sys/kern/kern_jail.c

   1 /*
   2  * ----------------------------------------------------------------------------
   3  * "THE BEER-WARE LICENSE" (Revision 42):
   4  * <phk@FreeBSD.ORG> wrote this file.  As long as you retain this notice you
   5  * can do whatever you want with this stuff. If we meet some day, and you think
   6  * this stuff is worth it, you can buy me a beer in return.   Poul-Henning Kamp
   7  * ----------------------------------------------------------------------------
   8  *
   9  */
  10 /*-
  11  * Copyright (c) 2006 Victor Balada Diaz <victor@bsdes.net>
  12  * All rights reserved.
  13  *
  14  * Redistribution and use in source and binary forms, with or without
  15  * modification, are permitted provided that the following conditions
  16  * are met:
  17  * 1. Redistributions of source code must retain the above copyright
  18  *    notice, this list of conditions and the following disclaimer.
  19  * 2. Redistributions in binary form must reproduce the above copyright
  20  *    notice, this list of conditions and the following disclaimer in the
  21  *    documentation and/or other materials provided with the distribution.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36
  37 /*
  38  * $FreeBSD: src/sys/kern/kern_jail.c,v 1.6.2.3 2001/08/17 01:00:26 rwatson Exp $
  39  * $DragonFly: src/sys/kern/kern_jail.c,v 1.19 2008/05/17 18:20:33 dillon Exp $
  40  */
  41
  42 #include "opt_inet6.h"
  43
  44 #include <sys/param.h>
  45 #include <sys/types.h>
  46 #include <sys/kernel.h>
  47 #include <sys/systm.h>
  48 #include <sys/errno.h>
  49 #include <sys/sysproto.h>
  50 #include <sys/malloc.h>
  51 #include <sys/nlookup.h>
  52 #include <sys/namecache.h>
  53 #include <sys/proc.h>
  54 #include <sys/priv.h>
  55 #include <sys/jail.h>
  56 #include <sys/socket.h>
  57 #include <sys/sysctl.h>
  58 #include <sys/kern_syscall.h>
  59 #include <net/if.h>
  60 #include <netinet/in.h>
  61 #include <netinet6/in6_var.h>
  62
  63 static struct prison    *prison_find(int);
  64 static void             prison_ipcache_init(struct prison *);
  65
  66 MALLOC_DEFINE(M_PRISON, "prison", "Prison structures");
  67
  68 SYSCTL_NODE(, OID_AUTO, jail, CTLFLAG_RW, 0,
  69     "Jail rules");
  70
  71 int     jail_set_hostname_allowed = 1;
  72 SYSCTL_INT(_jail, OID_AUTO, set_hostname_allowed, CTLFLAG_RW,
  73     &jail_set_hostname_allowed, 0,
  74     "Processes in jail can set their hostnames");
  75
  76 int     jail_socket_unixiproute_only = 1;
  77 SYSCTL_INT(_jail, OID_AUTO, socket_unixiproute_only, CTLFLAG_RW,
  78     &jail_socket_unixiproute_only, 0,
  79     "Processes in jail are limited to creating UNIX/IPv[46]/route sockets only");
  80
  81 int     jail_sysvipc_allowed = 0;
  82 SYSCTL_INT(_jail, OID_AUTO, sysvipc_allowed, CTLFLAG_RW,
  83     &jail_sysvipc_allowed, 0,
  84     "Processes in jail can use System V IPC primitives");
  85
  86 int    jail_chflags_allowed = 0;
  87 SYSCTL_INT(_jail, OID_AUTO, chflags_allowed, CTLFLAG_RW,
  88     &jail_chflags_allowed, 0,
  89     "Process in jail can set chflags(1)");
  90
  91 int    jail_allow_raw_sockets = 0;
  92 SYSCTL_INT(_jail, OID_AUTO, allow_raw_sockets, CTLFLAG_RW,
  93     &jail_allow_raw_sockets, 0,
  94     "Process in jail can create raw sockets");
  95
  96 int     lastprid = 0;
  97 int     prisoncount = 0;
  98
  99 LIST_HEAD(prisonlist, prison);
 100 struct  prisonlist allprison = LIST_HEAD_INITIALIZER(&allprison);
 101
 102 static int
 103 kern_jail_attach(int jid)
 104 {
 105         struct proc *p = curthread->td_proc;
 106         struct prison *pr;
 107         int error;
 108
 109         pr = prison_find(jid);
 110         if (pr == NULL)
 111                 return(EINVAL);
 112
 113         error = kern_chroot(&pr->pr_root);
 114         if (error)
 115                 return(error);
 116
 117         prison_hold(pr);
