1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3 *
4 * Copyright (c) 2009 James Gritton.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29 #include <sys/cdefs.h>
30 __FBSDID("$FreeBSD: stable/12/lib/libjail/jail.c 356718 2020-01-14 02:41:52Z markj $");
31
32 #include <sys/param.h>
33 #include <sys/types.h>
34 #include <sys/jail.h>
35 #include <sys/linker.h>
36 #include <sys/socket.h>
37 #include <sys/sysctl.h>
38
39 #include <arpa/inet.h>
40 #include <netinet/in.h>
41
42 #include <errno.h>
43 #include <inttypes.h>
44 #include <stdio.h>
45 #include <stdarg.h>
46 #include <stdlib.h>
47 #include <string.h>
48
49 #include "jail.h"
50
51 #define SJPARAM "security.jail.param"
52
53 #define JPS_IN_ADDR 1
54 #define JPS_IN6_ADDR 2
55
56 #define ARRAY_SANITY 5
57 #define ARRAY_SLOP 5
58
59
60 static int jailparam_import_enum(const char **values, int nvalues,
61 const char *valstr, size_t valsize, int *value);
62 static int jailparam_type(struct jailparam *jp);
63 static int kldload_param(const char *name);
64 static char *noname(const char *name);
65 static char *nononame(const char *name);
66
67 char jail_errmsg[JAIL_ERRMSGLEN];
68
69 static const char *bool_values[] = { "false", "true" };
70 static const char *jailsys_values[] = { "disable", "new", "inherit" };
71
72
73 /*
74 * Import a null-terminated parameter list and set a jail with the flags
75 * and parameters.
76 */
77 int
jail_setv(int flags,...)78 jail_setv(int flags, ...)
79 {
80 va_list ap, tap;
81 struct jailparam *jp;
82 const char *name, *value;
83 int njp, jid;
84
85 /* Create the parameter list and import the parameters. */
86 va_start(ap, flags);
87 va_copy(tap, ap);
88 for (njp = 0; va_arg(tap, char *) != NULL; njp++)
89 (void)va_arg(tap, char *);
90 va_end(tap);
91 jp = alloca(njp * sizeof(struct jailparam));
92 for (njp = 0; (name = va_arg(ap, char *)) != NULL;) {
93 value = va_arg(ap, char *);
94 if (jailparam_init(jp + njp, name) < 0)
95 goto error;
96 if (jailparam_import(jp + njp++, value) < 0)
97 goto error;
98 }
99 va_end(ap);
100 jid = jailparam_set(jp, njp, flags);
101 jailparam_free(jp, njp);
102 return (jid);
103
104 error:
105 jailparam_free(jp, njp);
106 va_end(ap);
107 return (-1);
108 }
109
110 /*
111 * Read a null-terminated parameter list, get the referenced jail, and export
112 * the parameters to the list.
113 */
114 int
jail_getv(int flags,...)115 jail_getv(int flags, ...)
116 {
117 va_list ap, tap;
118 struct jailparam *jp, *jp_lastjid, *jp_jid, *jp_name, *jp_key;
119 char *valarg, *value;
120 const char *name, *key_value, *lastjid_value, *jid_value, *name_value;
121 int njp, i, jid;
122
123 /* Create the parameter list and find the key. */
124 va_start(ap, flags);
125 va_copy(tap, ap);
126 for (njp = 0; va_arg(tap, char *) != NULL; njp++)
127 (void)va_arg(tap, char *);
128 va_end(tap);
129
130 jp = alloca(njp * sizeof(struct jailparam));
131 va_copy(tap, ap);
132 jp_lastjid = jp_jid = jp_name = NULL;
133 lastjid_value = jid_value = name_value = NULL;
134 for (njp = 0; (name = va_arg(tap, char *)) != NULL; njp++) {
135 value = va_arg(tap, char *);
136 if (jailparam_init(jp + njp, name) < 0) {
137 va_end(tap);
138 goto error;
139 }
140 if (!strcmp(jp[njp].jp_name, "lastjid")) {
141 jp_lastjid = jp + njp;
142 lastjid_value = value;
143 } else if (!strcmp(jp[njp].jp_name, "jid")) {
144 jp_jid = jp + njp;
145 jid_value = value;
146 } if (!strcmp(jp[njp].jp_name, "name")) {
147 jp_name = jp + njp;
148 name_value = value;
149 }
150 }
151 va_end(tap);
152 /* Import the key parameter. */
153 if (jp_lastjid != NULL) {
154 jp_key = jp_lastjid;
155 key_value = lastjid_value;
156 } else if (jp_jid != NULL && strtol(jid_value, NULL, 10) != 0) {
157 jp_key = jp_jid;
158 key_value = jid_value;
159 } else if (jp_name != NULL) {
160 jp_key = jp_name;
161 key_value = name_value;
162 } else {
163 strlcpy(jail_errmsg, "no jail specified", JAIL_ERRMSGLEN);
164 errno = ENOENT;
165 goto error;
166 }
167 if (jailparam_import(jp_key, key_value) < 0)
168 goto error;
169 /* Get the jail and export the parameters. */
170 jid = jailparam_get(jp, njp, flags);
171 if (jid < 0)
172 goto error;
173 for (i = 0; i < njp; i++) {
174 (void)va_arg(ap, char *);
175 valarg = va_arg(ap, char *);
176 if (jp + i != jp_key) {
177 /* It's up to the caller to ensure there's room. */
178 if ((jp[i].jp_ctltype & CTLTYPE) == CTLTYPE_STRING)
179 strcpy(valarg, jp[i].jp_value);
180 else {
181 value = jailparam_export(jp + i);
182 if (value == NULL)
183 goto error;
184 strcpy(valarg, value);
185 free(value);
186 }
187 }
188 }
189 jailparam_free(jp, njp);
190 va_end(ap);
191 return (jid);
192
193 error:
194 jailparam_free(jp, njp);
195 va_end(ap);
196 return (-1);
197 }
198
199 /*
200 * Return a list of all known parameters.
