The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/kern/kern_jail.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
    3  *
    4  * Copyright (c) 1999 Poul-Henning Kamp.
    5  * Copyright (c) 2008 Bjoern A. Zeeb.
    6  * Copyright (c) 2009 James Gritton.
    7  * All rights reserved.
    8  *
    9  * Redistribution and use in source and binary forms, with or without
   10  * modification, are permitted provided that the following conditions
   11  * are met:
   12  * 1. Redistributions of source code must retain the above copyright
   13  *    notice, this list of conditions and the following disclaimer.
   14  * 2. Redistributions in binary form must reproduce the above copyright
   15  *    notice, this list of conditions and the following disclaimer in the
   16  *    documentation and/or other materials provided with the distribution.
   17  *
   18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
   19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   21  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
   22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   28  * SUCH DAMAGE.
   29  */
   30 
   31 #include <sys/cdefs.h>
   32 __FBSDID("$FreeBSD$");
   33 
   34 #include "opt_ddb.h"
   35 #include "opt_inet.h"
   36 #include "opt_inet6.h"
   37 #include "opt_nfs.h"
   38 
   39 #include <sys/param.h>
   40 #include <sys/types.h>
   41 #include <sys/kernel.h>
   42 #include <sys/systm.h>
   43 #include <sys/errno.h>
   44 #include <sys/sysproto.h>
   45 #include <sys/malloc.h>
   46 #include <sys/osd.h>
   47 #include <sys/priv.h>
   48 #include <sys/proc.h>
   49 #include <sys/epoch.h>
   50 #include <sys/taskqueue.h>
   51 #include <sys/fcntl.h>
   52 #include <sys/jail.h>
   53 #include <sys/linker.h>
   54 #include <sys/lock.h>
   55 #include <sys/mman.h>
   56 #include <sys/mutex.h>
   57 #include <sys/racct.h>
   58 #include <sys/rctl.h>
   59 #include <sys/refcount.h>
   60 #include <sys/sx.h>
   61 #include <sys/sysent.h>
   62 #include <sys/namei.h>
   63 #include <sys/mount.h>
   64 #include <sys/queue.h>
   65 #include <sys/socket.h>
   66 #include <sys/syscallsubr.h>
   67 #include <sys/sysctl.h>
   68 #include <sys/uuid.h>
   69 #include <sys/vnode.h>
   70 
   71 #include <net/if.h>
   72 #include <net/vnet.h>
   73 
   74 #include <netinet/in.h>
   75 
   76 #ifdef DDB
   77 #include <ddb/ddb.h>
   78 #endif /* DDB */
   79 
   80 #include <security/mac/mac_framework.h>
   81 
   82 #define PRISON0_HOSTUUID_MODULE "hostuuid"
   83 
   84 MALLOC_DEFINE(M_PRISON, "prison", "Prison structures");
   85 static MALLOC_DEFINE(M_PRISON_RACCT, "prison_racct", "Prison racct structures");
   86 
   87 /* Keep struct prison prison0 and some code in kern_jail_set() readable. */
   88 #ifdef INET
   89 #ifdef INET6
   90 #define _PR_IP_SADDRSEL PR_IP4_SADDRSEL|PR_IP6_SADDRSEL
   91 #else
   92 #define _PR_IP_SADDRSEL PR_IP4_SADDRSEL
   93 #endif
   94 #else /* !INET */
   95 #ifdef INET6
   96 #define _PR_IP_SADDRSEL PR_IP6_SADDRSEL
   97 #else
   98 #define _PR_IP_SADDRSEL 0
   99 #endif
  100 #endif
  101 
  102 /* prison0 describes what is "real" about the system. */
  103 struct prison prison0 = {
  104         .pr_id          = 0,
  105         .pr_name        = "",
  106         .pr_ref         = 1,
  107         .pr_uref        = 1,
  108         .pr_path        = "/",
  109         .pr_securelevel = -1,
  110         .pr_devfs_rsnum = 0,
  111         .pr_state       = PRISON_STATE_ALIVE,
  112         .pr_childmax    = JAIL_MAX,
  113         .pr_hostuuid    = DEFAULT_HOSTUUID,
  114         .pr_children    = LIST_HEAD_INITIALIZER(prison0.pr_children),
  115 #ifdef VIMAGE
  116         .pr_flags       = PR_HOST|PR_VNET|_PR_IP_SADDRSEL,
  117 #else
  118         .pr_flags       = PR_HOST|_PR_IP_SADDRSEL,
  119 #endif
  120         .pr_allow       = PR_ALLOW_ALL_STATIC,
  121 };
  122 MTX_SYSINIT(prison0, &prison0.pr_mtx, "jail mutex", MTX_DEF);
  123 
  124 struct bool_flags {
  125         const char      *name;
  126         const char      *noname;
  127         volatile u_int   flag;
  128 };
  129 struct jailsys_flags {
  130         const char      *name;
  131         unsigned         disable;
  132         unsigned         new;
  133 };
  134 
  135 /* allprison, allprison_racct and lastprid are protected by allprison_lock. */
  136 struct  sx allprison_lock;
  137 SX_SYSINIT(allprison_lock, &allprison_lock, "allprison");
  138 struct  prisonlist allprison = TAILQ_HEAD_INITIALIZER(allprison);
  139 LIST_HEAD(, prison_racct) allprison_racct;
  140 int     lastprid = 0;
  141 
  142 static int get_next_prid(struct prison **insprp);
  143 static int do_jail_attach(struct thread *td, struct prison *pr, int drflags);
  144 static void prison_complete(void *context, int pending);
  145 static void prison_deref(struct prison *pr, int flags);
  146 static void prison_deref_kill(struct prison *pr, struct prisonlist *freeprison);
  147 static int prison_lock_xlock(struct prison *pr, int flags);
  148 static void prison_cleanup(struct prison *pr);
  149 static void prison_free_not_last(struct prison *pr);
  150 static void prison_proc_free_not_last(struct prison *pr);
  151 static void prison_proc_relink(struct prison *opr, struct prison *npr,
  152     struct proc *p);
  153 static void prison_set_allow_locked(struct prison *pr, unsigned flag,
  154     int enable);
  155 static char *prison_path(struct prison *pr1, struct prison *pr2);
  156 #ifdef RACCT
  157 static void prison_racct_attach(struct prison *pr);
  158 static void prison_racct_modify(struct prison *pr);
  159 static void prison_racct_detach(struct prison *pr);
  160 #endif
  161 
  162 /* Flags for prison_deref */
  163 #define PD_DEREF        0x01    /* Decrement pr_ref */
  164 #define PD_DEUREF       0x02    /* Decrement pr_uref */
  165 #define PD_KILL         0x04    /* Remove jail, kill processes, etc */
  166 #define PD_LOCKED       0x10    /* pr_mtx is held */
  167 #define PD_LIST_SLOCKED 0x20    /* allprison_lock is held shared */
  168 #define PD_LIST_XLOCKED 0x40    /* allprison_lock is held exclusive */
  169 #define PD_OP_FLAGS     0x07    /* Operation flags */
  170 #define PD_LOCK_FLAGS   0x70    /* Lock status flags */
  171 
  172 /*
  173  * Parameter names corresponding to PR_* flag values.  Size values are for kvm
  174  * as we cannot figure out the size of a sparse array, or an array without a
  175  * terminating entry.
  176  */
  177 static struct bool_flags pr_flag_bool[] = {
  178         {"persist", "nopersist", PR_PERSIST},
  179 #ifdef INET
  180         {"ip4.saddrsel", "ip4.nosaddrsel", PR_IP4_SADDRSEL},
  181 #endif
  182 #ifdef INET6
  183         {"ip6.saddrsel", "ip6.nosaddrsel", PR_IP6_SADDRSEL},
  184 #endif
  185 };
  186 const size_t pr_flag_bool_size = sizeof(pr_flag_bool);
  187 
  188 static struct jailsys_flags pr_flag_jailsys[] = {
  189         {"host", 0, PR_HOST},
  190 #ifdef VIMAGE
  191         {"vnet", 0, PR_VNET},
  192 #endif
  193 #ifdef INET
  194         {"ip4", PR_IP4_USER, PR_IP4_USER},
  195 #endif
  196 #ifdef INET6
  197         {"ip6", PR_IP6_USER, PR_IP6_USER},
  198 #endif
  199 };
  200 const size_t pr_flag_jailsys_size = sizeof(pr_flag_jailsys);
  201 
  202 /*
  203  * Make this array full-size so dynamic parameters can be added.
  204  * It is protected by prison0.mtx, but lockless reading is allowed
  205  * with an atomic check of the flag values.
  206  */
  207 static struct bool_flags pr_flag_allow[NBBY * NBPW] = {
  208         {"allow.set_hostname", "allow.noset_hostname", PR_ALLOW_SET_HOSTNAME},
  209         {"allow.sysvipc", "allow.nosysvipc", PR_ALLOW_SYSVIPC},
  210         {"allow.raw_sockets", "allow.noraw_sockets", PR_ALLOW_RAW_SOCKETS},
  211         {"allow.chflags", "allow.nochflags", PR_ALLOW_CHFLAGS},
  212         {"allow.mount", "allow.nomount", PR_ALLOW_MOUNT},
  213         {"allow.quotas", "allow.noquotas", PR_ALLOW_QUOTAS},
  214         {"allow.socket_af", "allow.nosocket_af", PR_ALLOW_SOCKET_AF},
  215         {"allow.mlock", "allow.nomlock", PR_ALLOW_MLOCK},
  216         {"allow.reserved_ports", "allow.noreserved_ports",
  217          PR_ALLOW_RESERVED_PORTS},
  218         {"allow.read_msgbuf", "allow.noread_msgbuf", PR_ALLOW_READ_MSGBUF},
  219         {"allow.unprivileged_proc_debug", "allow.nounprivileged_proc_debug",
  220          PR_ALLOW_UNPRIV_DEBUG},
  221         {"allow.suser", "allow.nosuser", PR_ALLOW_SUSER},
  222 #if defined(VNET_NFSD) && defined(VIMAGE) && defined(NFSD)
  223         {"allow.nfsd", "allow.nonfsd", PR_ALLOW_NFSD},
  224 #endif
  225 };
  226 static unsigned pr_allow_all = PR_ALLOW_ALL_STATIC;
  227 const size_t pr_flag_allow_size = sizeof(pr_flag_allow);
  228 
  229 #define JAIL_DEFAULT_ALLOW              (PR_ALLOW_SET_HOSTNAME | \
  230                                          PR_ALLOW_RESERVED_PORTS | \
  231                                          PR_ALLOW_UNPRIV_DEBUG | \
  232                                          PR_ALLOW_SUSER)
  233 #define JAIL_DEFAULT_ENFORCE_STATFS     2
  234 #define JAIL_DEFAULT_DEVFS_RSNUM        0
  235 static unsigned jail_default_allow = JAIL_DEFAULT_ALLOW;
  236 static int jail_default_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS;
  237 static int jail_default_devfs_rsnum = JAIL_DEFAULT_DEVFS_RSNUM;
  238 #if defined(INET) || defined(INET6)
  239 static unsigned jail_max_af_ips = 255;
  240 #endif
  241 
  242 /*
  243  * Initialize the parts of prison0 that can't be static-initialized with
  244  * constants.  This is called from proc0_init() after creating thread0 cpuset.
  245  */
  246 void
  247 prison0_init(void)
  248 {
  249         uint8_t *file, *data;
  250         size_t size;
  251         char buf[sizeof(prison0.pr_hostuuid)];
  252         bool valid;
  253 
  254         prison0.pr_cpuset = cpuset_ref(thread0.td_cpuset);
  255         prison0.pr_osreldate = osreldate;
  256         strlcpy(prison0.pr_osrelease, osrelease, sizeof(prison0.pr_osrelease));
  257 
  258         /* If we have a preloaded hostuuid, use it. */
  259         file = preload_search_by_type(PRISON0_HOSTUUID_MODULE);
  260         if (file != NULL) {
  261                 data = preload_fetch_addr(file);
  262                 size = preload_fetch_size(file);
  263                 if (data != NULL) {
  264                         /*
  265                          * The preloaded data may include trailing whitespace, almost
  266                          * certainly a newline; skip over any whitespace or
  267                          * non-printable characters to be safe.
  268                          */
  269                         while (size > 0 && data[size - 1] <= 0x20) {
  270                                 size--;
  271                         }
  272 
  273                         valid = false;
  274 
  275                         /*
  276                          * Not NUL-terminated when passed from loader, but
  277                          * validate_uuid requires that due to using sscanf (as
  278                          * does the subsequent strlcpy, since it still reads
  279                          * past the given size to return the true length);
  280                          * bounce to a temporary buffer to fix.
  281                          */
  282                         if (size >= sizeof(buf))
  283                                 goto done;
  284 
  285                         memcpy(buf, data, size);
  286                         buf[size] = '\0';
  287 
  288                         if (validate_uuid(buf, size, NULL, 0) != 0)
  289                                 goto done;
  290 
  291                         valid = true;
  292                         (void)strlcpy(prison0.pr_hostuuid, buf,
  293                             sizeof(prison0.pr_hostuuid));
  294 
  295 done:
  296                         if (bootverbose && !valid) {
  297                                 printf("hostuuid: preload data malformed: '%.*s'\n",
  298                                     (int)size, data);
  299                         }
  300                 }
  301         }
  302         if (bootverbose)
  303                 printf("hostuuid: using %s\n", prison0.pr_hostuuid);
  304 }
  305 
  306 /*
  307  * struct jail_args {
  308  *      struct jail *jail;
  309  * };
  310  */
  311 int
  312 sys_jail(struct thread *td, struct jail_args *uap)
  313 {
  314         uint32_t version;
  315         int error;
  316         struct jail j;
  317 
  318         error = copyin(uap->jail, &version, sizeof(uint32_t));
  319         if (error)
  320                 return (error);
  321 
  322         switch (version) {
  323         case 0:
  324         {
  325                 struct jail_v0 j0;
  326 
  327                 /* FreeBSD single IPv4 jails. */
  328                 bzero(&j, sizeof(struct jail));
  329                 error = copyin(uap->jail, &j0, sizeof(struct jail_v0));
  330                 if (error)
  331                         return (error);
  332                 j.version = j0.version;
  333                 j.path = j0.path;
  334                 j.hostname = j0.hostname;
  335                 j.ip4s = htonl(j0.ip_number);   /* jail_v0 is host order */
  336                 break;
  337         }
  338 
  339         case 1:
  340                 /*
  341                  * Version 1 was used by multi-IPv4 jail implementations
  342                  * that never made it into the official kernel.
  343                  */
  344                 return (EINVAL);
  345 
  346         case 2: /* JAIL_API_VERSION */
  347                 /* FreeBSD multi-IPv4/IPv6,noIP jails. */
  348                 error = copyin(uap->jail, &j, sizeof(struct jail));
  349                 if (error)
  350                         return (error);
  351                 break;
  352 
  353         default:
  354                 /* Sci-Fi jails are not supported, sorry. */
  355                 return (EINVAL);
  356         }
  357         return (kern_jail(td, &j));
  358 }
  359 
  360 int
  361 kern_jail(struct thread *td, struct jail *j)
  362 {
  363         struct iovec optiov[2 * (4 + nitems(pr_flag_allow)
  364 #ifdef INET
  365                             + 1
  366 #endif
  367 #ifdef INET6
  368                             + 1
  369 #endif
  370                             )];
  371         struct uio opt;
  372         char *u_path, *u_hostname, *u_name;
  373         struct bool_flags *bf;
  374 #ifdef INET
  375         uint32_t ip4s;
  376         struct in_addr *u_ip4;
  377 #endif
  378 #ifdef INET6
  379         struct in6_addr *u_ip6;
  380 #endif
  381         size_t tmplen;
  382         int error, enforce_statfs;
  383 
  384         bzero(&optiov, sizeof(optiov));
  385         opt.uio_iov = optiov;
  386         opt.uio_iovcnt = 0;
  387         opt.uio_offset = -1;
  388         opt.uio_resid = -1;
  389         opt.uio_segflg = UIO_SYSSPACE;
  390         opt.uio_rw = UIO_READ;
  391         opt.uio_td = td;
  392 
  393         /* Set permissions for top-level jails from sysctls. */
  394         if (!jailed(td->td_ucred)) {
  395                 for (bf = pr_flag_allow;
  396                      bf < pr_flag_allow + nitems(pr_flag_allow) &&
  397                         atomic_load_int(&bf->flag) != 0;
  398                      bf++) {
  399                         optiov[opt.uio_iovcnt].iov_base = __DECONST(char *,
  400                             (jail_default_allow & bf->flag)
  401                             ? bf->name : bf->noname);
  402                         optiov[opt.uio_iovcnt].iov_len =
  403                             strlen(optiov[opt.uio_iovcnt].iov_base) + 1;
  404                         opt.uio_iovcnt += 2;
  405                 }
  406                 optiov[opt.uio_iovcnt].iov_base = "enforce_statfs";
  407                 optiov[opt.uio_iovcnt].iov_len = sizeof("enforce_statfs");
  408                 opt.uio_iovcnt++;
  409                 enforce_statfs = jail_default_enforce_statfs;
  410                 optiov[opt.uio_iovcnt].iov_base = &enforce_statfs;
  411                 optiov[opt.uio_iovcnt].iov_len = sizeof(enforce_statfs);
  412                 opt.uio_iovcnt++;
  413         }
  414 
  415         tmplen = MAXPATHLEN + MAXHOSTNAMELEN + MAXHOSTNAMELEN;
  416 #ifdef INET
  417         ip4s = (j->version == 0) ? 1 : j->ip4s;
  418         if (ip4s > jail_max_af_ips)
  419                 return (EINVAL);
  420         tmplen += ip4s * sizeof(struct in_addr);
  421 #else
  422         if (j->ip4s > 0)
  423                 return (EINVAL);
  424 #endif
  425 #ifdef INET6
  426         if (j->ip6s > jail_max_af_ips)
  427                 return (EINVAL);
  428         tmplen += j->ip6s * sizeof(struct in6_addr);
  429 #else
  430         if (j->ip6s > 0)
  431                 return (EINVAL);
  432 #endif
  433         u_path = malloc(tmplen, M_TEMP, M_WAITOK);
  434         u_hostname = u_path + MAXPATHLEN;
  435         u_name = u_hostname + MAXHOSTNAMELEN;
  436 #ifdef INET
  437         u_ip4 = (struct in_addr *)(u_name + MAXHOSTNAMELEN);
  438 #endif
  439 #ifdef INET6
  440 #ifdef INET
  441         u_ip6 = (struct in6_addr *)(u_ip4 + ip4s);
  442 #else
  443         u_ip6 = (struct in6_addr *)(u_name + MAXHOSTNAMELEN);
  444 #endif
  445 #endif
  446         optiov[opt.uio_iovcnt].iov_base = "path";
  447         optiov[opt.uio_iovcnt].iov_len = sizeof("path");
  448         opt.uio_iovcnt++;
  449         optiov[opt.uio_iovcnt].iov_base = u_path;
  450         error = copyinstr(j->path, u_path, MAXPATHLEN,
  451             &optiov[opt.uio_iovcnt].iov_len);
  452         if (error) {
  453                 free(u_path, M_TEMP);
  454                 return (error);
  455         }
  456         opt.uio_iovcnt++;
  457         optiov[opt.uio_iovcnt].iov_base = "host.hostname";
  458         optiov[opt.uio_iovcnt].iov_len = sizeof("host.hostname");
  459         opt.uio_iovcnt++;
  460         optiov[opt.uio_iovcnt].iov_base = u_hostname;
  461         error = copyinstr(j->hostname, u_hostname, MAXHOSTNAMELEN,
  462             &optiov[opt.uio_iovcnt].iov_len);
  463         if (error) {
  464                 free(u_path, M_TEMP);
  465                 return (error);
  466         }
  467         opt.uio_iovcnt++;
  468         if (j->jailname != NULL) {
  469                 optiov[opt.uio_iovcnt].iov_base = "name";
  470                 optiov[opt.uio_iovcnt].iov_len = sizeof("name");
  471                 opt.uio_iovcnt++;
  472                 optiov[opt.uio_iovcnt].iov_base = u_name;
  473                 error = copyinstr(j->jailname, u_name, MAXHOSTNAMELEN,
  474                     &optiov[opt.uio_iovcnt].iov_len);
  475                 if (error) {
  476                         free(u_path, M_TEMP);
  477                         return (error);
  478                 }
  479                 opt.uio_iovcnt++;
  480         }
  481 #ifdef INET
  482         optiov[opt.uio_iovcnt].iov_base = "ip4.addr";
  483         optiov[opt.uio_iovcnt].iov_len = sizeof("ip4.addr");
  484         opt.uio_iovcnt++;
  485         optiov[opt.uio_iovcnt].iov_base = u_ip4;
  486         optiov[opt.uio_iovcnt].iov_len = ip4s * sizeof(struct in_addr);
  487         if (j->version == 0)
  488                 u_ip4->s_addr = j->ip4s;
  489         else {
  490                 error = copyin(j->ip4, u_ip4, optiov[opt.uio_iovcnt].iov_len);
  491                 if (error) {
  492                         free(u_path, M_TEMP);
  493                         return (error);
  494                 }
  495         }
  496         opt.uio_iovcnt++;
  497 #endif
  498 #ifdef INET6
  499         optiov[opt.uio_iovcnt].iov_base = "ip6.addr";
  500         optiov[opt.uio_iovcnt].iov_len = sizeof("ip6.addr");
  501         opt.uio_iovcnt++;
  502         optiov[opt.uio_iovcnt].iov_base = u_ip6;
  503         optiov[opt.uio_iovcnt].iov_len = j->ip6s * sizeof(struct in6_addr);
  504         error = copyin(j->ip6, u_ip6, optiov[opt.uio_iovcnt].iov_len);
  505         if (error) {
  506                 free(u_path, M_TEMP);
  507                 return (error);
  508         }
  509         opt.uio_iovcnt++;
  510 #endif
  511         KASSERT(opt.uio_iovcnt <= nitems(optiov),
  512                 ("kern_jail: too many iovecs (%d)", opt.uio_iovcnt));
  513         error = kern_jail_set(td, &opt, JAIL_CREATE | JAIL_ATTACH);
  514         free(u_path, M_TEMP);
  515         return (error);
  516 }
  517 
  518 /*
  519  * struct jail_set_args {
  520  *      struct iovec *iovp;
  521  *      unsigned int iovcnt;
  522  *      int flags;
  523  * };
  524  */
  525 int
  526 sys_jail_set(struct thread *td, struct jail_set_args *uap)
  527 {
  528         struct uio *auio;
  529         int error;
  530 
  531         /* Check that we have an even number of iovecs. */
  532         if (uap->iovcnt & 1)
  533                 return (EINVAL);
  534 
  535         error = copyinuio(uap->iovp, uap->iovcnt, &auio);
  536         if (error)
  537                 return (error);
  538         error = kern_jail_set(td, auio, uap->flags);
  539         free(auio, M_IOV);
  540         return (error);
  541 }
  542 
  543 #if defined(INET) || defined(INET6)
  544 typedef int prison_addr_cmp_t(const void *, const void *);
  545 typedef bool prison_addr_valid_t(const void *);
  546 static const struct pr_family {
  547         size_t                  size;
  548         prison_addr_cmp_t       *cmp;
  549         prison_addr_valid_t     *valid;
  550         int                     ip_flag;
  551 } pr_families[PR_FAMILY_MAX] = {
  552 #ifdef INET
  553         [PR_INET] = {
  554                 .size = sizeof(struct in_addr),
  555                 .cmp = prison_qcmp_v4,
  556                 .valid = prison_valid_v4,
  557                 .ip_flag = PR_IP4_USER,
  558          },
  559 #endif
  560 #ifdef INET6
  561         [PR_INET6] = {
  562                 .size = sizeof(struct in6_addr),
  563                 .cmp = prison_qcmp_v6,
  564                 .valid = prison_valid_v6,
  565                 .ip_flag = PR_IP6_USER,
  566         },
  567 #endif
  568 };
  569 
  570 /*
  571  * Network address lists (pr_addrs) allocation for jails.  The addresses
  572  * are accessed locklessly by the network stack, thus need to be protected by
  573  * the network epoch.
  574  */
  575 struct prison_ip {
  576         struct epoch_context ctx;
  577         uint32_t        ips;
  578 #ifdef FUTURE_C
  579         union {
  580                 struct in_addr pr_ip4[];
  581                 struct in6_addr pr_ip6[];
  582         };
  583 #else /* No future C :( */
  584 #define PR_IP(pip, i)   ((const char *)((pip) + 1) + pr_families[af].size * (i))
  585 #define PR_IPD(pip, i)  ((char *)((pip) + 1) + pr_families[af].size * (i))
  586 #endif
  587 };
  588 
  589 static struct prison_ip *
  590 prison_ip_alloc(const pr_family_t af, uint32_t cnt, int flags)
  591 {
  592         struct prison_ip *pip;
  593 
  594         pip = malloc(sizeof(struct prison_ip) + cnt * pr_families[af].size,
  595             M_PRISON, flags);
  596         if (pip != NULL)
  597                 pip->ips = cnt;
  598         return (pip);
  599 }
  600 
  601 /*
  602  * Allocate and copyin user supplied address list, sorting and validating.
  603  * kern_jail_set() helper.
  604  */
  605 static struct prison_ip *
  606 prison_ip_copyin(const pr_family_t af, void *op, uint32_t cnt)
  607 {
  608         prison_addr_cmp_t *const cmp = pr_families[af].cmp;
  609         const size_t size = pr_families[af].size;
  610         struct prison_ip *pip;
  611 
  612         pip = prison_ip_alloc(af, cnt, M_WAITOK);
  613         bcopy(op, pip + 1, cnt * size);
  614         /*
  615          * IP addresses are all sorted but ip[0] to preserve
  616          * the primary IP address as given from userland.
