New BSD Jail

This version does away with the /proc abuse, leaving only the ioctl
abuse to worry about.

Following advice by Brad Spender, it also places controls on inter-jail
usage of IPC and abstract unix domain sockets, and forbids
CAP_SYS_RAWIO.  

-- 
=======================================================
Serge Hallyn
Security Software Engineer, IBM Linux Technology Center
serue@us.ibm.com

/*
 * File: linux/security/bsdjail.c
 * Author: Serge Hallyn (serue@us.ibm.com)
 * Date: Mar 18, 2004
 *
 * Description:
 *
 * Implements a subset of the BSD Jail functionality as a Linux LSM.
 * What is currently implemented:
 *   If a proces is in a jail, it:
 *     1. Is locked under a chroot (as are all children) which is not
 *	  vulnerable to the trivial chdir(..)(etc)chroot(.) escape.
 *     2. Cannot mount or umount
 *     3. Cannot send signals outside of jail
 *     4. Cannot ptrace processes outside of jail
 *     5. Cannot create devices
 *     6. Cannot renice processes
 *     7. Cannot load or unload modules
 *     8. Cannot change network settings
 *     9. May be assigned a specific ip address which will be used
 *	  for all it's socket binds.
 *    10. Cannot see /proc/<pid> entries of processes not in the
 *	  same jail.
 *    11. Has no CAP_SYS_RAWIO capability (no ioperm/iopl)
 *    12. May not share shmem with processes outside jail.  (NOT IMPLEMENTED)
 *
 * WARNINGS:
 *	The security of this module is very much dependent on the security
 *	of the rest of the system.  You must carefully think through your
 *	use of the system.
 *	
 *	Some examples:
 *		1. If you leave /dev/hda1 in the jail, processes in the
 *		jail can access that filesystem - ie /sbin/debugfs.
 *		2. If you provide root access within a jail, this can
 *		be used to setuid binaries in the jail.  Combined with
 *		an unjailed regular user account, this gives jailed
 *		users unjailed root access.  (thanks to Brad Spender for
 *		pointing this out).  To protect against this, use jails
 *		in private namespaces, with the jail filesystems mounted
 *		ONLY within the jail namespaces.  For instance:
 *
 *	$ # (Make sure /dev/hdc5 is not mounted anywhere)
 *	$ new_namespace_shell /bin/bash
 *	$ mount /dev/hdc5 /opt
 *	$ mount -t proc proc /opt/proc
 *	$ echo -n "root /opt" > /proc/$$/attr/exec
 *	$ echo -n "ip 9.53.94.111" > /proc/$$/attr/exec
 *	$ exec /bin/sh
 *	$ sshd
 *	$ apachectl start
 *	$ exit
 *
 * How to use:
 *     1. modprobe bsdjail
 *     [ 1.5 /sbin/ifconfig eth0:0 2.2.2.2;
 *       1.6 /sbin/route add -host 2.2.2.2 dev eth0:0
 *       (optional) ]
 *     2. Make sure the root filesystem (ie /dev/hdc5) is not mounted
 *	  anywhere else.
 *     3. exec_private_namespace /bin/sh
 *     4. mount /dev/hdc5 /opt
 *     5. mount -t proc proc /opt/proc
 *     6. echo -n "root /opt" > /proc/$$/attr/exec
 *        echo -n "ip 2.2.2.2" > /proc/$$/attr/exec (optional)
 *     7. exec /bin/sh
 *     8. sshd
 *     9. exit
 *
 * The new shell will now run in a private jail on the filesystem on
 * /dev/hdc5. If proc has been mounted under /dev/hdc5, then a "ps -auxw"
 * under the jailed shell will show only entries for processes started under
 * that jail.
 *
 * If a private IP was specified for the jail, then cat /proc/net/dev
 * shows no information, and /sbin/ifconfig -a will only show the info
 * for the private network device.  This is not so much meant to protect
 * the rest of the system, as it is to be helpful to whoever is working
 * within the jail.
 *
 * Cat /proc/<pid>/attr/current returns -EINVAL if the reading process is
 * in a jail.  Otherwise, it returns information about the root and ip
 * for the target process, or "Not Jailed" if the target process is not
 * jailed.
 *
 * Cat /proc/$$/attr/exec gives a list of the valid keywords to cat into
 * /proc/$$/attr/exec when starting a jail.
 *
 * Current valid keywords for creating a jail are:
 *
 *	root: Root of jail's fs
 *	ip: Ip addr for this jail
 *	nrtask: Number of tasks in this jail
 *	nice: The nice level for this jail.  (maybe should be min/max?)
 *	slice: Max timeslice per process
 *	data: Max size of DATA segment per process
 *	memlock: Max size of memory which can be locked per process
 *
 *
 *
 *
 * Copyright (C) 2002 International Business Machines <robb@austin.ibm.com>
 *
 *   This program is free software; you can redistribute it and/or modify
 *   it under the terms of the GNU General Public License as published by
 *   the Free Software Foundation; either version 2 of the License, or
 *   (at your option) any later version.
 */

#include <linux/config.h>
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/security.h>
#include <linux/mount.h>
#include <linux/namei.h>
#include <linux/namespace.h>
#include <linux/proc_fs.h>
#include <linux/in.h>
#include <linux/pagemap.h>
#include <linux/ip.h>
#include <asm/uaccess.h>
#include <linux/netdevice.h>
#include <linux/inetdevice.h>
#include <linux/seq_file.h>
#include <linux/un.h>

static int jail_debug = 0;
MODULE_PARM(jail_debug, "i");
MODULE_PARM_DESC(jail_debug, "Print bsd jail debugging messages.\n");