201 */
202 int
jailparam_all(struct jailparam ** jpp)203 jailparam_all(struct jailparam **jpp)
204 {
205 struct jailparam *jp, *tjp;
206 size_t mlen1, mlen2, buflen;
207 unsigned njp, nlist;
208 int mib1[CTL_MAXNAME], mib2[CTL_MAXNAME - 2];
209 char buf[MAXPATHLEN];
210
211 njp = 0;
212 nlist = 32;
213 jp = malloc(nlist * sizeof(*jp));
214 if (jp == NULL) {
215 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
216 return (-1);
217 }
218 mib1[0] = 0;
219 mib1[1] = 2;
220 mlen1 = CTL_MAXNAME - 2;
221 if (sysctlnametomib(SJPARAM, mib1 + 2, &mlen1) < 0) {
222 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
223 "sysctlnametomib(" SJPARAM "): %s", strerror(errno));
224 goto error;
225 }
226 for (;; njp++) {
227 /* Get the next parameter. */
228 mlen2 = sizeof(mib2);
229 if (sysctl(mib1, mlen1 + 2, mib2, &mlen2, NULL, 0) < 0) {
230 if (errno == ENOENT) {
231 /* No more entries. */
232 break;
233 }
234 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
235 "sysctl(0.2): %s", strerror(errno));
236 goto error;
237 }
238 if (mib2[0] != mib1[2] ||
239 mib2[1] != mib1[3] ||
240 mib2[2] != mib1[4])
241 break;
242 /* Convert it to an ascii name. */
243 memcpy(mib1 + 2, mib2, mlen2);
244 mlen1 = mlen2 / sizeof(int);
245 mib1[1] = 1;
246 buflen = sizeof(buf);
247 if (sysctl(mib1, mlen1 + 2, buf, &buflen, NULL, 0) < 0) {
248 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
249 "sysctl(0.1): %s", strerror(errno));
250 goto error;
251 }
252 if (buf[buflen - 2] == '.')
253 buf[buflen - 2] = '\0';
254 /* Add the parameter to the list */
255 if (njp >= nlist) {
256 nlist *= 2;
257 tjp = reallocarray(jp, nlist, sizeof(*jp));
258 if (tjp == NULL)
259 goto error;
260 jp = tjp;
261 }
262 if (jailparam_init(jp + njp, buf + sizeof(SJPARAM)) < 0)
263 goto error;
264 mib1[1] = 2;
265 }
266 /* Just return the untrimmed buffer if reallocarray() somehow fails. */
267 tjp = reallocarray(jp, njp, sizeof(*jp));
268 if (tjp != NULL)
269 jp = tjp;
270 *jpp = jp;
271 return (njp);
272
273 error:
274 jailparam_free(jp, njp);
275 free(jp);
276 return (-1);
277 }
278
279 /*
280 * Clear a jail parameter and copy in its name.
281 */
282 int
jailparam_init(struct jailparam * jp,const char * name)283 jailparam_init(struct jailparam *jp, const char *name)
284 {
285
286 memset(jp, 0, sizeof(*jp));
287 jp->jp_name = strdup(name);
288 if (jp->jp_name == NULL) {
289 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
290 return (-1);
291 }
292 if (jailparam_type(jp) < 0) {
293 jailparam_free(jp, 1);
294 jp->jp_name = NULL;
295 jp->jp_value = NULL;
296 return (-1);
297 }
298 return (0);
299 }
300
301 /*
302 * Put a name and value into a jail parameter element, converting the value
303 * to internal form.
