diff --git a/usr.sbin/jail/command.c b/usr.sbin/jail/command.c index 8ea3f3ee8795..9da4fe51673a 100644 --- a/usr.sbin/jail/command.c +++ b/usr.sbin/jail/command.c @@ -1,1064 +1,1076 @@ /*- * SPDX-License-Identifier: BSD-2-Clause * * Copyright (c) 2011 James Gritton * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include "jailp.h" #define DEFAULT_STOP_TIMEOUT 10 #define PHASH_SIZE 256 LIST_HEAD(phhead, phash); struct phash { LIST_ENTRY(phash) le; struct cfjail *j; pid_t pid; }; int paralimit = -1; extern char **environ; static int run_command(struct cfjail *j); static int add_proc(struct cfjail *j, pid_t pid); static void clear_procs(struct cfjail *j); static struct cfjail *find_proc(pid_t pid); static int term_procs(struct cfjail *j); static int get_user_info(struct cfjail *j, const char *username, const struct passwd **pwdp, login_cap_t **lcapp); static int check_path(struct cfjail *j, const char *pname, const char *path, int isfile, const char *umount_type); static struct cfjails sleeping = TAILQ_HEAD_INITIALIZER(sleeping); static struct cfjails runnable = TAILQ_HEAD_INITIALIZER(runnable); static struct cfstring dummystring = { .len = 1 }; static struct phhead phash[PHASH_SIZE]; static int kq; static cpusetid_t root_cpuset_id(void) { static cpusetid_t setid = CPUSET_INVALID; static int error; /* Only try to get the cpuset once. */ if (error == 0 && setid == CPUSET_INVALID) error = cpuset_getid(CPU_LEVEL_ROOT, CPU_WHICH_PID, -1, &setid); if (error != 0) return (CPUSET_INVALID); return (setid); } /* * Run the next command associated with a jail. */ int next_command(struct cfjail *j) { enum intparam comparam; int create_failed, stopping; if (paralimit == 0) { if (j->flags & JF_FROM_RUNQ) requeue_head(j, &runnable); else requeue(j, &runnable); return 1; } j->flags &= ~JF_FROM_RUNQ; create_failed = (j->flags & (JF_STOP | JF_FAILED)) == JF_FAILED; stopping = (j->flags & JF_STOP) != 0; comparam = *j->comparam; for (;;) { if (j->comstring == NULL) { j->comparam += create_failed ? -1 : 1; switch ((comparam = *j->comparam)) { case IP__NULL: return 0; case IP_MOUNT_DEVFS: if (!bool_param(j->intparams[IP_MOUNT_DEVFS])) continue; j->comstring = &dummystring; break; case IP_MOUNT_FDESCFS: if (!bool_param(j->intparams[IP_MOUNT_FDESCFS])) continue; j->comstring = &dummystring; break; case IP_MOUNT_PROCFS: if (!bool_param(j->intparams[IP_MOUNT_PROCFS])) continue; j->comstring = &dummystring; break; case IP__OP: case IP_STOP_TIMEOUT: j->comstring = &dummystring; break; default: if (j->intparams[comparam] == NULL) continue; j->comstring = create_failed || (stopping && (j->intparams[comparam]->flags & PF_REV)) ? TAILQ_LAST(&j->intparams[comparam]->val, cfstrings) : TAILQ_FIRST(&j->intparams[comparam]->val); } } else { j->comstring = j->comstring == &dummystring ? NULL : create_failed || (stopping && (j->intparams[comparam]->flags & PF_REV)) ? TAILQ_PREV(j->comstring, cfstrings, tq) : TAILQ_NEXT(j->comstring, tq); } if (j->comstring == NULL || j->comstring->len == 0 || (create_failed && (comparam == IP_EXEC_PRESTART || comparam == IP_EXEC_CREATED || comparam == IP_EXEC_START || comparam == IP_COMMAND || comparam == IP_EXEC_POSTSTART || comparam == IP_EXEC_PREPARE))) continue; switch (run_command(j)) { case -1: failed(j); /* FALLTHROUGH */ case 1: return 1; } } } /* * Check command exit status */ int finish_command(struct cfjail *j) { struct cfjail *rj; int error; if (!(j->flags & JF_SLEEPQ)) return 0; j->flags &= ~JF_SLEEPQ; if (*j->comparam == IP_STOP_TIMEOUT) { j->flags &= ~JF_TIMEOUT; j->pstatus = 0; return 0; } paralimit++; if (!TAILQ_EMPTY(&runnable)) { rj = TAILQ_FIRST(&runnable); rj->flags |= JF_FROM_RUNQ; requeue(rj, &ready); } error = 0; if (j->flags & JF_TIMEOUT) { j->flags &= ~JF_TIMEOUT; if (*j->comparam != IP_STOP_TIMEOUT) { jail_warnx(j, "%s: timed out", j->comline); failed(j); error = -1; } else if (verbose > 0) jail_note(j, "timed out\n"); } else if (j->pstatus != 0) { if (WIFSIGNALED(j->pstatus)) jail_warnx(j, "%s: exited on signal %d", j->comline, WTERMSIG(j->pstatus)); else jail_warnx(j, "%s: failed", j->comline); j->pstatus = 0; failed(j); error = -1; } free(j->comline); j->comline = NULL; return error; } /* * Check for finished processes or timeouts. */ struct cfjail * next_proc(int nonblock) { struct kevent ke; struct timespec ts; struct timespec *tsp; struct cfjail *j; if (!TAILQ_EMPTY(&sleeping)) { again: tsp = NULL; if ((j = TAILQ_FIRST(&sleeping)) && j->timeout.tv_sec) { clock_gettime(CLOCK_REALTIME, &ts); ts.tv_sec = j->timeout.tv_sec - ts.tv_sec; ts.tv_nsec = j->timeout.tv_nsec - ts.tv_nsec; if (ts.tv_nsec < 0) { ts.tv_sec--; ts.tv_nsec += 1000000000; } if (ts.tv_sec < 0 || (ts.tv_sec == 0 && ts.tv_nsec == 0)) { j->flags |= JF_TIMEOUT; clear_procs(j); return j; } tsp = &ts; } if (nonblock) { ts.tv_sec = 0; ts.tv_nsec = 0; tsp = &ts; } switch (kevent(kq, NULL, 0, &ke, 1, tsp)) { case -1: if (errno != EINTR) err(1, "kevent"); goto again; case 0: if (!nonblock) { j = TAILQ_FIRST(&sleeping); j->flags |= JF_TIMEOUT; clear_procs(j); return j; } break; case 1: (void)waitpid(ke.ident, NULL, WNOHANG); if ((j = find_proc(ke.ident))) { j->pstatus = ke.data; return j; } goto again; } } return NULL; } /* * Run a single command for a jail, possibly inside the jail. */ static int run_command(struct cfjail *j) { const struct passwd *pwd; const struct cfstring *comstring, *s; login_cap_t *lcap; const char **argv; - char *acs, *ajidstr, *cs, *comcs, *devpath; + char *acs, *cs, *comcs, *devpath; const char *jidstr, *conslog, *fmt, *path, *ruleset, *term, *username; enum intparam comparam; size_t comlen, ret; pid_t pid; cpusetid_t setid; int argc, bg, clean, consfd, down, fib, i, injail, sjuser, timeout; #if defined(INET) || defined(INET6) char *addr, *extrap, *p, *val; #endif static char *cleanenv; /* Perform some operations that aren't actually commands */ comparam = *j->comparam; down = j->flags & (JF_STOP | JF_FAILED); switch (comparam) { case IP_STOP_TIMEOUT: return term_procs(j); case IP__OP: if (down) { if (jail_remove(j->jid) < 0 && errno == EPERM) { jail_warnx(j, "jail_remove: %s", strerror(errno)); return -1; } if (verbose > 0 || (verbose == 0 && (j->flags & JF_STOP ? note_remove : j->name != NULL))) jail_note(j, "removed\n"); j->jid = -1; if (j->flags & JF_STOP) dep_done(j, DF_LIGHT); else j->flags &= ~JF_PERSIST; } else { if (create_jail(j) < 0) return -1; if (iflag) printf("%d\n", j->jid); if (verbose >= 0 && (j->name || verbose > 0)) jail_note(j, "created\n"); + + /* + * Populate our jid and name parameters if they were not + * provided. This simplifies later logic that wants to + * use the jid or name to be able to do so reliably. + */ + if (j->intparams[KP_JID] == NULL) { + char ljidstr[16]; + + (void)snprintf(ljidstr, sizeof(ljidstr), "%d", + j->jid); + add_param(j, NULL, KP_JID, ljidstr); + } + + /* This matches the kernel behavior. */ + if (j->intparams[KP_NAME] == NULL) + add_param(j, j->intparams[KP_JID], KP_NAME, + NULL); + dep_done(j, DF_LIGHT); } return 0; default: ; } /* * Collect exec arguments. Internal commands for network and * mounting build their own argument lists. */ comstring = j->comstring; bg = 0; switch (comparam) { #ifdef INET case IP__IP4_IFADDR: argc = 0; val = alloca(strlen(comstring->s) + 1); strcpy(val, comstring->s); cs = val; extrap = NULL; while ((p = strchr(cs, ' ')) != NULL && strlen(p) > 1) { if (extrap == NULL) { *p = '\0'; extrap = p + 1; } cs = p + 1; argc++; } argv = alloca((8 + argc) * sizeof(char *)); argv[0] = _PATH_IFCONFIG; if ((cs = strchr(val, '|'))) { argv[1] = acs = alloca(cs - val + 1); strlcpy(acs, val, cs - val + 1); addr = cs + 1; } else { argv[1] = string_param(j->intparams[IP_INTERFACE]); addr = val; } argv[2] = "inet"; if (!(cs = strchr(addr, '/'))) { argv[3] = addr; argv[4] = "netmask"; argv[5] = "255.255.255.255"; argc = 6; } else if (strchr(cs + 1, '.')) { argv[3] = acs = alloca(cs - addr + 1); strlcpy(acs, addr, cs - addr + 1); argv[4] = "netmask"; argv[5] = cs + 1; argc = 6; } else { argv[3] = addr; argc = 4; } if (!down && extrap != NULL) { for (cs = strtok(extrap, " "); cs; cs = strtok(NULL, " ")) { size_t len = strlen(cs) + 1; argv[argc++] = acs = alloca(len); strlcpy(acs, cs, len); } } argv[argc] = down ? "-alias" : "alias"; argv[argc + 1] = NULL; break; #endif #ifdef INET6 case IP__IP6_IFADDR: argc = 0; val = alloca(strlen(comstring->s) + 1); strcpy(val, comstring->s); cs = val; extrap = NULL; while ((p = strchr(cs, ' ')) != NULL && strlen(p) > 1) { if (extrap == NULL) { *p = '\0'; extrap = p + 1; } cs = p + 1; argc++; } argv = alloca((8 + argc) * sizeof(char *)); argv[0] = _PATH_IFCONFIG; if ((cs = strchr(val, '|'))) { argv[1] = acs = alloca(cs - val + 1); strlcpy(acs, val, cs - val + 1); addr = cs + 1; } else { argv[1] = string_param(j->intparams[IP_INTERFACE]); addr = val; } argv[2] = "inet6"; argv[3] = addr; if (!