ujail: fixup code style: "func()" -> "func(void)"

[project/procd.git] / jail / jail.c

diff --git a/jail/jail.c b/jail/jail.c
index f459a5e..b7e6946 100644 (file)
--- a/jail/jail.c
+++ b/jail/jail.c
@@ -20,15 +20,16 @@
 #include <unistd.h>
 #include <values.h>
 #include <errno.h>
-#include <stdio.h>
 #include <string.h>
 #include <sys/stat.h>
 #include <fcntl.h>
 #include <libgen.h>
 #include <sched.h>
+#include <linux/limits.h>
 
 #include "elf.h"
 #include "capabilities.h"
+#include "log.h"
 
 #include <libubox/list.h>
 #include <libubox/uloop.h>
@@ -93,8 +94,8 @@ static int mount_bind(const char *root, const char *path, const char *name, int
 {
        const char *p = path;
        struct stat s;
-       char old[256];
-       char new[256];
+       char old[PATH_MAX];
+       char new[PATH_MAX];
        int fd;
 
        if (strstr(p, "local"))
@@ -138,7 +139,7 @@ static int mount_bind(const char *root, const char *path, const char *name, int
        return 0;
 }
 
-static int build_jail_fs()
+static int build_jail_fs(void)
 {
        struct library *l;
        struct extra *m;
@@ -153,11 +154,7 @@ static int build_jail_fs()
                return -1;
        }
 
-       avl_init(&libraries, avl_strcmp, false, NULL);
-       alloc_library_path("/lib64");
-       alloc_library_path("/lib");
-       alloc_library_path("/usr/lib");
-       load_ldso_conf("/etc/ld.so.conf");
+       init_library_search();
 
        if (elf_load_deps(*opts.jail_argv)) {
                ERROR("failed to load dependencies\n");
@@ -193,11 +190,11 @@ static int build_jail_fs()
        rmdir("/old");
        if (opts.procfs) {
                mkdir("/proc", 0755);
-               mount("proc", "/proc", "proc", MS_NOATIME, 0);
+               mount("proc", "/proc", "proc", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, 0);
        }
        if (opts.sysfs) {
                mkdir("/sys", 0755);
-               mount("sysfs", "/sys", "sysfs", MS_NOATIME, 0);
+               mount("sysfs", "/sys", "sysfs", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, 0);
        }
        if (opts.ronly)
                mount(NULL, "/", NULL, MS_RDONLY | MS_REMOUNT, 0);
@@ -209,10 +206,10 @@ static int build_jail_fs()
 static char** build_envp(const char *seccomp)
 {
        static char *envp[MAX_ENVP];
-       static char preload_var[64];
-       static char seccomp_var[64];
+       static char preload_var[PATH_MAX];
+       static char seccomp_var[PATH_MAX];
        static char debug_var[] = "LD_DEBUG=all";
-       char *preload_lib = find_lib("libpreload-seccomp.so");
+       const char *preload_lib = find_lib("libpreload-seccomp.so");
        int count = 0;
 
        if (seccomp && !preload_lib) {
@@ -256,7 +253,7 @@ ujail will not use namespace/build a jail,\n\
 and will only drop capabilities/apply seccomp filter.\n\n");
 }
 
-static int exec_jail()
+static int exec_jail(void)
 {
        char **envp = build_envp(opts.seccomp);
        if (!envp)
@@ -272,7 +269,7 @@ static int exec_jail()
        exit(EXIT_FAILURE);
 }
 
-static int spawn_jail(void *arg)
+static int spawn_jail(void *_notused)
 {
        if (opts.name && sethostname(opts.name, strlen(opts.name))) {
                ERROR("failed to sethostname: %s\n", strerror(errno));
@@ -424,7 +421,7 @@ int main(int argc, char **argv)
        if (opts.namespace) {
                jail_process.pid = clone(spawn_jail,
                        child_stack + STACK_SIZE,
-                       CLONE_NEWUTS | CLONE_NEWPID | CLONE_NEWNS | CLONE_NEWIPC | SIGCHLD, argv);
+                       CLONE_NEWUTS | CLONE_NEWPID | CLONE_NEWNS | CLONE_NEWIPC | SIGCHLD, NULL);
        } else {
                jail_process.pid = fork();
        }