kern_jail.c revision 126004
146197Sphk/* 246197Sphk * ---------------------------------------------------------------------------- 346197Sphk * "THE BEER-WARE LICENSE" (Revision 42): 446197Sphk * <phk@FreeBSD.ORG> wrote this file. As long as you retain this notice you 546197Sphk * can do whatever you want with this stuff. If we meet some day, and you think 646197Sphk * this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp 746197Sphk * ---------------------------------------------------------------------------- 846197Sphk */ 946155Sphk 10116182Sobrien#include <sys/cdefs.h> 11116182Sobrien__FBSDID("$FreeBSD: head/sys/kern/kern_jail.c 126004 2004-02-19 14:29:14Z pjd $"); 12116182Sobrien 1346155Sphk#include <sys/param.h> 1446155Sphk#include <sys/types.h> 1546155Sphk#include <sys/kernel.h> 1646155Sphk#include <sys/systm.h> 1746155Sphk#include <sys/errno.h> 1846155Sphk#include <sys/sysproto.h> 1946155Sphk#include <sys/malloc.h> 2046155Sphk#include <sys/proc.h> 21124882Srwatson#include <sys/taskqueue.h> 2246155Sphk#include <sys/jail.h> 2387275Srwatson#include <sys/lock.h> 2487275Srwatson#include <sys/mutex.h> 25113275Smike#include <sys/namei.h> 26113275Smike#include <sys/queue.h> 2746155Sphk#include <sys/socket.h> 28113275Smike#include <sys/syscallsubr.h> 2957163Srwatson#include <sys/sysctl.h> 30113275Smike#include <sys/vnode.h> 3146155Sphk#include <net/if.h> 3246155Sphk#include <netinet/in.h> 3346155Sphk 3446155SphkMALLOC_DEFINE(M_PRISON, "prison", "Prison structures"); 3546155Sphk 3689414SarrSYSCTL_DECL(_security); 3789414SarrSYSCTL_NODE(_security, OID_AUTO, jail, CTLFLAG_RW, 0, 3857163Srwatson "Jail rules"); 3957163Srwatson 4084828Sjhbmp_fixme("these variables need a lock") 4184828Sjhb 4257163Srwatsonint jail_set_hostname_allowed = 1; 4389414SarrSYSCTL_INT(_security_jail, OID_AUTO, set_hostname_allowed, CTLFLAG_RW, 4457163Srwatson &jail_set_hostname_allowed, 0, 4557163Srwatson "Processes in jail can set their hostnames"); 4657163Srwatson 4761235Srwatsonint jail_socket_unixiproute_only = 1; 4889414SarrSYSCTL_INT(_security_jail, OID_AUTO, socket_unixiproute_only, CTLFLAG_RW, 4961235Srwatson &jail_socket_unixiproute_only, 0, 5061235Srwatson "Processes in jail are limited to creating UNIX/IPv4/route sockets only"); 5161235Srwatson 5268024Srwatsonint jail_sysvipc_allowed = 0; 5389414SarrSYSCTL_INT(_security_jail, OID_AUTO, sysvipc_allowed, CTLFLAG_RW, 5468024Srwatson &jail_sysvipc_allowed, 0, 5568024Srwatson "Processes in jail can use System V IPC primitives"); 5668024Srwatson 57125804Srwatsonint jail_getfsstatroot_only = 1; 58125804SrwatsonSYSCTL_INT(_security_jail, OID_AUTO, getfsstate_getfsstatroot_only, CTLFLAG_RW, 59125804Srwatson &jail_getfsstatroot_only, 0, 60125804Srwatson "Processes see only their root file system in getfsstat()"); 61125804Srwatson 62125806Srwatsonint jail_list_allowed = 0; 63125806SrwatsonSYSCTL_INT(_security_jail, OID_AUTO, list_allowed, CTLFLAG_RW, 64125806Srwatson &jail_list_allowed, 0, 65125806Srwatson "Processes