jail.h revision 147185 
1/*-
2 * ----------------------------------------------------------------------------
3 * "THE BEER-WARE LICENSE" (Revision 42):
4 * <phk@FreeBSD.org> wrote this file.  As long as you retain this notice you
5 * can do whatever you want with this stuff. If we meet some day, and you think
6 * this stuff is worth it, you can buy me a beer in return.   Poul-Henning Kamp
7 * ----------------------------------------------------------------------------
8 *
9 * $FreeBSD: head/sys/sys/jail.h 147185 2005-06-09 18:49:19Z pjd $
10 *
11 */
12
13#ifndef _SYS_JAIL_H_
14#define _SYS_JAIL_H_
15
16struct jail {
17	u_int32_t	version;
18	char		*path;
19	char		*hostname;
20	u_int32_t	ip_number;
21};
22
23struct xprison {
24	int		 pr_version;
25	int		 pr_id;
26	char		 pr_path[MAXPATHLEN];
27	char 		 pr_host[MAXHOSTNAMELEN];
28	u_int32_t	 pr_ip;
29};
30#define	XPRISON_VERSION	1
31
32#ifndef _KERNEL
33
34int jail(struct jail *);
35int jail_attach(int);
36
37#else /* _KERNEL */
38
39#include <sys/queue.h>
40#include <sys/_lock.h>
41#include <sys/_mutex.h>
42#include <sys/_task.h>
43
44#define JAIL_MAX	999999
45
46#ifdef MALLOC_DECLARE
47MALLOC_DECLARE(M_PRISON);
48#endif
49#endif /* _KERNEL */
50
51/*
52 * This structure describes a prison.  It is pointed to by all struct
53 * ucreds's of the inmates.  pr_ref keeps track of them and is used to
54 * delete the struture when the last inmate is dead.
55 *
56 * Lock key:
57 *   (a) allprison_mtx
58 *   (p) locked by pr_mtx
59 *   (c) set only during creation before the structure is shared, no mutex
60 *       required to read
61 *   (d) set only during destruction of jail, no mutex needed
62 */
63#if defined(_KERNEL) || defined(_WANT_PRISON)
64struct prison {
65	LIST_ENTRY(prison) pr_list;			/* (a) all prisons */
66	int		 pr_id;				/* (c) prison id */
67	int		 pr_ref;			/* (p) refcount */
68	char		 pr_path[MAXPATHLEN];		/* (c) chroot path */
69	struct vnode	*pr_root;			/* (c) vnode to rdir */
70	char 		 pr_host[MAXHOSTNAMELEN];	/* (p) jail hostname */
71	u_int32_t	 pr_ip;				/* (c) ip addr host */
72	void		*pr_linux;			/* (p) linux abi */
73	int		 pr_securelevel;		/* (p) securelevel */
74	struct task	 pr_task;			/* (d) destroy task */
75	struct mtx	 pr_mtx;
76};
77#endif /* _KERNEL || _WANT_PRISON */
78
79#ifdef _KERNEL
80/*
81 * Sysctl-set variables that determine global jail policy
82 *
83 * XXX MIB entries will need to be protected by a mutex.
84 */
85extern int	jail_set_hostname_allowed;
86extern int	jail_socket_unixiproute_only;
87extern int	jail_sysvipc_allowed;
88extern int	jail_getfsstat_jailrootonly;
89extern int	jail_allow_raw_sockets;
90extern int	jail_chflags_allowed;
91
92LIST_HEAD(prisonlist, prison);
93extern struct	prisonlist allprison;
94
95/*
96 * Kernel support functions for jail().
97 */
98struct ucred;
99struct mount;
100struct sockaddr;
101struct statfs;
102int jailed(struct ucred *cred);
103void getcredhostname(struct ucred *cred, char *, size_t);
104int prison_check(struct ucred *cred1, struct ucred *cred2);
105int prison_canseemount(struct ucred *cred, struct mount *mp);
106void prison_enforce_statfs(struct ucred *cred, struct mount *mp,
107    struct statfs *sp);
108void prison_free(struct prison *pr);
109u_int32_t prison_getip(struct ucred *cred);
110void prison_hold(struct prison *pr);
111int prison_if(struct ucred *cred, struct sockaddr *sa);
112int prison_ip(struct ucred *cred, int flag, u_int32_t *ip);
113void prison_remote_ip(struct ucred *cred, int flags, u_int32_t *ip);
114
115#endif /* _KERNEL */
116#endif /* !_SYS_JAIL_H_ */
117