#define DBG 0
#define WARN 1
#define bsdj_debug(how, fmt, arg... ) \
	do { \
		if ( how || jail_debug ) \
			printk(KERN_NOTICE "%s: %s: " fmt, \
				MY_NAME, __FUNCTION__, \
				## arg ); \
	} while ( 0 )

/* flag to keep track of how we were registered */
static int secondary = 0;

/*
 * The task structure holding jail information.
 * Taskp->security points to one of these (or is null).
 * There is exactly one bsdjail_task_sec for each jail.  If >1 process
 * are in the same jail, they share the same bsdjail_task_sec.
 */
struct bsdjail_task_sec {
	short in_use;   /* in_use:
			 * if 0, then this task is actually setting up a jail,
			 * not currently in one
			 */
	atomic_t refcount;  /* how many processes in this jail */

	/* these are set on writes to /proc/<pid>/attr/exec */
	char *root_pathname; /* char * containing path to use as jail / */
	char *ip_addr_name;  /* char * containing ip addr to use for jail */

	/* these are set when a jail becomes active */
	char got_network;    /* if 0, jail can use any valid net addr */
	__u32 realaddr;      /* internal form of ip_addr_name */
	struct dentry *dentry;  /* dentry of fs root */
	struct vfsmount *mnt;   /* vfsmnt of fs root */

	/* Resource limits.  0 = no limit */
	long max_nrtask;	/* maximum number of tasks within this jail. */
	long cur_nrtask;	/* current number of tasks within this jail. */
	long maxtimeslice;      /* max timeslice in ms for procs in this jail */
	long nice;      	/* nice level for processes in this jail */
	long max_data, max_memlock;  /* equivalent to RLIMIT_{DATA,MEMLOCK} */
};

/* allow use with stacker LSM */
#define get_security(st,p,type) (p->type)
#define set_security(st,p,type,data) (p->type = data)

#define jail_of(proc) (get_security(task,proc,security))

#define MY_NAME "bsdjail"

static inline int
in_jail(struct task_struct *t)
{
	struct bsdjail_task_sec *tsec = get_security(task,t,security);
	
	if (tsec && tsec->in_use)
		return 1;

	return 0;
}

/*
 * alloc_task_security and free_task_security:
 *   these are intended to be simple, and deal only with the bsd
 *   jail task security struct, not with namespaces and network
 *   structures as will be necessary when destroying a jail.

 *   however, if a process had written into /proc/bsdjail/root
 *   or /proc/bsdjail/ip, then that data will be freed in
 *   free_task_security.
 */
static struct bsdjail_task_sec *
alloc_task_security(struct task_struct *tsk)
{
	struct bsdjail_task_sec *tsec;

	tsec = kmalloc(sizeof(struct bsdjail_task_sec), GFP_KERNEL);
	if (!tsec)
		return ERR_PTR(-ENOMEM);
	memset(tsec, 0, sizeof(struct bsdjail_task_sec));
	set_security(task,tsk,security,tsec);
	return tsec;
}

static void
free_task_security(struct task_struct *tsk)
{
	struct bsdjail_task_sec *tsec;

	tsec = get_security(task,tsk,security);
	if (!tsec)
		return;
	if (tsec->root_pathname)
		kfree(tsec->root_pathname);
	if (tsec->ip_addr_name)
		kfree(tsec->ip_addr_name);
	kfree(tsec);
	set_security(task,tsk,security,NULL);
}

/*
 * If a network address was passed into /proc/<pid>/attr/exec,
 * then process in its jail will only be allowed to bind/listen
 * to that address.
 */
void
setup_netaddress(struct bsdjail_task_sec *tsec)
{
	unsigned int a,b,c,d;

	tsec->got_network = 0;
	tsec->realaddr = 0;
	if (!tsec->ip_addr_name)
		return;

	if (sscanf(tsec->ip_addr_name,"%u.%u.%u.%u",&a,&b,&c,&d)!=4)
		return;
	if (a>255 || b>255 || c>255 || d>255)
		return;
	tsec->realaddr = htonl((a<<24)|(b<<16)|(c<<8)|d);
	tsec->got_network = 1;
	bsdj_debug(DBG, "Network set up (%s)\n", tsec->ip_addr_name);
}

/*
 * Called when a process is placed into a new jail to handle the
 * actual creation of the jail.
 *   Creates namespace
 *   Sets process root+pwd
 *   Stores the requested ip address
 *   Registers a unique pseudo-proc filesystem for this jail
 */
int create_jail(struct task_struct *tsk)
{
	struct nameidata nd;
	struct bsdjail_task_sec *tsec;
	int retval = -EFAULT;

	tsec = get_security(task,tsk,security);
	if (!tsec || !tsec->root_pathname)
		goto out;

	/* 
	 * USE_JAIL_NAMESPACE: could be useful, so that future mounts outside
	 * the jail don't affect the jail.  But it's not necessary, and
	 * requires exporting copy_namespace from fs/namespace.c
	 *
	 * Actually, it woudl also be useful for truly hiding
	 * information about mounts which do not exist in this jail.
#define USE_JAIL_NAMESPACE
	 */
#ifdef USE_JAIL_NAMESPACE
	bsdj_debug(DBG, "bsdjail: copying namespace.\n");
	retval = -EPERM;
	if (copy_namespace(CLONE_NEWNS, tsk))
		goto out;
	bsdj_debug(DBG, "bsdjail: copied namespace.\n");
#endif