in jail can access system jail list"); 66125806Srwatson 67113275Smike/* allprison, lastprid, and prisoncount are protected by allprison_mtx. */ 68113275Smikestruct prisonlist allprison; 69113275Smikestruct mtx allprison_mtx; 70113275Smikeint lastprid = 0; 71113275Smikeint prisoncount = 0; 72113275Smike 73113275Smikestatic void init_prison(void *); 74124882Srwatsonstatic void prison_complete(void *context, int pending); 75113275Smikestatic struct prison *prison_find(int); 76113275Smikestatic int sysctl_jail_list(SYSCTL_HANDLER_ARGS); 77113275Smike 78113275Smikestatic void 79113275Smikeinit_prison(void *data __unused) 80113275Smike{ 81113275Smike 82113275Smike mtx_init(&allprison_mtx, "allprison", NULL, MTX_DEF); 83113275Smike LIST_INIT(&allprison); 84113275Smike} 85113275Smike 86113275SmikeSYSINIT(prison, SI_SUB_INTRINSIC, SI_ORDER_ANY, init_prison, NULL); 87113275Smike 8882710Sdillon/* 8982710Sdillon * MPSAFE 90114168Smike * 91114168Smike * struct jail_args { 92114168Smike * struct jail *jail; 93114168Smike * }; 9482710Sdillon */ 9546155Sphkint 96114168Smikejail(struct thread *td, struct jail_args *uap) 9746155Sphk{ 98113275Smike struct nameidata nd; 99113275Smike struct prison *pr, *tpr; 10046155Sphk struct jail j; 101113275Smike struct jail_attach_args jaa; 102113275Smike int error, tryprid; 10346155Sphk 104114168Smike error = copyin(uap->jail, &j, sizeof(j)); 10546155Sphk if (error) 10684828Sjhb return (error); 10784828Sjhb if (j.version != 0) 10884828Sjhb return (EINVAL); 10984828Sjhb 110114168Smike MALLOC(pr, struct prison *, sizeof(*pr), M_PRISON, M_WAITOK | M_ZERO); 11193818Sjhb mtx_init(&pr->pr_mtx, "jail mutex", NULL, MTX_DEF); 112113275Smike pr->pr_ref = 1; 113114168Smike error = copyinstr(j.path, &pr->pr_path, sizeof(pr->pr_path), 0); 114113275Smike if (error) 115113275Smike goto e_killmtx; 116113275Smike mtx_lock(&Giant); 117113275Smike NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE, pr->pr_path, td); 118113275Smike error = namei(&nd); 119113275Smike if (error) { 120113275Smike mtx_unlock(&Giant); 121113275Smike goto e_killmtx; 122113275Smike } 123113275Smike pr->pr_root = nd.ni_vp; 124113275Smike VOP_UNLOCK(nd.ni_vp, 0, td); 125113275Smike NDFREE(&nd, NDF_ONLY_PNBUF); 126113275Smike mtx_unlock(&Giant); 127114168Smike error = copyinstr(j.hostname, &pr->pr_host, sizeof(pr->pr_host), 0); 12884828Sjhb if (error) 129113275Smike goto e_dropvnref; 130113275Smike pr->pr_ip = j.ip_number; 131113275Smike pr->pr_linux = NULL; 132113275Smike pr->pr_securelevel = securelevel; 133113275Smike 134113275Smike /* Determine next pr_id and add prison to allprison list. */ 135113275Smike mtx_lock(&allprison_mtx); 136113275Smike tryprid = lastprid + 1; 137113275Smike if (tryprid == JAIL_MAX) 138113275Smike tryprid = 1; 139113275Smikenext: 140113275Smike LIST_FOREACH(tpr, &allprison, pr_list) { 141113275Smike if (tpr->pr_id == tryprid) { 142113275Smike tryprid++; 143113275Smike if (tryprid == JAIL_MAX) { 144113275Smike mtx_unlock(&allprison_mtx); 