1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2009 James Gritton.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29 #include <sys/cdefs.h>
30 #include <sys/param.h>
31 #include <sys/jail.h>
32 #include <sys/linker.h>
33 #include <sys/socket.h>
34 #include <sys/sysctl.h>
35
36 #include <arpa/inet.h>
37 #include <netinet/in.h>
38
39 #include <errno.h>
40 #include <inttypes.h>
41 #include <stdio.h>
42 #include <stdarg.h>
43 #include <stdlib.h>
44 #include <string.h>
45
46 #include "jail.h"
47
48 #define SJPARAM "security.jail.param"
49
50 #define JPS_IN_ADDR 1
51 #define JPS_IN6_ADDR 2
52
53 #define ARRAY_SANITY 5
54 #define ARRAY_SLOP 5
55
56
57 static int jailparam_import_enum(const char **values, int nvalues,
58 const char *valstr, size_t valsize, int *value);
59 static int jailparam_type(struct jailparam *jp);
60 static int kldload_param(const char *name);
61 static char *noname(const char *name);
62 static char *nononame(const char *name);
63
64 char jail_errmsg[JAIL_ERRMSGLEN];
65
66 static const char *bool_values[] = { "false", "true" };
67 static const char *jailsys_values[] = { "disable", "new", "inherit" };
68
69
70 /*
71 * Import a null-terminated parameter list and set a jail with the flags
72 * and parameters.
73 */
74 int
jail_setv(int flags,...)75 jail_setv(int flags, ...)
76 {
77 va_list ap, tap;
78 struct jailparam *jp;
79 const char *name, *value;
80 int njp, jid;
81
82 /* Create the parameter list and import the parameters. */
83 va_start(ap, flags);
84 va_copy(tap, ap);
85 for (njp = 0; va_arg(tap, char *) != NULL; njp++)
86 (void)va_arg(tap, char *);
87 va_end(tap);
88 jp = alloca(njp * sizeof(struct jailparam));
89 for (njp = 0; (name = va_arg(ap, char *)) != NULL;) {
90 value = va_arg(ap, char *);
91 if (jailparam_init(jp + njp, name) < 0)
92 goto error;
93 if (jailparam_import(jp + njp++, value) < 0)
94 goto error;
95 }
96 va_end(ap);
97 jid = jailparam_set(jp, njp, flags);
98 jailparam_free(jp, njp);
99 return (jid);
100
101 error:
102 jailparam_free(jp, njp);
103 va_end(ap);
104 return (-1);
105 }
106
107 /*
108 * Read a null-terminated parameter list, get the referenced jail, and export
109 * the parameters to the list.
110 */
111 int
jail_getv(int flags,...)112 jail_getv(int flags, ...)
113 {
114 va_list ap, tap;
115 struct jailparam *jp, *jp_lastjid, *jp_jid, *jp_name, *jp_key;
116 char *valarg, *value;
117 const char *name, *key_value, *lastjid_value, *jid_value, *name_value;
118 int njp, i, jid;
119
120 /* Create the parameter list and find the key. */
121 va_start(ap, flags);
122 va_copy(tap, ap);
123 for (njp = 0; va_arg(tap, char *) != NULL; njp++)
124 (void)va_arg(tap, char *);
125 va_end(tap);
126
127 jp = alloca(njp * sizeof(struct jailparam));
128 va_copy(tap, ap);
129 jp_lastjid = jp_jid = jp_name = NULL;
130 lastjid_value = jid_value = name_value = NULL;
131 for (njp = 0; (name = va_arg(tap, char *)) != NULL; njp++) {
132 value = va_arg(tap, char *);
133 if (jailparam_init(jp + njp, name) < 0) {
134 va_end(tap);
135 goto error;
136 }
137 if (!strcmp(jp[njp].jp_name, "lastjid")) {
138 jp_lastjid = jp + njp;
139 lastjid_value = value;
140 } else if (!strcmp(jp[njp].jp_name, "jid")) {
141 jp_jid = jp + njp;
142 jid_value = value;
143 } if (!strcmp(jp[njp].jp_name, "name")) {
144 jp_name = jp + njp;
145 name_value = value;
146 }
147 }
148 va_end(tap);
149 /* Import the key parameter. */
150 if (jp_lastjid != NULL) {
151 jp_key = jp_lastjid;
152 key_value = lastjid_value;
153 } else if (jp_jid != NULL && strtol(jid_value, NULL, 10) != 0) {
154 jp_key = jp_jid;
155 key_value = jid_value;
156 } else if (jp_name != NULL) {
157 jp_key = jp_name;
158 key_value = name_value;
159 } else {
160 strlcpy(jail_errmsg, "no jail specified", JAIL_ERRMSGLEN);
161 errno = ENOENT;
162 goto error;
163 }
164 if (jailparam_import(jp_key, key_value) < 0)
165 goto error;
166 /* Get the jail and export the parameters. */
167 jid = jailparam_get(jp, njp, flags);
168 if (jid < 0)
169 goto error;
170 for (i = 0; i < njp; i++) {
171 (void)va_arg(ap, char *);
172 valarg = va_arg(ap, char *);
173 if (jp + i != jp_key) {
174 /* It's up to the caller to ensure there's room. */
175 if ((jp[i].jp_ctltype & CTLTYPE) == CTLTYPE_STRING)
176 strcpy(valarg, jp[i].jp_value);
177 else {
178 value = jailparam_export(jp + i);
179 if (value == NULL)
180 goto error;
181 strcpy(valarg, value);
182 free(value);
183 }
184 }
185 }
186 jailparam_free(jp, njp);
187 va_end(ap);
188 return (jid);
189
190 error:
191 jailparam_free(jp, njp);
192 va_end(ap);
193 return (-1);
194 }
195
196 /*
197 * Return a list of all known parameters.
