6 | PR_IP6_USER;
|
2009-07-30 14:28:56 +00:00
|
|
|
else if (!(pr_flags & PR_IP6_USER)) {
|
|
|
|
pr->pr_flags |= ppr->pr_flags & PR_IP6;
|
2021-12-26 18:45:50 +00:00
|
|
|
prison_ip_dup(ppr, pr, PR_INET6);
|
2009-07-30 14:28:56 +00:00
|
|
|
}
|
2009-07-29 16:46:59 +00:00
|
|
|
#endif
|
|
|
|
}
|
2009-05-27 14:11:23 +00:00
|
|
|
#endif
|
2010-01-17 12:57:11 +00:00
|
|
|
/* Source address selection is always on by default. */
|
|
|
|
pr->pr_flags |= _PR_IP_SADDRSEL;
|
|
|
|
|
2009-05-27 14:11:23 +00:00
|
|
|
pr->pr_securelevel = ppr->pr_securelevel;
|
|
|
|
pr->pr_allow = JAIL_DEFAULT_ALLOW & ppr->pr_allow;
|
2015-06-17 13:15:54 +00:00
|
|
|
pr->pr_enforce_statfs = jail_default_enforce_statfs;
|
2012-02-23 18:51:24 +00:00
|
|
|
pr->pr_devfs_rsnum = ppr->pr_devfs_rsnum;
|
2009-04-29 21:14:15 +00:00
|
|
|
|
2015-02-27 16:28:55 +00:00
|
|
|
pr->pr_osreldate = osreldt ? osreldt : ppr->pr_osreldate;
|
|
|
|
if (osrelstr == NULL)
|
2020-03-14 14:04:55 +00:00
|
|
|
strlcpy(pr->pr_osrelease, ppr->pr_osrelease,
|
|
|
|
sizeof(pr->pr_osrelease));
|
2015-02-27 16:28:55 +00:00
|
|
|
else
|
2020-03-14 14:04:55 +00:00
|
|
|
strlcpy(pr->pr_osrelease, osrelstr,
|
|
|
|
sizeof(pr->pr_osrelease));
|
2015-02-27 16:28:55 +00:00
|
|
|
|
2009-06-15 18:59:29 +00:00
|
|
|
#ifdef VIMAGE
|
|
|
|
/* Allocate a new vnet if specified. */
|
|
|
|
pr->pr_vnet = (pr_flags & PR_VNET)
|
|
|
|
? vnet_alloc() : ppr->pr_vnet;
|
|
|
|
#endif
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
/*
|
2009-04-29 21:14:15 +00:00
|
|
|
* Allocate a dedicated cpuset for each jail.
|
2021-09-26 13:17:41 +00:00
|
|
|
* Unlike other initial settings, this may return an error.
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
*/
|
2009-05-27 14:11:23 +00:00
|
|
|
error = cpuset_create_root(ppr, &pr->pr_cpuset);
|
2021-01-10 05:05:06 +00:00
|
|
|
if (error)
|
|
|
|
goto done_deref;
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
mtx_lock(&pr->pr_mtx);
|
2021-01-10 05:05:06 +00:00
|
|
|
drflags |= PD_LOCKED;
|
2009-04-29 21:14:15 +00:00
|
|
|
} else {
|
2009-07-30 14:28:56 +00:00
|
|
|
/*
|
|
|
|
* Grab a reference for existing prisons, to ensure they
|
|
|
|
* continue to exist for the duration of the call.
|
|
|
|
*/
|
2021-01-20 23:08:27 +00:00
|
|
|
prison_hold(pr);
|
2021-01-10 05:05:06 +00:00
|
|
|
drflags |= PD_DEREF;
|
2009-07-29 16:46:59 +00:00
|
|
|
#if defined(VIMAGE) && (defined(INET) || defined(INET6))
|
|
|
|
if ((pr->pr_flags & PR_VNET) &&
|
|
|
|
(ch_flags & (PR_IP4_USER | PR_IP6_USER))) {
|
|
|
|
error = EINVAL;
|
|
|
|
vfs_opterror(opts,
|
|
|
|
"vnet jails cannot have IP address restrictions");
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done_deref;
|
2009-07-29 16:46:59 +00:00
|
|
|
}
|
|
|
|
#endif
|
2009-07-30 14:28:56 +00:00
|
|
|
#ifdef INET
|
|
|
|
if (PR_IP4_USER & ch_flags & (pr_flags ^ pr->pr_flags)) {
|
|
|
|
error = EINVAL;
|
|
|
|
vfs_opterror(opts,
|
|
|
|
"ip4 cannot be changed after creation");
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done_deref;
|
2009-07-30 14:28:56 +00:00
|
|
|
}
|
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
|
|
|
if (PR_IP6_USER & ch_flags & (pr_flags ^ pr->pr_flags)) {
|
|
|
|
error = EINVAL;
|
|
|
|
vfs_opterror(opts,
|
|
|
|
"ip6 cannot be changed after creation");
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done_deref;
|
2009-07-30 14:28:56 +00:00
|
|
|
}
|
|
|
|
#endif
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
/* Do final error checking before setting anything. */
|
2009-05-27 14:11:23 +00:00
|
|
|
if (gotslevel) {
|
|
|
|
if (slevel < ppr->pr_securelevel) {
|
|
|
|
error = EPERM;
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done_deref;
|
2009-05-27 14:11:23 +00:00
|
|
|
}
|
|
|
|
}
|
2009-06-23 20:35:51 +00:00
|
|
|
if (gotchildmax) {
|
|
|
|
if (childmax >= ppr->pr_childmax) {
|
|
|
|
error = EPERM;
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done_deref;
|
2009-06-23 20:35:51 +00:00
|
|
|
}
|
|
|
|
}
|
2009-05-27 14:11:23 +00:00
|
|
|
if (gotenforce) {
|
|
|
|
if (enforce < ppr->pr_enforce_statfs) {
|
|
|
|
error = EPERM;
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done_deref;
|
2009-05-27 14:11:23 +00:00
|
|
|
}
|
|
|
|
}
|
2012-02-09 10:22:08 +00:00
|
|
|
if (gotrsnum) {
|
|
|
|
/*
|
|
|
|
* devfs_rsnum is a uint16_t
|
|
|
|
*/
|
2012-02-23 18:51:24 +00:00
|
|
|
if (rsnum < 0 || rsnum > 65535) {
|
2012-02-09 10:22:08 +00:00
|
|
|
error = EINVAL;
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done_deref;
|
2012-02-09 10:22:08 +00:00
|
|
|
}
|
|
|
|
/*
|
2012-02-23 18:51:24 +00:00
|
|
|
* Nested jails always inherit parent's devfs ruleset
|
2012-02-09 10:22:08 +00:00
|
|
|
*/
|
|
|
|
if (jailed(td->td_ucred)) {
|
|
|
|
if (rsnum > 0 && rsnum != ppr->pr_devfs_rsnum) {
|
|
|
|
error = EPERM;
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done_deref;
|
2012-02-23 18:51:24 +00:00
|
|
|
} else
|
2012-02-09 10:22:08 +00:00
|
|
|
rsnum = ppr->pr_devfs_rsnum;
|
|
|
|
}
|
|
|
|
}
|
2009-04-29 21:14:15 +00:00
|
|
|
#ifdef INET
|
2009-07-30 14:28:56 +00:00
|
|
|
if (ip4s > 0) {
|
2021-12-26 18:45:50 +00:00
|
|
|
if ((ppr->pr_flags & PR_IP4) &&
|
|
|
|
!prison_ip_parent_match(ppr->pr_addrs[PR_INET], ip4,
|
|
|
|
PR_INET)) {
|
|
|
|
error = EPERM;
|
|
|
|
goto done_deref;
|
2009-05-27 14:11:23 +00:00
|
|
|
}
|
2021-12-26 18:45:50 +00:00
|
|
|
if (!prison_ip_conflict_check(ppr, pr, ip4, PR_INET)) {
|
|
|
|
error = EADDRINUSE;
|
|
|
|
vfs_opterror(opts, "IPv4 addresses clash");
|
|
|
|
goto done_deref;
|
2009-05-27 14:11:23 +00:00
|
|
|
}
|
|
|
|
}
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
#endif
|
2009-04-29 21:14:15 +00:00
|
|
|
#ifdef INET6
|
2009-07-30 14:28:56 +00:00
|
|
|
if (ip6s > 0) {
|
2021-12-26 18:45:50 +00:00
|
|
|
if ((ppr->pr_flags & PR_IP6) &&
|
|
|
|
!prison_ip_parent_match(ppr->pr_addrs[PR_INET6], ip6,
|
|
|
|
PR_INET6)) {
|
|
|
|
error = EPERM;
|
|
|
|
goto done_deref;
|
2009-05-27 14:11:23 +00:00
|
|
|
}
|
2021-12-26 18:45:50 +00:00
|
|
|
if (!prison_ip_conflict_check(ppr, pr, ip6, PR_INET6)) {
|
|
|
|
error = EADDRINUSE;
|
|
|
|
vfs_opterror(opts, "IPv6 addresses clash");
|
|
|
|
goto done_deref;
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
2009-05-27 14:11:23 +00:00
|
|
|
}
|
2009-04-29 21:14:15 +00:00
|
|
|
#endif
|
2009-05-27 14:11:23 +00:00
|
|
|
onamelen = namelen = 0;
|
2016-04-25 04:27:58 +00:00
|
|
|
if (namelc != NULL) {
|
2015-12-15 17:25:00 +00:00
|
|
|
/* Give a default name of the jid. Also allow the name to be
|
|
|
|
* explicitly the jid - but not any other number, and only in
|
|
|
|
* normal form (no leading zero/etc).
|
|
|
|
*/
|
2016-04-25 04:27:58 +00:00
|
|
|
if (namelc[0] == '\0')
|
|
|
|
snprintf(namelc = numbuf, sizeof(numbuf), "%d", jid);
|
2015-12-15 17:25:00 +00:00
|
|
|
else if ((strtoul(namelc, &p, 10) != jid ||
|
|
|
|
namelc[0] < '1' || namelc[0] > '9') && *p == '\0') {
|
2009-04-29 21:14:15 +00:00
|
|
|
error = EINVAL;
|
2009-09-04 19:00:48 +00:00
|
|
|
vfs_opterror(opts,
|
|
|
|
"name cannot be numeric (unless it is the jid)");
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done_deref;
|
2009-05-27 14:11:23 +00:00
|
|
|
}
|
2009-04-29 21:14:15 +00:00
|
|
|
/*
|
2009-05-27 14:11:23 +00:00
|
|
|
* Make sure the name isn't too long for the prison or its
|
|
|
|
* children.
|
2009-04-29 21:14:15 +00:00
|
|
|
*/
|
2016-04-25 04:27:58 +00:00
|
|
|
pnamelen = (ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1;
|
|
|
|
onamelen = strlen(pr->pr_name + pnamelen);
|
|
|
|
namelen = strlen(namelc);
|
|
|
|
if (pnamelen + namelen + 1 > sizeof(pr->pr_name)) {
|
2009-05-27 14:11:23 +00:00
|
|
|
error = ENAMETOOLONG;
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done_deref;
|
2009-05-27 14:11:23 +00:00
|
|
|
}
|
|
|
|
FOREACH_PRISON_DESCENDANT(pr, tpr, descend) {
|
|
|
|
if (strlen(tpr->pr_name) + (namelen - onamelen) >=
|
|
|
|
sizeof(pr->pr_name)) {
|
|
|
|
error = ENAMETOOLONG;
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done_deref;
|
2009-05-27 14:11:23 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2018-11-27 17:51:50 +00:00
|
|
|
pr_allow_diff = pr_allow & ~ppr->pr_allow;
|
|
|
|
if (pr_allow_diff & ~PR_ALLOW_DIFFERENCES) {
|
2009-05-27 14:11:23 +00:00
|
|
|
error = EPERM;
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done_deref;
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
|
2016-04-25 04:27:58 +00:00
|
|
|
/*
|
|
|
|
* Let modules check their parameters. This requires unlocking and
|
|
|
|
* then re-locking the prison, but this is still a valid state as long
|
|
|
|
* as allprison_lock remains xlocked.
|
|
|
|
*/
|
|
|
|
mtx_unlock(&pr->pr_mtx);
|
2021-01-10 05:05:06 +00:00
|
|
|
drflags &= ~PD_LOCKED;
|
2016-04-25 04:27:58 +00:00
|
|
|
error = osd_jail_call(pr, PR_METHOD_CHECK, opts);
|
2021-01-10 05:05:06 +00:00
|
|
|
if (error != 0)
|
|
|
|
goto done_deref;
|
2016-04-25 04:27:58 +00:00
|
|
|
mtx_lock(&pr->pr_mtx);
|
2021-01-10 05:05:06 +00:00
|
|
|
drflags |= PD_LOCKED;
|
2016-04-25 04:27:58 +00:00
|
|
|
|
|
|
|
/* At this point, all valid parameters should have been noted. */
|
|
|
|
TAILQ_FOREACH(opt, opts, link) {
|
|
|
|
if (!opt->seen && strcmp(opt->name, "errmsg")) {
|
|
|
|
error = EINVAL;
|
|
|
|
vfs_opterror(opts, "unknown parameter: %s", opt->name);
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done_deref;
|
2016-04-25 04:27:58 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
/* Set the parameters of the prison. */
|
|
|
|
#ifdef INET
|
2022-12-31 02:56:58 +00:00
|
|
|
redo_ip4 = false;
|
2009-07-30 14:28:56 +00:00
|
|
|
if (pr_flags & PR_IP4_USER) {
|
|
|
|
pr->pr_flags |= PR_IP4;
|
2021-12-26 18:45:50 +00:00
|
|
|
prison_ip_set(pr, PR_INET, ip4);
|
2009-07-30 14:28:56 +00:00
|
|
|
ip4 = NULL;
|
2009-05-27 14:11:23 +00:00
|
|
|
FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
|
2009-07-29 16:46:59 +00:00
|
|
|
#ifdef VIMAGE
|
|
|
|
if (tpr->pr_flags & PR_VNET) {
|
|
|
|
descend = 0;
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
#endif
|
2022-12-31 02:56:58 +00:00
|
|
|
if (!prison_ip_restrict(tpr, PR_INET, NULL)) {
|
|
|
|
redo_ip4 = true;
|
2009-05-27 14:11:23 +00:00
|
|
|
descend = 0;
|
|
|
|
}
|
|
|
|
}
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
2022-12-31 02:56:58 +00:00
|
|
|
redo_ip6 = false;
|
2009-07-30 14:28:56 +00:00
|
|
|
if (pr_flags & PR_IP6_USER) {
|
|
|
|
pr->pr_flags |= PR_IP6;
|
2021-12-26 18:45:50 +00:00
|
|
|
prison_ip_set(pr, PR_INET6, ip6);
|
2009-07-30 14:28:56 +00:00
|
|
|
ip6 = NULL;
|
2009-05-27 14:11:23 +00:00
|
|
|
FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
|
2009-07-29 16:46:59 +00:00
|
|
|
#ifdef VIMAGE
|
|
|
|
if (tpr->pr_flags & PR_VNET) {
|
|
|
|
descend = 0;
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
#endif
|
2022-12-31 02:56:58 +00:00
|
|
|
if (!prison_ip_restrict(tpr, PR_INET6, NULL)) {
|
|
|
|
redo_ip6 = true;
|
2009-05-27 14:11:23 +00:00
|
|
|
descend = 0;
|
|
|
|
}
|
|
|
|
}
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
}
|
2009-04-29 21:14:15 +00:00
|
|
|
#endif
|
2009-05-27 14:11:23 +00:00
|
|
|
if (gotslevel) {
|
2009-04-29 21:14:15 +00:00
|
|
|
pr->pr_securelevel = slevel;
|
2009-05-27 14:11:23 +00:00
|
|
|
/* Set all child jails to be at least this level. */
|
|
|
|
FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
|
|
|
|
if (tpr->pr_securelevel < slevel)
|
|
|
|
tpr->pr_securelevel = slevel;
|
|
|
|
}
|
2009-06-23 20:35:51 +00:00
|
|
|
if (gotchildmax) {
|
|
|
|
pr->pr_childmax = childmax;
|
|
|
|
/* Set all child jails to under this limit. */
|
|
|
|
FOREACH_PRISON_DESCENDANT_LOCKED_LEVEL(pr, tpr, descend, level)
|
|
|
|
if (tpr->pr_childmax > childmax - level)
|
|
|
|
tpr->pr_childmax = childmax > level
|
|
|
|
? childmax - level : 0;
|
|
|
|
}
|
2009-05-27 14:11:23 +00:00
|
|
|
if (gotenforce) {
|
|
|
|
pr->pr_enforce_statfs = enforce;
|
|
|
|
/* Pass this restriction on to the children. */
|
|
|
|
FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
|
|
|
|
if (tpr->pr_enforce_statfs < enforce)
|
|
|
|
tpr->pr_enforce_statfs = enforce;
|
|
|
|
}
|
2012-02-09 10:22:08 +00:00
|
|
|
if (gotrsnum) {
|
|
|
|
pr->pr_devfs_rsnum = rsnum;
|
|
|
|
/* Pass this restriction on to the children. */
|
|
|
|
FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
|
2012-02-23 18:51:24 +00:00
|
|
|
tpr->pr_devfs_rsnum = rsnum;
|
2012-02-09 10:22:08 +00:00
|
|
|
}
|
2016-04-25 04:27:58 +00:00
|
|
|
if (namelc != NULL) {
|
2009-05-27 14:11:23 +00:00
|
|
|
if (ppr == &prison0)
|
2016-04-25 04:27:58 +00:00
|
|
|
strlcpy(pr->pr_name, namelc, sizeof(pr->pr_name));
|
2009-05-27 14:11:23 +00:00
|
|
|
else
|
|
|
|
snprintf(pr->pr_name, sizeof(pr->pr_name), "%s.%s",
|
2016-04-25 04:27:58 +00:00
|
|
|
ppr->pr_name, namelc);
|
2009-05-27 14:11:23 +00:00
|
|
|
/* Change this component of child names. */
|
|
|
|
FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
|
|
|
|
bcopy(tpr->pr_name + onamelen, tpr->pr_name + namelen,
|
|
|
|
strlen(tpr->pr_name + onamelen) + 1);
|
|
|
|
bcopy(pr->pr_name, tpr->pr_name, namelen);
|
|
|
|
}
|
|
|
|
}
|
2009-04-29 21:14:15 +00:00
|
|
|
if (path != NULL) {
|
2009-05-27 14:11:23 +00:00
|
|
|
/* Try to keep a real-rooted full pathname. */
|
2020-02-08 15:51:08 +00:00
|
|
|
strlcpy(pr->pr_path, path, sizeof(pr->pr_path));
|
2009-04-29 21:14:15 +00:00
|
|
|
pr->pr_root = root;
|
2021-01-10 05:05:06 +00:00
|
|
|
root = NULL;
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
2009-05-29 21:27:12 +00:00
|
|
|
if (PR_HOST & ch_flags & ~pr_flags) {
|
|
|
|
if (pr->pr_flags & PR_HOST) {
|
|
|
|
/*
|
|
|
|
* Copy the parent's host info. As with pr_ip4 above,
|
|
|
|
* the lack of a lock on the parent is not a problem;
|
|
|
|
* it is always set with allprison_lock at least
|
|
|
|
* shared, and is held exclusively here.
|
|
|
|
*/
|
2009-06-13 15:39:12 +00:00
|
|
|
strlcpy(pr->pr_hostname, pr->pr_parent->pr_hostname,
|
|
|
|
sizeof(pr->pr_hostname));
|
|
|
|
strlcpy(pr->pr_domainname, pr->pr_parent->pr_domainname,
|
|
|
|
sizeof(pr->pr_domainname));
|
|
|
|
strlcpy(pr->pr_hostuuid, pr->pr_parent->pr_hostuuid,
|
|
|
|
sizeof(pr->pr_hostuuid));
|
2009-05-29 21:27:12 +00:00
|
|
|
pr->pr_hostid = pr->pr_parent->pr_hostid;
|
|
|
|
}
|
|
|
|
} else if (host != NULL || domain != NULL || uuid != NULL || gothid) {
|
|
|
|
/* Set this prison, and any descendants without PR_HOST. */
|
|
|
|
if (host != NULL)
|
2009-06-13 15:39:12 +00:00
|
|
|
strlcpy(pr->pr_hostname, host, sizeof(pr->pr_hostname));
|
2009-05-29 21:27:12 +00:00
|
|
|
if (domain != NULL)
|
2009-06-13 15:39:12 +00:00
|
|
|
strlcpy(pr->pr_domainname, domain,
|
|
|
|
sizeof(pr->pr_domainname));
|
2009-05-29 21:27:12 +00:00
|
|
|
if (uuid != NULL)
|
2009-06-13 15:39:12 +00:00
|
|
|
strlcpy(pr->pr_hostuuid, uuid, sizeof(pr->pr_hostuuid));
|
2009-05-29 21:27:12 +00:00
|
|
|
if (gothid)
|
|
|
|
pr->pr_hostid = hid;
|
|
|
|
FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
|
|
|
|
if (tpr->pr_flags & PR_HOST)
|
|
|
|
descend = 0;
|
|
|
|
else {
|
|
|
|
if (host != NULL)
|
2009-06-13 15:39:12 +00:00
|
|
|
strlcpy(tpr->pr_hostname,
|
|
|
|
pr->pr_hostname,
|
|
|
|
sizeof(tpr->pr_hostname));
|
2009-05-29 21:27:12 +00:00
|
|
|
if (domain != NULL)
|
2009-06-13 15:39:12 +00:00
|
|
|
strlcpy(tpr->pr_domainname,
|
|
|
|
pr->pr_domainname,
|
|
|
|
sizeof(tpr->pr_domainname));
|
2009-05-29 21:27:12 +00:00
|
|
|
if (uuid != NULL)
|
2009-06-13 15:39:12 +00:00
|
|
|
strlcpy(tpr->pr_hostuuid,
|
|
|
|
pr->pr_hostuuid,
|
|
|
|
sizeof(tpr->pr_hostuuid));
|
2009-05-29 21:27:12 +00:00
|
|
|
if (gothid)
|
|
|
|
tpr->pr_hostid = hid;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2009-05-27 14:11:23 +00:00
|
|
|
pr->pr_allow = (pr->pr_allow & ~ch_allow) | pr_allow;
|
2020-12-27 04:25:02 +00:00
|
|
|
if ((tallow = ch_allow & ~pr_allow))
|
|
|
|
prison_set_allow_locked(pr, tallow, 0);
|
2009-04-29 21:14:15 +00:00
|
|
|
/*
|
|
|
|
* Persistent prisons get an extra reference, and prisons losing their
|
2021-02-21 21:24:47 +00:00
|
|
|
* persist flag lose that reference.
|
2009-04-29 21:14:15 +00:00
|
|
|
*/
|
jail: Add prison_isvalid() and prison_isalive()
prison_isvalid() checks if a prison record can be used at all, i.e.
pr_ref > 0. This filters out prisons that aren't fully created, and
those that are either in the process of being dismantled, or will be
at the next opportunity. While the check for pr_ref > 0 is simple
enough to make without a convenience function, this prepares the way
for other measures of prison validity.
prison_isalive() checks not only validity as far as the useablity of
the prison structure, but also whether the prison is visible to user
space. It replaces a test for pr_uref > 0, which is currently only
used within kern_jail.c, and not often there.
Both of these functions also assert that either the prison mutex or
allprison_lock is held, since it's generally the case that unlocked
prisons aren't guaranteed to remain useable for any length of time.
This isn't entirely true, for example a thread can assume its own
prison is good, but most exceptions will exist inside of kern_jail.c.
2021-01-18 18:56:20 +00:00
|
|
|
born = !prison_isalive(pr);
|
2021-02-21 21:24:47 +00:00
|
|
|
if (ch_flags & PR_PERSIST & (pr_flags ^ pr->pr_flags)) {
|
2009-04-29 21:14:15 +00:00
|
|
|
if (pr_flags & PR_PERSIST) {
|
2021-01-20 23:08:27 +00:00
|
|
|
prison_hold(pr);
|
2021-02-21 21:24:47 +00:00
|
|
|
/*
|
|
|
|
* This may make a dead prison alive again, but wait
|
|
|
|
* to label it as such until after OSD calls have had
|
|
|
|
* a chance to run (and perhaps to fail).
|
|
|
|
*/
|
2021-01-20 23:08:27 +00:00
|
|
|
refcount_acquire(&pr->pr_uref);
|
2009-04-29 21:14:15 +00:00
|
|
|
} else {
|
2021-01-22 18:50:10 +00:00
|
|
|
drflags |= PD_DEUREF;
|
2021-02-21 18:55:44 +00:00
|
|
|
prison_free_not_last(pr);
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
pr->pr_flags = (pr->pr_flags & ~ch_flags) | pr_flags;
|
|
|
|
mtx_unlock(&pr->pr_mtx);
|
2021-01-10 05:05:06 +00:00
|
|
|
drflags &= ~PD_LOCKED;
|
2021-02-25 05:54:49 +00:00
|
|
|
/*
|
|
|
|
* Any errors past this point will need to de-persist newly created
|
|
|
|
* prisons, as well as call remove methods.
|
|
|
|
*/
|
|
|
|
if (born)
|
|
|
|
drflags |= PD_KILL;
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
|
2011-05-03 07:32:58 +00:00
|
|
|
#ifdef RACCT
|
2015-04-29 10:23:02 +00:00
|
|
|
if (racct_enable && created)
|
2011-05-03 07:32:58 +00:00
|
|
|
prison_racct_attach(pr);
|
|
|
|
#endif
|
|
|
|
|
2009-05-27 14:11:23 +00:00
|
|
|
/* Locks may have prevented a complete restriction of child IP
|
|
|
|
* addresses. If so, allocate some more memory and try again.
|
|
|
|
*/
|
|
|
|
#ifdef INET
|
|
|
|
while (redo_ip4) {
|
2021-12-26 18:45:50 +00:00
|
|
|
ip4s = pr->pr_addrs[PR_INET]->ips;
|
2022-12-31 02:56:58 +00:00
|
|
|
MPASS(ip4 == NULL);
|
2021-12-26 18:45:50 +00:00
|
|
|
ip4 = prison_ip_alloc(PR_INET, ip4s, M_WAITOK);
|
2009-05-27 14:11:23 +00:00
|
|
|
mtx_lock(&pr->pr_mtx);
|
2022-12-31 02:56:58 +00:00
|
|
|
redo_ip4 = false;
|
2009-05-27 14:11:23 +00:00
|
|
|
FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
|
2009-07-29 16:46:59 +00:00
|
|
|
#ifdef VIMAGE
|
|
|
|
if (tpr->pr_flags & PR_VNET) {
|
|
|
|
descend = 0;
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
#endif
|
2023-02-21 15:43:25 +00:00
|
|
|
if (!prison_ip_restrict(tpr, PR_INET, &ip4))
|
|
|
|
redo_ip4 = true;
|
2009-05-27 14:11:23 +00:00
|
|
|
}
|
|
|
|
mtx_unlock(&pr->pr_mtx);
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
|
|
|
while (redo_ip6) {
|
2021-12-26 18:45:50 +00:00
|
|
|
ip6s = pr->pr_addrs[PR_INET6]->ips;
|
2022-12-31 02:56:58 +00:00
|
|
|
MPASS(ip6 == NULL);
|
2021-12-26 18:45:50 +00:00
|
|
|
ip6 = prison_ip_alloc(PR_INET6, ip6s, M_WAITOK);
|
2009-05-27 14:11:23 +00:00
|
|
|
mtx_lock(&pr->pr_mtx);
|
2022-12-31 02:56:58 +00:00
|
|
|
redo_ip6 = false;
|
2009-05-27 14:11:23 +00:00
|
|
|
FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
|
2009-07-29 16:46:59 +00:00
|
|
|
#ifdef VIMAGE
|
|
|
|
if (tpr->pr_flags & PR_VNET) {
|
|
|
|
descend = 0;
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
#endif
|
2023-02-21 15:43:25 +00:00
|
|
|
if (!prison_ip_restrict(tpr, PR_INET6, &ip6))
|
|
|
|
redo_ip6 = true;
|
2009-05-27 14:11:23 +00:00
|
|
|
}
|
|
|
|
mtx_unlock(&pr->pr_mtx);
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
/* Let the modules do their work. */
|
2016-04-25 04:24:00 +00:00
|
|
|
if (born) {
|
2009-04-29 21:14:15 +00:00
|
|
|
error = osd_jail_call(pr, PR_METHOD_CREATE, opts);
|
2021-02-25 05:54:49 +00:00
|
|
|
if (error)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done_deref;
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
|
|
|
error = osd_jail_call(pr, PR_METHOD_SET, opts);
|
2021-02-25 05:54:49 +00:00
|
|
|
if (error)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done_deref;
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
|
2021-02-21 21:24:47 +00:00
|
|
|
/*
|
|
|
|
* A new prison is now ready to be seen; either it has gained a user
|
|
|
|
* reference via persistence, or is about to gain one via attachment.