304 */
305 int
jailparam_import(struct jailparam * jp,const char * value)306 jailparam_import(struct jailparam *jp, const char *value)
307 {
308 char *p, *ep, *tvalue;
309 const char *avalue;
310 int i, nval, fw;
311
312 if (value == NULL)
313 return (0);
314 if ((jp->jp_ctltype & CTLTYPE) == CTLTYPE_STRING) {
315 jp->jp_value = strdup(value);
316 if (jp->jp_value == NULL) {
317 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
318 return (-1);
319 }
320 return (0);
321 }
322 nval = 1;
323 if (jp->jp_elemlen) {
324 if (value[0] == '\0' || (value[0] == '-' && value[1] == '\0')) {
325 jp->jp_value = strdup("");
326 if (jp->jp_value == NULL) {
327 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
328 return (-1);
329 }
330 jp->jp_valuelen = 0;
331 return (0);
332 }
333 for (p = strchr(value, ','); p; p = strchr(p + 1, ','))
334 nval++;
335 jp->jp_valuelen = jp->jp_elemlen * nval;
336 }
337 jp->jp_value = malloc(jp->jp_valuelen);
338 if (jp->jp_value == NULL) {
339 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
340 return (-1);
341 }
342 avalue = value;
343 for (i = 0; i < nval; i++) {
344 fw = nval == 1 ? strlen(avalue) : strcspn(avalue, ",");
345 switch (jp->jp_ctltype & CTLTYPE) {
346 case CTLTYPE_INT:
347 if (jp->jp_flags & (JP_BOOL | JP_NOBOOL)) {
348 if (!jailparam_import_enum(bool_values, 2,
349 avalue, fw, &((int *)jp->jp_value)[i])) {
350 snprintf(jail_errmsg,
351 JAIL_ERRMSGLEN, "%s: "
352 "unknown boolean value \"%.*s\"",
353 jp->jp_name, fw, avalue);
354 errno = EINVAL;
355 goto error;
356 }
357 break;
358 }
359 if (jp->jp_flags & JP_JAILSYS) {
360 /*
361 * Allow setting a jailsys parameter to "new"
362 * in a booleanesque fashion.
363 */
364 if (value[0] == '\0')
365 ((int *)jp->jp_value)[i] = JAIL_SYS_NEW;
366 else if (!jailparam_import_enum(jailsys_values,
367 sizeof(jailsys_values) /
368 sizeof(jailsys_values[0]), avalue, fw,
369 &((int *)jp->jp_value)[i])) {
370 snprintf(jail_errmsg,
371 JAIL_ERRMSGLEN, "%s: "
372 "unknown jailsys value \"%.*s\"",
373 jp->jp_name, fw, avalue);
374 errno = EINVAL;
375 goto error;
376 }
377 break;
378 }
379 ((int *)jp->jp_value)[i] = strtol(avalue, &ep, 10);
380 integer_test:
381 if (ep != avalue + fw) {
382 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
383 "%s: non-integer value \"%.*s\"",
384 jp->jp_name, fw, avalue);
385 errno = EINVAL;
386 goto error;
387 }
388 break;
389 case CTLTYPE_UINT:
390 ((unsigned *)jp->jp_value)[i] =
391 strtoul(avalue, &ep, 10);
392 goto integer_test;
393 case CTLTYPE_LONG:
394 ((long *)jp->jp_value)[i] = strtol(avalue, &ep, 10);
395 goto integer_test;
396 case CTLTYPE_ULONG:
397 ((unsigned long *)jp->jp_value)[i] =
398 strtoul(avalue, &ep, 10);
399 goto integer_test;
400 case CTLTYPE_S64:
401 ((int64_t *)jp->jp_value)[i] =
402 strtoimax(avalue, &ep, 10);
403 goto integer_test;
404 case CTLTYPE_U64:
405 ((uint64_t *)jp->jp_value)[i] =
406 strtoumax(avalue, &ep, 10);
407 goto integer_test;
408 case CTLTYPE_STRUCT:
409 tvalue = alloca(fw + 1);
410 strlcpy(tvalue, avalue, fw + 1);
411 switch (jp->jp_structtype) {
412 case JPS_IN_ADDR:
413 if (inet_pton(AF_INET, tvalue,
414 &((struct in_addr *)jp->jp_value)[i]) != 1)
415 {
416 snprintf(jail_errmsg,
417 JAIL_ERRMSGLEN,
418 "%s: not an IPv4 address: %s",
419 jp->jp_name, tvalue);
420 errno = EINVAL;
421 goto error;
422 }
423 break;
424 case JPS_IN6_ADDR:
425 if (inet_pton(AF_INET6, tvalue,
426 &((struct in6_addr *)jp->jp_value)[i]) != 1)
427 {
428 snprintf(jail_errmsg,
429 JAIL_ERRMSGLEN,
430 "%s: not an IPv6 address: %s",
431 jp->jp_name, tvalue);
432 errno = EINVAL;
433 goto error;
434 }
435 break;
436 default:
437 goto unknown_type;
438 }
439 break;
440 default:
441 unknown_type:
442 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
443 "unknown type for %s", jp->jp_name);
444 errno = ENOENT;
445 goto error;
446 }
447 avalue += fw + 1;
448 }
449 return (0);
450
451 error:
452 free(jp->jp_value);
453 jp->jp_value = NULL;
454 return (-1);
455 }
456
457 static int
jailparam_import_enum(const char ** values,int nvalues,const char * valstr,size_t valsize,int * value)458 jailparam_import_enum(const char **values, int nvalues, const char *valstr,
459 size_t valsize, int *value)
460 {
461 char *ep;
462 int i;
463
464 for (i = 0; i < nvalues; i++)
465 if (valsize == strlen(values[i]) &&
466 !strncasecmp(valstr, values[i], valsize)) {
467 *value = i;
468 return 1;
469 }
470 *value = strtol(valstr, &ep, 10);
471 return (ep == valstr + valsize);
472 }
473
474 /*
475 * Put a name and value into a jail parameter element, copying the value
476 * but not altering it.