(cs = strchr(addr, '/'))) { argv[4] = "prefixlen"; argv[5] = "128"; argc = 6; } else argc = 4; if (!down && extrap != NULL) { for (cs = strtok(extrap, " "); cs; cs = strtok(NULL, " ")) { size_t len = strlen(cs) + 1; argv[argc++] = acs = alloca(len); strlcpy(acs, cs, len); } } argv[argc] = down ? "-alias" : "alias"; argv[argc + 1] = NULL; break; #endif case IP_VNET_INTERFACE: argv = alloca(5 * sizeof(char *)); argv[0] = _PATH_IFCONFIG; argv[1] = comstring->s; argv[2] = down ? "-vnet" : "vnet"; - jidstr = string_param(j->intparams[KP_JID]); - argv[3] = jidstr ? jidstr : string_param(j->intparams[KP_NAME]); + argv[3] = string_param(j->intparams[KP_JID]); argv[4] = NULL; break; case IP_MOUNT: case IP__MOUNT_FROM_FSTAB: argv = alloca(8 * sizeof(char *)); comcs = alloca(comstring->len + 1); strcpy(comcs, comstring->s); argc = 0; for (cs = strtok(comcs, " \t\f\v\r\n"); cs && argc < 4; cs = strtok(NULL, " \t\f\v\r\n")) { if (argc <= 1 && strunvis(cs, cs) < 0) { jail_warnx(j, "%s: %s: fstab parse error", j->intparams[comparam]->name, comstring->s); return -1; } argv[argc++] = cs; } if (argc == 0) return 0; if (argc < 3) { jail_warnx(j, "%s: %s: missing information", j->intparams[comparam]->name, comstring->s); return -1; } if (check_path(j, j->intparams[comparam]->name, argv[1], 0, down ? argv[2] : NULL) < 0) return -1; if (down) { argv[4] = NULL; argv[3] = argv[1]; argv[0] = "/sbin/umount"; } else { if (argc == 4) { argv[7] = NULL; argv[6] = argv[1]; argv[5] = argv[0]; argv[4] = argv[3]; argv[3] = "-o"; } else { argv[5] = NULL; argv[4] = argv[1]; argv[3] = argv[0]; } argv[0] = _PATH_MOUNT; } argv[1] = "-t"; break; case IP_MOUNT_DEVFS: argv = alloca(7 * sizeof(char *)); path = string_param(j->intparams[KP_PATH]); if (path == NULL) { jail_warnx(j, "mount.devfs: no jail root path defined"); return -1; } devpath = alloca(strlen(path) + 5); sprintf(devpath, "%s/dev", path); if (check_path(j, "mount.devfs", devpath, 0, down ? "devfs" : NULL) < 0) return -1; if (down) { argv[0] = "/sbin/umount"; argv[1] = devpath; argv[2] = NULL; } else { argv[0] = _PATH_MOUNT; argv[1] = "-t"; argv[2] = "devfs"; ruleset = string_param(j->intparams[KP_DEVFS_RULESET]); if (!ruleset) ruleset = "4"; /* devfsrules_jail */ argv[3] = acs = alloca(11 + strlen(ruleset)); sprintf(acs, "-oruleset=%s", ruleset); argv[4] = "."; argv[5] = devpath; argv[6] = NULL; } break; case IP_MOUNT_FDESCFS: argv = alloca(7 * sizeof(char *)); path = string_param(j->intparams[KP_PATH]); if (path == NULL) { jail_warnx(j, "mount.fdescfs: no jail root path defined"); return -1; } devpath = alloca(strlen(path) + 8); sprintf(devpath, "%s/dev/fd", path); if (check_path(j, "mount.fdescfs", devpath, 0, down ? "fdescfs" : NULL) < 0) return -1; if (down) { argv[0] = "/sbin/umount"; argv[1] = devpath; argv[2] = NULL; } else { argv[0] = _PATH_MOUNT; argv[1] = "-t"; argv[2] = "fdescfs"; argv[3] = "."; argv[4] = devpath; argv[5] = NULL; } break; case IP_MOUNT_PROCFS: argv = alloca(7 * sizeof(char *)); path = string_param(j->intparams[KP_PATH]); if (path == NULL) { jail_warnx(j, "mount.procfs: no jail root path defined"); return -1; } devpath = alloca(strlen(path) + 6); sprintf(devpath, "%s/proc", path); if (check_path(j, "mount.procfs", devpath, 0, down ? "procfs" : NULL) < 0) return -1; if (down) { argv[0] = "/sbin/umount"; argv[1] = devpath; argv[2] = NULL; } else { argv[0] = _PATH_MOUNT; argv[1] = "-t"; argv[2] = "procfs"; argv[3] = "."; argv[4] = devpath; argv[5] = NULL; } break; case IP_ZFS_DATASET: argv = alloca(4 * sizeof(char *)); - jidstr = string_param(j->intparams[KP_JID]) ? - string_param(j->intparams[KP_JID]) : - string_param(j->intparams[KP_NAME]); + jidstr = string_param(j->intparams[KP_JID]); fmt = "if [ $(/sbin/zfs get -H -o value jailed %s) = on ]; then /sbin/zfs jail %s %s || echo error, attaching %s to jail %s failed; else echo error, you need to set jailed=on for dataset %s; fi"; comlen = strlen(fmt) + 2 * strlen(jidstr) + 4 * comstring->len - 6 * 2 /* 6 * "%s" */ + 1; comcs = alloca(comlen); ret = snprintf(comcs, comlen, fmt, comstring->s, jidstr, comstring->s, comstring->s, jidstr, comstring->s); if (ret >= comlen) { jail_warnx(j, "internal error in ZFS dataset handling"); exit(1); } argv[0] = _PATH_BSHELL; argv[1] = "-c"; argv[2] = comcs; argv[3] = NULL; break; case IP_COMMAND: if (j->name != NULL) goto default_command; argc = 0; TAILQ_FOREACH(s, &j->intparams[IP_COMMAND]->val, tq) argc++; argv = alloca((argc + 1) * sizeof(char *)); argc = 0; TAILQ_FOREACH(s, &j->intparams[IP_COMMAND]->val, tq) argv[argc++] = s->s; argv[argc] = NULL; j->comstring = &dummystring; break; default: default_command: if ((cs = strpbrk(comstring->s, "!\"$&'()*;<>?[\\]`{|}~")) && !(cs[0] == '&' && cs[1] == '\0')) { argv = alloca(4 * sizeof(char *)); argv[0] = _PATH_BSHELL; argv[1] = "-c"; argv[2] = comstring->s; argv[3] = NULL; } else { if (cs) { *cs = 0; bg = 1; } comcs = alloca(comstring->len + 1); strcpy(comcs, comstring->s); argc = 0; for (cs = strtok(comcs, " \t\f\v\r\n"); cs; cs = strtok(NULL, " \t\f\v\r\n")) argc++; argv = alloca((argc + 1) * sizeof(char *)); strcpy(comcs, comstring->s); argc = 0; for (cs = strtok(comcs, " \t\f\v\r\n"); cs; cs = strtok(NULL, " \t\f\v\r\n")) argv[argc++] = cs; argv[argc] = NULL; } } if (argv[0] == NULL) return 0; if (int_param(j->intparams[IP_EXEC_TIMEOUT], &timeout) && timeout != 0) { clock_gettime(CLOCK_REALTIME, &j->timeout); j->timeout.tv_sec += timeout; } else j->timeout.tv_sec = 0; injail = comparam == IP_EXEC_START || comparam == IP_COMMAND || comparam == IP_EXEC_STOP; if (injail) setid = root_cpuset_id(); else setid = CPUSET_INVALID; clean = bool_param(j->intparams[IP_EXEC_CLEAN]); username = string_param(j->intparams[injail ? IP_EXEC_JAIL_USER : IP_EXEC_SYSTEM_USER]); sjuser = bool_param(j->intparams[IP_EXEC_SYSTEM_JAIL_USER]); consfd = 0; if (injail && (conslog = string_param(j->intparams[IP_EXEC_CONSOLELOG]))) { if (check_path(j, "exec.consolelog", conslog, 1, NULL) < 0) return -1; consfd = open(conslog, O_WRONLY | O_CREAT | O_APPEND, DEFFILEMODE); if (consfd < 0) { jail_warnx(j, "open %s: %s", conslog, strerror(errno)); return -1; } } comlen = 0; for (i = 0; argv[i]; i++) comlen += strlen(argv[i]) + 1; j->comline = cs = emalloc(comlen); for (i = 0; argv[i]; i++) { strcpy(cs, argv[i]); if (argv[i + 1]) { cs += strlen(argv[i]) + 1; cs[-1] = ' '; } } if (verbose > 0) jail_note(j, "run command%s%s%s: %s\n", injail ? " in jail" : "", username ? " as " : "", username ? username : "", j->comline); pid = fork(); if (pid < 0) err(1, "fork"); if (pid > 0) { if (bg || !add_proc(j, pid)) { free(j->comline); j->comline = NULL; return 0; } else { paralimit--; return 1; } } if (bg) setsid(); /* Set up the environment and run the command */ pwd = NULL; lcap = NULL; if ((clean || username) && injail && sjuser && get_user_info(j, username, &pwd, &lcap) < 0) exit(1); if (injail) { /* jail_attach won't chdir along with its chroot. */ path = string_param(j->intparams[KP_PATH]); if (path && chdir(path) < 0) { jail_warnx(j, "chdir %s: %s", path, strerror(errno)); exit(1); } if (int_param(j->intparams[IP_EXEC_FIB], &fib) && setfib(fib) < 0) { jail_warnx(j, "setfib: %s", strerror(errno)); exit(1); } /* * We wouldn't have specialized our affinity, so just setid to * root. We do this prior to attaching to avoid the kernel * having to create a transient cpuset that we'll promptly * free up with a reset to the jail's cpuset. * * This is just a best-effort to use as wide of mask as * possible. */ if (setid != CPUSET_INVALID) (void)cpuset_setid(CPU_WHICH_PID, -1, setid); if (jail_attach(j->jid) < 0) { jail_warnx(j, "jail_attach: %s", strerror(errno)); exit(1); } } if (clean || username) { if (!(injail && sjuser) && get_user_info(j, username, &pwd, &lcap) < 0) exit(1); if (clean) { term = getenv("TERM"); environ = &cleanenv; setenv("PATH", "/bin:/usr/bin", 0); if (term != NULL) setenv("TERM", term, 1); } if (setgid(pwd->pw_gid) < 0) { jail_warnx(j, "setgid %d: %s", pwd->pw_gid, strerror(errno)); exit(1); } if (setusercontext(lcap, pwd, pwd->pw_uid, username ? LOGIN_SETALL & ~LOGIN_SETGROUP & ~LOGIN_SETLOGIN : LOGIN_SETPATH | LOGIN_SETENV) < 0) { jail_warnx(j, "setusercontext %s: %s", pwd->pw_name, strerror(errno)); exit(1); } login_close(lcap); setenv("USER", pwd->pw_name, 1); setenv("HOME", pwd->pw_dir, 1); setenv("SHELL", *pwd->pw_shell ? pwd->pw_shell : _PATH_BSHELL, 1); if (clean && username && chdir(pwd->pw_dir) < 0) { jail_warnx(j, "chdir %s: %s", pwd->pw_dir, strerror(errno)); exit(1); } endpwent(); } if (!injail) { - if (asprintf(&ajidstr, "%d", j->jid) == -1) { - jail_warnx(j, "asprintf jid=%d: %s", j->jid, - strerror(errno)); - exit(1); - } - setenv("JID", ajidstr, 1); - free(ajidstr); + if (string_param(j->intparams[KP_JID])) + setenv("JID", string_param(j->intparams[KP_JID]), 1); setenv("JNAME", string_param(j->intparams[KP_NAME]), 1); + path = string_param(j->intparams[KP_PATH]); setenv("JPATH", path ? path : "", 1); } if (consfd != 0 && (dup2(consfd, 1) < 0 || dup2(consfd, 2) < 0)) { jail_warnx(j, "exec.consolelog: %s", strerror(errno)); exit(1); } closefrom(3); execvp(argv[0], __DECONST(char *const*, argv)); jail_warnx(j, "exec %s: %s", argv[0], strerror(errno)); exit(1); } /* * Add a process to the hash, tied to a jail. */ static int add_proc(struct cfjail *j, pid_t pid) { struct kevent ke; struct cfjail *tj; struct phash *ph; if (!kq && (kq = kqueue()) < 0) err(1, "kqueue"); EV_SET(&ke, pid, EVFILT_PROC, EV_ADD, NOTE_EXIT, 0, NULL); if (kevent(kq, &ke, 1, NULL, 0, NULL) < 0) { if (errno == ESRCH) return 0; err(1, "kevent"); } ph = emalloc(sizeof(struct phash)); ph->j = j; ph->pid = pid; LIST_INSERT_HEAD(&phash[pid % PHASH_SIZE], ph, le); j->nprocs++; j->flags |= JF_SLEEPQ; if (j->timeout.tv_sec == 0) requeue(j, &sleeping); else { /* File the jail in the sleep queue according to its timeout. */ TAILQ_REMOVE(j->queue, j, tq); TAILQ_FOREACH(tj, &sleeping, tq) { if (!tj->timeout.tv_sec || j->timeout.tv_sec < tj->timeout.tv_sec || (j->timeout.tv_sec == tj->timeout.tv_sec && j->timeout.tv_nsec <= tj->timeout.tv_nsec)) { TAILQ_INSERT_BEFORE(tj, j, tq); break; } } if (tj == NULL) TAILQ_INSERT_TAIL(&sleeping, j, tq); j->queue = &sleeping; } return 1; } /* * Remove any processes from the hash that correspond to a jail. */ static void clear_procs(struct cfjail *j) { struct kevent ke; struct phash *ph, *tph; int i; j->nprocs = 0; for (i = 0; i < PHASH_SIZE; i++) LIST_FOREACH_SAFE(ph, &phash[i], le, tph) if (ph->j == j) { EV_SET(&ke, ph->pid, EVFILT_PROC, EV_DELETE, NOTE_EXIT, 0, NULL); (void)kevent(kq, &ke, 1, NULL, 0, NULL); LIST_REMOVE(ph, le); free(ph); } } /* * Find the jail that corresponds to an exited process. */ static struct cfjail * find_proc(pid_t pid) { struct cfjail *j; struct phash *ph; LIST_FOREACH(ph, &phash[pid % PHASH_SIZE], le) if (ph->pid == pid) { j = ph->j; LIST_REMOVE(ph, le); free(ph); return --j->nprocs ? NULL : j; } return NULL; } /* * Send SIGTERM to all processes in a jail and wait for them to die. */ static int term_procs(struct cfjail *j) { struct kinfo_proc *ki; int i, noted, pcnt, timeout; static kvm_t *kd; if (!int_param(j->intparams[IP_STOP_TIMEOUT], &timeout)) timeout = DEFAULT_STOP_TIMEOUT; else if (timeout == 0) return 0; if (kd == NULL) { kd = kvm_open(NULL, NULL, NULL, O_RDONLY, NULL); if (kd == NULL) return 0; } ki = kvm_getprocs(kd, KERN_PROC_PROC, 0, &pcnt); if (ki == NULL) return 0; noted = 0; for (i = 0; i < pcnt; i++) if (ki[i].ki_jid == j->jid && kill(ki[i].ki_pid, SIGTERM) == 0) { (void)add_proc(j, ki[i].ki_pid); if (verbose > 0) { if (!noted) { noted = 1; jail_note(j, "sent SIGTERM to:"); } printf(" %d", ki[i].ki_pid); } } if (noted) printf("\n"); if (j->nprocs > 0) { clock_gettime(CLOCK_REALTIME, &j->timeout); j->timeout.tv_sec += timeout; return 1; } return 0; } /* * Look up a user in the passwd and login.conf files. */ static int get_user_info(struct cfjail *j, const char *username, const struct passwd **pwdp, login_cap_t **lcapp) { const struct passwd *pwd; errno = 0; *pwdp = pwd = username ? getpwnam(username) : getpwuid(getuid()); if (pwd == NULL) { if (errno) jail_warnx(j, "getpwnam%s%s: %s", username ? " " : "", username ? username : "", strerror(errno)); else if (username) jail_warnx(j, "%s: no such user", username); else jail_warnx(j, "unknown uid %d", getuid()); return -1; } *lcapp = login_getpwclass(pwd); if (*lcapp == NULL) { jail_warnx(j, "getpwclass %s: %s", pwd->pw_name, strerror(errno)); return -1; } /* Set the groups while the group file is still available */ if (initgroups(pwd->pw_name, pwd->pw_gid) < 0) { jail_warnx(j, "initgroups %s: %s", pwd->pw_name, strerror(errno)); return -1; } return 0; } /* * Make sure a mount or consolelog path is a valid absolute pathname * with no symlinks. */ static int check_path(struct cfjail *j, const char *pname, const char *path, int isfile, const char *umount_type) { struct stat st, mpst; struct statfs stfs; char *tpath, *p; const char *jailpath; size_t jplen; if (path[0] != '/') { jail_warnx(j, "%s: %s: not an absolute pathname", pname, path); return -1; } /* * Only check for symlinks in components below the jail's path, * since that's where the security risk lies. */ jailpath = string_param(j->intparams[KP_PATH]); if (jailpath == NULL) jailpath = ""; jplen = strlen(jailpath); if (!strncmp(path, jailpath, jplen) && path[jplen] == '/') { tpath = alloca(strlen(path) + 1); strcpy(tpath, path); for (p = tpath + jplen; p != NULL; ) { p = strchr(p + 1, '/'); if (p) *p = '\0'; if (lstat(tpath, &st) < 0) { if (errno == ENOENT && isfile && !p) break; jail_warnx(j, "%s: %s: %s", pname, tpath, strerror(errno)); return -1; } if (S_ISLNK(st.st_mode)) { jail_warnx(j, "%s: %s is a symbolic link", pname, tpath); return -1; } if (p) *p = '/'; } } if (umount_type != NULL) { if (stat(path, &st) < 0 || statfs(path, &stfs) < 0) { jail_warnx(j, "%s: %s: %s", pname, path, strerror(errno)); return -1; } if (stat(stfs.f_mntonname, &mpst) < 0) { jail_warnx(j, "%s: %s: %s", pname, stfs.f_mntonname, strerror(errno)); return -1; } if (st.st_ino != mpst.st_ino) { jail_warnx(j, "%s: %s: not a mount point", pname, path); return -1; } if (strcmp(stfs.f_fstypename, umount_type)) { jail_warnx(j, "%s: %s: not a %s mount", pname, path, umount_type); return -1; } } return 0; } diff --git a/usr.sbin/jail/config.c b/usr.sbin/jail/config.c index 3af0088626c9..70de82e662e7 100644 --- a/usr.sbin/jail/config.c +++ b/usr.sbin/jail/config.c @@ -1,908 +1,919 @@ /*- * SPDX-License-Identifier: BSD-2-Clause * * Copyright (c) 2011 James Gritton * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include "jailp.h" #define MAX_INCLUDE_DEPTH 32 struct ipspec { const char *name; unsigned flags; }; extern int yylex_init_extra(struct cflex *extra, void *scanner); extern int yylex_destroy(void *scanner); extern int yyparse(void *scanner); extern int yyset_in(FILE *fp, void *scanner); struct cfjails cfjails = TAILQ_HEAD_INITIALIZER(cfjails); static void parse_config(const char *fname, int is_stdin); static void free_param(struct cfparams *pp, struct cfparam *p); static const struct ipspec intparams[] = { [IP_ALLOW_DYING] = {"allow.dying", PF_INTERNAL | PF_BOOL}, [IP_COMMAND] = {"command", PF_INTERNAL}, [IP_DEPEND] = {"depend", PF_INTERNAL}, [IP_EXEC_CLEAN] = {"exec.clean", PF_INTERNAL | PF_BOOL}, [IP_EXEC_CONSOLELOG] = {"exec.consolelog", PF_INTERNAL}, [IP_EXEC_FIB] = {"exec.fib", PF_INTERNAL | PF_INT}, [IP_EXEC_JAIL_USER] = {"exec.jail_user", PF_INTERNAL}, [IP_EXEC_POSTSTART] = {"exec.poststart", PF_INTERNAL}, [IP_EXEC_POSTSTOP] = {"exec.poststop", PF_INTERNAL}, [IP_EXEC_PREPARE] = {"exec.prepare", PF_INTERNAL}, [IP_EXEC_PRESTART] = {"exec.prestart", PF_INTERNAL}, [IP_EXEC_PRESTOP] = {"exec.prestop", PF_INTERNAL}, [IP_EXEC_RELEASE] = {"exec.release", PF_INTERNAL}, [IP_EXEC_CREATED] = {"exec.created", PF_INTERNAL}, [IP_EXEC_START] = {"exec.start", PF_INTERNAL}, [IP_EXEC_STOP] = {"exec.stop", PF_INTERNAL}, [IP_EXEC_SYSTEM_JAIL_USER]= {"exec.system_jail_user", PF_INTERNAL | PF_BOOL}, [IP_EXEC_SYSTEM_USER] = {"exec.system_user", PF_INTERNAL}, [IP_EXEC_TIMEOUT] = {"exec.timeout", PF_INTERNAL | PF_INT}, #if defined(INET) || defined(INET6) [IP_INTERFACE] = {"interface", PF_INTERNAL}, [IP_IP_HOSTNAME] = {"ip_hostname", PF_INTERNAL | PF_BOOL}, #endif [IP_MOUNT] = {"mount", PF_INTERNAL | PF_REV}, [IP_MOUNT_DEVFS] = {"mount.devfs", PF_INTERNAL | PF_BOOL}, [IP_MOUNT_FDESCFS] = {"mount.fdescfs", PF_INTERNAL | PF_BOOL}, [IP_MOUNT_PROCFS] = {"mount.procfs", PF_INTERNAL | PF_BOOL}, [IP_MOUNT_FSTAB] = {"mount.fstab", PF_INTERNAL}, [IP_STOP_TIMEOUT] = {"stop.timeout", PF_INTERNAL | PF_INT}, [IP_VNET_INTERFACE] = {"vnet.interface", PF_INTERNAL}, [IP_ZFS_DATASET] = {"zfs.dataset", PF_INTERNAL}, #ifdef INET [IP__IP4_IFADDR] = {"ip4.addr", PF_INTERNAL | PF_CONV | PF_REV}, #endif #ifdef INET6 [IP__IP6_IFADDR] = {"ip6.addr", PF_INTERNAL | PF_CONV | PF_REV}, #endif [IP__MOUNT_FROM_FSTAB] = {"mount.fstab", PF_INTERNAL | PF_CONV | PF_REV}, [IP__OP] = {NULL, PF_CONV}, [KP_ALLOW_CHFLAGS] = {"allow.chflags", 0}, [KP_ALLOW_MOUNT] = {"allow.mount", 0}, [KP_ALLOW_RAW_SOCKETS] = {"allow.raw_sockets", 0}, [KP_ALLOW_SET_HOSTNAME]= {"allow.set_hostname", 0}, [KP_ALLOW_SOCKET_AF] = {"allow.socket_af", 0}, [KP_ALLOW_SYSVIPC] = {"allow.sysvipc", 0}, [KP_DEVFS_RULESET] = {"devfs_ruleset", 0}, [KP_HOST_HOSTNAME] = {"host.hostname", 0}, #ifdef INET [KP_IP4_ADDR] = {"ip4.addr", 0}, #endif #ifdef INET6 [KP_IP6_ADDR] = {"ip6.addr", 0}, #endif [KP_JID] = {"jid", PF_IMMUTABLE}, [KP_NAME] = {"name", PF_IMMUTABLE}, [KP_PATH] = {"path", 0}, [KP_PERSIST] = {"persist", 0}, [KP_SECURELEVEL] = {"securelevel", 0}, [KP_VNET] = {"vnet", 0}, }; /* * Parse the jail configuration file. */ void load_config(const char *cfname) { struct cfjails wild; struct cfparams opp; struct cfjail *j, *tj, *wj; struct cfparam *p, *vp, *tp; struct cfstring *s, *vs, *ns; struct cfvar *v, *vv; char *ep; int did_self, jseq, pgen; parse_config(cfname, !strcmp(cfname, "-")); /* Separate the wildcard jails out from the actual jails. */ jseq = 0; TAILQ_INIT(&wild); TAILQ_FOREACH_SAFE(j, &cfjails, tq, tj) { j->seq = ++jseq; if (wild_jail_name(j->name)) requeue(j, &wild); } TAILQ_FOREACH(j, &cfjails, tq) { /* Set aside the jail's parameters. */ TAILQ_INIT(&opp); TAILQ_CONCAT(&opp, &j->params, tq); /* * The jail name implies its "name" or "jid" parameter, - * though they may also be explicitly set later on. + * though they may also be explicitly set later on. After we + * collect other parameters, we'll go back and ensure they're + * both set if we need to do so here. */ add_param(j, NULL, strtol(j->name, &ep, 10) && !