  617          * This special IP is used for unbound outgoing
  618          * connections as well for "loopback" traffic in case
  619          * source address selection cannot find any more fitting
  620          * address to connect from.
  621          */
  622         if (cnt > 1)
  623                 qsort((char *)(pip + 1) + size, cnt - 1, size,
  624                     pr_families[af].cmp);
  625         /*
  626          * Check for duplicate addresses and do some simple
  627          * zero and broadcast checks. If users give other bogus
  628          * addresses it is their problem.
  629          */
  630         for (int i = 0; i < cnt; i++) {
  631                 if (!pr_families[af].valid(PR_IP(pip, i))) {
  632                         free(pip, M_PRISON);
  633                         return (NULL);
  634                 }
  635                 if (i + 1 < cnt &&
  636                     (cmp(PR_IP(pip, 0), PR_IP(pip, i + 1)) == 0 ||
  637                      cmp(PR_IP(pip, i), PR_IP(pip, i + 1)) == 0)) {
  638                         free(pip, M_PRISON);
  639                         return (NULL);
  640                 }
  641         }
  642 
  643         return (pip);
  644 }
  645 
  646 /*
  647  * Allocate and dup parent prison address list.
  648  * kern_jail_set() helper.
  649  */
  650 static void
  651 prison_ip_dup(struct prison *ppr, struct prison *pr, const pr_family_t af)
  652 {
  653 
  654         if (ppr->pr_addrs[af] != NULL) {
  655                 pr->pr_addrs[af] = prison_ip_alloc(af,
  656                     ppr->pr_addrs[af]->ips, M_WAITOK);
  657                 bcopy(ppr->pr_addrs[af] + 1, pr->pr_addrs[af] + 1,
  658                     pr->pr_addrs[af]->ips * pr_families[af].size);
  659         }
  660 }
  661 
  662 /*
  663  * Make sure the new set of IP addresses is a subset of the parent's list.
  664  * Don't worry about the parent being unlocked, as any setting is done with
  665  * allprison_lock held.
  666  * kern_jail_set() helper.
  667  */
  668 static bool
  669 prison_ip_parent_match(const struct prison_ip *ppip,
  670     const struct prison_ip *pip, const pr_family_t af)
  671 {
  672         prison_addr_cmp_t *const cmp = pr_families[af].cmp;
  673         int i, j;
  674 
  675         if (ppip == NULL)
  676                 return (false);
  677 
  678         for (i = 0; i < ppip->ips; i++)
  679                 if (cmp(PR_IP(pip, 0), PR_IP(ppip, i)) == 0)
  680                         break;
  681 
  682         if (i == ppip->ips)
  683                 /* Main address not present in parent. */
  684                 return (false);
  685 
  686         if (pip->ips > 1) {
  687                 for (i = j = 1; i < pip->ips; i++) {
  688                         if (cmp(PR_IP(pip, i), PR_IP(ppip, 0)) == 0)
  689                                 /* Equals to parent primary address. */
  690                                 continue;
  691                         for (; j < ppip->ips; j++)
  692                                 if (cmp(PR_IP(pip, i), PR_IP(ppip, j)) == 0)
  693                                         break;
  694                         if (j == ppip->ips)
  695                                 break;
  696                 }
  697                 if (j == ppip->ips)
  698                         /* Address not present in parent. */
  699                         return (false);
  700         }
  701         return (true);
  702 }
  703 
  704 /*
  705  * Check for conflicting IP addresses.  We permit them if there is no more
  706  * than one IP on each jail.  If there is a duplicate on a jail with more
  707  * than one IP stop checking and return error.
  708  * kern_jail_set() helper.
  709  */
  710 static bool
  711 prison_ip_conflict_check(const struct prison *ppr, const struct prison *pr,
  712     const struct prison_ip *pip, pr_family_t af)
  713 {
  714         const struct prison *tppr, *tpr;
  715         int descend;
  716 
  717 #ifdef VIMAGE
  718         for (tppr = ppr; tppr != &prison0; tppr = tppr->pr_parent)
  719                 if (tppr->pr_flags & PR_VNET)
  720                         break;
  721 #else
  722         tppr = &prison0;
  723 #endif
  724         FOREACH_PRISON_DESCENDANT(tppr, tpr, descend) {
  725                 if (tpr == pr ||
  726 #ifdef VIMAGE
  727                     (tpr != tppr && (tpr->pr_flags & PR_VNET)) ||
  728 #endif
  729                     !prison_isalive(tpr)) {
  730                         descend = 0;
  731                         continue;
  732                 }
  733                 if (!(tpr->pr_flags & pr_families[af].ip_flag))
  734                         continue;
  735                 descend = 0;
  736                 if (tpr->pr_addrs[af] == NULL ||
  737                     (pip->ips == 1 && tpr->pr_addrs[af]->ips == 1))
  738                         continue;
  739                 for (int i = 0; i < pip->ips; i++)
  740                         if (prison_ip_check(tpr, af, PR_IP(pip, i)) == 0)
  741                                 return (false);
  742         }
  743 
  744         return (true);
  745 }
  746 
  747 _Static_assert(offsetof(struct prison_ip, ctx) == 0,
  748     "prison must start with epoch context");
  749 static void
  750 prison_ip_free_deferred(epoch_context_t ctx)
  751 {
  752 
  753         free(ctx, M_PRISON);
  754 }
  755 
  756 static void
  757 prison_ip_free(struct prison_ip *pip)
  758 {
  759 
  760         if (pip != NULL)
  761                 NET_EPOCH_CALL(prison_ip_free_deferred, &pip->ctx);
  762 }
  763 
  764 static void
  765 prison_ip_set(struct prison *pr, const pr_family_t af, struct prison_ip *new)
  766 {
  767         struct prison_ip **mem, *old;
  768 
  769         mtx_assert(&pr->pr_mtx, MA_OWNED);
  770 
  771         mem = &pr->pr_addrs[af];
  772 
  773         old = *mem;
  774         ck_pr_store_ptr(mem, new);
  775         prison_ip_free(old);
  776 }
  777 
  778 /*
  779  * Restrict a prison's IP address list with its parent's, possibly replacing
  780  * it.  Return true if succeed, otherwise should redo.
  781  * kern_jail_set() helper.
  782  */
  783 static bool
  784 prison_ip_restrict(struct prison *pr, const pr_family_t af,
  785     struct prison_ip **newp)
  786 {
  787         const struct prison_ip *ppip = pr->pr_parent->pr_addrs[af];
  788         const struct prison_ip *pip = pr->pr_addrs[af];
  789         int (*const cmp)(const void *, const void *) = pr_families[af].cmp;
  790         const size_t size = pr_families[af].size;
  791         struct prison_ip *new = newp != NULL ? *newp : NULL;
  792         uint32_t ips;
  793 
  794         mtx_assert(&pr->pr_mtx, MA_OWNED);
  795 
  796         /*
  797          * Due to epoch-synchronized access to the IP address lists we always
  798          * allocate a new list even if the old one has enough space.  We could
  799          * atomically update an IPv4 address inside a list, but that would
  800          * screw up sorting, and in case of IPv6 we can't even atomically write
  801          * one.
  802          */
  803         if (ppip == NULL) {
  804                 if (pip != NULL)
  805                         prison_ip_set(pr, af, NULL);
  806                 return (true);
  807         }
  808 
  809         if (!(pr->pr_flags & pr_families[af].ip_flag)) {
  810                 if (new == NULL) {
  811                         new = prison_ip_alloc(af, ppip->ips, M_NOWAIT);
  812                         if (new == NULL)
  813                                 return (false); /* Redo */
  814                 }
  815                 /* This has no user settings, so just copy the parent's list. */
  816                 MPASS(new->ips == ppip->ips);
  817                 bcopy(ppip + 1, new + 1, ppip->ips * size);
  818                 prison_ip_set(pr, af, new);
  819                 if (newp != NULL)
  820                         *newp = NULL; /* Used */
  821         } else if (pip != NULL) {
  822                 /* Remove addresses that aren't in the parent. */
  823                 int i;
  824 
  825                 i = 0; /* index in pip */
  826                 ips = 0; /* index in new */
  827 
  828                 if (new == NULL) {
  829                         new = prison_ip_alloc(af, pip->ips, M_NOWAIT);
  830                         if (new == NULL)
  831                                 return (false); /* Redo */
  832                 }
  833 
  834                 for (int pi = 0; pi < ppip->ips; pi++)
  835                         if (cmp(PR_IP(pip, 0), PR_IP(ppip, pi)) == 0) {
  836                                 /* Found our primary address in parent. */
  837                                 bcopy(PR_IP(pip, i), PR_IPD(new, ips), size);
  838                                 i++;
  839                                 ips++;
  840                                 break;
  841                         }
  842                 for (int pi = 1; i < pip->ips; ) {
  843                         /* Check against primary, which is unsorted. */
  844                         if (cmp(PR_IP(pip, i), PR_IP(ppip, 0)) == 0) {
  845                                 /* Matches parent's primary address. */
  846                                 bcopy(PR_IP(pip, i), PR_IPD(new, ips), size);
  847                                 i++;
  848                                 ips++;
  849                                 continue;
  850                         }
  851                         /* The rest are sorted. */
  852                         switch (pi >= ppip->ips ? -1 :
  853                                 cmp(PR_IP(pip, i), PR_IP(ppip, pi))) {
  854                         case -1:
  855                                 i++;
  856                                 break;
  857                         case 0:
  858                                 bcopy(PR_IP(pip, i), PR_IPD(new, ips), size);
  859                                 i++;
  860                                 pi++;
  861                                 ips++;
  862                                 break;
  863                         case 1:
  864                                 pi++;
  865                                 break;
  866                         }
  867                 }
  868                 if (ips == 0) {
  869                         if (newp == NULL || *newp == NULL)
  870                                 prison_ip_free(new);
  871                         new = NULL;
  872                 } else {
  873                         /* Shrink to real size */
  874                         KASSERT((new->ips >= ips),
  875                             ("Out-of-bounds write to prison_ip %p", new));
  876                         new->ips = ips;
  877                 }
  878                 prison_ip_set(pr, af, new);
  879                 if (newp != NULL)
  880                         *newp = NULL; /* Used */
  881         }
  882         return (true);
  883 }
  884 
  885 /*
  886  * Fast-path check if an address belongs to a prison.
  887  */
  888 int
  889 prison_ip_check(const struct prison *pr, const pr_family_t af,
  890     const void *addr)
  891 {
  892         int (*const cmp)(const void *, const void *) = pr_families[af].cmp;
  893         const struct prison_ip *pip;
  894         int i, a, z, d;
  895 
  896         MPASS(mtx_owned(&pr->pr_mtx) ||
  897             in_epoch(net_epoch_preempt) ||
  898             sx_xlocked(&allprison_lock));
  899 
  900         pip = ck_pr_load_ptr(&pr->pr_addrs[af]);
  901         if (__predict_false(pip == NULL))
  902                 return (EAFNOSUPPORT);
  903 
  904         /* Check the primary IP. */
  905         if (cmp(PR_IP(pip, 0), addr) == 0)
  906                 return (0);
  907 
  908         /*
  909          * All the other IPs are sorted so we can do a binary search.
  910          */
  911         a = 0;
  912         z = pip->ips - 2;
  913         while (a <= z) {
  914                 i = (a + z) / 2;
  915                 d = cmp(PR_IP(pip, i + 1), addr);
  916                 if (d > 0)
  917                         z = i - 1;
  918                 else if (d < 0)
  919                         a = i + 1;
  920                 else
  921                         return (0);
  922         }
  923 
  924         return (EADDRNOTAVAIL);
  925 }
  926 
  927 /*
  928  * Grab primary IP.  Historically required mutex, but nothing prevents
  929  * us to support epoch-protected access.  Is it used in fast path?
  930  * in{6}_jail.c helper
  931  */
  932 const void *
  933 prison_ip_get0(const struct prison *pr, const pr_family_t af)
  934 {
  935         const struct prison_ip *pip = pr->pr_addrs[af];
  936 
  937         mtx_assert(&pr->pr_mtx, MA_OWNED);
  938         MPASS(pip);
  939 
  940         return (pip + 1);
  941 }
  942 
  943 u_int
  944 prison_ip_cnt(const struct prison *pr, const pr_family_t af)
  945 {
  946 
  947         return (pr->pr_addrs[af]->ips);
  948 }
  949 #endif  /* defined(INET) || defined(INET6) */
  950 
  951 int
  952 kern_jail_set(struct thread *td, struct uio *optuio, int flags)
  953 {
  954         struct nameidata nd;
  955 #ifdef INET
  956         struct prison_ip *ip4;
  957 #endif
  958 #ifdef INET6
  959         struct prison_ip *ip6;
  960 #endif
  961         struct vfsopt *opt;
  962         struct vfsoptlist *opts;
  963         struct prison *pr, *deadpr, *inspr, *mypr, *ppr, *tpr;
  964         struct vnode *root;
  965         char *domain, *errmsg, *host, *name, *namelc, *p, *path, *uuid;
  966         char *g_path, *osrelstr;
  967         struct bool_flags *bf;
  968         struct jailsys_flags *jsf;
  969 #if defined(INET) || defined(INET6)
  970         void *op;
  971 #endif
  972         unsigned long hid;
  973         size_t namelen, onamelen, pnamelen;
  974         int born, created, cuflags, descend, drflags, enforce;
  975         int error, errmsg_len, errmsg_pos;
  976         int gotchildmax, gotenforce, gothid, gotrsnum, gotslevel;
  977         int jid, jsys, len, level;
  978         int childmax, osreldt, rsnum, slevel;
  979 #ifdef INET
  980         int ip4s;
  981         bool redo_ip4;
  982 #endif
  983 #ifdef INET6
  984         int ip6s;
  985         bool redo_ip6;
  986 #endif
  987         uint64_t pr_allow, ch_allow, pr_flags, ch_flags;
  988         uint64_t pr_allow_diff;
  989         unsigned tallow;
  990         char numbuf[12];
  991 
  992         error = priv_check(td, PRIV_JAIL_SET);
  993         if (!error && (flags & JAIL_ATTACH))
  994                 error = priv_check(td, PRIV_JAIL_ATTACH);
  995         if (error)
  996                 return (error);
  997         mypr = td->td_ucred->cr_prison;
  998         if ((flags & JAIL_CREATE) && mypr->pr_childmax == 0)
  999                 return (EPERM);
 1000         if (flags & ~JAIL_SET_MASK)
 1001                 return (EINVAL);
 1002 
 1003         /*
 1004          * Check all the parameters before committing to anything.  Not all
 1005          * errors can be caught early, but we may as well try.  Also, this
 1006          * takes care of some expensive stuff (path lookup) before getting
 1007          * the allprison lock.
 1008          *
 1009          * XXX Jails are not filesystems, and jail parameters are not mount
 1010          *     options.  But it makes more sense to re-use the vfsopt code
 1011          *     than duplicate it under a different name.
 1012          */
 1013         error = vfs_buildopts(optuio, &opts);
 1014         if (error)
 1015                 return (error);
 1016 #ifdef INET
 1017         ip4 = NULL;
 1018 #endif
 1019 #ifdef INET6
 1020         ip6 = NULL;
 1021 #endif
 1022         g_path = NULL;
 1023 
 1024         cuflags = flags & (JAIL_CREATE | JAIL_UPDATE);
 1025         if (!cuflags) {
 1026                 error = EINVAL;
 1027                 vfs_opterror(opts, "no valid operation (create or update)");
 1028                 goto done_errmsg;
 1029         }
 1030 
 1031         error = vfs_copyopt(opts, "jid", &jid, sizeof(jid));
 1032         if (error == ENOENT)
 1033                 jid = 0;
 1034         else if (error != 0)
 1035                 goto done_free;
 1036 
 1037         error = vfs_copyopt(opts, "securelevel", &slevel, sizeof(slevel));
 1038         if (error == ENOENT)
 1039                 gotslevel = 0;
 1040         else if (error != 0)
 1041                 goto done_free;
 1042         else
 1043                 gotslevel = 1;
 1044 
 1045         error =
 1046             vfs_copyopt(opts, "children.max", &childmax, sizeof(childmax));
 1047         if (error == ENOENT)
 1048                 gotchildmax = 0;
 1049         else if (error != 0)
 1050                 goto done_free;
 1051         else
 1052                 gotchildmax = 1;
 1053 
 1054         error = vfs_copyopt(opts, "enforce_statfs", &enforce, sizeof(enforce));
 1055         if (error == ENOENT)
 1056                 gotenforce = 0;
 1057         else if (error != 0)
 1058                 goto done_free;
 1059         else if (enforce < 0 || enforce > 2) {
 1060                 error = EINVAL;
 1061                 goto done_free;
 1062         } else
 1063                 gotenforce = 1;
 1064 
 1065         error = vfs_copyopt(opts, "devfs_ruleset", &rsnum, sizeof(rsnum));
 1066         if (error == ENOENT)
 1067                 gotrsnum = 0;
 1068         else if (error != 0)
 1069                 goto done_free;
 1070         else
 1071                 gotrsnum = 1;
 1072 
 1073         pr_flags = ch_flags = 0;
 1074         for (bf = pr_flag_bool;
 1075              bf < pr_flag_bool + nitems(pr_flag_bool);
 1076              bf++) {
 1077                 vfs_flagopt(opts, bf->name, &pr_flags, bf->flag);
 1078                 vfs_flagopt(opts, bf->noname, &ch_flags, bf->flag);
 1079         }
 1080         ch_flags |= pr_flags;
 1081         for (jsf = pr_flag_jailsys;
 1082              jsf < pr_flag_jailsys + nitems(pr_flag_jailsys);
 1083              jsf++) {
 1084                 error = vfs_copyopt(opts, jsf->name, &jsys, sizeof(jsys));
 1085                 if (error == ENOENT)
 1086                         continue;
 1087                 if (error != 0)
 1088                         goto done_free;
 1089                 switch (jsys) {
 1090                 case JAIL_SYS_DISABLE:
 1091                         if (!jsf->disable) {
 1092                                 error = EINVAL;
 1093                                 goto done_free;
 1094                         }
 1095                         pr_flags |= jsf->disable;
 1096                         break;
 1097                 case JAIL_SYS_NEW:
 1098                         pr_flags |= jsf->new;
 1099                         break;
 1100                 case JAIL_SYS_INHERIT:
 1101                         break;
 1102                 default:
 1103                         error = EINVAL;
 1104                         goto done_free;
 1105                 }
 1106                 ch_flags |= jsf->new | jsf->disable;
 1107         }
 1108         if ((flags & (JAIL_CREATE | JAIL_ATTACH)) == JAIL_CREATE
 1109             && !(pr_flags & PR_PERSIST)) {
 1110                 error = EINVAL;
 1111                 vfs_opterror(opts, "new jail must persist or attach");
 1112                 goto done_errmsg;
 1113         }
 1114 #ifdef VIMAGE
 1115         if ((flags & JAIL_UPDATE) && (ch_flags & PR_VNET)) {
 1116                 error = EINVAL;
 1117                 vfs_opterror(opts, "vnet cannot be changed after creation");
 1118                 goto done_errmsg;
 1119         }
 1120 #endif
 1121 #ifdef INET
 1122         if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP4_USER)) {
 1123                 error = EINVAL;
 1124                 vfs_opterror(opts, "ip4 cannot be changed after creation");
 1125                 goto done_errmsg;
 1126         }
 1127 #endif
 1128 #ifdef INET6
 1129         if ((flags & JAIL_UPDATE) && (ch_flags & PR_IP6_USER)) {
 1130                 error = EINVAL;
 1131                 vfs_opterror(opts, "ip6 cannot be changed after creation");
 1132                 goto done_errmsg;
 1133         }
 1134 #endif
 1135 
 1136         pr_allow = ch_allow = 0;
 1137         for (bf = pr_flag_allow;
 1138              bf < pr_flag_allow + nitems(pr_flag_allow) &&
 1139                 atomic_load_int(&bf->flag) != 0;
 1140              bf++) {
 1141                 vfs_flagopt(opts, bf->name, &pr_allow, bf->flag);
 1142                 vfs_flagopt(opts, bf->noname, &ch_allow, bf->flag);
 1143         }
 1144         ch_allow |= pr_allow;
 1145 
 1146         error = vfs_getopt(opts, "name", (void **)&name, &len);
 1147         if (error == ENOENT)
 1148                 name = NULL;
 1149         else if (error != 0)
 1150                 goto done_free;
 1151         else {
 1152                 if (len == 0 || name[len - 1] != '\0') {
 1153                         error = EINVAL;
 1154                         goto done_free;
 1155                 }
 1156                 if (len > MAXHOSTNAMELEN) {
 1157                         error = ENAMETOOLONG;
 1158                         goto done_free;
 1159                 }
 1160         }
 1161 
 1162         error = vfs_getopt(opts, "host.hostname", (void **)&host, &len);
 1163         if (error == ENOENT)
 1164                 host = NULL;
 1165         else if (error != 0)
 1166                 goto done_free;
 1167         else {
 1168                 ch_flags |= PR_HOST;
 1169                 pr_flags |= PR_HOST;
 1170                 if (len == 0 || host[len - 1] != '\0') {
 1171                         error = EINVAL;
 1172                         goto done_free;
 1173                 }
 1174                 if (len > MAXHOSTNAMELEN) {
 1175                         error = ENAMETOOLONG;
 1176                         goto done_free;
 1177                 }
 1178         }
 1179 
 1180         error = vfs_getopt(opts, "host.domainname", (void **)&domain, &len);
 1181         if (error == ENOENT)
 1182                 domain = NULL;
 1183         else if (error != 0)
 1184                 goto done_free;
 1185         else {
 1186                 ch_flags |= PR_HOST;
 1187                 pr_flags |= PR_HOST;
 1188                 if (len == 0 || domain[len - 1] != '\0') {
 1189                         error = EINVAL;
 1190                         goto done_free;
 1191                 }
 1192                 if (len > MAXHOSTNAMELEN) {
 1193                         error = ENAMETOOLONG;
 1194                         goto done_free;
 1195                 }
 1196         }
 1197 
 1198         error = vfs_getopt(opts, "host.hostuuid", (void **)&uuid, &len);
 1199         if (error == ENOENT)
 1200                 uuid = NULL;
 1201         else if (error != 0)
 1202                 goto done_free;
 1203         else {
 1204                 ch_flags |= PR_HOST;
 1205                 pr_flags |= PR_HOST;
 1206                 if (len == 0 || uuid[len - 1] != '\0') {
 1207                         error = EINVAL;
 1208                         goto done_free;
 1209                 }
 1210                 if (len > HOSTUUIDLEN) {
 1211                         error = ENAMETOOLONG;
 1212                         goto done_free;
 1213                 }
 1214         }
 1215 
 1216 #ifdef COMPAT_FREEBSD32
 1217         if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) {
 1218                 uint32_t hid32;
 1219 
 1220                 error = vfs_copyopt(opts, "host.hostid", &hid32, sizeof(hid32));
 1221                 hid = hid32;
 1222         } else
 1223 #endif
 1224                 error = vfs_copyopt(opts, "host.hostid", &hid, sizeof(hid));
 1225         if (error == ENOENT)
 1226                 gothid = 0;
 1227         else if (error != 0)
 1228                 goto done_free;
 1229         else {
 1230                 gothid = 1;
 1231                 ch_flags |= PR_HOST;
 1232                 pr_flags |= PR_HOST;
 1233         }
 1234 
 1235 #ifdef INET
 1236         error = vfs_getopt(opts, "ip4.addr", &op, &ip4s);
 1237         if (error == ENOENT)
 1238                 ip4s = 0;
 1239         else if (error != 0)
 1240                 goto done_free;
 1241         else if (ip4s & (sizeof(struct in_addr) - 1)) {
 1242                 error = EINVAL;
 1243                 goto done_free;
 1244         } else {
 1245                 ch_flags |= PR_IP4_USER;
 1246                 pr_flags |= PR_IP4_USER;
 1247                 if (ip4s > 0) {
 1248                         ip4s /= sizeof(struct in_addr);
 1249                         if (ip4s > jail_max_af_ips) {
 1250                                 error = EINVAL;
 1251                                 vfs_opterror(opts, "too many IPv4 addresses");
 1252                                 goto done_errmsg;
 1253                         }
 1254                         ip4 = prison_ip_copyin(PR_INET, op, ip4s);
 1255                         if (ip4 == NULL) {
 1256                                 error = EINVAL;
 1257                                 goto done_free;
 1258                         }
 1259                 }
 1260         }
 1261 #endif
 1262 
 1263 #ifdef INET6
 1264         error = vfs_getopt(opts, "ip6.addr", &op, &ip6s);
 1265         if (error == ENOENT)
 1266                 ip6s = 0;
 1267         else if (error != 0)
 1268                 goto done_free;
 1269         else if (ip6s & (sizeof(struct in6_addr) - 1)) {
 1270                 error = EINVAL;
 1271                 goto done_free;
 1272         } else {
 1273                 ch_flags |= PR_IP6_USER;
 1274                 pr_flags |= PR_IP6_USER;
 1275                 if (ip6s > 0) {
 1276                         ip6s /= sizeof(struct in6_addr);
 1277                         if (ip6s > jail_max_af_ips) {
 1278                                 error = EINVAL;
 1279                                 vfs_opterror(opts, "too many IPv6 addresses");
 1280                                 goto done_errmsg;
 1281                         }
 1282                         ip6 = prison_ip_copyin(PR_INET6, op, ip6s);
 1283                         if (ip6 == NULL) {
 1284                                 error = EINVAL;
 1285                                 goto done_free;
 1286                         }
 1287                 }
 1288         }
 1289 #endif
 1290 
 1291 #if defined(VIMAGE) && (defined(INET) || defined(INET6))
 1292         if ((ch_flags & PR_VNET) && (ch_flags & (PR_IP4_USER | PR_IP6_USER))) {
 1293                 error = EINVAL;
 1294                 vfs_opterror(opts,
 1295                     "vnet jails cannot have IP address restrictions");
 1296                 goto done_errmsg;
 1297         }
 1298 #endif
 1299 
 1300         error = vfs_getopt(opts, "osrelease", (void **)&osrelstr, &len);
 1301         if (error == ENOENT)
 1302                 osrelstr = NULL;
 1303         else if (error != 0)
 1304                 goto done_free;
 1305         else {
 1306                 if (flags & JAIL_UPDATE) {
 1307                         error = EINVAL;
 1308                         vfs_opterror(opts,
 1309                             "osrelease cannot be changed after creation");
 1310                         goto done_errmsg;
 1311                 }
 1312                 if (len == 0 || osrelstr[len - 1] != '\0') {
 1313                         error = EINVAL;
 1314                         goto done_free;
 1315                 }
 1316                 if (len >= OSRELEASELEN) {
 1317                         error = ENAMETOOLONG;
 1318                         vfs_opterror(opts,
 1319                             "osrelease string must be 1-%d bytes long",
 1320                             OSRELEASELEN - 1);
 1321                         goto done_errmsg;
 1322                 }
 1323         }
 1324 
 1325         error = vfs_copyopt(opts, "osreldate", &osreldt, sizeof(osreldt));
 1326         if (error == ENOENT)
 1327                 osreldt = 0;
 1328         else if (error != 0)
 1329                 goto done_free;
 1330         else {
 1331                 if (flags & JAIL_UPDATE) {
 1332                         error = EINVAL;
 1333                         vfs_opterror(opts,
 1334                             "osreldate cannot be changed after creation");
 1335                         goto done_errmsg;
 1336                 }
 1337                 if (osreldt == 0) {
 1338                         error = EINVAL;
 1339                         vfs_opterror(opts, "osreldate cannot be 0");
 1340                         goto done_errmsg;
 1341                 }
 1342         }
 1343 
 1344         root = NULL;
 1345         error = vfs_getopt(opts, "path", (void **)&path, &len);
 1346         if (error == ENOENT)
 1347                 path = NULL;
 1348         else if (error != 0)
 1349                 goto done_free;
 1350         else {
 1351                 if (flags & JAIL_UPDATE) {
 1352                         error = EINVAL;
 1353                         vfs_opterror(opts,
 1354                             "path cannot be changed after creation");
 1355                         goto done_errmsg;
 1356                 }
 1357                 if (len == 0 || path[len - 1] != '\0') {
 1358                         error = EINVAL;
 1359                         goto done_free;
 1360                 }
 1361                 NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE, path);
 1362                 error = namei(&nd);
 1363                 if (error)
 1364                         goto done_free;
 1365                 root = nd.ni_vp;
 1366                 NDFREE_PNBUF(&nd);
 1367                 g_path = malloc(MAXPATHLEN, M_TEMP, M_WAITOK);
 1368                 strlcpy(g_path, path, MAXPATHLEN);
 1369                 error = vn_path_to_global_path(td, root, g_path, MAXPATHLEN);
 1370                 if (error == 0) {
 1371                         path = g_path;
 1372                 } else {
 1373                         /* exit on other errors */
 1374                         goto done_free;
 1375                 }
 1376                 if (root->v_type != VDIR) {
 1377                         error = ENOTDIR;
 1378                         vput(root);
 1379                         goto done_free;
 1380                 }
 1381                 VOP_UNLOCK(root);
 1382         }
 1383 
 1384         /*
 1385          * Find the specified jail, or at least its parent.
