lib/libjail/jail.c

   1 /*-
   2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
   3  *
   4  * Copyright (c) 2009 James Gritton.
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  *
  16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  17  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  19  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  20  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  22  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  24  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  26  * SUCH DAMAGE.
  27  */
  28
  29 #include <sys/cdefs.h>
  30 __FBSDID("$FreeBSD$");
  31
  32 #include <sys/param.h>
  33 #include <sys/types.h>
  34 #include <sys/jail.h>
  35 #include <sys/linker.h>
  36 #include <sys/socket.h>
  37 #include <sys/sysctl.h>
  38
  39 #include <arpa/inet.h>
  40 #include <netinet/in.h>
  41
  42 #include <errno.h>
  43 #include <inttypes.h>
  44 #include <stdio.h>
  45 #include <stdarg.h>
  46 #include <stdlib.h>
  47 #include <string.h>
  48
  49 #include "jail.h"
  50
  51 #define SJPARAM         "security.jail.param"
  52
  53 #define JPS_IN_ADDR     1
  54 #define JPS_IN6_ADDR    2
  55
  56 #define ARRAY_SANITY    5
  57 #define ARRAY_SLOP      5
  58
  59
  60 static int jailparam_import_enum(const char **values, int nvalues,
  61     const char *valstr, size_t valsize, int *value);
  62 static int jailparam_type(struct jailparam *jp);
  63 static int kldload_param(const char *name);
  64 static char *noname(const char *name);
  65 static char *nononame(const char *name);
  66
  67 char jail_errmsg[JAIL_ERRMSGLEN];
  68
  69 static const char *bool_values[] = { "false", "true" };
  70 static const char *jailsys_values[] = { "disable", "new", "inherit" };
  71
  72
  73 /*
  74  * Import a null-terminated parameter list and set a jail with the flags
  75  * and parameters.
  76  */
  77 int
  78 jail_setv(int flags, ...)
  79 {
  80         va_list ap, tap;
  81         struct jailparam *jp;
  82         const char *name, *value;
  83         int njp, jid;
  84
  85         /* Create the parameter list and import the parameters. */
  86         va_start(ap, flags);
  87         va_copy(tap, ap);
  88         for (njp = 0; va_arg(tap, char *) != NULL; njp++)
  89                 (void)va_arg(tap, char *);
  90         va_end(tap);
  91         jp = alloca(njp * sizeof(struct jailparam));
  92         for (njp = 0; (name = va_arg(ap, char *)) != NULL;) {
  93                 value = va_arg(ap, char *);
  94                 if (jailparam_init(jp + njp, name) < 0)
  95                         goto error;
  96                 if (jailparam_import(jp + njp++, value) < 0)
  97                         goto error;
  98         }
  99         va_end(ap);
 100         jid = jailparam_set(jp, njp, flags);
 101         jailparam_free(jp, njp);
 102         return (jid);
 103
 104  error:
 105         jailparam_free(jp, njp);
 106         va_end(ap);
 107         return (-1);
 108 }
 109
 110 /*
 111  * Read a null-terminated parameter list, get the referenced jail, and export
 112  * the parameters to the list.
 113  */
 114 int
 115 jail_getv(int flags, ...)
 116 {
 117         va_list ap, tap;
 118         struct jailparam *jp, *jp_lastjid, *jp_jid, *jp_name, *jp_key;
 119         char *valarg, *value;
 120         const char *name, *key_value, *lastjid_value, *jid_value, *name_value;
 121         int njp, i, jid;
 122
 123         /* Create the parameter list and find the key. */
 124         va_start(ap, flags);
 125         va_copy(tap, ap);
 126         for (njp = 0; va_arg(tap, char *) != NULL; njp++)
 127                 (void)va_arg(tap, char *);
 128         va_end(tap);
 129
 130         jp = alloca(njp * sizeof(struct jailparam));
 131         va_copy(tap, ap);
 132         jp_lastjid = jp_jid = jp_name = NULL;
 133         lastjid_value = jid_value = name_value = NULL;
 134         for (njp = 0; (name = va_arg(tap, char *)) != NULL; njp++) {
 135                 value = va_arg(tap, char *);
 136                 if (jailparam_init(jp + njp, name) < 0) {
 137                         va_end(tap);
 138                         goto error;
 139                 }
 140                 if (!strcmp(jp[njp].jp_name, "lastjid")) {
 141                         jp_lastjid = jp + njp;
 142                         lastjid_value = value;
 143                 } else if (!strcmp(jp[njp].jp_name, "jid")) {
 144                         jp_jid = jp + njp;
 145                         jid_value = value;
 146                 } if (!strcmp(jp[njp].jp_name, "name")) {
 147                         jp_name = jp + njp;
 148                         name_value = value;
 149                 }
 150         }
 151         va_end(tap);
 152         /* Import the key parameter. */
 153         if (jp_lastjid != NULL) {
 154                 jp_key = jp_lastjid;
 155                 key_value = lastjid_value;
 156         } else if (jp_jid != NULL && strtol(jid_value, NULL, 10) != 0) {
 157                 jp_key = jp_jid;
 158                 key_value = jid_value;
 159         } else if (jp_name != NULL) {
 160                 jp_key = jp_name;
 161                 key_value = name_value;
 162         } else {
 163                 strlcpy(jail_errmsg, "no jail specified", JAIL_ERRMSGLEN);
 164                 errno = ENOENT;
 165                 goto error;
 166         }
 167         if (jailparam_import(jp_key, key_value) < 0)
 168                 goto error;
 169         /* Get the jail and export the parameters. */
 170         jid = jailparam_get(jp, njp, flags);
 171         if (jid < 0)
 172                 goto error;
 173         for (i = 0; i < njp; i++) {
 174                 (void)va_arg(ap, char *);
 175                 valarg = va_arg(ap, char *);
 176                 if (jp + i != jp_key) {
 177                         /* It's up to the caller to ensure there's room. */
 178                         if ((jp[i].jp_ctltype & CTLTYPE) == CTLTYPE_STRING)
 179                                 strcpy(valarg, jp[i].jp_value);
 180                         else {
 181                                 value = jailparam_export(jp + i);
 182                                 if (value == NULL)
 183                                         goto error;
 184                                 strcpy(valarg, value);
 185                                 free(value);
 186                         }
 187                 }
 188         }
 189         jailparam_free(jp, njp);
 190         va_end(ap);
 191         return (jid);
 192
 193  error:
 194         jailparam_free(jp, njp);
 195         va_end(ap);
 196         return (-1);
 197 }
 198
 199 /*
 200  * Return a list of all known parameters.
