jail.c (230495) | jail.c (234712) |
---|---|
1/*- 2 * Copyright (c) 1999 Poul-Henning Kamp. | 1/*- 2 * Copyright (c) 1999 Poul-Henning Kamp. |
3 * Copyright (c) 2009 James Gritton | 3 * Copyright (c) 2009-2012 James Gritton |
4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright --- 9 unchanged lines hidden (view full) --- 21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25 * SUCH DAMAGE. 26 */ 27 28#include <sys/cdefs.h> | 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright --- 9 unchanged lines hidden (view full) --- 21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25 * SUCH DAMAGE. 26 */ 27 28#include <sys/cdefs.h> |
29__FBSDID("$FreeBSD: head/usr.sbin/jail/jail.c 230495 2012-01-24 08:04:38Z mm $"); | 29__FBSDID("$FreeBSD: head/usr.sbin/jail/jail.c 234712 2012-04-26 17:36:05Z jamie $"); |
30 | 30 |
31#include <sys/param.h> 32#include <sys/jail.h> | 31#include <sys/types.h> 32#include <sys/stat.h> |
33#include <sys/socket.h> 34#include <sys/sysctl.h> 35 36#include <arpa/inet.h> 37#include <netinet/in.h> 38 | 33#include <sys/socket.h> 34#include <sys/sysctl.h> 35 36#include <arpa/inet.h> 37#include <netinet/in.h> 38 |
39#include <ctype.h> | |
40#include <err.h> 41#include <errno.h> | 39#include <err.h> 40#include <errno.h> |
42#include <grp.h> 43#include <jail.h> 44#include <login_cap.h> 45#include <netdb.h> 46#include <paths.h> 47#include <pwd.h> | 41#include <stdarg.h> |
48#include <stdio.h> 49#include <stdlib.h> 50#include <string.h> 51#include <unistd.h> 52 | 42#include <stdio.h> 43#include <stdlib.h> 44#include <string.h> 45#include <unistd.h> 46 |
53static struct jailparam *params; 54static char **param_values; 55static int nparams; | 47#include "jailp.h" |
56 | 48 |
57#ifdef INET6 58static int ip6_ok; 59static char *ip6_addr; 60#endif 61#ifdef INET 62static int ip4_ok; 63static char *ip4_addr; 64#endif | 49#define JP_RDTUN(jp) (((jp)->jp_ctltype & CTLFLAG_RDTUN) == CTLFLAG_RDTUN) |
65 | 50 |
66#if defined(INET6) || defined(INET) 67static void add_ip_addr(char **addrp, char *newaddr); 68#endif 69#ifdef INET6 70static void add_ip_addr46(char *newaddr); 71#endif 72static void add_ip_addrinfo(int ai_flags, char *value); | 51struct permspec { 52 const char *name; 53 enum intparam ipnum; 54 int rev; 55}; 56 57const char *cfname; 58int note_remove; 59int verbose; 60 61static void clear_persist(struct cfjail *j); 62static int update_jail(struct cfjail *j); 63static int rdtun_params(struct cfjail *j, int dofail); 64static void running_jid(struct cfjail *j, int dflag); 65static void jail_quoted_warnx(const struct cfjail *j, const char *name_msg, 66 const char *noname_msg); 67static int jailparam_set_note(const struct cfjail *j, struct jailparam *jp, 68 unsigned njp, int flags); 69static void print_jail(FILE *fp, struct cfjail *j, int oldcl); 70static void print_param(FILE *fp, const struct cfparam *p, int sep, int doname); |
73static void quoted_print(FILE *fp, char *str); | 71static void quoted_print(FILE *fp, char *str); |
74static void set_param(const char *name, char *value); | |
75static void usage(void); 76 | 72static void usage(void); 73 |
77static const char *perm_sysctl[][3] = { 78 { "security.jail.set_hostname_allowed", 79 "allow.noset_hostname", "allow.set_hostname" }, 80 { "security.jail.sysvipc_allowed", 81 "allow.nosysvipc", "allow.sysvipc" }, 82 { "security.jail.allow_raw_sockets", 83 "allow.noraw_sockets", "allow.raw_sockets" }, 84 { "security.jail.chflags_allowed", 85 "allow.nochflags", "allow.chflags" }, 86 { "security.jail.mount_allowed", 87 "allow.nomount", "allow.mount" }, 88 { "security.jail.socket_unixiproute_only", 89 "allow.socket_af", "allow.nosocket_af" }, | 74static struct permspec perm_sysctl[] = { 75 { "security.jail.set_hostname_allowed", KP_ALLOW_SET_HOSTNAME, 0 }, 76 { "security.jail.sysvipc_allowed", KP_ALLOW_SYSVIPC, 0 }, 77 { "security.jail.allow_raw_sockets", KP_ALLOW_RAW_SOCKETS, 0 }, 78 { "security.jail.chflags_allowed", KP_ALLOW_CHFLAGS, 0 }, 79 { "security.jail.mount_allowed", KP_ALLOW_MOUNT, 0 }, 80 { "security.jail.socket_unixiproute_only", KP_ALLOW_SOCKET_AF, 1 }, |
90}; 91 | 81}; 82 |
92extern char **environ; | 83static const enum intparam startcommands[] = { 84 0, 85#ifdef INET 86 IP__IP4_IFADDR, 87#endif 88#ifdef INET6 89 IP__IP6_IFADDR, 90#endif 91 IP_MOUNT, 92 IP__MOUNT_FROM_FSTAB, 93 IP_MOUNT_DEVFS, 94 IP_EXEC_PRESTART, 95 IP__OP, 96 IP_VNET_INTERFACE, 97 IP_EXEC_START, 98 IP_COMMAND, 99 IP_EXEC_POSTSTART, 100 0 101}; |
93 | 102 |