477 */
478 int
jailparam_import_raw(struct jailparam * jp,void * value,size_t valuelen)479 jailparam_import_raw(struct jailparam *jp, void *value, size_t valuelen)
480 {
481
482 jp->jp_value = value;
483 jp->jp_valuelen = valuelen;
484 jp->jp_flags |= JP_RAWVALUE;
485 return (0);
486 }
487
488 /*
489 * Run the jail_set and jail_get system calls on a parameter list.
490 */
491 int
jailparam_set(struct jailparam * jp,unsigned njp,int flags)492 jailparam_set(struct jailparam *jp, unsigned njp, int flags)
493 {
494 struct iovec *jiov;
495 char *nname;
496 int i, jid, bool0;
497 unsigned j;
498
499 jiov = alloca(sizeof(struct iovec) * 2 * (njp + 1));
500 bool0 = 0;
501 for (i = j = 0; j < njp; j++) {
502 jiov[i].iov_base = jp[j].jp_name;
503 jiov[i].iov_len = strlen(jp[j].jp_name) + 1;
504 i++;
505 if (jp[j].jp_flags & (JP_BOOL | JP_NOBOOL)) {
506 /*
507 * Set booleans without values. If one has a value of
508 * zero, change it to (or from) its "no" counterpart.
509 */
510 jiov[i].iov_base = NULL;
511 jiov[i].iov_len = 0;
512 if (jp[j].jp_value != NULL &&
513 jp[j].jp_valuelen == sizeof(int) &&
514 !*(int *)jp[j].jp_value) {
515 bool0 = 1;
516 nname = jp[j].jp_flags & JP_BOOL
517 ? noname(jp[j].jp_name)
518 : nononame(jp[j].jp_name);
519 if (nname == NULL) {
520 njp = j;
521 jid = -1;
522 goto done;
523 }
524 jiov[i - 1].iov_base = nname;
525 jiov[i - 1].iov_len = strlen(nname) + 1;
526
527 }
528 } else {
529 /*
530 * Try to fill in missing values with an empty string.
531 */
532 if (jp[j].jp_value == NULL && jp[j].jp_valuelen > 0 &&
533 jailparam_import(jp + j, "") < 0) {
534 njp = j;
535 jid = -1;
536 goto done;
537 }
538 jiov[i].iov_base = jp[j].jp_value;
539 jiov[i].iov_len =
540 (jp[j].jp_ctltype & CTLTYPE) == CTLTYPE_STRING
541 ? strlen(jp[j].jp_value) + 1
542 : jp[j].jp_valuelen;
543 }
544 i++;
545 }
546 jiov[i].iov_base = __DECONST(char *, "errmsg");
547 jiov[i].iov_len = sizeof("errmsg");
548 i++;
549 jiov[i].iov_base = jail_errmsg;
550 jiov[i].iov_len = JAIL_ERRMSGLEN;
551 i++;
552 jail_errmsg[0] = 0;
553 jid = jail_set(jiov, i, flags);
554 if (jid < 0 && !jail_errmsg[0])
555 snprintf(jail_errmsg, sizeof(jail_errmsg), "jail_set: %s",
556 strerror(errno));
557 done:
558 if (bool0)
559 for (j = 0; j < njp; j++)
560 if ((jp[j].jp_flags & (JP_BOOL | JP_NOBOOL)) &&
561 jp[j].jp_value != NULL &&
562 jp[j].jp_valuelen == sizeof(int) &&
563 !*(int *)jp[j].jp_value)
564 free(jiov[j * 2].iov_base);
565 return (jid);
566 }
567
568 int
jailparam_get(struct jailparam * jp,unsigned njp,int flags)569 jailparam_get(struct jailparam *jp, unsigned njp, int flags)
570 {
571 struct iovec *jiov;
572 struct jailparam *jp_lastjid, *jp_jid, *jp_name, *jp_key;
573 int i, ai, ki, jid, arrays, sanity;
574 unsigned j;
575
576 /*
577 * Get the types for all parameters.
578 * Find the key and any array parameters.