 201  */
 202 int
 203 jailparam_all(struct jailparam **jpp)
 204 {
 205         struct jailparam *jp, *tjp;
 206         size_t mlen1, mlen2, buflen;
 207         unsigned njp, nlist;
 208         int mib1[CTL_MAXNAME], mib2[CTL_MAXNAME - 2];
 209         char buf[MAXPATHLEN];
 210
 211         njp = 0;
 212         nlist = 32;
 213         jp = malloc(nlist * sizeof(*jp));
 214         if (jp == NULL) {
 215                 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
 216                 return (-1);
 217         }
 218         mib1[0] = 0;
 219         mib1[1] = 2;
 220         mlen1 = CTL_MAXNAME - 2;
 221         if (sysctlnametomib(SJPARAM, mib1 + 2, &mlen1) < 0) {
 222                 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
 223                     "sysctlnametomib(" SJPARAM "): %s", strerror(errno));
 224                 goto error;
 225         }
 226         for (;; njp++) {
 227                 /* Get the next parameter. */
 228                 mlen2 = sizeof(mib2);
 229                 if (sysctl(mib1, mlen1 + 2, mib2, &mlen2, NULL, 0) < 0) {
 230                         if (errno == ENOENT) {
 231                                 /* No more entries. */
 232                                 break;
 233                         }
 234                         snprintf(jail_errmsg, JAIL_ERRMSGLEN,
 235                             "sysctl(0.2): %s", strerror(errno));
 236                         goto error;
 237                 }
 238                 if (mib2[0] != mib1[2] ||
 239                     mib2[1] != mib1[3] ||
 240                     mib2[2] != mib1[4])
 241                         break;
 242                 /* Convert it to an ascii name. */
 243                 memcpy(mib1 + 2, mib2, mlen2);
 244                 mlen1 = mlen2 / sizeof(int);
 245                 mib1[1] = 1;
 246                 buflen = sizeof(buf);
 247                 if (sysctl(mib1, mlen1 + 2, buf, &buflen, NULL, 0) < 0) {
 248                         snprintf(jail_errmsg, JAIL_ERRMSGLEN,
 249                             "sysctl(0.1): %s", strerror(errno));
 250                         goto error;
 251                 }
 252                 if (buf[buflen - 2] == '.')
 253                         buf[buflen - 2] = '\0';
 254                 /* Add the parameter to the list */
 255                 if (njp >= nlist) {
 256                         nlist *= 2;
 257                         tjp = reallocarray(jp, nlist, sizeof(*jp));
 258                         if (tjp == NULL)
 259                                 goto error;
 260                         jp = tjp;
 261                 }
 262                 if (jailparam_init(jp + njp, buf + sizeof(SJPARAM)) < 0)
 263                         goto error;
 264                 mib1[1] = 2;
 265         }
 266         jp = reallocarray(jp, njp, sizeof(*jp));
 267         *jpp = jp;
 268         return (njp);
 269
 270  error:
 271         jailparam_free(jp, njp);
 272         free(jp);
 273         return (-1);
 274 }
 275
 276 /*
 277  * Clear a jail parameter and copy in its name.
 278  */
 279 int
 280 jailparam_init(struct jailparam *jp, const char *name)
 281 {
 282
 283         memset(jp, 0, sizeof(*jp));
 284         jp->jp_name = strdup(name);
 285         if (jp->jp_name == NULL) {
 286                 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
 287                 return (-1);
 288         }
 289         if (jailparam_type(jp) < 0) {
 290                 jailparam_free(jp, 1);
 291                 jp->jp_name = NULL;
 292                 jp->jp_value = NULL;
 293                 return (-1);
 294         }
 295         return (0);
 296 }
 297
 298 /*
 299  * Put a name and value into a jail parameter element, converting the value
 300  * to internal form.