94#define GET_USER_INFO do { \ 95 pwd = getpwnam(username); \ 96 if (pwd == NULL) { \ 97 if (errno) \ 98 err(1, "getpwnam: %s", username); \ 99 else \ 100 errx(1, "%s: no such user", username); \ 101 } \ 102 lcap = login_getpwclass(pwd); \ 103 if (lcap == NULL) \ 104 err(1, "getpwclass: %s", username); \ 105 ngroups = ngroups_max; \ 106 if (getgrouplist(username, pwd->pw_gid, groups, &ngroups) != 0) \ 107 err(1, "getgrouplist: %s", username); \ 108} while (0) | 103static const enum intparam stopcommands[] = { 104 0, 105 IP_EXEC_PRESTOP, 106 IP_EXEC_STOP, 107 IP_STOP_TIMEOUT, 108 IP__OP, 109 IP_EXEC_POSTSTOP, 110 IP_MOUNT_DEVFS, 111 IP__MOUNT_FROM_FSTAB, 112 IP_MOUNT, 113#ifdef INET6 114 IP__IP6_IFADDR, 115#endif 116#ifdef INET 117 IP__IP4_IFADDR, 118#endif 119 0 120}; |
109 110int 111main(int argc, char **argv) 112{ | 121 122int 123main(int argc, char **argv) 124{ |
113 login_cap_t *lcap = NULL; 114 struct passwd *pwd = NULL; 115 gid_t *groups; | 125 struct stat st; 126 FILE *jfp; 127 struct cfjail *j; 128 char *JidFile; |
116 size_t sysvallen; | 129 size_t sysvallen; |
117 int ch, cmdarg, i, jail_set_flags, jid, ngroups, sysval; 118 int hflag, iflag, Jflag, lflag, rflag, uflag, Uflag; 119 long ngroups_max; 120 unsigned pi; 121 char *jailname, *securelevel, *username, *JidFile; | 130 unsigned op, pi; 131 int ch, docf, error, i, oldcl, sysval; 132 int dflag, iflag, Rflag; |
122 char enforce_statfs[4]; | 133 char enforce_statfs[4]; |
123 static char *cleanenv; 124 const char *shell, *p = NULL; 125 FILE *fp; | 134#if defined(INET) || defined(INET6) 135 char *cs, *ncs; 136#endif 137#if defined(INET) && defined(INET6) 138 struct in6_addr addr6; 139#endif |
126 | 140 |
127 hflag = iflag = Jflag = lflag = rflag = uflag = Uflag = 128 jail_set_flags = 0; 129 cmdarg = jid = -1; 130 jailname = securelevel = username = JidFile = cleanenv = NULL; 131 fp = NULL; | 141 op = 0; 142 dflag = iflag = Rflag = 0; 143 docf = 1; 144 cfname = CONF_FILE; 145 JidFile = NULL; |
132 | 146 |
133 ngroups_max = sysconf(_SC_NGROUPS_MAX) + 1; 134 if ((groups = malloc(sizeof(gid_t) * ngroups_max)) == NULL) 135 err(1, "malloc"); 136 137 while ((ch = getopt(argc, argv, "cdhilmn:r:s:u:U:J:")) != -1) { | 147 while ((ch = getopt(argc, argv, "cdf:hiJ:lmn:p:qrRs:U:v")) != -1) { |
138 switch (ch) { | 148 switch (ch) { |
149 case 'c': 150 op |= JF_START; 151 break; |
|
139 case 'd': | 152 case 'd': |
140 jail_set_flags |= JAIL_DYING; | 153 dflag = 1; |
141 break; | 154 break; |
155 case 'f': 156 cfname = optarg; 157 break; |
|
142 case 'h': | 158 case 'h': |
143 hflag = 1; | 159#if defined(INET) || defined(INET6) 160 add_param(NULL, NULL, IP_IP_HOSTNAME, NULL); 161#endif 162 docf = 0; |
144 break; 145 case 'i': 146 iflag = 1; | 163 break; 164 case 'i': 165 iflag = 1; |
166 verbose = -1; |
|
147 break; 148 case 'J': 149 JidFile = optarg; | 167 break; 168 case 'J': 169 JidFile = optarg; |
150 Jflag = 1; | |
151 break; | 170 break; |
171 case 'l': 172 add_param(NULL, NULL, IP_EXEC_CLEAN, NULL); 173 docf = 0; 174 break; 175 case 'm': 176 op |= JF_SET; 177 break; |
|
152 case 'n': | 178 case 'n': |
153 jailname = optarg; | 179 add_param(NULL, NULL, KP_NAME, optarg); 180 docf = 0; |
154 break; | 181 break; |
155 case 's': 156 securelevel = optarg; | 182 case 'p': 183 paralimit = strtol(optarg, NULL, 10); 184 if (paralimit == 0) 185 paralimit = -1; |
157 break; | 186 break; |
158 case 'u': 159 username = optarg; 160 uflag = 1; | 187 case 'q': 188 verbose = -1; |
161 break; | 189 break; |
162 case 'U': 163 username = optarg; 164 Uflag = 1; | 190 case 'r': 191 op |= JF_STOP; |
165 break; | 192 break; |
166 case 'l': 167 lflag = 1; | 193 case 'R': 194 op |= JF_STOP; 195 Rflag = 1; |
168 break; | 196 break; |
169 case 'c': 170 jail_set_flags |= JAIL_CREATE; | 197 case 's': 198 add_param(NULL, NULL, KP_SECURELEVEL, optarg); 199 docf = 0; |
171 break; | 200 break; |
172 case 'm': 173 jail_set_flags |= JAIL_UPDATE; | 201 case 'u': 202 add_param(NULL, NULL, IP_EXEC_JAIL_USER, optarg); 203 add_param(NULL, NULL, IP_EXEC_SYSTEM_JAIL_USER, NULL); 204 docf = 0; |
174 break; | 205 break; |
175 case 'r': 176 jid = jail_getid(optarg); 177 if (jid < 0) 178 errx(1, "%s", jail_errmsg); 179 rflag = 1; | 206 case 'U': 207 add_param(NULL, NULL, IP_EXEC_JAIL_USER, optarg); 208 add_param(NULL, NULL, IP_EXEC_SYSTEM_JAIL_USER, 209 "false"); 210 docf = 0; |
180 break; | 211 break; |
212 case 'v': 213 verbose = 1; 214 break; |
|
181 default: 182 usage(); 183 } 184 } 185 argc -= optind; 186 argv += optind; | 215 default: 216 usage(); 217 } 218 } 219 argc -= optind; 220 argv += optind; |
187 if (rflag) { 188 if (argc > 0 || iflag || Jflag || lflag || uflag || Uflag) 189 usage(); 190 if (jail_remove(jid) < 0) 191 err(1, "jail_remove"); 192 exit (0); 193 } 194 if (argc == 0) 195 usage(); 196 if (uflag && Uflag) 197 usage(); 198 if (lflag && username == NULL) 199 usage(); 200 if (uflag) 201 GET_USER_INFO; | |
202 | 221 |