	/* find our new root directory */
	bsdj_debug(DBG, "bsdjail: looking up %s\n", tsec->root_pathname);
	retval = path_lookup(tsec->root_pathname, LOOKUP_FOLLOW | LOOKUP_DIRECTORY, &nd);
	if (retval)
		goto out;

	bsdj_debug(DBG, "bsdjail: got %s, setting root to it\n", tsec->root_pathname);

	/* and set the fsroot to it */
	set_fs_root(tsk->fs, nd.mnt, nd.dentry);
	set_fs_pwd(tsk->fs, nd.mnt, nd.dentry);

	bsdj_debug(DBG, "bsdjail: root has been set.  Have fun.\n");

	/* set up networking */
	if (tsec->ip_addr_name)
		setup_netaddress(tsec);

	tsec->cur_nrtask = 1;
	if (tsec->nice)
		set_user_nice(current, tsec->nice);
	if (tsec->max_data) {
		current->rlim[RLIMIT_DATA].rlim_cur = tsec->max_data;
		current->rlim[RLIMIT_DATA].rlim_max = tsec->max_data;
	}
	if (tsec->max_memlock) {
		current->rlim[RLIMIT_MEMLOCK].rlim_cur = tsec->max_memlock;
		current->rlim[RLIMIT_MEMLOCK].rlim_max = tsec->max_memlock;
	}
	if (tsec->maxtimeslice) {
		current->rlim[RLIMIT_CPU].rlim_cur = tsec->maxtimeslice;
		current->rlim[RLIMIT_CPU].rlim_max = tsec->maxtimeslice;
	}
	/* success and end */
	tsec->mnt = mntget(nd.mnt);
	tsec->dentry = dget(nd.dentry);
	path_release(&nd);
	atomic_inc(&tsec->refcount);
	tsec->in_use = 1;

	/* won't let ourselves be removed until this jail goes away */
	try_module_get(THIS_MODULE);

	return 0;

out:
	return retval;
}

static void
disable_jail(struct bsdjail_task_sec *tsec)
{
	/*
	 *   don't need to put namespace, it will be done automatically
	 *     when the last process in jail is put.
	 *   DO need to put the dentry and vfsmount
	 */

	dput(tsec->dentry);
	mntput(tsec->mnt);
	module_put(THIS_MODULE);
}

/*
 * LSM /proc/<pid>/attr hooks.
 * You may write into /proc/<pid>/attr/exec:
 *    root /some/path
 *    ip 2.2.2.2
 * These values will be used on the next exec() to set up your jail
 *  (assuming you're not already in a jail)
 */
static int
jail_setprocattr(struct task_struct *p, char *name, void *value, size_t size)
{
	struct bsdjail_task_sec *tsec;
	long val;

	if (in_jail(current))
		return -EINVAL;  /* let them guess why */
		
	if (p != current || strcmp(name, "exec"))
		return -EPERM;

	tsec = get_security(task,current,security);
	if (!tsec)
		tsec = alloc_task_security(current);
	if (IS_ERR(tsec))
		return -ENOMEM;

	if (strncmp(value, "root ", 5)==0) {
		if (tsec->root_pathname)
			kfree(tsec->root_pathname);
		tsec->root_pathname = kmalloc(size-4, GFP_KERNEL);
		if (!tsec->root_pathname)
			return -ENOMEM;
		strncpy(tsec->root_pathname, value+5, size-4);
		tsec->root_pathname[size-5] = '\0';
	} else if (strncmp(value, "ip ", 3)==0) {
		if (tsec->ip_addr_name)
			kfree(tsec->ip_addr_name);
		tsec->ip_addr_name = kmalloc(size-2, GFP_KERNEL);
		if (!tsec->ip_addr_name)
			return -ENOMEM;
		strncpy(tsec->ip_addr_name, value+3, size-2);
		tsec->ip_addr_name[size-3] = '\0';

	/* the next two are equivalent - I'm just lazy */
	} else if (strncmp(value, "slice ", 6)==0) {
		val = simple_strtoul(value+6, NULL, 0);
		tsec->maxtimeslice = val;
	} else if (strncmp(value, "timeslice ", 10)==0) {
		val = simple_strtoul(value+10, NULL, 0);
		tsec->maxtimeslice = val;
	} else if (strncmp(value, "nrtask ", 7)==0) {
		val = simple_strtoul(value+7, NULL, 0);
		tsec->max_nrtask = val;
	} else if (strncmp(value, "memlock ", 8)==0) {
		val = simple_strtoul(value+8, NULL, 0);
		tsec->max_memlock = val;
	} else if (strncmp(value, "data ", 5)==0) {
		val = simple_strtoul(value+5, NULL, 0);
		tsec->max_data = val;
	} else if (strncmp(value, "nice ", 5)==0) {
		val = simple_strtoul(value+5, NULL, 0);
		tsec->nice = val;
	} else
		return -EINVAL;

	return size;
}

/*
 * LSM /proc/<pid>/attr read hook.
 * If the reading process, say process 1001, is in a jail, then
 *   cat /proc/999/attr/exec
 * will return -EINVAL.
 * If the reading process, say process 1001, is not in a jail, then
 *   cat /proc/999/attr/exec
 * will return
 *   root: (root of jail)
 *   ip:   (ip address of jail)
 * if 999 is in a jail, or
 *   -EINVAL
 * if 999 is not in a jail.
 */
static int
jail_getprocattr(struct task_struct *p, char *name, void *value, size_t size)
{
	struct bsdjail_task_sec *tsec;
	int err = 0;