198 */
199 int
jailparam_all(struct jailparam ** jpp)200 jailparam_all(struct jailparam **jpp)
201 {
202 struct jailparam *jp, *tjp;
203 size_t mlen1, mlen2, buflen;
204 unsigned njp, nlist;
205 int mib1[CTL_MAXNAME], mib2[CTL_MAXNAME - 2];
206 char buf[MAXPATHLEN];
207
208 njp = 0;
209 nlist = 32;
210 jp = malloc(nlist * sizeof(*jp));
211 if (jp == NULL) {
212 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
213 return (-1);
214 }
215 mib1[0] = 0;
216 mib1[1] = 2;
217 mlen1 = CTL_MAXNAME - 2;
218 if (sysctlnametomib(SJPARAM, mib1 + 2, &mlen1) < 0) {
219 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
220 "sysctlnametomib(" SJPARAM "): %s", strerror(errno));
221 goto error;
222 }
223 for (;; njp++) {
224 /* Get the next parameter. */
225 mlen2 = sizeof(mib2);
226 if (sysctl(mib1, mlen1 + 2, mib2, &mlen2, NULL, 0) < 0) {
227 if (errno == ENOENT) {
228 /* No more entries. */
229 break;
230 }
231 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
232 "sysctl(0.2): %s", strerror(errno));
233 goto error;
234 }
235 if (mib2[0] != mib1[2] ||
236 mib2[1] != mib1[3] ||
237 mib2[2] != mib1[4])
238 break;
239 /* Convert it to an ascii name. */
240 memcpy(mib1 + 2, mib2, mlen2);
241 mlen1 = mlen2 / sizeof(int);
242 mib1[1] = 1;
243 buflen = sizeof(buf);
244 if (sysctl(mib1, mlen1 + 2, buf, &buflen, NULL, 0) < 0) {
245 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
246 "sysctl(0.1): %s", strerror(errno));
247 goto error;
248 }
249 if (buf[buflen - 2] == '.')
250 buf[buflen - 2] = '\0';
251 /* Add the parameter to the list */
252 if (njp >= nlist) {
253 nlist *= 2;
254 tjp = reallocarray(jp, nlist, sizeof(*jp));
255 if (tjp == NULL)
256 goto error;
257 jp = tjp;
258 }
259 if (jailparam_init(jp + njp, buf + sizeof(SJPARAM)) < 0)
260 goto error;
261 mib1[1] = 2;
262 }
263 /* Just return the untrimmed buffer if reallocarray() somehow fails. */
264 tjp = reallocarray(jp, njp, sizeof(*jp));
265 if (tjp != NULL)
266 jp = tjp;
267 *jpp = jp;
268 return (njp);
269
270 error:
271 jailparam_free(jp, njp);
272 free(jp);
273 return (-1);
274 }
275
276 /*
277 * Clear a jail parameter and copy in its name.
278 */
279 int
jailparam_init(struct jailparam * jp,const char * name)280 jailparam_init(struct jailparam *jp, const char *name)
281 {
282
283 memset(jp, 0, sizeof(*jp));
284 jp->jp_name = strdup(name);
285 if (jp->jp_name == NULL) {
286 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
287 return (-1);
288 }
289 if (jailparam_type(jp) < 0) {
290 jailparam_free(jp, 1);
291 jp->jp_name = NULL;
292 jp->jp_value = NULL;
293 return (-1);
294 }
295 return (0);
296 }
297
298 /*
299 * Put a name and value into a jail parameter element, converting the value
300 * to internal form.