 301  */
 302 int
 303 jailparam_import(struct jailparam *jp, const char *value)
 304 {
 305         char *p, *ep, *tvalue;
 306         const char *avalue;
 307         int i, nval, fw;
 308
 309         if (value == NULL)
 310                 return (0);
 311         if ((jp->jp_ctltype & CTLTYPE) == CTLTYPE_STRING) {
 312                 jp->jp_value = strdup(value);
 313                 if (jp->jp_value == NULL) {
 314                         strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
 315                         return (-1);
 316                 }
 317                 return (0);
 318         }
 319         nval = 1;
 320         if (jp->jp_elemlen) {
 321                 if (value[0] == '\0' || (value[0] == '-' && value[1] == '\0')) {
 322                         jp->jp_value = strdup("");
 323                         if (jp->jp_value == NULL) {
 324                                 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
 325                                 return (-1);
 326                         }
 327                         jp->jp_valuelen = 0;
 328                         return (0);
 329                 }
 330                 for (p = strchr(value, ','); p; p = strchr(p + 1, ','))
 331                         nval++;
 332                 jp->jp_valuelen = jp->jp_elemlen * nval;
 333         }
 334         jp->jp_value = malloc(jp->jp_valuelen);
 335         if (jp->jp_value == NULL) {
 336                 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
 337                 return (-1);
 338         }
 339         avalue = value;
 340         for (i = 0; i < nval; i++) {
 341                 fw = nval == 1 ? strlen(avalue) : strcspn(avalue, ",");
 342                 switch (jp->jp_ctltype & CTLTYPE) {
 343                 case CTLTYPE_INT:
 344                         if (jp->jp_flags & (JP_BOOL | JP_NOBOOL)) {
 345                                 if (!jailparam_import_enum(bool_values, 2,
 346                                     avalue, fw, &((int *)jp->jp_value)[i])) {
 347                                         snprintf(jail_errmsg,
 348                                             JAIL_ERRMSGLEN, "%s: "
 349                                             "unknown boolean value \"%.*s\"",
 350                                             jp->jp_name, fw, avalue);
 351                                         errno = EINVAL;
 352                                         goto error;
 353                                 }
 354                                 break;
 355                         }
 356                         if (jp->jp_flags & JP_JAILSYS) {
 357                                 /*
 358                                  * Allow setting a jailsys parameter to "new"
 359                                  * in a booleanesque fashion.
 360                                  */
 361                                 if (value[0] == '\0')
 362                                         ((int *)jp->jp_value)[i] = JAIL_SYS_NEW;
 363                                 else if (!jailparam_import_enum(jailsys_values,
 364                                     sizeof(jailsys_values) /
 365                                     sizeof(jailsys_values[0]), avalue, fw,
 366                                     &((int *)jp->jp_value)[i])) {
 367                                         snprintf(jail_errmsg,
 368                                             JAIL_ERRMSGLEN, "%s: "
 369                                             "unknown jailsys value \"%.*s\"",
 370                                             jp->jp_name, fw, avalue);
 371                                         errno = EINVAL;
 372                                         goto error;
 373                                 }
 374                                 break;
 375                         }
 376                         ((int *)jp->jp_value)[i] = strtol(avalue, &ep, 10);
 377                 integer_test:
 378                         if (ep != avalue + fw) {
 379                                 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
 380                                     "%s: non-integer value \"%.*s\"",
 381                                     jp->jp_name, fw, avalue);
 382                                 errno = EINVAL;
 383                                 goto error;
 384                         }
 385                         break;
 386                 case CTLTYPE_UINT:
 387                         ((unsigned *)jp->jp_value)[i] =
 388                             strtoul(avalue, &ep, 10);
 389                         goto integer_test;
 390                 case CTLTYPE_LONG:
 391                         ((long *)jp->jp_value)[i] = strtol(avalue, &ep, 10);
 392                         goto integer_test;
 393                 case CTLTYPE_ULONG:
 394                         ((unsigned long *)jp->jp_value)[i] =
 395                             strtoul(avalue, &ep, 10);
 396                         goto integer_test;
 397                 case CTLTYPE_S64:
 398                         ((int64_t *)jp->jp_value)[i] =
 399                             strtoimax(avalue, &ep, 10);
 400                         goto integer_test;
 401                 case CTLTYPE_U64:
 402                         ((uint64_t *)jp->jp_value)[i] =
 403                             strtoumax(avalue, &ep, 10);
 404                         goto integer_test;
 405                 case CTLTYPE_STRUCT:
 406                         tvalue = alloca(fw + 1);
 407                         strlcpy(tvalue, avalue, fw + 1);
 408                         switch (jp->jp_structtype) {
 409                         case JPS_IN_ADDR:
 410                                 if (inet_pton(AF_INET, tvalue,
 411                                     &((struct in_addr *)jp->jp_value)[i]) != 1)
 412                                 {
 413                                         snprintf(jail_errmsg,
 414                                             JAIL_ERRMSGLEN,
 415                                             "%s: not an IPv4 address: %s",
 416                                             jp->jp_name, tvalue);
 417                                         errno = EINVAL;
 418                                         goto error;
 419                                 }
 420                                 break;
 421                         case JPS_IN6_ADDR:
 422                                 if (inet_pton(AF_INET6, tvalue,
 423                                     &((struct in6_addr *)jp->jp_value)[i]) != 1)
 424                                 {
 425                                         snprintf(jail_errmsg,
 426                                             JAIL_ERRMSGLEN,
 427                                             "%s: not an IPv6 address: %s",
 428                                             jp->jp_name, tvalue);
 429                                         errno = EINVAL;
 430                                         goto error;
 431                                 }
 432                                 break;
 433                         default:
 434                                 goto unknown_type;
 435                         }
 436                         break;
 437                 default:
 438                 unknown_type:
 439                         snprintf(jail_errmsg, JAIL_ERRMSGLEN,
 440                             "unknown type for %s", jp->jp_name);
 441                         errno = ENOENT;
 442                         goto error;
 443                 }
 444                 avalue += fw + 1;
 445         }
 446         return (0);
 447
 448  error:
 449         free(jp->jp_value);
 450         jp->jp_value = NULL;
 451         return (-1);
 452 }
 453
 454 static int
 455 jailparam_import_enum(const char **values, int nvalues, const char *valstr,
 456     size_t valsize, int *value)
 457 {
 458         char *ep;
 459         int i;
 460
 461         for (i = 0; i < nvalues; i++)
 462                 if (valsize == strlen(values[i]) &&
 463                     !strncasecmp(valstr, values[i], valsize)) {
 464                         *value = i;
 465                         return 1;
 466                 }
 467         *value = strtol(valstr, &ep, 10);
 468         return (ep == valstr + valsize);
 469 }
 470
 471 /*
 472  * Put a name and value into a jail parameter element, copying the value
 473  * but not altering it.
