Date: Thu, 16 Aug 2018 19:09:43 +0000 (UTC) From: Jamie Gritton <jamie@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r337925 - in head: lib/libc/sys sys/compat/freebsd32 sys/kern sys/sys Message-ID: <201808161909.w7GJ9hXt060717@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: jamie Date: Thu Aug 16 19:09:43 2018 New Revision: 337925 URL: https://svnweb.freebsd.org/changeset/base/337925 Log: Revert r337922, except for some documention-only bits. This needs to wait until user is changed to stop using jail(2). Differential Revision: D14791 Modified: head/lib/libc/sys/jail.2 head/sys/compat/freebsd32/freebsd32_misc.c head/sys/compat/freebsd32/freebsd32_proto.h head/sys/compat/freebsd32/freebsd32_syscall.h head/sys/compat/freebsd32/freebsd32_syscalls.c head/sys/compat/freebsd32/freebsd32_sysent.c head/sys/compat/freebsd32/freebsd32_systrace_args.c head/sys/compat/freebsd32/syscalls.master head/sys/kern/init_sysent.c head/sys/kern/kern_jail.c head/sys/kern/syscalls.c head/sys/kern/syscalls.master head/sys/kern/systrace_args.c head/sys/sys/jail.h head/sys/sys/syscall.h head/sys/sys/syscall.mk head/sys/sys/syscallsubr.h head/sys/sys/sysproto.h Modified: head/lib/libc/sys/jail.2 ============================================================================== --- head/lib/libc/sys/jail.2 Thu Aug 16 18:58:34 2018 (r337924) +++ head/lib/libc/sys/jail.2 Thu Aug 16 19:09:43 2018 (r337925) @@ -25,10 +25,11 @@ .\" .\" $FreeBSD$ .\" -.Dd August 16, 2018 +.Dd February 8, 2012 .Dt JAIL 2 .Os .Sh NAME +.Nm jail , .Nm jail_get , .Nm jail_set , .Nm jail_remove , @@ -40,6 +41,8 @@ .In sys/param.h .In sys/jail.h .Ft int +.Fn jail "struct jail *jail" +.Ft int .Fn jail_attach "int jid" .Ft int .Fn jail_remove "int jid" @@ -50,7 +53,74 @@ .Fn jail_set "struct iovec *iov" "u_int niov" "int flags" .Sh DESCRIPTION The +.Fn jail +system call sets up a jail and locks the current process in it. +.Pp +The argument is a pointer to a structure describing the prison: +.Bd -literal -offset indent +struct jail { + uint32_t version; + char *path; + char *hostname; + char *jailname; + unsigned int ip4s; + unsigned int ip6s; + struct in_addr *ip4; + struct in6_addr *ip6; +}; +.Ed +.Pp +.Dq Li version +defines the version of the API in use. +.Dv JAIL_API_VERSION +is defined for the current version. +.Pp +The +.Dq Li path +pointer should be set to the directory which is to be the root of the +prison. +.Pp +The +.Dq Li hostname +pointer can be set to the hostname of the prison. +This can be changed +from the inside of the prison. +.Pp +The +.Dq Li jailname +pointer is an optional name that can be assigned to the jail +for example for management purposes. +.Pp +The +.Dq Li ip4s +and +.Dq Li ip6s +give the numbers of IPv4 and IPv6 addresses that will be passed +via their respective pointers. +.Pp +The +.Dq Li ip4 +and +.Dq Li ip6 +pointers can be set to an arrays of IPv4 and IPv6 addresses to be assigned to +the prison, or NULL if none. +IPv4 addresses must be in network byte order. +.Pp +This is equivalent to, and deprecated in favor of, the .Fn jail_set +system call (see below), with the parameters +.Va path , +.Va host.hostname , +.Va name , +.Va ip4.addr , +and +.Va ip6.addr , +and with the +.Dv JAIL_ATTACH +flag. +.Pp +The +.Fn jail_set system call creates a new jail, or modifies an existing one, and optionally locks the current process in it. Jail parameters are passed as an array of name-value pairs in the array @@ -76,19 +146,13 @@ The current set of available parameters, and their for retrieved via the .Va security.jail.param sysctl MIB entry. -Notable parameters include +Notable parameters include those mentioned in the +.Fn jail +description above, as well as .Va jid and -.Va name -which identify the jail being created or modified, -.Va path -(the root directory of the jail), -.Va host.hostname -(the hostname of the jail), and -.Va ip4.addr -and -.Va ip6.addr -(IP addresses to assign to the jail). +.Va name , +which identify the jail being created or modified. See .Xr jail 8 for more information on the core jail parameters. @@ -173,7 +237,8 @@ It will kill all processes belonging to the jail, and of that jail. .Sh RETURN VALUES If successful, -.Fn jail_set +.Fn jail , +.Fn jail_set , and .Fn jail_get return a non-negative integer, termed the jail identifier (JID). @@ -184,6 +249,25 @@ to indicate the error. .Rv -std jail_attach