d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Give jail(8) the feature to allow raw sockets from within a

Browse Source 
jail, which is less restrictive but allows for more flexible
jail usage (for those who are willing to make the sacrifice).
The default is off, but allowing raw sockets within jails can
now be accomplished by tuning security.jail.allow_raw_sockets
to 1.

Turning this on will allow you to use things like ping(8)
or traceroute(8) from within a jail.

The patch being committed is not identical to the patch
in the PR.  The committed version is more friendly to
APIs which pjd is working on, so it should integrate
into his work quite nicely.  This change has also been
presented and addressed on the freebsd-hackers mailing
list.

Submitted by: Christian S.J. Peron <maneo@bsdpro.com>
PR: kern/65800
This commit is contained in:
Bosko Milekic 2004-04-26 19:46:52 +00:00
parent f59f70e231
commit 5a59cefcd1
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=128664
4 changed files with 50 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
sys/kern/kern_jail.c
View File

@ -59,6 +59,11 @@ SYSCTL_INT(_security_jail, OID_AUTO, getfsstate_getfsstatroot_only, CTLFLAG_RW,
&jail_getfsstatroot_only, 0,
"Processes see only their root file system in getfsstat()");
int jail_allow_raw_sockets = 0;
SYSCTL_INT(_security_jail, OID_AUTO, allow_raw_sockets, CTLFLAG_RW,
&jail_allow_raw_sockets, 0,
"Prison root can create raw sockets");
/* allprison, lastprid, and prisoncount are protected by allprison_mtx. */
struct prisonlist allprison;
struct mtx allprison_mtx;

15
sys/net/rtsock.c
View File

@ -48,6 +48,8 @@
#include <net/raw_cb.h>
#include <net/route.h>
#include <netinet/in.h>
MALLOC_DEFINE(M_RTABLE, "routetbl", "routing tables");
/* NB: these are not modified */
@ -287,6 +289,7 @@ route_output(struct mbuf *m, struct socket *so)
int len, error = 0;
struct ifnet *ifp = NULL;
struct ifaddr *ifa = NULL;
struct sockaddr_in jail;
#define senderr(e) { error = e; goto flush;}
if (m == NULL || ((m->m_len < sizeof(long)) &&
@ -400,8 +403,16 @@ route_output(struct mbuf *m, struct socket *so)
if (ifp) {
info.rti_info[RTAX_IFP] =
ifaddr_byindex(ifp->if_index)->ifa_addr;
info.rti_info[RTAX_IFA] =
rt->rt_ifa->ifa_addr;
if (jailed(so->so_cred)) {
jail.sin_family = PF_INET;
jail.sin_len = sizeof(jail);
jail.sin_addr.s_addr =
htonl(prison_getip(so->so_cred));
info.rti_info[RTAX_IFA] =
(struct sockaddr *)&jail;
} else
info.rti_info[RTAX_IFA] =
rt->rt_ifa->ifa_addr;
if (ifp->if_flags & IFF_POINTOPOINT)
info.rti_info[RTAX_BRD] =
rt->rt_ifa->ifa_dstaddr;

33
sys/netinet/raw_ip.c
View File

@ -36,6 +36,7 @@
#include "opt_random_ip_id.h"
#include <sys/param.h>
#include <sys/jail.h>
#include <sys/kernel.h>
#include <sys/lock.h>
#include <sys/mac.h>
@ -206,6 +207,10 @@ rip_input(struct mbuf *m, int off)
if (inp->inp_faddr.s_addr &&
inp->inp_faddr.s_addr != ip->ip_src.s_addr)
goto docontinue;
if (jailed(inp->inp_socket->so_cred))
if (htonl(prison_getip(inp->inp_socket->so_cred))
!= ip->ip_dst.s_addr)
goto docontinue;
if (last) {
struct mbuf *n;
@ -261,7 +266,11 @@ rip_output(struct mbuf *m, struct socket *so, u_long dst)
ip->ip_off = 0;
ip->ip_p = inp->inp_ip_p;
ip->ip_len = m->m_pkthdr.len;
ip->ip_src = inp->inp_laddr;
if (jailed(inp->inp_socket->so_cred))
ip->ip_src.s_addr =
htonl(prison_getip(inp->inp_socket->so_cred));
else
ip->ip_src = inp->inp_laddr;
ip->ip_dst.s_addr = dst;
ip->ip_ttl = inp->inp_ip_ttl;
} else {
@ -270,6 +279,13 @@ rip_output(struct mbuf *m, struct socket *so, u_long dst)
return(EMSGSIZE);
}
ip = mtod(m, struct ip *);
if (jailed(inp->inp_socket->so_cred)) {
if (ip->ip_src.s_addr !=
htonl(prison_getip(inp->inp_socket->so_cred))) {
m_freem(m);
return (EPERM);
}
}
/* don't allow both user specified and setsockopt options,
and don't allow packet length sizes that will crash */
if (((ip->ip_hl != (sizeof (*ip) >> 2))
@ -518,7 +534,11 @@ rip_attach(struct socket *so, int proto, struct thread *td)
INP_INFO_WUNLOCK(&ripcbinfo);
return EINVAL;
}
if (td && (error = suser(td)) != 0) {
if (td && jailed(td->td_ucred) && !jail_allow_raw_sockets) {
INP_INFO_WUNLOCK(&ripcbinfo);
return (EPERM);
}
if (td && (error = suser_cred(td->td_ucred, PRISON_ROOT)) != 0) {
INP_INFO_WUNLOCK(&ripcbinfo);
return error;
}
@ -618,6 +638,15 @@ rip_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
if (nam->sa_len != sizeof(*addr))
return EINVAL;
if (jailed(td->td_ucred)) {
if (addr->sin_addr.s_addr == INADDR_ANY)
addr->sin_addr.s_addr =
htonl(prison_getip(td->td_ucred));
if (htonl(prison_getip(td->td_ucred))
!= addr->sin_addr.s_addr)
return (EADDRNOTAVAIL);
}
if (TAILQ_EMPTY(&ifnet) ||
(addr->sin_family != AF_INET && addr->sin_family != AF_IMPLINK) ||
(addr->sin_addr.s_addr &&

1
sys/sys/jail.h
View File

@ -82,6 +82,7 @@ extern int jail_set_hostname_allowed;
extern int jail_socket_unixiproute_only;
extern int jail_sysvipc_allowed;
extern int jail_getfsstat_jailrootonly;
extern int jail_allow_raw_sockets;
LIST_HEAD(prisonlist, prison);
extern struct prisonlist allprison;