2 * ----------------------------------------------------------------------------
3 * "THE BEER-WARE LICENSE" (Revision 42):
4 * <phk@FreeBSD.ORG> wrote this file. As long as you retain this notice you
5 * can do whatever you want with this stuff. If we meet some day, and you think
6 * this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp
7 * ----------------------------------------------------------------------------
9 * $FreeBSD: src/sys/kern/kern_jail.c,v 1.6.2.3 2001/08/17 01:00:26 rwatson Exp $
10 * $DragonFly: src/sys/kern/kern_jail.c,v 1.5 2003/06/26 02:17:45 dillon Exp $
14 #include <sys/param.h>
15 #include <sys/types.h>
16 #include <sys/kernel.h>
17 #include <sys/systm.h>
18 #include <sys/errno.h>
19 #include <sys/sysproto.h>
20 #include <sys/malloc.h>
23 #include <sys/socket.h>
24 #include <sys/sysctl.h>
26 #include <netinet/in.h>
28 MALLOC_DEFINE(M_PRISON, "prison", "Prison structures");
30 SYSCTL_NODE(, OID_AUTO, jail, CTLFLAG_RW, 0,
33 int jail_set_hostname_allowed = 1;
34 SYSCTL_INT(_jail, OID_AUTO, set_hostname_allowed, CTLFLAG_RW,
35 &jail_set_hostname_allowed, 0,
36 "Processes in jail can set their hostnames");
38 int jail_socket_unixiproute_only = 1;
39 SYSCTL_INT(_jail, OID_AUTO, socket_unixiproute_only, CTLFLAG_RW,
40 &jail_socket_unixiproute_only, 0,
41 "Processes in jail are limited to creating UNIX/IPv4/route sockets only");
43 int jail_sysvipc_allowed = 0;
44 SYSCTL_INT(_jail, OID_AUTO, sysvipc_allowed, CTLFLAG_RW,
45 &jail_sysvipc_allowed, 0,
46 "Processes in jail can use System V IPC primitives");
51 * jail_args(syscallarg(struct jail *) jail)
54 jail(struct jail_args *uap)
59 struct chroot_args ca;
60 struct thread *td = curthread;
61 struct proc *p = td->td_proc;
66 error = copyin(uap->jail, &j, sizeof j);
71 MALLOC(pr, struct prison *, sizeof *pr , M_PRISON, M_WAITOK);
72 bzero((caddr_t)pr, sizeof *pr);
73 error = copyinstr(j.hostname, &pr->pr_host, sizeof pr->pr_host, 0);
76 pr->pr_ip = j.ip_number;
85 p->p_ucred->cr_prison = pr;
86 p->p_flag |= P_JAILED;
95 prison_ip(struct thread *td, int flag, u_int32_t *ip)
100 if (td->td_proc == NULL)
102 if ((pr = td->td_proc->p_ucred->cr_prison) == NULL)
108 if (tmp == INADDR_ANY) {
112 *ip = htonl(pr->pr_ip);
115 if (tmp == INADDR_LOOPBACK) {
119 *ip = htonl(pr->pr_ip);
122 if (pr->pr_ip != tmp)
128 prison_remote_ip(struct thread *td, int flag, u_int32_t *ip)
133 if (td == NULL || td->td_proc == NULL)
135 if ((pr = td->td_proc->p_ucred->cr_prison) == NULL)
141 if (tmp == INADDR_LOOPBACK) {
145 *ip = htonl(pr->pr_ip);
151 prison_if(struct thread *td, struct sockaddr *sa)
154 struct sockaddr_in *sai = (struct sockaddr_in*) sa;
157 if (td->td_proc == NULL)
159 pr = td->td_proc->p_ucred->cr_prison;
161 if ((sai->sin_family != AF_INET) && jail_socket_unixiproute_only)
163 else if (sai->sin_family != AF_INET)
165 else if (pr->pr_ip != ntohl(sai->sin_addr.s_addr))