- Add the ability to run bhyve(8) within a jail(8).
This patch adds a new sysctl(8) knob "security.jail.vmm_allowed", by default this option is disable. Submitted by: Shawn Webb <shawn.webb____hardenedbsd.org> Reviewed by: jamie@ and myself. Relnotes: Yes. Sponsored by: HardenedBSD and G2, Inc. Differential Revision: https://reviews.freebsd.org/D16057
This commit is contained in:
parent
a5c4d9335b
commit
be963beee6
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=337023
@ -33,6 +33,7 @@ __FBSDID("$FreeBSD$");
|
|||||||
|
|
||||||
#include <sys/param.h>
|
#include <sys/param.h>
|
||||||
#include <sys/kernel.h>
|
#include <sys/kernel.h>
|
||||||
|
#include <sys/jail.h>
|
||||||
#include <sys/queue.h>
|
#include <sys/queue.h>
|
||||||
#include <sys/lock.h>
|
#include <sys/lock.h>
|
||||||
#include <sys/mutex.h>
|
#include <sys/mutex.h>
|
||||||
@ -43,6 +44,7 @@ __FBSDID("$FreeBSD$");
|
|||||||
#include <sys/ioccom.h>
|
#include <sys/ioccom.h>
|
||||||
#include <sys/mman.h>
|
#include <sys/mman.h>
|
||||||
#include <sys/uio.h>
|
#include <sys/uio.h>
|
||||||
|
#include <sys/proc.h>
|
||||||
|
|
||||||
#include <vm/vm.h>
|
#include <vm/vm.h>
|
||||||
#include <vm/pmap.h>
|
#include <vm/pmap.h>
|
||||||
@ -82,15 +84,28 @@ struct vmmdev_softc {
|
|||||||
|
|
||||||
static SLIST_HEAD(, vmmdev_softc) head;
|
static SLIST_HEAD(, vmmdev_softc) head;
|
||||||
|
|
||||||
|
static unsigned pr_allow_flag;
|
||||||
static struct mtx vmmdev_mtx;
|
static struct mtx vmmdev_mtx;
|
||||||
|
|
||||||
static MALLOC_DEFINE(M_VMMDEV, "vmmdev", "vmmdev");
|
static MALLOC_DEFINE(M_VMMDEV, "vmmdev", "vmmdev");
|
||||||
|
|
||||||
SYSCTL_DECL(_hw_vmm);
|
SYSCTL_DECL(_hw_vmm);
|
||||||
|
|
||||||
|
static int vmm_priv_check(struct ucred *ucred);
|
||||||
static int devmem_create_cdev(const char *vmname, int id, char *devmem);
|
static int devmem_create_cdev(const char *vmname, int id, char *devmem);
|
||||||
static void devmem_destroy(void *arg);
|
static void devmem_destroy(void *arg);
|
||||||
|
|
||||||
|
static int
|
||||||
|
vmm_priv_check(struct ucred *ucred)
|
||||||
|
{
|
||||||
|
|
||||||
|
if (jailed(ucred) &&
|
||||||
|
!(ucred->cr_prison->pr_allow & pr_allow_flag))
|
||||||
|
return (EPERM);
|
||||||
|
|
||||||
|
return (0);
|
||||||
|
}
|
||||||
|
|
||||||
static int
|
static int
|
||||||
vcpu_lock_one(struct vmmdev_softc *sc, int vcpu)
|
vcpu_lock_one(struct vmmdev_softc *sc, int vcpu)
|
||||||
{
|
{
|
||||||
@ -177,6 +192,10 @@ vmmdev_rw(struct cdev *cdev, struct uio *uio, int flags)
|
|||||||
void *hpa, *cookie;
|
void *hpa, *cookie;
|
||||||
struct vmmdev_softc *sc;
|
struct vmmdev_softc *sc;
|
||||||
|
|
||||||
