2 * ----------------------------------------------------------------------------
3 * "THE BEER-WARE LICENSE" (Revision 42):
4 * <phk@FreeBSD.ORG> wrote this file. As long as you retain this notice you
5 * can do whatever you want with this stuff. If we meet some day, and you think
6 * this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp
7 * ----------------------------------------------------------------------------
11 * Copyright (c) 2006 Victor Balada Diaz <victor@bsdes.net>
12 * All rights reserved.
14 * Redistribution and use in source and binary forms, with or without
15 * modification, are permitted provided that the following conditions
17 * 1. Redistributions of source code must retain the above copyright
18 * notice, this list of conditions and the following disclaimer.
19 * 2. Redistributions in binary form must reproduce the above copyright
20 * notice, this list of conditions and the following disclaimer in the
21 * documentation and/or other materials provided with the distribution.
23 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
38 * $FreeBSD: src/sys/kern/kern_jail.c,v 1.6.2.3 2001/08/17 01:00:26 rwatson Exp $
39 * $DragonFly: src/sys/kern/kern_jail.c,v 1.19 2008/05/17 18:20:33 dillon Exp $
42 #include "opt_inet6.h"
44 #include <sys/param.h>
45 #include <sys/types.h>
46 #include <sys/kernel.h>
47 #include <sys/systm.h>
48 #include <sys/errno.h>
49 #include <sys/sysproto.h>
50 #include <sys/malloc.h>
51 #include <sys/nlookup.h>
52 #include <sys/namecache.h>
56 #include <sys/socket.h>
57 #include <sys/sysctl.h>
58 #include <sys/kern_syscall.h>
60 #include <netinet/in.h>
61 #include <netinet6/in6_var.h>
63 #include <sys/mplock2.h>
65 static struct prison
*prison_find(int);
66 static void prison_ipcache_init(struct prison
*);
68 MALLOC_DEFINE(M_PRISON
, "prison", "Prison structures");
70 SYSCTL_NODE(, OID_AUTO
, jail
, CTLFLAG_RW
, 0,
73 int jail_set_hostname_allowed
= 1;
74 SYSCTL_INT(_jail
, OID_AUTO
, set_hostname_allowed
, CTLFLAG_RW
,
75 &jail_set_hostname_allowed
, 0,
76 "Processes in jail can set their hostnames");
78 int jail_socket_unixiproute_only
= 1;
79 SYSCTL_INT(_jail
, OID_AUTO
, socket_unixiproute_only
, CTLFLAG_RW
,
80 &jail_socket_unixiproute_only
, 0,
81 "Processes in jail are limited to creating UNIX/IPv[46]/route sockets only");
83 int jail_sysvipc_allowed
= 0;
84 SYSCTL_INT(_jail
, OID_AUTO
, sysvipc_allowed
, CTLFLAG_RW
,
85 &jail_sysvipc_allowed
, 0,
86 "Processes in jail can use System V IPC primitives");
88 int jail_chflags_allowed
= 0;
89 SYSCTL_INT(_jail
, OID_AUTO
, chflags_allowed
, CTLFLAG_RW
,
90 &jail_chflags_allowed
, 0,
91 "Process in jail can set chflags(1)");
93 int jail_allow_raw_sockets
= 0;
94 SYSCTL_INT(_jail
, OID_AUTO
, allow_raw_sockets
, CTLFLAG_RW
,
95 &jail_allow_raw_sockets
, 0,
96 "Process in jail can create raw sockets");
101 LIST_HEAD(prisonlist
, prison
);
102 struct prisonlist allprison
= LIST_HEAD_INITIALIZER(&allprison
);
105 kern_jail_attach(int jid
)
107 struct proc
*p
= curthread
->td_proc
;
111 pr
= prison_find(jid
);
115 error
= kern_chroot(&pr
->pr_root
);
121 p
->p_ucred
->cr_prison
= pr
;
122 p
->p_flag
|= P_JAILED
;
128 assign_prison_id(struct prison
*pr
)
133 tryprid