jail_remove .Sh ERRORS The +.Fn jail +system call +will fail if: +.Bl -tag -width Er +.It Bq Er EPERM +This process is not allowed to create a jail, either because it is not +the super-user, or because it would exceed the jail's +.Va children.max +limit. +.It Bq Er EFAULT +.Fa jail +points to an address outside the allocated address space of the process. +.It Bq Er EINVAL +The version number of the argument is not correct. +.It Bq Er EAGAIN +No free JID could be found. +.El +.Pp +The .Fn jail_set system call will fail if: @@ -287,7 +371,8 @@ does not exist. .El .Pp Further -.Fn jail_set +.Fn jail , +.Fn jail_set , and .Fn jail_attach call @@ -301,7 +386,7 @@ manual page for details. .Xr chroot 2 , .Xr jail 8 .Sh HISTORY -The now-deprecated +The .Fn jail system call appeared in .Fx 4.0 . Modified: head/sys/compat/freebsd32/freebsd32_misc.c ============================================================================== --- head/sys/compat/freebsd32/freebsd32_misc.c Thu Aug 16 18:58:34 2018 (r337924) +++ head/sys/compat/freebsd32/freebsd32_misc.c Thu Aug 16 19:09:43 2018 (r337925) @@ -2289,10 +2289,8 @@ freebsd32_sysctl(struct thread *td, struct freebsd32_s return (0); } -#ifdef COMPAT_FREEBSD11 int -freebsd11_freebsd32_jail(struct thread *td, - struct freebsd11_freebsd32_jail_args *uap) +freebsd32_jail(struct thread *td, struct freebsd32_jail_args *uap) { uint32_t version; int error; @@ -2349,9 +2347,8 @@ freebsd11_freebsd32_jail(struct thread *td, /* Sci-Fi jails are not supported, sorry. */ return (EINVAL); } - return (freebsd11_kern_jail(td, &j)); + return (kern_jail(td, &j)); } -#endif /* COMPAT_FREEBSD11 */ int freebsd32_jail_set(struct thread *td, struct freebsd32_jail_set_args *uap) Modified: head/sys/compat/freebsd32/freebsd32_proto.h ============================================================================== --- head/sys/compat/freebsd32/freebsd32_proto.h Thu Aug 16 18:58:34 2018 (r337924) +++ head/sys/compat/freebsd32/freebsd32_proto.h Thu Aug 16 19:09:43 2018 (r337925) @@ -283,6 +283,9 @@ struct freebsd32_sched_rr_get_interval_args { char pid_l_[PADL_(pid_t)]; pid_t pid; char pid_r_[PADR_(pid_t)]; char interval_l_[PADL_(struct timespec32 *)]; struct timespec32 * interval; char interval_r_[PADR_(struct timespec32 *)]; }; +struct freebsd32_jail_args { + char jail_l_[PADL_(struct jail32 *)]; struct jail32 * jail; char jail_r_[PADR_(struct jail32 *)]; +}; struct freebsd32_sigtimedwait_args { char set_l_[PADL_(const sigset_t *)]; const sigset_t * set; char set_r_[PADR_(const sigset_t *)]; char info_l_[PADL_(siginfo_t *)]; siginfo_t * info; char info_r_[PADR_(siginfo_t *)]; @@ -758,6 +761,7 @@ int freebsd32_aio_return(struct thread *, struct freeb int freebsd32_aio_suspend(struct thread *, struct freebsd32_aio_suspend_args *); int freebsd32_aio_error(struct thread *, struct freebsd32_aio_error_args *); int freebsd32_sched_rr_get_interval(struct thread *, struct freebsd32_sched_rr_get_interval_args *); +int freebsd32_jail(struct thread *, struct freebsd32_jail_args *); int freebsd32_sigtimedwait(struct thread *, struct freebsd32_sigtimedwait_args *); int freebsd32_sigwaitinfo(struct thread *, struct freebsd32_sigwaitinfo_args *); int freebsd32_aio_waitcomplete(struct thread *, struct freebsd32_aio_waitcomplete_args *); @@ -1180,9 +1184,6 @@ struct freebsd11_freebsd32_fhstat_args { char u_fhp_l_[PADL_(const struct fhandle *)]; const struct fhandle * u_fhp; char u_fhp_r_[PADR_(const struct fhandle *)]; char sb_l_[PADL_(struct freebsd11_stat32 *)]; struct freebsd11_stat32 * sb; char sb_r_[PADR_(struct freebsd11_stat32 *)]; }; -struct freebsd11_freebsd32_jail_args { - char jail_l_[PADL_(struct jail32 *)]; struct jail32 * jail; char jail_r_[PADR_(struct jail32 *)]; -}; struct freebsd11_freebsd32_kevent_args { char fd_l_[PADL_(int)]; int fd; char fd_r_[PADR_(int)]; char changelist_l_[PADL_(const struct kevent32_freebsd11 *)]; const struct kevent32_freebsd11 * changelist; char changelist_r_[PADR_(const struct kevent32_freebsd11 *)]; @@ -1222,7 +1223,6 @@ int freebsd11_freebsd32_lstat(struct thread *, struct int freebsd11_freebsd32_getdirentries(struct thread *, struct freebsd11_freebsd32_getdirentries_args *); int freebsd11_freebsd32_getdents(struct thread *, struct freebsd11_freebsd32_getdents_args *); int freebsd11_freebsd32_fhstat(struct thread *, struct freebsd11_freebsd32_fhstat_args *); -int