2 * Copyright (c) 2009 James Gritton.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
30 #include <sys/param.h>
31 #include <sys/types.h>
33 #include <sys/socket.h>
34 #include <sys/sysctl.h>
36 #include <arpa/inet.h>
37 #include <netinet/in.h>
48 #define SJPARAM "security.jail.param"
51 #define JPS_IN6_ADDR 2
53 #define ARRAY_SANITY 5
57 static int jailparam_import_enum(const char **values, int nvalues,
58 const char *valstr, size_t valsize, int *value);
59 static int jailparam_type(struct jailparam *jp);
60 static char *noname(const char *name);
61 static char *nononame(const char *name);
63 char jail_errmsg[JAIL_ERRMSGLEN];
65 static const char *bool_values[] = { "false", "true" };
66 static const char *jailsys_values[] = { "disable", "new", "inherit" };
70 * Import a null-terminated parameter list and set a jail with the flags
74 jail_setv(int flags, ...)
78 const char *name, *value;
81 /* Create the parameter list and import the parameters. */
84 for (njp = 0; va_arg(tap, char *) != NULL; njp++)
85 (void)va_arg(tap, char *);
87 jp = alloca(njp * sizeof(struct jailparam));
88 for (njp = 0; (name = va_arg(ap, char *)) != NULL; njp++) {
89 value = va_arg(ap, char *);
90 if (jailparam_init(jp + njp, name) < 0 ||
91 jailparam_import(jp + njp, value) < 0) {
92 jailparam_free(jp, njp);
98 jid = jailparam_set(jp, njp, flags);
99 jailparam_free(jp, njp);
104 * Read a null-terminated parameter list, get the referenced jail, and export
105 * the parameters to the list.
108 jail_getv(int flags, ...)
111 struct jailparam *jp, *jp_lastjid, *jp_jid, *jp_name, *jp_key;
112 char *valarg, *value;
113 const char *name, *key_value, *lastjid_value, *jid_value, *name_value;
116 /* Create the parameter list and find the key. */
119 for (njp = 0; va_arg(tap, char *) != NULL; njp++)
120 (void)va_arg(tap, char *);
123 jp = alloca(njp * sizeof(struct jailparam));
125 jp_lastjid = jp_jid = jp_name = NULL;
126 lastjid_value = jid_value = name_value = NULL;
127 for (njp = 0; (name = va_arg(tap, char *)) != NULL; njp++) {
128 value = va_arg(tap, char *);
129 if (jailparam_init(jp + njp, name) < 0) {
133 if (!strcmp(jp[njp].jp_name, "lastjid")) {
134 jp_lastjid = jp + njp;
135 lastjid_value = value;
136 } else if (!strcmp(jp[njp].jp_name, "jid")) {
139 } if (!strcmp(jp[njp].jp_name, "name")) {
145 /* Import the key parameter. */
146 if (jp_lastjid != NULL) {
148 key_value = lastjid_value;
149 } else if (jp_jid != NULL && strtol(jid_value, NULL, 10) != 0) {
151 key_value = jid_value;
152 } else if (jp_name != NULL) {
154 key_value = name_value;
156 strlcpy(jail_errmsg, "no jail specified", JAIL_ERRMSGLEN);
160 if (jailparam_import(jp_key, key_value) < 0)
162 /* Get the jail and export the parameters. */
163 jid = jailparam_get(jp, njp, flags);
166 for (i = 0; i < njp; i++) {
167 (void)va_arg(ap, char *);
168 valarg = va_arg(ap, char *);
169 if (jp + i != jp_key) {
170 /* It's up to the caller to ensure there's room. */
171 if ((jp[i].jp_ctltype & CTLTYPE) == CTLTYPE_STRING)
172 strcpy(valarg, jp[i].jp_value);
174 value = jailparam_export(jp + i);
177 strcpy(valarg, value);
182 jailparam_free(jp, njp);
187 jailparam_free(jp, njp);
193 * Return a list of all known parameters.