|
|
|
|
*/
|
|
|
|
if (born) {
|
|
|
|
drflags = prison_lock_xlock(pr, drflags);
|
|
|
|
pr->pr_state = PRISON_STATE_ALIVE;
|
|
|
|
}
|
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
/* Attach this process to the prison if requested. */
|
|
|
|
if (flags & JAIL_ATTACH) {
|
2021-02-25 05:54:49 +00:00
|
|
|
error = do_jail_attach(td, pr,
|
2021-02-26 04:10:42 +00:00
|
|
|
prison_lock_xlock(pr, drflags & PD_LOCK_FLAGS));
|
2021-02-21 18:55:44 +00:00
|
|
|
drflags &= ~(PD_LOCKED | PD_LIST_XLOCKED);
|
2009-04-29 21:14:15 +00:00
|
|
|
if (error) {
|
|
|
|
vfs_opterror(opts, "attach failed");
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done_deref;
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2012-05-22 19:43:20 +00:00
|
|
|
#ifdef RACCT
|
2015-04-29 10:23:02 +00:00
|
|
|
if (racct_enable && !created) {
|
2021-02-22 23:51:10 +00:00
|
|
|
if (drflags & PD_LOCKED) {
|
|
|
|
mtx_unlock(&pr->pr_mtx);
|
|
|
|
drflags &= ~PD_LOCKED;
|
|
|
|
}
|
2021-02-21 18:55:44 +00:00
|
|
|
if (drflags & PD_LIST_XLOCKED) {
|
|
|
|
sx_xunlock(&allprison_lock);
|
|
|
|
drflags &= ~PD_LIST_XLOCKED;
|
2020-12-31 23:18:43 +00:00
|
|
|
}
|
2012-05-22 19:43:20 +00:00
|
|
|
prison_racct_modify(pr);
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2022-12-17 21:43:49 +00:00
|
|
|
if (born && pr != &prison0 && (pr->pr_allow & PR_ALLOW_NFSD) != 0 &&
|
|
|
|
(pr->pr_root->v_vflag & VV_ROOT) == 0)
|
|
|
|
printf("Warning jail jid=%d: mountd/nfsd requires a separate"
|
|
|
|
" file system\n", pr->pr_id);
|
|
|
|
|
2021-02-25 05:54:49 +00:00
|
|
|
drflags &= ~PD_KILL;
|
2012-05-22 19:43:20 +00:00
|
|
|
td->td_retval[0] = pr->pr_id;
|
|
|
|
|
2021-01-10 05:05:06 +00:00
|
|
|
done_deref:
|
|
|
|
/* Release any temporary prison holds and/or locks. */
|
|
|
|
if (pr != NULL)
|
|
|
|
prison_deref(pr, drflags);
|
|
|
|
else if (drflags & PD_LIST_SLOCKED)
|
|
|
|
sx_sunlock(&allprison_lock);
|
|
|
|
else if (drflags & PD_LIST_XLOCKED)
|
|
|
|
sx_xunlock(&allprison_lock);
|
2012-10-22 17:50:54 +00:00
|
|
|
if (root != NULL)
|
2009-04-29 21:14:15 +00:00
|
|
|
vrele(root);
|
|
|
|
done_errmsg:
|
|
|
|
if (error) {
|
2021-01-10 05:05:06 +00:00
|
|
|
/* Write the error message back to userspace. */
|
2016-06-09 20:39:57 +00:00
|
|
|
if (vfs_getopt(opts, "errmsg", (void **)&errmsg,
|
|
|
|
&errmsg_len) == 0 && errmsg_len > 0) {
|
2009-04-29 21:14:15 +00:00
|
|
|
errmsg_pos = 2 * vfs_getopt_pos(opts, "errmsg") + 1;
|
2016-06-09 20:39:57 +00:00
|
|
|
if (optuio->uio_segflg == UIO_SYSSPACE)
|
|
|
|
bcopy(errmsg,
|
|
|
|
optuio->uio_iov[errmsg_pos].iov_base,
|
|
|
|
errmsg_len);
|
|
|
|
else
|
|
|
|
copyout(errmsg,
|
|
|
|
optuio->uio_iov[errmsg_pos].iov_base,
|
|
|
|
errmsg_len);
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
done_free:
|
|
|
|
#ifdef INET
|
2021-12-26 18:45:50 +00:00
|
|
|
prison_ip_free(ip4);
|
2009-04-29 21:14:15 +00:00
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
2021-12-26 18:45:50 +00:00
|
|
|
prison_ip_free(ip6);
|
2009-04-29 21:14:15 +00:00
|
|
|
#endif
|
2012-01-21 00:06:21 +00:00
|
|
|
if (g_path != NULL)
|
|
|
|
free(g_path, M_TEMP);
|
2009-04-29 21:14:15 +00:00
|
|
|
vfs_freeopts(opts);
|
|
|
|
return (error);
|
|
|
|
}
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
|
2020-12-26 18:39:34 +00:00
|
|
|
/*
|
|
|
|
* Find the next available prison ID. Return the ID on success, or zero
|
|
|
|
* on failure. Also set a pointer to the allprison list entry the prison
|
|
|
|
* should be inserted before.
|
|
|
|
*/
|
|
|
|
static int
|
|
|
|
get_next_prid(struct prison **insprp)
|
|
|
|
{
|
|
|
|
struct prison *inspr;
|
|
|
|
int jid, maxid;
|
|
|
|
|
|
|
|
jid = lastprid % JAIL_MAX + 1;
|
|
|
|
if (TAILQ_EMPTY(&allprison) ||
|
|
|
|
TAILQ_LAST(&allprison, prisonlist)->pr_id < jid) {
|
|
|
|
/*
|
|
|
|
* A common case is for all jails to be implicitly numbered,
|
|
|
|
* which means they'll go on the end of the list, at least
|
|
|
|
* for the first JAIL_MAX times.
|
|
|
|
*/
|
|
|
|
inspr = NULL;
|
|
|
|
} else {
|
|
|
|
/*
|
|
|
|
* Take two passes through the allprison list: first starting
|
|
|
|
* with the proposed jid, then ending with it.
|
|
|
|
*/
|
|
|
|
for (maxid = JAIL_MAX; maxid != 0; ) {
|
|
|
|
TAILQ_FOREACH(inspr, &allprison, pr_list) {
|
|
|
|
if (inspr->pr_id < jid)
|
|
|
|
continue;
|
2021-02-21 18:55:44 +00:00
|
|
|
if (inspr->pr_id > jid) {
|
|
|
|
/* Found an opening. */
|
2020-12-26 18:39:34 +00:00
|
|
|
maxid = 0;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
if (++jid > maxid) {
|
|
|
|
if (lastprid == maxid || lastprid == 0)
|
|
|
|
{
|
|
|
|
/*
|
|
|
|
* The entire legal range
|
|
|
|
* has been traversed
|
|
|
|
*/
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
/* Try again from the start. */
|
|
|
|
jid = 1;
|
|
|
|
maxid = lastprid;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (inspr == NULL) {
|
|
|
|
/* Found room at the end of the list. */
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
*insprp = inspr;
|
|
|
|
lastprid = jid;
|
|
|
|
return (jid);
|
|
|
|
}
|
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
/*
|
|
|
|
* struct jail_get_args {
|
|
|
|
* struct iovec *iovp;
|
|
|
|
* unsigned int iovcnt;
|
|
|
|
* int flags;
|
|
|
|
* };
|
|
|
|
*/
|
|
|
|
int
|
2011-09-16 13:58:51 +00:00
|
|
|
sys_jail_get(struct thread *td, struct jail_get_args *uap)
|
2009-04-29 21:14:15 +00:00
|
|
|
{
|
|
|
|
struct uio *auio;
|
|
|
|
int error;
|
|
|
|
|
|
|
|
/* Check that we have an even number of iovecs. */
|
|
|
|
if (uap->iovcnt & 1)
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
return (EINVAL);
|
2009-04-29 21:14:15 +00:00
|
|
|
|
|
|
|
error = copyinuio(uap->iovp, uap->iovcnt, &auio);
|
|
|
|
if (error)
|
|
|
|
return (error);
|
|
|
|
error = kern_jail_get(td, auio, uap->flags);
|
|
|
|
if (error == 0)
|
|
|
|
error = copyout(auio->uio_iov, uap->iovp,
|
|
|
|
uap->iovcnt * sizeof (struct iovec));
|
|
|
|
free(auio, M_IOV);
|
|
|
|
return (error);
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
int
|
2009-04-29 21:14:15 +00:00
|
|
|
kern_jail_get(struct thread *td, struct uio *optuio, int flags)
|
This Implements the mumbled about "Jail" feature.
This is a seriously beefed up chroot kind of thing. The process
is jailed along the same lines as a chroot does it, but with
additional tough restrictions imposed on what the superuser can do.
For all I know, it is safe to hand over the root bit inside a
prison to the customer living in that prison, this is what
it was developed for in fact: "real virtual servers".
Each prison has an ip number associated with it, which all IP
communications will be coerced to use and each prison has its own
hostname.
Needless to say, you need more RAM this way, but the advantage is
that each customer can run their own particular version of apache
and not stomp on the toes of their neighbors.
It generally does what one would expect, but setting up a jail
still takes a little knowledge.
A few notes:
I have no scripts for setting up a jail, don't ask me for them.
The IP number should be an alias on one of the interfaces.
mount a /proc in each jail, it will make ps more useable.
/proc/<pid>/status tells the hostname of the prison for
jailed processes.
Quotas are only sensible if you have a mountpoint per prison.
There are no privisions for stopping resource-hogging.
Some "#ifdef INET" and similar may be missing (send patches!)
If somebody wants to take it from here and develop it into
more of a "virtual machine" they should be most welcome!
Tools, comments, patches & documentation most welcome.
Have fun...
Sponsored by: http://www.rndassociates.com/
Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
|
|
|
{
|
2018-03-20 23:08:42 +00:00
|
|
|
struct bool_flags *bf;
|
|
|
|
struct jailsys_flags *jsf;
|
2009-05-27 14:11:23 +00:00
|
|
|
struct prison *pr, *mypr;
|
2009-04-29 21:14:15 +00:00
|
|
|
struct vfsopt *opt;
|
|
|
|
struct vfsoptlist *opts;
|
|
|
|
char *errmsg, *name;
|
2021-01-10 05:05:06 +00:00
|
|
|
int drflags, error, errmsg_len, errmsg_pos, i, jid, len, pos;
|
2018-03-20 23:08:42 +00:00
|
|
|
unsigned f;
|
This Implements the mumbled about "Jail" feature.
This is a seriously beefed up chroot kind of thing. The process
is jailed along the same lines as a chroot does it, but with
additional tough restrictions imposed on what the superuser can do.
For all I know, it is safe to hand over the root bit inside a
prison to the customer living in that prison, this is what
it was developed for in fact: "real virtual servers".
Each prison has an ip number associated with it, which all IP
communications will be coerced to use and each prison has its own
hostname.
Needless to say, you need more RAM this way, but the advantage is
that each customer can run their own particular version of apache
and not stomp on the toes of their neighbors.
It generally does what one would expect, but setting up a jail
still takes a little knowledge.
A few notes:
I have no scripts for setting up a jail, don't ask me for them.
The IP number should be an alias on one of the interfaces.
mount a /proc in each jail, it will make ps more useable.
/proc/<pid>/status tells the hostname of the prison for
jailed processes.
Quotas are only sensible if you have a mountpoint per prison.
There are no privisions for stopping resource-hogging.
Some "#ifdef INET" and similar may be missing (send patches!)
If somebody wants to take it from here and develop it into
more of a "virtual machine" they should be most welcome!
Tools, comments, patches & documentation most welcome.
Have fun...
Sponsored by: http://www.rndassociates.com/
Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
if (flags & ~JAIL_GET_MASK)
|
|
|
|
return (EINVAL);
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
/* Get the parameter list. */
|
|
|
|
error = vfs_buildopts(optuio, &opts);
|
This Implements the mumbled about "Jail" feature.
This is a seriously beefed up chroot kind of thing. The process
is jailed along the same lines as a chroot does it, but with
additional tough restrictions imposed on what the superuser can do.
For all I know, it is safe to hand over the root bit inside a
prison to the customer living in that prison, this is what
it was developed for in fact: "real virtual servers".
Each prison has an ip number associated with it, which all IP
communications will be coerced to use and each prison has its own
hostname.
Needless to say, you need more RAM this way, but the advantage is
that each customer can run their own particular version of apache
and not stomp on the toes of their neighbors.
It generally does what one would expect, but setting up a jail
still takes a little knowledge.
A few notes:
I have no scripts for setting up a jail, don't ask me for them.
The IP number should be an alias on one of the interfaces.
mount a /proc in each jail, it will make ps more useable.
/proc/<pid>/status tells the hostname of the prison for
jailed processes.
Quotas are only sensible if you have a mountpoint per prison.
There are no privisions for stopping resource-hogging.
Some "#ifdef INET" and similar may be missing (send patches!)
If somebody wants to take it from here and develop it into
more of a "virtual machine" they should be most welcome!
Tools, comments, patches & documentation most welcome.
Have fun...
Sponsored by: http://www.rndassociates.com/
Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
|
|
|
if (error)
|
2001-10-11 23:39:43 +00:00
|
|
|
return (error);
|
2009-04-29 21:14:15 +00:00
|
|
|
errmsg_pos = vfs_getopt_pos(opts, "errmsg");
|
2009-05-27 14:11:23 +00:00
|
|
|
mypr = td->td_ucred->cr_prison;
|
2021-01-10 05:05:06 +00:00
|
|
|
pr = NULL;
|
2009-05-23 16:13:26 +00:00
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
/*
|
|
|
|
* Find the prison specified by one of: lastjid, jid, name.
|
|
|
|
*/
|
|
|
|
sx_slock(&allprison_lock);
|
2021-01-10 05:05:06 +00:00
|
|
|
drflags = PD_LIST_SLOCKED;
|
2009-04-29 21:14:15 +00:00
|
|
|
error = vfs_copyopt(opts, "lastjid", &jid, sizeof(jid));
|
|
|
|
if (error == 0) {
|
|
|
|
TAILQ_FOREACH(pr, &allprison, pr_list) {
|
2021-02-21 18:55:44 +00:00
|
|
|
if (pr->pr_id > jid &&
|
|
|
|
((flags & JAIL_DYING) || prison_isalive(pr)) &&
|
|
|
|
prison_ischild(mypr, pr)) {
|
2009-04-29 21:14:15 +00:00
|
|
|
mtx_lock(&pr->pr_mtx);
|
2021-02-21 18:55:44 +00:00
|
|
|
drflags |= PD_LOCKED;
|
|
|
|
goto found_prison;
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
error = ENOENT;
|
|
|
|
vfs_opterror(opts, "no jail after %d", jid);
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-04-29 21:14:15 +00:00
|
|
|
} else if (error != ENOENT)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-04-29 21:14:15 +00:00
|
|
|
|
|
|
|
error = vfs_copyopt(opts, "jid", &jid, sizeof(jid));
|
|
|
|
if (error == 0) {
|
|
|
|
if (jid != 0) {
|
2009-05-27 14:11:23 +00:00
|
|
|
pr = prison_find_child(mypr, jid);
|
2009-04-29 21:14:15 +00:00
|
|
|
if (pr != NULL) {
|
2021-01-10 05:05:06 +00:00
|
|
|
drflags |= PD_LOCKED;
|
jail: Add prison_isvalid() and prison_isalive()
prison_isvalid() checks if a prison record can be used at all, i.e.
pr_ref > 0. This filters out prisons that aren't fully created, and
those that are either in the process of being dismantled, or will be
at the next opportunity. While the check for pr_ref > 0 is simple
enough to make without a convenience function, this prepares the way
for other measures of prison validity.
prison_isalive() checks not only validity as far as the useablity of
the prison structure, but also whether the prison is visible to user
space. It replaces a test for pr_uref > 0, which is currently only
used within kern_jail.c, and not often there.
Both of these functions also assert that either the prison mutex or
allprison_lock is held, since it's generally the case that unlocked
prisons aren't guaranteed to remain useable for any length of time.
This isn't entirely true, for example a thread can assume its own
prison is good, but most exceptions will exist inside of kern_jail.c.
2021-01-18 18:56:20 +00:00
|
|
|
if (!(prison_isalive(pr) ||
|
|
|
|
(flags & JAIL_DYING))) {
|
2009-04-29 21:14:15 +00:00
|
|
|
error = ENOENT;
|
|
|
|
vfs_opterror(opts, "jail %d is dying",
|
|
|
|
jid);
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
|
|
|
goto found_prison;
|
|
|
|
}
|
|
|
|
error = ENOENT;
|
|
|
|
vfs_opterror(opts, "jail %d not found", jid);
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
|
|
|
} else if (error != ENOENT)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-04-29 21:14:15 +00:00
|
|
|
|
|
|
|
error = vfs_getopt(opts, "name", (void **)&name, &len);
|
|
|
|
if (error == 0) {
|
|
|
|
if (len == 0 || name[len - 1] != '\0') {
|
|
|
|
error = EINVAL;
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
2009-05-27 14:11:23 +00:00
|
|
|
pr = prison_find_name(mypr, name);
|
2009-04-29 21:14:15 +00:00
|
|
|
if (pr != NULL) {
|
2021-01-10 05:05:06 +00:00
|
|
|
drflags |= PD_LOCKED;
|
jail: Add prison_isvalid() and prison_isalive()
prison_isvalid() checks if a prison record can be used at all, i.e.
pr_ref > 0. This filters out prisons that aren't fully created, and
those that are either in the process of being dismantled, or will be
at the next opportunity. While the check for pr_ref > 0 is simple
enough to make without a convenience function, this prepares the way
for other measures of prison validity.
prison_isalive() checks not only validity as far as the useablity of
the prison structure, but also whether the prison is visible to user
space. It replaces a test for pr_uref > 0, which is currently only
used within kern_jail.c, and not often there.
Both of these functions also assert that either the prison mutex or
allprison_lock is held, since it's generally the case that unlocked
prisons aren't guaranteed to remain useable for any length of time.
This isn't entirely true, for example a thread can assume its own
prison is good, but most exceptions will exist inside of kern_jail.c.
2021-01-18 18:56:20 +00:00
|
|
|
if (!(prison_isalive(pr) || (flags & JAIL_DYING))) {
|
2009-04-29 21:14:15 +00:00
|
|
|
error = ENOENT;
|
|
|
|
vfs_opterror(opts, "jail \"%s\" is dying",
|
|
|
|
name);
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
|
|
|
goto found_prison;
|
|
|
|
}
|
|
|
|
error = ENOENT;
|
|
|
|
vfs_opterror(opts, "jail \"%s\" not found", name);
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-04-29 21:14:15 +00:00
|
|
|
} else if (error != ENOENT)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-04-29 21:14:15 +00:00
|
|
|
|
|
|
|
vfs_opterror(opts, "no jail specified");
|
|
|
|
error = ENOENT;
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-04-29 21:14:15 +00:00
|
|
|
|
|
|
|
found_prison:
|
|
|
|
/* Get the parameters of the prison. */
|
2021-01-20 23:08:27 +00:00
|
|
|
prison_hold(pr);
|
2021-01-10 05:05:06 +00:00
|
|
|
drflags |= PD_DEREF;
|
2009-04-29 21:14:15 +00:00
|
|
|
td->td_retval[0] = pr->pr_id;
|
|
|
|
error = vfs_setopt(opts, "jid", &pr->pr_id, sizeof(pr->pr_id));
|
|
|
|
if (error != 0 && error != ENOENT)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-05-27 14:11:23 +00:00
|
|
|
i = (pr->pr_parent == mypr) ? 0 : pr->pr_parent->pr_id;
|
|
|
|
error = vfs_setopt(opts, "parent", &i, sizeof(i));
|
|
|
|
if (error != 0 && error != ENOENT)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-05-27 14:11:23 +00:00
|
|
|
error = vfs_setopts(opts, "name", prison_name(mypr, pr));
|
2009-04-29 21:14:15 +00:00
|
|
|
if (error != 0 && error != ENOENT)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-05-27 14:11:23 +00:00
|
|
|
error = vfs_setopt(opts, "cpuset.id", &pr->pr_cpuset->cs_id,
|
2009-04-29 21:14:15 +00:00
|
|
|
sizeof(pr->pr_cpuset->cs_id));
|
|
|
|
if (error != 0 && error != ENOENT)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-05-27 14:11:23 +00:00
|
|
|
error = vfs_setopts(opts, "path", prison_path(mypr, pr));
|
2009-04-29 21:14:15 +00:00
|
|
|
if (error != 0 && error != ENOENT)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-04-29 21:14:15 +00:00
|
|
|
#ifdef INET
|
2023-02-28 10:01:33 +00:00
|
|
|
error = vfs_setopt_part(opts, "ip4.addr", pr->pr_addrs[PR_INET]->pr_ip,
|
2021-12-26 18:45:50 +00:00
|
|
|
pr->pr_addrs[PR_INET] ? pr->pr_addrs[PR_INET]->ips *
|
|
|
|
pr_families[PR_INET].size : 0 );
|
2009-04-29 21:14:15 +00:00
|
|
|
if (error != 0 && error != ENOENT)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-04-29 21:14:15 +00:00
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
2023-02-28 10:01:33 +00:00
|
|
|
error = vfs_setopt_part(opts, "ip6.addr", pr->pr_addrs[PR_INET6]->pr_ip,
|
2021-12-26 18:45:50 +00:00
|
|
|
pr->pr_addrs[PR_INET6] ? pr->pr_addrs[PR_INET6]->ips *
|
|
|
|
pr_families[PR_INET6].size : 0 );
|
2009-04-29 21:14:15 +00:00
|
|
|
if (error != 0 && error != ENOENT)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-04-29 21:14:15 +00:00
|
|
|
#endif
|
|
|
|
error = vfs_setopt(opts, "securelevel", &pr->pr_securelevel,
|
|
|
|
sizeof(pr->pr_securelevel));
|
|
|
|
if (error != 0 && error != ENOENT)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-06-23 20:35:51 +00:00
|
|
|
error = vfs_setopt(opts, "children.cur", &pr->pr_childcount,
|
|
|
|
sizeof(pr->pr_childcount));
|
|
|
|
if (error != 0 && error != ENOENT)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-06-23 20:35:51 +00:00
|
|
|
error = vfs_setopt(opts, "children.max", &pr->pr_childmax,
|
|
|
|
sizeof(pr->pr_childmax));
|
|
|
|
if (error != 0 && error != ENOENT)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-06-13 15:39:12 +00:00
|
|
|
error = vfs_setopts(opts, "host.hostname", pr->pr_hostname);
|
2009-05-29 21:27:12 +00:00
|
|
|
if (error != 0 && error != ENOENT)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-06-13 15:39:12 +00:00
|
|
|
error = vfs_setopts(opts, "host.domainname", pr->pr_domainname);
|
2009-05-29 21:27:12 +00:00
|
|
|
if (error != 0 && error != ENOENT)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-06-13 15:39:12 +00:00
|
|
|
error = vfs_setopts(opts, "host.hostuuid", pr->pr_hostuuid);
|
2009-05-29 21:27:12 +00:00
|
|
|
if (error != 0 && error != ENOENT)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2010-03-11 14:49:06 +00:00
|
|
|
#ifdef COMPAT_FREEBSD32
|
2011-01-26 20:03:58 +00:00
|
|
|
if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) {
|
2009-05-29 21:27:12 +00:00
|
|
|
uint32_t hid32 = pr->pr_hostid;
|
|
|
|
|
|
|
|
error = vfs_setopt(opts, "host.hostid", &hid32, sizeof(hid32));
|
|
|
|
} else
|
|
|
|
#endif
|
|
|
|
error = vfs_setopt(opts, "host.hostid", &pr->pr_hostid,
|
|
|
|
sizeof(pr->pr_hostid));
|
2009-04-29 21:14:15 +00:00
|
|
|
if (error != 0 && error != ENOENT)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-05-27 14:11:23 +00:00
|
|
|
error = vfs_setopt(opts, "enforce_statfs", &pr->pr_enforce_statfs,
|
|
|
|
sizeof(pr->pr_enforce_statfs));
|
2009-04-29 21:14:15 +00:00
|
|
|
if (error != 0 && error != ENOENT)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2012-02-09 10:22:08 +00:00
|
|
|
error = vfs_setopt(opts, "devfs_ruleset", &pr->pr_devfs_rsnum,
|
|
|
|
sizeof(pr->pr_devfs_rsnum));
|
|
|
|
if (error != 0 && error != ENOENT)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2018-03-20 23:08:42 +00:00
|
|
|
for (bf = pr_flag_bool;
|
|
|
|
bf < pr_flag_bool + nitems(pr_flag_bool);
|
|
|
|
bf++) {
|
|
|
|
i = (pr->pr_flags & bf->flag) ? 1 : 0;
|
|
|
|
error = vfs_setopt(opts, bf->name, &i, sizeof(i));
|
2009-05-27 14:11:23 +00:00
|
|
|
if (error != 0 && error != ENOENT)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-05-27 14:11:23 +00:00
|
|
|
i = !i;
|
2018-03-20 23:08:42 +00:00
|
|
|
error = vfs_setopt(opts, bf->noname, &i, sizeof(i));
|
2009-05-27 14:11:23 +00:00
|
|
|
if (error != 0 && error != ENOENT)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-05-27 14:11:23 +00:00
|
|
|
}
|
2018-03-20 23:08:42 +00:00
|
|
|
for (jsf = pr_flag_jailsys;
|
|
|
|
jsf < pr_flag_jailsys + nitems(pr_flag_jailsys);
|
|
|
|
jsf++) {
|
|
|
|
f = pr->pr_flags & (jsf->disable | jsf->new);
|
|
|
|
i = (f != 0 && f == jsf->disable) ? JAIL_SYS_DISABLE
|
|
|
|
: (f == jsf->new) ? JAIL_SYS_NEW
|
2009-07-25 14:48:57 +00:00
|
|
|
: JAIL_SYS_INHERIT;
|
2018-03-20 23:08:42 +00:00
|
|
|
error = vfs_setopt(opts, jsf->name, &i, sizeof(i));
|
2009-07-25 14:48:57 +00:00
|
|
|
if (error != 0 && error != ENOENT)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-07-25 14:48:57 +00:00
|
|
|
}
|
2018-03-20 23:08:42 +00:00
|
|
|
for (bf = pr_flag_allow;
|
2020-12-26 20:53:28 +00:00
|
|
|
bf < pr_flag_allow + nitems(pr_flag_allow) &&
|
|
|
|
atomic_load_int(&bf->flag) != 0;
|
2018-03-20 23:08:42 +00:00
|
|
|
bf++) {
|
|
|
|
i = (pr->pr_allow & bf->flag) ? 1 : 0;
|
|
|
|
error = vfs_setopt(opts, bf->name, &i, sizeof(i));
|
2009-05-27 14:11:23 +00:00
|
|
|
if (error != 0 && error != ENOENT)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-05-27 14:11:23 +00:00
|
|
|
i = !i;
|
2018-03-20 23:08:42 +00:00
|
|
|
error = vfs_setopt(opts, bf->noname, &i, sizeof(i));
|
2009-05-27 14:11:23 +00:00
|
|
|
if (error != 0 && error != ENOENT)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-05-27 14:11:23 +00:00
|
|
|
}
|
jail: Add prison_isvalid() and prison_isalive()
prison_isvalid() checks if a prison record can be used at all, i.e.
pr_ref > 0. This filters out prisons that aren't fully created, and
those that are either in the process of being dismantled, or will be
at the next opportunity. While the check for pr_ref > 0 is simple
enough to make without a convenience function, this prepares the way
for other measures of prison validity.
prison_isalive() checks not only validity as far as the useablity of
the prison structure, but also whether the prison is visible to user
space. It replaces a test for pr_uref > 0, which is currently only
used within kern_jail.c, and not often there.
Both of these functions also assert that either the prison mutex or
allprison_lock is held, since it's generally the case that unlocked
prisons aren't guaranteed to remain useable for any length of time.
This isn't entirely true, for example a thread can assume its own
prison is good, but most exceptions will exist inside of kern_jail.c.
