2 * Copyright (c) 2009 James Gritton.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
30 #include <sys/param.h>
31 #include <sys/types.h>
33 #include <sys/socket.h>
34 #include <sys/sysctl.h>
36 #include <arpa/inet.h>
37 #include <netinet/in.h>
48 #define SJPARAM "security.jail.param"
51 #define JPS_IN6_ADDR 2
53 #define ARRAY_SANITY 5
57 static int jailparam_import_enum(const char **values, int nvalues,
58 const char *valstr, size_t valsize, int *value);
59 static int jailparam_vlist(struct jailparam **jpp, va_list ap);
60 static int jailparam_type(struct jailparam *jp);
61 static char *noname(const char *name);
62 static char *nononame(const char *name);
64 char jail_errmsg[JAIL_ERRMSGLEN];
66 static const char *bool_values[] = { "false", "true" };
67 static const char *jailsys_values[] = { "disable", "new", "inherit" };
71 * Import a null-terminated parameter list and set a jail with the flags
75 jail_setv(int flags, ...)
82 njp = jailparam_vlist(&jp, ap);
86 return (jailparam_set(jp, njp, flags));
90 * Read a null-terminated parameter list, get the referenced jail, and export
91 * the parameters to the list.
94 jail_getv(int flags, ...)
100 int njp, i, jid, namekey, zero;
104 njp = jailparam_vlist(&jp, tap);
109 * See if the name is the search key. If so, we don't want to write
110 * it back in case it's a read-only string.
114 for (i = 0; i < njp; i++) {
115 if (!strcmp(jp->jp_name, "lastjid") ||
116 (!strcmp(jp->jp_name, "jid") &&
117 memcmp(jp->jp_value, &zero, sizeof(zero))))
120 jid = jailparam_get(jp, njp, flags);
125 for (i = 0; i < njp; i++) {
126 (void)va_arg(ap, char *);
127 value = jailparam_export(jp + i);
132 valarg = va_arg(ap, char *);
133 if (!namekey || strcmp(jp[i].jp_name, "name"))
134 /* It's up to the caller to ensure there's room. */
135 strcpy(valarg, value);
142 * Return a list of all known parameters.
145 jailparam_all(struct jailparam **jpp)
147 struct jailparam *jp;
148 size_t mlen1, mlen2, buflen;
150 int mib1[CTL_MAXNAME], mib2[CTL_MAXNAME - 2];
151 char buf[MAXPATHLEN];
155 jp = malloc(nlist * sizeof(*jp));
157 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
162 mlen1 = CTL_MAXNAME - 2;
163 if (sysctlnametomib(SJPARAM, mib1 + 2, &mlen1) < 0) {
164 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
165 "sysctlnametomib(" SJPARAM "): %s", strerror(errno));
169 /* Get the next parameter. */
170 mlen2 = sizeof(mib2);
171 if (sysctl(mib1, mlen1 + 2, mib2, &mlen2, NULL, 0) < 0) {
172 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
173 "sysctl(0.2): %s", strerror(errno));
176 if (mib2[0] != mib1[2] || mib2[1] != mib1[3] ||
179 /* Convert it to an ascii name. */
180 memcpy(mib1 + 2, mib2, mlen2);
181 mlen1 = mlen2 / sizeof(int);
183 buflen = sizeof(buf);
184 if (sysctl(mib1, mlen1 + 2, buf, &buflen, NULL, 0) < 0) {
185 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
186 "sysctl(0.1): %s", strerror(errno));
189 if (buf[buflen - 2] == '.')
190 buf[buflen - 2] = '\0';
191 /* Add the parameter to the list */
194 jp = realloc(jp, nlist * sizeof(jp));
196 jailparam_free(jp, njp);
200 if (jailparam_init(jp + njp, buf + sizeof(SJPARAM)) < 0)
202 if (jailparam_type(jp + njp) < 0) {
208 jp = realloc(jp, njp * sizeof(*jp));
213 jailparam_free(jp, njp);
219 * Clear a jail parameter and copy in its name.
