X-Git-Url: http://git.archive.openwrt.org/?p=project%2Fprocd.git;a=blobdiff_plain;f=service%2Finstance.c;h=b7839660654a3548a6674a26b19a99f48c55edd9;hp=4ace40becc86a9ed61a8f69c52dd4774342d7922;hb=98dc89149231c5268de38fc98590f9267aa9d05b;hpb=7df968175ffd3bc7df5682d5852fbf20fe454759 diff --git a/service/instance.c b/service/instance.c index 4ace40b..b783966 100644 --- a/service/instance.c +++ b/service/instance.c @@ -12,6 +12,7 @@ * GNU General Public License for more details. */ +#define _GNU_SOURCE #include #include #include @@ -19,6 +20,7 @@ #include #include #include +#include #include #include #include @@ -47,9 +49,11 @@ enum { INSTANCE_ATTR_USER, INSTANCE_ATTR_STDOUT, INSTANCE_ATTR_STDERR, + INSTANCE_ATTR_NO_NEW_PRIVS, INSTANCE_ATTR_JAIL, INSTANCE_ATTR_TRACE, INSTANCE_ATTR_SECCOMP, + INSTANCE_ATTR_PIDFILE, __INSTANCE_ATTR_MAX }; @@ -68,29 +72,33 @@ static const struct blobmsg_policy instance_attr[__INSTANCE_ATTR_MAX] = { [INSTANCE_ATTR_USER] = { "user", BLOBMSG_TYPE_STRING }, [INSTANCE_ATTR_STDOUT] = { "stdout", BLOBMSG_TYPE_BOOL }, [INSTANCE_ATTR_STDERR] = { "stderr", BLOBMSG_TYPE_BOOL }, + [INSTANCE_ATTR_NO_NEW_PRIVS] = { "no_new_privs", BLOBMSG_TYPE_BOOL }, [INSTANCE_ATTR_JAIL] = { "jail", BLOBMSG_TYPE_TABLE }, [INSTANCE_ATTR_TRACE] = { "trace", BLOBMSG_TYPE_BOOL }, [INSTANCE_ATTR_SECCOMP] = { "seccomp", BLOBMSG_TYPE_STRING }, + [INSTANCE_ATTR_PIDFILE] = { "pidfile", BLOBMSG_TYPE_STRING }, }; enum { JAIL_ATTR_NAME, - JAIL_ATTR_ROOT, + JAIL_ATTR_HOSTNAME, JAIL_ATTR_PROCFS, JAIL_ATTR_SYSFS, JAIL_ATTR_UBUS, JAIL_ATTR_LOG, + JAIL_ATTR_RONLY, JAIL_ATTR_MOUNT, __JAIL_ATTR_MAX, }; static const struct blobmsg_policy jail_attr[__JAIL_ATTR_MAX] = { [JAIL_ATTR_NAME] = { "name", BLOBMSG_TYPE_STRING }, - [JAIL_ATTR_ROOT] = { "root", BLOBMSG_TYPE_STRING }, + [JAIL_ATTR_HOSTNAME] = { "hostname", BLOBMSG_TYPE_STRING }, [JAIL_ATTR_PROCFS] = { "procfs", BLOBMSG_TYPE_BOOL }, [JAIL_ATTR_SYSFS] = { "sysfs", BLOBMSG_TYPE_BOOL }, [JAIL_ATTR_UBUS] = { "ubus", BLOBMSG_TYPE_BOOL }, [JAIL_ATTR_LOG] = { "log", BLOBMSG_TYPE_BOOL }, + [JAIL_ATTR_RONLY] = { "ronly", BLOBMSG_TYPE_BOOL }, [JAIL_ATTR_MOUNT] = { "mount", BLOBMSG_TYPE_TABLE }, }; @@ -116,14 +124,16 @@ static const struct rlimit_name rlimit_names[] = { { "data", RLIMIT_DATA }, { "fsize", RLIMIT_FSIZE }, { "memlock", RLIMIT_MEMLOCK }, - { "msgqueue", RLIMIT_MSGQUEUE }, - { "nice", RLIMIT_NICE }, { "nofile", RLIMIT_NOFILE }, { "nproc", RLIMIT_NPROC }, { "rss", RLIMIT_RSS }, + { "stack", RLIMIT_STACK }, +#ifdef linux + { "nice", RLIMIT_NICE }, { "rtprio", RLIMIT_RTPRIO }, + { "msgqueue", RLIMIT_MSGQUEUE }, { "sigpending", RLIMIT_SIGPENDING }, - { "stack", RLIMIT_STACK }, +#endif { NULL, 0 } }; @@ -181,9 +191,9 @@ jail_run(struct service_instance *in, char **argv) argv[argc++] = jail->name; } - if (jail->root) { - argv[argc++] = "-P"; - argv[argc++] = jail->root; + if (jail->hostname) { + argv[argc++] = "-h"; + argv[argc++] = jail->hostname; } if (in->seccomp) { @@ -191,6 +201,9 @@ jail_run(struct service_instance *in, char **argv) argv[argc++] = in->seccomp; } + if (in->no_new_privs) + argv[argc++] = "-c"; + if (jail->procfs) argv[argc++] = "-p"; @@ -203,6 +216,9 @@ jail_run(struct service_instance *in, char **argv) if (jail->log) argv[argc++] = "-l"; + if (jail->ronly) + argv[argc++] = "-o"; + blobmsg_list_for_each(&jail->mount, var) { const char *type = blobmsg_data(var->data); @@ -218,14 +234,57 @@ jail_run(struct service_instance *in, char **argv) return argc; } +static int +instance_removepid(struct service_instance *in) { + if (!in->pidfile) + return 0; + if (unlink(in->pidfile)) { + ERROR("Failed to removed pidfile: %s: %d - %s\n", + in->pidfile, errno, strerror(errno)); + return 1; + } + return 0; +} + +static int +instance_writepid(struct service_instance *in) +{ + FILE *_pidfile; + + if (!in->pidfile) { + return 0; + } + _pidfile = fopen(in->pidfile, "w"); + if (_pidfile == NULL) { + ERROR("failed to open pidfile for writing: %s: %d (%s)", + in->pidfile, errno, strerror(errno)); + return 1; + } + if (fprintf(_pidfile, "%d\n", in->proc.pid) < 0) { + ERROR("failed to write pidfile: %s: %d (%s)", + in->pidfile, errno, strerror(errno)); + return 2; + } + if (fclose(_pidfile)) { + ERROR("failed to close pidfile: %s: %d (%s)", + in->pidfile, errno, strerror(errno)); + return 3; + } + + return 0; +} + static void instance_run(struct service_instance *in, int _stdout, int _stderr) { struct blobmsg_list_node *var; struct blob_attr *cur; char **argv; + char *ld_preload; int argc = 1; /* NULL terminated */ int rem, _stdin; + bool seccomp = !in->trace && !in->has_jail && in->seccomp; + bool setlbf = _stdout >= 0; if (in->nice) setpriority(PRIO_PROCESS, 0, in->nice); @@ -236,10 +295,14 @@ instance_run(struct service_instance *in, int _stdout, int _stderr) blobmsg_list_for_each(&in->env, var) setenv(blobmsg_name(var->data), blobmsg_data(var->data), 1); - if (!in->trace && !in->has_jail && in->seccomp) { + if (seccomp) setenv("SECCOMP_FILE", in->seccomp, 1); - setenv("LD_PRELOAD", "/lib/libpreload-seccomp.so", 1); - } + + if ((seccomp || setlbf) && asprintf(&ld_preload, "LD_PRELOAD=%s%s%s", + seccomp ? "/lib/libpreload-seccomp.so" : "", + seccomp && setlbf ? ":" : "", + setlbf ? "/lib/libsetlbf.so" : "") > 0) + putenv(ld_preload); blobmsg_list_for_each(&in->limits, var) instance_limits(blobmsg_name(var->data), blobmsg_data(var->data)); @@ -295,6 +358,22 @@ instance_run(struct service_instance *in, int _stdout, int _stderr) exit(127); } +static void +instance_free_stdio(struct service_instance *in) +{ + if (in->_stdout.fd.fd > -1) { + ustream_free(&in->_stdout.stream); + close(in->_stdout.fd.fd); + in->_stdout.fd.fd = -1; + } + + if (in->_stderr.fd.fd > -1) { + ustream_free(&in->_stderr.stream); + close(in->_stderr.fd.fd); + in->_stderr.fd.fd = -1; + } +} + void instance_start(struct service_instance *in) { @@ -310,6 +389,7 @@ instance_start(struct service_instance *in) if (in->proc.pending) return; + instance_free_stdio(in); if (in->_stdout.fd.fd > -2) { if (pipe(opipe)) { ULOG_WARN("pipe() failed: %d (%s)\n", errno, strerror(errno)); @@ -342,8 +422,9 @@ instance_start(struct service_instance *in) return; } - DEBUG(2, "Started instance %s::%s\n", in->srv->name, in->name); + DEBUG(2, "Started instance %s::%s[%d]\n", in->srv->name, in->name, pid); in->proc.pid = pid; + instance_writepid(in); clock_gettime(CLOCK_MONOTONIC, &in->start); uloop_process_add(&in->proc); @@ -432,7 +513,7 @@ instance_exit(struct uloop_process *p, int ret) uloop_timeout_cancel(&in->timeout); if (in->halt) { - /* no action */ + instance_removepid(in); } else if (in->restart) { instance_start(in); } else if (in->respawn) { @@ -445,7 +526,9 @@ instance_exit(struct uloop_process *p, int ret) in->srv->name, in->name, in->respawn_count, runtime); in->restart = in->respawn = 0; in->halt = 1; + service_event("instance.fail", in->srv->name, in->name); } else { + service_event("instance.respawn", in->srv->name, in->name); uloop_timeout_set(&in->timeout, in->respawn_timeout * 1000); } } @@ -470,6 +553,7 @@ instance_restart(struct service_instance *in) in->halt = false; in->restart = true; kill(in->proc.pid, SIGTERM); + instance_removepid(in); } static bool @@ -502,6 +586,16 @@ instance_config_changed(struct service_instance *in, struct service_instance *in if (in->gid != in_new->gid) return true; + if (in->pidfile && in_new->pidfile) + if (strcmp(in->pidfile, in_new->pidfile)) + return true; + + if (in->pidfile && !in_new->pidfile) + return true; + + if (!in->pidfile && in_new->pidfile) + return true; + if (!blobmsg_list_equal(&in->limits, &in_new->limits)) return true; @@ -620,8 +714,8 @@ instance_jail_parse(struct service_instance *in, struct blob_attr *attr) jail->name = blobmsg_get_string(tb[JAIL_ATTR_NAME]); jail->argc += 2; } - if (tb[JAIL_ATTR_ROOT]) { - jail->root = blobmsg_get_string(tb[JAIL_ATTR_ROOT]); + if (tb[JAIL_ATTR_HOSTNAME]) { + jail->hostname = blobmsg_get_string(tb[JAIL_ATTR_HOSTNAME]); jail->argc += 2; } if (tb[JAIL_ATTR_PROCFS]) { @@ -640,6 +734,10 @@ instance_jail_parse(struct service_instance *in, struct blob_attr *attr) jail->log = blobmsg_get_bool(tb[JAIL_ATTR_LOG]); jail->argc++; } + if (tb[JAIL_ATTR_RONLY]) { + jail->ronly = blobmsg_get_bool(tb[JAIL_ATTR_RONLY]); + jail->argc++; + } if (tb[JAIL_ATTR_MOUNT]) { struct blob_attr *cur; int rem; @@ -728,6 +826,9 @@ instance_config_parse(struct service_instance *in) if (tb[INSTANCE_ATTR_TRACE]) in->trace = blobmsg_get_bool(tb[INSTANCE_ATTR_TRACE]); + if (tb[INSTANCE_ATTR_NO_NEW_PRIVS]) + in->no_new_privs = blobmsg_get_bool(tb[INSTANCE_ATTR_NO_NEW_PRIVS]); + if (!in->trace && tb[INSTANCE_ATTR_SECCOMP]) { char *seccomp = blobmsg_get_string(tb[INSTANCE_ATTR_SECCOMP]); struct stat s; @@ -737,6 +838,13 @@ instance_config_parse(struct service_instance *in) else in->seccomp = seccomp; } + + if (tb[INSTANCE_ATTR_PIDFILE]) { + char *pidfile = blobmsg_get_string(tb[INSTANCE_ATTR_PIDFILE]); + if (pidfile) + in->pidfile = pidfile; + } + if (!in->trace && tb[INSTANCE_ATTR_JAIL]) in->has_jail = instance_jail_parse(in, tb[INSTANCE_ATTR_JAIL]); @@ -791,6 +899,7 @@ instance_config_move(struct service_instance *in, struct service_instance *in_sr blobmsg_list_move(&in->jail.mount, &in_src->jail.mount); in->trigger = in_src->trigger; in->command = in_src->command; + in->pidfile = in_src->pidfile; in->name = in_src->name; in->node.avl.key = in_src->node.avl.key; @@ -823,16 +932,7 @@ instance_update(struct service_instance *in, struct service_instance *in_new) void instance_free(struct service_instance *in) { - if (in->_stdout.fd.fd > -1) { - ustream_free(&in->_stdout.stream); - close(in->_stdout.fd.fd); - } - - if (in->_stderr.fd.fd > -1) { - ustream_free(&in->_stderr.stream); - close(in->_stderr.fd.fd); - } - + instance_free_stdio(in); uloop_process_delete(&in->proc); uloop_timeout_cancel(&in->timeout); trigger_del(in); @@ -917,8 +1017,8 @@ void instance_dump(struct blob_buf *b, struct service_instance *in, int verbose) if (in->respawn) { void *r = blobmsg_open_table(b, "respawn"); - blobmsg_add_u32(b, "timeout", in->respawn_timeout); blobmsg_add_u32(b, "threshold", in->respawn_threshold); + blobmsg_add_u32(b, "timeout", in->respawn_timeout); blobmsg_add_u32(b, "retry", in->respawn_retry); blobmsg_close_table(b, r); } @@ -926,19 +1026,26 @@ void instance_dump(struct blob_buf *b, struct service_instance *in, int verbose) if (in->trace) blobmsg_add_u8(b, "trace", true); + if (in->no_new_privs) + blobmsg_add_u8(b, "no_new_privs", true); + if (in->seccomp) blobmsg_add_string(b, "seccomp", in->seccomp); + if (in->pidfile) + blobmsg_add_string(b, "pidfile", in->pidfile); + if (in->has_jail) { void *r = blobmsg_open_table(b, "jail"); if (in->jail.name) blobmsg_add_string(b, "name", in->jail.name); - if (in->jail.root) - blobmsg_add_string(b, "root", in->jail.root); + if (in->jail.hostname) + blobmsg_add_string(b, "hostname", in->jail.hostname); blobmsg_add_u8(b, "procfs", in->jail.procfs); blobmsg_add_u8(b, "sysfs", in->jail.sysfs); blobmsg_add_u8(b, "ubus", in->jail.ubus); blobmsg_add_u8(b, "log", in->jail.log); + blobmsg_add_u8(b, "ronly", in->jail.ronly); blobmsg_close_table(b, r); if (!avl_is_empty(&in->jail.mount.avl)) { struct blobmsg_list_node *var;