29
30#include <sys/types.h>
31#include <sys/event.h>
32#include <sys/mount.h>
33#include <sys/stat.h>
34#include <sys/sysctl.h>
35#include <sys/user.h>
36#include <sys/wait.h>
37
38#include <err.h>
39#include <errno.h>
40#include <fcntl.h>
41#include <kvm.h>
42#include <login_cap.h>
43#include <paths.h>
44#include <pwd.h>
45#include <signal.h>
46#include <stdio.h>
47#include <stdlib.h>
48#include <string.h>
49#include <unistd.h>
50
51#include "jailp.h"
52
53#define DEFAULT_STOP_TIMEOUT 10
54#define PHASH_SIZE 256
55
56LIST_HEAD(phhead, phash);
57
58struct phash {
59 LIST_ENTRY(phash) le;
60 struct cfjail *j;
61 pid_t pid;
62};
63
64int paralimit = -1;
65
66extern char **environ;
67
68static int run_command(struct cfjail *j);
69static int add_proc(struct cfjail *j, pid_t pid);
70static void clear_procs(struct cfjail *j);
71static struct cfjail *find_proc(pid_t pid);
72static int term_procs(struct cfjail *j);
73static int get_user_info(struct cfjail *j, const char *username,
74 const struct passwd **pwdp, login_cap_t **lcapp);
75static int check_path(struct cfjail *j, const char *pname, const char *path,
76 int isfile, const char *umount_type);
77
78static struct cfjails sleeping = TAILQ_HEAD_INITIALIZER(sleeping);
79static struct cfjails runnable = TAILQ_HEAD_INITIALIZER(runnable);
80static struct cfstring dummystring = { .len = 1 };
81static struct phhead phash[PHASH_SIZE];
82static int kq;
83
84/*
85 * Run the next command associated with a jail.
86 */
87int
88next_command(struct cfjail *j)
89{
90 enum intparam comparam;
91 int create_failed, stopping;
92
93 if (paralimit == 0) {
94 requeue(j, &runnable);
95 return 1;
96 }
97 create_failed = (j->flags & (JF_STOP | JF_FAILED)) == JF_FAILED;
98 stopping = (j->flags & JF_STOP) != 0;
99 comparam = *j->comparam;
100 for (;;) {
101 if (j->comstring == NULL) {
102 j->comparam += create_failed ? -1 : 1;
103 switch ((comparam = *j->comparam)) {
104 case IP__NULL:
105 return 0;
106 case IP_MOUNT_DEVFS:
107 if (!bool_param(j->intparams[IP_MOUNT_DEVFS]))
108 continue;
109 j->comstring = &dummystring;
110 break;
111 case IP_MOUNT_FDESCFS:
112 if (!bool_param(j->intparams[IP_MOUNT_FDESCFS]))
113 continue;
114 j->comstring = &dummystring;
115 case IP__OP:
116 case IP_STOP_TIMEOUT:
117 j->comstring = &dummystring;
118 break;
119 default:
120 if (j->intparams[comparam] == NULL)
121 continue;
122 j->comstring = create_failed || (stopping &&
123 (j->intparams[comparam]->flags & PF_REV))
124 ? TAILQ_LAST(&j->intparams[comparam]->val,
125 cfstrings)
126 : TAILQ_FIRST(&j->intparams[comparam]->val);
127 }
128 } else {
129 j->comstring = j->comstring == &dummystring ? NULL :
130 create_failed || (stopping &&
131 (j->intparams[comparam]->flags & PF_REV))
132 ? TAILQ_PREV(j->comstring, cfstrings, tq)
133 : TAILQ_NEXT(j->comstring, tq);
134 }
135 if (j->comstring == NULL || j->comstring->len == 0 ||
136 (create_failed && (comparam == IP_EXEC_PRESTART ||
137 comparam == IP_EXEC_START || comparam == IP_COMMAND ||
138 comparam == IP_EXEC_POSTSTART)))
139 continue;
140 switch (run_command(j)) {
141 case -1:
142 failed(j);
143 /* FALLTHROUGH */
144 case 1:
145 return 1;
146 }
147 }
148}
149
150/*
151 * Check command exit status
152 */
153int
154finish_command(struct cfjail *j)
155{
156 int error;
157
158 if (!(j->flags & JF_SLEEPQ))
159 return 0;
160 j->flags &= ~JF_SLEEPQ;
161 if (*j->comparam == IP_STOP_TIMEOUT)
162 {
163 j->flags &= ~JF_TIMEOUT;
164 j->pstatus = 0;
165 return 0;
166 }
167 paralimit++;
168 if (!TAILQ_EMPTY(&runnable))
169 requeue(TAILQ_FIRST(&runnable), &ready);
170 error = 0;
171 if (j->flags & JF_TIMEOUT) {
172 j->flags &= ~JF_TIMEOUT;
173 if (*j->comparam != IP_STOP_TIMEOUT) {
174 jail_warnx(j, "%s: timed out", j->comline);
175 failed(j);
176 error = -1;
177 } else if (verbose > 0)
178 jail_note(j, "timed out\n");
179 } else if (j->pstatus != 0) {
180 if (WIFSIGNALED(j->pstatus))
181 jail_warnx(j, "%s: exited on signal %d",
182 j->comline, WTERMSIG(j->pstatus));
183 else
184 jail_warnx(j, "%s: failed", j->comline);
185 j->pstatus = 0;
186 failed(j);
187 error = -1;
188 }
189 free(j->comline);
190 j->comline = NULL;
191 return error;
192}
193
194/*
195 * Check for finished processes or timeouts.
196 */
197struct cfjail *
198next_proc(int nonblock)
199{
200 struct kevent ke;
201 struct timespec ts;
202 struct timespec *tsp;
203 struct cfjail *j;
204
205 if (!TAILQ_EMPTY(&sleeping)) {
206 again:
207 tsp = NULL;
208 if ((j = TAILQ_FIRST(&sleeping)) && j->timeout.tv_sec) {
209 clock_gettime(CLOCK_REALTIME, &ts);
210 ts.tv_sec = j->timeout.tv_sec - ts.tv_sec;
211 ts.tv_nsec = j->timeout.tv_nsec - ts.tv_nsec;
212 if (ts.tv_nsec < 0) {
213 ts.tv_sec--;
214 ts.tv_nsec += 1000000000;
215 }
216 if (ts.tv_sec < 0 ||
217 (ts.tv_sec == 0 && ts.tv_nsec == 0)) {
218 j->flags |= JF_TIMEOUT;
219 clear_procs(j);
220 return j;
221 }
222 tsp = &ts;
223 }
224 if (nonblock) {
225 ts.tv_sec = 0;
226 ts.tv_nsec = 0;
227 tsp = &ts;
228 }
229 switch (kevent(kq, NULL, 0, &ke, 1, tsp)) {
230 case -1:
231 if (errno != EINTR)
232 err(1, "kevent");
233 goto again;
234 case 0:
235 if (!nonblock) {
236 j = TAILQ_FIRST(&sleeping);
237 j->flags |= JF_TIMEOUT;
238 clear_procs(j);
239 return j;
240 }
241 break;
242 case 1:
243 (void)waitpid(ke.ident, NULL, WNOHANG);
244 if ((j = find_proc(ke.ident))) {
245 j->pstatus = ke.data;
246 return j;
247 }
248 goto again;
249 }
250 }
251 return NULL;
252}
253
254/*
255 * Run a single command for a jail, possible inside the jail.