222 jailparam_init(struct jailparam *jp, const char *name)
225 memset(jp, 0, sizeof(*jp));
226 jp->jp_name = strdup(name);
227 if (jp->jp_name == NULL) {
228 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
235 * Put a name and value into a jail parameter element, converting the value
239 jailparam_import(struct jailparam *jp, const char *value)
241 char *p, *ep, *tvalue;
245 if (!jp->jp_ctltype && jailparam_type(jp) < 0)
249 if ((jp->jp_ctltype & CTLTYPE) == CTLTYPE_STRING) {
250 jp->jp_value = strdup(value);
251 if (jp->jp_value == NULL) {
252 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
258 if (jp->jp_elemlen) {
259 if (value[0] == '\0' || (value[0] == '-' && value[1] == '\0')) {
260 jp->jp_value = strdup("");
261 if (jp->jp_value == NULL) {
262 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
268 for (p = strchr(value, ','); p; p = strchr(p + 1, ','))
270 jp->jp_valuelen = jp->jp_elemlen * nval;
272 jp->jp_value = malloc(jp->jp_valuelen);
273 if (jp->jp_value == NULL) {
274 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
278 for (i = 0; i < nval; i++) {
279 fw = nval == 1 ? strlen(avalue) : strcspn(avalue, ",");
280 switch (jp->jp_ctltype & CTLTYPE) {
282 if (jp->jp_flags & (JP_BOOL | JP_NOBOOL)) {
283 if (!jailparam_import_enum(bool_values, 2,
284 avalue, fw, &((int *)jp->jp_value)[i])) {
285 snprintf(jail_errmsg,
286 JAIL_ERRMSGLEN, "%s: "
287 "unknown boolean value \"%.*s\"",
288 jp->jp_name, fw, avalue);
294 if (jp->jp_flags & JP_JAILSYS) {
296 * Allow setting a jailsys parameter to "new"
297 * in a booleanesque fashion.
299 if (value[0] == '\0')
300 ((int *)jp->jp_value)[i] = JAIL_SYS_NEW;
301 else if (!jailparam_import_enum(jailsys_values,
302 sizeof(jailsys_values) /
303 sizeof(jailsys_values[0]), avalue, fw,
304 &((int *)jp->jp_value)[i])) {
305 snprintf(jail_errmsg,
306 JAIL_ERRMSGLEN, "%s: "
307 "unknown jailsys value \"%.*s\"",
308 jp->jp_name, fw, avalue);
314 ((int *)jp->jp_value)[i] = strtol(avalue, &ep, 10);
316 if (ep != avalue + fw) {
317 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
318 "%s: non-integer value \"%.*s\"",
319 jp->jp_name, fw, avalue);
325 ((unsigned *)jp->jp_value)[i] =
326 strtoul(avalue, &ep, 10);
329 ((long *)jp->jp_value)[i] = strtol(avalue, &ep, 10);
332 ((unsigned long *)jp->jp_value)[i] =
333 strtoul(avalue, &ep, 10);
336 ((int64_t *)jp->jp_value)[i] =
337 strtoimax(avalue, &ep, 10);
340 tvalue = alloca(fw + 1);
341 strlcpy(tvalue, avalue, fw + 1);
342 switch (jp->jp_structtype) {
344 if (inet_pton(AF_INET, tvalue,
345 &((struct in_addr *)jp->jp_value)[i]) != 1)
347 snprintf(jail_errmsg,
349 "%s: not an IPv4 address: %s",
350 jp->jp_name, tvalue);
356 if (inet_pton(AF_INET6, tvalue,
357 &((struct in6_addr *)jp->jp_value)[i]) != 1)
359 snprintf(jail_errmsg,
361 "%s: not an IPv6 address: %s",
362 jp->jp_name, tvalue);
373 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
374 "unknown type for %s", jp->jp_name);
389 jailparam_import_enum(const char **values, int nvalues, const char *valstr,
390 size_t valsize, int *value)
395 for (i = 0; i < nvalues; i++)
396 if (valsize == strlen(values[i]) &&
397 !strncasecmp(valstr, values[i], valsize)) {
401 *value = strtol(valstr, &ep, 10);
402 return (ep == valstr + valsize);
406 * Put a name and value into a jail parameter element, copying the value
407 * but not altering it.
410 jailparam_import_raw(struct jailparam *jp, void *value, size_t valuelen)
413 jp->jp_value = value;
414 jp->jp_valuelen = valuelen;
415 jp->jp_flags |= JP_RAWVALUE;
420 * Run the jail_set and jail_get system calls on a parameter list.
