FreeBSD/Linux Kernel Cross Reference
sys/kern/kern_jail.c
1 /*-
2 * ----------------------------------------------------------------------------
3 * "THE BEER-WARE LICENSE" (Revision 42):
4 * <phk@FreeBSD.ORG> wrote this file. As long as you retain this notice you
5 * can do whatever you want with this stuff. If we meet some day, and you think
6 * this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp
7 * ----------------------------------------------------------------------------
8 */
9
10 #include <sys/cdefs.h>
11 __FBSDID("$FreeBSD: releng/5.4/sys/kern/kern_jail.c 145335 2005-04-20 19:11:07Z cvs2svn $");
12
13 #include "opt_mac.h"
14
15 #include <sys/param.h>
16 #include <sys/types.h>
17 #include <sys/kernel.h>
18 #include <sys/systm.h>
19 #include <sys/errno.h>
20 #include <sys/sysproto.h>
21 #include <sys/mac.h>
22 #include <sys/malloc.h>
23 #include <sys/proc.h>
24 #include <sys/taskqueue.h>
25 #include <sys/jail.h>
26 #include <sys/lock.h>
27 #include <sys/mutex.h>
28 #include <sys/namei.h>
29 #include <sys/queue.h>
30 #include <sys/socket.h>
31 #include <sys/syscallsubr.h>
32 #include <sys/sysctl.h>
33 #include <sys/vnode.h>
34 #include <net/if.h>
35 #include <netinet/in.h>
36
37 MALLOC_DEFINE(M_PRISON, "prison", "Prison structures");
38
39 SYSCTL_DECL(_security);
40 SYSCTL_NODE(_security, OID_AUTO, jail, CTLFLAG_RW, 0,
41 "Jail rules");
42
43 mp_fixme("these variables need a lock")
44
45 int jail_set_hostname_allowed = 1;
46 SYSCTL_INT(_security_jail, OID_AUTO, set_hostname_allowed, CTLFLAG_RW,
47 &jail_set_hostname_allowed, 0,
48 "Processes in jail can set their hostnames");
49
50 int jail_socket_unixiproute_only = 1;
51 SYSCTL_INT(_security_jail, OID_AUTO, socket_unixiproute_only, CTLFLAG_RW,
52 &jail_socket_unixiproute_only, 0,
53 "Processes in jail are limited to creating UNIX/IPv4/route sockets only");
54
55 int jail_sysvipc_allowed = 0;
56 SYSCTL_INT(_security_jail, OID_AUTO, sysvipc_allowed, CTLFLAG_RW,
57 &jail_sysvipc_allowed, 0,
58 "Processes in jail can use System V IPC primitives");
59
60 int jail_getfsstatroot_only = 1;
61 SYSCTL_INT(_security_jail, OID_AUTO, getfsstatroot_only, CTLFLAG_RW,
62 &jail_getfsstatroot_only, 0,
63 "Processes see only their root file system in getfsstat()");
64
65 int jail_allow_raw_sockets = 0;
66 SYSCTL_INT(_security_jail, OID_AUTO, allow_raw_sockets, CTLFLAG_RW,
67 &jail_allow_raw_sockets, 0,
68 "Prison root can create raw sockets");
69
70 int jail_chflags_allowed = 0;
71 SYSCTL_INT(_security_jail, OID_AUTO, chflags_allowed, CTLFLAG_RW,
72 &jail_chflags_allowed, 0,
73 "Processes in jail can alter system file flags");
74
75 /* allprison, lastprid, and prisoncount are protected by allprison_mtx. */
76 struct prisonlist allprison;
77 struct mtx allprison_mtx;
78 int lastprid = 0;
79 int prisoncount = 0;
80
81 static void init_prison(void *);
82 static void prison_complete(void *context, int pending);
83 static struct prison *prison_find(int);
84 static int sysctl_jail_list(SYSCTL_HANDLER_ARGS);
85
86 static void
87 init_prison(void *data __unused)