579 */
580 jiov = alloca(sizeof(struct iovec) * 2 * (njp + 1));
581 jp_lastjid = jp_jid = jp_name = NULL;
582 arrays = 0;
583 for (ai = j = 0; j < njp; j++) {
584 if (!strcmp(jp[j].jp_name, "lastjid"))
585 jp_lastjid = jp + j;
586 else if (!strcmp(jp[j].jp_name, "jid"))
587 jp_jid = jp + j;
588 else if (!strcmp(jp[j].jp_name, "name"))
589 jp_name = jp + j;
590 else if (jp[j].jp_elemlen && !(jp[j].jp_flags & JP_RAWVALUE)) {
591 arrays = 1;
592 jiov[ai].iov_base = jp[j].jp_name;
593 jiov[ai].iov_len = strlen(jp[j].jp_name) + 1;
594 ai++;
595 jiov[ai].iov_base = NULL;
596 jiov[ai].iov_len = 0;
597 ai++;
598 }
599 }
600 jp_key = jp_lastjid ? jp_lastjid :
601 jp_jid && jp_jid->jp_valuelen == sizeof(int) &&
602 jp_jid->jp_value && *(int *)jp_jid->jp_value ? jp_jid : jp_name;
603 if (jp_key == NULL || jp_key->jp_value == NULL) {
604 strlcpy(jail_errmsg, "no jail specified", JAIL_ERRMSGLEN);
605 errno = ENOENT;
606 return (-1);
607 }
608 ki = ai;
609 jiov[ki].iov_base = jp_key->jp_name;
610 jiov[ki].iov_len = strlen(jp_key->jp_name) + 1;
611 ki++;
612 jiov[ki].iov_base = jp_key->jp_value;
613 jiov[ki].iov_len = (jp_key->jp_ctltype & CTLTYPE) == CTLTYPE_STRING
614 ? strlen(jp_key->jp_value) + 1 : jp_key->jp_valuelen;
615 ki++;
616 jiov[ki].iov_base = __DECONST(char *, "errmsg");
617 jiov[ki].iov_len = sizeof("errmsg");
618 ki++;
619 jiov[ki].iov_base = jail_errmsg;
620 jiov[ki].iov_len = JAIL_ERRMSGLEN;
621 ki++;
622 jail_errmsg[0] = 0;
623 if (arrays && jail_get(jiov, ki, flags) < 0) {
624 if (!jail_errmsg[0])
625 snprintf(jail_errmsg, sizeof(jail_errmsg),
626 "jail_get: %s", strerror(errno));
627 return (-1);
628 }
629 /* Allocate storage for all parameters. */
630 for (ai = j = 0, i = ki; j < njp; j++) {
631 if (jp[j].jp_elemlen && !(jp[j].jp_flags & JP_RAWVALUE)) {
632 ai++;
633 jiov[ai].iov_len += jp[j].jp_elemlen * ARRAY_SLOP;
634 if (jp[j].jp_valuelen >= jiov[ai].iov_len)
635 jiov[ai].iov_len = jp[j].jp_valuelen;
636 else {
637 jp[j].jp_valuelen = jiov[ai].iov_len;
638 if (jp[j].jp_value != NULL)
639 free(jp[j].jp_value);
640 jp[j].jp_value = malloc(jp[j].jp_valuelen);
641 if (jp[j].jp_value == NULL) {
642 strerror_r(errno, jail_errmsg,
643 JAIL_ERRMSGLEN);
644 return (-1);
645 }
646 }
647 jiov[ai].iov_base = jp[j].jp_value;
648 memset(jiov[ai].iov_base, 0, jiov[ai].iov_len);
649 ai++;
650 } else if (jp + j != jp_key) {
651 jiov[i].iov_base = jp[j].jp_name;
652 jiov[i].iov_len = strlen(jp[j].jp_name) + 1;
653 i++;
654 if (jp[j].jp_value == NULL &&
655 !(jp[j].jp_flags & JP_RAWVALUE)) {
656 jp[j].jp_value = malloc(jp[j].jp_valuelen);
657 if (jp[j].jp_value == NULL) {
658 strerror_r(errno, jail_errmsg,
659 JAIL_ERRMSGLEN);
660 return (-1);
661 }
662 }
663 jiov[i].iov_base = jp[j].jp_value;
664 jiov[i].iov_len = jp[j].jp_valuelen;
665 memset(jiov[i].iov_base, 0, jiov[i].iov_len);
666 i++;
667 }
668 }
669 /*
670 * Get the prison. If there are array elements, retry a few times
671 * in case their sizes changed from under us.
672 */
673 for (sanity = 0;; sanity++) {
674 jid = jail_get(jiov, i, flags);
675 if (jid >= 0 || !arrays || sanity == ARRAY_SANITY ||
676 errno != EINVAL || jail_errmsg[0])
677 break;
678 for (ai = j = 0; j < njp; j++) {
679 if (jp[j].jp_elemlen &&
680 !(jp[j].jp_flags & JP_RAWVALUE)) {
681 ai++;
682 jiov[ai].iov_base = NULL;
683 jiov[ai].iov_len = 0;
684 ai++;
685 }
686 }
687 if (jail_get(jiov, ki, flags) < 0)
688 break;
689 for (ai = j = 0; j < njp; j++) {
690 if (jp[j].jp_elemlen &&
691 !(jp[j].jp_flags & JP_RAWVALUE)) {
692 ai++;
693 jiov[ai].iov_len +=
694 jp[j].jp_elemlen * ARRAY_SLOP;
695 if (jp[j].jp_valuelen >= jiov[ai].iov_len)
696 jiov[ai].iov_len = jp[j].jp_valuelen;
697 else {
698 jp[j].jp_valuelen = jiov[ai].iov_len;
699 if (jp[j].jp_value != NULL)
700 free(jp[j].jp_value);
701 jp[j].jp_value =
702 malloc(jiov[ai].iov_len);
703 if (jp[j].jp_value == NULL) {
704 strerror_r(errno, jail_errmsg,
705 JAIL_ERRMSGLEN);
706 return (-1);
707 }
708 }
709 jiov[ai].iov_base = jp[j].jp_value;
710 memset(jiov[ai].iov_base, 0, jiov[ai].iov_len);
711 ai++;
712 }
713 }
714 }
715 if (jid < 0 && !jail_errmsg[0])
716 snprintf(jail_errmsg, sizeof(jail_errmsg),
717 "jail_get: %s", strerror(errno));
718 for (ai = j = 0, i = ki; j < njp; j++) {
719 if (jp[j].jp_elemlen && !(jp[j].jp_flags & JP_RAWVALUE)) {
720 ai++;
721 jp[j].jp_valuelen = jiov[ai].iov_len;
722 ai++;
723 } else if (jp + j != jp_key) {
724 i++;
725 jp[j].jp_valuelen = jiov[i].iov_len;
726 i++;
727 }
728 }
729 return (jid);
730 }
731
732 /*
733 * Convert a jail parameter's value to external form.
