From owner-cvs-src@FreeBSD.ORG  Sun Feb 15 12:36:03 2004
Return-Path: <owner-cvs-src@FreeBSD.ORG>
Delivered-To: cvs-src@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id A3A0716A4CE; Sun, 15 Feb 2004 12:36:03 -0800 (PST)
Received: from critter.freebsd.dk (critter.freebsd.dk [212.242.86.163])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id 1A17043D1D; Sun, 15 Feb 2004 12:36:03 -0800 (PST)
	(envelope-from phk@phk.freebsd.dk)
Received: from critter.freebsd.dk (localhost [127.0.0.1])
	by critter.freebsd.dk (8.12.10/8.12.10) with ESMTP id i1FKZkhM016174;
	Sun, 15 Feb 2004 21:35:51 +0100 (CET)
	(envelope-from phk@phk.freebsd.dk)
To: Kris Kennaway <kris@obsecurity.org>
From: "Poul-Henning Kamp" <phk@phk.freebsd.dk>
In-Reply-To: Your message of "Sun, 15 Feb 2004 12:12:38 PST."
             <20040215201238.GA52924@xor.obsecurity.org> 
Date: Sun, 15 Feb 2004 21:35:46 +0100
Message-ID: <16173.1076877346@critter.freebsd.dk>
cc: src-committers@FreeBSD.org
cc: Pawel Jakub Dawidek <pjd@FreeBSD.org>
cc: cvs-src@FreeBSD.org
cc: cvs-all@FreeBSD.org
cc: Robert Watson <rwatson@FreeBSD.org>
cc: Julian Elischer <julian@elischer.org>
Subject: Re: cvs commit: src/sys/kern kern_jail.c 
X-BeenThere: cvs-src@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: CVS commit messages for the src tree <cvs-src.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-src>,
	<mailto:cvs-src-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/cvs-src>
List-Post: <mailto:cvs-src@freebsd.org>
List-Help: <mailto:cvs-src-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-src>,
	<mailto:cvs-src-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 15 Feb 2004 20:36:03 -0000

In message <20040215201238.GA52924@xor.obsecurity.org>, Kris Kennaway writes:
>
>--mP3DRpeJDSE+ciuQ
>Content-Type: text/plain; charset=us-ascii
>Content-Disposition: inline
>
>On Sun, Feb 15, 2004 at 08:34:21AM -0800, Julian Elischer wrote:
>
>> you sometimes need to be able to know you are in a jail so that you can
>> know not to attempt things that are not permitted in jails..
>> (e.g. pings, or ifconfig'ing network interfaces)
>
>If you try to ping or ifconfig and discover that you can't, you're in
>a jail.

Here is the canonical "injail.c" program:

#include <stdio.h>
#include <sys/types.h>
#include <sys/sysctl.h>
#include <sys/param.h>
#include <sys/user.h>

/*
 * Exit 0 = no
 * Exit 1 = maybe
 * Exit 2 = yes
 */

int
main(int argc, char **argv)
{
	int mib[4];
	int i, l;
	struct kinfo_proc buf;

	mib[0] = CTL_KERN;
	mib[1] = KERN_PROC;
	mib[2] = KERN_PROC_PID;
	mib[3] = getpid();
	l = sizeof buf;
	i = sysctl(mib, 4, &buf, &l, NULL, 0);
	if (i != 0 || l != sizeof buf)
		exit(1);
	if (buf.kp_proc.p_flag & P_JAILED)
		exit(2);
	exit (0);
}

-- 
Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
phk@FreeBSD.ORG         | TCP/IP since RFC 956
FreeBSD committer       | BSD since 4.3-tahoe    
Never attribute to malice what can adequately be explained by incompetence.