X-Git-Url: http://git.archive.openwrt.org/?p=project%2Fprocd.git;a=blobdiff_plain;f=jail%2Fjail.c;h=9d7483c9fa4b8f37b9fbb0b65ce27aaa36173efe;hp=97ddaab6e7de109a35209cd0973157eb5efbac22;hb=cdc3dab3cd5d0295f638de3088bc4f5c9669e7c2;hpb=def4c1b9766cf04cfdf42ada9e27fff228d0dc19 diff --git a/jail/jail.c b/jail/jail.c index 97ddaab..9d7483c 100644 --- a/jail/jail.c +++ b/jail/jail.c @@ -25,6 +25,7 @@ #include #include #include +#include #include "capabilities.h" #include "elf.h" @@ -35,10 +36,11 @@ #include #define STACK_SIZE (1024 * 1024) -#define OPT_ARGS "S:C:n:r:w:d:psuloc" +#define OPT_ARGS "S:C:n:h:r:w:d:psuloc" static struct { char *name; + char *hostname; char **jail_argv; char *seccomp; char *capabilities; @@ -75,7 +77,7 @@ static int mkdir_p(char *dir, mode_t mask) return 0; if (ret) - ERROR("mkdir failed on %s: %s\n", dir, strerror(errno)); + ERROR("mkdir(%s, %d) failed: %s\n", dir, mask, strerror(errno)); return ret; } @@ -99,7 +101,7 @@ int mount_bind(const char *root, const char *path, int readonly, int error) snprintf(new, sizeof(new), "%s%s", root, path); fd = creat(new, 0644); if (fd == -1) { - ERROR("failed to create %s: %s\n", new, strerror(errno)); + ERROR("creat(%s) failed: %s\n", new, strerror(errno)); return -1; } close(fd); @@ -115,7 +117,7 @@ int mount_bind(const char *root, const char *path, int readonly, int error) return -1; } - DEBUG("mount -B %s %s\n", path, new); + DEBUG("mount -B %s %s (%s)\n", path, new, readonly?"ro":"rw"); return 0; } @@ -124,27 +126,23 @@ static int build_jail_fs(void) { char jail_root[] = "/tmp/ujail-XXXXXX"; if (mkdtemp(jail_root) == NULL) { - ERROR("mkdtemp(jail_root) failed: %s\n", strerror(errno)); + ERROR("mkdtemp(%s) failed: %s\n", jail_root, strerror(errno)); return -1; } - if (mount("tmpfs", jail_root, "tmpfs", MS_NOATIME, "mode=0755")) { - ERROR("tmpfs mount failed %s\n", strerror(errno)); - return -1; - } - - if (chdir(jail_root)) { - ERROR("failed to chdir() in the jail root\n"); + /* oldroot can't be MS_SHARED else pivot_root() fails */ + if (mount("none", "/", NULL, MS_REC|MS_PRIVATE, NULL)) { + ERROR("private mount failed %s\n", strerror(errno)); return -1; } - if (add_path_and_deps(*opts.jail_argv, 1, -1, 0)) { - ERROR("failed to load dependencies\n"); + if (mount("tmpfs", jail_root, "tmpfs", MS_NOATIME, "mode=0755")) { + ERROR("tmpfs mount failed %s\n", strerror(errno)); return -1; } - if (opts.seccomp && add_path_and_deps("libpreload-seccomp.so", 1, -1, 1)) { - ERROR("failed to load libpreload-seccomp.so\n"); + if (chdir(jail_root)) { + ERROR("chdir(%s) (jail_root) failed: %s\n", jail_root, strerror(errno)); return -1; } @@ -158,7 +156,11 @@ static int build_jail_fs(void) mkdir(dirbuf, 0755); if (pivot_root(jail_root, dirbuf) == -1) { - ERROR("pivot_root failed: %s\n", strerror(errno)); + ERROR("pivot_root(%s, %s) failed: %s\n", jail_root, dirbuf, strerror(errno)); + return -1; + } + if (chdir("/")) { + ERROR("chdir(/) (after pivot_root) failed: %s\n", strerror(errno)); return -1; } @@ -216,6 +218,7 @@ static void usage(void) fprintf(stderr, " -c\t\tset PR_SET_NO_NEW_PRIVS\n"); fprintf(stderr, " -n \tthe name of the jail\n"); fprintf(stderr, "namespace jail options:\n"); + fprintf(stderr, " -h \tchange the hostname of the jail\n"); fprintf(stderr, " -r \treadonly files that should be staged\n"); fprintf(stderr, " -w \twriteable files that should be staged\n"); fprintf(stderr, " -p\t\tjail has /proc\n"); @@ -232,12 +235,8 @@ ujail will not use namespace/build a jail,\n\ and will only drop capabilities/apply seccomp filter.