*ep ? KP_JID : KP_NAME, j->name); + /* * Collect parameters for the jail, global parameters/variables, * and any matching wildcard jails. */ did_self = 0; TAILQ_FOREACH(wj, &wild, tq) { if (j->seq < wj->seq && !did_self) { TAILQ_FOREACH(p, &opp, tq) add_param(j, p, 0, NULL); did_self = 1; } if (wild_jail_match(j->name, wj->name)) TAILQ_FOREACH(p, &wj->params, tq) add_param(j, p, 0, NULL); } if (!did_self) TAILQ_FOREACH(p, &opp, tq) add_param(j, p, 0, NULL); + /* + * We only backfill if it's the name that wasn't set; if it was + * the jid, we can assume that will be populated later when the + * jail is created or found. + */ + if (j->intparams[KP_NAME] == NULL) + add_param(j, j->intparams[KP_JID], KP_NAME, NULL); + /* Resolve any variable substitutions. */ pgen = 0; TAILQ_FOREACH(p, &j->params, tq) { p->gen = ++pgen; find_vars: TAILQ_FOREACH(s, &p->val, tq) { while ((v = STAILQ_FIRST(&s->vars))) { TAILQ_FOREACH(vp, &j->params, tq) if (!strcmp(vp->name, v->name)) break; if (!vp || TAILQ_EMPTY(&vp->val)) { jail_warnx(j, "%s: variable \"%s\" not found", p->name, v->name); bad_var: j->flags |= JF_FAILED; TAILQ_FOREACH(vp, &j->params, tq) if (vp->gen == pgen) vp->flags |= PF_BAD; goto free_var; } if (vp->flags & PF_BAD) goto bad_var; if (vp->gen == pgen) { jail_warnx(j, "%s: variable loop", v->name); goto bad_var; } TAILQ_FOREACH(vs, &vp->val, tq) if (!STAILQ_EMPTY(&vs->vars)) { vp->gen = pgen; TAILQ_REMOVE(&j->params, vp, tq); TAILQ_INSERT_BEFORE(p, vp, tq); p = vp; goto find_vars; } vs = TAILQ_FIRST(&vp->val); if (TAILQ_NEXT(vs, tq) != NULL && (s->s[0] != '\0' || STAILQ_NEXT(v, tq))) { jail_warnx(j, "%s: array cannot be " "substituted inline", p->name); goto bad_var; } s->s = erealloc(s->s, s->len + vs->len + 1); memmove(s->s + v->pos + vs->len, s->s + v->pos, s->len - v->pos + 1); memcpy(s->s + v->pos, vs->s, vs->len); vv = v; while ((vv = STAILQ_NEXT(vv, tq))) vv->pos += vs->len; s->len += vs->len; while ((vs = TAILQ_NEXT(vs, tq))) { ns = emalloc(sizeof(struct cfstring)); ns->s = estrdup(vs->s); ns->len = vs->len; STAILQ_INIT(&ns->vars); TAILQ_INSERT_AFTER(&p->val, s, ns, tq); s = ns; } free_var: free(v->name); STAILQ_REMOVE_HEAD(&s->vars, tq); free(v); } } } /* Free the jail's original parameter list and any variables. */ while ((p = TAILQ_FIRST(&opp))) free_param(&opp, p); TAILQ_FOREACH_SAFE(p, &j->params, tq, tp) if (p->flags & PF_VAR) free_param(&j->params, p); } while ((wj = TAILQ_FIRST(&wild))) { free(wj->name); while ((p = TAILQ_FIRST(&wj->params))) free_param(&wj->params, p); TAILQ_REMOVE(&wild, wj, tq); } } void include_config(void *scanner, const char *cfname) { static unsigned int depth; glob_t g = {0}; const char *slash; char *fullpath = NULL; /* Simple sanity check for include loops. */ if (++depth > MAX_INCLUDE_DEPTH) errx(1, "maximum include depth exceeded"); /* Base relative pathnames on the current config file. */ if (yyget_in(scanner) != stdin && cfname[0] != '/') { const char *outer_cfname = yyget_extra(scanner)->cfname; if ((slash = strrchr(outer_cfname, '/')) != NULL) { size_t dirlen = (slash - outer_cfname) + 1; fullpath = emalloc(dirlen + strlen(cfname) + 1); strncpy(fullpath, outer_cfname, dirlen); strcpy(fullpath + dirlen, cfname); cfname = fullpath; } } /* * Check if the include statement had a filename glob. * Globbing doesn't need to catch any files, but a non-glob * file needs to exist (enforced by parse_config). */ if (glob(cfname, GLOB_NOCHECK, NULL, &g) != 0) errx(1, "%s: filename glob failed", cfname); if (g.gl_flags & GLOB_MAGCHAR) { for (size_t gi = 0; gi < g.gl_matchc; gi++) parse_config(g.gl_pathv[gi], 0); } else parse_config(cfname, 0); if (fullpath) free(fullpath); --depth; } static void parse_config(const char *cfname, int is_stdin) { struct cflex cflex = {.cfname = cfname, .error = 0}; void *scanner; yylex_init_extra(&cflex, &scanner); if (is_stdin) { cflex.cfname = "STDIN"; yyset_in(stdin, scanner); } else { FILE *yfp = fopen(cfname, "r"); if (!yfp) err(1, "%s", cfname); yyset_in(yfp, scanner); } if (yyparse(scanner) || cflex.error) exit(1); yylex_destroy(scanner); } /* * Create a new jail record. */ struct cfjail * add_jail(void) { struct cfjail *j; j = emalloc(sizeof(struct cfjail)); memset(j, 0, sizeof(struct cfjail)); TAILQ_INIT(&j->params); STAILQ_INIT(&j->dep[DEP_FROM]); STAILQ_INIT(&j->dep[DEP_TO]); j->queue = &cfjails; TAILQ_INSERT_TAIL(&cfjails, j, tq); return j; } /* * Add a parameter to a jail. */ void add_param(struct cfjail *j, const struct cfparam *p, enum intparam ipnum, const char *value) { struct cfstrings nss; struct cfparam *dp, *np; struct cfstring *s, *ns; struct cfvar *v, *nv; const char *name; char *cs, *tname; unsigned flags; if (j == NULL) { /* Create a single anonymous jail if one doesn't yet exist. */ j = TAILQ_LAST(&cfjails, cfjails); if (j == NULL) j = add_jail(); } TAILQ_INIT(&nss); if (p != NULL) { name = p->name; flags = p->flags; /* * Make a copy of the parameter's string list, * which may be freed if it's overridden later. */ TAILQ_FOREACH(s, &p->val, tq) { ns = emalloc(sizeof(struct cfstring)); ns->s = estrdup(s->s); ns->len = s->len; STAILQ_INIT(&ns->vars); STAILQ_FOREACH(v, &s->vars, tq) { nv = emalloc(sizeof(struct cfvar)); nv->name = strdup(v->name); nv->pos = v->pos; STAILQ_INSERT_TAIL(&ns->vars, nv, tq); } TAILQ_INSERT_TAIL(&nss, ns, tq); } } else { flags = PF_APPEND; if (ipnum != IP__NULL) { name = intparams[ipnum].name; flags |= intparams[ipnum].flags; } else if ((cs = strchr(value, '='))) { tname = alloca(cs - value + 1); strlcpy(tname, value, cs - value + 1); name = tname; value = cs + 1; } else { name = value; value = NULL; } if (value != NULL) { ns = emalloc(sizeof(struct cfstring)); ns->s = estrdup(value); ns->len = strlen(value); STAILQ_INIT(&ns->vars); TAILQ_INSERT_TAIL(&nss, ns, tq); } } /* See if this parameter has already been added. */ if (ipnum != IP__NULL) dp = j->intparams[ipnum]; else TAILQ_FOREACH(dp, &j->params, tq) if (!(dp->flags & PF_CONV) && equalopts(dp->name, name)) break; if (dp != NULL) { /* Found it - append or replace. */ if ((flags ^ dp->flags) & PF_VAR) { jail_warnx(j, "variable \"$%s\" cannot have the same " "name as a parameter.", name); j->flags |= JF_FAILED; return; } if (dp->flags & PF_IMMUTABLE) { jail_warnx(j, "cannot redefine parameter \"%s\".", dp->name); j->flags |= JF_FAILED; return; } if (strcmp(dp->name, name)) { free(dp->name); dp->name = estrdup(name); } if (!(flags & PF_APPEND) || TAILQ_EMPTY(&nss)) free_param_strings(dp); TAILQ_CONCAT(&dp->val, &nss, tq); dp->flags |= flags; } else { /* Not found - add it. */ np = emalloc(sizeof(struct cfparam)); np->name = estrdup(name); TAILQ_INIT(&np->val); TAILQ_CONCAT(&np->val, &nss, tq); np->flags = flags; np->gen = 0; TAILQ_INSERT_TAIL(&j->params, np, tq); if (ipnum != IP__NULL) j->intparams[ipnum] = np; else for (ipnum = IP__NULL + 1; ipnum < IP_NPARAM; ipnum++) if (!(intparams[ipnum].flags & PF_CONV) && equalopts(name, intparams[ipnum].name)) { if (flags & PF_VAR) { jail_warnx(j, "variable \"$%s\" " "cannot have the same " "name as a parameter.", name); j->flags |= JF_FAILED; return; } j->intparams[ipnum] = np; np->flags |= intparams[ipnum].flags; break; } } } /* * Return if a boolean parameter exists and is true. */ int bool_param(const struct cfparam *p) { const char *cs; if (p == NULL) return 0; cs = strrchr(p->name, '.'); return !strncmp(cs ? cs + 1 : p->name, "no", 2) ^ (TAILQ_EMPTY(&p->val) || !strcasecmp(TAILQ_LAST(&p->val, cfstrings)->s, "true") || (strtol(TAILQ_LAST(&p->val, cfstrings)->s, NULL, 10))); } /* * Set an integer if a parameter if it exists. */ int int_param(const struct cfparam *p, int *ip) { if (p == NULL || TAILQ_EMPTY(&p->val)) return 0; *ip = strtol(TAILQ_LAST(&p->val, cfstrings)->s, NULL, 10); return 1; } /* * Return the string value of a scalar parameter if it exists. */ const char * string_param(const struct cfparam *p) { return (p && !TAILQ_EMPTY(&p->val) ? TAILQ_LAST(&p->val, cfstrings)->s : NULL); } /* * Check syntax and values of internal parameters. Set some internal * parameters based on the values of others. */ int check_intparams(struct cfjail *j) { struct cfparam *p; struct cfstring *s; FILE *f; const char *val; char *cs, *ep, *ln; size_t lnlen; int error; #if defined(INET) || defined(INET6) struct addrinfo hints; struct addrinfo *ai0, *ai; const char *hostname; int gicode, defif; #endif #ifdef INET struct in_addr addr4; int ip4ok; char avalue4[INET_ADDRSTRLEN]; #endif #ifdef INET6 struct in6_addr addr6; int ip6ok; char avalue6[INET6_ADDRSTRLEN]; #endif error = 0; /* Check format of boolan and integer values. */ TAILQ_FOREACH(p, &j->params, tq) { if (!TAILQ_EMPTY(&p->val) && (p->flags & (PF_BOOL | PF_INT))) { val = TAILQ_LAST(&p->val, cfstrings)->s; if (p->flags & PF_BOOL) { if (strcasecmp(val, "false") && strcasecmp(val, "true") && ((void)strtol(val, &ep, 10), *ep)) { jail_warnx(j, "%s: unknown boolean value \"%s\"", p->name, val); error = -1; } } else { (void)strtol(val, &ep, 10); if (ep == val || *ep) { jail_warnx(j, "%s: non-integer value \"%s\"", p->name, val); error = -1; } } } } #if defined(INET) || defined(INET6) /* * The ip_hostname parameter looks up the hostname, and adds parameters * for any IP addresses it finds. */ if (((j->flags & JF_OP_MASK) != JF_STOP || j->intparams[IP_INTERFACE] != NULL) && bool_param(j->intparams[IP_IP_HOSTNAME]) && (hostname = string_param(j->intparams[KP_HOST_HOSTNAME]))) { j->intparams[IP_IP_HOSTNAME] = NULL; /* * Silently ignore unsupported address families from * DNS lookups. */ #ifdef INET ip4ok = feature_present("inet"); #endif #ifdef INET6 ip6ok = feature_present("inet6"); #endif if ( #if defined(INET) && defined(INET6) ip4ok || ip6ok #elif defined(INET) ip4ok #elif defined(INET6) ip6ok #endif ) { /* Look up the hostname (or get the address) */ memset(&hints, 0, sizeof(hints)); hints.ai_socktype = SOCK_STREAM; hints.ai_family = #if defined(INET) && defined(INET6) ip4ok ? (ip6ok ? PF_UNSPEC : PF_INET) : PF_INET6; #elif defined(INET) PF_INET; #elif defined(INET6) PF_INET6; #endif gicode = getaddrinfo(hostname, NULL, &hints, &ai0); if (gicode != 0) { jail_warnx(j, "host.hostname %s: %s", hostname, gai_strerror(gicode)); error = -1; } else { /* * Convert the addresses to ASCII so jailparam * can convert them back. Errors are not * expected here. */ for (ai = ai0; ai; ai = ai->ai_next) switch (ai->ai_family) { #ifdef INET case AF_INET: memcpy(&addr4, &((struct sockaddr_in *) (void *)ai->ai_addr)-> sin_addr, sizeof(addr4)); if (inet_ntop(AF_INET, &addr4, avalue4, INET_ADDRSTRLEN) == NULL) err(1, "inet_ntop"); add_param(j, NULL, KP_IP4_ADDR, avalue4); break; #endif #ifdef INET6 case AF_INET6: memcpy(&addr6, &((struct sockaddr_in6 *) (void *)ai->ai_addr)-> sin6_addr, sizeof(addr6)); if (inet_ntop(AF_INET6, &addr6, avalue6, INET6_ADDRSTRLEN) == NULL) err(1, "inet_ntop"); add_param(j, NULL, KP_IP6_ADDR, avalue6); break; #endif } freeaddrinfo(ai0); } } } /* * IP addresses may include an interface to set that address on, * a netmask/suffix for that address and options for ifconfig. * These are copied to an internal command parameter and then stripped * so they won't be passed on to jailparam_set. */ defif = string_param(j->intparams[IP_INTERFACE]) != NULL; #ifdef INET if (j->intparams[KP_IP4_ADDR] != NULL) { TAILQ_FOREACH(s, &j->intparams[KP_IP4_ADDR]->val, tq) { cs = strchr(s->s, '|'); if (cs || defif) add_param(j, NULL, IP__IP4_IFADDR, s->s); if (cs) { s->len -= cs + 1 - s->s; memmove(s->s, cs + 1, s->len + 1); } if ((cs = strchr(s->s, '/')) != NULL) { *cs = '\0'; s->len = cs - s->s; } if ((cs = strchr(s->s, ' ')) != NULL) { *cs = '\0'; s->len = cs - s->s; } } } #endif #ifdef INET6 if (j->intparams[KP_IP6_ADDR] != NULL) { TAILQ_FOREACH(s, &j->intparams[KP_IP6_ADDR]->val, tq) { cs = strchr(s->s, '|'); if (cs || defif) add_param(j, NULL, IP__IP6_IFADDR, s->s); if (cs) { s->len -= cs + 1 - s->s; memmove(s->s, cs + 1, s->len + 1); } if ((cs = strchr(s->s, '/')) != NULL) { *cs = '\0'; s->len = cs - s->s; } if ((cs = strchr(s->s, ' ')) != NULL) { *cs = '\0'; s->len = cs - s->s; } } } #endif #endif /* * Read mount.fstab file(s), and treat each line as its own mount * parameter. */ if (j->intparams[IP_MOUNT_FSTAB] != NULL) { TAILQ_FOREACH(s, &j->intparams[IP_MOUNT_FSTAB]->val, tq) { if (s->len == 0) continue; f = fopen(s->s, "r"); if (f == NULL) { jail_warnx(j, "mount.fstab: %s: %s", s->s, strerror(errno)); error = -1; continue; } while ((ln = fgetln(f, &lnlen))) { if ((cs = memchr(ln, '#', lnlen - 1))) lnlen = cs - ln + 1; if (ln[lnlen - 1] == '\n' || ln[lnlen - 1] == '#') ln[lnlen - 1] = '\0'; else { cs = alloca(lnlen + 1); strlcpy(cs, ln, lnlen + 1); ln = cs; } add_param(j, NULL, IP__MOUNT_FROM_FSTAB, ln); } fclose(f); } } if (error) failed(j); return error; } /* * Import parameters into libjail's binary jailparam format. */ int import_params(struct cfjail *j) { struct cfparam *p; struct cfstring *s, *ts; struct jailparam *jp; char *value, *cs; size_t vallen; int error; error = 0; j->njp = 0; TAILQ_FOREACH(p, &j->params, tq) if (!(p->flags & PF_INTERNAL)) j->njp++; j->jp = jp = emalloc(j->njp * sizeof(struct jailparam)); TAILQ_FOREACH(p, &j->params, tq) { if (p->flags & PF_INTERNAL) continue; if (jailparam_init(jp, p->name) < 0) { error = -1; jail_warnx(j, "%s", jail_errmsg); jp++; continue; } if (TAILQ_EMPTY(&p->val)) value = NULL; else if (!jp->jp_elemlen || !TAILQ_NEXT(TAILQ_FIRST(&p->val), tq)) { /* * Scalar parameters silently discard multiple (array) * values, keeping only the last value added. This * lets values added from the command line append to * arrays wthout pre-checking the type. */ value = TAILQ_LAST(&p->val, cfstrings)->s; } else { /* * Convert arrays into comma-separated strings, which * jailparam_import will then convert back into arrays. */ vallen = 0; TAILQ_FOREACH(s, &p->val, tq) vallen += s->len + 1; value = alloca(vallen); cs = value; TAILQ_FOREACH_SAFE(s, &p->val, tq, ts) { memcpy(cs, s->s, s->len); cs += s->len + 1; cs[-1] = ','; } value[vallen - 1] = '\0'; } if (jailparam_import(jp, value) < 0) { error = -1; jail_warnx(j, "%s", jail_errmsg); } jp++; } if (error) { jailparam_free(j->jp, j->njp); free(j->jp); j->jp = NULL; failed(j); } return error; } /* * Check if options are equal (with or without the "no" prefix). */ int equalopts(const char *opt1, const char *opt2) { char *p; /* "opt" vs. "opt" or "noopt" vs. "noopt" */ if (strcmp(opt1, opt2) == 0) return (1); /* "noopt" vs. "opt" */ if (strncmp(opt1, "no", 2) == 0 && strcmp(opt1 + 2, opt2) == 0) return (1); /* "opt" vs. "noopt" */ if (strncmp(opt2, "no", 2) == 0 && strcmp(opt1, opt2 + 2) == 0) return (1); while ((p = strchr(opt1, '.')) != NULL && !strncmp(opt1, opt2, ++p - opt1)) { opt2 += p - opt1; opt1 = p; /* "foo.noopt" vs. "foo.opt" */ if (strncmp(opt1, "no", 2) == 0 && strcmp(opt1 + 2, opt2) == 0) return (1); /* "foo.opt" vs. "foo.noopt" */ if (strncmp(opt2, "no", 2) == 0 && strcmp(opt1, opt2 + 2) == 0) return (1); } return (0); } /* * See if a jail name matches a wildcard. */ int wild_jail_match(const char *jname, const char *wname) { const char *jc, *jd, *wc, *wd; /* * A non-final "*" component in the wild name matches a single jail * component, and a final "*" matches one or more jail components. */ for (jc = jname, wc = wname; (jd = strchr(jc, '.')) && (wd = strchr(wc, '.')); jc = jd + 1, wc = wd + 1) if (strncmp(jc, wc, jd - jc + 1) && strncmp(wc, "*.", 2)) return 0; return (!strcmp(jc, wc) || !strcmp(wc, "*")); } /* * Return if a jail name is a wildcard. */ int wild_jail_name(const char *wname) { const char *wc; for (wc = strchr(wname, '*'); wc; wc = strchr(wc + 1, '*')) if ((wc == wname || wc[-1] == '.') && (wc[1] == '\0' || wc[1] == '.')) return 1; return 0; } /* * Free a parameter record and all its strings and variables. */ static void free_param(struct cfparams *pp, struct cfparam *p) { free(p->name); free_param_strings(p); TAILQ_REMOVE(pp, p, tq); free(p); } void free_param_strings(struct cfparam *p) { struct cfstring *s; struct cfvar *v; while ((s = TAILQ_FIRST(&p->val))) { free(s->s); while ((v = STAILQ_FIRST(&s->vars))) { free(v->name); STAILQ_REMOVE_HEAD(&s->vars, tq); free(v); } TAILQ_REMOVE(&p->val, s, tq); free(s); } } diff --git a/usr.sbin/jail/jail.c b/usr.sbin/jail/jail.c index 27769cc14958..46cabf76ae11 100644 --- a/usr.sbin/jail/jail.c +++ b/usr.sbin/jail/jail.c @@ -1,1064 +1,1071 @@ /*- * SPDX-License-Identifier: BSD-2-Clause * * Copyright (c) 1999 Poul-Henning Kamp. * Copyright (c) 2009-2012 James Gritton * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include "jailp.h" #define JP_RDTUN(jp) (((jp)->jp_ctltype & CTLFLAG_RDTUN) == CTLFLAG_RDTUN) struct permspec { const char *name; enum intparam ipnum; int rev; }; int iflag; int note_remove; int verbose; const char *separator = "\t"; static void clear_persist(struct cfjail *j); static int update_jail(struct cfjail *j); static int rdtun_params(struct cfjail *j, int dofail); static void running_jid(struct cfjail *j); static void jail_quoted_warnx(const struct cfjail *j, const char *name_msg, const char *noname_msg); static int jailparam_set_note(const struct cfjail *j, struct jailparam *jp, unsigned njp, int flags); static void print_jail(FILE *fp, struct cfjail *j, int oldcl, int running); static void print_param(FILE *fp, const struct cfparam *p, int sep, int doname); static void show_jails(void); static void quoted_print(FILE *fp, char *str); static void usage(void) __dead2; static struct permspec perm_sysctl[] = { { "security.jail.set_hostname_allowed", KP_ALLOW_SET_HOSTNAME, 0 }, { "security.jail.sysvipc_allowed", KP_ALLOW_SYSVIPC, 0 }, { "security.jail.allow_raw_sockets", KP_ALLOW_RAW_SOCKETS, 0 }, { "security.jail.chflags_allowed", KP_ALLOW_CHFLAGS, 0 }, { "security.jail.mount_allowed", KP_ALLOW_MOUNT, 0 }, { "security.jail.socket_unixiproute_only", KP_ALLOW_SOCKET_AF, 1 }, }; static const enum intparam startcommands[] = { IP__NULL, IP_EXEC_PREPARE, #ifdef INET IP__IP4_IFADDR, #endif #ifdef INET6 IP__IP6_IFADDR, #endif IP_MOUNT, IP__MOUNT_FROM_FSTAB, IP_MOUNT_DEVFS, IP_MOUNT_FDESCFS, IP_MOUNT_PROCFS, IP_EXEC_PRESTART, IP__OP, IP_EXEC_CREATED, IP_ZFS_DATASET, IP_VNET_INTERFACE, IP_EXEC_START, IP_COMMAND, IP_EXEC_POSTSTART, IP__NULL }; static const enum intparam stopcommands[] = { IP__NULL, IP_EXEC_PRESTOP, IP_EXEC_STOP, IP_STOP_TIMEOUT, IP__OP, IP_EXEC_POSTSTOP, IP_MOUNT_PROCFS, IP_MOUNT_FDESCFS, IP_MOUNT_DEVFS, IP__MOUNT_FROM_FSTAB, IP_MOUNT, #ifdef INET6 IP__IP6_IFADDR, #endif #ifdef INET IP__IP4_IFADDR, #endif IP_EXEC_RELEASE, IP__NULL }; static const enum intparam cleancommands[] = { IP__NULL, IP_EXEC_POSTSTOP, IP_MOUNT_PROCFS, IP_MOUNT_FDESCFS, IP_MOUNT_DEVFS, IP__MOUNT_FROM_FSTAB, IP_MOUNT, #ifdef INET6 IP__IP6_IFADDR, #endif #ifdef INET IP__IP4_IFADDR, #endif IP_EXEC_RELEASE, IP__NULL }; static const struct { const char *name; enum intparam param; } listparams[] = { #ifdef INET { "ip4.addr", KP_IP4_ADDR }, #endif #ifdef INET6 { "ip6.addr", KP_IP6_ADDR }, #endif { "vnet.interface", IP_VNET_INTERFACE }, { "zfs.dataset", IP_ZFS_DATASET }, }; int main(int argc, char **argv) { struct stat st; FILE *jfp; struct cfjail *j; char *JidFile; const char *cfname; size_t sysvallen; unsigned op, pi; int ch, docf, dying_warned, error, i, oldcl, sysval; int dflag, eflag, Rflag; #if defined(INET) || defined(INET6) char *cs, *ncs; #endif #if defined(INET) && defined(INET6) struct in6_addr addr6; #endif op = 0; dflag = eflag = Rflag = 0; docf = 1; cfname = CONF_FILE; JidFile = NULL; while ((ch = getopt(argc, argv, "cCde:f:hiJ:lmn:p:qrRs:u:U:v")) != -1) { switch (ch) { case 'c': op |= JF_START; break; case 'C': op |= JF_CLEANUP; break; case 'd': dflag = 1; break; case 'e': eflag = 1; separator = optarg; break; case 'f': cfname = optarg; break; case 'h': #if defined(INET) || defined(INET6) add_param(NULL, NULL, IP_IP_HOSTNAME, NULL); #endif docf = 0; break; case 'i': iflag = 1; verbose = -1; break; case 'J': JidFile = optarg; break; case 'l': add_param(NULL, NULL, IP_EXEC_CLEAN, NULL); docf = 0; break; case 'm': op |= JF_SET; break; case 'n': add_param(NULL, NULL, KP_NAME, optarg); docf = 0; break; case 'p': paralimit = strtol(optarg, NULL, 10); if (paralimit == 0) paralimit = -1; break; case 'q': verbose = -1; break; case 'r': op |= JF_STOP; break; case 'R': op |= JF_STOP; Rflag = 1; break; case 's': add_param(NULL, NULL, KP_SECURELEVEL, optarg); docf = 0; break; case 'u': add_param(NULL, NULL, IP_EXEC_JAIL_USER, optarg); add_param(NULL, NULL, IP_EXEC_SYSTEM_JAIL_USER, NULL); docf = 0; break; case 'U': add_param(NULL, NULL, IP_EXEC_JAIL_USER, optarg); add_param(NULL, NULL, IP_EXEC_SYSTEM_JAIL_USER, "false"); docf = 0; break; case 'v': verbose = 1; break; default: usage(); } } argc -= optind; argv += optind; if (eflag) { /* Just print list of all configured non-wildcard jails */ if (op || argc > 0) usage(); load_config(cfname); show_jails(); exit(0); } /* Find out which of the command line styles this is. */ oldcl = 0; if (!op) { /* Old-style command line with four fixed parameters */ if (argc < 4 || argv[0][0] != '/') usage(); op = JF_START; docf = 0; oldcl = 1; add_param(NULL, NULL, KP_PATH, argv[0]); add_param(NULL, NULL, KP_HOST_HOSTNAME, argv[1]); #if defined(INET) || defined(INET6) if (argv[2][0] != '\0') { for (cs = argv[2];; cs = ncs + 1) { ncs = strchr(cs, ','); if (ncs) *ncs = '\0'; add_param(NULL, NULL, #if defined(INET) && defined(INET6) inet_pton(AF_INET6, cs, &addr6) == 1 ? KP_IP6_ADDR : KP_IP4_ADDR, #elif defined(INET) KP_IP4_ADDR, #elif defined(INET6) KP_IP6_ADDR, #endif cs); if (!ncs) break; } } #endif for (i = 3; i < argc; i++) add_param(NULL, NULL, IP_COMMAND, argv[i]); /* Emulate the defaults from security.jail.* sysctls. */ sysvallen = sizeof(sysval); if (sysctlbyname("security.jail.jailed", &sysval, &sysvallen, NULL, 0) == 0 && sysval == 0) { for (pi = 0; pi < sizeof(perm_sysctl) / sizeof(perm_sysctl[0]); pi++) { sysvallen = sizeof(sysval); if (sysctlbyname(perm_sysctl[pi].name, &sysval, &sysvallen, NULL, 0) == 0) add_param(NULL, NULL, perm_sysctl[pi].ipnum, (sysval ? 1 : 0) ^ perm_sysctl[pi].rev ? NULL : "false"); } } } else if (op == JF_STOP) { /* Jail remove, perhaps using the config file */ if (!docf || argc == 0) usage(); if (!Rflag) for (i = 0; i < argc; i++) if (strchr(argv[i], '=')) usage(); if ((docf = !Rflag && (!strcmp(cfname, "-") || stat(cfname, &st) == 0))) load_config(cfname); note_remove = docf || argc > 1 || wild_jail_name(argv[0]); } else if (argc > 1 || (argc == 1 && strchr(argv[0], '='))) { /* Single jail specified on the command line */ if (Rflag || (op & JF_CLEANUP)) usage(); docf = 0; for (i = 0; i < argc; i++) { size_t l; if (!strncmp(argv[i], "command", 7) && (argv[i][7] == '\0' || argv[i][7] == '=')) { if (argv[i][7] == '=') add_param(NULL, NULL, IP_COMMAND, argv[i] + 8); for (i++; i < argc; i++) add_param(NULL, NULL, IP_COMMAND, argv[i]); continue; } /* * Is this parameter a list? */ for (l = 0; l < nitems(listparams); l++) { size_t len; len = strlen(listparams[l].name); if (strncmp(argv[i], listparams[l].name, len) || argv[i][len] != '=') continue; for (cs = argv[i] + len + 1;; cs = ncs + 1) { ncs = strchr(cs, ','); if (ncs) *ncs = '\0'; add_param(NULL, NULL, listparams[l].param, cs); if (!ncs) break; } break; } if (l == nitems(listparams)) add_param(NULL, NULL, 0, argv[i]); } } else { /* From the config file, perhaps with a specified jail */ if (Rflag || !docf) usage(); load_config(cfname); } /* Find out which jails will be run. */ dep_setup(docf); error = 0; if ((op & JF_OP_MASK) == JF_STOP) { for (i = 0; i < argc; i++) if (start_state(argv[i], docf, op, Rflag) < 0) error = 1; } else { if (start_state(argv[0], docf, op, 0) < 0) exit(1); } jfp = NULL; if (JidFile != NULL) { jfp = fopen(JidFile, "w"); if (jfp == NULL) err(1, "open %s", JidFile); setlinebuf(jfp); } setlinebuf(stdout); /* * The main loop: Get an available jail and perform the required * operation on it. When that is done, the jail may be finished, * or it may go back for the next step. */ dying_warned = 0; while ((j = next_jail())) { if (j->flags & JF_FAILED) { error = 1; if (j->comparam == NULL) { dep_done(j, 0); continue; } } if (!(j->flags & JF_PARAMS)) { j->flags |= JF_PARAMS; if (dflag) add_param(j, NULL, IP_ALLOW_DYING, NULL); if (check_intparams(j) < 0) continue; if ((j->flags & (JF_START | JF_SET)) && import_params(j) < 0) continue; } if (j->intparams[IP_ALLOW_DYING] && !dying_warned) { warnx("%s", "the 'allow.dying' parameter and '-d' flag " "are deprecated and have no effect."); dying_warned = 1; } if (!j->jid) running_jid(j); if (finish_command(j)) continue; switch (j->flags & JF_OP_MASK) { /* * These operations just turn into a different op * depending on the jail's current status. */ case JF_START_SET: j->flags = j->jid < 0 ? (j->flags & JF_CLEANUP) | JF_START : JF_SET; break; case JF_SET_RESTART: if (j->jid < 0 && !(j->flags & JF_CLEANUP)) { jail_quoted_warnx(j, "not found", "no jail specified"); failed(j); continue; } j->flags = rdtun_params(j, 0) ? (j->flags & JF_CLEANUP) | JF_RESTART : JF_SET; if (j->flags == JF_RESTART) dep_reset(j); break; case JF_START_SET_RESTART: j->flags = j->jid < 0 ? JF_START : rdtun_params(j, 0) ? (j->flags & JF_CLEANUP) | JF_RESTART : JF_SET; if (j->flags == JF_RESTART) dep_reset(j); } switch (j->flags & JF_OP_MASK) { case JF_START: if (j->comparam == NULL) { if (j->jid > 0 && !(j->flags & (JF_DEPEND | JF_WILD))) { jail_quoted_warnx(j, "already exists", NULL); failed(j); continue; } if (dep_check(j)) continue; if (j->jid > 0) goto jail_create_done; if (j->flags & JF_CLEANUP) { j->flags |= JF_STOP; j->comparam = cleancommands; } else j->comparam = startcommands; j->comparam = startcommands; j->comstring = NULL; } if (next_command(j)) continue; if (j->flags & JF_STOP) goto jail_remove_done; jail_create_done: clear_persist(j); if (jfp != NULL) print_jail(jfp, j, oldcl, 1); dep_done(j, 0); break; case JF_SET: if (j->jid < 0 && !(j->flags & JF_DEPEND)) { jail_quoted_warnx(j, "not found", "no jail specified"); failed(j); continue; } if (dep_check(j)) continue; if (!(j->flags & JF_DEPEND)) { if (rdtun_params(j, 1) < 0 || update_jail(j) < 0) continue; if (verbose >= 0 && (j->name || verbose > 0)) jail_note(j, "updated\n"); } dep_done(j, 0); break; case JF_STOP: case JF_RESTART: if (j->comparam == NULL) { if (dep_check(j)) continue; if (j->flags & JF_CLEANUP) { j->comparam = j->jid < 0 ? cleancommands : stopcommands; } else if (j->jid < 0) { if (!