Lines Matching +full:cs +full:- +full:0
1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
65 int paralimit = -1;
92 if (error == 0 && setid == CPUSET_INVALID)
93 error = cpuset_getid(CPU_LEVEL_ROOT, CPU_WHICH_PID, -1, &setid);
94 if (error != 0)
108 if (paralimit == 0) {
109 if (j->flags & JF_FROM_RUNQ)
115 j->flags &= ~JF_FROM_RUNQ;
116 create_failed = (j->flags & (JF_STOP | JF_FAILED)) == JF_FAILED;
117 stopping = (j->flags & JF_STOP) != 0;
118 comparam = *j->comparam;
120 if (j->comstring == NULL) {
121 j->comparam += create_failed ? -1 : 1;
122 switch ((comparam = *j->comparam)) {
124 return 0;
126 if (!bool_param(j->intparams[IP_MOUNT_DEVFS]))
128 j->comstring = &dummystring;
131 if (!bool_param(j->intparams[IP_MOUNT_FDESCFS]))
133 j->comstring = &dummystring;
136 if (!bool_param(j->intparams[IP_MOUNT_PROCFS]))
138 j->comstring = &dummystring;
142 j->comstring = &dummystring;
145 if (j->intparams[comparam] == NULL)
147 j->comstring = create_failed || (stopping &&
148 (j->intparams[comparam]->flags & PF_REV))
149 ? TAILQ_LAST(&j->intparams[comparam]->val,
151 : TAILQ_FIRST(&j->intparams[comparam]->val);
154 j->comstring = j->comstring == &dummystring ? NULL :
156 (j->intparams[comparam]->flags & PF_REV))
157 ? TAILQ_PREV(j->comstring, cfstrings, tq)
158 : TAILQ_NEXT(j->comstring, tq);
160 if (j->comstring == NULL || j->comstring->len == 0 ||
167 case -1:
185 if (!(j->flags & JF_SLEEPQ))
186 return 0;
187 j->flags &= ~JF_SLEEPQ;
188 if (*j->comparam == IP_STOP_TIMEOUT) {
189 j->flags &= ~JF_TIMEOUT;
190 j->pstatus = 0;
191 return 0;
196 rj->flags |= JF_FROM_RUNQ;
199 error = 0;
200 if (j->flags & JF_TIMEOUT) {
201 j->flags &= ~JF_TIMEOUT;
202 if (*j->comparam != IP_STOP_TIMEOUT) {
203 jail_warnx(j, "%s: timed out", j->comline);
205 error = -1;
206 } else if (verbose > 0)
208 } else if (j->pstatus != 0) {
209 if (WIFSIGNALED(j->pstatus))
211 j->comline, WTERMSIG(j->pstatus));
213 jail_warnx(j, "%s: failed", j->comline);
214 j->pstatus = 0;
216 error = -1;
218 free(j->comline);
219 j->comline = NULL;
237 if ((j = TAILQ_FIRST(&sleeping)) && j->timeout.tv_sec) {
239 ts.tv_sec = j->timeout.tv_sec - ts.tv_sec;
240 ts.tv_nsec = j->timeout.tv_nsec - ts.tv_nsec;
241 if (ts.tv_nsec < 0) {
242 ts.tv_sec--;
245 if (ts.tv_sec < 0 ||
246 (ts.tv_sec == 0 && ts.tv_nsec == 0)) {
247 j->flags |= JF_TIMEOUT;
254 ts.tv_sec = 0;
255 ts.tv_nsec = 0;
258 switch (kevent(kq, NULL, 0, &ke, 1, tsp)) {
259 case -1:
263 case 0:
266 j->flags |= JF_TIMEOUT;
274 j->pstatus = ke.data;
293 char *acs, *cs, *comcs, *devpath;
307 comparam = *j->comparam;
308 down = j->flags & (JF_STOP | JF_FAILED);
315 if (jail_remove(j->jid) < 0 && errno == EPERM) {
318 return -1;
320 if (verbose > 0 || (verbose == 0 && (j->flags & JF_STOP
321 ? note_remove : j->name != NULL)))
323 j->jid = -1;
324 if (j->flags & JF_STOP)
327 j->flags &= ~JF_PERSIST;
329 if (create_jail(j) < 0)
330 return -1;
332 printf("%d\n", j->jid);
333 if (verbose >= 0 && (j->name || verbose > 0))
337 return 0;
345 comstring = j->comstring;
346 bg = 0;
350 argc = 0;
351 val = alloca(strlen(comstring->s) + 1);