2021-01-18 18:56:20 +00:00
|
|
|
i = !prison_isalive(pr);
|
2009-04-29 21:14:15 +00:00
|
|
|
error = vfs_setopt(opts, "dying", &i, sizeof(i));
|
|
|
|
if (error != 0 && error != ENOENT)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-04-29 21:14:15 +00:00
|
|
|
i = !i;
|
|
|
|
error = vfs_setopt(opts, "nodying", &i, sizeof(i));
|
2015-02-28 17:32:31 +00:00
|
|
|
if (error != 0 && error != ENOENT)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2015-02-28 17:44:31 +00:00
|
|
|
error = vfs_setopt(opts, "osreldate", &pr->pr_osreldate,
|
|
|
|
sizeof(pr->pr_osreldate));
|
2015-02-28 17:32:31 +00:00
|
|
|
if (error != 0 && error != ENOENT)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2015-02-28 17:32:31 +00:00
|
|
|
error = vfs_setopts(opts, "osrelease", pr->pr_osrelease);
|
2009-04-29 21:14:15 +00:00
|
|
|
if (error != 0 && error != ENOENT)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-04-29 21:14:15 +00:00
|
|
|
|
|
|
|
/* Get the module parameters. */
|
|
|
|
mtx_unlock(&pr->pr_mtx);
|
2021-01-10 05:05:06 +00:00
|
|
|
drflags &= ~PD_LOCKED;
|
2009-04-29 21:14:15 +00:00
|
|
|
error = osd_jail_call(pr, PR_METHOD_GET, opts);
|
2001-10-11 23:39:43 +00:00
|
|
|
if (error)
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
|
|
|
prison_deref(pr, drflags);
|
|
|
|
pr = NULL;
|
|
|
|
drflags = 0;
|
2009-04-29 21:14:15 +00:00
|
|
|
|
|
|
|
/* By now, all parameters should have been noted. */
|
|
|
|
TAILQ_FOREACH(opt, opts, link) {
|
|
|
|
if (!opt->seen && strcmp(opt->name, "errmsg")) {
|
|
|
|
error = EINVAL;
|
|
|
|
vfs_opterror(opts, "unknown parameter: %s", opt->name);
|
2021-01-10 05:05:06 +00:00
|
|
|
goto done;
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
}
|
2009-04-29 21:14:15 +00:00
|
|
|
|
|
|
|
/* Write the fetched parameters back to userspace. */
|
|
|
|
error = 0;
|
|
|
|
TAILQ_FOREACH(opt, opts, link) {
|
|
|
|
if (opt->pos >= 0 && opt->pos != errmsg_pos) {
|
|
|
|
pos = 2 * opt->pos + 1;
|
|
|
|
optuio->uio_iov[pos].iov_len = opt->len;
|
|
|
|
if (opt->value != NULL) {
|
|
|
|
if (optuio->uio_segflg == UIO_SYSSPACE) {
|
|
|
|
bcopy(opt->value,
|
|
|
|
optuio->uio_iov[pos].iov_base,
|
|
|
|
opt->len);
|
|
|
|
} else {
|
|
|
|
error = copyout(opt->value,
|
|
|
|
optuio->uio_iov[pos].iov_base,
|
|
|
|
opt->len);
|
|
|
|
if (error)
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
}
|
2009-04-29 21:14:15 +00:00
|
|
|
|
2021-01-10 05:05:06 +00:00
|
|
|
done:
|
|
|
|
/* Release any temporary prison holds and/or locks. */
|
|
|
|
if (pr != NULL)
|
|
|
|
prison_deref(pr, drflags);
|
|
|
|
else if (drflags & PD_LIST_SLOCKED)
|
|
|
|
sx_sunlock(&allprison_lock);
|
2009-04-29 21:14:15 +00:00
|
|
|
if (error && errmsg_pos >= 0) {
|
2021-01-10 05:05:06 +00:00
|
|
|
/* Write the error message back to userspace. */
|
2009-04-29 21:14:15 +00:00
|
|
|
vfs_getopt(opts, "errmsg", (void **)&errmsg, &errmsg_len);
|
|
|
|
errmsg_pos = 2 * errmsg_pos + 1;
|
|
|
|
if (errmsg_len > 0) {
|
|
|
|
if (optuio->uio_segflg == UIO_SYSSPACE)
|
|
|
|
bcopy(errmsg,
|
|
|
|
optuio->uio_iov[errmsg_pos].iov_base,
|
|
|
|
errmsg_len);
|
|
|
|
else
|
|
|
|
copyout(errmsg,
|
|
|
|
optuio->uio_iov[errmsg_pos].iov_base,
|
|
|
|
errmsg_len);
|
|
|
|
}
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
}
|
2009-04-29 21:14:15 +00:00
|
|
|
vfs_freeopts(opts);
|
|
|
|
return (error);
|
|
|
|
}
|
2003-04-09 02:55:18 +00:00
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
/*
|
|
|
|
* struct jail_remove_args {
|
|
|
|
* int jid;
|
|
|
|
* };
|
|
|
|
*/
|
|
|
|
int
|
2011-09-16 13:58:51 +00:00
|
|
|
sys_jail_remove(struct thread *td, struct jail_remove_args *uap)
|
2009-04-29 21:14:15 +00:00
|
|
|
{
|
2021-02-25 05:54:49 +00:00
|
|
|
struct prison *pr;
|
|
|
|
int error;
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
error = priv_check(td, PRIV_JAIL_REMOVE);
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
if (error)
|
2009-04-29 21:14:15 +00:00
|
|
|
return (error);
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
|
2007-04-05 23:19:13 +00:00
|
|
|
sx_xlock(&allprison_lock);
|
2009-05-27 14:11:23 +00:00
|
|
|
pr = prison_find_child(td->td_ucred->cr_prison, uap->jid);
|
2009-04-29 21:14:15 +00:00
|
|
|
if (pr == NULL) {
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
sx_xunlock(&allprison_lock);
|
2009-04-29 21:14:15 +00:00
|
|
|
return (EINVAL);
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
}
|
2021-02-25 05:54:49 +00:00
|
|
|
if (!prison_isalive(pr)) {
|
|
|
|
/* Silently ignore already-dying prisons. */
|
2009-05-27 14:11:23 +00:00
|
|
|
mtx_unlock(&pr->pr_mtx);
|
2021-02-25 05:54:49 +00:00
|
|
|
sx_xunlock(&allprison_lock);
|
|
|
|
return (0);
|
2009-05-27 14:11:23 +00:00
|
|
|
}
|
2021-02-25 05:54:49 +00:00
|
|
|
prison_deref(pr, PD_KILL | PD_LOCKED | PD_LIST_XLOCKED);
|
2009-05-27 14:11:23 +00:00
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
2003-04-09 02:55:18 +00:00
|
|
|
/*
|
2003-04-28 18:32:19 +00:00
|
|
|
* struct jail_attach_args {
|
|
|
|
* int jid;
|
|
|
|
* };
|
2003-04-09 02:55:18 +00:00
|
|
|
*/
|
|
|
|
int
|
2011-09-16 13:58:51 +00:00
|
|
|
sys_jail_attach(struct thread *td, struct jail_attach_args *uap)
|
2003-04-09 02:55:18 +00:00
|
|
|
{
|
|
|
|
struct prison *pr;
|
2009-04-29 21:14:15 +00:00
|
|
|
int error;
|
2007-03-07 21:24:51 +00:00
|
|
|
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
error = priv_check(td, PRIV_JAIL_ATTACH);
|
2004-02-19 21:03:20 +00:00
|
|
|
if (error)
|
|
|
|
return (error);
|
2003-04-09 02:55:18 +00:00
|
|
|
|
2021-02-21 18:55:44 +00:00
|
|
|
sx_slock(&allprison_lock);
|
2009-05-27 14:11:23 +00:00
|
|
|
pr = prison_find_child(td->td_ucred->cr_prison, uap->jid);
|
2003-04-09 02:55:18 +00:00
|
|
|
if (pr == NULL) {
|
2007-04-05 23:19:13 +00:00
|
|
|
sx_sunlock(&allprison_lock);
|
2003-04-09 02:55:18 +00:00
|
|
|
return (EINVAL);
|
|
|
|
}
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
|
jail: Add prison_isvalid() and prison_isalive()
prison_isvalid() checks if a prison record can be used at all, i.e.
pr_ref > 0. This filters out prisons that aren't fully created, and
those that are either in the process of being dismantled, or will be
at the next opportunity. While the check for pr_ref > 0 is simple
enough to make without a convenience function, this prepares the way
for other measures of prison validity.
prison_isalive() checks not only validity as far as the useablity of
the prison structure, but also whether the prison is visible to user
space. It replaces a test for pr_uref > 0, which is currently only
used within kern_jail.c, and not often there.
Both of these functions also assert that either the prison mutex or
allprison_lock is held, since it's generally the case that unlocked
prisons aren't guaranteed to remain useable for any length of time.
This isn't entirely true, for example a thread can assume its own
prison is good, but most exceptions will exist inside of kern_jail.c.
2021-01-18 18:56:20 +00:00
|
|
|
/* Do not allow a process to attach to a prison that is not alive. */
|
|
|
|
if (!prison_isalive(pr)) {
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
mtx_unlock(&pr->pr_mtx);
|
|
|
|
sx_sunlock(&allprison_lock);
|
|
|
|
return (EINVAL);
|
|
|
|
}
|
2009-04-29 21:14:15 +00:00
|
|
|
|
2021-02-21 18:55:44 +00:00
|
|
|
return (do_jail_attach(td, pr, PD_LOCKED | PD_LIST_SLOCKED));
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
2021-02-21 18:55:44 +00:00
|
|
|
do_jail_attach(struct thread *td, struct prison *pr, int drflags)
|
2009-04-29 21:14:15 +00:00
|
|
|
{
|
|
|
|
struct proc *p;
|
|
|
|
struct ucred *newcred, *oldcred;
|
2012-10-22 17:50:54 +00:00
|
|
|
int error;
|
2009-04-29 21:14:15 +00:00
|
|
|
|
2021-02-21 18:55:44 +00:00
|
|
|
mtx_assert(&pr->pr_mtx, MA_OWNED);
|
|
|
|
sx_assert(&allprison_lock, SX_LOCKED);
|
2021-02-26 04:10:42 +00:00
|
|
|
drflags &= PD_LOCK_FLAGS;
|
2009-04-29 21:14:15 +00:00
|
|
|
/*
|
|
|
|
* XXX: Note that there is a slight race here if two threads
|
|
|
|
* in the same privileged process attempt to attach to two
|
|
|
|
* different jails at the same time. It is important for
|
|
|
|
* user processes not to do this, or they might end up with
|
|
|
|
* a process root from one prison, but attached to the jail
|
|
|
|
* of another.
|
|
|
|
*/
|
2021-02-21 21:24:47 +00:00
|
|
|
prison_hold(pr);
|
2021-01-20 23:08:27 +00:00
|
|
|
refcount_acquire(&pr->pr_uref);
|
2021-02-21 18:55:44 +00:00
|
|
|
drflags |= PD_DEREF | PD_DEUREF;
|
2003-04-09 02:55:18 +00:00
|
|
|
mtx_unlock(&pr->pr_mtx);
|
2021-02-21 18:55:44 +00:00
|
|
|
drflags &= ~PD_LOCKED;
|
2009-04-29 21:14:15 +00:00
|
|
|
|
|
|
|
/* Let modules do whatever they need to prepare for attaching. */
|
|
|
|
error = osd_jail_call(pr, PR_METHOD_ATTACH, td);
|
|
|
|
if (error) {
|
2021-02-21 18:55:44 +00:00
|
|
|
prison_deref(pr, drflags);
|
2009-04-29 21:14:15 +00:00
|
|
|
return (error);
|
|
|
|
}
|
2021-02-21 18:55:44 +00:00
|
|
|
sx_unlock(&allprison_lock);
|
|
|
|
drflags &= ~(PD_LIST_SLOCKED | PD_LIST_XLOCKED);
|
2003-04-09 02:55:18 +00:00
|
|
|
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
/*
|
|
|
|
* Reparent the newly attached process to this jail.
|
|
|
|
*/
|
2009-04-29 21:14:15 +00:00
|
|
|
p = td->td_proc;
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
error = cpuset_setproc_update_set(p, pr->pr_cpuset);
|
|
|
|
if (error)
|
2009-04-29 21:14:15 +00:00
|
|
|
goto e_revert_osd;
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
|
2008-01-10 01:10:58 +00:00
|
|
|
vn_lock(pr->pr_root, LK_EXCLUSIVE | LK_RETRY);
|
2003-04-09 02:55:18 +00:00
|
|
|
if ((error = change_dir(pr->pr_root, td)) != 0)
|
|
|
|
goto e_unlock;
|
|
|
|
#ifdef MAC
|
2007-10-24 19:04:04 +00:00
|
|
|
if ((error = mac_vnode_check_chroot(td->td_ucred, pr->pr_root)))
|
2003-04-09 02:55:18 +00:00
|
|
|
goto e_unlock;
|
|
|
|
#endif
|
2020-01-03 22:29:58 +00:00
|
|
|
VOP_UNLOCK(pr->pr_root);
|
2021-02-19 22:13:35 +00:00
|
|
|
if ((error = pwd_chroot_chdir(td, pr->pr_root)))
|
2012-10-22 17:50:54 +00:00
|
|
|
goto e_revert_osd;
|
2003-04-09 02:55:18 +00:00
|
|
|
|
2001-10-11 23:39:43 +00:00
|
|
|
newcred = crget();
|
|
|
|
PROC_LOCK(p);
|
2016-04-26 21:19:12 +00:00
|
|
|
oldcred = crcopysafe(p, newcred);
|
2003-04-17 22:26:53 +00:00
|
|
|
newcred->cr_prison = pr;
|
2015-03-16 00:10:03 +00:00
|
|
|
proc_set_cred(p, newcred);
|
2016-04-26 21:19:12 +00:00
|
|
|
setsugid(p);
|
2011-03-29 17:47:25 +00:00
|
|
|
#ifdef RACCT
|
|
|
|
racct_proc_ucred_changed(p, oldcred, newcred);
|
2018-04-20 13:08:04 +00:00
|
|
|
crhold(newcred);
|
|
|
|
#endif
|
|
|
|
PROC_UNLOCK(p);
|
|
|
|
#ifdef RCTL
|
|
|
|
rctl_proc_ucred_changed(p, newcred);
|
|
|
|
crfree(newcred);
|
2011-03-29 17:47:25 +00:00
|
|
|
#endif
|
2022-03-10 18:42:37 +00:00
|
|
|
prison_proc_relink(oldcred->cr_prison, pr, p);
|
2021-02-21 18:55:44 +00:00
|
|
|
prison_deref(oldcred->cr_prison, drflags);
|
2001-10-11 23:39:43 +00:00
|
|
|
crfree(oldcred);
|
2021-02-16 19:19:13 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* If the prison was killed while changing credentials, die along
|
|
|
|
* with it.
|
|
|
|
*/
|
|
|
|
if (!prison_isalive(pr)) {
|
|
|
|
PROC_LOCK(p);
|
|
|
|
kern_psignal(p, SIGKILL);
|
|
|
|
PROC_UNLOCK(p);
|
|
|
|
}
|
|
|
|
|
This Implements the mumbled about "Jail" feature.
This is a seriously beefed up chroot kind of thing. The process
is jailed along the same lines as a chroot does it, but with
additional tough restrictions imposed on what the superuser can do.
For all I know, it is safe to hand over the root bit inside a
prison to the customer living in that prison, this is what
it was developed for in fact: "real virtual servers".
Each prison has an ip number associated with it, which all IP
communications will be coerced to use and each prison has its own
hostname.
Needless to say, you need more RAM this way, but the advantage is
that each customer can run their own particular version of apache
and not stomp on the toes of their neighbors.
It generally does what one would expect, but setting up a jail
still takes a little knowledge.
A few notes:
I have no scripts for setting up a jail, don't ask me for them.
The IP number should be an alias on one of the interfaces.
mount a /proc in each jail, it will make ps more useable.
/proc/<pid>/status tells the hostname of the prison for
jailed processes.
Quotas are only sensible if you have a mountpoint per prison.
There are no privisions for stopping resource-hogging.
Some "#ifdef INET" and similar may be missing (send patches!)
If somebody wants to take it from here and develop it into
more of a "virtual machine" they should be most welcome!
Tools, comments, patches & documentation most welcome.
Have fun...
Sponsored by: http://www.rndassociates.com/
Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
|
|
|
return (0);
|
2016-04-26 21:19:12 +00:00
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
e_unlock:
|
2020-01-03 22:29:58 +00:00
|
|
|
VOP_UNLOCK(pr->pr_root);
|
2009-04-29 21:14:15 +00:00
|
|
|
e_revert_osd:
|
|
|
|
/* Tell modules this thread is still in its old jail after all. */
|
2020-12-27 04:49:30 +00:00
|
|
|
sx_slock(&allprison_lock);
|
2021-02-21 18:55:44 +00:00
|
|
|
drflags |= PD_LIST_SLOCKED;
|
2016-04-26 21:19:12 +00:00
|
|
|
(void)osd_jail_call(td->td_ucred->cr_prison, PR_METHOD_ATTACH, td);
|
2021-02-21 18:55:44 +00:00
|
|
|
prison_deref(pr, drflags);
|
This Implements the mumbled about "Jail" feature.
This is a seriously beefed up chroot kind of thing. The process
is jailed along the same lines as a chroot does it, but with
additional tough restrictions imposed on what the superuser can do.
For all I know, it is safe to hand over the root bit inside a
prison to the customer living in that prison, this is what
it was developed for in fact: "real virtual servers".
Each prison has an ip number associated with it, which all IP
communications will be coerced to use and each prison has its own
hostname.
Needless to say, you need more RAM this way, but the advantage is
that each customer can run their own particular version of apache
and not stomp on the toes of their neighbors.
It generally does what one would expect, but setting up a jail
still takes a little knowledge.
A few notes:
I have no scripts for setting up a jail, don't ask me for them.
The IP number should be an alias on one of the interfaces.
mount a /proc in each jail, it will make ps more useable.
/proc/<pid>/status tells the hostname of the prison for
jailed processes.
Quotas are only sensible if you have a mountpoint per prison.
There are no privisions for stopping resource-hogging.
Some "#ifdef INET" and similar may be missing (send patches!)
If somebody wants to take it from here and develop it into
more of a "virtual machine" they should be most welcome!
Tools, comments, patches & documentation most welcome.
Have fun...
Sponsored by: http://www.rndassociates.com/
Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
|
|
|
return (error);
|
|
|
|
}
|
|
|
|
|
2003-04-09 02:55:18 +00:00
|
|
|
/*
|
|
|
|
* Returns a locked prison instance, or NULL on failure.
|
|
|
|
*/
|
2007-04-05 21:34:54 +00:00
|
|
|
struct prison *
|
2003-04-09 02:55:18 +00:00
|
|
|
prison_find(int prid)
|
|
|
|
{
|
|
|
|
struct prison *pr;
|
|
|
|
|
2007-04-05 23:19:13 +00:00
|
|
|
sx_assert(&allprison_lock, SX_LOCKED);
|
2009-04-29 21:14:15 +00:00
|
|
|
TAILQ_FOREACH(pr, &allprison, pr_list) {
|
2021-02-21 18:55:44 +00:00
|
|
|
if (pr->pr_id < prid)
|
|
|
|
continue;
|
2020-12-26 18:39:34 +00:00
|
|
|
if (pr->pr_id > prid)
|
|
|
|
break;
|
2021-02-21 18:55:44 +00:00
|
|
|
KASSERT(prison_isvalid(pr), ("Found invalid prison %p", pr));
|
|
|
|
mtx_lock(&pr->pr_mtx);
|
|
|
|
return (pr);
|
2003-04-09 02:55:18 +00:00
|
|
|
}
|
|
|
|
return (NULL);
|
|
|
|
}
|
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
/*
|
2009-05-27 14:11:23 +00:00
|
|
|
* Find a prison that is a descendant of mypr. Returns a locked prison or NULL.
|
|
|
|
*/
|
|
|
|
struct prison *
|
|
|
|
prison_find_child(struct prison *mypr, int prid)
|
|
|
|
{
|
|
|
|
struct prison *pr;
|
|
|
|
int descend;
|
|
|
|
|
|
|
|
sx_assert(&allprison_lock, SX_LOCKED);
|
|
|
|
FOREACH_PRISON_DESCENDANT(mypr, pr, descend) {
|
|
|
|
if (pr->pr_id == prid) {
|
2021-02-21 18:55:44 +00:00
|
|
|
KASSERT(prison_isvalid(pr),
|
|
|
|
("Found invalid prison %p", pr));
|
2009-05-27 14:11:23 +00:00
|
|
|
mtx_lock(&pr->pr_mtx);
|
2021-02-21 18:55:44 +00:00
|
|
|
return (pr);
|
2009-05-27 14:11:23 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
return (NULL);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Look for the name relative to mypr. Returns a locked prison or NULL.
|
2009-04-29 21:14:15 +00:00
|
|
|
*/
|
|
|
|
struct prison *
|
2009-05-27 14:11:23 +00:00
|
|
|
prison_find_name(struct prison *mypr, const char *name)
|
2009-04-29 21:14:15 +00:00
|
|
|
{
|
|
|
|
struct prison *pr, *deadpr;
|
2009-05-27 14:11:23 +00:00
|
|
|
size_t mylen;
|
|
|
|
int descend;
|
2009-04-29 21:14:15 +00:00
|
|
|
|
|
|
|
sx_assert(&allprison_lock, SX_LOCKED);
|
2009-05-27 14:11:23 +00:00
|
|
|
mylen = (mypr == &prison0) ? 0 : strlen(mypr->pr_name) + 1;
|
2009-04-29 21:14:15 +00:00
|
|
|
deadpr = NULL;
|
2009-05-27 14:11:23 +00:00
|
|
|
FOREACH_PRISON_DESCENDANT(mypr, pr, descend) {
|
|
|
|
if (!strcmp(pr->pr_name + mylen, name)) {
|
2021-02-21 18:55:44 +00:00
|
|
|
KASSERT(prison_isvalid(pr),
|
|
|
|
("Found invalid prison %p", pr));
|
|
|
|
if (prison_isalive(pr)) {
|
|
|
|
mtx_lock(&pr->pr_mtx);
|
jail: Add prison_isvalid() and prison_isalive()
prison_isvalid() checks if a prison record can be used at all, i.e.
pr_ref > 0. This filters out prisons that aren't fully created, and
those that are either in the process of being dismantled, or will be
at the next opportunity. While the check for pr_ref > 0 is simple
enough to make without a convenience function, this prepares the way
for other measures of prison validity.
prison_isalive() checks not only validity as far as the useablity of
the prison structure, but also whether the prison is visible to user
space. It replaces a test for pr_uref > 0, which is currently only
used within kern_jail.c, and not often there.
Both of these functions also assert that either the prison mutex or
allprison_lock is held, since it's generally the case that unlocked
prisons aren't guaranteed to remain useable for any length of time.
This isn't entirely true, for example a thread can assume its own
prison is good, but most exceptions will exist inside of kern_jail.c.
2021-01-18 18:56:20 +00:00
|
|
|
return (pr);
|
2021-02-21 18:55:44 +00:00
|
|
|
}
|
|
|
|
deadpr = pr;
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
|
|
|
}
|
2009-05-27 14:11:23 +00:00
|
|
|
/* There was no valid prison - perhaps there was a dying one. */
|
2021-02-21 18:55:44 +00:00
|
|
|
if (deadpr != NULL)
|
2009-04-29 21:14:15 +00:00
|
|
|
mtx_lock(&deadpr->pr_mtx);
|
|
|
|
return (deadpr);
|
|
|
|
}
|
|
|
|
|
2009-05-27 14:11:23 +00:00
|
|
|
/*
|
2020-12-27 04:25:02 +00:00
|
|
|
* See if a prison has the specific flag set. The prison should be locked,
|
|
|
|
* unless checking for flags that are only set at jail creation (such as
|
|
|
|
* PR_IP4 and PR_IP6), or only the single bit is examined, without regard
|
|
|
|
* to any other prison data.
|
2009-05-27 14:11:23 +00:00
|
|
|
*/
|
2023-03-15 03:04:40 +00:00
|
|
|
bool
|
2009-05-27 14:11:23 +00:00
|
|
|
prison_flag(struct ucred *cred, unsigned flag)
|
|
|
|
{
|
|
|
|
|
2023-03-15 03:04:40 +00:00
|
|
|
return ((cred->cr_prison->pr_flags & flag) != 0);
|
2009-05-27 14:11:23 +00:00
|
|
|
}
|
|
|
|
|
2023-03-15 03:04:40 +00:00
|
|
|
/*
|
|
|
|
* See if a prison has the specific allow flag set.
|
|
|
|
* The prison *should* be locked, or only a single bit is examined, without
|
|
|
|
* regard to any other prison data.
|
|
|
|
*/
|
|
|
|
bool
|
2009-05-27 14:11:23 +00:00
|
|
|
prison_allow(struct ucred *cred, unsigned flag)
|
|
|
|
{
|
|
|
|
|
2020-12-27 04:25:02 +00:00
|
|
|
return ((cred->cr_prison->pr_allow & flag) != 0);
|
2009-05-27 14:11:23 +00:00
|
|
|
}
|
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
/*
|
2021-01-19 01:23:51 +00:00
|
|
|
* Hold a prison reference, by incrementing pr_ref. It is generally
|
|
|
|
* an error to hold a prison that does not already have a reference.
|
|
|
|
* A prison record will remain valid as long as it has at least one
|
|
|
|
* reference, and will not be removed as long as either the prison
|
|
|
|
* mutex or the allprison lock is held (allprison_lock may be shared).
|
|
|
|
*/
|
|
|
|
void
|
|
|
|
prison_hold_locked(struct prison *pr)
|
|
|
|
{
|
|
|
|
|
2021-01-20 23:08:27 +00:00
|
|
|
/* Locking is no longer required. */
|
|
|
|
prison_hold(pr);
|
2021-01-19 01:23:51 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void
|
|
|
|
prison_hold(struct prison *pr)
|
|
|
|
{
|
2021-01-20 23:08:27 +00:00
|
|
|
#ifdef INVARIANTS
|
|
|
|
int was_valid = refcount_acquire_if_not_zero(&pr->pr_ref);
|
2021-01-19 01:23:51 +00:00
|
|
|
|
2021-01-20 23:08:27 +00:00
|
|
|
KASSERT(was_valid,
|
|
|
|
("Trying to hold dead prison %p (jid=%d).", pr, pr->pr_id));
|
|
|
|
#else
|
|
|
|
refcount_acquire(&pr->pr_ref);
|
|
|
|
#endif
|
2021-01-19 01:23:51 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Remove a prison reference. If that was the last reference, the
|
2021-02-21 18:55:44 +00:00
|
|
|
* prison will be removed (at a later time).
|
2009-04-29 21:14:15 +00:00
|
|
|
*/
|
2001-02-21 06:39:57 +00:00
|
|
|
void
|
Update ZFS from version 6 to 13 and bring some FreeBSD-specific changes.
This bring huge amount of changes, I'll enumerate only user-visible changes:
- Delegated Administration
Allows regular users to perform ZFS operations, like file system
creation, snapshot creation, etc.
- L2ARC
Level 2 cache for ZFS - allows to use additional disks for cache.
Huge performance improvements mostly for random read of mostly
static content.
- slog
Allow to use additional disks for ZFS Intent Log to speed up
operations like fsync(2).
- vfs.zfs.super_owner
Allows regular users to perform privileged operations on files stored
on ZFS file systems owned by him. Very careful with this one.
- chflags(2)
Not all the flags are supported. This still needs work.
- ZFSBoot
Support to boot off of ZFS pool. Not finished, AFAIK.
Submitted by: dfr
- Snapshot properties
- New failure modes
Before if write requested failed, system paniced. Now one
can select from one of three failure modes:
- panic - panic on write error
- wait - wait for disk to reappear
- continue - serve read requests if possible, block write requests
- Refquota, refreservation properties
Just quota and reservation properties, but don't count space consumed
by children file systems, clones and snapshots.
- Sparse volumes
ZVOLs that don't reserve space in the pool.
- External attributes
Compatible with extattr(2).
- NFSv4-ACLs
Not sure about the status, might not be complete yet.
Submitted by: trasz
- Creation-time properties
- Regression tests for zpool(8) command.
Obtained from: OpenSolaris
2008-11-17 20:49:29 +00:00
|
|
|
prison_free_locked(struct prison *pr)
|
2001-02-21 06:39:57 +00:00
|
|
|
{
|
|
|
|
|
Update ZFS from version 6 to 13 and bring some FreeBSD-specific changes.
This bring huge amount of changes, I'll enumerate only user-visible changes:
- Delegated Administration
Allows regular users to perform ZFS operations, like file system
creation, snapshot creation, etc.
- L2ARC
Level 2 cache for ZFS - allows to use additional disks for cache.
Huge performance improvements mostly for random read of mostly
static content.
- slog
Allow to use additional disks for ZFS Intent Log to speed up
operations like fsync(2).
- vfs.zfs.super_owner
Allows regular users to perform privileged operations on files stored
on ZFS file systems owned by him. Very careful with this one.
- chflags(2)
Not all the flags are supported. This still needs work.
- ZFSBoot
Support to boot off of ZFS pool. Not finished, AFAIK.
Submitted by: dfr
- Snapshot properties
- New failure modes
Before if write requested failed, system paniced. Now one
can select from one of three failure modes:
- panic - panic on write error
- wait - wait for disk to reappear
- continue - serve read requests if possible, block write requests
- Refquota, refreservation properties
Just quota and reservation properties, but don't count space consumed
by children file systems, clones and snapshots.
- Sparse volumes
ZVOLs that don't reserve space in the pool.
- External attributes
Compatible with extattr(2).
- NFSv4-ACLs
Not sure about the status, might not be complete yet.
Submitted by: trasz
- Creation-time properties
- Regression tests for zpool(8) command.
Obtained from: OpenSolaris
2008-11-17 20:49:29 +00:00
|
|
|
mtx_assert(&pr->pr_mtx, MA_OWNED);
|
2021-02-21 18:55:44 +00:00
|
|
|
/*
|
|
|
|
* Locking is no longer required, but unlock because the caller
|
|
|
|
* expects it.
|
|
|
|
*/
|
|
|
|
mtx_unlock(&pr->pr_mtx);
|
|
|
|
prison_free(pr);
|
|
|
|
}
|
|
|
|
|
|
|
|
void
|
|
|
|
prison_free(struct prison *pr)
|
|
|
|
{
|
|
|
|
|
2021-01-20 23:08:27 +00:00
|
|
|
KASSERT(refcount_load(&pr->pr_ref) > 0,
|
|
|
|
("Trying to free dead prison %p (jid=%d).",
|
|
|
|
pr, pr->pr_id));
|
2021-02-21 18:55:44 +00:00
|
|
|
if (!refcount_release_if_not_last(&pr->pr_ref)) {
|
2021-01-19 01:23:51 +00:00
|
|
|
/*
|
2021-02-21 18:55:44 +00:00
|
|
|
* Don't remove the last reference in this context,
|
2021-01-19 01:23:51 +00:00
|
|
|
* in case there are locks held.
|
|
|
|
*/
|
2016-04-27 02:25:21 +00:00
|
|
|
taskqueue_enqueue(taskqueue_thread, &pr->pr_task);
|
2021-01-19 01:23:51 +00:00
|
|
|
}
|
2001-02-21 06:39:57 +00:00
|
|
|
}
|
|
|
|
|
2021-02-21 18:55:44 +00:00
|
|
|
static void
|
|
|
|
prison_free_not_last(struct prison *pr)
|
Update ZFS from version 6 to 13 and bring some FreeBSD-specific changes.
This bring huge amount of changes, I'll enumerate only user-visible changes:
- Delegated Administration
Allows regular users to perform ZFS operations, like file system
creation, snapshot creation, etc.
