X-Git-Url: http://git.archive.openwrt.org/?p=project%2Fprocd.git;a=blobdiff_plain;f=jail%2Fjail.c;h=541363aab4632daed080188b8b461a2de072ba75;hp=3d0830e98010d792712c14828a8b2f13d00cdda3;hb=ad3ddbf04850a9ab229e21b70bf637090b33bf00;hpb=51201235db9dad9fe1823d9de46ed90f5e160fd0 diff --git a/jail/jail.c b/jail/jail.c index 3d0830e..541363a 100644 --- a/jail/jail.c +++ b/jail/jail.c @@ -12,61 +12,44 @@ */ #define _GNU_SOURCE -#include -#include -#include -#include -#include -#include #include #include #include #include #include -#include #include -#include #include #include #include -#include #include -#include -#include #include +#include -#include "elf.h" #include "capabilities.h" +#include "elf.h" +#include "fs.h" +#include "jail.h" +#include "log.h" -#include -#include #include #define STACK_SIZE (1024 * 1024) -#define OPT_ARGS "P:S:C:n:r:w:d:psulo" +#define OPT_ARGS "S:C:n:h:r:w:d:psuloc" static struct { - char *path; char *name; + char *hostname; char **jail_argv; char *seccomp; char *capabilities; + int no_new_privs; + int namespace; int procfs; int ronly; int sysfs; } opts; -struct extra { - struct list_head list; - - const char *path; - const char *name; - int readonly; -}; - -static LIST_HEAD(extras); - extern int pivot_root(const char *new_root, const char *put_old); int debug = 0; @@ -98,32 +81,23 @@ static int mkdir_p(char *dir, mode_t mask) return ret; } -static int mount_bind(const char *root, const char *path, const char *name, int readonly, int error) +int mount_bind(const char *root, const char *path, int readonly, int error) { - const char *p = path; struct stat s; - char old[256]; - char new[256]; + char new[PATH_MAX]; int fd; - if (strstr(p, "local")) - p = "/lib"; - - snprintf(old, sizeof(old), "%s/%s", path, name); - snprintf(new, sizeof(new), "%s%s", root, p); - - mkdir_p(new, 0755); - - snprintf(new, sizeof(new), "%s%s/%s", root, p, name); - - if (stat(old, &s)) { - ERROR("%s does not exist\n", old); + if (stat(path, &s)) { + ERROR("stat(%s) failed: %s\n", path, strerror(errno)); return error; } + snprintf(new, sizeof(new), "%s%s", root, path); if (S_ISDIR(s.st_mode)) { mkdir_p(new, 0755); } else { + mkdir_p(dirname(new), 0755); + snprintf(new, sizeof(new), "%s%s", root, path); fd = creat(new, 0644); if (fd == -1) { ERROR("failed to create %s: %s\n", new, strerror(errno)); @@ -132,8 +106,8 @@ static int mount_bind(const char *root, const char *path, const char *name, int close(fd); } - if (mount(old, new, NULL, MS_BIND, NULL)) { - ERROR("failed to mount -B %s %s: %s\n", old, new, strerror(errno)); + if (mount(path, new, NULL, MS_BIND, NULL)) { + ERROR("failed to mount -B %s %s: %s\n", path, new, strerror(errno)); return -1; } @@ -142,71 +116,65 @@ static int mount_bind(const char *root, const char *path, const char *name, int return -1; } - DEBUG("mount -B %s %s\n", old, new); + DEBUG("mount -B %s %s\n", path, new); return 0; } -static int build_jail_fs() +static int build_jail_fs(void) { - struct library *l; - struct extra *m; + char jail_root[] = "/tmp/ujail-XXXXXX"; + if (mkdtemp(jail_root) == NULL) { + ERROR("mkdtemp(jail_root) failed: %s\n", strerror(errno)); + return -1; + } - if (mount("tmpfs", opts.path, "tmpfs", MS_NOATIME, "mode=0755")) { + if (mount("tmpfs", jail_root, "tmpfs", MS_NOATIME, "mode=0755")) { ERROR("tmpfs mount failed %s\n", strerror(errno)); return -1; } - if (chdir(opts.path)) { + if (chdir(jail_root)) { ERROR("failed to chdir() in the jail root\n"); return -1; } - avl_init(&libraries, avl_strcmp, false, NULL); - alloc_library_path("/lib64"); - alloc_library_path("/lib"); - alloc_library_path("/usr/lib"); - load_ldso_conf("/etc/ld.so.conf"); - - if (elf_load_deps(*opts.jail_argv)) { + if (add_path_and_deps(*opts.jail_argv, 1, -1, 0)) { ERROR("failed to load dependencies\n"); return -1; } - if (opts.seccomp && elf_load_deps("libpreload-seccomp.so")) { + if (opts.seccomp && add_path_and_deps("libpreload-seccomp.so", 1, -1, 1)) { ERROR("failed to load libpreload-seccomp.so\n"); return -1; } - avl_for_each_element(&libraries, l, avl) - if (mount_bind(opts.path, l->path, l->name, 1, -1)) - return -1; - - list_for_each_entry(m, &extras, list) - if (mount_bind(opts.path, m->path, m->name, m->readonly, 0)) - return -1; - - char *mpoint; - if (asprintf(&mpoint, "%s/old", opts.path) < 0) { - ERROR("failed to alloc pivot path: %s\n", strerror(errno)); + if (mount_all(jail_root)) { + ERROR("mount_all() failed\n"); return -1; } - mkdir_p(mpoint, 0755); - if (pivot_root(opts.path, mpoint) == -1) { - ERROR("pivot_root failed:%s\n", strerror(errno)); - free(mpoint); + + char dirbuf[sizeof(jail_root) + 4]; + snprintf(dirbuf, sizeof(dirbuf), "%s/old", jail_root); + mkdir(dirbuf, 0755); + + if (pivot_root(jail_root, dirbuf) == -1) { + ERROR("pivot_root failed: %s\n", strerror(errno)); return -1; } - free(mpoint); + + snprintf(dirbuf, sizeof(dirbuf), "/old%s", jail_root); + rmdir(dirbuf); umount2("/old", MNT_DETACH); rmdir("/old"); + if (opts.procfs) { mkdir("/proc", 0755); - mount("proc", "/proc", "proc", MS_NOATIME, 0); + mount("proc", "/proc", "proc", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, 0); } if (opts.sysfs) { mkdir("/sys", 0755); - mount("sysfs", "/sys", "sysfs", MS_NOATIME, 0); + mount("sysfs", "/sys", "sysfs", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, 0); } if (opts.ronly) mount(NULL, "/", NULL, MS_RDONLY | MS_REMOUNT, 0); @@ -218,10 +186,10 @@ static int build_jail_fs() static char** build_envp(const char *seccomp) { static char *envp[MAX_ENVP]; - static char preload_var[64]; - static char seccomp_var[64]; + static char preload_var[PATH_MAX]; + static char seccomp_var[PATH_MAX]; static char debug_var[] = "LD_DEBUG=all"; - char *preload_lib = find_lib("libpreload-seccomp.so"); + const char *preload_lib = find_lib("libpreload-seccomp.so"); int count = 0; if (seccomp && !preload_lib) { @@ -243,13 +211,15 @@ static char** build_envp(const char *seccomp) static void usage(void) { fprintf(stderr, "ujail -- \n"); - fprintf(stderr, " -P \tpath where the jail will be staged\n"); - fprintf(stderr, " -S \tseccomp filter\n"); + fprintf(stderr, " -d \tshow debug log (increase num to increase verbosity)\n"); + fprintf(stderr, " -S \tseccomp filter config\n"); fprintf(stderr, " -C \tcapabilities drop config\n"); + fprintf(stderr, " -c\t\tset PR_SET_NO_NEW_PRIVS\n"); fprintf(stderr, " -n \tthe name of the jail\n"); + fprintf(stderr, "namespace jail options:\n"); + fprintf(stderr, " -h \tchange the hostname of the jail\n"); fprintf(stderr, " -r \treadonly files that should be staged\n"); fprintf(stderr, " -w \twriteable files that should be staged\n"); - fprintf(stderr, " -d \tshow debug log (increase num to increase verbosity)\n"); fprintf(stderr, " -p\t\tjail has /proc\n"); fprintf(stderr, " -s\t\tjail has /sys\n"); fprintf(stderr, " -l\t\tjail has /dev/log\n"); @@ -258,20 +228,14 @@ static void usage(void) fprintf(stderr, "\nWarning: by default root inside the jail is the same\n\ and he has the same powers as root outside the jail,\n\ thus he can escape the jail and/or break stuff.\n\ -Please use an appropriate seccomp/capabilities filter (-S/-C) to restrict his powers\n"); +Please use seccomp/capabilities (-S/-C) to restrict his powers\n\n\ +If you use none of the namespace jail options,\n\ +ujail will not use namespace/build a jail,\n\ +and will only drop capabilities/apply seccomp filter.\n\n"); } -static int spawn_jail(void *arg) +static int exec_jail(void) { - if (opts.name && sethostname(opts.name, strlen(opts.name))) { - ERROR("failed to sethostname: %s\n", strerror(errno)); - } - - if (build_jail_fs()) { - ERROR("failed to build jail fs"); - exit(EXIT_FAILURE); - } - char **envp = build_envp(opts.seccomp); if (!envp) exit(EXIT_FAILURE); @@ -279,13 +243,32 @@ static int spawn_jail(void *arg) if (opts.capabilities && drop_capabilities(opts.capabilities)) exit(EXIT_FAILURE); + if (opts.no_new_privs && prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { + ERROR("prctl(PR_SET_NO_NEW_PRIVS) failed: %s\n", strerror(errno)); + exit(EXIT_FAILURE); + } + INFO("exec-ing %s\n", *opts.jail_argv); execve(*opts.jail_argv, opts.jail_argv, envp); - //we get there only if execve fails + /* we get there only if execve fails */ ERROR("failed