196 jailparam_all(struct jailparam **jpp)
198 struct jailparam *jp;
199 size_t mlen1, mlen2, buflen;
201 int mib1[CTL_MAXNAME], mib2[CTL_MAXNAME - 2];
202 char buf[MAXPATHLEN];
206 jp = malloc(nlist * sizeof(*jp));
208 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
213 mlen1 = CTL_MAXNAME - 2;
214 if (sysctlnametomib(SJPARAM, mib1 + 2, &mlen1) < 0) {
215 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
216 "sysctlnametomib(" SJPARAM "): %s", strerror(errno));
220 /* Get the next parameter. */
221 mlen2 = sizeof(mib2);
222 if (sysctl(mib1, mlen1 + 2, mib2, &mlen2, NULL, 0) < 0) {
223 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
224 "sysctl(0.2): %s", strerror(errno));
227 if (mib2[0] != mib1[2] || mib2[1] != mib1[3] ||
230 /* Convert it to an ascii name. */
231 memcpy(mib1 + 2, mib2, mlen2);
232 mlen1 = mlen2 / sizeof(int);
234 buflen = sizeof(buf);
235 if (sysctl(mib1, mlen1 + 2, buf, &buflen, NULL, 0) < 0) {
236 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
237 "sysctl(0.1): %s", strerror(errno));
240 if (buf[buflen - 2] == '.')
241 buf[buflen - 2] = '\0';
242 /* Add the parameter to the list */
245 jp = realloc(jp, nlist * sizeof(*jp));
247 jailparam_free(jp, njp);
251 if (jailparam_init(jp + njp, buf + sizeof(SJPARAM)) < 0)
255 jp = realloc(jp, njp * sizeof(*jp));
260 jailparam_free(jp, njp);
266 * Clear a jail parameter and copy in its name.
269 jailparam_init(struct jailparam *jp, const char *name)
272 memset(jp, 0, sizeof(*jp));
273 jp->jp_name = strdup(name);
274 if (jp->jp_name == NULL) {
275 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
278 if (jailparam_type(jp) < 0) {
279 jailparam_free(jp, 1);
286 * Put a name and value into a jail parameter element, converting the value
290 jailparam_import(struct jailparam *jp, const char *value)
292 char *p, *ep, *tvalue;
298 if ((jp->jp_ctltype & CTLTYPE) == CTLTYPE_STRING) {
299 jp->jp_value = strdup(value);
300 if (jp->jp_value == NULL) {
301 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
307 if (jp->jp_elemlen) {
308 if (value[0] == '\0' || (value[0] == '-' && value[1] == '\0')) {
309 jp->jp_value = strdup("");
310 if (jp->jp_value == NULL) {
311 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
317 for (p = strchr(value, ','); p; p = strchr(p + 1, ','))
319 jp->jp_valuelen = jp->jp_elemlen * nval;
321 jp->jp_value = malloc(jp->jp_valuelen);
322 if (jp->jp_value == NULL) {
323 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
327 for (i = 0; i < nval; i++) {
328 fw = nval == 1 ? strlen(avalue) : strcspn(avalue, ",");
329 switch (jp->jp_ctltype & CTLTYPE) {
331 if (jp->jp_flags & (JP_BOOL | JP_NOBOOL)) {
332 if (!jailparam_import_enum(bool_values, 2,
333 avalue, fw, &((int *)jp->jp_value)[i])) {
334 snprintf(jail_errmsg,
335 JAIL_ERRMSGLEN, "%s: "
336 "unknown boolean value \"%.*s\"",
337 jp->jp_name, fw, avalue);
343 if (jp->jp_flags & JP_JAILSYS) {
345 * Allow setting a jailsys parameter to "new"
346 * in a booleanesque fashion.
348 if (value[0] == '\0')
349 ((int *)jp->jp_value)[i] = JAIL_SYS_NEW;
350 else if (!jailparam_import_enum(jailsys_values,
351 sizeof(jailsys_values) /
352 sizeof(jailsys_values[0]), avalue, fw,
353 &((int *)jp->jp_value)[i])) {
354 snprintf(jail_errmsg,
355 JAIL_ERRMSGLEN, "%s: "
356 "unknown jailsys value \"%.*s\"",
357 jp->jp_name, fw, avalue);
363 ((int *)jp->jp_value)[i] = strtol(avalue, &ep, 10);
365 if (ep != avalue + fw) {
366 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
367 "%s: non-integer value \"%.*s\"",
368 jp->jp_name, fw, avalue);
374 ((unsigned *)jp->jp_value)[i] =
375 strtoul(avalue, &ep, 10);
378 ((long *)jp->jp_value)[i] = strtol(avalue, &ep, 10);
381 ((unsigned long *)jp->jp_value)[i] =
382 strtoul(avalue, &ep, 10);
385 ((int64_t *)jp->jp_value)[i] =
386 strtoimax(avalue, &ep, 10);
389 tvalue = alloca(fw + 1);
390 strlcpy(tvalue, avalue, fw + 1);
391 switch (jp->jp_structtype) {
393 if (inet_pton(AF_INET, tvalue,
394 &((struct in_addr *)jp->jp_value)[i]) != 1)
396 snprintf(jail_errmsg,
398 "%s: not an IPv4 address: %s",
399 jp->jp_name, tvalue);
405 if (inet_pton(AF_INET6, tvalue,
406 &((struct in6_addr *)jp->jp_value)[i]) != 1)
408 snprintf(jail_errmsg,
410 "%s: not an IPv6 address: %s",
411 jp->jp_name, tvalue);
422 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
423 "unknown type for %s", jp->jp_name);
438 jailparam_import_enum(const char **values, int nvalues, const char *valstr,
439 size_t valsize, int *value)
444 for (i = 0; i < nvalues; i++)
445 if (valsize == strlen(values[i]) &&
446 !strncasecmp(valstr, values[i], valsize)) {
450 *value = strtol(valstr, &ep, 10);
451 return (ep == valstr + valsize);
455 * Put a name and value into a jail parameter element, copying the value
456 * but not altering it.