145113275Smike error = EAGAIN; 146113275Smike goto e_dropvnref; 147113275Smike } 148113275Smike goto next; 149113275Smike } 150113275Smike } 151113275Smike pr->pr_id = jaa.jid = lastprid = tryprid; 152113275Smike LIST_INSERT_HEAD(&allprison, pr, pr_list); 153113275Smike prisoncount++; 154113275Smike mtx_unlock(&allprison_mtx); 155113275Smike 156113275Smike error = jail_attach(td, &jaa); 157113275Smike if (error) 158113275Smike goto e_dropprref; 159113275Smike mtx_lock(&pr->pr_mtx); 160113275Smike pr->pr_ref--; 161113275Smike mtx_unlock(&pr->pr_mtx); 162113275Smike td->td_retval[0] = jaa.jid; 163113275Smike return (0); 164113275Smikee_dropprref: 165113275Smike mtx_lock(&allprison_mtx); 166113275Smike LIST_REMOVE(pr, pr_list); 167113275Smike prisoncount--; 168113275Smike mtx_unlock(&allprison_mtx); 169113275Smikee_dropvnref: 17099227Siedowse mtx_lock(&Giant); 171113275Smike vrele(pr->pr_root); 17299227Siedowse mtx_unlock(&Giant); 173113275Smikee_killmtx: 174113275Smike mtx_destroy(&pr->pr_mtx); 175113275Smike FREE(pr, M_PRISON); 176113275Smike return (error); 177113275Smike} 178113275Smike 179113275Smike/* 180113275Smike * MPSAFE 181114168Smike * 182114168Smike * struct jail_attach_args { 183114168Smike * int jid; 184114168Smike * }; 185113275Smike */ 186113275Smikeint 187114168Smikejail_attach(struct thread *td, struct jail_attach_args *uap) 188113275Smike{ 189113275Smike struct proc *p; 190113275Smike struct ucred *newcred, *oldcred; 191113275Smike struct prison *pr; 192113275Smike int error; 193113275Smike 194113275Smike p = td->td_proc; 195113275Smike 196113275Smike mtx_lock(&allprison_mtx); 197113275Smike pr = prison_find(uap->jid); 198113275Smike if (pr == NULL) { 199113275Smike mtx_unlock(&allprison_mtx); 200113275Smike return (EINVAL); 201113275Smike } 202113275Smike pr->pr_ref++; 203113275Smike mtx_unlock(&pr->pr_mtx); 204113275Smike mtx_unlock(&allprison_mtx); 205113275Smike 206113275Smike error = suser_cred(td->td_ucred, PRISON_ROOT); 20746155Sphk if (error) 208113275Smike goto e_dropref; 209113275Smike mtx_lock(&Giant); 210113275Smike vn_lock(pr->pr_root, LK_EXCLUSIVE | LK_RETRY, td); 211113275Smike if ((error = change_dir(pr->pr_root, td)) != 0) 212113275Smike goto e_unlock; 213113275Smike#ifdef MAC 214113275Smike if ((error = mac_check_vnode_chroot(td->td_ucred, pr->pr_root))) 215113275Smike goto e_unlock; 216113275Smike#endif 217113275Smike VOP_UNLOCK(pr->pr_root, 0, td); 218113275Smike change_root(pr->pr_root, td); 219113275Smike mtx_unlock(&Giant); 220113275Smike 22184828Sjhb newcred = crget(); 22284828Sjhb PROC_LOCK(p); 22384828Sjhb /* Implicitly fail if already in jail. */ 22493593Sjhb error = suser_cred(p->p_ucred, 0); 225113275Smike if (error) { 226113275Smike PROC_UNLOCK(p); 227113275Smike crfree(newcred); 228113275Smike goto e_dropref; 229113275Smike } 23084828Sjhb oldcred = p->p_ucred; 231113275Smike setsugid(p); 23284828Sjhb crcopy(newcred, oldcred); 233113630Sjhb newcred->cr_prison = pr; 23484828Sjhb