352 strcpy(val, comstring->s);
353 cs = val;
355 while ((p = strchr(cs, ' ')) != NULL && strlen(p) > 1) {
357 *p = '\0';
360 cs = p + 1;
365 argv[0] = _PATH_IFCONFIG;
366 if ((cs = strchr(val, '|'))) {
367 argv[1] = acs = alloca(cs - val + 1);
368 strlcpy(acs, val, cs - val + 1);
369 addr = cs + 1;
371 argv[1] = string_param(j->intparams[IP_INTERFACE]);
375 if (!(cs = strchr(addr, '/'))) {
380 } else if (strchr(cs + 1, '.')) {
381 argv[3] = acs = alloca(cs - addr + 1);
382 strlcpy(acs, addr, cs - addr + 1);
384 argv[5] = cs + 1;
392 for (cs = strtok(extrap, " "); cs;
393 cs = strtok(NULL, " ")) {
394 size_t len = strlen(cs) + 1;
396 strlcpy(acs, cs, len);
400 argv[argc] = down ? "-alias" : "alias";
407 argc = 0;
408 val = alloca(strlen(comstring->s) + 1);
409 strcpy(val, comstring->s);
410 cs = val;
412 while ((p = strchr(cs, ' ')) != NULL && strlen(p) > 1) {
414 *p = '\0';
417 cs = p + 1;
422 argv[0] = _PATH_IFCONFIG;
423 if ((cs = strchr(val, '|'))) {
424 argv[1] = acs = alloca(cs - val + 1);
425 strlcpy(acs, val, cs - val + 1);
426 addr = cs + 1;
428 argv[1] = string_param(j->intparams[IP_INTERFACE]);
433 if (!(cs = strchr(addr, '/'))) {
441 for (cs = strtok(extrap, " "); cs;
442 cs = strtok(NULL, " ")) {
443 size_t len = strlen(cs) + 1;
445 strlcpy(acs, cs, len);
449 argv[argc] = down ? "-alias" : "alias";
456 argv[0] = _PATH_IFCONFIG;
457 argv[1] = comstring->s;
458 argv[2] = down ? "-vnet" : "vnet";
459 jidstr = string_param(j->intparams[KP_JID]);
460 argv[3] = jidstr ? jidstr : string_param(j->intparams[KP_NAME]);
467 comcs = alloca(comstring->len + 1);
468 strcpy(comcs, comstring->s);
469 argc = 0;
470 for (cs = strtok(comcs, " \t\f\v\r\n"); cs && argc < 4;
471 cs = strtok(NULL, " \t\f\v\r\n")) {
472 if (argc <= 1 && strunvis(cs, cs) < 0) {
474 j->intparams[comparam]->name, comstring->s);
475 return -1;
477 argv[argc++] = cs;
479 if (argc == 0)
480 return 0;
483 j->intparams[comparam]->name, comstring->s);
484 return -1;
486 if (check_path(j, j->intparams[comparam]->name, argv[1], 0,
487 down ? argv[2] : NULL) < 0)
488 return -1;
492 argv[0] = "/sbin/umount";
497 argv[5] = argv[0];
499 argv[3] = "-o";
503 argv[3] = argv[0];
505 argv[0] = _PATH_MOUNT;
507 argv[1] = "-t";
512 path = string_param(j->intparams[KP_PATH]);
515 return -1;
519 if (check_path(j, "mount.devfs", devpath, 0,
520 down ? "devfs" : NULL) < 0)
521 return -1;
523 argv[0] = "/sbin/umount";
527 argv[0] = _PATH_MOUNT;
528 argv[1] = "-t";
530 ruleset = string_param(j->intparams[KP_DEVFS_RULESET]);
534 sprintf(acs, "-oruleset=%s", ruleset);
543 path = string_param(j->intparams[KP_PATH]);
546 return -1;
550 if (check_path(j, "mount.fdescfs", devpath, 0,
551 down ? "fdescfs" : NULL) < 0)
552 return -1;
554 argv[0] = "/sbin/umount";
558 argv[0] = _PATH_MOUNT;
559 argv[1] = "-t";
569 path = string_param(j->intparams[KP_PATH]);
572 return -1;
576 if (check_path(j, "mount.procfs", devpath, 0,
577 down ? "procfs" : NULL) < 0)
578 return -1;
580 argv[0] = "/sbin/umount";
584 argv[0] = _PATH_MOUNT;
585 argv[1] = "-t";
595 jidstr = string_param(j->intparams[KP_JID]) ?
