Deleted Added
sdiff udiff text old ( 230495 ) new ( 234712 )
full compact
jail.c (230495) jail.c (234712)
1/*-
2 * Copyright (c) 1999 Poul-Henning Kamp.
1/*-
2 * Copyright (c) 1999 Poul-Henning Kamp.
3 * Copyright (c) 2009 James Gritton
3 * Copyright (c) 2009-2012 James Gritton
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright

--- 9 unchanged lines hidden (view full) ---

21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25 * SUCH DAMAGE.
26 */
27
28#include <sys/cdefs.h>
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright

--- 9 unchanged lines hidden (view full) ---

21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25 * SUCH DAMAGE.
26 */
27
28#include <sys/cdefs.h>
29__FBSDID("$FreeBSD: head/usr.sbin/jail/jail.c 230495 2012-01-24 08:04:38Z mm $");
29__FBSDID("$FreeBSD: head/usr.sbin/jail/jail.c 234712 2012-04-26 17:36:05Z jamie $");
30
30
31#include <sys/param.h>
32#include <sys/jail.h>
31#include <sys/types.h>
32#include <sys/stat.h>
33#include <sys/socket.h>
34#include <sys/sysctl.h>
35
36#include <arpa/inet.h>
37#include <netinet/in.h>
38
33#include <sys/socket.h>
34#include <sys/sysctl.h>
35
36#include <arpa/inet.h>
37#include <netinet/in.h>
38
39#include <ctype.h>
40#include <err.h>
41#include <errno.h>
39#include <err.h>
40#include <errno.h>
42#include <grp.h>
43#include <jail.h>
44#include <login_cap.h>
45#include <netdb.h>
46#include <paths.h>
47#include <pwd.h>
41#include <stdarg.h>
48#include <stdio.h>
49#include <stdlib.h>
50#include <string.h>
51#include <unistd.h>
52
42#include <stdio.h>
43#include <stdlib.h>
44#include <string.h>
45#include <unistd.h>
46
53static struct jailparam *params;
54static char **param_values;
55static int nparams;
47#include "jailp.h"
56
48
57#ifdef INET6
58static int ip6_ok;
59static char *ip6_addr;
60#endif
61#ifdef INET
62static int ip4_ok;
63static char *ip4_addr;
64#endif
49#define JP_RDTUN(jp) (((jp)->jp_ctltype & CTLFLAG_RDTUN) == CTLFLAG_RDTUN)
65
50
66#if defined(INET6) || defined(INET)
67static void add_ip_addr(char **addrp, char *newaddr);
68#endif
69#ifdef INET6
70static void add_ip_addr46(char *newaddr);
71#endif
72static void add_ip_addrinfo(int ai_flags, char *value);
51struct permspec {
52 const char *name;
53 enum intparam ipnum;
54 int rev;
55};
56
57const char *cfname;
58int note_remove;
59int verbose;
60
61static void clear_persist(struct cfjail *j);
62static int update_jail(struct cfjail *j);
63static int rdtun_params(struct cfjail *j, int dofail);
64static void running_jid(struct cfjail *j, int dflag);
65static void jail_quoted_warnx(const struct cfjail *j, const char *name_msg,
66 const char *noname_msg);
67static int jailparam_set_note(const struct cfjail *j, struct jailparam *jp,
68 unsigned njp, int flags);
69static void print_jail(FILE *fp, struct cfjail *j, int oldcl);
70static void print_param(FILE *fp, const struct cfparam *p, int sep, int doname);
73static void quoted_print(FILE *fp, char *str);
71static void quoted_print(FILE *fp, char *str);
74static void set_param(const char *name, char *value);
75static void usage(void);
76
72static void usage(void);
73
77static const char *perm_sysctl[][3] = {
78 { "security.jail.set_hostname_allowed",
79 "allow.noset_hostname", "allow.set_hostname" },
80 { "security.jail.sysvipc_allowed",
81 "allow.nosysvipc", "allow.sysvipc" },
82 { "security.jail.allow_raw_sockets",
83 "allow.noraw_sockets", "allow.raw_sockets" },
84 { "security.jail.chflags_allowed",
85 "allow.nochflags", "allow.chflags" },
86 { "security.jail.mount_allowed",
87 "allow.nomount", "allow.mount" },
88 { "security.jail.socket_unixiproute_only",
89 "allow.socket_af", "allow.nosocket_af" },
74static struct permspec perm_sysctl[] = {
75 { "security.jail.set_hostname_allowed", KP_ALLOW_SET_HOSTNAME, 0 },
76 { "security.jail.sysvipc_allowed", KP_ALLOW_SYSVIPC, 0 },
77 { "security.jail.allow_raw_sockets", KP_ALLOW_RAW_SOCKETS, 0 },
78 { "security.jail.chflags_allowed", KP_ALLOW_CHFLAGS, 0 },
79 { "security.jail.mount_allowed", KP_ALLOW_MOUNT, 0 },
80 { "security.jail.socket_unixiproute_only", KP_ALLOW_SOCKET_AF, 1 },
90};
91
81};
82
92extern char **environ;
83static const enum intparam startcommands[] = {
84 0,
85#ifdef INET
86 IP__IP4_IFADDR,
87#endif
88#ifdef INET6
89 IP__IP6_IFADDR,
90#endif
91 IP_MOUNT,
92 IP__MOUNT_FROM_FSTAB,
93 IP_MOUNT_DEVFS,
94 IP_EXEC_PRESTART,
95 IP__OP,
96 IP_VNET_INTERFACE,
97 IP_EXEC_START,
98 IP_COMMAND,
99 IP_EXEC_POSTSTART,
100 0
101};
93
102
94#define GET_USER_INFO do { \
95 pwd = getpwnam(username); \
96 if (pwd == NULL) { \
97 if (errno) \
98 err(1, "getpwnam: %s", username); \
99 else \
100 errx(1, "%s: no such user", username); \
101 } \
102 lcap = login_getpwclass(pwd); \
103 if (lcap == NULL) \
104 err(1, "getpwclass: %s", username); \
105 ngroups = ngroups_max; \
106 if (getgrouplist(username, pwd->pw_gid, groups, &ngroups) != 0) \
107 err(1, "getgrouplist: %s", username); \
108} while (0)
103static const enum intparam stopcommands[] = {
104 0,
105 IP_EXEC_PRESTOP,
106 IP_EXEC_STOP,
107 IP_STOP_TIMEOUT,
108 IP__OP,
109 IP_EXEC_POSTSTOP,
110 IP_MOUNT_DEVFS,
111 IP__MOUNT_FROM_FSTAB,
112 IP_MOUNT,
113#ifdef INET6