459 jailparam_import_raw(struct jailparam *jp, void *value, size_t valuelen)
462 jp->jp_value = value;
463 jp->jp_valuelen = valuelen;
464 jp->jp_flags |= JP_RAWVALUE;
469 * Run the jail_set and jail_get system calls on a parameter list.
472 jailparam_set(struct jailparam *jp, unsigned njp, int flags)
479 jiov = alloca(sizeof(struct iovec) * 2 * (njp + 1));
481 for (i = j = 0; j < njp; j++) {
482 jiov[i].iov_base = jp[j].jp_name;
483 jiov[i].iov_len = strlen(jp[j].jp_name) + 1;
485 if (jp[j].jp_flags & (JP_BOOL | JP_NOBOOL)) {
487 * Set booleans without values. If one has a value of
488 * zero, change it to (or from) its "no" counterpart.
490 jiov[i].iov_base = NULL;
492 if (jp[j].jp_value != NULL &&
493 jp[j].jp_valuelen == sizeof(int) &&
494 !*(int *)jp[j].jp_value) {
496 nname = jp[j].jp_flags & JP_BOOL
497 ? noname(jp[j].jp_name)
498 : nononame(jp[j].jp_name);
504 jiov[i - 1].iov_base = nname;
505 jiov[i - 1].iov_len = strlen(nname) + 1;
510 * Try to fill in missing values with an empty string.
512 if (jp[j].jp_value == NULL && jp[j].jp_valuelen > 0 &&
513 jailparam_import(jp + j, "") < 0) {
518 jiov[i].iov_base = jp[j].jp_value;
520 (jp[j].jp_ctltype & CTLTYPE) == CTLTYPE_STRING
521 ? strlen(jp[j].jp_value) + 1
526 *(const void **)&jiov[i].iov_base = "errmsg";
527 jiov[i].iov_len = sizeof("errmsg");
529 jiov[i].iov_base = jail_errmsg;
530 jiov[i].iov_len = JAIL_ERRMSGLEN;
533 jid = jail_set(jiov, i, flags);
534 if (jid < 0 && !jail_errmsg[0])
535 snprintf(jail_errmsg, sizeof(jail_errmsg), "jail_set: %s",
539 for (j = 0; j < njp; j++)
540 if ((jp[j].jp_flags & (JP_BOOL | JP_NOBOOL)) &&
541 jp[j].jp_value != NULL &&
542 jp[j].jp_valuelen == sizeof(int) &&
543 !*(int *)jp[j].jp_value)
544 free(jiov[j * 2].iov_base);
549 jailparam_get(struct jailparam *jp, unsigned njp, int flags)
552 struct jailparam *jp_lastjid, *jp_jid, *jp_name, *jp_key;
553 int i, ai, ki, jid, arrays, sanity;
557 * Get the types for all parameters.
558 * Find the key and any array parameters.
