2 * ----------------------------------------------------------------------------
3 * "THE BEER-WARE LICENSE" (Revision 42):
4 * <phk@FreeBSD.org> wrote this file. As long as you retain this notice you
5 * can do whatever you want with this stuff. If we meet some day, and you think
6 * this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp
7 * ----------------------------------------------------------------------------
26 char pr_path[MAXPATHLEN];
27 char pr_host[MAXHOSTNAMELEN];
30 #define XPRISON_VERSION 1
34 int jail(struct jail *);
39 #include <sys/queue.h>
40 #include <sys/_lock.h>
41 #include <sys/_mutex.h>
42 #include <sys/_task.h>
44 #define JAIL_MAX 999999
47 MALLOC_DECLARE(M_PRISON);
51 * This structure describes a prison. It is pointed to by all struct
52 * ucreds's of the inmates. pr_ref keeps track of them and is used to
53 * delete the struture when the last inmate is dead.
57 * (p) locked by pr_mutex
58 * (c) set only during creation before the structure is shared, no mutex
60 * (d) set only during destruction of jail, no mutex needed
63 LIST_ENTRY(prison) pr_list; /* (a) all prisons */
64 int pr_id; /* (c) prison id */
65 int pr_ref; /* (p) refcount */
66 char pr_path[MAXPATHLEN]; /* (c) chroot path */
67 struct vnode *pr_root; /* (c) vnode to rdir */
68 char pr_host[MAXHOSTNAMELEN]; /* (p) jail hostname */
69 u_int32_t pr_ip; /* (c) ip addr host */
70 void *pr_linux; /* (p) linux abi */
71 int pr_securelevel; /* (p) securelevel */
72 struct task pr_task; /* (d) destroy task */
77 * Sysctl-set variables that determine global jail policy
79 * XXX MIB entries will need to be protected by a mutex.
81 extern int jail_set_hostname_allowed;
82 extern int jail_socket_unixiproute_only;
83 extern int jail_sysvipc_allowed;
84 extern int jail_getfsstat_jailrootonly;
85 extern int jail_allow_raw_sockets;
87 LIST_HEAD(prisonlist, prison);
88 extern struct prisonlist allprison;
91 * Kernel support functions for jail().
96 int jailed(struct ucred *cred);
97 void getcredhostname(struct ucred *cred, char *, size_t);
98 int prison_check(struct ucred *cred1, struct ucred *cred2);
99 int prison_check_mount(struct ucred *cred, struct mount *mp);
100 void prison_free(struct prison *pr);
101 u_int32_t prison_getip(struct ucred *cred);
102 void prison_hold(struct prison *pr);
103 int prison_if(struct ucred *cred, struct sockaddr *sa);
104 int prison_ip(struct ucred *cred, int flag, u_int32_t *ip);
105 void prison_remote_ip(struct ucred *cred, int flags, u_int32_t *ip);
107 #endif /* !_KERNEL */
108 #endif /* !_SYS_JAIL_H_ */