kern_jail.c revision 125804
146197Sphk/* 246197Sphk * ---------------------------------------------------------------------------- 346197Sphk * "THE BEER-WARE LICENSE" (Revision 42): 446197Sphk * <phk@FreeBSD.ORG> wrote this file. As long as you retain this notice you 546197Sphk * can do whatever you want with this stuff. If we meet some day, and you think 646197Sphk * this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp 746197Sphk * ---------------------------------------------------------------------------- 846197Sphk */ 946155Sphk 10116182Sobrien#include <sys/cdefs.h> 11116182Sobrien__FBSDID("$FreeBSD: head/sys/kern/kern_jail.c 125804 2004-02-14 18:31:11Z rwatson $"); 12116182Sobrien 1346155Sphk#include <sys/param.h> 1446155Sphk#include <sys/types.h> 1546155Sphk#include <sys/kernel.h> 1646155Sphk#include <sys/systm.h> 1746155Sphk#include <sys/errno.h> 1846155Sphk#include <sys/sysproto.h> 1946155Sphk#include <sys/malloc.h> 2046155Sphk#include <sys/proc.h> 21124882Srwatson#include <sys/taskqueue.h> 2246155Sphk#include <sys/jail.h> 2387275Srwatson#include <sys/lock.h> 2487275Srwatson#include <sys/mutex.h> 25113275Smike#include <sys/namei.h> 26113275Smike#include <sys/queue.h> 2746155Sphk#include <sys/socket.h> 28113275Smike#include <sys/syscallsubr.h> 2957163Srwatson#include <sys/sysctl.h> 30113275Smike#include <sys/vnode.h> 3146155Sphk#include <net/if.h> 3246155Sphk#include <netinet/in.h> 3346155Sphk 3446155SphkMALLOC_DEFINE(M_PRISON, "prison", "Prison structures"); 3546155Sphk 3689414SarrSYSCTL_DECL(_security); 3789414SarrSYSCTL_NODE(_security, OID_AUTO, jail, CTLFLAG_RW, 0, 3857163Srwatson "Jail rules"); 3957163Srwatson 4084828Sjhbmp_fixme("these variables need a lock") 4184828Sjhb 4257163Srwatsonint jail_set_hostname_allowed = 1; 4389414SarrSYSCTL_INT(_security_jail, OID_AUTO, set_hostname_allowed, CTLFLAG_RW, 4457163Srwatson &jail_set_hostname_allowed, 0, 4557163Srwatson "Processes in jail can set their hostnames"); 4657163Srwatson 4761235Srwatsonint jail_socket_unixiproute_only = 1; 4889414SarrSYSCTL_INT(_security_jail, OID_AUTO, socket_unixiproute_only, CTLFLAG_RW, 4961235Srwatson &jail_socket_unixiproute_only, 0, 5061235Srwatson "Processes in jail are limited to creating UNIX/IPv4/route sockets only"); 5161235Srwatson 5268024Srwatsonint jail_sysvipc_allowed = 0; 5389414SarrSYSCTL_INT(_security_jail, OID_AUTO, sysvipc_allowed, CTLFLAG_RW, 5468024Srwatson &jail_sysvipc_allowed, 0, 5568024Srwatson "Processes in jail can use System V IPC primitives"); 5668024Srwatson 57125804Srwatsonint jail_getfsstatroot_only = 1; 58125804SrwatsonSYSCTL_INT(_security_jail, OID_AUTO, getfsstate_getfsstatroot_only, CTLFLAG_RW, 59125804Srwatson &jail_getfsstatroot_only, 0, 60125804Srwatson "Processes see only their root file system in getfsstat()"); 61125804Srwatson 62113275Smike/* allprison, lastprid, and prisoncount are protected by allprison_mtx. */ 63113275Smikestruct prisonlist allprison; 64113275Smikestruct mtx allprison_mtx; 65113275Smikeint lastprid = 0; 66113275Smikeint prisoncount = 0; 67113275Smike 68113275Smikestatic void init_prison(void *); 69124882Srwatsonstatic void prison_complete(void *context, int pending); 70113275Smikestatic struct prison *prison_find(int); 71113275Smikestatic int sysctl_jail_list(SYSCTL_HANDLER_ARGS); 72113275Smike 73113275Smikestatic void 74113275Smikeinit_prison(void *data __unused) 75113275Smike{ 76113275Smike 77113275Smike