114 IP__IP6_IFADDR,
115#endif
116#ifdef INET
117 IP__IP4_IFADDR,
118#endif
119 0
120};
109
110int
111main(int argc, char **argv)
112{
121
122int
123main(int argc, char **argv)
124{
113 login_cap_t *lcap = NULL;
114 struct passwd *pwd = NULL;
115 gid_t *groups;
125 struct stat st;
126 FILE *jfp;
127 struct cfjail *j;
128 char *JidFile;
116 size_t sysvallen;
129 size_t sysvallen;
117 int ch, cmdarg, i, jail_set_flags, jid, ngroups, sysval;
118 int hflag, iflag, Jflag, lflag, rflag, uflag, Uflag;
119 long ngroups_max;
120 unsigned pi;
121 char *jailname, *securelevel, *username, *JidFile;
130 unsigned op, pi;
131 int ch, docf, error, i, oldcl, sysval;
132 int dflag, iflag, Rflag;
122 char enforce_statfs[4];
133 char enforce_statfs[4];
123 static char *cleanenv;
124 const char *shell, *p = NULL;
125 FILE *fp;
134#if defined(INET) || defined(INET6)
135 char *cs, *ncs;
136#endif
137#if defined(INET) && defined(INET6)
138 struct in6_addr addr6;
139#endif
126
140
127 hflag = iflag = Jflag = lflag = rflag = uflag = Uflag =
128 jail_set_flags = 0;
129 cmdarg = jid = -1;
130 jailname = securelevel = username = JidFile = cleanenv = NULL;
131 fp = NULL;
141 op = 0;
142 dflag = iflag = Rflag = 0;
143 docf = 1;
144 cfname = CONF_FILE;
145 JidFile = NULL;
132
146
133 ngroups_max = sysconf(_SC_NGROUPS_MAX) + 1;
134 if ((groups = malloc(sizeof(gid_t) * ngroups_max)) == NULL)
135 err(1, "malloc");
136
137 while ((ch = getopt(argc, argv, "cdhilmn:r:s:u:U:J:")) != -1) {
147 while ((ch = getopt(argc, argv, "cdf:hiJ:lmn:p:qrRs:U:v")) != -1) {
138 switch (ch) {
148 switch (ch) {
149 case 'c':
150 op |= JF_START;
151 break;
139 case 'd':
152 case 'd':
140 jail_set_flags |= JAIL_DYING;
153 dflag = 1;
141 break;
154 break;
155 case 'f':
156 cfname = optarg;
157 break;
142 case 'h':
158 case 'h':
143 hflag = 1;
159#if defined(INET) || defined(INET6)
160 add_param(NULL, NULL, IP_IP_HOSTNAME, NULL);
161#endif
162 docf = 0;
144 break;
145 case 'i':
146 iflag = 1;
163 break;
164 case 'i':
165 iflag = 1;
166 verbose = -1;
147 break;
148 case 'J':
149 JidFile = optarg;
167 break;
168 case 'J':
169 JidFile = optarg;
150 Jflag = 1;
151 break;
170 break;
171 case 'l':
172 add_param(NULL, NULL, IP_EXEC_CLEAN, NULL);
173 docf = 0;
174 break;
175 case 'm':
176 op |= JF_SET;
177 break;
152 case 'n':
178 case 'n':
153 jailname = optarg;
179 add_param(NULL, NULL, KP_NAME, optarg);
180 docf = 0;
154 break;
181 break;
155 case 's':
156 securelevel = optarg;
182 case 'p':
183 paralimit = strtol(optarg, NULL, 10);
184 if (paralimit == 0)
185 paralimit = -1;
157 break;
186 break;
158 case 'u':
159 username = optarg;
160 uflag = 1;
187 case 'q':
188 verbose = -1;
161 break;
189 break;
162 case 'U':
163 username = optarg;
164 Uflag = 1;
190 case 'r':
191 op |= JF_STOP;
165 break;
192 break;
166 case 'l':
167 lflag = 1;
193 case 'R':
194 op |= JF_STOP;
195 Rflag = 1;
168 break;
196 break;
169 case 'c':
170 jail_set_flags |= JAIL_CREATE;
197 case 's':
198 add_param(NULL, NULL, KP_SECURELEVEL, optarg);
199 docf = 0;
171 break;
200 break;
172 case 'm':
173 jail_set_flags |= JAIL_UPDATE;
201 case 'u':
202 add_param(NULL, NULL, IP_EXEC_JAIL_USER, optarg);
203 add_param(NULL, NULL, IP_EXEC_SYSTEM_JAIL_USER, NULL);
204 docf = 0;
174 break;
205 break;
175 case 'r':
176 jid = jail_getid(optarg);
177 if (jid < 0)
178 errx(1, "%s", jail_errmsg);
179 rflag = 1;
206 case 'U':
207 add_param(NULL, NULL, IP_EXEC_JAIL_USER, optarg);
208 add_param(NULL, NULL, IP_EXEC_SYSTEM_JAIL_USER,
209 "false");
210 docf = 0;
180 break;
211 break;
212 case 'v':
213 verbose = 1;
214 break;
181 default:
182 usage();
183 }
184 }
185 argc -= optind;
186 argv += optind;
215 default:
216 usage();
217 }
218 }
219 argc -= optind;
220 argv += optind;
187 if (rflag) {
188 if (argc > 0 || iflag || Jflag || lflag || uflag || Uflag)
189 usage();
190 if (jail_remove(jid) < 0)
191 err(1, "jail_remove");
192 exit (0);
193 }
194 if (argc == 0)
195 usage();
196 if (uflag && Uflag)
197 usage();
198 if (lflag && username == NULL)
199 usage();
200 if (uflag)
201 GET_USER_INFO;
202
221
203#ifdef INET6
204 ip6_ok = feature_present("inet6");
222 /* Find out which of the four command line styles this is. */
223 oldcl = 0;
224 if (!op) {
225 /* Old-style command line with four fixed parameters */
226 if (argc < 4 || argv[0][0] != '/')
227 usage();
228 op = JF_START;
229 docf = 0;
230 oldcl = 1;
231 add_param(NULL, NULL, KP_PATH, argv[0]);
232 add_param(NULL, NULL, KP_HOST_HOSTNAME, argv[1]);
233#if defined(INET) || defined(INET6)
234 if (argv[2][0] != '\0') {
235 for (cs = argv[2];; cs = ncs + 1) {
236 ncs = strchr(cs, ',');
237 if (ncs)
238 *ncs = '\0';
239 add_param(NULL, NULL,
240#if defined(INET) && defined(INET6)
241 inet_pton(AF_INET6, cs, &addr6) == 1
242 ? KP_IP6_ADDR : KP_IP4_ADDR,
243#elif defined(INET)
244 KP_IP4_ADDR,
245#elif defined(INET6)
246 KP_IP6_ADDR,
205#endif
247#endif
206#ifdef INET
207 ip4_ok = feature_present("inet");
208#endif
209
210 if (jailname)
211 set_param("name", jailname);
212 if (securelevel)
213 set_param("securelevel", securelevel);
214 if (jail_set_flags) {
215 for (i = 0; i < argc; i++) {
216 if (!strncmp(argv[i], "command=", 8)) {