- L2ARC
Level 2 cache for ZFS - allows to use additional disks for cache.
Huge performance improvements mostly for random read of mostly
static content.
- slog
Allow to use additional disks for ZFS Intent Log to speed up
operations like fsync(2).
- vfs.zfs.super_owner
Allows regular users to perform privileged operations on files stored
on ZFS file systems owned by him. Very careful with this one.
- chflags(2)
Not all the flags are supported. This still needs work.
- ZFSBoot
Support to boot off of ZFS pool. Not finished, AFAIK.
Submitted by: dfr
- Snapshot properties
- New failure modes
Before if write requested failed, system paniced. Now one
can select from one of three failure modes:
- panic - panic on write error
- wait - wait for disk to reappear
- continue - serve read requests if possible, block write requests
- Refquota, refreservation properties
Just quota and reservation properties, but don't count space consumed
by children file systems, clones and snapshots.
- Sparse volumes
ZVOLs that don't reserve space in the pool.
- External attributes
Compatible with extattr(2).
- NFSv4-ACLs
Not sure about the status, might not be complete yet.
Submitted by: trasz
- Creation-time properties
- Regression tests for zpool(8) command.
Obtained from: OpenSolaris
2008-11-17 20:49:29 +00:00
|
|
|
{
|
2021-02-21 18:55:44 +00:00
|
|
|
#ifdef INVARIANTS
|
|
|
|
int lastref;
|
Update ZFS from version 6 to 13 and bring some FreeBSD-specific changes.
This bring huge amount of changes, I'll enumerate only user-visible changes:
- Delegated Administration
Allows regular users to perform ZFS operations, like file system
creation, snapshot creation, etc.
- L2ARC
Level 2 cache for ZFS - allows to use additional disks for cache.
Huge performance improvements mostly for random read of mostly
static content.
- slog
Allow to use additional disks for ZFS Intent Log to speed up
operations like fsync(2).
- vfs.zfs.super_owner
Allows regular users to perform privileged operations on files stored
on ZFS file systems owned by him. Very careful with this one.
- chflags(2)
Not all the flags are supported. This still needs work.
- ZFSBoot
Support to boot off of ZFS pool. Not finished, AFAIK.
Submitted by: dfr
- Snapshot properties
- New failure modes
Before if write requested failed, system paniced. Now one
can select from one of three failure modes:
- panic - panic on write error
- wait - wait for disk to reappear
- continue - serve read requests if possible, block write requests
- Refquota, refreservation properties
Just quota and reservation properties, but don't count space consumed
by children file systems, clones and snapshots.
- Sparse volumes
ZVOLs that don't reserve space in the pool.
- External attributes
Compatible with extattr(2).
- NFSv4-ACLs
Not sure about the status, might not be complete yet.
Submitted by: trasz
- Creation-time properties
- Regression tests for zpool(8) command.
Obtained from: OpenSolaris
2008-11-17 20:49:29 +00:00
|
|
|
|
2021-01-20 23:08:27 +00:00
|
|
|
KASSERT(refcount_load(&pr->pr_ref) > 0,
|
|
|
|
("Trying to free dead prison %p (jid=%d).",
|
|
|
|
pr, pr->pr_id));
|
2021-02-21 18:55:44 +00:00
|
|
|
lastref = refcount_release(&pr->pr_ref);
|
|
|
|
KASSERT(!lastref,
|
|
|
|
("prison_free_not_last freed last ref on prison %p (jid=%d).",
|
|
|
|
pr, pr->pr_id));
|
|
|
|
#else
|
2021-02-21 19:57:21 +00:00
|
|
|
refcount_release(&pr->pr_ref);
|
2021-02-21 18:55:44 +00:00
|
|
|
#endif
|
Update ZFS from version 6 to 13 and bring some FreeBSD-specific changes.
This bring huge amount of changes, I'll enumerate only user-visible changes:
- Delegated Administration
Allows regular users to perform ZFS operations, like file system
creation, snapshot creation, etc.
- L2ARC
Level 2 cache for ZFS - allows to use additional disks for cache.
Huge performance improvements mostly for random read of mostly
static content.
- slog
Allow to use additional disks for ZFS Intent Log to speed up
operations like fsync(2).
- vfs.zfs.super_owner
Allows regular users to perform privileged operations on files stored
on ZFS file systems owned by him. Very careful with this one.
- chflags(2)
Not all the flags are supported. This still needs work.
- ZFSBoot
Support to boot off of ZFS pool. Not finished, AFAIK.
Submitted by: dfr
- Snapshot properties
- New failure modes
Before if write requested failed, system paniced. Now one
can select from one of three failure modes:
- panic - panic on write error
- wait - wait for disk to reappear
- continue - serve read requests if possible, block write requests
- Refquota, refreservation properties
Just quota and reservation properties, but don't count space consumed
by children file systems, clones and snapshots.
- Sparse volumes
ZVOLs that don't reserve space in the pool.
- External attributes
Compatible with extattr(2).
- NFSv4-ACLs
Not sure about the status, might not be complete yet.
Submitted by: trasz
- Creation-time properties
- Regression tests for zpool(8) command.
Obtained from: OpenSolaris
2008-11-17 20:49:29 +00:00
|
|
|
}
|
|
|
|
|
2021-01-19 01:23:51 +00:00
|
|
|
/*
|
2022-04-09 12:19:17 +00:00
|
|
|
* Hold a prison for user visibility, by incrementing pr_uref.
|
2021-01-19 01:23:51 +00:00
|
|
|
* It is generally an error to hold a prison that isn't already
|
2022-09-04 11:00:01 +00:00
|
|
|
* user-visible, except through the jail system calls. It is also
|
2021-01-19 01:23:51 +00:00
|
|
|
* an error to hold an invalid prison. A prison record will remain
|
|
|
|
* alive as long as it has at least one user reference, and will not
|
2021-02-21 18:55:44 +00:00
|
|
|
* be set to the dying state until the prison mutex and allprison_lock
|
|
|
|
* are both freed.
|
2021-01-19 01:23:51 +00:00
|
|
|
*/
|
|
|
|
void
|
|
|
|
prison_proc_hold(struct prison *pr)
|
|
|
|
{
|
2021-01-20 23:08:27 +00:00
|
|
|
#ifdef INVARIANTS
|
|
|
|
int was_alive = refcount_acquire_if_not_zero(&pr->pr_uref);
|
2021-01-19 01:23:51 +00:00
|
|
|
|
2021-01-20 23:08:27 +00:00
|
|
|
KASSERT(was_alive,
|
2021-01-19 01:23:51 +00:00
|
|
|
("Cannot add a process to a non-alive prison (jid=%d)", pr->pr_id));
|
2021-01-20 23:08:27 +00:00
|
|
|
#else
|
|
|
|
refcount_acquire(&pr->pr_uref);
|
|
|
|
#endif
|
2021-01-19 01:23:51 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Remove a prison user reference. If it was the last reference, the
|
|
|
|
* prison will be considered "dying", and may be removed once all of
|
|
|
|
* its references are dropped.
|
|
|
|
*/
|
|
|
|
void
|
|
|
|
prison_proc_free(struct prison *pr)
|
|
|
|
{
|
|
|
|
|
2021-01-20 23:08:27 +00:00
|
|
|
/*
|
|
|
|
* Locking is only required when releasing the last reference.
|
|
|
|
* This allows assurance that a locked prison will remain alive
|
|
|
|
* until it is unlocked.
|
|
|
|
*/
|
|
|
|
KASSERT(refcount_load(&pr->pr_uref) > 0,
|
2021-01-19 01:23:51 +00:00
|
|
|
("Trying to kill a process in a dead prison (jid=%d)", pr->pr_id));
|
2021-01-22 18:56:24 +00:00
|
|
|
if (!refcount_release_if_not_last(&pr->pr_uref)) {
|
2021-01-19 01:23:51 +00:00
|
|
|
/*
|
|
|
|
* Don't remove the last user reference in this context,
|
|
|
|
* which is expected to be a process that is not only locked,
|
|
|
|
* but also half dead. Add a reference so any calls to
|
|
|
|
* prison_free() won't re-submit the task.
|
|
|
|
*/
|
2021-02-21 18:55:44 +00:00
|
|
|
prison_hold(pr);
|
2021-02-21 21:24:47 +00:00
|
|
|
mtx_lock(&pr->pr_mtx);
|
|
|
|
KASSERT(!(pr->pr_flags & PR_COMPLETE_PROC),
|
|
|
|
("Redundant last reference in prison_proc_free (jid=%d)",
|
|
|
|
pr->pr_id));
|
|
|
|
pr->pr_flags |= PR_COMPLETE_PROC;
|
|
|
|
mtx_unlock(&pr->pr_mtx);
|
2021-01-19 01:23:51 +00:00
|
|
|
taskqueue_enqueue(taskqueue_thread, &pr->pr_task);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-02-25 05:54:49 +00:00
|
|
|
static void
|
|
|
|
prison_proc_free_not_last(struct prison *pr)
|
|
|
|
{
|
|
|
|
#ifdef INVARIANTS
|
|
|
|
int lastref;
|
|
|
|
|
|
|
|
KASSERT(refcount_load(&pr->pr_uref) > 0,
|
|
|
|
("Trying to free dead prison %p (jid=%d).",
|
|
|
|
pr, pr->pr_id));
|
|
|
|
lastref = refcount_release(&pr->pr_uref);
|
|
|
|
KASSERT(!lastref,
|
|
|
|
("prison_proc_free_not_last freed last uref on prison %p (jid=%d).",
|
|
|
|
pr, pr->pr_id));
|
|
|
|
#else
|
|
|
|
refcount_release(&pr->pr_uref);
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
2022-03-10 18:42:37 +00:00
|
|
|
void
|
|
|
|
prison_proc_link(struct prison *pr, struct proc *p)
|
|
|
|
{
|
|
|
|
|
|
|
|
sx_assert(&allproc_lock, SA_XLOCKED);
|
|
|
|
LIST_INSERT_HEAD(&pr->pr_proclist, p, p_jaillist);
|
|
|
|
}
|
|
|
|
|
|
|
|
void
|
|
|
|
prison_proc_unlink(struct prison *pr, struct proc *p)
|
|
|
|
{
|
|
|
|
|
|
|
|
sx_assert(&allproc_lock, SA_XLOCKED);
|
|
|
|
LIST_REMOVE(p, p_jaillist);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
prison_proc_relink(struct prison *opr, struct prison *npr, struct proc *p)
|
|
|
|
{
|
|
|
|
|
|
|
|
sx_xlock(&allproc_lock);
|
|
|
|
prison_proc_unlink(opr, p);
|
|
|
|
prison_proc_link(npr, p);
|
|
|
|
sx_xunlock(&allproc_lock);
|
|
|
|
}
|
|
|
|
|
2016-04-27 02:25:21 +00:00
|
|
|
/*
|
|
|
|
* Complete a call to either prison_free or prison_proc_free.
|
|
|
|
*/
|
2004-01-23 20:44:26 +00:00
|
|
|
static void
|
|
|
|
prison_complete(void *context, int pending)
|
|
|
|
{
|
2016-04-27 02:25:21 +00:00
|
|
|
struct prison *pr = context;
|
2021-02-21 18:55:44 +00:00
|
|
|
int drflags;
|
2004-01-23 20:44:26 +00:00
|
|
|
|
2021-01-19 01:23:51 +00:00
|
|
|
/*
|
2021-02-21 21:24:47 +00:00
|
|
|
* This could be called to release the last reference, or the last
|
|
|
|
* user reference (plus the reference held in prison_proc_free).
|
2021-01-19 01:23:51 +00:00
|
|
|
*/
|
2021-02-21 18:55:44 +00:00
|
|
|
drflags = prison_lock_xlock(pr, PD_DEREF);
|
2021-02-21 21:24:47 +00:00
|
|
|
if (pr->pr_flags & PR_COMPLETE_PROC) {
|
|
|
|
pr->pr_flags &= ~PR_COMPLETE_PROC;
|
2021-02-21 18:55:44 +00:00
|
|
|
drflags |= PD_DEUREF;
|
2021-02-21 21:24:47 +00:00
|
|
|
}
|
2021-02-21 18:55:44 +00:00
|
|
|
prison_deref(pr, drflags);
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
2004-01-23 20:44:26 +00:00
|
|
|
|
2022-03-10 18:42:37 +00:00
|
|
|
static void
|
|
|
|
prison_kill_processes_cb(struct proc *p, void *arg __unused)
|
|
|
|
{
|
|
|
|
|
|
|
|
kern_psignal(p, SIGKILL);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Note the iteration does not guarantee acting on all processes.
|
|
|
|
* Most notably there may be fork or jail_attach in progress.
|
|
|
|
*/
|
|
|
|
void
|
|
|
|
prison_proc_iterate(struct prison *pr, void (*cb)(struct proc *, void *),
|
|
|
|
void *cbarg)
|
|
|
|
{
|
|
|
|
struct prison *ppr;
|
|
|
|
struct proc *p;
|
|
|
|
|
|
|
|
if (atomic_load_int(&pr->pr_childcount) == 0) {
|
|
|
|
sx_slock(&allproc_lock);
|
|
|
|
LIST_FOREACH(p, &pr->pr_proclist, p_jaillist) {
|
|
|
|
if (p->p_state == PRS_NEW)
|
|
|
|
continue;
|
|
|
|
PROC_LOCK(p);
|
|
|
|
cb(p, cbarg);
|
|
|
|
PROC_UNLOCK(p);
|
|
|
|
}
|
|
|
|
sx_sunlock(&allproc_lock);
|
|
|
|
if (atomic_load_int(&pr->pr_childcount) == 0)
|
|
|
|
return;
|
|
|
|
/*
|
|
|
|
* Some jails popped up during the iteration, fall through to a
|
|
|
|
* system-wide search.
|
|
|
|
*/
|
|
|
|
}
|
|
|
|
|
|
|
|
sx_slock(&allproc_lock);
|
|
|
|
FOREACH_PROC_IN_SYSTEM(p) {
|
|
|
|
PROC_LOCK(p);
|
|
|
|
if (p->p_state != PRS_NEW && p->p_ucred != NULL) {
|
|
|
|
for (ppr = p->p_ucred->cr_prison;
|
|
|
|
ppr != &prison0;
|
|
|
|
ppr = ppr->pr_parent) {
|
|
|
|
if (ppr == pr) {
|
|
|
|
cb(p, cbarg);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
PROC_UNLOCK(p);
|
|
|
|
}
|
|
|
|
sx_sunlock(&allproc_lock);
|
|
|
|
}
|
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
/*
|
2021-01-19 01:23:51 +00:00
|
|
|
* Remove a prison reference and/or user reference (usually).
|
|
|
|
* This assumes context that allows sleeping (for allprison_lock),
|
|
|
|
* with no non-sleeping locks held, except perhaps the prison itself.
|
|
|
|
* If there are no more references, release and delist the prison.
|
|
|
|
* On completion, the prison lock and the allprison lock are both
|
|
|
|
* unlocked.
|
2009-04-29 21:14:15 +00:00
|
|
|
*/
|
|
|
|
static void
|
|
|
|
prison_deref(struct prison *pr, int flags)
|
|
|
|
{
|
2021-02-20 22:38:58 +00:00
|
|
|
struct prisonlist freeprison;
|
2021-02-25 05:54:49 +00:00
|
|
|
struct prison *killpr, *rpr, *ppr, *tpr;
|
Update ZFS from version 6 to 13 and bring some FreeBSD-specific changes.
This bring huge amount of changes, I'll enumerate only user-visible changes:
- Delegated Administration
Allows regular users to perform ZFS operations, like file system
creation, snapshot creation, etc.
- L2ARC
Level 2 cache for ZFS - allows to use additional disks for cache.
Huge performance improvements mostly for random read of mostly
static content.
- slog
Allow to use additional disks for ZFS Intent Log to speed up
operations like fsync(2).
- vfs.zfs.super_owner
Allows regular users to perform privileged operations on files stored
on ZFS file systems owned by him. Very careful with this one.
- chflags(2)
Not all the flags are supported. This still needs work.
- ZFSBoot
Support to boot off of ZFS pool. Not finished, AFAIK.
Submitted by: dfr
- Snapshot properties
- New failure modes
Before if write requested failed, system paniced. Now one
can select from one of three failure modes:
- panic - panic on write error
- wait - wait for disk to reappear
- continue - serve read requests if possible, block write requests
- Refquota, refreservation properties
Just quota and reservation properties, but don't count space consumed
by children file systems, clones and snapshots.
- Sparse volumes
ZVOLs that don't reserve space in the pool.
- External attributes
Compatible with extattr(2).
- NFSv4-ACLs
Not sure about the status, might not be complete yet.
Submitted by: trasz
- Creation-time properties
- Regression tests for zpool(8) command.
Obtained from: OpenSolaris
2008-11-17 20:49:29 +00:00
|
|
|
|
2021-02-25 05:54:49 +00:00
|
|
|
killpr = NULL;
|
2021-02-20 22:38:58 +00:00
|
|
|
TAILQ_INIT(&freeprison);
|
|
|
|
/*
|
|
|
|
* Release this prison as requested, which may cause its parent
|
|
|
|
* to be released, and then maybe its grandparent, etc.
|
|
|
|
*/
|
2009-05-27 14:11:23 +00:00
|
|
|
for (;;) {
|
2021-02-25 05:54:49 +00:00
|
|
|
if (flags & PD_KILL) {
|
|
|
|
/* Kill the prison and its descendents. */
|
2021-02-26 04:10:42 +00:00
|
|
|
KASSERT(pr != &prison0,
|
|
|
|
("prison_deref trying to kill prison0"));
|
2021-02-25 05:54:49 +00:00
|
|
|
if (!(flags & PD_DEREF)) {
|
|
|
|
prison_hold(pr);
|
|
|
|
flags |= PD_DEREF;
|
|
|
|
}
|
|
|
|
flags = prison_lock_xlock(pr, flags);
|
|
|
|
prison_deref_kill(pr, &freeprison);
|
|
|
|
}
|
2011-08-26 16:03:34 +00:00
|
|
|
if (flags & PD_DEUREF) {
|
2021-02-21 18:55:44 +00:00
|
|
|
/* Drop a user reference. */
|
2021-01-20 23:08:27 +00:00
|
|
|
KASSERT(refcount_load(&pr->pr_uref) > 0,
|
2016-04-27 02:25:21 +00:00
|
|
|
("prison_deref PD_DEUREF on a dead prison (jid=%d)",
|
|
|
|
pr->pr_id));
|
2021-02-21 18:55:44 +00:00
|
|
|
if (!refcount_release_if_not_last(&pr->pr_uref)) {
|
|
|
|
if (!(flags & PD_DEREF)) {
|
|
|
|
prison_hold(pr);
|
|
|
|
flags |= PD_DEREF;
|
|
|
|
}
|
|
|
|
flags = prison_lock_xlock(pr, flags);
|
2021-02-21 21:24:47 +00:00
|
|
|
if (refcount_release(&pr->pr_uref) &&
|
|
|
|
pr->pr_state == PRISON_STATE_ALIVE) {
|
2021-02-21 18:55:44 +00:00
|
|
|
/*
|
|
|
|
* When the last user references goes,
|
|
|
|
* this becomes a dying prison.
|
|
|
|
*/
|
|
|
|
KASSERT(
|
|
|
|
refcount_load(&prison0.pr_uref) > 0,
|
|
|
|
("prison0 pr_uref=0"));
|
2021-02-21 21:24:47 +00:00
|
|
|
pr->pr_state = PRISON_STATE_DYING;
|
2021-02-21 18:55:44 +00:00
|
|
|
mtx_unlock(&pr->pr_mtx);
|
|
|
|
flags &= ~PD_LOCKED;
|
2022-06-29 17:33:05 +00:00
|
|
|
prison_cleanup(pr);
|
2021-02-21 18:55:44 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2021-02-25 05:54:49 +00:00
|
|
|
if (flags & PD_KILL) {
|
|
|
|
/*
|
|
|
|
* Any remaining user references are probably processes
|
|
|
|
* that need to be killed, either in this prison or its
|
|
|
|
* descendants.
|
|
|
|
*/
|
|
|
|
if (refcount_load(&pr->pr_uref) > 0)
|
|
|
|
killpr = pr;
|
2021-02-26 04:10:42 +00:00
|
|
|
/* Make sure the parent prison doesn't get killed. */
|
|
|
|
flags &= ~PD_KILL;
|
2021-02-25 05:54:49 +00:00
|
|
|
}
|
2016-04-27 02:25:21 +00:00
|
|
|
if (flags & PD_DEREF) {
|
2021-02-21 18:55:44 +00:00
|
|
|
/* Drop a reference. */
|
2021-01-20 23:08:27 +00:00
|
|
|
KASSERT(refcount_load(&pr->pr_ref) > 0,
|
2016-04-27 02:25:21 +00:00
|
|
|
("prison_deref PD_DEREF on a dead prison (jid=%d)",
|
|
|
|
pr->pr_id));
|
2021-02-21 18:55:44 +00:00
|
|
|
if (!refcount_release_if_not_last(&pr->pr_ref)) {
|
|
|
|
flags = prison_lock_xlock(pr, flags);
|
|
|
|
if (refcount_release(&pr->pr_ref)) {
|
|
|
|
/*
|
|
|
|
* When the last reference goes,
|
|
|
|
* unlink the prison and set it aside.
|
|
|
|
*/
|
|
|
|
KASSERT(
|
|
|
|
refcount_load(&pr->pr_uref) == 0,
|
|
|
|
("prison_deref: last ref, "
|
|
|
|
"but still has %d urefs (jid=%d)",
|
|
|
|
pr->pr_uref, pr->pr_id));
|
|
|
|
KASSERT(
|
|
|
|
refcount_load(&prison0.pr_ref) != 0,
|
|
|
|
("prison0 pr_ref=0"));
|
2021-02-21 21:24:47 +00:00
|
|
|
pr->pr_state = PRISON_STATE_INVALID;
|
2021-02-21 18:55:44 +00:00
|
|
|
TAILQ_REMOVE(&allprison, pr, pr_list);
|
|
|
|
LIST_REMOVE(pr, pr_sibling);
|
|
|
|
TAILQ_INSERT_TAIL(&freeprison, pr,
|
|
|
|
pr_list);
|
|
|
|
for (ppr = pr->pr_parent;
|
|
|
|
ppr != NULL;
|
|
|
|
ppr = ppr->pr_parent)
|
|
|
|
ppr->pr_childcount--;
|
|
|
|
/*
|
|
|
|
* Removing a prison frees references
|
|
|
|
* from its parent.
|
|
|
|
*/
|
|
|
|
mtx_unlock(&pr->pr_mtx);
|
|
|
|
flags &= ~PD_LOCKED;
|
|
|
|
pr = pr->pr_parent;
|
|
|
|
flags |= PD_DEREF | PD_DEUREF;
|
|
|
|
continue;
|
2020-12-27 04:49:30 +00:00
|
|
|
}
|
2016-04-25 04:24:00 +00:00
|
|
|
}
|
|
|
|
}
|
2021-02-21 18:55:44 +00:00
|
|
|
break;
|
2021-02-20 22:38:58 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Release all the prison locks. */
|
2021-02-21 18:55:44 +00:00
|
|
|
if (flags & PD_LOCKED)
|
|
|
|
mtx_unlock(&pr->pr_mtx);
|
2021-02-20 22:38:58 +00:00
|
|
|
if (flags & PD_LIST_SLOCKED)
|
|
|
|
sx_sunlock(&allprison_lock);
|
|
|
|
else if (flags & PD_LIST_XLOCKED)
|
2009-08-27 16:15:51 +00:00
|
|
|
sx_xunlock(&allprison_lock);
|
2009-05-27 14:11:23 +00:00
|
|
|
|
2021-02-25 05:54:49 +00:00
|
|
|
/* Kill any processes attached to a killed prison. */
|
2022-03-10 18:42:37 +00:00
|
|
|
if (killpr != NULL)
|
|
|
|
prison_proc_iterate(killpr, prison_kill_processes_cb, NULL);
|
2021-02-25 05:54:49 +00:00
|
|
|
|
2021-02-20 22:38:58 +00:00
|
|
|
/*
|
|
|
|
* Finish removing any unreferenced prisons, which couldn't happen
|
|
|
|
* while allprison_lock was held (to avoid a LOR on vrele).
|
|
|
|
*/
|
|
|
|
TAILQ_FOREACH_SAFE(rpr, &freeprison, pr_list, tpr) {
|
2009-06-15 18:59:29 +00:00
|
|
|
#ifdef VIMAGE
|
2021-02-20 22:38:58 +00:00
|
|
|
if (rpr->pr_vnet != rpr->pr_parent->pr_vnet)
|
|
|
|
vnet_destroy(rpr->pr_vnet);
|
2009-06-15 18:59:29 +00:00
|
|
|
#endif
|
2021-02-20 22:38:58 +00:00
|
|
|
if (rpr->pr_root != NULL)
|
|
|
|
vrele(rpr->pr_root);
|
|
|
|
mtx_destroy(&rpr->pr_mtx);
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
#ifdef INET
|
2021-12-26 18:45:50 +00:00
|
|
|
prison_ip_free(rpr->pr_addrs[PR_INET]);
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
#endif
|
2009-04-29 21:14:15 +00:00
|
|
|
#ifdef INET6
|
2021-12-26 18:45:50 +00:00
|
|
|
prison_ip_free(rpr->pr_addrs[PR_INET6]);
|
2009-04-29 21:14:15 +00:00
|
|
|
#endif
|
2021-02-20 22:38:58 +00:00
|
|
|
if (rpr->pr_cpuset != NULL)
|
|
|
|
cpuset_rel(rpr->pr_cpuset);
|
|
|
|
osd_jail_exit(rpr);
|
2011-05-03 07:32:58 +00:00
|
|
|
#ifdef RACCT
|
2015-04-29 10:23:02 +00:00
|
|
|
if (racct_enable)
|
2021-02-20 22:38:58 +00:00
|
|
|
prison_racct_detach(rpr);
|
2011-03-30 17:48:15 +00:00
|
|
|
#endif
|
2021-02-21 18:55:44 +00:00
|
|
|
TAILQ_REMOVE(&freeprison, rpr, pr_list);
|
2021-02-20 22:38:58 +00:00
|
|
|
free(rpr, M_PRISON);
|
2009-05-27 14:11:23 +00:00
|
|
|
}
|
2004-01-23 20:44:26 +00:00
|
|
|
}
|
|
|
|
|
2021-02-25 05:54:49 +00:00
|
|
|
/*
|
|
|
|
* Kill the prison and its descendants. Mark them as dying, clear the
|
|
|
|
* persist flag, and call module remove methods.
|
|
|
|
*/
|
|
|
|
static void
|
|
|
|
prison_deref_kill(struct prison *pr, struct prisonlist *freeprison)
|
|
|
|
{
|
|
|
|
struct prison *cpr, *ppr, *rpr;
|
|
|
|
bool descend;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Unlike the descendants, the target prison can be killed
|
|
|
|
* even if it is currently dying. This is useful for failed
|
|
|
|
* creation in jail_set(2).
|
|
|
|
*/
|
|
|
|
KASSERT(refcount_load(&pr->pr_ref) > 0,
|
|
|
|
("Trying to kill dead prison %p (jid=%d).",
|
|
|
|
pr, pr->pr_id));
|
|
|
|
refcount_acquire(&pr->pr_uref);
|
|
|
|
pr->pr_state = PRISON_STATE_DYING;
|
|
|
|
mtx_unlock(&pr->pr_mtx);
|
|
|
|
|
|
|
|
rpr = NULL;
|
|
|
|
FOREACH_PRISON_DESCENDANT_PRE_POST(pr, cpr, descend) {
|
|
|
|
if (descend) {
|
|
|
|
if (!prison_isalive(cpr)) {
|
|
|
|
descend = false;
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
prison_hold(cpr);
|
|
|
|
prison_proc_hold(cpr);
|
|
|
|
mtx_lock(&cpr->pr_mtx);
|
|
|
|
cpr->pr_state = PRISON_STATE_DYING;
|
|
|
|
cpr->pr_flags |= PR_REMOVE;
|
|
|
|
mtx_unlock(&cpr->pr_mtx);
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
if (!(cpr->pr_flags & PR_REMOVE))
|
|
|
|
continue;
|
2022-06-29 17:33:05 +00:00
|
|
|
prison_cleanup(cpr);
|
2021-02-25 05:54:49 +00:00
|
|
|
mtx_lock(&cpr->pr_mtx);
|
|
|
|
cpr->pr_flags &= ~PR_REMOVE;
|
|
|
|
if (cpr->pr_flags & PR_PERSIST) {
|
|
|
|
cpr->pr_flags &= ~PR_PERSIST;
|
|
|
|
prison_proc_free_not_last(cpr);
|
|
|
|
prison_free_not_last(cpr);
|
|
|
|
}
|
|
|
|
(void)refcount_release(&cpr->pr_uref);
|
|
|
|
if (refcount_release(&cpr->pr_ref)) {
|
|
|
|
/*
|
|
|
|
* When the last reference goes, unlink the prison
|
|
|
|
* and set it aside for prison_deref() to handle.
|
|
|
|
* Delay unlinking the sibling list to keep the loop
|
|
|
|
* safe.
|
|
|
|
*/
|
|
|
|
if (rpr != NULL)
|
|
|
|
LIST_REMOVE(rpr, pr_sibling);
|
|
|
|
rpr = cpr;
|
|
|
|
rpr->pr_state = PRISON_STATE_INVALID;
|
|
|
|
TAILQ_REMOVE(&allprison, rpr, pr_list);
|
|
|
|
TAILQ_INSERT_TAIL(freeprison, rpr, pr_list);
|
|
|
|
/*
|
|
|
|
* Removing a prison frees references from its parent.