 1386          * This abuses the file error codes ENOENT and EEXIST.
 1387          */
 1388         pr = NULL;
 1389         inspr = NULL;
 1390         if (cuflags == JAIL_CREATE && jid == 0 && name != NULL) {
 1391                 namelc = strrchr(name, '.');
 1392                 jid = strtoul(namelc != NULL ? namelc + 1 : name, &p, 10);
 1393                 if (*p != '\0')
 1394                         jid = 0;
 1395         }
 1396         sx_xlock(&allprison_lock);
 1397         drflags = PD_LIST_XLOCKED;
 1398         ppr = mypr;
 1399         if (!prison_isalive(ppr)) {
 1400                 /* This jail is dying.  This process will surely follow. */
 1401                 error = EAGAIN;
 1402                 goto done_deref;
 1403         }
 1404         if (jid != 0) {
 1405                 if (jid < 0) {
 1406                         error = EINVAL;
 1407                         vfs_opterror(opts, "negative jid");
 1408                         goto done_deref;
 1409                 }
 1410                 /*
 1411                  * See if a requested jid already exists.  Keep track of
 1412                  * where it can be inserted later.
 1413                  */
 1414                 TAILQ_FOREACH(inspr, &allprison, pr_list) {
 1415                         if (inspr->pr_id < jid)
 1416                                 continue;
 1417                         if (inspr->pr_id > jid)
 1418                                 break;
 1419                         pr = inspr;
 1420                         mtx_lock(&pr->pr_mtx);
 1421                         drflags |= PD_LOCKED;
 1422                         inspr = NULL;
 1423                         break;
 1424                 }
 1425                 if (pr != NULL) {
 1426                         /* Create: jid must not exist. */
 1427                         if (cuflags == JAIL_CREATE) {
 1428                                 /*
 1429                                  * Even creators that cannot see the jail will
 1430                                  * get EEXIST.
 1431                                  */
 1432                                 error = EEXIST;
 1433                                 vfs_opterror(opts, "jail %d already exists",
 1434                                     jid);
 1435                                 goto done_deref;
 1436                         }
 1437                         if (!prison_ischild(mypr, pr)) {
 1438                                 /*
 1439                                  * Updaters get ENOENT if they cannot see the
 1440                                  * jail.  This is true even for CREATE | UPDATE,
 1441                                  * which normally cannot give this error.
 1442                                  */
 1443                                 error = ENOENT;
 1444                                 vfs_opterror(opts, "jail %d not found", jid);
 1445                                 goto done_deref;
 1446                         }
 1447                         ppr = pr->pr_parent;
 1448                         if (!prison_isalive(ppr)) {
 1449                                 error = ENOENT;
 1450                                 vfs_opterror(opts, "jail %d is dying",
 1451                                     ppr->pr_id);
 1452                                 goto done_deref;
 1453                         }
 1454                         if (!prison_isalive(pr)) {
 1455                                 if (!(flags & JAIL_DYING)) {
 1456                                         error = ENOENT;
 1457                                         vfs_opterror(opts, "jail %d is dying",
 1458                                             jid);
 1459                                         goto done_deref;
 1460                                 }
 1461                                 if ((flags & JAIL_ATTACH) ||
 1462                                     (pr_flags & PR_PERSIST)) {
 1463                                         /*
 1464                                          * A dying jail might be resurrected
 1465                                          * (via attach or persist), but first
 1466                                          * it must determine if another jail
 1467                                          * has claimed its name.  Accomplish
 1468                                          * this by implicitly re-setting the
 1469                                          * name.
 1470                                          */
 1471                                         if (name == NULL)
 1472                                                 name = prison_name(mypr, pr);
 1473                                 }
 1474                         }
 1475                 } else {
 1476                         /* Update: jid must exist. */
 1477                         if (cuflags == JAIL_UPDATE) {
 1478                                 error = ENOENT;
 1479                                 vfs_opterror(opts, "jail %d not found", jid);
 1480                                 goto done_deref;
 1481                         }
 1482                 }
 1483         }
 1484         /*
 1485          * If the caller provided a name, look for a jail by that name.
 1486          * This has different semantics for creates and updates keyed by jid
 1487          * (where the name must not already exist in a different jail),
 1488          * and updates keyed by the name itself (where the name must exist
 1489          * because that is the jail being updated).
 1490          */
 1491         namelc = NULL;
 1492         if (name != NULL) {
 1493                 namelc = strrchr(name, '.');
 1494                 if (namelc == NULL)
 1495                         namelc = name;
 1496                 else {
 1497                         /*
 1498                          * This is a hierarchical name.  Split it into the
 1499                          * parent and child names, and make sure the parent
 1500                          * exists or matches an already found jail.
 1501                          */
 1502                         if (pr != NULL) {
 1503                                 if (strncmp(name, ppr->pr_name, namelc - name)
 1504                                     || ppr->pr_name[namelc - name] != '\0') {
 1505                                         error = EINVAL;
 1506                                         vfs_opterror(opts,
 1507                                             "cannot change jail's parent");
 1508                                         goto done_deref;
 1509                                 }
 1510                         } else {
 1511                                 *namelc = '\0';
 1512                                 ppr = prison_find_name(mypr, name);
 1513                                 if (ppr == NULL) {
 1514                                         error = ENOENT;
 1515                                         vfs_opterror(opts,
 1516                                             "jail \"%s\" not found", name);
 1517                                         goto done_deref;
 1518                                 }
 1519                                 mtx_unlock(&ppr->pr_mtx);
 1520                                 if (!prison_isalive(ppr)) {
 1521                                         error = ENOENT;
 1522                                         vfs_opterror(opts,
 1523                                             "jail \"%s\" is dying", name);
 1524                                         goto done_deref;
 1525                                 }
 1526                                 *namelc = '.';
 1527                         }
 1528                         namelc++;
 1529                 }
 1530                 if (namelc[0] != '\0') {
 1531                         pnamelen =
 1532                             (ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1;
 1533                         deadpr = NULL;
 1534                         FOREACH_PRISON_CHILD(ppr, tpr) {
 1535                                 if (tpr != pr &&
 1536                                     !strcmp(tpr->pr_name + pnamelen, namelc)) {
 1537                                         if (prison_isalive(tpr)) {
 1538                                                 if (pr == NULL &&
 1539                                                     cuflags != JAIL_CREATE) {
 1540                                                         /*
 1541                                                          * Use this jail
 1542                                                          * for updates.
 1543                                                          */
 1544                                                         pr = tpr;
 1545                                                         mtx_lock(&pr->pr_mtx);
 1546                                                         drflags |= PD_LOCKED;
 1547                                                         break;
 1548                                                 }
 1549                                                 /*
 1550                                                  * Create, or update(jid):
 1551                                                  * name must not exist in an
 1552                                                  * active sibling jail.
 1553                                                  */
 1554                                                 error = EEXIST;
 1555                                                 vfs_opterror(opts,
 1556                                                    "jail \"%s\" already exists",
 1557                                                    name);
 1558                                                 goto done_deref;
 1559                                         }
 1560                                         if (pr == NULL &&
 1561                                             cuflags != JAIL_CREATE) {
 1562                                                 deadpr = tpr;
 1563                                         }
 1564                                 }
 1565                         }
 1566                         /* If no active jail is found, use a dying one. */
 1567                         if (deadpr != NULL && pr == NULL) {
 1568                                 if (flags & JAIL_DYING) {
 1569                                         pr = deadpr;
 1570                                         mtx_lock(&pr->pr_mtx);
 1571                                         drflags |= PD_LOCKED;
 1572                                 } else if (cuflags == JAIL_UPDATE) {
 1573                                         error = ENOENT;
 1574                                         vfs_opterror(opts,
 1575                                             "jail \"%s\" is dying", name);
 1576                                         goto done_deref;
 1577                                 }
 1578                         }
 1579                         /* Update: name must exist if no jid. */
 1580                         else if (cuflags == JAIL_UPDATE && pr == NULL) {
 1581                                 error = ENOENT;
 1582                                 vfs_opterror(opts, "jail \"%s\" not found",
 1583                                     name);
 1584                                 goto done_deref;
 1585                         }
 1586                 }
 1587         }
 1588         /* Update: must provide a jid or name. */
 1589         else if (cuflags == JAIL_UPDATE && pr == NULL) {
 1590                 error = ENOENT;
 1591                 vfs_opterror(opts, "update specified no jail");
 1592                 goto done_deref;
 1593         }
 1594 
 1595         /* If there's no prison to update, create a new one and link it in. */
 1596         created = pr == NULL;
 1597         if (created) {
 1598                 for (tpr = mypr; tpr != NULL; tpr = tpr->pr_parent)
 1599                         if (tpr->pr_childcount >= tpr->pr_childmax) {
 1600                                 error = EPERM;
 1601                                 vfs_opterror(opts, "prison limit exceeded");
 1602                                 goto done_deref;
 1603                         }
 1604                 if (jid == 0 && (jid = get_next_prid(&inspr)) == 0) {
 1605                         error = EAGAIN;
 1606                         vfs_opterror(opts, "no available jail IDs");
 1607                         goto done_deref;
 1608                 }
 1609 
 1610                 pr = malloc(sizeof(*pr), M_PRISON, M_WAITOK | M_ZERO);
 1611                 pr->pr_state = PRISON_STATE_INVALID;
 1612                 refcount_init(&pr->pr_ref, 1);
 1613                 refcount_init(&pr->pr_uref, 0);
 1614                 drflags |= PD_DEREF;
 1615                 LIST_INIT(&pr->pr_children);
 1616                 mtx_init(&pr->pr_mtx, "jail mutex", NULL, MTX_DEF | MTX_DUPOK);
 1617                 TASK_INIT(&pr->pr_task, 0, prison_complete, pr);
 1618 
 1619                 pr->pr_id = jid;
 1620                 if (inspr != NULL)
 1621                         TAILQ_INSERT_BEFORE(inspr, pr, pr_list);
 1622                 else
 1623                         TAILQ_INSERT_TAIL(&allprison, pr, pr_list);
 1624 
 1625                 pr->pr_parent = ppr;
 1626                 prison_hold(ppr);
 1627                 prison_proc_hold(ppr);
 1628                 LIST_INSERT_HEAD(&ppr->pr_children, pr, pr_sibling);
 1629                 for (tpr = ppr; tpr != NULL; tpr = tpr->pr_parent)
 1630                         tpr->pr_childcount++;
 1631 
 1632                 /* Set some default values, and inherit some from the parent. */
 1633                 if (namelc == NULL)
 1634                         namelc = "";
 1635                 if (path == NULL) {
 1636                         path = "/";
 1637                         root = mypr->pr_root;
 1638                         vref(root);
 1639                 }
 1640                 strlcpy(pr->pr_hostuuid, DEFAULT_HOSTUUID, HOSTUUIDLEN);
 1641                 pr->pr_flags |= PR_HOST;
 1642 #if defined(INET) || defined(INET6)
 1643 #ifdef VIMAGE
 1644                 if (!(pr_flags & PR_VNET))
 1645 #endif
 1646                 {
 1647 #ifdef INET
 1648                         if (!(ch_flags & PR_IP4_USER))
 1649                                 pr->pr_flags |= PR_IP4 | PR_IP4_USER;
 1650                         else if (!(pr_flags & PR_IP4_USER)) {
 1651                                 pr->pr_flags |= ppr->pr_flags & PR_IP4;
 1652                                 prison_ip_dup(ppr, pr, PR_INET);
 1653                         }
 1654 #endif
 1655 #ifdef INET6
 1656                         if (!(ch_flags & PR_IP6_USER))
 1657                                 pr->pr_flags |= PR_IP6 | PR_IP6_USER;
 1658                         else if (!(pr_flags & PR_IP6_USER)) {
 1659                                 pr->pr_flags |= ppr->pr_flags & PR_IP6;
 1660                                 prison_ip_dup(ppr, pr, PR_INET6);
 1661                         }
 1662 #endif
 1663                 }
 1664 #endif
 1665                 /* Source address selection is always on by default. */
 1666                 pr->pr_flags |= _PR_IP_SADDRSEL;
 1667 
 1668                 pr->pr_securelevel = ppr->pr_securelevel;
 1669                 pr->pr_allow = JAIL_DEFAULT_ALLOW & ppr->pr_allow;
 1670                 pr->pr_enforce_statfs = jail_default_enforce_statfs;
 1671                 pr->pr_devfs_rsnum = ppr->pr_devfs_rsnum;
 1672 
 1673                 pr->pr_osreldate = osreldt ? osreldt : ppr->pr_osreldate;
 1674                 if (osrelstr == NULL)
 1675                         strlcpy(pr->pr_osrelease, ppr->pr_osrelease,
 1676                             sizeof(pr->pr_osrelease));
 1677                 else
 1678                         strlcpy(pr->pr_osrelease, osrelstr,
 1679                             sizeof(pr->pr_osrelease));
 1680 
 1681 #ifdef VIMAGE
 1682                 /* Allocate a new vnet if specified. */
 1683                 pr->pr_vnet = (pr_flags & PR_VNET)
 1684                     ? vnet_alloc() : ppr->pr_vnet;
 1685 #endif
 1686                 /*
 1687                  * Allocate a dedicated cpuset for each jail.
 1688                  * Unlike other initial settings, this may return an error.
 1689                  */
 1690                 error = cpuset_create_root(ppr, &pr->pr_cpuset);
 1691                 if (error)
 1692                         goto done_deref;
 1693 
 1694                 mtx_lock(&pr->pr_mtx);
 1695                 drflags |= PD_LOCKED;
 1696         } else {
 1697                 /*
 1698                  * Grab a reference for existing prisons, to ensure they
 1699                  * continue to exist for the duration of the call.
 1700                  */
 1701                 prison_hold(pr);
 1702                 drflags |= PD_DEREF;
 1703 #if defined(VIMAGE) && (defined(INET) || defined(INET6))
 1704                 if ((pr->pr_flags & PR_VNET) &&
 1705                     (ch_flags & (PR_IP4_USER | PR_IP6_USER))) {
 1706                         error = EINVAL;
 1707                         vfs_opterror(opts,
 1708                             "vnet jails cannot have IP address restrictions");
 1709                         goto done_deref;
 1710                 }
 1711 #endif
 1712 #ifdef INET
 1713                 if (PR_IP4_USER & ch_flags & (pr_flags ^ pr->pr_flags)) {
 1714                         error = EINVAL;
 1715                         vfs_opterror(opts,
 1716                             "ip4 cannot be changed after creation");
 1717                         goto done_deref;
 1718                 }
 1719 #endif
 1720 #ifdef INET6
 1721                 if (PR_IP6_USER & ch_flags & (pr_flags ^ pr->pr_flags)) {
 1722                         error = EINVAL;
 1723                         vfs_opterror(opts,
 1724                             "ip6 cannot be changed after creation");
 1725                         goto done_deref;
 1726                 }
 1727 #endif
 1728         }
 1729 
 1730         /* Do final error checking before setting anything. */
 1731         if (gotslevel) {
 1732                 if (slevel < ppr->pr_securelevel) {
 1733                         error = EPERM;
 1734                         goto done_deref;
 1735                 }
 1736         }
 1737         if (gotchildmax) {
 1738                 if (childmax >= ppr->pr_childmax) {
 1739                         error = EPERM;
 1740                         goto done_deref;
 1741                 }
 1742         }
 1743         if (gotenforce) {
 1744                 if (enforce < ppr->pr_enforce_statfs) {
 1745                         error = EPERM;
 1746                         goto done_deref;
 1747                 }
 1748         }
 1749         if (gotrsnum) {
 1750                 /*
 1751                  * devfs_rsnum is a uint16_t
 1752                  */
 1753                 if (rsnum < 0 || rsnum > 65535) {
 1754                         error = EINVAL;
 1755                         goto done_deref;
 1756                 }
 1757                 /*
 1758                  * Nested jails always inherit parent's devfs ruleset
 1759                  */
 1760                 if (jailed(td->td_ucred)) {
 1761                         if (rsnum > 0 && rsnum != ppr->pr_devfs_rsnum) {
 1762                                 error = EPERM;
 1763                                 goto done_deref;
 1764                         } else
 1765                                 rsnum = ppr->pr_devfs_rsnum;
 1766                 }
 1767         }
 1768 #ifdef INET
 1769         if (ip4s > 0) {
 1770                 if ((ppr->pr_flags & PR_IP4) &&
 1771                     !prison_ip_parent_match(ppr->pr_addrs[PR_INET], ip4,
 1772                     PR_INET)) {
 1773                         error = EPERM;
 1774                         goto done_deref;
 1775                 }
 1776                 if (!prison_ip_conflict_check(ppr, pr, ip4, PR_INET)) {
 1777                         error = EADDRINUSE;
 1778                         vfs_opterror(opts, "IPv4 addresses clash");
 1779                         goto done_deref;
 1780                 }
 1781         }
 1782 #endif
 1783 #ifdef INET6
 1784         if (ip6s > 0) {
 1785                 if ((ppr->pr_flags & PR_IP6) &&
 1786                     !prison_ip_parent_match(ppr->pr_addrs[PR_INET6], ip6,
 1787                     PR_INET6)) {
 1788                         error = EPERM;
 1789                         goto done_deref;
 1790                 }
 1791                 if (!prison_ip_conflict_check(ppr, pr, ip6, PR_INET6)) {
 1792                         error = EADDRINUSE;
 1793                         vfs_opterror(opts, "IPv6 addresses clash");
 1794                         goto done_deref;
 1795                 }
 1796         }
 1797 #endif
 1798         onamelen = namelen = 0;
 1799         if (namelc != NULL) {
 1800                 /* Give a default name of the jid.  Also allow the name to be
 1801                  * explicitly the jid - but not any other number, and only in
 1802                  * normal form (no leading zero/etc).
 1803                  */
 1804                 if (namelc[0] == '\0')
 1805                         snprintf(namelc = numbuf, sizeof(numbuf), "%d", jid);
 1806                 else if ((strtoul(namelc, &p, 10) != jid ||
 1807                           namelc[0] < '1' || namelc[0] > '9') && *p == '\0') {
 1808                         error = EINVAL;
 1809                         vfs_opterror(opts,
 1810                             "name cannot be numeric (unless it is the jid)");
 1811                         goto done_deref;
 1812                 }
 1813                 /*
 1814                  * Make sure the name isn't too long for the prison or its
 1815                  * children.
 1816                  */
 1817                 pnamelen = (ppr == &prison0) ? 0 : strlen(ppr->pr_name) + 1;
 1818                 onamelen = strlen(pr->pr_name + pnamelen);
 1819                 namelen = strlen(namelc);
 1820                 if (pnamelen + namelen + 1 > sizeof(pr->pr_name)) {
 1821                         error = ENAMETOOLONG;
 1822                         goto done_deref;
 1823                 }
 1824                 FOREACH_PRISON_DESCENDANT(pr, tpr, descend) {
 1825                         if (strlen(tpr->pr_name) + (namelen - onamelen) >=
 1826                             sizeof(pr->pr_name)) {
 1827                                 error = ENAMETOOLONG;
 1828                                 goto done_deref;
 1829                         }
 1830                 }
 1831         }
 1832         pr_allow_diff = pr_allow & ~ppr->pr_allow;
 1833         if (pr_allow_diff & ~PR_ALLOW_DIFFERENCES) {
 1834                 error = EPERM;
 1835                 goto done_deref;
 1836         }
 1837 
 1838         /*
 1839          * Let modules check their parameters.  This requires unlocking and
 1840          * then re-locking the prison, but this is still a valid state as long
 1841          * as allprison_lock remains xlocked.
 1842          */
 1843         mtx_unlock(&pr->pr_mtx);
 1844         drflags &= ~PD_LOCKED;
 1845         error = osd_jail_call(pr, PR_METHOD_CHECK, opts);
 1846         if (error != 0)
 1847                 goto done_deref;
 1848         mtx_lock(&pr->pr_mtx);
 1849         drflags |= PD_LOCKED;
 1850 
 1851         /* At this point, all valid parameters should have been noted. */
 1852         TAILQ_FOREACH(opt, opts, link) {
 1853                 if (!opt->seen && strcmp(opt->name, "errmsg")) {
 1854                         error = EINVAL;
 1855                         vfs_opterror(opts, "unknown parameter: %s", opt->name);
 1856                         goto done_deref;
 1857                 }
 1858         }
 1859 
 1860         /* Set the parameters of the prison. */
 1861 #ifdef INET
 1862         redo_ip4 = false;
 1863         if (pr_flags & PR_IP4_USER) {
 1864                 pr->pr_flags |= PR_IP4;
 1865                 prison_ip_set(pr, PR_INET, ip4);
 1866                 ip4 = NULL;
 1867                 FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
 1868 #ifdef VIMAGE
 1869                         if (tpr->pr_flags & PR_VNET) {
 1870                                 descend = 0;
 1871                                 continue;
 1872                         }
 1873 #endif
 1874                         if (!prison_ip_restrict(tpr, PR_INET, NULL)) {
 1875                                 redo_ip4 = true;
 1876                                 descend = 0;
 1877                         }
 1878                 }
 1879         }
 1880 #endif
 1881 #ifdef INET6
 1882         redo_ip6 = false;
 1883         if (pr_flags & PR_IP6_USER) {
 1884                 pr->pr_flags |= PR_IP6;
 1885                 prison_ip_set(pr, PR_INET6, ip6);
 1886                 ip6 = NULL;
 1887                 FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
 1888 #ifdef VIMAGE
 1889                         if (tpr->pr_flags & PR_VNET) {
 1890                                 descend = 0;
 1891                                 continue;
 1892                         }
 1893 #endif
 1894                         if (!prison_ip_restrict(tpr, PR_INET6, NULL)) {
 1895                                 redo_ip6 = true;
 1896                                 descend = 0;
 1897                         }
 1898                 }
 1899         }
 1900 #endif
 1901         if (gotslevel) {
 1902                 pr->pr_securelevel = slevel;
 1903                 /* Set all child jails to be at least this level. */
 1904                 FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
 1905                         if (tpr->pr_securelevel < slevel)
 1906                                 tpr->pr_securelevel = slevel;
 1907         }
 1908         if (gotchildmax) {
 1909                 pr->pr_childmax = childmax;
 1910                 /* Set all child jails to under this limit. */
 1911                 FOREACH_PRISON_DESCENDANT_LOCKED_LEVEL(pr, tpr, descend, level)
 1912                         if (tpr->pr_childmax > childmax - level)
 1913                                 tpr->pr_childmax = childmax > level
 1914                                     ? childmax - level : 0;
 1915         }
 1916         if (gotenforce) {
 1917                 pr->pr_enforce_statfs = enforce;
 1918                 /* Pass this restriction on to the children. */
 1919                 FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
 1920                         if (tpr->pr_enforce_statfs < enforce)
 1921                                 tpr->pr_enforce_statfs = enforce;
 1922         }
 1923         if (gotrsnum) {
 1924                 pr->pr_devfs_rsnum = rsnum;
 1925                 /* Pass this restriction on to the children. */
 1926                 FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend)
 1927                         tpr->pr_devfs_rsnum = rsnum;
 1928         }
 1929         if (namelc != NULL) {
 1930                 if (ppr == &prison0)
 1931                         strlcpy(pr->pr_name, namelc, sizeof(pr->pr_name));
 1932                 else
 1933                         snprintf(pr->pr_name, sizeof(pr->pr_name), "%s.%s",
 1934                             ppr->pr_name, namelc);
 1935                 /* Change this component of child names. */
 1936                 FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
 1937                         bcopy(tpr->pr_name + onamelen, tpr->pr_name + namelen,
 1938                             strlen(tpr->pr_name + onamelen) + 1);
 1939                         bcopy(pr->pr_name, tpr->pr_name, namelen);
 1940                 }
 1941         }
 1942         if (path != NULL) {
 1943                 /* Try to keep a real-rooted full pathname. */
 1944                 strlcpy(pr->pr_path, path, sizeof(pr->pr_path));
 1945                 pr->pr_root = root;
 1946                 root = NULL;
 1947         }
 1948         if (PR_HOST & ch_flags & ~pr_flags) {
 1949                 if (pr->pr_flags & PR_HOST) {
 1950                         /*
 1951                          * Copy the parent's host info.  As with pr_ip4 above,
 1952                          * the lack of a lock on the parent is not a problem;
 1953                          * it is always set with allprison_lock at least
 1954                          * shared, and is held exclusively here.