256 */
257static int
258run_command(struct cfjail *j)
259{
260 const struct passwd *pwd;
261 const struct cfstring *comstring, *s;
262 login_cap_t *lcap;
263 char **argv;
264 char *cs, *comcs, *devpath;
265 const char *jidstr, *conslog, *path, *ruleset, *term, *username;
266 enum intparam comparam;
267 size_t comlen;
268 pid_t pid;
269 int argc, bg, clean, consfd, down, fib, i, injail, sjuser, timeout;
270#if defined(INET) || defined(INET6)
| 29
30#include <sys/types.h>
31#include <sys/event.h>
32#include <sys/mount.h>
33#include <sys/stat.h>
34#include <sys/sysctl.h>
35#include <sys/user.h>
36#include <sys/wait.h>
37
38#include <err.h>
39#include <errno.h>
40#include <fcntl.h>
41#include <kvm.h>
42#include <login_cap.h>
43#include <paths.h>
44#include <pwd.h>
45#include <signal.h>
46#include <stdio.h>
47#include <stdlib.h>
48#include <string.h>
49#include <unistd.h>
50
51#include "jailp.h"
52
53#define DEFAULT_STOP_TIMEOUT 10
54#define PHASH_SIZE 256
55
56LIST_HEAD(phhead, phash);
57
58struct phash {
59 LIST_ENTRY(phash) le;
60 struct cfjail *j;
61 pid_t pid;
62};
63
64int paralimit = -1;
65
66extern char **environ;
67
68static int run_command(struct cfjail *j);
69static int add_proc(struct cfjail *j, pid_t pid);
70static void clear_procs(struct cfjail *j);
71static struct cfjail *find_proc(pid_t pid);
72static int term_procs(struct cfjail *j);
73static int get_user_info(struct cfjail *j, const char *username,
74 const struct passwd **pwdp, login_cap_t **lcapp);
75static int check_path(struct cfjail *j, const char *pname, const char *path,
76 int isfile, const char *umount_type);
77
78static struct cfjails sleeping = TAILQ_HEAD_INITIALIZER(sleeping);
79static struct cfjails runnable = TAILQ_HEAD_INITIALIZER(runnable);
80static struct cfstring dummystring = { .len = 1 };
81static struct phhead phash[PHASH_SIZE];
82static int kq;
83
84/*
85 * Run the next command associated with a jail.
86 */
87int
88next_command(struct cfjail *j)
89{
90 enum intparam comparam;
91 int create_failed, stopping;
92
93 if (paralimit == 0) {
94 requeue(j, &runnable);
95 return 1;
96 }
97 create_failed = (j->flags & (JF_STOP | JF_FAILED)) == JF_FAILED;
98 stopping = (j->flags & JF_STOP) != 0;
99 comparam = *j->comparam;
100 for (;;) {
101 if (j->comstring == NULL) {
102 j->comparam += create_failed ? -1 : 1;
103 switch ((comparam = *j->comparam)) {
104 case IP__NULL:
105 return 0;
106 case IP_MOUNT_DEVFS:
107 if (!bool_param(j->intparams[IP_MOUNT_DEVFS]))
108 continue;
109 j->comstring = &dummystring;
110 break;
111 case IP_MOUNT_FDESCFS:
112 if (!bool_param(j->intparams[IP_MOUNT_FDESCFS]))
113 continue;
114 j->comstring = &dummystring;
115 case IP__OP:
116 case IP_STOP_TIMEOUT:
117 j->comstring = &dummystring;
118 break;
119 default:
120 if (j->intparams[comparam] == NULL)
121 continue;
122 j->comstring = create_failed || (stopping &&
123 (j->intparams[comparam]->flags & PF_REV))
124 ? TAILQ_LAST(&j->intparams[comparam]->val,
125 cfstrings)
126 : TAILQ_FIRST(&j->intparams[comparam]->val);
127 }
128 } else {
129 j->comstring = j->comstring == &dummystring ? NULL :
130 create_failed || (stopping &&
131 (j->intparams[comparam]->flags & PF_REV))
132 ? TAILQ_PREV(j->comstring, cfstrings, tq)
133 : TAILQ_NEXT(j->comstring, tq);
134 }
135 if (j->comstring == NULL || j->comstring->len == 0 ||
136 (create_failed && (comparam == IP_EXEC_PRESTART ||
137 comparam == IP_EXEC_START || comparam == IP_COMMAND ||
138 comparam == IP_EXEC_POSTSTART)))
139 continue;
140 switch (run_command(j)) {
141 case -1:
142 failed(j);
143 /* FALLTHROUGH */
144 case 1:
145 return 1;
146 }
147 }
148}
149
150/*
151 * Check command exit status
152 */
153int
154finish_command(struct cfjail *j)
155{
156 int error;
157
158 if (!(j->flags & JF_SLEEPQ))
159 return 0;
160 j->flags &= ~JF_SLEEPQ;
161 if (*j->comparam == IP_STOP_TIMEOUT)
162 {
163 j->flags &= ~JF_TIMEOUT;
164 j->pstatus = 0;
165 return 0;
166 }
167 paralimit++;
168 if (!TAILQ_EMPTY(&runnable))
169 requeue(TAILQ_FIRST(&runnable), &ready);
170 error = 0;
171 if (j->flags & JF_TIMEOUT) {
172 j->flags &= ~JF_TIMEOUT;
173 if (*j->comparam != IP_STOP_TIMEOUT) {
174 jail_warnx(j, "%s: timed out", j->comline);
175 failed(j);
176 error = -1;
177 } else if (verbose > 0)
178 jail_note(j, "timed out\n");
179 } else if (j->pstatus != 0) {
180 if (WIFSIGNALED(j->pstatus))
181 jail_warnx(j, "%s: exited on signal %d",
182 j->comline, WTERMSIG(j->pstatus));
183 else
184 jail_warnx(j, "%s: failed", j->comline);
185 j->pstatus = 0;
186 failed(j);
187 error = -1;
188 }
189 free(j->comline);
190 j->comline = NULL;
191 return error;
192}
193
194/*
195 * Check for finished processes or timeouts.