560 jiov = alloca(sizeof(struct iovec) * 2 * (njp + 1));
561 jp_lastjid = jp_jid = jp_name = NULL;
563 for (ai = j = 0; j < njp; j++) {
564 if (!strcmp(jp[j].jp_name, "lastjid"))
566 else if (!strcmp(jp[j].jp_name, "jid"))
568 else if (!strcmp(jp[j].jp_name, "name"))
570 else if (jp[j].jp_elemlen && !(jp[j].jp_flags & JP_RAWVALUE)) {
572 jiov[ai].iov_base = jp[j].jp_name;
573 jiov[ai].iov_len = strlen(jp[j].jp_name) + 1;
575 jiov[ai].iov_base = NULL;
576 jiov[ai].iov_len = 0;
580 jp_key = jp_lastjid ? jp_lastjid :
581 jp_jid && jp_jid->jp_valuelen == sizeof(int) &&
582 jp_jid->jp_value && *(int *)jp_jid->jp_value ? jp_jid : jp_name;
583 if (jp_key == NULL || jp_key->jp_value == NULL) {
584 strlcpy(jail_errmsg, "no jail specified", JAIL_ERRMSGLEN);
589 jiov[ki].iov_base = jp_key->jp_name;
590 jiov[ki].iov_len = strlen(jp_key->jp_name) + 1;
592 jiov[ki].iov_base = jp_key->jp_value;
593 jiov[ki].iov_len = (jp_key->jp_ctltype & CTLTYPE) == CTLTYPE_STRING
594 ? strlen(jp_key->jp_value) + 1 : jp_key->jp_valuelen;
596 *(const void **)&jiov[ki].iov_base = "errmsg";
597 jiov[ki].iov_len = sizeof("errmsg");
599 jiov[ki].iov_base = jail_errmsg;
600 jiov[ki].iov_len = JAIL_ERRMSGLEN;
603 if (arrays && jail_get(jiov, ki, flags) < 0) {
605 snprintf(jail_errmsg, sizeof(jail_errmsg),
606 "jail_get: %s", strerror(errno));
609 /* Allocate storage for all parameters. */
610 for (ai = j = 0, i = ki; j < njp; j++) {
611 if (jp[j].jp_elemlen && !(jp[j].jp_flags & JP_RAWVALUE)) {
613 jiov[ai].iov_len += jp[j].jp_elemlen * ARRAY_SLOP;
614 if (jp[j].jp_valuelen >= jiov[ai].iov_len)
615 jiov[ai].iov_len = jp[j].jp_valuelen;
617 jp[j].jp_valuelen = jiov[ai].iov_len;
618 if (jp[j].jp_value != NULL)
619 free(jp[j].jp_value);
620 jp[j].jp_value = malloc(jp[j].jp_valuelen);
621 if (jp[j].jp_value == NULL) {
622 strerror_r(errno, jail_errmsg,
627 jiov[ai].iov_base = jp[j].jp_value;
628 memset(jiov[ai].iov_base, 0, jiov[ai].iov_len);
630 } else if (jp + j != jp_key) {
631 jiov[i].iov_base = jp[j].jp_name;
632 jiov[i].iov_len = strlen(jp[j].jp_name) + 1;
634 if (jp[j].jp_value == NULL &&
635 !(jp[j].jp_flags & JP_RAWVALUE)) {
636 jp[j].jp_value = malloc(jp[j].jp_valuelen);
637 if (jp[j].jp_value == NULL) {
638 strerror_r(errno, jail_errmsg,
643 jiov[i].iov_base = jp[j].jp_value;
644 jiov[i].iov_len = jp[j].jp_valuelen;
645 memset(jiov[i].iov_base, 0, jiov[i].iov_len);
650 * Get the prison. If there are array elements, retry a few times
651 * in case their sizes changed from under us.
653 for (sanity = 0;; sanity++) {
654 jid = jail_get(jiov, i, flags);
655 if (jid >= 0 || !arrays || sanity == ARRAY_SANITY ||
656 errno != EINVAL || jail_errmsg[0])
658 for (ai = j = 0; j < njp; j++) {
659 if (jp[j].jp_elemlen &&
660 !(jp[j].jp_flags & JP_RAWVALUE)) {
662 jiov[ai].iov_base = NULL;
663 jiov[ai].iov_len = 0;
667 if (jail_get(jiov, ki, flags) < 0)
669 for (ai = j = 0; j < njp; j++) {
670 if (jp[j].jp_elemlen &&
671 !(jp[j].jp_flags & JP_RAWVALUE)) {
674 jp[j].jp_elemlen * ARRAY_SLOP;
675 if (jp[j].jp_valuelen >= jiov[ai].iov_len)
676 jiov[ai].iov_len = jp[j].jp_valuelen;
678 jp[j].jp_valuelen = jiov[ai].iov_len;
679 if (jp[j].jp_value != NULL)
680 free(jp[j].jp_value);
682 malloc(jiov[ai].iov_len);
683 if (jp[j].jp_value == NULL) {
684 strerror_r(errno, jail_errmsg,
689 jiov[ai].iov_base = jp[j].jp_value;
690 memset(jiov[ai].iov_base, 0, jiov[ai].iov_len);
695 if (jid < 0 && !jail_errmsg[0])
696 snprintf(jail_errmsg, sizeof(jail_errmsg),
697 "jail_get: %s", strerror(errno));
698 for (ai = j = 0, i = ki; j < njp; j++) {
699 if (jp[j].jp_elemlen && !(jp[j].jp_flags & JP_RAWVALUE)) {
701 jp[j].jp_valuelen = jiov[ai].iov_len;
703 } else if (jp + j != jp_key) {
705 jp[j].jp_valuelen = jiov[i].iov_len;
713 * Convert a jail parameter's value to external form.