734 */
735 char *
jailparam_export(struct jailparam * jp)736 jailparam_export(struct jailparam *jp)
737 {
738 size_t *valuelens;
739 char *value, *tvalue, **values;
740 size_t valuelen;
741 int i, nval, ival;
742 char valbuf[INET6_ADDRSTRLEN];
743
744 if ((jp->jp_ctltype & CTLTYPE) == CTLTYPE_STRING) {
745 value = strdup(jp->jp_value);
746 if (value == NULL)
747 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
748 return (value);
749 }
750 nval = jp->jp_elemlen ? jp->jp_valuelen / jp->jp_elemlen : 1;
751 if (nval == 0) {
752 value = strdup("");
753 if (value == NULL)
754 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
755 return (value);
756 }
757 values = alloca(nval * sizeof(char *));
758 valuelens = alloca(nval * sizeof(size_t));
759 valuelen = 0;
760 for (i = 0; i < nval; i++) {
761 switch (jp->jp_ctltype & CTLTYPE) {
762 case CTLTYPE_INT:
763 ival = ((int *)jp->jp_value)[i];
764 if ((jp->jp_flags & (JP_BOOL | JP_NOBOOL)) &&
765 (unsigned)ival < 2) {
766 strlcpy(valbuf, bool_values[ival],
767 sizeof(valbuf));
768 break;
769 }
770 if ((jp->jp_flags & JP_JAILSYS) &&
771 (unsigned)ival < sizeof(jailsys_values) /
772 sizeof(jailsys_values[0])) {
773 strlcpy(valbuf, jailsys_values[ival],
774 sizeof(valbuf));
775 break;
776 }
777 snprintf(valbuf, sizeof(valbuf), "%d", ival);
778 break;
779 case CTLTYPE_UINT:
780 snprintf(valbuf, sizeof(valbuf), "%u",
781 ((unsigned *)jp->jp_value)[i]);
782 break;
783 case CTLTYPE_LONG:
784 snprintf(valbuf, sizeof(valbuf), "%ld",
785 ((long *)jp->jp_value)[i]);
786 break;
787 case CTLTYPE_ULONG:
788 snprintf(valbuf, sizeof(valbuf), "%lu",
789 ((unsigned long *)jp->jp_value)[i]);
790 break;
791 case CTLTYPE_S64:
792 snprintf(valbuf, sizeof(valbuf), "%jd",
793 (intmax_t)((int64_t *)jp->jp_value)[i]);
794 break;
795 case CTLTYPE_U64:
796 snprintf(valbuf, sizeof(valbuf), "%ju",
797 (uintmax_t)((uint64_t *)jp->jp_value)[i]);
798 break;
799 case CTLTYPE_STRUCT:
800 switch (jp->jp_structtype) {
801 case JPS_IN_ADDR:
802 if (inet_ntop(AF_INET,
803 &((struct in_addr *)jp->jp_value)[i],
804 valbuf, sizeof(valbuf)) == NULL) {
805 strerror_r(errno, jail_errmsg,
806 JAIL_ERRMSGLEN);
807 return (NULL);
808 }
809 break;
810 case JPS_IN6_ADDR:
811 if (inet_ntop(AF_INET6,
812 &((struct in6_addr *)jp->jp_value)[i],
813 valbuf, sizeof(valbuf)) == NULL) {
814 strerror_r(errno, jail_errmsg,
815 JAIL_ERRMSGLEN);
816 return (NULL);
817 }
818 break;
819 default:
820 goto unknown_type;
821 }
822 break;
823 default:
824 unknown_type:
825 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
826 "unknown type for %s", jp->jp_name);
827 errno = ENOENT;
828 return (NULL);
829 }
830 valuelens[i] = strlen(valbuf) + 1;
831 valuelen += valuelens[i];
832 values[i] = alloca(valuelens[i]);
833 strcpy(values[i], valbuf);
834 }
835 value = malloc(valuelen);
836 if (value == NULL)
837 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
838 else {
839 tvalue = value;
840 for (i = 0; i < nval; i++) {
841 strcpy(tvalue, values[i]);
842 if (i < nval - 1) {
843 tvalue += valuelens[i];
844 tvalue[-1] = ',';
845 }
846 }
847 }
848 return (value);
849 }
850
851 /*
852 * Free the contents of a jail parameter list (but not the list itself).