301 */
302 int
jailparam_import(struct jailparam * jp,const char * value)303 jailparam_import(struct jailparam *jp, const char *value)
304 {
305 char *p, *ep, *tvalue;
306 const char *avalue;
307 int i, nval, fw;
308
309 if (value == NULL)
310 return (0);
311 if ((jp->jp_ctltype & CTLTYPE) == CTLTYPE_STRING) {
312 jp->jp_value = strdup(value);
313 if (jp->jp_value == NULL) {
314 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
315 return (-1);
316 }
317 return (0);
318 }
319 nval = 1;
320 if (jp->jp_elemlen) {
321 if (value[0] == '\0' || (value[0] == '-' && value[1] == '\0')) {
322 jp->jp_value = strdup("");
323 if (jp->jp_value == NULL) {
324 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
325 return (-1);
326 }
327 jp->jp_valuelen = 0;
328 return (0);
329 }
330 for (p = strchr(value, ','); p; p = strchr(p + 1, ','))
331 nval++;
332 jp->jp_valuelen = jp->jp_elemlen * nval;
333 }
334 jp->jp_value = malloc(jp->jp_valuelen);
335 if (jp->jp_value == NULL) {
336 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
337 return (-1);
338 }
339 avalue = value;
340 for (i = 0; i < nval; i++) {
341 fw = nval == 1 ? strlen(avalue) : strcspn(avalue, ",");
342 switch (jp->jp_ctltype & CTLTYPE) {
343 case CTLTYPE_INT:
344 if (jp->jp_flags & (JP_BOOL | JP_NOBOOL)) {
345 if (!jailparam_import_enum(bool_values, 2,
346 avalue, fw, &((int *)jp->jp_value)[i])) {
347 snprintf(jail_errmsg,
348 JAIL_ERRMSGLEN, "%s: "
349 "unknown boolean value \"%.*s\"",
350 jp->jp_name, fw, avalue);
351 errno = EINVAL;
352 goto error;
353 }
354 break;
355 }
356 if (jp->jp_flags & JP_JAILSYS) {
357 /*
358 * Allow setting a jailsys parameter to "new"
359 * in a booleanesque fashion.
360 */
361 if (value[0] == '\0')
362 ((int *)jp->jp_value)[i] = JAIL_SYS_NEW;
363 else if (!jailparam_import_enum(jailsys_values,
364 sizeof(jailsys_values) /
365 sizeof(jailsys_values[0]), avalue, fw,
366 &((int *)jp->jp_value)[i])) {
367 snprintf(jail_errmsg,
368 JAIL_ERRMSGLEN, "%s: "
369 "unknown jailsys value \"%.*s\"",
370 jp->jp_name, fw, avalue);
371 errno = EINVAL;
372 goto error;
373 }
374 break;
375 }
376 ((int *)jp->jp_value)[i] = strtol(avalue, &ep, 10);
377 integer_test:
378 if (ep != avalue + fw) {
379 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
380 "%s: non-integer value \"%.*s\"",
381 jp->jp_name, fw, avalue);
382 errno = EINVAL;
383 goto error;
384 }
385 break;
386 case CTLTYPE_UINT:
387 ((unsigned *)jp->jp_value)[i] =
388 strtoul(avalue, &ep, 10);
389 goto integer_test;
390 case CTLTYPE_LONG:
391 ((long *)jp->jp_value)[i] = strtol(avalue, &ep, 10);
392 goto integer_test;
393 case CTLTYPE_ULONG:
394 ((unsigned long *)jp->jp_value)[i] =
395 strtoul(avalue, &ep, 10);
396 goto integer_test;
397 case CTLTYPE_S64:
398 ((int64_t *)jp->jp_value)[i] =
399 strtoimax(avalue, &ep, 10);
400 goto integer_test;
401 case CTLTYPE_U64:
402 ((uint64_t *)jp->jp_value)[i] =
403 strtoumax(avalue, &ep, 10);
404 goto integer_test;
405 case CTLTYPE_STRUCT:
406 tvalue = alloca(fw + 1);
407 strlcpy(tvalue, avalue, fw + 1);
408 switch (jp->jp_structtype) {
409 case JPS_IN_ADDR:
410 if (inet_pton(AF_INET, tvalue,
411 &((struct in_addr *)jp->jp_value)[i]) != 1)
412 {
413 snprintf(jail_errmsg,
414 JAIL_ERRMSGLEN,
415 "%s: not an IPv4 address: %s",
416 jp->jp_name, tvalue);
417 errno = EINVAL;
418 goto error;
419 }
420 break;
421 case JPS_IN6_ADDR:
422 if (inet_pton(AF_INET6, tvalue,
423 &((struct in6_addr *)jp->jp_value)[i]) != 1)
424 {
425 snprintf(jail_errmsg,
426 JAIL_ERRMSGLEN,
427 "%s: not an IPv6 address: %s",
428 jp->jp_name, tvalue);
429 errno = EINVAL;
430 goto error;
431 }
432 break;
433 default:
434 goto unknown_type;
435 }
436 break;
437 default:
438 unknown_type:
439 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
440 "unknown type for %s", jp->jp_name);
441 errno = ENOENT;
442 goto error;
443 }
444 avalue += fw + 1;
445 }
446 return (0);
447
448 error:
449 free(jp->jp_value);
450 jp->jp_value = NULL;
451 return (-1);
452 }
453
454 static int
jailparam_import_enum(const char ** values,int nvalues,const char * valstr,size_t valsize,int * value)455 jailparam_import_enum(const char **values, int nvalues, const char *valstr,
456 size_t valsize, int *value)
457 {
458 char *ep;
459 int i;
460
461 for (i = 0; i < nvalues; i++)
462 if (valsize == strlen(values[i]) &&
463 !strncasecmp(valstr, values[i], valsize)) {
464 *value = i;
465 return 1;
466 }
467 *value = strtol(valstr, &ep, 10);
468 return (ep == valstr + valsize);
469 }
470
471 /*
472 * Put a name and value into a jail parameter element, copying the value
473 * but not altering it.