423 jailparam_set(struct jailparam *jp, unsigned njp, int flags)
430 jiov = alloca(sizeof(struct iovec) * 2 * (njp + 1));
432 for (i = j = 0; j < njp; j++) {
433 jiov[i].iov_base = jp[j].jp_name;
434 jiov[i].iov_len = strlen(jp[j].jp_name) + 1;
436 if (jp[j].jp_flags & (JP_BOOL | JP_NOBOOL)) {
438 * Set booleans without values. If one has a value of
439 * zero, change it to (or from) its "no" counterpart.
441 jiov[i].iov_base = NULL;
443 if (jp[j].jp_value != NULL &&
444 jp[j].jp_valuelen == sizeof(int) &&
445 !*(int *)jp[j].jp_value) {
447 nname = jp[j].jp_flags & JP_BOOL
448 ? noname(jp[j].jp_name)
449 : nononame(jp[j].jp_name);
455 jiov[i - 1].iov_base = nname;
456 jiov[i - 1].iov_len = strlen(nname) + 1;
461 * Try to fill in missing values with an empty string.
463 if (jp[j].jp_value == NULL && jp[j].jp_valuelen > 0 &&
464 jailparam_import(jp + j, "") < 0) {
469 jiov[i].iov_base = jp[j].jp_value;
471 (jp[j].jp_ctltype & CTLTYPE) == CTLTYPE_STRING
472 ? strlen(jp[j].jp_value) + 1
477 *(const void **)&jiov[i].iov_base = "errmsg";
478 jiov[i].iov_len = sizeof("errmsg");
480 jiov[i].iov_base = jail_errmsg;
481 jiov[i].iov_len = JAIL_ERRMSGLEN;
484 jid = jail_set(jiov, i, flags);
485 if (jid < 0 && !jail_errmsg[0])
486 snprintf(jail_errmsg, sizeof(jail_errmsg), "jail_set: %s",
490 for (j = 0; j < njp; j++)
491 if ((jp[j].jp_flags & (JP_BOOL | JP_NOBOOL)) &&
492 jp[j].jp_value != NULL &&
493 jp[j].jp_valuelen == sizeof(int) &&
494 !*(int *)jp[j].jp_value)
495 free(jiov[j * 2].iov_base);
500 jailparam_get(struct jailparam *jp, unsigned njp, int flags)
503 struct jailparam *jp_lastjid, *jp_jid, *jp_name, *jp_key;
504 int i, ai, ki, jid, arrays, sanity;
508 * Get the types for all parameters.
509 * Find the key and any array parameters.
511 jiov = alloca(sizeof(struct iovec) * 2 * (njp + 1));
512 jp_lastjid = jp_jid = jp_name = NULL;
514 for (ai = j = 0; j < njp; j++) {
515 if (!jp[j].jp_ctltype && jailparam_type(jp + j) < 0)
517 if (!strcmp(jp[j].jp_name, "lastjid"))
519 else if (!strcmp(jp[j].jp_name, "jid"))
521 else if (!strcmp(jp[j].jp_name, "name"))
523 else if (jp[j].jp_elemlen && !(jp[j].jp_flags & JP_RAWVALUE)) {
525 jiov[ai].iov_base = jp[j].jp_name;
526 jiov[ai].iov_len = strlen(jp[j].jp_name) + 1;
528 jiov[ai].iov_base = NULL;
529 jiov[ai].iov_len = 0;
533 jp_key = jp_lastjid ? jp_lastjid :
534 jp_jid && jp_jid->jp_valuelen == sizeof(int) &&
535 *(int *)jp_jid->jp_value ? jp_jid : jp_name;
536 if (jp_key == NULL || jp_key->jp_value == NULL) {
537 strlcpy(jail_errmsg, "no jail specified", JAIL_ERRMSGLEN);
542 jiov[ki].iov_base = jp_key->jp_name;
543 jiov[ki].iov_len = strlen(jp_key->jp_name) + 1;
545 jiov[ki].iov_base = jp_key->jp_value;
546 jiov[ki].iov_len = (jp_key->jp_ctltype & CTLTYPE) == CTLTYPE_STRING