853 */
854 void
jailparam_free(struct jailparam * jp,unsigned njp)855 jailparam_free(struct jailparam *jp, unsigned njp)
856 {
857 unsigned j;
858
859 for (j = 0; j < njp; j++) {
860 free(jp[j].jp_name);
861 if (!(jp[j].jp_flags & JP_RAWVALUE))
862 free(jp[j].jp_value);
863 }
864 }
865
866 /*
867 * Find a parameter's type and size from its MIB.
868 */
869 static int
jailparam_type(struct jailparam * jp)870 jailparam_type(struct jailparam *jp)
871 {
872 char *p, *name, *nname;
873 size_t miblen, desclen;
874 int i, isarray;
875 struct {
876 int i;
877 char s[MAXPATHLEN];
878 } desc;
879 int mib[CTL_MAXNAME];
880
881 /* The "lastjid" parameter isn't real. */
882 name = jp->jp_name;
883 if (!strcmp(name, "lastjid")) {
884 jp->jp_valuelen = sizeof(int);
885 jp->jp_ctltype = CTLTYPE_INT | CTLFLAG_WR;
886 return (0);
887 }
888
889 /* Find the sysctl that describes the parameter. */
890 mib[0] = 0;
891 mib[1] = 3;
892 snprintf(desc.s, sizeof(desc.s), SJPARAM ".%s", name);
893 miblen = sizeof(mib) - 2 * sizeof(int);
894 if (sysctl(mib, 2, mib + 2, &miblen, desc.s, strlen(desc.s)) < 0) {
895 if (errno != ENOENT) {
896 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
897 "sysctl(0.3.%s): %s", name, strerror(errno));
898 return (-1);
899 }
900 if (kldload_param(name) >= 0 && sysctl(mib, 2, mib + 2, &miblen,
901 desc.s, strlen(desc.s)) >= 0)
902 goto mib_desc;
903 /*
904 * The parameter probably doesn't exist. But it might be
905 * the "no" counterpart to a boolean.
906 */
907 nname = nononame(name);
908 if (nname == NULL) {
909 unknown_parameter:
910 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
911 "unknown parameter: %s", jp->jp_name);
912 errno = ENOENT;
913 return (-1);
914 }
915 name = alloca(strlen(nname) + 1);
916 strcpy(name, nname);
917 free(nname);
918 snprintf(desc.s, sizeof(desc.s), SJPARAM ".%s", name);
919 miblen = sizeof(mib) - 2 * sizeof(int);
920 if (sysctl(mib, 2, mib + 2, &miblen, desc.s,
921 strlen(desc.s)) < 0)
922 goto unknown_parameter;
923 jp->jp_flags |= JP_NOBOOL;
924 }
925 mib_desc:
926 mib[1] = 4;
927 desclen = sizeof(desc);
928 if (sysctl(mib, (miblen / sizeof(int)) + 2, &desc, &desclen,
929 NULL, 0) < 0) {
930 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
931 "sysctl(0.4.%s): %s", name, strerror(errno));
932 return (-1);
933 }
934 jp->jp_ctltype = desc.i;
935 /* If this came from removing a "no", it better be a boolean. */
936 if (jp->jp_flags & JP_NOBOOL) {
937 if ((desc.i & CTLTYPE) == CTLTYPE_INT && desc.s[0] == 'B') {
938 jp->jp_valuelen = sizeof(int);
939 return (0);
940 }
941 else if ((desc.i & CTLTYPE) != CTLTYPE_NODE)
942 goto unknown_parameter;
943 }
944 /* See if this is an array type. */
945 p = strchr(desc.s, '\0');
946 isarray = 0;
947 if (p - 2 < desc.s || strcmp(p - 2, ",a"))
948 isarray = 0;
949 else {
950 isarray = 1;
951 p[-2] = 0;
952 }
953 /* Look for types we understand. */
954 switch (desc.i & CTLTYPE) {
955 case CTLTYPE_INT:
956 if (desc.s[0] == 'B')
957 jp->jp_flags |= JP_BOOL;
958 else if (!strcmp(desc.s, "E,jailsys"))
959 jp->jp_flags |= JP_JAILSYS;
960 case CTLTYPE_UINT:
961 jp->jp_valuelen = sizeof(int);
962 break;
963 case CTLTYPE_LONG:
964 case CTLTYPE_ULONG:
965 jp->jp_valuelen = sizeof(long);
966 break;
967 case CTLTYPE_S64:
968 case CTLTYPE_U64:
969 jp->jp_valuelen = sizeof(int64_t);
970 break;
971 case CTLTYPE_STRING:
972 desc.s[0] = 0;
973 desclen = sizeof(desc.s);
974 if (sysctl(mib + 2, miblen / sizeof(int), desc.s, &desclen,
975 NULL, 0) < 0) {
976 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
977 "sysctl(" SJPARAM ".%s): %s", name,
978 strerror(errno));
979 return (-1);
980 }
981 jp->jp_valuelen = strtoul(desc.s, NULL, 10);
982 break;
983 case CTLTYPE_STRUCT:
984 if (!strcmp(desc.s, "S,in_addr")) {
985 jp->jp_structtype = JPS_IN_ADDR;
986 jp->jp_valuelen = sizeof(struct in_addr);
987 } else if (!strcmp(desc.s, "S,in6_addr")) {
988 jp->jp_structtype = JPS_IN6_ADDR;
989 jp->jp_valuelen = sizeof(struct in6_addr);
990 } else {
991 desclen = 0;
992 if (sysctl(mib + 2, miblen / sizeof(int),
993 NULL, &jp->jp_valuelen, NULL, 0) < 0) {
994 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
995 "sysctl(" SJPARAM ".%s): %s", name,
996 strerror(errno));
997 return (-1);
998 }
999 }
1000 break;
1001 case CTLTYPE_NODE:
1002 /*
1003 * A node might be described by an empty-named child,
1004 * which would be immediately before or after the node itself.
