Put jail(2) under COMPAT_FREEBSD11. It has been the "old" way of creating
jails since FreeBSD 7. Along with the system call, put the various security.jail.allow_foo and security.jail.foo_allowed sysctls partly under COMPAT_FREEBSD11 (or BURN_BRIDGES). These sysctls had two disparate uses: on the system side, they were global permissions for jails created via jail(2) which lacked fine-grained permission controls; inside a jail, they're read-only descriptions of what the current jail is allowed to do. The first use is obsolete along with jail(2), but keep them for the second-read-only use. Differential Revision: D14791
This commit is contained in:
parent
a8e44f4da0
commit
284001a222
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=337922
@ -28,7 +28,7 @@
|
|||||||
.\" @(#)kvm_getvfsbyname.3 8.3 (Berkeley) 5/4/95
|
.\" @(#)kvm_getvfsbyname.3 8.3 (Berkeley) 5/4/95
|
||||||
.\" $FreeBSD$
|
.\" $FreeBSD$
|
||||||
.\"
|
.\"
|
||||||
.Dd August 30, 2016
|
.Dd August 16, 2018
|
||||||
.Dt GETVFSBYNAME 3
|
.Dt GETVFSBYNAME 3
|
||||||
.Os
|
.Os
|
||||||
.Sh NAME
|
.Sh NAME
|
||||||
@ -83,9 +83,10 @@ aliases some other mounted FS
|
|||||||
stores file names as Unicode
|
stores file names as Unicode
|
||||||
.It Dv VFCF_JAIL
|
.It Dv VFCF_JAIL
|
||||||
can be mounted from within a jail if
|
can be mounted from within a jail if
|
||||||
.Va security.jail.mount_allowed
|
.Va allow.mount
|
||||||
sysctl is set to
|
and
|
||||||
.Dv 1
|
.Va allow.mount.<vfc_name>
|
||||||
|
jail parameters are set
|
||||||
.It Dv VFCF_DELEGADMIN
|
.It Dv VFCF_DELEGADMIN
|
||||||
supports delegated administration if
|
supports delegated administration if
|
||||||
.Va vfs.usermount
|
.Va vfs.usermount
|
||||||
|
@ -25,11 +25,10 @@
|
|||||||
.\"
|
.\"
|
||||||
.\" $FreeBSD$
|
.\" $FreeBSD$
|
||||||
.\"
|
.\"
|
||||||
.Dd February 8, 2012
|
.Dd August 16, 2018
|
||||||
.Dt JAIL 2
|
.Dt JAIL 2
|
||||||
.Os
|
.Os
|
||||||
.Sh NAME
|
.Sh NAME
|
||||||
.Nm jail ,
|
|
||||||
.Nm jail_get ,
|
.Nm jail_get ,
|
||||||
.Nm jail_set ,
|
.Nm jail_set ,
|
||||||
.Nm jail_remove ,
|
.Nm jail_remove ,
|
||||||
@ -41,8 +40,6 @@
|
|||||||
.In sys/param.h
|
.In sys/param.h
|
||||||
.In sys/jail.h
|
.In sys/jail.h
|
||||||
.Ft int
|
.Ft int
|
||||||
.Fn jail "struct jail *jail"
|
|
||||||
.Ft int
|
|
||||||
.Fn jail_attach "int jid"
|
.Fn jail_attach "int jid"
|
||||||
.Ft int
|
.Ft int
|
||||||
.Fn jail_remove "int jid"
|
.Fn jail_remove "int jid"
|
||||||
@ -53,73 +50,6 @@
|
|||||||
.Fn jail_set "struct iovec *iov" "u_int niov" "int flags"
|
.Fn jail_set "struct iovec *iov" "u_int niov" "int flags"
|
||||||
.Sh DESCRIPTION
|
.Sh DESCRIPTION
|
||||||
The
|
The
|
||||||
.Fn jail
|
|
||||||
system call sets up a jail and locks the current process in it.
|
|
||||||
.Pp
|
|
||||||
The argument is a pointer to a structure describing the prison:
|
|
||||||
.Bd -literal -offset indent
|
|
||||||
struct jail {
|
|
||||||
uint32_t version;
|
|
||||||
char *path;
|
|
||||||
char *hostname;
|
|
||||||
char *jailname;
|
|
||||||
unsigned int ip4s;
|
|
||||||
unsigned int ip6s;
|
|
||||||
struct in_addr *ip4;
|
|
||||||
struct in6_addr *ip6;
|
|
||||||
};
|
|
||||||
.Ed
|
|
||||||
.Pp
|
|
||||||
.Dq Li version
|
|
||||||
defines the version of the API in use.
|
|
||||||
.Dv JAIL_API_VERSION
|
|
||||||
is defined for the current version.
|
|
||||||
.Pp
|
|
||||||
The
|
|
||||||
.Dq Li path
|
|
||||||
pointer should be set to the directory which is to be the root of the
|
|
||||||
prison.
|
|
||||||
.Pp
|
|
||||||
The
|
|
||||||
.Dq Li hostname
|
|
||||||
pointer can be set to the hostname of the prison.
|
|
||||||
This can be changed
|
|
||||||
from the inside of the prison.
|
|
||||||
.Pp
|
|
||||||
The
|
|
||||||
.Dq Li jailname
|
|
||||||
pointer is an optional name that can be assigned to the jail
|
|
||||||
for example for management purposes.
|
|
||||||
.Pp
|
|
||||||
The
|
|
||||||
.Dq Li ip4s
|
|
||||||
and
|
|
||||||
.Dq Li ip6s
|
|
||||||
give the numbers of IPv4 and IPv6 addresses that will be passed
|
|
||||||
via their respective pointers.
|
|
||||||
.Pp
|
|
||||||
The
|
|
||||||
.Dq Li ip4
|
|
||||||
and
|
|
||||||
.Dq Li ip6
|
|
||||||
pointers can be set to an arrays of IPv4 and IPv6 addresses to be assigned to
|
|
||||||
the prison, or NULL if none.
|
|
||||||
IPv4 addresses must be in network byte order.
|
|
||||||
.Pp
|
|
||||||
This is equivalent to, and deprecated in favor of, the
|
|
||||||
.Fn jail_set
|
|
||||||
system call (see below), with the parameters
|
|
||||||
.Va path ,
|
|
||||||
.Va host.hostname ,
|
|
||||||
.Va name ,
|
|
||||||
.Va ip4.addr ,
|
|
||||||
and
|
|
||||||
.Va ip6.addr ,
|
|
||||||
and with the
|
|
||||||
.Dv JAIL_ATTACH
|
|
||||||
flag.
|
|
||||||
.Pp
|
|
||||||
The
|
|
||||||
.Fn jail_set
|
.Fn jail_set
|
||||||
system call creates a new jail, or modifies an existing one, and optionally
|
system call creates a new jail, or modifies an existing one, and optionally
|
||||||
locks the current process in it.
|
locks the current process in it.
|
||||||
@ -146,13 +76,19 @@ The current set of available parameters, and their formats, can be
|
|||||||
retrieved via the
|
retrieved via the
|
||||||
.Va security.jail.param
|
.Va security.jail.param
|
||||||
sysctl MIB entry.
|
sysctl MIB entry.
|
||||||
Notable parameters include those mentioned in the
|
Notable parameters include
|
||||||
.Fn jail
|
|
||||||
description above, as well as
|
|
||||||
.Va jid
|
.Va jid
|
||||||
and
|
and
|
||||||
.Va name ,
|
.Va name
|
||||||
which identify the jail being created or modified.
|
which identify the jail being created or modified,
|
||||||
|
.Va path
|
||||||
|
(the root directory of the jail),
|
||||||
|
.Va host.hostname
|
||||||
|
(the hostname of the jail), and
|
||||||
|
.Va ip4.addr
|
||||||
|
and
|
||||||
|
.Va ip6.addr
|
||||||
|
(IP addresses to assign to the jail).
|
||||||
See
|
See
|
||||||
.Xr jail 8
|
.Xr jail 8
|
||||||
for more information on the core jail parameters.
|
for more information on the core jail parameters.
|
||||||
@ -237,8 +173,7 @@ It will kill all processes belonging to the jail, and remove any children
|
|||||||
of that jail.
|
of that jail.
|
||||||
.Sh RETURN VALUES
|
.Sh RETURN VALUES
|
||||||
If successful,
|
If successful,
|
||||||
.Fn jail ,
|
.Fn jail_set
|
||||||
.Fn jail_set ,
|
|
||||||
and
|
and
|
||||||
.Fn jail_get
|
.Fn jail_get
|
||||||
return a non-negative integer, termed the jail identifier (JID).
|
return a non-negative integer, termed the jail identifier (JID).
|
||||||
@ -249,25 +184,6 @@ to indicate the error.
|
|||||||
.Rv -std jail_attach jail_remove
|
.Rv -std jail_attach jail_remove
|
||||||
.Sh ERRORS
|
.Sh ERRORS
|
||||||
The
|
The
|
||||||
.Fn jail
|
|
||||||
system call
|
|
||||||
will fail if:
|
|
||||||
.Bl -tag -width Er
|
|
||||||
.It Bq Er EPERM
|
|
||||||
This process is not allowed to create a jail, either because it is not
|
|
||||||
the super-user, or because it would exceed the jail's
|
|
||||||
.Va children.max
|
|
||||||
limit.
|
|
||||||
.It Bq Er EFAULT
|
|
||||||
.Fa jail
|
|
||||||
points to an address outside the allocated address space of the process.
|
|
||||||
.It Bq Er EINVAL
|
|
||||||
The version number of the argument is not correct.
|
|
||||||
.It Bq Er EAGAIN
|
|
||||||
No free JID could be found.
