From nobody Thu Sep 10 19:04:14 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hgnCm0WsTz6r96F for ; Thu, 10 Sep 2026 19:04:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hgnCl6NJVz4YmR for ; Thu, 10 Sep 2026 19:04:19 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1789067059; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=C9r04YemWQq6rLMODvCCMTSj3be96bWYtTFvoL/wHBQ=; b=UpZ4uT2oC7NPJiZVubTTMX/KiIfHt9d3Me4IZfwiEwdnIaeCIspVlFGixizLjF59EDpRAF oyEqKdLXL80yZ/PNup15eChw7pi4+5XhaoZSWQHsSyM2U0+Jaf8euHs2xuY2R7TewJv8cw H+NxvLdWPR4Omkh4w47MJJoBSFkBaDxl1GbmChmt21Tewd13O9Xta2k5FxSMGdRAoT44hp X/UowMPXbxm/W16J2NkGAfLX299QSSX+qVHtlbbkOThdx6Yh1jqG40ZhI+GeWLGcEtVoft djOEMxgT2t8IR+xdiRh1ve6BXV5pDI/XAE+joN4mpbT3/5tOm4aaC8THbAfxNA== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1789067059; b=B1fortYxPN60r5JFqUlHWS8PXSrlfY/DFTwql/S2JgHjzGG4M9R6vd2COxLiM4132/ji4G nzQOAnhEYX9oIqvMUJNSTYTYbZnRUrN+Th0pAZLoEUcsUyxFVSXxNe1zHVmA5YpGwCJmX6 6BoJuzl9kMWYgpFu+KSlHucv3q8z/adJxEw5FFRGzUEabfngWKKTAgnsTC8a6/huIJCFFi FGx28rQMZXfLVIQXQ6V1zDbO1IYi1m8gEeZ6/dodeVyaRCRzxKPH1kh0phrjaxG1EsBCyr i01/qzGx7utS92gq3Sstt1wUVkmHTzHWUs3L4KXxu6Mei4TGHvz6iXGZDh6P1A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1789067059; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=C9r04YemWQq6rLMODvCCMTSj3be96bWYtTFvoL/wHBQ=; b=Qej/U4EzBjlyBEX/A+6EmaCTZ82N8+3GscCFgBGEWp8gkMplxvR4SH4pwKpvTdTdjTbT2t OORkp1WOPTjt0cofAteBB+8kaXrdZPAsosuL4ds1nZ5RNbqWXTfgQILVx+9SfcR58RCHU5 En/QHKczAaolp+3HMtcGBywHuk4xNkJotSBeCBuSbyxpBQMclAyglJV1pLnRXG5XA9vn6m TSJVyiOOSprEwTSgJ1mBOe7Kohx+FT6vrHOivTtTYT5S++Z762oIW+iAItctPjIwH5HnBf uoJejLji7ke7QqCHhGfACZh4TGke4XIVcK3OEJ42rzCfnzEZOfn/M6QUBeOi/w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hgnCl5CkBzh9w for ; Thu, 10 Sep 2026 19:04:19 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1946f by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 10 Sep 2026 19:04:14 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Abdelkader Boudih Subject: git: 1256447cbc21 - main - jail: define well-known parameter names in sys/jail.h List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: seuros X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 1256447cbc21361ff5a6f9022b58ad6c1c43e59f Auto-Submitted: auto-generated Date: Thu, 10 Sep 2026 19:04:14 +0000 Message-Id: <6aa2ff2e.1946f.389ac54d@gitrepo.freebsd.org> The branch main has been updated by seuros: URL: https://cgit.FreeBSD.org/src/commit/?id=1256447cbc21361ff5a6f9022b58ad6c1c43e59f commit 1256447cbc21361ff5a6f9022b58ad6c1c43e59f Author: Abdelkader Boudih AuthorDate: 2026-09-10 19:03:57 +0000 Commit: Abdelkader Boudih CommitDate: 2026-09-10 19:03:57 +0000 jail: define well-known parameter names in sys/jail.h Userland jail managers hardcode jail parameter name strings; nothing in the headers has ever named them, even when sys/jail.h already has JAIL_META_PRIVATE/JAIL_META_SHARED for the metadata pair. Added JAIL_PARAM_* string constants for the static parameters registered by the base kernel. No functional change. MFC After: 1 week Reviewed by: jamie, adrian Differential Revision: https://reviews.freebsd.org/D59572 --- sys/kern/kern_jail.c | 190 +++++++++++++++++++++++++++------------------------ sys/sys/jail.h | 93 +++++++++++++++++++++++++ 2 files changed, 195 insertions(+), 88 deletions(-) diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c