196 */
197struct cfjail *
198next_proc(int nonblock)
199{
200 struct kevent ke;
201 struct timespec ts;
202 struct timespec *tsp;
203 struct cfjail *j;
204
205 if (!TAILQ_EMPTY(&sleeping)) {
206 again:
207 tsp = NULL;
208 if ((j = TAILQ_FIRST(&sleeping)) && j->timeout.tv_sec) {
209 clock_gettime(CLOCK_REALTIME, &ts);
210 ts.tv_sec = j->timeout.tv_sec - ts.tv_sec;
211 ts.tv_nsec = j->timeout.tv_nsec - ts.tv_nsec;
212 if (ts.tv_nsec < 0) {
213 ts.tv_sec--;
214 ts.tv_nsec += 1000000000;
215 }
216 if (ts.tv_sec < 0 ||
217 (ts.tv_sec == 0 && ts.tv_nsec == 0)) {
218 j->flags |= JF_TIMEOUT;
219 clear_procs(j);
220 return j;
221 }
222 tsp = &ts;
223 }
224 if (nonblock) {
225 ts.tv_sec = 0;
226 ts.tv_nsec = 0;
227 tsp = &ts;
228 }
229 switch (kevent(kq, NULL, 0, &ke, 1, tsp)) {
230 case -1:
231 if (errno != EINTR)
232 err(1, "kevent");
233 goto again;
234 case 0:
235 if (!nonblock) {
236 j = TAILQ_FIRST(&sleeping);
237 j->flags |= JF_TIMEOUT;
238 clear_procs(j);
239 return j;
240 }
241 break;
242 case 1:
243 (void)waitpid(ke.ident, NULL, WNOHANG);
244 if ((j = find_proc(ke.ident))) {
245 j->pstatus = ke.data;
246 return j;
247 }
248 goto again;
249 }
250 }
251 return NULL;
252}
253
254/*
255 * Run a single command for a jail, possible inside the jail.
256 */
257static int
258run_command(struct cfjail *j)
259{
260 const struct passwd *pwd;
261 const struct cfstring *comstring, *s;
262 login_cap_t *lcap;
263 char **argv;
264 char *cs, *comcs, *devpath;
265 const char *jidstr, *conslog, *path, *ruleset, *term, *username;
266 enum intparam comparam;
267 size_t comlen;
268 pid_t pid;
269 int argc, bg, clean, consfd, down, fib, i, injail, sjuser, timeout;
270#if defined(INET) || defined(INET6)
|
373 *(const char **)&argv[argc] = down ? "-alias" : "alias";
374 argv[argc + 1] = NULL;
375 break;
376#endif
377
378 case IP_VNET_INTERFACE:
379 argv = alloca(5 * sizeof(char *));
380 *(const char **)&argv[0] = _PATH_IFCONFIG;
381 argv[1] = comstring->s;
382 *(const char **)&argv[2] = down ? "-vnet" : "vnet";
383 jidstr = string_param(j->intparams[KP_JID]);
384 *(const char **)&argv[3] =
385 jidstr ? jidstr : string_param(j->intparams[KP_NAME]);
386 argv[4] = NULL;
387 break;
388
389 case IP_MOUNT:
390 case IP__MOUNT_FROM_FSTAB:
391 argv = alloca(8 * sizeof(char *));
392 comcs = alloca(comstring->len + 1);
393 strcpy(comcs, comstring->s);
394 argc = 0;
395 for (cs = strtok(comcs, " \t\f\v\r\n"); cs && argc < 4;
396 cs = strtok(NULL, " \t\f\v\r\n"))
397 argv[argc++] = cs;
398 if (argc == 0)
399 return 0;
400 if (argc < 3) {
401 jail_warnx(j, "%s: %s: missing information",
402 j->intparams[comparam]->name, comstring->s);
403 return -1;
404 }
405 if (check_path(j, j->intparams[comparam]->name, argv[1], 0,
406 down ? argv[2] : NULL) < 0)
407 return -1;
408 if (down) {
409 argv[4] = NULL;
410 argv[3] = argv[1];
411 *(const char **)&argv[0] = "/sbin/umount";
412 } else {
413 if (argc == 4) {
414 argv[7] = NULL;
415 argv[6] = argv[1];
416 argv[5] = argv[0];
417 argv[4] = argv[3];
418 *(const char **)&argv[3] = "-o";
419 } else {
420 argv[5] = NULL;
421 argv[4] = argv[1];
422 argv[3] = argv[0];
423 }
424 *(const char **)&argv[0] = _PATH_MOUNT;
425 }
426 *(const char **)&argv[1] = "-t";
427 break;
428
429 case IP_MOUNT_DEVFS:
430 argv = alloca(7 * sizeof(char *));
431 path = string_param(j->intparams[KP_PATH]);
432 if (path == NULL) {
433 jail_warnx(j, "mount.devfs: no path");
434 return -1;
435 }
436 devpath = alloca(strlen(path) + 5);
437 sprintf(devpath, "%s/dev", path);
438 if (check_path(j, "mount.devfs", devpath, 0,
439 down ? "devfs" : NULL) < 0)
440 return -1;
441 if (down) {
442 *(const char **)&argv[0] = "/sbin/umount";
443 argv[1] = devpath;
444 argv[2] = NULL;
445 } else {
446 *(const char **)&argv[0] = _PATH_MOUNT;
447 *(const char **)&argv[1] = "-t";
448 *(const char **)&argv[2] = "devfs";
449 ruleset = string_param(j->intparams[KP_DEVFS_RULESET]);
450 if (!ruleset)
451 ruleset = "4"; /* devfsrules_jail */
452 argv[3] = alloca(11 + strlen(ruleset));
453 sprintf(argv[3], "-oruleset=%s", ruleset);
454 *(const char **)&argv[4] = ".";
455 argv[5] = devpath;
456 argv[6] = NULL;
457 }
458 break;
459
460 case IP_MOUNT_FDESCFS:
461 argv = alloca(7 * sizeof(char *));
462 path = string_param(j->intparams[KP_PATH]);
463 if (path == NULL) {
464 jail_warnx(j, "mount.fdescfs: no path");
465 return -1;
466 }
467 devpath = alloca(strlen(path) + 8);
468 sprintf(devpath, "%s/dev/fd", path);
469 if (check_path(j, "mount.fdescfs", devpath, 0,
470 down ? "fdescfs" : NULL) < 0)
471 return -1;
472 if (down) {
473 *(const char **)&argv[0] = "/sbin/umount";
474 argv[1] = devpath;
475 argv[2] = NULL;
476 } else {
477 *(const char **)&argv[0] = _PATH_MOUNT;
478 *(const char **)&argv[1] = "-t";
479 *(const char **)&argv[2] = "fdescfs";