1005 */
1006 mib[1] = 1;
1007 miblen += sizeof(int);
1008 for (i = -1; i <= 1; i += 2) {
1009 mib[(miblen / sizeof(int)) + 1] =
1010 mib[(miblen / sizeof(int))] + i;
1011 desclen = sizeof(desc.s);
1012 if (sysctl(mib, (miblen / sizeof(int)) + 2, desc.s,
1013 &desclen, NULL, 0) < 0) {
1014 if (errno == ENOENT)
1015 continue;
1016 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
1017 "sysctl(0.1): %s", strerror(errno));
1018 return (-1);
1019 }
1020 if (desclen == sizeof(SJPARAM) + strlen(name) + 2 &&
1021 memcmp(SJPARAM ".", desc.s, sizeof(SJPARAM)) == 0 &&
1022 memcmp(name, desc.s + sizeof(SJPARAM),
1023 desclen - sizeof(SJPARAM) - 2) == 0 &&
1024 desc.s[desclen - 2] == '.')
1025 goto mib_desc;
1026 }
1027 goto unknown_parameter;
1028 default:
1029 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
1030 "unknown type for %s", jp->jp_name);
1031 errno = ENOENT;
1032 return (-1);
1033 }
1034 if (isarray) {
1035 jp->jp_elemlen = jp->jp_valuelen;
1036 jp->jp_valuelen = 0;
1037 }
1038 return (0);
1039 }
1040
1041 /*
1042 * Attempt to load a kernel module matching an otherwise nonexistent parameter.
1043 */
1044 static int
kldload_param(const char * name)1045 kldload_param(const char *name)
1046 {
1047 int kl;
1048
1049 if (strcmp(name, "linux") == 0 || strncmp(name, "linux.", 6) == 0)
1050 kl = kldload("linux");
1051 else if (strcmp(name, "sysvmsg") == 0 || strcmp(name, "sysvsem") == 0 ||
1052 strcmp(name, "sysvshm") == 0)
1053 kl = kldload(name);
1054 else if (strncmp(name, "allow.mount.", 12) == 0) {
1055 /* Load the matching filesystem */
1056 const char *modname = name + 12;
1057
1058 kl = kldload(modname);
1059 if (kl < 0 && errno == ENOENT &&
1060 strncmp(modname, "no", 2) == 0)
1061 kl = kldload(modname + 2);
1062 } else {
1063 errno = ENOENT;
1064 return (-1);
1065 }
1066 if (kl < 0 && errno == EEXIST) {
1067 /*
1068 * In the module is already loaded, then it must not contain
1069 * the parameter.
1070 */
1071 errno = ENOENT;
1072 }
1073 return kl;
1074 }
1075
1076 /*
1077 * Change a boolean parameter name into its "no" counterpart or vice versa.
1078 */
1079 static char *
noname(const char * name)1080 noname(const char *name)
1081 {
1082 char *nname, *p;
1083
1084 nname = malloc(strlen(name) + 3);
1085 if (nname == NULL) {
1086 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
1087 return (NULL);
1088 }
1089 p = strrchr(name, '.');
1090 if (p != NULL)
1091 sprintf(nname, "%.*s.no%s", (int)(p - name), name, p + 1);
1092 else
1093 sprintf(nname, "no%s", name);
1094 return (nname);
1095 }
1096
1097 static char *
nononame(const char * name)1098 nononame(const char *name)
1099 {
1100 char *p, *nname;
1101
1102 p = strrchr(name, '.');
1103 if (strncmp(p ? p + 1 : name, "no", 2)) {
1104 snprintf(jail_errmsg, sizeof(jail_errmsg),
1105 "mismatched boolean: %s", name);
1106 errno = EINVAL;
1107 return (NULL);
1108 }
1109 nname = malloc(strlen(name) - 1);
1110 if (nname == NULL) {
1111 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
1112 return (NULL);
1113 }
1114 if (p != NULL)
1115 sprintf(nname, "%.*s.%s", (int)(p - name), name, p + 3);
1116 else
1117 strcpy(nname, name + 2);
1118 return (nname);
1119 }
1120