 1955                          */
 1956                         strlcpy(pr->pr_hostname, pr->pr_parent->pr_hostname,
 1957                             sizeof(pr->pr_hostname));
 1958                         strlcpy(pr->pr_domainname, pr->pr_parent->pr_domainname,
 1959                             sizeof(pr->pr_domainname));
 1960                         strlcpy(pr->pr_hostuuid, pr->pr_parent->pr_hostuuid,
 1961                             sizeof(pr->pr_hostuuid));
 1962                         pr->pr_hostid = pr->pr_parent->pr_hostid;
 1963                 }
 1964         } else if (host != NULL || domain != NULL || uuid != NULL || gothid) {
 1965                 /* Set this prison, and any descendants without PR_HOST. */
 1966                 if (host != NULL)
 1967                         strlcpy(pr->pr_hostname, host, sizeof(pr->pr_hostname));
 1968                 if (domain != NULL)
 1969                         strlcpy(pr->pr_domainname, domain, 
 1970                             sizeof(pr->pr_domainname));
 1971                 if (uuid != NULL)
 1972                         strlcpy(pr->pr_hostuuid, uuid, sizeof(pr->pr_hostuuid));
 1973                 if (gothid)
 1974                         pr->pr_hostid = hid;
 1975                 FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
 1976                         if (tpr->pr_flags & PR_HOST)
 1977                                 descend = 0;
 1978                         else {
 1979                                 if (host != NULL)
 1980                                         strlcpy(tpr->pr_hostname,
 1981                                             pr->pr_hostname,
 1982                                             sizeof(tpr->pr_hostname));
 1983                                 if (domain != NULL)
 1984                                         strlcpy(tpr->pr_domainname, 
 1985                                             pr->pr_domainname,
 1986                                             sizeof(tpr->pr_domainname));
 1987                                 if (uuid != NULL)
 1988                                         strlcpy(tpr->pr_hostuuid,
 1989                                             pr->pr_hostuuid,
 1990                                             sizeof(tpr->pr_hostuuid));
 1991                                 if (gothid)
 1992                                         tpr->pr_hostid = hid;
 1993                         }
 1994                 }
 1995         }
 1996         pr->pr_allow = (pr->pr_allow & ~ch_allow) | pr_allow;
 1997         if ((tallow = ch_allow & ~pr_allow))
 1998                 prison_set_allow_locked(pr, tallow, 0);
 1999         /*
 2000          * Persistent prisons get an extra reference, and prisons losing their
 2001          * persist flag lose that reference.
 2002          */
 2003         born = !prison_isalive(pr);
 2004         if (ch_flags & PR_PERSIST & (pr_flags ^ pr->pr_flags)) {
 2005                 if (pr_flags & PR_PERSIST) {
 2006                         prison_hold(pr);
 2007                         /*
 2008                          * This may make a dead prison alive again, but wait
 2009                          * to label it as such until after OSD calls have had
 2010                          * a chance to run (and perhaps to fail).
 2011                          */
 2012                         refcount_acquire(&pr->pr_uref);
 2013                 } else {
 2014                         drflags |= PD_DEUREF;
 2015                         prison_free_not_last(pr);
 2016                 }
 2017         }
 2018         pr->pr_flags = (pr->pr_flags & ~ch_flags) | pr_flags;
 2019         mtx_unlock(&pr->pr_mtx);
 2020         drflags &= ~PD_LOCKED;
 2021         /*
 2022          * Any errors past this point will need to de-persist newly created
 2023          * prisons, as well as call remove methods.
 2024          */
 2025         if (born)
 2026                 drflags |= PD_KILL;
 2027 
 2028 #ifdef RACCT
 2029         if (racct_enable && created)
 2030                 prison_racct_attach(pr);
 2031 #endif
 2032 
 2033         /* Locks may have prevented a complete restriction of child IP
 2034          * addresses.  If so, allocate some more memory and try again.
 2035          */
 2036 #ifdef INET
 2037         while (redo_ip4) {
 2038                 ip4s = pr->pr_addrs[PR_INET]->ips;
 2039                 MPASS(ip4 == NULL);
 2040                 ip4 = prison_ip_alloc(PR_INET, ip4s, M_WAITOK);
 2041                 mtx_lock(&pr->pr_mtx);
 2042                 redo_ip4 = false;
 2043                 FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
 2044 #ifdef VIMAGE
 2045                         if (tpr->pr_flags & PR_VNET) {
 2046                                 descend = 0;
 2047                                 continue;
 2048                         }
 2049 #endif
 2050                         redo_ip4 = !prison_ip_restrict(tpr, PR_INET, &ip4);
 2051                 }
 2052                 mtx_unlock(&pr->pr_mtx);
 2053         }
 2054 #endif
 2055 #ifdef INET6
 2056         while (redo_ip6) {
 2057                 ip6s = pr->pr_addrs[PR_INET6]->ips;
 2058                 MPASS(ip6 == NULL);
 2059                 ip6 = prison_ip_alloc(PR_INET6, ip6s, M_WAITOK);
 2060                 mtx_lock(&pr->pr_mtx);
 2061                 redo_ip6 = false;
 2062                 FOREACH_PRISON_DESCENDANT_LOCKED(pr, tpr, descend) {
 2063 #ifdef VIMAGE
 2064                         if (tpr->pr_flags & PR_VNET) {
 2065                                 descend = 0;
 2066                                 continue;
 2067                         }
 2068 #endif
 2069                         redo_ip6 = !prison_ip_restrict(tpr, PR_INET6, &ip6);
 2070                 }
 2071                 mtx_unlock(&pr->pr_mtx);
 2072         }
 2073 #endif
 2074 
 2075         /* Let the modules do their work. */
 2076         if (born) {
 2077                 error = osd_jail_call(pr, PR_METHOD_CREATE, opts);
 2078                 if (error)
 2079                         goto done_deref;
 2080         }
 2081         error = osd_jail_call(pr, PR_METHOD_SET, opts);
 2082         if (error)
 2083                 goto done_deref;
 2084 
 2085         /*
 2086          * A new prison is now ready to be seen; either it has gained a user
 2087          * reference via persistence, or is about to gain one via attachment.
 2088          */
 2089         if (born) {
 2090                 drflags = prison_lock_xlock(pr, drflags);
 2091                 pr->pr_state = PRISON_STATE_ALIVE;
 2092         }
 2093 
 2094         /* Attach this process to the prison if requested. */
 2095         if (flags & JAIL_ATTACH) {
 2096                 error = do_jail_attach(td, pr,
 2097                     prison_lock_xlock(pr, drflags & PD_LOCK_FLAGS));
 2098                 drflags &= ~(PD_LOCKED | PD_LIST_XLOCKED);
 2099                 if (error) {
 2100                         vfs_opterror(opts, "attach failed");
 2101                         goto done_deref;
 2102                 }
 2103         }
 2104 
 2105 #ifdef RACCT
 2106         if (racct_enable && !created) {
 2107                 if (drflags & PD_LOCKED) {
 2108                         mtx_unlock(&pr->pr_mtx);
 2109                         drflags &= ~PD_LOCKED;
 2110                 }
 2111                 if (drflags & PD_LIST_XLOCKED) {
 2112                         sx_xunlock(&allprison_lock);
 2113                         drflags &= ~PD_LIST_XLOCKED;
 2114                 }
 2115                 prison_racct_modify(pr);
 2116         }
 2117 #endif
 2118 
 2119 #ifdef VNET_NFSD
 2120         if (born && pr != &prison0 && (pr->pr_allow & PR_ALLOW_NFSD) != 0 &&
 2121             (pr->pr_root->v_vflag & VV_ROOT) == 0)
 2122                 printf("Warning jail jid=%d: mountd/nfsd requires a separate"
 2123                    " file system\n", pr->pr_id);
 2124 #endif
 2125 
 2126         drflags &= ~PD_KILL;
 2127         td->td_retval[0] = pr->pr_id;
 2128 
 2129  done_deref:
 2130         /* Release any temporary prison holds and/or locks. */
 2131         if (pr != NULL)
 2132                 prison_deref(pr, drflags);
 2133         else if (drflags & PD_LIST_SLOCKED)
 2134                 sx_sunlock(&allprison_lock);
 2135         else if (drflags & PD_LIST_XLOCKED)
 2136                 sx_xunlock(&allprison_lock);
 2137         if (root != NULL)
 2138                 vrele(root);
 2139  done_errmsg:
 2140         if (error) {
 2141                 /* Write the error message back to userspace. */
 2142                 if (vfs_getopt(opts, "errmsg", (void **)&errmsg,
 2143                     &errmsg_len) == 0 && errmsg_len > 0) {
 2144                         errmsg_pos = 2 * vfs_getopt_pos(opts, "errmsg") + 1;
 2145                         if (optuio->uio_segflg == UIO_SYSSPACE)
 2146                                 bcopy(errmsg,
 2147                                     optuio->uio_iov[errmsg_pos].iov_base,
 2148                                     errmsg_len);
 2149                         else
 2150                                 copyout(errmsg,
 2151                                     optuio->uio_iov[errmsg_pos].iov_base,
 2152                                     errmsg_len);
 2153                 }
 2154         }
 2155  done_free:
 2156 #ifdef INET
 2157         prison_ip_free(ip4);
 2158 #endif
 2159 #ifdef INET6
 2160         prison_ip_free(ip6);
 2161 #endif
 2162         if (g_path != NULL)
 2163                 free(g_path, M_TEMP);
 2164         vfs_freeopts(opts);
 2165         return (error);
 2166 }
 2167 
 2168 /*
 2169  * Find the next available prison ID.  Return the ID on success, or zero
 2170  * on failure.  Also set a pointer to the allprison list entry the prison
 2171  * should be inserted before.
 2172  */
 2173 static int
 2174 get_next_prid(struct prison **insprp)
 2175 {
 2176         struct prison *inspr;
 2177         int jid, maxid;
 2178 
 2179         jid = lastprid % JAIL_MAX + 1;
 2180         if (TAILQ_EMPTY(&allprison) ||
 2181             TAILQ_LAST(&allprison, prisonlist)->pr_id < jid) {
 2182                 /*
 2183                  * A common case is for all jails to be implicitly numbered,
 2184                  * which means they'll go on the end of the list, at least
 2185                  * for the first JAIL_MAX times.
 2186                  */
 2187                 inspr = NULL;
 2188         } else {
 2189                 /*
 2190                  * Take two passes through the allprison list: first starting
 2191                  * with the proposed jid, then ending with it.
 2192                  */
 2193                 for (maxid = JAIL_MAX; maxid != 0; ) {
 2194                         TAILQ_FOREACH(inspr, &allprison, pr_list) {
 2195                                 if (inspr->pr_id < jid)
 2196                                         continue;
 2197                                 if (inspr->pr_id > jid) {
 2198                                         /* Found an opening. */
 2199                                         maxid = 0;
 2200                                         break;
 2201                                 }
 2202                                 if (++jid > maxid) {
 2203                                         if (lastprid == maxid || lastprid == 0)
 2204                                         {
 2205                                                 /*
 2206                                                  * The entire legal range
 2207                                                  * has been traversed
 2208                                                  */
 2209                                                 return 0;
 2210                                         }
 2211                                         /* Try again from the start. */
 2212                                         jid = 1;
 2213                                         maxid = lastprid;
 2214                                         break;
 2215                                 }
 2216                         }
 2217                         if (inspr == NULL) {
 2218                                 /* Found room at the end of the list. */
 2219                                 break;
 2220                         }
 2221                 }
 2222         }
 2223         *insprp = inspr;
 2224         lastprid = jid;
 2225         return (jid);
 2226 }
 2227 
 2228 /*
 2229  * struct jail_get_args {
 2230  *      struct iovec *iovp;
 2231  *      unsigned int iovcnt;
 2232  *      int flags;
 2233  * };
 2234  */
 2235 int
 2236 sys_jail_get(struct thread *td, struct jail_get_args *uap)
 2237 {
 2238         struct uio *auio;
 2239         int error;
 2240 
 2241         /* Check that we have an even number of iovecs. */
 2242         if (uap->iovcnt & 1)
 2243                 return (EINVAL);
 2244 
 2245         error = copyinuio(uap->iovp, uap->iovcnt, &auio);
 2246         if (error)
 2247                 return (error);
 2248         error = kern_jail_get(td, auio, uap->flags);
 2249         if (error == 0)
 2250                 error = copyout(auio->uio_iov, uap->iovp,
 2251                     uap->iovcnt * sizeof (struct iovec));
 2252         free(auio, M_IOV);
 2253         return (error);
 2254 }
 2255 
 2256 int
 2257 kern_jail_get(struct thread *td, struct uio *optuio, int flags)
 2258 {
 2259         struct bool_flags *bf;
 2260         struct jailsys_flags *jsf;
 2261         struct prison *pr, *mypr;
 2262         struct vfsopt *opt;
 2263         struct vfsoptlist *opts;
 2264         char *errmsg, *name;
 2265         int drflags, error, errmsg_len, errmsg_pos, i, jid, len, pos;
 2266         unsigned f;
 2267 
 2268         if (flags & ~JAIL_GET_MASK)
 2269                 return (EINVAL);
 2270 
 2271         /* Get the parameter list. */
 2272         error = vfs_buildopts(optuio, &opts);
 2273         if (error)
 2274                 return (error);
 2275         errmsg_pos = vfs_getopt_pos(opts, "errmsg");
 2276         mypr = td->td_ucred->cr_prison;
 2277         pr = NULL;
 2278 
 2279         /*
 2280          * Find the prison specified by one of: lastjid, jid, name.
 2281          */
 2282         sx_slock(&allprison_lock);
 2283         drflags = PD_LIST_SLOCKED;
 2284         error = vfs_copyopt(opts, "lastjid", &jid, sizeof(jid));
 2285         if (error == 0) {
 2286                 TAILQ_FOREACH(pr, &allprison, pr_list) {
 2287                         if (pr->pr_id > jid &&
 2288                             ((flags & JAIL_DYING) || prison_isalive(pr)) &&
 2289                             prison_ischild(mypr, pr)) {
 2290                                 mtx_lock(&pr->pr_mtx);
 2291                                 drflags |= PD_LOCKED;
 2292                                 goto found_prison;
 2293                         }
 2294                 }
 2295                 error = ENOENT;
 2296                 vfs_opterror(opts, "no jail after %d", jid);
 2297                 goto done;
 2298         } else if (error != ENOENT)
 2299                 goto done;
 2300 
 2301         error = vfs_copyopt(opts, "jid", &jid, sizeof(jid));
 2302         if (error == 0) {
 2303                 if (jid != 0) {
 2304                         pr = prison_find_child(mypr, jid);
 2305                         if (pr != NULL) {
 2306                                 drflags |= PD_LOCKED;
 2307                                 if (!(prison_isalive(pr) ||
 2308                                     (flags & JAIL_DYING))) {
 2309                                         error = ENOENT;
 2310                                         vfs_opterror(opts, "jail %d is dying",
 2311                                             jid);
 2312                                         goto done;
 2313                                 }
 2314                                 goto found_prison;
 2315                         }
 2316                         error = ENOENT;
 2317                         vfs_opterror(opts, "jail %d not found", jid);
 2318                         goto done;
 2319                 }
 2320         } else if (error != ENOENT)
 2321                 goto done;
 2322 
 2323         error = vfs_getopt(opts, "name", (void **)&name, &len);
 2324         if (error == 0) {
 2325                 if (len == 0 || name[len - 1] != '\0') {
 2326                         error = EINVAL;
 2327                         goto done;
 2328                 }
 2329                 pr = prison_find_name(mypr, name);
 2330                 if (pr != NULL) {
 2331                         drflags |= PD_LOCKED;
 2332                         if (!(prison_isalive(pr) || (flags & JAIL_DYING))) {
 2333                                 error = ENOENT;
 2334                                 vfs_opterror(opts, "jail \"%s\" is dying",
 2335                                     name);
 2336                                 goto done;
 2337                         }
 2338                         goto found_prison;
 2339                 }
 2340                 error = ENOENT;
 2341                 vfs_opterror(opts, "jail \"%s\" not found", name);
 2342                 goto done;
 2343         } else if (error != ENOENT)
 2344                 goto done;
 2345 
 2346         vfs_opterror(opts, "no jail specified");
 2347         error = ENOENT;
 2348         goto done;
 2349 
 2350  found_prison:
 2351         /* Get the parameters of the prison. */
 2352         prison_hold(pr);
 2353         drflags |= PD_DEREF;
 2354         td->td_retval[0] = pr->pr_id;
 2355         error = vfs_setopt(opts, "jid", &pr->pr_id, sizeof(pr->pr_id));
 2356         if (error != 0 && error != ENOENT)
 2357                 goto done;
 2358         i = (pr->pr_parent == mypr) ? 0 : pr->pr_parent->pr_id;
 2359         error = vfs_setopt(opts, "parent", &i, sizeof(i));
 2360         if (error != 0 && error != ENOENT)
 2361                 goto done;
 2362         error = vfs_setopts(opts, "name", prison_name(mypr, pr));
 2363         if (error != 0 && error != ENOENT)
 2364                 goto done;
 2365         error = vfs_setopt(opts, "cpuset.id", &pr->pr_cpuset->cs_id,
 2366             sizeof(pr->pr_cpuset->cs_id));
 2367         if (error != 0 && error != ENOENT)
 2368                 goto done;
 2369         error = vfs_setopts(opts, "path", prison_path(mypr, pr));
 2370         if (error != 0 && error != ENOENT)
 2371                 goto done;
 2372 #ifdef INET
 2373         error = vfs_setopt_part(opts, "ip4.addr", pr->pr_addrs[PR_INET] + 1,
 2374             pr->pr_addrs[PR_INET] ? pr->pr_addrs[PR_INET]->ips *
 2375             pr_families[PR_INET].size : 0 );
 2376         if (error != 0 && error != ENOENT)
 2377                 goto done;
 2378 #endif
 2379 #ifdef INET6
 2380         error = vfs_setopt_part(opts, "ip6.addr", pr->pr_addrs[PR_INET6] + 1,
 2381             pr->pr_addrs[PR_INET6] ? pr->pr_addrs[PR_INET6]->ips *
 2382             pr_families[PR_INET6].size : 0 );
 2383         if (error != 0 && error != ENOENT)
 2384                 goto done;
 2385 #endif
 2386         error = vfs_setopt(opts, "securelevel", &pr->pr_securelevel,
 2387             sizeof(pr->pr_securelevel));
 2388         if (error != 0 && error != ENOENT)
 2389                 goto done;
 2390         error = vfs_setopt(opts, "children.cur", &pr->pr_childcount,
 2391             sizeof(pr->pr_childcount));
 2392         if (error != 0 && error != ENOENT)
 2393                 goto done;
 2394         error = vfs_setopt(opts, "children.max", &pr->pr_childmax,
 2395             sizeof(pr->pr_childmax));
 2396         if (error != 0 && error != ENOENT)
 2397                 goto done;
 2398         error = vfs_setopts(opts, "host.hostname", pr->pr_hostname);
 2399         if (error != 0 && error != ENOENT)
 2400                 goto done;
 2401         error = vfs_setopts(opts, "host.domainname", pr->pr_domainname);
 2402         if (error != 0 && error != ENOENT)
 2403                 goto done;
 2404         error = vfs_setopts(opts, "host.hostuuid", pr->pr_hostuuid);
 2405         if (error != 0 && error != ENOENT)
 2406                 goto done;
 2407 #ifdef COMPAT_FREEBSD32
 2408         if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) {
 2409                 uint32_t hid32 = pr->pr_hostid;
 2410 
 2411                 error = vfs_setopt(opts, "host.hostid", &hid32, sizeof(hid32));
 2412         } else
 2413 #endif
 2414         error = vfs_setopt(opts, "host.hostid", &pr->pr_hostid,
 2415             sizeof(pr->pr_hostid));
 2416         if (error != 0 && error != ENOENT)
 2417                 goto done;
 2418         error = vfs_setopt(opts, "enforce_statfs", &pr->pr_enforce_statfs,
 2419             sizeof(pr->pr_enforce_statfs));
 2420         if (error != 0 && error != ENOENT)
 2421                 goto done;
 2422         error = vfs_setopt(opts, "devfs_ruleset", &pr->pr_devfs_rsnum,
 2423             sizeof(pr->pr_devfs_rsnum));
 2424         if (error != 0 && error != ENOENT)
 2425                 goto done;
 2426         for (bf = pr_flag_bool;
 2427              bf < pr_flag_bool + nitems(pr_flag_bool);
 2428              bf++) {
 2429                 i = (pr->pr_flags & bf->flag) ? 1 : 0;
 2430                 error = vfs_setopt(opts, bf->name, &i, sizeof(i));
 2431                 if (error != 0 && error != ENOENT)
 2432                         goto done;
 2433                 i = !i;
 2434                 error = vfs_setopt(opts, bf->noname, &i, sizeof(i));
 2435                 if (error != 0 && error != ENOENT)
 2436                         goto done;
 2437         }
 2438         for (jsf = pr_flag_jailsys;
 2439              jsf < pr_flag_jailsys + nitems(pr_flag_jailsys);
 2440              jsf++) {
 2441                 f = pr->pr_flags & (jsf->disable | jsf->new);
 2442                 i = (f != 0 && f == jsf->disable) ? JAIL_SYS_DISABLE
 2443                     : (f == jsf->new) ? JAIL_SYS_NEW
 2444                     : JAIL_SYS_INHERIT;
 2445                 error = vfs_setopt(opts, jsf->name, &i, sizeof(i));
 2446                 if (error != 0 && error != ENOENT)
 2447                         goto done;
 2448         }
 2449         for (bf = pr_flag_allow;
 2450              bf < pr_flag_allow + nitems(pr_flag_allow) &&
 2451                 atomic_load_int(&bf->flag) != 0;
 2452              bf++) {
 2453                 i = (pr->pr_allow & bf->flag) ? 1 : 0;
 2454                 error = vfs_setopt(opts, bf->name, &i, sizeof(i));
 2455                 if (error != 0 && error != ENOENT)
 2456                         goto done;
 2457                 i = !i;
 2458                 error = vfs_setopt(opts, bf->noname, &i, sizeof(i));
 2459                 if (error != 0 && error != ENOENT)
 2460                         goto done;
 2461         }
 2462         i = !prison_isalive(pr);
 2463         error = vfs_setopt(opts, "dying", &i, sizeof(i));
 2464         if (error != 0 && error != ENOENT)
 2465                 goto done;
 2466         i = !i;
 2467         error = vfs_setopt(opts, "nodying", &i, sizeof(i));
 2468         if (error != 0 && error != ENOENT)
 2469                 goto done;
 2470         error = vfs_setopt(opts, "osreldate", &pr->pr_osreldate,
 2471             sizeof(pr->pr_osreldate));
 2472         if (error != 0 && error != ENOENT)
 2473                 goto done;
 2474         error = vfs_setopts(opts, "osrelease", pr->pr_osrelease);
 2475         if (error != 0 && error != ENOENT)
 2476                 goto done;
 2477 
 2478         /* Get the module parameters. */
 2479         mtx_unlock(&pr->pr_mtx);
 2480         drflags &= ~PD_LOCKED;
 2481         error = osd_jail_call(pr, PR_METHOD_GET, opts);
 2482         if (error)
 2483                 goto done;
 2484         prison_deref(pr, drflags);
 2485         pr = NULL;
 2486         drflags = 0;
 2487 
 2488         /* By now, all parameters should have been noted. */
 2489         TAILQ_FOREACH(opt, opts, link) {
 2490                 if (!opt->seen && strcmp(opt->name, "errmsg")) {
 2491                         error = EINVAL;
 2492                         vfs_opterror(opts, "unknown parameter: %s", opt->name);
 2493                         goto done;
 2494                 }
 2495         }
 2496 
 2497         /* Write the fetched parameters back to userspace. */
 2498         error = 0;
 2499         TAILQ_FOREACH(opt, opts, link) {
 2500                 if (opt->pos >= 0 && opt->pos != errmsg_pos) {
 2501                         pos = 2 * opt->pos + 1;
 2502                         optuio->uio_iov[pos].iov_len = opt->len;
 2503                         if (opt->value != NULL) {
 2504                                 if (optuio->uio_segflg == UIO_SYSSPACE) {
 2505                                         bcopy(opt->value,
 2506                                             optuio->uio_iov[pos].iov_base,
 2507                                             opt->len);
 2508                                 } else {
 2509                                         error = copyout(opt->value,
 2510                                             optuio->uio_iov[pos].iov_base,
 2511                                             opt->len);
 2512                                         if (error)
 2513                                                 break;
 2514                                 }
 2515                         }
 2516                 }
 2517         }
 2518 
 2519  done:
 2520         /* Release any temporary prison holds and/or locks. */
 2521         if (pr != NULL)
 2522                 prison_deref(pr, drflags);
 2523         else if (drflags & PD_LIST_SLOCKED)
 2524                 sx_sunlock(&allprison_lock);
 2525         if (error && errmsg_pos >= 0) {
 2526                 /* Write the error message back to userspace. */
 2527                 vfs_getopt(opts, "errmsg", (void **)&errmsg, &errmsg_len);
 2528                 errmsg_pos = 2 * errmsg_pos + 1;
 2529                 if (errmsg_len > 0) {
 2530                         if (optuio->uio_segflg == UIO_SYSSPACE)
 2531                                 bcopy(errmsg,
 2532                                     optuio->uio_iov[errmsg_pos].iov_base,
 2533                                     errmsg_len);
 2534                         else
 2535                                 copyout(errmsg,
 2536                                     optuio->uio_iov[errmsg_pos].iov_base,
 2537                                     errmsg_len);
 2538                 }
 2539         }
 2540         vfs_freeopts(opts);
 2541         return (error);
 2542 }
 2543 
 2544 /*
 2545  * struct jail_remove_args {
 2546  *      int jid;
 2547  * };
 2548  */
 2549 int
 2550 sys_jail_remove(struct thread *td, struct jail_remove_args *uap)
 2551 {
 2552         struct prison *pr;
 2553         int error;
 2554 
 2555         error = priv_check(td, PRIV_JAIL_REMOVE);
 2556         if (error)
 2557                 return (error);
 2558 
 2559         sx_xlock(&allprison_lock);
 2560         pr = prison_find_child(td->td_ucred->cr_prison, uap->jid);
 2561         if (pr == NULL) {
 2562                 sx_xunlock(&allprison_lock);
 2563                 return (EINVAL);
 2564         }
 2565         if (!prison_isalive(pr)) {
 2566                 /* Silently ignore already-dying prisons. */
 2567                 mtx_unlock(&pr->pr_mtx);
 2568                 sx_xunlock(&allprison_lock);
 2569                 return (0);
 2570         }
 2571         prison_deref(pr, PD_KILL | PD_LOCKED | PD_LIST_XLOCKED);
 2572         return (0);
 2573 }
 2574 
 2575 /*
 2576  * struct jail_attach_args {
 2577  *      int jid;
 2578  * };
 2579  */
 2580 int
 2581 sys_jail_attach(struct thread *td, struct jail_attach_args *uap)
 2582 {
 2583         struct prison *pr;
 2584         int error;
 2585 
 2586         error = priv_check(td, PRIV_JAIL_ATTACH);
 2587         if (error)
 2588                 return (error);
 2589 
 2590         sx_slock(&allprison_lock);
 2591         pr = prison_find_child(td->td_ucred->cr_prison, uap->jid);
 2592         if (pr == NULL) {
 2593                 sx_sunlock(&allprison_lock);
 2594                 return (EINVAL);
 2595         }
 2596 
 2597         /* Do not allow a process to attach to a prison that is not alive. */
 2598         if (!prison_isalive(pr)) {
 2599                 mtx_unlock(&pr->pr_mtx);
 2600                 sx_sunlock(&allprison_lock);
 2601                 return (EINVAL);
 2602         }
 2603 
 2604         return (do_jail_attach(td, pr, PD_LOCKED | PD_LIST_SLOCKED));
 2605 }
 2606 
 2607 static int
 2608 do_jail_attach(struct thread *td, struct prison *pr, int drflags)
 2609 {
 2610         struct proc *p;
 2611         struct ucred *newcred, *oldcred;
 2612         int error;
 2613 
 2614         mtx_assert(&pr->pr_mtx, MA_OWNED);
 2615         sx_assert(&allprison_lock, SX_LOCKED);
 2616         drflags &= PD_LOCK_FLAGS;
 2617         /*
 2618          * XXX: Note that there is a slight race here if two threads
 2619          * in the same privileged process attempt to attach to two
 2620          * different jails at the same time.  It is important for
 2621          * user processes not to do this, or they might end up with
 2622          * a process root from one prison, but attached to the jail
 2623          * of another.