 118         cratom(&p->p_ucred);
 119         p->p_ucred->cr_prison = pr;
 120         p->p_flag |= P_JAILED;
 121
 122         return(0);
 123 }
 124
 125 static int
 126 assign_prison_id(struct prison *pr)
 127 {
 128         int tryprid;
 129         struct prison *tpr;
 130
 131         tryprid = lastprid + 1;
 132         if (tryprid == JAIL_MAX)
 133                 tryprid = 1;
 134 next:
 135         LIST_FOREACH(tpr, &allprison, pr_list) {
 136                 if (tpr->pr_id != tryprid)
 137                         continue;
 138                 tryprid++;
 139                 if (tryprid == JAIL_MAX) {
 140                         return (ERANGE);
 141                 }
 142                 goto next;
 143         }
 144         pr->pr_id = lastprid = tryprid;
 145
 146         return (0);
 147 }
 148
 149 static int
 150 kern_jail(struct prison *pr, struct jail *j)
 151 {
 152         int error;
 153         struct nlookupdata nd;
 154
 155         error = nlookup_init(&nd, j->path, UIO_USERSPACE, NLC_FOLLOW);
 156         if (error) {
 157                 nlookup_done(&nd);
 158                 return (error);
 159         }
 160         error = nlookup(&nd);
 161         if (error) {
 162                 nlookup_done(&nd);
 163                 return (error);
 164         }
 165         cache_copy(&nd.nl_nch, &pr->pr_root);
 166
 167         varsymset_init(&pr->pr_varsymset, NULL);
 168         prison_ipcache_init(pr);
 169
 170         error = assign_prison_id(pr);
 171         if (error) {
 172                 varsymset_clean(&pr->pr_varsymset);
 173                 nlookup_done(&nd);
 174                 return (error);
 175         }
 176
 177         LIST_INSERT_HEAD(&allprison, pr, pr_list);
 178         prisoncount++;
 179
 180         error = kern_jail_attach(pr->pr_id);
 181         if (error) {
 182                 LIST_REMOVE(pr, pr_list);
 183                 varsymset_clean(&pr->pr_varsymset);
 184         }
 185         nlookup_done(&nd);
 186         return (error);
 187 }
 188
 189 /*
 190  * jail()
 191  *
 192  * jail_args(syscallarg(struct jail *) jail)
 193  */
 194 int
 195 sys_jail(struct jail_args *uap)
 196 {
 197         struct thread *td = curthread;
 198         struct prison *pr;
 199         struct jail_ip_storage *jip;
 200         struct jail j;
 201         int error;
 202         uint32_t jversion;
 203
 204         uap->sysmsg_result = -1;
 205
 206         error = priv_check(td, PRIV_JAIL_CREATE);
 207         if (error)
 208                 return (error);
 209
 210         error = copyin(uap->jail, &jversion, sizeof(jversion));
 211         if (error)
 212                 return (error);
 213
 214         pr = kmalloc(sizeof(*pr), M_PRISON, M_WAITOK | M_ZERO);
 215         SLIST_INIT(&pr->pr_ips);
 216
 217         switch (jversion) {
 218         case 0:
 219                 /* Single IPv4 jails. */
 220                 {
 221                 struct jail_v0 jv0;
 222                 struct sockaddr_in ip4addr;
 223
 224                 error = copyin(uap->jail, &jv0, sizeof(jv0));
 225                 if (error)
 226                         goto out;
 227
 228                 j.path = jv0.path;
 229                 j.hostname = jv0.hostname;
 230
 231                 jip = kmalloc(sizeof(*jip),  M_PRISON, M_WAITOK | M_ZERO);
 232                 ip4addr.sin_family = AF_INET;
 233                 ip4addr.sin_addr.s_addr = htonl(jv0.ip_number);
 234                 memcpy(&jip->ip, &ip4addr, sizeof(ip4addr));
 235                 SLIST_INSERT_HEAD(&pr->pr_ips, jip, entries);
 236                 break;
 237                 }
 238
 239         case 1:
 240                 /*
 241                  * DragonFly multi noIP/IPv4/IPv6 jails
 242                  *
 243                  * NOTE: This version is unsupported by FreeBSD
 244                  * (which uses version 2 instead).
