system/freebsd-src
system/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src synced 2024-09-06 17:18:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

jail: expose children.max and children.cur via sysctl

Browse source 
Submitted by:	Igor Ostapenko <igor.ostapenko_pm.me>
Differential Revision:	<https://reviews.freebsd.org/D43565>
This commit is contained in:
Jamie Gritton 2024-01-26 09:45:40 -08:00
parent 90372a9e3c
commit ab0841bdbe
3 changed files with 111 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

29
sys/kern/kern_jail.c
View file

@ -4468,6 +4468,35 @@ SYSCTL_PROC(_security_jail, OID_AUTO, devfs_ruleset,
sysctl_jail_default_level, "I",
"Ruleset for the devfs filesystem in jail (deprecated)");
SYSCTL_NODE(_security_jail, OID_AUTO, children, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
"Limits and stats of child jails");
static int
sysctl_jail_children(SYSCTL_HANDLER_ARGS)
{
struct prison *pr;
int i;
pr = req->td->td_ucred->cr_prison;
switch (oidp->oid_kind & CTLTYPE) {
case CTLTYPE_INT:
i = *(int *)((char *)pr + arg2);
return (SYSCTL_OUT(req, &i, sizeof(i)));
}
return (0);
}
SYSCTL_PROC(_security_jail_children, OID_AUTO, max,
CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE,
NULL, offsetof(struct prison, pr_childmax), sysctl_jail_children,
"I", "Maximum number of child jails");
SYSCTL_PROC(_security_jail_children, OID_AUTO, cur,
CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE,
NULL, offsetof(struct prison, pr_childcount), sysctl_jail_children,
"I", "Current number of child jails");
/*
* Nodes to describe jail parameters. Maximum length of string parameters
* is returned in the string itself, and the other parameters exist merely

80
sys/kern/sysctl_security_jail_children.sh Normal file
View file

@ -0,0 +1,80 @@
#
# SPDX-License-Identifier: BSD-2-Clause
#
# Copyright (c) 2024 Igor Ostapenko <pm@igoro.pro>
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in the
# documentation and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
# SUCH DAMAGE.
#
# Even being is_exclusive="true" this test does not expect a host to spawn
# other jails during the test execution.
#
atf_test_case "max_cur" "cleanup"
max_cur_head()
{
atf_set descr 'Test maximum and current number of child jails'
atf_set require.user root
}
max_cur_body()
{
origin_max=$(sysctl -n security.jail.children.max)
origin_cur=$(sysctl -n security.jail.children.cur)
# Magic numbers reasoning:
# 3 stands for:
# - the test creates three jails: childfree, maxallowed, maxallowed.family
# 6 stands for:
# - maxallowed.family wants to set children.max=4
# - it means that its parent (maxallowed) should have at least children.max=5
# - it makes the origin (parent of maxallowed) provide children.max=6 minimum
#
test $origin_cur -le $origin_max || atf_fail "Abnormal cur=$origin_cur > max=$origin_max."
test $((origin_max - origin_cur)) -ge 3 || atf_skip "Not enough child jails are allowed for the test."
test $origin_max -ge 6 || atf_skip "Not high enough children.max limit for the test."
jail -c name=childfree persist
atf_check_equal "$((origin_cur + 1))" "$(sysctl -n security.jail.children.cur)"
atf_check_equal "0" "$(jexec childfree sysctl -n security.jail.children.max)"
atf_check_equal "0" "$(jexec childfree sysctl -n security.jail.children.cur)"
jail -c name=maxallowed children.max=$((origin_max - 1)) persist
atf_check_equal "$((origin_cur + 2))" "$(sysctl -n security.jail.children.cur)"
atf_check_equal "$((origin_max - 1))" "$(jexec maxallowed sysctl -n security.jail.children.max)"
atf_check_equal "0" "$(jexec maxallowed sysctl -n security.jail.children.cur)"
jexec maxallowed jail -c name=family children.max=4 persist
atf_check_equal "$((origin_cur + 3))" "$(sysctl -n security.jail.children.cur)"
atf_check_equal "1" "$(jexec maxallowed sysctl -n security.jail.children.cur)"
atf_check_equal "4" "$(jexec maxallowed.family sysctl -n security.jail.children.max)"
atf_check_equal "0" "$(jexec maxallowed.family sysctl -n security.jail.children.cur)"
}
max_cur_cleanup()
{
jail -r maxallowed
jail -r childfree
return 0
}
atf_init_test_cases()
{
atf_add_test_case "max_cur"
}

2
tests/sys/kern/Makefile
View file

@ -59,6 +59,8 @@ ATF_TESTS_SH+= sonewconn_overflow
TEST_METADATA.sonewconn_overflow+= required_programs="python"
TEST_METADATA.sonewconn_overflow+= required_user="root"
ATF_TESTS_SH+= sendfile_test
ATF_TESTS_SH+= sysctl_security_jail_children
TEST_METADATA.sysctl_security_jail_children+= is_exclusive="true"
${PACKAGE}FILES+= sonewconn_overflow.py
${PACKAGE}FILESMODE_sonewconn_overflow.py=0555