 2624          */
 2625         prison_hold(pr);
 2626         refcount_acquire(&pr->pr_uref);
 2627         drflags |= PD_DEREF | PD_DEUREF;
 2628         mtx_unlock(&pr->pr_mtx);
 2629         drflags &= ~PD_LOCKED;
 2630 
 2631         /* Let modules do whatever they need to prepare for attaching. */
 2632         error = osd_jail_call(pr, PR_METHOD_ATTACH, td);
 2633         if (error) {
 2634                 prison_deref(pr, drflags);
 2635                 return (error);
 2636         }
 2637         sx_unlock(&allprison_lock);
 2638         drflags &= ~(PD_LIST_SLOCKED | PD_LIST_XLOCKED);
 2639 
 2640         /*
 2641          * Reparent the newly attached process to this jail.
 2642          */
 2643         p = td->td_proc;
 2644         error = cpuset_setproc_update_set(p, pr->pr_cpuset);
 2645         if (error)
 2646                 goto e_revert_osd;
 2647 
 2648         vn_lock(pr->pr_root, LK_EXCLUSIVE | LK_RETRY);
 2649         if ((error = change_dir(pr->pr_root, td)) != 0)
 2650                 goto e_unlock;
 2651 #ifdef MAC
 2652         if ((error = mac_vnode_check_chroot(td->td_ucred, pr->pr_root)))
 2653                 goto e_unlock;
 2654 #endif
 2655         VOP_UNLOCK(pr->pr_root);
 2656         if ((error = pwd_chroot_chdir(td, pr->pr_root)))
 2657                 goto e_revert_osd;
 2658 
 2659         newcred = crget();
 2660         PROC_LOCK(p);
 2661         oldcred = crcopysafe(p, newcred);
 2662         newcred->cr_prison = pr;
 2663         proc_set_cred(p, newcred);
 2664         setsugid(p);
 2665 #ifdef RACCT
 2666         racct_proc_ucred_changed(p, oldcred, newcred);
 2667         crhold(newcred);
 2668 #endif
 2669         PROC_UNLOCK(p);
 2670 #ifdef RCTL
 2671         rctl_proc_ucred_changed(p, newcred);
 2672         crfree(newcred);
 2673 #endif
 2674         prison_proc_relink(oldcred->cr_prison, pr, p);
 2675         prison_deref(oldcred->cr_prison, drflags);
 2676         crfree(oldcred);
 2677 
 2678         /*
 2679          * If the prison was killed while changing credentials, die along
 2680          * with it.
 2681          */
 2682         if (!prison_isalive(pr)) {
 2683                 PROC_LOCK(p);
 2684                 kern_psignal(p, SIGKILL);
 2685                 PROC_UNLOCK(p);
 2686         }
 2687 
 2688         return (0);
 2689 
 2690  e_unlock:
 2691         VOP_UNLOCK(pr->pr_root);
 2692  e_revert_osd:
 2693         /* Tell modules this thread is still in its old jail after all. */
 2694         sx_slock(&allprison_lock);
 2695         drflags |= PD_LIST_SLOCKED;
 2696         (void)osd_jail_call(td->td_ucred->cr_prison, PR_METHOD_ATTACH, td);
 2697         prison_deref(pr, drflags);
 2698         return (error);
 2699 }
 2700 
 2701 /*
 2702  * Returns a locked prison instance, or NULL on failure.
 2703  */
 2704 struct prison *
 2705 prison_find(int prid)
 2706 {
 2707         struct prison *pr;
 2708 
 2709         sx_assert(&allprison_lock, SX_LOCKED);
 2710         TAILQ_FOREACH(pr, &allprison, pr_list) {
 2711                 if (pr->pr_id < prid)
 2712                         continue;
 2713                 if (pr->pr_id > prid)
 2714                         break;
 2715                 KASSERT(prison_isvalid(pr), ("Found invalid prison %p", pr));
 2716                 mtx_lock(&pr->pr_mtx);
 2717                 return (pr);
 2718         }
 2719         return (NULL);
 2720 }
 2721 
 2722 /*
 2723  * Find a prison that is a descendant of mypr.  Returns a locked prison or NULL.
 2724  */
 2725 struct prison *
 2726 prison_find_child(struct prison *mypr, int prid)
 2727 {
 2728         struct prison *pr;
 2729         int descend;
 2730 
 2731         sx_assert(&allprison_lock, SX_LOCKED);
 2732         FOREACH_PRISON_DESCENDANT(mypr, pr, descend) {
 2733                 if (pr->pr_id == prid) {
 2734                         KASSERT(prison_isvalid(pr),
 2735                             ("Found invalid prison %p", pr));
 2736                         mtx_lock(&pr->pr_mtx);
 2737                         return (pr);
 2738                 }
 2739         }
 2740         return (NULL);
 2741 }
 2742 
 2743 /*
 2744  * Look for the name relative to mypr.  Returns a locked prison or NULL.
 2745  */
 2746 struct prison *
 2747 prison_find_name(struct prison *mypr, const char *name)
 2748 {
 2749         struct prison *pr, *deadpr;
 2750         size_t mylen;
 2751         int descend;
 2752 
 2753         sx_assert(&allprison_lock, SX_LOCKED);
 2754         mylen = (mypr == &prison0) ? 0 : strlen(mypr->pr_name) + 1;
 2755         deadpr = NULL;
 2756         FOREACH_PRISON_DESCENDANT(mypr, pr, descend) {
 2757                 if (!strcmp(pr->pr_name + mylen, name)) {
 2758                         KASSERT(prison_isvalid(pr),
 2759                             ("Found invalid prison %p", pr));
 2760                         if (prison_isalive(pr)) {
 2761                                 mtx_lock(&pr->pr_mtx);
 2762                                 return (pr);
 2763                         }
 2764                         deadpr = pr;
 2765                 }
 2766         }
 2767         /* There was no valid prison - perhaps there was a dying one. */
 2768         if (deadpr != NULL)
 2769                 mtx_lock(&deadpr->pr_mtx);
 2770         return (deadpr);
 2771 }
 2772 
 2773 /*
 2774  * See if a prison has the specific flag set.  The prison should be locked,
 2775  * unless checking for flags that are only set at jail creation (such as
 2776  * PR_IP4 and PR_IP6), or only the single bit is examined, without regard
 2777  * to any other prison data.
 2778  */
 2779 int
 2780 prison_flag(struct ucred *cred, unsigned flag)
 2781 {
 2782 
 2783         return (cred->cr_prison->pr_flags & flag);
 2784 }
 2785 
 2786 int
 2787 prison_allow(struct ucred *cred, unsigned flag)
 2788 {
 2789 
 2790         return ((cred->cr_prison->pr_allow & flag) != 0);
 2791 }
 2792 
 2793 /*
 2794  * Hold a prison reference, by incrementing pr_ref.  It is generally
 2795  * an error to hold a prison that does not already have a reference.
 2796  * A prison record will remain valid as long as it has at least one
 2797  * reference, and will not be removed as long as either the prison
 2798  * mutex or the allprison lock is held (allprison_lock may be shared).
 2799  */
 2800 void
 2801 prison_hold_locked(struct prison *pr)
 2802 {
 2803 
 2804         /* Locking is no longer required. */
 2805         prison_hold(pr);
 2806 }
 2807 
 2808 void
 2809 prison_hold(struct prison *pr)
 2810 {
 2811 #ifdef INVARIANTS
 2812         int was_valid = refcount_acquire_if_not_zero(&pr->pr_ref);
 2813 
 2814         KASSERT(was_valid,
 2815             ("Trying to hold dead prison %p (jid=%d).", pr, pr->pr_id));
 2816 #else
 2817         refcount_acquire(&pr->pr_ref);
 2818 #endif
 2819 }
 2820 
 2821 /*
 2822  * Remove a prison reference.  If that was the last reference, the
 2823  * prison will be removed (at a later time).
 2824  */
 2825 void
 2826 prison_free_locked(struct prison *pr)
 2827 {
 2828 
 2829         mtx_assert(&pr->pr_mtx, MA_OWNED);
 2830         /*
 2831          * Locking is no longer required, but unlock because the caller
 2832          * expects it.
 2833          */
 2834         mtx_unlock(&pr->pr_mtx);
 2835         prison_free(pr);
 2836 }
 2837 
 2838 void
 2839 prison_free(struct prison *pr)
 2840 {
 2841 
 2842         KASSERT(refcount_load(&pr->pr_ref) > 0,
 2843             ("Trying to free dead prison %p (jid=%d).",
 2844              pr, pr->pr_id));
 2845         if (!refcount_release_if_not_last(&pr->pr_ref)) {
 2846                 /*
 2847                  * Don't remove the last reference in this context,
 2848                  * in case there are locks held.
 2849                  */
 2850                 taskqueue_enqueue(taskqueue_thread, &pr->pr_task);
 2851         }
 2852 }
 2853 
 2854 static void
 2855 prison_free_not_last(struct prison *pr)
 2856 {
 2857 #ifdef INVARIANTS
 2858         int lastref;
 2859 
 2860         KASSERT(refcount_load(&pr->pr_ref) > 0,
 2861             ("Trying to free dead prison %p (jid=%d).",
 2862              pr, pr->pr_id));
 2863         lastref = refcount_release(&pr->pr_ref);
 2864         KASSERT(!lastref,
 2865             ("prison_free_not_last freed last ref on prison %p (jid=%d).",
 2866              pr, pr->pr_id));
 2867 #else
 2868         refcount_release(&pr->pr_ref);
 2869 #endif
 2870 }
 2871 
 2872 /*
 2873  * Hold a prison for user visibility, by incrementing pr_uref.
 2874  * It is generally an error to hold a prison that isn't already
 2875  * user-visible, except through the jail system calls.  It is also
 2876  * an error to hold an invalid prison.  A prison record will remain
 2877  * alive as long as it has at least one user reference, and will not
 2878  * be set to the dying state until the prison mutex and allprison_lock
 2879  * are both freed.
 2880  */
 2881 void
 2882 prison_proc_hold(struct prison *pr)
 2883 {
 2884 #ifdef INVARIANTS
 2885         int was_alive = refcount_acquire_if_not_zero(&pr->pr_uref);
 2886 
 2887         KASSERT(was_alive,
 2888             ("Cannot add a process to a non-alive prison (jid=%d)", pr->pr_id));
 2889 #else
 2890         refcount_acquire(&pr->pr_uref);
 2891 #endif
 2892 }
 2893 
 2894 /*
 2895  * Remove a prison user reference.  If it was the last reference, the
 2896  * prison will be considered "dying", and may be removed once all of
 2897  * its references are dropped.
 2898  */
 2899 void
 2900 prison_proc_free(struct prison *pr)
 2901 {
 2902 
 2903         /*
 2904          * Locking is only required when releasing the last reference.
 2905          * This allows assurance that a locked prison will remain alive
 2906          * until it is unlocked.
 2907          */
 2908         KASSERT(refcount_load(&pr->pr_uref) > 0,
 2909             ("Trying to kill a process in a dead prison (jid=%d)", pr->pr_id));
 2910         if (!refcount_release_if_not_last(&pr->pr_uref)) {
 2911                 /*
 2912                  * Don't remove the last user reference in this context,
 2913                  * which is expected to be a process that is not only locked,
 2914                  * but also half dead.  Add a reference so any calls to
 2915                  * prison_free() won't re-submit the task.
 2916                  */
 2917                 prison_hold(pr);
 2918                 mtx_lock(&pr->pr_mtx);
 2919                 KASSERT(!(pr->pr_flags & PR_COMPLETE_PROC),
 2920                     ("Redundant last reference in prison_proc_free (jid=%d)",
 2921                      pr->pr_id));
 2922                 pr->pr_flags |= PR_COMPLETE_PROC;
 2923                 mtx_unlock(&pr->pr_mtx);
 2924                 taskqueue_enqueue(taskqueue_thread, &pr->pr_task);
 2925         }
 2926 }
 2927 
 2928 static void
 2929 prison_proc_free_not_last(struct prison *pr)
 2930 {
 2931 #ifdef INVARIANTS
 2932         int lastref;
 2933 
 2934         KASSERT(refcount_load(&pr->pr_uref) > 0,
 2935             ("Trying to free dead prison %p (jid=%d).",
 2936              pr, pr->pr_id));
 2937         lastref = refcount_release(&pr->pr_uref);
 2938         KASSERT(!lastref,
 2939             ("prison_proc_free_not_last freed last uref on prison %p (jid=%d).",
 2940              pr, pr->pr_id));
 2941 #else
 2942         refcount_release(&pr->pr_uref);
 2943 #endif
 2944 }
 2945 
 2946 void
 2947 prison_proc_link(struct prison *pr, struct proc *p)
 2948 {
 2949 
 2950         sx_assert(&allproc_lock, SA_XLOCKED);
 2951         LIST_INSERT_HEAD(&pr->pr_proclist, p, p_jaillist);
 2952 }
 2953 
 2954 void
 2955 prison_proc_unlink(struct prison *pr, struct proc *p)
 2956 {
 2957 
 2958         sx_assert(&allproc_lock, SA_XLOCKED);
 2959         LIST_REMOVE(p, p_jaillist);
 2960 }
 2961 
 2962 static void
 2963 prison_proc_relink(struct prison *opr, struct prison *npr, struct proc *p)
 2964 {
 2965 
 2966         sx_xlock(&allproc_lock);
 2967         prison_proc_unlink(opr, p);
 2968         prison_proc_link(npr, p);
 2969         sx_xunlock(&allproc_lock);
 2970 }
 2971 
 2972 /*
 2973  * Complete a call to either prison_free or prison_proc_free.
 2974  */
 2975 static void
 2976 prison_complete(void *context, int pending)
 2977 {
 2978         struct prison *pr = context;
 2979         int drflags;
 2980 
 2981         /*
 2982          * This could be called to release the last reference, or the last
 2983          * user reference (plus the reference held in prison_proc_free).
 2984          */
 2985         drflags = prison_lock_xlock(pr, PD_DEREF);
 2986         if (pr->pr_flags & PR_COMPLETE_PROC) {
 2987                 pr->pr_flags &= ~PR_COMPLETE_PROC;
 2988                 drflags |= PD_DEUREF;
 2989         }
 2990         prison_deref(pr, drflags);
 2991 }
 2992 
 2993 static void
 2994 prison_kill_processes_cb(struct proc *p, void *arg __unused)
 2995 {
 2996 
 2997         kern_psignal(p, SIGKILL);
 2998 }
 2999 
 3000 /*
 3001  * Note the iteration does not guarantee acting on all processes.
 3002  * Most notably there may be fork or jail_attach in progress.
 3003  */
 3004 void
 3005 prison_proc_iterate(struct prison *pr, void (*cb)(struct proc *, void *),
 3006     void *cbarg)
 3007 {
 3008         struct prison *ppr;
 3009         struct proc *p;
 3010 
 3011         if (atomic_load_int(&pr->pr_childcount) == 0) {
 3012                 sx_slock(&allproc_lock);
 3013                 LIST_FOREACH(p, &pr->pr_proclist, p_jaillist) {
 3014                         if (p->p_state == PRS_NEW)
 3015                                 continue;
 3016                         PROC_LOCK(p);
 3017                         cb(p, cbarg);
 3018                         PROC_UNLOCK(p);
 3019                 }
 3020                 sx_sunlock(&allproc_lock);
 3021                 if (atomic_load_int(&pr->pr_childcount) == 0)
 3022                         return;
 3023                 /*
 3024                  * Some jails popped up during the iteration, fall through to a
 3025                  * system-wide search.
 3026                  */
 3027         }
 3028 
 3029         sx_slock(&allproc_lock);
 3030         FOREACH_PROC_IN_SYSTEM(p) {
 3031                 PROC_LOCK(p);
 3032                 if (p->p_state != PRS_NEW && p->p_ucred != NULL) {
 3033                         for (ppr = p->p_ucred->cr_prison;
 3034                             ppr != &prison0;
 3035                             ppr = ppr->pr_parent) {
 3036                                 if (ppr == pr) {
 3037                                         cb(p, cbarg);
 3038                                         break;
 3039                                 }
 3040                         }
 3041                 }
 3042                 PROC_UNLOCK(p);
 3043         }
 3044         sx_sunlock(&allproc_lock);
 3045 }
 3046 
 3047 /*
 3048  * Remove a prison reference and/or user reference (usually).
 3049  * This assumes context that allows sleeping (for allprison_lock),
 3050  * with no non-sleeping locks held, except perhaps the prison itself.
 3051  * If there are no more references, release and delist the prison.
 3052  * On completion, the prison lock and the allprison lock are both
 3053  * unlocked.
 3054  */
 3055 static void
 3056 prison_deref(struct prison *pr, int flags)
 3057 {
 3058         struct prisonlist freeprison;
 3059         struct prison *killpr, *rpr, *ppr, *tpr;
 3060 
 3061         killpr = NULL;
 3062         TAILQ_INIT(&freeprison);
 3063         /*
 3064          * Release this prison as requested, which may cause its parent
 3065          * to be released, and then maybe its grandparent, etc.
 3066          */
 3067         for (;;) {
 3068                 if (flags & PD_KILL) {
 3069                         /* Kill the prison and its descendents. */
 3070                         KASSERT(pr != &prison0,
 3071                             ("prison_deref trying to kill prison0"));
 3072                         if (!(flags & PD_DEREF)) {
 3073                                 prison_hold(pr);
 3074                                 flags |= PD_DEREF;
 3075                         }
 3076                         flags = prison_lock_xlock(pr, flags);
 3077                         prison_deref_kill(pr, &freeprison);
 3078                 }
 3079                 if (flags & PD_DEUREF) {
 3080                         /* Drop a user reference. */
 3081                         KASSERT(refcount_load(&pr->pr_uref) > 0,
 3082                             ("prison_deref PD_DEUREF on a dead prison (jid=%d)",
 3083                              pr->pr_id));
 3084                         if (!refcount_release_if_not_last(&pr->pr_uref)) {
 3085                                 if (!(flags & PD_DEREF)) {
 3086                                         prison_hold(pr);
 3087                                         flags |= PD_DEREF;
 3088                                 }
 3089                                 flags = prison_lock_xlock(pr, flags);
 3090                                 if (refcount_release(&pr->pr_uref) &&
 3091                                     pr->pr_state == PRISON_STATE_ALIVE) {
 3092                                         /*
 3093                                          * When the last user references goes,
 3094                                          * this becomes a dying prison.
 3095                                          */
 3096                                         KASSERT(
 3097                                             refcount_load(&prison0.pr_uref) > 0,
 3098                                             ("prison0 pr_uref=0"));
 3099                                         pr->pr_state = PRISON_STATE_DYING;
 3100                                         mtx_unlock(&pr->pr_mtx);
 3101                                         flags &= ~PD_LOCKED;
 3102                                         prison_cleanup(pr);
 3103                                 }
 3104                         }
 3105                 }
 3106                 if (flags & PD_KILL) {
 3107                         /*
 3108                          * Any remaining user references are probably processes
 3109                          * that need to be killed, either in this prison or its
 3110                          * descendants.
 3111                          */
 3112                         if (refcount_load(&pr->pr_uref) > 0)
 3113                                 killpr = pr;
 3114                         /* Make sure the parent prison doesn't get killed. */
 3115                         flags &= ~PD_KILL;
 3116                 }
 3117                 if (flags & PD_DEREF) {
 3118                         /* Drop a reference. */
 3119                         KASSERT(refcount_load(&pr->pr_ref) > 0,
 3120                             ("prison_deref PD_DEREF on a dead prison (jid=%d)",
 3121                              pr->pr_id));
 3122                         if (!refcount_release_if_not_last(&pr->pr_ref)) {
 3123                                 flags = prison_lock_xlock(pr, flags);
 3124                                 if (refcount_release(&pr->pr_ref)) {
 3125                                         /*
 3126                                          * When the last reference goes,
 3127                                          * unlink the prison and set it aside.
 3128                                          */
 3129                                         KASSERT(
 3130                                             refcount_load(&pr->pr_uref) == 0,
 3131                                             ("prison_deref: last ref, "
 3132                                              "but still has %d urefs (jid=%d)",
 3133                                              pr->pr_uref, pr->pr_id));
 3134                                         KASSERT(
 3135                                             refcount_load(&prison0.pr_ref) != 0,
 3136                                             ("prison0 pr_ref=0"));
 3137                                         pr->pr_state = PRISON_STATE_INVALID;
 3138                                         TAILQ_REMOVE(&allprison, pr, pr_list);
 3139                                         LIST_REMOVE(pr, pr_sibling);
 3140                                         TAILQ_INSERT_TAIL(&freeprison, pr,
 3141                                             pr_list);
 3142                                         for (ppr = pr->pr_parent;
 3143                                              ppr != NULL;
 3144                                              ppr = ppr->pr_parent)
 3145                                                 ppr->pr_childcount--;
 3146                                         /*
 3147                                          * Removing a prison frees references
 3148                                          * from its parent.
 3149                                          */
 3150                                         mtx_unlock(&pr->pr_mtx);
 3151                                         flags &= ~PD_LOCKED;
 3152                                         pr = pr->pr_parent;
 3153                                         flags |= PD_DEREF | PD_DEUREF;
 3154                                         continue;
 3155                                 }
 3156                         }
 3157                 }
 3158                 break;
 3159         }
 3160 
 3161         /* Release all the prison locks. */
 3162         if (flags & PD_LOCKED)
 3163                 mtx_unlock(&pr->pr_mtx);
 3164         if (flags & PD_LIST_SLOCKED)
 3165                 sx_sunlock(&allprison_lock);
 3166         else if (flags & PD_LIST_XLOCKED)
 3167                 sx_xunlock(&allprison_lock);
 3168 
 3169         /* Kill any processes attached to a killed prison. */
 3170         if (killpr != NULL)
 3171                 prison_proc_iterate(killpr, prison_kill_processes_cb, NULL);
 3172 
 3173         /*
 3174          * Finish removing any unreferenced prisons, which couldn't happen
 3175          * while allprison_lock was held (to avoid a LOR on vrele).