|
|
||||||
.El
|
|
||||||
.Pp
|
|
||||||
The
|
|
||||||
.Fn jail_set
|
.Fn jail_set
|
||||||
system call
|
system call
|
||||||
will fail if:
|
will fail if:
|
||||||
@ -371,8 +287,7 @@ does not exist.
|
|||||||
.El
|
.El
|
||||||
.Pp
|
.Pp
|
||||||
Further
|
Further
|
||||||
.Fn jail ,
|
.Fn jail_set
|
||||||
.Fn jail_set ,
|
|
||||||
and
|
and
|
||||||
.Fn jail_attach
|
.Fn jail_attach
|
||||||
call
|
call
|
||||||
@ -386,7 +301,7 @@ manual page for details.
|
|||||||
.Xr chroot 2 ,
|
.Xr chroot 2 ,
|
||||||
.Xr jail 8
|
.Xr jail 8
|
||||||
.Sh HISTORY
|
.Sh HISTORY
|
||||||
The
|
The now-deprecated
|
||||||
.Fn jail
|
.Fn jail
|
||||||
system call appeared in
|
system call appeared in
|
||||||
.Fx 4.0 .
|
.Fx 4.0 .
|
||||||
|
@ -26,7 +26,7 @@
|
|||||||
.\"
|
.\"
|
||||||
.\" $FreeBSD$
|
.\" $FreeBSD$
|
||||||
.\"
|
.\"
|
||||||
.Dd February 21, 2013
|
.Dd August 16, 2018
|
||||||
.Dt VFS_SET 9
|
.Dt VFS_SET 9
|
||||||
.Os
|
.Os
|
||||||
.Sh NAME
|
.Sh NAME
|
||||||
@ -72,9 +72,10 @@ Loopback file system layer.
|
|||||||
File names are stored as Unicode.
|
File names are stored as Unicode.
|
||||||
.It Dv VFCF_JAIL
|
.It Dv VFCF_JAIL
|
||||||
Can be mounted from within a jail if
|
Can be mounted from within a jail if
|
||||||
.Va security.jail.mount_allowed
|
.Va allow.mount
|
||||||
sysctl is set to
|
and
|
||||||
.Dv 1 .
|
.Va allow.mount.<fsname>
|
||||||
|
jail parameters are set.
|
||||||
.It Dv VFCF_DELEGADMIN
|
.It Dv VFCF_DELEGADMIN
|
||||||
Supports delegated administration if
|
Supports delegated administration if
|
||||||
.Va vfs.usermount
|
.Va vfs.usermount
|
||||||
|
@ -5195,9 +5195,8 @@ zfs_freebsd_setattr(ap)
|
|||||||
* Privileged non-jail processes may not modify system flags
|
* Privileged non-jail processes may not modify system flags
|
||||||
* if securelevel > 0 and any existing system flags are set.
|
* if securelevel > 0 and any existing system flags are set.
|
||||||
* Privileged jail processes behave like privileged non-jail
|
* Privileged jail processes behave like privileged non-jail
|
||||||
* processes if the security.jail.chflags_allowed sysctl is
|
* processes if the PR_ALLOW_CHFLAGS permission bit is set;
|
||||||
* is non-zero; otherwise, they behave like unprivileged
|
* otherwise, they behave like unprivileged processes.
|
||||||
* processes.
|
|
||||||
*/
|
*/
|
||||||
if (secpolicy_fs_owner(vp->v_mount, cred) == 0 ||
|
if (secpolicy_fs_owner(vp->v_mount, cred) == 0 ||
|
||||||
priv_check_cred(cred, PRIV_VFS_SYSFLAGS, 0) == 0) {
|
priv_check_cred(cred, PRIV_VFS_SYSFLAGS, 0) == 0) {
|
||||||
|
@ -2289,8 +2289,10 @@ freebsd32_sysctl(struct thread *td, struct freebsd32_sysctl_args *uap)
|
|||||||
return (0);
|
return (0);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#ifdef COMPAT_FREEBSD11
|
||||||
int
|
int
|
||||||
freebsd32_jail(struct thread *td, struct freebsd32_jail_args *uap)
|
freebsd11_freebsd32_jail(struct thread *td,
|
||||||
|
struct freebsd11_freebsd32_jail_args *uap)
|
||||||
{
|
{
|
||||||
uint32_t version;
|
uint32_t version;
|
||||||
int error;
|
int error;
|
||||||
@ -2347,8 +2349,9 @@ freebsd32_jail(struct thread *td, struct freebsd32_jail_args *uap)
|
|||||||
/* Sci-Fi jails are not supported, sorry. */
|
/* Sci-Fi jails are not supported, sorry. */
|
||||||
return (EINVAL);
|
return (EINVAL);
|
||||||
}
|
}
|
||||||
return (kern_jail(td, &j));
|
return (freebsd11_kern_jail(td, &j));
|
||||||
}
|
}
|
||||||
|
#endif /* COMPAT_FREEBSD11 */
|
||||||
|
|
||||||
int
|
int
|
||||||
freebsd32_jail_set(struct thread *td, struct freebsd32_jail_set_args *uap)
|
freebsd32_jail_set(struct thread *td, struct freebsd32_jail_set_args *uap)
|
||||||
|
@ -283,9 +283,6 @@ struct freebsd32_sched_rr_get_interval_args {
|
|||||||
char pid_l_[PADL_(pid_t)]; pid_t pid; char pid_r_[PADR_(pid_t)];
|
char pid_l_[PADL_(pid_t)]; pid_t pid; char pid_r_[PADR_(pid_t)];
|
||||||
char interval_l_[PADL_(struct timespec32 *)]; struct timespec32 * interval; char interval_r_[PADR_(struct timespec32 *)];
|
char interval_l_[PADL_(struct timespec32 *)]; struct timespec32 * interval; char interval_r_[PADR_(struct timespec32 *)];
|
||||||
};
|
};
|
||||||
struct freebsd32_jail_args {
|
|
||||||
char jail_l_[PADL_(struct jail32 *)]; struct jail32 * jail; char jail_r_[PADR_(struct jail32 *)];
|
|
||||||
};
|
|
||||||
struct freebsd32_sigtimedwait_args {
|
struct freebsd32_sigtimedwait_args {
|
||||||
char set_l_[PADL_(const sigset_t *)]; const sigset_t * set; char set_r_[PADR_(const sigset_t *)];
|
char set_l_[PADL_(const sigset_t *)]; const sigset_t * set; char set_r_[PADR_(const sigset_t *)];
|
||||||
char info_l_[PADL_(siginfo_t *)]; siginfo_t * info; char info_r_[PADR_(siginfo_t *)];
|
char info_l_[PADL_(siginfo_t *)]; siginfo_t * info; char info_r_[PADR_(siginfo_t *)];
|
||||||
@ -761,7 +758,6 @@ int freebsd32_aio_return(struct thread *, struct freebsd32_aio_return_args *);
|
|||||||
int freebsd32_aio_suspend(struct thread *, struct freebsd32_aio_suspend_args *);
|
int freebsd32_aio_suspend(struct thread *, struct freebsd32_aio_suspend_args *);
|
||||||
int freebsd32_aio_error(struct thread *, struct freebsd32_aio_error_args *);
|
int freebsd32_aio_error(struct thread *, struct freebsd32_aio_error_args *);
|
||||||
int freebsd32_sched_rr_get_interval(struct thread *, struct freebsd32_sched_rr_get_interval_args *);
|
int freebsd32_sched_rr_get_interval(struct thread *, struct freebsd32_sched_rr_get_interval_args *);
|
||||||
int freebsd32_jail(struct thread *, struct freebsd32_jail_args *);
|
|
||||||
int freebsd32_sigtimedwait(struct thread *, struct freebsd32_sigtimedwait_args *);
|
int freebsd32_sigtimedwait(struct thread *, struct freebsd32_sigtimedwait_args *);
|
||||||
int freebsd32_sigwaitinfo(struct thread *, struct freebsd32_sigwaitinfo_args *);
|
int freebsd32_sigwaitinfo(struct thread *, struct freebsd32_sigwaitinfo_args *);
|
||||||
int freebsd32_aio_waitcomplete(struct thread *, struct freebsd32_aio_waitcomplete_args *);
|
int freebsd32_aio_waitcomplete(struct thread *, struct freebsd32_aio_waitcomplete_args *);
|
||||||
@ -1184,6 +1180,9 @@ struct freebsd11_freebsd32_fhstat_args {
|
|||||||
char u_fhp_l_[PADL_(const struct fhandle *)]; const struct fhandle * u_fhp; char u_fhp_r_[PADR_(const struct fhandle *)];
|
char u_fhp_l_[PADL_(const struct fhandle *)]; const struct fhandle * u_fhp; char u_fhp_r_[PADR_(const struct fhandle *)];
|
||||||
char sb_l_[PADL_(struct freebsd11_stat32 *)]; struct freebsd11_stat32 * sb; char sb_r_[PADR_(struct freebsd11_stat32 *)];
|
char sb_l_[PADL_(struct freebsd11_stat32 *)]; struct freebsd11_stat32 * sb; char sb_r_[PADR_(struct freebsd11_stat32 *)];
|
||||||
};
|
};
|
||||||
|
struct freebsd11_freebsd32_jail_args {
|
||||||
|
char jail_l_[PADL_(struct jail32 *)]; struct jail32 * jail; char jail_r_[PADR_(struct jail32 *)];
|
||||||
|
};
|
||||||
struct freebsd11_freebsd32_kevent_args {
|
struct freebsd11_freebsd32_kevent_args {
|
||||||
char fd_l_[PADL_(int)]; int fd; char fd_r_[PADR_(int)];
|
char fd_l_[PADL_(int)]; int fd; char fd_r_[PADR_(int)];
|
||||||
char changelist_l_[PADL_(const struct kevent32_freebsd11 *)]; const struct kevent32_freebsd11 * changelist; char changelist_r_[PADR_(const struct kevent32_freebsd11 *)];
|
char changelist_l_[PADL_(const struct kevent32_freebsd11 *)]; const struct kevent32_freebsd11 * changelist; char changelist_r_[PADR_(const struct kevent32_freebsd11 *)];
|
||||||
@ -1223,6 +1222,7 @@ int freebsd11_freebsd32_lstat(struct thread *, struct freebsd11_freebsd32_lstat_
|
|||||||
int freebsd11_freebsd32_getdirentries(struct thread *, struct freebsd11_freebsd32_getdirentries_args *);
|
int freebsd11_freebsd32_getdirentries(struct thread *, struct freebsd11_freebsd32_getdirentries_args *);
|
||||||
int freebsd11_freebsd32_getdents(struct thread *, struct freebsd11_freebsd32_getdents_args *);
|
int freebsd11_freebsd32_getdents(struct thread *, struct freebsd11_freebsd32_getdents_args *);
