2 * ----------------------------------------------------------------------------
3 * "THE BEER-WARE LICENSE" (Revision 42):
4 * <phk@FreeBSD.ORG> wrote this file. As long as you retain this notice you
5 * can do whatever you want with this stuff. If we meet some day, and you think
6 * this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp
7 * ----------------------------------------------------------------------------
11 * Copyright (c) 2006 Victor Balada Diaz <victor@bsdes.net>
12 * All rights reserved.
14 * Redistribution and use in source and binary forms, with or without
15 * modification, are permitted provided that the following conditions
17 * 1. Redistributions of source code must retain the above copyright
18 * notice, this list of conditions and the following disclaimer.
19 * 2. Redistributions in binary form must reproduce the above copyright
20 * notice, this list of conditions and the following disclaimer in the
21 * documentation and/or other materials provided with the distribution.
23 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
38 * $FreeBSD: src/sys/kern/kern_jail.c,v 1.6.2.3 2001/08/17 01:00:26 rwatson Exp $
39 * $DragonFly: src/sys/kern/kern_jail.c,v 1.16 2007/01/01 19:45:54 victor Exp $
43 #include <sys/param.h>
44 #include <sys/types.h>
45 #include <sys/kernel.h>
46 #include <sys/systm.h>
47 #include <sys/errno.h>
48 #include <sys/sysproto.h>
49 #include <sys/malloc.h>
50 #include <sys/nlookup.h>
51 #include <sys/namecache.h>
54 #include <sys/socket.h>
55 #include <sys/sysctl.h>
56 #include <sys/kern_syscall.h>
58 #include <netinet/in.h>
59 #include <netinet6/in6_var.h>
61 static struct prison *prison_find(int);
63 MALLOC_DEFINE(M_PRISON, "prison", "Prison structures");
65 SYSCTL_NODE(, OID_AUTO, jail, CTLFLAG_RW, 0,
68 int jail_set_hostname_allowed = 1;
69 SYSCTL_INT(_jail, OID_AUTO, set_hostname_allowed, CTLFLAG_RW,
70 &jail_set_hostname_allowed, 0,
71 "Processes in jail can set their hostnames");
73 int jail_socket_unixiproute_only = 1;
74 SYSCTL_INT(_jail, OID_AUTO, socket_unixiproute_only, CTLFLAG_RW,
75 &jail_socket_unixiproute_only, 0,
76 "Processes in jail are limited to creating UNIX/IPv[46]/route sockets only");
78 int jail_sysvipc_allowed = 0;
79 SYSCTL_INT(_jail, OID_AUTO, sysvipc_allowed, CTLFLAG_RW,
80 &jail_sysvipc_allowed, 0,
81 "Processes in jail can use System V IPC primitives");
83 int jail_chflags_allowed = 0;
84 SYSCTL_INT(_jail, OID_AUTO, chflags_allowed, CTLFLAG_RW,
85 &jail_chflags_allowed, 0,
86 "Process in jail can set chflags(1)");
91 LIST_HEAD(prisonlist, prison);
92 struct prisonlist allprison = LIST_HEAD_INITIALIZER(&allprison);
95 kern_jail_attach(int jid)
97 struct proc *p = curthread->td_proc;
101 pr = prison_find(jid);
105 error = kern_chroot(&pr->pr_root);
111 p->p_ucred->cr_prison = pr;
112 p->p_flag |= P_JAILED;
120 * jail_args(syscallarg(struct jail *) jail)
123 sys_jail(struct jail_args *uap)
125 struct prison *pr, *tpr;
128 struct thread *td = curthread;
129 int error, tryprid, i;
131 struct nlookupdata nd;
133 struct sockaddr_storage *uips; /* Userland ips */
134 struct sockaddr_in ip4addr;
135 struct jail_ip_storage *jip;
140 uap->sysmsg_result = -1;
143 error = copyin(uap->jail, &jversion, sizeof jversion);
145 uap->sysmsg_result = -1;
148 pr = kmalloc(sizeof *pr , M_PRISON, M_WAITOK | M_ZERO);
149 SLIST_INIT(&pr->pr_ips);
153 error = copyin(uap->jail, &jv0, sizeof(struct jail_v0));