= lastprid
+ 1;
134 if (tryprid
== JAIL_MAX
)
137 LIST_FOREACH(tpr
, &allprison
, pr_list
) {
138 if (tpr
->pr_id
!= tryprid
)
141 if (tryprid
== JAIL_MAX
) {
146 pr
->pr_id
= lastprid
= tryprid
;
152 kern_jail(struct prison
*pr
, struct jail
*j
)
155 struct nlookupdata nd
;
157 error
= nlookup_init(&nd
, j
->path
, UIO_USERSPACE
, NLC_FOLLOW
);
162 error
= nlookup(&nd
);
167 cache_copy(&nd
.nl_nch
, &pr
->pr_root
);
169 varsymset_init(&pr
->pr_varsymset
, NULL
);
170 prison_ipcache_init(pr
);
172 error
= assign_prison_id(pr
);
174 varsymset_clean(&pr
->pr_varsymset
);
179 LIST_INSERT_HEAD(&allprison
, pr
, pr_list
);
182 error
= kern_jail_attach(pr
->pr_id
);
184 LIST_REMOVE(pr
, pr_list
);
186 varsymset_clean(&pr
->pr_varsymset
);
195 * jail_args(syscallarg(struct jail *) jail)
200 sys_jail(struct jail_args
*uap
)
202 struct thread
*td
= curthread
;
204 struct jail_ip_storage
*jip
;
209 uap
->sysmsg_result
= -1;
211 error
= priv_check(td
, PRIV_JAIL_CREATE
);
215 error
= copyin(uap
->jail
, &jversion
, sizeof(jversion
));
219 pr
= kmalloc(sizeof(*pr
), M_PRISON
, M_WAITOK
| M_ZERO
);
220 SLIST_INIT(&pr
->pr_ips
);
225 /* Single IPv4 jails. */
228 struct sockaddr_in ip4addr
;
230 error
= copyin(uap
->jail
, &jv0
, sizeof(jv0
));
235 j
.hostname
= jv0
.hostname
;
237 jip
= kmalloc(sizeof(*jip
), M_PRISON
, M_WAITOK
| M_ZERO
);
238 ip4addr
.sin_family
= AF_INET
;
239 ip4addr
.sin_addr
.s_addr
= htonl(jv0
.ip_number
);
240 memcpy(&jip
->ip
, &ip4addr
, sizeof(ip4addr
));
241 SLIST_INSERT_HEAD(&pr
->pr_ips
, jip
, entries
);
247 * DragonFly multi noIP/IPv4/IPv6 jails
249 * NOTE: This version is unsupported by FreeBSD
250 * (which uses version 2 instead).
253 error
= copyin(uap
->jail
, &j
, sizeof(j
));
257 for (int i
= 0; i
< j
.n_ips
; i
++) {
258 jip
= kmalloc(sizeof(*jip
), M_PRISON
,
260 SLIST_INSERT_HEAD(&pr
->pr_ips
, jip
, entries
);
261 error
= copyin(&j
.ips
[i
], &jip
->ip
,
262 sizeof(struct sockaddr_storage
));
272 error
= copyinstr(j
.hostname
, &pr
->pr_host
, sizeof(pr
->pr_host
), 0);
276 error
= kern_jail(pr
, &j
);
280 uap
->sysmsg_result
= pr
->pr_id
;
286 while (!SLIST_EMPTY(&pr
->pr_ips
)) {
287 jip
= SLIST_FIRST(&pr
->pr_ips
);
288 SLIST_REMOVE_HEAD(&pr
->pr_ips
, entries
);
289 kfree(jip
, M_PRISON
);
297 * int jail_attach(int jid);
302 sys_jail_attach(struct jail_attach_args
*uap
)
304 struct thread
*td
= curthread
;
307 error
= priv_check(td
, PRIV_JAIL_ATTACH
);
311 error
= kern_jail_attach(uap
->jid
);
317 prison_ipcache_init(struct prison
*pr
)
319 struct jail_ip_storage
*jis
;
320 struct sockaddr_in
*ip4
;
321 struct sockaddr_in6
*ip6
;
323 SLIST_FOREACH(jis
, &pr
->pr_ips
, entries
) {
324 switch (jis
->ip
.ss_family
) {
326 ip4
= (struct sockaddr_in
*)&jis
->ip
;
327 if ((ntohl(ip4
->sin_addr
.s_addr
) >> IN_CLASSA_NSHIFT
) ==
329 /* loopback address */
330 if (pr
->local_ip4
== NULL
)
334 if (pr
->nonlocal_ip4
== NULL
)
335 pr
->nonlocal_ip4
= ip4
;
340 ip6
= (struct sockaddr_in6
*)&jis
->ip
;
341 if (IN6_IS_ADDR_LOOPBACK(&ip6
->sin6_addr
)) {
342 /* loopback address */
343 if (pr
->local_ip6
== NULL
)
347 if (pr
->nonlocal_ip6
== NULL
)
348 pr
->nonlocal_ip6
= ip6
;
356 * Changes INADDR_LOOPBACK for a valid jail address.