217 cmdarg = i;
218 argv[cmdarg] += 8;
219 jail_set_flags |= JAIL_ATTACH;
220 break;
221 }
222 if (hflag) {
223#ifdef INET
224 if (!strncmp(argv[i], "ip4.addr=", 9)) {
225 add_ip_addr(&ip4_addr, argv[i] + 9);
248 cs);
249 if (!ncs)
226 break;
250 break;
227 }
228#endif
229#ifdef INET6
230 if (!strncmp(argv[i], "ip6.addr=", 9)) {
231 add_ip_addr(&ip6_addr, argv[i] + 9);
232 break;
233 }
234#endif
235 if (!strncmp(argv[i], "host.hostname=", 14))
236 add_ip_addrinfo(0, argv[i] + 14);
237 }
251 }
238 set_param(NULL, argv[i]);
239 }
252 }
240 } else {
241 if (argc < 4 || argv[0][0] != '/')
242 errx(1, "%s\n%s",
243 "no -c or -m, so this must be an old-style command.",
244 "But it doesn't look like one.");
245 set_param("path", argv[0]);
246 set_param("host.hostname", argv[1]);
247 if (hflag)
248 add_ip_addrinfo(0, argv[1]);
249#if defined(INET6) || defined(INET)
250 if (argv[2][0] != '\0')
251#ifdef INET6
252 add_ip_addr46(argv[2]);
253#else
254 add_ip_addr(&ip4_addr, argv[2]);
255#endif
253#endif
256#endif
257 cmdarg = 3;
258 /* Emulate the defaults from security.jail.* sysctls */
254 for (i = 3; i < argc; i++)
255 add_param(NULL, NULL, IP_COMMAND, argv[i]);
256 /* Emulate the defaults from security.jail.* sysctls. */
259 sysvallen = sizeof(sysval);
260 if (sysctlbyname("security.jail.jailed", &sysval, &sysvallen,
261 NULL, 0) == 0 && sysval == 0) {
262 for (pi = 0; pi < sizeof(perm_sysctl) /
263 sizeof(perm_sysctl[0]); pi++) {
264 sysvallen = sizeof(sysval);
257 sysvallen = sizeof(sysval);
258 if (sysctlbyname("security.jail.jailed", &sysval, &sysvallen,
259 NULL, 0) == 0 && sysval == 0) {
260 for (pi = 0; pi < sizeof(perm_sysctl) /
261 sizeof(perm_sysctl[0]); pi++) {
262 sysvallen = sizeof(sysval);
265 if (sysctlbyname(perm_sysctl[pi][0],
263 if (sysctlbyname(perm_sysctl[pi].name,
266 &sysval, &sysvallen, NULL, 0) == 0)
264 &sysval, &sysvallen, NULL, 0) == 0)
267 set_param(perm_sysctl[pi]
268 [sysval ? 2 : 1], NULL);
265 add_param(NULL, NULL,
266 perm_sysctl[pi].ipnum,
267 (sysval ? 1 : 0) ^
268 perm_sysctl[pi].rev
269 ? NULL : "false");
269 }
270 sysvallen = sizeof(sysval);
271 if (sysctlbyname("security.jail.enforce_statfs",
272 &sysval, &sysvallen, NULL, 0) == 0) {
273 snprintf(enforce_statfs,
274 sizeof(enforce_statfs), "%d", sysval);
270 }
271 sysvallen = sizeof(sysval);
272 if (sysctlbyname("security.jail.enforce_statfs",
273 &sysval, &sysvallen, NULL, 0) == 0) {
274 snprintf(enforce_statfs,
275 sizeof(enforce_statfs), "%d", sysval);
275 set_param("enforce_statfs", enforce_statfs);
276 add_param(NULL, NULL, KP_ENFORCE_STATFS,
277 enforce_statfs);
276 }
277 }
278 }
279 }
280 } else if (op == JF_STOP) {
281 /* Jail remove, perhaps using the config file */
282 if (!docf || argc == 0)
283 usage();
284 if (!Rflag)
285 for (i = 0; i < argc; i++)
286 if (strchr(argv[i], '='))
287 usage();
288 if ((docf = !Rflag &&
289 (!strcmp(cfname, "-") || stat(cfname, &st) == 0)))
290 load_config();
291 note_remove = docf || argc > 1 || wild_jail_name(argv[0]);
292 } else if (argc > 1 || (argc == 1 && strchr(argv[0], '='))) {
293 /* Single jail specified on the command line */
294 if (Rflag)
295 usage();
296 docf = 0;
297 for (i = 0; i < argc; i++) {
298 if (!strncmp(argv[i], "command", 7) &&
299 (argv[i][7] == '\0' || argv[i][7] == '=')) {
300 if (argv[i][7] == '=')
301 add_param(NULL, NULL, IP_COMMAND,
302 argv[i] + 8);
303 for (i++; i < argc; i++)
304 add_param(NULL, NULL, IP_COMMAND,
305 argv[i]);
306 break;
307 }
308 add_param(NULL, NULL, 0, argv[i]);
309 }
310 } else {
311 /* From the config file, perhaps with a specified jail */
312 if (Rflag || !docf)
313 usage();
314 load_config();
278 }
315 }
279#ifdef INET
280 if (ip4_addr != NULL)
281 set_param("ip4.addr", ip4_addr);
282#endif
283#ifdef INET6
284 if (ip6_addr != NULL)
285 set_param("ip6.addr", ip6_addr);
286#endif
287
316
288 if (Jflag) {
289 fp = fopen(JidFile, "w");
290 if (fp == NULL)
291 errx(1, "Could not create JidFile: %s", JidFile);
317 /* Find out which jails will be run. */
318 dep_setup(docf);
319 error = 0;
320 if (op == JF_STOP) {
321 for (i = 0; i < argc; i++)
322 if (start_state(argv[i], docf, op, Rflag) < 0)
323 error = 1;
324 } else {
325 if (start_state(argv[0], docf, op, 0) < 0)
326 exit(1);
292 }
327 }
293 jid = jailparam_set(params, nparams,
294 jail_set_flags ? jail_set_flags : JAIL_CREATE | JAIL_ATTACH);
295 if (jid < 0)
296 errx(1, "%s", jail_errmsg);
297 if (iflag) {
298 printf("%d\n", jid);
299 fflush(stdout);
328
329 jfp = NULL;
330 if (JidFile != NULL) {
331 jfp = fopen(JidFile, "w");
332 if (jfp == NULL)
333 err(1, "open %s", JidFile);
334 setlinebuf(jfp);
300 }
335 }
301 if (Jflag) {
302 if (jail_set_flags) {
303 fprintf(fp, "jid=%d", jid);
304 for (i = 0; i < nparams; i++)
305 if (strcmp(params[i].jp_name, "jid")) {
306 fprintf(fp, " %s",
307 (char *)params[i].jp_name);
308 if (param_values[i]) {
309 putc('=', fp);
310 quoted_print(fp,
311 param_values[i]);
312 }
336 setlinebuf(stdout);
337
338 /*
339 * The main loop: Get an available jail and perform the required
340 * operation on it. When that is done, the jail may be finished,
341 * or it may go back for the next step.
