jail.h revision 277985 
1/*-
2 * Copyright (c) 1999 Poul-Henning Kamp.
3 * Copyright (c) 2009 James Gritton.
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 *    notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 *    notice, this list of conditions and the following disclaimer in the
13 *    documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25 * SUCH DAMAGE.
26 *
27 * $FreeBSD: stable/10/sys/sys/jail.h 277985 2015-01-31 17:35:53Z jamie $
28 */
29
30#ifndef _SYS_JAIL_H_
31#define _SYS_JAIL_H_
32
33#ifdef _KERNEL
34struct jail_v0 {
35	u_int32_t	version;
36	char		*path;
37	char		*hostname;
38	u_int32_t	ip_number;
39};
40#endif
41
42struct jail {
43	uint32_t	version;
44	char		*path;
45	char		*hostname;
46	char		*jailname;
47	uint32_t	ip4s;
48	uint32_t	ip6s;
49	struct in_addr	*ip4;
50	struct in6_addr	*ip6;
51};
52#define	JAIL_API_VERSION	2
53
54/*
55 * For all xprison structs, always keep the pr_version an int and
56 * the first variable so userspace can easily distinguish them.
57 */
58#ifndef _KERNEL
59struct xprison_v1 {
60	int		 pr_version;
61	int		 pr_id;
62	char		 pr_path[MAXPATHLEN];
63	char		 pr_host[MAXHOSTNAMELEN];
64	u_int32_t	 pr_ip;
65};
66#endif
67
68struct xprison {
69	int		 pr_version;
70	int		 pr_id;
71	int		 pr_state;
72	cpusetid_t	 pr_cpusetid;
73	char		 pr_path[MAXPATHLEN];
74	char		 pr_host[MAXHOSTNAMELEN];
75	char		 pr_name[MAXHOSTNAMELEN];
76	uint32_t	 pr_ip4s;
77	uint32_t	 pr_ip6s;
78#if 0
79	/*
80	 * sizeof(xprison) will be malloced + size needed for all
81	 * IPv4 and IPv6 addesses. Offsets are based numbers of addresses.
82	 */
83	struct in_addr	 pr_ip4[];
84	struct in6_addr	 pr_ip6[];
85#endif
86};
87#define	XPRISON_VERSION		3
88
89#define	PRISON_STATE_INVALID	0
90#define	PRISON_STATE_ALIVE	1
91#define	PRISON_STATE_DYING	2
92
93/*
94 * Flags for jail_set and jail_get.
95 */
96#define	JAIL_CREATE	0x01	/* Create jail if it doesn't exist */
97#define	JAIL_UPDATE	0x02	/* Update parameters of existing jail */
98#define	JAIL_ATTACH	0x04	/* Attach to jail upon creation */
99#define	JAIL_DYING	0x08	/* Allow getting a dying jail */
100#define	JAIL_SET_MASK	0x0f
101#define	JAIL_GET_MASK	0x08
102
103#define	JAIL_SYS_DISABLE	0
104#define	JAIL_SYS_NEW		1
105#define	JAIL_SYS_INHERIT	2
106
107#ifndef _KERNEL
108
109struct iovec;
110
111int jail(struct jail *);
112int jail_set(struct iovec *, unsigned int, int);
113int jail_get(struct iovec *, unsigned int, int);
114int jail_attach(int);
115int jail_remove(int);
116
117#else /* _KERNEL */
118
119#include <sys/queue.h>
120#include <sys/sysctl.h>
121#include <sys/lock.h>
122#include <sys/mutex.h>
123#include <sys/_task.h>
124
125#define JAIL_MAX	999999
126
127#ifdef MALLOC_DECLARE
128MALLOC_DECLARE(M_PRISON);
129#endif
130#endif /* _KERNEL */
131
132#if defined(_KERNEL) || defined(_WANT_PRISON)
133
134#include <sys/osd.h>
135
136#define	HOSTUUIDLEN	64
137
138struct racct;
139struct prison_racct;
140
141/*
142 * This structure describes a prison.  It is pointed to by all struct
143 * ucreds's of the inmates.  pr_ref keeps track of them and is used to
144 * delete the struture when the last inmate is dead.