 245                  */
 246
 247                 error = copyin(uap->jail, &j, sizeof(j));
 248                 if (error)
 249                         goto out;
 250
 251                 for (int i = 0; i < j.n_ips; i++) {
 252                         jip = kmalloc(sizeof(*jip), M_PRISON,
 253                                       M_WAITOK | M_ZERO);
 254                         SLIST_INSERT_HEAD(&pr->pr_ips, jip, entries);
 255                         error = copyin(&j.ips[i], &jip->ip,
 256                                         sizeof(struct sockaddr_storage));
 257                         if (error)
 258                                 goto out;
 259                 }
 260                 break;
 261         default:
 262                 error = EINVAL;
 263                 goto out;
 264         }
 265
 266         error = copyinstr(j.hostname, &pr->pr_host, sizeof(pr->pr_host), 0);
 267         if (error)
 268                 goto out;
 269
 270         error = kern_jail(pr, &j);
 271         if (error)
 272                 goto out;
 273
 274         uap->sysmsg_result = pr->pr_id;
 275         return (0);
 276
 277 out:
 278         /* Delete all ips */
 279         while (!SLIST_EMPTY(&pr->pr_ips)) {
 280                 jip = SLIST_FIRST(&pr->pr_ips);
 281                 SLIST_REMOVE_HEAD(&pr->pr_ips, entries);
 282                 kfree(jip, M_PRISON);
 283         }
 284         kfree(pr, M_PRISON);
 285         return (error);
 286 }
 287
 288 /*
 289  * int jail_attach(int jid);
 290  */
 291 int
 292 sys_jail_attach(struct jail_attach_args *uap)
 293 {
 294         struct thread *td = curthread;
 295         int error;
 296
 297         error = priv_check(td, PRIV_JAIL_ATTACH);
 298         if (error)
 299                 return(error);
 300
 301         return(kern_jail_attach(uap->jid));
 302 }
 303
 304 static void
 305 prison_ipcache_init(struct prison *pr)
 306 {
 307         struct jail_ip_storage *jis;
 308         struct sockaddr_in *ip4;
 309         struct sockaddr_in6 *ip6;
 310
 311         SLIST_FOREACH(jis, &pr->pr_ips, entries) {
 312                 switch (jis->ip.ss_family) {
 313                 case AF_INET:
 314                         ip4 = (struct sockaddr_in *)&jis->ip;
 315                         if ((ntohl(ip4->sin_addr.s_addr) >> IN_CLASSA_NSHIFT) ==
 316                             IN_LOOPBACKNET) {
 317                                 /* loopback address */
 318                                 if (pr->local_ip4 == NULL)
 319                                         pr->local_ip4 = ip4;
 320                         } else {
 321                                 /* public address */
 322                                 if (pr->nonlocal_ip4 == NULL)
 323                                         pr->nonlocal_ip4 = ip4;
 324                         }
 325                         break;
 326
 327                 case AF_INET6:
 328                         ip6 = (struct sockaddr_in6 *)&jis->ip;
 329                         if (IN6_IS_ADDR_LOOPBACK(&ip6->sin6_addr)) {
 330                                 /* loopback address */
 331                                 if (pr->local_ip6 == NULL)
 332                                         pr->local_ip6 = ip6;
 333                         } else {
 334                                 /* public address */
 335                                 if (pr->nonlocal_ip6 == NULL)
 336                                         pr->nonlocal_ip6 = ip6;
 337                         }
 338                         break;
 339                 }
 340         }
 341 }
 342
 343 /*
 344  * Changes INADDR_LOOPBACK for a valid jail address.