|
error = vmm_priv_check(curthread->td_ucred);
|
||||||
|
if (error)
|
||||||
|
return (error);
|
||||||
|
|
||||||
sc = vmmdev_lookup2(cdev);
|
sc = vmmdev_lookup2(cdev);
|
||||||
if (sc == NULL)
|
if (sc == NULL)
|
||||||
return (ENXIO);
|
return (ENXIO);
|
||||||
@ -351,11 +370,14 @@ vmmdev_ioctl(struct cdev *cdev, u_long cmd, caddr_t data, int fflag,
|
|||||||
uint64_t *regvals;
|
uint64_t *regvals;
|
||||||
int *regnums;
|
int *regnums;
|
||||||
|
|
||||||
|
error = vmm_priv_check(curthread->td_ucred);
|
||||||
|
if (error)
|
||||||
|
return (error);
|
||||||
|
|
||||||
sc = vmmdev_lookup2(cdev);
|
sc = vmmdev_lookup2(cdev);
|
||||||
if (sc == NULL)
|
if (sc == NULL)
|
||||||
return (ENXIO);
|
return (ENXIO);
|
||||||
|
|
||||||
error = 0;
|
|
||||||
vcpu = -1;
|
vcpu = -1;
|
||||||
state_changed = 0;
|
state_changed = 0;
|
||||||
|
|
||||||
@ -777,6 +799,10 @@ vmmdev_mmap_single(struct cdev *cdev, vm_ooffset_t *offset, vm_size_t mapsize,
|
|||||||
int error, found, segid;
|
int error, found, segid;
|
||||||
bool sysmem;
|
bool sysmem;
|
||||||
|
|
||||||
|
error = vmm_priv_check(curthread->td_ucred);
|
||||||
|
if (error)
|
||||||
|
return (error);
|
||||||
|
|
||||||
first = *offset;
|
first = *offset;
|
||||||
last = first + mapsize;
|
last = first + mapsize;
|
||||||
if ((nprot & PROT_EXEC) || first < 0 || first >= last)
|
if ((nprot & PROT_EXEC) || first < 0 || first >= last)
|
||||||
@ -865,6 +891,10 @@ sysctl_vmm_destroy(SYSCTL_HANDLER_ARGS)
|
|||||||
struct vmmdev_softc *sc;
|
struct vmmdev_softc *sc;
|
||||||
struct cdev *cdev;
|
struct cdev *cdev;
|
||||||
|
|
||||||
|
error = vmm_priv_check(req->td->td_ucred);
|
||||||
|
if (error)
|
||||||
|
return (error);
|
||||||
|
|
||||||
strlcpy(buf, "beavis", sizeof(buf));
|
strlcpy(buf, "beavis", sizeof(buf));
|
||||||
error = sysctl_handle_string(oidp, buf, sizeof(buf), req);
|
error = sysctl_handle_string(oidp, buf, sizeof(buf), req);
|
||||||
if (error != 0 || req->newptr == NULL)
|
if (error != 0 || req->newptr == NULL)
|
||||||
@ -906,7 +936,8 @@ sysctl_vmm_destroy(SYSCTL_HANDLER_ARGS)
|
|||||||
destroy_dev_sched_cb(cdev, vmmdev_destroy, sc);
|
destroy_dev_sched_cb(cdev, vmmdev_destroy, sc);
|
||||||
return (0);
|
return (0);
|
||||||
}
|
}
|
||||||
SYSCTL_PROC(_hw_vmm, OID_AUTO, destroy, CTLTYPE_STRING | CTLFLAG_RW,
|
SYSCTL_PROC(_hw_vmm, OID_AUTO, destroy,
|
||||||
|
CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_PRISON,
|
||||||
NULL, 0, sysctl_vmm_destroy, "A", NULL);
|
NULL, 0, sysctl_vmm_destroy, "A", NULL);
|
||||||
|
|
||||||
static struct cdevsw vmmdevsw = {
|
static struct cdevsw vmmdevsw = {
|
||||||