357 * ip is in network byte order.
358 * Returns 1 if the ip is among jail valid ips.
359 * Returns 0 if is not among jail valid ips or
360 * if couldn't replace INADDR_LOOPBACK for a valid
364 prison_replace_wildcards(struct thread
*td
, struct sockaddr
*ip
)
366 struct sockaddr_in
*ip4
= (struct sockaddr_in
*)ip
;
367 struct sockaddr_in6
*ip6
= (struct sockaddr_in6
*)ip
;
370 if (td
->td_proc
== NULL
|| td
->td_ucred
== NULL
)
372 if ((pr
= td
->td_ucred
->cr_prison
) == NULL
)
375 if ((ip
->sa_family
== AF_INET
&&
376 ip4
->sin_addr
.s_addr
== htonl(INADDR_ANY
)) ||
377 (ip
->sa_family
== AF_INET6
&&
378 IN6_IS_ADDR_UNSPECIFIED(&ip6
->sin6_addr
)))
380 if ((ip
->sa_family
== AF_INET
&&
381 ip4
->sin_addr
.s_addr
== htonl(INADDR_LOOPBACK
)) ||
382 (ip
->sa_family
== AF_INET6
&&
383 IN6_IS_ADDR_LOOPBACK(&ip6
->sin6_addr
))) {
384 if (!prison_get_local(pr
, ip
->sa_family
, ip
) &&
385 !prison_get_nonlocal(pr
, ip
->sa_family
, ip
))
390 if (jailed_ip(pr
, ip
))
396 prison_remote_ip(struct thread
*td
, struct sockaddr
*ip
)
398 struct sockaddr_in
*ip4
= (struct sockaddr_in
*)ip
;
399 struct sockaddr_in6
*ip6
= (struct sockaddr_in6
*)ip
;
402 if (td
== NULL
|| td
->td_proc
== NULL
|| td
->td_ucred
== NULL
)
404 if ((pr
= td
->td_ucred
->cr_prison
) == NULL
)
406 if ((ip
->sa_family
== AF_INET
&&
407 ip4
->sin_addr
.s_addr
== htonl(INADDR_LOOPBACK
)) ||
408 (ip
->sa_family
== AF_INET6
&&
409 IN6_IS_ADDR_LOOPBACK(&ip6
->sin6_addr
))) {
410 if (!prison_get_local(pr
, ip
->sa_family
, ip
) &&
411 !prison_get_nonlocal(pr
, ip
->sa_family
, ip
))
420 * Prison get non loopback ip:
421 * - af is the address family of the ip we want (AF_INET|AF_INET6).
422 * - If ip != NULL, put the first IP address that is not a loopback address
425 * ip is in network by order and we don't touch it unless we find a valid ip.
426 * No matter if ip == NULL or not, we return either a valid struct sockaddr *,
427 * or NULL. This struct may not be modified.
430 prison_get_nonlocal(struct prison
*pr
, sa_family_t af
, struct sockaddr
*ip
)
432 struct sockaddr_in
*ip4
= (struct sockaddr_in
*)ip
;
433 struct sockaddr_in6
*ip6
= (struct sockaddr_in6
*)ip
;
435 /* Check if it is cached */
438 if (ip4
!= NULL
&& pr
->nonlocal_ip4
!= NULL
)
439 ip4
->sin_addr
.s_addr
= pr
->nonlocal_ip4
->sin_addr
.s_addr
;
440 return (struct sockaddr
*)pr
->nonlocal_ip4
;
443 if (ip6
!= NULL
&& pr
->nonlocal_ip6
!= NULL
)
444 ip6
->sin6_addr
= pr
->nonlocal_ip6
->sin6_addr
;
445 return (struct sockaddr
*)pr
->nonlocal_ip6
;
453 * Prison get loopback ip.