|
|
|
|
*/
|
|
|
|
ppr = rpr->pr_parent;
|
|
|
|
prison_proc_free_not_last(ppr);
|
|
|
|
prison_free_not_last(ppr);
|
|
|
|
for (; ppr != NULL; ppr = ppr->pr_parent)
|
|
|
|
ppr->pr_childcount--;
|
|
|
|
}
|
|
|
|
mtx_unlock(&cpr->pr_mtx);
|
|
|
|
}
|
|
|
|
if (rpr != NULL)
|
|
|
|
LIST_REMOVE(rpr, pr_sibling);
|
|
|
|
|
2022-06-29 17:33:05 +00:00
|
|
|
prison_cleanup(pr);
|
2021-02-25 05:54:49 +00:00
|
|
|
mtx_lock(&pr->pr_mtx);
|
|
|
|
if (pr->pr_flags & PR_PERSIST) {
|
|
|
|
pr->pr_flags &= ~PR_PERSIST;
|
|
|
|
prison_proc_free_not_last(pr);
|
|
|
|
prison_free_not_last(pr);
|
|
|
|
}
|
|
|
|
(void)refcount_release(&pr->pr_uref);
|
|
|
|
}
|
|
|
|
|
2021-02-21 18:55:44 +00:00
|
|
|
/*
|
|
|
|
* Given the current locking state in the flags, make sure allprison_lock
|
|
|
|
* is held exclusive, and the prison is locked. Return flags indicating
|
|
|
|
* the new state.
|
|
|
|
*/
|
|
|
|
static int
|
|
|
|
prison_lock_xlock(struct prison *pr, int flags)
|
|
|
|
{
|
|
|
|
|
|
|
|
if (!(flags & PD_LIST_XLOCKED)) {
|
|
|
|
/*
|
|
|
|
* Get allprison_lock, which may be an upgrade,
|
|
|
|
* and may require unlocking the prison.
|
|
|
|
*/
|
|
|
|
if (flags & PD_LOCKED) {
|
|
|
|
mtx_unlock(&pr->pr_mtx);
|
|
|
|
flags &= ~PD_LOCKED;
|
|
|
|
}
|
|
|
|
if (flags & PD_LIST_SLOCKED) {
|
|
|
|
if (!sx_try_upgrade(&allprison_lock)) {
|
|
|
|
sx_sunlock(&allprison_lock);
|
|
|
|
sx_xlock(&allprison_lock);
|
|
|
|
}
|
|
|
|
flags &= ~PD_LIST_SLOCKED;
|
|
|
|
} else
|
|
|
|
sx_xlock(&allprison_lock);
|
|
|
|
flags |= PD_LIST_XLOCKED;
|
|
|
|
}
|
|
|
|
if (!(flags & PD_LOCKED)) {
|
|
|
|
/* Lock the prison mutex. */
|
|
|
|
mtx_lock(&pr->pr_mtx);
|
|
|
|
flags |= PD_LOCKED;
|
|
|
|
}
|
|
|
|
return flags;
|
|
|
|
}
|
|
|
|
|
2022-06-29 17:33:05 +00:00
|
|
|
/*
|
|
|
|
* Release a prison's resources when it starts dying (when the last user
|
|
|
|
* reference is dropped, or when it is killed).
|
|
|
|
*/
|
|
|
|
static void
|
|
|
|
prison_cleanup(struct prison *pr)
|
|
|
|
{
|
|
|
|
sx_assert(&allprison_lock, SA_XLOCKED);
|
|
|
|
mtx_assert(&pr->pr_mtx, MA_NOTOWNED);
|
2023-02-21 21:00:42 +00:00
|
|
|
vfs_exjail_delete(pr);
|
2022-06-29 17:47:39 +00:00
|
|
|
shm_remove_prison(pr);
|
2022-06-29 17:33:05 +00:00
|
|
|
(void)osd_jail_call(pr, PR_METHOD_REMOVE, NULL);
|
|
|
|
}
|
|
|
|
|
2020-12-27 04:25:02 +00:00
|
|
|
/*
|
|
|
|
* Set or clear a permission bit in the pr_allow field, passing restrictions
|
|
|
|
* (cleared permission) down to child jails.
|
|
|
|
*/
|
|
|
|
void
|
|
|
|
prison_set_allow(struct ucred *cred, unsigned flag, int enable)
|
|
|
|
{
|
|
|
|
struct prison *pr;
|
|
|
|
|
|
|
|
pr = cred->cr_prison;
|
|
|
|
sx_slock(&allprison_lock);
|
|
|
|
mtx_lock(&pr->pr_mtx);
|
|
|
|
prison_set_allow_locked(pr, flag, enable);
|
|
|
|
mtx_unlock(&pr->pr_mtx);
|
|
|
|
sx_sunlock(&allprison_lock);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
prison_set_allow_locked(struct prison *pr, unsigned flag, int enable)
|
|
|
|
{
|
|
|
|
struct prison *cpr;
|
|
|
|
int descend;
|
|
|
|
|
|
|
|
if (enable != 0)
|
|
|
|
pr->pr_allow |= flag;
|
|
|
|
else {
|
|
|
|
pr->pr_allow &= ~flag;
|
|
|
|
FOREACH_PRISON_DESCENDANT_LOCKED(pr, cpr, descend)
|
|
|
|
cpr->pr_allow &= ~flag;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2009-02-05 14:15:18 +00:00
|
|
|
/*
|
|
|
|
* Check if a jail supports the given address family.
|
|
|
|
*
|
|
|
|
* Returns 0 if not jailed or the address family is supported, EAFNOSUPPORT
|
|
|
|
* if not.
|
|
|
|
*/
|
|
|
|
int
|
|
|
|
prison_check_af(struct ucred *cred, int af)
|
|
|
|
{
|
2009-05-27 14:11:23 +00:00
|
|
|
struct prison *pr;
|
2009-02-05 14:15:18 +00:00
|
|
|
int error;
|
|
|
|
|
|
|
|
KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
|
|
|
|
|
2009-05-27 14:11:23 +00:00
|
|
|
pr = cred->cr_prison;
|
2009-06-24 22:06:56 +00:00
|
|
|
#ifdef VIMAGE
|
2009-06-24 21:39:50 +00:00
|
|
|
/* Prisons with their own network stack are not limited. */
|
2009-12-13 13:57:32 +00:00
|
|
|
if (prison_owns_vnet(cred))
|
2009-06-24 21:39:50 +00:00
|
|
|
return (0);
|
2009-06-24 22:06:56 +00:00
|
|
|
#endif
|
2009-06-24 21:39:50 +00:00
|
|
|
|
2009-02-05 14:15:18 +00:00
|
|
|
error = 0;
|
|
|
|
switch (af)
|
|
|
|
{
|
|
|
|
#ifdef INET
|
|
|
|
case AF_INET:
|
2009-05-27 14:11:23 +00:00
|
|
|
if (pr->pr_flags & PR_IP4)
|
|
|
|
{
|
|
|
|
mtx_lock(&pr->pr_mtx);
|
2021-12-26 18:45:50 +00:00
|
|
|
if ((pr->pr_flags & PR_IP4) &&
|
|
|
|
pr->pr_addrs[PR_INET] == NULL)
|
2009-05-27 14:11:23 +00:00
|
|
|
error = EAFNOSUPPORT;
|
|
|
|
mtx_unlock(&pr->pr_mtx);
|
|
|
|
}
|
2009-02-05 14:15:18 +00:00
|
|
|
break;
|
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
|
|
|
case AF_INET6:
|
2009-05-27 14:11:23 +00:00
|
|
|
if (pr->pr_flags & PR_IP6)
|
|
|
|
{
|
|
|
|
mtx_lock(&pr->pr_mtx);
|
2021-12-26 18:45:50 +00:00
|
|
|
if ((pr->pr_flags & PR_IP6) &&
|
|
|
|
pr->pr_addrs[PR_INET6] == NULL)
|
2009-05-27 14:11:23 +00:00
|
|
|
error = EAFNOSUPPORT;
|
|
|
|
mtx_unlock(&pr->pr_mtx);
|
|
|
|
}
|
2009-02-05 14:15:18 +00:00
|
|
|
break;
|
|
|
|
#endif
|
|
|
|
case AF_LOCAL:
|
|
|
|
case AF_ROUTE:
|
2023-03-26 08:42:51 +00:00
|
|
|
case AF_NETLINK:
|
2009-02-05 14:15:18 +00:00
|
|
|
break;
|
|
|
|
default:
|
2009-05-27 14:11:23 +00:00
|
|
|
if (!(pr->pr_allow & PR_ALLOW_SOCKET_AF))
|
2009-02-05 14:15:18 +00:00
|
|
|
error = EAFNOSUPPORT;
|
|
|
|
}
|
|
|
|
return (error);
|
|
|
|
}
|
|
|
|
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
/*
|
|
|
|
* Check if given address belongs to the jail referenced by cred (wrapper to
|
|
|
|
* prison_check_ip[46]).
|
|
|
|
*
|
2009-05-27 14:11:23 +00:00
|
|
|
* Returns 0 if jail doesn't restrict the address family or if address belongs
|
|
|
|
* to jail, EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if
|
|
|
|
* the jail doesn't allow the address family. IPv4 Address passed in in NBO.
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
*/
|
This Implements the mumbled about "Jail" feature.
This is a seriously beefed up chroot kind of thing. The process
is jailed along the same lines as a chroot does it, but with
additional tough restrictions imposed on what the superuser can do.
For all I know, it is safe to hand over the root bit inside a
prison to the customer living in that prison, this is what
it was developed for in fact: "real virtual servers".
Each prison has an ip number associated with it, which all IP
communications will be coerced to use and each prison has its own
hostname.
Needless to say, you need more RAM this way, but the advantage is
that each customer can run their own particular version of apache
and not stomp on the toes of their neighbors.
It generally does what one would expect, but setting up a jail
still takes a little knowledge.
A few notes:
I have no scripts for setting up a jail, don't ask me for them.
The IP number should be an alias on one of the interfaces.
mount a /proc in each jail, it will make ps more useable.
/proc/<pid>/status tells the hostname of the prison for
jailed processes.
Quotas are only sensible if you have a mountpoint per prison.
There are no privisions for stopping resource-hogging.
Some "#ifdef INET" and similar may be missing (send patches!)
If somebody wants to take it from here and develop it into
more of a "virtual machine" they should be most welcome!
Tools, comments, patches & documentation most welcome.
Have fun...
Sponsored by: http://www.rndassociates.com/
Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
|
|
|
int
|
2019-12-31 17:26:53 +00:00
|
|
|
prison_if(struct ucred *cred, const struct sockaddr *sa)
|
This Implements the mumbled about "Jail" feature.
This is a seriously beefed up chroot kind of thing. The process
is jailed along the same lines as a chroot does it, but with
additional tough restrictions imposed on what the superuser can do.
For all I know, it is safe to hand over the root bit inside a
prison to the customer living in that prison, this is what
it was developed for in fact: "real virtual servers".
Each prison has an ip number associated with it, which all IP
communications will be coerced to use and each prison has its own
hostname.
Needless to say, you need more RAM this way, but the advantage is
that each customer can run their own particular version of apache
and not stomp on the toes of their neighbors.
It generally does what one would expect, but setting up a jail
still takes a little knowledge.
A few notes:
I have no scripts for setting up a jail, don't ask me for them.
The IP number should be an alias on one of the interfaces.
mount a /proc in each jail, it will make ps more useable.
/proc/<pid>/status tells the hostname of the prison for
jailed processes.
Quotas are only sensible if you have a mountpoint per prison.
There are no privisions for stopping resource-hogging.
Some "#ifdef INET" and similar may be missing (send patches!)
If somebody wants to take it from here and develop it into
more of a "virtual machine" they should be most welcome!
Tools, comments, patches & documentation most welcome.
Have fun...
Sponsored by: http://www.rndassociates.com/
Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
|
|
|
{
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
#ifdef INET
|
2019-12-31 17:26:53 +00:00
|
|
|
const struct sockaddr_in *sai;
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
2019-12-31 17:26:53 +00:00
|
|
|
const struct sockaddr_in6 *sai6;
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
#endif
|
2009-02-05 14:06:09 +00:00
|
|
|
int error;
|
This Implements the mumbled about "Jail" feature.
This is a seriously beefed up chroot kind of thing. The process
is jailed along the same lines as a chroot does it, but with
additional tough restrictions imposed on what the superuser can do.
For all I know, it is safe to hand over the root bit inside a
prison to the customer living in that prison, this is what
it was developed for in fact: "real virtual servers".
Each prison has an ip number associated with it, which all IP
communications will be coerced to use and each prison has its own
hostname.
Needless to say, you need more RAM this way, but the advantage is
that each customer can run their own particular version of apache
and not stomp on the toes of their neighbors.
It generally does what one would expect, but setting up a jail
still takes a little knowledge.
A few notes:
I have no scripts for setting up a jail, don't ask me for them.
The IP number should be an alias on one of the interfaces.
mount a /proc in each jail, it will make ps more useable.
/proc/<pid>/status tells the hostname of the prison for
jailed processes.
Quotas are only sensible if you have a mountpoint per prison.
There are no privisions for stopping resource-hogging.
Some "#ifdef INET" and similar may be missing (send patches!)
If somebody wants to take it from here and develop it into
more of a "virtual machine" they should be most welcome!
Tools, comments, patches & documentation most welcome.
Have fun...
Sponsored by: http://www.rndassociates.com/
Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
|
|
|
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
|
|
|
|
KASSERT(sa != NULL, ("%s: sa is NULL", __func__));
|
|
|
|
|
2009-12-13 13:57:32 +00:00
|
|
|
#ifdef VIMAGE
|
|
|
|
if (prison_owns_vnet(cred))
|
|
|
|
return (0);
|
|
|
|
#endif
|
|
|
|
|
2009-02-05 14:06:09 +00:00
|
|
|
error = 0;
|
|
|
|
switch (sa->sa_family)
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
{
|
|
|
|
#ifdef INET
|
|
|
|
case AF_INET:
|
2019-12-31 17:26:53 +00:00
|
|
|
sai = (const struct sockaddr_in *)sa;
|
2009-02-05 14:06:09 +00:00
|
|
|
error = prison_check_ip4(cred, &sai->sin_addr);
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
break;
|
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
|
|
|
case AF_INET6:
|
2019-12-31 17:26:53 +00:00
|
|
|
sai6 = (const struct sockaddr_in6 *)sa;
|
2009-02-05 14:06:09 +00:00
|
|
|
error = prison_check_ip6(cred, &sai6->sin6_addr);
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
break;
|
|
|
|
#endif
|
|
|
|
default:
|
2009-05-27 14:11:23 +00:00
|
|
|
if (!(cred->cr_prison->pr_allow & PR_ALLOW_SOCKET_AF))
|
2009-02-05 14:06:09 +00:00
|
|
|
error = EAFNOSUPPORT;
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
}
|
2009-02-05 14:06:09 +00:00
|
|
|
return (error);
|
This Implements the mumbled about "Jail" feature.
This is a seriously beefed up chroot kind of thing. The process
is jailed along the same lines as a chroot does it, but with
additional tough restrictions imposed on what the superuser can do.
For all I know, it is safe to hand over the root bit inside a
prison to the customer living in that prison, this is what
it was developed for in fact: "real virtual servers".
Each prison has an ip number associated with it, which all IP
communications will be coerced to use and each prison has its own
hostname.
Needless to say, you need more RAM this way, but the advantage is
that each customer can run their own particular version of apache
and not stomp on the toes of their neighbors.
It generally does what one would expect, but setting up a jail
still takes a little knowledge.
A few notes:
I have no scripts for setting up a jail, don't ask me for them.
The IP number should be an alias on one of the interfaces.
mount a /proc in each jail, it will make ps more useable.
/proc/<pid>/status tells the hostname of the prison for
jailed processes.
Quotas are only sensible if you have a mountpoint per prison.
There are no privisions for stopping resource-hogging.
Some "#ifdef INET" and similar may be missing (send patches!)
If somebody wants to take it from here and develop it into
more of a "virtual machine" they should be most welcome!
Tools, comments, patches & documentation most welcome.
Have fun...
Sponsored by: http://www.rndassociates.com/
Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
|
|
|
}
|
2001-02-21 06:39:57 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Return 0 if jails permit p1 to frob p2, otherwise ESRCH.
|
|
|
|
*/
|
|
|
|
int
|
2003-04-28 18:32:19 +00:00
|
|
|
prison_check(struct ucred *cred1, struct ucred *cred2)
|
2001-02-21 06:39:57 +00:00
|
|
|
{
|
|
|
|
|
2009-05-27 14:11:23 +00:00
|
|
|
return ((cred1->cr_prison == cred2->cr_prison ||
|
|
|
|
prison_ischild(cred1->cr_prison, cred2->cr_prison)) ? 0 : ESRCH);
|
|
|
|
}
|
|
|
|
|
2022-12-17 21:43:49 +00:00
|
|
|
/*
|
|
|
|
* For mountd/nfsd to run within a prison, it must be:
|
|
|
|
* - A vnet prison.
|
|
|
|
* - PR_ALLOW_NFSD must be set on it.
|
|
|
|
* - The root directory (pr_root) of the prison must be
|
|
|
|
* a file system mount point, so the mountd can hang
|
|
|
|
* export information on it.
|
2023-02-02 00:02:20 +00:00
|
|
|
* - The prison's enforce_statfs cannot be 0, so that
|
|
|
|
* mountd(8) can do exports.
|
2022-12-17 21:43:49 +00:00
|
|
|
*/
|
|
|
|
bool
|
|
|
|
prison_check_nfsd(struct ucred *cred)
|
|
|
|
{
|
|
|
|
|
|
|
|
if (jailed_without_vnet(cred))
|
|
|
|
return (false);
|
|
|
|
if (!prison_allow(cred, PR_ALLOW_NFSD))
|
|
|
|
return (false);
|
|
|
|
if ((cred->cr_prison->pr_root->v_vflag & VV_ROOT) == 0)
|
|
|
|
return (false);
|
2023-02-02 00:02:20 +00:00
|
|
|
if (cred->cr_prison->pr_enforce_statfs == 0)
|
|
|
|
return (false);
|
2022-12-17 21:43:49 +00:00
|
|
|
return (true);
|
|
|
|
}
|
|
|
|
|
2009-05-27 14:11:23 +00:00
|
|
|
/*
|
2023-03-15 03:04:40 +00:00
|
|
|
* Return true if p2 is a child of p1, otherwise false.
|
2009-05-27 14:11:23 +00:00
|
|
|
*/
|
2023-03-15 03:04:40 +00:00
|
|
|
bool
|
2009-05-27 14:11:23 +00:00
|
|
|
prison_ischild(struct prison *pr1, struct prison *pr2)
|
|
|
|
{
|
2001-02-21 06:39:57 +00:00
|
|
|
|
2009-05-27 14:11:23 +00:00
|
|
|
for (pr2 = pr2->pr_parent; pr2 != NULL; pr2 = pr2->pr_parent)
|
|
|
|
if (pr1 == pr2)
|
2023-03-15 03:04:40 +00:00
|
|
|
return (true);
|
|
|
|
return (false);
|
2001-02-21 06:39:57 +00:00
|
|
|
}
|
|
|
|
|
jail: Add prison_isvalid() and prison_isalive()
prison_isvalid() checks if a prison record can be used at all, i.e.
pr_ref > 0. This filters out prisons that aren't fully created, and
those that are either in the process of being dismantled, or will be
at the next opportunity. While the check for pr_ref > 0 is simple
enough to make without a convenience function, this prepares the way
for other measures of prison validity.
prison_isalive() checks not only validity as far as the useablity of
the prison structure, but also whether the prison is visible to user
space. It replaces a test for pr_uref > 0, which is currently only
used within kern_jail.c, and not often there.
Both of these functions also assert that either the prison mutex or
allprison_lock is held, since it's generally the case that unlocked
prisons aren't guaranteed to remain useable for any length of time.
This isn't entirely true, for example a thread can assume its own
prison is good, but most exceptions will exist inside of kern_jail.c.
2021-01-18 18:56:20 +00:00
|
|
|
/*
|
2021-02-21 18:55:44 +00:00
|
|
|
* Return true if the prison is currently alive. A prison is alive if it
|
|
|
|
* holds user references and it isn't being removed.
|
jail: Add prison_isvalid() and prison_isalive()
prison_isvalid() checks if a prison record can be used at all, i.e.
pr_ref > 0. This filters out prisons that aren't fully created, and
those that are either in the process of being dismantled, or will be
at the next opportunity. While the check for pr_ref > 0 is simple
enough to make without a convenience function, this prepares the way
for other measures of prison validity.
prison_isalive() checks not only validity as far as the useablity of
the prison structure, but also whether the prison is visible to user
space. It replaces a test for pr_uref > 0, which is currently only
used within kern_jail.c, and not often there.
Both of these functions also assert that either the prison mutex or
allprison_lock is held, since it's generally the case that unlocked
prisons aren't guaranteed to remain useable for any length of time.
This isn't entirely true, for example a thread can assume its own
prison is good, but most exceptions will exist inside of kern_jail.c.
2021-01-18 18:56:20 +00:00
|
|
|
*/
|
|
|
|
bool
|
2021-12-26 18:45:50 +00:00
|
|
|
prison_isalive(const struct prison *pr)
|
jail: Add prison_isvalid() and prison_isalive()
prison_isvalid() checks if a prison record can be used at all, i.e.
pr_ref > 0. This filters out prisons that aren't fully created, and
those that are either in the process of being dismantled, or will be
at the next opportunity. While the check for pr_ref > 0 is simple
enough to make without a convenience function, this prepares the way
for other measures of prison validity.
prison_isalive() checks not only validity as far as the useablity of
the prison structure, but also whether the prison is visible to user
space. It replaces a test for pr_uref > 0, which is currently only
used within kern_jail.c, and not often there.
Both of these functions also assert that either the prison mutex or
allprison_lock is held, since it's generally the case that unlocked
prisons aren't guaranteed to remain useable for any length of time.
This isn't entirely true, for example a thread can assume its own
prison is good, but most exceptions will exist inside of kern_jail.c.
2021-01-18 18:56:20 +00:00
|
|
|
{
|
|
|
|
|
2021-02-21 21:24:47 +00:00
|
|
|
if (__predict_false(pr->pr_state != PRISON_STATE_ALIVE))
|
2021-02-16 19:19:13 +00:00
|
|
|
return (false);
|
jail: Add prison_isvalid() and prison_isalive()
prison_isvalid() checks if a prison record can be used at all, i.e.
pr_ref > 0. This filters out prisons that aren't fully created, and
those that are either in the process of being dismantled, or will be
at the next opportunity. While the check for pr_ref > 0 is simple
enough to make without a convenience function, this prepares the way
for other measures of prison validity.
prison_isalive() checks not only validity as far as the useablity of
the prison structure, but also whether the prison is visible to user
space. It replaces a test for pr_uref > 0, which is currently only
used within kern_jail.c, and not often there.
Both of these functions also assert that either the prison mutex or
allprison_lock is held, since it's generally the case that unlocked
prisons aren't guaranteed to remain useable for any length of time.
This isn't entirely true, for example a thread can assume its own
prison is good, but most exceptions will exist inside of kern_jail.c.
2021-01-18 18:56:20 +00:00
|
|
|
return (true);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Return true if the prison is currently valid. A prison is valid if it has
|
|
|
|
* been fully created, and is not being destroyed. Note that dying prisons
|
2021-02-21 18:55:44 +00:00
|
|
|
* are still considered valid. Invalid prisons won't be found under normal
|
|
|
|
* circumstances, as they're only put in that state by functions that have
|
|
|
|
* an exclusive hold on allprison_lock.
|
jail: Add prison_isvalid() and prison_isalive()
prison_isvalid() checks if a prison record can be used at all, i.e.
pr_ref > 0. This filters out prisons that aren't fully created, and
those that are either in the process of being dismantled, or will be
at the next opportunity. While the check for pr_ref > 0 is simple
enough to make without a convenience function, this prepares the way
for other measures of prison validity.
prison_isalive() checks not only validity as far as the useablity of
the prison structure, but also whether the prison is visible to user
space. It replaces a test for pr_uref > 0, which is currently only
used within kern_jail.c, and not often there.
Both of these functions also assert that either the prison mutex or
allprison_lock is held, since it's generally the case that unlocked
prisons aren't guaranteed to remain useable for any length of time.
This isn't entirely true, for example a thread can assume its own
prison is good, but most exceptions will exist inside of kern_jail.c.
2021-01-18 18:56:20 +00:00
|
|
|
*/
|
|
|
|
bool
|
|
|
|
prison_isvalid(struct prison *pr)
|
|
|
|
{
|
|
|
|
|
2021-02-21 21:24:47 +00:00
|
|
|
if (__predict_false(pr->pr_state == PRISON_STATE_INVALID))
|
|
|
|
return (false);
|
2021-01-20 23:08:27 +00:00
|
|
|
if (__predict_false(refcount_load(&pr->pr_ref) == 0))
|
jail: Add prison_isvalid() and prison_isalive()
prison_isvalid() checks if a prison record can be used at all, i.e.
pr_ref > 0. This filters out prisons that aren't fully created, and
those that are either in the process of being dismantled, or will be
at the next opportunity. While the check for pr_ref > 0 is simple
enough to make without a convenience function, this prepares the way
for other measures of prison validity.
prison_isalive() checks not only validity as far as the useablity of
the prison structure, but also whether the prison is visible to user
space. It replaces a test for pr_uref > 0, which is currently only
used within kern_jail.c, and not often there.
Both of these functions also assert that either the prison mutex or
allprison_lock is held, since it's generally the case that unlocked
prisons aren't guaranteed to remain useable for any length of time.
This isn't entirely true, for example a thread can assume its own
prison is good, but most exceptions will exist inside of kern_jail.c.