	if (in_jail(current))
		return -EINVAL;  /* let them guess why */
		
	if (strcmp(name, "exec") == 0) {
		/* Print usage some help */
		err = snprintf(value, size,
			"Valid keywords:\n"
			"root    <pathname>\n"
			"ip      <ip4-addr>\n"
			"nrtask  <max number of tasks in this jail>\n"
			"nice    <nice level for processes in this jail>\n"
			"slice   <max timeslice per process in msecs>\n"
			"data    <max data size per process in bytes>\n"
			"memlock <max lockable memory per process in bytes>\n");
		return err;
	}

	if (strcmp(name, "current"))
		return -EPERM;

	tsec = get_security(task, p, security);
	if (!tsec || !tsec->in_use) {
		err = snprintf(value, size, "Not Jailed\n");
	} else {
		err = snprintf(value, size,
			"Root: %s\nIP: %s\n"
			"max_nrtask %lu current nrtask %lu max_timeslice %lu "
			"nice %lu\n"
			"max_memlock %lu max_data %lu\n",
			tsec->root_pathname,
			tsec->ip_addr_name ? tsec->ip_addr_name : "(none)",
			tsec->max_nrtask, tsec->cur_nrtask, tsec->maxtimeslice,
			tsec->nice, tsec->max_data, tsec->max_memlock);
	}

	return err;
}

/*
 * Forbid a process in a jail from sending a signal to a process in another
 * (or no) jail through file sigio.
 *
 * We consider the process which set the fowner to be the one sending the
 * signal, rather than the one writing to the file.  Therefore we store the
 * jail of a process during jail_file_set_fowner, then check that against
 * the jail of the process receiving the signal.
 */
static int
jail_file_send_sigiotask(struct task_struct *tsk, struct fown_struct *fown,
       int fd, int reason)
{
	struct file *file;
	struct bsdjail_task_sec *tsec;

	if (!in_jail(current))
		return 0;

        file = (struct file *)((long)fown - offsetof(struct file,f_owner));
	tsec = jail_of(tsk);

/*	if (jail_of(tsk) != jail_of(current))*/
	if (get_security(file,file,f_security) != tsec)
		return -EPERM;

	return 0;
}

static int
jail_file_set_fowner(struct file *file)
{
	struct bsdjail_task_sec *tsec;

	tsec = jail_of(current);
	set_security(file,file,f_security,tsec);

	return 0;
}

/* 
 * LSM ptrace hook:
 * process in jail may not ptrace process not in the same jail
 */
static int
jail_ptrace (struct task_struct *doctor, struct task_struct *patient)
{
	if (in_jail(doctor)) {
		if (jail_of(doctor) == jail_of(patient))
			return 0;
		return -EPERM;
	}
	return 0;
}


#ifdef CONFIG_SECURITY_NETWORK

#define loopbackaddr htonl((127 << 24) | 1)

/*
 * process in jail may only use one (aliased) ip address.  If they try to
 * attach to 127.0.0.1, that is remapped to their own address.  If some
 * other address (and not their own), deny permisison
 */
static int jail_socket_unix_bind(struct socket *sock, struct sockaddr *address,
		int addrlen);

static int
jail_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
{
	struct bsdjail_task_sec *tsec;
	struct sockaddr_in *inaddr;
	__u32 sin_addr, jailaddr;

	if (!in_jail(current))
		return 0;

	if (sock->sk->sk_family == AF_UNIX)
		return jail_socket_unix_bind(sock, address, addrlen);

	if (address->sa_family != AF_INET)
		return 0;

	tsec = get_security(task,current,security);

	if (!tsec->got_network)
		/* If we want to be strict, we could just
		 * deny net access when lacking a pseudo ip.
		 * For now we just allow it. */
		return 0;

	inaddr = (struct sockaddr_in *)address;
	sin_addr = inaddr->sin_addr.s_addr;
	jailaddr = tsec->realaddr;

	if (sin_addr == jailaddr)
		return 0;

	if (sin_addr == loopbackaddr || !sin_addr) {
		bsdj_debug(DBG, "Got a loopback or 0 address\n");
		sin_addr = jailaddr;
		bsdj_debug(DBG, "Converted to: %u.%u.%u.%u\n", 
			NIPQUAD(sin_addr));
		return 0;
	}

	return -EPERM;
}

static void
jail_socket_post_create(struct socket *sock, int family, int type,
	int protocol, int kern)
{
	struct inet_opt *inet;
	struct bsdjail_task_sec *tsec;

	if (!in_jail(current) || kern)
		return;
	tsec = get_security(task,current,security);
	if (!tsec->got_network)
		return;

	if (sock->sk->sk_family != AF_INET)
		return;

	inet = inet_sk(sock->sk);
	inet->saddr = tsec->realaddr;

	return;
}

static int
jail_socket_listen(struct socket *sock, int backlog)
{
	struct inet_opt *inet;
	struct bsdjail_task_sec *tsec;

	if (!in_jail(current))
		return 0;

	tsec = get_security(task,current,security);
	if (!tsec->got_network)
		return 0;

	if (sock->sk->sk_family != AF_INET)
		return 0;

	inet = inet_sk(sock->sk);

	if (inet->saddr == tsec->realaddr)
		return 0;

	return -EPERM;
}
#endif

static int
jail_mount(char * dev_name, struct nameidata *nd, char * type,
                         unsigned long flags, void * data)
{
	if (in_jail(current))
		return -EPERM;

	return 0;
}

static int
jail_umount(struct vfsmount *mnt, int flags)
{
	if (in_jail(current))
		return -EPERM;

	return 0;
}

/* 
 * process in jail may not:
 *   use nice
 *   change network config
 *   load/unload modules
 */
static int
jail_capable (struct task_struct *tsk, int cap)
{
	if (in_jail(tsk)) {
		if (cap == CAP_SYS_NICE)
			return -EPERM;
		if (cap == CAP_NET_ADMIN)
			return -EPERM;
		if (cap == CAP_SYS_MODULE)
			return -EPERM;
		if (cap == CAP_SYS_RAWIO)
			return -EPERM;
	}

	if (cap_is_fs_cap (cap) ? tsk->fsuid == 0 : tsk->euid == 0)
		return 0;
	return -EPERM;
}