freebsd11_freebsd32_jail(struct thread *, struct freebsd11_freebsd32_jail_args *); int freebsd11_freebsd32_kevent(struct thread *, struct freebsd11_freebsd32_kevent_args *); int freebsd11_freebsd32_fstatat(struct thread *, struct freebsd11_freebsd32_fstatat_args *); int freebsd11_freebsd32_mknodat(struct thread *, struct freebsd11_freebsd32_mknodat_args *); @@ -1317,7 +1317,7 @@ int freebsd11_freebsd32_mknodat(struct thread *, struc #define FREEBSD32_SYS_AUE_freebsd6_freebsd32_lio_listio AUE_LIO_LISTIO #define FREEBSD32_SYS_AUE_freebsd32_sched_rr_get_interval AUE_NULL #define FREEBSD32_SYS_AUE_freebsd4_freebsd32_sendfile AUE_SENDFILE -#define FREEBSD32_SYS_AUE_freebsd11_freebsd32_jail AUE_JAIL +#define FREEBSD32_SYS_AUE_freebsd32_jail AUE_JAIL #define FREEBSD32_SYS_AUE_freebsd4_freebsd32_sigaction AUE_SIGACTION #define FREEBSD32_SYS_AUE_freebsd4_freebsd32_sigreturn AUE_SIGRETURN #define FREEBSD32_SYS_AUE_freebsd32_sigtimedwait AUE_SIGWAIT Modified: head/sys/compat/freebsd32/freebsd32_syscall.h ============================================================================== --- head/sys/compat/freebsd32/freebsd32_syscall.h Thu Aug 16 18:58:34 2018 (r337924) +++ head/sys/compat/freebsd32/freebsd32_syscall.h Thu Aug 16 19:09:43 2018 (r337925) @@ -275,7 +275,7 @@ #define FREEBSD32_SYS_utrace 335 /* 336 is freebsd4 freebsd32_sendfile */ #define FREEBSD32_SYS_kldsym 337 -#define FREEBSD32_SYS_freebsd11_freebsd32_jail 338 +#define FREEBSD32_SYS_freebsd32_jail 338 #define FREEBSD32_SYS_sigprocmask 340 #define FREEBSD32_SYS_sigsuspend 341 /* 342 is freebsd4 freebsd32_sigaction */ Modified: head/sys/compat/freebsd32/freebsd32_syscalls.c ============================================================================== --- head/sys/compat/freebsd32/freebsd32_syscalls.c Thu Aug 16 18:58:34 2018 (r337924) +++ head/sys/compat/freebsd32/freebsd32_syscalls.c Thu Aug 16 19:09:43 2018 (r337925) @@ -347,7 +347,7 @@ const char *freebsd32_syscallnames[] = { "utrace", /* 335 = utrace */ "compat4.freebsd32_sendfile", /* 336 = freebsd4 freebsd32_sendfile */ "kldsym", /* 337 = kldsym */ - "compat11.freebsd32_jail", /* 338 = freebsd11 freebsd32_jail */ + "freebsd32_jail", /* 338 = freebsd32_jail */ "#339", /* 339 = pioctl */ "sigprocmask", /* 340 = sigprocmask */ "sigsuspend", /* 341 = sigsuspend */ Modified: head/sys/compat/freebsd32/freebsd32_sysent.c ============================================================================== --- head/sys/compat/freebsd32/freebsd32_sysent.c Thu Aug 16 18:58:34 2018 (r337924) +++ head/sys/compat/freebsd32/freebsd32_sysent.c Thu Aug 16 19:09:43 2018 (r337925) @@ -394,7 +394,7 @@ struct sysent freebsd32_sysent[] = { { AS(utrace_args), (sy_call_t *)sys_utrace, AUE_NULL, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 335 = utrace */ { compat4(AS(freebsd4_freebsd32_sendfile_args),freebsd32_sendfile), AUE_SENDFILE, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 336 = freebsd4 freebsd32_sendfile */ { AS(kldsym_args), (sy_call_t *)sys_kldsym, AUE_NULL, NULL, 0, 0, 0, SY_THR_STATIC }, /* 337 = kldsym */ - { compat11(AS(freebsd11_freebsd32_jail_args),freebsd32_jail), AUE_JAIL, NULL, 0, 0, 0, SY_THR_STATIC }, /* 338 = freebsd11 freebsd32_jail */ + { AS(freebsd32_jail_args), (sy_call_t *)freebsd32_jail, AUE_JAIL, NULL, 0, 0, 0, SY_THR_STATIC }, /* 338 = freebsd32_jail */ { 0, (sy_call_t *)nosys, AUE_NULL, NULL, 0, 0, 0, SY_THR_ABSENT }, /* 339 = pioctl */ { AS(sigprocmask_args), (sy_call_t *)sys_sigprocmask, AUE_SIGPROCMASK, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 340 = sigprocmask */ { AS(sigsuspend_args), (sy_call_t *)sys_sigsuspend, AUE_SIGSUSPEND, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 341 = sigsuspend */ Modified: head/sys/compat/freebsd32/freebsd32_systrace_args.c ============================================================================== --- head/sys/compat/freebsd32/freebsd32_systrace_args.c Thu Aug 16 18:58:34 2018 (r337924) +++ head/sys/compat/freebsd32/freebsd32_systrace_args.c Thu Aug 16 19:09:43 2018 (r337925) @@ -1559,6 +1559,13 @@ systrace_args(int sysnum, void *params, uint64_t *uarg *n_args = 3; break; } + /* freebsd32_jail */ + case 338: { + struct freebsd32_jail_args *p = params; + uarg[0] = (intptr_t) p->jail; /* struct jail32 * */ + *n_args = 1; + break; + } /* sigprocmask */ case 340: { struct sigprocmask_args *p = params; @@ -5704,6 +5711,16 @@ systrace_entry_setargdesc(int sysnum, int ndx, char *d break; }; break; + /* freebsd32_jail */ + case 338: + switch(ndx) { + case 0: + p = "userland struct jail32 *"; + break; + default: + break; + }; + break; /* sigprocmask */ case 340: switch(ndx) { @@ -9653,6 +9670,11 @@ systrace_return_setargdesc(int sysnum, int ndx, char * break; /* kldsym */ case 337: + if (ndx == 0 || ndx == 1) + p = "int"; + break; + /* freebsd32_jail */ + case 338: if (ndx == 0 || ndx == 1) p = "int"; break; Modified: head/sys/compat/freebsd32/syscalls.master ============================================================================== --- head/sys/compat/freebsd32/syscalls.master Thu Aug 16 18:58:34 2018 (r337924) +++ head/sys/compat/freebsd32/syscalls.master Thu Aug 16 19:09:43 2018 (r337925) @@ -601,7 +601,7 @@ off_t *sbytes, int flags); } 337 AUE_NULL NOPROTO { int kldsym(int fileid, int cmd, \ void *data); } -338 AUE_JAIL COMPAT11 { int freebsd32_jail(struct jail32 *jail); } +338 AUE_JAIL STD { int freebsd32_jail(struct jail32 *jail); } 339 AUE_NULL UNIMPL pioctl 340 AUE_SIGPROCMASK NOPROTO { int sigprocmask(int how, \ const sigset_t *set, sigset_t *oset); } Modified: head/sys/kern/init_sysent.c ============================================================================== --- head/sys/kern/init_sysent.c Thu Aug 16 18:58:34 2018 (r337924) +++ head/sys/kern/init_sysent.c Thu Aug 16 19:09:43 2018 (r337925) @@ -387,7 +387,7 @@ struct sysent sysent[] = { { AS(utrace_args), (sy_call_t *)sys_utrace, AUE_NULL, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 335 = utrace */ { compat4(AS(freebsd4_sendfile_args),sendfile), AUE_SENDFILE, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 336 = freebsd4 sendfile */ { AS(kldsym_args), (sy_call_t *)sys_kldsym, AUE_NULL, NULL, 0, 0, 0, SY_THR_STATIC }, /* 337 = kldsym */ - { compat11(AS(freebsd11_jail_args),jail), AUE_JAIL, NULL, 0, 0, 0, SY_THR_STATIC }, /* 338 = freebsd11 jail */ + { AS(jail_args), (sy_call_t *)sys_jail, AUE_JAIL, NULL, 0, 0, 0, SY_THR_STATIC }, /* 338 = jail */ { AS(nnpfs_syscall_args), (sy_call_t *)lkmressys, AUE_NULL, NULL, 0, 0, 0, SY_THR_ABSENT }, /* 339 = nnpfs_syscall */ { AS(sigprocmask_args), (sy_call_t *)sys_sigprocmask, AUE_SIGPROCMASK, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 340 = sigprocmask */ { AS(sigsuspend_args), (sy_call_t *)sys_sigsuspend, AUE_SIGSUSPEND, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 341 = sigsuspend */ Modified: head/sys/kern/kern_jail.c ============================================================================== --- head/sys/kern/kern_jail.c Thu Aug 16 18:58:34 2018 (r337924) +++ head/sys/kern/kern_jail.c Thu Aug 16 19:09:43 2018 (r337925) @@ -74,14 +74,6 @@ __FBSDID("$FreeBSD$"); #include <security/mac/mac_framework.h> -/* - * The old jail(2) interface will exist under COMPAT_FREEBSD11, but the global - * permission sysctls are slated to go away sometime (even with COMPAT). - */ -#if defined(COMPAT_FREEBSD11) && !defined(BURN_BRIDGES) -#define PR_GLOBAL_ALLOW -#endif - #define DEFAULT_HOSTUUID "00000000-0000-0000-0000-000000000000" MALLOC_DEFINE(M_PRISON, "prison", "Prison structures"); @@ -207,11 +199,9 @@ const size_t pr_flag_allow_size = sizeof(pr_flag_allow #define JAIL_DEFAULT_ALLOW (PR_ALLOW_SET_HOSTNAME | PR_ALLOW_RESERVED_PORTS) #define JAIL_DEFAULT_ENFORCE_STATFS 2 #define JAIL_DEFAULT_DEVFS_RSNUM 0 -#ifdef PR_GLOBAL_ALLOW static unsigned jail_default_allow = JAIL_DEFAULT_ALLOW; static int jail_default_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS; static int jail_default_devfs_rsnum = JAIL_DEFAULT_DEVFS_RSNUM; -#endif #if defined(INET) || defined(INET6) static unsigned jail_max_af_ips = 255; #endif @@ -229,14 +219,13 @@ prison0_init(void) strlcpy(prison0.pr_osrelease, osrelease, sizeof(prison0.pr_osrelease)); } -#ifdef COMPAT_FREEBSD11 /* * struct jail_args { * struct jail *jail; * }; */ int -freebsd11_jail(struct thread *td, struct freebsd11_jail_args *uap) +sys_jail(struct thread *td, struct jail_args *uap) { uint32_t version; int error; @@ -281,16 +270,13 @@ freebsd11_jail(struct thread *td, struct freebsd11_jai /* Sci-Fi jails are not supported, sorry. */ return (EINVAL); } - return (freebsd11_kern_jail(td, &j)); + return (kern_jail(td, &j)); } int -freebsd11_kern_jail(struct thread *td, struct jail *j) +kern_jail(struct thread *td, struct jail *j) { - struct iovec