(j->flags & (JF_DEPEND|JF_WILD))) { if (verbose >= 0) jail_quoted_warnx(j, "not found", NULL); failed(j); } goto jail_remove_done; } else j->comparam = stopcommands; j->comstring = NULL; } else if ((j->flags & JF_FAILED) && j->jid > 0) goto jail_remove_done; if (next_command(j)) continue; jail_remove_done: dep_done(j, 0); if ((j->flags & (JF_START | JF_FAILED)) == JF_START) { j->comparam = NULL; j->flags &= ~(JF_STOP | JF_CLEANUP); dep_reset(j); requeue(j, j->ndeps ? &depend : &ready); } break; } } if (jfp != NULL) fclose(jfp); exit(error); } /* * Mark a jail's failure for future handling. */ void failed(struct cfjail *j) { j->flags |= JF_FAILED; TAILQ_REMOVE(j->queue, j, tq); TAILQ_INSERT_HEAD(&ready, j, tq); j->queue = &ready; } /* * Exit slightly more gracefully when out of memory. */ void * emalloc(size_t size) { void *p; p = malloc(size); if (!p) err(1, "malloc"); return p; } void * erealloc(void *ptr, size_t size) { void *p; p = realloc(ptr, size); if (!p) err(1, "malloc"); return p; } char * estrdup(const char *str) { char *ns; ns = strdup(str); if (!ns) err(1, "malloc"); return ns; } /* * Print a message including an optional jail name. */ void jail_note(const struct cfjail *j, const char *fmt, ...) { va_list ap, tap; char *cs; size_t len; va_start(ap, fmt); va_copy(tap, ap); len = vsnprintf(NULL, 0, fmt, tap); va_end(tap); cs = alloca(len + 1); (void)vsnprintf(cs, len + 1, fmt, ap); va_end(ap); if (j->name) printf("%s: %s", j->name, cs); else printf("%s", cs); } /* * Print a warning message including an optional jail name. */ void jail_warnx(const struct cfjail *j, const char *fmt, ...) { va_list ap, tap; char *cs; size_t len; va_start(ap, fmt); va_copy(tap, ap); len = vsnprintf(NULL, 0, fmt, tap); va_end(tap); cs = alloca(len + 1); (void)vsnprintf(cs, len + 1, fmt, ap); va_end(ap); if (j->name) warnx("%s: %s", j->name, cs); else warnx("%s", cs); } /* * Create a new jail. */ int create_jail(struct cfjail *j) { struct stat st; struct jailparam *jp, *setparams, *sjp; const char *path; int dopersist, ns; /* * Check the jail's path, with a better error message than jail_set * gives. */ if ((path = string_param(j->intparams[KP_PATH]))) { if (j->name != NULL && path[0] != '/') { jail_warnx(j, "path %s: not an absolute pathname", path); return -1; } if (stat(path, &st) < 0) { jail_warnx(j, "path %s: %s", path, strerror(errno)); return -1; } if (!S_ISDIR(st.st_mode)) { jail_warnx(j, "path %s: %s", path, strerror(ENOTDIR)); return -1; } } /* * Copy all the parameters, except that "persist" is always set when * there are commands to run later. */ dopersist = !bool_param(j->intparams[KP_PERSIST]) && (j->intparams[IP_EXEC_START] || j->intparams[IP_COMMAND] || j->intparams[IP_EXEC_POSTSTART]); sjp = setparams = alloca((j->njp + dopersist) * sizeof(struct jailparam)); if (dopersist && jailparam_init(sjp++, "persist") < 0) { jail_warnx(j, "%s", jail_errmsg); return -1; } for (jp = j->jp; jp < j->jp + j->njp; jp++) if (!dopersist || !equalopts(jp->jp_name, "persist")) *sjp++ = *jp; ns = sjp - setparams; j->jid = jailparam_set_note(j, setparams, ns, JAIL_CREATE); if (j->jid < 0) { jail_warnx(j, "%s", jail_errmsg); failed(j); } if (dopersist) { jailparam_free(setparams, 1); if (j->jid > 0) j->flags |= JF_PERSIST; } return j->jid; } /* * Remove a temporarily set "persist" parameter. */ static void clear_persist(struct cfjail *j) { struct iovec jiov[4]; int jid; if (!(j->flags & JF_PERSIST)) return; j->flags &= ~JF_PERSIST; jiov[0].iov_base = __DECONST(char *, "jid"); jiov[0].iov_len = sizeof("jid"); jiov[1].iov_base = &j->jid; jiov[1].iov_len = sizeof(j->jid); jiov[2].iov_base = __DECONST(char *, "nopersist"); jiov[2].iov_len = sizeof("nopersist"); jiov[3].iov_base = NULL; jiov[3].iov_len = 0; jid = jail_set(jiov, 4, JAIL_UPDATE); if (verbose > 0) jail_note(j, "jail_set(JAIL_UPDATE) jid=%d nopersist%s%s\n", j->jid, jid < 0 ? ": " : "", jid < 0 ? strerror(errno) : ""); } /* * Set a jail's parameters. */ static int update_jail(struct cfjail *j) { struct jailparam *jp, *setparams, *sjp; int ns, jid; ns = 0; for (jp = j->jp; jp < j->jp + j->njp; jp++) if (!JP_RDTUN(jp)) ns++; if (ns == 0) return 0; sjp = setparams = alloca(++ns * sizeof(struct jailparam)); if (jailparam_init(sjp, "jid") < 0 || jailparam_import_raw(sjp, &j->jid, sizeof j->jid) < 0) { jail_warnx(j, "%s", jail_errmsg); failed(j); return -1; } for (jp = j->jp; jp < j->jp + j->njp; jp++) if (!JP_RDTUN(jp)) *++sjp = *jp; jid = jailparam_set_note(j, setparams, ns, JAIL_UPDATE); if (jid < 0) { jail_warnx(j, "%s", jail_errmsg); failed(j); } jailparam_free(setparams, 1); return jid; } /* * Return if a jail set would change any create-only parameters. */ static int rdtun_params(struct cfjail *j, int dofail) { struct jailparam *jp, *rtparams, *rtjp; const void *jp_value; size_t jp_valuelen; int nrt, rval, bool_true; if (j->flags & JF_RDTUN) return 0; j->flags |= JF_RDTUN; nrt = 0; for (jp = j->jp; jp < j->jp + j->njp; jp++) if (JP_RDTUN(jp) && strcmp(jp->jp_name, "jid")) nrt++; if (nrt == 0) return 0; rtjp = rtparams = alloca(++nrt * sizeof(struct jailparam)); if (jailparam_init(rtjp, "jid") < 0 || jailparam_import_raw(rtjp, &j->jid, sizeof j->jid) < 0) { jail_warnx(j, "%s", jail_errmsg); exit(1); } for (jp = j->jp; jp < j->jp + j->njp; jp++) if (JP_RDTUN(jp) && strcmp(jp->jp_name, "jid")) { *++rtjp = *jp; rtjp->jp_value = NULL; } rval = 0; if (jailparam_get(rtparams, nrt, 0) > 0) { rtjp = rtparams + 1; for (jp = j->jp; rtjp < rtparams + nrt; jp++) { if (JP_RDTUN(jp) && strcmp(jp->jp_name, "jid")) { jp_value = jp->jp_value; jp_valuelen = jp->jp_valuelen; if (jp_value == NULL && jp_valuelen > 0) { if (jp->jp_flags & (JP_BOOL | JP_NOBOOL | JP_JAILSYS)) { bool_true = 1; jp_value = &bool_true; jp_valuelen = sizeof(bool_true); } else if ((jp->jp_ctltype & CTLTYPE) == CTLTYPE_STRING) jp_value = ""; else jp_valuelen = 0; } if (rtjp->jp_valuelen != jp_valuelen || (CTLTYPE_STRING ? strncmp(rtjp->jp_value, jp_value, jp_valuelen) : memcmp(rtjp->jp_value, jp_value, jp_valuelen))) { if (dofail) { jail_warnx(j, "%s cannot be " "changed after creation", jp->jp_name); failed(j); rval = -1; } else rval = 1; break; } rtjp++; } } } for (rtjp = rtparams + 1; rtjp < rtparams + nrt; rtjp++) rtjp->jp_name = NULL; jailparam_free(rtparams, nrt); return rval; } /* * Get the jail's jid if it is running. */ static void running_jid(struct cfjail *j) { struct iovec jiov[2]; const char *pval; char *ep; int jid; if ((pval = string_param(j->intparams[KP_JID]))) { if (!(jid = strtol(pval, &ep, 10)) || *ep) { j->jid = -1; return; } jiov[0].iov_base = __DECONST(char *, "jid"); jiov[0].iov_len = sizeof("jid"); jiov[1].iov_base = &jid; jiov[1].iov_len = sizeof(jid); } else if ((pval = string_param(j->intparams[KP_NAME]))) { jiov[0].iov_base = __DECONST(char *, "name"); jiov[0].iov_len = sizeof("name"); jiov[1].iov_len = strlen(pval) + 1; jiov[1].iov_base = alloca(jiov[1].iov_len); strcpy(jiov[1].iov_base, pval); } else { j->jid = -1; return; } + j->jid = jail_get(jiov, 2, 0); + if (j->jid > 0 && j->intparams[KP_JID] == NULL) { + char jidstr[16]; + + (void)snprintf(jidstr, sizeof(jidstr), "%d", j->jid); + add_param(j, NULL, KP_JID, jidstr); + } } static void jail_quoted_warnx(const struct cfjail *j, const char *name_msg, const char *noname_msg) { const char *pval; if ((pval = j->name) || (pval = string_param(j->intparams[KP_JID])) || (pval = string_param(j->intparams[KP_NAME]))) warnx("\"%s\" %s", pval, name_msg); else warnx("%s", noname_msg); } /* * Set jail parameters and possibly print them out. */ static int jailparam_set_note(const struct cfjail *j, struct jailparam *jp, unsigned njp, int flags) { char *value; int jid; unsigned i; jid = jailparam_set(jp, njp, flags); if (verbose > 0) { jail_note(j, "jail_set(%s)", (flags & (JAIL_CREATE | JAIL_UPDATE)) == JAIL_CREATE ? "JAIL_CREATE" : "JAIL_UPDATE"); for (i = 0; i < njp; i++) { printf(" %s", jp[i].jp_name); if (jp[i].jp_value == NULL) continue; putchar('='); value = jailparam_export(jp + i); if (value == NULL) err(1, "jailparam_export"); quoted_print(stdout, value); free(value); } if (jid < 0) printf(": %s", strerror(errno)); printf("\n"); } return jid; } /* * Print a jail record. */ static void print_jail(FILE *fp, struct cfjail *j, int oldcl, int running) { struct cfparam *p; int printsep; if (oldcl) { if (running) fprintf(fp, "%d%s", j->jid, separator); print_param(fp, j->intparams[KP_PATH], ',', 0); fputs(separator, fp); print_param(fp, j->intparams[KP_HOST_HOSTNAME], ',', 0); fputs(separator, fp); #ifdef INET print_param(fp, j->intparams[KP_IP4_ADDR], ',', 0); #ifdef INET6 if (j->intparams[KP_IP4_ADDR] && !TAILQ_EMPTY(&j->intparams[KP_IP4_ADDR]->val) && j->intparams[KP_IP6_ADDR] && !TAILQ_EMPTY(&j->intparams[KP_IP6_ADDR]->val)) putc(',', fp); #endif #endif #ifdef INET6 print_param(fp, j->intparams[KP_IP6_ADDR], ',', 0); #endif fputs(separator, fp); print_param(fp, j->intparams[IP_COMMAND], ' ', 0); } else { printsep = 0; if (running) { fprintf(fp, "jid=%d", j->jid); printsep = 1; } TAILQ_FOREACH(p, &j->params, tq) if (strcmp(p->name, "jid")) { if (printsep) fputs(separator, fp); else printsep = 1; print_param(fp, p, ',', 1); } } putc('\n', fp); } /* * Exhibit list of all configured non-wildcard jails */ static void show_jails(void) { struct cfjail *j; TAILQ_FOREACH(j, &cfjails, tq) print_jail(stdout, j, 0, 0); } /* * Print a parameter value, or a name=value pair. */ static void print_param(FILE *fp, const struct cfparam *p, int sep, int doname) { const struct cfstring *s, *ts; if (doname) fputs(p->name, fp); if (p == NULL || TAILQ_EMPTY(&p->val)) return; if (doname) putc('=', fp); TAILQ_FOREACH_SAFE(s, &p->val, tq, ts) { quoted_print(fp, s->s); if (ts != NULL) putc(sep, fp); } } /* * Print a string with quotes around spaces. */ static void quoted_print(FILE *fp, char *str) { int c, qc; char *p = str; qc = !