|
||||||
int freebsd11_freebsd32_fhstat(struct thread *, struct freebsd11_freebsd32_fhstat_args *);
|
int freebsd11_freebsd32_fhstat(struct thread *, struct freebsd11_freebsd32_fhstat_args *);
|
||||||
|
int freebsd11_freebsd32_jail(struct thread *, struct freebsd11_freebsd32_jail_args *);
|
||||||
int freebsd11_freebsd32_kevent(struct thread *, struct freebsd11_freebsd32_kevent_args *);
|
int freebsd11_freebsd32_kevent(struct thread *, struct freebsd11_freebsd32_kevent_args *);
|
||||||
int freebsd11_freebsd32_fstatat(struct thread *, struct freebsd11_freebsd32_fstatat_args *);
|
int freebsd11_freebsd32_fstatat(struct thread *, struct freebsd11_freebsd32_fstatat_args *);
|
||||||
int freebsd11_freebsd32_mknodat(struct thread *, struct freebsd11_freebsd32_mknodat_args *);
|
int freebsd11_freebsd32_mknodat(struct thread *, struct freebsd11_freebsd32_mknodat_args *);
|
||||||
@ -1317,7 +1317,7 @@ int freebsd11_freebsd32_mknodat(struct thread *, struct freebsd11_freebsd32_mkno
|
|||||||
#define FREEBSD32_SYS_AUE_freebsd6_freebsd32_lio_listio AUE_LIO_LISTIO
|
#define FREEBSD32_SYS_AUE_freebsd6_freebsd32_lio_listio AUE_LIO_LISTIO
|
||||||
#define FREEBSD32_SYS_AUE_freebsd32_sched_rr_get_interval AUE_NULL
|
#define FREEBSD32_SYS_AUE_freebsd32_sched_rr_get_interval AUE_NULL
|
||||||
#define FREEBSD32_SYS_AUE_freebsd4_freebsd32_sendfile AUE_SENDFILE
|
#define FREEBSD32_SYS_AUE_freebsd4_freebsd32_sendfile AUE_SENDFILE
|
||||||
#define FREEBSD32_SYS_AUE_freebsd32_jail AUE_JAIL
|
#define FREEBSD32_SYS_AUE_freebsd11_freebsd32_jail AUE_JAIL
|
||||||
#define FREEBSD32_SYS_AUE_freebsd4_freebsd32_sigaction AUE_SIGACTION
|
#define FREEBSD32_SYS_AUE_freebsd4_freebsd32_sigaction AUE_SIGACTION
|
||||||
#define FREEBSD32_SYS_AUE_freebsd4_freebsd32_sigreturn AUE_SIGRETURN
|
#define FREEBSD32_SYS_AUE_freebsd4_freebsd32_sigreturn AUE_SIGRETURN
|
||||||
#define FREEBSD32_SYS_AUE_freebsd32_sigtimedwait AUE_SIGWAIT
|
#define FREEBSD32_SYS_AUE_freebsd32_sigtimedwait AUE_SIGWAIT
|
||||||
|
@ -275,7 +275,7 @@
|
|||||||
#define FREEBSD32_SYS_utrace 335
|
#define FREEBSD32_SYS_utrace 335
|
||||||
/* 336 is freebsd4 freebsd32_sendfile */
|
/* 336 is freebsd4 freebsd32_sendfile */
|
||||||
#define FREEBSD32_SYS_kldsym 337
|
#define FREEBSD32_SYS_kldsym 337
|
||||||
#define FREEBSD32_SYS_freebsd32_jail 338
|
#define FREEBSD32_SYS_freebsd11_freebsd32_jail 338
|
||||||
#define FREEBSD32_SYS_sigprocmask 340
|
#define FREEBSD32_SYS_sigprocmask 340
|
||||||
#define FREEBSD32_SYS_sigsuspend 341
|
#define FREEBSD32_SYS_sigsuspend 341
|
||||||
/* 342 is freebsd4 freebsd32_sigaction */
|
/* 342 is freebsd4 freebsd32_sigaction */
|
||||||
|
@ -347,7 +347,7 @@ const char *freebsd32_syscallnames[] = {
|
|||||||
"utrace", /* 335 = utrace */
|
"utrace", /* 335 = utrace */
|
||||||
"compat4.freebsd32_sendfile", /* 336 = freebsd4 freebsd32_sendfile */
|
"compat4.freebsd32_sendfile", /* 336 = freebsd4 freebsd32_sendfile */
|
||||||
"kldsym", /* 337 = kldsym */
|
"kldsym", /* 337 = kldsym */
|
||||||
"freebsd32_jail", /* 338 = freebsd32_jail */
|
"compat11.freebsd32_jail", /* 338 = freebsd11 freebsd32_jail */
|
||||||
"#339", /* 339 = pioctl */
|
"#339", /* 339 = pioctl */
|
||||||
"sigprocmask", /* 340 = sigprocmask */
|
"sigprocmask", /* 340 = sigprocmask */
|
||||||
"sigsuspend", /* 341 = sigsuspend */
|
"sigsuspend", /* 341 = sigsuspend */
|
||||||
|
@ -394,7 +394,7 @@ struct sysent freebsd32_sysent[] = {
|
|||||||
{ AS(utrace_args), (sy_call_t *)sys_utrace, AUE_NULL, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 335 = utrace */
|
{ AS(utrace_args), (sy_call_t *)sys_utrace, AUE_NULL, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 335 = utrace */
|
||||||
{ compat4(AS(freebsd4_freebsd32_sendfile_args),freebsd32_sendfile), AUE_SENDFILE, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 336 = freebsd4 freebsd32_sendfile */
|
{ compat4(AS(freebsd4_freebsd32_sendfile_args),freebsd32_sendfile), AUE_SENDFILE, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 336 = freebsd4 freebsd32_sendfile */
|
||||||
{ AS(kldsym_args), (sy_call_t *)sys_kldsym, AUE_NULL, NULL, 0, 0, 0, SY_THR_STATIC }, /* 337 = kldsym */
|
{ AS(kldsym_args), (sy_call_t *)sys_kldsym, AUE_NULL, NULL, 0, 0, 0, SY_THR_STATIC }, /* 337 = kldsym */
|
||||||
{ AS(freebsd32_jail_args), (sy_call_t *)freebsd32_jail, AUE_JAIL, NULL, 0, 0, 0, SY_THR_STATIC }, /* 338 = freebsd32_jail */
|
{ compat11(AS(freebsd11_freebsd32_jail_args),freebsd32_jail), AUE_JAIL, NULL, 0, 0, 0, SY_THR_STATIC }, /* 338 = freebsd11 freebsd32_jail */
|
||||||
{ 0, (sy_call_t *)nosys, AUE_NULL, NULL, 0, 0, 0, SY_THR_ABSENT }, /* 339 = pioctl */
|
{ 0, (sy_call_t *)nosys, AUE_NULL, NULL, 0, 0, 0, SY_THR_ABSENT }, /* 339 = pioctl */
|
||||||
{ AS(sigprocmask_args), (sy_call_t *)sys_sigprocmask, AUE_SIGPROCMASK, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 340 = sigprocmask */
|
{ AS(sigprocmask_args), (sy_call_t *)sys_sigprocmask, AUE_SIGPROCMASK, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 340 = sigprocmask */
|
||||||
{ AS(sigsuspend_args), (sy_call_t *)sys_sigsuspend, AUE_SIGSUSPEND, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 341 = sigsuspend */
|
{ AS(sigsuspend_args), (sy_call_t *)sys_sigsuspend, AUE_SIGSUSPEND, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 341 = sigsuspend */
|
||||||
|
@ -1559,13 +1559,6 @@ systrace_args(int sysnum, void *params, uint64_t *uarg, int *n_args)
|
|||||||
*n_args = 3;
|
*n_args = 3;
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
/* freebsd32_jail */
|
|
||||||
case 338: {
|
|
||||||
struct freebsd32_jail_args *p = params;
|
|
||||||
uarg[0] = (intptr_t) p->jail; /* struct jail32 * */
|
|
||||||
*n_args = 1;
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
/* sigprocmask */
|
/* sigprocmask */
|
||||||
case 340: {
|
case 340: {
|
||||||
struct sigprocmask_args *p = params;
|
struct sigprocmask_args *p = params;
|
||||||
@ -5711,16 +5704,6 @@ systrace_entry_setargdesc(int sysnum, int ndx, char *desc, size_t descsz)
|
|||||||
break;
|
break;
|
||||||
};
|
};
|
||||||
break;
|
break;
|
||||||
/* freebsd32_jail */
|
|
||||||
case 338:
|
|
||||||
switch(ndx) {
|
|
||||||
case 0:
|
|
||||||
p = "userland struct jail32 *";
|
|
||||||
break;
|
|
||||||
default:
|
|
||||||
break;
|
|
||||||
};
|
|
||||||
break;
|
|
||||||
/* sigprocmask */
|
/* sigprocmask */
|
||||||
case 340:
|
case 340:
|
||||||
switch(ndx) {
|
switch(ndx) {
|
||||||
@ -9673,11 +9656,6 @@ systrace_return_setargdesc(int sysnum, int ndx, char *desc, size_t descsz)
|
|||||||
if (ndx == 0 || ndx == 1)
|
if (ndx == 0 || ndx == 1)
|
||||||
p = "int";
|
p = "int";
|
||||||
break;
|
break;
|
||||||
/* freebsd32_jail */
|
|
||||||
case 338:
|
|
||||||
if (ndx == 0 || ndx == 1)
|
|
||||||
p = "int";
|
|
||||||
break;
|
|
||||||
/* sigprocmask */
|
/* sigprocmask */
|
||||||
case 340:
|
case 340:
|
||||||
if (ndx == 0 || ndx == 1)
|
if (ndx == 0 || ndx == 1)
|
||||||
|
@ -601,7 +601,7 @@
|
|||||||
off_t *sbytes, int flags); }
|
off_t *sbytes, int flags); }
|
||||||
337 AUE_NULL NOPROTO { int kldsym(int fileid, int cmd, \
|
337 AUE_NULL NOPROTO { int kldsym(int fileid, int cmd, \
|
||||||
void *data); }
|
void *data); }
|
||||||
338 AUE_JAIL STD { int freebsd32_jail(struct jail32 *jail); }
|
338 AUE_JAIL COMPAT11 { int freebsd32_jail(struct jail32 *jail); }
|
||||||
339 AUE_NULL UNIMPL pioctl
|
339 AUE_NULL UNIMPL pioctl
|
||||||
340 AUE_SIGPROCMASK NOPROTO { int sigprocmask(int how, \
|
340 AUE_SIGPROCMASK NOPROTO { int sigprocmask(int how, \
|
||||||
const sigset_t *set, sigset_t *oset); }
|
const sigset_t *set, sigset_t *oset); }
|
||||||
|
@ -834,9 +834,8 @@ nandfs_setattr(struct vop_setattr_args *ap)
|
|||||||
* Privileged non-jail processes may not modify system flags
|
* Privileged non-jail processes may not modify system flags
|
||||||
* if securelevel > 0 and any existing system flags are set.