p->p_ucred = newcred; 23584828Sjhb PROC_UNLOCK(p); 23684828Sjhb crfree(oldcred); 23746155Sphk return (0); 238113275Smikee_unlock: 239113275Smike VOP_UNLOCK(pr->pr_root, 0, td); 240113275Smike mtx_unlock(&Giant); 241113275Smikee_dropref: 242113275Smike mtx_lock(&pr->pr_mtx); 243113275Smike pr->pr_ref--; 244113275Smike mtx_unlock(&pr->pr_mtx); 24546155Sphk return (error); 24646155Sphk} 24746155Sphk 248113275Smike/* 249113275Smike * Returns a locked prison instance, or NULL on failure. 250113275Smike */ 251113275Smikestatic struct prison * 252113275Smikeprison_find(int prid) 253113275Smike{ 254113275Smike struct prison *pr; 255113275Smike 256113275Smike mtx_assert(&allprison_mtx, MA_OWNED); 257113275Smike LIST_FOREACH(pr, &allprison, pr_list) { 258113275Smike if (pr->pr_id == prid) { 259113275Smike mtx_lock(&pr->pr_mtx); 260113275Smike return (pr); 261113275Smike } 262113275Smike } 263113275Smike return (NULL); 264113275Smike} 265113275Smike 26672786Srwatsonvoid 26772786Srwatsonprison_free(struct prison *pr) 26872786Srwatson{ 26972786Srwatson 270113275Smike mtx_lock(&allprison_mtx); 27187275Srwatson mtx_lock(&pr->pr_mtx); 27272786Srwatson pr->pr_ref--; 27372786Srwatson if (pr->pr_ref == 0) { 274113275Smike LIST_REMOVE(pr, pr_list); 27587275Srwatson mtx_unlock(&pr->pr_mtx); 276113275Smike prisoncount--; 277113275Smike mtx_unlock(&allprison_mtx); 278124882Srwatson 279124882Srwatson TASK_INIT(&pr->pr_task, 0, prison_complete, pr); 280124882Srwatson taskqueue_enqueue(taskqueue_swi, &pr->pr_task); 28187275Srwatson return; 28272786Srwatson } 28387275Srwatson mtx_unlock(&pr->pr_mtx); 284113275Smike mtx_unlock(&allprison_mtx); 28572786Srwatson} 28672786Srwatson 287124882Srwatsonstatic void 288124882Srwatsonprison_complete(void *context, int pending) 289124882Srwatson{ 290124882Srwatson struct prison *pr; 291124882Srwatson 292124882Srwatson pr = (struct prison *)context; 293124882Srwatson 294124882Srwatson mtx_lock(&Giant); 295124882Srwatson vrele(pr->pr_root); 296124882Srwatson mtx_unlock(&Giant); 297124882Srwatson 298124882Srwatson mtx_destroy(&pr->pr_mtx); 299124882Srwatson if (pr->pr_linux != NULL) 300124882Srwatson FREE(pr->pr_linux, M_PRISON); 301124882Srwatson FREE(pr, M_PRISON); 302124882Srwatson} 303124882Srwatson 30472786Srwatsonvoid 30572786Srwatsonprison_hold(struct prison *pr) 30672786Srwatson{ 30772786Srwatson 30887275Srwatson mtx_lock(&pr->pr_mtx); 30972786Srwatson pr->pr_ref++; 31087275Srwatson mtx_unlock(&pr->pr_mtx); 31172786Srwatson} 31272786Srwatson 31387275Srwatsonu_int32_t 31487275Srwatsonprison_getip(struct ucred *cred) 31587275Srwatson{ 31687275Srwatson 31787275Srwatson return (cred->cr_prison->pr_ip); 31887275Srwatson} 31987275Srwatson 32046155Sphkint 32172786Srwatsonprison_ip(struct ucred *cred, int flag, u_int32_t *ip) 32246155Sphk{ 32346155Sphk u_int32_t tmp; 32446155Sphk 32572786Srwatson if (!jailed(cred)) 32646155Sphk return (0); 32746155Sphk if (flag) 32846155Sphk tmp = *ip; 32946155Sphk else 33046155Sphk tmp = ntohl(*ip); 