index c1ead6475916..869da730ff77 100644 --- a/sys/kern/kern_jail.c +++ b/sys/kern/kern_jail.c @@ -196,26 +196,26 @@ static void prison_knote(struct prison *pr, long hint); * terminating entry. */ static struct bool_flags pr_flag_bool[] = { - {"persist", "nopersist", PR_PERSIST}, + {JAIL_PARAM_PERSIST, JAIL_PARAM_NOPERSIST, PR_PERSIST}, #ifdef INET - {"ip4.saddrsel", "ip4.nosaddrsel", PR_IP4_SADDRSEL}, + {JAIL_PARAM_IP4_SADDRSEL, JAIL_PARAM_IP4_NOSADDRSEL, PR_IP4_SADDRSEL}, #endif #ifdef INET6 - {"ip6.saddrsel", "ip6.nosaddrsel", PR_IP6_SADDRSEL}, + {JAIL_PARAM_IP6_SADDRSEL, JAIL_PARAM_IP6_NOSADDRSEL, PR_IP6_SADDRSEL}, #endif }; const size_t pr_flag_bool_size = sizeof(pr_flag_bool); static struct jailsys_flags pr_flag_jailsys[] = { - {"host", 0, PR_HOST}, + {JAIL_PARAM_HOST, 0, PR_HOST}, #ifdef VIMAGE - {"vnet", 0, PR_VNET}, + {JAIL_PARAM_VNET, 0, PR_VNET}, #endif #ifdef INET - {"ip4", PR_IP4_USER, PR_IP4_USER}, + {JAIL_PARAM_IP4, PR_IP4_USER, PR_IP4_USER}, #endif #ifdef INET6 - {"ip6", PR_IP6_USER, PR_IP6_USER}, + {JAIL_PARAM_IP6, PR_IP6_USER, PR_IP6_USER}, #endif }; const size_t pr_flag_jailsys_size = sizeof(pr_flag_jailsys); @@ -226,32 +226,43 @@ const size_t pr_flag_jailsys_size = sizeof(pr_flag_jailsys); * with an atomic check of the flag values. */ static struct bool_flags pr_flag_allow[NBBY * NBPW] = { - {"allow.set_hostname", "allow.noset_hostname", PR_ALLOW_SET_HOSTNAME}, - {"allow.sysvipc", "allow.nosysvipc", PR_ALLOW_SYSVIPC}, - {"allow.raw_sockets", "allow.noraw_sockets", PR_ALLOW_RAW_SOCKETS}, - {"allow.chflags", "allow.nochflags", PR_ALLOW_CHFLAGS}, - {"allow.mount", "allow.nomount", PR_ALLOW_MOUNT}, - {"allow.quotas", "allow.noquotas", PR_ALLOW_QUOTAS}, - {"allow.socket_af", "allow.nosocket_af", PR_ALLOW_SOCKET_AF}, - {"allow.mlock", "allow.nomlock", PR_ALLOW_MLOCK}, - {"allow.reserved_ports", "allow.noreserved_ports", + {JAIL_PARAM_ALLOW_SET_HOSTNAME, JAIL_PARAM_ALLOW_NOSET_HOSTNAME, + PR_ALLOW_SET_HOSTNAME}, + {JAIL_PARAM_ALLOW_SYSVIPC, JAIL_PARAM_ALLOW_NOSYSVIPC, + PR_ALLOW_SYSVIPC}, + {JAIL_PARAM_ALLOW_RAW_SOCKETS, JAIL_PARAM_ALLOW_NORAW_SOCKETS, + PR_ALLOW_RAW_SOCKETS}, + {JAIL_PARAM_ALLOW_CHFLAGS, JAIL_PARAM_ALLOW_NOCHFLAGS, + PR_ALLOW_CHFLAGS}, + {JAIL_PARAM_ALLOW_MOUNT, JAIL_PARAM_ALLOW_NOMOUNT, PR_ALLOW_MOUNT}, + {JAIL_PARAM_ALLOW_QUOTAS, JAIL_PARAM_ALLOW_NOQUOTAS, PR_ALLOW_QUOTAS}, + {JAIL_PARAM_ALLOW_SOCKET_AF, JAIL_PARAM_ALLOW_NOSOCKET_AF, + PR_ALLOW_SOCKET_AF}, + {JAIL_PARAM_ALLOW_MLOCK, JAIL_PARAM_ALLOW_NOMLOCK, PR_ALLOW_MLOCK}, + {JAIL_PARAM_ALLOW_RESERVED_PORTS, JAIL_PARAM_ALLOW_NORESERVED_PORTS, PR_ALLOW_RESERVED_PORTS}, - {"allow.read_msgbuf", "allow.noread_msgbuf", PR_ALLOW_READ_MSGBUF}, - {"allow.unprivileged_proc_debug", "allow.nounprivileged_proc_debug", + {JAIL_PARAM_ALLOW_READ_MSGBUF, JAIL_PARAM_ALLOW_NOREAD_MSGBUF, + PR_ALLOW_READ_MSGBUF}, + {JAIL_PARAM_ALLOW_UNPRIV_DEBUG, JAIL_PARAM_ALLOW_NOUNPRIV_DEBUG, PR_ALLOW_UNPRIV_DEBUG}, - {"allow.suser", "allow.nosuser", PR_ALLOW_SUSER}, + {JAIL_PARAM_ALLOW_SUSER, JAIL_PARAM_ALLOW_NOSUSER, PR_ALLOW_SUSER}, #ifdef VIMAGE - {"allow.nfsd", "allow.nonfsd", PR_ALLOW_NFSD}, -#endif - {"allow.extattr", "allow.noextattr", PR_ALLOW_EXTATTR}, - {"allow.adjtime", "allow.noadjtime", PR_ALLOW_ADJTIME}, - {"allow.settime", "allow.nosettime", PR_ALLOW_SETTIME}, - {"allow.routing", "allow.norouting", PR_ALLOW_ROUTING}, - {"allow.unprivileged_parent_tampering", - "allow.nounprivileged_parent_tampering", + {JAIL_PARAM_ALLOW_NFSD, JAIL_PARAM_ALLOW_NONFSD, PR_ALLOW_NFSD}, +#endif + {JAIL_PARAM_ALLOW_EXTATTR, JAIL_PARAM_ALLOW_NOEXTATTR, + PR_ALLOW_EXTATTR}, + {JAIL_PARAM_ALLOW_ADJTIME, JAIL_PARAM_ALLOW_NOADJTIME, + PR_ALLOW_ADJTIME}, + {JAIL_PARAM_ALLOW_SETTIME, JAIL_PARAM_ALLOW_NOSETTIME, + PR_ALLOW_SETTIME}, + {JAIL_PARAM_ALLOW_ROUTING, JAIL_PARAM_ALLOW_NOROUTING, + PR_ALLOW_ROUTING}, + {JAIL_PARAM_ALLOW_UNPRIV_PARENT_TAMPER, + JAIL_PARAM_ALLOW_NOUNPRIV_PARENT_TAMPER, PR_ALLOW_UNPRIV_PARENT_TAMPER}, #ifdef AUDIT - {"allow.setaudit", "allow.nosetaudit", PR_ALLOW_SETAUDIT}, + {JAIL_PARAM_ALLOW_SETAUDIT, JAIL_PARAM_ALLOW_NOSETAUDIT, + PR_ALLOW_SETAUDIT}, #endif }; static unsigned pr_allow_all = PR_ALLOW_ALL_STATIC; @@ -443,8 +454,8 @@ kern_jail(struct thread *td, struct jail *j) strlen(optiov[opt.uio_iovcnt].iov_base) + 1; opt.uio_iovcnt += 2; } - optiov[opt.uio_iovcnt].iov_base = "enforce_statfs"; - optiov[opt.uio_iovcnt].iov_len = sizeof("enforce_statfs"); + optiov[opt.uio_iovcnt].iov_base = JAIL_PARAM_ENFORCE_STATFS; + optiov[opt.uio_iovcnt].iov_len = sizeof(JAIL_PARAM_ENFORCE_STATFS); opt.uio_iovcnt++; enforce_statfs = jail_default_enforce_statfs; optiov[opt.uio_iovcnt].iov_base = &enforce_statfs; @@ -483,8 +494,8 @@ kern_jail(struct thread *td, struct jail *j) u_ip6 = (struct in6_addr *)(u_name + MAXHOSTNAMELEN); #endif #endif - optiov[opt.uio_iovcnt].iov_base = "path"; - optiov[opt.uio_iovcnt].iov_len = sizeof("path"); + optiov[opt.uio_iovcnt].iov_base = JAIL_PARAM_PATH; + optiov[opt.uio_iovcnt].iov_len = sizeof(JAIL_PARAM_PATH); opt.uio_iovcnt++; optiov[opt.uio_iovcnt].iov_base = u_path; error = copyinstr(j->path, u_path, MAXPATHLEN, @@ -494,8 +505,8 @@ kern_jail(struct thread *td, struct jail *j) return (error); } opt.uio_iovcnt++; - optiov[opt.uio_iovcnt].iov_base = "host.hostname"; - optiov[opt.uio_iovcnt].iov_len = sizeof("host.hostname"); + optiov[opt.uio_iovcnt].iov_base = JAIL_PARAM_HOST_HOSTNAME; + optiov[opt.uio_iovcnt].iov_len = sizeof(JAIL_PARAM_HOST_HOSTNAME); opt.uio_iovcnt++; optiov[opt.uio_iovcnt].iov_base = u_hostname; error = copyinstr(j->hostname, u_hostname, MAXHOSTNAMELEN, @@ -506,8 +517,8 @@ kern_jail(struct thread *td, struct jail *j) } opt.uio_iovcnt++; if (j->jailname != NULL) { - optiov[opt.uio_iovcnt].iov_base = "name"; - optiov[opt.uio_iovcnt].iov_len = sizeof("name"); + optiov[opt.uio_iovcnt].iov_base = JAIL_PARAM_NAME; + optiov[opt.uio_iovcnt].iov_len = sizeof(JAIL_PARAM_NAME); opt.uio_iovcnt++; optiov[opt.uio_iovcnt].iov_base = u_name; error = copyinstr(j->jailname, u_name, MAXHOSTNAMELEN, @@ -519,8 +530,8 @@ kern_jail(struct thread *td, struct jail *j) opt.uio_iovcnt++; } #ifdef INET - optiov[opt.uio_iovcnt].iov_base = "ip4.addr"; - optiov[opt.uio_iovcnt].iov_len = sizeof("ip4.addr"); + optiov[opt.uio_iovcnt].iov_base = JAIL_PARAM_IP4_ADDR; + optiov[opt.uio_iovcnt].iov_len = sizeof(JAIL_PARAM_IP4_ADDR); opt.uio_iovcnt++; optiov[opt.uio_iovcnt].iov_base = u_ip4; optiov[opt.uio_iovcnt].iov_len = ip4s * sizeof(struct in_addr); @@ -536,8 +547,8 @@ kern_jail(struct thread *td, struct jail *j) opt.uio_iovcnt++; #endif #ifdef INET6 - optiov[opt.uio_iovcnt].iov_base = "ip6.addr"; - optiov[opt.uio_iovcnt].iov_len = sizeof("ip6.addr"); + optiov[opt.uio_iovcnt].iov_base = JAIL_PARAM_IP6_ADDR; + optiov[opt.uio_iovcnt].iov_len = sizeof(JAIL_PARAM_IP6_ADDR); opt.uio_iovcnt++; optiov[opt.uio_iovcnt].iov_base = u_ip6; optiov[opt.uio_iovcnt].iov_len = j->ip6s * sizeof(struct in6_addr); @@ -1104,7 +1115,7 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) goto done_errmsg; } - error = vfs_copyopt(opts, "desc", &jfd_in, sizeof(jfd_in)); + error = vfs_copyopt(opts, JAIL_PARAM_DESC, &jfd_in, sizeof(jfd_in)); if (error == ENOENT) { if (flags & (JAIL_USE_DESC | JAIL_AT_DESC | JAIL_GET_DESC | JAIL_OWN_DESC)) { @@ -1163,13 +1174,13 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) goto done_free; } - error = vfs_copyopt(opts, "jid", &jid, sizeof(jid)); + error = vfs_copyopt(opts, JAIL_PARAM_JID, &jid, sizeof(jid)); if (error == ENOENT) jid = 0; else if (error != 0) goto done_free; - error = vfs_copyopt(opts, "securelevel", &slevel, sizeof(slevel)); + error = vfs_copyopt(opts, JAIL_PARAM_SECURELEVEL, &slevel, sizeof(slevel)); if (error == ENOENT) gotslevel = 0; else if (error != 0) @@ -1178,7 +1189,7 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) gotslevel = 1; error = - vfs_copyopt(opts, "children.max", &childmax, sizeof(childmax)); + vfs_copyopt(opts, JAIL_PARAM_CHILDREN_MAX, &childmax, sizeof(childmax)); if (error == ENOENT) gotchildmax = 0; else if (error != 0) @@ -1186,7 +1197,8 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) else gotchildmax = 1; - error = vfs_copyopt(opts, "enforce_statfs", &enforce, sizeof(enforce)); + error = vfs_copyopt(opts, JAIL_PARAM_ENFORCE_STATFS, &enforce, + sizeof(enforce)); if (error == ENOENT) gotenforce = 0; else if (error != 0) @@ -1197,7 +1209,7 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) } else gotenforce = 1; - error = vfs_copyopt(opts, "devfs_ruleset", &rsnum, sizeof(rsnum)); + error = vfs_copyopt(opts, JAIL_PARAM_DEVFS_RULESET, &rsnum, sizeof(rsnum)); if (error == ENOENT) gotrsnum = 0; else if (error != 0) @@ -1278,7 +1290,7 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) } ch_allow |= pr_allow; - error = vfs_getopt(opts, "name", (void **)&name, &len); + error = vfs_getopt(opts, JAIL_PARAM_NAME, (void **)&name, &len); if (error == ENOENT) name = NULL; else if (error != 0) @@ -1294,7 +1306,7 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) } } - error = vfs_getopt(opts, "host.hostname", (void **)&host, &len); + error = vfs_getopt(opts, JAIL_PARAM_HOST_HOSTNAME, (void **)&host, &len); if (error == ENOENT) host = NULL; else if (error != 0) @@ -1312,7 +1324,7 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) } } - error = vfs_getopt(opts, "host.domainname", (void **)&domain, &len); + error = vfs_getopt(opts, JAIL_PARAM_HOST_DOMAINNAME, (void **)&domain, &len); if (error == ENOENT) domain = NULL; else if (error != 0) @@ -1330,7 +1342,7 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) } } - error = vfs_getopt(opts, "host.hostuuid", (void **)&uuid, &len); + error = vfs_getopt(opts, JAIL_PARAM_HOST_HOSTUUID, (void **)&uuid, &len); if (error == ENOENT) uuid = NULL; else if (error != 0) @@ -1352,11 +1364,11 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) { uint32_t hid32; - error = vfs_copyopt(opts, "host.hostid", &hid32, sizeof(hid32)); + error = vfs_copyopt(opts, JAIL_PARAM_HOST_HOSTID, &hid32, sizeof(hid32)); hid = hid32; } else #endif - error = vfs_copyopt(opts, "host.hostid", &hid, sizeof(hid)); + error = vfs_copyopt(opts, JAIL_PARAM_HOST_HOSTID, &hid, sizeof(hid)); if (error == ENOENT) gothid = 0; else if (error != 0) @@ -1379,7 +1391,7 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) #endif #ifdef INET - error = vfs_getopt(opts, "ip4.addr", &op, &ip4s); + error = vfs_getopt(opts, JAIL_PARAM_IP4_ADDR, &op, &ip4s); if (error == ENOENT) ip4s = 0; else if (error != 0) @@ -1407,7 +1419,7 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) #endif #ifdef INET6 - error = vfs_getopt(opts, "ip6.addr", &op, &ip6s); + error = vfs_getopt(opts, JAIL_PARAM_IP6_ADDR, &op, &ip6s); if (error == ENOENT) ip6s = 0; else if (error != 0) @@ -1443,7 +1455,7 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) } #endif - error = vfs_getopt(opts, "osrelease", (void **)&osrelstr, &len); + error = vfs_getopt(opts, JAIL_PARAM_OSRELEASE, (void **)&osrelstr, &len); if (error == ENOENT) osrelstr = NULL; else if (error != 0) @@ -1468,7 +1480,7 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) } } - error = vfs_copyopt(opts, "osreldate", &osreldt, sizeof(osreldt)); + error = vfs_copyopt(opts, JAIL_PARAM_OSRELDATE, &osreldt, sizeof(osreldt)); if (error == ENOENT) osreldt = 0; else if (error != 0) @@ -1488,7 +1500,7 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) } root = NULL; - error = vfs_getopt(opts, "path", (void **)&path, &len); + error = vfs_getopt(opts, JAIL_PARAM_PATH, (void **)&path, &len); if (error == ENOENT) path = NULL; else if (error != 0) @@ -2359,7 +2371,7 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) mtx_lock(&pr->pr_mtx); drflags |= PD_LOCKED; } - jfd_pos = 2 * vfs_getopt_pos(opts, "desc") + 1; + jfd_pos = 2 * vfs_getopt_pos(opts, JAIL_PARAM_DESC) + 1; if (optuio->uio_segflg == UIO_SYSSPACE) *(int*)optuio->uio_iov[jfd_pos].iov_base = jfd_out; else @@ -2391,9 +2403,9 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) done_errmsg: if (error) { /* Write the error message back to userspace. */ - if (vfs_getopt(opts, "errmsg", (void **)&errmsg, + if (vfs_getopt(opts, JAIL_PARAM_ERRMSG, (void **)&errmsg, &errmsg_len) == 0 && errmsg_len > 0) { - errmsg_pos = 2 * vfs_getopt_pos(opts, "errmsg") + 1; + errmsg_pos = 2 * vfs_getopt_pos(opts, JAIL_PARAM_ERRMSG) + 1; if (optuio->uio_segflg == UIO_SYSSPACE) bcopy(errmsg, optuio->uio_iov[errmsg_pos].iov_base, @@ -2591,7 +2603,7 @@ kern_jail_get(struct thread *td, struct uio *optuio, int flags) error = vfs_buildopts(optuio, &opts); if (error) return (error); - errmsg_pos = vfs_getopt_pos(opts, "errmsg"); + errmsg_pos = vfs_getopt_pos(opts, JAIL_PARAM_ERRMSG); mypr = td->td_ucred->cr_prison; prison_hold(mypr); pr = NULL; @@ -2604,7 +2616,7 @@ kern_jail_get(struct thread *td, struct uio *optuio, int flags) sx_slock(&allprison_lock); drflags = PD_LIST_SLOCKED; - error = vfs_copyopt(opts, "desc", &jfd_in, sizeof(jfd_in)); + error = vfs_copyopt(opts, JAIL_PARAM_DESC, &jfd_in, sizeof(jfd_in)); if (error == ENOENT) { if (flags & (JAIL_AT_DESC | JAIL_GET_DESC | JAIL_OWN_DESC)) { vfs_opterror(opts, "missing desc"); @@ -2655,7 +2667,7 @@ kern_jail_get(struct thread *td, struct uio *optuio, int flags) } else goto done; - error = vfs_copyopt(opts, "lastjid", &jid, sizeof(jid)); + error = vfs_copyopt(opts, JAIL_PARAM_LASTJID, &jid, sizeof(jid)); if (error == 0) { TAILQ_FOREACH(pr, &allprison, pr_list) { if (pr->pr_id > jid && @@ -2694,7 +2706,7 @@ kern_jail_get(struct