|
* if securelevel > 0 and any existing system flags are set.
|
||||||
* Privileged jail processes behave like privileged non-jail
|
* Privileged jail processes behave like privileged non-jail
|
||||||
* processes if the security.jail.chflags_allowed sysctl is
|
* processes if the PR_ALLOW_CHFLAGS permission bit is set;
|
||||||
* is non-zero; otherwise, they behave like unprivileged
|
* otherwise, they behave like unprivileged processes.
|
||||||
* processes.
|
|
||||||
*/
|
*/
|
||||||
|
|
||||||
flags = inode->i_flags;
|
flags = inode->i_flags;
|
||||||
|
@ -387,7 +387,7 @@ struct sysent sysent[] = {
|
|||||||
{ AS(utrace_args), (sy_call_t *)sys_utrace, AUE_NULL, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 335 = utrace */
|
{ AS(utrace_args), (sy_call_t *)sys_utrace, AUE_NULL, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 335 = utrace */
|
||||||
{ compat4(AS(freebsd4_sendfile_args),sendfile), AUE_SENDFILE, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 336 = freebsd4 sendfile */
|
{ compat4(AS(freebsd4_sendfile_args),sendfile), AUE_SENDFILE, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 336 = freebsd4 sendfile */
|
||||||
{ AS(kldsym_args), (sy_call_t *)sys_kldsym, AUE_NULL, NULL, 0, 0, 0, SY_THR_STATIC }, /* 337 = kldsym */
|
{ AS(kldsym_args), (sy_call_t *)sys_kldsym, AUE_NULL, NULL, 0, 0, 0, SY_THR_STATIC }, /* 337 = kldsym */
|
||||||
{ AS(jail_args), (sy_call_t *)sys_jail, AUE_JAIL, NULL, 0, 0, 0, SY_THR_STATIC }, /* 338 = jail */
|
{ compat11(AS(freebsd11_jail_args),jail), AUE_JAIL, NULL, 0, 0, 0, SY_THR_STATIC }, /* 338 = freebsd11 jail */
|
||||||
{ AS(nnpfs_syscall_args), (sy_call_t *)lkmressys, AUE_NULL, NULL, 0, 0, 0, SY_THR_ABSENT }, /* 339 = nnpfs_syscall */
|
{ AS(nnpfs_syscall_args), (sy_call_t *)lkmressys, AUE_NULL, NULL, 0, 0, 0, SY_THR_ABSENT }, /* 339 = nnpfs_syscall */
|
||||||
{ AS(sigprocmask_args), (sy_call_t *)sys_sigprocmask, AUE_SIGPROCMASK, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 340 = sigprocmask */
|
{ AS(sigprocmask_args), (sy_call_t *)sys_sigprocmask, AUE_SIGPROCMASK, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 340 = sigprocmask */
|
||||||
{ AS(sigsuspend_args), (sy_call_t *)sys_sigsuspend, AUE_SIGSUSPEND, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 341 = sigsuspend */
|
{ AS(sigsuspend_args), (sy_call_t *)sys_sigsuspend, AUE_SIGSUSPEND, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 341 = sigsuspend */
|
||||||
|
@ -74,6 +74,14 @@ __FBSDID("$FreeBSD$");
|
|||||||
|
|
||||||
#include <security/mac/mac_framework.h>
|
#include <security/mac/mac_framework.h>
|
||||||
|
|
||||||
|
/*
|
||||||
|
* The old jail(2) interface will exist under COMPAT_FREEBSD11, but the global
|
||||||
|
* permission sysctls are slated to go away sometime (even with COMPAT).
|
||||||
|
*/
|
||||||
|
#if defined(COMPAT_FREEBSD11) && !defined(BURN_BRIDGES)
|
||||||
|
#define PR_GLOBAL_ALLOW
|
||||||
|
#endif
|
||||||
|
|
||||||
#define DEFAULT_HOSTUUID "00000000-0000-0000-0000-000000000000"
|
#define DEFAULT_HOSTUUID "00000000-0000-0000-0000-000000000000"
|
||||||
|
|
||||||
MALLOC_DEFINE(M_PRISON, "prison", "Prison structures");
|
MALLOC_DEFINE(M_PRISON, "prison", "Prison structures");
|
||||||
@ -199,9 +207,11 @@ const size_t pr_flag_allow_size = sizeof(pr_flag_allow);
|
|||||||
#define JAIL_DEFAULT_ALLOW (PR_ALLOW_SET_HOSTNAME | PR_ALLOW_RESERVED_PORTS)
|
#define JAIL_DEFAULT_ALLOW (PR_ALLOW_SET_HOSTNAME | PR_ALLOW_RESERVED_PORTS)
|
||||||
#define JAIL_DEFAULT_ENFORCE_STATFS 2
|
#define JAIL_DEFAULT_ENFORCE_STATFS 2
|
||||||
#define JAIL_DEFAULT_DEVFS_RSNUM 0
|
#define JAIL_DEFAULT_DEVFS_RSNUM 0
|
||||||
|
#ifdef PR_GLOBAL_ALLOW
|
||||||
static unsigned jail_default_allow = JAIL_DEFAULT_ALLOW;
|
static unsigned jail_default_allow = JAIL_DEFAULT_ALLOW;
|
||||||
static int jail_default_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS;
|
static int jail_default_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS;
|
||||||
static int jail_default_devfs_rsnum = JAIL_DEFAULT_DEVFS_RSNUM;
|
static int jail_default_devfs_rsnum = JAIL_DEFAULT_DEVFS_RSNUM;
|
||||||
|
#endif
|
||||||
#if defined(INET) || defined(INET6)
|
#if defined(INET) || defined(INET6)
|
||||||
static unsigned jail_max_af_ips = 255;
|
static unsigned jail_max_af_ips = 255;
|
||||||
#endif
|
#endif
|
||||||
@ -219,13 +229,14 @@ prison0_init(void)
|
|||||||
strlcpy(prison0.pr_osrelease, osrelease, sizeof(prison0.pr_osrelease));
|
strlcpy(prison0.pr_osrelease, osrelease, sizeof(prison0.pr_osrelease));
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#ifdef COMPAT_FREEBSD11
|
||||||
/*
|
/*
|
||||||
* struct jail_args {
|
* struct jail_args {
|
||||||
* struct jail *jail;
|
* struct jail *jail;
|
||||||
* };
|
* };
|
||||||
*/
|
*/
|
||||||
int
|
int
|
||||||
sys_jail(struct thread *td, struct jail_args *uap)
|
freebsd11_jail(struct thread *td, struct freebsd11_jail_args *uap)
|
||||||
{
|
{
|
||||||
uint32_t version;
|
uint32_t version;
|
||||||
int error;
|
int error;
|
||||||
@ -270,13 +281,16 @@ sys_jail(struct thread *td, struct jail_args *uap)
|
|||||||
/* Sci-Fi jails are not supported, sorry. */
|
/* Sci-Fi jails are not supported, sorry. */
|
||||||
return (EINVAL);
|
return (EINVAL);
|
||||||
}
|
}
|
||||||
return (kern_jail(td, &j));
|
return (freebsd11_kern_jail(td, &j));
|
||||||
}
|
}
|
||||||
|
|
||||||
int
|
int
|
||||||
kern_jail(struct thread *td, struct jail *j)
|
freebsd11_kern_jail(struct thread *td, struct jail *j)
|
||||||
{
|
{
|
||||||
struct iovec optiov[2 * (4 + nitems(pr_flag_allow)
|
struct iovec optiov[2 * (3
|
||||||
|
#ifdef PR_GLOBAL_ALLOW
|
||||||
|
+ 1 + nitems(pr_flag_allow)
|
||||||
|
#endif
|
||||||
#ifdef INET
|
#ifdef INET
|
||||||
+ 1
|
+ 1
|
||||||
#endif
|
#endif
|
||||||
@ -286,7 +300,10 @@ kern_jail(struct thread *td, struct jail *j)
|
|||||||
)];
|
)];
|
||||||
struct uio opt;
|
struct uio opt;
|
||||||
char *u_path, *u_hostname, *u_name;
|
char *u_path, *u_hostname, *u_name;
|
||||||
|
#ifdef PR_GLOBAL_ALLOW
|
||||||
struct bool_flags *bf;
|
struct bool_flags *bf;
|
||||||
|
int enforce_statfs;
|
||||||
