config.c revision 223189 
1/*-
2 * Copyright (c) 2010 James Gritton
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in the
12 *    documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24 * SUCH DAMAGE.
25 */
26
27#include <sys/cdefs.h>
28__FBSDID("$FreeBSD: projects/jailconf/usr.sbin/jail/config.c 223189 2011-06-17 16:18:44Z jamie $");
29
30#include <sys/types.h>
31#include <sys/errno.h>
32#include <sys/socket.h>
33#include <sys/sysctl.h>
34
35#include <arpa/inet.h>
36#include <netinet/in.h>
37
38#include <err.h>
39#include <netdb.h>
40#include <stdio.h>
41#include <stdlib.h>
42#include <string.h>
43
44#include "jailp.h"
45
46struct ipspec {
47	const char	*name;
48	unsigned	flags;
49};
50
51extern FILE *yyin;
52extern int yynerrs;
53
54struct cfjails cfjails = TAILQ_HEAD_INITIALIZER(cfjails);
55
56static void free_param(struct cfparams *pp, struct cfparam *p);
57static void free_param_strings(struct cfparam *p);
58
59static const struct ipspec intparams[] = {
60    [IP_ALLOW_DYING] =		{"allow.dying",		PF_INTERNAL | PF_BOOL},
61    [IP_COMMAND] =		{"command",		PF_INTERNAL},
62    [IP_DEPEND] =		{"depend",		PF_INTERNAL},
63    [IP_EXEC_CLEAN] =		{"exec.clean",		PF_INTERNAL | PF_BOOL},
64    [IP_EXEC_CONSOLELOG] =	{"exec.consolelog",	PF_INTERNAL},
65    [IP_EXEC_FIB] =		{"exec.fib",		PF_INTERNAL | PF_INT},
66    [IP_EXEC_JAIL_USER] =	{"exec.jail_user",	PF_INTERNAL},
67    [IP_EXEC_POSTSTART] =	{"exec.poststart",	PF_INTERNAL},
68    [IP_EXEC_POSTSTOP] =	{"exec.poststop",	PF_INTERNAL},
69    [IP_EXEC_PRESTART] =	{"exec.prestart",	PF_INTERNAL},
70    [IP_EXEC_PRESTOP] =		{"exec.prestop",	PF_INTERNAL},
71    [IP_EXEC_START] =		{"exec.start",		PF_INTERNAL},
72    [IP_EXEC_STOP] =		{"exec.stop",		PF_INTERNAL},
73    [IP_EXEC_SYSTEM_JAIL_USER]=	{"exec.system_jail_user",
74							PF_INTERNAL | PF_BOOL},
75    [IP_EXEC_SYSTEM_USER] =	{"exec.system_user",	PF_INTERNAL},
76    [IP_EXEC_TIMEOUT] =		{"exec.timeout",	PF_INTERNAL | PF_INT},
77    [IP_INTERFACE] =		{"interface",		PF_INTERNAL},
78    [IP_IP_HOSTNAME] =		{"ip_hostname",		PF_INTERNAL | PF_BOOL},
79    [IP_MOUNT] =		{"mount",		PF_INTERNAL},
80    [IP_MOUNT_DEVFS] =		{"mount.devfs",		PF_INTERNAL | PF_BOOL},
81    [IP_MOUNT_DEVFS_RULESET]=	{"mount.devfs.ruleset",	PF_INTERNAL},
82    [IP_MOUNT_FSTAB] =		{"mount.fstab",		PF_INTERNAL},
83    [IP_STOP_TIMEOUT] =		{"stop.timeout",	PF_INTERNAL | PF_INT},
84    [IP_VNET_INTERFACE] =	{"vnet.interface",	PF_INTERNAL},
85    [IP__IP4_IFADDR] =		{"ip4.addr",		PF_INTERNAL | PF_CONV},
86#ifdef INET6
87    [IP__IP6_IFADDR] =		{"ip6.addr",		PF_INTERNAL | PF_CONV},
88#endif
89    [IP__MOUNT_FROM_FSTAB] =	{"mount.fstab",		PF_INTERNAL | PF_CONV},
90    [IP__OP] =			{NULL,			PF_CONV},
91    [KP_ALLOW_CHFLAGS] =	{"allow.chflags",	0},
92    [KP_ALLOW_MOUNT] =		{"allow.mount",		0},
93    [KP_ALLOW_RAW_SOCKETS] =	{"allow.raw_sockets",	0},
94    [KP_ALLOW_SET_HOSTNAME]=	{"allow.set_hostname",	0},
95    [KP_ALLOW_SOCKET_AF] =	{"allow.socket_af",	0},
96    [KP_ALLOW_SYSVIPC] =	{"allow.sysvipc",	0},
97    [KP_ENFORCE_STATFS] =	{"enforce_statfs",	0},
98    [KP_HOST_HOSTNAME] =	{"host.hostname",	0},
99    [KP_IP4_ADDR] =		{"ip4.addr",		0},
100#ifdef INET6
101    [KP_IP6_ADDR] =		{"ip6.addr",		0},
102#endif
103    [KP_JID] =			{"jid",			0},
104    [KP_NAME] =			{"name",		0},
105    [KP_PATH] =			{"path",		0},
106    [KP_PERSIST] =		{"persist",		0},
107    [KP_SECURELEVEL] =		{"securelevel",		0},
108    [KP_VNET] =			{"vnet",		0},
109};
110
111/*
112 * Parse the jail configuration file.