156 jip = kmalloc(sizeof(*jip), M_PRISON, M_WAITOK | M_ZERO);
157 ip4addr.sin_family = AF_INET;
158 ip4addr.sin_addr.s_addr = htonl(jv0.ip_number);
159 memcpy(&jip->ip, &ip4addr, sizeof(ip4addr));
160 SLIST_INSERT_HEAD(&pr->pr_ips, jip, entries);
163 error = copyin(uap->jail, &j, sizeof(j));
166 uips = kmalloc((sizeof(*uips) * j.n_ips), M_PRISON,
168 error = copyin(j.ips, uips, (sizeof(*uips) * j.n_ips));
170 kfree(uips, M_PRISON);
173 for (i = 0; i < j.n_ips; i++) {
174 jip = kmalloc(sizeof(*jip), M_PRISON,
176 memcpy(&jip->ip, &uips[i], sizeof(*uips));
177 SLIST_INSERT_HEAD(&pr->pr_ips, jip, entries);
179 kfree(uips, M_PRISON);
186 error = copyinstr(j.hostname, &pr->pr_host, sizeof pr->pr_host, 0);
189 error = nlookup_init(&nd, j.path, UIO_USERSPACE, NLC_FOLLOW);
191 goto nlookup_init_clean;
192 error = nlookup(&nd);
194 goto nlookup_init_clean;
195 cache_copy(&nd.nl_nch, &pr->pr_root);
197 varsymset_init(&pr->pr_varsymset, NULL);
199 tryprid = lastprid + 1;
200 if (tryprid == JAIL_MAX)
203 LIST_FOREACH(tpr, &allprison, pr_list) {
204 if (tpr->pr_id != tryprid)
207 if (tryprid == JAIL_MAX) {
213 pr->pr_id = lastprid = tryprid;
214 LIST_INSERT_HEAD(&allprison, pr, pr_list);
217 error = kern_jail_attach(pr->pr_id);
219 goto jail_attach_clean;
222 uap->sysmsg_result = pr->pr_id;
226 LIST_REMOVE(pr, pr_list);
228 varsymset_clean(&pr->pr_varsymset);
233 while (!SLIST_EMPTY(&pr->pr_ips)) {
234 jip = SLIST_FIRST(&pr->pr_ips);
235 SLIST_REMOVE_HEAD(&pr->pr_ips, entries);
243 * int jail_attach(int jid);
246 sys_jail_attach(struct jail_attach_args *uap)
248 struct thread *td = curthread;
255 return(kern_jail_attach(uap->jid));
259 * Changes INADDR_LOOPBACK for a valid jail address.
260 * ip is in network byte order.
261 * Returns 1 if the ip is among jail valid ips.
262 * Returns 0 if is not among jail valid ips or
263 * if couldn't replace INADDR_LOOPBACK for a valid
267 prison_replace_wildcards(struct thread *td, struct sockaddr *ip)
269 struct sockaddr_in *ip4 = (struct sockaddr_in *)ip;
270 struct sockaddr_in6 *ip6 = (struct sockaddr_in6 *)ip;
273 if (td->td_proc == NULL)
275 if ((pr = td->td_proc->p_ucred->cr_prison) == NULL)
278 if ((ip->sa_family == AF_INET &&
279 ip4->sin_addr.s_addr == htonl(INADDR_ANY)) ||
280 (ip->sa_family == AF_INET6 &&
281 IN6_IS_ADDR_UNSPECIFIED(&ip6->sin6_addr)))
283 if ((ip->sa_family == AF_INET &&
284 ip4->sin_addr.s_addr == htonl(INADDR_LOOPBACK)) ||
285 (ip->sa_family == AF_INET6 &&
286 IN6_IS_ADDR_LOOPBACK(&ip6->sin6_addr))) {
287 if (!prison_get_local(pr, ip) && !prison_get_nonlocal(pr, ip))
292 if (jailed_ip(pr, ip))
298 prison_remote_ip(struct thread *td, struct sockaddr *ip)
300 struct sockaddr_in *ip4 = (struct sockaddr_in *)ip;
301 struct sockaddr_in6 *ip6 = (struct sockaddr_in6 *)ip;
304 if (td == NULL || td->td_proc == NULL)
306 if ((pr = td->td_proc->p_ucred->cr_prison) == NULL)
308 if ((ip->sa_family == AF_INET &&
309 ip4->sin_addr.s_addr == htonl(INADDR_LOOPBACK)) ||
310 (ip->sa_family == AF_INET6 &&
311 IN6_IS_ADDR_LOOPBACK(&ip6->sin6_addr))) {
312 if (!prison_get_local(pr, ip) && !prison_get_nonlocal(pr, ip))
321 * Prison get non loopback ip:
322 * Put on *ip the first IP address that is not a loopback address.
323 * af is the address family of the ip we want (AF_INET|AF_INET6).
324 * ip is in network by order and we don't touch it unless we find a valid ip.