 474  */
 475 int
 476 jailparam_import_raw(struct jailparam *jp, void *value, size_t valuelen)
 477 {
 478
 479         jp->jp_value = value;
 480         jp->jp_valuelen = valuelen;
 481         jp->jp_flags |= JP_RAWVALUE;
 482         return (0);
 483 }
 484
 485 /*
 486  * Run the jail_set and jail_get system calls on a parameter list.
 487  */
 488 int
 489 jailparam_set(struct jailparam *jp, unsigned njp, int flags)
 490 {
 491         struct iovec *jiov;
 492         char *nname;
 493         int i, jid, bool0;
 494         unsigned j;
 495
 496         jiov = alloca(sizeof(struct iovec) * 2 * (njp + 1));
 497         bool0 = 0;
 498         for (i = j = 0; j < njp; j++) {
 499                 jiov[i].iov_base = jp[j].jp_name;
 500                 jiov[i].iov_len = strlen(jp[j].jp_name) + 1;
 501                 i++;
 502                 if (jp[j].jp_flags & (JP_BOOL | JP_NOBOOL)) {
 503                         /*
 504                          * Set booleans without values.  If one has a value of
 505                          * zero, change it to (or from) its "no" counterpart.
 506                          */
 507                         jiov[i].iov_base = NULL;
 508                         jiov[i].iov_len = 0;
 509                         if (jp[j].jp_value != NULL &&
 510                             jp[j].jp_valuelen == sizeof(int) &&
 511                             !*(int *)jp[j].jp_value) {
 512                                 bool0 = 1;
 513                                 nname = jp[j].jp_flags & JP_BOOL
 514                                     ? noname(jp[j].jp_name)
 515                                     : nononame(jp[j].jp_name);
 516                                 if (nname == NULL) {
 517                                         njp = j;
 518                                         jid = -1;
 519                                         goto done;
 520                                 }
 521                                 jiov[i - 1].iov_base = nname;
 522                                 jiov[i - 1].iov_len = strlen(nname) + 1;
 523
 524                         }
 525                 } else {
 526                         /*
 527                          * Try to fill in missing values with an empty string.
 528                          */
 529                         if (jp[j].jp_value == NULL && jp[j].jp_valuelen > 0 &&
 530                             jailparam_import(jp + j, "") < 0) {
 531                                 njp = j;
 532                                 jid = -1;
 533                                 goto done;
 534                         }
 535                         jiov[i].iov_base = jp[j].jp_value;
 536                         jiov[i].iov_len =
 537                             (jp[j].jp_ctltype & CTLTYPE) == CTLTYPE_STRING
 538                             ? strlen(jp[j].jp_value) + 1
 539                             : jp[j].jp_valuelen;
 540                 }
 541                 i++;
 542         }
 543         jiov[i].iov_base = __DECONST(char *, "errmsg");
 544         jiov[i].iov_len = sizeof("errmsg");
 545         i++;
 546         jiov[i].iov_base = jail_errmsg;
 547         jiov[i].iov_len = JAIL_ERRMSGLEN;
 548         i++;
 549         jail_errmsg[0] = 0;
 550         jid = jail_set(jiov, i, flags);
 551         if (jid < 0 && !jail_errmsg[0])
 552                 snprintf(jail_errmsg, sizeof(jail_errmsg), "jail_set: %s",
 553                     strerror(errno));
 554  done:
 555         if (bool0)
 556                 for (j = 0; j < njp; j++)
 557                         if ((jp[j].jp_flags & (JP_BOOL | JP_NOBOOL)) &&
 558                             jp[j].jp_value != NULL &&
 559                             jp[j].jp_valuelen == sizeof(int) &&
 560                             !*(int *)jp[j].jp_value)
 561                                 free(jiov[j * 2].iov_base);
 562         return (jid);
 563 }
 564
 565 int
 566 jailparam_get(struct jailparam *jp, unsigned njp, int flags)
 567 {
 568         struct iovec *jiov;
 569         struct jailparam *jp_lastjid, *jp_jid, *jp_name, *jp_key;
 570         int i, ai, ki, jid, arrays, sanity;
 571         unsigned j;
 572
 573         /*
 574          * Get the types for all parameters.
 575          * Find the key and any array parameters.