480 *(const char **)&argv[3] = ".";
481 argv[4] = devpath;
482 argv[5] = NULL;
483 }
484 break;
485
486 case IP_COMMAND:
487 if (j->name != NULL)
488 goto default_command;
489 argc = 0;
490 TAILQ_FOREACH(s, &j->intparams[IP_COMMAND]->val, tq)
491 argc++;
492 argv = alloca((argc + 1) * sizeof(char *));
493 argc = 0;
494 TAILQ_FOREACH(s, &j->intparams[IP_COMMAND]->val, tq)
495 argv[argc++] = s->s;
496 argv[argc] = NULL;
497 j->comstring = &dummystring;
498 break;
499
500 default:
501 default_command:
502 if ((cs = strpbrk(comstring->s, "!\"$&'()*;<>?[\\]`{|}~")) &&
503 !(cs[0] == '&' && cs[1] == '\0')) {
504 argv = alloca(4 * sizeof(char *));
505 *(const char **)&argv[0] = _PATH_BSHELL;
506 *(const char **)&argv[1] = "-c";
507 argv[2] = comstring->s;
508 argv[3] = NULL;
509 } else {
510 if (cs) {
511 *cs = 0;
512 bg = 1;
513 }
514 comcs = alloca(comstring->len + 1);
515 strcpy(comcs, comstring->s);
516 argc = 0;
517 for (cs = strtok(comcs, " \t\f\v\r\n"); cs;
518 cs = strtok(NULL, " \t\f\v\r\n"))
519 argc++;
520 argv = alloca((argc + 1) * sizeof(char *));
521 strcpy(comcs, comstring->s);
522 argc = 0;
523 for (cs = strtok(comcs, " \t\f\v\r\n"); cs;
524 cs = strtok(NULL, " \t\f\v\r\n"))
525 argv[argc++] = cs;
526 argv[argc] = NULL;
527 }
528 }
529 if (argv[0] == NULL)
530 return 0;
531
532 if (int_param(j->intparams[IP_EXEC_TIMEOUT], &timeout) &&
533 timeout != 0) {
534 clock_gettime(CLOCK_REALTIME, &j->timeout);
535 j->timeout.tv_sec += timeout;
536 } else
537 j->timeout.tv_sec = 0;
538
539 injail = comparam == IP_EXEC_START || comparam == IP_COMMAND ||
540 comparam == IP_EXEC_STOP;
541 clean = bool_param(j->intparams[IP_EXEC_CLEAN]);
542 username = string_param(j->intparams[injail
543 ? IP_EXEC_JAIL_USER : IP_EXEC_SYSTEM_USER]);
544 sjuser = bool_param(j->intparams[IP_EXEC_SYSTEM_JAIL_USER]);
545
546 consfd = 0;
547 if (injail &&
548 (conslog = string_param(j->intparams[IP_EXEC_CONSOLELOG]))) {
549 if (check_path(j, "exec.consolelog", conslog, 1, NULL) < 0)
550 return -1;
551 consfd =
552 open(conslog, O_WRONLY | O_CREAT | O_APPEND, DEFFILEMODE);
553 if (consfd < 0) {
554 jail_warnx(j, "open %s: %s", conslog, strerror(errno));
555 return -1;
556 }
557 }
558
559 comlen = 0;
560 for (i = 0; argv[i]; i++)
561 comlen += strlen(argv[i]) + 1;
562 j->comline = cs = emalloc(comlen);
563 for (i = 0; argv[i]; i++) {
564 strcpy(cs, argv[i]);
565 if (argv[i + 1]) {
566 cs += strlen(argv[i]) + 1;
567 cs[-1] = ' ';
568 }
569 }
570 if (verbose > 0)
571 jail_note(j, "run command%s%s%s: %s\n",
572 injail ? " in jail" : "", username ? " as " : "",
573 username ? username : "", j->comline);
574
575 pid = fork();
576 if (pid < 0)
577 err(1, "fork");
578 if (pid > 0) {
579 if (bg || !add_proc(j, pid)) {
580 free(j->comline);
581 j->comline = NULL;
582 return 0;
583 } else {
584 paralimit--;
585 return 1;
586 }
587 }
588 if (bg)
589 setsid();
590
591 /* Set up the environment and run the command */
592 pwd = NULL;
593 lcap = NULL;
594 if ((clean || username) && injail && sjuser &&
595 get_user_info(j, username, &pwd, &lcap) < 0)
596 exit(1);
597 if (injail) {
598 /* jail_attach won't chdir along with its chroot. */
599 path = string_param(j->intparams[KP_PATH]);
600 if (path && chdir(path) < 0) {
601 jail_warnx(j, "chdir %s: %s", path, strerror(errno));
602 exit(1);
603 }
604 if (int_param(j->intparams[IP_EXEC_FIB], &fib) &&
605 setfib(fib) < 0) {
606 jail_warnx(j, "setfib: %s", strerror(errno));
607 exit(1);
608 }
609 if (jail_attach(j->jid) < 0) {
610 jail_warnx(j, "jail_attach: %s", strerror(errno));
611 exit(1);
612 }
613 }
614 if (clean || username) {
615 if (!(injail && sjuser) &&
616 get_user_info(j, username, &pwd, &lcap) < 0)
617 exit(1);
618 if (clean) {
619 term = getenv("TERM");
620 environ = &cleanenv;
621 setenv("PATH", "/bin:/usr/bin", 0);
622 if (term != NULL)
623 setenv("TERM", term, 1);
624 }
625 if (setusercontext(lcap, pwd, pwd->pw_uid, username
626 ? LOGIN_SETALL & ~LOGIN_SETGROUP & ~LOGIN_SETLOGIN
627 : LOGIN_SETPATH | LOGIN_SETENV) < 0) {
628 jail_warnx(j, "setusercontext %s: %s", pwd->pw_name,
629 strerror(errno));
630 exit(1);
631 }
632 login_close(lcap);
633 setenv("USER", pwd->pw_name, 1);
634 setenv("HOME", pwd->pw_dir, 1);
635 setenv("SHELL",
636 *pwd->pw_shell ? pwd->pw_shell : _PATH_BSHELL, 1);
637 if (clean && chdir(pwd->pw_dir) < 0) {
638 jail_warnx(j, "chdir %s: %s",
639 pwd->pw_dir, strerror(errno));
640 exit(1);
641 }
642 endpwent();
643 }
644
645 if (consfd != 0 && (dup2(consfd, 1) < 0 || dup2(consfd, 2) < 0)) {
646 jail_warnx(j, "exec.consolelog: %s", strerror(errno));
647 exit(1);
648 }
649 closefrom(3);
650 execvp(argv[0], argv);
651 jail_warnx(j, "exec %s: %s", argv[0], strerror(errno));
652 exit(1);
653}
654
655/*
656 * Add a process to the hash, tied to a jail.