454 * - af is the address family of the ip we want (AF_INET|AF_INET6).
455 * - If ip != NULL, put the first IP address that is not a loopback address
458 * ip is in network by order and we don't touch it unless we find a valid ip.
459 * No matter if ip == NULL or not, we return either a valid struct sockaddr *,
460 * or NULL. This struct may not be modified.
463 prison_get_local(struct prison
*pr
, sa_family_t af
, struct sockaddr
*ip
)
465 struct sockaddr_in
*ip4
= (struct sockaddr_in
*)ip
;
466 struct sockaddr_in6
*ip6
= (struct sockaddr_in6
*)ip
;
468 /* Check if it is cached */
471 if (ip4
!= NULL
&& pr
->local_ip4
!= NULL
)
472 ip4
->sin_addr
.s_addr
= pr
->local_ip4
->sin_addr
.s_addr
;
473 return (struct sockaddr
*)pr
->local_ip4
;
476 if (ip6
!= NULL
&& pr
->local_ip6
!= NULL
)
477 ip6
->sin6_addr
= pr
->local_ip6
->sin6_addr
;
478 return (struct sockaddr
*)pr
->local_ip6
;
485 /* Check if the IP is among ours, if it is return 1, else 0 */
487 jailed_ip(struct prison
*pr
, struct sockaddr
*ip
)
489 struct jail_ip_storage
*jis
;
490 struct sockaddr_in
*jip4
, *ip4
;
491 struct sockaddr_in6
*jip6
, *ip6
;
495 ip4
= (struct sockaddr_in
*)ip
;
496 ip6
= (struct sockaddr_in6
*)ip
;
497 SLIST_FOREACH(jis
, &pr
->pr_ips
, entries
) {
498 switch (ip
->sa_family
) {
500 jip4
= (struct sockaddr_in
*) &jis
->ip
;
501 if (jip4
->sin_family
== AF_INET
&&
502 ip4
->sin_addr
.s_addr
== jip4
->sin_addr
.s_addr
)
506 jip6
= (struct sockaddr_in6
*) &jis
->ip
;
507 if (jip6
->sin6_family
== AF_INET6
&&
508 IN6_ARE_ADDR_EQUAL(&ip6
->sin6_addr
,
519 prison_if(struct ucred
*cred
, struct sockaddr
*sa
)
522 struct sockaddr_in
*sai
= (struct sockaddr_in
*) sa
;
524 pr
= cred
->cr_prison
;
526 if (((sai
->sin_family
!= AF_INET
) && (sai
->sin_family
!= AF_INET6
))
527 && jail_socket_unixiproute_only
)
529 else if ((sai
->sin_family
!= AF_INET
) && (sai
->sin_family
!= AF_INET6
))
531 else if (jailed_ip(pr
, sa
))
537 * Returns a prison instance, or NULL on failure.
539 static struct prison
*
540 prison_find(int prid
)
544 LIST_FOREACH(pr
, &allprison
, pr_list
) {
545 if (pr
->pr_id
== prid
)
552 sysctl_jail_list(SYSCTL_HANDLER_ARGS
)
554 struct thread
*td
= curthread
;
555 struct jail_ip_storage
*jip
;
557 struct sockaddr_in6
*jsin6
;
559 struct sockaddr_in
*jsin
;
562 unsigned int jlssize
, jlsused
;
564 char *jls
; /* Jail list */
565 char *oip
; /* Output ip */
566 char *fullpath
, *freepath
;
570 if (jailed(td
->td_ucred
))
579 jlssize
= (count
* 1024);
580 jls
= kmalloc(jlssize
+ 1, M_TEMP
, M_WAITOK
| M_ZERO
);
581 if (count
< prisoncount
) {
587 LIST_FOREACH(pr
, &allprison
, pr_list
) {
588 error
= cache_fullpath(lp
->lwp_proc
, &pr
->pr_root
,
589 &fullpath
, &freepath
, 0);
592 if (jlsused
&& jlsused
< jlssize
)
593 jls
[jlsused
++] = '\n';
594 count
= ksnprintf(jls
+ jlsused
, (jlssize
- jlsused
),
596 pr
->pr_id
, pr
->pr_host
, fullpath
);
597 kfree(freepath
, M_TEMP
);
603 SLIST_FOREACH(jip
, &pr
->pr_ips
, entries
) {
604 jsin
= (struct sockaddr_in
*)&jip
->ip
;
606 switch(jsin
->sin_family
) {
608 oip
= inet_ntoa(jsin
->sin_addr
);
612 jsin6
= (struct sockaddr_in6
*)&jip
->ip
;
613 oip
= ip6_sprintf(&jsin6
->sin6_addr
);
621 if ((jlssize
- jlsused
) < (strlen(oip
) + 1)) {
625 count
= ksnprintf(jls
+ jlsused
, (jlssize
- jlsused
),
635 * pr_id <SPC> hostname1 <SPC> PATH1 <SPC> IP1 <SPC> IP2\npr_id...