 576          */
 577         jiov = alloca(sizeof(struct iovec) * 2 * (njp + 1));
 578         jp_lastjid = jp_jid = jp_name = NULL;
 579         arrays = 0;
 580         for (ai = j = 0; j < njp; j++) {
 581                 if (!strcmp(jp[j].jp_name, "lastjid"))
 582                         jp_lastjid = jp + j;
 583                 else if (!strcmp(jp[j].jp_name, "jid"))
 584                         jp_jid = jp + j;
 585                 else if (!strcmp(jp[j].jp_name, "name"))
 586                         jp_name = jp + j;
 587                 else if (jp[j].jp_elemlen && !(jp[j].jp_flags & JP_RAWVALUE)) {
 588                         arrays = 1;
 589                         jiov[ai].iov_base = jp[j].jp_name;
 590                         jiov[ai].iov_len = strlen(jp[j].jp_name) + 1;
 591                         ai++;
 592                         jiov[ai].iov_base = NULL;
 593                         jiov[ai].iov_len = 0;
 594                         ai++;
 595                 }
 596         }
 597         jp_key = jp_lastjid ? jp_lastjid :
 598             jp_jid && jp_jid->jp_valuelen == sizeof(int) &&
 599             jp_jid->jp_value && *(int *)jp_jid->jp_value ? jp_jid : jp_name;
 600         if (jp_key == NULL || jp_key->jp_value == NULL) {
 601                 strlcpy(jail_errmsg, "no jail specified", JAIL_ERRMSGLEN);
 602                 errno = ENOENT;
 603                 return (-1);
 604         }
 605         ki = ai;
 606         jiov[ki].iov_base = jp_key->jp_name;
 607         jiov[ki].iov_len = strlen(jp_key->jp_name) + 1;
 608         ki++;
 609         jiov[ki].iov_base = jp_key->jp_value;
 610         jiov[ki].iov_len = (jp_key->jp_ctltype & CTLTYPE) == CTLTYPE_STRING
 611             ? strlen(jp_key->jp_value) + 1 : jp_key->jp_valuelen;
 612         ki++;
 613         jiov[ki].iov_base = __DECONST(char *, "errmsg");
 614         jiov[ki].iov_len = sizeof("errmsg");
 615         ki++;
 616         jiov[ki].iov_base = jail_errmsg;
 617         jiov[ki].iov_len = JAIL_ERRMSGLEN;
 618         ki++;
 619         jail_errmsg[0] = 0;
 620         if (arrays && jail_get(jiov, ki, flags) < 0) {
 621                 if (!jail_errmsg[0])
 622                         snprintf(jail_errmsg, sizeof(jail_errmsg),
 623                             "jail_get: %s", strerror(errno));
 624                 return (-1);
 625         }
 626         /* Allocate storage for all parameters. */
 627         for (ai = j = 0, i = ki; j < njp; j++) {
 628                 if (jp[j].jp_elemlen && !(jp[j].jp_flags & JP_RAWVALUE)) {
 629                         ai++;
 630                         jiov[ai].iov_len += jp[j].jp_elemlen * ARRAY_SLOP;
 631                         if (jp[j].jp_valuelen >= jiov[ai].iov_len)
 632                                 jiov[ai].iov_len = jp[j].jp_valuelen;
 633                         else {
 634                                 jp[j].jp_valuelen = jiov[ai].iov_len;
 635                                 if (jp[j].jp_value != NULL)
 636                                         free(jp[j].jp_value);
 637                                 jp[j].jp_value = malloc(jp[j].jp_valuelen);
 638                                 if (jp[j].jp_value == NULL) {
 639                                         strerror_r(errno, jail_errmsg,
 640                                             JAIL_ERRMSGLEN);
 641                                         return (-1);
 642                                 }
 643                         }
 644                         jiov[ai].iov_base = jp[j].jp_value;
 645                         memset(jiov[ai].iov_base, 0, jiov[ai].iov_len);
 646                         ai++;
 647                 } else if (jp + j != jp_key) {
 648                         jiov[i].iov_base = jp[j].jp_name;
 649                         jiov[i].iov_len = strlen(jp[j].jp_name) + 1;
 650                         i++;
 651                         if (jp[j].jp_value == NULL &&
 652                             !(jp[j].jp_flags & JP_RAWVALUE)) {
 653                                 jp[j].jp_value = malloc(jp[j].jp_valuelen);
 654                                 if (jp[j].jp_value == NULL) {
 655                                         strerror_r(errno, jail_errmsg,
 656                                             JAIL_ERRMSGLEN);
 657                                         return (-1);
 658                                 }
 659                         }
 660                         jiov[i].iov_base = jp[j].jp_value;
 661                         jiov[i].iov_len = jp[j].jp_valuelen;
 662                         memset(jiov[i].iov_base, 0, jiov[i].iov_len);
 663                         i++;
 664                 }
 665         }
 666         /*
 667          * Get the prison.  If there are array elements, retry a few times
 668          * in case their sizes changed from under us.
 669          */
 670         for (sanity = 0;; sanity++) {
 671                 jid = jail_get(jiov, i, flags);
 672                 if (jid >= 0 || !arrays || sanity == ARRAY_SANITY ||
 673                     errno != EINVAL || jail_errmsg[0])
 674                         break;
 675                 for (ai = j = 0; j < njp; j++) {
 676                         if (jp[j].jp_elemlen &&
 677                             !(jp[j].jp_flags & JP_RAWVALUE)) {
 678                                 ai++;
 679                                 jiov[ai].iov_base = NULL;
 680                                 jiov[ai].iov_len = 0;
 681                                 ai++;
 682                         }
 683                 }
 684                 if (jail_get(jiov, ki, flags) < 0)
 685                         break;
 686                 for (ai = j = 0; j < njp; j++) {
 687                         if (jp[j].jp_elemlen &&
 688                             !(jp[j].jp_flags & JP_RAWVALUE)) {
 689                                 ai++;
 690                                 jiov[ai].iov_len +=
 691                                     jp[j].jp_elemlen * ARRAY_SLOP;
 692                                 if (jp[j].jp_valuelen >= jiov[ai].iov_len)
 693                                         jiov[ai].iov_len = jp[j].jp_valuelen;
 694                                 else {
 695                                         jp[j].jp_valuelen = jiov[ai].iov_len;
 696                                         if (jp[j].jp_value != NULL)
 697                                                 free(jp[j].jp_value);
 698                                         jp[j].jp_value =
 699                                             malloc(jiov[ai].iov_len);
 700                                         if (jp[j].jp_value == NULL) {
 701                                                 strerror_r(errno, jail_errmsg,
 702                                                     JAIL_ERRMSGLEN);
 703                                                 return (-1);
 704                                         }
 705                                 }
 706                                 jiov[ai].iov_base = jp[j].jp_value;
 707                                 memset(jiov[ai].iov_base, 0, jiov[ai].iov_len);
 708                                 ai++;
 709                         }
 710                 }
 711         }
 712         if (jid < 0 && !jail_errmsg[0])
 713                 snprintf(jail_errmsg, sizeof(jail_errmsg),
 714                     "jail_get: %s", strerror(errno));
 715         for (ai = j = 0, i = ki; j < njp; j++) {
 716                 if (jp[j].jp_elemlen && !(jp[j].jp_flags & JP_RAWVALUE)) {
 717                         ai++;
 718                         jp[j].jp_valuelen = jiov[ai].iov_len;
 719                         ai++;
 720                 } else if (jp + j != jp_key) {
 721                         i++;
 722                         jp[j].jp_valuelen = jiov[i].iov_len;
 723                         i++;
 724                 }
 725         }
 726         return (jid);
 727 }
 728
 729 /*
 730  * Convert a jail parameter's value to external form.