113 */
114void
115load_config(void)
116{
117	struct cfjails wild;
118	struct cfparams opp;
119	struct cfjail *j, *tj, *wj;
120	struct cfparam *p, *vp, *tp;
121	struct cfstring *s, *vs, *ns;
122	struct cfvar *v;
123	char *ep;
124	size_t varoff;
125	int did_self, jseq, pgen;
126
127	if (!strcmp(cfname, "-")) {
128		cfname = "STDIN";
129		yyin = stdin;
130	} else {
131		yyin = fopen(cfname, "r");
132		if (!yyin)
133			err(1, "%s", cfname);
134	}
135	if (yyparse() || yynerrs)
136		exit(1);
137
138	/* Separate the wildcard jails out from the actual jails. */
139	jseq = 0;
140	TAILQ_INIT(&wild);
141	TAILQ_FOREACH_SAFE(j, &cfjails, tq, tj) {
142		j->seq = ++jseq;
143		if (wild_jail_name(j->name))
144			requeue(j, &wild);
145	}
146
147	TAILQ_FOREACH(j, &cfjails, tq) {
148		/* Set aside the jail's parameters. */
149		TAILQ_INIT(&opp);
150		TAILQ_CONCAT(&opp, &j->params, tq);
151		/*
152		 * The jail name implies its "name" or "jid" parameter,
153		 * though they may also be explicitly set later on.
154		 */
155		add_param(j, NULL,
156		    strtol(j->name, &ep, 10) && !*ep ? KP_JID : KP_NAME,
157		    j->name);
158		/*
159		 * Collect parameters for the jail, global parameters/variables,
160		 * and any matching wildcard jails.
161		 */
162		did_self = 0;
163		TAILQ_FOREACH(wj, &wild, tq) {
164			if (j->seq < wj->seq && !did_self) {
165				TAILQ_FOREACH(p, &opp, tq)
166					add_param(j, p, 0, NULL);
167				did_self = 1;
168			}
169			if (wild_jail_match(j->name, wj->name))
170				TAILQ_FOREACH(p, &wj->params, tq)
171					add_param(j, p, 0, NULL);
172		}
173		if (!did_self)
174			TAILQ_FOREACH(p, &opp, tq)
175				add_param(j, p, 0, NULL);
176
177		/* Resolve any variable substitutions. */
178		pgen = 0;
179		TAILQ_FOREACH(p, &j->params, tq) {
180		    p->gen = ++pgen;
181		find_vars:
182		    TAILQ_FOREACH(s, &p->val, tq) {
183			varoff = 0;
184			while ((v = STAILQ_FIRST(&s->vars))) {
185				TAILQ_FOREACH(vp, &j->params, tq)
186					if (!strcmp(vp->name, v->name))
187						break;
188				if (!vp) {
189					jail_warnx(j,
190					    "%s: variable \"%s\" not found",
191					    p->name, v->name);
192				bad_var:
193					j->flags |= JF_FAILED;
194					TAILQ_FOREACH(vp, &j->params, tq)
195						if (vp->gen == pgen)
196							vp->flags |= PF_BAD;
197					goto free_var;
198				}
199				if (vp->flags & PF_BAD)
200					goto bad_var;
201				if (vp->gen == pgen) {
202					jail_warnx(j, "%s: variable loop",
203					    v->name);
204					goto bad_var;
205				}
206				TAILQ_FOREACH(vs, &vp->val, tq)
207					if (!STAILQ_EMPTY(&vs->vars)) {
208						vp->gen = pgen;
209						TAILQ_REMOVE(&j->params, vp,
