jaildesc: remove file-mode-based access controls

Jail descriptors were given a file-like mode, user, and group, for the
purpose of controlling how the descriptor may be used.  This is too far
removed from the file paradigm to make sense.  Remove it in favor of a
better access control method to be added, such as Capsicum.

Also add missing code in jaildesc_fill_kinfo.

Reported by:	crest at rlwinm.de, kib
MFC after:	3 days

Author: Jamie Gritton

lib/libsys/jail.2

@@ -340,31 +340,6 @@ work the same as
 and
 .Fn jail_remove ,
 except that they operate on the jail referred to by the passed descriptor.
-.Pp
-Jail operations via descriptors can be done by processes that do not
-normally have permission to see or affect the jail,
-as long as they are allowed by the file permissions of the jail
-descriptor itself.
-These permissions can be changed by the descriptor owner via
-.Xr fchmod 2
-and
-.Xr fchown 2 .
-.Fn jail_get
-requires read permission,
-.Fn jail_set
-and
-.Fn jail_remove
-require write permission,
-and
-.Fn jail_attach
-requires execute permission.
-Also, use of a descriptor with the
-.Dv JAIL_AT_DESC
-flag requires execute permission.
-An owning descriptor is identified by the
-.Em sticky bit ,
-which may also be changed via
-.Xr fchmod 2 .
 .Sh RETURN VALUES
 If successful,
 .Fn jail ,
@@ -402,22 +377,6 @@ The
 system call
 will fail if:
 .Bl -tag -width Er
-.It Bq Er EACCES
-Write permission is denied on the jail descriptor in the
-.Va desc
-parameter,
-and the
-.Dv JAIL_USE_DESC
-flag was set.
-.It Bq Er EACCES
-Execute permission is denied on the jail descriptor in the
-.Va desc
-parameter,
-and either the
-.Dv JAIL_AT_DESC
-or
-.Dv JAIL_ATTACH
-flag was set.
 .It Bq Er EPERM
 This process is not allowed to create a jail, either because it is not
 the super-user, or because it would exceed the jail's
@@ -505,24 +464,6 @@ The
 system call
 will fail if:
 .Bl -tag -width Er
-.It Bq Er EACCES
-Read permission is denied on the jail descriptor in the
-.Va desc
-parameter,
-and the
-.Dv JAIL_USE_DESC
-flag was set.
-.It Bq Er EACCES
-Execute permission is denied on the jail descriptor in the
-.Va desc
-parameter,
-and the
-.Dv JAIL_AT_DESC
-flag was set.
-.It Bq Er EFAULT
-.Fa Iov ,
-or one of the addresses contained within it,
-points to an address outside the allocated address space of the process.
 .It Bq Er ENOENT
 The jail referred to by a
 .Va jid
@@ -597,14 +538,6 @@ will fail if:
 The
 .Fa fd
 argument is not a valid jail descriptor.
-.It Bq Er EACCES
-Permission is denied on the jail descriptor
-.Po
-execute permission for
-.Fn jail_attach_fd ,
-or write permission for
-.Fn jail_remove_fd
-.Pc .
 .It Bq Er EPERM
 The jail descriptor was created by a user other than the super-user.
 .It Bq Er EINVAL