 345  * ip is in network byte order.
 346  * Returns 1 if the ip is among jail valid ips.
 347  * Returns 0 if is not among jail valid ips or
 348  * if couldn't replace INADDR_LOOPBACK for a valid
 349  * IP.
 350  */
 351 int
 352 prison_replace_wildcards(struct thread *td, struct sockaddr *ip)
 353 {
 354         struct sockaddr_in *ip4 = (struct sockaddr_in *)ip;
 355         struct sockaddr_in6 *ip6 = (struct sockaddr_in6 *)ip;
 356         struct prison *pr;
 357
 358         if (td->td_proc == NULL)
 359                 return (1);
 360         if ((pr = td->td_proc->p_ucred->cr_prison) == NULL)
 361                 return (1);
 362
 363         if ((ip->sa_family == AF_INET &&
 364             ip4->sin_addr.s_addr == htonl(INADDR_ANY)) ||
 365             (ip->sa_family == AF_INET6 &&
 366             IN6_IS_ADDR_UNSPECIFIED(&ip6->sin6_addr)))
 367                 return (1);
 368         if ((ip->sa_family == AF_INET &&
 369             ip4->sin_addr.s_addr == htonl(INADDR_LOOPBACK)) ||
 370             (ip->sa_family == AF_INET6 &&
 371             IN6_IS_ADDR_LOOPBACK(&ip6->sin6_addr))) {
 372                 if (!prison_get_local(pr, ip->sa_family, ip) &&
 373                     !prison_get_nonlocal(pr, ip->sa_family, ip))
 374                         return(0);
 375                 else
 376                         return(1);
 377         }
 378         if (jailed_ip(pr, ip))
 379                 return(1);
 380         return(0);
 381 }
 382
 383 int
 384 prison_remote_ip(struct thread *td, struct sockaddr *ip)
 385 {
 386         struct sockaddr_in *ip4 = (struct sockaddr_in *)ip;
 387         struct sockaddr_in6 *ip6 = (struct sockaddr_in6 *)ip;
 388         struct prison *pr;
 389
 390         if (td == NULL || td->td_proc == NULL)
 391                 return(1);
 392         if ((pr = td->td_proc->p_ucred->cr_prison) == NULL)
 393                 return(1);
 394         if ((ip->sa_family == AF_INET &&
 395             ip4->sin_addr.s_addr == htonl(INADDR_LOOPBACK)) ||
 396             (ip->sa_family == AF_INET6 &&
 397             IN6_IS_ADDR_LOOPBACK(&ip6->sin6_addr))) {
 398                 if (!prison_get_local(pr, ip->sa_family, ip) &&
 399                     !prison_get_nonlocal(pr, ip->sa_family, ip))
 400                         return(0);
 401                 else
 402                         return(1);
 403         }
 404         return(1);
 405 }
 406
 407 /*
 408  * Prison get non loopback ip:
 409  * - af is the address family of the ip we want (AF_INET|AF_INET6).
 410  * - If ip != NULL, put the first IP address that is not a loopback address
 411  *   into *ip.
 412  *
 413  * ip is in network by order and we don't touch it unless we find a valid ip.
 414  * No matter if ip == NULL or not, we return either a valid struct sockaddr *,
 415  * or NULL.  This struct may not be modified.