|
#endif
|
||||||
#ifdef INET
|
#ifdef INET
|
||||||
uint32_t ip4s;
|
uint32_t ip4s;
|
||||||
struct in_addr *u_ip4;
|
struct in_addr *u_ip4;
|
||||||
@ -295,7 +312,7 @@ kern_jail(struct thread *td, struct jail *j)
|
|||||||
struct in6_addr *u_ip6;
|
struct in6_addr *u_ip6;
|
||||||
#endif
|
#endif
|
||||||
size_t tmplen;
|
size_t tmplen;
|
||||||
int error, enforce_statfs;
|
int error;
|
||||||
|
|
||||||
bzero(&optiov, sizeof(optiov));
|
bzero(&optiov, sizeof(optiov));
|
||||||
opt.uio_iov = optiov;
|
opt.uio_iov = optiov;
|
||||||
@ -306,6 +323,7 @@ kern_jail(struct thread *td, struct jail *j)
|
|||||||
opt.uio_rw = UIO_READ;
|
opt.uio_rw = UIO_READ;
|
||||||
opt.uio_td = td;
|
opt.uio_td = td;
|
||||||
|
|
||||||
|
#ifdef PR_GLOBAL_ALLOW
|
||||||
/* Set permissions for top-level jails from sysctls. */
|
/* Set permissions for top-level jails from sysctls. */
|
||||||
if (!jailed(td->td_ucred)) {
|
if (!jailed(td->td_ucred)) {
|
||||||
for (bf = pr_flag_allow;
|
for (bf = pr_flag_allow;
|
||||||
@ -327,6 +345,7 @@ kern_jail(struct thread *td, struct jail *j)
|
|||||||
optiov[opt.uio_iovcnt].iov_len = sizeof(enforce_statfs);
|
optiov[opt.uio_iovcnt].iov_len = sizeof(enforce_statfs);
|
||||||
opt.uio_iovcnt++;
|
opt.uio_iovcnt++;
|
||||||
}
|
}
|
||||||
|
#endif
|
||||||
|
|
||||||
tmplen = MAXPATHLEN + MAXHOSTNAMELEN + MAXHOSTNAMELEN;
|
tmplen = MAXPATHLEN + MAXHOSTNAMELEN + MAXHOSTNAMELEN;
|
||||||
#ifdef INET
|
#ifdef INET
|
||||||
@ -430,6 +449,7 @@ kern_jail(struct thread *td, struct jail *j)
|
|||||||
free(u_path, M_TEMP);
|
free(u_path, M_TEMP);
|
||||||
return (error);
|
return (error);
|
||||||
}
|
}
|
||||||
|
#endif /* COMPAT_FREEBSD11 */
|
||||||
|
|
||||||
|
|
||||||
/*
|
/*
|
||||||
@ -1247,7 +1267,11 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags)
|
|||||||
|
|
||||||
pr->pr_securelevel = ppr->pr_securelevel;
|
pr->pr_securelevel = ppr->pr_securelevel;
|
||||||
pr->pr_allow = JAIL_DEFAULT_ALLOW & ppr->pr_allow;
|
pr->pr_allow = JAIL_DEFAULT_ALLOW & ppr->pr_allow;
|
||||||
|
#ifdef PR_GLOBAL_ALLOW
|
||||||
pr->pr_enforce_statfs = jail_default_enforce_statfs;
|
pr->pr_enforce_statfs = jail_default_enforce_statfs;
|
||||||
|
#else
|
||||||
|
pr->pr_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS;
|
||||||
|
#endif
|
||||||
pr->pr_devfs_rsnum = ppr->pr_devfs_rsnum;
|
pr->pr_devfs_rsnum = ppr->pr_devfs_rsnum;
|
||||||
|
|
||||||
pr->pr_osreldate = osreldt ? osreldt : ppr->pr_osreldate;
|
pr->pr_osreldate = osreldt ? osreldt : ppr->pr_osreldate;
|
||||||
@ -3415,6 +3439,7 @@ prison_path(struct prison *pr1, struct prison *pr2)
|
|||||||
static SYSCTL_NODE(_security, OID_AUTO, jail, CTLFLAG_RW, 0,
|
static SYSCTL_NODE(_security, OID_AUTO, jail, CTLFLAG_RW, 0,
|
||||||
"Jails");
|
"Jails");
|
||||||
|
|
||||||
|
#ifdef COMPAT_FREEBSD11
|
||||||
static int
|
static int
|
||||||
sysctl_jail_list(SYSCTL_HANDLER_ARGS)
|
sysctl_jail_list(SYSCTL_HANDLER_ARGS)
|
||||||
{
|
{
|
||||||
@ -3518,6 +3543,7 @@ sysctl_jail_list(SYSCTL_HANDLER_ARGS)
|
|||||||
SYSCTL_OID(_security_jail, OID_AUTO, list,
|
SYSCTL_OID(_security_jail, OID_AUTO, list,
|
||||||
CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
|
CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
|
||||||
sysctl_jail_list, "S", "List of active jails");
|
sysctl_jail_list, "S", "List of active jails");
|
||||||
|
#endif /* COMPAT_FREEBSD11 */
|
||||||
|
|
||||||
static int
|
static int
|
||||||
sysctl_jail_jailed(SYSCTL_HANDLER_ARGS)
|
sysctl_jail_jailed(SYSCTL_HANDLER_ARGS)
|
||||||
@ -3557,13 +3583,14 @@ SYSCTL_PROC(_security_jail, OID_AUTO, vnet,
|
|||||||
#if defined(INET) || defined(INET6)
|
#if defined(INET) || defined(INET6)
|
||||||
SYSCTL_UINT(_security_jail, OID_AUTO, jail_max_af_ips, CTLFLAG_RW,
|
SYSCTL_UINT(_security_jail, OID_AUTO, jail_max_af_ips, CTLFLAG_RW,
|
||||||
&jail_max_af_ips, 0,
|
&jail_max_af_ips, 0,
|
||||||
"Number of IP addresses a jail may have at most per address family (deprecated)");
|
"Number of IP addresses a jail may have at most per address family");
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Default parameters for jail(2) compatibility. For historical reasons,
|
* Jail permissions - jailed processes can read these to find out what they are
|
||||||
* the sysctl names have varying similarity to the parameter names. Prisons
|
* allowed to do. A deprecated use is to set default permissions for prisons
|
||||||
* just see their own parameters, and can't change them.
|
* created via jail(2). For historical reasons, the sysctl names have varying
|
||||||
|
* similarity to the parameter names.
|
||||||
*/
|
*/
|
||||||
static int
|
static int
|
||||||
sysctl_jail_default_allow(SYSCTL_HANDLER_ARGS)
|
sysctl_jail_default_allow(SYSCTL_HANDLER_ARGS)
|
||||||
@ -3572,52 +3599,68 @@ sysctl_jail_default_allow(SYSCTL_HANDLER_ARGS)
|
|||||||
int allow, error, i;
|
int allow, error, i;
|
||||||
|
|
||||||
pr = req->td->td_ucred->cr_prison;
|
pr = req->td->td_ucred->cr_prison;
|
||||||
|
#ifdef PR_GLOBAL_ALLOW
|
||||||
allow = (pr == &prison0) ? jail_default_allow : pr->pr_allow;
|
allow = (pr == &prison0) ? jail_default_allow : pr->pr_allow;
|
||||||
|
#else
|
||||||
|
allow = pr->pr_allow;
|
||||||
|
#endif
|
||||||
|
|
||||||
/* Get the current flag value, and convert it to a boolean. */
|
/* Get the current flag value, and convert it to a boolean. */
|
||||||
i = (allow & arg2) ? 1 : 0;
|
i = (allow & arg2) ? 1 : 0;
|
||||||
if (arg1 != NULL)
|
if (arg1 != NULL)
|
||||||
i = !i;
|
i = !i;
|
||||||
error = sysctl_handle_int(oidp, &i, 0, req);
|
error = sysctl_handle_int(oidp, &i, 0, req);
|
||||||
if (error || !req->newptr)
|
if (error)
|
||||||
return (error);
|
return (error);
|
||||||
i = i ? arg2 : 0;
|
#ifdef PR_GLOBAL_ALLOW
|
||||||
if (arg1 != NULL)
|
if (req->newptr) {
|
||||||
i ^= arg2;
|
i = i ? arg2 : 0;
|
||||||
/*
|
if (arg1 != NULL)
|
||||||
* The sysctls don't have CTLFLAGS_PRISON, so assume prison0
|
i ^= arg2;
|
||||||
* for writing.
|
/*
|
||||||
*/
|
* The sysctls don't have CTLFLAGS_PRISON, so assume prison0
|
||||||
mtx_lock(&prison0.pr_mtx);
|
* for writing.