33146155Sphk if (tmp == INADDR_ANY) { 33246155Sphk if (flag) 33372786Srwatson *ip = cred->cr_prison->pr_ip; 33446155Sphk else 33572786Srwatson *ip = htonl(cred->cr_prison->pr_ip); 33646155Sphk return (0); 33746155Sphk } 33881114Srwatson if (tmp == INADDR_LOOPBACK) { 33981114Srwatson if (flag) 34081114Srwatson *ip = cred->cr_prison->pr_ip; 34181114Srwatson else 34281114Srwatson *ip = htonl(cred->cr_prison->pr_ip); 34381114Srwatson return (0); 34481114Srwatson } 34572786Srwatson if (cred->cr_prison->pr_ip != tmp) 34646155Sphk return (1); 34746155Sphk return (0); 34846155Sphk} 34946155Sphk 35046155Sphkvoid 35172786Srwatsonprison_remote_ip(struct ucred *cred, int flag, u_int32_t *ip) 35246155Sphk{ 35346155Sphk u_int32_t tmp; 35446155Sphk 35572786Srwatson if (!jailed(cred)) 35646155Sphk return; 35746155Sphk if (flag) 35846155Sphk tmp = *ip; 35946155Sphk else 36046155Sphk tmp = ntohl(*ip); 36181114Srwatson if (tmp == INADDR_LOOPBACK) { 36246155Sphk if (flag) 36372786Srwatson *ip = cred->cr_prison->pr_ip; 36446155Sphk else 36572786Srwatson *ip = htonl(cred->cr_prison->pr_ip); 36646155Sphk return; 36746155Sphk } 36846155Sphk return; 36946155Sphk} 37046155Sphk 37146155Sphkint 37272786Srwatsonprison_if(struct ucred *cred, struct sockaddr *sa) 37346155Sphk{ 374114168Smike struct sockaddr_in *sai; 37546155Sphk int ok; 37646155Sphk 377114168Smike sai = (struct sockaddr_in *)sa; 37861235Srwatson if ((sai->sin_family != AF_INET) && jail_socket_unixiproute_only) 37961235Srwatson ok = 1; 38061235Srwatson else if (sai->sin_family != AF_INET) 38146155Sphk ok = 0; 38272786Srwatson else if (cred->cr_prison->pr_ip != ntohl(sai->sin_addr.s_addr)) 38346155Sphk ok = 1; 38446155Sphk else 38546155Sphk ok = 0; 38646155Sphk return (ok); 38746155Sphk} 38872786Srwatson 38972786Srwatson/* 39072786Srwatson * Return 0 if jails permit p1 to frob p2, otherwise ESRCH. 39172786Srwatson */ 39272786Srwatsonint 393114168Smikeprison_check(struct ucred *cred1, struct ucred *cred2) 39472786Srwatson{ 39572786Srwatson 39672786Srwatson if (jailed(cred1)) { 39772786Srwatson if (!jailed(cred2)) 39872786Srwatson return (ESRCH); 39972786Srwatson if (cred2->cr_prison != cred1->cr_prison) 40072786Srwatson return (ESRCH); 40172786Srwatson } 40272786Srwatson 40372786Srwatson return (0); 40472786Srwatson} 40572786Srwatson 40672786Srwatson/* 40772786Srwatson * Return 1 if the passed credential is in a jail, otherwise 0. 40872786Srwatson */ 40972786Srwatsonint 410114168Smikejailed(struct ucred *cred) 41172786Srwatson{ 41272786Srwatson 41372786Srwatson return (cred->cr_prison != NULL); 41472786Srwatson} 41591384Srobert 41691384Srobert/* 41791384Srobert * Return the correct hostname for the passed credential. 