X-Git-Url: http://git.archive.openwrt.org/?p=project%2Fprocd.git;a=blobdiff_plain;f=jail%2Fjail.c;h=5c995e5b21d0000d08d3c580afce1eabd5f6109e;hp=5b24f63165e03dc17058cd43d3176eef19dc9847;hb=6f192af24458cff4ca3e3f83533ac4c7f26b33e3;hpb=2909fab250c033eaad2b02d1b28b795d417d58e3 diff --git a/jail/jail.c b/jail/jail.c index 5b24f63..5c995e5 100644 --- a/jail/jail.c +++ b/jail/jail.c @@ -18,7 +18,6 @@ #include #include -#include #include #include #include @@ -27,11 +26,12 @@ #include #include -#include "elf.h" #include "capabilities.h" +#include "elf.h" +#include "fs.h" +#include "jail.h" #include "log.h" -#include #include #define STACK_SIZE (1024 * 1024) @@ -49,16 +49,6 @@ static struct { int sysfs; } opts; -struct extra { - struct list_head list; - - const char *path; - const char *name; - int readonly; -}; - -static LIST_HEAD(extras); - extern int pivot_root(const char *new_root, const char *put_old); int debug = 0; @@ -90,32 +80,23 @@ static int mkdir_p(char *dir, mode_t mask) return ret; } -static int mount_bind(const char *root, const char *path, const char *name, int readonly, int error) +int mount_bind(const char *root, const char *path, int readonly, int error) { - const char *p = path; struct stat s; - char old[PATH_MAX]; char new[PATH_MAX]; int fd; - if (strstr(p, "local")) - p = "/lib"; - - snprintf(old, sizeof(old), "%s/%s", path, name); - snprintf(new, sizeof(new), "%s%s", root, p); - - mkdir_p(new, 0755); - - snprintf(new, sizeof(new), "%s%s/%s", root, p, name); - - if (stat(old, &s)) { - ERROR("%s does not exist\n", old); + if (stat(path, &s)) { + ERROR("stat(%s) failed: %s\n", path, strerror(errno)); return error; } + snprintf(new, sizeof(new), "%s%s", root, path); if (S_ISDIR(s.st_mode)) { mkdir_p(new, 0755); } else { + mkdir_p(dirname(new), 0755); + snprintf(new, sizeof(new), "%s%s", root, path); fd = creat(new, 0644); if (fd == -1) { ERROR("failed to create %s: %s\n", new, strerror(errno)); @@ -124,8 +105,8 @@ static int mount_bind(const char *root, const char *path, const char *name, int close(fd); } - if (mount(old, new, NULL, MS_BIND, NULL)) { - ERROR("failed to mount -B %s %s: %s\n", old, new, strerror(errno)); + if (mount(path, new, NULL, MS_BIND, NULL)) { + ERROR("failed to mount -B %s %s: %s\n", path, new, strerror(errno)); return -1; } @@ -134,16 +115,13 @@ static int mount_bind(const char *root, const char *path, const char *name, int return -1; } - DEBUG("mount -B %s %s\n", old, new); + DEBUG("mount -B %s %s\n", path, new); return 0; } -static int build_jail_fs() +static int build_jail_fs(void) { - struct library *l; - struct extra *m; - if (mount("tmpfs", opts.path, "tmpfs", MS_NOATIME, "mode=0755")) { ERROR("tmpfs mount failed %s\n", strerror(errno)); return -1; @@ -154,25 +132,20 @@ static int build_jail_fs() return -1; } - init_library_search(); - - if (elf_load_deps(*opts.jail_argv)) { + if (add_path_and_deps(*opts.jail_argv, 1, -1, 0)) { ERROR("failed to load dependencies\n"); return -1; } - if (opts.seccomp && elf_load_deps("libpreload-seccomp.so")) { + if (opts.seccomp && add_path_and_deps("libpreload-seccomp.so", 1, -1, 1)) { ERROR("failed to load libpreload-seccomp.so\n"); return -1; } - avl_for_each_element(&libraries, l, avl) - if (mount_bind(opts.path, l->path, l->name, 1, -1)) - return -1; - - list_for_each_entry(m, &extras, list) - if (mount_bind(opts.path, m->path, m->name, m->readonly, 0)) - return -1; + if (mount_all(opts.path)) { + ERROR("mount_all() failed\n"); + return -1; + } char *mpoint; if (asprintf(&mpoint, "%s/old", opts.path) < 0) { @@ -253,7 +226,7 @@ ujail will not use namespace/build a jail,\n\ and will only drop capabilities/apply seccomp filter.\n\n"); } -static int exec_jail() +static int exec_jail(void) { char **envp = build_envp(opts.seccomp); if (!envp) @@ -264,7 +237,7 @@ static int exec_jail() INFO("exec-ing %s\n", *opts.jail_argv); execve(*opts.jail_argv, opts.jail_argv, envp); - //we get there only if execve fails + /* we get there only if execve fails */ ERROR("failed to execve %s: %s\n", *opts.jail_argv, strerror(errno)); exit(EXIT_FAILURE); } @@ -303,24 +276,6 @@ static struct uloop_process jail_process = { .cb = jail_process_handler, }; -static void add_extra(char *name, int readonly) -{ - struct extra *f; - - if (*name != '/') { - ERROR("%s is not an absolute path\n", name); - return; - } - - f = calloc(1, sizeof(struct extra)); - - f->name = basename(name); - f->path = dirname(strdup(name)); - f->readonly = readonly; - - list_add_tail(&f->list, &extras); -} - int main(int argc, char **argv) { uid_t uid = getuid(); @@ -335,6 +290,8 @@ int main(int argc, char **argv) } umask(022); + mount_list_init(); + init_library_search(); while ((ch = getopt(argc, argv, OPT_ARGS)) != -1) { switch (ch) { @@ -355,11 +312,11 @@ int main(int argc, char **argv) break; case 'S': opts.seccomp = optarg; - add_extra(optarg, 1); + add_mount(optarg, 1, -1); break; case 'C': opts.capabilities = optarg; - add_extra(optarg, 1); + add_mount(optarg, 1, -1); break; case 'P': opts.namespace = 1; @@ -370,24 +327,24 @@ int main(int argc, char **argv) break; case 'r': opts.namespace = 1; - add_extra(optarg, 1); + add_path_and_deps(optarg, 1, 0, 0); break; case 'w': opts.namespace = 1; - add_extra(optarg, 0); + add_path_and_deps(optarg, 0, 0, 0); break; case 'u': opts.namespace = 1; - add_extra(ubus, 0); + add_mount(ubus, 0, -1); break; case 'l': opts.namespace = 1; - add_extra(log, 0); + add_mount(log, 0, -1); break; } } - //no param found + /* no param found */ if (argc - optind < 1) { usage(); return EXIT_FAILURE; @@ -427,7 +384,7 @@ int main(int argc, char **argv) } if (jail_process.pid > 0) { - //parent process + /* parent process */ uloop_process_add(&jail_process); uloop_run(); uloop_done(); @@ -437,7 +394,7 @@ int main(int argc, char **argv) waitpid(jail_process.pid, NULL, 0); } } else if (jail_process.pid == 0) { - //fork child process + /* fork child process */ return exec_jail(); } else { ERROR("failed to clone/fork: %s\n", strerror(errno));