\n\n"); } -static int exec_jail(void) +static int exec_jail(void *_notused) { - char **envp = build_envp(opts.seccomp); - if (!envp) - exit(EXIT_FAILURE); - if (opts.capabilities && drop_capabilities(opts.capabilities)) exit(EXIT_FAILURE); @@ -246,32 +245,39 @@ static int exec_jail(void) exit(EXIT_FAILURE); } - INFO("exec-ing %s\n", *opts.jail_argv); - execve(*opts.jail_argv, opts.jail_argv, envp); - /* we get there only if execve fails */ - ERROR("failed to execve %s: %s\n", *opts.jail_argv, strerror(errno)); - exit(EXIT_FAILURE); -} - -static int spawn_jail(void *_notused) -{ - if (opts.name && sethostname(opts.name, strlen(opts.name))) { - ERROR("failed to sethostname: %s\n", strerror(errno)); + if (opts.namespace && opts.hostname && strlen(opts.hostname) > 0 + && sethostname(opts.hostname, strlen(opts.hostname))) { + ERROR("sethostname(%s) failed: %s\n", opts.hostname, strerror(errno)); + exit(EXIT_FAILURE); } - if (build_jail_fs()) { - ERROR("failed to build jail fs"); + if (opts.namespace && build_jail_fs()) { + ERROR("failed to build jail fs\n"); exit(EXIT_FAILURE); } - return exec_jail(); + char **envp = build_envp(opts.seccomp); + if (!envp) + exit(EXIT_FAILURE); + + INFO("exec-ing %s\n", *opts.jail_argv); + execve(*opts.jail_argv, opts.jail_argv, envp); + /* we get there only if execve fails */ + ERROR("failed to execve %s: %s\n", *opts.jail_argv, strerror(errno)); + exit(EXIT_FAILURE); } static int jail_running = 1; static int jail_return_code = 0; +static void jail_process_timeout_cb(struct uloop_timeout *t); +static struct uloop_timeout jail_process_timeout = { + .cb = jail_process_timeout_cb, +}; + static void jail_process_handler(struct uloop_process *c, int ret) { + uloop_timeout_cancel(&jail_process_timeout); if (WIFEXITED(ret)) { jail_return_code = WEXITSTATUS(ret); INFO("jail (%d) exited with exit: %d\n", c->pid, jail_return_code); @@ -287,12 +293,25 @@ static struct uloop_process jail_process = { .cb = jail_process_handler, }; +static void jail_process_timeout_cb(struct uloop_timeout *t) +{ + DEBUG("jail process failed to stop, sending SIGKILL\n"); + kill(jail_process.pid, SIGKILL); +} + +static void jail_handle_signal(int signo) +{ + DEBUG("forwarding signal %d to the jailed process\n", signo); + kill(jail_process.pid, signo); +} + int main(int argc, char **argv) { + sigset_t sigmask; uid_t uid = getuid(); char log[] = "/dev/log"; char ubus[] = "/var/run/ubus.sock"; - int ch; + int ch, i; if (uid) { ERROR("not root, aborting: %s\n", strerror(errno)); @@ -326,7 +345,6 @@ int main(int argc, char **argv) break; case 'C': opts.capabilities = optarg; - add_mount(optarg, 1, -1); break; case 'c': opts.no_new_privs = 1; @@ -334,6 +352,9 @@ int main(int argc, char **argv) case 'n': opts.name = optarg; break; + case 'h': + opts.hostname = optarg; + break; case 'r': opts.namespace = 1; add_path_and_deps(optarg, 1, 0, 0); @@ -370,14 +391,44 @@ int main(int argc, char **argv) opts.jail_argv = &argv[optind]; + if (opts.namespace && add_path_and_deps(*opts.jail_argv, 1, -1, 0)) { + ERROR("failed to load dependencies\n"); + return -1; + } + + if (opts.namespace && opts.seccomp && add_path_and_deps("libpreload-seccomp.so", 1, -1, 1)) { + ERROR("failed to load libpreload-seccomp.so\n"); + return -1; + } + if (opts.name) prctl(PR_SET_NAME, opts.name, NULL, NULL, NULL); uloop_init(); + + sigfillset(&sigmask); + for (i = 0; i < _NSIG; i++) { + struct sigaction s = { 0 }; + + if (!sigismember(&sigmask, i)) + continue; + if ((i == SIGCHLD) || (i == SIGPIPE)) + continue; + + s.sa_handler = jail_handle_signal; + sigaction(i, &s, NULL); + } + if (opts.namespace) { - jail_process.pid = clone(spawn_jail, - child_stack + STACK_SIZE, - CLONE_NEWUTS | CLONE_NEWPID | CLONE_NEWNS | CLONE_NEWIPC | SIGCHLD, NULL); + add_mount("/dev/full", 0, -1); + add_mount("/dev/null", 0, -1); + add_mount("/dev/urandom", 0, -1); + add_mount("/dev/zero", 0, -1); + + int flags = CLONE_NEWPID | CLONE_NEWNS | CLONE_NEWIPC | SIGCHLD; + if (opts.hostname) + flags |= CLONE_NEWUTS; + jail_process.pid = clone(exec_jail, child_stack + STACK_SIZE, flags, NULL); } else { jail_process.pid = fork(); } @@ -386,16 +437,17 @@ int main(int argc, char **argv) /* parent process */ uloop_process_add(&jail_process); uloop_run(); - uloop_done(); if (jail_running) { DEBUG("uloop interrupted, killing jail process\n"); kill(jail_process.pid, SIGTERM); - waitpid(jail_process.pid, NULL, 0); + uloop_timeout_set(&jail_process_timeout, 1000); + uloop_run(); } + uloop_done(); return jail_return_code; } else if (jail_process.pid == 0) { /* fork child process */ - return exec_jail(); + return exec_jail(NULL); } else { ERROR("failed to clone/fork: %s\n", strerror(errno)); return EXIT_FAILURE;