547 ? strlen(jp_key->jp_value) + 1 : jp_key->jp_valuelen;
549 *(const void **)&jiov[ki].iov_base = "errmsg";
550 jiov[ki].iov_len = sizeof("errmsg");
552 jiov[ki].iov_base = jail_errmsg;
553 jiov[ki].iov_len = JAIL_ERRMSGLEN;
556 if (arrays && jail_get(jiov, ki, flags) < 0) {
558 snprintf(jail_errmsg, sizeof(jail_errmsg),
559 "jail_get: %s", strerror(errno));
562 /* Allocate storage for all parameters. */
563 for (ai = j = 0, i = ki; j < njp; j++) {
564 if (jp[j].jp_elemlen && !(jp[j].jp_flags & JP_RAWVALUE)) {
566 jiov[ai].iov_len += jp[j].jp_elemlen * ARRAY_SLOP;
567 if (jp[j].jp_valuelen >= jiov[ai].iov_len)
568 jiov[ai].iov_len = jp[j].jp_valuelen;
570 jp[j].jp_valuelen = jiov[ai].iov_len;
571 if (jp[j].jp_value != NULL)
572 free(jp[j].jp_value);
573 jp[j].jp_value = malloc(jp[j].jp_valuelen);
574 if (jp[j].jp_value == NULL) {
575 strerror_r(errno, jail_errmsg,
580 jiov[ai].iov_base = jp[j].jp_value;
581 memset(jiov[ai].iov_base, 0, jiov[ai].iov_len);
583 } else if (jp + j != jp_key) {
584 jiov[i].iov_base = jp[j].jp_name;
585 jiov[i].iov_len = strlen(jp[j].jp_name) + 1;
587 if (jp[j].jp_value == NULL &&
588 !(jp[j].jp_flags & JP_RAWVALUE)) {
589 jp[j].jp_value = malloc(jp[j].jp_valuelen);
590 if (jp[j].jp_value == NULL) {
591 strerror_r(errno, jail_errmsg,
596 jiov[i].iov_base = jp[j].jp_value;
597 jiov[i].iov_len = jp[j].jp_valuelen;
598 memset(jiov[i].iov_base, 0, jiov[i].iov_len);
603 * Get the prison. If there are array elements, retry a few times
604 * in case their sizes changed from under us.
606 for (sanity = 0;; sanity++) {
607 jid = jail_get(jiov, i, flags);
608 if (jid >= 0 || !arrays || sanity == ARRAY_SANITY ||
609 errno != EINVAL || jail_errmsg[0])
611 for (ai = j = 0; j < njp; j++) {
612 if (jp[j].jp_elemlen &&
613 !(jp[j].jp_flags & JP_RAWVALUE)) {
615 jiov[ai].iov_base = NULL;
616 jiov[ai].iov_len = 0;
620 if (jail_get(jiov, ki, flags) < 0)
622 for (ai = j = 0; j < njp; j++) {
623 if (jp[j].jp_elemlen &&
624 !(jp[j].jp_flags & JP_RAWVALUE)) {
627 jp[j].jp_elemlen * ARRAY_SLOP;
628 if (jp[j].jp_valuelen >= jiov[ai].iov_len)
629 jiov[ai].iov_len = jp[j].jp_valuelen;
631 jp[j].jp_valuelen = jiov[ai].iov_len;
632 if (jp[j].jp_value != NULL)
633 free(jp[j].jp_value);
635 malloc(jiov[ai].iov_len);
636 if (jp[j].jp_value == NULL) {
637 strerror_r(errno, jail_errmsg,
642 jiov[ai].iov_base = jp[j].jp_value;
643 memset(jiov[ai].iov_base, 0, jiov[ai].iov_len);
648 if (jid < 0 && !jail_errmsg[0])
649 snprintf(jail_errmsg, sizeof(jail_errmsg),
650 "jail_get: %s", strerror(errno));
651 for (ai = j = 0, i = ki; j < njp; j++) {
652 if (jp[j].jp_elemlen && !(jp[j].jp_flags & JP_RAWVALUE)) {
654 jp[j].jp_valuelen = jiov[ai].iov_len;
656 } else if (jp + j != jp_key) {
658 jp[j].jp_valuelen = jiov[i].iov_len;
666 * Convert a jail parameter's value to external form.