203#ifdef INET6 204 ip6_ok = feature_present("inet6"); | 222 /* Find out which of the four command line styles this is. */ 223 oldcl = 0; 224 if (!op) { 225 /* Old-style command line with four fixed parameters */ 226 if (argc < 4 || argv[0][0] != '/') 227 usage(); 228 op = JF_START; 229 docf = 0; 230 oldcl = 1; 231 add_param(NULL, NULL, KP_PATH, argv[0]); 232 add_param(NULL, NULL, KP_HOST_HOSTNAME, argv[1]); 233#if defined(INET) || defined(INET6) 234 if (argv[2][0] != '\0') { 235 for (cs = argv[2];; cs = ncs + 1) { 236 ncs = strchr(cs, ','); 237 if (ncs) 238 *ncs = '\0'; 239 add_param(NULL, NULL, 240#if defined(INET) && defined(INET6) 241 inet_pton(AF_INET6, cs, &addr6) == 1 242 ? KP_IP6_ADDR : KP_IP4_ADDR, 243#elif defined(INET) 244 KP_IP4_ADDR, 245#elif defined(INET6) 246 KP_IP6_ADDR, |
205#endif | 247#endif |
206#ifdef INET 207 ip4_ok = feature_present("inet"); 208#endif 209 210 if (jailname) 211 set_param("name", jailname); 212 if (securelevel) 213 set_param("securelevel", securelevel); 214 if (jail_set_flags) { 215 for (i = 0; i < argc; i++) { 216 if (!strncmp(argv[i], "command=", 8)) { 217 cmdarg = i; 218 argv[cmdarg] += 8; 219 jail_set_flags |= JAIL_ATTACH; 220 break; 221 } 222 if (hflag) { 223#ifdef INET 224 if (!strncmp(argv[i], "ip4.addr=", 9)) { 225 add_ip_addr(&ip4_addr, argv[i] + 9); | 248 cs); 249 if (!ncs) |
226 break; | 250 break; |
227 } 228#endif 229#ifdef INET6 230 if (!strncmp(argv[i], "ip6.addr=", 9)) { 231 add_ip_addr(&ip6_addr, argv[i] + 9); 232 break; 233 } 234#endif 235 if (!strncmp(argv[i], "host.hostname=", 14)) 236 add_ip_addrinfo(0, argv[i] + 14); | |
237 } | 251 } |
238 set_param(NULL, argv[i]); | |
239 } | 252 } |
240 } else { 241 if (argc < 4 || argv[0][0] != '/') 242 errx(1, "%s\n%s", 243 "no -c or -m, so this must be an old-style command.", 244 "But it doesn't look like one."); 245 set_param("path", argv[0]); 246 set_param("host.hostname", argv[1]); 247 if (hflag) 248 add_ip_addrinfo(0, argv[1]); 249#if defined(INET6) || defined(INET) 250 if (argv[2][0] != '\0') 251#ifdef INET6 252 add_ip_addr46(argv[2]); 253#else 254 add_ip_addr(&ip4_addr, argv[2]); | |
255#endif | 253#endif |
256#endif 257 cmdarg = 3; 258 /* Emulate the defaults from security.jail.* sysctls */ | 254 for (i = 3; i < argc; i++) 255 add_param(NULL, NULL, IP_COMMAND, argv[i]); 256 /* Emulate the defaults from security.jail.* sysctls. */ |
259 sysvallen = sizeof(sysval); 260 if (sysctlbyname("security.jail.jailed", &sysval, &sysvallen, 261 NULL, 0) == 0 && sysval == 0) { 262 for (pi = 0; pi < sizeof(perm_sysctl) / 263 sizeof(perm_sysctl[0]); pi++) { 264 sysvallen = sizeof(sysval); | 257 sysvallen = sizeof(sysval); 258 if (sysctlbyname("security.jail.jailed", &sysval, &sysvallen, 259 NULL, 0) == 0 && sysval == 0) { 260 for (pi = 0; pi < sizeof(perm_sysctl) / 261 sizeof(perm_sysctl[0]); pi++) { 262 sysvallen = sizeof(sysval); |
265 if (sysctlbyname(perm_sysctl[pi][0], | 263 if (sysctlbyname(perm_sysctl[pi].name, |
266 &sysval, &sysvallen, NULL, 0) == 0) | 264 &sysval, &sysvallen, NULL, 0) == 0) |
267 set_param(perm_sysctl[pi] 268 [sysval ? 2 : 1], NULL); | 265 add_param(NULL, NULL, 266 perm_sysctl[pi].ipnum, 267 (sysval ? 1 : 0) ^ 268 perm_sysctl[pi].rev 269 ? NULL : "false"); |
269 } 270 sysvallen = sizeof(sysval); 271 if (sysctlbyname("security.jail.enforce_statfs", 272 &sysval, &sysvallen, NULL, 0) == 0) { 273 snprintf(enforce_statfs, 274 sizeof(enforce_statfs), "%d", sysval); | 270 } 271 sysvallen = sizeof(sysval); 272 if (sysctlbyname("security.jail.enforce_statfs", 273 &sysval, &sysvallen, NULL, 0) == 0) { 274 snprintf(enforce_statfs, 275 sizeof(enforce_statfs), "%d", sysval); |
275 set_param("enforce_statfs", enforce_statfs); | 276 add_param(NULL, NULL, KP_ENFORCE_STATFS, 277 enforce_statfs); |
276 } 277 } | 278 } 279 } |
280 } else if (op == JF_STOP) { 281 /* Jail remove, perhaps using the config file */ 282 if (!docf || argc == 0) 283 usage(); 284 if (!Rflag) 285 for (i = 0; i < argc; i++) 286 if (strchr(argv[i], '=')) 287 usage(); 288 if ((docf = !Rflag && 289 (!strcmp(cfname, "-") || stat(cfname, &st) == 0))) 290 load_config(); 291 note_remove = docf || argc > 1 || wild_jail_name(argv[0]); 292 } else if (argc > 1 || (argc == 1 && strchr(argv[0], '='))) { 293 /* Single jail specified on the command line */ 294 if (Rflag) 295 usage(); 296 docf = 0; 297 for (i = 0; i < argc; i++) { 298 if (!strncmp(argv[i], "command", 7) && 299 (argv[i][7] == '\0' || argv[i][7] == '=')) { 300 if (argv[i][7] == '=') 301 add_param(NULL, NULL, IP_COMMAND, 302 argv[i] + 8); 303 for (i++; i < argc; i++) 304 add_param(NULL, NULL, IP_COMMAND, 305 argv[i]); 306 break; 307 } 308 add_param(NULL, NULL, 0, argv[i]); 309 } 310 } else { 311 /* From the config file, perhaps with a specified jail */ 312 if (Rflag || !docf) 313 usage(); 314 load_config(); |
|
278 } | 315 } |
279#ifdef INET 280 if (ip4_addr != NULL) 281 set_param("ip4.addr", ip4_addr); 282#endif 283#ifdef INET6 284 if (ip6_addr != NULL) 285 set_param("ip6.addr", ip6_addr); 286#endif | |