optiov[2 * (3 -#ifdef PR_GLOBAL_ALLOW - + 1 + nitems(pr_flag_allow) -#endif + struct iovec optiov[2 * (4 + nitems(pr_flag_allow) #ifdef INET + 1 #endif @@ -300,10 +286,7 @@ freebsd11_kern_jail(struct thread *td, struct jail *j) )]; struct uio opt; char *u_path, *u_hostname, *u_name; -#ifdef PR_GLOBAL_ALLOW struct bool_flags *bf; - int enforce_statfs; -#endif #ifdef INET uint32_t ip4s; struct in_addr *u_ip4; @@ -312,7 +295,7 @@ freebsd11_kern_jail(struct thread *td, struct jail *j) struct in6_addr *u_ip6; #endif size_t tmplen; - int error; + int error, enforce_statfs; bzero(&optiov, sizeof(optiov)); opt.uio_iov = optiov; @@ -323,7 +306,6 @@ freebsd11_kern_jail(struct thread *td, struct jail *j) opt.uio_rw = UIO_READ; opt.uio_td = td; -#ifdef PR_GLOBAL_ALLOW /* Set permissions for top-level jails from sysctls. */ if (!jailed(td->td_ucred)) { for (bf = pr_flag_allow; @@ -345,7 +327,6 @@ freebsd11_kern_jail(struct thread *td, struct jail *j) optiov[opt.uio_iovcnt].iov_len = sizeof(enforce_statfs); opt.uio_iovcnt++; } -#endif tmplen = MAXPATHLEN + MAXHOSTNAMELEN + MAXHOSTNAMELEN; #ifdef INET @@ -449,7 +430,6 @@ freebsd11_kern_jail(struct thread *td, struct jail *j) free(u_path, M_TEMP); return (error); } -#endif /* COMPAT_FREEBSD11 */ /* @@ -1267,11 +1247,7 @@ kern_jail_set(struct thread *td, struct uio *optuio, i pr->pr_securelevel = ppr->pr_securelevel; pr->pr_allow = JAIL_DEFAULT_ALLOW & ppr->pr_allow; -#ifdef PR_GLOBAL_ALLOW pr->pr_enforce_statfs = jail_default_enforce_statfs; -#else - pr->pr_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS; -#endif pr->pr_devfs_rsnum = ppr->pr_devfs_rsnum; pr->pr_osreldate = osreldt ? osreldt : ppr->pr_osreldate; @@ -3439,7 +3415,6 @@ prison_path(struct prison *pr1, struct prison *pr2) static SYSCTL_NODE(_security, OID_AUTO, jail, CTLFLAG_RW, 0, "Jails"); -#ifdef COMPAT_FREEBSD11 static int sysctl_jail_list(SYSCTL_HANDLER_ARGS) { @@ -3543,7 +3518,6 @@ sysctl_jail_list(SYSCTL_HANDLER_ARGS) SYSCTL_OID(_security_jail, OID_AUTO, list, CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0, sysctl_jail_list, "S", "List of active jails"); -#endif /* COMPAT_FREEBSD11 */ static int sysctl_jail_jailed(SYSCTL_HANDLER_ARGS) @@ -3583,14 +3557,13 @@ SYSCTL_PROC(_security_jail, OID_AUTO, vnet, #if defined(INET) || defined(INET6) SYSCTL_UINT(_security_jail, OID_AUTO, jail_max_af_ips, CTLFLAG_RW, &jail_max_af_ips, 0, - "Number of IP addresses a jail may have at most per address family"); + "Number of IP addresses a jail may have at most per address family (deprecated)"); #endif /* - * Jail permissions - jailed processes can read these to find out what they are - * allowed to do. A deprecated use is to set default permissions for prisons - * created via jail(2). For historical reasons, the sysctl names have varying - * similarity to the parameter names. + * Default parameters for jail(2) compatibility. For historical reasons, + * the sysctl names have varying similarity to the parameter names. Prisons + * just see their own parameters, and can't change them. */ static int sysctl_jail_default_allow(SYSCTL_HANDLER_ARGS) @@ -3599,68 +3572,52 @@ sysctl_jail_default_allow(SYSCTL_HANDLER_ARGS) int allow, error, i; pr = req->td->td_ucred->cr_prison; -#ifdef PR_GLOBAL_ALLOW allow = (pr == &prison0) ? jail_default_allow : pr->pr_allow; -#else - allow = pr->pr_allow; -#endif /* Get the current flag value, and convert it to a boolean. */ i = (allow & arg2) ? 1 : 0; if (arg1 != NULL) i = !i; error = sysctl_handle_int(oidp, &i, 0, req); - if (error) + if (error || !req->newptr) return (error); -#ifdef PR_GLOBAL_ALLOW - if (req->newptr) { - i = i ? arg2 : 0; - if (arg1 != NULL) - i ^= arg2; - /* - * The sysctls don't have CTLFLAGS_PRISON, so assume prison0 - * for writing. - */ - mtx_lock(&prison0.pr_mtx); - jail_default_allow = (jail_default_allow & ~arg2) | i; - mtx_unlock(&prison0.pr_mtx); - } -#endif + i = i ? arg2 : 0; + if (arg1 != NULL) + i ^= arg2; + /* + * The sysctls don't have CTLFLAGS_PRISON, so assume prison0 + * for writing. + */ + mtx_lock(&prison0.pr_mtx); + jail_default_allow = (jail_default_allow & ~arg2) | i; + mtx_unlock(&prison0.pr_mtx); return (0); } -#ifdef PR_GLOBAL_ALLOW -#define CTLFLAG_GLOBAL_ALLOW (CTLFLAG_RW | CTLFLAG_MPSAFE) -#define ADDR_GLOBAL_ALLOW(i) &i -#else -#define CTLFLAG_GLOBAL_ALLOW (CTLFLAG_RD | CTLFLAG_MPSAFE) -#define ADDR_GLOBAL_ALLOW(i) NULL -#endif - SYSCTL_PROC(_security_jail, OID_AUTO, set_hostname_allowed, - CTLTYPE_INT | CTLFLAG_GLOBAL_ALLOW, + CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, PR_ALLOW_SET_HOSTNAME, sysctl_jail_default_allow, "I", - "Processes in jail can set their hostnames"); + "Processes in jail can set their hostnames (deprecated)"); SYSCTL_PROC(_security_jail, OID_AUTO, socket_unixiproute_only, - CTLTYPE_INT | CTLFLAG_GLOBAL_ALLOW, + CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, (void *)1, PR_ALLOW_SOCKET_AF, sysctl_jail_default_allow, "I", - "Processes in jail are limited to creating UNIX/IP/route sockets only"); + "Processes in jail are limited to creating UNIX/IP/route sockets only (deprecated)"); SYSCTL_PROC(_security_jail, OID_AUTO, sysvipc_allowed, - CTLTYPE_INT | CTLFLAG_GLOBAL_ALLOW, + CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, PR_ALLOW_SYSVIPC, sysctl_jail_default_allow, "I", - "Processes in jail can use System V IPC primitives"); + "Processes in jail can use System V IPC primitives (deprecated)"); SYSCTL_PROC(_security_jail, OID_AUTO, allow_raw_sockets, - CTLTYPE_INT | CTLFLAG_GLOBAL_ALLOW, + CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, PR_ALLOW_RAW_SOCKETS, sysctl_jail_default_allow, "I", - "Prison root can create raw sockets"); + "Prison root can create raw sockets (deprecated)"); SYSCTL_PROC(_security_jail, OID_AUTO, chflags_allowed, - CTLTYPE_INT | CTLFLAG_GLOBAL_ALLOW, + CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, PR_ALLOW_CHFLAGS, sysctl_jail_default_allow, "I", - "Processes in jail can alter system file flags"); + "Processes in jail can alter system file flags (deprecated)"); SYSCTL_PROC(_security_jail, OID_AUTO, mount_allowed, - CTLTYPE_INT | CTLFLAG_GLOBAL_ALLOW, + CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, PR_ALLOW_MOUNT, sysctl_jail_default_allow, "I", - "Processes in jail can mount/unmount jail-friendly file systems"); + "Processes in jail can mount/unmount jail-friendly file systems (deprecated)"); static int sysctl_jail_default_level(SYSCTL_HANDLER_ARGS) @@ -3669,33 +3626,25 @@ sysctl_jail_default_level(SYSCTL_HANDLER_ARGS) int level, error; pr = req->td->td_ucred->cr_prison; -#ifdef PR_GLOBAL_ALLOW level = (pr == &prison0) ? *(int *)arg1 : *(int *)((char *)pr + arg2); -#else - level = *(int *)((char *)pr + arg2); -#endif error = sysctl_handle_int(oidp, &level, 0, req); - if (error) + if (error || !req->newptr) return (error); -#ifdef PR_GLOBAL_ALLOW - if (req->newptr) - *(int *)arg1 = level; -#endif + *(int *)arg1 = level; return (0); } SYSCTL_PROC(_security_jail, OID_AUTO, enforce_statfs, - CTLTYPE_INT | CTLFLAG_GLOBAL_ALLOW, - ADDR_GLOBAL_ALLOW(jail_default_enforce_statfs), - offsetof(struct prison, pr_enforce_statfs), + CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, + &jail_default_enforce_statfs, offsetof(struct prison, pr_enforce_statfs), sysctl_jail_default_level, "I", - "Processes in jail cannot see all mounted file systems"); + "Processes in jail cannot see all mounted file systems (deprecated)"); + SYSCTL_PROC(_security_jail, OID_AUTO, devfs_ruleset, - CTLTYPE_INT | CTLFLAG_GLOBAL_ALLOW, - ADDR_GLOBAL_ALLOW(jail_default_devfs_rsnum), - offsetof(struct prison, pr_devfs_rsnum), + CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, + &jail_default_devfs_rsnum, offsetof(struct prison, pr_devfs_rsnum), sysctl_jail_default_level, "I", - "Ruleset for the devfs filesystem in jail"); + "Ruleset for the devfs filesystem in jail (deprecated)"); /* * Nodes to describe jail parameters. Maximum length of string parameters @@ -3836,6 +3785,9 @@ prison_add_allow(const char *prefix, const char *name, struct bool_flags *bf; struct sysctl_oid *parent; char *allow_name, *allow_noname, *allowed; +#ifndef NO_SYSCTL_DESCR + char *descr_deprecated; +#endif unsigned allow_flag; if (prefix @@ -3892,7 +3844,10 @@ prison_add_allow(const char *prefix, const char *name, bf->flag = allow_flag; mtx_unlock(&prison0.pr_mtx); - /* Create sysctls for the paramter, and the current permission. */ + /* + * Create sysctls for the paramter, and the back-compat global + * permission. + */ parent = prefix ? SYSCTL_ADD_NODE(NULL, SYSCTL_CHILDREN(&sysctl___security_jail_param_allow), @@ -3904,10 +3859,17 @@ prison_add_allow(const char *prefix, const char *name, if ((prefix ? asprintf(&allowed, M_TEMP, "%s_%s_allowed", prefix, name) : asprintf(&allowed, M_TEMP, "%s_allowed", name)) >= 