88 {
89
90 mtx_init(&allprison_mtx, "allprison", NULL, MTX_DEF);
91 LIST_INIT(&allprison);
92 }
93
94 SYSINIT(prison, SI_SUB_INTRINSIC, SI_ORDER_ANY, init_prison, NULL);
95
96 /*
97 * MPSAFE
98 *
99 * struct jail_args {
100 * struct jail *jail;
101 * };
102 */
103 int
104 jail(struct thread *td, struct jail_args *uap)
105 {
106 struct nameidata nd;
107 struct prison *pr, *tpr;
108 struct jail j;
109 struct jail_attach_args jaa;
110 int error, tryprid;
111
112 error = copyin(uap->jail, &j, sizeof(j));
113 if (error)
114 return (error);
115 if (j.version != 0)
116 return (EINVAL);
117
118 MALLOC(pr, struct prison *, sizeof(*pr), M_PRISON, M_WAITOK | M_ZERO);
119 mtx_init(&pr->pr_mtx, "jail mutex", NULL, MTX_DEF);
120 pr->pr_ref = 1;
121 error = copyinstr(j.path, &pr->pr_path, sizeof(pr->pr_path), 0);
122 if (error)
123 goto e_killmtx;
124 mtx_lock(&Giant);
125 NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE, pr->pr_path, td);
126 error = namei(&nd);
127 if (error) {
128 mtx_unlock(&Giant);
129 goto e_killmtx;
130 }
131 pr->pr_root = nd.ni_vp;
132 VOP_UNLOCK(nd.ni_vp, 0, td);
133 NDFREE(&nd, NDF_ONLY_PNBUF);
134 mtx_unlock(&Giant);
135 error = copyinstr(j.hostname, &pr->pr_host, sizeof(pr->pr_host), 0);
136 if (error)
137 goto e_dropvnref;
138 pr->pr_ip = j.ip_number;
139 pr->pr_linux = NULL;
140 pr->pr_securelevel = securelevel;
141
142 /* Determine next pr_id and add prison to allprison list. */
143 mtx_lock(&allprison_mtx);
144 tryprid = lastprid + 1;
145 if (tryprid == JAIL_MAX)
146 tryprid = 1;
147 next:
148 LIST_FOREACH(tpr, &allprison, pr_list) {
149 if (tpr->pr_id == tryprid) {
150 tryprid++;
151 if (tryprid == JAIL_MAX) {
152 mtx_unlock(&allprison_mtx);
153 error = EAGAIN;
154 goto e_dropvnref;
155 }
156 goto next;
157 }
158 }
159 pr->pr_id = jaa.jid = lastprid = tryprid;
160 LIST_INSERT_HEAD(&allprison, pr, pr_list);
161 prisoncount++;
162 mtx_unlock(&allprison_mtx);
163
164 error = jail_attach(td, &jaa);
165 if (error)
166 goto e_dropprref;
167 mtx_lock(&pr->pr_mtx);
168 pr->pr_ref--;
169 mtx_unlock(&pr->pr_mtx);
170 td->td_retval[0] = jaa.jid;
171 return (0);
172 e_dropprref:
173 mtx_lock(&allprison_mtx);
174 LIST_REMOVE(pr, pr_list);
175 prisoncount--;
176 mtx_unlock(&allprison_mtx);
177 e_dropvnref:
178 mtx_lock(&Giant);
179 vrele(pr->pr_root);
180 mtx_unlock(&Giant);
181 e_killmtx:
182 mtx_destroy(&pr->pr_mtx);
183 FREE(pr, M_PRISON);
184 return (error);
185 }
186
187 /*
188 * MPSAFE
189 *
190 * struct jail_attach_args {
191 * int jid;
192 * };
193 */
194 int
195 jail_attach(struct thread *td, struct jail_attach_args *uap)
196 {
197 struct proc *p;
198 struct ucred *newcred, *oldcred;
199 struct prison *pr;
200 int error;
201
202 /*
203 * XXX: Note that there is a slight race here if two threads
204 * in the same privileged process attempt to attach to two
205 * different jails at the same time. It is important for
206 * user processes not to do this, or they might end up with
207 * a process root from one prison, but attached to the jail
208 * of another.