657 */
658static int
659add_proc(struct cfjail *j, pid_t pid)
660{
661 struct kevent ke;
662 struct cfjail *tj;
663 struct phash *ph;
664
665 if (!kq && (kq = kqueue()) < 0)
666 err(1, "kqueue");
667 EV_SET(&ke, pid, EVFILT_PROC, EV_ADD, NOTE_EXIT, 0, NULL);
668 if (kevent(kq, &ke, 1, NULL, 0, NULL) < 0) {
669 if (errno == ESRCH)
670 return 0;
671 err(1, "kevent");
672 }
673 ph = emalloc(sizeof(struct phash));
674 ph->j = j;
675 ph->pid = pid;
676 LIST_INSERT_HEAD(&phash[pid % PHASH_SIZE], ph, le);
677 j->nprocs++;
678 j->flags |= JF_SLEEPQ;
679 if (j->timeout.tv_sec == 0)
680 requeue(j, &sleeping);
681 else {
682 /* File the jail in the sleep queue acording to its timeout. */
683 TAILQ_REMOVE(j->queue, j, tq);
684 TAILQ_FOREACH(tj, &sleeping, tq) {
685 if (!tj->timeout.tv_sec ||
686 j->timeout.tv_sec < tj->timeout.tv_sec ||
687 (j->timeout.tv_sec == tj->timeout.tv_sec &&
688 j->timeout.tv_nsec <= tj->timeout.tv_nsec)) {
689 TAILQ_INSERT_BEFORE(tj, j, tq);
690 break;
691 }
692 }
693 if (tj == NULL)
694 TAILQ_INSERT_TAIL(&sleeping, j, tq);
695 j->queue = &sleeping;
696 }
697 return 1;
698}
699
700/*
701 * Remove any processes from the hash that correspond to a jail.
702 */
703static void
704clear_procs(struct cfjail *j)
705{
706 struct kevent ke;
707 struct phash *ph, *tph;
708 int i;
709
710 j->nprocs = 0;
711 for (i = 0; i < PHASH_SIZE; i++)
712 LIST_FOREACH_SAFE(ph, &phash[i], le, tph)
713 if (ph->j == j) {
714 EV_SET(&ke, ph->pid, EVFILT_PROC, EV_DELETE,
715 NOTE_EXIT, 0, NULL);
716 (void)kevent(kq, &ke, 1, NULL, 0, NULL);
717 LIST_REMOVE(ph, le);
718 free(ph);
719 }
720}
721
722/*
723 * Find the jail that corresponds to an exited process.
724 */
725static struct cfjail *
726find_proc(pid_t pid)
727{
728 struct cfjail *j;
729 struct phash *ph;
730
731 LIST_FOREACH(ph, &phash[pid % PHASH_SIZE], le)
732 if (ph->pid == pid) {
733 j = ph->j;
734 LIST_REMOVE(ph, le);
735 free(ph);
736 return --j->nprocs ? NULL : j;
737 }
738 return NULL;
739}
740
741/*
742 * Send SIGTERM to all processes in a jail and wait for them to die.
743 */
744static int
745term_procs(struct cfjail *j)
746{
747 struct kinfo_proc *ki;
748 int i, noted, pcnt, timeout;
749
750 static kvm_t *kd;
751
752 if (!int_param(j->intparams[IP_STOP_TIMEOUT], &timeout))
753 timeout = DEFAULT_STOP_TIMEOUT;
754 else if (timeout == 0)
755 return 0;
756
757 if (kd == NULL) {
758 kd = kvm_open(NULL, NULL, NULL, O_RDONLY, NULL);
759 if (kd == NULL)
760 return 0;
761 }
762
763 ki = kvm_getprocs(kd, KERN_PROC_PROC, 0, &pcnt);
764 if (ki == NULL)
765 return 0;
766 noted = 0;
767 for (i = 0; i < pcnt; i++)
768 if (ki[i].ki_jid == j->jid &&
769 kill(ki[i].ki_pid, SIGTERM) == 0) {
770 (void)add_proc(j, ki[i].ki_pid);
771 if (verbose > 0) {
772 if (!noted) {
773 noted = 1;
774 jail_note(j, "sent SIGTERM to:");
775 }
776 printf(" %d", ki[i].ki_pid);
777 }
778 }
779 if (noted)
780 printf("\n");
781 if (j->nprocs > 0) {
782 clock_gettime(CLOCK_REALTIME, &j->timeout);
783 j->timeout.tv_sec += timeout;
784 return 1;
785 }
786 return 0;
787}
788
789/*
790 * Look up a user in the passwd and login.conf files.
791 */
792static int
793get_user_info(struct cfjail *j, const char *username,
794 const struct passwd **pwdp, login_cap_t **lcapp)
795{
796 const struct passwd *pwd;
797
798 *pwdp = pwd = username ? getpwnam(username) : getpwuid(getuid());
799 if (pwd == NULL) {
800 if (errno)
801 jail_warnx(j, "getpwnam%s%s: %s", username ? " " : "",
802 username ? username : "", strerror(errno));
803 else if (username)
804 jail_warnx(j, "%s: no such user", username);
805 else
806 jail_warnx(j, "unknown uid %d", getuid());
807 return -1;
808 }
809 *lcapp = login_getpwclass(pwd);
810 if (*lcapp == NULL) {
811 jail_warnx(j, "getpwclass %s: %s", pwd->pw_name,
812 strerror(errno));
813 return -1;
814 }
815 /* Set the groups while the group file is still available */
816 if (initgroups(pwd->pw_name, pwd->pw_gid) < 0) {
817 jail_warnx(j, "initgroups %s: %s", pwd->pw_name,
818 strerror(errno));
819 return -1;
820 }
821 return 0;
822}
823
824/*
825 * Make sure a mount or consolelog path is a valid absolute pathname
826 * with no symlinks.
827 */
828static int
829check_path(struct cfjail *j, const char *pname, const char *path, int isfile,
830 const char *umount_type)
831{
832 struct stat st, mpst;
833 struct statfs stfs;
834 char *tpath, *p;
835 const char *jailpath;
836 size_t jplen;
837
838 if (path[0] != '/') {
839 jail_warnx(j, "%s: %s: not an absolute pathname",
840 pname, path);
841 return -1;
842 }
843 /*
844 * Only check for symlinks in components below the jail's path,
845 * since that's where the security risk lies.
846 */
847 jailpath = string_param(j->intparams[KP_PATH]);
848 if (jailpath == NULL)
849 jailpath = "";
850 jplen = strlen(jailpath);
851 if (!strncmp(path, jailpath, jplen) && path[jplen] == '/') {
852 tpath = alloca(strlen(path) + 1);
853 strcpy(tpath, path);
854 for (p = tpath + jplen; p != NULL; ) {
855 p = strchr(p + 1, '/');
856 if (p)
857 *p = '\0';
858 if (lstat(tpath, &st) < 0) {
859 if (errno == ENOENT && isfile && !p)
860 break;
861 jail_warnx(j, "%s: %s: %s", pname, tpath,
862 strerror(errno));
863 return -1;
864 }
865 if (S_ISLNK(st.st_mode)) {
866 jail_warnx(j, "%s: %s is a symbolic link",
867 pname, tpath);
868 return -1;
869 }
870 if (p)
871 *p = '/';
872 }
873 }
874 if (umount_type != NULL) {
875 if (stat(path, &st) < 0 || statfs(path, &stfs) < 0) {
876 jail_warnx(j, "%s: %s: %s", pname, path,
877 strerror(errno));
878 return -1;
879 }
880 if (stat(stfs.f_mntonname, &mpst) < 0) {
881 jail_warnx(j, "%s: %s: %s", pname, stfs.f_mntonname,
882 strerror(errno));
883 return -1;
884 }
885 if (st.st_ino != mpst.st_ino) {
886 jail_warnx(j, "%s: %s: not a mount point",
887 pname, path);
888 return -1;
889 }
890 if (strcmp(stfs.f_fstypename, umount_type)) {
891 jail_warnx(j, "%s: %s: not a %s mount",
892 pname, path, umount_type);
893 return -1;
894 }
895 }
896 return 0;
897}
| 419 *(const char **)&argv[argc] = down ? "-alias" : "alias";
420 argv[argc + 1] = NULL;
421 break;
422#endif
423
424 case IP_VNET_INTERFACE:
425 argv = alloca(5 * sizeof(char *));
426 *(const char **)&argv[0] = _PATH_IFCONFIG;
427 argv[1] = comstring->s;
428 *(const char **)&argv[2] = down ? "-vnet" : "vnet";
429 jidstr = string_param(j->intparams[KP_JID]);
430 *(const char **)&argv[3] =
431 jidstr ? jidstr : string_param(j->intparams[KP_NAME]);
432 argv[4] = NULL;
433 break;
434
435 case IP_MOUNT:
436 case IP__MOUNT_FROM_FSTAB:
437 argv = alloca(8 * sizeof(char *));
438 comcs = alloca(comstring->len + 1);
439 strcpy(comcs, comstring->s);
440 argc = 0;
441 for (cs = strtok(comcs, " \t\f\v\r\n"); cs && argc < 4;
442 cs = strtok(NULL, " \t\f\v\r\n"))
443 argv[argc++] = cs;
444 if (argc == 0)
445 return 0;
446 if (argc < 3) {
447 jail_warnx(j, "%s: %s: missing information",
448 j->intparams[comparam]->name, comstring->s);
449 return -1;
450 }
451 if (check_path(j, j->intparams[comparam]->name, argv[1], 0,
452 down ? argv[2] : NULL) < 0)
453 return -1;
454 if (down) {
455 argv[4] = NULL;
456 argv[3] = argv[1];
457 *(const char **)&argv[0] = "/sbin/umount";
458 } else {
459 if (argc == 4) {
460 argv[7] = NULL;
461 argv[6] = argv[1];
462 argv[5] = argv[0];
463 argv[4] = argv[3];
464 *(const char **)&argv[3] = "-o";
465 } else {
466 argv[5] = NULL;
467 argv[4] = argv[1];
468 argv[3] = argv[0];
469 }
470 *(const char **)&argv[0] = _PATH_MOUNT;
471 }
472 *(const char **)&argv[1] = "-t";
473 break;
474
475 case IP_MOUNT_DEVFS:
476 argv = alloca(7 * sizeof(char *));
477 path = string_param(j->intparams[KP_PATH]);
478 if (path == NULL) {
479 jail_warnx(j, "mount.devfs: no path");
480 return -1;
481 }
482 devpath = alloca(strlen(path) + 5);
483 sprintf(devpath, "%s/dev", path);
484 if (check_path(j, "mount.devfs", devpath, 0,
485 down ? "devfs" : NULL) < 0)
486 return -1;
487 if (down) {
488 *(const char **)&argv[0] = "/sbin/umount";
489 argv[1] = devpath;
490 argv[2] = NULL;
491 } else {
492 *(const char **)&argv[0] = _PATH_MOUNT;
493 *(const char **)&argv[1] = "-t";
494 *(const char **)&argv[2] = "devfs";
495 ruleset = string_param(j->intparams[KP_DEVFS_RULESET]);
496 if (!ruleset)
497 ruleset = "4"; /* devfsrules_jail */
498 argv[3] = alloca(11 + strlen(ruleset));
499 sprintf(argv[3], "-oruleset=%s", ruleset);
500 *(const char **)&argv[4] = ".";
501 argv[5] = devpath;
502 argv[6] = NULL;
503 }
504 break;
505
506 case IP_MOUNT_FDESCFS:
507 argv = alloca(7 * sizeof(char *));
508 path = string_param(j->intparams[KP_PATH]);
509 if (path == NULL) {
510 jail_warnx(j, "mount.fdescfs: no path");
511 return -1;
512 }
513 devpath = alloca(strlen(path) + 8);
514 sprintf(devpath, "%s/dev/fd", path);
515 if (check_path(j, "mount.fdescfs", devpath, 0,
516 down ? "fdescfs" : NULL) < 0)
517 return -1;
518 if (down) {
519 *(const char **)&argv[0] = "/sbin/umount";
520 argv[1] = devpath;
521 argv[2] = NULL;
522 } else {
523 *(const char **)&argv[0] = _PATH_MOUNT;
524 *(const char **)&argv[1] = "-t";
525 *(const char **)&argv[2] = "fdescfs";
526 *(const char **)&argv[3] = ".";
527 argv[4] = devpath;
528 argv[5] = NULL;
529 }
530 break;
531
532 case IP_COMMAND:
533 if (j->name != NULL)
534 goto default_command;
535 argc = 0;
536 TAILQ_FOREACH(s, &j->intparams[IP_COMMAND]->val, tq)
537 argc++;
538 argv = alloca((argc + 1) * sizeof(char *));
539 argc = 0;
540 TAILQ_FOREACH(s, &j->intparams[IP_COMMAND]->val, tq)
541 argv[argc++] = s->s;
542 argv[argc] = NULL;
543 j->comstring = &dummystring;
544 break;
545
546 default:
547 default_command:
548 if ((cs = strpbrk(comstring->s, "!\"$&'()*;<>?[\\]`{|}~")) &&
549 !(cs[0] == '&' && cs[1] == '\0')) {
550 argv = alloca(4 * sizeof(char *));
551 *(const char **)&argv[0] = _PATH_BSHELL;
552 *(const char **)&argv[1] = "-c";
553 argv[2] = comstring->s;
554 argv[3] = NULL;
555 } else {
556 if (cs) {
557 *cs = 0;
558 bg = 1;
559 }
560 comcs = alloca(comstring->len + 1);
561 strcpy(comcs, comstring->s);
562 argc = 0;
563 for (cs = strtok(comcs, " \t\f\v\r\n"); cs;
564 cs = strtok(NULL, " \t\f\v\r\n"))
565 argc++;
566 argv = alloca((argc + 1) * sizeof(char *));
567 strcpy(comcs, comstring->s);
568 argc = 0;
569 for (cs = strtok(comcs, " \t\f\v\r\n"); cs;
570 cs = strtok(NULL, " \t\f\v\r\n"))
571 argv[argc++] = cs;
572 argv[argc] = NULL;
573 }
574 }
575 if (argv[0] == NULL)
576 return 0;
577
578 if (int_param(j->intparams[IP_EXEC_TIMEOUT], &timeout) &&
579 timeout != 0) {
580 clock_gettime(CLOCK_REALTIME, &j->timeout);
581 j->timeout.tv_sec += timeout;
582 } else
583 j->timeout.tv_sec = 0;
584
585 injail = comparam == IP_EXEC_START || comparam == IP_COMMAND ||
586 comparam == IP_EXEC_STOP;
587 clean = bool_param(j->intparams[IP_EXEC_CLEAN]);
588 username = string_param(j->intparams[injail
589 ? IP_EXEC_JAIL_USER : IP_EXEC_SYSTEM_USER]);
590 sjuser = bool_param(j->intparams[IP_EXEC_SYSTEM_JAIL_USER]);
591
592 consfd = 0;
593 if (injail &&
594 (conslog = string_param(j->intparams[IP_EXEC_CONSOLELOG]))) {
595 if (check_path(j, "exec.consolelog", conslog, 1, NULL) < 0)
596 return -1;
597 consfd =
598 open(conslog, O_WRONLY | O_CREAT | O_APPEND, DEFFILEMODE);
599 if (consfd < 0) {
600 jail_warnx(j, "open %s: %s", conslog, strerror(errno));
601 return -1;
602 }
603 }
604
605 comlen = 0;
606 for (i = 0; argv[i]; i++)
607 comlen += strlen(argv[i]) + 1;
608 j->comline = cs = emalloc(comlen);
609 for (i = 0; argv[i]; i++) {
610 strcpy(cs, argv[i]);
611 if (argv[i + 1]) {
612 cs += strlen(argv[i]) + 1;
613 cs[-1] = ' ';
614 }
615 }
616 if (verbose > 0)
617 jail_note(j, "run command%s%s%s: %s\n",
618 injail ? " in jail" : "", username ? " as " : "",
619 username ? username : "", j->comline);
620
621 pid = fork();
622 if (pid < 0)
623 err(1, "fork");
624 if (pid > 0) {
625 if (bg || !add_proc(j, pid)) {
626 free(j->comline);
627 j->comline = NULL;
628 return 0;
629 } else {
630 paralimit--;
631 return 1;
632 }
633 }
634 if (bg)
635 setsid();
636
637 /* Set up the environment and run the command */
638 pwd = NULL;
639 lcap = NULL;
640 if ((clean || username) && injail && sjuser &&
641 get_user_info(j, username, &pwd, &lcap) < 0)
642 exit(1);
643 if (injail) {
644 /* jail_attach won't chdir along with its chroot. */
645 path = string_param(j->intparams[KP_PATH]);
646 if (path && chdir(path) < 0) {
647 jail_warnx(j, "chdir %s: %s", path, strerror(errno));
648 exit(1);
649 }
650 if (int_param(j->intparams[IP_EXEC_FIB], &fib) &&
651 setfib(fib) < 0) {
652 jail_warnx(j, "setfib: %s", strerror(errno));
653 exit(1);
654 }
655 if (jail_attach(j->jid) < 0) {
656 jail_warnx(j, "jail_attach: %s", strerror(errno));
657 exit(1);
658 }
659 }
660 if (clean || username) {
661 if (!(injail && sjuser) &&
662 get_user_info(j, username, &pwd, &lcap) < 0)
663 exit(1);
664 if (clean) {
665 term = getenv("TERM");
666 environ = &cleanenv;
667 setenv("PATH", "/bin:/usr/bin", 0);
668 if (term != NULL)
669 setenv("TERM", term, 1);
670 }
671 if (setusercontext(lcap, pwd, pwd->pw_uid, username
672 ? LOGIN_SETALL & ~LOGIN_SETGROUP & ~LOGIN_SETLOGIN
673 : LOGIN_SETPATH | LOGIN_SETENV) < 0) {
674 jail_warnx(j, "setusercontext %s: %s", pwd->pw_name,
675 strerror(errno));
676 exit(1);
677 }
678 login_close(lcap);
679 setenv("USER", pwd->pw_name, 1);
680 setenv("HOME", pwd->pw_dir, 1);
681 setenv("SHELL",
682 *pwd->pw_shell ? pwd->pw_shell : _PATH_BSHELL, 1);
683 if (clean && chdir(pwd->pw_dir) < 0) {
684 jail_warnx(j, "chdir %s: %s",
685 pwd->pw_dir, strerror(errno));
686 exit(1);
687 }
688 endpwent();
689 }
690
691 if (consfd != 0 && (dup2(consfd, 1) < 0 || dup2(consfd, 2) < 0)) {
692 jail_warnx(j, "exec.consolelog: %s", strerror(errno));
693 exit(1);
694 }
695 closefrom(3);
696 execvp(argv[0], argv);
697 jail_warnx(j, "exec %s: %s", argv[0], strerror(errno));
698 exit(1);
699}
700
701/*
702 * Add a process to the hash, tied to a jail.
703 */
704static int
705add_proc(struct cfjail *j, pid_t pid)
706{
707 struct kevent ke;
708 struct cfjail *tj;
709 struct phash *ph;
710
711 if (!kq && (kq = kqueue()) < 0)
712 err(1, "kqueue");
713 EV_SET(&ke, pid, EVFILT_PROC, EV_ADD, NOTE_EXIT, 0, NULL);
714 if (kevent(kq, &ke, 1, NULL, 0, NULL) < 0) {
715 if (errno == ESRCH)
716 return 0;
717 err(1, "kevent");
718 }
719 ph = emalloc(sizeof(struct phash));
720 ph->j = j;
721 ph->pid = pid;
722 LIST_INSERT_HEAD(&phash[pid % PHASH_SIZE], ph, le);
723 j->nprocs++;
724 j->flags |= JF_SLEEPQ;
725 if (j->timeout.tv_sec == 0)
726 requeue(j, &sleeping);
727 else {
728 /* File the jail in the sleep queue acording to its timeout. */
729 TAILQ_REMOVE(j->queue, j, tq);
730 TAILQ_FOREACH(tj, &sleeping, tq) {
731 if (!tj->timeout.tv_sec ||
732 j->timeout.tv_sec < tj->timeout.tv_sec ||
733 (j->timeout.tv_sec == tj->timeout.tv_sec &&
734 j->timeout.tv_nsec <= tj->timeout.tv_nsec)) {
735 TAILQ_INSERT_BEFORE(tj, j, tq);
736 break;
737 }
738 }
739 if (tj == NULL)
740 TAILQ_INSERT_TAIL(&sleeping, j, tq);
741 j->queue = &sleeping;
742 }
743 return 1;
744}
745
746/*
747 * Remove any processes from the hash that correspond to a jail.