/*
 * jail_security_task_create:
 *
 * If the current process is ina a jail, and that jail is about to exceed a
 * maximum number of processes, then refuse to fork.  If the maximum number
 * of jails is listed as 0, then there is no limit for this jail, and we allow
 * all forks.
 */
static inline int
jail_security_task_create (unsigned long clone_flags)
{
	struct bsdjail_task_sec *tsec;

	if (!in_jail(current))
		return 0;

	tsec = jail_of(current);
	if (tsec->max_nrtask && tsec->cur_nrtask >= tsec->max_nrtask)
		return -EPERM;
	return 0;
}

static int
jail_task_alloc_security(struct task_struct *tsk)
{
	struct bsdjail_task_sec *tsec;

	if (!in_jail(current))
		return 0;

	/* in jail - child belongs in the same jail */
	tsec = get_security(task,current,security);
	set_security(task,tsk,security,tsec);
	atomic_inc(&tsec->refcount);
	tsec->cur_nrtask++;
	if (tsec->maxtimeslice) {
		tsk->rlim[RLIMIT_CPU].rlim_max = tsec->maxtimeslice;
		tsk->rlim[RLIMIT_CPU].rlim_cur = tsec->maxtimeslice;
	}
	if (tsec->max_data) {
		tsk->rlim[RLIMIT_CPU].rlim_max = tsec->max_data;
		tsk->rlim[RLIMIT_CPU].rlim_cur = tsec->max_data;
	}
	if (tsec->max_memlock) {
		tsk->rlim[RLIMIT_CPU].rlim_max = tsec->max_memlock;
		tsk->rlim[RLIMIT_CPU].rlim_cur = tsec->max_memlock;
	}
	if (tsec->nice)
		set_user_nice(current, tsec->nice);

	return 0;
}

static int
jail_bprm_alloc_security(struct linux_binprm *bprm)
{
	struct bsdjail_task_sec *tsec;
	int ret;

	tsec = get_security(task,current,security);
	if (!tsec)
		return 0;

	if (tsec->in_use)
		return 0;

	if (tsec->root_pathname) {
		ret = create_jail(current);
		if (ret) {
			/* if we failed, nix out the root/ip requests */
			free_task_security(current);
			return ret;
		}
	}
	return 0;
}

static void
jail_task_free_security(struct task_struct *tsk)
{
	struct bsdjail_task_sec *tsec;

	tsec = get_security(task,tsk,security);
	if (!tsec)
		return;
	if (!tsec->in_use) {
		/* 
		 * someone did 'echo -n x > /proc/<pid>/attr/exec' but
		 * then forked before execing.  Nuke the old info.
		 */
		free_task_security(tsk);
		return;
	}

	tsec->cur_nrtask--;
	/* If this was the last process in the jail, delete the jail */
	if (atomic_dec_and_test(&tsec->refcount)) {
		disable_jail(tsec);
		free_task_security(tsk);
	}
}

/*
 * Process in jail may not create devices 
 * Thanks to Brad Spender for pointing out fifos should be allowed.
 */
/* TODO: We may want to allow /dev/log, at least... */
static int
jail_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
{
	if (!in_jail(current))
		return 0;

	if (S_ISFIFO(mode))
		return 0;

	return -EPERM;
}

/* yanked from fs/proc/base.c */
static unsigned name_to_int(struct dentry *dentry)
{
	const char *name = dentry->d_name.name;
	int len = dentry->d_name.len;
	unsigned n = 0;

	if (len > 1 && *name == '0')
		goto out;
	while (len-- > 0) {
		unsigned c = *name++ - '0';
		if (c > 9)
			goto out;
		if (n >= (~0U-9)/10)
			goto out;
		n *= 10;
		n += c;
	}
	return n;
out:
	return ~0U;
}

/*
 * jail_proc_inode_permission:
 *   called only when current is in a jail, and is trying to reach
 *   /proc/<pid>.  We check whether <pid> is in the same jail as
 *   current.  If not, permission is denied.
 */
static int
jail_proc_inode_permission(struct inode *inode, int mask,
				    struct nameidata *nd)
{
	struct bsdjail_task_sec *tsec = jail_of(current);
	unsigned pid;
	int err = 0;
	struct task_struct *tsk;

	pid = name_to_int(nd->dentry);
	if (pid == ~0U) {
		struct qstr *dname = &nd->dentry->d_name;
		if (strcmp(dname->name, "net")==0 || strcmp(dname->name, "sys")==0 ||
			strcmp(dname->name, "ide")==0)
			return -EPERM;
		return 0;
	}

	read_lock(&tasklist_lock);
	tsk = find_task_by_pid(pid);
	if (tsk && jail_of(tsk) != tsec)
		err = -ENOENT;
	read_unlock(&tasklist_lock);

	return err;
}

/*
 * Here is our attempt to prevent chroot escapes.
 */
static int
is_jailroot_parent(struct dentry *candidate, struct dentry *root,
	struct vfsmount *rootmnt)
{
	if (candidate == root)
		return 0;

	/* simple case:  fs->root/.. == candidate */
	if (root->d_parent == candidate)
		return 1;