 3176          */
 3177         TAILQ_FOREACH_SAFE(rpr, &freeprison, pr_list, tpr) {
 3178 #ifdef VIMAGE
 3179                 if (rpr->pr_vnet != rpr->pr_parent->pr_vnet)
 3180                         vnet_destroy(rpr->pr_vnet);
 3181 #endif
 3182                 if (rpr->pr_root != NULL)
 3183                         vrele(rpr->pr_root);
 3184                 mtx_destroy(&rpr->pr_mtx);
 3185 #ifdef INET
 3186                 prison_ip_free(rpr->pr_addrs[PR_INET]);
 3187 #endif
 3188 #ifdef INET6
 3189                 prison_ip_free(rpr->pr_addrs[PR_INET6]);
 3190 #endif
 3191                 if (rpr->pr_cpuset != NULL)
 3192                         cpuset_rel(rpr->pr_cpuset);
 3193                 osd_jail_exit(rpr);
 3194 #ifdef RACCT
 3195                 if (racct_enable)
 3196                         prison_racct_detach(rpr);
 3197 #endif
 3198                 TAILQ_REMOVE(&freeprison, rpr, pr_list);
 3199                 free(rpr, M_PRISON);
 3200         }
 3201 }
 3202 
 3203 /*
 3204  * Kill the prison and its descendants.  Mark them as dying, clear the
 3205  * persist flag, and call module remove methods.
 3206  */
 3207 static void
 3208 prison_deref_kill(struct prison *pr, struct prisonlist *freeprison)
 3209 {
 3210         struct prison *cpr, *ppr, *rpr;
 3211         bool descend;
 3212 
 3213         /*
 3214          * Unlike the descendants, the target prison can be killed
 3215          * even if it is currently dying.  This is useful for failed
 3216          * creation in jail_set(2).
 3217          */
 3218         KASSERT(refcount_load(&pr->pr_ref) > 0,
 3219             ("Trying to kill dead prison %p (jid=%d).",
 3220              pr, pr->pr_id));
 3221         refcount_acquire(&pr->pr_uref);
 3222         pr->pr_state = PRISON_STATE_DYING;
 3223         mtx_unlock(&pr->pr_mtx);
 3224 
 3225         rpr = NULL;
 3226         FOREACH_PRISON_DESCENDANT_PRE_POST(pr, cpr, descend) {
 3227                 if (descend) {
 3228                         if (!prison_isalive(cpr)) {
 3229                                 descend = false;
 3230                                 continue;
 3231                         }
 3232                         prison_hold(cpr);
 3233                         prison_proc_hold(cpr);
 3234                         mtx_lock(&cpr->pr_mtx);
 3235                         cpr->pr_state = PRISON_STATE_DYING;
 3236                         cpr->pr_flags |= PR_REMOVE;
 3237                         mtx_unlock(&cpr->pr_mtx);
 3238                         continue;
 3239                 }
 3240                 if (!(cpr->pr_flags & PR_REMOVE))
 3241                         continue;
 3242                 prison_cleanup(cpr);
 3243                 mtx_lock(&cpr->pr_mtx);
 3244                 cpr->pr_flags &= ~PR_REMOVE;
 3245                 if (cpr->pr_flags & PR_PERSIST) {
 3246                         cpr->pr_flags &= ~PR_PERSIST;
 3247                         prison_proc_free_not_last(cpr);
 3248                         prison_free_not_last(cpr);
 3249                 }
 3250                 (void)refcount_release(&cpr->pr_uref);
 3251                 if (refcount_release(&cpr->pr_ref)) {
 3252                         /*
 3253                          * When the last reference goes, unlink the prison
 3254                          * and set it aside for prison_deref() to handle.
 3255                          * Delay unlinking the sibling list to keep the loop
 3256                          * safe.
 3257                          */
 3258                         if (rpr != NULL)
 3259                                 LIST_REMOVE(rpr, pr_sibling);
 3260                         rpr = cpr;
 3261                         rpr->pr_state = PRISON_STATE_INVALID;
 3262                         TAILQ_REMOVE(&allprison, rpr, pr_list);
 3263                         TAILQ_INSERT_TAIL(freeprison, rpr, pr_list);
 3264                         /*
 3265                          * Removing a prison frees references from its parent.
 3266                          */
 3267                         ppr = rpr->pr_parent;
 3268                         prison_proc_free_not_last(ppr);
 3269                         prison_free_not_last(ppr);
 3270                         for (; ppr != NULL; ppr = ppr->pr_parent)
 3271                                 ppr->pr_childcount--;
 3272                 }
 3273                 mtx_unlock(&cpr->pr_mtx);
 3274         }
 3275         if (rpr != NULL)
 3276                 LIST_REMOVE(rpr, pr_sibling);
 3277 
 3278         prison_cleanup(pr);
 3279         mtx_lock(&pr->pr_mtx);
 3280         if (pr->pr_flags & PR_PERSIST) {
 3281                 pr->pr_flags &= ~PR_PERSIST;
 3282                 prison_proc_free_not_last(pr);
 3283                 prison_free_not_last(pr);
 3284         }
 3285         (void)refcount_release(&pr->pr_uref);
 3286 }
 3287 
 3288 /*
 3289  * Given the current locking state in the flags, make sure allprison_lock
 3290  * is held exclusive, and the prison is locked.  Return flags indicating
 3291  * the new state.
 3292  */
 3293 static int
 3294 prison_lock_xlock(struct prison *pr, int flags)
 3295 {
 3296 
 3297         if (!(flags & PD_LIST_XLOCKED)) {
 3298                 /*
 3299                  * Get allprison_lock, which may be an upgrade,
 3300                  * and may require unlocking the prison.
 3301                  */
 3302                 if (flags & PD_LOCKED) {
 3303                         mtx_unlock(&pr->pr_mtx);
 3304                         flags &= ~PD_LOCKED;
 3305                 }
 3306                 if (flags & PD_LIST_SLOCKED) {
 3307                         if (!sx_try_upgrade(&allprison_lock)) {
 3308                                 sx_sunlock(&allprison_lock);
 3309                                 sx_xlock(&allprison_lock);
 3310                         }
 3311                         flags &= ~PD_LIST_SLOCKED;
 3312                 } else
 3313                         sx_xlock(&allprison_lock);
 3314                 flags |= PD_LIST_XLOCKED;
 3315         }
 3316         if (!(flags & PD_LOCKED)) {
 3317                 /* Lock the prison mutex. */
 3318                 mtx_lock(&pr->pr_mtx);
 3319                 flags |= PD_LOCKED;
 3320         }
 3321         return flags;
 3322 }
 3323 
 3324 /*
 3325  * Release a prison's resources when it starts dying (when the last user
 3326  * reference is dropped, or when it is killed).
 3327  */
 3328 static void
 3329 prison_cleanup(struct prison *pr)
 3330 {
 3331         sx_assert(&allprison_lock, SA_XLOCKED);
 3332         mtx_assert(&pr->pr_mtx, MA_NOTOWNED);
 3333         shm_remove_prison(pr);
 3334         (void)osd_jail_call(pr, PR_METHOD_REMOVE, NULL);
 3335 }
 3336 
 3337 /*
 3338  * Set or clear a permission bit in the pr_allow field, passing restrictions
 3339  * (cleared permission) down to child jails.
 3340  */
 3341 void
 3342 prison_set_allow(struct ucred *cred, unsigned flag, int enable)
 3343 {
 3344         struct prison *pr;
 3345 
 3346         pr = cred->cr_prison;
 3347         sx_slock(&allprison_lock);
 3348         mtx_lock(&pr->pr_mtx);
 3349         prison_set_allow_locked(pr, flag, enable);
 3350         mtx_unlock(&pr->pr_mtx);
 3351         sx_sunlock(&allprison_lock);
 3352 }
 3353 
 3354 static void
 3355 prison_set_allow_locked(struct prison *pr, unsigned flag, int enable)
 3356 {
 3357         struct prison *cpr;
 3358         int descend;
 3359 
 3360         if (enable != 0)
 3361                 pr->pr_allow |= flag;
 3362         else {
 3363                 pr->pr_allow &= ~flag;
 3364                 FOREACH_PRISON_DESCENDANT_LOCKED(pr, cpr, descend)
 3365                         cpr->pr_allow &= ~flag;
 3366         }
 3367 }
 3368 
 3369 /*
 3370  * Check if a jail supports the given address family.
 3371  *
 3372  * Returns 0 if not jailed or the address family is supported, EAFNOSUPPORT
 3373  * if not.
 3374  */
 3375 int
 3376 prison_check_af(struct ucred *cred, int af)
 3377 {
 3378         struct prison *pr;
 3379         int error;
 3380 
 3381         KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
 3382 
 3383         pr = cred->cr_prison;
 3384 #ifdef VIMAGE
 3385         /* Prisons with their own network stack are not limited. */
 3386         if (prison_owns_vnet(cred))
 3387                 return (0);
 3388 #endif
 3389 
 3390         error = 0;
 3391         switch (af)
 3392         {
 3393 #ifdef INET
 3394         case AF_INET:
 3395                 if (pr->pr_flags & PR_IP4)
 3396                 {
 3397                         mtx_lock(&pr->pr_mtx);
 3398                         if ((pr->pr_flags & PR_IP4) &&
 3399                             pr->pr_addrs[PR_INET] == NULL)
 3400                                 error = EAFNOSUPPORT;
 3401                         mtx_unlock(&pr->pr_mtx);
 3402                 }
 3403                 break;
 3404 #endif
 3405 #ifdef INET6
 3406         case AF_INET6:
 3407                 if (pr->pr_flags & PR_IP6)
 3408                 {
 3409                         mtx_lock(&pr->pr_mtx);
 3410                         if ((pr->pr_flags & PR_IP6) &&
 3411                             pr->pr_addrs[PR_INET6] == NULL)
 3412                                 error = EAFNOSUPPORT;
 3413                         mtx_unlock(&pr->pr_mtx);
 3414                 }
 3415                 break;
 3416 #endif
 3417         case AF_LOCAL:
 3418         case AF_ROUTE:
 3419                 break;
 3420         default:
 3421                 if (!(pr->pr_allow & PR_ALLOW_SOCKET_AF))
 3422                         error = EAFNOSUPPORT;
 3423         }
 3424         return (error);
 3425 }
 3426 
 3427 /*
 3428  * Check if given address belongs to the jail referenced by cred (wrapper to
 3429  * prison_check_ip[46]).
 3430  *
 3431  * Returns 0 if jail doesn't restrict the address family or if address belongs
 3432  * to jail, EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if
 3433  * the jail doesn't allow the address family.  IPv4 Address passed in in NBO.
 3434  */
 3435 int
 3436 prison_if(struct ucred *cred, const struct sockaddr *sa)
 3437 {
 3438 #ifdef INET
 3439         const struct sockaddr_in *sai;
 3440 #endif
 3441 #ifdef INET6
 3442         const struct sockaddr_in6 *sai6;
 3443 #endif
 3444         int error;
 3445 
 3446         KASSERT(cred != NULL, ("%s: cred is NULL", __func__));
 3447         KASSERT(sa != NULL, ("%s: sa is NULL", __func__));
 3448 
 3449 #ifdef VIMAGE
 3450         if (prison_owns_vnet(cred))
 3451                 return (0);
 3452 #endif
 3453 
 3454         error = 0;
 3455         switch (sa->sa_family)
 3456         {
 3457 #ifdef INET
 3458         case AF_INET:
 3459                 sai = (const struct sockaddr_in *)sa;
 3460                 error = prison_check_ip4(cred, &sai->sin_addr);
 3461                 break;
 3462 #endif
 3463 #ifdef INET6
 3464         case AF_INET6:
 3465                 sai6 = (const struct sockaddr_in6 *)sa;
 3466                 error = prison_check_ip6(cred, &sai6->sin6_addr);
 3467                 break;
 3468 #endif
 3469         default:
 3470                 if (!(cred->cr_prison->pr_allow & PR_ALLOW_SOCKET_AF))
 3471                         error = EAFNOSUPPORT;
 3472         }
 3473         return (error);
 3474 }
 3475 
 3476 /*
 3477  * Return 0 if jails permit p1 to frob p2, otherwise ESRCH.
 3478  */
 3479 int
 3480 prison_check(struct ucred *cred1, struct ucred *cred2)
 3481 {
 3482 
 3483         return ((cred1->cr_prison == cred2->cr_prison ||
 3484             prison_ischild(cred1->cr_prison, cred2->cr_prison)) ? 0 : ESRCH);
 3485 }
 3486 
 3487 /*
 3488  * For mountd/nfsd to run within a prison, it must be:
 3489  * - A vnet prison.
 3490  * - PR_ALLOW_NFSD must be set on it.
 3491  * - The root directory (pr_root) of the prison must be
 3492  *   a file system mount point, so the mountd can hang
 3493  *   export information on it.
 3494  */
 3495 bool
 3496 prison_check_nfsd(struct ucred *cred)
 3497 {
 3498 
 3499         if (jailed_without_vnet(cred))
 3500                 return (false);
 3501         if (!prison_allow(cred, PR_ALLOW_NFSD))
 3502                 return (false);
 3503         if ((cred->cr_prison->pr_root->v_vflag & VV_ROOT) == 0)
 3504                 return (false);
 3505         return (true);
 3506 }
 3507 
 3508 /*
 3509  * Return 1 if p2 is a child of p1, otherwise 0.
 3510  */
 3511 int
 3512 prison_ischild(struct prison *pr1, struct prison *pr2)
 3513 {
 3514 
 3515         for (pr2 = pr2->pr_parent; pr2 != NULL; pr2 = pr2->pr_parent)
 3516                 if (pr1 == pr2)
 3517                         return (1);
 3518         return (0);
 3519 }
 3520 
 3521 /*
 3522  * Return true if the prison is currently alive.  A prison is alive if it
 3523  * holds user references and it isn't being removed.
 3524  */
 3525 bool
 3526 prison_isalive(const struct prison *pr)
 3527 {
 3528 
 3529         if (__predict_false(pr->pr_state != PRISON_STATE_ALIVE))
 3530                 return (false);
 3531         return (true);
 3532 }
 3533 
 3534 /*
 3535  * Return true if the prison is currently valid.  A prison is valid if it has
 3536  * been fully created, and is not being destroyed.  Note that dying prisons
 3537  * are still considered valid.  Invalid prisons won't be found under normal
 3538  * circumstances, as they're only put in that state by functions that have
 3539  * an exclusive hold on allprison_lock.
 3540  */
 3541 bool
 3542 prison_isvalid(struct prison *pr)
 3543 {
 3544 
 3545         if (__predict_false(pr->pr_state == PRISON_STATE_INVALID))
 3546                 return (false);
 3547         if (__predict_false(refcount_load(&pr->pr_ref) == 0))
 3548                 return (false);
 3549         return (true);
 3550 }
 3551 
 3552 /*
 3553  * Return 1 if the passed credential is in a jail and that jail does not
 3554  * have its own virtual network stack, otherwise 0.
 3555  */
 3556 int
 3557 jailed_without_vnet(struct ucred *cred)
 3558 {
 3559 
 3560         if (!jailed(cred))
 3561                 return (0);
 3562 #ifdef VIMAGE
 3563         if (prison_owns_vnet(cred))
 3564                 return (0);
 3565 #endif
 3566 
 3567         return (1);
 3568 }
 3569 
 3570 /*
 3571  * Return the correct hostname (domainname, et al) for the passed credential.
 3572  */
 3573 void
 3574 getcredhostname(struct ucred *cred, char *buf, size_t size)
 3575 {
 3576         struct prison *pr;
 3577 
 3578         /*
 3579          * A NULL credential can be used to shortcut to the physical
 3580          * system's hostname.
 3581          */
 3582         pr = (cred != NULL) ? cred->cr_prison : &prison0;
 3583         mtx_lock(&pr->pr_mtx);
 3584         strlcpy(buf, pr->pr_hostname, size);
 3585         mtx_unlock(&pr->pr_mtx);
 3586 }
 3587 
 3588 void
 3589 getcreddomainname(struct ucred *cred, char *buf, size_t size)
 3590 {
 3591 
 3592         mtx_lock(&cred->cr_prison->pr_mtx);
 3593         strlcpy(buf, cred->cr_prison->pr_domainname, size);
 3594         mtx_unlock(&cred->cr_prison->pr_mtx);
 3595 }
 3596 
 3597 void
 3598 getcredhostuuid(struct ucred *cred, char *buf, size_t size)
 3599 {
 3600 
 3601         mtx_lock(&cred->cr_prison->pr_mtx);
 3602         strlcpy(buf, cred->cr_prison->pr_hostuuid, size);
 3603         mtx_unlock(&cred->cr_prison->pr_mtx);
 3604 }
 3605 
 3606 void
 3607 getcredhostid(struct ucred *cred, unsigned long *hostid)
 3608 {
 3609 
 3610         mtx_lock(&cred->cr_prison->pr_mtx);
 3611         *hostid = cred->cr_prison->pr_hostid;
 3612         mtx_unlock(&cred->cr_prison->pr_mtx);
 3613 }
 3614 
 3615 void
 3616 getjailname(struct ucred *cred, char *name, size_t len)
 3617 {
 3618 
 3619         mtx_lock(&cred->cr_prison->pr_mtx);
 3620         strlcpy(name, cred->cr_prison->pr_name, len);
 3621         mtx_unlock(&cred->cr_prison->pr_mtx);
 3622 }
 3623 
 3624 #ifdef VIMAGE
 3625 /*
 3626  * Determine whether the prison represented by cred owns
 3627  * its vnet rather than having it inherited.
 3628  *
 3629  * Returns 1 in case the prison owns the vnet, 0 otherwise.
 3630  */
 3631 int
 3632 prison_owns_vnet(struct ucred *cred)
 3633 {
 3634 
 3635         /*
 3636          * vnets cannot be added/removed after jail creation,
 3637          * so no need to lock here.
 3638          */
 3639         return (cred->cr_prison->pr_flags & PR_VNET ? 1 : 0);
 3640 }
 3641 #endif
 3642 
 3643 /*
 3644  * Determine whether the subject represented by cred can "see"
 3645  * status of a mount point.
 3646  * Returns: 0 for permitted, ENOENT otherwise.
 3647  * XXX: This function should be called cr_canseemount() and should be
 3648  *      placed in kern_prot.c.
 3649  */
 3650 int
 3651 prison_canseemount(struct ucred *cred, struct mount *mp)
 3652 {
 3653         struct prison *pr;
 3654         struct statfs *sp;
 3655         size_t len;
 3656 
 3657         pr = cred->cr_prison;
 3658         if (pr->pr_enforce_statfs == 0)
 3659                 return (0);
 3660         if (pr->pr_root->v_mount == mp)
 3661                 return (0);
 3662         if (pr->pr_enforce_statfs == 2)
 3663                 return (ENOENT);
 3664         /*
 3665          * If jail's chroot directory is set to "/" we should be able to see
 3666          * all mount-points from inside a jail.
 3667          * This is ugly check, but this is the only situation when jail's
 3668          * directory ends with '/'.
 3669          */
 3670         if (strcmp(pr->pr_path, "/") == 0)
 3671                 return (0);
 3672         len = strlen(pr->pr_path);
 3673         sp = &mp->mnt_stat;
 3674         if (strncmp(pr->pr_path, sp->f_mntonname, len) != 0)
 3675                 return (ENOENT);
 3676         /*
 3677          * Be sure that we don't have situation where jail's root directory
 3678          * is "/some/path" and mount point is "/some/pathpath".
 3679          */
 3680         if (sp->f_mntonname[len] != '\0' && sp->f_mntonname[len] != '/')
 3681                 return (ENOENT);
 3682         return (0);
 3683 }
 3684 
 3685 void
 3686 prison_enforce_statfs(struct ucred *cred, struct mount *mp, struct statfs *sp)
 3687 {
 3688         char jpath[MAXPATHLEN];
 3689         struct prison *pr;
 3690         size_t len;
 3691 
 3692         pr = cred->cr_prison;
 3693         if (pr->pr_enforce_statfs == 0)
 3694                 return;
 3695         if (prison_canseemount(cred, mp) != 0) {
 3696                 bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
 3697                 strlcpy(sp->f_mntonname, "[restricted]",
 3698                     sizeof(sp->f_mntonname));
 3699                 return;
 3700         }
 3701         if (pr->pr_root->v_mount == mp) {
 3702                 /*
 3703                  * Clear current buffer data, so we are sure nothing from
 3704                  * the valid path left there.
 3705                  */
 3706                 bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
 3707                 *sp->f_mntonname = '/';
 3708                 return;
 3709         }
 3710         /*
 3711          * If jail's chroot directory is set to "/" we should be able to see
 3712          * all mount-points from inside a jail.
 3713          */
 3714         if (strcmp(pr->pr_path, "/") == 0)
 3715                 return;
 3716         len = strlen(pr->pr_path);
 3717         strlcpy(jpath, sp->f_mntonname + len, sizeof(jpath));
 3718         /*
 3719          * Clear current buffer data, so we are sure nothing from
 3720          * the valid path left there.
 3721          */
 3722         bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
 3723         if (*jpath == '\0') {
 3724                 /* Should never happen. */
 3725                 *sp->f_mntonname = '/';
 3726         } else {
 3727                 strlcpy(sp->f_mntonname, jpath, sizeof(sp->f_mntonname));
 3728         }
 3729 }
 3730 
 3731 /*
 3732  * Check with permission for a specific privilege is granted within jail.  We
 3733  * have a specific list of accepted privileges; the rest are denied.
 3734  */
 3735 int
 3736 prison_priv_check(struct ucred *cred, int priv)
 3737 {
 3738         struct prison *pr;
 3739         int error;
 3740 
 3741         /*
 3742          * Some policies have custom handlers. This routine should not be
 3743          * called for them. See priv_check_cred().
 3744          */
 3745         switch (priv) {
 3746         case PRIV_VFS_LOOKUP:
 3747         case PRIV_VFS_GENERATION:
 3748                 KASSERT(0, ("prison_priv_check instead of a custom handler "
 3749                     "called for %d\n", priv));
 3750         }
 3751 
 3752         if (!jailed(cred))
 3753                 return (0);
 3754 
 3755 #ifdef VIMAGE
 3756         /*
 3757          * Privileges specific to prisons with a virtual network stack.
 3758          * There might be a duplicate entry here in case the privilege
 3759          * is only granted conditionally in the legacy jail case.
 3760          */
 3761         switch (priv) {
 3762                 /*
 3763                  * NFS-specific privileges.
 3764                  */
 3765         case PRIV_NFS_DAEMON:
 3766         case PRIV_VFS_GETFH:
 3767         case PRIV_VFS_MOUNT_EXPORTED:
 3768 #ifdef VNET_NFSD
 3769                 if (!prison_check_nfsd(cred))
 3770 #else
 3771                 printf("running nfsd in a prison requires a kernel "
 3772                     "built with ''options VNET_NFSD''\n");
 3773 #endif
 3774                         return (EPERM);
 3775 #ifdef notyet
 3776         case PRIV_NFS_LOCKD:
 3777 #endif
 3778                 /*
 3779                  * Network stack privileges.
 3780                  */
 3781         case PRIV_NET_BRIDGE:
 3782         case PRIV_NET_GRE:
 3783         case PRIV_NET_BPF:
 3784         case PRIV_NET_RAW:              /* Dup, cond. in legacy jail case. */
 3785         case PRIV_NET_ROUTE:
 3786         case PRIV_NET_TAP:
 3787         case PRIV_NET_SETIFMTU:
 3788         case PRIV_NET_SETIFFLAGS:
 3789         case PRIV_NET_SETIFCAP:
 3790         case PRIV_NET_SETIFDESCR:
 3791         case PRIV_NET_SETIFNAME :
 3792         case PRIV_NET_SETIFMETRIC:
 3793         case PRIV_NET_SETIFPHYS:
 3794         case PRIV_NET_SETIFMAC:
 3795         case PRIV_NET_SETLANPCP:
 3796         case PRIV_NET_ADDMULTI:
 3797         case PRIV_NET_DELMULTI:
 3798         case PRIV_NET_HWIOCTL:
 3799         case PRIV_NET_SETLLADDR:
 3800         case PRIV_NET_ADDIFGROUP:
 3801         case PRIV_NET_DELIFGROUP:
 3802         case PRIV_NET_IFCREATE:
 3803         case PRIV_NET_IFDESTROY:
 3804         case PRIV_NET_ADDIFADDR:
 3805         case PRIV_NET_DELIFADDR:
 3806         case PRIV_NET_LAGG:
 3807         case PRIV_NET_GIF:
 3808         case PRIV_NET_SETIFVNET:
 3809         case PRIV_NET_SETIFFIB:
 3810         case PRIV_NET_OVPN:
 3811         case PRIV_NET_ME:
 3812         case PRIV_NET_WG:
 3813 
 3814                 /*
 3815                  * 802.11-related privileges.
 3816                  */
 3817         case PRIV_NET80211_VAP_GETKEY:
 3818         case PRIV_NET80211_VAP_MANAGE:
 3819 
 3820 #ifdef notyet
 3821                 /*
 3822                  * ATM privileges.
 3823                  */
 3824         case PRIV_NETATM_CFG:
 3825         case PRIV_NETATM_ADD:
 3826         case PRIV_NETATM_DEL:
 3827         case PRIV_NETATM_SET:
 3828 
 3829                 /*
 3830                  * Bluetooth privileges.