mtx_init(&allprison_mtx, "allprison", NULL, MTX_DEF); 78113275Smike LIST_INIT(&allprison); 79113275Smike} 80113275Smike 81113275SmikeSYSINIT(prison, SI_SUB_INTRINSIC, SI_ORDER_ANY, init_prison, NULL); 82113275Smike 8382710Sdillon/* 8482710Sdillon * MPSAFE 85114168Smike * 86114168Smike * struct jail_args { 87114168Smike * struct jail *jail; 88114168Smike * }; 8982710Sdillon */ 9046155Sphkint 91114168Smikejail(struct thread *td, struct jail_args *uap) 9246155Sphk{ 93113275Smike struct nameidata nd; 94113275Smike struct prison *pr, *tpr; 9546155Sphk struct jail j; 96113275Smike struct jail_attach_args jaa; 97113275Smike int error, tryprid; 9846155Sphk 99114168Smike error = copyin(uap->jail, &j, sizeof(j)); 10046155Sphk if (error) 10184828Sjhb return (error); 10284828Sjhb if (j.version != 0) 10384828Sjhb return (EINVAL); 10484828Sjhb 105114168Smike MALLOC(pr, struct prison *, sizeof(*pr), M_PRISON, M_WAITOK | M_ZERO); 10693818Sjhb mtx_init(&pr->pr_mtx, "jail mutex", NULL, MTX_DEF); 107113275Smike pr->pr_ref = 1; 108114168Smike error = copyinstr(j.path, &pr->pr_path, sizeof(pr->pr_path), 0); 109113275Smike if (error) 110113275Smike goto e_killmtx; 111113275Smike mtx_lock(&Giant); 112113275Smike NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE, pr->pr_path, td); 113113275Smike error = namei(&nd); 114113275Smike if (error) { 115113275Smike mtx_unlock(&Giant); 116113275Smike goto e_killmtx; 117113275Smike } 118113275Smike pr->pr_root = nd.ni_vp; 119113275Smike VOP_UNLOCK(nd.ni_vp, 0, td); 120113275Smike NDFREE(&nd, NDF_ONLY_PNBUF); 121113275Smike mtx_unlock(&Giant); 122114168Smike error = copyinstr(j.hostname, &pr->pr_host, sizeof(pr->pr_host), 0); 12384828Sjhb if (error) 124113275Smike goto e_dropvnref; 125113275Smike pr->pr_ip = j.ip_number; 126113275Smike pr->pr_linux = NULL; 127113275Smike pr->pr_securelevel = securelevel; 128113275Smike 129113275Smike /* Determine next pr_id and add prison to allprison list. */ 130113275Smike mtx_lock(&allprison_mtx); 131113275Smike tryprid = lastprid + 1; 132113275Smike if (tryprid == JAIL_MAX) 133113275Smike tryprid = 1; 134113275Smikenext: 135113275Smike LIST_FOREACH(tpr, &allprison, pr_list) { 136113275Smike if (tpr->pr_id == tryprid) { 137113275Smike tryprid++; 138113275Smike if (tryprid == JAIL_MAX) { 139113275Smike mtx_unlock(&allprison_mtx); 140113275Smike error = EAGAIN; 141113275Smike goto e_dropvnref; 142113275Smike } 143113275Smike goto next; 144113275Smike } 145113275Smike } 146113275Smike pr->pr_id = jaa.jid = lastprid = tryprid; 147113275Smike LIST_INSERT_HEAD(&allprison, pr, pr_list); 148113275Smike prisoncount++; 149113275Smike mtx_unlock(&allprison_mtx); 150113275Smike 151113275Smike error = jail_attach(td, &jaa); 152113275Smike if (error) 153113275Smike goto e_dropprref; 154113275Smike mtx_lock(&pr->pr_mtx); 155113275Smike pr->pr_ref--; 156113275Smike mtx_unlock(&pr->pr_mtx); 157113275Smike td->td_retval[0] = jaa.jid; 158113275Smike return (0); 159113275Smikee_dropprref: 160113275Smike mtx_lock(&allprison_mtx); 161113275Smike LIST_REMOVE(pr, pr_list); 162113275Smike prisoncount--; 163113275Smike mtx_unlock(&allprison_mtx); 164113275Smikee_dropvnref: 16599227Siedowse mtx_lock(&Giant); 166113275Smike vrele(pr->pr_root); 16799227Siedowse mtx_unlock(&Giant); 168113275Smikee_killmtx: 169113275Smike mtx_destroy(&pr->pr_mtx); 170113275Smike FREE(pr, M_PRISON); 171113275Smike return (error); 172113275Smike} 