474 */
475 int
jailparam_import_raw(struct jailparam * jp,void * value,size_t valuelen)476 jailparam_import_raw(struct jailparam *jp, void *value, size_t valuelen)
477 {
478
479 jp->jp_value = value;
480 jp->jp_valuelen = valuelen;
481 jp->jp_flags |= JP_RAWVALUE;
482 return (0);
483 }
484
485 /*
486 * Run the jail_set and jail_get system calls on a parameter list.
487 */
488 int
jailparam_set(struct jailparam * jp,unsigned njp,int flags)489 jailparam_set(struct jailparam *jp, unsigned njp, int flags)
490 {
491 struct iovec *jiov;
492 char *nname;
493 int i, jid, bool0;
494 unsigned j;
495
496 jiov = alloca(sizeof(struct iovec) * 2 * (njp + 1));
497 bool0 = 0;
498 for (i = j = 0; j < njp; j++) {
499 jiov[i].iov_base = jp[j].jp_name;
500 jiov[i].iov_len = strlen(jp[j].jp_name) + 1;
501 i++;
502 if (jp[j].jp_flags & (JP_BOOL | JP_NOBOOL)) {
503 /*
504 * Set booleans without values. If one has a value of
505 * zero, change it to (or from) its "no" counterpart.
506 */
507 jiov[i].iov_base = NULL;
508 jiov[i].iov_len = 0;
509 if (jp[j].jp_value != NULL &&
510 jp[j].jp_valuelen == sizeof(int) &&
511 !*(int *)jp[j].jp_value) {
512 bool0 = 1;
513 nname = jp[j].jp_flags & JP_BOOL
514 ? noname(jp[j].jp_name)
515 : nononame(jp[j].jp_name);
516 if (nname == NULL) {
517 njp = j;
518 jid = -1;
519 goto done;
520 }
521 jiov[i - 1].iov_base = nname;
522 jiov[i - 1].iov_len = strlen(nname) + 1;
523
524 }
525 } else {
526 /*
527 * Try to fill in missing values with an empty string.
528 */
529 if (jp[j].jp_value == NULL && jp[j].jp_valuelen > 0 &&
530 jailparam_import(jp + j, "") < 0) {
531 njp = j;
532 jid = -1;
533 goto done;
534 }
535 jiov[i].iov_base = jp[j].jp_value;
536 jiov[i].iov_len =
537 (jp[j].jp_ctltype & CTLTYPE) == CTLTYPE_STRING
538 ? strlen(jp[j].jp_value) + 1
539 : jp[j].jp_valuelen;
540 }
541 i++;
542 }
543 jiov[i].iov_base = __DECONST(char *, "errmsg");
544 jiov[i].iov_len = sizeof("errmsg");
545 i++;
546 jiov[i].iov_base = jail_errmsg;
547 jiov[i].iov_len = JAIL_ERRMSGLEN;
548 i++;
549 jail_errmsg[0] = 0;
550 jid = jail_set(jiov, i, flags);
551 if (jid < 0 && !jail_errmsg[0])
552 snprintf(jail_errmsg, sizeof(jail_errmsg), "jail_set: %s",
553 strerror(errno));
554 done:
555 if (bool0)
556 for (j = 0; j < njp; j++)
557 if ((jp[j].jp_flags & (JP_BOOL | JP_NOBOOL)) &&
558 jp[j].jp_value != NULL &&
559 jp[j].jp_valuelen == sizeof(int) &&
560 !*(int *)jp[j].jp_value)
561 free(jiov[j * 2].iov_base);
562 return (jid);
563 }
564
565 int
jailparam_get(struct jailparam * jp,unsigned njp,int flags)566 jailparam_get(struct jailparam *jp, unsigned njp, int flags)
567 {
568 struct iovec *jiov;
569 struct jailparam *jp_lastjid, *jp_jid, *jp_name, *jp_key;
570 int i, ai, ki, jid, arrays, sanity;
571 unsigned j;
572
573 /*
574 * Get the types for all parameters.
575 * Find the key and any array parameters.