 416  */
 417 struct sockaddr *
 418 prison_get_nonlocal(struct prison *pr, sa_family_t af, struct sockaddr *ip)
 419 {
 420         struct sockaddr_in *ip4 = (struct sockaddr_in *)ip;
 421         struct sockaddr_in6 *ip6 = (struct sockaddr_in6 *)ip;
 422
 423         /* Check if it is cached */
 424         switch(af) {
 425         case AF_INET:
 426                 if (ip4 != NULL && pr->nonlocal_ip4 != NULL)
 427                         ip4->sin_addr.s_addr = pr->nonlocal_ip4->sin_addr.s_addr;
 428                 return (struct sockaddr *)pr->nonlocal_ip4;
 429
 430         case AF_INET6:
 431                 if (ip6 != NULL && pr->nonlocal_ip6 != NULL)
 432                         ip6->sin6_addr = pr->nonlocal_ip6->sin6_addr;
 433                 return (struct sockaddr *)pr->nonlocal_ip6;
 434         }
 435
 436         /* NOTREACHED */
 437         return NULL;
 438 }
 439
 440 /*
 441  * Prison get loopback ip.
 442  * - af is the address family of the ip we want (AF_INET|AF_INET6).
 443  * - If ip != NULL, put the first IP address that is not a loopback address
 444  *   into *ip.
 445  *
 446  * ip is in network by order and we don't touch it unless we find a valid ip.
 447  * No matter if ip == NULL or not, we return either a valid struct sockaddr *,
 448  * or NULL.  This struct may not be modified.
 449  */
 450 struct sockaddr *
 451 prison_get_local(struct prison *pr, sa_family_t af, struct sockaddr *ip)
 452 {
 453         struct sockaddr_in *ip4 = (struct sockaddr_in *)ip;
 454         struct sockaddr_in6 *ip6 = (struct sockaddr_in6 *)ip;
 455
 456         /* Check if it is cached */
 457         switch(af) {
 458         case AF_INET:
 459                 if (ip4 != NULL && pr->local_ip4 != NULL)
 460                         ip4->sin_addr.s_addr = pr->local_ip4->sin_addr.s_addr;
 461                 return (struct sockaddr *)pr->local_ip4;
 462
 463         case AF_INET6:
 464                 if (ip6 != NULL && pr->local_ip6 != NULL)
 465                         ip6->sin6_addr = pr->local_ip6->sin6_addr;
 466                 return (struct sockaddr *)pr->local_ip6;
 467         }
 468
 469         /* NOTREACHED */
 470         return NULL;
 471 }
 472
 473 /* Check if the IP is among ours, if it is return 1, else 0 */
 474 int
 475 jailed_ip(struct prison *pr, struct sockaddr *ip)
 476 {
 477         struct jail_ip_storage *jis;
 478         struct sockaddr_in *jip4, *ip4;
 479         struct sockaddr_in6 *jip6, *ip6;
 480
 481         if (pr == NULL)
 482                 return(0);
 483         ip4 = (struct sockaddr_in *)ip;
 484         ip6 = (struct sockaddr_in6 *)ip;
 485         SLIST_FOREACH(jis, &pr->pr_ips, entries) {
 486                 switch (ip->sa_family) {
 487                 case AF_INET:
 488                         jip4 = (struct sockaddr_in *) &jis->ip;
 489                         if (jip4->sin_family == AF_INET &&
 490                             ip4->sin_addr.s_addr == jip4->sin_addr.s_addr)
 491                                 return(1);
 492                         break;
 493                 case AF_INET6:
 494                         jip6 = (struct sockaddr_in6 *) &jis->ip;
 495                         if (jip6->sin6_family == AF_INET6 &&
 496                             IN6_ARE_ADDR_EQUAL(&ip6->sin6_addr,
 497                                                &jip6->sin6_addr))
 498                                 return(1);
 499                         break;
 500                 }
 501         }
 502         /* Ip not in list */
 503         return(0);
 504 }
 505
 506 int
 507 prison_if(struct ucred *cred, struct sockaddr *sa)
 508 {
 509         struct prison *pr;
 510         struct sockaddr_in *sai = (struct sockaddr_in*) sa;
 511
 512         pr = cred->cr_prison;
 513
 514         if (((sai->sin_family != AF_INET) && (sai->sin_family != AF_INET6))
 515             && jail_socket_unixiproute_only)
 516                 return(1);
 517         else if ((sai->sin_family != AF_INET) && (sai->sin_family != AF_INET6))
 518                 return(0);
 519         else if (jailed_ip(pr, sa))
 520                 return(0);
 521         return(1);
 522 }
 523
 524 /*
 525  * Returns a prison instance, or NULL on failure.