287 | 316 |
288 if (Jflag) { 289 fp = fopen(JidFile, "w"); 290 if (fp == NULL) 291 errx(1, "Could not create JidFile: %s", JidFile); | 317 /* Find out which jails will be run. */ 318 dep_setup(docf); 319 error = 0; 320 if (op == JF_STOP) { 321 for (i = 0; i < argc; i++) 322 if (start_state(argv[i], docf, op, Rflag) < 0) 323 error = 1; 324 } else { 325 if (start_state(argv[0], docf, op, 0) < 0) 326 exit(1); |
292 } | 327 } |
293 jid = jailparam_set(params, nparams, 294 jail_set_flags ? jail_set_flags : JAIL_CREATE | JAIL_ATTACH); 295 if (jid < 0) 296 errx(1, "%s", jail_errmsg); 297 if (iflag) { 298 printf("%d\n", jid); 299 fflush(stdout); | 328 329 jfp = NULL; 330 if (JidFile != NULL) { 331 jfp = fopen(JidFile, "w"); 332 if (jfp == NULL) 333 err(1, "open %s", JidFile); 334 setlinebuf(jfp); |
300 } | 335 } |
301 if (Jflag) { 302 if (jail_set_flags) { 303 fprintf(fp, "jid=%d", jid); 304 for (i = 0; i < nparams; i++) 305 if (strcmp(params[i].jp_name, "jid")) { 306 fprintf(fp, " %s", 307 (char *)params[i].jp_name); 308 if (param_values[i]) { 309 putc('=', fp); 310 quoted_print(fp, 311 param_values[i]); 312 } | 336 setlinebuf(stdout); 337 338 /* 339 * The main loop: Get an available jail and perform the required 340 * operation on it. When that is done, the jail may be finished, 341 * or it may go back for the next step. 342 */ 343 while ((j = next_jail())) 344 { 345 if (j->flags & JF_FAILED) { 346 error = 1; 347 if (j->comparam == NULL) { 348 dep_done(j, 0); 349 continue; 350 } 351 } 352 if (!(j->flags & JF_PARAMS)) 353 { 354 j->flags |= JF_PARAMS; 355 if (dflag) 356 add_param(j, NULL, IP_ALLOW_DYING, NULL); 357 if (check_intparams(j) < 0) 358 continue; 359 if ((j->flags & (JF_START | JF_SET)) && 360 import_params(j) < 0) 361 continue; 362 } 363 if (!j->jid) 364 running_jid(j, 365 (j->flags & (JF_SET | JF_DEPEND)) == JF_SET 366 ? dflag || bool_param(j->intparams[IP_ALLOW_DYING]) 367 : 0); 368 if (finish_command(j)) 369 continue; 370 371 switch (j->flags & JF_OP_MASK) { 372 /* 373 * These operations just turn into a different op 374 * depending on the jail's current status. 375 */ 376 case JF_START_SET: 377 j->flags = j->jid < 0 ? JF_START : JF_SET; 378 break; 379 case JF_SET_RESTART: 380 if (j->jid < 0) { 381 jail_quoted_warnx(j, "not found", 382 "no jail specified"); 383 failed(j); 384 continue; 385 } 386 j->flags = rdtun_params(j, 0) ? JF_RESTART : JF_SET; 387 if (j->flags == JF_RESTART) 388 dep_reset(j); 389 break; 390 case JF_START_SET_RESTART: 391 j->flags = j->jid < 0 ? JF_START 392 : rdtun_params(j, 0) ? JF_RESTART : JF_SET; 393 if (j->flags == JF_RESTART) 394 dep_reset(j); 395 } 396 397 switch (j->flags & JF_OP_MASK) { 398 case JF_START: 399 if (j->comparam == NULL) { 400 if (j->jid > 0 && 401 !(j->flags & (JF_DEPEND | JF_WILD))) { 402 jail_quoted_warnx(j, "already exists", 403 NULL); 404 failed(j); 405 continue; |
313 } | 406 } |
314 fprintf(fp, "\n"); 315 } else { 316 for (i = 0; i < nparams; i++) 317 if (!strcmp(params[i].jp_name, "path")) 318 break; 319#if defined(INET6) && defined(INET) 320 fprintf(fp, "%d\t%s\t%s\t%s%s%s\t%s\n", 321 jid, i < nparams 322 ? (char *)params[i].jp_value : argv[0], 323 argv[1], ip4_addr ? ip4_addr : "", 324 ip4_addr && ip4_addr[0] && ip6_addr && ip6_addr[0] 325 ? "," : "", ip6_addr ? ip6_addr : "", argv[3]); 326#elif defined(INET6) 327 fprintf(fp, "%d\t%s\t%s\t%s\t%s\n", 328 jid, i < nparams 329 ? (char *)params[i].jp_value : argv[0], 330 argv[1], ip6_addr ? ip6_addr : "", argv[3]); 331#elif defined(INET) 332 fprintf(fp, "%d\t%s\t%s\t%s\t%s\n", 333 jid, i < nparams 334 ? (char *)params[i].jp_value : argv[0], 335 argv[1], ip4_addr ? ip4_addr : "", argv[3]); 336#endif | 407 if (dep_check(j)) 408 continue; 409 if (j->jid > 0) 410 goto jail_create_done; 411 j->comparam = startcommands; 412 j->comstring = NULL; 413 } 414 if (next_command(j)) 415 continue; 416 jail_create_done: 417 clear_persist(j); 418 if (iflag) 419 printf("%d\n", j->jid); 420 if (jfp != NULL) 421 print_jail(jfp, j, oldcl); 422 dep_done(j, 0); 423 break; 424 425 case JF_SET: 426 if (j->jid < 0 && !(j->flags & JF_DEPEND)) { 427 jail_quoted_warnx(j, "not found", 428 "no jail specified"); 429 failed(j); 430 continue; 431 } 432 if (dep_check(j)) 433 continue; 434 if (!(j->flags & JF_DEPEND)) { 435 if (rdtun_params(j, 1) < 0 || 436 update_jail(j) < 0) 437 continue; 438 if (verbose >= 0 && (j->name || verbose > 0)) 439 jail_note(j, "updated\n"); 440 } 441 dep_done(j, 0); 442 break; 443 444 case JF_STOP: 445 case JF_RESTART: 446 if (j->comparam == NULL) { 447 if (dep_check(j)) 448 continue; 449 if (j->jid < 0) { 450 if (!(j->flags & (JF_DEPEND | JF_WILD)) 451 && verbose >= 0) 452 jail_quoted_warnx(j, 453 "not found", NULL); 454 goto jail_remove_done; 455 } 456 j->comparam = stopcommands; 457 j->comstring = NULL; 458 } else if ((j->flags & JF_FAILED) && j->jid > 0) 459 goto jail_remove_done; 460 if (next_command(j)) 461 continue; 462 jail_remove_done: 463 dep_done(j, 0); 464 if ((j->flags & (JF_START | JF_FAILED)) == JF_START) { 465 j->comparam = NULL; 466 j->flags &= ~JF_STOP; 467 dep_reset(j); 468 requeue(j, j->ndeps ? &depend : &ready); 469 } 470 break; |