|
||||||
jail_default_allow = (jail_default_allow & ~arg2) | i;
|
*/
|
||||||
mtx_unlock(&prison0.pr_mtx);
|
mtx_lock(&prison0.pr_mtx);
|
||||||
|
jail_default_allow = (jail_default_allow & ~arg2) | i;
|
||||||
|
mtx_unlock(&prison0.pr_mtx);
|
||||||
|
}
|
||||||
|
#endif
|
||||||
return (0);
|
return (0);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#ifdef PR_GLOBAL_ALLOW
|
||||||
|
#define CTLFLAG_GLOBAL_ALLOW (CTLFLAG_RW | CTLFLAG_MPSAFE)
|
||||||
|
#define ADDR_GLOBAL_ALLOW(i) &i
|
||||||
|
#else
|
||||||
|
#define CTLFLAG_GLOBAL_ALLOW (CTLFLAG_RD | CTLFLAG_MPSAFE)
|
||||||
|
#define ADDR_GLOBAL_ALLOW(i) NULL
|
||||||
|
#endif
|
||||||
|
|
||||||
SYSCTL_PROC(_security_jail, OID_AUTO, set_hostname_allowed,
|
SYSCTL_PROC(_security_jail, OID_AUTO, set_hostname_allowed,
|
||||||
CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
|
CTLTYPE_INT | CTLFLAG_GLOBAL_ALLOW,
|
||||||
NULL, PR_ALLOW_SET_HOSTNAME, sysctl_jail_default_allow, "I",
|
NULL, PR_ALLOW_SET_HOSTNAME, sysctl_jail_default_allow, "I",
|
||||||
"Processes in jail can set their hostnames (deprecated)");
|
"Processes in jail can set their hostnames");
|
||||||
SYSCTL_PROC(_security_jail, OID_AUTO, socket_unixiproute_only,
|
SYSCTL_PROC(_security_jail, OID_AUTO, socket_unixiproute_only,
|
||||||
CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
|
CTLTYPE_INT | CTLFLAG_GLOBAL_ALLOW,
|
||||||
(void *)1, PR_ALLOW_SOCKET_AF, sysctl_jail_default_allow, "I",
|
(void *)1, PR_ALLOW_SOCKET_AF, sysctl_jail_default_allow, "I",
|
||||||
"Processes in jail are limited to creating UNIX/IP/route sockets only (deprecated)");
|
"Processes in jail are limited to creating UNIX/IP/route sockets only");
|
||||||
SYSCTL_PROC(_security_jail, OID_AUTO, sysvipc_allowed,
|
SYSCTL_PROC(_security_jail, OID_AUTO, sysvipc_allowed,
|
||||||
CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
|
CTLTYPE_INT | CTLFLAG_GLOBAL_ALLOW,
|
||||||
NULL, PR_ALLOW_SYSVIPC, sysctl_jail_default_allow, "I",
|
NULL, PR_ALLOW_SYSVIPC, sysctl_jail_default_allow, "I",
|
||||||
"Processes in jail can use System V IPC primitives (deprecated)");
|
"Processes in jail can use System V IPC primitives");
|
||||||
SYSCTL_PROC(_security_jail, OID_AUTO, allow_raw_sockets,
|
SYSCTL_PROC(_security_jail, OID_AUTO, allow_raw_sockets,
|
||||||
CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
|
CTLTYPE_INT | CTLFLAG_GLOBAL_ALLOW,
|
||||||
NULL, PR_ALLOW_RAW_SOCKETS, sysctl_jail_default_allow, "I",
|
NULL, PR_ALLOW_RAW_SOCKETS, sysctl_jail_default_allow, "I",
|
||||||
"Prison root can create raw sockets (deprecated)");
|
"Prison root can create raw sockets");
|
||||||
SYSCTL_PROC(_security_jail, OID_AUTO, chflags_allowed,
|
SYSCTL_PROC(_security_jail, OID_AUTO, chflags_allowed,
|
||||||
CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
|
CTLTYPE_INT | CTLFLAG_GLOBAL_ALLOW,
|
||||||
NULL, PR_ALLOW_CHFLAGS, sysctl_jail_default_allow, "I",
|
NULL, PR_ALLOW_CHFLAGS, sysctl_jail_default_allow, "I",
|
||||||
"Processes in jail can alter system file flags (deprecated)");
|
"Processes in jail can alter system file flags");
|
||||||
SYSCTL_PROC(_security_jail, OID_AUTO, mount_allowed,
|
SYSCTL_PROC(_security_jail, OID_AUTO, mount_allowed,
|
||||||
CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
|
CTLTYPE_INT | CTLFLAG_GLOBAL_ALLOW,
|
||||||
NULL, PR_ALLOW_MOUNT, sysctl_jail_default_allow, "I",
|
NULL, PR_ALLOW_MOUNT, sysctl_jail_default_allow, "I",
|
||||||
"Processes in jail can mount/unmount jail-friendly file systems (deprecated)");
|
"Processes in jail can mount/unmount jail-friendly file systems");
|
||||||
|
|
||||||
static int
|
static int
|
||||||
sysctl_jail_default_level(SYSCTL_HANDLER_ARGS)
|
sysctl_jail_default_level(SYSCTL_HANDLER_ARGS)
|
||||||
@ -3626,25 +3669,33 @@ sysctl_jail_default_level(SYSCTL_HANDLER_ARGS)
|
|||||||
int level, error;
|
int level, error;
|
||||||
|
|
||||||
pr = req->td->td_ucred->cr_prison;
|
pr = req->td->td_ucred->cr_prison;
|
||||||
|
#ifdef PR_GLOBAL_ALLOW
|
||||||
level = (pr == &prison0) ? *(int *)arg1 : *(int *)((char *)pr + arg2);
|
level = (pr == &prison0) ? *(int *)arg1 : *(int *)((char *)pr + arg2);
|
||||||
|
#else
|
||||||
|
level = *(int *)((char *)pr + arg2);
|
||||||
|
#endif
|
||||||
error = sysctl_handle_int(oidp, &level, 0, req);
|
error = sysctl_handle_int(oidp, &level, 0, req);
|
||||||
if (error || !req->newptr)
|
if (error)
|
||||||
return (error);
|
return (error);
|
||||||
*(int *)arg1 = level;
|
#ifdef PR_GLOBAL_ALLOW
|
||||||
|
if (req->newptr)
|
||||||
|
*(int *)arg1 = level;
|
||||||
|
#endif
|
||||||
return (0);
|
return (0);
|
||||||
}
|
}
|
||||||
|
|
||||||
SYSCTL_PROC(_security_jail, OID_AUTO, enforce_statfs,
|
SYSCTL_PROC(_security_jail, OID_AUTO, enforce_statfs,
|
||||||
CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
|
CTLTYPE_INT | CTLFLAG_GLOBAL_ALLOW,
|
||||||
&jail_default_enforce_statfs, offsetof(struct prison, pr_enforce_statfs),
|
ADDR_GLOBAL_ALLOW(jail_default_enforce_statfs),
|
||||||
|
offsetof(struct prison, pr_enforce_statfs),
|
||||||
sysctl_jail_default_level, "I",
|
sysctl_jail_default_level, "I",
|
||||||
"Processes in jail cannot see all mounted file systems (deprecated)");
|
"Processes in jail cannot see all mounted file systems");
|
||||||
|
|
||||||
SYSCTL_PROC(_security_jail, OID_AUTO, devfs_ruleset,
|
SYSCTL_PROC(_security_jail, OID_AUTO, devfs_ruleset,
|
||||||
CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE,
|
CTLTYPE_INT | CTLFLAG_GLOBAL_ALLOW,
|
||||||
&jail_default_devfs_rsnum, offsetof(struct prison, pr_devfs_rsnum),
|
ADDR_GLOBAL_ALLOW(jail_default_devfs_rsnum),
|
||||||
|
offsetof(struct prison, pr_devfs_rsnum),
|
||||||
sysctl_jail_default_level, "I",
|
sysctl_jail_default_level, "I",
|
||||||
"Ruleset for the devfs filesystem in jail (deprecated)");
|
"Ruleset for the devfs filesystem in jail");
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Nodes to describe jail parameters. Maximum length of string parameters
|
* Nodes to describe jail parameters. Maximum length of string parameters
|
||||||
@ -3785,9 +3836,6 @@ prison_add_allow(const char *prefix, const char *name, const char *prefix_descr,
|
|||||||
struct bool_flags *bf;
|
struct bool_flags *bf;
|
||||||
struct sysctl_oid *parent;
|
struct sysctl_oid *parent;
|
||||||
char *allow_name, *allow_noname, *allowed;
|
char *allow_name, *allow_noname, *allowed;
|
||||||
#ifndef NO_SYSCTL_DESCR
|
|
||||||
char *descr_deprecated;
|
|
||||||
#endif
|
|
||||||
unsigned allow_flag;
|
unsigned allow_flag;
|
||||||
|
|
||||||
if (prefix
|
if (prefix
|
||||||
@ -3844,10 +3892,7 @@ prison_add_allow(const char *prefix, const char *name, const char *prefix_descr,
|
|||||||
bf->flag = allow_flag;
|
bf->flag = allow_flag;
|
||||||
mtx_unlock(&prison0.pr_mtx);
|
mtx_unlock(&prison0.pr_mtx);
|
||||||
|
|
||||||
/*
|
/* Create sysctls for the paramter, and the current permission. */
|
||||||
* Create sysctls for the paramter, and the back-compat global
|
|
||||||
* permission.