145 *
146 * Lock key:
147 *   (a) allprison_lock
148 *   (p) locked by pr_mtx
149 *   (c) set only during creation before the structure is shared, no mutex
150 *       required to read
151 *   (d) set only during destruction of jail, no mutex needed
152 */
153struct prison {
154	TAILQ_ENTRY(prison) pr_list;			/* (a) all prisons */
155	int		 pr_id;				/* (c) prison id */
156	int		 pr_ref;			/* (p) refcount */
157	int		 pr_uref;			/* (p) user (alive) refcount */
158	unsigned	 pr_flags;			/* (p) PR_* flags */
159	LIST_HEAD(, prison) pr_children;		/* (a) list of child jails */
160	LIST_ENTRY(prison) pr_sibling;			/* (a) next in parent's list */
161	struct prison	*pr_parent;			/* (c) containing jail */
162	struct mtx	 pr_mtx;
163	struct task	 pr_task;			/* (d) destroy task */
164	struct osd	 pr_osd;			/* (p) additional data */
165	struct cpuset	*pr_cpuset;			/* (p) cpuset */
166	struct vnet	*pr_vnet;			/* (c) network stack */
167	struct vnode	*pr_root;			/* (c) vnode to rdir */
168	int		 pr_ip4s;			/* (p) number of v4 IPs */
169	int		 pr_ip6s;			/* (p) number of v6 IPs */
170	struct in_addr	*pr_ip4;			/* (p) v4 IPs of jail */
171	struct in6_addr	*pr_ip6;			/* (p) v6 IPs of jail */
172	struct prison_racct *pr_prison_racct;		/* (c) racct jail proxy */
173	void		*pr_sparep[3];
174	int		 pr_childcount;			/* (a) number of child jails */
175	int		 pr_childmax;			/* (p) maximum child jails */
176	unsigned	 pr_allow;			/* (p) PR_ALLOW_* flags */
177	int		 pr_securelevel;		/* (p) securelevel */
178	int		 pr_enforce_statfs;		/* (p) statfs permission */
179	int		 pr_devfs_rsnum;		/* (p) devfs ruleset */
180	int		 pr_spare[4];
181	unsigned long	 pr_hostid;			/* (p) jail hostid */
182	char		 pr_name[MAXHOSTNAMELEN];	/* (p) admin jail name */
183	char		 pr_path[MAXPATHLEN];		/* (c) chroot path */
184	char		 pr_hostname[MAXHOSTNAMELEN];	/* (p) jail hostname */
185	char		 pr_domainname[MAXHOSTNAMELEN];	/* (p) jail domainname */
186	char		 pr_hostuuid[HOSTUUIDLEN];	/* (p) jail hostuuid */
187};
188
189struct prison_racct {
190	LIST_ENTRY(prison_racct) prr_next;
191	char		prr_name[MAXHOSTNAMELEN];
192	u_int		prr_refcount;
193	struct racct	*prr_racct;
194};
195#endif /* _KERNEL || _WANT_PRISON */
196
197#ifdef _KERNEL
198/* Flag bits set via options */
199#define	PR_PERSIST	0x00000001	/* Can exist without processes */
200#define	PR_HOST		0x00000002	/* Virtualize hostname et al */
201#define	PR_IP4_USER	0x00000004	/* Restrict IPv4 addresses */
202#define	PR_IP6_USER	0x00000008	/* Restrict IPv6 addresses */
203#define	PR_VNET		0x00000010	/* Virtual network stack */
204#define	PR_IP4_DISABLE	0x00000020	/* Disable IPv4 */
205#define	PR_IP6_DISABLE	0x00000040	/* Disable IPv6 */
206#define	PR_IP4_SADDRSEL	0x00000080	/* Do IPv4 src addr sel. or use the */
207					/* primary jail address. */
208#define	PR_IP6_SADDRSEL	0x00000100	/* Do IPv6 src addr sel. or use the */
209					/* primary jail address. */
210
211/* Internal flag bits */
212#define	PR_REMOVE	0x01000000	/* In process of being removed */
213#define	PR_IP4		0x02000000	/* IPv4 restricted or disabled */
214					/* by this jail or an ancestor */
215#define	PR_IP6		0x04000000	/* IPv6 restricted or disabled */
216					/* by this jail or an ancestor */
217
218/* Flags for pr_allow */
219#define	PR_ALLOW_SET_HOSTNAME		0x0001
220#define	PR_ALLOW_SYSVIPC		0x0002
221#define	PR_ALLOW_RAW_SOCKETS		0x0004
222#define	PR_ALLOW_CHFLAGS		0x0008
223#define	PR_ALLOW_MOUNT			0x0010
224#define	PR_ALLOW_QUOTAS			0x0020
225#define	PR_ALLOW_SOCKET_AF		0x0040
226#define	PR_ALLOW_MOUNT_DEVFS		0x0080
227#define	PR_ALLOW_MOUNT_NULLFS		0x0100
228#define	PR_ALLOW_MOUNT_ZFS		0x0200
229#define	PR_ALLOW_MOUNT_PROCFS		0x0400
230#define	PR_ALLOW_MOUNT_TMPFS		0x0800
231#define	PR_ALLOW_MOUNT_FDESCFS		0x1000
232#define	PR_ALLOW_ALL			0x1fff
233
234/*
235 * OSD methods
236 */
237#define	PR_METHOD_CREATE	0
238#define	PR_METHOD_GET		1
239#define	PR_METHOD_SET		2
240#define	PR_METHOD_CHECK		3
241#define	PR_METHOD_ATTACH	4
242#define	PR_MAXMETHOD		5
243
244/*
245 * Lock/unlock a prison.