2021-01-18 18:56:20 +00:00
|
|
|
return (false);
|
|
|
|
return (true);
|
|
|
|
}
|
|
|
|
|
2009-12-13 13:57:32 +00:00
|
|
|
/*
|
2023-03-15 03:04:40 +00:00
|
|
|
* Return true if the passed credential is in a jail and that jail does not
|
|
|
|
* have its own virtual network stack, otherwise false.
|
2009-12-13 13:57:32 +00:00
|
|
|
*/
|
2023-03-15 03:04:40 +00:00
|
|
|
bool
|
2009-12-13 13:57:32 +00:00
|
|
|
jailed_without_vnet(struct ucred *cred)
|
|
|
|
{
|
|
|
|
|
|
|
|
if (!jailed(cred))
|
2023-03-15 03:04:40 +00:00
|
|
|
return (false);
|
2009-12-13 13:57:32 +00:00
|
|
|
#ifdef VIMAGE
|
|
|
|
if (prison_owns_vnet(cred))
|
2023-03-15 03:04:40 +00:00
|
|
|
return (false);
|
2009-12-13 13:57:32 +00:00
|
|
|
#endif
|
|
|
|
|
2023-03-15 03:04:40 +00:00
|
|
|
return (true);
|
2009-12-13 13:57:32 +00:00
|
|
|
}
|
|
|
|
|
2002-02-27 14:58:32 +00:00
|
|
|
/*
|
2009-06-13 00:12:02 +00:00
|
|
|
* Return the correct hostname (domainname, et al) for the passed credential.
|
2002-02-27 14:58:32 +00:00
|
|
|
*/
|
2002-02-27 16:43:20 +00:00
|
|
|
void
|
2003-04-28 18:32:19 +00:00
|
|
|
getcredhostname(struct ucred *cred, char *buf, size_t size)
|
2002-02-27 14:58:32 +00:00
|
|
|
{
|
2009-05-29 21:27:12 +00:00
|
|
|
struct prison *pr;
|
2002-02-27 14:58:32 +00:00
|
|
|
|
2009-06-13 00:12:02 +00:00
|
|
|
/*
|
|
|
|
* A NULL credential can be used to shortcut to the physical
|
|
|
|
* system's hostname.
|
|
|
|
*/
|
2009-05-29 21:27:12 +00:00
|
|
|
pr = (cred != NULL) ? cred->cr_prison : &prison0;
|
|
|
|
mtx_lock(&pr->pr_mtx);
|
2009-06-13 15:39:12 +00:00
|
|
|
strlcpy(buf, pr->pr_hostname, size);
|
2009-05-29 21:27:12 +00:00
|
|
|
mtx_unlock(&pr->pr_mtx);
|
2002-02-27 14:58:32 +00:00
|
|
|
}
|
2003-04-09 02:55:18 +00:00
|
|
|
|
2009-06-13 00:12:02 +00:00
|
|
|
void
|
|
|
|
getcreddomainname(struct ucred *cred, char *buf, size_t size)
|
|
|
|
{
|
|
|
|
|
|
|
|
mtx_lock(&cred->cr_prison->pr_mtx);
|
2009-06-13 15:39:12 +00:00
|
|
|
strlcpy(buf, cred->cr_prison->pr_domainname, size);
|
2009-06-13 00:12:02 +00:00
|
|
|
mtx_unlock(&cred->cr_prison->pr_mtx);
|
|
|
|
}
|
|
|
|
|
|
|
|
void
|
|
|
|
getcredhostuuid(struct ucred *cred, char *buf, size_t size)
|
|
|
|
{
|
|
|
|
|
|
|
|
mtx_lock(&cred->cr_prison->pr_mtx);
|
2009-06-13 15:39:12 +00:00
|
|
|
strlcpy(buf, cred->cr_prison->pr_hostuuid, size);
|
2009-06-13 00:12:02 +00:00
|
|
|
mtx_unlock(&cred->cr_prison->pr_mtx);
|
|
|
|
}
|
|
|
|
|
|
|
|
void
|
|
|
|
getcredhostid(struct ucred *cred, unsigned long *hostid)
|
|
|
|
{
|
|
|
|
|
|
|
|
mtx_lock(&cred->cr_prison->pr_mtx);
|
|
|
|
*hostid = cred->cr_prison->pr_hostid;
|
|
|
|
mtx_unlock(&cred->cr_prison->pr_mtx);
|
|
|
|
}
|
|
|
|
|
2020-04-18 07:50:30 +00:00
|
|
|
void
|
|
|
|
getjailname(struct ucred *cred, char *name, size_t len)
|
|
|
|
{
|
|
|
|
|
|
|
|
mtx_lock(&cred->cr_prison->pr_mtx);
|
|
|
|
strlcpy(name, cred->cr_prison->pr_name, len);
|
|
|
|
mtx_unlock(&cred->cr_prison->pr_mtx);
|
|
|
|
}
|
|
|
|
|
2009-08-13 10:26:34 +00:00
|
|
|
#ifdef VIMAGE
|
|
|
|
/*
|
|
|
|
* Determine whether the prison represented by cred owns
|
|
|
|
* its vnet rather than having it inherited.
|
|
|
|
*
|
2023-03-15 03:04:40 +00:00
|
|
|
* Returns true in case the prison owns the vnet, false otherwise.
|
2009-08-13 10:26:34 +00:00
|
|
|
*/
|
2023-03-15 03:04:40 +00:00
|
|
|
bool
|
2009-08-13 10:26:34 +00:00
|
|
|
prison_owns_vnet(struct ucred *cred)
|
|
|
|
{
|
|
|
|
|
|
|
|
/*
|
|
|
|
* vnets cannot be added/removed after jail creation,
|
|
|
|
* so no need to lock here.
|
|
|
|
*/
|
2023-03-15 03:04:40 +00:00
|
|
|
return ((cred->cr_prison->pr_flags & PR_VNET) != 0);
|
2009-08-13 10:26:34 +00:00
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2004-02-14 18:31:11 +00:00
|
|
|
/*
|
2005-06-09 18:49:19 +00:00
|
|
|
* Determine whether the subject represented by cred can "see"
|
|
|
|
* status of a mount point.
|
|
|
|
* Returns: 0 for permitted, ENOENT otherwise.
|
|
|
|
* XXX: This function should be called cr_canseemount() and should be
|
|
|
|
* placed in kern_prot.c.
|
2004-02-14 18:31:11 +00:00
|
|
|
*/
|
|
|
|
int
|
2005-06-09 18:49:19 +00:00
|
|
|
prison_canseemount(struct ucred *cred, struct mount *mp)
|
2004-02-14 18:31:11 +00:00
|
|
|
{
|
2005-06-09 18:49:19 +00:00
|
|
|
struct prison *pr;
|
|
|
|
struct statfs *sp;
|
|
|
|
size_t len;
|
2004-02-14 18:31:11 +00:00
|
|
|
|
2005-06-09 18:49:19 +00:00
|
|
|
pr = cred->cr_prison;
|
2009-05-27 14:11:23 +00:00
|
|
|
if (pr->pr_enforce_statfs == 0)
|
|
|
|
return (0);
|
2005-06-09 18:49:19 +00:00
|
|
|
if (pr->pr_root->v_mount == mp)
|
|
|
|
return (0);
|
2009-05-27 14:11:23 +00:00
|
|
|
if (pr->pr_enforce_statfs == 2)
|
2005-06-09 18:49:19 +00:00
|
|
|
return (ENOENT);
|
|
|
|
/*
|
|
|
|
* If jail's chroot directory is set to "/" we should be able to see
|
|
|
|
* all mount-points from inside a jail.
|
|
|
|
* This is ugly check, but this is the only situation when jail's
|
|
|
|
* directory ends with '/'.
|
|
|
|
*/
|
|
|
|
if (strcmp(pr->pr_path, "/") == 0)
|
|
|
|
return (0);
|
|
|
|
len = strlen(pr->pr_path);
|
|
|
|
sp = &mp->mnt_stat;
|
|
|
|
if (strncmp(pr->pr_path, sp->f_mntonname, len) != 0)
|
|
|
|
return (ENOENT);
|
|
|
|
/*
|
|
|
|
* Be sure that we don't have situation where jail's root directory
|
|
|
|
* is "/some/path" and mount point is "/some/pathpath".
|
|
|
|
*/
|
|
|
|
if (sp->f_mntonname[len] != '\0' && sp->f_mntonname[len] != '/')
|
|
|
|
return (ENOENT);
|
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
|
|
|
void
|
|
|
|
prison_enforce_statfs(struct ucred *cred, struct mount *mp, struct statfs *sp)
|
|
|
|
{
|
|
|
|
char jpath[MAXPATHLEN];
|
|
|
|
struct prison *pr;
|
|
|
|
size_t len;
|
|
|
|
|
|
|
|
pr = cred->cr_prison;
|
2009-05-27 14:11:23 +00:00
|
|
|
if (pr->pr_enforce_statfs == 0)
|
|
|
|
return;
|
2005-06-09 18:49:19 +00:00
|
|
|
if (prison_canseemount(cred, mp) != 0) {
|
|
|
|
bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
|
|
|
|
strlcpy(sp->f_mntonname, "[restricted]",
|
|
|
|
sizeof(sp->f_mntonname));
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
if (pr->pr_root->v_mount == mp) {
|
|
|
|
/*
|
|
|
|
* Clear current buffer data, so we are sure nothing from
|
|
|
|
* the valid path left there.
|
|
|
|
*/
|
|
|
|
bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
|
|
|
|
*sp->f_mntonname = '/';
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
/*
|
|
|
|
* If jail's chroot directory is set to "/" we should be able to see
|
|
|
|
* all mount-points from inside a jail.
|
|
|
|
*/
|
|
|
|
if (strcmp(pr->pr_path, "/") == 0)
|
|
|
|
return;
|
|
|
|
len = strlen(pr->pr_path);
|
|
|
|
strlcpy(jpath, sp->f_mntonname + len, sizeof(jpath));
|
|
|
|
/*
|
|
|
|
* Clear current buffer data, so we are sure nothing from
|
|
|
|
* the valid path left there.
|
|
|
|
*/
|
|
|
|
bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
|
|
|
|
if (*jpath == '\0') {
|
|
|
|
/* Should never happen. */
|
|
|
|
*sp->f_mntonname = '/';
|
|
|
|
} else {
|
|
|
|
strlcpy(sp->f_mntonname, jpath, sizeof(sp->f_mntonname));
|
2004-02-14 18:31:11 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
/*
|
|
|
|
* Check with permission for a specific privilege is granted within jail. We
|
|
|
|
* have a specific list of accepted privileges; the rest are denied.
|
|
|
|
*/
|
|
|
|
int
|
|
|
|
prison_priv_check(struct ucred *cred, int priv)
|
|
|
|
{
|
2020-12-27 04:25:02 +00:00
|
|
|
struct prison *pr;
|
|
|
|
int error;
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
|
2020-02-13 22:22:15 +00:00
|
|
|
/*
|
|
|
|
* Some policies have custom handlers. This routine should not be
|
|
|
|
* called for them. See priv_check_cred().
|
|
|
|
*/
|
|
|
|
switch (priv) {
|
2020-08-25 14:18:50 +00:00
|
|
|
case PRIV_VFS_LOOKUP:
|
2020-02-13 22:22:15 +00:00
|
|
|
case PRIV_VFS_GENERATION:
|
|
|
|
KASSERT(0, ("prison_priv_check instead of a custom handler "
|
|
|
|
"called for %d\n", priv));
|
|
|
|
}
|
|
|
|
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
if (!jailed(cred))
|
|
|
|
return (0);
|
|
|
|
|
2009-06-24 21:39:50 +00:00
|
|
|
#ifdef VIMAGE
|
|
|
|
/*
|
|
|
|
* Privileges specific to prisons with a virtual network stack.
|
|
|
|
* There might be a duplicate entry here in case the privilege
|
|
|
|
* is only granted conditionally in the legacy jail case.
|
|
|
|
*/
|
|
|
|
switch (priv) {
|
|
|
|
/*
|
|
|
|
* NFS-specific privileges.
|
|
|
|
*/
|
|
|
|
case PRIV_NFS_DAEMON:
|
2022-12-17 21:43:49 +00:00
|
|
|
case PRIV_VFS_GETFH:
|
|
|
|
case PRIV_VFS_MOUNT_EXPORTED:
|
|
|
|
if (!prison_check_nfsd(cred))
|
|
|
|
return (EPERM);
|
|
|
|
#ifdef notyet
|
2009-06-24 21:39:50 +00:00
|
|
|
case PRIV_NFS_LOCKD:
|
|
|
|
#endif
|
|
|
|
/*
|
|
|
|
* Network stack privileges.
|
|
|
|
*/
|
|
|
|
case PRIV_NET_BRIDGE:
|
|
|
|
case PRIV_NET_GRE:
|
|
|
|
case PRIV_NET_BPF:
|
|
|
|
case PRIV_NET_RAW: /* Dup, cond. in legacy jail case. */
|
|
|
|
case PRIV_NET_ROUTE:
|
|
|
|
case PRIV_NET_TAP:
|
|
|
|
case PRIV_NET_SETIFMTU:
|
|
|
|
case PRIV_NET_SETIFFLAGS:
|
|
|
|
case PRIV_NET_SETIFCAP:
|
2010-01-27 00:30:07 +00:00
|
|
|
case PRIV_NET_SETIFDESCR:
|
2009-06-24 21:39:50 +00:00
|
|
|
case PRIV_NET_SETIFNAME :
|
|
|
|
case PRIV_NET_SETIFMETRIC:
|
|
|
|
case PRIV_NET_SETIFPHYS:
|
|
|
|
case PRIV_NET_SETIFMAC:
|
2018-11-12 15:59:32 +00:00
|
|
|
case PRIV_NET_SETLANPCP:
|
2009-06-24 21:39:50 +00:00
|
|
|
case PRIV_NET_ADDMULTI:
|
|
|
|
case PRIV_NET_DELMULTI:
|
|
|
|
case PRIV_NET_HWIOCTL:
|
|
|
|
case PRIV_NET_SETLLADDR:
|
|
|
|
case PRIV_NET_ADDIFGROUP:
|
|
|
|
case PRIV_NET_DELIFGROUP:
|
|
|
|
case PRIV_NET_IFCREATE:
|
|
|
|
case PRIV_NET_IFDESTROY:
|
|
|
|
case PRIV_NET_ADDIFADDR:
|
|
|
|
case PRIV_NET_DELIFADDR:
|
|
|
|
case PRIV_NET_LAGG:
|
|
|
|
case PRIV_NET_GIF:
|
|
|
|
case PRIV_NET_SETIFVNET:
|
2011-07-03 12:22:02 +00:00
|
|
|
case PRIV_NET_SETIFFIB:
|
2022-02-22 09:21:38 +00:00
|
|
|
case PRIV_NET_OVPN:
|
2022-10-15 15:05:36 +00:00
|
|
|
case PRIV_NET_ME:
|
2022-10-28 20:36:12 +00:00
|
|
|
case PRIV_NET_WG:
|
2009-06-24 21:39:50 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* 802.11-related privileges.
|
|
|
|
*/
|
2020-07-19 15:16:27 +00:00
|
|
|
case PRIV_NET80211_VAP_GETKEY:
|
|
|
|
case PRIV_NET80211_VAP_MANAGE:
|
2009-06-24 21:39:50 +00:00
|
|
|
|
|
|
|
#ifdef notyet
|
|
|
|
/*
|
|
|
|
* ATM privileges.
|
|
|
|
*/
|
|
|
|
case PRIV_NETATM_CFG:
|
|
|
|
case PRIV_NETATM_ADD:
|
|
|
|
case PRIV_NETATM_DEL:
|
|
|
|
case PRIV_NETATM_SET:
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Bluetooth privileges.
|
|
|
|
*/
|
|
|
|
case PRIV_NETBLUETOOTH_RAW:
|
|
|
|
#endif
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Netgraph and netgraph module privileges.
|
|
|
|
*/
|
|
|
|
case PRIV_NETGRAPH_CONTROL:
|
|
|
|
#ifdef notyet
|
|
|
|
case PRIV_NETGRAPH_TTY:
|
|
|
|
#endif
|
|
|
|
|
|
|
|
/*
|
|
|
|
* IPv4 and IPv6 privileges.
|
|
|
|
*/
|
|
|
|
case PRIV_NETINET_IPFW:
|
|
|
|
case PRIV_NETINET_DIVERT:
|
|
|
|
case PRIV_NETINET_PF:
|
|
|
|
case PRIV_NETINET_DUMMYNET:
|
|
|
|
case PRIV_NETINET_CARP:
|
|
|
|
case PRIV_NETINET_MROUTE:
|
|
|
|
case PRIV_NETINET_RAW:
|
|
|
|
case PRIV_NETINET_ADDRCTRL6:
|
|
|
|
case PRIV_NETINET_ND6:
|
|
|
|
case PRIV_NETINET_SCOPE6:
|
|
|
|
case PRIV_NETINET_ALIFETIME6:
|
|
|
|
case PRIV_NETINET_IPSEC:
|
|
|
|
case PRIV_NETINET_BINDANY:
|
|
|
|
|
|
|
|
#ifdef notyet
|
|
|
|
/*
|
|
|
|
* NCP privileges.
|
|
|
|
*/
|
|
|
|
case PRIV_NETNCP:
|
|
|
|
|
|
|
|
/*
|
|
|
|
* SMB privileges.
|
|
|
|
*/
|
|
|
|
case PRIV_NETSMB:
|
|
|
|
#endif
|
|
|
|
|
|
|
|
/*
|
|
|
|
* No default: or deny here.
|
|
|
|
* In case of no permit fall through to next switch().
|
|
|
|
*/
|
|
|
|
if (cred->cr_prison->pr_flags & PR_VNET)
|
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
#endif /* VIMAGE */
|
|
|
|
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
switch (priv) {
|
|
|
|
/*
|
|
|
|
* Allow ktrace privileges for root in jail.
|
|
|
|
*/
|
|
|
|
case PRIV_KTRACE:
|
|
|
|
|
2007-02-19 13:10:29 +00:00
|
|
|
#if 0
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
/*
|
|
|
|
* Allow jailed processes to configure audit identity and
|
|
|
|
* submit audit records (login, etc). In the future we may
|
|
|
|
* want to further refine the relationship between audit and
|
|
|
|
* jail.
|
|
|
|
*/
|
|
|
|
case PRIV_AUDIT_GETAUDIT:
|
|
|
|
case PRIV_AUDIT_SETAUDIT:
|
|
|
|
case PRIV_AUDIT_SUBMIT:
|
2007-02-19 13:10:29 +00:00
|
|
|
#endif
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Allow jailed processes to manipulate process UNIX
|
|
|
|
* credentials in any way they see fit.
|
|
|
|
*/
|
|
|
|
case PRIV_CRED_SETUID:
|
|
|
|
case PRIV_CRED_SETEUID:
|
|
|
|
case PRIV_CRED_SETGID:
|
|
|
|
case PRIV_CRED_SETEGID:
|
|
|
|
case PRIV_CRED_SETGROUPS:
|
|
|
|
case PRIV_CRED_SETREUID:
|
|
|
|
case PRIV_CRED_SETREGID:
|
|
|
|
case PRIV_CRED_SETRESUID:
|
|
|
|
case PRIV_CRED_SETRESGID:
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Jail implements visibility constraints already, so allow
|
|
|
|
* jailed root to override uid/gid-based constraints.
|
|
|
|
*/
|
|
|
|
case PRIV_SEEOTHERGIDS:
|
|
|
|
case PRIV_SEEOTHERUIDS:
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Jail implements inter-process debugging limits already, so
|
|
|
|
* allow jailed root various debugging privileges.
|
|
|
|
*/
|
|
|
|
case PRIV_DEBUG_DIFFCRED:
|
|
|
|
case PRIV_DEBUG_SUGID:
|
|
|
|
case PRIV_DEBUG_UNPRIV:
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Allow jail to set various resource limits and login
|
|
|
|
* properties, and for now, exceed process resource limits.
|
|
|
|
*/
|
|
|
|
case PRIV_PROC_LIMIT:
|
|
|
|
case PRIV_PROC_SETLOGIN:
|
|
|
|
case PRIV_PROC_SETRLIMIT:
|
|
|
|
|
|
|
|
/*
|
|
|
|
* System V and POSIX IPC privileges are granted in jail.
|
|
|
|
*/
|
|
|
|
case PRIV_IPC_READ:
|
|
|
|
case PRIV_IPC_WRITE:
|
|
|
|
case PRIV_IPC_ADMIN:
|
|
|
|
case PRIV_IPC_MSGSIZE:
|
|
|
|
case PRIV_MQ_ADMIN:
|
|
|
|
|
2009-05-27 14:11:23 +00:00
|
|
|
/*
|
|
|
|
* Jail operations within a jail work on child jails.
|
|
|
|
*/
|
|
|
|
case PRIV_JAIL_ATTACH:
|
|
|
|
case PRIV_JAIL_SET:
|
|
|
|
case PRIV_JAIL_REMOVE:
|
|
|
|
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
/*
|
|
|
|
* Jail implements its own inter-process limits, so allow
|
|
|
|
* root processes in jail to change scheduling on other
|
|
|
|
* processes in the same jail. Likewise for signalling.
|
|
|
|
*/
|
|
|
|
case PRIV_SCHED_DIFFCRED:
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
case PRIV_SCHED_CPUSET:
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
case PRIV_SIGNAL_DIFFCRED:
|
|
|
|
case PRIV_SIGNAL_SUGID:
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Allow jailed processes to write to sysctls marked as jail
|
|
|
|
* writable.
|
|
|
|
*/
|
|
|
|
case PRIV_SYSCTL_WRITEJAIL:
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Allow root in jail to manage a variety of quota
|
2007-02-19 13:26:39 +00:00
|
|
|
* properties. These should likely be conditional on a
|
|
|
|
* configuration option.
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
*/
|
2007-02-19 13:33:10 +00:00
|
|
|
case PRIV_VFS_GETQUOTA:
|
|
|
|
case PRIV_VFS_SETQUOTA:
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Since Jail relies on chroot() to implement file system
|
|
|
|
* protections, grant many VFS privileges to root in jail.
|
|
|
|
* Be careful to exclude mount-related and NFS-related
|
|
|
|
* privileges.
|
|
|
|
*/
|
|
|
|
case PRIV_VFS_READ:
|
|
|
|
case PRIV_VFS_WRITE:
|
|
|
|
case PRIV_VFS_ADMIN:
|
|
|
|
case PRIV_VFS_EXEC:
|
|
|
|
case PRIV_VFS_BLOCKRESERVE: /* XXXRW: Slightly surprising. */
|
|
|
|
case PRIV_VFS_CHFLAGS_DEV:
|
|
|
|
case PRIV_VFS_CHOWN:
|
|
|
|
case PRIV_VFS_CHROOT:
|
2007-03-01 20:47:42 +00:00
|
|
|
case PRIV_VFS_RETAINSUGID:
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
case PRIV_VFS_FCHROOT:
|
|
|
|
case PRIV_VFS_LINK:
|
|
|
|
case PRIV_VFS_SETGID:
|
2007-10-21 22:50:11 +00:00
|
|
|
case PRIV_VFS_STAT:
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
case PRIV_VFS_STICKYFILE:
|
2013-09-06 17:32:29 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* As in the non-jail case, non-root users are expected to be
|
2021-10-27 04:16:06 +00:00
|
|
|
* able to read kernel/physical memory (provided /dev/[k]mem
|
2013-09-06 17:32:29 +00:00
|
|
|
* exists in the jail and they have permission to access it).
|
|
|
|
*/
|
|
|
|
case PRIV_KMEM_READ:
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
return (0);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Depending on the global setting, allow privilege of
|
|
|
|
* setting system flags.
|
|
|
|
*/
|
|
|
|
case PRIV_VFS_SYSFLAGS:
|
2009-05-27 14:11:23 +00:00
|
|
|
if (cred->cr_prison->pr_allow & PR_ALLOW_CHFLAGS)
|
2007-04-05 21:03:05 +00:00
|
|
|
return (0);
|
|
|
|
else
|
|
|
|
return (EPERM);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Depending on the global setting, allow privilege of
|
|
|
|
* mounting/unmounting file systems.
|
|
|
|
*/
|
|
|
|
case PRIV_VFS_MOUNT:
|
|
|
|
case PRIV_VFS_UNMOUNT:
|
|
|
|
case PRIV_VFS_MOUNT_NONUSER:
|
2007-04-13 23:54:22 +00:00
|
|
|
case PRIV_VFS_MOUNT_OWNER:
|
2020-12-27 04:25:02 +00:00
|
|
|
pr = cred->cr_prison;
|
|
|
|
prison_lock(pr);
|
|
|
|
if (pr->pr_allow & PR_ALLOW_MOUNT && pr->pr_enforce_statfs < 2)
|
|
|
|
error = 0;
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
else
|
2020-12-27 04:25:02 +00:00
|
|
|
error = EPERM;
|
|
|
|
prison_unlock(pr);
|
|
|
|
return (error);
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
|
vfs: add restrictions to read(2) of a directory [2/2]
This commit adds the priv(9) that waters down the sysctl to make it only
allow read(2) of a dirfd by the system root. Jailed root is not allowed, but
jail policy and superuser policy will abstain from allowing/denying it so
that a MAC module can fully control the policy.
Such a MAC module has been written, and can be found at:
https://people.freebsd.org/~kevans/mac_read_dir-0.1.0.tar.gz
It is expected that the MAC module won't be needed by many, as most only
need to do such diagnostics that require this behavior as system root
anyways. Interested parties are welcome to grab the MAC module above and
create a port or locally integrate it, and with enough support it could see
introduction to base. As noted in mac_read_dir.c, it is released under the
BSD 2 clause license and allows the restrictions to be lifted for only
jailed root or for all unprivileged users.
PR: 246412
Reviewed by: mckusick, kib, emaste, jilles, cy, phk, imp (all previous)
Reviewed by: rgrimes (latest version)
Differential Revision: https://reviews.freebsd.org/D24596
2020-06-04 18:17:25 +00:00
|
|
|
/*
|
|
|
|
* Jails should hold no disposition on the PRIV_VFS_READ_DIR
|
|
|
|
* policy. priv_check_cred will not specifically allow it, and
|
|
|
|
* we may want a MAC policy to allow it.
|
|
|
|
*/
|
|
|
|
case PRIV_VFS_READ_DIR:
|
|
|
|
return (0);
|
|
|
|
|
2018-07-29 12:41:56 +00:00
|
|
|
/*
|
|
|
|
* Conditionnaly allow locking (unlocking) physical pages
|
|
|
|
* in memory.
|
|
|
|
*/
|
|
|
|
case PRIV_VM_MLOCK:
|
|
|
|
case PRIV_VM_MUNLOCK:
|
|
|
|
if (cred->cr_prison->pr_allow & PR_ALLOW_MLOCK)
|
|
|
|
return (0);
|
|
|
|
else
|
|
|
|
return (EPERM);
|
|
|
|
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
/*
|
2017-06-06 02:15:00 +00:00
|
|
|
* Conditionally allow jailed root to bind reserved ports.
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
*/
|
|
|
|
case PRIV_NETINET_RESERVEDPORT:
|
2017-06-06 02:15:00 +00:00
|
|
|
if (cred->cr_prison->pr_allow & PR_ALLOW_RESERVED_PORTS)
|
|
|
|
return (0);
|
|
|
|
else
|
|
|
|
return (EPERM);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Allow jailed root to reuse in-use ports.
|
|
|
|
*/
|
2007-04-10 15:59:49 +00:00
|
|
|
case PRIV_NETINET_REUSEPORT:
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
return (0);
|
|
|
|
|
2008-01-24 08:25:59 +00:00
|
|
|
/*
|
2016-04-29 22:15:33 +00:00
|
|
|
* Allow jailed root to set certain IPv4/6 (option) headers.
|
2008-01-24 08:25:59 +00:00
|
|
|
*/
|
|
|
|
case PRIV_NETINET_SETHDROPTS:
|
|
|
|
return (0);
|
|
|
|
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
/*
|
|
|
|
* Conditionally allow creating raw sockets in jail.
|
|
|
|
*/
|
|
|
|
case PRIV_NETINET_RAW:
|
2009-05-27 14:11:23 +00:00
|
|
|
if (cred->cr_prison->pr_allow & PR_ALLOW_RAW_SOCKETS)
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
return (0);
|
|
|
|
else
|
|
|
|
return (EPERM);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Since jail implements its own visibility limits on netstat
|
|
|
|
* sysctls, allow getcred. This allows identd to work in
|
|
|
|
* jail.
|
|
|
|
*/
|
|
|
|
case PRIV_NETINET_GETCRED:
|
|
|
|
return (0);
|
|
|
|
|
2011-03-05 12:40:35 +00:00
|
|
|
/*
|
|
|
|
* Allow jailed root to set loginclass.
|
|
|
|
*/
|
|
|
|
case PRIV_PROC_SETLOGINCLASS:
|
|
|
|
return (0);
|
|
|
|
|
2018-10-17 16:11:43 +00:00
|
|
|
/*
|
2018-10-18 15:02:57 +00:00
|
|
|
* Do not allow a process inside a jail to read the kernel
|
2018-10-17 16:11:43 +00:00
|
|
|
* message buffer unless explicitly permitted.
|
|
|
|
*/
|
|
|
|
case PRIV_MSGBUF:
|
|
|
|
if (cred->cr_prison->pr_allow & PR_ALLOW_READ_MSGBUF)
|
|
|
|
return (0);
|
|
|
|
return (EPERM);
|
|
|
|
|
Add a new priv(9) kernel interface for checking the availability of
privilege for threads and credentials. Unlike the existing suser(9)
interface, priv(9) exposes a named privilege identifier to the privilege
checking code, allowing more complex policies regarding the granting of
privilege to be expressed. Two interfaces are provided, replacing the
existing suser(9) interface:
suser(td) -> priv_check(td, priv)
suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags)
A comprehensive list of currently available kernel privileges may be
found in priv.h. New privileges are easily added as required, but the
comments on adding privileges found in priv.h and priv(9) should be read
before doing so.
The new privilege interface exposed sufficient information to the
privilege checking routine that it will now be possible for jail to
determine whether a particular privilege is granted in the check routine,
rather than relying on hints from the calling context via the
SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail
check function, prison_priv_check(), is exposed from kern_jail.c and used
by the privilege check routine to determine if the privilege is permitted
in jail. As a result, a centralized list of privileges permitted in jail
is now present in kern_jail.c.
The MAC Framework is now also able to instrument privilege checks, both
to deny privileges otherwise granted (mac_priv_check()), and to grant
privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
modules to implement privilege models, as well as control a much broader
range of system behavior in order to constrain processes running with
root privilege.
The suser() and suser_cred() functions remain implemented, now in terms
of priv_check() and the PRIV_ROOT privilege, for use during the transition
and possibly continuing use by third party kernel modules that have not
been updated. The PRIV_DRIVER privilege exists to allow device drivers to
check privilege without adopting a more specific privilege identifier.
This change does not modify the actual security policy, rather, it
modifies the interface for privilege checks so changes to the security
policy become more feasible.
Sponsored by: nCircle Network Security, Inc.
