priv: Use PRIV_VFS_SETGID
[dragonfly.git] / sys / kern / kern_jail.c
blob3b0db0ec45c9c93ac8362199df1fea790c0a3ef1
1 /*
2 * ----------------------------------------------------------------------------
3 * "THE BEER-WARE LICENSE" (Revision 42):
4 * <phk@FreeBSD.ORG> wrote this file. As long as you retain this notice you
5 * can do whatever you want with this stuff. If we meet some day, and you think
6 * this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp
7 * ----------------------------------------------------------------------------
9 */
10 /*-
11 * Copyright (c) 2006 Victor Balada Diaz <victor@bsdes.net>
12 * All rights reserved.
14 * Redistribution and use in source and binary forms, with or without
15 * modification, are permitted provided that the following conditions
16 * are met:
17 * 1. Redistributions of source code must retain the above copyright
18 * notice, this list of conditions and the following disclaimer.
19 * 2. Redistributions in binary form must reproduce the above copyright
20 * notice, this list of conditions and the following disclaimer in the
21 * documentation and/or other materials provided with the distribution.
23 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33 * SUCH DAMAGE.
38 * $FreeBSD: src/sys/kern/kern_jail.c,v 1.6.2.3 2001/08/17 01:00:26 rwatson Exp $
39 * $DragonFly: src/sys/kern/kern_jail.c,v 1.19 2008/05/17 18:20:33 dillon Exp $
42 #include "opt_inet6.h"
44 #include <sys/param.h>
45 #include <sys/types.h>
46 #include <sys/kernel.h>
47 #include <sys/systm.h>
48 #include <sys/errno.h>
49 #include <sys/sysproto.h>
50 #include <sys/malloc.h>
51 #include <sys/nlookup.h>
52 #include <sys/namecache.h>
53 #include <sys/proc.h>
54 #include <sys/priv.h>
55 #include <sys/jail.h>
56 #include <sys/socket.h>
57 #include <sys/sysctl.h>
58 #include <sys/kern_syscall.h>
59 #include <net/if.h>
60 #include <netinet/in.h>
61 #include <netinet6/in6_var.h>
63 static struct prison *prison_find(int);
64 static void prison_ipcache_init(struct prison *);
66 MALLOC_DEFINE(M_PRISON, "prison", "Prison structures");
68 SYSCTL_NODE(, OID_AUTO, jail, CTLFLAG_RW, 0,
69 "Jail rules");
71 int jail_set_hostname_allowed = 1;
72 SYSCTL_INT(_jail, OID_AUTO, set_hostname_allowed, CTLFLAG_RW,
73 &jail_set_hostname_allowed, 0,
74 "Processes in jail can set their hostnames");
76 int jail_socket_unixiproute_only = 1;
77 SYSCTL_INT(_jail, OID_AUTO, socket_unixiproute_only, CTLFLAG_RW,
78 &jail_socket_unixiproute_only, 0,
79 "Processes in jail are limited to creating UNIX/IPv[46]/route sockets only");
81 int jail_sysvipc_allowed = 0;
82 SYSCTL_INT(_jail, OID_AUTO, sysvipc_allowed, CTLFLAG_RW,
83 &jail_sysvipc_allowed, 0,
84 "Processes in jail can use System V IPC primitives");
86 int jail_chflags_allowed = 0;
87 SYSCTL_INT(_jail, OID_AUTO, chflags_allowed, CTLFLAG_RW,
88 &jail_chflags_allowed, 0,
89 "Process in jail can set chflags(1)");
91 int jail_allow_raw_sockets = 0;
92 SYSCTL_INT(_jail, OID_AUTO, allow_raw_sockets, CTLFLAG_RW,