41891384Srobert */ 41991391Srobertvoid 420114168Smikegetcredhostname(struct ucred *cred, char *buf, size_t size) 42191384Srobert{ 42291384Srobert 42391391Srobert if (jailed(cred)) { 42491391Srobert mtx_lock(&cred->cr_prison->pr_mtx); 425105354Srobert strlcpy(buf, cred->cr_prison->pr_host, size); 42691391Srobert mtx_unlock(&cred->cr_prison->pr_mtx); 427114168Smike } else 428105354Srobert strlcpy(buf, hostname, size); 42991384Srobert} 430113275Smike 431125804Srwatson/* 432125804Srwatson * Return 1 if the passed credential can "see" the passed mountpoint 433125804Srwatson * when performing a getfsstat(); otherwise, 0. 434125804Srwatson */ 435125804Srwatsonint 436125804Srwatsonprison_check_mount(struct ucred *cred, struct mount *mp) 437125804Srwatson{ 438125804Srwatson 439125805Srwatson if (jail_getfsstatroot_only && cred->cr_prison != NULL) { 440125804Srwatson if (cred->cr_prison->pr_root->v_mount != mp) 441125804Srwatson return (0); 442125804Srwatson } 443125804Srwatson return (1); 444125804Srwatson} 445125804Srwatson 446113275Smikestatic int 447113275Smikesysctl_jail_list(SYSCTL_HANDLER_ARGS) 448113275Smike{ 449113275Smike struct xprison *xp, *sxp; 450113275Smike struct prison *pr; 451113275Smike int count, error; 452113275Smike 453113275Smike mtx_assert(&Giant, MA_OWNED); 454125806Srwatson if (jailed(req->td->td_ucred) && !jail_list_allowed) 455125806Srwatson return (0); 456113275Smikeretry: 457113275Smike mtx_lock(&allprison_mtx); 458113275Smike count = prisoncount; 459113275Smike mtx_unlock(&allprison_mtx); 460113275Smike 461113275Smike if (count == 0) 462113275Smike return (0); 463113275Smike 464113275Smike sxp = xp = malloc(sizeof(*xp) * count, M_TEMP, M_WAITOK | M_ZERO); 465113275Smike mtx_lock(&allprison_mtx); 466113275Smike if (count != prisoncount) { 467113275Smike mtx_unlock(&allprison_mtx); 468113275Smike free(sxp, M_TEMP); 469113275Smike goto retry; 470113275Smike } 471113275Smike 472113275Smike LIST_FOREACH(pr, &allprison, pr_list) { 473113275Smike mtx_lock(&pr->pr_mtx); 474113275Smike xp->pr_version = XPRISON_VERSION; 475113275Smike xp->pr_id = pr->pr_id; 476113275Smike strlcpy(xp->pr_path, pr->pr_path, sizeof(xp->pr_path)); 477113275Smike strlcpy(xp->pr_host, pr->pr_host, sizeof(xp->pr_host)); 478113275Smike xp->pr_ip = pr->pr_ip; 479113275Smike mtx_unlock(&pr->pr_mtx); 480113275Smike xp++; 481113275Smike } 482113275Smike mtx_unlock(&allprison_mtx); 483113275Smike 484113275Smike error = SYSCTL_OUT(req, sxp, sizeof(*sxp) * count); 485113275Smike free(sxp, M_TEMP); 486113275Smike if (error) 487113275Smike return (error); 488113275Smike return (0); 489113275Smike} 490113275Smike 491113275SmikeSYSCTL_OID(_security_jail, OID_AUTO, list, CTLTYPE_STRUCT | CTLFLAG_RD, 492113275Smike NULL, 0, sysctl_jail_list, "S", "List of active jails"); 493126004Spjd 494126004Spjdstatic int 495126004Spjdsysctl_jail_jailed(SYSCTL_HANDLER_ARGS) 496126004Spjd{ 497126004Spjd int error, injail; 498126004Spjd 499126004Spjd injail = jailed(req->td->td_ucred); 500126004Spjd error = SYSCTL_OUT(req, &injail, sizeof(injail)); 501126004Spjd 502126004Spjd return (error); 503126004Spjd} 504126004SpjdSYSCTL_PROC(_security_jail, OID_AUTO, jailed, CTLTYPE_INT | CTLFLAG_RD, 505126004Spjd NULL, 0, sysctl_jail_jailed, "I", "Process in jail?"); 506