0) { +#ifndef NO_SYSCTL_DESCR + (void)asprintf(&descr_deprecated, M_TEMP, "%s (deprecated)", + descr); +#endif (void)SYSCTL_ADD_PROC(NULL, SYSCTL_CHILDREN(&sysctl___security_jail), OID_AUTO, allowed, - CTLTYPE_INT | CTLFLAG_GLOBAL_ALLOW, NULL, allow_flag, - sysctl_jail_default_allow, "I", descr); + CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, allow_flag, + sysctl_jail_default_allow, "I", descr_deprecated); +#ifndef NO_SYSCTL_DESCR + free(descr_deprecated, M_TEMP); +#endif free(allowed, M_TEMP); } return allow_flag; Modified: head/sys/kern/syscalls.c ============================================================================== --- head/sys/kern/syscalls.c Thu Aug 16 18:58:34 2018 (r337924) +++ head/sys/kern/syscalls.c Thu Aug 16 19:09:43 2018 (r337925) @@ -344,7 +344,7 @@ const char *syscallnames[] = { "utrace", /* 335 = utrace */ "compat4.sendfile", /* 336 = freebsd4 sendfile */ "kldsym", /* 337 = kldsym */ - "compat11.jail", /* 338 = freebsd11 jail */ + "jail", /* 338 = jail */ "nnpfs_syscall", /* 339 = nnpfs_syscall */ "sigprocmask", /* 340 = sigprocmask */ "sigsuspend", /* 341 = sigsuspend */ Modified: head/sys/kern/syscalls.master ============================================================================== --- head/sys/kern/syscalls.master Thu Aug 16 18:58:34 2018 (r337924) +++ head/sys/kern/syscalls.master Thu Aug 16 19:09:43 2018 (r337925) @@ -738,7 +738,7 @@ _Out_opt_ off_t *sbytes, int flags); } 337 AUE_NULL STD { int kldsym(int fileid, int cmd, \ _In_ void *data); } -338 AUE_JAIL COMPAT11 { int jail( \ +338 AUE_JAIL STD { int jail( \ _In_ struct jail *jail); } 339 AUE_NULL NOSTD|NOTSTATIC { int nnpfs_syscall(int operation, \ Modified: head/sys/kern/systrace_args.c ============================================================================== --- head/sys/kern/systrace_args.c Thu Aug 16 18:58:34 2018 (r337924) +++ head/sys/kern/systrace_args.c Thu Aug 16 19:09:43 2018 (r337925) @@ -1593,6 +1593,13 @@ systrace_args(int sysnum, void *params, uint64_t *uarg *n_args = 3; break; } + /* jail */ + case 338: { + struct jail_args *p = params; + uarg[0] = (intptr_t) p->jail; /* struct jail * */ + *n_args = 1; + break; + } /* nnpfs_syscall */ case 339: { struct nnpfs_syscall_args *p = params; @@ -5765,6 +5772,16 @@ systrace_entry_setargdesc(int sysnum, int ndx, char *d break; }; break; + /* jail */ + case 338: + switch(ndx) { + case 0: + p = "userland struct jail *"; + break; + default: + break; + }; + break; /* nnpfs_syscall */ case 339: switch(ndx) { @@ -9627,6 +9644,11 @@ systrace_return_setargdesc(int sysnum, int ndx, char * break; /* kldsym */ case 337: + if (ndx == 0 || ndx == 1) + p = "int"; + break; + /* jail */ + case 338: if (ndx == 0 || ndx == 1) p = "int"; break; Modified: head/sys/sys/jail.h ============================================================================== --- head/sys/sys/jail.h Thu Aug 16 18:58:34 2018 (r337924) +++ head/sys/sys/jail.h Thu Aug 16 19:09:43 2018 (r337925) @@ -32,7 +32,6 @@ #ifndef _SYS_JAIL_H_ #define _SYS_JAIL_H_ -#ifdef COMPAT_FREEBSD11 #ifdef _KERNEL struct jail_v0 { u_int32_t version; @@ -58,6 +57,16 @@ struct jail { * For all xprison structs, always keep the pr_version an int and * the first variable so userspace can easily distinguish them. */ +#ifndef _KERNEL +struct xprison_v1 { + int pr_version; + int pr_id; + char pr_path[MAXPATHLEN]; + char pr_host[MAXHOSTNAMELEN]; + u_int32_t pr_ip; +}; +#endif + struct xprison { int pr_version; int pr_id; @@ -82,7 +91,6 @@ struct xprison { #define PRISON_STATE_INVALID 0 #define PRISON_STATE_ALIVE 1 #define PRISON_STATE_DYING 2 -#endif /* COMPAT_FREEBSD11 */ /* * Flags for jail_set and jail_get. @@ -102,6 +110,7 @@ struct xprison { struct iovec; +int jail(struct jail *); int jail_set(struct iovec *, unsigned int, int); int jail_get(struct iovec *, unsigned int, int); int jail_attach(int); Modified: head/sys/sys/syscall.h ============================================================================== --- head/sys/sys/syscall.h Thu Aug 16 18:58:34 2018 (r337924) +++ head/sys/sys/syscall.h Thu Aug 16 19:09:43 2018 (r337925) @@ -280,7 +280,7 @@ #define SYS_utrace 335 /* 336 is freebsd4 sendfile */ #define SYS_kldsym 337 -#define SYS_freebsd11_jail 338 +#define SYS_jail 338 #define SYS_nnpfs_syscall 339 #define SYS_sigprocmask 340 #define SYS_sigsuspend 341 Modified: head/sys/sys/syscall.mk ============================================================================== --- head/sys/sys/syscall.mk Thu Aug 16 18:58:34 2018 (r337924) +++ head/sys/sys/syscall.mk Thu Aug 16 19:09:43 2018 (r337925) @@ -209,7 +209,7 @@ MIASM = \ sched_rr_get_interval.o \ utrace.o \ kldsym.o \ - freebsd11_jail.o \ + jail.o \ nnpfs_syscall.o \ sigprocmask.o \ sigsuspend.o \ Modified: head/sys/sys/syscallsubr.h ============================================================================== --- head/sys/sys/syscallsubr.h Thu Aug 16 18:58:34 2018 (r337924) +++ head/sys/sys/syscallsubr.h Thu Aug 16 19:09:43 2018 (r337925) @@ -143,6 +143,7 @@ int kern_getsockname(struct thread *td, int fd, struct int kern_getsockopt(struct thread *td, int s, int level, int name, void *optval, enum uio_seg valseg, socklen_t *valsize); int kern_ioctl(struct thread *td, int fd, u_long com, caddr_t data); +int kern_jail(struct thread *td, struct jail *j); int kern_jail_get(struct thread *td, struct uio *options, int flags); int kern_jail_set(struct thread *td, struct uio *options, int flags); int kern_kevent(struct thread *td, int fd, int nchanges, int nevents, @@ -307,6 +308,5 @@ struct freebsd11_dirent; int freebsd11_kern_getdirentries(struct thread *td, int fd, char *ubuf, u_int count, long *basep, void (*func)(struct freebsd11_dirent *)); -int freebsd11_kern_jail(struct thread *td, struct jail *j); #endif /* !_SYS_SYSCALLSUBR_H_ */ Modified: head/sys/sys/sysproto.h ============================================================================== --- head/sys/sys/sysproto.h Thu Aug 16 18:58:34 2018 (r337924) +++ head/sys/sys/sysproto.h Thu Aug 16 19:09:43 2018 (r337925) @@ -849,6 +849,9 @@ struct kldsym_args { char cmd_l_[PADL_(int)]; int cmd; char cmd_r_[PADR_(int)]; char data_l_[PADL_(void *)]; void * data; char data_r_[PADR_(void *)]; }; +struct jail_args { + char jail_l_[PADL_(struct jail *)]; struct jail * jail; char jail_r_[PADR_(struct jail *)]; +}; struct nnpfs_syscall_args { char operation_l_[PADL_(int)]; int operation; char operation_r_[PADR_(int)]; char a_pathP_l_[PADL_(char *)]; char * a_pathP; char a_pathP_r_[PADR_(char *)]; @@ -1958,6 +1961,7 @@ int sys_sched_get_priority_min(struct thread *, struct int sys_sched_rr_get_interval(struct thread *, struct sched_rr_get_interval_args *); int sys_utrace(struct thread *, struct utrace_args *); int sys_kldsym(struct thread *, struct kldsym_args *); +int sys_jail(struct thread *, struct jail_args *); int sys_nnpfs_syscall(struct thread *, struct nnpfs_syscall_args *); int sys_sigprocmask(struct thread *, struct sigprocmask_args *); int sys_sigsuspend(struct thread *, struct sigsuspend_args *); @@ -2527,9 +2531,6 @@ struct freebsd11_fhstat_args { char u_fhp_l_[PADL_(const struct fhandle *)]; const struct fhandle * u_fhp; char u_fhp_r_[PADR_(const struct fhandle *)]; char sb_l_[PADL_(struct freebsd11_stat *)]; struct freebsd11_stat * sb; char sb_r_[PADR_(struct freebsd11_stat *)]; }; -struct freebsd11_jail_args { - char jail_l_[PADL_(struct jail *)]; struct jail * jail; char jail_r_[PADR_(struct jail *)]; -}; struct freebsd11_kevent_args { char fd_l_[PADL_(int)]; int fd; char fd_r_[PADR_(int)]; char changelist_l_[PADL_(struct kevent_freebsd11 *)]; struct kevent_freebsd11 * changelist; char changelist_r_[PADR_(struct kevent_freebsd11 *)]; @@ -2578,7 +2579,6 @@ int freebsd11_nstat(struct thread *, struct freebsd11_ int freebsd11_nfstat(struct thread *, struct freebsd11_nfstat_args *); int freebsd11_nlstat(struct thread *, struct freebsd11_nlstat_args *); int freebsd11_fhstat(struct thread *, struct freebsd11_fhstat_args *); -int freebsd11_jail(struct thread *, struct freebsd11_jail_args *); int freebsd11_kevent(struct thread *, struct freebsd11_kevent_args *); int freebsd11_getfsstat(struct thread *, struct freebsd11_getfsstat_args *); int freebsd11_statfs(struct thread *, struct freebsd11_statfs_args *); @@ -2849,7 +2849,7 @@ int freebsd11_mknodat(struct thread *, struct freebsd1 #define SYS_AUE_utrace AUE_NULL #define SYS_AUE_freebsd4_sendfile AUE_SENDFILE #define SYS_AUE_kldsym AUE_NULL -#define SYS_AUE_freebsd11_jail AUE_JAIL +#define SYS_AUE_jail AUE_JAIL #define SYS_AUE_nnpfs_syscall AUE_NULL #define SYS_AUE_sigprocmask AUE_SIGPROCMASK #define SYS_AUE_sigsuspend AUE_SIGSUSPEND
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201808161909.w7GJ9hXt060717>