93 &jail_allow_raw_sockets, 0,
94 "Process in jail can create raw sockets");
96 int lastprid = 0;
97 int prisoncount = 0;
99 LIST_HEAD(prisonlist, prison);
100 struct prisonlist allprison = LIST_HEAD_INITIALIZER(&allprison);
102 static int
103 kern_jail_attach(int jid)
105 struct proc *p = curthread->td_proc;
106 struct prison *pr;
107 int error;
109 pr = prison_find(jid);
110 if (pr == NULL)
111 return(EINVAL);
113 error = kern_chroot(&pr->pr_root);
114 if (error)
115 return(error);
117 prison_hold(pr);
118 cratom(&p->p_ucred);
119 p->p_ucred->cr_prison = pr;
120 p->p_flag |= P_JAILED;
122 return(0);
125 static int
126 assign_prison_id(struct prison *pr)
128 int tryprid;
129 struct prison *tpr;
131 tryprid = lastprid + 1;
132 if (tryprid == JAIL_MAX)
133 tryprid = 1;
134 next:
135 LIST_FOREACH(tpr, &allprison, pr_list) {
136 if (tpr->pr_id != tryprid)
137 continue;
138 tryprid++;
139 if (tryprid == JAIL_MAX) {
140 return (ERANGE);
142 goto next;
144 pr->pr_id = lastprid = tryprid;
146 return (0);
149 static int
150 kern_jail(struct prison *pr, struct jail *j)
152 int error;
153 struct nlookupdata nd;
155 error = nlookup_init(&nd, j->path, UIO_USERSPACE, NLC_FOLLOW);
156 if (error) {
157 nlookup_done(&nd);
158 return (error);
160 error = nlookup(&nd);
161 if (error) {
162 nlookup_done(&nd);
163 return (error);
165 cache_copy(&nd.nl_nch, &pr->pr_root);
167 varsymset_init(&pr->pr_varsymset, NULL);
168 prison_ipcache_init(pr);
170 error = assign_prison_id(pr);
171 if (error) {
172 varsymset_clean(&pr->pr_varsymset);
173 nlookup_done(&nd);
174 return (error);
177 LIST_INSERT_HEAD(&allprison, pr, pr_list);
178 prisoncount++;
180 error = kern_jail_attach(pr->pr_id);
181 if (error) {
182 LIST_REMOVE(pr, pr_list);
183 varsymset_clean(&pr->pr_varsymset);
185 nlookup_done(&nd);
186 return (error);
190 * jail()
192 * jail_args(syscallarg(struct jail *) jail)
195 sys_jail(struct jail_args *uap)
197 struct thread *td = curthread;
198 struct prison *pr;
199 struct jail_ip_storage *jip;
200 struct jail j;
201 int error;
202 uint32_t jversion;
204 uap->sysmsg_result = -1;
206 error = priv_check(td, PRIV_JAIL_CREATE);
207 if (error)
208 return (error);
210 error = copyin(uap->jail, &jversion, sizeof(jversion));
211 if (error)
212 return (error);
214 pr = kmalloc(sizeof(*pr), M_PRISON, M_WAITOK | M_ZERO);
215 SLIST_INIT(&pr->pr_ips);
217 switch (jversion) {
218 case 0:
219 /* Single IPv4 jails. */
221 struct jail_v0 jv0;
222 struct sockaddr_in ip4addr;
224 error = copyin(uap->jail, &jv0, sizeof(jv0));
225 if (error)
226 goto out;
228 j.path = jv0.path;
229 j.hostname = jv0.hostname;
231 jip = kmalloc(sizeof(*jip), M_PRISON, M_WAITOK | M_ZERO);
232 ip4addr.sin_family = AF_INET;
233 ip4addr.sin_addr.s_addr = htonl(jv0.ip_number);
234 memcpy(&jip->ip, &ip4addr, sizeof(ip4addr));
235 SLIST_INSERT_HEAD(&pr->pr_ips, jip, entries);
236 break;
239 case 1:
241 * DragonFly multi noIP/IPv4/IPv6 jails
243 * NOTE: This version is unsupported by FreeBSD
244 * (which uses version 2 instead).