to execve %s: %s\n", *opts.jail_argv, strerror(errno)); exit(EXIT_FAILURE); } +static int spawn_jail(void *_notused) +{ + if (opts.hostname && sethostname(opts.hostname, strlen(opts.hostname))) { + ERROR("sethostname(%s) failed: %s\n", opts.hostname, strerror(errno)); + } + + if (build_jail_fs()) { + ERROR("failed to build jail fs"); + exit(EXIT_FAILURE); + } + + return exec_jail(); +} + static int jail_running = 1; static int jail_return_code = 0; @@ -306,30 +289,11 @@ static struct uloop_process jail_process = { .cb = jail_process_handler, }; -static void add_extra(char *name, int readonly) -{ - struct extra *f; - - if (*name != '/') { - ERROR("%s is not an absolute path\n", name); - return; - } - - f = calloc(1, sizeof(struct extra)); - - f->name = basename(name); - f->path = dirname(strdup(name)); - f->readonly = readonly; - - list_add_tail(&f->list, &extras); -} - int main(int argc, char **argv) { uid_t uid = getuid(); char log[] = "/dev/log"; char ubus[] = "/var/run/ubus.sock"; - int ret = EXIT_SUCCESS; int ch; if (uid) { @@ -338,6 +302,8 @@ int main(int argc, char **argv) } umask(022); + mount_list_init(); + init_library_search(); while ((ch = getopt(argc, argv, OPT_ARGS)) != -1) { switch (ch) { @@ -345,89 +311,98 @@ int main(int argc, char **argv) debug = atoi(optarg); break; case 'p': + opts.namespace = 1; opts.procfs = 1; break; case 'o': + opts.namespace = 1; opts.ronly = 1; break; case 's': + opts.namespace = 1; opts.sysfs = 1; break; case 'S': opts.seccomp = optarg; - add_extra(optarg, 1); + add_mount(optarg, 1, -1); break; case 'C': opts.capabilities = optarg; - add_extra(optarg, 1); + add_mount(optarg, 1, -1); break; - case 'P': - opts.path = optarg; + case 'c': + opts.no_new_privs = 1; break; case 'n': opts.name = optarg; break; + case 'h': + opts.hostname = optarg; + break; case 'r': - add_extra(optarg, 1); + opts.namespace = 1; + add_path_and_deps(optarg, 1, 0, 0); break; case 'w': - add_extra(optarg, 0); + opts.namespace = 1; + add_path_and_deps(optarg, 0, 0, 0); break; case 'u': - add_extra(ubus, 0); + opts.namespace = 1; + add_mount(ubus, 0, -1); break; case 'l': - add_extra(log, 0); + opts.namespace = 1; + add_mount(log, 0, -1); break; } } - //no param found + /* no param found */ if (argc - optind < 1) { usage(); return EXIT_FAILURE; } + if (!(opts.namespace||opts.capabilities||opts.seccomp)) { + ERROR("Not using namespaces, capabilities or seccomp !!!\n\n"); + usage(); + return EXIT_FAILURE; + } + DEBUG("Using namespaces(%d), capabilities(%d), seccomp(%d)\n", + opts.namespace, + opts.capabilities != 0, + opts.seccomp != 0); opts.jail_argv = &argv[optind]; if (opts.name) prctl(PR_SET_NAME, opts.name, NULL, NULL, NULL); - if (!opts.path && asprintf(&opts.path, "/tmp/%s", basename(*opts.jail_argv)) == -1) { - ERROR("failed to asprintf root path: %s\n", strerror(errno)); - return EXIT_FAILURE; - } - - if (mkdir(opts.path, 0755)) { - ERROR("unable to create root path: %s (%s)\n", opts.path, strerror(errno)); - return EXIT_FAILURE; - } - uloop_init(); - jail_process.pid = clone(spawn_jail, + if (opts.namespace) { + jail_process.pid = clone(spawn_jail, child_stack + STACK_SIZE, - CLONE_NEWUTS | CLONE_NEWPID | CLONE_NEWNS | CLONE_NEWIPC | SIGCHLD, argv); + CLONE_NEWUTS | CLONE_NEWPID | CLONE_NEWNS | CLONE_NEWIPC | SIGCHLD, NULL); + } else { + jail_process.pid = fork(); + } - if (jail_process.pid != -1) { + if (jail_process.pid > 0) { + /* parent process */ uloop_process_add(&jail_process); uloop_run(); uloop_done(); if (jail_running) { + DEBUG("uloop interrupted, killing jail process\n"); kill(jail_process.pid, SIGTERM); waitpid(jail_process.pid, NULL, 0); } + return jail_return_code; + } else if (jail_process.pid == 0) { + /* fork child process */ + return exec_jail(); } else { - ERROR("failed to spawn namespace: %s\n", strerror(errno)); - ret = EXIT_FAILURE; - } - - if (rmdir(opts.path)) { - ERROR("Unable to remove root path: %s (%s)\n", opts.path, strerror(errno)); - ret = EXIT_FAILURE; + ERROR("failed to clone/fork: %s\n", strerror(errno)); + return EXIT_FAILURE; } - - if (ret) - return ret; - - return jail_return_code; }