Skip to content

Commit 851dc7f

Browse files
Jamie GrittonJamie Gritton
Jamie Gritton
authored and
Jamie Gritton
committed
jail: add jail descriptors
Similar to process descriptors, jail desriptors are allow jail administration using the file descriptor interface instead of JIDs. They come from and can be used by jail_set(2) and jail_get(2), and there are two new system calls, jail_attach_jd(2) and jail_remove_jd(2). Reviewed by: bz, brooks Relnotes: yes Differential Revision: https://reviews.freebsd.org/D43696
1 parent 2a346c8 commit 851dc7f

24 files changed

+1256
-54
lines changed

‎lib/libjail/jail.c

Lines changed: 49 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -75,8 +75,9 @@ int
7575
jail_setv(int flags, ...)
7676
{
7777
va_list ap, tap;
78-
struct jailparam *jp;
79-
const char *name, *value;
78+
struct jailparam *jp, *jp_desc;
79+
const char *name;
80+
char *value, *desc_value;
8081
int njp, jid;
8182

8283
/* Create the parameter list and import the parameters. */
@@ -86,15 +87,24 @@ jail_setv(int flags, ...)
8687
(void)va_arg(tap, char *);
8788
va_end(tap);
8889
jp = alloca(njp * sizeof(struct jailparam));
89-
for (njp = 0; (name = va_arg(ap, char *)) != NULL;) {
90+
jp_desc = NULL;
91+
desc_value = NULL;
92+
for (njp = 0; (name = va_arg(ap, char *)) != NULL; njp++) {
9093
value = va_arg(ap, char *);
9194
if (jailparam_init(jp + njp, name) < 0)
9295
goto error;
93-
if (jailparam_import(jp + njp++, value) < 0)
96+
if (jailparam_import(jp + njp, value) < 0)
9497
goto error;
98+
if (!strcmp(name, "desc")
99+
&& (flags & (JAIL_GET_DESC | JAIL_OWN_DESC))) {
100+
jp_desc = jp + njp;
101+
desc_value = value;
102+
}
95103
}
96104
va_end(ap);
97105
jid = jailparam_set(jp, njp, flags);
106+
if (jid > 0 && jp_desc != NULL)
107+
sprintf(desc_value, "%d", *(int *)jp_desc->jp_value);
98108
jailparam_free(jp, njp);
99109
return (jid);
100110

@@ -112,9 +122,10 @@ int
112122
jail_getv(int flags, ...)
113123
{
114124
va_list ap, tap;
115-
struct jailparam *jp, *jp_lastjid, *jp_jid, *jp_name, *jp_key;
125+
struct jailparam *jp, *jp_desc, *jp_lastjid, *jp_jid, *jp_name, *jp_key;
116126
char *valarg, *value;
117-
const char *name, *key_value, *lastjid_value, *jid_value, *name_value;
127+
const char *name, *key_value, *desc_value, *lastjid_value, *jid_value;
128+
const char *name_value;
118129
int njp, i, jid;
119130

120131
/* Create the parameter list and find the key. */
@@ -126,15 +137,19 @@ jail_getv(int flags, ...)
126137

127138
jp = alloca(njp * sizeof(struct jailparam));
128139
va_copy(tap, ap);
129-
jp_lastjid = jp_jid = jp_name = NULL;
130-
lastjid_value = jid_value = name_value = NULL;
140+
jp_desc = jp_lastjid = jp_jid = jp_name = NULL;
141+
desc_value = lastjid_value = jid_value = name_value = NULL;
131142
for (njp = 0; (name = va_arg(tap, char *)) != NULL; njp++) {
132143
value = va_arg(tap, char *);
133144
if (jailparam_init(jp + njp, name) < 0) {
134145
va_end(tap);
135146
goto error;
136147
}
137-
if (!strcmp(jp[njp].jp_name, "lastjid")) {
148+
if (!strcmp(jp[njp].jp_name, "desc")
149+
&& (flags & (JAIL_USE_DESC | JAIL_AT_DESC))) {
150+
jp_desc = jp + njp;
151+
desc_value = value;
152+
} else if (!strcmp(jp[njp].jp_name, "lastjid")) {
138153
jp_lastjid = jp + njp;
139154
lastjid_value = value;
140155
} else if (!strcmp(jp[njp].jp_name, "jid")) {
@@ -147,7 +162,10 @@ jail_getv(int flags, ...)
147162
}
148163
va_end(tap);
149164
/* Import the key parameter. */
150-
if (jp_lastjid != NULL) {
165+
if (jp_desc != NULL && (flags & JAIL_USE_DESC)) {
166+
jp_key = jp_desc;
167+
key_value = desc_value;
168+
} else if (jp_lastjid != NULL) {
151169
jp_key = jp_lastjid;
152170
key_value = lastjid_value;
153171
} else if (jp_jid != NULL && strtol(jid_value, NULL, 10) != 0) {
@@ -163,6 +181,9 @@ jail_getv(int flags, ...)
163181
}
164182
if (jailparam_import(jp_key, key_value) < 0)
165183
goto error;
184+
if (jp_desc != NULL && jp_desc != jp_key
185+
&& jailparam_import(jp_desc, desc_value) < 0)
186+
goto error;
166187
/* Get the jail and export the parameters. */
167188
jid = jailparam_get(jp, njp, flags);
168189
if (jid < 0)
@@ -571,7 +592,7 @@ int
571592
jailparam_get(struct jailparam *jp, unsigned njp, int flags)
572593
{
573594
struct iovec *jiov;
574-
struct jailparam *jp_lastjid, *jp_jid, *jp_name, *jp_key;
595+
struct jailparam *jp_desc, *jp_lastjid, *jp_jid, *jp_name, *jp_key;
575596
int i, ai, ki, jid, arrays, sanity;
576597
unsigned j;
577598