 731  */
 732 char *
 733 jailparam_export(struct jailparam *jp)
 734 {
 735         size_t *valuelens;
 736         char *value, *tvalue, **values;
 737         size_t valuelen;
 738         int i, nval, ival;
 739         char valbuf[INET6_ADDRSTRLEN];
 740
 741         if ((jp->jp_ctltype & CTLTYPE) == CTLTYPE_STRING) {
 742                 value = strdup(jp->jp_value);
 743                 if (value == NULL)
 744                         strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
 745                 return (value);
 746         }
 747         nval = jp->jp_elemlen ? jp->jp_valuelen / jp->jp_elemlen : 1;
 748         if (nval == 0) {
 749                 value = strdup("");
 750                 if (value == NULL)
 751                         strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
 752                 return (value);
 753         }
 754         values = alloca(nval * sizeof(char *));
 755         valuelens = alloca(nval * sizeof(size_t));
 756         valuelen = 0;
 757         for (i = 0; i < nval; i++) {
 758                 switch (jp->jp_ctltype & CTLTYPE) {
 759                 case CTLTYPE_INT:
 760                         ival = ((int *)jp->jp_value)[i];
 761                         if ((jp->jp_flags & (JP_BOOL | JP_NOBOOL)) &&
 762                             (unsigned)ival < 2) {
 763                                 strlcpy(valbuf, bool_values[ival],
 764                                     sizeof(valbuf));
 765                                 break;
 766                         }
 767                         if ((jp->jp_flags & JP_JAILSYS) &&
 768                             (unsigned)ival < sizeof(jailsys_values) /
 769                             sizeof(jailsys_values[0])) {
 770                                 strlcpy(valbuf, jailsys_values[ival],
 771                                     sizeof(valbuf));
 772                                 break;
 773                         }
 774                         snprintf(valbuf, sizeof(valbuf), "%d", ival);
 775                         break;
 776                 case CTLTYPE_UINT:
 777                         snprintf(valbuf, sizeof(valbuf), "%u",
 778                             ((unsigned *)jp->jp_value)[i]);
 779                         break;
 780                 case CTLTYPE_LONG:
 781                         snprintf(valbuf, sizeof(valbuf), "%ld",
 782                             ((long *)jp->jp_value)[i]);
 783                         break;
 784                 case CTLTYPE_ULONG:
 785                         snprintf(valbuf, sizeof(valbuf), "%lu",
 786                             ((unsigned long *)jp->jp_value)[i]);
 787                         break;
 788                 case CTLTYPE_S64:
 789                         snprintf(valbuf, sizeof(valbuf), "%jd",
 790                             (intmax_t)((int64_t *)jp->jp_value)[i]);
 791                         break;
 792                 case CTLTYPE_U64:
 793                         snprintf(valbuf, sizeof(valbuf), "%ju",
 794                             (uintmax_t)((uint64_t *)jp->jp_value)[i]);
 795                         break;
 796                 case CTLTYPE_STRUCT:
 797                         switch (jp->jp_structtype) {
 798                         case JPS_IN_ADDR:
 799                                 if (inet_ntop(AF_INET,
 800                                     &((struct in_addr *)jp->jp_value)[i],
 801                                     valbuf, sizeof(valbuf)) == NULL) {
 802                                         strerror_r(errno, jail_errmsg,
 803                                             JAIL_ERRMSGLEN);
 804                                         return (NULL);
 805                                 }
 806                                 break;
 807                         case JPS_IN6_ADDR:
 808                                 if (inet_ntop(AF_INET6,
 809                                     &((struct in6_addr *)jp->jp_value)[i],
 810                                     valbuf, sizeof(valbuf)) == NULL) {
 811                                         strerror_r(errno, jail_errmsg,
 812                                             JAIL_ERRMSGLEN);
 813                                         return (NULL);
 814                                 }
 815                                 break;
 816                         default:
 817                                 goto unknown_type;
 818                         }
 819                         break;
 820                 default:
 821                 unknown_type:
 822                         snprintf(jail_errmsg, JAIL_ERRMSGLEN,
 823                             "unknown type for %s", jp->jp_name);
 824                         errno = ENOENT;
 825                         return (NULL);
 826                 }
 827                 valuelens[i] = strlen(valbuf) + 1;
 828                 valuelen += valuelens[i];
 829                 values[i] = alloca(valuelens[i]);
 830                 strcpy(values[i], valbuf);
 831         }
 832         value = malloc(valuelen);
 833         if (value == NULL)
 834                 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
 835         else {
 836                 tvalue = value;
 837                 for (i = 0; i < nval; i++) {
 838                         strcpy(tvalue, values[i]);
 839                         if (i < nval - 1) {
 840                                 tvalue += valuelens[i];
 841                                 tvalue[-1] = ',';
 842                         }
 843                 }
 844         }
 845         return (value);
 846 }
 847
 848 /*
 849  * Free the contents of a jail parameter list (but not the list itself).