210						    tq);
211						TAILQ_INSERT_BEFORE(p, vp, tq);
212						p = vp;
213						goto find_vars;
214					}
215				vs = TAILQ_FIRST(&vp->val);
216				if (TAILQ_NEXT(vs, tq) != NULL &&
217				    (s->s[0] != '\0' ||
218				     STAILQ_NEXT(v, tq))) {
219					jail_warnx(j, "%s: array cannot be "
220					    "substituted inline",
221					    p->name);
222					goto bad_var;
223				}
224				s->s = erealloc(s->s, s->len + vs->len + 1);
225				memmove(s->s + v->pos + varoff + vs->len,
226				    s->s + v->pos + varoff,
227				    s->len - (v->pos + varoff) + 1);
228				memcpy(s->s + v->pos + varoff, vs->s, vs->len);
229				varoff += vs->len;
230				s->len += vs->len;
231				while ((vs = TAILQ_NEXT(vs, tq))) {
232					ns = emalloc(sizeof(struct cfstring));
233					ns->s = estrdup(vs->s);
234					ns->len = vs->len;
235					STAILQ_INIT(&ns->vars);
236					TAILQ_INSERT_AFTER(&p->val, s, ns, tq);
237					s = ns;
238				}
239			free_var:
240				free(v->name);
241				STAILQ_REMOVE_HEAD(&s->vars, tq);
242				free(v);
243			}
244		    }
245		}
246
247		/* Free the jail's original parameter list and any variables. */
248		while ((p = TAILQ_FIRST(&opp)))
249			free_param(&opp, p);
250		TAILQ_FOREACH_SAFE(p, &j->params, tq, tp)
251			if (p->flags & PF_VAR)
252				free_param(&j->params, p);
253	}
254	while ((wj = TAILQ_FIRST(&wild))) {
255		free(wj->name);
256		while ((p = TAILQ_FIRST(&wj->params)))
257			free_param(&wj->params, p);
258		TAILQ_REMOVE(&wild, wj, tq);
259	}
260}
261
262/*
263 * Create a new jail record.
264 */
265struct cfjail *
266add_jail(void)
267{
268	struct cfjail *j;
269
270	j = emalloc(sizeof(struct cfjail));
271	memset(j, 0, sizeof(struct cfjail));
272	TAILQ_INIT(&j->params);
273	STAILQ_INIT(&j->dep[DEP_FROM]);
274	STAILQ_INIT(&j->dep[DEP_TO]);
275	j->queue = &cfjails;
276	TAILQ_INSERT_TAIL(&cfjails, j, tq);
277	return j;
278}
279
280/*
281 * Add a parameter to a jail.
282 */
283void
284add_param(struct cfjail *j, const struct cfparam *p, enum intparam ipnum,
285    const char *value)
286{
287	struct cfstrings nss;
288	struct cfparam *dp, *np;
289	struct cfstring *s, *ns;
290	struct cfvar *v, *nv;
291	struct ipspec *ips;
292	const char *name;
293	char *cs, *tname;
294	unsigned flags;
295
296	if (j == NULL) {
297		/* Create a single anonymous jail if one doesn't yet exist. */
298		j = TAILQ_LAST(&cfjails, cfjails);
299		if (j == NULL)
300			j = add_jail();
301	}
302	TAILQ_INIT(&nss);
303	if (p != NULL) {
304		name = p->name;
305		flags = p->flags;
306		/*
307		 * Make a copy of the parameter's string list,
308		 * which may be freed if it's overridden later.