337 } | 471 } |
338 (void)fclose(fp); | |
339 } | 472 } |
340 if (cmdarg < 0) 341 exit(0); 342 if (username != NULL) { 343 if (Uflag) 344 GET_USER_INFO; 345 if (lflag) { 346 p = getenv("TERM"); 347 environ = &cleanenv; | 473 474 if (jfp != NULL) 475 fclose(jfp); 476 exit(error); 477} 478 479/* 480 * Mark a jail's failure for future handling. 481 */ 482void 483failed(struct cfjail *j) 484{ 485 j->flags |= JF_FAILED; 486 TAILQ_REMOVE(j->queue, j, tq); 487 TAILQ_INSERT_HEAD(&ready, j, tq); 488 j->queue = &ready; 489} 490 491/* 492 * Exit slightly more gracefully when out of memory. 493 */ 494void * 495emalloc(size_t size) 496{ 497 void *p; 498 499 p = malloc(size); 500 if (!p) 501 err(1, "malloc"); 502 return p; 503} 504 505void * 506erealloc(void *ptr, size_t size) 507{ 508 void *p; 509 510 p = realloc(ptr, size); 511 if (!p) 512 err(1, "malloc"); 513 return p; 514} 515 516char * 517estrdup(const char *str) 518{ 519 char *ns; 520 521 ns = strdup(str); 522 if (!ns) 523 err(1, "malloc"); 524 return ns; 525} 526 527/* 528 * Print a message including an optional jail name. 529 */ 530void 531jail_note(const struct cfjail *j, const char *fmt, ...) 532{ 533 va_list ap, tap; 534 char *cs; 535 size_t len; 536 537 va_start(ap, fmt); 538 va_copy(tap, ap); 539 len = vsnprintf(NULL, 0, fmt, tap); 540 va_end(tap); 541 cs = alloca(len + 1); 542 (void)vsnprintf(cs, len + 1, fmt, ap); 543 va_end(ap); 544 if (j->name) 545 printf("%s: %s", j->name, cs); 546 else 547 printf("%s", cs); 548} 549 550/* 551 * Print a warning message including an optional jail name. 552 */ 553void 554jail_warnx(const struct cfjail *j, const char *fmt, ...) 555{ 556 va_list ap, tap; 557 char *cs; 558 size_t len; 559 560 va_start(ap, fmt); 561 va_copy(tap, ap); 562 len = vsnprintf(NULL, 0, fmt, tap); 563 va_end(tap); 564 cs = alloca(len + 1); 565 (void)vsnprintf(cs, len + 1, fmt, ap); 566 va_end(ap); 567 if (j->name) 568 warnx("%s: %s", j->name, cs); 569 else 570 warnx("%s", cs); 571} 572 573/* 574 * Create a new jail. 575 */ 576int 577create_jail(struct cfjail *j) 578{ 579 struct iovec jiov[4]; 580 struct stat st; 581 struct jailparam *jp, *setparams, *setparams2, *sjp; 582 const char *path; 583 int dopersist, ns, jid, dying, didfail; 584 585 /* 586 * Check the jail's path, with a better error message than jail_set 587 * gives. 588 */ 589 if ((path = string_param(j->intparams[KP_PATH]))) { 590 if (j->name != NULL && path[0] != '/') { 591 jail_warnx(j, "path %s: not an absolute pathname", 592 path); 593 return -1; |
348 } | 594 } |
349 if (setgroups(ngroups, groups) != 0) 350 err(1, "setgroups"); 351 if (setgid(pwd->pw_gid) != 0) 352 err(1, "setgid"); 353 if (setusercontext(lcap, pwd, pwd->pw_uid, 354 LOGIN_SETALL & ~LOGIN_SETGROUP & ~LOGIN_SETLOGIN) != 0) 355 err(1, "setusercontext"); 356 login_close(lcap); | 595 if (stat(path, &st) < 0) { 596 jail_warnx(j, "path %s: %s", path, strerror(errno)); 597 return -1; 598 } 599 if (!S_ISDIR(st.st_mode)) { 600 jail_warnx(j, "path %s: %s", path, strerror(ENOTDIR)); 601 return -1; 602 } |
357 } | 603 } |
358 if (lflag) { 359 if (*pwd->pw_shell) 360 shell = pwd->pw_shell; 361 else 362 shell = _PATH_BSHELL; 363 if (chdir(pwd->pw_dir) < 0) 364 errx(1, "no home directory"); 365 setenv("HOME", pwd->pw_dir, 1); 366 setenv("SHELL", shell, 1); 367 setenv("USER", pwd->pw_name, 1); 368 if (p) 369 setenv("TERM", p, 1); | 604 605 /* 606 * Copy all the parameters, except that "persist" is always set when 607 * there are commands to run later. 608 */ 609 dopersist = !bool_param(j->intparams[KP_PERSIST]) && 610 (j->intparams[IP_EXEC_START] || j->intparams[IP_COMMAND] || 611 j->intparams[IP_EXEC_POSTSTART]); 612 sjp = setparams = 613 alloca((j->njp + dopersist) * sizeof(struct jailparam)); 614 if (dopersist && jailparam_init(sjp++, "persist") < 0) { 615 jail_warnx(j, "%s", jail_errmsg); 616 return -1; |
370 } | 617 } |