669 jailparam_export(struct jailparam *jp)
671 char *value, *tvalue, **values;
674 char valbuf[INET6_ADDRSTRLEN];
676 if (!jp->jp_ctltype && jailparam_type(jp) < 0)
678 if ((jp->jp_ctltype & CTLTYPE) == CTLTYPE_STRING) {
679 value = strdup(jp->jp_value);
681 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
684 nval = jp->jp_elemlen ? jp->jp_valuelen / jp->jp_elemlen : 1;
688 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
691 values = alloca(nval * sizeof(char *));
693 for (i = 0; i < nval; i++) {
694 switch (jp->jp_ctltype & CTLTYPE) {
696 ival = ((int *)jp->jp_value)[i];
697 if ((jp->jp_flags & (JP_BOOL | JP_NOBOOL)) &&
698 (unsigned)ival < 2) {
699 strlcpy(valbuf, bool_values[ival],
703 if ((jp->jp_flags & JP_JAILSYS) &&
704 (unsigned)ival < sizeof(jailsys_values) /
705 sizeof(jailsys_values[0])) {
706 strlcpy(valbuf, jailsys_values[ival],
710 snprintf(valbuf, sizeof(valbuf), "%d", ival);
713 snprintf(valbuf, sizeof(valbuf), "%u",
714 ((unsigned *)jp->jp_value)[i]);
717 snprintf(valbuf, sizeof(valbuf), "%ld",
718 ((long *)jp->jp_value)[i]);
721 snprintf(valbuf, sizeof(valbuf), "%lu",
722 ((unsigned long *)jp->jp_value)[i]);
725 snprintf(valbuf, sizeof(valbuf), "%jd",
726 (intmax_t)((int64_t *)jp->jp_value)[i]);
729 switch (jp->jp_structtype) {
731 if (inet_ntop(AF_INET,
732 &((struct in_addr *)jp->jp_value)[i],
733 valbuf, sizeof(valbuf)) == NULL) {
734 strerror_r(errno, jail_errmsg,
741 if (inet_ntop(AF_INET6,
742 &((struct in6_addr *)jp->jp_value)[i],
743 valbuf, sizeof(valbuf)) == NULL) {
744 strerror_r(errno, jail_errmsg,
756 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
757 "unknown type for %s", jp->jp_name);
761 valuelen += strlen(valbuf) + 1;
762 values[i] = alloca(valuelen);
763 strcpy(values[i], valbuf);
765 value = malloc(valuelen + 1);
767 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
770 for (i = 0; i < nval; i++) {
771 strcpy(tvalue, values[i]);
773 tvalue += strlen(values[i]);
782 * Free the contents of a jail parameter list (but not thst list itself).
785 jailparam_free(struct jailparam *jp, unsigned njp)
789 for (j = 0; j < njp; j++) {
791 if (!(jp[j].jp_flags & JP_RAWVALUE))
792 free(jp[j].jp_value);
797 * Create and import an array of jail parameters, given a list of name and
798 * value strings, terminated by a null name.
801 jailparam_vlist(struct jailparam **jpp, va_list ap)
804 struct jailparam *jp;
809 for (njp = 0; va_arg(tap, char *) != NULL; njp++)
810 (void)va_arg(tap, char *);
812 jp = calloc(njp, sizeof(struct jailparam));
814 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
818 for (njp = 0; (name = va_arg(ap, char *)) != NULL; njp++) {
819 value = va_arg(ap, char *);
820 if (jailparam_init(jp + njp, name) < 0 ||
821 jailparam_import(jp + njp, value) < 0) {
822 jailparam_free(jp, njp);
832 * Find a parameter's type and size from its MIB.
835 jailparam_type(struct jailparam *jp)
838 size_t miblen, desclen;
844 int mib[CTL_MAXNAME];
846 /* The "lastjid" parameter isn't real. */
847 if (!strcmp(jp->jp_name, "lastjid")) {
848 jp->jp_valuelen = sizeof(int);
849 jp->jp_ctltype = CTLTYPE_INT | CTLFLAG_WR;
853 /* Find the sysctl that describes the parameter. */
856 snprintf(desc.s, sizeof(desc.s), SJPARAM ".%s", jp->jp_name);
857 miblen = sizeof(mib) - 2 * sizeof(int);
858 if (sysctl(mib, 2, mib + 2, &miblen, desc.s, strlen(desc.s)) < 0) {
859 if (errno != ENOENT) {
860 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
861 "sysctl(0.3.%s): %s", jp->jp_name, strerror(errno));
865 * The parameter probably doesn't exist. But it might be
866 * the "no" counterpart to a boolean.
