source: rtems-libbsd/rtemsbsd/rtems/rtems-kernel-jail.c @ dd35ec5

5-freebsd-12
Last change on this file since dd35ec5 was 3c967ca, checked in by Sebastian Huber <sebastian.huber@…>, on Jun 8, 2017 at 11:15:12 AM

Use <sys/lock.h> provided by Newlib

  • Property mode set to 100644
File size: 8.4 KB
Line 
1/**
2 * @file
3 *
4 * @ingroup rtems_bsd_rtems
5 *
6 * @brief This object is an minimal rtems implementation of kern_jail.c.
7 */
8
9/*
10 * Copyright (c) 2009, 2010 embedded brains GmbH.  All rights reserved.
11 *
12 *  embedded brains GmbH
13 *  Obere Lagerstr. 30
14 *  82178 Puchheim
15 *  Germany
16 *  <rtems@embedded-brains.de>
17 *
18 * Redistribution and use in source and binary forms, with or without
19 * modification, are permitted provided that the following conditions
20 * are met:
21 * 1. Redistributions of source code must retain the above copyright
22 *    notice, this list of conditions and the following disclaimer.
23 * 2. Redistributions in binary form must reproduce the above copyright
24 *    notice, this list of conditions and the following disclaimer in the
25 *    documentation and/or other materials provided with the distribution.
26 *
27 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
28 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
29 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
30 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
31 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
32 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
33 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
34 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
35 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
36 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
37 * SUCH DAMAGE.
38 */
39
40#include <machine/rtems-bsd-kernel-space.h>
41
42/*#include <sys/types.h>
43#include <sys/systm.h>
44#include <sys/malloc.h>
45#include <sys/jail.h>
46#include <sys/lock.h>
47#include <sys/mutex.h>*/
48
49#include <sys/param.h>
50#include <sys/types.h>
51#include <sys/kernel.h>
52#include <sys/systm.h>
53#include <sys/errno.h>
54#include <sys/sysproto.h>
55#include <sys/malloc.h>
56#include <sys/osd.h>
57#include <sys/priv.h>
58#include <sys/proc.h>
59#include <sys/taskqueue.h>
60#include <sys/fcntl.h>
61#include <sys/jail.h>
62#include <sys/lock.h>
63#include <sys/mutex.h>
64#include <sys/sx.h>
65#include <sys/sysent.h>
66#include <sys/namei.h>
67#include <sys/mount.h>
68#include <sys/queue.h>
69#include <sys/socket.h>
70#include <sys/syscallsubr.h>
71#include <sys/sysctl.h>
72
73#define DEFAULT_HOSTUUID  "00000000-0000-0000-0000-000000000000"
74
75/* Keep struct prison prison0 and some code in kern_jail_set() readable. */
76#ifdef INET
77#ifdef INET6
78#define _PR_IP_SADDRSEL PR_IP4_SADDRSEL|PR_IP6_SADDRSEL
79#else
80#define _PR_IP_SADDRSEL PR_IP4_SADDRSEL
81#endif
82#else /* !INET */
83#ifdef INET6
84#define _PR_IP_SADDRSEL PR_IP6_SADDRSEL
85#else
86#define _PR_IP_SADDRSEL 0
87#endif
88#endif
89
90/* prison0 describes what is "real" about the system. */
91struct prison prison0 = {
92  .pr_id    = 0,
93  .pr_name  = "0",
94  .pr_ref   = 1,
95  .pr_uref  = 1,
96  .pr_path  = "/",
97  .pr_securelevel = -1,
98  .pr_childmax  = JAIL_MAX,
99  .pr_hostuuid  = DEFAULT_HOSTUUID,
100  .pr_children  = LIST_HEAD_INITIALIZER(prison0.pr_children),
101#ifdef VIMAGE
102  .pr_flags = PR_HOST|PR_VNET|_PR_IP_SADDRSEL,
103#else
104  .pr_flags = PR_HOST|_PR_IP_SADDRSEL,
105#endif
106  .pr_allow = PR_ALLOW_ALL,
107};
108MTX_SYSINIT(prison0, &prison0.pr_mtx, "jail mutex", MTX_DEF);
109
110/*
111 * See if a prison has the specific flag set.
112 */
113int
114prison_flag(struct ucred *cred, unsigned flag)
115{
116  /* This is an atomic read, so no locking is necessary. */
117  return (prison0.pr_flags & flag);
118}
119
120void
121prison_free(struct prison *pr)
122{
123}
124
125void
126prison_hold(struct prison *pr)
127{
128}
129
130/*
131 * Check if given address belongs to the jail referenced by cred (wrapper to
132 * prison_check_ip[46]).
133 *
134 * Returns 0 if jail doesn't restrict the address family or if address belongs
135 * to jail, EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if
136 * the jail doesn't allow the address family.  IPv4 Address passed in in NBO.
137 */
138int
139prison_if(struct ucred *cred, struct sockaddr *sa)
140{
141  return 0;
142}
143
144/*
145 * Return 1 if we should do proper source address selection or are not jailed.
146 * We will return 0 if we should bypass source address selection in favour
147 * of the primary jail IPv6 address. Only in this case *ia will be updated and
148 * returned in NBO.
149 * Return EAFNOSUPPORT, in case this jail does not allow IPv6.
150 */
151int
152prison_saddrsel_ip6(struct ucred *cred, struct in6_addr *ia6)
153{
154  return EAFNOSUPPORT;
155}