371 execvp(argv[cmdarg], argv + cmdarg); 372 err(1, "execvp: %s", argv[cmdarg]); | 618 for (jp = j->jp; jp < j->jp + j->njp; jp++) 619 if (!dopersist || !equalopts(jp->jp_name, "persist")) 620 *sjp++ = *jp; 621 ns = sjp - setparams; 622 623 didfail = 0; 624 j->jid = jailparam_set_note(j, setparams, ns, JAIL_CREATE); 625 if (j->jid < 0 && errno == EEXIST && 626 bool_param(j->intparams[IP_ALLOW_DYING]) && 627 int_param(j->intparams[KP_JID], &jid) && jid != 0) { 628 /* 629 * The jail already exists, but may be dying. 630 * Make sure it is, in which case an update is appropriate. 631 */ 632 *(const void **)&jiov[0].iov_base = "jid"; 633 jiov[0].iov_len = sizeof("jid"); 634 jiov[1].iov_base = &jid; 635 jiov[1].iov_len = sizeof(jid); 636 *(const void **)&jiov[2].iov_base = "dying"; 637 jiov[2].iov_len = sizeof("dying"); 638 jiov[3].iov_base = &dying; 639 jiov[3].iov_len = sizeof(dying); 640 if (jail_get(jiov, 4, JAIL_DYING) < 0) { 641 /* 642 * It could be that the jail just barely finished 643 * dying, or it could be that the jid never existed 644 * but the name does. In either case, another try 645 * at creating the jail should do the right thing. 646 */ 647 if (errno == ENOENT) 648 j->jid = jailparam_set_note(j, setparams, ns, 649 JAIL_CREATE); 650 } else if (dying) { 651 j->jid = jid; 652 if (rdtun_params(j, 1) < 0) { 653 j->jid = -1; 654 didfail = 1; 655 } else { 656 sjp = setparams2 = alloca((j->njp + dopersist) * 657 sizeof(struct jailparam)); 658 for (jp = setparams; jp < setparams + ns; jp++) 659 if (!JP_RDTUN(jp) || 660 !strcmp(jp->jp_name, "jid")) 661 *sjp++ = *jp; 662 j->jid = jailparam_set_note(j, setparams2, 663 sjp - setparams2, JAIL_UPDATE | JAIL_DYING); 664 /* 665 * Again, perhaps the jail just finished dying. 666 */ 667 if (j->jid < 0 && errno == ENOENT) 668 j->jid = jailparam_set_note(j, 669 setparams, ns, JAIL_CREATE); 670 } 671 } 672 } 673 if (j->jid < 0 && !didfail) { 674 jail_warnx(j, "%s", jail_errmsg); 675 failed(j); 676 } 677 if (dopersist) { 678 jailparam_free(setparams, 1); 679 if (j->jid > 0) 680 j->flags |= JF_PERSIST; 681 } 682 return j->jid; |
373} 374 | 683} 684 |
375#if defined(INET6) || defined(INET) | 685/* 686 * Remove a temporarily set "persist" parameter. 687 */ |
376static void | 688static void |
377add_ip_addr(char **addrp, char *value) | 689clear_persist(struct cfjail *j) |
378{ | 690{ |
379 int addrlen; 380 char *addr; | 691 struct iovec jiov[4]; 692 int jid; |
381 | 693 |
382 if (!*addrp) { 383 *addrp = strdup(value); 384 if (!*addrp) 385 err(1, "malloc"); 386 } else if (value[0]) { 387 addrlen = strlen(*addrp) + strlen(value) + 2; 388 addr = malloc(addrlen); 389 if (!addr) 390 err(1, "malloc"); 391 snprintf(addr, addrlen, "%s,%s", *addrp, value); 392 free(*addrp); 393 *addrp = addr; | 694 if (!(j->flags & JF_PERSIST)) 695 return; 696 j->flags &= ~JF_PERSIST; 697 *(const void **)&jiov[0].iov_base = "jid"; 698 jiov[0].iov_len = sizeof("jid"); 699 jiov[1].iov_base = &j->jid; 700 jiov[1].iov_len = sizeof(j->jid); 701 *(const void **)&jiov[2].iov_base = "nopersist"; 702 jiov[2].iov_len = sizeof("nopersist"); 703 jiov[3].iov_base = NULL; 704 jiov[3].iov_len = 0; 705 jid = jail_set(jiov, 4, JAIL_UPDATE); 706 if (verbose > 0) 707 jail_note(j, "jail_set(JAIL_UPDATE) jid=%d nopersist%s%s\n", 708 j->jid, jid < 0 ? ": " : "", 709 jid < 0 ? strerror(errno) : ""); 710} 711 712/* 713 * Set a jail's parameters. 714 */ 715static int 716update_jail(struct cfjail *j) 717{ 718 struct jailparam *jp, *setparams, *sjp; 719 int ns, jid; 720 721 ns = 0; 722 for (jp = j->jp; jp < j->jp + j->njp; jp++) 723 if (!JP_RDTUN(jp)) 724 ns++; 725 if (ns == 0) 726 return 0; 727 sjp = setparams = alloca(++ns * sizeof(struct jailparam)); 728 if (jailparam_init(sjp, "jid") < 0 || 729 jailparam_import_raw(sjp, &j->jid, sizeof j->jid) < 0) { 730 jail_warnx(j, "%s", jail_errmsg); 731 failed(j); 732 return -1; |
394 } | 733 } |
734 for (jp = j->jp; jp < j->jp + j->njp; jp++) 735 if (!JP_RDTUN(jp)) 736 *++sjp = *jp; 737 738 jid = jailparam_set_note(j, setparams, ns, 739 bool_param(j->intparams[IP_ALLOW_DYING]) 740 ? JAIL_UPDATE | JAIL_DYING : JAIL_UPDATE); 741 if (jid < 0) { 742 jail_warnx(j, "%s", jail_errmsg); 743 failed(j); 744 } 745 jailparam_free(setparams, 1); 746 return jid; |
|
395} | 747} |
396#endif | |
397 | 748 |
398#ifdef INET6 | 749/* 750 * Return if a jail set would change any create-only parameters. 751 */ 752static int 753rdtun_params(struct cfjail *j, int dofail) 754{ 755 struct jailparam *jp, *rtparams, *rtjp; 756 int nrt, rval; 757 758 if (j->flags & JF_RDTUN) 759 return 0; 760 j->flags |= JF_RDTUN; 761 nrt = 0; 762 for (jp = j->jp; jp < j->jp + j->njp; jp++) 763 if (JP_RDTUN(jp) && strcmp(jp->jp_name, "jid")) 764 nrt++; 765 if (nrt == 0) 766 return 0; 767 rtjp = rtparams = alloca(++nrt * sizeof(struct jailparam)); 768 if (jailparam_init(rtjp, "jid") < 0 || 769 jailparam_import_raw(rtjp, &j->jid, sizeof j->jid) < 0) { 770 jail_warnx(j, "%s", jail_errmsg); 771 exit(1); 772 } 773 for (jp = j->jp; jp < j->jp + j->njp; jp++) 774 if (JP_RDTUN(jp) && strcmp(jp->jp_name, "jid")) 775 *++rtjp = *jp; 776 rval = 0; 777 if (jailparam_get(rtparams, nrt, 778 bool_param(j->intparams[IP_ALLOW_DYING]) ? JAIL_DYING : 0) > 0) { 779 rtjp = rtparams + 1; 780 for (jp = j->jp, rtjp = rtparams + 1; rtjp < rtparams + nrt; 781 jp++) { 782 if (JP_RDTUN(jp) && strcmp(jp->jp_name, "jid")) { 783 if (!((jp->jp_flags & (JP_BOOL | JP_NOBOOL)) && 784 jp->jp_valuelen == 0 && 785 *(int *)jp->jp_value) && 786 !(rtjp->jp_valuelen == jp->jp_valuelen && 787 !memcmp(rtjp->jp_value, jp->jp_value, 788 jp->jp_valuelen))) { 789 if (dofail) { 790 jail_warnx(j, "%s cannot be " 791 "changed after creation", 792 jp->jp_name); 793 failed(j); 794 rval = -1; 795 } else 796 rval = 1; 797 break; 798 } 799 rtjp++; 800 } 801 } 802 } 803 for (rtjp = rtparams + 1; rtjp < rtparams + nrt; rtjp++) 804 rtjp->jp_name = NULL; 805 jailparam_free(rtparams, nrt); 806 return rval; 807} 808 809/* 810 * Get the jail's jid if it is running. 811 */ |