247 error = copyin(uap->jail, &j, sizeof(j));
248 if (error)
249 goto out;
251 for (int i = 0; i < j.n_ips; i++) {
252 jip = kmalloc(sizeof(*jip), M_PRISON,
253 M_WAITOK | M_ZERO);
254 SLIST_INSERT_HEAD(&pr->pr_ips, jip, entries);
255 error = copyin(&j.ips[i], &jip->ip,
256 sizeof(struct sockaddr_storage));
257 if (error)
258 goto out;
260 break;
261 default:
262 error = EINVAL;
263 goto out;
266 error = copyinstr(j.hostname, &pr->pr_host, sizeof(pr->pr_host), 0);
267 if (error)
268 goto out;
270 error = kern_jail(pr, &j);
271 if (error)
272 goto out;
274 uap->sysmsg_result = pr->pr_id;
275 return (0);
277 out:
278 /* Delete all ips */
279 while (!SLIST_EMPTY(&pr->pr_ips)) {
280 jip = SLIST_FIRST(&pr->pr_ips);
281 SLIST_REMOVE_HEAD(&pr->pr_ips, entries);
282 kfree(jip, M_PRISON);
284 kfree(pr, M_PRISON);
285 return (error);
289 * int jail_attach(int jid);
292 sys_jail_attach(struct jail_attach_args *uap)
294 struct thread *td = curthread;
295 int error;
297 error = priv_check(td, PRIV_JAIL_ATTACH);
298 if (error)
299 return(error);
301 return(kern_jail_attach(uap->jid));
304 static void
305 prison_ipcache_init(struct prison *pr)
307 struct jail_ip_storage *jis;
308 struct sockaddr_in *ip4;
309 struct sockaddr_in6 *ip6;
311 SLIST_FOREACH(jis, &pr->pr_ips, entries) {
312 switch (jis->ip.ss_family) {
313 case AF_INET:
314 ip4 = (struct sockaddr_in *)&jis->ip;
315 if ((ntohl(ip4->sin_addr.s_addr) >> IN_CLASSA_NSHIFT) ==
316 IN_LOOPBACKNET) {
317 /* loopback address */
318 if (pr->local_ip4 == NULL)
319 pr->local_ip4 = ip4;
320 } else {
321 /* public address */
322 if (pr->nonlocal_ip4 == NULL)
323 pr->nonlocal_ip4 = ip4;
325 break;
327 case AF_INET6:
328 ip6 = (struct sockaddr_in6 *)&jis->ip;
329 if (IN6_IS_ADDR_LOOPBACK(&ip6->sin6_addr)) {
330 /* loopback address */
331 if (pr->local_ip6 == NULL)
332 pr->local_ip6 = ip6;
333 } else {
334 /* public address */
335 if (pr->nonlocal_ip6 == NULL)
336 pr->nonlocal_ip6 = ip6;
338 break;
344 * Changes INADDR_LOOPBACK for a valid jail address.
345 * ip is in network byte order.
346 * Returns 1 if the ip is among jail valid ips.
347 * Returns 0 if is not among jail valid ips or
348 * if couldn't replace INADDR_LOOPBACK for a valid
349 * IP.