716 jailparam_export(struct jailparam *jp)
719 char *value, *tvalue, **values;
722 char valbuf[INET6_ADDRSTRLEN];
724 if ((jp->jp_ctltype & CTLTYPE) == CTLTYPE_STRING) {
725 value = strdup(jp->jp_value);
727 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
730 nval = jp->jp_elemlen ? jp->jp_valuelen / jp->jp_elemlen : 1;
734 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
737 values = alloca(nval * sizeof(char *));
738 valuelens = alloca(nval * sizeof(size_t));
740 for (i = 0; i < nval; i++) {
741 switch (jp->jp_ctltype & CTLTYPE) {
743 ival = ((int *)jp->jp_value)[i];
744 if ((jp->jp_flags & (JP_BOOL | JP_NOBOOL)) &&
745 (unsigned)ival < 2) {
746 strlcpy(valbuf, bool_values[ival],
750 if ((jp->jp_flags & JP_JAILSYS) &&
751 (unsigned)ival < sizeof(jailsys_values) /
752 sizeof(jailsys_values[0])) {
753 strlcpy(valbuf, jailsys_values[ival],
757 snprintf(valbuf, sizeof(valbuf), "%d", ival);
760 snprintf(valbuf, sizeof(valbuf), "%u",
761 ((unsigned *)jp->jp_value)[i]);
764 snprintf(valbuf, sizeof(valbuf), "%ld",
765 ((long *)jp->jp_value)[i]);
768 snprintf(valbuf, sizeof(valbuf), "%lu",
769 ((unsigned long *)jp->jp_value)[i]);
772 snprintf(valbuf, sizeof(valbuf), "%jd",
773 (intmax_t)((int64_t *)jp->jp_value)[i]);
776 switch (jp->jp_structtype) {
778 if (inet_ntop(AF_INET,
779 &((struct in_addr *)jp->jp_value)[i],
780 valbuf, sizeof(valbuf)) == NULL) {
781 strerror_r(errno, jail_errmsg,
787 if (inet_ntop(AF_INET6,
788 &((struct in6_addr *)jp->jp_value)[i],
789 valbuf, sizeof(valbuf)) == NULL) {
790 strerror_r(errno, jail_errmsg,
801 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
802 "unknown type for %s", jp->jp_name);
806 valuelens[i] = strlen(valbuf) + 1;
807 valuelen += valuelens[i];
808 values[i] = alloca(valuelens[i]);
809 strcpy(values[i], valbuf);
811 value = malloc(valuelen);
813 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
816 for (i = 0; i < nval; i++) {
817 strcpy(tvalue, values[i]);
819 tvalue += valuelens[i];
828 * Free the contents of a jail parameter list (but not the list itself).
831 jailparam_free(struct jailparam *jp, unsigned njp)
835 for (j = 0; j < njp; j++) {
837 if (!(jp[j].jp_flags & JP_RAWVALUE))
838 free(jp[j].jp_value);
843 * Find a parameter's type and size from its MIB.
846 jailparam_type(struct jailparam *jp)
849 size_t miblen, desclen;
855 int mib[CTL_MAXNAME];
857 /* The "lastjid" parameter isn't real. */
858 if (!strcmp(jp->jp_name, "lastjid")) {
859 jp->jp_valuelen = sizeof(int);
860 jp->jp_ctltype = CTLTYPE_INT | CTLFLAG_WR;
864 /* Find the sysctl that describes the parameter. */
867 snprintf(desc.s, sizeof(desc.s), SJPARAM ".%s", jp->jp_name);
868 miblen = sizeof(mib) - 2 * sizeof(int);
869 if (sysctl(mib, 2, mib + 2, &miblen, desc.s, strlen(desc.s)) < 0) {
870 if (errno != ENOENT) {
871 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
872 "sysctl(0.3.%s): %s", jp->jp_name, strerror(errno));
876 * The parameter probably doesn't exist. But it might be
877 * the "no" counterpart to a boolean.