596 string_param(j->intparams[KP_JID]) :
597 string_param(j->intparams[KP_NAME]);
598 fmt = "if [ $(/sbin/zfs get -H -o value jailed %s) = on ]; then /sbin/zfs jail %s %s || echo error, attaching %s to jail %s failed; else echo error, you need to set jailed=on for dataset %s; fi";
601 + 4 * comstring->len
602 - 6 * 2 /* 6 * "%s" */
605 ret = snprintf(comcs, comlen, fmt, comstring->s,
606 jidstr, comstring->s, comstring->s, jidstr,
607 comstring->s);
612 argv[0] = _PATH_BSHELL;
613 argv[1] = "-c";
619 if (j->name != NULL)
621 argc = 0;
622 TAILQ_FOREACH(s, &j->intparams[IP_COMMAND]->val, tq)
625 argc = 0;
626 TAILQ_FOREACH(s, &j->intparams[IP_COMMAND]->val, tq)
627 argv[argc++] = s->s;
629 j->comstring = &dummystring;
634 if ((cs = strpbrk(comstring->s, "!\"$&'()*;<>?[\\]`{|}~")) &&
635 !(cs[0] == '&' && cs[1] == '\0')) {
637 argv[0] = _PATH_BSHELL;
638 argv[1] = "-c";
639 argv[2] = comstring->s;
642 if (cs) {
643 *cs = 0;
646 comcs = alloca(comstring->len + 1);
647 strcpy(comcs, comstring->s);
648 argc = 0;
649 for (cs = strtok(comcs, " \t\f\v\r\n"); cs;
650 cs = strtok(NULL, " \t\f\v\r\n"))
653 strcpy(comcs, comstring->s);
654 argc = 0;
655 for (cs = strtok(comcs, " \t\f\v\r\n"); cs;
656 cs = strtok(NULL, " \t\f\v\r\n"))
657 argv[argc++] = cs;
661 if (argv[0] == NULL)
662 return 0;
664 if (int_param(j->intparams[IP_EXEC_TIMEOUT], &timeout) &&
665 timeout != 0) {
666 clock_gettime(CLOCK_REALTIME, &j->timeout);
667 j->timeout.tv_sec += timeout;
669 j->timeout.tv_sec = 0;
677 clean = bool_param(j->intparams[IP_EXEC_CLEAN]);
678 username = string_param(j->intparams[injail
680 sjuser = bool_param(j->intparams[IP_EXEC_SYSTEM_JAIL_USER]);
682 consfd = 0;
684 (conslog = string_param(j->intparams[IP_EXEC_CONSOLELOG]))) {
685 if (check_path(j, "exec.consolelog", conslog, 1, NULL) < 0)
686 return -1;
689 if (consfd < 0) {
691 return -1;
695 comlen = 0;
696 for (i = 0; argv[i]; i++)
698 j->comline = cs = emalloc(comlen);
699 for (i = 0; argv[i]; i++) {
700 strcpy(cs, argv[i]);
702 cs += strlen(argv[i]) + 1;
703 cs[-1] = ' ';
706 if (verbose > 0)
709 username ? username : "", j->comline);
712 if (pid < 0)
714 if (pid > 0) {
716 free(j->comline);
717 j->comline = NULL;
718 return 0;
720 paralimit--;
731 get_user_info(j, username, &pwd, &lcap) < 0)
735 path = string_param(j->intparams[KP_PATH]);
736 if (path && chdir(path) < 0) {
740 if (int_param(j->intparams[IP_EXEC_FIB], &fib) &&
741 setfib(fib) < 0) {
752 * This is just a best-effort to use as wide of mask as
756 (void)cpuset_setid(CPU_WHICH_PID, -1, setid);
758 if (jail_attach(j->jid) < 0) {