 3831                  */
 3832         case PRIV_NETBLUETOOTH_RAW:
 3833 #endif
 3834 
 3835                 /*
 3836                  * Netgraph and netgraph module privileges.
 3837                  */
 3838         case PRIV_NETGRAPH_CONTROL:
 3839 #ifdef notyet
 3840         case PRIV_NETGRAPH_TTY:
 3841 #endif
 3842 
 3843                 /*
 3844                  * IPv4 and IPv6 privileges.
 3845                  */
 3846         case PRIV_NETINET_IPFW:
 3847         case PRIV_NETINET_DIVERT:
 3848         case PRIV_NETINET_PF:
 3849         case PRIV_NETINET_DUMMYNET:
 3850         case PRIV_NETINET_CARP:
 3851         case PRIV_NETINET_MROUTE:
 3852         case PRIV_NETINET_RAW:
 3853         case PRIV_NETINET_ADDRCTRL6:
 3854         case PRIV_NETINET_ND6:
 3855         case PRIV_NETINET_SCOPE6:
 3856         case PRIV_NETINET_ALIFETIME6:
 3857         case PRIV_NETINET_IPSEC:
 3858         case PRIV_NETINET_BINDANY:
 3859 
 3860 #ifdef notyet
 3861                 /*
 3862                  * NCP privileges.
 3863                  */
 3864         case PRIV_NETNCP:
 3865 
 3866                 /*
 3867                  * SMB privileges.
 3868                  */
 3869         case PRIV_NETSMB:
 3870 #endif
 3871 
 3872         /*
 3873          * No default: or deny here.
 3874          * In case of no permit fall through to next switch().
 3875          */
 3876                 if (cred->cr_prison->pr_flags & PR_VNET)
 3877                         return (0);
 3878         }
 3879 #endif /* VIMAGE */
 3880 
 3881         switch (priv) {
 3882                 /*
 3883                  * Allow ktrace privileges for root in jail.
 3884                  */
 3885         case PRIV_KTRACE:
 3886 
 3887 #if 0
 3888                 /*
 3889                  * Allow jailed processes to configure audit identity and
 3890                  * submit audit records (login, etc).  In the future we may
 3891                  * want to further refine the relationship between audit and
 3892                  * jail.
 3893                  */
 3894         case PRIV_AUDIT_GETAUDIT:
 3895         case PRIV_AUDIT_SETAUDIT:
 3896         case PRIV_AUDIT_SUBMIT:
 3897 #endif
 3898 
 3899                 /*
 3900                  * Allow jailed processes to manipulate process UNIX
 3901                  * credentials in any way they see fit.
 3902                  */
 3903         case PRIV_CRED_SETUID:
 3904         case PRIV_CRED_SETEUID:
 3905         case PRIV_CRED_SETGID:
 3906         case PRIV_CRED_SETEGID:
 3907         case PRIV_CRED_SETGROUPS:
 3908         case PRIV_CRED_SETREUID:
 3909         case PRIV_CRED_SETREGID:
 3910         case PRIV_CRED_SETRESUID:
 3911         case PRIV_CRED_SETRESGID:
 3912 
 3913                 /*
 3914                  * Jail implements visibility constraints already, so allow
 3915                  * jailed root to override uid/gid-based constraints.
 3916                  */
 3917         case PRIV_SEEOTHERGIDS:
 3918         case PRIV_SEEOTHERUIDS:
 3919 
 3920                 /*
 3921                  * Jail implements inter-process debugging limits already, so
 3922                  * allow jailed root various debugging privileges.
 3923                  */
 3924         case PRIV_DEBUG_DIFFCRED:
 3925         case PRIV_DEBUG_SUGID:
 3926         case PRIV_DEBUG_UNPRIV:
 3927 
 3928                 /*
 3929                  * Allow jail to set various resource limits and login
 3930                  * properties, and for now, exceed process resource limits.
 3931                  */
 3932         case PRIV_PROC_LIMIT:
 3933         case PRIV_PROC_SETLOGIN:
 3934         case PRIV_PROC_SETRLIMIT:
 3935 
 3936                 /*
 3937                  * System V and POSIX IPC privileges are granted in jail.
 3938                  */
 3939         case PRIV_IPC_READ:
 3940         case PRIV_IPC_WRITE:
 3941         case PRIV_IPC_ADMIN:
 3942         case PRIV_IPC_MSGSIZE:
 3943         case PRIV_MQ_ADMIN:
 3944 
 3945                 /*
 3946                  * Jail operations within a jail work on child jails.
 3947                  */
 3948         case PRIV_JAIL_ATTACH:
 3949         case PRIV_JAIL_SET:
 3950         case PRIV_JAIL_REMOVE:
 3951 
 3952                 /*
 3953                  * Jail implements its own inter-process limits, so allow
 3954                  * root processes in jail to change scheduling on other
 3955                  * processes in the same jail.  Likewise for signalling.
 3956                  */
 3957         case PRIV_SCHED_DIFFCRED:
 3958         case PRIV_SCHED_CPUSET:
 3959         case PRIV_SIGNAL_DIFFCRED:
 3960         case PRIV_SIGNAL_SUGID:
 3961 
 3962                 /*
 3963                  * Allow jailed processes to write to sysctls marked as jail
 3964                  * writable.
 3965                  */
 3966         case PRIV_SYSCTL_WRITEJAIL:
 3967 
 3968                 /*
 3969                  * Allow root in jail to manage a variety of quota
 3970                  * properties.  These should likely be conditional on a
 3971                  * configuration option.
 3972                  */
 3973         case PRIV_VFS_GETQUOTA:
 3974         case PRIV_VFS_SETQUOTA:
 3975 
 3976                 /*
 3977                  * Since Jail relies on chroot() to implement file system
 3978                  * protections, grant many VFS privileges to root in jail.
 3979                  * Be careful to exclude mount-related and NFS-related
 3980                  * privileges.
 3981                  */
 3982         case PRIV_VFS_READ:
 3983         case PRIV_VFS_WRITE:
 3984         case PRIV_VFS_ADMIN:
 3985         case PRIV_VFS_EXEC:
 3986         case PRIV_VFS_BLOCKRESERVE:     /* XXXRW: Slightly surprising. */
 3987         case PRIV_VFS_CHFLAGS_DEV:
 3988         case PRIV_VFS_CHOWN:
 3989         case PRIV_VFS_CHROOT:
 3990         case PRIV_VFS_RETAINSUGID:
 3991         case PRIV_VFS_FCHROOT:
 3992         case PRIV_VFS_LINK:
 3993         case PRIV_VFS_SETGID:
 3994         case PRIV_VFS_STAT:
 3995         case PRIV_VFS_STICKYFILE:
 3996 
 3997                 /*
 3998                  * As in the non-jail case, non-root users are expected to be
 3999                  * able to read kernel/physical memory (provided /dev/[k]mem
 4000                  * exists in the jail and they have permission to access it).
 4001                  */
 4002         case PRIV_KMEM_READ:
 4003                 return (0);
 4004 
 4005                 /*
 4006                  * Depending on the global setting, allow privilege of
 4007                  * setting system flags.
 4008                  */
 4009         case PRIV_VFS_SYSFLAGS:
 4010                 if (cred->cr_prison->pr_allow & PR_ALLOW_CHFLAGS)
 4011                         return (0);
 4012                 else
 4013                         return (EPERM);
 4014 
 4015                 /*
 4016                  * Depending on the global setting, allow privilege of
 4017                  * mounting/unmounting file systems.
 4018                  */
 4019         case PRIV_VFS_MOUNT:
 4020         case PRIV_VFS_UNMOUNT:
 4021         case PRIV_VFS_MOUNT_NONUSER:
 4022         case PRIV_VFS_MOUNT_OWNER:
 4023                 pr = cred->cr_prison;
 4024                 prison_lock(pr);
 4025                 if (pr->pr_allow & PR_ALLOW_MOUNT && pr->pr_enforce_statfs < 2)
 4026                         error = 0;
 4027                 else
 4028                         error = EPERM;
 4029                 prison_unlock(pr);
 4030                 return (error);
 4031 
 4032                 /*
 4033                  * Jails should hold no disposition on the PRIV_VFS_READ_DIR
 4034                  * policy.  priv_check_cred will not specifically allow it, and
 4035                  * we may want a MAC policy to allow it.
 4036                  */
 4037         case PRIV_VFS_READ_DIR:
 4038                 return (0);
 4039 
 4040                 /*
 4041                  * Conditionnaly allow locking (unlocking) physical pages
 4042                  * in memory.
 4043                  */
 4044         case PRIV_VM_MLOCK:
 4045         case PRIV_VM_MUNLOCK:
 4046                 if (cred->cr_prison->pr_allow & PR_ALLOW_MLOCK)
 4047                         return (0);
 4048                 else
 4049                         return (EPERM);
 4050 
 4051                 /*
 4052                  * Conditionally allow jailed root to bind reserved ports.
 4053                  */
 4054         case PRIV_NETINET_RESERVEDPORT:
 4055                 if (cred->cr_prison->pr_allow & PR_ALLOW_RESERVED_PORTS)
 4056                         return (0);
 4057                 else
 4058                         return (EPERM);
 4059 
 4060                 /*
 4061                  * Allow jailed root to reuse in-use ports.
 4062                  */
 4063         case PRIV_NETINET_REUSEPORT:
 4064                 return (0);
 4065 
 4066                 /*
 4067                  * Allow jailed root to set certain IPv4/6 (option) headers.
 4068                  */
 4069         case PRIV_NETINET_SETHDROPTS:
 4070                 return (0);
 4071 
 4072                 /*
 4073                  * Conditionally allow creating raw sockets in jail.
 4074                  */
 4075         case PRIV_NETINET_RAW:
 4076                 if (cred->cr_prison->pr_allow & PR_ALLOW_RAW_SOCKETS)
 4077                         return (0);
 4078                 else
 4079                         return (EPERM);
 4080 
 4081                 /*
 4082                  * Since jail implements its own visibility limits on netstat
 4083                  * sysctls, allow getcred.  This allows identd to work in
 4084                  * jail.
 4085                  */
 4086         case PRIV_NETINET_GETCRED:
 4087                 return (0);
 4088 
 4089                 /*
 4090                  * Allow jailed root to set loginclass.
 4091                  */
 4092         case PRIV_PROC_SETLOGINCLASS:
 4093                 return (0);
 4094 
 4095                 /*
 4096                  * Do not allow a process inside a jail to read the kernel
 4097                  * message buffer unless explicitly permitted.
 4098                  */
 4099         case PRIV_MSGBUF:
 4100                 if (cred->cr_prison->pr_allow & PR_ALLOW_READ_MSGBUF)
 4101                         return (0);
 4102                 return (EPERM);
 4103 
 4104         default:
 4105                 /*
 4106                  * In all remaining cases, deny the privilege request.  This
 4107                  * includes almost all network privileges, many system
 4108                  * configuration privileges.
 4109                  */
 4110                 return (EPERM);
 4111         }
 4112 }
 4113 
 4114 /*
 4115  * Return the part of pr2's name that is relative to pr1, or the whole name
 4116  * if it does not directly follow.
 4117  */
 4118 
 4119 char *
 4120 prison_name(struct prison *pr1, struct prison *pr2)
 4121 {
 4122         char *name;
 4123 
 4124         /* Jails see themselves as "" (if they see themselves at all). */
 4125         if (pr1 == pr2)
 4126                 return "";
 4127         name = pr2->pr_name;
 4128         if (prison_ischild(pr1, pr2)) {
 4129                 /*
 4130                  * pr1 isn't locked (and allprison_lock may not be either)
 4131                  * so its length can't be counted on.  But the number of dots
 4132                  * can be counted on - and counted.
 4133                  */
 4134                 for (; pr1 != &prison0; pr1 = pr1->pr_parent)
 4135                         name = strchr(name, '.') + 1;
 4136         }
 4137         return (name);
 4138 }
 4139 
 4140 /*
 4141  * Return the part of pr2's path that is relative to pr1, or the whole path
 4142  * if it does not directly follow.
 4143  */
 4144 static char *
 4145 prison_path(struct prison *pr1, struct prison *pr2)
 4146 {
 4147         char *path1, *path2;
 4148         int len1;
 4149 
 4150         path1 = pr1->pr_path;
 4151         path2 = pr2->pr_path;
 4152         if (!strcmp(path1, "/"))
 4153                 return (path2);
 4154         len1 = strlen(path1);
 4155         if (strncmp(path1, path2, len1))
 4156                 return (path2);
 4157         if (path2[len1] == '\0')
 4158                 return "/";
 4159         if (path2[len1] == '/')
 4160                 return (path2 + len1);
 4161         return (path2);
 4162 }
 4163 
 4164 /*
 4165  * Jail-related sysctls.
 4166  */
 4167 static SYSCTL_NODE(_security, OID_AUTO, jail, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
 4168     "Jails");
 4169 
 4170 #if defined(INET) || defined(INET6)
 4171 /*
 4172  * Copy address array to memory that would be then SYSCTL_OUT-ed.
 4173  * sysctl_jail_list() helper.
 4174  */
 4175 static void
 4176 prison_ip_copyout(struct prison *pr, const pr_family_t af, void **out, int *len)
 4177 {
 4178         const size_t size = pr_families[af].size;
 4179 
 4180  again:
 4181         mtx_assert(&pr->pr_mtx, MA_OWNED);
 4182         if (pr->pr_addrs[af] != NULL) {
 4183                 if (*len < pr->pr_addrs[af]->ips) {
 4184                         *len = pr->pr_addrs[af]->ips;
 4185                         mtx_unlock(&pr->pr_mtx);
 4186                         *out = realloc(*out, *len * size, M_TEMP, M_WAITOK);
 4187                         mtx_lock(&pr->pr_mtx);
 4188                         goto again;
 4189                 }
 4190                 bcopy(pr->pr_addrs[af] + 1, *out, pr->pr_addrs[af]->ips * size);
 4191         }
 4192 }
 4193 #endif
 4194 
 4195 static int
 4196 sysctl_jail_list(SYSCTL_HANDLER_ARGS)
 4197 {
 4198         struct xprison *xp;
 4199         struct prison *pr, *cpr;
 4200 #ifdef INET
 4201         struct in_addr *ip4 = NULL;
 4202         int ip4s = 0;
 4203 #endif
 4204 #ifdef INET6
 4205         struct in6_addr *ip6 = NULL;
 4206         int ip6s = 0;
 4207 #endif
 4208         int descend, error;
 4209 
 4210         xp = malloc(sizeof(*xp), M_TEMP, M_WAITOK);
 4211         pr = req->td->td_ucred->cr_prison;
 4212         error = 0;
 4213         sx_slock(&allprison_lock);
 4214         FOREACH_PRISON_DESCENDANT(pr, cpr, descend) {
 4215                 mtx_lock(&cpr->pr_mtx);
 4216 #ifdef INET
 4217                 prison_ip_copyout(cpr, PR_INET, (void **)&ip4, &ip4s);
 4218 #endif
 4219 #ifdef INET6
 4220                 prison_ip_copyout(cpr, PR_INET6, (void **)&ip6, &ip6s);
 4221 #endif
 4222                 bzero(xp, sizeof(*xp));
 4223                 xp->pr_version = XPRISON_VERSION;
 4224                 xp->pr_id = cpr->pr_id;
 4225                 xp->pr_state = cpr->pr_state;
 4226                 strlcpy(xp->pr_path, prison_path(pr, cpr), sizeof(xp->pr_path));
 4227                 strlcpy(xp->pr_host, cpr->pr_hostname, sizeof(xp->pr_host));
 4228                 strlcpy(xp->pr_name, prison_name(pr, cpr), sizeof(xp->pr_name));
 4229 #ifdef INET
 4230                 xp->pr_ip4s = ip4s;
 4231 #endif
 4232 #ifdef INET6
 4233                 xp->pr_ip6s = ip6s;
 4234 #endif
 4235                 mtx_unlock(&cpr->pr_mtx);
 4236                 error = SYSCTL_OUT(req, xp, sizeof(*xp));
 4237                 if (error)
 4238                         break;
 4239 #ifdef INET
 4240                 if (xp->pr_ip4s > 0) {
 4241                         error = SYSCTL_OUT(req, ip4,
 4242                             xp->pr_ip4s * sizeof(struct in_addr));
 4243                         if (error)
 4244                                 break;
 4245                 }
 4246 #endif
 4247 #ifdef INET6
 4248                 if (xp->pr_ip6s > 0) {
 4249                         error = SYSCTL_OUT(req, ip6,
 4250                             xp->pr_ip6s * sizeof(struct in6_addr));
 4251                         if (error)
 4252                                 break;
 4253                 }
 4254 #endif
 4255         }
 4256         sx_sunlock(&allprison_lock);
 4257         free(xp, M_TEMP);
 4258 #ifdef INET
 4259         free(ip4, M_TEMP);
 4260 #endif
 4261 #ifdef INET6
 4262         free(ip6, M_TEMP);
 4263 #endif
 4264         return (error);
 4265 }
 4266 
 4267 SYSCTL_OID(_security_jail, OID_AUTO, list,
 4268     CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
 4269     sysctl_jail_list, "S", "List of active jails");
 4270 
 4271 static int
 4272 sysctl_jail_jailed(SYSCTL_HANDLER_ARGS)
 4273 {
 4274         int error, injail;
 4275 
 4276         injail = jailed(req->td->td_ucred);
 4277         error = SYSCTL_OUT(req, &injail, sizeof(injail));
 4278 
 4279         return (error);
 4280 }
 4281 
 4282 SYSCTL_PROC(_security_jail, OID_AUTO, jailed,
 4283     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
 4284     sysctl_jail_jailed, "I", "Process in jail?");
 4285 
 4286 static int
 4287 sysctl_jail_vnet(SYSCTL_HANDLER_ARGS)
 4288 {
 4289         int error, havevnet;
 4290 #ifdef VIMAGE
 4291         struct ucred *cred = req->td->td_ucred;
 4292 
 4293         havevnet = jailed(cred) && prison_owns_vnet(cred);
 4294 #else
 4295         havevnet = 0;
 4296 #endif
 4297         error = SYSCTL_OUT(req, &havevnet, sizeof(havevnet));
 4298 
 4299         return (error);
 4300 }
 4301 
 4302 SYSCTL_PROC(_security_jail, OID_AUTO, vnet,
 4303     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
 4304     sysctl_jail_vnet, "I", "Jail owns vnet?");
 4305 
 4306 #if defined(INET) || defined(INET6)
 4307 SYSCTL_UINT(_security_jail, OID_AUTO, jail_max_af_ips, CTLFLAG_RW,
 4308     &jail_max_af_ips, 0,
 4309     "Number of IP addresses a jail may have at most per address family (deprecated)");
 4310 #endif
 4311 
 4312 /*
 4313  * Default parameters for jail(2) compatibility.  For historical reasons,
 4314  * the sysctl names have varying similarity to the parameter names.  Prisons
 4315  * just see their own parameters, and can't change them.
 4316  */
 4317 static int
 4318 sysctl_jail_default_allow(SYSCTL_HANDLER_ARGS)
 4319 {
 4320         int error, i;
 4321 
 4322         /* Get the current flag value, and convert it to a boolean. */
 4323         if (req->td->td_ucred->cr_prison == &prison0) {
 4324                 mtx_lock(&prison0.pr_mtx);
 4325                 i = (jail_default_allow & arg2) != 0;
 4326                 mtx_unlock(&prison0.pr_mtx);
 4327         } else
 4328                 i = prison_allow(req->td->td_ucred, arg2);
 4329 
 4330         if (arg1 != NULL)
 4331                 i = !i;
 4332         error = sysctl_handle_int(oidp, &i, 0, req);
 4333         if (error || !req->newptr)
 4334                 return (error);
 4335         i = i ? arg2 : 0;
 4336         if (arg1 != NULL)
 4337                 i ^= arg2;
 4338         /*
 4339          * The sysctls don't have CTLFLAGS_PRISON, so assume prison0
 4340          * for writing.
 4341          */
 4342         mtx_lock(&prison0.pr_mtx);
 4343         jail_default_allow = (jail_default_allow & ~arg2) | i;
 4344         mtx_unlock(&prison0.pr_mtx);
 4345         return (0);
 4346 }
 4347 
 4348 SYSCTL_PROC(_security_jail, OID_AUTO, set_hostname_allowed,
 4349     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
 4350     NULL, PR_ALLOW_SET_HOSTNAME, sysctl_jail_default_allow, "I",
 4351     "Processes in jail can set their hostnames (deprecated)");
 4352 SYSCTL_PROC(_security_jail, OID_AUTO, socket_unixiproute_only,
 4353     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
 4354     (void *)1, PR_ALLOW_SOCKET_AF, sysctl_jail_default_allow, "I",
 4355     "Processes in jail are limited to creating UNIX/IP/route sockets only (deprecated)");
 4356 SYSCTL_PROC(_security_jail, OID_AUTO, sysvipc_allowed,
 4357     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
 4358     NULL, PR_ALLOW_SYSVIPC, sysctl_jail_default_allow, "I",
 4359     "Processes in jail can use System V IPC primitives (deprecated)");
 4360 SYSCTL_PROC(_security_jail, OID_AUTO, allow_raw_sockets,
 4361     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
 4362     NULL, PR_ALLOW_RAW_SOCKETS, sysctl_jail_default_allow, "I",
 4363     "Prison root can create raw sockets (deprecated)");
 4364 SYSCTL_PROC(_security_jail, OID_AUTO, chflags_allowed,
 4365     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
 4366     NULL, PR_ALLOW_CHFLAGS, sysctl_jail_default_allow, "I",
 4367     "Processes in jail can alter system file flags (deprecated)");
 4368 SYSCTL_PROC(_security_jail, OID_AUTO, mount_allowed,
 4369     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
 4370     NULL, PR_ALLOW_MOUNT, sysctl_jail_default_allow, "I",
 4371     "Processes in jail can mount/unmount jail-friendly file systems (deprecated)");
 4372 
 4373 static int
 4374 sysctl_jail_default_level(SYSCTL_HANDLER_ARGS)
 4375 {
 4376         struct prison *pr;
 4377         int level, error;
 4378 
 4379         pr = req->td->td_ucred->cr_prison;
 4380         level = (pr == &prison0) ? *(int *)arg1 : *(int *)((char *)pr + arg2);
 4381         error = sysctl_handle_int(oidp, &level, 0, req);
 4382         if (error || !req->newptr)
 4383                 return (error);
 4384         *(int *)arg1 = level;
 4385         return (0);
 4386 }
 4387 
 4388 SYSCTL_PROC(_security_jail, OID_AUTO, enforce_statfs,
 4389     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
 4390     &jail_default_enforce_statfs, offsetof(struct prison, pr_enforce_statfs),
 4391     sysctl_jail_default_level, "I",
 4392     "Processes in jail cannot see all mounted file systems (deprecated)");
 4393 
 4394 SYSCTL_PROC(_security_jail, OID_AUTO, devfs_ruleset,
 4395     CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE,
 4396     &jail_default_devfs_rsnum, offsetof(struct prison, pr_devfs_rsnum),
 4397     sysctl_jail_default_level, "I",
 4398     "Ruleset for the devfs filesystem in jail (deprecated)");
 4399 
 4400 /*
 4401  * Nodes to describe jail parameters.  Maximum length of string parameters
 4402  * is returned in the string itself, and the other parameters exist merely
 4403  * to make themselves and their types known.
 4404  */
 4405 SYSCTL_NODE(_security_jail, OID_AUTO, param, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
 4406     "Jail parameters");
 4407 
 4408 int
 4409 sysctl_jail_param(SYSCTL_HANDLER_ARGS)
 4410 {
 4411         int i;
 4412         long l;
 4413         size_t s;
 4414         char numbuf[12];
 4415 
 4416         switch (oidp->oid_kind & CTLTYPE)
 4417         {
 4418         case CTLTYPE_LONG:
 4419         case CTLTYPE_ULONG:
 4420                 l = 0;
 4421 #ifdef SCTL_MASK32
 4422                 if (!(req->flags & SCTL_MASK32))
 4423 #endif
 4424                         return (SYSCTL_OUT(req, &l, sizeof(l)));
 4425         case CTLTYPE_INT:
 4426         case CTLTYPE_UINT:
 4427                 i = 0;
 4428                 return (SYSCTL_OUT(req, &i, sizeof(i)));
 4429         case CTLTYPE_STRING:
 4430                 snprintf(numbuf, sizeof(numbuf), "%jd", (intmax_t)arg2);
 4431                 return
 4432                     (sysctl_handle_string(oidp, numbuf, sizeof(numbuf), req));
 4433         case CTLTYPE_STRUCT:
 4434                 s = (size_t)arg2;
 4435                 return (SYSCTL_OUT(req, &s, sizeof(s)));
 4436         }
 4437         return (0);
 4438 }
 4439 
 4440 /*
 4441  * CTLFLAG_RDTUN in the following indicates jail parameters that can be set at
 4442  * jail creation time but cannot be changed in an existing jail.