 526  */
 527 static struct prison *
 528 prison_find(int prid)
 529 {
 530         struct prison *pr;
 531
 532         LIST_FOREACH(pr, &allprison, pr_list) {
 533                 if (pr->pr_id == prid)
 534                         break;
 535         }
 536         return(pr);
 537 }
 538
 539 static int
 540 sysctl_jail_list(SYSCTL_HANDLER_ARGS)
 541 {
 542         struct jail_ip_storage *jip;
 543 #ifdef INET6
 544         struct sockaddr_in6 *jsin6;
 545 #endif
 546         struct sockaddr_in *jsin;
 547         struct proc *p;
 548         struct prison *pr;
 549         unsigned int jlssize, jlsused;
 550         int count, error;
 551         char *jls; /* Jail list */
 552         char *oip; /* Output ip */
 553         char *fullpath, *freepath;
 554
 555         jlsused = 0;
 556         p = curthread->td_proc;
 557
 558         if (jailed(p->p_ucred))
 559                 return (0);
 560 retry:
 561         count = prisoncount;
 562
 563         if (count == 0)
 564                 return(0);
 565
 566         jlssize = (count * 1024);
 567         jls = kmalloc(jlssize + 1, M_TEMP, M_WAITOK | M_ZERO);
 568         if (count < prisoncount) {
 569                 kfree(jls, M_TEMP);
 570                 goto retry;
 571         }
 572         count = prisoncount;
 573
 574         LIST_FOREACH(pr, &allprison, pr_list) {
 575                 error = cache_fullpath(p, &pr->pr_root, &fullpath, &freepath);
 576                 if (error)
 577                         continue;
 578                 if (jlsused && jlsused < jlssize)
 579                         jls[jlsused++] = '\n';
 580                 count = ksnprintf(jls + jlsused, (jlssize - jlsused),
 581                                  "%d %s %s",
 582                                  pr->pr_id, pr->pr_host, fullpath);
 583                 kfree(freepath, M_TEMP);
 584                 if (count < 0)
 585                         goto end;
 586                 jlsused += count;
 587
 588                 /* Copy the IPS */
 589                 SLIST_FOREACH(jip, &pr->pr_ips, entries) {
 590                         jsin = (struct sockaddr_in *)&jip->ip;
 591
 592                         switch(jsin->sin_family) {
 593                         case AF_INET:
 594                                 oip = inet_ntoa(jsin->sin_addr);
 595                                 break;
 596 #ifdef INET6
 597                         case AF_INET6:
 598                                 jsin6 = (struct sockaddr_in6 *)&jip->ip;
 599                                 oip = ip6_sprintf(&jsin6->sin6_addr);
 600                                 break;
 601 #endif
 602                         default:
 603                                 oip = "?family?";
 604                                 break;
 605                         }
 606
 607                         if ((jlssize - jlsused) < (strlen(oip) + 1)) {
 608                                 error = ERANGE;
 609                                 goto end;
 610                         }
 611                         count = ksnprintf(jls + jlsused, (jlssize - jlsused),
 612                                           " %s", oip);
 613                         if (count < 0)
 614                                 goto end;
 615                         jlsused += count;
 616                 }
 617         }
 618
 619         /*
 620          * The format is:
 621          * pr_id <SPC> hostname1 <SPC> PATH1 <SPC> IP1 <SPC> IP2\npr_id...