352 prison_replace_wildcards(struct thread *td, struct sockaddr *ip)
354 struct sockaddr_in *ip4 = (struct sockaddr_in *)ip;
355 struct sockaddr_in6 *ip6 = (struct sockaddr_in6 *)ip;
356 struct prison *pr;
358 if (td->td_proc == NULL)
359 return (1);
360 if ((pr = td->td_proc->p_ucred->cr_prison) == NULL)
361 return (1);
363 if ((ip->sa_family == AF_INET &&
364 ip4->sin_addr.s_addr == htonl(INADDR_ANY)) ||
365 (ip->sa_family == AF_INET6 &&
366 IN6_IS_ADDR_UNSPECIFIED(&ip6->sin6_addr)))
367 return (1);
368 if ((ip->sa_family == AF_INET &&
369 ip4->sin_addr.s_addr == htonl(INADDR_LOOPBACK)) ||
370 (ip->sa_family == AF_INET6 &&
371 IN6_IS_ADDR_LOOPBACK(&ip6->sin6_addr))) {
372 if (!prison_get_local(pr, ip->sa_family, ip) &&
373 !prison_get_nonlocal(pr, ip->sa_family, ip))
374 return(0);
375 else
376 return(1);
378 if (jailed_ip(pr, ip))
379 return(1);
380 return(0);
384 prison_remote_ip(struct thread *td, struct sockaddr *ip)
386 struct sockaddr_in *ip4 = (struct sockaddr_in *)ip;
387 struct sockaddr_in6 *ip6 = (struct sockaddr_in6 *)ip;
388 struct prison *pr;
390 if (td == NULL || td->td_proc == NULL)
391 return(1);
392 if ((pr = td->td_proc->p_ucred->cr_prison) == NULL)
393 return(1);
394 if ((ip->sa_family == AF_INET &&
395 ip4->sin_addr.s_addr == htonl(INADDR_LOOPBACK)) ||
396 (ip->sa_family == AF_INET6 &&
397 IN6_IS_ADDR_LOOPBACK(&ip6->sin6_addr))) {
398 if (!prison_get_local(pr, ip->sa_family, ip) &&
399 !prison_get_nonlocal(pr, ip->sa_family, ip))
400 return(0);
401 else
402 return(1);
404 return(1);
408 * Prison get non loopback ip:
409 * - af is the address family of the ip we want (AF_INET|AF_INET6).
410 * - If ip != NULL, put the first IP address that is not a loopback address
411 * into *ip.
413 * ip is in network by order and we don't touch it unless we find a valid ip.
414 * No matter if ip == NULL or not, we return either a valid struct sockaddr *,
415 * or NULL. This struct may not be modified.
417 struct sockaddr *
418 prison_get_nonlocal(struct prison *pr, sa_family_t af, struct sockaddr *ip)
420 struct sockaddr_in *ip4 = (struct sockaddr_in *)ip;
421 struct sockaddr_in6 *ip6 = (struct sockaddr_in6 *)ip;
423 /* Check if it is cached */
424 switch(af) {
425 case AF_INET:
426 if (ip4 != NULL && pr->nonlocal_ip4 != NULL)
427 ip4->sin_addr.s_addr = pr->nonlocal_ip4->sin_addr.s_addr;
428 return (struct sockaddr *)pr->nonlocal_ip4;
430 case AF_INET6:
431 if (ip6 != NULL && pr->nonlocal_ip6 != NULL)
432 ip6->sin6_addr = pr->nonlocal_ip6->sin6_addr;
433 return (struct sockaddr *)pr->nonlocal_ip6;
436 /* NOTREACHED */
437 return NULL;
441 * Prison get loopback ip.
442 * - af is the address family of the ip we want (AF_INET|AF_INET6).
443 * - If ip != NULL, put the first IP address that is not a loopback address
444 * into *ip.
446 * ip is in network by order and we don't touch it unless we find a valid ip.
447 * No matter if ip == NULL or not, we return either a valid struct sockaddr *,
448 * or NULL. This struct may not be modified.