576 */
577 jiov = alloca(sizeof(struct iovec) * 2 * (njp + 1));
578 jp_lastjid = jp_jid = jp_name = NULL;
579 arrays = 0;
580 for (ai = j = 0; j < njp; j++) {
581 if (!strcmp(jp[j].jp_name, "lastjid"))
582 jp_lastjid = jp + j;
583 else if (!strcmp(jp[j].jp_name, "jid"))
584 jp_jid = jp + j;
585 else if (!strcmp(jp[j].jp_name, "name"))
586 jp_name = jp + j;
587 else if (jp[j].jp_elemlen && !(jp[j].jp_flags & JP_RAWVALUE)) {
588 arrays = 1;
589 jiov[ai].iov_base = jp[j].jp_name;
590 jiov[ai].iov_len = strlen(jp[j].jp_name) + 1;
591 ai++;
592 jiov[ai].iov_base = NULL;
593 jiov[ai].iov_len = 0;
594 ai++;
595 }
596 }
597 jp_key = jp_lastjid ? jp_lastjid :
598 jp_jid && jp_jid->jp_valuelen == sizeof(int) &&
599 jp_jid->jp_value && *(int *)jp_jid->jp_value ? jp_jid : jp_name;
600 if (jp_key == NULL || jp_key->jp_value == NULL) {
601 strlcpy(jail_errmsg, "no jail specified", JAIL_ERRMSGLEN);
602 errno = ENOENT;
603 return (-1);
604 }
605 ki = ai;
606 jiov[ki].iov_base = jp_key->jp_name;
607 jiov[ki].iov_len = strlen(jp_key->jp_name) + 1;
608 ki++;
609 jiov[ki].iov_base = jp_key->jp_value;
610 jiov[ki].iov_len = (jp_key->jp_ctltype & CTLTYPE) == CTLTYPE_STRING
611 ? strlen(jp_key->jp_value) + 1 : jp_key->jp_valuelen;
612 ki++;
613 jiov[ki].iov_base = __DECONST(char *, "errmsg");
614 jiov[ki].iov_len = sizeof("errmsg");
615 ki++;
616 jiov[ki].iov_base = jail_errmsg;
617 jiov[ki].iov_len = JAIL_ERRMSGLEN;
618 ki++;
619 jail_errmsg[0] = 0;
620 if (arrays && jail_get(jiov, ki, flags) < 0) {
621 if (!jail_errmsg[0])
622 snprintf(jail_errmsg, sizeof(jail_errmsg),
623 "jail_get: %s", strerror(errno));
624 return (-1);
625 }
626 /* Allocate storage for all parameters. */
627 for (ai = j = 0, i = ki; j < njp; j++) {
628 if (jp[j].jp_elemlen && !(jp[j].jp_flags & JP_RAWVALUE)) {
629 ai++;
630 jiov[ai].iov_len += jp[j].jp_elemlen * ARRAY_SLOP;
631 if (jp[j].jp_valuelen >= jiov[ai].iov_len)
632 jiov[ai].iov_len = jp[j].jp_valuelen;
633 else {
634 jp[j].jp_valuelen = jiov[ai].iov_len;
635 if (jp[j].jp_value != NULL)
636 free(jp[j].jp_value);
637 jp[j].jp_value = malloc(jp[j].jp_valuelen);
638 if (jp[j].jp_value == NULL) {
639 strerror_r(errno, jail_errmsg,
640 JAIL_ERRMSGLEN);
641 return (-1);
642 }
643 }
644 jiov[ai].iov_base = jp[j].jp_value;
645 memset(jiov[ai].iov_base, 0, jiov[ai].iov_len);
646 ai++;
647 } else if (jp + j != jp_key) {
648 jiov[i].iov_base = jp[j].jp_name;
649 jiov[i].iov_len = strlen(jp[j].jp_name) + 1;
650 i++;
651 if (jp[j].jp_value == NULL &&
652 !(jp[j].jp_flags & JP_RAWVALUE)) {
653 jp[j].jp_value = malloc(jp[j].jp_valuelen);
654 if (jp[j].jp_value == NULL) {
655 strerror_r(errno, jail_errmsg,
656 JAIL_ERRMSGLEN);
657 return (-1);
658 }
659 }
660 jiov[i].iov_base = jp[j].jp_value;
661 jiov[i].iov_len = jp[j].jp_valuelen;
662 memset(jiov[i].iov_base, 0, jiov[i].iov_len);
663 i++;
664 }
665 }
666 /*
667 * Get the prison. If there are array elements, retry a few times
668 * in case their sizes changed from under us.
669 */
670 for (sanity = 0;; sanity++) {
671 jid = jail_get(jiov, i, flags);
672 if (jid >= 0 || !arrays || sanity == ARRAY_SANITY ||
673 errno != EINVAL || jail_errmsg[0])
674 break;
675 for (ai = j = 0; j < njp; j++) {
676 if (jp[j].jp_elemlen &&
677 !(jp[j].jp_flags & JP_RAWVALUE)) {
678 ai++;
679 jiov[ai].iov_base = NULL;
680 jiov[ai].iov_len = 0;
681 ai++;
682 }
683 }
684 if (jail_get(jiov, ki, flags) < 0)
685 break;
686 for (ai = j = 0; j < njp; j++) {
687 if (jp[j].jp_elemlen &&
688 !(jp[j].jp_flags & JP_RAWVALUE)) {
689 ai++;
690 jiov[ai].iov_len +=
691 jp[j].jp_elemlen * ARRAY_SLOP;
692 if (jp[j].jp_valuelen >= jiov[ai].iov_len)
693 jiov[ai].iov_len = jp[j].jp_valuelen;
694 else {
695 jp[j].jp_valuelen = jiov[ai].iov_len;
696 if (jp[j].jp_value != NULL)
697 free(jp[j].jp_value);
698 jp[j].jp_value =
699 malloc(jiov[ai].iov_len);
700 if (jp[j].jp_value == NULL) {
701 strerror_r(errno, jail_errmsg,
702 JAIL_ERRMSGLEN);
703 return (-1);
704 }
705 }
706 jiov[ai].iov_base = jp[j].jp_value;
707 memset(jiov[ai].iov_base, 0, jiov[ai].iov_len);
708 ai++;
709 }
710 }
711 }
712 if (jid < 0 && !jail_errmsg[0])
713 snprintf(jail_errmsg, sizeof(jail_errmsg),
714 "jail_get: %s", strerror(errno));
715 for (ai = j = 0, i = ki; j < njp; j++) {
716 if (jp[j].jp_elemlen && !(jp[j].jp_flags & JP_RAWVALUE)) {
717 ai++;
718 jp[j].jp_valuelen = jiov[ai].iov_len;
719 ai++;
720 } else if (jp + j != jp_key) {
721 i++;
722 jp[j].jp_valuelen = jiov[i].iov_len;
723 i++;
724 }
725 }
726 return (jid);
727 }
728
729 /*
730 * Convert a jail parameter's value to external form.