 850  */
 851 void
 852 jailparam_free(struct jailparam *jp, unsigned njp)
 853 {
 854         unsigned j;
 855
 856         for (j = 0; j < njp; j++) {
 857                 free(jp[j].jp_name);
 858                 if (!(jp[j].jp_flags & JP_RAWVALUE))
 859                         free(jp[j].jp_value);
 860         }
 861 }
 862
 863 /*
 864  * Find a parameter's type and size from its MIB.
 865  */
 866 static int
 867 jailparam_type(struct jailparam *jp)
 868 {
 869         char *p, *name, *nname;
 870         size_t miblen, desclen;
 871         int i, isarray;
 872         struct {
 873             int i;
 874             char s[MAXPATHLEN];
 875         } desc;
 876         int mib[CTL_MAXNAME];
 877
 878         /* The "lastjid" parameter isn't real. */
 879         name = jp->jp_name;
 880         if (!strcmp(name, "lastjid")) {
 881                 jp->jp_valuelen = sizeof(int);
 882                 jp->jp_ctltype = CTLTYPE_INT | CTLFLAG_WR;
 883                 return (0);
 884         }
 885
 886         /* Find the sysctl that describes the parameter. */
 887         mib[0] = 0;
 888         mib[1] = 3;
 889         snprintf(desc.s, sizeof(desc.s), SJPARAM ".%s", name);
 890         miblen = sizeof(mib) - 2 * sizeof(int);
 891         if (sysctl(mib, 2, mib + 2, &miblen, desc.s, strlen(desc.s)) < 0) {
 892                 if (errno != ENOENT) {
 893                         snprintf(jail_errmsg, JAIL_ERRMSGLEN,
 894                             "sysctl(0.3.%s): %s", name, strerror(errno));
 895                         return (-1);
 896                 }
 897                 if (kldload_param(name) >= 0 && sysctl(mib, 2, mib + 2, &miblen,
 898                     desc.s, strlen(desc.s)) >= 0)
 899                         goto mib_desc;
 900                 /*
 901                  * The parameter probably doesn't exist.  But it might be
 902                  * the "no" counterpart to a boolean.
 903                  */
 904                 nname = nononame(name);
 905                 if (nname == NULL) {
 906                 unknown_parameter:
 907                         snprintf(jail_errmsg, JAIL_ERRMSGLEN,
 908                             "unknown parameter: %s", jp->jp_name);
 909                         errno = ENOENT;
 910                         return (-1);
 911                 }
 912                 name = alloca(strlen(nname) + 1);
 913                 strcpy(name, nname);
 914                 free(nname);
 915                 snprintf(desc.s, sizeof(desc.s), SJPARAM ".%s", name);
 916                 miblen = sizeof(mib) - 2 * sizeof(int);
 917                 if (sysctl(mib, 2, mib + 2, &miblen, desc.s,
 918                     strlen(desc.s)) < 0)
 919                         goto unknown_parameter;
 920                 jp->jp_flags |= JP_NOBOOL;
 921         }
 922  mib_desc:
 923         mib[1] = 4;
 924         desclen = sizeof(desc);
 925         if (sysctl(mib, (miblen / sizeof(int)) + 2, &desc, &desclen,
 926             NULL, 0) < 0) {
 927                 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
 928                     "sysctl(0.4.%s): %s", name, strerror(errno));
 929                 return (-1);
 930         }
 931         jp->jp_ctltype = desc.i;
 932         /* If this came from removing a "no", it better be a boolean. */
 933         if (jp->jp_flags & JP_NOBOOL) {
 934                 if ((desc.i & CTLTYPE) == CTLTYPE_INT && desc.s[0] == 'B') {
 935                         jp->jp_valuelen = sizeof(int);
 936                         return (0);
 937                 }
 938                 else if ((desc.i & CTLTYPE) != CTLTYPE_NODE)
 939                         goto unknown_parameter;
 940         }
 941         /* See if this is an array type. */
 942         p = strchr(desc.s, '\0');
 943         isarray  = 0;
 944         if (p - 2 < desc.s || strcmp(p - 2, ",a"))
 945                 isarray = 0;
 946         else {
 947                 isarray = 1;
 948                 p[-2] = 0;
 949         }
 950         /* Look for types we understand. */
 951         switch (desc.i & CTLTYPE) {
 952         case CTLTYPE_INT:
 953                 if (desc.s[0] == 'B')
 954                         jp->jp_flags |= JP_BOOL;
 955                 else if (!strcmp(desc.s, "E,jailsys"))
 956                         jp->jp_flags |= JP_JAILSYS;
 957         case CTLTYPE_UINT:
 958                 jp->jp_valuelen = sizeof(int);
 959                 break;
 960         case CTLTYPE_LONG:
 961         case CTLTYPE_ULONG:
 962                 jp->jp_valuelen = sizeof(long);
 963                 break;
 964         case CTLTYPE_S64:
 965         case CTLTYPE_U64:
 966                 jp->jp_valuelen = sizeof(int64_t);
 967                 break;
 968         case CTLTYPE_STRING:
 969                 desc.s[0] = 0;
 970                 desclen = sizeof(desc.s);
 971                 if (sysctl(mib + 2, miblen / sizeof(int), desc.s, &desclen,
 972                     NULL, 0) < 0) {
 973                         snprintf(jail_errmsg, JAIL_ERRMSGLEN,
 974                             "sysctl(" SJPARAM ".%s): %s", name,
 975                             strerror(errno));
 976                         return (-1);
 977                 }
 978                 jp->jp_valuelen = strtoul(desc.s, NULL, 10);
 979                 break;
 980         case CTLTYPE_STRUCT:
 981                 if (!strcmp(desc.s, "S,in_addr")) {
 982                         jp->jp_structtype = JPS_IN_ADDR;
 983                         jp->jp_valuelen = sizeof(struct in_addr);
 984                 } else if (!strcmp(desc.s, "S,in6_addr")) {
 985                         jp->jp_structtype = JPS_IN6_ADDR;
 986                         jp->jp_valuelen = sizeof(struct in6_addr);
 987                 } else {
 988                         desclen = 0;
 989                         if (sysctl(mib + 2, miblen / sizeof(int),
 990                             NULL, &jp->jp_valuelen, NULL, 0) < 0) {
 991                                 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
 992                                     "sysctl(" SJPARAM ".%s): %s", name,
 993                                     strerror(errno));
 994                                 return (-1);
 995                         }
 996                 }
 997                 break;
 998         case CTLTYPE_NODE:
 999                 /*
1000                  * A node might be described by an empty-named child,
1001                  * which would be immediately before or after the node itself.