309		 */
310		TAILQ_FOREACH(s, &p->val, tq) {
311			ns = emalloc(sizeof(struct cfstring));
312			ns->s = estrdup(s->s);
313			ns->len = s->len;
314			STAILQ_INIT(&ns->vars);
315			STAILQ_FOREACH(v, &s->vars, tq) {
316				nv = emalloc(sizeof(struct cfvar));
317				nv->name = strdup(v->name);
318				nv->pos = v->pos;
319				STAILQ_INSERT_TAIL(&ns->vars, nv, tq);
320			}
321			TAILQ_INSERT_TAIL(&nss, ns, tq);
322		}
323	} else {
324		flags = PF_APPEND;
325		if (ipnum != 0) {
326			name = intparams[ipnum].name;
327			flags |= intparams[ipnum].flags;
328		} else if ((cs = strchr(value, '='))) {
329			tname = alloca(cs - value + 1);
330			strlcpy(tname, value, cs - value + 1);
331			name = tname;
332			value = cs + 1;
333		} else {
334			name = value;
335			value = NULL;
336		}
337		if (value != NULL) {
338			ns = emalloc(sizeof(struct cfstring));
339			ns->s = estrdup(value);
340			ns->len = strlen(value);
341			STAILQ_INIT(&ns->vars);
342			TAILQ_INSERT_TAIL(&nss, ns, tq);
343		}
344	}
345
346	/* See if this parameter has already been added. */
347	if (ipnum != 0)
348		dp = j->intparams[ipnum];
349	else
350		TAILQ_FOREACH(dp, &j->params, tq)
351			if (!(dp->flags & PF_CONV) && equalopts(dp->name, name))
352				break;
353	if (dp != NULL) {
354		/* Found it - append or replace. */
355		if (strcmp(dp->name, name)) {
356			free(dp->name);
357			dp->name = estrdup(name);
358		}
359		if (!(flags & PF_APPEND) || TAILQ_EMPTY(&nss))
360			free_param_strings(dp);
361		TAILQ_CONCAT(&dp->val, &nss, tq);
362		dp->flags |= flags;
363	} else {
364		/* Not found - add it. */
365		np = emalloc(sizeof(struct cfparam));
366		np->name = estrdup(name);
367		TAILQ_INIT(&np->val);
368		TAILQ_CONCAT(&np->val, &nss, tq);
369		np->flags = flags;
370		np->gen = 0;
371		TAILQ_INSERT_TAIL(&j->params, np, tq);
372		if (ipnum != 0)
373			j->intparams[ipnum] = np;
374		else
375			for (ipnum = 1; ipnum < IP_NPARAM; ipnum++)
376				if (!(intparams[ipnum].flags & PF_CONV) &&
377				    equalopts(name, intparams[ipnum].name)) {
378					j->intparams[ipnum] = np;
379					np->flags |= intparams[ipnum].flags;
380					break;
381				}
382	}
383}
384
385/*
386 * Return if a boolean parameter exists and is true.
387 */
388int
389bool_param(const struct cfparam *p)
390{
391	const char *cs;
392
393	if (p == NULL)
394		return 0;
395	cs = strrchr(p->name, '.');
396	return !strncmp(cs ? cs + 1 : p->name, "no", 2) ^
397	    (TAILQ_EMPTY(&p->val) ||
398	     !strcasecmp(TAILQ_LAST(&p->val, cfstrings)->s, "true") ||
399	     (strtol(TAILQ_LAST(&p->val, cfstrings)->s, NULL, 10)));
400}
401
402/*
403 * Set an integer if a parameter if it exists.
404 */
405int
406int_param(const struct cfparam *p, int *ip)
407{
408	if (p == NULL || TAILQ_EMPTY(&p->val))
409		return 0;
410	*ip = strtol(TAILQ_LAST(&p->val, cfstrings)->s, NULL, 10);
411	return 1;
412}
413
414/*
415 * Return the string value of a scalar parameter if it exists.
416 */
417const char *
418string_param(const struct cfparam *p)
419{
420	return (p && !TAILQ_EMPTY(&p->val)
421	    ? TAILQ_LAST(&p->val, cfstrings)->s : NULL);
422}
423
424/*
425 * Check syntax and values of internal parameters.  Set some internal
426 * parameters based on the values of others.