342 */
343 while ((j = next_jail()))
344 {
345 if (j->flags & JF_FAILED) {
346 error = 1;
347 if (j->comparam == NULL) {
348 dep_done(j, 0);
349 continue;
350 }
351 }
352 if (!(j->flags & JF_PARAMS))
353 {
354 j->flags |= JF_PARAMS;
355 if (dflag)
356 add_param(j, NULL, IP_ALLOW_DYING, NULL);
357 if (check_intparams(j) < 0)
358 continue;
359 if ((j->flags & (JF_START | JF_SET)) &&
360 import_params(j) < 0)
361 continue;
362 }
363 if (!j->jid)
364 running_jid(j,
365 (j->flags & (JF_SET | JF_DEPEND)) == JF_SET
366 ? dflag || bool_param(j->intparams[IP_ALLOW_DYING])
367 : 0);
368 if (finish_command(j))
369 continue;
370
371 switch (j->flags & JF_OP_MASK) {
372 /*
373 * These operations just turn into a different op
374 * depending on the jail's current status.
375 */
376 case JF_START_SET:
377 j->flags = j->jid < 0 ? JF_START : JF_SET;
378 break;
379 case JF_SET_RESTART:
380 if (j->jid < 0) {
381 jail_quoted_warnx(j, "not found",
382 "no jail specified");
383 failed(j);
384 continue;
385 }
386 j->flags = rdtun_params(j, 0) ? JF_RESTART : JF_SET;
387 if (j->flags == JF_RESTART)
388 dep_reset(j);
389 break;
390 case JF_START_SET_RESTART:
391 j->flags = j->jid < 0 ? JF_START
392 : rdtun_params(j, 0) ? JF_RESTART : JF_SET;
393 if (j->flags == JF_RESTART)
394 dep_reset(j);
395 }
396
397 switch (j->flags & JF_OP_MASK) {
398 case JF_START:
399 if (j->comparam == NULL) {
400 if (j->jid > 0 &&
401 !(j->flags & (JF_DEPEND | JF_WILD))) {
402 jail_quoted_warnx(j, "already exists",
403 NULL);
404 failed(j);
405 continue;
313 }
406 }
314 fprintf(fp, "\n");
315 } else {
316 for (i = 0; i < nparams; i++)
317 if (!strcmp(params[i].jp_name, "path"))
318 break;
319#if defined(INET6) && defined(INET)
320 fprintf(fp, "%d\t%s\t%s\t%s%s%s\t%s\n",
321 jid, i < nparams
322 ? (char *)params[i].jp_value : argv[0],
323 argv[1], ip4_addr ? ip4_addr : "",
324 ip4_addr && ip4_addr[0] && ip6_addr && ip6_addr[0]
325 ? "," : "", ip6_addr ? ip6_addr : "", argv[3]);
326#elif defined(INET6)
327 fprintf(fp, "%d\t%s\t%s\t%s\t%s\n",
328 jid, i < nparams
329 ? (char *)params[i].jp_value : argv[0],
330 argv[1], ip6_addr ? ip6_addr : "", argv[3]);
331#elif defined(INET)
332 fprintf(fp, "%d\t%s\t%s\t%s\t%s\n",
333 jid, i < nparams
334 ? (char *)params[i].jp_value : argv[0],
335 argv[1], ip4_addr ? ip4_addr : "", argv[3]);
336#endif
407 if (dep_check(j))
408 continue;
409 if (j->jid > 0)
410 goto jail_create_done;
411 j->comparam = startcommands;
412 j->comstring = NULL;
413 }
414 if (next_command(j))
415 continue;
416 jail_create_done:
417 clear_persist(j);
418 if (iflag)
419 printf("%d\n", j->jid);
420 if (jfp != NULL)
421 print_jail(jfp, j, oldcl);
422 dep_done(j, 0);
423 break;
424
425 case JF_SET:
426 if (j->jid < 0 && !(j->flags & JF_DEPEND)) {
427 jail_quoted_warnx(j, "not found",
428 "no jail specified");
429 failed(j);
430 continue;
431 }
432 if (dep_check(j))
433 continue;
434 if (!(j->flags & JF_DEPEND)) {
435 if (rdtun_params(j, 1) < 0 ||
436 update_jail(j) < 0)
437 continue;
438 if (verbose >= 0 && (j->name || verbose > 0))
439 jail_note(j, "updated\n");
440 }
441 dep_done(j, 0);
442 break;
443
444 case JF_STOP:
445 case JF_RESTART:
446 if (j->comparam == NULL) {
447 if (dep_check(j))
448 continue;
449 if (j->jid < 0) {
450 if (!(j->flags & (JF_DEPEND | JF_WILD))
451 && verbose >= 0)
452 jail_quoted_warnx(j,
453 "not found", NULL);
454 goto jail_remove_done;
455 }
456 j->comparam = stopcommands;
457 j->comstring = NULL;
458 } else if ((j->flags & JF_FAILED) && j->jid > 0)
459 goto jail_remove_done;
460 if (next_command(j))
461 continue;
462 jail_remove_done:
463 dep_done(j, 0);
464 if ((j->flags & (JF_START | JF_FAILED)) == JF_START) {
465 j->comparam = NULL;
466 j->flags &= ~JF_STOP;
467 dep_reset(j);
468 requeue(j, j->ndeps ? &depend : &ready);
469 }
470 break;
337 }
471 }
338 (void)fclose(fp);
339 }
472 }
340 if (cmdarg < 0)
341 exit(0);
342 if (username != NULL) {
343 if (Uflag)
344 GET_USER_INFO;
345 if (lflag) {
346 p = getenv("TERM");
347 environ = &cleanenv;
473
474 if (jfp != NULL)
475 fclose(jfp);
476 exit(error);
477}
478
479/*
480 * Mark a jail's failure for future handling.