|
|
||||||
*/
|
|
||||||
parent = prefix
|
parent = prefix
|
||||||
? SYSCTL_ADD_NODE(NULL,
|
? SYSCTL_ADD_NODE(NULL,
|
||||||
SYSCTL_CHILDREN(&sysctl___security_jail_param_allow),
|
SYSCTL_CHILDREN(&sysctl___security_jail_param_allow),
|
||||||
@ -3859,17 +3904,10 @@ prison_add_allow(const char *prefix, const char *name, const char *prefix_descr,
|
|||||||
if ((prefix
|
if ((prefix
|
||||||
? asprintf(&allowed, M_TEMP, "%s_%s_allowed", prefix, name)
|
? asprintf(&allowed, M_TEMP, "%s_%s_allowed", prefix, name)
|
||||||
: asprintf(&allowed, M_TEMP, "%s_allowed", name)) >= 0) {
|
: asprintf(&allowed, M_TEMP, "%s_allowed", name)) >= 0) {
|
||||||
#ifndef NO_SYSCTL_DESCR
|
|
||||||
(void)asprintf(&descr_deprecated, M_TEMP, "%s (deprecated)",
|
|
||||||
descr);
|
|
||||||
#endif
|
|
||||||
(void)SYSCTL_ADD_PROC(NULL,
|
(void)SYSCTL_ADD_PROC(NULL,
|
||||||
SYSCTL_CHILDREN(&sysctl___security_jail), OID_AUTO, allowed,
|
SYSCTL_CHILDREN(&sysctl___security_jail), OID_AUTO, allowed,
|
||||||
CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, allow_flag,
|
CTLTYPE_INT | CTLFLAG_GLOBAL_ALLOW, NULL, allow_flag,
|
||||||
sysctl_jail_default_allow, "I", descr_deprecated);
|
sysctl_jail_default_allow, "I", descr);
|
||||||
#ifndef NO_SYSCTL_DESCR
|
|
||||||
free(descr_deprecated, M_TEMP);
|
|
||||||
#endif
|
|
||||||
free(allowed, M_TEMP);
|
free(allowed, M_TEMP);
|
||||||
}
|
}
|
||||||
return allow_flag;
|
return allow_flag;
|
||||||
|
@ -344,7 +344,7 @@ const char *syscallnames[] = {
|
|||||||
"utrace", /* 335 = utrace */
|
"utrace", /* 335 = utrace */
|
||||||
"compat4.sendfile", /* 336 = freebsd4 sendfile */
|
"compat4.sendfile", /* 336 = freebsd4 sendfile */
|
||||||
"kldsym", /* 337 = kldsym */
|
"kldsym", /* 337 = kldsym */
|
||||||
"jail", /* 338 = jail */
|
"compat11.jail", /* 338 = freebsd11 jail */
|
||||||
"nnpfs_syscall", /* 339 = nnpfs_syscall */
|
"nnpfs_syscall", /* 339 = nnpfs_syscall */
|
||||||
"sigprocmask", /* 340 = sigprocmask */
|
"sigprocmask", /* 340 = sigprocmask */
|
||||||
"sigsuspend", /* 341 = sigsuspend */
|
"sigsuspend", /* 341 = sigsuspend */
|
||||||
|
@ -738,7 +738,7 @@
|
|||||||
_Out_opt_ off_t *sbytes, int flags); }
|
_Out_opt_ off_t *sbytes, int flags); }
|
||||||
337 AUE_NULL STD { int kldsym(int fileid, int cmd, \
|
337 AUE_NULL STD { int kldsym(int fileid, int cmd, \
|
||||||
_In_ void *data); }
|
_In_ void *data); }
|
||||||
338 AUE_JAIL STD { int jail( \
|
338 AUE_JAIL COMPAT11 { int jail( \
|
||||||
_In_ struct jail *jail); }
|
_In_ struct jail *jail); }
|
||||||
|
|
||||||
339 AUE_NULL NOSTD|NOTSTATIC { int nnpfs_syscall(int operation, \
|
339 AUE_NULL NOSTD|NOTSTATIC { int nnpfs_syscall(int operation, \
|
||||||
|
@ -1593,13 +1593,6 @@ systrace_args(int sysnum, void *params, uint64_t *uarg, int *n_args)
|
|||||||
*n_args = 3;
|
*n_args = 3;
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
/* jail */
|
|
||||||
case 338: {
|
|
||||||
struct jail_args *p = params;
|
|
||||||
uarg[0] = (intptr_t) p->jail; /* struct jail * */
|
|
||||||
*n_args = 1;
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
/* nnpfs_syscall */
|
/* nnpfs_syscall */
|
||||||
case 339: {
|
case 339: {
|
||||||
struct nnpfs_syscall_args *p = params;
|
struct nnpfs_syscall_args *p = params;
|
||||||
@ -5772,16 +5765,6 @@ systrace_entry_setargdesc(int sysnum, int ndx, char *desc, size_t descsz)
|
|||||||
break;
|
break;
|
||||||
};
|
};
|
||||||
break;
|
break;
|
||||||
/* jail */
|
|
||||||
case 338:
|
|
||||||
switch(ndx) {
|
|
||||||
case 0:
|
|
||||||
p = "userland struct jail *";
|
|
||||||
break;
|
|
||||||
default:
|
|
||||||
break;
|
|
||||||
};
|
|
||||||
break;
|
|
||||||
/* nnpfs_syscall */
|
/* nnpfs_syscall */
|
||||||
case 339:
|
case 339:
|
||||||
switch(ndx) {
|
switch(ndx) {
|
||||||
@ -9647,11 +9630,6 @@ systrace_return_setargdesc(int sysnum, int ndx, char *desc, size_t descsz)
|
|||||||
if (ndx == 0 || ndx == 1)
|
if (ndx == 0 || ndx == 1)
|
||||||
p = "int";
|
p = "int";
|
||||||
break;
|
break;
|
||||||
/* jail */
|
|
||||||
case 338:
|
|
||||||
if (ndx == 0 || ndx == 1)
|
|
||||||
p = "int";
|
|
||||||
break;
|
|
||||||
/* nnpfs_syscall */
|
/* nnpfs_syscall */
|
||||||
case 339:
|
case 339:
|
||||||
if (ndx == 0 || ndx == 1)
|
if (ndx == 0 || ndx == 1)
|
||||||
|
@ -32,6 +32,7 @@
|
|||||||
#ifndef _SYS_JAIL_H_
|
#ifndef _SYS_JAIL_H_
|
||||||
#define _SYS_JAIL_H_
|
#define _SYS_JAIL_H_
|
||||||
|
|
||||||
|
#ifdef COMPAT_FREEBSD11
|
||||||
#ifdef _KERNEL
|
#ifdef _KERNEL
|
||||||
struct jail_v0 {
|
struct jail_v0 {
|
||||||
u_int32_t version;
|
u_int32_t version;
|
||||||
@ -57,16 +58,6 @@ struct jail {
|
|||||||
* For all xprison structs, always keep the pr_version an int and
|
* For all xprison structs, always keep the pr_version an int and
|
||||||
* the first variable so userspace can easily distinguish them.
|
* the first variable so userspace can easily distinguish them.
|
||||||
*/
|
*/
|
||||||
#ifndef _KERNEL
|
|
||||||
struct xprison_v1 {
|
|
||||||
int pr_version;
|
|
||||||
int pr_id;
|
|
||||||
char pr_path[MAXPATHLEN];
|
|
||||||
char pr_host[MAXHOSTNAMELEN];
|
|
||||||
u_int32_t pr_ip;
|
|
||||||
};
|
|
||||||
#endif
|
|
||||||
|
|
||||||
struct xprison {
|
struct xprison {
|
||||||
int pr_version;
|
int pr_version;
|
||||||
int pr_id;
|
int pr_id;
|
||||||
@ -91,6 +82,7 @@ struct xprison {
|
|||||||
#define PRISON_STATE_INVALID 0
|
#define PRISON_STATE_INVALID 0
|
||||||
#define PRISON_STATE_ALIVE 1
|
#define PRISON_STATE_ALIVE 1
|
||||||
#define PRISON_STATE_DYING 2
|
#define PRISON_STATE_DYING 2
|
||||||
|
#endif /* COMPAT_FREEBSD11 */
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Flags for jail_set and jail_get.
|
* Flags for jail_set and jail_get.