879 nname = nononame(jp->jp_name);
881 snprintf(desc.s, sizeof(desc.s), SJPARAM ".%s", nname);
883 miblen = sizeof(mib) - 2 * sizeof(int);
884 if (sysctl(mib, 2, mib + 2, &miblen, desc.s,
885 strlen(desc.s)) >= 0) {
887 desclen = sizeof(desc);
888 if (sysctl(mib, (miblen / sizeof(int)) + 2,
889 &desc, &desclen, NULL, 0) < 0) {
890 snprintf(jail_errmsg,
892 "sysctl(0.4.%s): %s", desc.s,
896 if ((desc.i & CTLTYPE) == CTLTYPE_INT &&
898 jp->jp_ctltype = desc.i;
899 jp->jp_flags |= JP_NOBOOL;
900 jp->jp_valuelen = sizeof(int);
906 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
907 "unknown parameter: %s", jp->jp_name);
913 desclen = sizeof(desc);
914 if (sysctl(mib, (miblen / sizeof(int)) + 2, &desc, &desclen,
916 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
917 "sysctl(0.4.%s): %s", jp->jp_name, strerror(errno));
920 /* See if this is an array type. */
921 p = strchr(desc.s, '\0');
923 if (p - 2 < desc.s || strcmp(p - 2, ",a"))
929 /* Look for types we understand. */
930 jp->jp_ctltype = desc.i;
931 switch (desc.i & CTLTYPE) {
933 if (desc.s[0] == 'B')
934 jp->jp_flags |= JP_BOOL;
935 else if (!strcmp(desc.s, "E,jailsys"))
936 jp->jp_flags |= JP_JAILSYS;
938 jp->jp_valuelen = sizeof(int);
942 jp->jp_valuelen = sizeof(long);
945 jp->jp_valuelen = sizeof(int64_t);
949 desclen = sizeof(desc.s);
950 if (sysctl(mib + 2, miblen / sizeof(int), desc.s, &desclen,
952 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
953 "sysctl(" SJPARAM ".%s): %s", jp->jp_name,
957 jp->jp_valuelen = strtoul(desc.s, NULL, 10);
960 if (!strcmp(desc.s, "S,in_addr")) {
961 jp->jp_structtype = JPS_IN_ADDR;
962 jp->jp_valuelen = sizeof(struct in_addr);
963 } else if (!strcmp(desc.s, "S,in6_addr")) {
964 jp->jp_structtype = JPS_IN6_ADDR;
965 jp->jp_valuelen = sizeof(struct in6_addr);
968 if (sysctl(mib + 2, miblen / sizeof(int),
969 NULL, &jp->jp_valuelen, NULL, 0) < 0) {
970 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
971 "sysctl(" SJPARAM ".%s): %s", jp->jp_name,
978 /* A node might be described by an empty-named child. */
980 mib[(miblen / sizeof(int)) + 2] =
981 mib[(miblen / sizeof(int)) + 1] - 1;
982 miblen += sizeof(int);
983 desclen = sizeof(desc.s);
984 if (sysctl(mib, (miblen / sizeof(int)) + 2, desc.s, &desclen,
986 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
987 "sysctl(0.1): %s", strerror(errno));
990 if (desc.s[desclen - 2] != '.')
991 goto unknown_parameter;
994 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
995 "unknown type for %s", jp->jp_name);
1000 jp->jp_elemlen = jp->jp_valuelen;
1001 jp->jp_valuelen = 0;
1007 * Change a boolean parameter name into its "no" counterpart or vice versa.
1010 noname(const char *name)
1014 nname = malloc(strlen(name) + 3);
1015 if (nname == NULL) {
1016 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
1019 p = strrchr(name, '.');
1021 sprintf(nname, "%.*s.no%s", (int)(p - name), name, p + 1);
1023 sprintf(nname, "no%s", name);
1028 nononame(const char *name)
1032 p = strrchr(name, '.');
1033 if (strncmp(p ? p + 1 : name, "no", 2)) {
1034 snprintf(jail_errmsg, sizeof(jail_errmsg),
1035 "mismatched boolean: %s", name);
1039 nname = malloc(strlen(name) - 1);
1040 if (nname == NULL) {
1041 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
1045 sprintf(nname, "%.*s.%s", (int)(p - name), name, p + 3);
1047 strcpy(nname, name + 2);