481 */
482void
483failed(struct cfjail *j)
484{
485 j->flags |= JF_FAILED;
486 TAILQ_REMOVE(j->queue, j, tq);
487 TAILQ_INSERT_HEAD(&ready, j, tq);
488 j->queue = &ready;
489}
490
491/*
492 * Exit slightly more gracefully when out of memory.
493 */
494void *
495emalloc(size_t size)
496{
497 void *p;
498
499 p = malloc(size);
500 if (!p)
501 err(1, "malloc");
502 return p;
503}
504
505void *
506erealloc(void *ptr, size_t size)
507{
508 void *p;
509
510 p = realloc(ptr, size);
511 if (!p)
512 err(1, "malloc");
513 return p;
514}
515
516char *
517estrdup(const char *str)
518{
519 char *ns;
520
521 ns = strdup(str);
522 if (!ns)
523 err(1, "malloc");
524 return ns;
525}
526
527/*
528 * Print a message including an optional jail name.
529 */
530void
531jail_note(const struct cfjail *j, const char *fmt, ...)
532{
533 va_list ap, tap;
534 char *cs;
535 size_t len;
536
537 va_start(ap, fmt);
538 va_copy(tap, ap);
539 len = vsnprintf(NULL, 0, fmt, tap);
540 va_end(tap);
541 cs = alloca(len + 1);
542 (void)vsnprintf(cs, len + 1, fmt, ap);
543 va_end(ap);
544 if (j->name)
545 printf("%s: %s", j->name, cs);
546 else
547 printf("%s", cs);
548}
549
550/*
551 * Print a warning message including an optional jail name.
552 */
553void
554jail_warnx(const struct cfjail *j, const char *fmt, ...)
555{
556 va_list ap, tap;
557 char *cs;
558 size_t len;
559
560 va_start(ap, fmt);
561 va_copy(tap, ap);
562 len = vsnprintf(NULL, 0, fmt, tap);
563 va_end(tap);
564 cs = alloca(len + 1);
565 (void)vsnprintf(cs, len + 1, fmt, ap);
566 va_end(ap);
567 if (j->name)
568 warnx("%s: %s", j->name, cs);
569 else
570 warnx("%s", cs);
571}
572
573/*
574 * Create a new jail.
575 */
576int
577create_jail(struct cfjail *j)
578{
579 struct iovec jiov[4];
580 struct stat st;
581 struct jailparam *jp, *setparams, *setparams2, *sjp;
582 const char *path;
583 int dopersist, ns, jid, dying, didfail;
584
585 /*
586 * Check the jail's path, with a better error message than jail_set
587 * gives.
588 */
589 if ((path = string_param(j->intparams[KP_PATH]))) {
590 if (j->name != NULL && path[0] != '/') {
591 jail_warnx(j, "path %s: not an absolute pathname",
592 path);
593 return -1;
348 }
594 }
349 if (setgroups(ngroups, groups) != 0)
350 err(1, "setgroups");
351 if (setgid(pwd->pw_gid) != 0)
352 err(1, "setgid");
353 if (setusercontext(lcap, pwd, pwd->pw_uid,
354 LOGIN_SETALL & ~LOGIN_SETGROUP & ~LOGIN_SETLOGIN) != 0)
355 err(1, "setusercontext");
356 login_close(lcap);
595 if (stat(path, &st) < 0) {
596 jail_warnx(j, "path %s: %s", path, strerror(errno));
597 return -1;
598 }
599 if (!S_ISDIR(st.st_mode)) {
600 jail_warnx(j, "path %s: %s", path, strerror(ENOTDIR));
601 return -1;
602 }
357 }
603 }
358 if (lflag) {
359 if (*pwd->pw_shell)
360 shell = pwd->pw_shell;
361 else
362 shell = _PATH_BSHELL;
363 if (chdir(pwd->pw_dir) < 0)
364 errx(1, "no home directory");
365 setenv("HOME", pwd->pw_dir, 1);
366 setenv("SHELL", shell, 1);
367 setenv("USER", pwd->pw_name, 1);
368 if (p)
369 setenv("TERM", p, 1);
604
605 /*
606 * Copy all the parameters, except that "persist" is always set when
607 * there are commands to run later.
608 */
609 dopersist = !bool_param(j->intparams[KP_PERSIST]) &&
610 (j->intparams[IP_EXEC_START] || j->intparams[IP_COMMAND] ||
611 j->intparams[IP_EXEC_POSTSTART]);
612 sjp = setparams =
613 alloca((j->njp + dopersist) * sizeof(struct jailparam));
614 if (dopersist && jailparam_init(sjp++, "persist") < 0) {
615 jail_warnx(j, "%s", jail_errmsg);
616 return -1;
370 }
617 }
371 execvp(argv[cmdarg], argv + cmdarg);
372 err(1, "execvp: %s", argv[cmdarg]);
618 for (jp = j->jp; jp < j->jp + j->njp; jp++)
619 if (!dopersist || !equalopts(jp->jp_name, "persist"))
620 *sjp++ = *jp;
621 ns = sjp - setparams;
622
623 didfail = 0;
624 j->jid = jailparam_set_note(j, setparams, ns, JAIL_CREATE);
625 if (j->jid < 0 && errno == EEXIST &&
626 bool_param(j->intparams[IP_ALLOW_DYING]) &&
627 int_param(j->intparams[KP_JID], &jid) && jid != 0) {
628 /*
629 * The jail already exists, but may be dying.
630 * Make sure it is, in which case an update is appropriate.