thread *td, struct uio *optuio, int flags) } else if (error != ENOENT) goto done; - error = vfs_copyopt(opts, "jid", &jid, sizeof(jid)); + error = vfs_copyopt(opts, JAIL_PARAM_JID, &jid, sizeof(jid)); if (error == 0) { if (jid != 0) { pr = prison_find_child(mypr, jid); @@ -2709,7 +2721,7 @@ kern_jail_get(struct thread *td, struct uio *optuio, int flags) } else if (error != ENOENT) goto done; - error = vfs_getopt(opts, "name", (void **)&name, &len); + error = vfs_getopt(opts, JAIL_PARAM_NAME, (void **)&name, &len); if (error == 0) { if (len == 0 || name[len - 1] != '\0') { error = EINVAL; @@ -2757,79 +2769,81 @@ kern_jail_get(struct thread *td, struct uio *optuio, int flags) } td->td_retval[0] = pr->pr_id; if (jfd_out >= 0) { - error = vfs_setopt(opts, "desc", &jfd_out, sizeof(jfd_out)); + error = vfs_setopt(opts, JAIL_PARAM_DESC, &jfd_out, sizeof(jfd_out)); if (error != 0 && error != ENOENT) goto done; jaildesc_set_prison(jfp_out, pr); } - error = vfs_setopt(opts, "jid", &pr->pr_id, sizeof(pr->pr_id)); + error = vfs_setopt(opts, JAIL_PARAM_JID, &pr->pr_id, sizeof(pr->pr_id)); if (error != 0 && error != ENOENT) goto done; i = (pr->pr_parent == mypr) ? 0 : pr->pr_parent->pr_id; - error = vfs_setopt(opts, "parent", &i, sizeof(i)); + error = vfs_setopt(opts, JAIL_PARAM_PARENT, &i, sizeof(i)); if (error != 0 && error != ENOENT) goto done; - error = vfs_setopts(opts, "name", prison_name(mypr, pr)); + error = vfs_setopts(opts, JAIL_PARAM_NAME, prison_name(mypr, pr)); if (error != 0 && error != ENOENT) goto done; - error = vfs_setopt(opts, "cpuset.id", &pr->pr_cpuset->cs_id, + error = vfs_setopt(opts, JAIL_PARAM_CPUSET_ID, &pr->pr_cpuset->cs_id, sizeof(pr->pr_cpuset->cs_id)); if (error != 0 && error != ENOENT) goto done; - error = vfs_setopts(opts, "path", prison_path(mypr, pr)); + error = vfs_setopts(opts, JAIL_PARAM_PATH, prison_path(mypr, pr)); if (error != 0 && error != ENOENT) goto done; #ifdef INET - error = vfs_setopt_part(opts, "ip4.addr", pr->pr_addrs[PR_INET]->pr_ip, + error = vfs_setopt_part(opts, JAIL_PARAM_IP4_ADDR, + pr->pr_addrs[PR_INET]->pr_ip, pr->pr_addrs[PR_INET] ? pr->pr_addrs[PR_INET]->ips * pr_families[PR_INET].size : 0 ); if (error != 0 && error != ENOENT) goto done; #endif #ifdef INET6 - error = vfs_setopt_part(opts, "ip6.addr", pr->pr_addrs[PR_INET6]->pr_ip, + error = vfs_setopt_part(opts, JAIL_PARAM_IP6_ADDR, + pr->pr_addrs[PR_INET6]->pr_ip, pr->pr_addrs[PR_INET6] ? pr->pr_addrs[PR_INET6]->ips * pr_families[PR_INET6].size : 0 ); if (error != 0 && error != ENOENT) goto done; #endif - error = vfs_setopt(opts, "securelevel", &pr->pr_securelevel, + error = vfs_setopt(opts, JAIL_PARAM_SECURELEVEL, &pr->pr_securelevel, sizeof(pr->pr_securelevel)); if (error != 0 && error != ENOENT) goto done; - error = vfs_setopt(opts, "children.cur", &pr->pr_childcount, + error = vfs_setopt(opts, JAIL_PARAM_CHILDREN_CUR, &pr->pr_childcount, sizeof(pr->pr_childcount)); if (error != 0 && error != ENOENT) goto done; - error = vfs_setopt(opts, "children.max", &pr->pr_childmax, + error = vfs_setopt(opts, JAIL_PARAM_CHILDREN_MAX, &pr->pr_childmax, sizeof(pr->pr_childmax)); if (error != 0 && error != ENOENT) goto done; - error = vfs_setopts(opts, "host.hostname", pr->pr_hostname); + error = vfs_setopts(opts, JAIL_PARAM_HOST_HOSTNAME, pr->pr_hostname); if (error != 0 && error != ENOENT) goto done; - error = vfs_setopts(opts, "host.domainname", pr->pr_domainname); + error = vfs_setopts(opts, JAIL_PARAM_HOST_DOMAINNAME, pr->pr_domainname); if (error != 0 && error != ENOENT) goto done; - error = vfs_setopts(opts, "host.hostuuid", pr->pr_hostuuid); + error = vfs_setopts(opts, JAIL_PARAM_HOST_HOSTUUID, pr->pr_hostuuid); if (error != 0 && error != ENOENT) goto done; #ifdef COMPAT_FREEBSD32 if (SV_PROC_FLAG(td->td_proc, SV_ILP32)) { uint32_t hid32 = pr->pr_hostid; - error = vfs_setopt(opts, "host.hostid", &hid32, sizeof(hid32)); + error = vfs_setopt(opts, JAIL_PARAM_HOST_HOSTID, &hid32, sizeof(hid32)); } else #endif - error = vfs_setopt(opts, "host.hostid", &pr->pr_hostid, + error = vfs_setopt(opts, JAIL_PARAM_HOST_HOSTID, &pr->pr_hostid, sizeof(pr->pr_hostid)); if (error != 0 && error != ENOENT) goto done; - error = vfs_setopt(opts, "enforce_statfs", &pr->pr_enforce_statfs, + error = vfs_setopt(opts, JAIL_PARAM_ENFORCE_STATFS, &pr->pr_enforce_statfs, sizeof(pr->pr_enforce_statfs)); if (error != 0 && error != ENOENT) goto done; - error = vfs_setopt(opts, "devfs_ruleset", &pr->pr_devfs_rsnum, + error = vfs_setopt(opts, JAIL_PARAM_DEVFS_RULESET, &pr->pr_devfs_rsnum, sizeof(pr->pr_devfs_rsnum)); if (error != 0 && error != ENOENT) goto done; @@ -2870,18 +2884,18 @@ kern_jail_get(struct thread *td, struct uio *optuio, int flags) goto done; } i = !prison_isalive(pr); - error = vfs_setopt(opts, "dying", &i, sizeof(i)); + error = vfs_setopt(opts, JAIL_PARAM_DYING, &i, sizeof(i)); if (error != 0 && error != ENOENT) goto done; i = !i; - error = vfs_setopt(opts, "nodying", &i, sizeof(i)); + error = vfs_setopt(opts, JAIL_PARAM_NODYING, &i, sizeof(i)); if (error != 0 && error != ENOENT) goto done; - error = vfs_setopt(opts, "osreldate", &pr->pr_osreldate, + error = vfs_setopt(opts, JAIL_PARAM_OSRELDATE, &pr->pr_osreldate, sizeof(pr->pr_osreldate)); if (error != 0 && error != ENOENT) goto done; - error = vfs_setopts(opts, "osrelease", pr->pr_osrelease); + error = vfs_setopts(opts, JAIL_PARAM_OSRELEASE, pr->pr_osrelease); if (error != 0 && error != ENOENT) goto done; @@ -2963,7 +2977,7 @@ kern_jail_get(struct thread *td, struct uio *optuio, int flags) (void)kern_close(td, jfd_out); if (error && errmsg_pos >= 0) { /* Write the error message back to userspace. */ - vfs_getopt(opts, "errmsg", (void **)&errmsg, &errmsg_len); + vfs_getopt(opts, JAIL_PARAM_ERRMSG, (void **)&errmsg, &errmsg_len); errmsg_pos = 2 * errmsg_pos + 1; if (errmsg_len > 0) { if (optuio->uio_segflg == UIO_SYSSPACE) diff --git a/sys/sys/jail.h b/sys/sys/jail.h index c0ad53eec3cf..dbd2f071f652 100644 --- a/sys/sys/jail.h +++ b/sys/sys/jail.h @@ -110,6 +110,99 @@ enum prison_state { #define JAIL_SYS_NEW 1 #define JAIL_SYS_INHERIT 2 +/* + * Names of the static jail parameters registered by the base kernel. + * Runtime-registered parameters (allow.mount.*, modules) are only + * discoverable via the security.jail.param sysctl tree. + */ +#define JAIL_PARAM_JID "jid" +#define JAIL_PARAM_LASTJID "lastjid" +#define JAIL_PARAM_NAME "name" +#define JAIL_PARAM_PARENT "parent" +#define JAIL_PARAM_PATH "path" +#define JAIL_PARAM_DESC "desc" +#define JAIL_PARAM_ERRMSG "errmsg" +#define JAIL_PARAM_PERSIST "persist" +#define JAIL_PARAM_NOPERSIST "nopersist" +#define JAIL_PARAM_DYING "dying" +#define JAIL_PARAM_NODYING "nodying" +#define JAIL_PARAM_SECURELEVEL "securelevel" +#define