 4443  */
 4444 SYSCTL_JAIL_PARAM(, jid, CTLTYPE_INT | CTLFLAG_RDTUN, "I", "Jail ID");
 4445 SYSCTL_JAIL_PARAM(, parent, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail parent ID");
 4446 SYSCTL_JAIL_PARAM_STRING(, name, CTLFLAG_RW, MAXHOSTNAMELEN, "Jail name");
 4447 SYSCTL_JAIL_PARAM_STRING(, path, CTLFLAG_RDTUN, MAXPATHLEN, "Jail root path");
 4448 SYSCTL_JAIL_PARAM(, securelevel, CTLTYPE_INT | CTLFLAG_RW,
 4449     "I", "Jail secure level");
 4450 SYSCTL_JAIL_PARAM(, osreldate, CTLTYPE_INT | CTLFLAG_RDTUN, "I",
 4451     "Jail value for kern.osreldate and uname -K");
 4452 SYSCTL_JAIL_PARAM_STRING(, osrelease, CTLFLAG_RDTUN, OSRELEASELEN,
 4453     "Jail value for kern.osrelease and uname -r");
 4454 SYSCTL_JAIL_PARAM(, enforce_statfs, CTLTYPE_INT | CTLFLAG_RW,
 4455     "I", "Jail cannot see all mounted file systems");
 4456 SYSCTL_JAIL_PARAM(, devfs_ruleset, CTLTYPE_INT | CTLFLAG_RW,
 4457     "I", "Ruleset for in-jail devfs mounts");
 4458 SYSCTL_JAIL_PARAM(, persist, CTLTYPE_INT | CTLFLAG_RW,
 4459     "B", "Jail persistence");
 4460 #ifdef VIMAGE
 4461 SYSCTL_JAIL_PARAM(, vnet, CTLTYPE_INT | CTLFLAG_RDTUN,
 4462     "E,jailsys", "Virtual network stack");
 4463 #endif
 4464 SYSCTL_JAIL_PARAM(, dying, CTLTYPE_INT | CTLFLAG_RD,
 4465     "B", "Jail is in the process of shutting down");
 4466 
 4467 SYSCTL_JAIL_PARAM_NODE(children, "Number of child jails");
 4468 SYSCTL_JAIL_PARAM(_children, cur, CTLTYPE_INT | CTLFLAG_RD,
 4469     "I", "Current number of child jails");
 4470 SYSCTL_JAIL_PARAM(_children, max, CTLTYPE_INT | CTLFLAG_RW,
 4471     "I", "Maximum number of child jails");
 4472 
 4473 SYSCTL_JAIL_PARAM_SYS_NODE(host, CTLFLAG_RW, "Jail host info");
 4474 SYSCTL_JAIL_PARAM_STRING(_host, hostname, CTLFLAG_RW, MAXHOSTNAMELEN,
 4475     "Jail hostname");
 4476 SYSCTL_JAIL_PARAM_STRING(_host, domainname, CTLFLAG_RW, MAXHOSTNAMELEN,
 4477     "Jail NIS domainname");
 4478 SYSCTL_JAIL_PARAM_STRING(_host, hostuuid, CTLFLAG_RW, HOSTUUIDLEN,
 4479     "Jail host UUID");
 4480 SYSCTL_JAIL_PARAM(_host, hostid, CTLTYPE_ULONG | CTLFLAG_RW,
 4481     "LU", "Jail host ID");
 4482 
 4483 SYSCTL_JAIL_PARAM_NODE(cpuset, "Jail cpuset");
 4484 SYSCTL_JAIL_PARAM(_cpuset, id, CTLTYPE_INT | CTLFLAG_RD, "I", "Jail cpuset ID");
 4485 
 4486 #ifdef INET
 4487 SYSCTL_JAIL_PARAM_SYS_NODE(ip4, CTLFLAG_RDTUN,
 4488     "Jail IPv4 address virtualization");
 4489 SYSCTL_JAIL_PARAM_STRUCT(_ip4, addr, CTLFLAG_RW, sizeof(struct in_addr),
 4490     "S,in_addr,a", "Jail IPv4 addresses");
 4491 SYSCTL_JAIL_PARAM(_ip4, saddrsel, CTLTYPE_INT | CTLFLAG_RW,
 4492     "B", "Do (not) use IPv4 source address selection rather than the "
 4493     "primary jail IPv4 address.");
 4494 #endif
 4495 #ifdef INET6
 4496 SYSCTL_JAIL_PARAM_SYS_NODE(ip6, CTLFLAG_RDTUN,
 4497     "Jail IPv6 address virtualization");
 4498 SYSCTL_JAIL_PARAM_STRUCT(_ip6, addr, CTLFLAG_RW, sizeof(struct in6_addr),
 4499     "S,in6_addr,a", "Jail IPv6 addresses");
 4500 SYSCTL_JAIL_PARAM(_ip6, saddrsel, CTLTYPE_INT | CTLFLAG_RW,
 4501     "B", "Do (not) use IPv6 source address selection rather than the "
 4502     "primary jail IPv6 address.");
 4503 #endif
 4504 
 4505 SYSCTL_JAIL_PARAM_NODE(allow, "Jail permission flags");
 4506 SYSCTL_JAIL_PARAM(_allow, set_hostname, CTLTYPE_INT | CTLFLAG_RW,
 4507     "B", "Jail may set hostname");
 4508 SYSCTL_JAIL_PARAM(_allow, sysvipc, CTLTYPE_INT | CTLFLAG_RW,
 4509     "B", "Jail may use SYSV IPC");
 4510 SYSCTL_JAIL_PARAM(_allow, raw_sockets, CTLTYPE_INT | CTLFLAG_RW,
 4511     "B", "Jail may create raw sockets");
 4512 SYSCTL_JAIL_PARAM(_allow, chflags, CTLTYPE_INT | CTLFLAG_RW,
 4513     "B", "Jail may alter system file flags");
 4514 SYSCTL_JAIL_PARAM(_allow, quotas, CTLTYPE_INT | CTLFLAG_RW,
 4515     "B", "Jail may set file quotas");
 4516 SYSCTL_JAIL_PARAM(_allow, socket_af, CTLTYPE_INT | CTLFLAG_RW,
 4517     "B", "Jail may create sockets other than just UNIX/IPv4/IPv6/route");
 4518 SYSCTL_JAIL_PARAM(_allow, mlock, CTLTYPE_INT | CTLFLAG_RW,
 4519     "B", "Jail may lock (unlock) physical pages in memory");
 4520 SYSCTL_JAIL_PARAM(_allow, reserved_ports, CTLTYPE_INT | CTLFLAG_RW,
 4521     "B", "Jail may bind sockets to reserved ports");
 4522 SYSCTL_JAIL_PARAM(_allow, read_msgbuf, CTLTYPE_INT | CTLFLAG_RW,
 4523     "B", "Jail may read the kernel message buffer");
 4524 SYSCTL_JAIL_PARAM(_allow, unprivileged_proc_debug, CTLTYPE_INT | CTLFLAG_RW,
 4525     "B", "Unprivileged processes may use process debugging facilities");
 4526 SYSCTL_JAIL_PARAM(_allow, suser, CTLTYPE_INT | CTLFLAG_RW,
 4527     "B", "Processes in jail with uid 0 have privilege");
 4528 #if defined(VNET_NFSD) && defined(VIMAGE) && defined(NFSD)
 4529 SYSCTL_JAIL_PARAM(_allow, nfsd, CTLTYPE_INT | CTLFLAG_RW,
 4530     "B", "Mountd/nfsd may run in the jail");
 4531 #endif
 4532 
 4533 SYSCTL_JAIL_PARAM_SUBNODE(allow, mount, "Jail mount/unmount permission flags");
 4534 SYSCTL_JAIL_PARAM(_allow_mount, , CTLTYPE_INT | CTLFLAG_RW,
 4535     "B", "Jail may mount/unmount jail-friendly file systems in general");
 4536 
 4537 /*
 4538  * Add a dynamic parameter allow.<name>, or allow.<prefix>.<name>.  Return
 4539  * its associated bit in the pr_allow bitmask, or zero if the parameter was
 4540  * not created.
 4541  */
 4542 unsigned
 4543 prison_add_allow(const char *prefix, const char *name, const char *prefix_descr,
 4544     const char *descr)
 4545 {
 4546         struct bool_flags *bf;
 4547         struct sysctl_oid *parent;
 4548         char *allow_name, *allow_noname, *allowed;
 4549 #ifndef NO_SYSCTL_DESCR
 4550         char *descr_deprecated;
 4551 #endif
 4552         u_int allow_flag;
 4553 
 4554         if (prefix
 4555             ? asprintf(&allow_name, M_PRISON, "allow.%s.%s", prefix, name)
 4556                 < 0 ||
 4557               asprintf(&allow_noname, M_PRISON, "allow.%s.no%s", prefix, name)
 4558                 < 0
 4559             : asprintf(&allow_name, M_PRISON, "allow.%s", name) < 0 ||
 4560               asprintf(&allow_noname, M_PRISON, "allow.no%s", name) < 0) {
 4561                 free(allow_name, M_PRISON);
 4562                 return 0;
 4563         }
 4564 
 4565         /*
 4566          * See if this parameter has already beed added, i.e. a module was
 4567          * previously loaded/unloaded.
 4568          */
 4569         mtx_lock(&prison0.pr_mtx);
 4570         for (bf = pr_flag_allow;
 4571              bf < pr_flag_allow + nitems(pr_flag_allow) &&
 4572                 atomic_load_int(&bf->flag) != 0;
 4573              bf++) {
 4574                 if (strcmp(bf->name, allow_name) == 0) {
 4575                         allow_flag = bf->flag;
 4576                         goto no_add;
 4577                 }
 4578         }
 4579 
 4580         /*
 4581          * Find a free bit in pr_allow_all, failing if there are none
 4582          * (which shouldn't happen as long as we keep track of how many
 4583          * potential dynamic flags exist).
 4584          */
 4585         for (allow_flag = 1;; allow_flag <<= 1) {
 4586                 if (allow_flag == 0)
 4587                         goto no_add;
 4588                 if ((pr_allow_all & allow_flag) == 0)
 4589                         break;
 4590         }
 4591 
 4592         /* Note the parameter in the next open slot in pr_flag_allow. */
 4593         for (bf = pr_flag_allow; ; bf++) {
 4594                 if (bf == pr_flag_allow + nitems(pr_flag_allow)) {
 4595                         /* This should never happen, but is not fatal. */
 4596                         allow_flag = 0;
 4597                         goto no_add;
 4598                 }
 4599                 if (atomic_load_int(&bf->flag) == 0)
 4600                         break;
 4601         }
 4602         bf->name = allow_name;
 4603         bf->noname = allow_noname;
 4604         pr_allow_all |= allow_flag;
 4605         /*
 4606          * prison0 always has permission for the new parameter.
 4607          * Other jails must have it granted to them.
 4608          */
 4609         prison0.pr_allow |= allow_flag;
 4610         /* The flag indicates a valid entry, so make sure it is set last. */
 4611         atomic_store_rel_int(&bf->flag, allow_flag);
 4612         mtx_unlock(&prison0.pr_mtx);
 4613 
 4614         /*
 4615          * Create sysctls for the parameter, and the back-compat global
 4616          * permission.
 4617          */
 4618         parent = prefix
 4619             ? SYSCTL_ADD_NODE(NULL,
 4620                   SYSCTL_CHILDREN(&sysctl___security_jail_param_allow),
 4621                   OID_AUTO, prefix, CTLFLAG_MPSAFE, 0, prefix_descr)
 4622             : &sysctl___security_jail_param_allow;
 4623         (void)SYSCTL_ADD_PROC(NULL, SYSCTL_CHILDREN(parent), OID_AUTO,
 4624             name, CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
 4625             NULL, 0, sysctl_jail_param, "B", descr);
 4626         if ((prefix
 4627              ? asprintf(&allowed, M_TEMP, "%s_%s_allowed", prefix, name)
 4628              : asprintf(&allowed, M_TEMP, "%s_allowed", name)) >= 0) {
 4629 #ifndef NO_SYSCTL_DESCR
 4630                 (void)asprintf(&descr_deprecated, M_TEMP, "%s (deprecated)",
 4631                     descr);
 4632 #endif
 4633                 (void)SYSCTL_ADD_PROC(NULL,
 4634                     SYSCTL_CHILDREN(&sysctl___security_jail), OID_AUTO, allowed,
 4635                     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, allow_flag,
 4636                     sysctl_jail_default_allow, "I", descr_deprecated);
 4637 #ifndef NO_SYSCTL_DESCR
 4638                 free(descr_deprecated, M_TEMP);
 4639 #endif
 4640                 free(allowed, M_TEMP);
 4641         }
 4642         return allow_flag;
 4643 
 4644  no_add:
 4645         mtx_unlock(&prison0.pr_mtx);
 4646         free(allow_name, M_PRISON);
 4647         free(allow_noname, M_PRISON);
 4648         return allow_flag;
 4649 }
 4650 
 4651 /*
 4652  * The VFS system will register jail-aware filesystems here.  They each get
 4653  * a parameter allow.mount.xxxfs and a flag to check when a jailed user
 4654  * attempts to mount.
 4655  */
 4656 void
 4657 prison_add_vfs(struct vfsconf *vfsp)
 4658 {
 4659 #ifdef NO_SYSCTL_DESCR
 4660 
 4661         vfsp->vfc_prison_flag = prison_add_allow("mount", vfsp->vfc_name,
 4662             NULL, NULL);
 4663 #else
 4664         char *descr;
 4665 
 4666         (void)asprintf(&descr, M_TEMP, "Jail may mount the %s file system",
 4667             vfsp->vfc_name);
 4668         vfsp->vfc_prison_flag = prison_add_allow("mount", vfsp->vfc_name,
 4669             NULL, descr);
 4670         free(descr, M_TEMP);
 4671 #endif
 4672 }
 4673 
 4674 #ifdef RACCT
 4675 void
 4676 prison_racct_foreach(void (*callback)(struct racct *racct,
 4677     void *arg2, void *arg3), void (*pre)(void), void (*post)(void),
 4678     void *arg2, void *arg3)
 4679 {
 4680         struct prison_racct *prr;
 4681 
 4682         ASSERT_RACCT_ENABLED();
 4683 
 4684         sx_slock(&allprison_lock);
 4685         if (pre != NULL)
 4686                 (pre)();
 4687         LIST_FOREACH(prr, &allprison_racct, prr_next)
 4688                 (callback)(prr->prr_racct, arg2, arg3);
 4689         if (post != NULL)
 4690                 (post)();
 4691         sx_sunlock(&allprison_lock);
 4692 }
 4693 
 4694 static struct prison_racct *
 4695 prison_racct_find_locked(const char *name)
 4696 {
 4697         struct prison_racct *prr;
 4698 
 4699         ASSERT_RACCT_ENABLED();
 4700         sx_assert(&allprison_lock, SA_XLOCKED);
 4701 
 4702         if (name[0] == '\0' || strlen(name) >= MAXHOSTNAMELEN)
 4703                 return (NULL);
 4704 
 4705         LIST_FOREACH(prr, &allprison_racct, prr_next) {
 4706                 if (strcmp(name, prr->prr_name) != 0)
 4707                         continue;
 4708 
 4709                 /* Found prison_racct with a matching name? */
 4710                 prison_racct_hold(prr);
 4711                 return (prr);
 4712         }
 4713 
 4714         /* Add new prison_racct. */
 4715         prr = malloc(sizeof(*prr), M_PRISON_RACCT, M_ZERO | M_WAITOK);
 4716         racct_create(&prr->prr_racct);
 4717 
 4718         strcpy(prr->prr_name, name);
 4719         refcount_init(&prr->prr_refcount, 1);
 4720         LIST_INSERT_HEAD(&allprison_racct, prr, prr_next);
 4721 
 4722         return (prr);
 4723 }
 4724 
 4725 struct prison_racct *
 4726 prison_racct_find(const char *name)
 4727 {
 4728         struct prison_racct *prr;
 4729 
 4730         ASSERT_RACCT_ENABLED();
 4731 
 4732         sx_xlock(&allprison_lock);
 4733         prr = prison_racct_find_locked(name);
 4734         sx_xunlock(&allprison_lock);
 4735         return (prr);
 4736 }
 4737 
 4738 void
 4739 prison_racct_hold(struct prison_racct *prr)
 4740 {
 4741 
 4742         ASSERT_RACCT_ENABLED();
 4743 
 4744         refcount_acquire(&prr->prr_refcount);
 4745 }
 4746 
 4747 static void
 4748 prison_racct_free_locked(struct prison_racct *prr)
 4749 {
 4750 
 4751         ASSERT_RACCT_ENABLED();
 4752         sx_assert(&allprison_lock, SA_XLOCKED);
 4753 
 4754         if (refcount_release(&prr->prr_refcount)) {
 4755                 racct_destroy(&prr->prr_racct);
 4756                 LIST_REMOVE(prr, prr_next);
 4757                 free(prr, M_PRISON_RACCT);
 4758         }
 4759 }
 4760 
 4761 void
 4762 prison_racct_free(struct prison_racct *prr)
 4763 {
 4764 
 4765         ASSERT_RACCT_ENABLED();
 4766         sx_assert(&allprison_lock, SA_UNLOCKED);
 4767 
 4768         if (refcount_release_if_not_last(&prr->prr_refcount))
 4769                 return;
 4770 
 4771         sx_xlock(&allprison_lock);
 4772         prison_racct_free_locked(prr);
 4773         sx_xunlock(&allprison_lock);
 4774 }
 4775 
 4776 static void
 4777 prison_racct_attach(struct prison *pr)
 4778 {
 4779         struct prison_racct *prr;
 4780 
 4781         ASSERT_RACCT_ENABLED();
 4782         sx_assert(&allprison_lock, SA_XLOCKED);
 4783 
 4784         prr = prison_racct_find_locked(pr->pr_name);
 4785         KASSERT(prr != NULL, ("cannot find prison_racct"));
 4786 
 4787         pr->pr_prison_racct = prr;
 4788 }
 4789 
 4790 /*
 4791  * Handle jail renaming.  From the racct point of view, renaming means
 4792  * moving from one prison_racct to another.
 4793  */
 4794 static void
 4795 prison_racct_modify(struct prison *pr)
 4796 {
 4797 #ifdef RCTL
 4798         struct proc *p;
 4799         struct ucred *cred;
 4800 #endif
 4801         struct prison_racct *oldprr;
 4802 
 4803         ASSERT_RACCT_ENABLED();
 4804 
 4805         sx_slock(&allproc_lock);
 4806         sx_xlock(&allprison_lock);
 4807 
 4808         if (strcmp(pr->pr_name, pr->pr_prison_racct->prr_name) == 0) {
 4809                 sx_xunlock(&allprison_lock);
 4810                 sx_sunlock(&allproc_lock);
 4811                 return;
 4812         }
 4813 
 4814         oldprr = pr->pr_prison_racct;
 4815         pr->pr_prison_racct = NULL;
 4816 
 4817         prison_racct_attach(pr);
 4818 
 4819         /*
 4820          * Move resource utilisation records.
 4821          */
 4822         racct_move(pr->pr_prison_racct->prr_racct, oldprr->prr_racct);
 4823 
 4824 #ifdef RCTL
 4825         /*
 4826          * Force rctl to reattach rules to processes.
 4827          */
 4828         FOREACH_PROC_IN_SYSTEM(p) {
 4829                 PROC_LOCK(p);
 4830                 cred = crhold(p->p_ucred);
 4831                 PROC_UNLOCK(p);
 4832                 rctl_proc_ucred_changed(p, cred);
 4833                 crfree(cred);
 4834         }
 4835 #endif
 4836 
 4837         sx_sunlock(&allproc_lock);
 4838         prison_racct_free_locked(oldprr);
 4839         sx_xunlock(&allprison_lock);
 4840 }
 4841 
 4842 static void
 4843 prison_racct_detach(struct prison *pr)
 4844 {
 4845 
 4846         ASSERT_RACCT_ENABLED();
 4847         sx_assert(&allprison_lock, SA_UNLOCKED);
 4848 
 4849         if (pr->pr_prison_racct == NULL)
 4850                 return;
 4851         prison_racct_free(pr->pr_prison_racct);
 4852         pr->pr_prison_racct = NULL;
 4853 }
 4854 #endif /* RACCT */
 4855 
 4856 #ifdef DDB
 4857 
 4858 static void
 4859 db_show_prison(struct prison *pr)
 4860 {
 4861         struct bool_flags *bf;
 4862         struct jailsys_flags *jsf;
 4863 #if defined(INET) || defined(INET6)
 4864         int ii;
 4865 #endif
 4866         unsigned f;
 4867 #ifdef INET
 4868         char ip4buf[INET_ADDRSTRLEN];
 4869 #endif
 4870 #ifdef INET6
 4871         char ip6buf[INET6_ADDRSTRLEN];
 4872 #endif
 4873 
 4874         db_printf("prison %p:\n", pr);
 4875         db_printf(" jid             = %d\n", pr->pr_id);
 4876         db_printf(" name            = %s\n", pr->pr_name);
 4877         db_printf(" parent          = %p\n", pr->pr_parent);
 4878         db_printf(" ref             = %d\n", pr->pr_ref);
 4879         db_printf(" uref            = %d\n", pr->pr_uref);
 4880         db_printf(" state           = %s\n",
 4881             pr->pr_state == PRISON_STATE_ALIVE ? "alive" :
 4882             pr->pr_state == PRISON_STATE_DYING ? "dying" :
 4883             "invalid");
 4884         db_printf(" path            = %s\n", pr->pr_path);
 4885         db_printf(" cpuset          = %d\n", pr->pr_cpuset
 4886             ? pr->pr_cpuset->cs_id : -1);
 4887 #ifdef VIMAGE
 4888         db_printf(" vnet            = %p\n", pr->pr_vnet);
 4889 #endif
 4890         db_printf(" root            = %p\n", pr->pr_root);
 4891         db_printf(" securelevel     = %d\n", pr->pr_securelevel);
 4892         db_printf(" devfs_rsnum     = %d\n", pr->pr_devfs_rsnum);
 4893         db_printf(" children.max    = %d\n", pr->pr_childmax);
 4894         db_printf(" children.cur    = %d\n", pr->pr_childcount);
 4895         db_printf(" child           = %p\n", LIST_FIRST(&pr->pr_children));
 4896         db_printf(" sibling         = %p\n", LIST_NEXT(pr, pr_sibling));
 4897         db_printf(" flags           = 0x%x", pr->pr_flags);
 4898         for (bf = pr_flag_bool; bf < pr_flag_bool + nitems(pr_flag_bool); bf++)
 4899                 if (pr->pr_flags & bf->flag)
 4900                         db_printf(" %s", bf->name);
 4901         for (jsf = pr_flag_jailsys;
 4902              jsf < pr_flag_jailsys + nitems(pr_flag_jailsys);
 4903              jsf++) {
 4904                 f = pr->pr_flags & (jsf->disable | jsf->new);
 4905                 db_printf(" %-16s= %s\n", jsf->name,
 4906                     (f != 0 && f == jsf->disable) ? "disable"
 4907                     : (f == jsf->new) ? "new"
 4908                     : "inherit");
 4909         }
 4910         db_printf(" allow           = 0x%x", pr->pr_allow);
 4911         for (bf = pr_flag_allow;
 4912              bf < pr_flag_allow + nitems(pr_flag_allow) &&
 4913                 atomic_load_int(&bf->flag) != 0;
 4914              bf++)
 4915                 if (pr->pr_allow & bf->flag)
 4916                         db_printf(" %s", bf->name);
 4917         db_printf("\n");
 4918         db_printf(" enforce_statfs  = %d\n", pr->pr_enforce_statfs);
 4919         db_printf(" host.hostname   = %s\n", pr->pr_hostname);
 4920         db_printf(" host.domainname = %s\n", pr->pr_domainname);
 4921         db_printf(" host.hostuuid   = %s\n", pr->pr_hostuuid);
 4922         db_printf(" host.hostid     = %lu\n", pr->pr_hostid);
 4923 #ifdef INET
 4924         if (pr->pr_addrs[PR_INET] != NULL) {
 4925                 pr_family_t af = PR_INET;
 4926 
 4927                 db_printf(" ip4s            = %d\n", pr->pr_addrs[af]->ips);
 4928                 for (ii = 0; ii < pr->pr_addrs[af]->ips; ii++)
 4929                         db_printf(" %s %s\n",
 4930                             ii == 0 ? "ip4.addr        =" : "                 ",
 4931                             inet_ntoa_r(
 4932                             *(const struct in_addr *)PR_IP(pr->pr_addrs[af], ii),
 4933                             ip4buf));
 4934         }
 4935 #endif
 4936 #ifdef INET6
 4937         if (pr->pr_addrs[PR_INET6] != NULL) {
 4938                 pr_family_t af = PR_INET6;
 4939 
 4940                 db_printf(" ip6s            = %d\n", pr->pr_addrs[af]->ips);
 4941                 for (ii = 0; ii < pr->pr_addrs[af]->ips; ii++)
 4942                         db_printf(" %s %s\n",
 4943                             ii == 0 ? "ip6.addr        =" : "                 ",
 4944                             ip6_sprintf(ip6buf,
 4945                             (const struct in6_addr *)PR_IP(pr->pr_addrs[af], ii)));
 4946         }
 4947 #endif
 4948 }
 4949 
 4950 DB_SHOW_COMMAND(prison, db_show_prison_command)
 4951 {
 4952         struct prison *pr;
 4953 
 4954         if (!have_addr) {
 4955                 /*
 4956                  * Show all prisons in the list, and prison0 which is not
 4957                  * listed.
 4958                  */
 4959                 db_show_prison(&prison0);
 4960                 if (!db_pager_quit) {
 4961                         TAILQ_FOREACH(pr, &allprison, pr_list) {
 4962                                 db_show_prison(pr);
 4963                                 if (db_pager_quit)
 4964                                         break;
 4965                         }
 4966                 }
 4967                 return;
 4968         }
 4969 
 4970         if (addr == 0)
 4971                 pr = &prison0;
 4972         else {
 4973                 /* Look for a prison with the ID and with references. */
 4974                 TAILQ_FOREACH(pr, &allprison, pr_list)
 4975                         if (pr->pr_id == addr && pr->pr_ref > 0)
 4976                                 break;
 4977                 if (pr == NULL)
 4978                         /* Look again, without requiring a reference. */
 4979                         TAILQ_FOREACH(pr, &allprison, pr_list)
 4980                                 if (pr->pr_id == addr)
 4981                                         break;
 4982                 if (pr == NULL)
 4983                         /* Assume address points to a valid prison. */
 4984                         pr = (struct prison *)addr;
 4985         }
 4986         db_show_prison(pr);
 4987 }
 4988 
 4989 #endif /* DDB */

Cache object: 438f39972dccf5e348d9f8cc7d06466d


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.