399static void | 812static void |
400add_ip_addr46(char *value) | 813running_jid(struct cfjail *j, int dflag) |
401{ | 814{ |
402 char *p, *np; | 815 struct iovec jiov[2]; 816 const char *pval; 817 char *ep; 818 int jid; |
403 | 819 |
404 for (p = value;; p = np + 1) 405 { 406 np = strchr(p, ','); 407 if (np) 408 *np = '\0'; 409 add_ip_addrinfo(AI_NUMERICHOST, p); 410 if (!np) 411 break; | 820 if ((pval = string_param(j->intparams[KP_JID]))) { 821 if (!(jid = strtol(pval, &ep, 10)) || *ep) { 822 j->jid = -1; 823 return; 824 } 825 *(const void **)&jiov[0].iov_base = "jid"; 826 jiov[0].iov_len = sizeof("jid"); 827 jiov[1].iov_base = &jid; 828 jiov[1].iov_len = sizeof(jid); 829 } else if ((pval = string_param(j->intparams[KP_NAME]))) { 830 *(const void **)&jiov[0].iov_base = "name"; 831 jiov[0].iov_len = sizeof("name"); 832 jiov[1].iov_len = strlen(pval) + 1; 833 jiov[1].iov_base = alloca(jiov[1].iov_len); 834 strcpy(jiov[1].iov_base, pval); 835 } else { 836 j->jid = -1; 837 return; |
412 } | 838 } |
839 j->jid = jail_get(jiov, 2, dflag ? JAIL_DYING : 0); |
|
413} | 840} |
414#endif | |
415 416static void | 841 842static void |
417add_ip_addrinfo(int ai_flags, char *value) | 843jail_quoted_warnx(const struct cfjail *j, const char *name_msg, 844 const char *noname_msg) |
418{ | 845{ |
419 struct addrinfo hints, *ai0, *ai; 420 int error; 421#ifdef INET 422 char avalue4[INET_ADDRSTRLEN]; 423 struct in_addr addr4; 424#endif 425#ifdef INET6 426 char avalue6[INET6_ADDRSTRLEN]; 427 struct in6_addr addr6; 428#endif | 846 const char *pval; |
429 | 847 |
430 /* Look up the hostname (or get the address) */ 431 memset(&hints, 0, sizeof(hints)); 432 hints.ai_socktype = SOCK_STREAM; 433#if defined(INET6) && defined(INET) 434 hints.ai_family = PF_UNSPEC; 435#elif defined(INET6) 436 hints.ai_family = PF_INET6; 437#elif defined(INET) 438 hints.ai_family = PF_INET; 439#endif 440 hints.ai_flags = ai_flags; 441 error = getaddrinfo(value, NULL, &hints, &ai0); 442 if (error != 0) 443 errx(1, "hostname %s: %s", value, gai_strerror(error)); | 848 if ((pval = j->name) || (pval = string_param(j->intparams[KP_JID])) || 849 (pval = string_param(j->intparams[KP_NAME]))) 850 warnx("\"%s\" %s", pval, name_msg); 851 else 852 warnx("%s", noname_msg); 853} |
444 | 854 |
445 /* Convert the addresses to ASCII so set_param can convert them back. */ 446 for (ai = ai0; ai; ai = ai->ai_next) 447 switch (ai->ai_family) { | 855/* 856 * Set jail parameters and possible print them out. 857 */ 858static int 859jailparam_set_note(const struct cfjail *j, struct jailparam *jp, unsigned njp, 860 int flags) 861{ 862 char *value; 863 int jid; 864 unsigned i; 865 866 jid = jailparam_set(jp, njp, flags); 867 if (verbose > 0) { 868 jail_note(j, "jail_set(%s%s)", 869 (flags & (JAIL_CREATE | JAIL_UPDATE)) == JAIL_CREATE 870 ? "JAIL_CREATE" : "JAIL_UPDATE", 871 (flags & JAIL_DYING) ? " | JAIL_DYING" : ""); 872 for (i = 0; i < njp; i++) { 873 printf(" %s", jp[i].jp_name); 874 if (jp[i].jp_value == NULL) 875 continue; 876 putchar('='); 877 value = jailparam_export(jp + i); 878 if (value == NULL) 879 err(1, "jailparam_export"); 880 quoted_print(stdout, value); 881 free(value); 882 } 883 if (jid < 0) 884 printf(": %s", strerror(errno)); 885 printf("\n"); 886 } 887 return jid; 888} 889 890/* 891 * Print a jail record. 892 */ 893static void 894print_jail(FILE *fp, struct cfjail *j, int oldcl) 895{ 896 struct cfparam *p; 897 898 if (oldcl) { 899 fprintf(fp, "%d\t", j->jid); 900 print_param(fp, j->intparams[KP_PATH], ',', 0); 901 putc('\t', fp); 902 print_param(fp, j->intparams[KP_HOST_HOSTNAME], ',', 0); 903 putc('\t', fp); |
448#ifdef INET | 904#ifdef INET |
449 case AF_INET: 450 if (!ip4_ok && (ai_flags & AI_NUMERICHOST) == 0) 451 break; 452 memcpy(&addr4, &((struct sockaddr_in *) 453 (void *)ai->ai_addr)->sin_addr, sizeof(addr4)); 454 if (inet_ntop(AF_INET, &addr4, avalue4, 455 INET_ADDRSTRLEN) == NULL) 456 err(1, "inet_ntop"); 457 add_ip_addr(&ip4_addr, avalue4); 458 break; | 905 print_param(fp, j->intparams[KP_IP4_ADDR], ',', 0); 906#ifdef INET6 907 if (j->intparams[KP_IP4_ADDR] && 908 !TAILQ_EMPTY(&j->intparams[KP_IP4_ADDR]->val) && 909 j->intparams[KP_IP6_ADDR] && 910 !TAILQ_EMPTY(&j->intparams[KP_IP6_ADDR]->val)) 911 putc(',', fp); |