427 */
428int
429check_intparams(struct cfjail *j)
430{
431	struct in_addr addr4;
432	struct addrinfo hints;
433	struct addrinfo *ai0, *ai;
434	struct cfparam *p;
435	struct cfstring *s, *ns;
436	FILE *f;
437	const char *hostname, *val;
438	char *cs, *ep, *ln;
439	size_t size, lnlen;
440	int error, gicode, ip4ok, defif, prefix;
441	int mib[4];
442	char avalue4[INET_ADDRSTRLEN];
443#ifdef INET6
444	struct in6_addr addr6;
445	int ip6ok, isip6;
446	char avalue6[INET6_ADDRSTRLEN];
447#endif
448
449	error = 0;
450	/* Check format of boolan and integer values. */
451	TAILQ_FOREACH(p, &j->params, tq) {
452		if (!TAILQ_EMPTY(&p->val) && (p->flags & (PF_BOOL | PF_INT))) {
453			val = TAILQ_LAST(&p->val, cfstrings)->s;
454			if (p->flags & PF_BOOL) {
455				if (strcasecmp(val, "false") &&
456				    strcasecmp(val, "true") &&
457				    ((void)strtol(val, &ep, 10), *ep)) {
458					jail_warnx(j,
459					    "%s: unknown boolean value \"%s\"",
460					    p->name, val);
461					error = -1;
462				}
463			} else {
464				(void)strtol(val, &ep, 10);
465				if (ep == val || *ep) {
466					jail_warnx(j,
467					    "%s: non-integer value \"%s\"",
468					    p->name, val);
469					error = -1;
470				}
471			}
472		}
473	}
474
475	/*
476	 * The ip_hostname parameter looks up the hostname, and adds parameters
477	 * for any IP addresses it finds.
478	 */
479	if (((j->flags & JF_OP_MASK) != JF_STOP ||
480	    j->intparams[IP_INTERFACE] != NULL) &&
481	    bool_param(j->intparams[IP_IP_HOSTNAME]) &&
482	    (hostname = string_param(j->intparams[KP_HOST_HOSTNAME]))) {
483		j->intparams[IP_IP_HOSTNAME] = NULL;
484		/*
485		 * Silently ignore unsupported address families from
486		 * DNS lookups.
487		 */
488		size = 4;
489		ip4ok = sysctlnametomib("security.jail.param.ip4", mib, &size)
490		    == 0;
491#ifdef INET6
492		size = 4;
493		ip6ok = sysctlnametomib("security.jail.param.ip6", mib, &size)
494		    == 0;
495#endif
496		if (ip4ok
497#ifdef INET6
498		    || ip6ok
499#endif
500			    ) {
501			/* Look up the hostname (or get the address) */
502			memset(&hints, 0, sizeof(hints));
503			hints.ai_socktype = SOCK_STREAM;
504			hints.ai_family =
505#ifdef INET6
506			    ip6ok ? (ip4ok ? PF_UNSPEC : PF_INET6) :
507#endif
508			    PF_INET;
509			gicode = getaddrinfo(hostname, NULL, &hints, &ai0);
510			if (gicode != 0) {
511				jail_warnx(j, "host.hostname %s: %s", hostname,
512				    gai_strerror(gicode));
513				error = -1;
514			} else {
515				/*
516				 * Convert the addresses to ASCII so jailparam
517				 * can convert them back.  Errors are not
518				 * expected here.
519				 */
520				for (ai = ai0; ai; ai = ai->ai_next)
521					switch (ai->ai_family) {
522					case AF_INET:
523						memcpy(&addr4,
524						    &((struct sockaddr_in *)
525						    (void *)ai->ai_addr)->
526						    sin_addr, sizeof(addr4));
527						if (inet_ntop(AF_INET,
528						    &addr4, avalue4,
529						    INET_ADDRSTRLEN) == NULL)
530							err(1, "inet_ntop");
531						add_param(j, NULL, KP_IP4_ADDR,
532						    avalue4);
533						break;
534#ifdef INET6
535					case AF_INET6:
536						memcpy(&addr6,
537						    &((struct sockaddr_in6 *)
538						    (void *)ai->ai_addr)->
539						    sin6_addr, sizeof(addr6));
540						if (inet_ntop(AF_INET6,
541						    &addr6, avalue6,
542						    INET6_ADDRSTRLEN) == NULL)
543							err(1, "inet_ntop");
544						add_param(j, NULL, KP_IP6_ADDR,
545						    avalue6);
546						break;
547#endif
548					}
549				freeaddrinfo(ai0);
550			}
551		}
552	}
553
554	/*
555	 * IP addresses may include an interface to set that address on,
556	 * and a netmask/suffix for that address.