173113275Smike 174113275Smike/* 175113275Smike * MPSAFE 176114168Smike * 177114168Smike * struct jail_attach_args { 178114168Smike * int jid; 179114168Smike * }; 180113275Smike */ 181113275Smikeint 182114168Smikejail_attach(struct thread *td, struct jail_attach_args *uap) 183113275Smike{ 184113275Smike struct proc *p; 185113275Smike struct ucred *newcred, *oldcred; 186113275Smike struct prison *pr; 187113275Smike int error; 188113275Smike 189113275Smike p = td->td_proc; 190113275Smike 191113275Smike mtx_lock(&allprison_mtx); 192113275Smike pr = prison_find(uap->jid); 193113275Smike if (pr == NULL) { 194113275Smike mtx_unlock(&allprison_mtx); 195113275Smike return (EINVAL); 196113275Smike } 197113275Smike pr->pr_ref++; 198113275Smike mtx_unlock(&pr->pr_mtx); 199113275Smike mtx_unlock(&allprison_mtx); 200113275Smike 201113275Smike error = suser_cred(td->td_ucred, PRISON_ROOT); 20246155Sphk if (error) 203113275Smike goto e_dropref; 204113275Smike mtx_lock(&Giant); 205113275Smike vn_lock(pr->pr_root, LK_EXCLUSIVE | LK_RETRY, td); 206113275Smike if ((error = change_dir(pr->pr_root, td)) != 0) 207113275Smike goto e_unlock; 208113275Smike#ifdef MAC 209113275Smike if ((error = mac_check_vnode_chroot(td->td_ucred, pr->pr_root))) 210113275Smike goto e_unlock; 211113275Smike#endif 212113275Smike VOP_UNLOCK(pr->pr_root, 0, td); 213113275Smike change_root(pr->pr_root, td); 214113275Smike mtx_unlock(&Giant); 215113275Smike 21684828Sjhb newcred = crget(); 21784828Sjhb PROC_LOCK(p); 21884828Sjhb /* Implicitly fail if already in jail. */ 21993593Sjhb error = suser_cred(p->p_ucred, 0); 220113275Smike if (error) { 221113275Smike PROC_UNLOCK(p); 222113275Smike crfree(newcred); 223113275Smike goto e_dropref; 224113275Smike } 22584828Sjhb oldcred = p->p_ucred; 226113275Smike setsugid(p); 22784828Sjhb crcopy(newcred, oldcred); 228113630Sjhb newcred->cr_prison = pr; 22984828Sjhb p->p_ucred = newcred; 23084828Sjhb PROC_UNLOCK(p); 23184828Sjhb crfree(oldcred); 23246155Sphk return (0); 233113275Smikee_unlock: 234113275Smike VOP_UNLOCK(pr->pr_root, 0, td); 235113275Smike mtx_unlock(&Giant); 236113275Smikee_dropref: 237113275Smike mtx_lock(&pr->pr_mtx); 238113275Smike pr->pr_ref--; 239113275Smike mtx_unlock(&pr->pr_mtx); 24046155Sphk return (error); 24146155Sphk} 24246155Sphk 243113275Smike/* 244113275Smike * Returns a locked prison instance, or NULL on failure. 245113275Smike */ 246113275Smikestatic struct prison * 247113275Smikeprison_find(int prid) 248113275Smike{ 249113275Smike struct prison *pr; 250113275Smike 251113275Smike mtx_assert(&allprison_mtx, MA_OWNED); 252113275Smike LIST_FOREACH(pr, &allprison, pr_list) { 253113275Smike if (pr->pr_id == prid) { 254113275Smike mtx_lock(&pr->pr_mtx); 255113275Smike return (pr); 256113275Smike } 257113275Smike } 258113275Smike return (NULL); 259113275Smike} 260113275Smike 26172786Srwatsonvoid 26272786Srwatsonprison_free(struct prison *pr) 26372786Srwatson{ 26472786Srwatson 265113275Smike mtx_lock(&allprison_mtx); 26687275Srwatson mtx_lock(&pr->pr_mtx); 26772786Srwatson pr->pr_ref--; 26872786Srwatson if (pr->pr_ref == 0) { 269113275Smike LIST_REMOVE(pr, pr_list); 27087275Srwatson mtx_unlock(&pr->pr_mtx); 271113275Smike prisoncount--; 272113275Smike mtx_unlock(&allprison_mtx); 273124882Srwatson 274124882Srwatson TASK_INIT(&pr->pr_task, 0, prison_complete, pr); 275124882Srwatson taskqueue_enqueue(taskqueue_swi, &pr->pr_task); 27687275Srwatson