459#endif | 912#endif |
913#endif |
|
460#ifdef INET6 | 914#ifdef INET6 |
461 case AF_INET6: 462 if (!ip6_ok && (ai_flags & AI_NUMERICHOST) == 0) 463 break; 464 memcpy(&addr6, &((struct sockaddr_in6 *) 465 (void *)ai->ai_addr)->sin6_addr, sizeof(addr6)); 466 if (inet_ntop(AF_INET6, &addr6, avalue6, 467 INET6_ADDRSTRLEN) == NULL) 468 err(1, "inet_ntop"); 469 add_ip_addr(&ip6_addr, avalue6); 470 break; | 915 print_param(fp, j->intparams[KP_IP6_ADDR], ',', 0); |
471#endif | 916#endif |
472 } 473 freeaddrinfo(ai0); | 917 putc('\t', fp); 918 print_param(fp, j->intparams[IP_COMMAND], ' ', 0); 919 } else { 920 fprintf(fp, "jid=%d", j->jid); 921 TAILQ_FOREACH(p, &j->params, tq) 922 if (strcmp(p->name, "jid")) { 923 putc(' ', fp); 924 print_param(fp, p, ',', 1); 925 } 926 } 927 putc('\n', fp); |
474} 475 | 928} 929 |
930/* 931 * Print a parameter value, or a name=value pair. 932 */ |
|
476static void | 933static void |
477quoted_print(FILE *fp, char *str) | 934print_param(FILE *fp, const struct cfparam *p, int sep, int doname) |
478{ | 935{ |
479 int c, qc; 480 char *p = str; | 936 const struct cfstring *s, *ts; |
481 | 937 |
482 /* An empty string needs quoting. */ 483 if (!*p) { 484 fputs("\"\"", fp); | 938 if (doname) 939 fputs(p->name, fp); 940 if (p == NULL || TAILQ_EMPTY(&p->val)) |
485 return; | 941 return; |
942 if (doname) 943 putc('=', fp); 944 TAILQ_FOREACH_SAFE(s, &p->val, tq, ts) { 945 quoted_print(fp, s->s); 946 if (ts != NULL) 947 putc(sep, fp); |
|
486 } | 948 } |
949} |
|
487 | 950 |
488 /* 489 * The value will be surrounded by quotes if it contains spaces 490 * or quotes. 491 */ 492 qc = strchr(p, '\'') ? '"' | 951/* 952 * Print a string with quotes around spaces. 953 */ 954static void 955quoted_print(FILE *fp, char *str) 956{ 957 int c, qc; 958 char *p = str; 959 960 qc = !*p ? '"' 961 : strchr(p, '\'') ? '"' |
493 : strchr(p, '"') ? '\'' 494 : strchr(p, ' ') || strchr(p, '\t') ? '"' 495 : 0; 496 if (qc) 497 putc(qc, fp); 498 while ((c = *p++)) { 499 if (c == '\\' || c == qc) 500 putc('\\', fp); 501 putc(c, fp); 502 } 503 if (qc) 504 putc(qc, fp); 505} 506 507static void | 962 : strchr(p, '"') ? '\'' 963 : strchr(p, ' ') || strchr(p, '\t') ? '"' 964 : 0; 965 if (qc) 966 putc(qc, fp); 967 while ((c = *p++)) { 968 if (c == '\\' || c == qc) 969 putc('\\', fp); 970 putc(c, fp); 971 } 972 if (qc) 973 putc(qc, fp); 974} 975 976static void |
508set_param(const char *name, char *value) 509{ 510 struct jailparam *param; 511 char path[PATH_MAX]; 512 int i; 513 514 static int paramlistsize; 515 516 /* Separate the name from the value, if not done already. */ 517 if (name == NULL) { 518 name = value; 519 if ((value = strchr(value, '='))) 520 *value++ = '\0'; 521 } 522 523 /* jail_set won't chdir along with its chroot, so do it here. */ 524 if (!strcmp(name, "path")) { 525 /* resolve the path with realpath(3) */ 526 if (realpath(value, path) != NULL) 527 value = path; 528 if (chdir(value) < 0) 529 err(1, "chdir: %s", value); 530 } 531 532 /* Check for repeat parameters */ 533 for (i = 0; i < nparams; i++) 534 if (!strcmp(name, params[i].jp_name)) { 535 jailparam_free(params + i, 1); 536 memcpy(params + i, params + i + 1, 537 (--nparams - i) * sizeof(struct jailparam)); 538 break; 539 } 540 541 /* Make sure there is room for the new param record. */ 542 if (!nparams) { 543 paramlistsize = 32; 544 params = malloc(paramlistsize * sizeof(*params)); 545 param_values = malloc(paramlistsize * sizeof(*param_values)); 546 if (params == NULL || param_values == NULL) 547 err(1, "malloc"); 548 } else if (nparams >= paramlistsize) { 549 paramlistsize *= 2; 550 params = realloc(params, paramlistsize * sizeof(*params)); 551 param_values = realloc(param_values, 552 paramlistsize * sizeof(*param_values)); 553 if (params == NULL) 554 err(1, "realloc"); 555 } 556 557 /* Look up the paramter. */ 558 param_values[nparams] = value; 559 param = params + nparams++; 560 if (jailparam_init(param, name) < 0 || 561 jailparam_import(param, value) < 0) 562 errx(1, "%s", jail_errmsg); 563} 564 565static void | |
566usage(void) 567{ 568 569 (void)fprintf(stderr, | 977usage(void) 978{ 979 980 (void)fprintf(stderr, |
570 "usage: jail [-d] [-h] [-i] [-J jid_file] " 571 "[-l -u username | -U username]\n" 572 " [-c | -m] param=value ... [command=command ...]\n" 573 " jail [-r jail]\n"); | 981 "usage: jail [-dhilqv] [-J jid_file] [-u username] [-U username]\n" 982 " -[cmr] param=value ... [command=command ...]\n" 983 " jail [-dqv] [-f file] -[cmr] [jail]\n" 984 " jail [-qv] [-f file] -[rR] ['*' | jail ...]\n" 985 " jail [-dhilqv] [-J jid_file] [-u username] [-U username]\n" 986 " [-n jailname] [-s securelevel]\n" 987 " path hostname [ip[,...]] command ...\n"); |
574 exit(1); 575} | 988 exit(1); 989} |