246 * XXX These exist not so much for general convenience, but to be useable in
247 *     the FOREACH_PRISON_DESCENDANT_LOCKED macro which can't handle them in
248 *     non-function form as currently defined.
249 */
250static __inline void
251prison_lock(struct prison *pr)
252{
253
254	mtx_lock(&pr->pr_mtx);
255}
256
257static __inline void
258prison_unlock(struct prison *pr)
259{
260
261	mtx_unlock(&pr->pr_mtx);
262}
263
264/* Traverse a prison's immediate children. */
265#define	FOREACH_PRISON_CHILD(ppr, cpr)					\
266	LIST_FOREACH(cpr, &(ppr)->pr_children, pr_sibling)
267
268/*
269 * Preorder traversal of all of a prison's descendants.
270 * This ugly loop allows the macro to be followed by a single block
271 * as expected in a looping primitive.
272 */
273#define	FOREACH_PRISON_DESCENDANT(ppr, cpr, descend)			\
274	for ((cpr) = (ppr), (descend) = 1;				\
275	    ((cpr) = (((descend) && !LIST_EMPTY(&(cpr)->pr_children))	\
276	      ? LIST_FIRST(&(cpr)->pr_children)				\
277	      : ((cpr) == (ppr)						\
278		 ? NULL							\
279		 : (((descend) = LIST_NEXT(cpr, pr_sibling) != NULL)	\
280		    ? LIST_NEXT(cpr, pr_sibling)			\
281		    : (cpr)->pr_parent))));)				\
282		if (!(descend))						\
283			;						\
284		else
285
286/*
287 * As above, but lock descendants on the way down and unlock on the way up.
288 */
289#define	FOREACH_PRISON_DESCENDANT_LOCKED(ppr, cpr, descend)		\
290	for ((cpr) = (ppr), (descend) = 1;				\
291	    ((cpr) = (((descend) && !LIST_EMPTY(&(cpr)->pr_children))	\
292	      ? LIST_FIRST(&(cpr)->pr_children)				\
293	      : ((cpr) == (ppr)						\
294		 ? NULL							\
295		 : ((prison_unlock(cpr),				\
296		    (descend) = LIST_NEXT(cpr, pr_sibling) != NULL)	\
297		    ? LIST_NEXT(cpr, pr_sibling)			\
298		    : (cpr)->pr_parent))));)				\
299		if ((descend) ? (prison_lock(cpr), 0) : 1)		\
300			;						\
301		else
302
303/*
304 * As above, but also keep track of the level descended to.
305 */
306#define	FOREACH_PRISON_DESCENDANT_LOCKED_LEVEL(ppr, cpr, descend, level)\
307	for ((cpr) = (ppr), (descend) = 1, (level) = 0;			\
308	    ((cpr) = (((descend) && !LIST_EMPTY(&(cpr)->pr_children))	\
309	      ? (level++, LIST_FIRST(&(cpr)->pr_children))		\
310	      : ((cpr) == (ppr)						\
311		 ? NULL							\
312		 : ((prison_unlock(cpr),				\
313		    (descend) = LIST_NEXT(cpr, pr_sibling) != NULL)	\
314		    ? LIST_NEXT(cpr, pr_sibling)			\
315		    : (level--, (cpr)->pr_parent)))));)			\
316		if ((descend) ? (prison_lock(cpr), 0) : 1)		\
317			;						\
318		else
319
320/*
321 * Attributes of the physical system, and the root of the jail tree.
322 */
323extern struct	prison prison0;
324
325TAILQ_HEAD(prisonlist, prison);
326extern struct	prisonlist allprison;
327extern struct	sx allprison_lock;
328
329/*
330 * Sysctls to describe jail parameters.