156
157/*
158 * Check if given address belongs to the jail referenced by cred/prison.
159 *
160 * Returns 0 if jail doesn't restrict IPv4 or if address belongs to jail,
161 * EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if the jail
162 * doesn't allow IPv4.  Address passed in in NBO.
163 */
164int
165prison_check_ip4(const struct ucred *cred, const struct in_addr *ia)
166{
167  return 0;
168}
169
170/*
171 * Assuming 0 means no restrictions.
172 *
173 * NOTE: RTEMS does not restrict via a jail so return 0.
174 */
175int
176prison_check_ip6(const struct ucred *cred, const struct in6_addr *ia6)
177{
178  return 0;
179}
180
181/*
182 * Make sure our (source) address is set to something meaningful to this
183 * jail.
184 *
185 * Returns 0 if jail doesn't restrict IPv4 or if address belongs to jail,
186 * EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if the jail
187 * doesn't allow IPv4.  Address passed in in NBO and returned in NBO.
188 */
189int
190prison_local_ip4(struct ucred *cred, struct in_addr *ia)
191{
192  return 0;
193}
194
195/*
196 * Rewrite destination address in case we will connect to loopback address.
197 *
198 * Returns 0 on success, EAFNOSUPPORT if the jail doesn't allow IPv4.
199 * Address passed in in NBO and returned in NBO.
200 */
201int
202prison_remote_ip4(struct ucred *cred, struct in_addr *ia)
203{
204  return 0;
205}
206
207/*
208 * Make sure our (source) address is set to something meaningful to this jail.
209 *
210 * v6only should be set based on (inp->inp_flags & IN6P_IPV6_V6ONLY != 0)
211 * when needed while binding.
212 *
213 * Returns 0 if jail doesn't restrict IPv6 or if address belongs to jail,
214 * EADDRNOTAVAIL if the address doesn't belong, or EAFNOSUPPORT if the jail
215 * doesn't allow IPv6.
216 *
217 * NOTE: RTEMS does not restrict via a jail so return 0.
218 */
219int
220prison_local_ip6(struct ucred *cred, struct in6_addr *ia6, int v6only)
221{
222  return 0;
223}
224
225/*
226 * Rewrite destination address in case we will connect to loopback address.
227 *
228 * Returns 0 on success, EAFNOSUPPORT if the jail doesn't allow IPv6.
229 *
230 * NOTE: RTEMS does not restrict via a jail so return 0.
231 */
232int
233prison_remote_ip6(struct ucred *cred, struct in6_addr *ia6)
234{
235  return 0;
236}
237
238/*
239 * Return 1 if we should do proper source address selection or are not jailed.
240 * We will return 0 if we should bypass source address selection in favour
241 * of the primary jail IPv4 address. Only in this case *ia will be updated and
242 * returned in NBO.
243 * Return EAFNOSUPPORT, in case this jail does not allow IPv4.
244 */
245int
246prison_saddrsel_ip4(struct ucred *cred, struct in_addr *ia)
247{
248  return 1;
249}
250
251/*
252 * Pass back primary IPv4 address of this jail.
253 *
254 * If not restricted return success but do not alter the address.  Caller has
255 * to make sure to initialize it correctly (e.g. INADDR_ANY).
256 *
257 * Returns 0 on success, EAFNOSUPPORT if the jail doesn't allow IPv4.
258 * Address returned in NBO.
259 */
260int
261prison_get_ip4(struct ucred *cred, struct in_addr *ia)
262{
263  return 0;
264}
265
266/*
267 * Return 1 if the passed credential is in a jail and that jail does not
268 * have its own virtual network stack, otherwise 0.
269 */
270int
271jailed_without_vnet(struct ucred *cred)
272{
273  return 0;
274}
275
276/*
277 * Pass back primary IPv6 address for this jail.
278 *
279 * If not restricted return success but do not alter the address.  Caller has
280 * to make sure to initialize it correctly (e.g. IN6ADDR_ANY_INIT).
281 *
282 * Returns 0 on success, EAFNOSUPPORT if the jail doesn't allow IPv6.
283 */
284int
285prison_get_ip6(struct ucred *cred, struct in6_addr *ia6)
286{
287  return 0;
288}
289/*
290 * Return 0 if jails permit p1 to frob p2, otherwise ESRCH.
291 */
292int
293prison_check(struct ucred *cred1, struct ucred *cred2)
294{
295  return 0;
296}
297
298/*
299 * Check if a jail supports the given address family.
300 *
301 * Returns 0 if not jailed or the address family is supported, EAFNOSUPPORT
302 * if not.
303 */
304int
305prison_check_af(struct ucred *cred, int af)
306{
307  return 0;
308}
309
310/*
311 * Return the correct hostname (domainname, et al) for the passed credential.
312 */
313void
314getcredhostname(struct ucred *cred, char *buf, size_t size)
315{
316  gethostname(buf, size);
317}
318
319void
320getcreddomainname(struct ucred *cred, char *buf, size_t size)
321{
322  getdomainname(buf, size);
323}
324
325void
326getcredhostid(struct ucred *cred, unsigned long *hostid)
327{
328  *hostid = 0;
329}
330
331/*
332 * Return 1 if the passed credential is in a jail, otherwise 0.
333 */
334int
335jailed(struct ucred *cred)
336{
337  return 0;
338}
Note: See TracBrowser for help on using the repository browser.