return; 27772786Srwatson } 27887275Srwatson mtx_unlock(&pr->pr_mtx); 279113275Smike mtx_unlock(&allprison_mtx); 28072786Srwatson} 28172786Srwatson 282124882Srwatsonstatic void 283124882Srwatsonprison_complete(void *context, int pending) 284124882Srwatson{ 285124882Srwatson struct prison *pr; 286124882Srwatson 287124882Srwatson pr = (struct prison *)context; 288124882Srwatson 289124882Srwatson mtx_lock(&Giant); 290124882Srwatson vrele(pr->pr_root); 291124882Srwatson mtx_unlock(&Giant); 292124882Srwatson 293124882Srwatson mtx_destroy(&pr->pr_mtx); 294124882Srwatson if (pr->pr_linux != NULL) 295124882Srwatson FREE(pr->pr_linux, M_PRISON); 296124882Srwatson FREE(pr, M_PRISON); 297124882Srwatson} 298124882Srwatson 29972786Srwatsonvoid 30072786Srwatsonprison_hold(struct prison *pr) 30172786Srwatson{ 30272786Srwatson 30387275Srwatson mtx_lock(&pr->pr_mtx); 30472786Srwatson pr->pr_ref++; 30587275Srwatson mtx_unlock(&pr->pr_mtx); 30672786Srwatson} 30772786Srwatson 30887275Srwatsonu_int32_t 30987275Srwatsonprison_getip(struct ucred *cred) 31087275Srwatson{ 31187275Srwatson 31287275Srwatson return (cred->cr_prison->pr_ip); 31387275Srwatson} 31487275Srwatson 31546155Sphkint 31672786Srwatsonprison_ip(struct ucred *cred, int flag, u_int32_t *ip) 31746155Sphk{ 31846155Sphk u_int32_t tmp; 31946155Sphk 32072786Srwatson if (!jailed(cred)) 32146155Sphk return (0); 32246155Sphk if (flag) 32346155Sphk tmp = *ip; 32446155Sphk else 32546155Sphk tmp = ntohl(*ip); 32646155Sphk if (tmp == INADDR_ANY) { 32746155Sphk if (flag) 32872786Srwatson *ip = cred->cr_prison->pr_ip; 32946155Sphk else 33072786Srwatson *ip = htonl(cred->cr_prison->pr_ip); 33146155Sphk return (0); 33246155Sphk } 33381114Srwatson if (tmp == INADDR_LOOPBACK) { 33481114Srwatson if (flag) 33581114Srwatson *ip = cred->cr_prison->pr_ip; 33681114Srwatson else 33781114Srwatson *ip = htonl(cred->cr_prison->pr_ip); 33881114Srwatson return (0); 33981114Srwatson } 34072786Srwatson if (cred->cr_prison->pr_ip != tmp) 34146155Sphk return (1); 34246155Sphk return (0); 34346155Sphk} 34446155Sphk 34546155Sphkvoid 34672786Srwatsonprison_remote_ip(struct ucred *cred, int flag, u_int32_t *ip) 34746155Sphk{ 34846155Sphk u_int32_t tmp; 34946155Sphk 35072786Srwatson if (!jailed(cred)) 35146155Sphk return; 35246155Sphk if (flag) 35346155Sphk tmp = *ip; 35446155Sphk else 35546155Sphk tmp = ntohl(*ip); 35681114Srwatson if (tmp == INADDR_LOOPBACK) { 35746155Sphk if (flag) 35872786Srwatson *ip = cred->cr_prison->pr_ip; 35946155Sphk else 36072786Srwatson *ip = htonl(cred->cr_prison->pr_ip); 36146155Sphk return; 36246155Sphk } 36346155Sphk return; 36446155Sphk} 36546155Sphk 36646155Sphkint 36772786Srwatsonprison_if(struct ucred *cred, struct sockaddr *sa) 36846155Sphk{ 369114168Smike struct sockaddr_in *sai; 37046155Sphk int ok; 37146155Sphk 372114168Smike sai = (struct sockaddr_in *)sa; 37361235Srwatson if ((sai->sin_family != AF_INET) && jail_socket_unixiproute_only) 37461235Srwatson ok = 1; 37561235Srwatson else if (sai->sin_family != AF_INET) 37646155Sphk ok = 0; 37772786Srwatson else if (cred->cr_prison->pr_ip != ntohl(sai->sin_addr.s_addr)) 37846155Sphk ok = 1; 37946155Sphk else 38046155Sphk ok = 0; 38146155Sphk return (ok); 38246155Sphk} 38372786Srwatson 38472786Srwatson/* 38572786Srwatson * Return 0 if jails permit p1 to frob p2, otherwise ESRCH. 