sys/kern/kern_jail.c

@@ -991,7 +991,6 @@ int
 kern_jail_set(struct thread *td, struct uio *optuio, int flags)
 {
 	struct file *jfp_out;
-	struct jaildesc *desc_in;
 	struct nameidata nd;
 #ifdef INET
 	struct prison_ip *ip4;
@@ -1095,24 +1094,13 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags)
 			 * descriptor's prison.
 			 */
 			prison_free(mypr);
-			error = jaildesc_find(td, jfd_in, &desc_in, &mypr,
-			    NULL);
+			error = jaildesc_find(td, jfd_in, &mypr, NULL);
 			if (error != 0) {
 				vfs_opterror(opts, error == ENOENT ?
 				    "descriptor to dead jail" :
 				    "not a jail descriptor");
 				goto done_errmsg;
 			}
-			/*
-			 * Check file permissions using the current
-			 * credentials, and operation permissions
-			 * using the descriptor's credentials.
-			 */
-			error = vaccess(VREG, desc_in->jd_mode, desc_in->jd_uid,
-			    desc_in->jd_gid, VEXEC, td->td_ucred);
-			JAILDESC_UNLOCK(desc_in);
-			if (error != 0)
-				goto done_free;
 			if ((flags & JAIL_CREATE) && mypr->pr_childmax == 0) {
 				error = EPERM;
 				goto done_free;
@@ -1516,27 +1504,15 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags)
 	}
 	if (flags & JAIL_USE_DESC) {
 		/* Get the jail from its descriptor. */
-		error = jaildesc_find(td, jfd_in, &desc_in, &pr, &jdcred);
+		error = jaildesc_find(td, jfd_in, &pr, &jdcred);
 		if (error) {
 			vfs_opterror(opts, error == ENOENT ?
 			    "descriptor to dead jail" :
 			    "not a jail descriptor");
 			goto done_deref;
 		}
 		drflags |= PD_DEREF;
-		/*
-		 * Check file permissions using the current credentials,
-		 * and operation permissions using the descriptor's
-		 * credentials.
-		 */
-		error = vaccess(VREG, desc_in->jd_mode, desc_in->jd_uid,
-		    desc_in->jd_gid, VWRITE, td->td_ucred);
-		if (error == 0 && (flags & JAIL_ATTACH))
-			error = vaccess(VREG, desc_in->jd_mode, desc_in->jd_uid,
-			    desc_in->jd_gid, VEXEC, td->td_ucred);
-		JAILDESC_UNLOCK(desc_in);
-		if (error == 0)
-			error = priv_check_cred(jdcred, PRIV_JAIL_SET);
+		error = priv_check_cred(jdcred, PRIV_JAIL_SET);
 		if (error == 0 && (flags & JAIL_ATTACH))
 			error = priv_check_cred(jdcred, PRIV_JAIL_ATTACH);
 		crfree(jdcred);
@@ -2500,7 +2476,6 @@ kern_jail_get(struct thread *td, struct uio *optuio, int flags)
 {
 	struct bool_flags *bf;
 	struct file *jfp_out;
-	struct jaildesc *desc_in;
 	struct jailsys_flags *jsf;
 	struct prison *pr, *mypr;
 	struct vfsopt *opt;
@@ -2547,19 +2522,14 @@ kern_jail_get(struct thread *td, struct uio *optuio, int flags)
 		}
 		if (flags & JAIL_USE_DESC) {
 			/* Get the jail from its descriptor. */
-			error = jaildesc_find(td, jfd_in, &desc_in, &pr, NULL);
+			error = jaildesc_find(td, jfd_in, &pr, NULL);
 			if (error) {
 				vfs_opterror(opts, error == ENOENT ?
 				    "descriptor to dead jail" :
 				    "not a jail descriptor");
 				goto done;
 			}
 			drflags |= PD_DEREF;
-			error = vaccess(VREG, desc_in->jd_mode, desc_in->jd_uid,
-			    desc_in->jd_gid, VREAD, td->td_ucred);
-			JAILDESC_UNLOCK(desc_in);
-			if (error != 0)
-				goto done;
 			mtx_lock(&pr->pr_mtx);
 			drflags |= PD_LOCKED;
 			if (!(prison_isalive(pr) || (flags & JAIL_DYING))) {
@@ -2573,19 +2543,13 @@ kern_jail_get(struct thread *td, struct uio *optuio, int flags)
 		if (flags & JAIL_AT_DESC) {
 			/* Look up jails based on the descriptor's prison. */
 			prison_free(mypr);
-			error = jaildesc_find(td, jfd_in, &desc_in, &mypr,
-			    NULL);
+			error = jaildesc_find(td, jfd_in, &mypr, NULL);
 			if (error != 0) {
 				vfs_opterror(opts, error == ENOENT ?
 				    "descriptor to dead jail" :
 				    "not a jail descriptor");
 				goto done;
 			}
-			error = vaccess(VREG, desc_in->jd_mode, desc_in->jd_uid,
-			    desc_in->jd_gid, VEXEC, td->td_ucred);
-			JAILDESC_UNLOCK(desc_in);
-			if (error != 0)
-				goto done;
 		}
 		if (flags & (JAIL_GET_DESC | JAIL_OWN_DESC)) {
 			/* Allocate a jail descriptor to return later. */
@@ -2916,23 +2880,14 @@ sys_jail_remove(struct thread *td, struct jail_remove_args *uap)
 int
 sys_jail_remove_jd(struct thread *td, struct jail_remove_jd_args *uap)
 {
-	struct jaildesc *jd;
 	struct prison *pr;
 	struct ucred *jdcred;
 	int error;
 
-	error = jaildesc_find(td, uap->fd, &jd, &pr, &jdcred);
+	error = jaildesc_find(td, uap->fd, &pr, &jdcred);
 	if (error)
 		return (error);
-	/*
-	 * Check file permissions using the current credentials, and
-	 * operation permissions using the descriptor's credentials.
-	 */
-	error = vaccess(VREG, jd->jd_mode, jd->jd_uid, jd->jd_gid, VWRITE,
-	    td->td_ucred);
-	JAILDESC_UNLOCK(jd);
-	if (error == 0)
-	    error = priv_check_cred(jdcred, PRIV_JAIL_REMOVE);
+	error = priv_check_cred(jdcred, PRIV_JAIL_REMOVE);
 	crfree(jdcred);
 	if (error) {
 		prison_free(pr);
@@ -3002,26 +2957,17 @@ sys_jail_attach(struct thread *td, struct jail_attach_args *uap)
 int
 sys_jail_attach_jd(struct thread *td, struct jail_attach_jd_args *uap)
 {
-	struct jaildesc *jd;
 	struct prison *pr;
 	struct ucred *jdcred;
 	int drflags, error;
 
 	sx_slock(&allprison_lock);
 	drflags = PD_LIST_SLOCKED;
-	error = jaildesc_find(td, uap->fd, &jd, &pr, &jdcred);
+	error = jaildesc_find(td, uap->fd, &pr, &jdcred);
 	if (error)
 		goto fail;
 	drflags |= PD_DEREF;
-	/*
-	 * Check file permissions using the current credentials, and
-	 * operation permissions using the descriptor's credentials.
-	 */
-	error = vaccess(VREG, jd->jd_mode, jd->jd_uid, jd->jd_gid, VEXEC,
-	    td->td_ucred);
-	JAILDESC_UNLOCK(jd);
-	if (error == 0)
-		error = priv_check_cred(jdcred, PRIV_JAIL_ATTACH);
+	error = priv_check_cred(jdcred, PRIV_JAIL_ATTACH);
 	crfree(jdcred);
 	if (error)
 		goto fail;