From nobody Fri Jan 26 17:48:51 2024 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4TM4tq3qDtz58Xxp; Fri, 26 Jan 2024 17:48:51 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4TM4tq3HGNz3xC8; Fri, 26 Jan 2024 17:48:51 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1706291331; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=X+7hpcgXh+kNZ0RLL4S823/qBuFWcnCdyT0sWKOADlA=; b=FqoAHYTEaOiviGPbtLNyvZhNFC9B74s/Q15Lh8XbwV9Hdxg+uDScIkRd/7M45Ee1EpjkTh KjaqL0mQQlQxfcVibUQzMm0JRuLTmqXfUg3EvIRi6w8I4/H8Ki930o29MUMwFcvlv08hcU Lgt/F7S3uVKrQFp6tzEPYz+Pvj90XLobglP2iK9ftoVlFcLc0nS3/f8bJ7HTrCYZjYlGvE 8MOA+36HMqgEH4CfWE52M33v9bqex2/1yD4kWgVp5zjPriVQGMMgmB5BPgyunigCLkUmhM TngYs+hKz0tqQhtljoPyS/p5+pvmuu4DQKQHe6yEBhxWGjX04d0z5hRV9FANew== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1706291331; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=X+7hpcgXh+kNZ0RLL4S823/qBuFWcnCdyT0sWKOADlA=; b=yfwbBkiA4x5d/Z75XeLF/zfg+IDx6KYGVRmtYsZwBqtZzwovEFaIHH4rJqygiMQQFn3rq5 4wR+vyJ8p6J5Pu/pL6P3E5zgSox4+P4a2g/ph/5ejGsi2n1o4pUuNd2Q2awmCIl/0kzGwO u7hJ3lojw1If7osXYYF/SfDDNWzcAJZ4E+0ix/dXGi5Jl36LpOaSN7KIRvpURjC/SwLfSn mRGOi6l60l2S4XzoTXf9x2t7nbSNaf49oMquVkNkvc2SvXT+qKWhrx5X3hJ6N5F5wWZVbE zPhzcXQkqxLQ1qrHaYOHuaLyFmEpB7NvDVKP1edTLsAdl8z6dxL0s6bOvCJtEg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1706291331; a=rsa-sha256; cv=none; b=XzDzstUvDFjVG59sC8d5MnvEFI7XPqzPhXv3oQWuwMzvGGJo380BykpxspErxXMgD1aojq fsVvMQAQ9OCmMKfv4TIlgmECcuBVHidABviUpX8oiswUHBqnHGQ2j0NWuUiuD8AL/Cjfkj ChoEzay8YyesQQUMZbcenFrXfME+zJ5nEZP3Rhf7qwmuUmO+HzhJy0QvusOOcpnPPWl/yV hHZDr6k9/lO3r7as71kuKO9hXAXY91JePF9ouzhbor6G+gilJKazZ0SLZCb5K6nQYqtdtq EGOGEIzklhfvVETrvWmFSDw4PyxKexPlQUl+hirI1RqrxecIYkwhbDVIJMF+Yw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4TM4tq1wKfzrcx; Fri, 26 Jan 2024 17:48:51 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 40QHmp5D047761; Fri, 26 Jan 2024 17:48:51 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 40QHmplP047758; Fri, 26 Jan 2024 17:48:51 GMT (envelope-from git) Date: Fri, 26 Jan 2024 17:48:51 GMT Message-Id: <202401261748.40QHmplP047758@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Jamie Gritton Subject: git: ab0841bdbe84 - main - jail: expose children.max and children.cur via sysctl List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-main@freebsd.org X-BeenThere: dev-commits-src-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jamie X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: ab0841bdbe8460db6eb77e0228a08812ce74d583 Auto-Submitted: auto-generated The branch main has been updated by jamie: URL: https://cgit.FreeBSD.org/src/commit/?id=ab0841bdbe8460db6eb77e0228a08812ce74d583 commit ab0841bdbe8460db6eb77e0228a08812ce74d583 Author: Jamie Gritton AuthorDate: 2024-01-26 17:45:40 +0000 Commit: Jamie Gritton CommitDate: 2024-01-26 17:45:40 +0000 jail: expose children.max and children.cur via sysctl Submitted by: Igor Ostapenko Differential Revision: --- sys/kern/kern_jail.c | 29 +++++++++++ sys/kern/sysctl_security_jail_children.sh | 80 +++++++++++++++++++++++++++++++ tests/sys/kern/Makefile | 2 + 3 files changed, 111 insertions(+) diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c index 0ae1d9a02f60..fb674b991a73 100644 --- a/sys/kern/kern_jail.c +++ b/sys/kern/kern_jail.c @@ -4468,6 +4468,35 @@ SYSCTL_PROC(_security_jail, OID_AUTO, devfs_ruleset, sysctl_jail_default_level, "I", "Ruleset for the devfs filesystem in jail (deprecated)"); +SYSCTL_NODE(_security_jail, OID_AUTO, children, CTLFLAG_RW | CTLFLAG_MPSAFE, 0, + "Limits and stats of child jails"); + +static int +sysctl_jail_children(SYSCTL_HANDLER_ARGS) +{ + struct prison *pr; + int i; + + pr = req->td->td_ucred->cr_prison; + + switch (oidp->oid_kind & CTLTYPE) { + case CTLTYPE_INT: + i = *(int *)((char *)pr + arg2); + return (SYSCTL_OUT(req, &i, sizeof(i))); + } + + return (0); +} + +SYSCTL_PROC(_security_jail_children, OID_AUTO, max, + CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, + NULL, offsetof(struct prison, pr_childmax), sysctl_jail_children, + "I", "Maximum number of child jails"); +SYSCTL_PROC(_security_jail_children, OID_AUTO, cur, + CTLTYPE_INT | CTLFLAG_RD | CTLFLAG_MPSAFE, + NULL, offsetof(struct prison, pr_childcount), sysctl_jail_children, + "I", "Current number of child jails"); + /* * Nodes to describe jail parameters. Maximum length of string parameters * is returned in the string itself, and the other parameters exist merely diff --git a/sys/kern/sysctl_security_jail_children.sh b/sys/kern/sysctl_security_jail_children.sh new file mode 100644 index 000000000000..0423cf1e8a59 --- /dev/null +++ b/sys/kern/sysctl_security_jail_children.sh @@ -0,0 +1,80 @@ +# +# SPDX-License-Identifier: BSD-2-Clause +# +# Copyright (c) 2024 Igor Ostapenko +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. + +# +# Even being is_exclusive="true" this test does not expect a host to spawn +# other jails during the test execution. +# +atf_test_case "max_cur" "cleanup" +max_cur_head() +{ + atf_set descr 'Test maximum and current number of child jails' + atf_set require.user root +} +max_cur_body() +{ + origin_max=$(sysctl -n security.jail.children.max) + origin_cur=$(sysctl -n security.jail.children.cur) + + # Magic numbers reasoning: + # 3 stands for: + # - the test creates three jails: childfree, maxallowed, maxallowed.family + # 6 stands for: + # - maxallowed.family wants to set children.max=4 + # - it means that its parent (maxallowed) should have at least children.max=5 + # - it makes the origin (parent of maxallowed) provide children.max=6 minimum + # + test $origin_cur -le $origin_max || atf_fail "Abnormal cur=$origin_cur > max=$origin_max." + test $((origin_max - origin_cur)) -ge 3 || atf_skip "Not enough child jails are allowed for the test." + test $origin_max -ge 6 || atf_skip "Not high enough children.max limit for the test." + + jail -c name=childfree persist + atf_check_equal "$((origin_cur + 1))" "$(sysctl -n security.jail.children.cur)" + atf_check_equal "0" "$(jexec childfree sysctl -n security.jail.children.max)" + atf_check_equal "0" "$(jexec childfree sysctl -n security.jail.children.cur)" + + jail -c name=maxallowed children.max=$((origin_max - 1)) persist + atf_check_equal "$((origin_cur + 2))" "$(sysctl -n security.jail.children.cur)" + atf_check_equal "$((origin_max - 1))" "$(jexec maxallowed sysctl -n security.jail.children.max)" + atf_check_equal "0" "$(jexec maxallowed sysctl -n security.jail.children.cur)" + + jexec maxallowed jail -c name=family children.max=4 persist + atf_check_equal "$((origin_cur + 3))" "$(sysctl -n security.jail.children.cur)" + atf_check_equal "1" "$(jexec maxallowed sysctl -n security.jail.children.cur)" + atf_check_equal "4" "$(jexec maxallowed.family sysctl -n security.jail.children.max)" + atf_check_equal "0" "$(jexec maxallowed.family sysctl -n security.jail.children.cur)" +} +max_cur_cleanup() +{ + jail -r maxallowed + jail -r childfree + return 0 +} + +atf_init_test_cases() +{ + atf_add_test_case "max_cur" +} diff --git a/tests/sys/kern/Makefile b/tests/sys/kern/Makefile index 7b5d87ff30ac..5a7e27319ddb 100644 --- a/tests/sys/kern/Makefile +++ b/tests/sys/kern/Makefile @@ -59,6 +59,8 @@ ATF_TESTS_SH+= sonewconn_overflow TEST_METADATA.sonewconn_overflow+= required_programs="python" TEST_METADATA.sonewconn_overflow+= required_user="root" ATF_TESTS_SH+= sendfile_test +ATF_TESTS_SH+= sysctl_security_jail_children +TEST_METADATA.sysctl_security_jail_children+= is_exclusive="true" ${PACKAGE}FILES+= sonewconn_overflow.py ${PACKAGE}FILESMODE_sonewconn_overflow.py=0555