38672786Srwatson */ 38772786Srwatsonint 388114168Smikeprison_check(struct ucred *cred1, struct ucred *cred2) 38972786Srwatson{ 39072786Srwatson 39172786Srwatson if (jailed(cred1)) { 39272786Srwatson if (!jailed(cred2)) 39372786Srwatson return (ESRCH); 39472786Srwatson if (cred2->cr_prison != cred1->cr_prison) 39572786Srwatson return (ESRCH); 39672786Srwatson } 39772786Srwatson 39872786Srwatson return (0); 39972786Srwatson} 40072786Srwatson 40172786Srwatson/* 40272786Srwatson * Return 1 if the passed credential is in a jail, otherwise 0. 40372786Srwatson */ 40472786Srwatsonint 405114168Smikejailed(struct ucred *cred) 40672786Srwatson{ 40772786Srwatson 40872786Srwatson return (cred->cr_prison != NULL); 40972786Srwatson} 41091384Srobert 41191384Srobert/* 41291384Srobert * Return the correct hostname for the passed credential. 41391384Srobert */ 41491391Srobertvoid 415114168Smikegetcredhostname(struct ucred *cred, char *buf, size_t size) 41691384Srobert{ 41791384Srobert 41891391Srobert if (jailed(cred)) { 41991391Srobert mtx_lock(&cred->cr_prison->pr_mtx); 420105354Srobert strlcpy(buf, cred->cr_prison->pr_host, size); 42191391Srobert mtx_unlock(&cred->cr_prison->pr_mtx); 422114168Smike } else 423105354Srobert strlcpy(buf, hostname, size); 42491384Srobert} 425113275Smike 426125804Srwatson/* 427125804Srwatson * Return 1 if the passed credential can "see" the passed mountpoint 428125804Srwatson * when performing a getfsstat(); otherwise, 0. 429125804Srwatson */ 430125804Srwatsonint 431125804Srwatsonprison_check_mount(struct ucred *cred, struct mount *mp) 432125804Srwatson{ 433125804Srwatson 434125804Srwatson if (jail_getfsstatroot_only) { 435125804Srwatson if (cred->cr_prison->pr_root->v_mount != mp) 436125804Srwatson return (0); 437125804Srwatson } 438125804Srwatson return (1); 439125804Srwatson} 440125804Srwatson 441113275Smikestatic int 442113275Smikesysctl_jail_list(SYSCTL_HANDLER_ARGS) 443113275Smike{ 444113275Smike struct xprison *xp, *sxp; 445113275Smike struct prison *pr; 446113275Smike int count, error; 447113275Smike 448113275Smike mtx_assert(&Giant, MA_OWNED); 449113275Smikeretry: 450113275Smike mtx_lock(&allprison_mtx); 451113275Smike count = prisoncount; 452113275Smike mtx_unlock(&allprison_mtx); 453113275Smike 454113275Smike if (count == 0) 455113275Smike return (0); 456113275Smike 457113275Smike sxp = xp = malloc(sizeof(*xp) * count, M_TEMP, M_WAITOK | M_ZERO); 458113275Smike mtx_lock(&allprison_mtx); 459113275Smike if (count != prisoncount) { 460113275Smike mtx_unlock(&allprison_mtx); 461113275Smike free(sxp, M_TEMP); 462113275Smike goto retry; 463113275Smike } 464113275Smike 465113275Smike LIST_FOREACH(pr, &allprison, pr_list) { 466113275Smike mtx_lock(&pr->pr_mtx); 467113275Smike xp->pr_version = XPRISON_VERSION; 468113275Smike xp->pr_id = pr->pr_id; 469113275Smike strlcpy(xp->pr_path, pr->pr_path, sizeof(xp->pr_path)); 470113275Smike strlcpy(xp->pr_host, pr->pr_host, sizeof(xp->pr_host)); 471113275Smike xp->pr_ip = pr->pr_ip; 472113275Smike mtx_unlock(&pr->pr_mtx); 473113275Smike xp++; 474113275Smike } 475113275Smike mtx_unlock(&allprison_mtx); 476113275Smike 477113275Smike error = SYSCTL_OUT(req, sxp, sizeof(*sxp) * count); 478113275Smike free(sxp, M_TEMP); 479113275Smike if (error) 480113275Smike return (error); 481113275Smike return (0); 482113275Smike} 483113275Smike 484113275SmikeSYSCTL_OID(_security_jail, OID_AUTO, list, CTLTYPE_STRUCT | CTLFLAG_RD, 485113275Smike NULL, 0, sysctl_jail_list, "S", "List of active jails"); 486