Obtained from: TrustedBSD Project
Discussed on: arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
Alex Lyashkov <umka at sevcity dot net>,
Skip Ford <skip dot ford at verizon dot net>,
Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:37:19 +00:00
|
|
|
default:
|
|
|
|
/*
|
|
|
|
* In all remaining cases, deny the privilege request. This
|
|
|
|
* includes almost all network privileges, many system
|
|
|
|
* configuration privileges.
|
|
|
|
*/
|
|
|
|
return (EPERM);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2009-05-27 14:11:23 +00:00
|
|
|
/*
|
|
|
|
* Return the part of pr2's name that is relative to pr1, or the whole name
|
|
|
|
* if it does not directly follow.
|
|
|
|
*/
|
|
|
|
|
|
|
|
char *
|
|
|
|
prison_name(struct prison *pr1, struct prison *pr2)
|
|
|
|
{
|
|
|
|
char *name;
|
|
|
|
|
|
|
|
/* Jails see themselves as "0" (if they see themselves at all). */
|
|
|
|
if (pr1 == pr2)
|
|
|
|
return "0";
|
|
|
|
name = pr2->pr_name;
|
|
|
|
if (prison_ischild(pr1, pr2)) {
|
|
|
|
/*
|
|
|
|
* pr1 isn't locked (and allprison_lock may not be either)
|
|
|
|
* so its length can't be counted on. But the number of dots
|
|
|
|
* can be counted on - and counted.
|
|
|
|
*/
|
|
|
|
for (; pr1 != &prison0; pr1 = pr1->pr_parent)
|
|
|
|
name = strchr(name, '.') + 1;
|
|
|
|
}
|
|
|
|
return (name);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Return the part of pr2's path that is relative to pr1, or the whole path
|
|
|
|
* if it does not directly follow.
|
|
|
|
*/
|
|
|
|
static char *
|
|
|
|
prison_path(struct prison *pr1, struct prison *pr2)
|
|
|
|
{
|
|
|
|
char *path1, *path2;
|
|
|
|
int len1;
|
|
|
|
|
|
|
|
path1 = pr1->pr_path;
|
|
|
|
path2 = pr2->pr_path;
|
|
|
|
if (!strcmp(path1, "/"))
|
|
|
|
return (path2);
|
|
|
|
len1 = strlen(path1);
|
|
|
|
if (strncmp(path1, path2, len1))
|
|
|
|
return (path2);
|
|
|
|
if (path2[len1] == '\0')
|
|
|
|
return "/";
|
|
|
|
if (path2[len1] == '/')
|
|
|
|
return (path2 + len1);
|
|
|
|
return (path2);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Jail-related sysctls.
|
|
|
|
*/
|
2020-02-26 14:26:36 +00:00
|
|
|
static SYSCTL_NODE(_security, OID_AUTO, jail, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
|
2009-05-27 14:11:23 +00:00
|
|
|
"Jails");
|
|
|
|
|
2021-12-26 18:45:50 +00:00
|
|
|
#if defined(INET) || defined(INET6)
|
|
|
|
/*
|
|
|
|
* Copy address array to memory that would be then SYSCTL_OUT-ed.
|
|
|
|
* sysctl_jail_list() helper.
|
|
|
|
*/
|
|
|
|
static void
|
|
|
|
prison_ip_copyout(struct prison *pr, const pr_family_t af, void **out, int *len)
|
|
|
|
{
|
2023-02-28 10:14:07 +00:00
|
|
|
const struct prison_ip *pip;
|
2021-12-26 18:45:50 +00:00
|
|
|
const size_t size = pr_families[af].size;
|
|
|
|
|
|
|
|
again:
|
|
|
|
mtx_assert(&pr->pr_mtx, MA_OWNED);
|
2023-02-28 10:14:07 +00:00
|
|
|
if ((pip = pr->pr_addrs[af]) != NULL) {
|
|
|
|
if (*len < pip->ips) {
|
|
|
|
*len = pip->ips;
|
2021-12-26 18:45:50 +00:00
|
|
|
mtx_unlock(&pr->pr_mtx);
|
|
|
|
*out = realloc(*out, *len * size, M_TEMP, M_WAITOK);
|
|
|
|
mtx_lock(&pr->pr_mtx);
|
|
|
|
goto again;
|
|
|
|
}
|
2023-02-28 10:14:07 +00:00
|
|
|
bcopy(pip->pr_ip, *out, pip->ips * size);
|
2021-12-26 18:45:50 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2003-04-09 02:55:18 +00:00
|
|
|
static int
|
|
|
|
sysctl_jail_list(SYSCTL_HANDLER_ARGS)
|
|
|
|
{
|
2009-04-29 21:14:15 +00:00
|
|
|
struct xprison *xp;
|
2009-05-27 14:11:23 +00:00
|
|
|
struct prison *pr, *cpr;
|
2009-04-29 21:14:15 +00:00
|
|
|
#ifdef INET
|
|
|
|
struct in_addr *ip4 = NULL;
|
|
|
|
int ip4s = 0;
|
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
2010-06-04 14:38:24 +00:00
|
|
|
struct in6_addr *ip6 = NULL;
|
2009-04-29 21:14:15 +00:00
|
|
|
int ip6s = 0;
|
|
|
|
#endif
|
2009-05-27 14:11:23 +00:00
|
|
|
int descend, error;
|
2003-04-09 02:55:18 +00:00
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
xp = malloc(sizeof(*xp), M_TEMP, M_WAITOK);
|
2009-05-27 14:11:23 +00:00
|
|
|
pr = req->td->td_ucred->cr_prison;
|
2009-04-29 21:14:15 +00:00
|
|
|
error = 0;
|
2007-04-05 23:19:13 +00:00
|
|
|
sx_slock(&allprison_lock);
|
2009-05-27 14:11:23 +00:00
|
|
|
FOREACH_PRISON_DESCENDANT(pr, cpr, descend) {
|
|
|
|
mtx_lock(&cpr->pr_mtx);
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
#ifdef INET
|
2021-12-26 18:45:50 +00:00
|
|
|
prison_ip_copyout(cpr, PR_INET, (void **)&ip4, &ip4s);
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
2021-12-26 18:45:50 +00:00
|
|
|
prison_ip_copyout(cpr, PR_INET6, (void **)&ip6, &ip6s);
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
#endif
|
2009-04-29 21:14:15 +00:00
|
|
|
bzero(xp, sizeof(*xp));
|
2003-04-09 02:55:18 +00:00
|
|
|
xp->pr_version = XPRISON_VERSION;
|
2009-05-27 14:11:23 +00:00
|
|
|
xp->pr_id = cpr->pr_id;
|
2021-02-21 21:24:47 +00:00
|
|
|
xp->pr_state = cpr->pr_state;
|
2009-05-27 14:11:23 +00:00
|
|
|
strlcpy(xp->pr_path, prison_path(pr, cpr), sizeof(xp->pr_path));
|
2009-06-13 15:39:12 +00:00
|
|
|
strlcpy(xp->pr_host, cpr->pr_hostname, sizeof(xp->pr_host));
|
2009-05-27 14:11:23 +00:00
|
|
|
strlcpy(xp->pr_name, prison_name(pr, cpr), sizeof(xp->pr_name));
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
#ifdef INET
|
2021-12-26 18:45:50 +00:00
|
|
|
xp->pr_ip4s = ip4s;
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
2021-12-26 18:45:50 +00:00
|
|
|
xp->pr_ip6s = ip6s;
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
#endif
|
2009-05-27 14:11:23 +00:00
|
|
|
mtx_unlock(&cpr->pr_mtx);
|
2009-04-29 21:14:15 +00:00
|
|
|
error = SYSCTL_OUT(req, xp, sizeof(*xp));
|
|
|
|
if (error)
|
|
|
|
break;
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
#ifdef INET
|
2009-04-29 21:14:15 +00:00
|
|
|
if (xp->pr_ip4s > 0) {
|
|
|
|
error = SYSCTL_OUT(req, ip4,
|
|
|
|
xp->pr_ip4s * sizeof(struct in_addr));
|
|
|
|
if (error)
|
|
|
|
break;
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
}
|
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
2009-04-29 21:14:15 +00:00
|
|
|
if (xp->pr_ip6s > 0) {
|
|
|
|
error = SYSCTL_OUT(req, ip6,
|
|
|
|
xp->pr_ip6s * sizeof(struct in6_addr));
|
|
|
|
if (error)
|
|
|
|
break;
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
}
|
|
|
|
#endif
|
2003-04-09 02:55:18 +00:00
|
|
|
}
|
2007-04-05 23:19:13 +00:00
|
|
|
sx_sunlock(&allprison_lock);
|
2009-04-29 21:14:15 +00:00
|
|
|
free(xp, M_TEMP);
|
|
|
|
#ifdef INET
|
|
|
|
free(ip4, M_TEMP);
|
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
|
|
|
free(ip6, M_TEMP);
|
|
|
|
#endif
|
2007-03-09 05:22:10 +00:00
|
|
|
return (error);
|
2003-04-09 02:55:18 +00:00
|
|
|
}
|
|
|
|
|
Mark most often used sysctl's as MPSAFE.
After running a `make buildkernel', I noticed most of the Giant locks in
sysctl are only caused by a very small amount of sysctl's:
- sysctl.name2oid. This one is locked by SYSCTL_LOCK, just like
sysctl.oidfmt.
- kern.ident, kern.osrelease, kern.version, etc. These are just constant
strings.
- kern.arandom, used by the stack protector. It is already protected by
arc4_mtx.
I also saw the following sysctl's show up. Not as often as the ones
above, but still quite often:
- security.jail.jailed. Also mark security.jail.list as MPSAFE. They
don't need locking or already use allprison_lock.
- kern.devname, used by devname(3), ttyname(3), etc.
This seems to reduce Giant locking inside sysctl by ~75% in my primitive
test setup.
2009-01-28 19:58:05 +00:00
|
|
|
SYSCTL_OID(_security_jail, OID_AUTO, list,
|
|
|
|
CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
|
|
|
|
sysctl_jail_list, "S", "List of active jails");
|
2004-02-19 14:29:14 +00:00
|
|
|
|
|
|
|
static int
|
|
|
|
sysctl_jail_jailed(SYSCTL_HANDLER_ARGS)
|
|
|
|
{
|
|
|
|
int error, injail;
|
|
|
|
|
|
|
|
injail = jailed(req->td->td_ucred);
|
|
|
|
error = SYSCTL_OUT(req, &injail, sizeof(injail));
|
|
|
|
|
|
|
|
return (error);
|
|
|
|
}
|
2009-05-27 14:11:23 +00:00
|
|
|
|
Mark most often used sysctl's as MPSAFE.
After running a `make buildkernel', I noticed most of the Giant locks in
sysctl are only caused by a very small amount of sysctl's:
- sysctl.name2oid. This one is locked by SYSCTL_LOCK, just like
sysctl.oidfmt.
- kern.ident, kern.osrelease, kern.version, etc. These are just constant
strings.
- kern.arandom, used by the stack protector. It is already protected by
arc4_mtx.
I also saw the following sysctl's show up. Not as often as the ones
above, but still quite often:
- security.jail.jailed. Also mark security.jail.list as MPSAFE. They
don't need locking or already use allprison_lock.
- kern.devname, used by devname(3), ttyname(3), etc.
This seems to reduce Giant locking inside sysctl by ~75% in my primitive
test setup.
2009-01-28 19:58:05 +00:00
|
|
|
SYSCTL_PROC(_security_jail, OID_AUTO, jailed,
|
|
|
|
CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
|
|
|
|
sysctl_jail_jailed, "I", "Process in jail?");
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
|
2013-05-19 04:10:34 +00:00
|
|
|
static int
|
|
|
|
sysctl_jail_vnet(SYSCTL_HANDLER_ARGS)
|
|
|
|
{
|
|
|
|
int error, havevnet;
|
|
|
|
#ifdef VIMAGE
|
|
|
|
struct ucred *cred = req->td->td_ucred;
|
|
|
|
|
|
|
|
havevnet = jailed(cred) && prison_owns_vnet(cred);
|
|
|
|
#else
|
|
|
|
havevnet = 0;
|
|
|
|
#endif
|
|
|
|
error = SYSCTL_OUT(req, &havevnet, sizeof(havevnet));
|
|
|
|
|
|
|
|
return (error);
|
|
|
|
}
|
|
|
|
|
|
|
|
SYSCTL_PROC(_security_jail, OID_AUTO, vnet,
|
|
|
|
CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
|
2018-05-24 15:31:05 +00:00
|
|
|
sysctl_jail_vnet, "I", "Jail owns vnet?");
|
2013-05-19 04:10:34 +00:00
|
|
|
|
2009-05-27 14:11:23 +00:00
|
|
|
#if defined(INET) || defined(INET6)
|
2009-06-09 22:09:29 +00:00
|
|
|
SYSCTL_UINT(_security_jail, OID_AUTO, jail_max_af_ips, CTLFLAG_RW,
|
2009-05-27 14:11:23 +00:00
|
|
|
&jail_max_af_ips, 0,
|
2018-08-16 19:09:43 +00:00
|
|
|
"Number of IP addresses a jail may have at most per address family (deprecated)");
|
2009-05-27 14:11:23 +00:00
|
|
|
#endif
|
|
|
|
|
|
|
|
/*
|
2018-08-16 19:09:43 +00:00
|
|
|
* Default parameters for jail(2) compatibility. For historical reasons,
|
|
|
|
* the sysctl names have varying similarity to the parameter names. Prisons
|
|
|
|
* just see their own parameters, and can't change them.
|
2009-05-27 14:11:23 +00:00
|
|
|
*/
|
|
|
|
static int
|
|
|
|
sysctl_jail_default_allow(SYSCTL_HANDLER_ARGS)
|
|
|
|
{
|
2020-12-27 04:25:02 +00:00
|
|
|
int error, i;
|
2009-05-27 14:11:23 +00:00
|
|
|
|
|
|
|
/* Get the current flag value, and convert it to a boolean. */
|
2020-12-27 04:25:02 +00:00
|
|
|
if (req->td->td_ucred->cr_prison == &prison0) {
|
|
|
|
mtx_lock(&prison0.pr_mtx);
|
|
|
|
i = (jail_default_allow & arg2) != 0;
|
|
|
|
mtx_unlock(&prison0.pr_mtx);
|
|
|
|
} else
|
|
|
|
i = prison_allow(req->td->td_ucred, arg2);
|
|
|
|
|
2009-05-27 14:11:23 +00:00
|
|
|
if (arg1 != NULL)
|
|
|
|
i = !i;
|
|
|
|
error = sysctl_handle_int(oidp, &i, 0, req);
|
2018-08-16 19:09:43 +00:00
|
|
|
if (error || !req->newptr)
|
2009-05-27 14:11:23 +00:00
|
|
|
return (error);
|
2018-08-16 19:09:43 +00:00
|
|
|
i = i ? arg2 : 0;
|
|
|
|
if (arg1 != NULL)
|
|
|
|
i ^= arg2;
|
|
|
|
/*
|
|
|
|
* The sysctls don't have CTLFLAGS_PRISON, so assume prison0
|
|
|
|
* for writing.
|
|
|
|
*/
|
|
|
|
mtx_lock(&prison0.pr_mtx);
|
|
|
|
jail_default_allow = (jail_default_allow & ~arg2) | i;
|
|
|
|
mtx_unlock(&prison0.pr_mtx);
|
2009-05-27 14:11:23 +00:00
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
|
|
|
SYSCTL_PROC(_security_jail, OID_AUTO, set_hostname_allowed,
|
2018-08-16 19:09:43 +00:00
|
|
|
CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
|
2009-05-27 14:11:23 +00:00
|
|
|
NULL, PR_ALLOW_SET_HOSTNAME, sysctl_jail_default_allow, "I",
|
2018-08-16 19:09:43 +00:00
|
|
|
"Processes in jail can set their hostnames (deprecated)");
|
2009-05-27 14:11:23 +00:00
|
|
|
SYSCTL_PROC(_security_jail, OID_AUTO, socket_unixiproute_only,
|
2018-08-16 19:09:43 +00:00
|
|
|
CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
|
2009-05-27 14:11:23 +00:00
|
|
|
(void *)1, PR_ALLOW_SOCKET_AF, sysctl_jail_default_allow, "I",
|
2018-08-16 19:09:43 +00:00
|
|
|
"Processes in jail are limited to creating UNIX/IP/route sockets only (deprecated)");
|
2009-05-27 14:11:23 +00:00
|
|
|
SYSCTL_PROC(_security_jail, OID_AUTO, sysvipc_allowed,
|
2018-08-16 19:09:43 +00:00
|
|
|
CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
|
2009-05-27 14:11:23 +00:00
|
|
|
NULL, PR_ALLOW_SYSVIPC, sysctl_jail_default_allow, "I",
|
2018-08-16 19:09:43 +00:00
|
|
|
"Processes in jail can use System V IPC primitives (deprecated)");
|
2009-05-27 14:11:23 +00:00
|
|
|
SYSCTL_PROC(_security_jail, OID_AUTO, allow_raw_sockets,
|
2018-08-16 19:09:43 +00:00
|
|
|
CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
|
2009-05-27 14:11:23 +00:00
|
|
|
NULL, PR_ALLOW_RAW_SOCKETS, sysctl_jail_default_allow, "I",
|
2018-08-16 19:09:43 +00:00
|
|
|
"Prison root can create raw sockets (deprecated)");
|
2009-05-27 14:11:23 +00:00
|
|
|
SYSCTL_PROC(_security_jail, OID_AUTO, chflags_allowed,
|
2018-08-16 19:09:43 +00:00
|
|
|
CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
|
2009-05-27 14:11:23 +00:00
|
|
|
NULL, PR_ALLOW_CHFLAGS, sysctl_jail_default_allow, "I",
|
2018-08-16 19:09:43 +00:00
|
|
|
"Processes in jail can alter system file flags (deprecated)");
|
2009-05-27 14:11:23 +00:00
|
|
|
SYSCTL_PROC(_security_jail, OID_AUTO, mount_allowed,
|
2018-08-16 19:09:43 +00:00
|
|
|
CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
|
2009-05-27 14:11:23 +00:00
|
|
|
NULL, PR_ALLOW_MOUNT, sysctl_jail_default_allow, "I",
|
2018-08-16 19:09:43 +00:00
|
|
|
"Processes in jail can mount/unmount jail-friendly file systems (deprecated)");
|
2009-05-27 14:11:23 +00:00
|
|
|
|
|
|
|
static int
|
|
|
|
sysctl_jail_default_level(SYSCTL_HANDLER_ARGS)
|
|
|
|
{
|
|
|
|
struct prison *pr;
|
|
|
|
int level, error;
|
|
|
|
|
|
|
|
pr = req->td->td_ucred->cr_prison;
|
|
|
|
level = (pr == &prison0) ? *(int *)arg1 : *(int *)((char *)pr + arg2);
|
|
|
|
error = sysctl_handle_int(oidp, &level, 0, req);
|
2018-08-16 19:09:43 +00:00
|
|
|
if (error || !req->newptr)
|
2009-05-27 14:11:23 +00:00
|
|
|
return (error);
|
2018-08-16 19:09:43 +00:00
|
|
|
*(int *)arg1 = level;
|
2009-05-27 14:11:23 +00:00
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
|
|
|
SYSCTL_PROC(_security_jail, OID_AUTO, enforce_statfs,
|
2018-08-16 19:09:43 +00:00
|
|
|
CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
|
|
|
|
&jail_default_enforce_statfs, offsetof(struct prison, pr_enforce_statfs),
|
2009-05-27 14:11:23 +00:00
|
|
|
sysctl_jail_default_level, "I",
|
2018-08-16 19:09:43 +00:00
|
|
|
"Processes in jail cannot see all mounted file systems (deprecated)");
|
|
|
|
|
2012-02-09 10:22:08 +00:00
|
|
|
SYSCTL_PROC(_security_jail, OID_AUTO, devfs_ruleset,
|
2018-08-16 19:09:43 +00:00
|
|
|
CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE,
|
|
|
|
&jail_default_devfs_rsnum, offsetof(struct prison, pr_devfs_rsnum),
|
2012-02-09 10:22:08 +00:00
|
|
|
sysctl_jail_default_level, "I",
|
2018-08-16 19:09:43 +00:00
|
|
|
"Ruleset for the devfs filesystem in jail (deprecated)");
|
2012-02-09 10:22:08 +00:00
|
|
|
|
2009-05-27 14:11:23 +00:00
|
|
|
/*
|
|
|
|
* Nodes to describe jail parameters. Maximum length of string parameters
|
|
|
|
* is returned in the string itself, and the other parameters exist merely
|
|
|
|
* to make themselves and their types known.
|
|
|
|
*/
|
2020-02-26 14:26:36 +00:00
|
|
|
SYSCTL_NODE(_security_jail, OID_AUTO, param, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
|
2009-05-27 14:11:23 +00:00
|
|
|
"Jail parameters");
|
|
|
|
|
|
|
|
int
|
|
|
|
sysctl_jail_param(SYSCTL_HANDLER_ARGS)
|
|
|
|
{
|
|
|
|
int i;
|
|
|
|
long l;
|
|
|
|
size_t s;
|
|
|
|
char numbuf[12];
|
|
|
|
|
|
|
|
switch (oidp->oid_kind & CTLTYPE)
|
|
|
|
{
|
|
|
|
case CTLTYPE_LONG:
|
|
|
|
case CTLTYPE_ULONG:
|
|
|
|
l = 0;
|
|
|
|
#ifdef SCTL_MASK32
|
|
|
|
if (!(req->flags & SCTL_MASK32))
|
|
|
|
#endif
|
|
|
|
return (SYSCTL_OUT(req, &l, sizeof(l)));
|
|
|
|
case CTLTYPE_INT:
|
|
|
|
case CTLTYPE_UINT:
|
|
|
|
i = 0;
|
|
|
|
return (SYSCTL_OUT(req, &i, sizeof(i)));
|
|
|
|
case CTLTYPE_STRING:
|
2011-03-21 09:40:01 +00:00
|
|
|
snprintf(numbuf, sizeof(numbuf), "%jd", (intmax_t)arg2);
|
2009-05-27 14:11:23 +00:00
|
|
|
return
|
|
|
|
(sysctl_handle_string(oidp, numbuf, sizeof(numbuf), req));
|
|
|
|
case CTLTYPE_STRUCT:
|
|
|
|
s = (size_t)arg2;
|
|
|
|
return (SYSCTL_OUT(req, &s, sizeof(s)));
|
|
|
|
}
|
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
2015-02-27 16:28:55 +00:00
|
|
|
/*
|
|
|
|
* CTLFLAG_RDTUN in the following indicates jail parameters that can be set at
|
|
|
|
* jail creation time but cannot be changed in an existing jail.
|
|
|
|
*/
|
2009-05-27 14:11:23 +00:00
|
|
|
SYSCTL_JAIL_PARAM(, jid, CTLTYPE_INT | CTLFLAG_RDTUN, "I", "Jail ID");
|
|
|
|
SYSCTL_JAIL_PARAM(, parent, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail parent ID");
|
|
|
|
SYSCTL_JAIL_PARAM_STRING(, name, CTLFLAG_RW, MAXHOSTNAMELEN, "Jail name");
|
|
|
|
SYSCTL_JAIL_PARAM_STRING(, path, CTLFLAG_RDTUN, MAXPATHLEN, "Jail root path");
|
|
|
|
SYSCTL_JAIL_PARAM(, securelevel, CTLTYPE_INT | CTLFLAG_RW,
|
|
|
|
"I", "Jail secure level");
|
2020-11-18 20:59:58 +00:00
|
|
|
SYSCTL_JAIL_PARAM(, osreldate, CTLTYPE_INT | CTLFLAG_RDTUN, "I",
|
2015-02-27 16:28:55 +00:00
|
|
|
"Jail value for kern.osreldate and uname -K");
|
2020-11-18 20:59:58 +00:00
|
|
|
SYSCTL_JAIL_PARAM_STRING(, osrelease, CTLFLAG_RDTUN, OSRELEASELEN,
|
2015-02-27 16:28:55 +00:00
|
|
|
"Jail value for kern.osrelease and uname -r");
|
2009-05-27 14:11:23 +00:00
|
|
|
SYSCTL_JAIL_PARAM(, enforce_statfs, CTLTYPE_INT | CTLFLAG_RW,
|
|
|
|
"I", "Jail cannot see all mounted file systems");
|
2012-02-09 10:22:08 +00:00
|
|
|
SYSCTL_JAIL_PARAM(, devfs_ruleset, CTLTYPE_INT | CTLFLAG_RW,
|
|
|
|
"I", "Ruleset for in-jail devfs mounts");
|
2009-05-27 14:11:23 +00:00
|
|
|
SYSCTL_JAIL_PARAM(, persist, CTLTYPE_INT | CTLFLAG_RW,
|
|
|
|
"B", "Jail persistence");
|
2009-06-15 18:59:29 +00:00
|
|
|
#ifdef VIMAGE
|
|
|
|
SYSCTL_JAIL_PARAM(, vnet, CTLTYPE_INT | CTLFLAG_RDTUN,
|
2009-07-25 14:48:57 +00:00
|
|
|
"E,jailsys", "Virtual network stack");
|
2009-06-15 18:59:29 +00:00
|
|
|
#endif
|
2009-05-27 14:11:23 +00:00
|
|
|
SYSCTL_JAIL_PARAM(, dying, CTLTYPE_INT | CTLFLAG_RD,
|
|
|
|
"B", "Jail is in the process of shutting down");
|
|
|
|
|
2009-06-23 20:35:51 +00:00
|
|
|
SYSCTL_JAIL_PARAM_NODE(children, "Number of child jails");
|
|
|
|
SYSCTL_JAIL_PARAM(_children, cur, CTLTYPE_INT | CTLFLAG_RD,
|
|
|
|
"I", "Current number of child jails");
|
|
|
|
SYSCTL_JAIL_PARAM(_children, max, CTLTYPE_INT | CTLFLAG_RW,
|
|
|
|
"I", "Maximum number of child jails");
|
|
|
|
|
2009-07-25 14:48:57 +00:00
|
|
|
SYSCTL_JAIL_PARAM_SYS_NODE(host, CTLFLAG_RW, "Jail host info");
|
2009-05-27 14:11:23 +00:00
|
|
|
SYSCTL_JAIL_PARAM_STRING(_host, hostname, CTLFLAG_RW, MAXHOSTNAMELEN,
|
|
|
|
"Jail hostname");
|
2009-05-29 21:27:12 +00:00
|
|
|
SYSCTL_JAIL_PARAM_STRING(_host, domainname, CTLFLAG_RW, MAXHOSTNAMELEN,
|
|
|
|
"Jail NIS domainname");
|
|
|
|
SYSCTL_JAIL_PARAM_STRING(_host, hostuuid, CTLFLAG_RW, HOSTUUIDLEN,
|
|
|
|
"Jail host UUID");
|
|
|
|
SYSCTL_JAIL_PARAM(_host, hostid, CTLTYPE_ULONG | CTLFLAG_RW,
|
|
|
|
"LU", "Jail host ID");
|
2009-05-27 14:11:23 +00:00
|
|
|
|
|
|
|
SYSCTL_JAIL_PARAM_NODE(cpuset, "Jail cpuset");
|
|
|
|
SYSCTL_JAIL_PARAM(_cpuset, id, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail cpuset ID");
|
|
|
|
|
|
|
|
#ifdef INET
|
2009-07-30 14:28:56 +00:00
|
|
|
SYSCTL_JAIL_PARAM_SYS_NODE(ip4, CTLFLAG_RDTUN,
|
|
|
|
"Jail IPv4 address virtualization");
|
2009-05-27 14:11:23 +00:00
|
|
|
SYSCTL_JAIL_PARAM_STRUCT(_ip4, addr, CTLFLAG_RW, sizeof(struct in_addr),
|
|
|
|
"S,in_addr,a", "Jail IPv4 addresses");
|
2010-01-17 12:57:11 +00:00
|
|
|
SYSCTL_JAIL_PARAM(_ip4, saddrsel, CTLTYPE_INT | CTLFLAG_RW,
|
|
|
|
"B", "Do (not) use IPv4 source address selection rather than the "
|
|
|
|
"primary jail IPv4 address.");
|
2009-05-27 14:11:23 +00:00
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
2009-07-30 14:28:56 +00:00
|
|
|
SYSCTL_JAIL_PARAM_SYS_NODE(ip6, CTLFLAG_RDTUN,
|
|
|
|
"Jail IPv6 address virtualization");
|
2009-05-27 14:11:23 +00:00
|
|
|
SYSCTL_JAIL_PARAM_STRUCT(_ip6, addr, CTLFLAG_RW, sizeof(struct in6_addr),
|
|
|
|
"S,in6_addr,a", "Jail IPv6 addresses");
|
2010-01-17 12:57:11 +00:00
|
|
|
SYSCTL_JAIL_PARAM(_ip6, saddrsel, CTLTYPE_INT | CTLFLAG_RW,
|
|
|
|
"B", "Do (not) use IPv6 source address selection rather than the "
|
|
|
|
"primary jail IPv6 address.");
|
2009-05-27 14:11:23 +00:00
|
|
|
#endif
|
|
|
|
|
|
|
|
SYSCTL_JAIL_PARAM_NODE(allow, "Jail permission flags");
|
|
|
|
SYSCTL_JAIL_PARAM(_allow, set_hostname, CTLTYPE_INT | CTLFLAG_RW,
|
|
|
|
"B", "Jail may set hostname");
|
|
|
|
SYSCTL_JAIL_PARAM(_allow, sysvipc, CTLTYPE_INT | CTLFLAG_RW,
|
|
|
|
"B", "Jail may use SYSV IPC");
|
|
|
|
SYSCTL_JAIL_PARAM(_allow, raw_sockets, CTLTYPE_INT | CTLFLAG_RW,
|
|
|
|
"B", "Jail may create raw sockets");
|
|
|
|
SYSCTL_JAIL_PARAM(_allow, chflags, CTLTYPE_INT | CTLFLAG_RW,
|
|
|
|
"B", "Jail may alter system file flags");
|
|
|
|
SYSCTL_JAIL_PARAM(_allow, quotas, CTLTYPE_INT | CTLFLAG_RW,
|
|
|
|
"B", "Jail may set file quotas");
|
|
|
|
SYSCTL_JAIL_PARAM(_allow, socket_af, CTLTYPE_INT | CTLFLAG_RW,
|
|
|
|
"B", "Jail may create sockets other than just UNIX/IPv4/IPv6/route");
|
2018-07-29 12:41:56 +00:00
|
|
|
SYSCTL_JAIL_PARAM(_allow, mlock, CTLTYPE_INT | CTLFLAG_RW,
|
|
|
|
"B", "Jail may lock (unlock) physical pages in memory");
|
2017-06-06 02:15:00 +00:00
|
|
|
SYSCTL_JAIL_PARAM(_allow, reserved_ports, CTLTYPE_INT | CTLFLAG_RW,
|
|
|
|
"B", "Jail may bind sockets to reserved ports");
|
2018-10-17 16:11:43 +00:00
|
|
|
SYSCTL_JAIL_PARAM(_allow, read_msgbuf, CTLTYPE_INT | CTLFLAG_RW,
|
|
|
|
"B", "Jail may read the kernel message buffer");
|
2018-11-27 17:51:50 +00:00
|
|
|
SYSCTL_JAIL_PARAM(_allow, unprivileged_proc_debug, CTLTYPE_INT | CTLFLAG_RW,
|
|
|
|
"B", "Unprivileged processes may use process debugging facilities");
|
2020-11-18 21:07:08 +00:00
|
|
|
SYSCTL_JAIL_PARAM(_allow, suser, CTLTYPE_INT | CTLFLAG_RW,
|
|
|
|
"B", "Processes in jail with uid 0 have privilege");
|
2023-03-02 21:13:24 +00:00
|
|
|
#ifdef VIMAGE
|
2022-12-17 21:43:49 +00:00
|
|
|
SYSCTL_JAIL_PARAM(_allow, nfsd, CTLTYPE_INT | CTLFLAG_RW,
|
|
|
|
"B", "Mountd/nfsd may run in the jail");
|
|
|
|
#endif
|
2009-05-27 14:11:23 +00:00
|
|
|
|
2012-02-23 18:51:24 +00:00
|
|
|
SYSCTL_JAIL_PARAM_SUBNODE(allow, mount, "Jail mount/unmount permission flags");
|
|
|
|
SYSCTL_JAIL_PARAM(_allow_mount, , CTLTYPE_INT | CTLFLAG_RW,
|
|
|
|
"B", "Jail may mount/unmount jail-friendly file systems in general");
|
2018-05-04 20:54:27 +00:00
|
|
|
|
|
|
|
/*
|
2018-07-06 18:50:22 +00:00
|
|
|
* Add a dynamic parameter allow.<name>, or allow.<prefix>.<name>. Return
|
|
|
|
* its associated bit in the pr_allow bitmask, or zero if the parameter was
|
|
|
|
* not created.