637 error
= SYSCTL_OUT(req
, jls
, jlsused
);
643 SYSCTL_OID(_jail
, OID_AUTO
, list
, CTLTYPE_STRING
| CTLFLAG_RD
, NULL
, 0,
644 sysctl_jail_list
, "A", "List of active jails");
650 prison_hold(struct prison
*pr
)
652 atomic_add_int(&pr
->pr_ref
, 1);
659 prison_free(struct prison
*pr
)
661 struct jail_ip_storage
*jls
;
663 KKASSERT(pr
->pr_ref
> 0);
664 if (atomic_fetchadd_int(&pr
->pr_ref
, -1) != 1)
668 * The MP lock is needed on the last ref to adjust
676 LIST_REMOVE(pr
, pr_list
);
683 while (!SLIST_EMPTY(&pr
->pr_ips
)) {
684 jls
= SLIST_FIRST(&pr
->pr_ips
);
685 SLIST_REMOVE_HEAD(&pr
->pr_ips
, entries
);
686 kfree(jls
, M_PRISON
);
689 if (pr
->pr_linux
!= NULL
)
690 kfree(pr
->pr_linux
, M_PRISON
);
691 varsymset_clean(&pr
->pr_varsymset
);
692 cache_drop(&pr
->pr_root
);
697 * Check if permisson for a specific privilege is granted within jail.
702 prison_priv_check(struct ucred
*cred
, int priv
)
708 case PRIV_CRED_SETUID
:
709 case PRIV_CRED_SETEUID
:
710 case PRIV_CRED_SETGID
:
711 case PRIV_CRED_SETEGID
:
712 case PRIV_CRED_SETGROUPS
:
713 case PRIV_CRED_SETREUID
:
714 case PRIV_CRED_SETREGID
:
715 case PRIV_CRED_SETRESUID
:
716 case PRIV_CRED_SETRESGID
:
718 case PRIV_VFS_SYSFLAGS
:
721 case PRIV_VFS_CHROOT
:
723 case PRIV_VFS_CHFLAGS_DEV
:
724 case PRIV_VFS_REVOKE
:
725 case PRIV_VFS_MKNOD_BAD
:
726 case PRIV_VFS_MKNOD_WHT
:
727 case PRIV_VFS_MKNOD_DIR
:
728 case PRIV_VFS_SETATTR
:
729 case PRIV_VFS_SETGID
:
731 case PRIV_PROC_SETRLIMIT
:
732 case PRIV_PROC_SETLOGIN
:
734 case PRIV_SYSCTL_WRITEJAIL
:
736 case PRIV_VARSYM_SYS
:
738 case PRIV_SETHOSTNAME
:
740 case PRIV_PROC_TRESPASS
:
744 case PRIV_UFS_QUOTAON
:
745 case PRIV_UFS_QUOTAOFF
:
746 case PRIV_VFS_SETQUOTA
:
747 case PRIV_UFS_SETUSE
:
748 case PRIV_VFS_GETQUOTA
:
752 case PRIV_DEBUG_UNPRIV
:
757 * Allow jailed root to bind reserved ports.
759 case PRIV_NETINET_RESERVEDPORT
:
764 * Conditionally allow creating raw sockets in jail.
766 case PRIV_NETINET_RAW
:
767 if (jail_allow_raw_sockets
)
772 case PRIV_HAMMER_IOCTL
: