Deleted Added
sdiff udiff text old ( 158475 ) new ( 185435 )
full compact
jail.c (158475) jail.c (185435)
1/*
2 * ----------------------------------------------------------------------------
3 * "THE BEER-WARE LICENSE" (Revision 42):
4 * <phk@FreeBSD.ORG> wrote this file. As long as you retain this notice you
5 * can do whatever you want with this stuff. If we meet some day, and you think
6 * this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp
7 * ----------------------------------------------------------------------------
8 */
9
10#include <sys/cdefs.h>
1/*
2 * ----------------------------------------------------------------------------
3 * "THE BEER-WARE LICENSE" (Revision 42):
4 * <phk@FreeBSD.ORG> wrote this file. As long as you retain this notice you
5 * can do whatever you want with this stuff. If we meet some day, and you think
6 * this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp
7 * ----------------------------------------------------------------------------
8 */
9
10#include <sys/cdefs.h>
11__FBSDID("$FreeBSD: head/usr.sbin/jail/jail.c 158475 2006-05-12 15:14:43Z matteo $");
11__FBSDID("$FreeBSD: head/usr.sbin/jail/jail.c 185435 2008-11-29 14:32:14Z bz $");
12
13#include <sys/param.h>
14#include <sys/jail.h>
12
13#include <sys/param.h>
14#include <sys/jail.h>
15#include <sys/queue.h>
16#include <sys/socket.h>
15#include <sys/sysctl.h>
17#include <sys/sysctl.h>
18#include <sys/types.h>
16
17#include <netinet/in.h>
18#include <arpa/inet.h>
19
20#include <netinet/in.h>
21#include <arpa/inet.h>
22#include <netdb.h>
19
20#include <err.h>
21#include <errno.h>
22#include <grp.h>
23#include <login_cap.h>
24#include <paths.h>
25#include <pwd.h>
26#include <stdio.h>
27#include <stdlib.h>
23
24#include <err.h>
25#include <errno.h>
26#include <grp.h>
27#include <login_cap.h>
28#include <paths.h>
29#include <pwd.h>
30#include <stdio.h>
31#include <stdlib.h>
32#include <strings.h>
28#include <string.h>
29#include <unistd.h>
30
33#include <string.h>
34#include <unistd.h>
35
31static void usage(void);
36static void usage(void);
37static int add_addresses(struct addrinfo *);
38static struct in_addr *copy_addr4(void);
39#ifdef INET6
40static struct in6_addr *copy_addr6(void);
41#endif
42
32extern char **environ;
33
43extern char **environ;
44
45struct addr4entry {
46 STAILQ_ENTRY(addr4entry) addr4entries;
47 struct in_addr ip4;
48 int count;
49};
50struct addr6entry {
51 STAILQ_ENTRY(addr6entry) addr6entries;
52#ifdef INET6
53 struct in6_addr ip6;
54#endif
55 int count;
56};
57STAILQ_HEAD(addr4head, addr4entry) addr4 = STAILQ_HEAD_INITIALIZER(addr4);
58STAILQ_HEAD(addr6head, addr6entry) addr6 = STAILQ_HEAD_INITIALIZER(addr6);
59
34#define GET_USER_INFO do { \
35 pwd = getpwnam(username); \
36 if (pwd == NULL) { \
37 if (errno) \
38 err(1, "getpwnam: %s", username); \
39 else \
40 errx(1, "%s: no such user", username); \
41 } \

--- 6 unchanged lines hidden (view full) ---

48} while (0)
49
50int
51main(int argc, char **argv)
52{
53 login_cap_t *lcap = NULL;
54 struct jail j;
55 struct passwd *pwd = NULL;
60#define GET_USER_INFO do { \
61 pwd = getpwnam(username); \
62 if (pwd == NULL) { \
63 if (errno) \
64 err(1, "getpwnam: %s", username); \
65 else \
66 errx(1, "%s: no such user", username); \
67 } \

--- 6 unchanged lines hidden (view full) ---

74} while (0)
75
76int
77main(int argc, char **argv)
78{
79 login_cap_t *lcap = NULL;
80 struct jail j;
81 struct passwd *pwd = NULL;
56 struct in_addr in;
57 gid_t groups[NGROUPS];
82 gid_t groups[NGROUPS];
58 int ch, i, iflag, Jflag, lflag, ngroups, securelevel, uflag, Uflag;
59 char path[PATH_MAX], *ep, *username, *JidFile;
83 int ch, error, i, ngroups, securelevel;
84 int hflag, iflag, Jflag, lflag, uflag, Uflag;
85 char path[PATH_MAX], *jailname, *ep, *username, *JidFile, *ip;
60 static char *cleanenv;
61 const char *shell, *p = NULL;
62 long ltmp;
63 FILE *fp;
86 static char *cleanenv;
87 const char *shell, *p = NULL;
88 long ltmp;
89 FILE *fp;
90 struct addrinfo hints, *res0;
64
91
65 iflag = Jflag = lflag = uflag = Uflag = 0;
92 hflag = iflag = Jflag = lflag = uflag = Uflag = 0;
66 securelevel = -1;
93 securelevel = -1;
67 username = JidFile = cleanenv = NULL;
94 jailname = username = JidFile = cleanenv = NULL;
68 fp = NULL;
69
95 fp = NULL;
96
70 while ((ch = getopt(argc, argv, "ils:u:U:J:")) != -1) {
97 while ((ch = getopt(argc, argv, "hiln:s:u:U:J:")) != -1) {
71 switch (ch) {
98 switch (ch) {
99 case 'h':
100 hflag = 1;
101 break;
72 case 'i':
73 iflag = 1;
74 break;
75 case 'J':
76 JidFile = optarg;
77 Jflag = 1;
78 break;
102 case 'i':
103 iflag = 1;
104 break;
105 case 'J':
106 JidFile = optarg;
107 Jflag = 1;
108 break;
109 case 'n':
110 jailname = optarg;
111 break;
79 case 's':
80 ltmp = strtol(optarg, &ep, 0);
81 if (*ep || ep == optarg || ltmp > INT_MAX || !ltmp)
82 errx(1, "invalid securelevel: `%s'", optarg);
83 securelevel = ltmp;
84 break;
85 case 'u':
86 username = optarg;

--- 19 unchanged lines hidden (view full) ---

106 if (lflag && username == NULL)
107 usage();
108 if (uflag)
109 GET_USER_INFO;
110 if (realpath(argv[0], path) == NULL)
111 err(1, "realpath: %s", argv[0]);
112 if (chdir(path) != 0)
113 err(1, "chdir: %s", path);
112 case 's':
113 ltmp = strtol(optarg, &ep, 0);
114 if (*ep || ep == optarg || ltmp > INT_MAX || !ltmp)
115 errx(1, "invalid securelevel: `%s'", optarg);
116 securelevel = ltmp;
117 break;
118 case 'u':
119 username = optarg;

--- 19 unchanged lines hidden (view full) ---

139 if (lflag && username == NULL)
140 usage();
141 if (uflag)
142 GET_USER_INFO;
143 if (realpath(argv[0], path) == NULL)
144 err(1, "realpath: %s", argv[0]);
145 if (chdir(path) != 0)
146 err(1, "chdir: %s", path);
147 /* Initialize struct jail. */
114 memset(&j, 0, sizeof(j));
148 memset(&j, 0, sizeof(j));
115 j.version = 0;
149 j.version = JAIL_API_VERSION;
116 j.path = path;
117 j.hostname = argv[1];
150 j.path = path;
151 j.hostname = argv[1];
118 if (inet_aton(argv[2], &in) == 0)
119 errx(1, "Could not make sense of ip-number: %s", argv[2]);
120 j.ip_number = ntohl(in.s_addr);
152 if (jailname != NULL)
153 j.jailname = jailname;
154
155 /* Handle IP addresses. If requested resolve hostname too. */
156 bzero(&hints, sizeof(struct addrinfo));
157 hints.ai_protocol = IPPROTO_TCP;
158 hints.ai_socktype = SOCK_STREAM;
159 if (JAIL_API_VERSION < 2)
160 hints.ai_family = PF_INET;
161 else
162 hints.ai_family = PF_UNSPEC;
163 /* Handle hostname. */
164 if (hflag != 0) {
165 error = getaddrinfo(j.hostname, NULL, &hints, &res0);
166 if (error != 0)
167 errx(1, "failed to handle hostname: %s",
168 gai_strerror(error));
169 error = add_addresses(res0);
170 freeaddrinfo(res0);
171 if (error != 0)
172 errx(1, "failed to add addresses.");
173 }
174 /* Handle IP addresses. */
175 hints.ai_flags = AI_NUMERICHOST;
176 ip = strtok(argv[2], ",");
177 while (ip != NULL) {
178 error = getaddrinfo(ip, NULL, &hints, &res0);
179 if (error != 0)
180 errx(1, "failed to handle ip: %s", gai_strerror(error));
181 error = add_addresses(res0);
182 freeaddrinfo(res0);
183 if (error != 0)
184 errx(1, "failed to add addresses.");
185 ip = strtok(NULL, ",");
186 }
187 /* Count IP addresses and add them to struct jail. */
188 if (!STAILQ_EMPTY(&addr4)) {
189 j.ip4s = STAILQ_FIRST(&addr4)->count;
190 j.ip4 = copy_addr4();
191 if (j.ip4s > 0 && j.ip4 == NULL)
192 errx(1, "copy_addr4()");
193 }
194#ifdef INET6
195 if (!STAILQ_EMPTY(&addr6)) {
196 j.ip6s = STAILQ_FIRST(&addr6)->count;
197 j.ip6 = copy_addr6();
198 if (j.ip6s > 0 && j.ip6 == NULL)
199 errx(1, "copy_addr6()");
200 }
201#endif
202
121 if (Jflag) {
122 fp = fopen(JidFile, "w");
123 if (fp == NULL)
124 errx(1, "Could not create JidFile: %s", JidFile);
125 }
126 i = jail(&j);
127 if (i == -1)
203 if (Jflag) {
204 fp = fopen(JidFile, "w");
205 if (fp == NULL)
206 errx(1, "Could not create JidFile: %s", JidFile);
207 }
208 i = jail(&j);
209 if (i == -1)
128 err(1, "jail");
210 err(1, "syscall failed with");
129 if (iflag) {
130 printf("%d\n", i);
131 fflush(stdout);
132 }
133 if (Jflag) {
134 if (fp != NULL) {
135 fprintf(fp, "%d\t%s\t%s\t%s\t%s\n",
136 i, j.path, j.hostname, argv[2], argv[3]);

--- 41 unchanged lines hidden (view full) ---

178 exit(0);
179}
180
181static void
182usage(void)
183{
184
185 (void)fprintf(stderr, "%s%s%s\n",
211 if (iflag) {
212 printf("%d\n", i);
213 fflush(stdout);
214 }
215 if (Jflag) {
216 if (fp != NULL) {
217 fprintf(fp, "%d\t%s\t%s\t%s\t%s\n",
218 i, j.path, j.hostname, argv[2], argv[3]);

--- 41 unchanged lines hidden (view full) ---

260 exit(0);
261}
262
263static void
264usage(void)
265{
266
267 (void)fprintf(stderr, "%s%s%s\n",
186 "usage: jail [-i] [-J jid_file] [-s securelevel] [-l -u ",
187 "username | -U username]",
188 " path hostname ip-number command ...");
268 "usage: jail [-hi] [-n jailname] [-J jid_file] ",
269 "[-s securelevel] [-l -u username | -U username] ",
270 "path hostname [ip[,..]] command ...");
189 exit(1);
190}
271 exit(1);
272}
273
274static int
275add_addresses(struct addrinfo *res0)
276{
277 int error;
278 struct addrinfo *res;
279 struct addr4entry *a4p;
280 struct sockaddr_in *sai;
281#ifdef INET6
282 struct addr6entry *a6p;
283 struct sockaddr_in6 *sai6;
284#endif
285 int count;
286
287 error = 0;
288 for (res = res0; res && error == 0; res = res->ai_next) {
289 switch (res->ai_family) {
290 case AF_INET:
291 sai = (struct sockaddr_in *)(void *)res->ai_addr;
292 STAILQ_FOREACH(a4p, &addr4, addr4entries) {
293 if (bcmp(&sai->sin_addr, &a4p->ip4,
294 sizeof(struct in_addr)) == 0) {
295 err(1, "Ignoring duplicate IPv4 address.");
296 break;
297 }
298 }
299 a4p = (struct addr4entry *) malloc(
300 sizeof(struct addr4entry));
301 if (a4p == NULL) {
302 error = 1;
303 break;
304 }
305 bzero(a4p, sizeof(struct addr4entry));
306 bcopy(&sai->sin_addr, &a4p->ip4,
307 sizeof(struct in_addr));
308 if (!STAILQ_EMPTY(&addr4))
309 count = STAILQ_FIRST(&addr4)->count;
310 else
311 count = 0;
312 STAILQ_INSERT_TAIL(&addr4, a4p, addr4entries);
313 STAILQ_FIRST(&addr4)->count = count + 1;
314 break;
315#ifdef INET6
316 case AF_INET6:
317 sai6 = (struct sockaddr_in6 *)(void *)res->ai_addr;
318 STAILQ_FOREACH(a6p, &addr6, addr6entries) {
319 if (bcmp(&sai6->sin6_addr, &a6p->ip6,
320 sizeof(struct in6_addr)) == 0) {
321 err(1, "Ignoring duplicate IPv6 address.");
322 break;
323 }
324 }
325 a6p = (struct addr6entry *) malloc(
326 sizeof(struct addr6entry));
327 if (a6p == NULL) {
328 error = 1;
329 break;
330 }
331 bzero(a6p, sizeof(struct addr6entry));
332 bcopy(&sai6->sin6_addr, &a6p->ip6,
333 sizeof(struct in6_addr));
334 if (!STAILQ_EMPTY(&addr6))
335 count = STAILQ_FIRST(&addr6)->count;
336 else
337 count = 0;
338 STAILQ_INSERT_TAIL(&addr6, a6p, addr6entries);
339 STAILQ_FIRST(&addr6)->count = count + 1;
340 break;
341#endif
342 default:
343 err(1, "Address family %d not supported. Ignoring.\n",
344 res->ai_family);
345 break;
346 }
347 }
348
349 return (error);
350}
351
352static struct in_addr *
353copy_addr4(void)
354{
355 size_t len;
356 struct in_addr *ip4s, *p, ia;
357 struct addr4entry *a4p;
358
359 if (STAILQ_EMPTY(&addr4))
360 return NULL;
361
362 len = STAILQ_FIRST(&addr4)->count * sizeof(struct in_addr);
363
364 ip4s = p = (struct in_addr *)malloc(len);
365 if (ip4s == NULL)
366 return (NULL);
367
368 bzero(p, len);
369
370 while (!STAILQ_EMPTY(&addr4)) {
371 a4p = STAILQ_FIRST(&addr4);
372 STAILQ_REMOVE_HEAD(&addr4, addr4entries);
373 ia.s_addr = a4p->ip4.s_addr;
374 bcopy(&ia, p, sizeof(struct in_addr));
375 p++;
376 free(a4p);
377 }
378
379 return (ip4s);
380}
381
382#ifdef INET6
383static struct in6_addr *
384copy_addr6(void)
385{
386 size_t len;
387 struct in6_addr *ip6s, *p;
388 struct addr6entry *a6p;
389
390 if (STAILQ_EMPTY(&addr6))
391 return NULL;
392
393 len = STAILQ_FIRST(&addr6)->count * sizeof(struct in6_addr);
394
395 ip6s = p = (struct in6_addr *)malloc(len);
396 if (ip6s == NULL)
397 return (NULL);
398
399 bzero(p, len);
400
401 while (!STAILQ_EMPTY(&addr6)) {
402 a6p = STAILQ_FIRST(&addr6);
403 STAILQ_REMOVE_HEAD(&addr6, addr6entries);
404 bcopy(&a6p->ip6, p, sizeof(struct in6_addr));
405 p++;
406 free(a6p);
407 }
408
409 return (ip6s);
410}
411#endif
412