557	 */
558	defif = string_param(j->intparams[IP_INTERFACE]) != NULL;
559#ifdef INET6
560	for (isip6 = 0; isip6 <= 1; isip6++)
561#else
562#define isip6 0
563	do
564#endif
565	{
566		if (j->intparams[KP_IP4_ADDR + isip6] == NULL)
567			continue;
568		TAILQ_FOREACH(s, &j->intparams[KP_IP4_ADDR + isip6]->val, tq) {
569			cs = strchr(s->s, '|');
570			if (cs || defif)
571				add_param(j, NULL, IP__IP4_IFADDR + isip6,
572				    s->s);
573			if (cs) {
574				strcpy(s->s, cs + 1);
575				s->len -= cs + 1 - s->s;
576			}
577			if ((cs = strchr(s->s, '/'))) {
578				prefix = strtol(cs + 1, &ep, 10);
579				if (
580#ifdef INET6
581				    !isip6 &&
582#endif
583				    *ep == '.'
584				    ? inet_pton(AF_INET, cs + 1, &addr4) != 1
585				    : *ep || prefix < 0 || prefix > (
586#ifdef INET6
587				      isip6 ? 128 :
588#endif
589				      32)) {
590					jail_warnx(j,
591#ifdef INET6
592					    isip6
593					    ? "ip6.addr: bad prefixlen \"%s\"" :
594#endif
595					    "ip4.addr: bad netmask \"%s\"",
596					    cs);
597					error = -1;
598				}
599				*cs = '\0';
600				s->len = cs - s->s + 1;
601			}
602		}
603	}
604#ifndef INET6
605	while (0);
606#endif
607
608	/*
609	 * Read mount.fstab file(s), and treat each line as its own mount
610	 * parameter.
611	 */
612	if (j->intparams[IP_MOUNT_FSTAB] != NULL) {
613		TAILQ_FOREACH(s, &j->intparams[IP_MOUNT_FSTAB]->val, tq) {
614			if (s->len == 0)
615				continue;
616			f = fopen(s->s, "r");
617			if (f == NULL) {
618				jail_warnx(j, "mount.fstab: %s: %s",
619				    s->s, strerror(errno));
620				error = -1;
621				continue;
622			}
623			while ((ln = fgetln(f, &lnlen))) {
624				if ((cs = memchr(ln, '#', lnlen - 1)))
625					lnlen = cs - ln + 1;
626				if (ln[lnlen - 1] == '\n' ||
627				    ln[lnlen - 1] == '#')
628					ln[lnlen - 1] = '\0';
629				else {
630					cs = alloca(lnlen + 1);
631					strlcpy(cs, ln, lnlen + 1);
632					ln = cs;
633				}
634				add_param(j, NULL, IP__MOUNT_FROM_FSTAB, ln);
635			}
636			fclose(f);
637		}
638	}
639	if (error)
640		failed(j);
641	return error;
642}
643
644/*
645 * Import parameters into libjail's binary jailparam format.
646 */
647int
648import_params(struct cfjail *j)
649{
650	struct cfparam *p;
651	struct cfstring *s, *ts;
652	struct jailparam *jp;
653	char *value, *cs;
654	size_t vallen;
655	int error;
656
657	error = 0;
658	j->njp = 0;
659	TAILQ_FOREACH(p, &j->params, tq)
660		if (!(p->flags & PF_INTERNAL))
661			j->njp++;
662	j->jp = jp = emalloc(j->njp * sizeof(struct jailparam));
663	TAILQ_FOREACH(p, &j->params, tq) {
664		if (p->flags & PF_INTERNAL)
665			continue;
666		if (jailparam_init(jp, p->name) < 0) {
667			error = -1;
668			jail_warnx(j, "%s", jail_errmsg);
669			continue;
670		}
671		if (TAILQ_EMPTY(&p->val))
672			value = NULL;
673		else if (!jp->jp_elemlen ||
674			 !TAILQ_NEXT(TAILQ_FIRST(&p->val), tq)) {
675			/*
676			 * Scalar parameters silently discard multiple (array)
677			 * values, keeping only the last value added.  This
678			 * lets values added from the command line append to
679			 * arrays wthout pre-checking the type.