@ -927,6 +958,10 @@ sysctl_vmm_create(SYSCTL_HANDLER_ARGS)
|
|||||||
struct vmmdev_softc *sc, *sc2;
|
struct vmmdev_softc *sc, *sc2;
|
||||||
char buf[VM_MAX_NAMELEN];
|
char buf[VM_MAX_NAMELEN];
|
||||||
|
|
||||||
|
error = vmm_priv_check(req->td->td_ucred);
|
||||||
|
if (error)
|
||||||
|
return (error);
|
||||||
|
|
||||||
strlcpy(buf, "beavis", sizeof(buf));
|
strlcpy(buf, "beavis", sizeof(buf));
|
||||||
error = sysctl_handle_string(oidp, buf, sizeof(buf), req);
|
error = sysctl_handle_string(oidp, buf, sizeof(buf), req);
|
||||||
if (error != 0 || req->newptr == NULL)
|
if (error != 0 || req->newptr == NULL)
|
||||||
@ -977,13 +1012,16 @@ sysctl_vmm_create(SYSCTL_HANDLER_ARGS)
|
|||||||
|
|
||||||
return (0);
|
return (0);
|
||||||
}
|
}
|
||||||
SYSCTL_PROC(_hw_vmm, OID_AUTO, create, CTLTYPE_STRING | CTLFLAG_RW,
|
SYSCTL_PROC(_hw_vmm, OID_AUTO, create,
|
||||||
|
CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_PRISON,
|
||||||
NULL, 0, sysctl_vmm_create, "A", NULL);
|
NULL, 0, sysctl_vmm_create, "A", NULL);
|
||||||
|
|
||||||
void
|
void
|
||||||
vmmdev_init(void)
|
vmmdev_init(void)
|
||||||
{
|
{
|
||||||
mtx_init(&vmmdev_mtx, "vmm device mutex", NULL, MTX_DEF);
|
mtx_init(&vmmdev_mtx, "vmm device mutex", NULL, MTX_DEF);
|
||||||
|
pr_allow_flag = prison_add_allow(NULL, "vmm", NULL,
|
||||||
|
"Allow use of vmm in a jail.");
|
||||||
}
|
}
|
||||||
|
|
||||||
int
|
int
|
||||||
|
@ -25,7 +25,7 @@
|
|||||||
.\"
|
.\"
|
||||||
.\" $FreeBSD$
|
.\" $FreeBSD$
|
||||||
.\"
|
.\"
|
||||||
.Dd July 29, 2018
|
.Dd July 30, 2018
|
||||||
.Dt JAIL 8
|
.Dt JAIL 8
|
||||||
.Os
|
.Os
|
||||||
.Sh NAME
|
.Sh NAME
|
||||||
@ -650,6 +650,12 @@ See
|
|||||||
.Xr zfs 8
|
.Xr zfs 8
|
||||||
for information on how to configure the ZFS filesystem to operate from
|
for information on how to configure the ZFS filesystem to operate from
|
||||||
within a jail.
|
within a jail.
|
||||||
|
.It Va allow.vmm
|
||||||
|
The jail may access
|
||||||
|
.Xr vmm 4 .
|
||||||
|
This flag is only available when the
|
||||||
|
.Xr vmm 4
|
||||||
|
kernel module is loaded.
|
||||||
.It Va linux
|
.It Va linux
|
||||||
Determine how a jail's Linux emulation environment appears.
|
Determine how a jail's Linux emulation environment appears.
|
||||||
A value of
|
A value of
|
||||||
@ -1294,6 +1300,7 @@ environment of the first jail.
|
|||||||
.Xr ps 1 ,
|
.Xr ps 1 ,
|
||||||
.Xr quota 1 ,
|
.Xr quota 1 ,
|
||||||
.Xr jail_set 2 ,
|
.Xr jail_set 2 ,
|
||||||
|
.Xr vmm 4 ,
|
||||||
.Xr devfs 5 ,
|
.Xr devfs 5 ,
|
||||||
.Xr fdescfs 5 ,
|
.Xr fdescfs 5 ,
|
||||||
.Xr jail.conf 5 ,
|
.Xr jail.conf 5 ,
|
||||||
|
Loading…
Reference in New Issue
Block a user