*p ? '"' : strchr(p, '\'') ? '"' : strchr(p, '"') ? '\'' : strchr(p, ' ') || strchr(p, '\t') ? '"' : 0; if (qc) putc(qc, fp); while ((c = *p++)) { if (c == '\\' || c == qc) putc('\\', fp); putc(c, fp); } if (qc) putc(qc, fp); } static void usage(void) { (void)fprintf(stderr, "usage: jail [-dhilqv] [-J jid_file] [-u username] [-U username]\n" " -[cmr] param=value ... [command=command ...]\n" " jail [-dqv] [-f file] -[cmr] [jail]\n" " jail [-qv] [-f file] -[rR] ['*' | jail ...]\n" " jail [-dhilqv] [-J jid_file] [-u username] [-U username]\n" " [-n jailname] [-s securelevel]\n" " path hostname ip[,...] command ...\n" " jail [-f file] -e separator\n"); exit(1); } diff --git a/usr.sbin/jail/tests/jail_basic_test.sh b/usr.sbin/jail/tests/jail_basic_test.sh index f3c8be4a6595..509900e8569c 100755 --- a/usr.sbin/jail/tests/jail_basic_test.sh +++ b/usr.sbin/jail/tests/jail_basic_test.sh @@ -1,175 +1,304 @@ # # SPDX-License-Identifier: BSD-2-Clause # # Copyright (c) 2019 Michael Zhilin # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions # are met: # 1. Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # 2. Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF # SUCH DAMAGE. atf_test_case "basic" "cleanup" basic_head() { atf_set descr 'Basic jail test' atf_set require.user root } basic_body() { # Create the jail atf_check -s exit:0 -o ignore jail -c name=basejail persist ip4.addr=192.0.1.1 # Check output of jls atf_check -s exit:0 -o ignore jls atf_check -s exit:0 -o ignore jls -v atf_check -s exit:0 -o ignore jls -n # Stop jail atf_check -s exit:0 -o ignore jail -r basejail jail -c name=basejail persist ip4.addr=192.0.1.1 # Stop jail by jid atf_check -s exit:0 -o ignore jail -r `jls -j basejail jid` # Recreate atf_check -s exit:0 -o ignore jail -cm name=basejail persist ip4.addr=192.0.1.1 # Restart atf_check -s exit:0 -o ignore jail -rc name=basejail persist ip4.addr=192.0.1.1 } basic_cleanup() { jail -r basejail } atf_test_case "list" "cleanup" list_head() { atf_set descr 'Specify some jail parameters as lists' atf_set require.user root } list_body() { if [ "$(sysctl -qn kern.features.vimage)" -ne 1 ]; then atf_skip "cannot create VNET jails" fi atf_check -o save:epair ifconfig epair create epair=$(cat epair) atf_check jail -c name=basejail vnet persist vnet.interface=${epair},${epair%a}b atf_check -o ignore jexec basejail ifconfig ${epair} atf_check -o ignore jexec basejail ifconfig ${epair%a}b } list_cleanup() { jail -r basejail if [ -f epair ]; then ifconfig $(cat epair) destroy fi } atf_test_case "nested" "cleanup" nested_head() { atf_set descr 'Hierarchical jails test' atf_set require.user root } nested_body() { # Create the first jail jail -c name=basejail persist ip4.addr=192.0.1.1 children.max=1 atf_check -s exit:0 -o empty \ jexec basejail \ jail -c name=nestedjail persist ip4.addr=192.0.1.1 atf_check -s exit:1 -o empty -e inline:"jail: prison limit exceeded\n"\ jexec basejail \ jail -c name=secondnestedjail persist ip4.addr=192.0.1.1 # Check output of jls atf_check -s exit:0 -o ignore \ jexec basejail jls atf_check -s exit:0 -o ignore \ jexec basejail jls -v atf_check -s exit:0 -o ignore \ jexec basejail jls -n # Create jail with no child - children.max should be 0 by default jail -c name=basejail_nochild persist ip4.addr=192.0.1.1 atf_check -s exit:1 -o empty \ -e inline:"jail: jail_set: Operation not permitted\n" \ jexec basejail_nochild \ jail -c name=nestedjail persist ip4.addr=192.0.1.1 } nested_cleanup() { jail -r nestedjail jail -r basejail jail -r basejail_nochild } atf_test_case "commands" "cleanup" commands_head() { atf_set descr 'Commands jail test' atf_set require.user root } commands_body() { cp "$(atf_get_srcdir)/commands.jail.conf" jail.conf echo "path = \"$PWD\";" >> jail.conf # exec.prestart (START) and exec.poststart (env) atf_check -o save:stdout -e empty \ jail -f jail.conf -qc basejail # exec.prestart output is missing atf_check grep -qE '^START$' stdout # JID was not set in the exec.poststart env atf_check grep -qE '^JID=[0-9]+' stdout # JNAME was not set in the exec.poststart env atf_check grep -qE '^JNAME=basejail$' stdout # JPATH was not set in the exec.poststart env atf_check grep -qE "^JPATH=$PWD$" stdout # exec.prestop by jailname atf_check -s exit:0 -o inline:"STOP\n" \ jail -f jail.conf -qr basejail # exec.prestop by jid jail -f jail.conf -qc basejail atf_check -s exit:0 -o inline:"STOP\n" \ jail -f jail.conf -qr `jls -j basejail jid` } commands_cleanup() { if jls -j basejail > /dev/null 2>&1; then jail -r basejail fi } +atf_test_case "jid_name_set" "cleanup" +jid_name_set_head() +{ + atf_set descr 'Test that one can set both the jid and name in a config file' + atf_set require.user root +} + +find_unused_jid() +{ + : ${JAIL_MAX=999999} + + # We'll start at a higher jid number and roll through the space until + # we find one that isn't taken. We start high to avoid racing parallel + # activity for the 'next available', though ideally we don't have a lot + # of parallel jail activity like that. + jid=5309 + while jls -cj "$jid"; do + if [ "$jid" -eq "$JAIL_MAX" ]; then + atf_skip "System has too many jail, cannot find free slot" + fi + + jid=$((jid + 1)) + done + + echo "$jid" | tee -a jails.lst +} +clean_jails() +{ + if [ ! -s jails.lst ]; then + return 0 + fi + + while read jail; do + if jls -e -j "$jail"; then + jail -r "$jail" + fi + done < jails.lst +} + +jid_name_set_body() +{ + local jid=$(find_unused_jid) + + echo "basejail" >> jails.lst + echo "$jid { name = basejail; persist; }" > jail.conf + atf_check -o match:"$jid: created" jail -f jail.conf -c "$jid" + atf_check -o match:"$jid: removed" jail -f jail.conf -r "$jid" + + echo "basejail { jid = $jid; persist; }" > jail.conf + atf_check -o match:"basejail: created" jail -f jail.conf -c basejail + atf_check -o match:"basejail: removed" jail -f jail.conf -r basejail +} + +jid_name_set_cleanup() +{ + clean_jails +} + +atf_test_case "param_consistency" "cleanup" +param_consistency_head() +{ + atf_set descr 'Test for consistency in jid/name params being set implicitly' + atf_set require.user root +} + +param_consistency_body() +{ + local iface jid + + echo "basejail" >> jails.lst + + # Most basic test: exec.poststart running a command without a jail + # config. This would previously crash as we only had the jid and name + # as populated at creation time. + atf_check jail -c path=/ exec.poststart="true" command=/usr/bin/true + + iface=$(ifconfig lo create) + atf_check test -n "$iface" + echo "$iface" >> interfaces.lst + + # Now do it again but exercising IP_VNET_INTERFACE, which is an + # implied command that wants to use the jid or name. This would crash + # as neither KP_JID or KP_NAME are populated when a jail is created, + # just as above- just at a different spot. + atf_check jail -c \ + path=/ vnet=new vnet.interface="$iface" command=/usr/bin/true + + # Test that a jail that we only know by name will have its jid resolved + # and added to its param set. + echo "basejail {path = /; exec.prestop = 'echo STOP'; persist; }" > jail.conf + + atf_check -o ignore jail -f jail.conf -c basejail + atf_check -o match:"STOP" jail -f jail.conf -r basejail + + # Do the same sequence as above, but use a jail with a jid-ish name. + jid=$(find_unused_jid) + echo "$jid {path = /; exec.prestop = 'echo STOP'; persist; }" > jail.conf + + atf_check -o ignore jail -f jail.conf -c "$jid" + atf_check -o match:"STOP" jail -f jail.conf -r "$jid" + + # Ditto, but now we set a name for that jid-jail. + echo "$jid {name = basejail; path = /; exec.prestop = 'echo STOP'; persist; }" > jail.conf + + atf_check -o ignore jail -f jail.conf -c "$jid" + atf_check -o match:"STOP" jail -f jail.conf -r "$jid" + + # Confirm that we have a valid jid available in exec.poststop. It's + # probably debatable whether we should or not. + echo "basejail {path = /; exec.poststop = 'echo JID=\$JID'; persist; }" > jail.conf + atf_check -o ignore jail -f jail.conf -c basejail + jid=$(jls -j basejail jid) + + atf_check -o match:"JID=$jid" jail -f jail.conf -r basejail + +} + +param_consistency_cleanup() +{ + clean_jails + + if [ -f "interfaces.lst" ]; then + while read iface; do + ifconfig "$iface" destroy + done < interfaces.lst + fi +} atf_init_test_cases() { atf_add_test_case "basic" atf_add_test_case "list" atf_add_test_case "nested" atf_add_test_case "commands" + atf_add_test_case "jid_name_set" + atf_add_test_case "param_consistency" }