731 */
732 char *
jailparam_export(struct jailparam * jp)733 jailparam_export(struct jailparam *jp)
734 {
735 size_t *valuelens;
736 char *value, *tvalue, **values;
737 size_t valuelen;
738 int i, nval, ival;
739 char valbuf[INET6_ADDRSTRLEN];
740
741 if (jp->jp_value == NULL) {
742 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
743 "parameter %s was not imported", jp->jp_name);
744 errno = EINVAL;
745 return (NULL);
746 }
747 if ((jp->jp_ctltype & CTLTYPE) == CTLTYPE_STRING) {
748 value = strdup(jp->jp_value);
749 if (value == NULL)
750 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
751 return (value);
752 }
753 nval = jp->jp_elemlen ? jp->jp_valuelen / jp->jp_elemlen : 1;
754 if (nval == 0) {
755 value = strdup("");
756 if (value == NULL)
757 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
758 return (value);
759 }
760 values = alloca(nval * sizeof(char *));
761 valuelens = alloca(nval * sizeof(size_t));
762 valuelen = 0;
763 for (i = 0; i < nval; i++) {
764 switch (jp->jp_ctltype & CTLTYPE) {
765 case CTLTYPE_INT:
766 ival = ((int *)jp->jp_value)[i];
767 if ((jp->jp_flags & (JP_BOOL | JP_NOBOOL)) &&
768 (unsigned)ival < 2) {
769 strlcpy(valbuf, bool_values[ival],
770 sizeof(valbuf));
771 break;
772 }
773 if ((jp->jp_flags & JP_JAILSYS) &&
774 (unsigned)ival < sizeof(jailsys_values) /
775 sizeof(jailsys_values[0])) {
776 strlcpy(valbuf, jailsys_values[ival],
777 sizeof(valbuf));
778 break;
779 }
780 snprintf(valbuf, sizeof(valbuf), "%d", ival);
781 break;
782 case CTLTYPE_UINT:
783 snprintf(valbuf, sizeof(valbuf), "%u",
784 ((unsigned *)jp->jp_value)[i]);
785 break;
786 case CTLTYPE_LONG:
787 snprintf(valbuf, sizeof(valbuf), "%ld",
788 ((long *)jp->jp_value)[i]);
789 break;
790 case CTLTYPE_ULONG:
791 snprintf(valbuf, sizeof(valbuf), "%lu",
792 ((unsigned long *)jp->jp_value)[i]);
793 break;
794 case CTLTYPE_S64:
795 snprintf(valbuf, sizeof(valbuf), "%jd",
796 (intmax_t)((int64_t *)jp->jp_value)[i]);
797 break;
798 case CTLTYPE_U64:
799 snprintf(valbuf, sizeof(valbuf), "%ju",
800 (uintmax_t)((uint64_t *)jp->jp_value)[i]);
801 break;
802 case CTLTYPE_STRUCT:
803 switch (jp->jp_structtype) {
804 case JPS_IN_ADDR:
805 if (inet_ntop(AF_INET,
806 &((struct in_addr *)jp->jp_value)[i],
807 valbuf, sizeof(valbuf)) == NULL) {
808 strerror_r(errno, jail_errmsg,
809 JAIL_ERRMSGLEN);
810 return (NULL);
811 }
812 break;
813 case JPS_IN6_ADDR:
814 if (inet_ntop(AF_INET6,
815 &((struct in6_addr *)jp->jp_value)[i],
816 valbuf, sizeof(valbuf)) == NULL) {
817 strerror_r(errno, jail_errmsg,
818 JAIL_ERRMSGLEN);
819 return (NULL);
820 }
821 break;
822 default:
823 goto unknown_type;
824 }
825 break;
826 default:
827 unknown_type:
828 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
829 "unknown type for %s", jp->jp_name);
830 errno = ENOENT;
831 return (NULL);
832 }
833 valuelens[i] = strlen(valbuf) + 1;
834 valuelen += valuelens[i];
835 values[i] = alloca(valuelens[i]);
836 strcpy(values[i], valbuf);
837 }
838 value = malloc(valuelen);
839 if (value == NULL)
840 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
841 else {
842 tvalue = value;
843 for (i = 0; i < nval; i++) {
844 strcpy(tvalue, values[i]);
845 if (i < nval - 1) {
846 tvalue += valuelens[i];
847 tvalue[-1] = ',';
848 }
849 }
850 }
851 return (value);
852 }
853
854 /*
855 * Free the contents of a jail parameter list (but not the list itself).
