X-Git-Url: http://git.archive.openwrt.org/?p=project%2Fprocd.git;a=blobdiff_plain;f=jail%2Fjail.c;h=9d7483c9fa4b8f37b9fbb0b65ce27aaa36173efe;hp=4297f717c0bd894885585857156fc1c3fdfa7031;hb=cdc3dab3cd5d0295f638de3088bc4f5c9669e7c2;hpb=15ff8b1d09187c11b1331f811cc75b0dd2076827 diff --git a/jail/jail.c b/jail/jail.c index 4297f71..9d7483c 100644 --- a/jail/jail.c +++ b/jail/jail.c @@ -25,6 +25,7 @@ #include #include #include +#include #include "capabilities.h" #include "elf.h" @@ -35,14 +36,15 @@ #include #define STACK_SIZE (1024 * 1024) -#define OPT_ARGS "P:S:C:n:r:w:d:psulo" +#define OPT_ARGS "S:C:n:h:r:w:d:psuloc" static struct { - char *path; char *name; + char *hostname; char **jail_argv; char *seccomp; char *capabilities; + int no_new_privs; int namespace; int procfs; int ronly; @@ -75,7 +77,7 @@ static int mkdir_p(char *dir, mode_t mask) return 0; if (ret) - ERROR("mkdir failed on %s: %s\n", dir, strerror(errno)); + ERROR("mkdir(%s, %d) failed: %s\n", dir, mask, strerror(errno)); return ret; } @@ -99,7 +101,7 @@ int mount_bind(const char *root, const char *path, int readonly, int error) snprintf(new, sizeof(new), "%s%s", root, path); fd = creat(new, 0644); if (fd == -1) { - ERROR("failed to create %s: %s\n", new, strerror(errno)); + ERROR("creat(%s) failed: %s\n", new, strerror(errno)); return -1; } close(fd); @@ -115,52 +117,58 @@ int mount_bind(const char *root, const char *path, int readonly, int error) return -1; } - DEBUG("mount -B %s %s\n", path, new); + DEBUG("mount -B %s %s (%s)\n", path, new, readonly?"ro":"rw"); return 0; } static int build_jail_fs(void) { - if (mount("tmpfs", opts.path, "tmpfs", MS_NOATIME, "mode=0755")) { - ERROR("tmpfs mount failed %s\n", strerror(errno)); + char jail_root[] = "/tmp/ujail-XXXXXX"; + if (mkdtemp(jail_root) == NULL) { + ERROR("mkdtemp(%s) failed: %s\n", jail_root, strerror(errno)); return -1; } - if (chdir(opts.path)) { - ERROR("failed to chdir() in the jail root\n"); + /* oldroot can't be MS_SHARED else pivot_root() fails */ + if (mount("none", "/", NULL, MS_REC|MS_PRIVATE, NULL)) { + ERROR("private mount failed %s\n", strerror(errno)); return -1; } - if (add_path_and_deps(*opts.jail_argv, 1, -1, 0)) { - ERROR("failed to load dependencies\n"); + if (mount("tmpfs", jail_root, "tmpfs", MS_NOATIME, "mode=0755")) { + ERROR("tmpfs mount failed %s\n", strerror(errno)); return -1; } - if (opts.seccomp && add_path_and_deps("libpreload-seccomp.so", 1, -1, 1)) { - ERROR("failed to load libpreload-seccomp.so\n"); + if (chdir(jail_root)) { + ERROR("chdir(%s) (jail_root) failed: %s\n", jail_root, strerror(errno)); return -1; } - if (mount_all(opts.path)) { + if (mount_all(jail_root)) { ERROR("mount_all() failed\n"); return -1; } - char *mpoint; - if (asprintf(&mpoint, "%s/old", opts.path) < 0) { - ERROR("failed to alloc pivot path: %s\n", strerror(errno)); + char dirbuf[sizeof(jail_root) + 4]; + snprintf(dirbuf, sizeof(dirbuf), "%s/old", jail_root); + mkdir(dirbuf, 0755); + + if (pivot_root(jail_root, dirbuf) == -1) { + ERROR("pivot_root(%s, %s) failed: %s\n", jail_root, dirbuf, strerror(errno)); return -1; } - mkdir_p(mpoint, 0755); - if (pivot_root(opts.path, mpoint) == -1) { - ERROR("pivot_root failed:%s\n", strerror(errno)); - free(mpoint); + if (chdir("/")) { + ERROR("chdir(/) (after pivot_root) failed: %s\n", strerror(errno)); return -1; } - free(mpoint); + + snprintf(dirbuf, sizeof(dirbuf), "/old%s", jail_root); + rmdir(dirbuf); umount2("/old", MNT_DETACH); rmdir("/old"); + if (opts.procfs) { mkdir("/proc", 0755); mount("proc", "/proc", "proc", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, 0); @@ -207,9 +215,10 @@ static void usage(void) fprintf(stderr, " -d \tshow debug log (increase num to increase verbosity)\n"); fprintf(stderr, " -S \tseccomp filter config\n"); fprintf(stderr, " -C \tcapabilities drop config\n"); + fprintf(stderr, " -c\t\tset PR_SET_NO_NEW_PRIVS\n"); fprintf(stderr, " -n \tthe name of the jail\n"); fprintf(stderr, "namespace jail options:\n"); - fprintf(stderr, " -P \tpath where the jail will be staged\n"); + fprintf(stderr, " -h \tchange the hostname of the jail\n"); fprintf(stderr, " -r \treadonly files that should be staged\n"); fprintf(stderr, " -w \twriteable files that should be staged\n"); fprintf(stderr, " -p\t\tjail has /proc\n"); @@ -226,41 +235,49 @@ ujail will not use namespace/build a jail,\n\ and will only drop capabilities/apply seccomp filter.\n\n"); } -static int exec_jail(void) +static int exec_jail(void *_notused) { - char **envp = build_envp(opts.seccomp); - if (!envp) - exit(EXIT_FAILURE); - if (opts.capabilities && drop_capabilities(opts.capabilities)) exit(EXIT_FAILURE); - INFO("exec-ing %s\n", *opts.jail_argv); - execve(*opts.jail_argv, opts.jail_argv, envp); - //we get there only if execve fails - ERROR("failed to execve %s: %s\n", *opts.jail_argv, strerror(errno)); - exit(EXIT_FAILURE); -} + if (opts.no_new_privs && prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { + ERROR("prctl(PR_SET_NO_NEW_PRIVS) failed: %s\n", strerror(errno)); + exit(EXIT_FAILURE); + } -static int spawn_jail(void *_notused) -{ - if (opts.name && sethostname(opts.name, strlen(opts.name))) { - ERROR("failed to sethostname: %s\n", strerror(errno)); + if (opts.namespace && opts.hostname && strlen(opts.hostname) > 0 + && sethostname(opts.hostname, strlen(opts.hostname))) { + ERROR("sethostname(%s) failed: %s\n", opts.hostname, strerror(errno)); + exit(EXIT_FAILURE); } - if (build_jail_fs()) { - ERROR("failed to build jail fs"); + if (opts.namespace && build_jail_fs()) { + ERROR("failed to build jail fs\n"); exit(EXIT_FAILURE); } - return exec_jail(); + char **envp = build_envp(opts.seccomp); + if (!envp) + exit(EXIT_FAILURE); + + INFO("exec-ing %s\n", *opts.jail_argv); + execve(*opts.jail_argv, opts.jail_argv, envp); + /* we get there only if execve fails */ + ERROR("failed to execve %s: %s\n", *opts.jail_argv, strerror(errno)); + exit(EXIT_FAILURE); } static int jail_running = 1; static int jail_return_code = 0; +static void jail_process_timeout_cb(struct uloop_timeout *t); +static struct uloop_timeout jail_process_timeout = { + .cb = jail_process_timeout_cb, +}; + static void jail_process_handler(struct uloop_process *c, int ret) { + uloop_timeout_cancel(&jail_process_timeout); if (WIFEXITED(ret)) { jail_return_code = WEXITSTATUS(ret); INFO("jail (%d) exited with exit: %d\n", c->pid, jail_return_code); @@ -276,13 +293,25 @@ static struct uloop_process jail_process = { .cb = jail_process_handler, }; +static void jail_process_timeout_cb(struct uloop_timeout *t) +{ + DEBUG("jail process failed to stop, sending SIGKILL\n"); + kill(jail_process.pid, SIGKILL); +} + +static void jail_handle_signal(int