325 * Return 1 if we've found a non loopback ip, else return 0.
328 prison_get_nonlocal(struct prison *pr, struct sockaddr *ip)
330 struct jail_ip_storage *jis;
331 struct sockaddr_in *jip4, *ip4;
332 struct sockaddr_in6 *jip6, *ip6;
334 ip4 = (struct sockaddr_in *)ip;
335 ip6 = (struct sockaddr_in6 *)ip;
336 /* Check if it is cached */
337 switch(ip->sa_family) {
339 /* -1 Means that we don't have any address */
340 if (pr->nonlocal_ip4 == (struct sockaddr_storage *)-1)
342 if (pr->nonlocal_ip4 != NULL) {
343 jip4 = (struct sockaddr_in *) pr->nonlocal_ip4;
344 ip4->sin_addr.s_addr = jip4->sin_addr.s_addr;
348 /* -1 Means that we don't have any address */
349 if (pr->nonlocal_ip6 == (struct sockaddr_storage *)-1)
351 if (pr->nonlocal_ip6 != NULL) {
352 jip6 = (struct sockaddr_in6 *) pr->nonlocal_ip6;
353 ip6->sin6_addr = jip6->sin6_addr;
357 SLIST_FOREACH(jis, &pr->pr_ips, entries) {
358 switch (ip->sa_family) {
360 jip4 = (struct sockaddr_in *) &jis->ip;
361 if (jip4->sin_family == AF_INET &&
362 ((ntohl(jip4->sin_addr.s_addr) >> IN_CLASSA_NSHIFT) != IN_LOOPBACKNET)) {
363 pr->nonlocal_ip4 = &jis->ip;
364 ip4->sin_addr.s_addr = jip4->sin_addr.s_addr;
369 jip6 = (struct sockaddr_in6 *) &jis->ip;
370 if ( jip6->sin6_family == AF_INET6 &&
371 !IN6_IS_ADDR_LOOPBACK(&jip6->sin6_addr)) {
372 pr->nonlocal_ip6 = &jis->ip;
373 ip6->sin6_addr = jip6->sin6_addr;
379 if (ip->sa_family == AF_INET)
380 pr->nonlocal_ip4 = (struct sockaddr_storage *)-1;
382 pr->nonlocal_ip6 = (struct sockaddr_storage *)-1;
387 * Prison get loopback ip.
388 * Put on *ip the first loopback IP address.
389 * af is the address family of the ip we want (AF_INET|PF_INET).
390 * *ip is in network by order and we don't touch it unless we find a valid ip.
391 * return 1 if we've found a loopback ip, else return 0.
394 prison_get_local(struct prison *pr, struct sockaddr *ip)
396 struct jail_ip_storage *jis;
397 struct sockaddr_in *jip4, *ip4;
398 struct sockaddr_in6 *jip6, *ip6;
400 ip4 = (struct sockaddr_in *)ip;
401 ip6 = (struct sockaddr_in6 *)ip;
402 /* Check if it is cached */
403 switch(ip->sa_family) {
405 /* -1 Means that we don't have any address */
406 if (pr->local_ip4 == (struct sockaddr_storage *)-1)
408 if (pr->local_ip4 != NULL) {
409 jip4 = (struct sockaddr_in *) pr->local_ip4;
410 ip4->sin_addr.s_addr = jip4->sin_addr.s_addr;
414 /* -1 Means that we don't have any address */
415 if (pr->local_ip6 == (struct sockaddr_storage *)-1)
417 if (pr->local_ip6 != NULL) {
418 jip6 = (struct sockaddr_in6 *) pr->local_ip6;
419 ip6->sin6_addr = jip6->sin6_addr;
423 SLIST_FOREACH(jis, &pr->pr_ips, entries) {
424 switch(ip->sa_family) {
426 jip4 = (struct sockaddr_in *) &jis->ip;
427 if (jip4->sin_family == AF_INET &&
428 ((ntohl(jip4->sin_addr.s_addr) >> IN_CLASSA_NSHIFT)
429 == IN_LOOPBACKNET)) {
430 pr->local_ip4 = &jis->ip;
431 ip4->sin_addr.s_addr = jip4->sin_addr.s_addr;
436 jip6 = (struct sockaddr_in6 *) &jis->ip;
437 if (jip6->sin6_family == AF_INET6 &&
438 IN6_IS_ADDR_LOOPBACK(&jip6->sin6_addr)) {
439 pr->local_ip6 = &jis->ip;
440 ip6->sin6_addr = jip6->sin6_addr;