748 */
749static void
750clear_procs(struct cfjail *j)
751{
752 struct kevent ke;
753 struct phash *ph, *tph;
754 int i;
755
756 j->nprocs = 0;
757 for (i = 0; i < PHASH_SIZE; i++)
758 LIST_FOREACH_SAFE(ph, &phash[i], le, tph)
759 if (ph->j == j) {
760 EV_SET(&ke, ph->pid, EVFILT_PROC, EV_DELETE,
761 NOTE_EXIT, 0, NULL);
762 (void)kevent(kq, &ke, 1, NULL, 0, NULL);
763 LIST_REMOVE(ph, le);
764 free(ph);
765 }
766}
767
768/*
769 * Find the jail that corresponds to an exited process.
770 */
771static struct cfjail *
772find_proc(pid_t pid)
773{
774 struct cfjail *j;
775 struct phash *ph;
776
777 LIST_FOREACH(ph, &phash[pid % PHASH_SIZE], le)
778 if (ph->pid == pid) {
779 j = ph->j;
780 LIST_REMOVE(ph, le);
781 free(ph);
782 return --j->nprocs ? NULL : j;
783 }
784 return NULL;
785}
786
787/*
788 * Send SIGTERM to all processes in a jail and wait for them to die.
789 */
790static int
791term_procs(struct cfjail *j)
792{
793 struct kinfo_proc *ki;
794 int i, noted, pcnt, timeout;
795
796 static kvm_t *kd;
797
798 if (!int_param(j->intparams[IP_STOP_TIMEOUT], &timeout))
799 timeout = DEFAULT_STOP_TIMEOUT;
800 else if (timeout == 0)
801 return 0;
802
803 if (kd == NULL) {
804 kd = kvm_open(NULL, NULL, NULL, O_RDONLY, NULL);
805 if (kd == NULL)
806 return 0;
807 }
808
809 ki = kvm_getprocs(kd, KERN_PROC_PROC, 0, &pcnt);
810 if (ki == NULL)
811 return 0;
812 noted = 0;
813 for (i = 0; i < pcnt; i++)
814 if (ki[i].ki_jid == j->jid &&
815 kill(ki[i].ki_pid, SIGTERM) == 0) {
816 (void)add_proc(j, ki[i].ki_pid);
817 if (verbose > 0) {
818 if (!noted) {
819 noted = 1;
820 jail_note(j, "sent SIGTERM to:");
821 }
822 printf(" %d", ki[i].ki_pid);
823 }
824 }
825 if (noted)
826 printf("\n");
827 if (j->nprocs > 0) {
828 clock_gettime(CLOCK_REALTIME, &j->timeout);
829 j->timeout.tv_sec += timeout;
830 return 1;
831 }
832 return 0;
833}
834
835/*
836 * Look up a user in the passwd and login.conf files.
837 */
838static int
839get_user_info(struct cfjail *j, const char *username,
840 const struct passwd **pwdp, login_cap_t **lcapp)
841{
842 const struct passwd *pwd;
843
844 *pwdp = pwd = username ? getpwnam(username) : getpwuid(getuid());
845 if (pwd == NULL) {
846 if (errno)
847 jail_warnx(j, "getpwnam%s%s: %s", username ? " " : "",
848 username ? username : "", strerror(errno));
849 else if (username)
850 jail_warnx(j, "%s: no such user", username);
851 else
852 jail_warnx(j, "unknown uid %d", getuid());
853 return -1;
854 }
855 *lcapp = login_getpwclass(pwd);
856 if (*lcapp == NULL) {
857 jail_warnx(j, "getpwclass %s: %s", pwd->pw_name,
858 strerror(errno));
859 return -1;
860 }
861 /* Set the groups while the group file is still available */
862 if (initgroups(pwd->pw_name, pwd->pw_gid) < 0) {
863 jail_warnx(j, "initgroups %s: %s", pwd->pw_name,
864 strerror(errno));
865 return -1;
866 }
867 return 0;
868}
869
870/*
871 * Make sure a mount or consolelog path is a valid absolute pathname
872 * with no symlinks.
873 */
874static int
875check_path(struct cfjail *j, const char *pname, const char *path, int isfile,
876 const char *umount_type)
877{
878 struct stat st, mpst;
879 struct statfs stfs;
880 char *tpath, *p;
881 const char *jailpath;
882 size_t jplen;
883
884 if (path[0] != '/') {
885 jail_warnx(j, "%s: %s: not an absolute pathname",
886 pname, path);
887 return -1;
888 }
889 /*
890 * Only check for symlinks in components below the jail's path,
891 * since that's where the security risk lies.
892 */
893 jailpath = string_param(j->intparams[KP_PATH]);
894 if (jailpath == NULL)
895 jailpath = "";
896 jplen = strlen(jailpath);
897 if (!strncmp(path, jailpath, jplen) && path[jplen] == '/') {
898 tpath = alloca(strlen(path) + 1);
899 strcpy(tpath, path);
900 for (p = tpath + jplen; p != NULL; ) {
901 p = strchr(p + 1, '/');
902 if (p)
903 *p = '\0';
904 if (lstat(tpath, &st) < 0) {
905 if (errno == ENOENT && isfile && !p)
906 break;
907 jail_warnx(j, "%s: %s: %s", pname, tpath,
908 strerror(errno));
909 return -1;
910 }
911 if (S_ISLNK(st.st_mode)) {
912 jail_warnx(j, "%s: %s is a symbolic link",
913 pname, tpath);
914 return -1;
915 }
916 if (p)
917 *p = '/';
918 }
919 }
920 if (umount_type != NULL) {
921 if (stat(path, &st) < 0 || statfs(path, &stfs) < 0) {
922 jail_warnx(j, "%s: %s: %s", pname, path,
923 strerror(errno));
924 return -1;
925 }
926 if (stat(stfs.f_mntonname, &mpst) < 0) {
927 jail_warnx(j, "%s: %s: %s", pname, stfs.f_mntonname,
928 strerror(errno));
929 return -1;
930 }
931 if (st.st_ino != mpst.st_ino) {
932 jail_warnx(j, "%s: %s: not a mount point",
933 pname, path);
934 return -1;
935 }
936 if (strcmp(stfs.f_fstypename, umount_type)) {
937 jail_warnx(j, "%s: %s: not a %s mount",
938 pname, path, umount_type);
939 return -1;
940 }
941 }
942 return 0;
943}
|