856 */
857 void
jailparam_free(struct jailparam * jp,unsigned njp)858 jailparam_free(struct jailparam *jp, unsigned njp)
859 {
860 unsigned j;
861
862 for (j = 0; j < njp; j++) {
863 free(jp[j].jp_name);
864 if (!(jp[j].jp_flags & JP_RAWVALUE))
865 free(jp[j].jp_value);
866 }
867 }
868
869 /*
870 * Find a parameter's type and size from its MIB.
871 */
872 static int
jailparam_type(struct jailparam * jp)873 jailparam_type(struct jailparam *jp)
874 {
875 char *p, *name, *nname;
876 size_t miblen, desclen;
877 int i, isarray;
878 struct {
879 int i;
880 char s[MAXPATHLEN];
881 } desc;
882 int mib[CTL_MAXNAME];
883
884 /* The "lastjid" parameter isn't real. */
885 name = jp->jp_name;
886 if (!strcmp(name, "lastjid")) {
887 jp->jp_valuelen = sizeof(int);
888 jp->jp_ctltype = CTLTYPE_INT | CTLFLAG_WR;
889 return (0);
890 }
891
892 /* Find the sysctl that describes the parameter. */
893 mib[0] = 0;
894 mib[1] = 3;
895 snprintf(desc.s, sizeof(desc.s), SJPARAM ".%s", name);
896 miblen = sizeof(mib) - 2 * sizeof(int);
897 if (sysctl(mib, 2, mib + 2, &miblen, desc.s, strlen(desc.s)) < 0) {
898 if (errno != ENOENT) {
899 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
900 "sysctl(0.3.%s): %s", name, strerror(errno));
901 return (-1);
902 }
903 if (kldload_param(name) >= 0 && sysctl(mib, 2, mib + 2, &miblen,
904 desc.s, strlen(desc.s)) >= 0)
905 goto mib_desc;
906 /*
907 * The parameter probably doesn't exist. But it might be
908 * the "no" counterpart to a boolean.
909 */
910 nname = nononame(name);
911 if (nname == NULL) {
912 unknown_parameter:
913 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
914 "unknown parameter: %s", jp->jp_name);
915 errno = ENOENT;
916 return (-1);
917 }
918 name = alloca(strlen(nname) + 1);
919 strcpy(name, nname);
920 free(nname);
921 snprintf(desc.s, sizeof(desc.s), SJPARAM ".%s", name);
922 miblen = sizeof(mib) - 2 * sizeof(int);
923 if (sysctl(mib, 2, mib + 2, &miblen, desc.s,
924 strlen(desc.s)) < 0)
925 goto unknown_parameter;
926 jp->jp_flags |= JP_NOBOOL;
927 }
928 mib_desc:
929 mib[1] = 4;
930 desclen = sizeof(desc);
931 if (sysctl(mib, (miblen / sizeof(int)) + 2, &desc, &desclen,
932 NULL, 0) < 0) {
933 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
934 "sysctl(0.4.%s): %s", name, strerror(errno));
935 return (-1);
936 }
937 jp->jp_ctltype = desc.i;
938 /* If this came from removing a "no", it better be a boolean. */
939 if (jp->jp_flags & JP_NOBOOL) {
940 if ((desc.i & CTLTYPE) == CTLTYPE_INT && desc.s[0] == 'B') {
941 jp->jp_valuelen = sizeof(int);
942 return (0);
943 }
944 else if ((desc.i & CTLTYPE) != CTLTYPE_NODE)
945 goto unknown_parameter;
946 }
947 /* See if this is an array type. */
948 p = strchr(desc.s, '\0');
949 isarray = 0;
950 if (p - 2 < desc.s || strcmp(p - 2, ",a"))
951 isarray = 0;
952 else {
953 isarray = 1;
954 p[-2] = 0;
955 }
956 /* Look for types we understand. */
957 switch (desc.i & CTLTYPE) {
958 case CTLTYPE_INT:
959 if (desc.s[0] == 'B')
960 jp->jp_flags |= JP_BOOL;
961 else if (!strcmp(desc.s, "E,jailsys"))
962 jp->jp_flags |= JP_JAILSYS;
963 case CTLTYPE_UINT:
964 jp->jp_valuelen = sizeof(int);
965 break;
966 case CTLTYPE_LONG:
967 case CTLTYPE_ULONG:
968 jp->jp_valuelen = sizeof(long);
969 break;
970 case CTLTYPE_S64:
971 case CTLTYPE_U64:
972 jp->jp_valuelen = sizeof(int64_t);
973 break;
974 case CTLTYPE_STRING:
975 desc.s[0] = 0;
976 desclen = sizeof(desc.s);
977 if (sysctl(mib + 2, miblen / sizeof(int), desc.s, &desclen,
978 NULL, 0) < 0) {
979 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
980 "sysctl(" SJPARAM ".%s): %s", name,
981 strerror(errno));
982 return (-1);
983 }
984 jp->jp_valuelen = strtoul(desc.s, NULL, 10);
985 break;
986 case CTLTYPE_STRUCT:
987 if (!strcmp(desc.s, "S,in_addr")) {
988 jp->jp_structtype = JPS_IN_ADDR;
989 jp->jp_valuelen = sizeof(struct in_addr);
990 } else if (!strcmp(desc.s, "S,in6_addr")) {
991 jp->jp_structtype = JPS_IN6_ADDR;
992 jp->jp_valuelen = sizeof(struct in6_addr);
993 } else {
994 desclen = 0;
995 if (sysctl(mib + 2, miblen / sizeof(int),
996 NULL, &jp->jp_valuelen, NULL, 0) < 0) {
997 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
998 "sysctl(" SJPARAM ".%s): %s", name,
999 strerror(errno));
1000 return (-1);
1001 }
1002 }
1003 break;
1004 case CTLTYPE_NODE:
1005 /*
1006 * A node might be described by an empty-named child,
1007 * which would be immediately before or after the node itself.
