usr.sbin/jail/jail.c

   1 /*
   2  * ----------------------------------------------------------------------------
   3  * "THE BEER-WARE LICENSE" (Revision 42):
   4  * <phk@FreeBSD.ORG> wrote this file.  As long as you retain this notice you
   5  * can do whatever you want with this stuff. If we meet some day, and you think
   6  * this stuff is worth it, you can buy me a beer in return.   Poul-Henning Kamp
   7  * ----------------------------------------------------------------------------
   8  */
   9
  10 #include <sys/cdefs.h>
  11 __FBSDID("$FreeBSD$");
  12
  13 #include <sys/param.h>
  14 #include <sys/jail.h>
  15
  16 #include <netinet/in.h>
  17 #include <arpa/inet.h>
  18
  19 #include <err.h>
  20 #include <errno.h>
  21 #include <grp.h>
  22 #include <login_cap.h>
  23 #include <paths.h>
  24 #include <pwd.h>
  25 #include <stdio.h>
  26 #include <stdlib.h>
  27 #include <string.h>
  28 #include <unistd.h>
  29
  30 static void     usage(void);
  31 extern char     **environ;
  32
  33 #define GET_USER_INFO do {                                              \
  34         pwd = getpwnam(username);                                       \
  35         if (pwd == NULL) {                                              \
  36                 if (errno)                                              \
  37                         err(1, "getpwnam: %s", username);               \
  38                 else                                                    \
  39                         errx(1, "%s: no such user", username);          \
  40         }                                                               \
  41         lcap = login_getpwclass(pwd);                                   \
  42         if (lcap == NULL)                                               \
  43                 err(1, "getpwclass: %s", username);                     \
  44         ngroups = NGROUPS;                                              \
  45         if (getgrouplist(username, pwd->pw_gid, groups, &ngroups) != 0) \
  46                 err(1, "getgrouplist: %s", username);                   \
  47 } while (0)
  48
  49 int
  50 main(int argc, char **argv)
  51 {
  52         login_cap_t *lcap = NULL;
  53         struct jail j;
  54         struct passwd *pwd = NULL;
  55         struct in_addr in;
  56         gid_t groups[NGROUPS];
  57         int ch, i, iflag, Jflag, lflag, ngroups, uflag, Uflag;
  58         char path[PATH_MAX], *username, *JidFile;
  59         static char *cleanenv;
  60         const char *shell, *p = NULL;
  61         FILE *fp;
  62
  63         iflag = Jflag = lflag = uflag = Uflag = 0;
  64         username = JidFile = cleanenv = NULL;
  65         fp = NULL;
  66
  67         while ((ch = getopt(argc, argv, "ilu:U:J:")) != -1) {
  68                 switch (ch) {
  69                 case 'i':
  70                         iflag = 1;
  71                         break;
  72                 case 'J':
  73                         JidFile = optarg;
  74                         Jflag = 1;
  75                         break;
  76                 case 'u':
  77                         username = optarg;
  78                         uflag = 1;
  79                         break;
  80                 case 'U':
  81                         username = optarg;
  82                         Uflag = 1;
  83                         break;
  84                 case 'l':
  85                         lflag = 1;
  86                         break;
  87                 default:
  88                         usage();
  89                 }
  90         }
  91         argc -= optind;
  92         argv += optind;
  93         if (argc < 4)
  94                 usage();
  95         if (uflag && Uflag)
  96                 usage();
  97         if (lflag && username == NULL)
  98                 usage();
  99         if (uflag)
 100                 GET_USER_INFO;
 101         if (realpath(argv[0], path) == NULL)
 102                 err(1, "realpath: %s", argv[0]);
 103         if (chdir(path) != 0)
 104                 err(1, "chdir: %s", path);
 105         memset(&j, 0, sizeof(j));
 106         j.version = 0;
 107         j.path = path;
 108         j.hostname = argv[1];
 109         if (inet_aton(argv[2], &in) == 0)
 110                 errx(1, "Could not make sense of ip-number: %s", argv[2]);
 111         j.ip_number = ntohl(in.s_addr);
 112         if (Jflag) {
 113                 fp = fopen(JidFile, "w");
 114                 if (fp == NULL)
 115                         errx(1, "Could not create JidFile: %s", JidFile);
 116         }
 117         i = jail(&j);
 118         if (i == -1)
 119                 err(1, "jail");
 120         if (iflag) {
 121                 printf("%d\n", i);
 122                 fflush(stdout);
 123         }
 124         if (Jflag) {
 125                 if (fp != NULL) {
 126                         fprintf(fp, "%d\t%s\t%s\t%s\t%s\n",
 127                             i, j.path, j.hostname, argv[2], argv[3]);
 128                         (void)fclose(fp);
 129                 } else {
 130                         errx(1, "Could not write JidFile: %s", JidFile);
 131                 }
 132         }
 133         if (username != NULL) {
 134                 if (Uflag)
 135                         GET_USER_INFO;
 136                 if (lflag) {
 137                         p = getenv("TERM");
 138                         environ = &cleanenv;
 139                 }
 140                 if (setgroups(ngroups, groups) != 0)
 141                         err(1, "setgroups");
 142                 if (setgid(pwd->pw_gid) != 0)
 143                         err(1, "setgid");
 144                 if (setusercontext(lcap, pwd, pwd->pw_uid,
 145                     LOGIN_SETALL & ~LOGIN_SETGROUP) != 0)
 146                         err(1, "setusercontext");
 147                 login_close(lcap);
 148         }
 149         if (lflag) {
 150                 if (*pwd->pw_shell)
 151                         shell = pwd->pw_shell;
 152                 else
 153                         shell = _PATH_BSHELL;
 154                 if (chdir(pwd->pw_dir) < 0)
 155                         errx(1, "no home directory");
 156                 setenv("HOME", pwd->pw_dir, 1);
 157                 setenv("SHELL", shell, 1);
 158                 setenv("USER", pwd->pw_name, 1);
 159                 if (p)
 160                         setenv("TERM", p, 1);
 161         }
 162         if (execv(argv[3], argv + 3) != 0)
 163                 err(1, "execv: %s", argv[3]);
 164         exit(0);
 165 }
 166
 167 static void
 168 usage(void)
 169 {
 170
 171         (void)fprintf(stderr, "%s%s\n",
 172              "usage: jail [-i] [-J jid_file] [-l -u username | -U username]",
 173              " path hostname ip-number command ...");
 174         exit(1);
 175 }