	/*
	 * now more complicated:  if fs->root is a mounted directory,
	 * then chdir(..) out of fs->root, at follow_dotdot, will follow
	 * the fs->root mount point. So we must check the parent dir of
	 * the fs->root mount point.
	 */
	if (rootmnt->mnt_root == root && rootmnt->mnt_mountpoint!=root) {
		root = rootmnt->mnt_mountpoint;
		rootmnt = rootmnt->mnt_parent;
		return is_jailroot_parent(candidate, root, rootmnt);
	}

	return 0;
}

static int
jail_inode_permission(struct inode *inode, int mask,
				    struct nameidata *nd)
{
	struct bsdjail_task_sec *tsec;

	if (!in_jail(current))
		return 0;

	if (!nd)
		return 0;

	/*
	 * If trying to get under /proc, we may deny permission:
	 *
	 * Note - we'll want to use sb->s_security to cache whether
	 *  it is the proc fs.  Except that's all the more conflicts
	 *  with selinux security fields.
	 */
	if (nd->dentry &&
		strcmp(nd->dentry->d_sb->s_type->name, "proc")==0) {
		return jail_proc_inode_permission(inode, mask, nd);

	}

	/* this is only for 'cd ..' */
	if (!(mask&MAY_EXEC))
		return 0;
	if (!inode || !S_ISDIR(inode->i_mode))
		return 0;

	tsec = get_security(task,current,security);
	if (is_jailroot_parent(nd->dentry, tsec->dentry, tsec->mnt)) {
		/* you may not chdir(..) out of fs->root */
		bsdj_debug(WARN,"Attempt to chdir(..) out of jail!\n"
				"(%s is a subdir of %s)\n",
				tsec->dentry->d_name.name,
				nd->dentry->d_name.name);
		return -EPERM;
	}

	return 0;
}

/* process in jail may not send signal to process not in the same jail */
static int
jail_task_kill(struct task_struct *p, struct siginfo *info, int sig)
{
	if (!in_jail(current))
		return 0;

	if (jail_of(current) == jail_of(p))
		return 0;

	if (sig==SIGCHLD)
		return 0;

	return -EPERM;
}

/*
 * LSM hooks to limit jailed process' abilities to muck with resource
 * limits
 */
static int jail_task_setrlimit (unsigned int resource, struct rlimit *new_rlim)
{
	if (!in_jail(current))
		return 0;

	return -EPERM;
}

static int jail_task_setscheduler (struct task_struct *p, int policy,
				    struct sched_param *lp)
{
	if (!in_jail(current))
		return 0;

	return -EPERM;
}

/*
 * LSM hooks to limit IPC access.
 */

static inline int
basic_ipc_security_check(struct kern_ipc_perm *p, struct task_struct *target)
{
	if (!in_jail(target))
		return 0;

	if (p->security != jail_of(target))
		return -EPERM;

	return 0;
}

static int
jail_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
{
	return basic_ipc_security_check(ipcp, current);
}

static int
jail_shm_alloc_security (struct shmid_kernel *shp)
{
	shp->shm_perm.security = jail_of(current);
	return 0;
}

static void
jail_shm_free_security (struct shmid_kernel *shp)
{
	shp->shm_perm.security = NULL;
}

static int
jail_shm_associate (struct shmid_kernel *shp, int shmflg)
{
	return basic_ipc_security_check(&shp->shm_perm, current);
}

static int
jail_shm_shmctl(struct shmid_kernel *shp, int cmd)
{
	if (cmd == IPC_INFO || cmd == SHM_INFO)
		return 0;

	return basic_ipc_security_check(&shp->shm_perm, current);
}

static int
jail_shm_shmat(struct shmid_kernel *shp, char *shmaddr, int shmflg)
{
	return basic_ipc_security_check(&shp->shm_perm, current);
}

static int
jail_msg_queue_alloc(struct msg_queue *msq)
{
	msq->q_perm.security = jail_of(current);
	return 0;
}

static void
jail_msg_queue_free(struct msg_queue *msq)
{
	msq->q_perm.security = NULL;
}

static int jail_msg_queue_associate(struct msg_queue *msq, int flag)
{
	return basic_ipc_security_check(&msq->q_perm, current);
}

static int
jail_msg_queue_msgctl(struct msg_queue *msq, int cmd)
{
	if (cmd == IPC_INFO || cmd == MSG_INFO)
		return 0;

	return basic_ipc_security_check(&msq->q_perm, current);
}

static int
jail_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
{
	return basic_ipc_security_check(&msq->q_perm, current);
}

static int
jail_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
		struct task_struct *target, long type, int mode)

{
	return basic_ipc_security_check(&msq->q_perm, target);
}

static int
jail_sem_alloc_security(struct sem_array *sma)
{
	sma->sem_perm.security = jail_of(current);
	return 0;
}

static void
jail_sem_free_security(struct sem_array *sma)
{
	sma->sem_perm.security = NULL;
}

static int
jail_sem_associate(struct sem_array *sma, int semflg)
{
	return basic_ipc_security_check(&sma->sem_perm, current);
}

static int
jail_sem_semctl(struct sem_array *sma, int cmd)
{
	if (cmd == IPC_INFO || cmd == SEM_INFO)
		return 0;
	return basic_ipc_security_check(&sma->sem_perm, current);
}

static int
jail_sem_semop(struct sem_array *sma, struct sembuf *sops, unsigned nsops,
	int alter)
{
	return basic_ipc_security_check(&sma->sem_perm, current);
}