1008 */
1009 mib[1] = 1;
1010 miblen += sizeof(int);
1011 for (i = -1; i <= 1; i += 2) {
1012 mib[(miblen / sizeof(int)) + 1] =
1013 mib[(miblen / sizeof(int))] + i;
1014 desclen = sizeof(desc.s);
1015 if (sysctl(mib, (miblen / sizeof(int)) + 2, desc.s,
1016 &desclen, NULL, 0) < 0) {
1017 if (errno == ENOENT)
1018 continue;
1019 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
1020 "sysctl(0.1): %s", strerror(errno));
1021 return (-1);
1022 }
1023 if (desclen == sizeof(SJPARAM) + strlen(name) + 2 &&
1024 memcmp(SJPARAM ".", desc.s, sizeof(SJPARAM)) == 0 &&
1025 memcmp(name, desc.s + sizeof(SJPARAM),
1026 desclen - sizeof(SJPARAM) - 2) == 0 &&
1027 desc.s[desclen - 2] == '.')
1028 goto mib_desc;
1029 }
1030 goto unknown_parameter;
1031 default:
1032 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
1033 "unknown type for %s", jp->jp_name);
1034 errno = ENOENT;
1035 return (-1);
1036 }
1037 if (isarray) {
1038 jp->jp_elemlen = jp->jp_valuelen;
1039 jp->jp_valuelen = 0;
1040 }
1041 return (0);
1042 }
1043
1044 /*
1045 * Attempt to load a kernel module matching an otherwise nonexistent parameter.
1046 */
1047 static int
kldload_param(const char * name)1048 kldload_param(const char *name)
1049 {
1050 int kl;
1051
1052 if (strcmp(name, "linux") == 0 || strncmp(name, "linux.", 6) == 0)
1053 kl = kldload("linux");
1054 else if (strcmp(name, "sysvmsg") == 0 || strcmp(name, "sysvsem") == 0 ||
1055 strcmp(name, "sysvshm") == 0)
1056 kl = kldload(name);
1057 else if (strncmp(name, "allow.mount.", 12) == 0) {
1058 /* Load the matching filesystem */
1059 const char *modname = name + 12;
1060
1061 kl = kldload(modname);
1062 if (kl < 0 && errno == ENOENT &&
1063 strncmp(modname, "no", 2) == 0)
1064 kl = kldload(modname + 2);
1065 } else {
1066 errno = ENOENT;
1067 return (-1);
1068 }
1069 if (kl < 0 && errno == EEXIST) {
1070 /*
1071 * In the module is already loaded, then it must not contain
1072 * the parameter.
1073 */
1074 errno = ENOENT;
1075 }
1076 return kl;
1077 }
1078
1079 /*
1080 * Change a boolean parameter name into its "no" counterpart or vice versa.
1081 */
1082 static char *
noname(const char * name)1083 noname(const char *name)
1084 {
1085 char *nname, *p;
1086
1087 nname = malloc(strlen(name) + 3);
1088 if (nname == NULL) {
1089 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
1090 return (NULL);
1091 }
1092 p = strrchr(name, '.');
1093 if (p != NULL)
1094 sprintf(nname, "%.*s.no%s", (int)(p - name), name, p + 1);
1095 else
1096 sprintf(nname, "no%s", name);
1097 return (nname);
1098 }
1099
1100 static char *
nononame(const char * name)1101 nononame(const char *name)
1102 {
1103 char *p, *nname;
1104
1105 p = strrchr(name, '.');
1106 if (strncmp(p ? p + 1 : name, "no", 2)) {
1107 snprintf(jail_errmsg, sizeof(jail_errmsg),
1108 "mismatched boolean: %s", name);
1109 errno = EINVAL;
1110 return (NULL);
1111 }
1112 nname = malloc(strlen(name) - 1);
1113 if (nname == NULL) {
1114 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
1115 return (NULL);
1116 }
1117 if (p != NULL)
1118 sprintf(nname, "%.*s.%s", (int)(p - name), name, p + 3);
1119 else
1120 strcpy(nname, name + 2);
1121 return (nname);
1122 }
1123