450 struct sockaddr *
451 prison_get_local(struct prison *pr, sa_family_t af, struct sockaddr *ip)
453 struct sockaddr_in *ip4 = (struct sockaddr_in *)ip;
454 struct sockaddr_in6 *ip6 = (struct sockaddr_in6 *)ip;
456 /* Check if it is cached */
457 switch(af) {
458 case AF_INET:
459 if (ip4 != NULL && pr->local_ip4 != NULL)
460 ip4->sin_addr.s_addr = pr->local_ip4->sin_addr.s_addr;
461 return (struct sockaddr *)pr->local_ip4;
463 case AF_INET6:
464 if (ip6 != NULL && pr->local_ip6 != NULL)
465 ip6->sin6_addr = pr->local_ip6->sin6_addr;
466 return (struct sockaddr *)pr->local_ip6;
469 /* NOTREACHED */
470 return NULL;
473 /* Check if the IP is among ours, if it is return 1, else 0 */
475 jailed_ip(struct prison *pr, struct sockaddr *ip)
477 struct jail_ip_storage *jis;
478 struct sockaddr_in *jip4, *ip4;
479 struct sockaddr_in6 *jip6, *ip6;
481 if (pr == NULL)
482 return(0);
483 ip4 = (struct sockaddr_in *)ip;
484 ip6 = (struct sockaddr_in6 *)ip;
485 SLIST_FOREACH(jis, &pr->pr_ips, entries) {
486 switch (ip->sa_family) {
487 case AF_INET:
488 jip4 = (struct sockaddr_in *) &jis->ip;
489 if (jip4->sin_family == AF_INET &&
490 ip4->sin_addr.s_addr == jip4->sin_addr.s_addr)
491 return(1);
492 break;
493 case AF_INET6:
494 jip6 = (struct sockaddr_in6 *) &jis->ip;
495 if (jip6->sin6_family == AF_INET6 &&
496 IN6_ARE_ADDR_EQUAL(&ip6->sin6_addr,
497 &jip6->sin6_addr))
498 return(1);
499 break;
502 /* Ip not in list */
503 return(0);
507 prison_if(struct ucred *cred, struct sockaddr *sa)
509 struct prison *pr;
510 struct sockaddr_in *sai = (struct sockaddr_in*) sa;
512 pr = cred->cr_prison;
514 if (((sai->sin_family != AF_INET) && (sai->sin_family != AF_INET6))
515 && jail_socket_unixiproute_only)
516 return(1);
517 else if ((sai->sin_family != AF_INET) && (sai->sin_family != AF_INET6))
518 return(0);
519 else if (jailed_ip(pr, sa))
520 return(0);
521 return(1);
525 * Returns a prison instance, or NULL on failure.
527 static struct prison *
528 prison_find(int prid)
530 struct prison *pr;
532 LIST_FOREACH(pr, &allprison, pr_list) {
533 if (pr->pr_id == prid)
534 break;
536 return(pr);
539 static int
540 sysctl_jail_list(SYSCTL_HANDLER_ARGS)
542 struct jail_ip_storage *jip;
543 #ifdef INET6
544 struct sockaddr_in6 *jsin6;
545 #endif
546 struct sockaddr_in *jsin;
547 struct proc *p;
548 struct prison *pr;
549 unsigned int jlssize, jlsused;
550 int count, error;
551 char *jls; /* Jail list */
552 char *oip; /* Output ip */
553 char *fullpath, *freepath;
555 jlsused = 0;
556 p = curthread->td_proc;
558 if (jailed(p->p_ucred))
559 return (0);
560 retry:
561 count = prisoncount;
563 if (count == 0)
564 return(0);
566 jlssize = (count * 1024);
567 jls = kmalloc(jlssize + 1, M_TEMP, M_WAITOK | M_ZERO);
568 if (count < prisoncount) {
569 kfree(jls, M_TEMP);
570 goto retry;
572 count = prisoncount;
574 LIST_FOREACH(pr, &allprison, pr_list) {
575 error = cache_fullpath(p, &pr->pr_root, &fullpath, &freepath);
576 if (error)
577 continue;
578 if (jlsused && jlsused < jlssize)
579 jls[jlsused++] = '\n';
580 count = ksnprintf(jls + jlsused, (jlssize - jlsused),
581 "%d %s %s",
582 pr->pr_id, pr->pr_host, fullpath);
583 kfree(freepath, M_TEMP);
584 if (count < 0)
585 goto end;
586 jlsused += count;
588 /* Copy the IPS */
589 SLIST_FOREACH(jip, &pr->pr_ips, entries) {
590 jsin = (struct sockaddr_in *)&jip->ip;
592 switch(jsin->sin_family) {
593 case AF_INET:
594 oip = inet_ntoa(jsin->sin_addr);
595 break;
596 #ifdef INET6
597 case AF_INET6:
598 jsin6 = (struct sockaddr_in6 *)&jip->ip;
599 oip = ip6_sprintf(&jsin6->sin6_addr);
600 break;
601 #endif
602 default:
603 oip = "?family?";
604 break;
607 if ((jlssize - jlsused) < (strlen(oip) + 1)) {
608 error = ERANGE;
609 goto end;
611 count = ksnprintf(jls + jlsused, (jlssize - jlsused),
612 " %s", oip);
613 if (count < 0)
614 goto end;
615 jlsused += count;
620 * The format is:
621 * pr_id <SPC> hostname1 <SPC> PATH1 <SPC> IP1 <SPC> IP2\npr_id...