631 */
632 *(const void **)&jiov[0].iov_base = "jid";
633 jiov[0].iov_len = sizeof("jid");
634 jiov[1].iov_base = &jid;
635 jiov[1].iov_len = sizeof(jid);
636 *(const void **)&jiov[2].iov_base = "dying";
637 jiov[2].iov_len = sizeof("dying");
638 jiov[3].iov_base = &dying;
639 jiov[3].iov_len = sizeof(dying);
640 if (jail_get(jiov, 4, JAIL_DYING) < 0) {
641 /*
642 * It could be that the jail just barely finished
643 * dying, or it could be that the jid never existed
644 * but the name does. In either case, another try
645 * at creating the jail should do the right thing.
646 */
647 if (errno == ENOENT)
648 j->jid = jailparam_set_note(j, setparams, ns,
649 JAIL_CREATE);
650 } else if (dying) {
651 j->jid = jid;
652 if (rdtun_params(j, 1) < 0) {
653 j->jid = -1;
654 didfail = 1;
655 } else {
656 sjp = setparams2 = alloca((j->njp + dopersist) *
657 sizeof(struct jailparam));
658 for (jp = setparams; jp < setparams + ns; jp++)
659 if (!JP_RDTUN(jp) ||
660 !strcmp(jp->jp_name, "jid"))
661 *sjp++ = *jp;
662 j->jid = jailparam_set_note(j, setparams2,
663 sjp - setparams2, JAIL_UPDATE | JAIL_DYING);
664 /*
665 * Again, perhaps the jail just finished dying.
666 */
667 if (j->jid < 0 && errno == ENOENT)
668 j->jid = jailparam_set_note(j,
669 setparams, ns, JAIL_CREATE);
670 }
671 }
672 }
673 if (j->jid < 0 && !didfail) {
674 jail_warnx(j, "%s", jail_errmsg);
675 failed(j);
676 }
677 if (dopersist) {
678 jailparam_free(setparams, 1);
679 if (j->jid > 0)
680 j->flags |= JF_PERSIST;
681 }
682 return j->jid;
373}
374
683}
684
375#if defined(INET6) || defined(INET)
685/*
686 * Remove a temporarily set "persist" parameter.
687 */
376static void
688static void
377add_ip_addr(char **addrp, char *value)
689clear_persist(struct cfjail *j)
378{
690{
379 int addrlen;
380 char *addr;
691 struct iovec jiov[4];
692 int jid;
381
693
382 if (!*addrp) {
383 *addrp = strdup(value);
384 if (!*addrp)
385 err(1, "malloc");
386 } else if (value[0]) {
387 addrlen = strlen(*addrp) + strlen(value) + 2;
388 addr = malloc(addrlen);
389 if (!addr)
390 err(1, "malloc");
391 snprintf(addr, addrlen, "%s,%s", *addrp, value);
392 free(*addrp);
393 *addrp = addr;
694 if (!(j->flags & JF_PERSIST))
695 return;
696 j->flags &= ~JF_PERSIST;
697 *(const void **)&jiov[0].iov_base = "jid";
698 jiov[0].iov_len = sizeof("jid");
699 jiov[1].iov_base = &j->jid;
700 jiov[1].iov_len = sizeof(j->jid);
701 *(const void **)&jiov[2].iov_base = "nopersist";
702 jiov[2].iov_len = sizeof("nopersist");
703 jiov[3].iov_base = NULL;
704 jiov[3].iov_len = 0;
705 jid = jail_set(jiov, 4, JAIL_UPDATE);
706 if (verbose > 0)
707 jail_note(j, "jail_set(JAIL_UPDATE) jid=%d nopersist%s%s\n",
708 j->jid, jid < 0 ? ": " : "",
709 jid < 0 ? strerror(errno) : "");
710}
711
712/*
713 * Set a jail's parameters.
714 */
715static int
716update_jail(struct cfjail *j)
717{
718 struct jailparam *jp, *setparams, *sjp;
719 int ns, jid;
720
721 ns = 0;
722 for (jp = j->jp; jp < j->jp + j->njp; jp++)
723 if (!JP_RDTUN(jp))
724 ns++;
725 if (ns == 0)
726 return 0;
727 sjp = setparams = alloca(++ns * sizeof(struct jailparam));
728 if (jailparam_init(sjp, "jid") < 0 ||
729 jailparam_import_raw(sjp, &j->jid, sizeof j->jid) < 0) {
730 jail_warnx(j, "%s", jail_errmsg);
731 failed(j);
732 return -1;
394 }
733 }
734 for (jp = j->jp; jp < j->jp + j->njp; jp++)
735 if (!JP_RDTUN(jp))
736 *++sjp = *jp;
737
738 jid = jailparam_set_note(j, setparams, ns,
739 bool_param(j->intparams[IP_ALLOW_DYING])
740 ? JAIL_UPDATE | JAIL_DYING : JAIL_UPDATE);
741 if (jid < 0) {
742 jail_warnx(j, "%s", jail_errmsg);
743 failed(j);
744 }
745 jailparam_free(setparams, 1);
746 return jid;
395}
747}
396#endif
397
748
398#ifdef INET6
749/*
750 * Return if a jail set would change any create-only parameters.
751 */
752static int
753rdtun_params(struct cfjail *j, int dofail)
754{
755 struct jailparam *jp, *rtparams, *rtjp;
756 int nrt, rval;
757
758 if (j->flags & JF_RDTUN)
759 return 0;
760 j->flags |= JF_RDTUN;
761 nrt = 0;
762 for (jp = j->jp; jp < j->jp + j->njp; jp++)
763 if (JP_RDTUN(jp) && strcmp(jp->jp_name, "jid"))
764 nrt++;
765 if (nrt == 0)
766 return 0;
767 rtjp = rtparams = alloca(++nrt * sizeof(struct jailparam));
768 if (jailparam_init(rtjp, "jid") < 0 ||
769 jailparam_import_raw(rtjp, &j->jid, sizeof j->jid) < 0) {
770 jail_warnx(j, "%s", jail_errmsg);
771 exit(1);
772 }
773 for (jp = j->jp; jp < j->jp + j->njp; jp++)
774 if (JP_RDTUN(jp) && strcmp(jp->jp_name, "jid"))
775 *++rtjp = *jp;
776 rval = 0;
777 if (jailparam_get(rtparams, nrt,
778 bool_param(j->intparams[IP_ALLOW_DYING]) ? JAIL_DYING : 0) > 0) {
779 rtjp = rtparams + 1;
780 for (jp = j->jp, rtjp = rtparams + 1; rtjp < rtparams + nrt;
781 jp++) {
782 if (JP_RDTUN(jp) && strcmp(jp->jp_name, "jid")) {
783 if (!((jp->jp_flags & (JP_BOOL | JP_NOBOOL)) &&
784 jp->jp_valuelen == 0 &&
785 *(int *)jp->jp_value) &&
786 !(rtjp->jp_valuelen == jp->jp_valuelen &&
787 !memcmp(rtjp->jp_value, jp->jp_value,
788 jp->jp_valuelen))) {
789 if (dofail) {
790 jail_warnx(j, "%s cannot be "
791 "changed after creation",
792 jp->jp_name);
793 failed(j);
794 rval = -1;
795 } else
796 rval = 1;
797 break;
798 }
799 rtjp++;
800 }
801 }
802 }
803 for (rtjp = rtparams + 1; rtjp < rtparams + nrt; rtjp++)
804 rtjp->jp_name = NULL;
805 jailparam_free(rtparams, nrt);
806 return rval;
807}
808
809/*
810 * Get the jail's jid if it is running.