JAIL_PARAM_DEVFS_RULESET "devfs_ruleset" +#define JAIL_PARAM_ENFORCE_STATFS "enforce_statfs" +#define JAIL_PARAM_CHILDREN_CUR "children.cur" +#define JAIL_PARAM_CHILDREN_MAX "children.max" +#define JAIL_PARAM_CPUSET_ID "cpuset.id" +#define JAIL_PARAM_OSRELDATE "osreldate" +#define JAIL_PARAM_OSRELEASE "osrelease" + +#define JAIL_PARAM_HOST "host" +#define JAIL_PARAM_HOST_HOSTNAME "host.hostname" +#define JAIL_PARAM_HOST_DOMAINNAME "host.domainname" +#define JAIL_PARAM_HOST_HOSTUUID "host.hostuuid" +#define JAIL_PARAM_HOST_HOSTID "host.hostid" + +#if !defined(_KERNEL) || defined(INET) +#define JAIL_PARAM_IP4 "ip4" +#define JAIL_PARAM_IP4_ADDR "ip4.addr" +#define JAIL_PARAM_IP4_SADDRSEL "ip4.saddrsel" +#define JAIL_PARAM_IP4_NOSADDRSEL "ip4.nosaddrsel" +#endif +#if !defined(_KERNEL) || defined(INET6) +#define JAIL_PARAM_IP6 "ip6" +#define JAIL_PARAM_IP6_ADDR "ip6.addr" +#define JAIL_PARAM_IP6_SADDRSEL "ip6.saddrsel" +#define JAIL_PARAM_IP6_NOSADDRSEL "ip6.nosaddrsel" +#endif +#if !defined(_KERNEL) || defined(VIMAGE) +#define JAIL_PARAM_VNET "vnet" +#endif + +#define JAIL_PARAM_ALLOW_SET_HOSTNAME "allow.set_hostname" +#define JAIL_PARAM_ALLOW_NOSET_HOSTNAME "allow.noset_hostname" +#define JAIL_PARAM_ALLOW_SYSVIPC "allow.sysvipc" +#define JAIL_PARAM_ALLOW_NOSYSVIPC "allow.nosysvipc" +#define JAIL_PARAM_ALLOW_RAW_SOCKETS "allow.raw_sockets" +#define JAIL_PARAM_ALLOW_NORAW_SOCKETS "allow.noraw_sockets" +#define JAIL_PARAM_ALLOW_CHFLAGS "allow.chflags" +#define JAIL_PARAM_ALLOW_NOCHFLAGS "allow.nochflags" +#define JAIL_PARAM_ALLOW_MOUNT "allow.mount" +#define JAIL_PARAM_ALLOW_NOMOUNT "allow.nomount" +#define JAIL_PARAM_ALLOW_QUOTAS "allow.quotas" +#define JAIL_PARAM_ALLOW_NOQUOTAS "allow.noquotas" +#define JAIL_PARAM_ALLOW_SOCKET_AF "allow.socket_af" +#define JAIL_PARAM_ALLOW_NOSOCKET_AF "allow.nosocket_af" +#define JAIL_PARAM_ALLOW_MLOCK "allow.mlock" +#define JAIL_PARAM_ALLOW_NOMLOCK "allow.nomlock" +#define JAIL_PARAM_ALLOW_RESERVED_PORTS "allow.reserved_ports" +#define JAIL_PARAM_ALLOW_NORESERVED_PORTS \ + "allow.noreserved_ports" +#define JAIL_PARAM_ALLOW_READ_MSGBUF "allow.read_msgbuf" +#define JAIL_PARAM_ALLOW_NOREAD_MSGBUF "allow.noread_msgbuf" +#define JAIL_PARAM_ALLOW_UNPRIV_DEBUG "allow.unprivileged_proc_debug" +#define JAIL_PARAM_ALLOW_NOUNPRIV_DEBUG "allow.nounprivileged_proc_debug" +#define JAIL_PARAM_ALLOW_SUSER "allow.suser" +#define JAIL_PARAM_ALLOW_NOSUSER "allow.nosuser" +#if !defined(_KERNEL) || defined(VIMAGE) +#define JAIL_PARAM_ALLOW_NFSD "allow.nfsd" +#define JAIL_PARAM_ALLOW_NONFSD "allow.nonfsd" +#endif +#define JAIL_PARAM_ALLOW_EXTATTR "allow.extattr" +#define JAIL_PARAM_ALLOW_NOEXTATTR "allow.noextattr" +#define JAIL_PARAM_ALLOW_ADJTIME "allow.adjtime" +#define JAIL_PARAM_ALLOW_NOADJTIME "allow.noadjtime" +#define JAIL_PARAM_ALLOW_SETTIME "allow.settime" +#define JAIL_PARAM_ALLOW_NOSETTIME "allow.nosettime" +#define JAIL_PARAM_ALLOW_ROUTING "allow.routing" +#define JAIL_PARAM_ALLOW_NOROUTING "allow.norouting" +#define JAIL_PARAM_ALLOW_UNPRIV_PARENT_TAMPER \ + "allow.unprivileged_parent_tampering" +#define JAIL_PARAM_ALLOW_NOUNPRIV_PARENT_TAMPER \ + "allow.nounprivileged_parent_tampering" +#if !defined(_KERNEL) || defined(AUDIT) +#define JAIL_PARAM_ALLOW_SETAUDIT "allow.setaudit" +#define JAIL_PARAM_ALLOW_NOSETAUDIT "allow.nosetaudit" +#endif + #ifndef _KERNEL struct iovec;