|
2018-05-04 20:54:27 +00:00
|
|
|
*/
|
2018-07-06 18:50:22 +00:00
|
|
|
unsigned
|
|
|
|
prison_add_allow(const char *prefix, const char *name, const char *prefix_descr,
|
|
|
|
const char *descr)
|
2018-05-04 20:54:27 +00:00
|
|
|
{
|
|
|
|
struct bool_flags *bf;
|
2018-07-06 18:50:22 +00:00
|
|
|
struct sysctl_oid *parent;
|
|
|
|
char *allow_name, *allow_noname, *allowed;
|
2018-08-16 19:09:43 +00:00
|
|
|
#ifndef NO_SYSCTL_DESCR
|
|
|
|
char *descr_deprecated;
|
|
|
|
#endif
|
2020-12-26 20:53:28 +00:00
|
|
|
u_int allow_flag;
|
2018-05-04 20:54:27 +00:00
|
|
|
|
2018-07-06 18:50:22 +00:00
|
|
|
if (prefix
|
|
|
|
? asprintf(&allow_name, M_PRISON, "allow.%s.%s", prefix, name)
|
|
|
|
< 0 ||
|
|
|
|
asprintf(&allow_noname, M_PRISON, "allow.%s.no%s", prefix, name)
|
|
|
|
< 0
|
|
|
|
: asprintf(&allow_name, M_PRISON, "allow.%s", name) < 0 ||
|
|
|
|
asprintf(&allow_noname, M_PRISON, "allow.no%s", name) < 0) {
|
2018-05-04 20:54:27 +00:00
|
|
|
free(allow_name, M_PRISON);
|
2018-07-06 18:50:22 +00:00
|
|
|
return 0;
|
2018-05-04 20:54:27 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2018-07-06 18:50:22 +00:00
|
|
|
* See if this parameter has already beed added, i.e. a module was
|
|
|
|
* previously loaded/unloaded.
|
2018-05-04 20:54:27 +00:00
|
|
|
*/
|
|
|
|
mtx_lock(&prison0.pr_mtx);
|
|
|
|
for (bf = pr_flag_allow;
|
2020-12-26 20:53:28 +00:00
|
|
|
bf < pr_flag_allow + nitems(pr_flag_allow) &&
|
|
|
|
atomic_load_int(&bf->flag) != 0;
|
2018-05-04 20:54:27 +00:00
|
|
|
bf++) {
|
|
|
|
if (strcmp(bf->name, allow_name) == 0) {
|
2018-07-06 18:50:22 +00:00
|
|
|
allow_flag = bf->flag;
|
2018-05-04 20:54:27 +00:00
|
|
|
goto no_add;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2020-12-26 20:53:28 +00:00
|
|
|
* Find a free bit in pr_allow_all, failing if there are none
|
2018-05-04 20:54:27 +00:00
|
|
|
* (which shouldn't happen as long as we keep track of how many
|
2018-07-06 18:50:22 +00:00
|
|
|
* potential dynamic flags exist).
|
2018-05-04 20:54:27 +00:00
|
|
|
*/
|
|
|
|
for (allow_flag = 1;; allow_flag <<= 1) {
|
|
|
|
if (allow_flag == 0)
|
|
|
|
goto no_add;
|
2020-12-26 20:53:28 +00:00
|
|
|
if ((pr_allow_all & allow_flag) == 0)
|
2018-05-04 20:54:27 +00:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2020-12-26 20:53:28 +00:00
|
|
|
/* Note the parameter in the next open slot in pr_flag_allow. */
|
|
|
|
for (bf = pr_flag_allow; ; bf++) {
|
2018-05-04 20:54:27 +00:00
|
|
|
if (bf == pr_flag_allow + nitems(pr_flag_allow)) {
|
|
|
|
/* This should never happen, but is not fatal. */
|
2018-07-06 18:50:22 +00:00
|
|
|
allow_flag = 0;
|
2018-05-04 20:54:27 +00:00
|
|
|
goto no_add;
|
|
|
|
}
|
2020-12-26 20:53:28 +00:00
|
|
|
if (atomic_load_int(&bf->flag) == 0)
|
|
|
|
break;
|
|
|
|
}
|
2018-05-04 20:54:27 +00:00
|
|
|
bf->name = allow_name;
|
|
|
|
bf->noname = allow_noname;
|
2020-12-26 20:53:28 +00:00
|
|
|
pr_allow_all |= allow_flag;
|
|
|
|
/*
|
|
|
|
* prison0 always has permission for the new parameter.
|
|
|
|
* Other jails must have it granted to them.
|
|
|
|
*/
|
|
|
|
prison0.pr_allow |= allow_flag;
|
|
|
|
/* The flag indicates a valid entry, so make sure it is set last. */
|
|
|
|
atomic_store_rel_int(&bf->flag, allow_flag);
|
2018-05-04 20:54:27 +00:00
|
|
|
mtx_unlock(&prison0.pr_mtx);
|
|
|
|
|
2018-08-16 19:09:43 +00:00
|
|
|
/*
|
2022-09-15 08:25:19 +00:00
|
|
|
* Create sysctls for the parameter, and the back-compat global
|
2018-08-16 19:09:43 +00:00
|
|
|
* permission.
|
|
|
|
*/
|
2018-07-06 18:50:22 +00:00
|
|
|
parent = prefix
|
|
|
|
? SYSCTL_ADD_NODE(NULL,
|
|
|
|
SYSCTL_CHILDREN(&sysctl___security_jail_param_allow),
|
2020-02-26 14:26:36 +00:00
|
|
|
OID_AUTO, prefix, CTLFLAG_MPSAFE, 0, prefix_descr)
|
2018-07-06 18:50:22 +00:00
|
|
|
: &sysctl___security_jail_param_allow;
|
|
|
|
(void)SYSCTL_ADD_PROC(NULL, SYSCTL_CHILDREN(parent), OID_AUTO,
|
|
|
|
name, CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
|
2018-05-04 20:54:27 +00:00
|
|
|
NULL, 0, sysctl_jail_param, "B", descr);
|
2018-07-06 18:50:22 +00:00
|
|
|
if ((prefix
|
|
|
|
? asprintf(&allowed, M_TEMP, "%s_%s_allowed", prefix, name)
|
|
|
|
: asprintf(&allowed, M_TEMP, "%s_allowed", name)) >= 0) {
|
2018-08-16 19:09:43 +00:00
|
|
|
#ifndef NO_SYSCTL_DESCR
|
|
|
|
(void)asprintf(&descr_deprecated, M_TEMP, "%s (deprecated)",
|
|
|
|
descr);
|
|
|
|
#endif
|
2018-05-04 20:54:27 +00:00
|
|
|
(void)SYSCTL_ADD_PROC(NULL,
|
2018-07-06 18:50:22 +00:00
|
|
|
SYSCTL_CHILDREN(&sysctl___security_jail), OID_AUTO, allowed,
|
2018-08-16 19:09:43 +00:00
|
|
|
CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, allow_flag,
|
|
|
|
sysctl_jail_default_allow, "I", descr_deprecated);
|
|
|
|
#ifndef NO_SYSCTL_DESCR
|
|
|
|
free(descr_deprecated, M_TEMP);
|
|
|
|
#endif
|
2018-07-06 18:50:22 +00:00
|
|
|
free(allowed, M_TEMP);
|
2018-05-04 20:54:27 +00:00
|
|
|
}
|
2018-07-06 18:50:22 +00:00
|
|
|
return allow_flag;
|
2018-05-04 20:54:27 +00:00
|
|
|
|
|
|
|
no_add:
|
|
|
|
mtx_unlock(&prison0.pr_mtx);
|
|
|
|
free(allow_name, M_PRISON);
|
|
|
|
free(allow_noname, M_PRISON);
|
2018-07-06 18:50:22 +00:00
|
|
|
return allow_flag;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* The VFS system will register jail-aware filesystems here. They each get
|
|
|
|
* a parameter allow.mount.xxxfs and a flag to check when a jailed user
|
|
|
|
* attempts to mount.
|
|
|
|
*/
|
|
|
|
void
|
|
|
|
prison_add_vfs(struct vfsconf *vfsp)
|
|
|
|
{
|
|
|
|
#ifdef NO_SYSCTL_DESCR
|
|
|
|
|
|
|
|
vfsp->vfc_prison_flag = prison_add_allow("mount", vfsp->vfc_name,
|
|
|
|
NULL, NULL);
|
|
|
|
#else
|
|
|
|
char *descr;
|
|
|
|
|
|
|
|
(void)asprintf(&descr, M_TEMP, "Jail may mount the %s file system",
|
|
|
|
vfsp->vfc_name);
|
|
|
|
vfsp->vfc_prison_flag = prison_add_allow("mount", vfsp->vfc_name,
|
|
|
|
NULL, descr);
|
|
|
|
free(descr, M_TEMP);
|
|
|
|
#endif
|
2018-05-04 20:54:27 +00:00
|
|
|
}
|
2012-02-23 18:51:24 +00:00
|
|
|
|
2015-04-29 10:23:02 +00:00
|
|
|
#ifdef RACCT
|
2011-03-29 17:47:25 +00:00
|
|
|
void
|
|
|
|
prison_racct_foreach(void (*callback)(struct racct *racct,
|
2015-11-15 12:10:51 +00:00
|
|
|
void *arg2, void *arg3), void (*pre)(void), void (*post)(void),
|
|
|
|
void *arg2, void *arg3)
|
2011-03-29 17:47:25 +00:00
|
|
|
{
|
2011-05-03 07:32:58 +00:00
|
|
|
struct prison_racct *prr;
|
2011-03-29 17:47:25 +00:00
|
|
|
|
2015-04-29 10:23:02 +00:00
|
|
|
ASSERT_RACCT_ENABLED();
|
|
|
|
|
2011-03-29 17:47:25 +00:00
|
|
|
sx_slock(&allprison_lock);
|
2015-11-15 12:10:51 +00:00
|
|
|
if (pre != NULL)
|
|
|
|
(pre)();
|
2011-05-03 07:32:58 +00:00
|
|
|
LIST_FOREACH(prr, &allprison_racct, prr_next)
|
|
|
|
(callback)(prr->prr_racct, arg2, arg3);
|
2015-11-15 12:10:51 +00:00
|
|
|
if (post != NULL)
|
|
|
|
(post)();
|
2011-03-29 17:47:25 +00:00
|
|
|
sx_sunlock(&allprison_lock);
|
|
|
|
}
|
2009-05-27 14:11:23 +00:00
|
|
|
|
2011-05-03 07:32:58 +00:00
|
|
|
static struct prison_racct *
|
|
|
|
prison_racct_find_locked(const char *name)
|
|
|
|
{
|
|
|
|
struct prison_racct *prr;
|
|
|
|
|
2015-04-29 10:23:02 +00:00
|
|
|
ASSERT_RACCT_ENABLED();
|
2011-05-03 07:32:58 +00:00
|
|
|
sx_assert(&allprison_lock, SA_XLOCKED);
|
|
|
|
|
|
|
|
if (name[0] == '\0' || strlen(name) >= MAXHOSTNAMELEN)
|
|
|
|
return (NULL);
|
|
|
|
|
|
|
|
LIST_FOREACH(prr, &allprison_racct, prr_next) {
|
|
|
|
if (strcmp(name, prr->prr_name) != 0)
|
|
|
|
continue;
|
|
|
|
|
|
|
|
/* Found prison_racct with a matching name? */
|
|
|
|
prison_racct_hold(prr);
|
|
|
|
return (prr);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Add new prison_racct. */
|
|
|
|
prr = malloc(sizeof(*prr), M_PRISON_RACCT, M_ZERO | M_WAITOK);
|
|
|
|
racct_create(&prr->prr_racct);
|
|
|
|
|
|
|
|
strcpy(prr->prr_name, name);
|
|
|
|
refcount_init(&prr->prr_refcount, 1);
|
|
|
|
LIST_INSERT_HEAD(&allprison_racct, prr, prr_next);
|
|
|
|
|
|
|
|
return (prr);
|
|
|
|
}
|
|
|
|
|
|
|
|
struct prison_racct *
|
|
|
|
prison_racct_find(const char *name)
|
|
|
|
{
|
|
|
|
struct prison_racct *prr;
|
|
|
|
|
2015-04-29 10:23:02 +00:00
|
|
|
ASSERT_RACCT_ENABLED();
|
|
|
|
|
2011-05-03 07:32:58 +00:00
|
|
|
sx_xlock(&allprison_lock);
|
|
|
|
prr = prison_racct_find_locked(name);
|
|
|
|
sx_xunlock(&allprison_lock);
|
|
|
|
return (prr);
|
|
|
|
}
|
|
|
|
|
|
|
|
void
|
|
|
|
prison_racct_hold(struct prison_racct *prr)
|
|
|
|
{
|
|
|
|
|
2015-04-29 10:23:02 +00:00
|
|
|
ASSERT_RACCT_ENABLED();
|
|
|
|
|
2011-05-03 07:32:58 +00:00
|
|
|
refcount_acquire(&prr->prr_refcount);
|
|
|
|
}
|
|
|
|
|
2012-03-06 11:05:50 +00:00
|
|
|
static void
|
|
|
|
prison_racct_free_locked(struct prison_racct *prr)
|
|
|
|
{
|
|
|
|
|
2015-04-29 10:23:02 +00:00
|
|
|
ASSERT_RACCT_ENABLED();
|
2012-03-06 11:05:50 +00:00
|
|
|
sx_assert(&allprison_lock, SA_XLOCKED);
|
|
|
|
|
|
|
|
if (refcount_release(&prr->prr_refcount)) {
|
|
|
|
racct_destroy(&prr->prr_racct);
|
|
|
|
LIST_REMOVE(prr, prr_next);
|
|
|
|
free(prr, M_PRISON_RACCT);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2011-05-03 07:32:58 +00:00
|
|
|
void
|
|
|
|
prison_racct_free(struct prison_racct *prr)
|
|
|
|
{
|
|
|
|
|
2015-04-29 10:23:02 +00:00
|
|
|
ASSERT_RACCT_ENABLED();
|
2012-03-06 11:05:50 +00:00
|
|
|
sx_assert(&allprison_lock, SA_UNLOCKED);
|
|
|
|
|
2018-12-07 16:11:45 +00:00
|
|
|
if (refcount_release_if_not_last(&prr->prr_refcount))
|
2011-05-03 07:32:58 +00:00
|
|
|
return;
|
|
|
|
|
|
|
|
sx_xlock(&allprison_lock);
|
2012-03-06 11:05:50 +00:00
|
|
|
prison_racct_free_locked(prr);
|
2011-05-03 07:32:58 +00:00
|
|
|
sx_xunlock(&allprison_lock);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
prison_racct_attach(struct prison *pr)
|
|
|
|
{
|
|
|
|
struct prison_racct *prr;
|
|
|
|
|
2015-04-29 10:23:02 +00:00
|
|
|
ASSERT_RACCT_ENABLED();
|
2012-03-06 11:05:50 +00:00
|
|
|
sx_assert(&allprison_lock, SA_XLOCKED);
|
|
|
|
|
2011-05-03 07:32:58 +00:00
|
|
|
prr = prison_racct_find_locked(pr->pr_name);
|
|
|
|
KASSERT(prr != NULL, ("cannot find prison_racct"));
|
|
|
|
|
|
|
|
pr->pr_prison_racct = prr;
|
|
|
|
}
|
|
|
|
|
2012-03-06 11:05:50 +00:00
|
|
|
/*
|
|
|
|
* Handle jail renaming. From the racct point of view, renaming means
|
|
|
|
* moving from one prison_racct to another.
|
|
|
|
*/
|
|
|
|
static void
|
|
|
|
prison_racct_modify(struct prison *pr)
|
|
|
|
{
|
2018-07-05 13:37:31 +00:00
|
|
|
#ifdef RCTL
|
2012-03-06 11:05:50 +00:00
|
|
|
struct proc *p;
|
|
|
|
struct ucred *cred;
|
2018-07-05 13:37:31 +00:00
|
|
|
#endif
|
2012-03-06 11:05:50 +00:00
|
|
|
struct prison_racct *oldprr;
|
|
|
|
|
2015-04-29 10:23:02 +00:00
|
|
|
ASSERT_RACCT_ENABLED();
|
|
|
|
|
2012-03-06 11:05:50 +00:00
|
|
|
sx_slock(&allproc_lock);
|
|
|
|
sx_xlock(&allprison_lock);
|
|
|
|
|
2012-05-22 17:30:02 +00:00
|
|
|
if (strcmp(pr->pr_name, pr->pr_prison_racct->prr_name) == 0) {
|
|
|
|
sx_xunlock(&allprison_lock);
|
|
|
|
sx_sunlock(&allproc_lock);
|
2012-03-06 11:05:50 +00:00
|
|
|
return;
|
2012-05-22 17:30:02 +00:00
|
|
|
}
|
2012-03-06 11:05:50 +00:00
|
|
|
|
|
|
|
oldprr = pr->pr_prison_racct;
|
|
|
|
pr->pr_prison_racct = NULL;
|
|
|
|
|
|
|
|
prison_racct_attach(pr);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Move resource utilisation records.
|
|
|
|
*/
|
|
|
|
racct_move(pr->pr_prison_racct->prr_racct, oldprr->prr_racct);
|
|
|
|
|
2018-04-20 13:08:04 +00:00
|
|
|
#ifdef RCTL
|
2012-03-06 11:05:50 +00:00
|
|
|
/*
|
|
|
|
* Force rctl to reattach rules to processes.
|
|
|
|
*/
|
|
|
|
FOREACH_PROC_IN_SYSTEM(p) {
|
|
|
|
PROC_LOCK(p);
|
|
|
|
cred = crhold(p->p_ucred);
|
|
|
|
PROC_UNLOCK(p);
|
2018-04-20 13:08:04 +00:00
|
|
|
rctl_proc_ucred_changed(p, cred);
|
2012-03-06 11:05:50 +00:00
|
|
|
crfree(cred);
|
|
|
|
}
|
2018-04-20 13:08:04 +00:00
|
|
|
#endif
|
2012-03-06 11:05:50 +00:00
|
|
|
|
|
|
|
sx_sunlock(&allproc_lock);
|
|
|
|
prison_racct_free_locked(oldprr);
|
|
|
|
sx_xunlock(&allprison_lock);
|
|
|
|
}
|
|
|
|
|
2011-05-03 07:32:58 +00:00
|
|
|
static void
|
|
|
|
prison_racct_detach(struct prison *pr)
|
|
|
|
{
|
2012-03-06 11:05:50 +00:00
|
|
|
|
2015-04-29 10:23:02 +00:00
|
|
|
ASSERT_RACCT_ENABLED();
|
2012-03-06 11:05:50 +00:00
|
|
|
sx_assert(&allprison_lock, SA_UNLOCKED);
|
|
|
|
|
2012-12-18 18:34:36 +00:00
|
|
|
if (pr->pr_prison_racct == NULL)
|
|
|
|
return;
|
2011-05-03 07:32:58 +00:00
|
|
|
prison_racct_free(pr->pr_prison_racct);
|
|
|
|
pr->pr_prison_racct = NULL;
|
|
|
|
}
|
|
|
|
#endif /* RACCT */
|
|
|
|
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
#ifdef DDB
|
2009-04-29 21:14:15 +00:00
|
|
|
|
|
|
|
static void
|
|
|
|
db_show_prison(struct prison *pr)
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
{
|
2018-03-20 23:08:42 +00:00
|
|
|
struct bool_flags *bf;
|
|
|
|
struct jailsys_flags *jsf;
|
2009-04-29 21:14:15 +00:00
|
|
|
#if defined(INET) || defined(INET6)
|
|
|
|
int ii;
|
2023-02-28 10:01:33 +00:00
|
|
|
struct prison_ip *pip;
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
#endif
|
2018-03-20 23:08:42 +00:00
|
|
|
unsigned f;
|
2017-02-16 20:47:41 +00:00
|
|
|
#ifdef INET
|
|
|
|
char ip4buf[INET_ADDRSTRLEN];
|
|
|
|
#endif
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
#ifdef INET6
|
|
|
|
char ip6buf[INET6_ADDRSTRLEN];
|
|
|
|
#endif
|
|
|
|
|
2009-04-29 21:14:15 +00:00
|
|
|
db_printf("prison %p:\n", pr);
|
|
|
|
db_printf(" jid = %d\n", pr->pr_id);
|
|
|
|
db_printf(" name = %s\n", pr->pr_name);
|
2009-05-27 14:11:23 +00:00
|
|
|
db_printf(" parent = %p\n", pr->pr_parent);
|
2009-04-29 21:14:15 +00:00
|
|
|
db_printf(" ref = %d\n", pr->pr_ref);
|
|
|
|
db_printf(" uref = %d\n", pr->pr_uref);
|
2021-02-21 21:24:47 +00:00
|
|
|
db_printf(" state = %s\n",
|
|
|
|
pr->pr_state == PRISON_STATE_ALIVE ? "alive" :
|
|
|
|
pr->pr_state == PRISON_STATE_DYING ? "dying" :
|
|
|
|
"invalid");
|
2009-04-29 21:14:15 +00:00
|
|
|
db_printf(" path = %s\n", pr->pr_path);
|
|
|
|
db_printf(" cpuset = %d\n", pr->pr_cpuset
|
|
|
|
? pr->pr_cpuset->cs_id : -1);
|
2009-06-15 18:59:29 +00:00
|
|
|
#ifdef VIMAGE
|
|
|
|
db_printf(" vnet = %p\n", pr->pr_vnet);
|
|
|
|
#endif
|
2009-04-29 21:14:15 +00:00
|
|
|
db_printf(" root = %p\n", pr->pr_root);
|
|
|
|
db_printf(" securelevel = %d\n", pr->pr_securelevel);
|
2012-02-09 10:22:08 +00:00
|
|
|
db_printf(" devfs_rsnum = %d\n", pr->pr_devfs_rsnum);
|
2010-01-11 22:34:25 +00:00
|
|
|
db_printf(" children.max = %d\n", pr->pr_childmax);
|
|
|
|
db_printf(" children.cur = %d\n", pr->pr_childcount);
|
2009-05-27 14:11:23 +00:00
|
|
|
db_printf(" child = %p\n", LIST_FIRST(&pr->pr_children));
|
|
|
|
db_printf(" sibling = %p\n", LIST_NEXT(pr, pr_sibling));
|
2010-01-11 22:34:25 +00:00
|
|
|
db_printf(" flags = 0x%x", pr->pr_flags);
|
2018-03-20 23:08:42 +00:00
|
|
|
for (bf = pr_flag_bool; bf < pr_flag_bool + nitems(pr_flag_bool); bf++)
|
|
|
|
if (pr->pr_flags & bf->flag)
|
|
|
|
db_printf(" %s", bf->name);
|
|
|
|
for (jsf = pr_flag_jailsys;
|
|
|
|
jsf < pr_flag_jailsys + nitems(pr_flag_jailsys);
|
|
|
|
jsf++) {
|
|
|
|
f = pr->pr_flags & (jsf->disable | jsf->new);
|
|
|
|
db_printf(" %-16s= %s\n", jsf->name,
|
|
|
|
(f != 0 && f == jsf->disable) ? "disable"
|
|
|
|
: (f == jsf->new) ? "new"
|
2009-07-25 14:48:57 +00:00
|
|
|
: "inherit");
|
|
|
|
}
|
2010-01-11 22:34:25 +00:00
|
|
|
db_printf(" allow = 0x%x", pr->pr_allow);
|
2018-03-20 23:08:42 +00:00
|
|
|
for (bf = pr_flag_allow;
|
2020-12-26 20:53:28 +00:00
|
|
|
bf < pr_flag_allow + nitems(pr_flag_allow) &&
|
|
|
|
atomic_load_int(&bf->flag) != 0;
|
2018-03-20 23:08:42 +00:00
|
|
|
bf++)
|
|
|
|
if (pr->pr_allow & bf->flag)
|
|
|
|
db_printf(" %s", bf->name);
|
2009-04-29 21:14:15 +00:00
|
|
|
db_printf("\n");
|
2009-05-27 14:11:23 +00:00
|
|
|
db_printf(" enforce_statfs = %d\n", pr->pr_enforce_statfs);
|
2009-06-13 15:39:12 +00:00
|
|
|
db_printf(" host.hostname = %s\n", pr->pr_hostname);
|
|
|
|
db_printf(" host.domainname = %s\n", pr->pr_domainname);
|
|
|
|
db_printf(" host.hostuuid = %s\n", pr->pr_hostuuid);
|
2009-05-29 21:27:12 +00:00
|
|
|
db_printf(" host.hostid = %lu\n", pr->pr_hostid);
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
#ifdef INET
|
2023-02-28 10:01:33 +00:00
|
|
|
if ((pip = pr->pr_addrs[PR_INET]) != NULL) {
|
|
|
|
db_printf(" ip4s = %d\n", pip->ips);
|
|
|
|
for (ii = 0; ii < pip->ips; ii++)
|
2021-12-26 18:45:50 +00:00
|
|
|
db_printf(" %s %s\n",
|
|
|
|
ii == 0 ? "ip4.addr =" : " ",
|
|
|
|
inet_ntoa_r(
|
2023-02-28 10:01:33 +00:00
|
|
|
*(const struct in_addr *)PR_IP(pip, PR_INET, ii),
|
2021-12-26 18:45:50 +00:00
|
|
|
ip4buf));
|
|
|
|
}
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
2023-02-28 10:01:33 +00:00
|
|
|
if ((pip = pr->pr_addrs[PR_INET6]) != NULL) {
|
|
|
|
db_printf(" ip6s = %d\n", pip->ips);
|
|
|
|
for (ii = 0; ii < pip->ips; ii++)
|
2021-12-26 18:45:50 +00:00
|
|
|
db_printf(" %s %s\n",
|
|
|
|
ii == 0 ? "ip6.addr =" : " ",
|
|
|
|
ip6_sprintf(ip6buf,
|
2023-02-28 10:01:33 +00:00
|
|
|
(const struct in6_addr *)PR_IP(pip, PR_INET6, ii)));
|
2021-12-26 18:45:50 +00:00
|
|
|
}
|
2009-04-29 21:14:15 +00:00
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
|
|
|
DB_SHOW_COMMAND(prison, db_show_prison_command)
|
|
|
|
{
|
|
|
|
struct prison *pr;
|
|
|
|
|
|
|
|
if (!have_addr) {
|
2009-05-27 14:11:23 +00:00
|
|
|
/*
|
|
|
|
* Show all prisons in the list, and prison0 which is not
|
|
|
|
* listed.
|
|
|
|
*/
|
|
|
|
db_show_prison(&prison0);
|
|
|
|
if (!db_pager_quit) {
|
|
|
|
TAILQ_FOREACH(pr, &allprison, pr_list) {
|
|
|
|
db_show_prison(pr);
|
|
|
|
if (db_pager_quit)
|
|
|
|
break;
|
|
|
|
}
|
2009-04-29 21:14:15 +00:00
|
|
|
}
|
|
|
|
return;
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
}
|
2009-04-29 21:14:15 +00:00
|
|
|
|
2009-05-27 14:11:23 +00:00
|
|
|
if (addr == 0)
|
|
|
|
pr = &prison0;
|
|
|
|
else {
|
|
|
|
/* Look for a prison with the ID and with references. */
|
2009-04-29 21:14:15 +00:00
|
|
|
TAILQ_FOREACH(pr, &allprison, pr_list)
|
2009-05-27 14:11:23 +00:00
|
|
|
if (pr->pr_id == addr && pr->pr_ref > 0)
|
2009-04-29 21:14:15 +00:00
|
|
|
break;
|
2009-05-27 14:11:23 +00:00
|
|
|
if (pr == NULL)
|
|
|
|
/* Look again, without requiring a reference. */
|
|
|
|
TAILQ_FOREACH(pr, &allprison, pr_list)
|
|
|
|
if (pr->pr_id == addr)
|
|
|
|
break;
|
|
|
|
if (pr == NULL)
|
|
|
|
/* Assume address points to a valid prison. */
|
|
|
|
pr = (struct prison *)addr;
|
|
|
|
}
|
2009-04-29 21:14:15 +00:00
|
|
|
db_show_prison(pr);
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
}
|
2009-04-29 21:14:15 +00:00
|
|
|
|
MFp4:
Bring in updated jail support from bz_jail branch.
This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..
SCTP support was updated and supports IPv6 in jails as well.
Cpuset support permits jails to be bound to specific processor
sets after creation.
Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.
DDB 'show jails' command was added to aid debugging.
Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.
Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.
Bump __FreeBSD_version for the afore mentioned and in kernel changes.
Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.
Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible
2008-11-29 14:32:14 +00:00
|
|
|
#endif /* DDB */
|