868 nname = nononame(jp->jp_name);
870 snprintf(desc.s, sizeof(desc.s), SJPARAM ".%s", nname);
872 miblen = sizeof(mib) - 2 * sizeof(int);
873 if (sysctl(mib, 2, mib + 2, &miblen, desc.s,
874 strlen(desc.s)) >= 0) {
876 desclen = sizeof(desc);
877 if (sysctl(mib, (miblen / sizeof(int)) + 2,
878 &desc, &desclen, NULL, 0) < 0) {
879 snprintf(jail_errmsg,
881 "sysctl(0.4.%s): %s", desc.s,
885 if ((desc.i & CTLTYPE) == CTLTYPE_INT &&
887 jp->jp_ctltype = desc.i;
888 jp->jp_flags |= JP_NOBOOL;
889 jp->jp_valuelen = sizeof(int);
895 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
896 "unknown parameter: %s", jp->jp_name);
902 desclen = sizeof(desc);
903 if (sysctl(mib, (miblen / sizeof(int)) + 2, &desc, &desclen,
905 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
906 "sysctl(0.4.%s): %s", jp->jp_name, strerror(errno));
909 /* See if this is an array type. */
910 p = strchr(desc.s, '\0');
912 if (p - 2 < desc.s || strcmp(p - 2, ",a"))
918 /* Look for types we understand */
919 jp->jp_ctltype = desc.i;
920 switch (desc.i & CTLTYPE) {
922 if (desc.s[0] == 'B')
923 jp->jp_flags |= JP_BOOL;
924 else if (!strcmp(desc.s, "E,jailsys"))
925 jp->jp_flags |= JP_JAILSYS;
927 jp->jp_valuelen = sizeof(int);
931 jp->jp_valuelen = sizeof(long);
934 jp->jp_valuelen = sizeof(int64_t);
938 desclen = sizeof(desc.s);
939 if (sysctl(mib + 2, miblen / sizeof(int), desc.s, &desclen,
941 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
942 "sysctl(" SJPARAM ".%s): %s", jp->jp_name,
946 jp->jp_valuelen = strtoul(desc.s, NULL, 10);
949 if (!strcmp(desc.s, "S,in_addr")) {
950 jp->jp_structtype = JPS_IN_ADDR;
951 jp->jp_valuelen = sizeof(struct in_addr);
952 } else if (!strcmp(desc.s, "S,in6_addr")) {
953 jp->jp_structtype = JPS_IN6_ADDR;
954 jp->jp_valuelen = sizeof(struct in6_addr);
957 if (sysctl(mib + 2, miblen / sizeof(int),
958 NULL, &jp->jp_valuelen, NULL, 0) < 0) {
959 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
960 "sysctl(" SJPARAM ".%s): %s", jp->jp_name,
967 /* A node might be described by an empty-named child. */
969 mib[(miblen / sizeof(int)) + 2] =
970 mib[(miblen / sizeof(int)) + 1] - 1;
971 miblen += sizeof(int);
972 desclen = sizeof(desc.s);
973 if (sysctl(mib, (miblen / sizeof(int)) + 2, desc.s, &desclen,
975 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
976 "sysctl(0.1): %s", strerror(errno));
979 if (desc.s[desclen - 2] != '.')
980 goto unknown_parameter;
983 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
984 "unknown type for %s", jp->jp_name);
989 jp->jp_elemlen = jp->jp_valuelen;
996 * Change a boolean parameter name into its "no" counterpart or vice versa.
999 noname(const char *name)
1003 nname = malloc(strlen(name) + 3);
1004 if (nname == NULL) {
1005 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
1008 p = strrchr(name, '.');
1010 sprintf(nname, "%.*s.no%s", (int)(p - name), name, p + 1);
1012 sprintf(nname, "no%s", name);
1017 nononame(const char *name)
1021 p = strrchr(name, '.');
1022 if (strncmp(p ? p + 1 : name, "no", 2)) {
1023 snprintf(jail_errmsg, sizeof(jail_errmsg),
1024 "mismatched boolean: %s", name);
1028 nname = malloc(strlen(name) - 1);
1029 if (nname == NULL) {
1030 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
1034 sprintf(nname, "%.*s.%s", (int)(p - name), name, p + 3);
1036 strcpy(nname, name + 2);