 622          */
 623         error = SYSCTL_OUT(req, jls, jlsused);
 624 end:
 625         kfree(jls, M_TEMP);
 626         return(error);
 627 }
 628
 629 SYSCTL_OID(_jail, OID_AUTO, list, CTLTYPE_STRING | CTLFLAG_RD, NULL, 0,
 630            sysctl_jail_list, "A", "List of active jails");
 631
 632 void
 633 prison_hold(struct prison *pr)
 634 {
 635         pr->pr_ref++;
 636 }
 637
 638 void
 639 prison_free(struct prison *pr)
 640 {
 641         struct jail_ip_storage *jls;
 642         KKASSERT(pr->pr_ref >= 1);
 643
 644         if (--pr->pr_ref > 0)
 645                 return;
 646
 647         /* Delete all ips */
 648         while (!SLIST_EMPTY(&pr->pr_ips)) {
 649                 jls = SLIST_FIRST(&pr->pr_ips);
 650                 SLIST_REMOVE_HEAD(&pr->pr_ips, entries);
 651                 kfree(jls, M_PRISON);
 652         }
 653         LIST_REMOVE(pr, pr_list);
 654         prisoncount--;
 655
 656         if (pr->pr_linux != NULL)
 657                 kfree(pr->pr_linux, M_PRISON);
 658         varsymset_clean(&pr->pr_varsymset);
 659         cache_drop(&pr->pr_root);
 660         kfree(pr, M_PRISON);
 661 }
 662
 663 /*
 664  * Check if permisson for a specific privilege is granted within jail.
 665  */
 666 int
 667 prison_priv_check(struct ucred *cred, int priv)
 668 {
 669         if (!jailed(cred))
 670                 return (0);
 671
 672         switch (priv) {
 673         case PRIV_CRED_SETUID:
 674         case PRIV_CRED_SETEUID:
 675         case PRIV_CRED_SETGID:
 676         case PRIV_CRED_SETEGID:
 677         case PRIV_CRED_SETGROUPS:
 678         case PRIV_CRED_SETREUID:
 679         case PRIV_CRED_SETREGID:
 680         case PRIV_CRED_SETRESUID:
 681         case PRIV_CRED_SETRESGID:
 682
 683         case PRIV_VFS_SYSFLAGS:
 684         case PRIV_VFS_CHOWN:
 685         case PRIV_VFS_CHMOD:
 686         case PRIV_VFS_CHROOT:
 687         case PRIV_VFS_LINK:
 688         case PRIV_VFS_CHFLAGS_DEV:
 689         case PRIV_VFS_REVOKE:
 690         case PRIV_VFS_MKNOD_BAD:
 691         case PRIV_VFS_MKNOD_WHT:
 692         case PRIV_VFS_MKNOD_DIR:
 693         case PRIV_VFS_SETATTR:
 694         case PRIV_VFS_SETGID:
 695
 696         case PRIV_PROC_SETRLIMIT:
 697         case PRIV_PROC_SETLOGIN:
 698
 699         case PRIV_SYSCTL_WRITEJAIL:
 700
 701                 return (0);
 702
 703         case PRIV_UFS_QUOTAON:
 704         case PRIV_UFS_QUOTAOFF:
 705         case PRIV_VFS_SETQUOTA:
 706         case PRIV_UFS_SETUSE:
 707         case PRIV_VFS_GETQUOTA:
 708                 return (0);
 709
 710
 711                 /*
 712                  * Allow jailed root to bind reserved ports.
 713                  */
 714         case PRIV_NETINET_RESERVEDPORT:
 715                 return (0);
 716
 717
 718                 /*
 719                  * Conditionally allow creating raw sockets in jail.
 720                  */
 721         case PRIV_NETINET_RAW:
 722                 if (jail_allow_raw_sockets)
 723                         return (0);
 724                 else
 725                         return (EPERM);
 726
 727         default:
 728
 729                 return (EPERM);
 730         }
 731 }