811 */
399static void
812static void
400add_ip_addr46(char *value)
813running_jid(struct cfjail *j, int dflag)
401{
814{
402 char *p, *np;
815 struct iovec jiov[2];
816 const char *pval;
817 char *ep;
818 int jid;
403
819
404 for (p = value;; p = np + 1)
405 {
406 np = strchr(p, ',');
407 if (np)
408 *np = '\0';
409 add_ip_addrinfo(AI_NUMERICHOST, p);
410 if (!np)
411 break;
820 if ((pval = string_param(j->intparams[KP_JID]))) {
821 if (!(jid = strtol(pval, &ep, 10)) || *ep) {
822 j->jid = -1;
823 return;
824 }
825 *(const void **)&jiov[0].iov_base = "jid";
826 jiov[0].iov_len = sizeof("jid");
827 jiov[1].iov_base = &jid;
828 jiov[1].iov_len = sizeof(jid);
829 } else if ((pval = string_param(j->intparams[KP_NAME]))) {
830 *(const void **)&jiov[0].iov_base = "name";
831 jiov[0].iov_len = sizeof("name");
832 jiov[1].iov_len = strlen(pval) + 1;
833 jiov[1].iov_base = alloca(jiov[1].iov_len);
834 strcpy(jiov[1].iov_base, pval);
835 } else {
836 j->jid = -1;
837 return;
412 }
838 }
839 j->jid = jail_get(jiov, 2, dflag ? JAIL_DYING : 0);
413}
840}
414#endif
415
416static void
841
842static void
417add_ip_addrinfo(int ai_flags, char *value)
843jail_quoted_warnx(const struct cfjail *j, const char *name_msg,
844 const char *noname_msg)
418{
845{
419 struct addrinfo hints, *ai0, *ai;
420 int error;
421#ifdef INET
422 char avalue4[INET_ADDRSTRLEN];
423 struct in_addr addr4;
424#endif
425#ifdef INET6
426 char avalue6[INET6_ADDRSTRLEN];
427 struct in6_addr addr6;
428#endif
846 const char *pval;
429
847
430 /* Look up the hostname (or get the address) */
431 memset(&hints, 0, sizeof(hints));
432 hints.ai_socktype = SOCK_STREAM;
433#if defined(INET6) && defined(INET)
434 hints.ai_family = PF_UNSPEC;
435#elif defined(INET6)
436 hints.ai_family = PF_INET6;
437#elif defined(INET)
438 hints.ai_family = PF_INET;
439#endif
440 hints.ai_flags = ai_flags;
441 error = getaddrinfo(value, NULL, &hints, &ai0);
442 if (error != 0)
443 errx(1, "hostname %s: %s", value, gai_strerror(error));
848 if ((pval = j->name) || (pval = string_param(j->intparams[KP_JID])) ||
849 (pval = string_param(j->intparams[KP_NAME])))
850 warnx("\"%s\" %s", pval, name_msg);
851 else
852 warnx("%s", noname_msg);
853}
444
854
445 /* Convert the addresses to ASCII so set_param can convert them back. */
446 for (ai = ai0; ai; ai = ai->ai_next)
447 switch (ai->ai_family) {
855/*
856 * Set jail parameters and possible print them out.
857 */
858static int
859jailparam_set_note(const struct cfjail *j, struct jailparam *jp, unsigned njp,
860 int flags)
861{
862 char *value;
863 int jid;
864 unsigned i;
865
866 jid = jailparam_set(jp, njp, flags);
867 if (verbose > 0) {
868 jail_note(j, "jail_set(%s%s)",
869 (flags & (JAIL_CREATE | JAIL_UPDATE)) == JAIL_CREATE
870 ? "JAIL_CREATE" : "JAIL_UPDATE",
871 (flags & JAIL_DYING) ? " | JAIL_DYING" : "");
872 for (i = 0; i < njp; i++) {
873 printf(" %s", jp[i].jp_name);
874 if (jp[i].jp_value == NULL)
875 continue;
876 putchar('=');
877 value = jailparam_export(jp + i);
878 if (value == NULL)
879 err(1, "jailparam_export");
880 quoted_print(stdout, value);
881 free(value);
882 }
883 if (jid < 0)
884 printf(": %s", strerror(errno));
885 printf("\n");
886 }
887 return jid;
888}
889
890/*
891 * Print a jail record.