331 */
332SYSCTL_DECL(_security_jail_param);
333
334#define	SYSCTL_JAIL_PARAM(module, param, type, fmt, descr)		\
335    SYSCTL_PROC(_security_jail_param ## module, OID_AUTO, param,	\
336	(type) | CTLFLAG_MPSAFE, NULL, 0, sysctl_jail_param, fmt, descr)
337#define	SYSCTL_JAIL_PARAM_STRING(module, param, access, len, descr)	\
338    SYSCTL_PROC(_security_jail_param ## module, OID_AUTO, param,	\
339	CTLTYPE_STRING | CTLFLAG_MPSAFE | (access), NULL, len,		\
340	sysctl_jail_param, "A", descr)
341#define	SYSCTL_JAIL_PARAM_STRUCT(module, param, access, len, fmt, descr)\
342    SYSCTL_PROC(_security_jail_param ## module, OID_AUTO, param,	\
343	CTLTYPE_STRUCT | CTLFLAG_MPSAFE | (access), NULL, len,		\
344	sysctl_jail_param, fmt, descr)
345#define	SYSCTL_JAIL_PARAM_NODE(module, descr)				\
346    SYSCTL_NODE(_security_jail_param, OID_AUTO, module, 0, 0, descr)
347#define	SYSCTL_JAIL_PARAM_SUBNODE(parent, module, descr)		\
348    SYSCTL_NODE(_security_jail_param_##parent, OID_AUTO, module, 0, 0, descr)
349#define	SYSCTL_JAIL_PARAM_SYS_NODE(module, access, descr)		\
350    SYSCTL_JAIL_PARAM_NODE(module, descr);				\
351    SYSCTL_JAIL_PARAM(_##module, , CTLTYPE_INT | (access), "E,jailsys",	\
352	descr)
353
354/*
355 * Kernel support functions for jail().
356 */
357struct ucred;
358struct mount;
359struct sockaddr;
360struct statfs;
361int jailed(struct ucred *cred);
362int jailed_without_vnet(struct ucred *);
363void getcredhostname(struct ucred *, char *, size_t);
364void getcreddomainname(struct ucred *, char *, size_t);
365void getcredhostuuid(struct ucred *, char *, size_t);
366void getcredhostid(struct ucred *, unsigned long *);
367int prison_allow(struct ucred *, unsigned);
368int prison_check(struct ucred *cred1, struct ucred *cred2);
369int prison_owns_vnet(struct ucred *);
370int prison_canseemount(struct ucred *cred, struct mount *mp);
371void prison_enforce_statfs(struct ucred *cred, struct mount *mp,
372    struct statfs *sp);
373struct prison *prison_find(int prid);
374struct prison *prison_find_child(struct prison *, int);
375struct prison *prison_find_name(struct prison *, const char *);
376int prison_flag(struct ucred *, unsigned);
377void prison_free(struct prison *pr);
378void prison_free_locked(struct prison *pr);
379void prison_hold(struct prison *pr);
380void prison_hold_locked(struct prison *pr);
381void prison_proc_hold(struct prison *);
382void prison_proc_free(struct prison *);
383int prison_ischild(struct prison *, struct prison *);
384int prison_equal_ip4(struct prison *, struct prison *);
385int prison_get_ip4(struct ucred *cred, struct in_addr *ia);
386int prison_local_ip4(struct ucred *cred, struct in_addr *ia);
387int prison_remote_ip4(struct ucred *cred, struct in_addr *ia);
388int prison_check_ip4(struct ucred *cred, struct in_addr *ia);
389int prison_saddrsel_ip4(struct ucred *, struct in_addr *);
390#ifdef INET6
391int prison_equal_ip6(struct prison *, struct prison *);
392int prison_get_ip6(struct ucred *, struct in6_addr *);
393int prison_local_ip6(struct ucred *, struct in6_addr *, int);
394int prison_remote_ip6(struct ucred *, struct in6_addr *);
395int prison_check_ip6(struct ucred *, struct in6_addr *);
396int prison_saddrsel_ip6(struct ucred *, struct in6_addr *);
397#endif
398int prison_check_af(struct ucred *cred, int af);
399int prison_if(struct ucred *cred, struct sockaddr *sa);
400char *prison_name(struct prison *, struct prison *);
401int prison_priv_check(struct ucred *cred, int priv);
402int sysctl_jail_param(SYSCTL_HANDLER_ARGS);
403void prison_racct_foreach(void (*callback)(struct racct *racct,
404    void *arg2, void *arg3), void *arg2, void *arg3);
405struct prison_racct *prison_racct_find(const char *name);
406void prison_racct_hold(struct prison_racct *prr);
407void prison_racct_free(struct prison_racct *prr);
408
409#endif /* _KERNEL */
410#endif /* !_SYS_JAIL_H_ */
411