765 get_user_info(j, username, &pwd, &lcap) < 0)
770 setenv("PATH", "/bin:/usr/bin", 0);
774 if (setgid(pwd->pw_gid) < 0) {
775 jail_warnx(j, "setgid %d: %s", pwd->pw_gid,
779 if (setusercontext(lcap, pwd, pwd->pw_uid, username
781 : LOGIN_SETPATH | LOGIN_SETENV) < 0) {
782 jail_warnx(j, "setusercontext %s: %s", pwd->pw_name,
787 setenv("USER", pwd->pw_name, 1);
788 setenv("HOME", pwd->pw_dir, 1);
790 *pwd->pw_shell ? pwd->pw_shell : _PATH_BSHELL, 1);
791 if (clean && username && chdir(pwd->pw_dir) < 0) {
793 pwd->pw_dir, strerror(errno));
799 if (consfd != 0 && (dup2(consfd, 1) < 0 || dup2(consfd, 2) < 0)) {
804 execvp(argv[0], __DECONST(char *const*, argv));
805 jail_warnx(j, "exec %s: %s", argv[0], strerror(errno));
819 if (!kq && (kq = kqueue()) < 0)
821 EV_SET(&ke, pid, EVFILT_PROC, EV_ADD, NOTE_EXIT, 0, NULL);
822 if (kevent(kq, &ke, 1, NULL, 0, NULL) < 0) {
824 return 0;
828 ph->j = j;
829 ph->pid = pid;
831 j->nprocs++;
832 j->flags |= JF_SLEEPQ;
833 if (j->timeout.tv_sec == 0)
837 TAILQ_REMOVE(j->queue, j, tq);
839 if (!tj->timeout.tv_sec ||
840 j->timeout.tv_sec < tj->timeout.tv_sec ||
841 (j->timeout.tv_sec == tj->timeout.tv_sec &&
842 j->timeout.tv_nsec <= tj->timeout.tv_nsec)) {
849 j->queue = &sleeping;
864 j->nprocs = 0;
865 for (i = 0; i < PHASH_SIZE; i++)
867 if (ph->j == j) {
868 EV_SET(&ke, ph->pid, EVFILT_PROC, EV_DELETE,
869 NOTE_EXIT, 0, NULL);
870 (void)kevent(kq, &ke, 1, NULL, 0, NULL);
886 if (ph->pid == pid) {
887 j = ph->j;
890 return --j->nprocs ? NULL : j;
906 if (!int_param(j->intparams[IP_STOP_TIMEOUT], &timeout))
908 else if (timeout == 0)
909 return 0;
914 return 0;
917 ki = kvm_getprocs(kd, KERN_PROC_PROC, 0, &pcnt);
919 return 0;
920 noted = 0;
921 for (i = 0; i < pcnt; i++)
922 if (ki[i].ki_jid == j->jid &&
923 kill(ki[i].ki_pid, SIGTERM) == 0) {
925 if (verbose > 0) {
935 if (j->nprocs > 0) {
936 clock_gettime(CLOCK_REALTIME, &j->timeout);
937 j->timeout.tv_sec += timeout;
940 return 0;
952 errno = 0;
962 return -1;
966 jail_warnx(j, "getpwclass %s: %s", pwd->pw_name,
968 return -1;
971 if (initgroups(pwd->pw_name, pwd->pw_gid) < 0) {
972 jail_warnx(j, "initgroups %s: %s", pwd->pw_name,
974 return -1;
976 return 0;
993 if (path[0] != '/') {
996 return -1;
1002 jailpath = string_param(j->intparams[KP_PATH]);
1012 *p = '\0';
1013 if (lstat(tpath, &st) < 0) {
1018 return -1;
1023 return -1;
1030 if (stat(path, &st) < 0 || statfs(path, &stfs) < 0) {
1033 return -1;
1035 if (stat(stfs.f_mntonname, &mpst) < 0) {
1038 return -1;
1043 return -1;
1048 return -1;
1051 return 0;