/*
 * The next three (socket) hooks prevent a process in a jail from sending
 * data to a abstract unix domain socket which was bound outside the jail.
 */
static int
jail_socket_unix_bind(struct socket *sock, struct sockaddr *address,
	int addrlen)
{
	struct sockaddr_un *sunaddr;
	struct bsdjail_task_sec *tsec;

	if (sock->sk->sk_family != AF_UNIX)
		return 0;

	sunaddr = (struct sockaddr_un *)address;
	if (sunaddr->sun_path[0] != 0)
		return 0;

	tsec = jail_of(current);
	set_security(sock,sock->sk,sk_security,tsec);
	return 0;
}

/*
 * Note - we deny sends  both from unjailed to jailed, and from jailed
 * to unjailed.  As well as, of course between different jails.
 */
static int
jail_socket_unix_may_send(struct socket *sock, struct socket *other)
{
	struct bsdjail_task_sec *tsec, *ssec;

	tsec = jail_of(current);  /* jail of sending process */
	ssec = get_security(sock,other->sk,sk_security);  /* jail of receiver */

	if (tsec != ssec)
		return -EPERM;

	return 0;
}

static int
jail_socket_unix_stream_connect(struct socket *sock,
	      struct socket *other, struct sock *newsk)
{
	struct bsdjail_task_sec *tsec, *ssec;

	tsec = jail_of(current);  /* jail of sending process */
	ssec = get_security(sock,other->sk,sk_security);  /* jail of receiver */

	if (tsec != ssec)
		return -EPERM;

	return 0;
}

static struct security_operations bsdjail_security_ops = {
	.ptrace  =			jail_ptrace,
	.capable =			jail_capable,

	.task_kill =			jail_task_kill,
	.task_alloc_security =		jail_task_alloc_security,
	.task_free_security =		jail_task_free_security,
	.bprm_alloc_security =		jail_bprm_alloc_security,
	.task_create =			jail_security_task_create,

	.task_setrlimit =		jail_task_setrlimit,
	.task_setscheduler =		jail_task_setscheduler,

	.setprocattr =                  jail_setprocattr,
	.getprocattr =                  jail_getprocattr,

	.file_set_fowner =		jail_file_set_fowner,
	.file_send_sigiotask =		jail_file_send_sigiotask,

#ifdef CONFIG_SECURITY_NETWORK
	.socket_bind =			jail_socket_bind,
	.socket_listen =		jail_socket_listen,
	.socket_post_create =		jail_socket_post_create,
        .unix_stream_connect =		jail_socket_unix_stream_connect,
	.unix_may_send =		jail_socket_unix_may_send,
#endif

	.inode_mknod =			jail_inode_mknod,
	.inode_permission =		jail_inode_permission,
	.sb_mount =			jail_mount,
	.sb_umount =			jail_umount,

	.ipc_permission =		jail_ipc_permission,
	.shm_alloc_security = 		jail_shm_alloc_security,
	.shm_free_security = 		jail_shm_free_security,
	.shm_associate =		jail_shm_associate,
	.shm_shmctl =			jail_shm_shmctl,
	.shm_shmat =			jail_shm_shmat,

	.msg_queue_alloc_security =	jail_msg_queue_alloc,
	.msg_queue_free_security =	jail_msg_queue_free,
	.msg_queue_associate =		jail_msg_queue_associate,
	.msg_queue_msgctl =		jail_msg_queue_msgctl,
	.msg_queue_msgsnd =		jail_msg_queue_msgsnd,
	.msg_queue_msgrcv =		jail_msg_queue_msgrcv,

	.sem_alloc_security = 		jail_sem_alloc_security,
	.sem_free_security =  		jail_sem_free_security,
	.sem_associate =		jail_sem_associate,
	.sem_semctl =			jail_sem_semctl,
	.sem_semop =			jail_sem_semop,
};

/*
 * networking ioctl ops:
 * we insert our own wrapper around the dgram and stream ioctl
 * functions, which calls the original ioctl function, then
 * butchers the output so as to show only a jail's own network
 * address.
 */
extern struct proto_ops inet_stream_ops;
extern struct proto_ops inet_dgram_ops;

int (*saved_stream_ioctl)(struct socket *sock, unsigned int cmd,
		unsigned long arg);
int (*saved_dgram_ioctl)(struct socket *sock, unsigned int cmd,
		unsigned long arg);

int jail_stream_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
{
	int err = 0;
	struct ifreq ifr;
	struct sockaddr_in *sin;
	struct bsdjail_task_sec *tsec = jail_of(current);
	struct ifconf ifc;
	char *lastgood, *cur;
	int oldlen;

	err = saved_stream_ioctl(sock, cmd, arg);

	if (!tsec || !tsec->in_use || !tsec->got_network)
		return err;

	switch (cmd) {
	case SIOCGIFADDR:
		if (copy_from_user(&ifr, (void *)arg, sizeof(struct ifreq)))
			return -EFAULT;
		sin = (struct sockaddr_in *)&ifr.ifr_addr;
		if (sin->sin_family != AF_INET)
			return err;
		if (sin->sin_addr.s_addr != tsec->realaddr) {
			bsdj_debug(WARN, "jail_stream_ioctl DENIED %lu\n",
				(unsigned long)sin->sin_addr.s_addr);
			memset(&ifr, 0, sizeof(struct ifreq));
			copy_to_user((void *)arg, &ifr, sizeof(struct ifreq));
			return -EFAULT;
		}
		break;
	case SIOCGIFCONF:

		bsdj_debug(DBG, "%s called\n", __FUNCTION__);
		if (copy_from_user(&ifc, (void *)arg, sizeof(struct ifconf)))
			return -EFAULT;
		/* first we figure out how much space we really need */
		lastgood = cur = ifc.ifc_buf;
		oldlen = ifc.ifc_len;
		ifc.ifc_len = 0;
		while (cur < ifc.ifc_buf + oldlen) {
			copy_from_user(&ifr, cur, sizeof(struct ifreq));
			sin = (struct sockaddr_in *)&ifr.ifr_addr;
			if (sin->sin_family != AF_INET ||
				sin->sin_addr.s_addr == tsec->realaddr) {
				if (lastgood < cur) {
					copy_to_user(lastgood, &ifr,
						sizeof(struct ifreq));
				}
				ifc.ifc_len += sizeof(struct ifreq);
				lastgood += sizeof(struct ifreq);
				bsdj_debug(DBG, "adding %s\n\n",
					ifr.ifr_name);
			} else {
				bsdj_debug(DBG, "skipping %s\n\n",
					ifr.ifr_name);
			}
			cur += sizeof(struct ifreq);
		}
		memset(&ifr, 0, sizeof(struct ifreq));
		while (lastgood < ifc.ifc_buf + oldlen) {
			copy_to_user(lastgood, &ifr, sizeof(struct ifreq));
			lastgood += sizeof(struct ifreq);
		}
		copy_to_user((void *)arg, &ifc, sizeof(struct ifconf));
	}
	return err;
}

int jail_dgram_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
{
	int err = 0;
	struct ifreq ifr;
	struct sockaddr_in *sin;
	struct bsdjail_task_sec *tsec = jail_of(current);
	struct ifconf ifc;
	char *lastgood, *cur;
	int oldlen;

	err = saved_dgram_ioctl(sock, cmd, arg);

	if (!tsec || !tsec->in_use || !tsec->got_network)
		return err;

	switch (cmd) {
	case SIOCGIFADDR:
		if (copy_from_user(&ifr, (void *)arg, sizeof(struct ifreq)))
			return -EFAULT;
		sin = (struct sockaddr_in *)&ifr.ifr_addr;
		if (sin->sin_family != AF_INET)
			return err;
		if (sin->sin_addr.s_addr != tsec->realaddr) {
			bsdj_debug(WARN, "jail_dgram_ioctl DENIED %lu\n",
				(unsigned long)sin->sin_addr.s_addr);
			memset(&ifr, 0, sizeof(struct ifreq));
			copy_to_user((void *)arg, &ifr, sizeof(struct ifreq));
			return -EFAULT;
		}
		break;

	case SIOCGIFCONF:
		bsdj_debug(DBG, "%s called\n", __FUNCTION__);
		if (copy_from_user(&ifc, (void *)arg, sizeof(struct ifconf)))
			return -EFAULT;
		/* first we figure out how much space we really need */
		lastgood = cur = ifc.ifc_buf;
		oldlen = ifc.ifc_len;
		ifc.ifc_len = 0;
		while (cur < ifc.ifc_buf + oldlen) {
			copy_from_user(&ifr, cur, sizeof(struct ifreq));
			sin = (struct sockaddr_in *)&ifr.ifr_addr;
			if (sin->sin_family != AF_INET ||
				sin->sin_addr.s_addr == tsec->realaddr) {
				if (lastgood < cur) {
					copy_to_user(lastgood, &ifr,
						sizeof(struct ifreq));
				}
				ifc.ifc_len += sizeof(struct ifreq);
				lastgood += sizeof(struct ifreq);
				bsdj_debug(DBG, "adding %s\n\n",
					ifr.ifr_name);
			} else {
				bsdj_debug(DBG, "skipping %s\n\n",
					ifr.ifr_name);
			}
			cur += sizeof(struct ifreq);
		}
		memset(&ifr, 0, sizeof(struct ifreq));
		while (lastgood < ifc.ifc_buf + oldlen) {
			copy_to_user(lastgood, &ifr, sizeof(struct ifreq));
			lastgood += sizeof(struct ifreq);
		}
		copy_to_user((void *)arg, &ifc, sizeof(struct ifconf));
	}
	return err;
}

void butcher_inet_ops(void)
{
	lock_kernel();
	saved_stream_ioctl = inet_stream_ops.ioctl;
	saved_dgram_ioctl = inet_dgram_ops.ioctl;
	inet_stream_ops.ioctl = jail_stream_ioctl;
	inet_dgram_ops.ioctl = jail_dgram_ioctl;
	unlock_kernel();
}

void unbutcher_inet_ops(void)
{
	lock_kernel();
	inet_stream_ops.ioctl = saved_stream_ioctl;
	inet_dgram_ops.ioctl = saved_dgram_ioctl;
	unlock_kernel();
}

static int __init bsdjail_init (void)
{
	butcher_inet_ops();

	if (register_security (&bsdjail_security_ops)) {
		printk (KERN_INFO 
			"Failure registering BSD Jail module with the kernel\n");

		if (mod_reg_security (MY_NAME, &bsdjail_security_ops)) {
			printk (KERN_INFO "Failure registering BSD Jail "
				" module with primary security module.\n");
			return -EINVAL;
		}
		secondary = 1;
	}
	printk (KERN_INFO "BSD Jail module initialized.\n");

	return 0;
}

static void __exit bsdjail_exit (void)
{
	unbutcher_inet_ops();

	if (secondary) {
		if (mod_unreg_security (MY_NAME, &bsdjail_security_ops))
			printk (KERN_INFO "Failure unregistering BSD Jail "
				" module with primary module.\n");
	} else { 
		if (unregister_security (&bsdjail_security_ops)) {
			printk (KERN_INFO "Failure unregistering BSD Jail "
				"module with the kernel\n");
		}
	}

	printk (KERN_INFO "BSD Jail module removed\n");
}

security_initcall (bsdjail_init);
module_exit (bsdjail_exit);

MODULE_DESCRIPTION("BSD Jail LSM.");
MODULE_LICENSE("GPL");