mirror of
https://github.com/RGBCube/serenity
synced 2025-07-25 18:47:34 +00:00
Kernel: Add support for jails
Our implementation for Jails resembles much of how FreeBSD jails are working - it's essentially only a matter of using a RefPtr in the Process class to a Jail object. Then, when we iterate over all processes in various cases, we could ensure if either the current process is in jail and therefore should be restricted what is visible in terms of PID isolation, and also to be able to expose metadata about Jails in /sys/kernel/jails node (which does not reveal anything to a process which is in jail). A lifetime model for the Jail object is currently plain simple - there's simpy no way to manually delete a Jail object once it was created. Such feature should be carefully designed to allow safe destruction of a Jail without the possibility of releasing a process which is in Jail from the actual jail. Each process which is attached into a Jail cannot leave it until the end of a Process (i.e. when finalizing a Process). All jails are kept being referenced in the JailManagement. When a last attached process is finalized, the Jail is automatically destroyed.
This commit is contained in:
parent
d69a0380e1
commit
5e062414c1
35 changed files with 609 additions and 160 deletions
76
Kernel/JailManagement.cpp
Normal file
76
Kernel/JailManagement.cpp
Normal file
|
@ -0,0 +1,76 @@
|
|||
/*
|
||||
* Copyright (c) 2022, Liav A. <liavalb@hotmail.co.il>
|
||||
*
|
||||
* SPDX-License-Identifier: BSD-2-Clause
|
||||
*/
|
||||
|
||||
#include <AK/Singleton.h>
|
||||
#include <Kernel/JailManagement.h>
|
||||
#include <Kernel/Process.h>
|
||||
#include <Kernel/Sections.h>
|
||||
|
||||
namespace Kernel {
|
||||
|
||||
static Singleton<JailManagement> s_the;
|
||||
static Atomic<u64> s_jail_id;
|
||||
|
||||
UNMAP_AFTER_INIT JailManagement::JailManagement() = default;
|
||||
|
||||
JailIndex JailManagement::generate_jail_id()
|
||||
{
|
||||
return s_jail_id.fetch_add(1);
|
||||
}
|
||||
|
||||
JailManagement& JailManagement::the()
|
||||
{
|
||||
return *s_the;
|
||||
}
|
||||
|
||||
LockRefPtr<Jail> JailManagement::find_jail_by_index(JailIndex index)
|
||||
{
|
||||
return m_jails.with([&](auto& list) -> LockRefPtr<Jail> {
|
||||
for (auto& jail : list) {
|
||||
if (jail.index() == index)
|
||||
return jail;
|
||||
}
|
||||
return {};
|
||||
});
|
||||
}
|
||||
|
||||
ErrorOr<void> JailManagement::for_each_in_same_jail(Function<ErrorOr<void>(Jail&)> callback)
|
||||
{
|
||||
return Process::current().jail().with([&](auto& my_jail) -> ErrorOr<void> {
|
||||
// Note: If we are in a jail, don't reveal anything about the outside world,
|
||||
// not even the fact that we are in which jail...
|
||||
if (my_jail)
|
||||
return {};
|
||||
return m_jails.with([&](auto& list) -> ErrorOr<void> {
|
||||
for (auto& jail : list) {
|
||||
TRY(callback(jail));
|
||||
}
|
||||
return {};
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
LockRefPtr<Jail> JailManagement::find_first_jail_by_name(StringView name)
|
||||
{
|
||||
return m_jails.with([&](auto& list) -> LockRefPtr<Jail> {
|
||||
for (auto& jail : list) {
|
||||
if (jail.name() == name)
|
||||
return jail;
|
||||
}
|
||||
return {};
|
||||
});
|
||||
}
|
||||
|
||||
ErrorOr<NonnullLockRefPtr<Jail>> JailManagement::create_jail(NonnullOwnPtr<KString> name)
|
||||
{
|
||||
return m_jails.with([&](auto& list) -> ErrorOr<NonnullLockRefPtr<Jail>> {
|
||||
auto jail = TRY(Jail::create({}, move(name), generate_jail_id()));
|
||||
list.append(jail);
|
||||
return jail;
|
||||
});
|
||||
}
|
||||
|
||||
}
|
Loading…
Add table
Add a link
Reference in a new issue