892 */
893static void
894print_jail(FILE *fp, struct cfjail *j, int oldcl)
895{
896 struct cfparam *p;
897
898 if (oldcl) {
899 fprintf(fp, "%d\t", j->jid);
900 print_param(fp, j->intparams[KP_PATH], ',', 0);
901 putc('\t', fp);
902 print_param(fp, j->intparams[KP_HOST_HOSTNAME], ',', 0);
903 putc('\t', fp);
448#ifdef INET
904#ifdef INET
449 case AF_INET:
450 if (!ip4_ok && (ai_flags & AI_NUMERICHOST) == 0)
451 break;
452 memcpy(&addr4, &((struct sockaddr_in *)
453 (void *)ai->ai_addr)->sin_addr, sizeof(addr4));
454 if (inet_ntop(AF_INET, &addr4, avalue4,
455 INET_ADDRSTRLEN) == NULL)
456 err(1, "inet_ntop");
457 add_ip_addr(&ip4_addr, avalue4);
458 break;
905 print_param(fp, j->intparams[KP_IP4_ADDR], ',', 0);
906#ifdef INET6
907 if (j->intparams[KP_IP4_ADDR] &&
908 !TAILQ_EMPTY(&j->intparams[KP_IP4_ADDR]->val) &&
909 j->intparams[KP_IP6_ADDR] &&
910 !TAILQ_EMPTY(&j->intparams[KP_IP6_ADDR]->val))
911 putc(',', fp);
459#endif
912#endif
913#endif
460#ifdef INET6
914#ifdef INET6
461 case AF_INET6:
462 if (!ip6_ok && (ai_flags & AI_NUMERICHOST) == 0)
463 break;
464 memcpy(&addr6, &((struct sockaddr_in6 *)
465 (void *)ai->ai_addr)->sin6_addr, sizeof(addr6));
466 if (inet_ntop(AF_INET6, &addr6, avalue6,
467 INET6_ADDRSTRLEN) == NULL)
468 err(1, "inet_ntop");
469 add_ip_addr(&ip6_addr, avalue6);
470 break;
915 print_param(fp, j->intparams[KP_IP6_ADDR], ',', 0);
471#endif
916#endif
472 }
473 freeaddrinfo(ai0);
917 putc('\t', fp);
918 print_param(fp, j->intparams[IP_COMMAND], ' ', 0);
919 } else {
920 fprintf(fp, "jid=%d", j->jid);
921 TAILQ_FOREACH(p, &j->params, tq)
922 if (strcmp(p->name, "jid")) {
923 putc(' ', fp);
924 print_param(fp, p, ',', 1);
925 }
926 }
927 putc('\n', fp);
474}
475
928}
929
930/*
931 * Print a parameter value, or a name=value pair.
932 */
476static void
933static void
477quoted_print(FILE *fp, char *str)
934print_param(FILE *fp, const struct cfparam *p, int sep, int doname)
478{
935{
479 int c, qc;
480 char *p = str;
936 const struct cfstring *s, *ts;
481
937
482 /* An empty string needs quoting. */
483 if (!*p) {
484 fputs("\"\"", fp);
938 if (doname)
939 fputs(p->name, fp);
940 if (p == NULL || TAILQ_EMPTY(&p->val))
485 return;
941 return;
942 if (doname)
943 putc('=', fp);
944 TAILQ_FOREACH_SAFE(s, &p->val, tq, ts) {
945 quoted_print(fp, s->s);
946 if (ts != NULL)
947 putc(sep, fp);
486 }
948 }
949}
487
950
488 /*
489 * The value will be surrounded by quotes if it contains spaces
490 * or quotes.
491 */
492 qc = strchr(p, '\'') ? '"'
951/*
952 * Print a string with quotes around spaces.
953 */
954static void
955quoted_print(FILE *fp, char *str)
956{
957 int c, qc;
958 char *p = str;
959
960 qc = !*p ? '"'
961 : strchr(p, '\'') ? '"'
493 : strchr(p, '"') ? '\''
494 : strchr(p, ' ') || strchr(p, '\t') ? '"'
495 : 0;
496 if (qc)
497 putc(qc, fp);
498 while ((c = *p++)) {
499 if (c == '\\' || c == qc)
500 putc('\\', fp);
501 putc(c, fp);
502 }
503 if (qc)
504 putc(qc, fp);
505}
506
507static void
962 : strchr(p, '"') ? '\''
963 : strchr(p, ' ') || strchr(p, '\t') ? '"'
964 : 0;
965 if (qc)
966 putc(qc, fp);
967 while ((c = *p++)) {
968 if (c == '\\' || c == qc)
969 putc('\\', fp);
970 putc(c, fp);
971 }
972 if (qc)
973 putc(qc, fp);
974}
975
976static void
508set_param(const char *name, char *value)
509{
510 struct jailparam *param;
511 char path[PATH_MAX];
512 int i;
513
514 static int paramlistsize;
515
516 /* Separate the name from the value, if not done already. */
517 if (name == NULL) {
518 name = value;
519 if ((value = strchr(value, '=')))
520 *value++ = '\0';
521 }
522
523 /* jail_set won't chdir along with its chroot, so do it here. */
524 if (!strcmp(name, "path")) {
525 /* resolve the path with realpath(3) */
526 if (realpath(value, path) != NULL)
527 value = path;
528 if (chdir(value) < 0)
529 err(1, "chdir: %s", value);
530 }
531
532 /* Check for repeat parameters */
533 for (i = 0; i < nparams; i++)
534 if (!strcmp(name, params[i].jp_name)) {
535 jailparam_free(params + i, 1);
536 memcpy(params + i, params + i + 1,
537 (--nparams - i) * sizeof(struct jailparam));
538 break;
539 }
540
541 /* Make sure there is room for the new param record. */
542 if (!nparams) {
543 paramlistsize = 32;
544 params = malloc(paramlistsize * sizeof(*params));
545 param_values = malloc(paramlistsize * sizeof(*param_values));
546 if (params == NULL || param_values == NULL)
547 err(1, "malloc");
548 } else if (nparams >= paramlistsize) {
549 paramlistsize *= 2;
550 params = realloc(params, paramlistsize * sizeof(*params));
551 param_values = realloc(param_values,
552 paramlistsize * sizeof(*param_values));
553 if (params == NULL)
554 err(1, "realloc");
555 }
556
557 /* Look up the paramter. */
558 param_values[nparams] = value;
559 param = params + nparams++;
560 if (jailparam_init(param, name) < 0 ||
561 jailparam_import(param, value) < 0)
562 errx(1, "%s", jail_errmsg);
563}
564
565static void
566usage(void)
567{
568
569 (void)fprintf(stderr,
977usage(void)
978{
979
980 (void)fprintf(stderr,
570 "usage: jail [-d] [-h] [-i] [-J jid_file] "
571 "[-l -u username | -U username]\n"
572 " [-c | -m] param=value ... [command=command ...]\n"
573 " jail [-r jail]\n");
981 "usage: jail [-dhilqv] [-J jid_file] [-u username] [-U username]\n"
982 " -[cmr] param=value ... [command=command ...]\n"
983 " jail [-dqv] [-f file] -[cmr] [jail]\n"
984 " jail [-qv] [-f file] -[rR] ['*' | jail ...]\n"
985 " jail [-dhilqv] [-J jid_file] [-u username] [-U username]\n"
986 " [-n jailname] [-s securelevel]\n"
987 " path hostname [ip[,...]] command ...\n");
574 exit(1);
575}
988 exit(1);
989}