680			 */
681			value = TAILQ_LAST(&p->val, cfstrings)->s;
682		} else {
683			/*
684			 * Convert arrays into comma-separated strings, which
685			 * jailparam_import will then convert back into arrays.
686			 */
687			vallen = 0;
688			TAILQ_FOREACH(s, &p->val, tq)
689				vallen += s->len + 1;
690			value = alloca(vallen);
691			cs = value;
692			TAILQ_FOREACH_SAFE(s, &p->val, tq, ts) {
693				strcpy(cs, s->s);
694				if (ts != NULL) {
695					cs += s->len + 1;
696					cs[-1] = ',';
697				}
698			}
699		}
700		if (jailparam_import(jp, value) < 0) {
701			error = -1;
702			jail_warnx(j, "%s", jail_errmsg);
703		}
704		jp++;
705	}
706	if (error) {
707		jailparam_free(j->jp, j->njp);
708		free(j->jp);
709		j->jp = NULL;
710		failed(j);
711	}
712	return error;
713}
714
715/*
716 * Check if options are equal (with or without the "no" prefix).
717 */
718int
719equalopts(const char *opt1, const char *opt2)
720{
721	char *p;
722
723	/* "opt" vs. "opt" or "noopt" vs. "noopt" */
724	if (strcmp(opt1, opt2) == 0)
725		return (1);
726	/* "noopt" vs. "opt" */
727	if (strncmp(opt1, "no", 2) == 0 && strcmp(opt1 + 2, opt2) == 0)
728		return (1);
729	/* "opt" vs. "noopt" */
730	if (strncmp(opt2, "no", 2) == 0 && strcmp(opt1, opt2 + 2) == 0)
731		return (1);
732	while ((p = strchr(opt1, '.')) != NULL &&
733	    !strncmp(opt1, opt2, ++p - opt1)) {
734		opt2 += p - opt1;
735		opt1 = p;
736		/* "foo.noopt" vs. "foo.opt" */
737		if (strncmp(opt1, "no", 2) == 0 && strcmp(opt1 + 2, opt2) == 0)
738			return (1);
739		/* "foo.opt" vs. "foo.noopt" */
740		if (strncmp(opt2, "no", 2) == 0 && strcmp(opt1, opt2 + 2) == 0)
741			return (1);
742	}
743	return (0);
744}
745
746/*
747 * See if a jail name matches a wildcard.
748 */
749int
750wild_jail_match(const char *jname, const char *wname)
751{
752	const char *jc, *jd, *wc, *wd;
753
754	/*
755	 * A non-final "*" component in the wild name matches a single jail
756	 * component, and a final "*" matches one or more jail components.
757	 */
758	for (jc = jname, wc = wname;
759	     (jd = strchr(jc, '.')) && (wd = strchr(wc, '.'));
760	     jc = jd + 1, wc = wd + 1)
761		if (strncmp(jc, wc, jd - jc + 1) && strncmp(wc, "*.", 2))
762			return 0;
763	return (!strcmp(jc, wc) || !strcmp(wc, "*"));
764}
765
766/*
767 * Return if a jail name is a wildcard.
768 */
769int
770wild_jail_name(const char *wname)
771{
772	const char *wc;
773
774	for (wc = strchr(wname, '*'); wc; wc = strchr(wc + 1, '*'))
775		if ((wc == wname || wc[-1] == '.') &&
776		    (wc[1] == '\0' || wc[1] == '.'))
777			return 1;
778	return 0;
779}
780
781/*
782 * Free a parameter record and all its strings and variables.
783 */
784static void
785free_param(struct cfparams *pp, struct cfparam *p)
786{
787	free(p->name);
788	free_param_strings(p);
789	TAILQ_REMOVE(pp, p, tq);
790	free(p);
791}
792
793static void
794free_param_strings(struct cfparam *p)
795{
796	struct cfstring *s;
797	struct cfvar *v;
798
799	while ((s = TAILQ_FIRST(&p->val))) {
800		free(s->s);
801		while ((v = STAILQ_FIRST(&s->vars))) {
802			free(v->name);
803			STAILQ_REMOVE_HEAD(&s->vars, tq);
804			free(v);
805		}
806		TAILQ_REMOVE(&p->val, s, tq);
807		free(s);
808	}
809}
810