|
||||||
@ -110,7 +102,6 @@ struct xprison {
|
|||||||
|
|
||||||
struct iovec;
|
struct iovec;
|
||||||
|
|
||||||
int jail(struct jail *);
|
|
||||||
int jail_set(struct iovec *, unsigned int, int);
|
int jail_set(struct iovec *, unsigned int, int);
|
||||||
int jail_get(struct iovec *, unsigned int, int);
|
int jail_get(struct iovec *, unsigned int, int);
|
||||||
int jail_attach(int);
|
int jail_attach(int);
|
||||||
|
@ -280,7 +280,7 @@
|
|||||||
#define SYS_utrace 335
|
#define SYS_utrace 335
|
||||||
/* 336 is freebsd4 sendfile */
|
/* 336 is freebsd4 sendfile */
|
||||||
#define SYS_kldsym 337
|
#define SYS_kldsym 337
|
||||||
#define SYS_jail 338
|
#define SYS_freebsd11_jail 338
|
||||||
#define SYS_nnpfs_syscall 339
|
#define SYS_nnpfs_syscall 339
|
||||||
#define SYS_sigprocmask 340
|
#define SYS_sigprocmask 340
|
||||||
#define SYS_sigsuspend 341
|
#define SYS_sigsuspend 341
|
||||||
|
@ -209,7 +209,7 @@ MIASM = \
|
|||||||
sched_rr_get_interval.o \
|
sched_rr_get_interval.o \
|
||||||
utrace.o \
|
utrace.o \
|
||||||
kldsym.o \
|
kldsym.o \
|
||||||
jail.o \
|
freebsd11_jail.o \
|
||||||
nnpfs_syscall.o \
|
nnpfs_syscall.o \
|
||||||
sigprocmask.o \
|
sigprocmask.o \
|
||||||
sigsuspend.o \
|
sigsuspend.o \
|
||||||
|
@ -143,7 +143,6 @@ int kern_getsockname(struct thread *td, int fd, struct sockaddr **sa,
|
|||||||
int kern_getsockopt(struct thread *td, int s, int level, int name,
|
int kern_getsockopt(struct thread *td, int s, int level, int name,
|
||||||
void *optval, enum uio_seg valseg, socklen_t *valsize);
|
void *optval, enum uio_seg valseg, socklen_t *valsize);
|
||||||
int kern_ioctl(struct thread *td, int fd, u_long com, caddr_t data);
|
int kern_ioctl(struct thread *td, int fd, u_long com, caddr_t data);
|
||||||
int kern_jail(struct thread *td, struct jail *j);
|
|
||||||
int kern_jail_get(struct thread *td, struct uio *options, int flags);
|
int kern_jail_get(struct thread *td, struct uio *options, int flags);
|
||||||
int kern_jail_set(struct thread *td, struct uio *options, int flags);
|
int kern_jail_set(struct thread *td, struct uio *options, int flags);
|
||||||
int kern_kevent(struct thread *td, int fd, int nchanges, int nevents,
|
int kern_kevent(struct thread *td, int fd, int nchanges, int nevents,
|
||||||
@ -308,5 +307,6 @@ struct freebsd11_dirent;
|
|||||||
|
|
||||||
int freebsd11_kern_getdirentries(struct thread *td, int fd, char *ubuf, u_int
|
int freebsd11_kern_getdirentries(struct thread *td, int fd, char *ubuf, u_int
|
||||||
count, long *basep, void (*func)(struct freebsd11_dirent *));
|
count, long *basep, void (*func)(struct freebsd11_dirent *));
|
||||||
|
int freebsd11_kern_jail(struct thread *td, struct jail *j);
|
||||||
|
|
||||||
#endif /* !_SYS_SYSCALLSUBR_H_ */
|
#endif /* !_SYS_SYSCALLSUBR_H_ */
|
||||||
|
@ -849,9 +849,6 @@ struct kldsym_args {
|
|||||||
char cmd_l_[PADL_(int)]; int cmd; char cmd_r_[PADR_(int)];
|
char cmd_l_[PADL_(int)]; int cmd; char cmd_r_[PADR_(int)];
|
||||||
char data_l_[PADL_(void *)]; void * data; char data_r_[PADR_(void *)];
|
char data_l_[PADL_(void *)]; void * data; char data_r_[PADR_(void *)];
|
||||||
};
|
};
|
||||||
struct jail_args {
|
|
||||||
char jail_l_[PADL_(struct jail *)]; struct jail * jail; char jail_r_[PADR_(struct jail *)];
|
|
||||||
};
|
|
||||||
struct nnpfs_syscall_args {
|
struct nnpfs_syscall_args {
|
||||||
char operation_l_[PADL_(int)]; int operation; char operation_r_[PADR_(int)];
|
char operation_l_[PADL_(int)]; int operation; char operation_r_[PADR_(int)];
|
||||||
char a_pathP_l_[PADL_(char *)]; char * a_pathP; char a_pathP_r_[PADR_(char *)];
|
char a_pathP_l_[PADL_(char *)]; char * a_pathP; char a_pathP_r_[PADR_(char *)];
|
||||||
@ -1961,7 +1958,6 @@ int sys_sched_get_priority_min(struct thread *, struct sched_get_priority_min_ar
|
|||||||
int sys_sched_rr_get_interval(struct thread *, struct sched_rr_get_interval_args *);
|
int sys_sched_rr_get_interval(struct thread *, struct sched_rr_get_interval_args *);
|
||||||
int sys_utrace(struct thread *, struct utrace_args *);
|
int sys_utrace(struct thread *, struct utrace_args *);
|
||||||
int sys_kldsym(struct thread *, struct kldsym_args *);
|
int sys_kldsym(struct thread *, struct kldsym_args *);
|
||||||
int sys_jail(struct thread *, struct jail_args *);
|
|
||||||
int sys_nnpfs_syscall(struct thread *, struct nnpfs_syscall_args *);
|
int sys_nnpfs_syscall(struct thread *, struct nnpfs_syscall_args *);
|
||||||
int sys_sigprocmask(struct thread *, struct sigprocmask_args *);
|
int sys_sigprocmask(struct thread *, struct sigprocmask_args *);
|
||||||
int sys_sigsuspend(struct thread *, struct sigsuspend_args *);
|
int sys_sigsuspend(struct thread *, struct sigsuspend_args *);
|
||||||
@ -2531,6 +2527,9 @@ struct freebsd11_fhstat_args {
|
|||||||
char u_fhp_l_[PADL_(const struct fhandle *)]; const struct fhandle * u_fhp; char u_fhp_r_[PADR_(const struct fhandle *)];
|
char u_fhp_l_[PADL_(const struct fhandle *)]; const struct fhandle * u_fhp; char u_fhp_r_[PADR_(const struct fhandle *)];
|
||||||
char sb_l_[PADL_(struct freebsd11_stat *)]; struct freebsd11_stat * sb; char sb_r_[PADR_(struct freebsd11_stat *)];
|
char sb_l_[PADL_(struct freebsd11_stat *)]; struct freebsd11_stat * sb; char sb_r_[PADR_(struct freebsd11_stat *)];
|
||||||
};
|
};
|
||||||
|
struct freebsd11_jail_args {
|
||||||
|
char jail_l_[PADL_(struct jail *)]; struct jail * jail; char jail_r_[PADR_(struct jail *)];
|
||||||
|
};
|
||||||
struct freebsd11_kevent_args {
|
struct freebsd11_kevent_args {
|
||||||
char fd_l_[PADL_(int)]; int fd; char fd_r_[PADR_(int)];
|
char fd_l_[PADL_(int)]; int fd; char fd_r_[PADR_(int)];
|
||||||
char changelist_l_[PADL_(struct kevent_freebsd11 *)]; struct kevent_freebsd11 * changelist; char changelist_r_[PADR_(struct kevent_freebsd11 *)];
|
char changelist_l_[PADL_(struct kevent_freebsd11 *)]; struct kevent_freebsd11 * changelist; char changelist_r_[PADR_(struct kevent_freebsd11 *)];
|
||||||
@ -2579,6 +2578,7 @@ int freebsd11_nstat(struct thread *, struct freebsd11_nstat_args *);
|
|||||||
int freebsd11_nfstat(struct thread *, struct freebsd11_nfstat_args *);
|
int freebsd11_nfstat(struct thread *, struct freebsd11_nfstat_args *);
|
||||||
int freebsd11_nlstat(struct thread *, struct freebsd11_nlstat_args *);
|
int freebsd11_nlstat(struct thread *, struct freebsd11_nlstat_args *);
|
||||||
int freebsd11_fhstat(struct thread *, struct freebsd11_fhstat_args *);
|
int freebsd11_fhstat(struct thread *, struct freebsd11_fhstat_args *);
|
||||||
|
int freebsd11_jail(struct thread *, struct freebsd11_jail_args *);
|
||||||
int freebsd11_kevent(struct thread *, struct freebsd11_kevent_args *);
|
int freebsd11_kevent(struct thread *, struct freebsd11_kevent_args *);
|
||||||
int freebsd11_getfsstat(struct thread *, struct freebsd11_getfsstat_args *);
|
int freebsd11_getfsstat(struct thread *, struct freebsd11_getfsstat_args *);
|
||||||
int freebsd11_statfs(struct thread *, struct freebsd11_statfs_args *);
|
int freebsd11_statfs(struct thread *, struct freebsd11_statfs_args *);
|
||||||
@ -2849,7 +2849,7 @@ int freebsd11_mknodat(struct thread *, struct freebsd11_mknodat_args *);
|
|||||||
#define SYS_AUE_utrace AUE_NULL
|
#define SYS_AUE_utrace AUE_NULL
|
||||||
#define SYS_AUE_freebsd4_sendfile AUE_SENDFILE
|
#define SYS_AUE_freebsd4_sendfile AUE_SENDFILE
|
||||||
#define SYS_AUE_kldsym AUE_NULL
|
#define SYS_AUE_kldsym AUE_NULL
|
||||||
#define SYS_AUE_jail AUE_JAIL
|
#define SYS_AUE_freebsd11_jail AUE_JAIL
|
||||||
#define SYS_AUE_nnpfs_syscall AUE_NULL
|
#define SYS_AUE_nnpfs_syscall AUE_NULL
|
||||||
#define SYS_AUE_sigprocmask AUE_SIGPROCMASK
|
#define SYS_AUE_sigprocmask AUE_SIGPROCMASK
|
||||||
#define SYS_AUE_sigsuspend AUE_SIGSUSPEND
|
#define SYS_AUE_sigsuspend AUE_SIGSUSPEND
|
||||||
|
@ -550,9 +550,8 @@ ufs_setattr(ap)
|
|||||||
* Privileged non-jail processes may not modify system flags
|
* Privileged non-jail processes may not modify system flags
|
||||||
* if securelevel > 0 and any existing system flags are set.
|
* if securelevel > 0 and any existing system flags are set.
|
||||||
* Privileged jail processes behave like privileged non-jail
|
* Privileged jail processes behave like privileged non-jail
|
||||||
* processes if the security.jail.chflags_allowed sysctl is
|
* processes if the PR_ALLOW_CHFLAGS permission bit is set;
|
||||||
* is non-zero; otherwise, they behave like unprivileged
|
* otherwise, they behave like unprivileged processes.
|
||||||
* processes.
|
|
||||||
*/
|
*/
|
||||||
if (!priv_check_cred(cred, PRIV_VFS_SYSFLAGS, 0)) {
|
if (!priv_check_cred(cred, PRIV_VFS_SYSFLAGS, 0)) {
|
||||||
if (ip->i_flags &
|
if (ip->i_flags &
|
||||||
|
Loading…
Reference in New Issue
Block a user