209 */
210 error = suser(td);
211 if (error)
212 return (error);
213
214 p = td->td_proc;
215 mtx_lock(&allprison_mtx);
216 pr = prison_find(uap->jid);
217 if (pr == NULL) {
218 mtx_unlock(&allprison_mtx);
219 return (EINVAL);
220 }
221 pr->pr_ref++;
222 mtx_unlock(&pr->pr_mtx);
223 mtx_unlock(&allprison_mtx);
224
225 mtx_lock(&Giant);
226 vn_lock(pr->pr_root, LK_EXCLUSIVE | LK_RETRY, td);
227 if ((error = change_dir(pr->pr_root, td)) != 0)
228 goto e_unlock;
229 #ifdef MAC
230 if ((error = mac_check_vnode_chroot(td->td_ucred, pr->pr_root)))
231 goto e_unlock;
232 #endif
233 VOP_UNLOCK(pr->pr_root, 0, td);
234 change_root(pr->pr_root, td);
235 mtx_unlock(&Giant);
236
237 newcred = crget();
238 PROC_LOCK(p);
239 oldcred = p->p_ucred;
240 setsugid(p);
241 crcopy(newcred, oldcred);
242 newcred->cr_prison = pr;
243 p->p_ucred = newcred;
244 PROC_UNLOCK(p);
245 crfree(oldcred);
246 return (0);
247 e_unlock:
248 VOP_UNLOCK(pr->pr_root, 0, td);
249 mtx_unlock(&Giant);
250 mtx_lock(&pr->pr_mtx);
251 pr->pr_ref--;
252 mtx_unlock(&pr->pr_mtx);
253 return (error);
254 }
255
256 /*
257 * Returns a locked prison instance, or NULL on failure.
258 */
259 static struct prison *
260 prison_find(int prid)
261 {
262 struct prison *pr;
263
264 mtx_assert(&allprison_mtx, MA_OWNED);
265 LIST_FOREACH(pr, &allprison, pr_list) {
266 if (pr->pr_id == prid) {
267 mtx_lock(&pr->pr_mtx);
268 return (pr);
269 }
270 }
271 return (NULL);
272 }
273
274 void
275 prison_free(struct prison *pr)
276 {
277
278 mtx_lock(&allprison_mtx);
279 mtx_lock(&pr->pr_mtx);
280 pr->pr_ref--;
281 if (pr->pr_ref == 0) {
282 LIST_REMOVE(pr, pr_list);
283 mtx_unlock(&pr->pr_mtx);
284 prisoncount--;
285 mtx_unlock(&allprison_mtx);
286
287 TASK_INIT(&pr->pr_task, 0, prison_complete, pr);
288 taskqueue_enqueue(taskqueue_swi, &pr->pr_task);
289 return;
290 }
291 mtx_unlock(&pr->pr_mtx);
292 mtx_unlock(&allprison_mtx);
293 }
294
295 static void
296 prison_complete(void *context, int pending)
297 {
298 struct prison *pr;
299
300 pr = (struct prison *)context;
301
302 mtx_lock(&Giant);
303 vrele(pr->pr_root);
304 mtx_unlock(&Giant);
305
306 mtx_destroy(&pr->pr_mtx);
307 if (pr->pr_linux != NULL)
308 FREE(pr->pr_linux, M_PRISON);
309 FREE(pr, M_PRISON);
310 }
311
312 void
313 prison_hold(struct prison *pr)
314 {
315
316 mtx_lock(&pr->pr_mtx);
317 pr->pr_ref++;
318 mtx_unlock(&pr->pr_mtx);
319 }
320
321 u_int32_t
322 prison_getip(struct ucred *cred)
323 {
324
325 return (cred->cr_prison->pr_ip);
326 }
327
328 int
329 prison_ip(struct ucred *cred, int flag, u_int32_t *ip)
330 {
331 u_int32_t tmp;
332
333 if (!jailed(cred))
334 return (0);
335 if (flag)
336 tmp = *ip;
337 else
338 tmp = ntohl(*ip);
339 if (tmp == INADDR_ANY) {
340 if (flag)
341 *ip = cred->cr_prison->pr_ip;
342 else
343 *ip = htonl(cred->cr_prison->pr_ip);
344 return (0);
345 }
346 if (tmp == INADDR_LOOPBACK) {
347 if (flag)
348 *ip = cred->cr_prison->pr_ip;
349 else
350 *ip = htonl(cred->cr_prison->pr_ip);
351 return (0);
352 }
353 if (cred->cr_prison->pr_ip != tmp)
354 return (1);
355 return (0);
356 }
357
358 void
359 prison_remote_ip(struct ucred *cred, int flag, u_int32_t *ip)
360 {
361 u_int32_t tmp;
362
363 if (!jailed(cred))
364 return;
365 if (flag)
366 tmp = *ip;
367 else
368 tmp = ntohl(*ip);
369 if (tmp == INADDR_LOOPBACK) {
370 if (flag)
371 *ip = cred->cr_prison->pr_ip;
372 else
373 *ip = htonl(cred->cr_prison->pr_ip);
374 return;
375 }
376 return;
377 }
378
379 int
380 prison_if(struct ucred *cred, struct sockaddr *sa)
381 {
382 struct sockaddr_in *sai;
383 int ok;
384
385 sai = (struct sockaddr_in *)sa;
386 if ((sai->sin_family != AF_INET) && jail_socket_unixiproute_only)
387 ok = 1;
388 else if (sai->sin_family != AF_INET)
389 ok = 0;
390 else if (cred->cr_prison->pr_ip != ntohl(sai->sin_addr.s_addr))
391 ok = 1;
392 else
393 ok = 0;
394 return (ok);
395 }
396
397 /*
398 * Return 0 if jails permit p1 to frob p2, otherwise ESRCH.