signo) +{ + DEBUG("forwarding signal %d to the jailed process\n", signo); + kill(jail_process.pid, signo); +} + int main(int argc, char **argv) { + sigset_t sigmask; uid_t uid = getuid(); char log[] = "/dev/log"; char ubus[] = "/var/run/ubus.sock"; - int ret = EXIT_SUCCESS; - int ch; + int ch, i; if (uid) { ERROR("not root, aborting: %s\n", strerror(errno)); @@ -316,15 +345,16 @@ int main(int argc, char **argv) break; case 'C': opts.capabilities = optarg; - add_mount(optarg, 1, -1); break; - case 'P': - opts.namespace = 1; - opts.path = optarg; + case 'c': + opts.no_new_privs = 1; break; case 'n': opts.name = optarg; break; + case 'h': + opts.hostname = optarg; + break; case 'r': opts.namespace = 1; add_path_and_deps(optarg, 1, 0, 0); @@ -344,7 +374,7 @@ int main(int argc, char **argv) } } - //no param found + /* no param found */ if (argc - optind < 1) { usage(); return EXIT_FAILURE; @@ -361,53 +391,65 @@ int main(int argc, char **argv) opts.jail_argv = &argv[optind]; + if (opts.namespace && add_path_and_deps(*opts.jail_argv, 1, -1, 0)) { + ERROR("failed to load dependencies\n"); + return -1; + } + + if (opts.namespace && opts.seccomp && add_path_and_deps("libpreload-seccomp.so", 1, -1, 1)) { + ERROR("failed to load libpreload-seccomp.so\n"); + return -1; + } + if (opts.name) prctl(PR_SET_NAME, opts.name, NULL, NULL, NULL); - if (opts.namespace && !opts.path && asprintf(&opts.path, "/tmp/%s", basename(*opts.jail_argv)) == -1) { - ERROR("failed to asprintf root path: %s\n", strerror(errno)); - return EXIT_FAILURE; - } + uloop_init(); - if (opts.namespace && mkdir(opts.path, 0755)) { - ERROR("unable to create root path: %s (%s)\n", opts.path, strerror(errno)); - return EXIT_FAILURE; + sigfillset(&sigmask); + for (i = 0; i < _NSIG; i++) { + struct sigaction s = { 0 }; + + if (!sigismember(&sigmask, i)) + continue; + if ((i == SIGCHLD) || (i == SIGPIPE)) + continue; + + s.sa_handler = jail_handle_signal; + sigaction(i, &s, NULL); } - uloop_init(); if (opts.namespace) { - jail_process.pid = clone(spawn_jail, - child_stack + STACK_SIZE, - CLONE_NEWUTS | CLONE_NEWPID | CLONE_NEWNS | CLONE_NEWIPC | SIGCHLD, NULL); + add_mount("/dev/full", 0, -1); + add_mount("/dev/null", 0, -1); + add_mount("/dev/urandom", 0, -1); + add_mount("/dev/zero", 0, -1); + + int flags = CLONE_NEWPID | CLONE_NEWNS | CLONE_NEWIPC | SIGCHLD; + if (opts.hostname) + flags |= CLONE_NEWUTS; + jail_process.pid = clone(exec_jail, child_stack + STACK_SIZE, flags, NULL); } else { jail_process.pid = fork(); } if (jail_process.pid > 0) { - //parent process + /* parent process */ uloop_process_add(&jail_process); uloop_run(); - uloop_done(); if (jail_running) { DEBUG("uloop interrupted, killing jail process\n"); kill(jail_process.pid, SIGTERM); - waitpid(jail_process.pid, NULL, 0); + uloop_timeout_set(&jail_process_timeout, 1000); + uloop_run(); } + uloop_done(); + return jail_return_code; } else if (jail_process.pid == 0) { - //fork child process - return exec_jail(); + /* fork child process */ + return exec_jail(NULL); } else { ERROR("failed to clone/fork: %s\n", strerror(errno)); - ret = EXIT_FAILURE; - } - - if (opts.namespace && rmdir(opts.path)) { - ERROR("Unable to remove root path: %s (%s)\n", opts.path, strerror(errno)); - ret = EXIT_FAILURE; + return EXIT_FAILURE; } - - if (ret) - return ret; - - return jail_return_code; }