446 if (ip->sa_family == AF_INET)
447 pr->local_ip4 = (struct sockaddr_storage *)-1;
449 pr->local_ip6 = (struct sockaddr_storage *)-1;
453 /* Check if the IP is among ours, if it is return 1, else 0 */
455 jailed_ip(struct prison *pr, struct sockaddr *ip)
457 struct jail_ip_storage *jis;
458 struct sockaddr_in *jip4, *ip4;
459 struct sockaddr_in6 *jip6, *ip6;
463 ip4 = (struct sockaddr_in *)ip;
464 ip6 = (struct sockaddr_in6 *)ip;
465 SLIST_FOREACH(jis, &pr->pr_ips, entries) {
466 switch (ip->sa_family) {
468 jip4 = (struct sockaddr_in *) &jis->ip;
469 if (jip4->sin_family == AF_INET &&
470 ip4->sin_addr.s_addr == jip4->sin_addr.s_addr)
474 jip6 = (struct sockaddr_in6 *) &jis->ip;
475 if (jip6->sin6_family == AF_INET6 &&
476 IN6_ARE_ADDR_EQUAL(&ip6->sin6_addr,
487 prison_if(struct ucred *cred, struct sockaddr *sa)
490 struct sockaddr_in *sai = (struct sockaddr_in*) sa;
492 pr = cred->cr_prison;
494 if (((sai->sin_family != AF_INET) && (sai->sin_family != AF_INET6))
495 && jail_socket_unixiproute_only)
497 else if ((sai->sin_family != AF_INET) && (sai->sin_family != AF_INET6))
499 else if (jailed_ip(pr, sa))
505 * Returns a prison instance, or NULL on failure.
507 static struct prison *
508 prison_find(int prid)
512 LIST_FOREACH(pr, &allprison, pr_list) {
513 if (pr->pr_id == prid)
520 sysctl_jail_list(SYSCTL_HANDLER_ARGS)
522 struct jail_ip_storage *jip;
524 struct sockaddr_in6 *jsin6;
526 struct sockaddr_in *jsin;
529 unsigned int jlssize, jlsused;
531 char *jls; /* Jail list */
532 char *oip; /* Output ip */
533 char *fullpath, *freepath;
536 p = curthread->td_proc;
538 if (jailed(p->p_ucred))
546 jlssize = (count * 1024);
547 jls = kmalloc(jlssize + 1, M_TEMP, M_WAITOK | M_ZERO);
548 if (count < prisoncount) {
554 LIST_FOREACH(pr, &allprison, pr_list) {
555 error = cache_fullpath(p, &pr->pr_root, &fullpath, &freepath);
558 if (jlsused && jlsused < jlssize)
559 jls[jlsused++] = '\n';
560 count = ksnprintf(jls + jlsused, (jlssize - jlsused),
562 pr->pr_id, pr->pr_host, fullpath);
563 kfree(freepath, M_TEMP);
569 SLIST_FOREACH(jip, &pr->pr_ips, entries) {
570 jsin = (struct sockaddr_in *)&jip->ip;
572 switch(jsin->sin_family) {
574 oip = inet_ntoa(jsin->sin_addr);
578 jsin6 = (struct sockaddr_in6 *)&jip->ip;
579 oip = ip6_sprintf(&jsin6->sin6_addr);
587 if ((jlssize - jlsused) < (strlen(oip) + 1)) {
591 count = ksnprintf(jls + jlsused, (jlssize - jlsused),
601 * pr_id <SPC> hostname1 <SPC> PATH1 <SPC> IP1 <SPC> IP2\npr_id...
603 error = SYSCTL_OUT(req, jls, jlsused);
609 SYSCTL_OID(_jail, OID_AUTO, list, CTLTYPE_STRING | CTLFLAG_RD, NULL, 0,
610 sysctl_jail_list, "A", "List of active jails");
613 prison_hold(struct prison *pr)
619 prison_free(struct prison *pr)
621 struct jail_ip_storage *jls;
622 KKASSERT(pr->pr_ref >= 1);
624 if (--pr->pr_ref > 0)
628 while (!SLIST_EMPTY(&pr->pr_ips)) {
629 jls = SLIST_FIRST(&pr->pr_ips);
630 SLIST_REMOVE_HEAD(&pr->pr_ips, entries);
633 LIST_REMOVE(pr, pr_list);
636 if (pr->pr_linux != NULL)
637 kfree(pr->pr_linux, M_PRISON);
638 varsymset_clean(&pr->pr_varsymset);
639 cache_drop(&pr->pr_root);