1002                  */
1003                 mib[1] = 1;
1004                 miblen += sizeof(int);
1005                 for (i = -1; i <= 1; i += 2) {
1006                         mib[(miblen / sizeof(int)) + 1] =
1007                             mib[(miblen / sizeof(int))] + i;
1008                         desclen = sizeof(desc.s);
1009                         if (sysctl(mib, (miblen / sizeof(int)) + 2, desc.s,
1010                             &desclen, NULL, 0) < 0) {
1011                                 if (errno == ENOENT)
1012                                         continue;
1013                                 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
1014                                     "sysctl(0.1): %s", strerror(errno));
1015                                 return (-1);
1016                         }
1017                         if (desclen == sizeof(SJPARAM) + strlen(name) + 2 &&
1018                             memcmp(SJPARAM ".", desc.s, sizeof(SJPARAM)) == 0 &&
1019                             memcmp(name, desc.s + sizeof(SJPARAM),
1020                             desclen - sizeof(SJPARAM) - 2) == 0 &&
1021                             desc.s[desclen - 2] == '.')
1022                                 goto mib_desc;
1023                 }
1024                 goto unknown_parameter;
1025         default:
1026                 snprintf(jail_errmsg, JAIL_ERRMSGLEN,
1027                     "unknown type for %s", jp->jp_name);
1028                 errno = ENOENT;
1029                 return (-1);
1030         }
1031         if (isarray) {
1032                 jp->jp_elemlen = jp->jp_valuelen;
1033                 jp->jp_valuelen = 0;
1034         }
1035         return (0);
1036 }
1037
1038 /*
1039  * Attempt to load a kernel module matching an otherwise nonexistent parameter.
1040  */
1041 static int
1042 kldload_param(const char *name)
1043 {
1044         int kl;
1045
1046         if (strcmp(name, "linux") == 0 || strncmp(name, "linux.", 6) == 0)
1047                 kl = kldload("linux");
1048         else if (strcmp(name, "sysvmsg") == 0 || strcmp(name, "sysvsem") == 0 ||
1049             strcmp(name, "sysvshm") == 0)
1050                 kl = kldload(name);
1051         else if (strncmp(name, "allow.mount.", 12) == 0) {
1052                 /* Load the matching filesystem */
1053                 const char *modname = name + 12;
1054
1055                 kl = kldload(modname);
1056                 if (kl < 0 && errno == ENOENT &&
1057                     strncmp(modname, "no", 2) == 0)
1058                         kl = kldload(modname + 2);
1059         } else {
1060                 errno = ENOENT;
1061                 return (-1);
1062         }
1063         if (kl < 0 && errno == EEXIST) {
1064                 /*
1065                  * In the module is already loaded, then it must not contain
1066                  * the parameter.
1067                  */
1068                 errno = ENOENT;
1069         }
1070         return kl;
1071 }
1072
1073 /*
1074  * Change a boolean parameter name into its "no" counterpart or vice versa.
1075  */
1076 static char *
1077 noname(const char *name)
1078 {
1079         char *nname, *p;
1080
1081         nname = malloc(strlen(name) + 3);
1082         if (nname == NULL) {
1083                 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
1084                 return (NULL);
1085         }
1086         p = strrchr(name, '.');
1087         if (p != NULL)
1088                 sprintf(nname, "%.*s.no%s", (int)(p - name), name, p + 1);
1089         else
1090                 sprintf(nname, "no%s", name);
1091         return (nname);
1092 }
1093
1094 static char *
1095 nononame(const char *name)
1096 {
1097         char *p, *nname;
1098
1099         p = strrchr(name, '.');
1100         if (strncmp(p ? p + 1 : name, "no", 2)) {
1101                 snprintf(jail_errmsg, sizeof(jail_errmsg),
1102                     "mismatched boolean: %s", name);
1103                 errno = EINVAL;
1104                 return (NULL);
1105         }
1106         nname = malloc(strlen(name) - 1);
1107         if (nname == NULL) {
1108                 strerror_r(errno, jail_errmsg, JAIL_ERRMSGLEN);
1109                 return (NULL);
1110         }
1111         if (p != NULL)
1112                 sprintf(nname, "%.*s.%s", (int)(p - name), name, p + 3);
1113         else
1114                 strcpy(nname, name + 2);
1115         return (nname);
1116 }