399 */
400 int
401 prison_check(struct ucred *cred1, struct ucred *cred2)
402 {
403
404 if (jailed(cred1)) {
405 if (!jailed(cred2))
406 return (ESRCH);
407 if (cred2->cr_prison != cred1->cr_prison)
408 return (ESRCH);
409 }
410
411 return (0);
412 }
413
414 /*
415 * Return 1 if the passed credential is in a jail, otherwise 0.
416 */
417 int
418 jailed(struct ucred *cred)
419 {
420
421 return (cred->cr_prison != NULL);
422 }
423
424 /*
425 * Return the correct hostname for the passed credential.
426 */
427 void
428 getcredhostname(struct ucred *cred, char *buf, size_t size)
429 {
430
431 if (jailed(cred)) {
432 mtx_lock(&cred->cr_prison->pr_mtx);
433 strlcpy(buf, cred->cr_prison->pr_host, size);
434 mtx_unlock(&cred->cr_prison->pr_mtx);
435 } else
436 strlcpy(buf, hostname, size);
437 }
438
439 /*
440 * Return 1 if the passed credential can "see" the passed mountpoint
441 * when performing a getfsstat(); otherwise, 0.
442 */
443 int
444 prison_check_mount(struct ucred *cred, struct mount *mp)
445 {
446
447 if (jail_getfsstatroot_only && cred->cr_prison != NULL) {
448 if (cred->cr_prison->pr_root->v_mount != mp)
449 return (0);
450 }
451 return (1);
452 }
453
454 static int
455 sysctl_jail_list(SYSCTL_HANDLER_ARGS)
456 {
457 struct xprison *xp, *sxp;
458 struct prison *pr;
459 int count, error;
460
461 mtx_assert(&Giant, MA_OWNED);
462 if (jailed(req->td->td_ucred))
463 return (0);
464 retry:
465 mtx_lock(&allprison_mtx);
466 count = prisoncount;
467 mtx_unlock(&allprison_mtx);
468
469 if (count == 0)
470 return (0);
471
472 sxp = xp = malloc(sizeof(*xp) * count, M_TEMP, M_WAITOK | M_ZERO);
473 mtx_lock(&allprison_mtx);
474 if (count != prisoncount) {
475 mtx_unlock(&allprison_mtx);
476 free(sxp, M_TEMP);
477 goto retry;
478 }
479
480 LIST_FOREACH(pr, &allprison, pr_list) {
481 mtx_lock(&pr->pr_mtx);
482 xp->pr_version = XPRISON_VERSION;
483 xp->pr_id = pr->pr_id;
484 strlcpy(xp->pr_path, pr->pr_path, sizeof(xp->pr_path));
485 strlcpy(xp->pr_host, pr->pr_host, sizeof(xp->pr_host));
486 xp->pr_ip = pr->pr_ip;
487 mtx_unlock(&pr->pr_mtx);
488 xp++;
489 }
490 mtx_unlock(&allprison_mtx);
491
492 error = SYSCTL_OUT(req, sxp, sizeof(*sxp) * count);
493 free(sxp, M_TEMP);
494 if (error)
495 return (error);
496 return (0);
497 }
498
499 SYSCTL_OID(_security_jail, OID_AUTO, list, CTLTYPE_STRUCT | CTLFLAG_RD,
500 NULL, 0, sysctl_jail_list, "S", "List of active jails");
501
502 static int
503 sysctl_jail_jailed(SYSCTL_HANDLER_ARGS)
504 {
505 int error, injail;
506
507 injail = jailed(req->td->td_ucred);
508 error = SYSCTL_OUT(req, &injail, sizeof(injail));
509
510 return (error);
511 }
512 SYSCTL_PROC(_security_jail, OID_AUTO, jailed, CTLTYPE_INT | CTLFLAG_RD,
513 NULL, 0, sysctl_jail_jailed, "I", "Process in jail?");
Cache object: dd95d5e1522ef1455332d2d5a8ac8666
|