623 error = SYSCTL_OUT(req, jls, jlsused);
624 end:
625 kfree(jls, M_TEMP);
626 return(error);
629 SYSCTL_OID(_jail, OID_AUTO, list, CTLTYPE_STRING | CTLFLAG_RD, NULL, 0,
630 sysctl_jail_list, "A", "List of active jails");
632 void
633 prison_hold(struct prison *pr)
635 pr->pr_ref++;
638 void
639 prison_free(struct prison *pr)
641 struct jail_ip_storage *jls;
642 KKASSERT(pr->pr_ref >= 1);
644 if (--pr->pr_ref > 0)
645 return;
647 /* Delete all ips */
648 while (!SLIST_EMPTY(&pr->pr_ips)) {
649 jls = SLIST_FIRST(&pr->pr_ips);
650 SLIST_REMOVE_HEAD(&pr->pr_ips, entries);
651 kfree(jls, M_PRISON);
653 LIST_REMOVE(pr, pr_list);
654 prisoncount--;
656 if (pr->pr_linux != NULL)
657 kfree(pr->pr_linux, M_PRISON);
658 varsymset_clean(&pr->pr_varsymset);
659 cache_drop(&pr->pr_root);
660 kfree(pr, M_PRISON);
664 * Check if permisson for a specific privilege is granted within jail.
667 prison_priv_check(struct ucred *cred, int priv)
669 if (!jailed(cred))
670 return (0);
672 switch (priv) {
673 case PRIV_CRED_SETUID:
674 case PRIV_CRED_SETEUID:
675 case PRIV_CRED_SETGID:
676 case PRIV_CRED_SETEGID:
677 case PRIV_CRED_SETGROUPS:
678 case PRIV_CRED_SETREUID:
679 case PRIV_CRED_SETREGID:
680 case PRIV_CRED_SETRESUID:
681 case PRIV_CRED_SETRESGID:
683 case PRIV_VFS_SYSFLAGS:
684 case PRIV_VFS_CHOWN:
685 case PRIV_VFS_CHMOD:
686 case PRIV_VFS_CHROOT:
687 case PRIV_VFS_LINK:
688 case PRIV_VFS_CHFLAGS_DEV:
689 case PRIV_VFS_REVOKE:
690 case PRIV_VFS_MKNOD_BAD:
691 case PRIV_VFS_MKNOD_WHT:
692 case PRIV_VFS_MKNOD_DIR:
693 case PRIV_VFS_SETATTR:
694 case PRIV_VFS_SETGID:
696 case PRIV_PROC_SETRLIMIT:
697 case PRIV_PROC_SETLOGIN:
699 case PRIV_SYSCTL_WRITEJAIL:
701 return (0);
703 case PRIV_UFS_QUOTAON:
704 case PRIV_UFS_QUOTAOFF:
705 case PRIV_VFS_SETQUOTA:
706 case PRIV_UFS_SETUSE:
707 case PRIV_VFS_GETQUOTA:
708 return (0);
712 * Allow jailed root to bind reserved ports.
714 case PRIV_NETINET_RESERVEDPORT:
715 return (0);
719 * Conditionally allow creating raw sockets in jail.
721 case PRIV_NETINET_RAW:
722 if (jail_allow_raw_sockets)
723 return (0);
724 else
725 return (EPERM);
727 default:
729 return (EPERM);