@@ -580,10 +601,13 @@ jailparam_get(struct jailparam *jp, unsigned njp, int flags)
580601
* Find the key and any array parameters.
581602
*/
582603
jiov = alloca(sizeof(struct iovec) * 2 * (njp + 1));
583-
jp_lastjid = jp_jid = jp_name = NULL;
604+
jp_desc = jp_lastjid = jp_jid = jp_name = NULL;
584605
arrays = 0;
585606
for (ai = j = 0; j < njp; j++) {
586-
if (!strcmp(jp[j].jp_name, "lastjid"))
607+
if (!strcmp(jp[j].jp_name, "desc")
608+
&& (flags & (JAIL_USE_DESC | JAIL_AT_DESC)))
609+
jp_desc = jp + j;
610+
else if (!strcmp(jp[j].jp_name, "lastjid"))
587611
jp_lastjid = jp + j;
588612
else if (!strcmp(jp[j].jp_name, "jid"))
589613
jp_jid = jp + j;
@@ -599,7 +623,9 @@ jailparam_get(struct jailparam *jp, unsigned njp, int flags)
599623
ai++;
600624
}
601625
}
602-
jp_key = jp_lastjid ? jp_lastjid :
626+
jp_key = jp_desc && jp_desc->jp_valuelen == sizeof(int) &&
627+
jp_desc->jp_value && (flags & JAIL_USE_DESC) ? jp_desc :
628+
jp_lastjid ? jp_lastjid :
603629
jp_jid && jp_jid->jp_valuelen == sizeof(int) &&
604630
jp_jid->jp_value && *(int *)jp_jid->jp_value ? jp_jid : jp_name;
605631
if (jp_key == NULL || jp_key->jp_value == NULL) {
@@ -622,6 +648,14 @@ jailparam_get(struct jailparam *jp, unsigned njp, int flags)
622648
jiov[ki].iov_len = JAIL_ERRMSGLEN;
623649
ki++;
624650
jail_errmsg[0] = 0;
651+
if (jp_desc != NULL && jp_desc != jp_key) {
652+
jiov[ki].iov_base = jp_desc->jp_name;
653+
jiov[ki].iov_len = strlen(jp_desc->jp_name) + 1;
654+
ki++;
655+
jiov[ki].iov_base = jp_desc->jp_value;
656+
jiov[ki].iov_len = jp_desc->jp_valuelen;
657+
ki++;
658+
}
625659
if (arrays && jail_get(jiov, ki, flags) < 0) {
626660
if (!jail_errmsg[0])
627661
snprintf(jail_errmsg, sizeof(jail_errmsg),
@@ -649,7 +683,7 @@ jailparam_get(struct jailparam *jp, unsigned njp, int flags)
649683
jiov[ai].iov_base = jp[j].jp_value;
650684
memset(jiov[ai].iov_base, 0, jiov[ai].iov_len);
651685
ai++;
652-
} else if (jp + j != jp_key) {
686+
} else if (jp + j != jp_key && jp + j != jp_desc) {
653687
jiov[i].iov_base = jp[j].jp_name;
654688
jiov[i].iov_len = strlen(jp[j].jp_name) + 1;
655689
i++;

‎lib/libsys/Symbol.sys.map

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -382,6 +382,8 @@ FBSD_1.8 {
382382
getrlimitusage;
383383
inotify_add_watch_at;
384384
inotify_rm_watch;
385+
jail_attach_jd;
386+
jail_remove_jd;
385387
kcmp;
386388
setcred;
387389
setgroups;

‎lib/libsys/_libsys.h

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -468,6 +468,8 @@ typedef int (__sys_inotify_add_watch_at_t)(int, int, const char *, uint32_t);
468468
typedef int (__sys_inotify_rm_watch_t)(int, int);
469469
typedef int (__sys_getgroups_t)(int, gid_t *);
470470
typedef int (__sys_setgroups_t)(int, const gid_t *);
471+
typedef int (__sys_jail_attach_jd_t)(int);
472+
typedef int (__sys_jail_remove_jd_t)(int);
471473

472474
_Noreturn void __sys__exit(int rval);
473475
int __sys_fork(void);
@@ -872,6 +874,8 @@ int __sys_inotify_add_watch_at(int fd, int dfd, const char * path, uint32_t mask
872874
int __sys_inotify_rm_watch(int fd, int wd);
873875
int __sys_getgroups(int gidsetsize, gid_t * gidset);
874876
int __sys_setgroups(int gidsetsize, const gid_t * gidset);
877+
int __sys_jail_attach_jd(int fd);
878+
int __sys_jail_remove_jd(int fd);
875879
__END_DECLS
876880

877881
#endif /* __LIBSYS_H_ */

0 commit comments

Comments
 (0)