X-Git-Url: https://git.archive.openwrt.org/?a=blobdiff_plain;f=jail%2Fjail.c;h=c442847109881e42c3d64b83539515c7a3dee45f;hb=b8eb07c22fc5f3dea04d9843e8fd6d2eac6e61fa;hp=5c995e5b21d0000d08d3c580afce1eabd5f6109e;hpb=6f192af24458cff4ca3e3f83533ac4c7f26b33e3;p=project%2Fprocd.git diff --git a/jail/jail.c b/jail/jail.c index 5c995e5..c442847 100644 --- a/jail/jail.c +++ b/jail/jail.c @@ -35,14 +35,15 @@ #include #define STACK_SIZE (1024 * 1024) -#define OPT_ARGS "P:S:C:n:r:w:d:psulo" +#define OPT_ARGS "S:C:n:h:r:w:d:psuloc" static struct { - char *path; char *name; + char *hostname; char **jail_argv; char *seccomp; char *capabilities; + int no_new_privs; int namespace; int procfs; int ronly; @@ -75,7 +76,7 @@ static int mkdir_p(char *dir, mode_t mask) return 0; if (ret) - ERROR("mkdir failed on %s: %s\n", dir, strerror(errno)); + ERROR("mkdir(%s, %d) failed: %s\n", dir, mask, strerror(errno)); return ret; } @@ -99,7 +100,7 @@ int mount_bind(const char *root, const char *path, int readonly, int error) snprintf(new, sizeof(new), "%s%s", root, path); fd = creat(new, 0644); if (fd == -1) { - ERROR("failed to create %s: %s\n", new, strerror(errno)); + ERROR("creat(%s) failed: %s\n", new, strerror(errno)); return -1; } close(fd); @@ -115,52 +116,58 @@ int mount_bind(const char *root, const char *path, int readonly, int error) return -1; } - DEBUG("mount -B %s %s\n", path, new); + DEBUG("mount -B %s %s (%s)\n", path, new, readonly?"ro":"rw"); return 0; } static int build_jail_fs(void) { - if (mount("tmpfs", opts.path, "tmpfs", MS_NOATIME, "mode=0755")) { - ERROR("tmpfs mount failed %s\n", strerror(errno)); + char jail_root[] = "/tmp/ujail-XXXXXX"; + if (mkdtemp(jail_root) == NULL) { + ERROR("mkdtemp(%s) failed: %s\n", jail_root, strerror(errno)); return -1; } - if (chdir(opts.path)) { - ERROR("failed to chdir() in the jail root\n"); + /* oldroot can't be MS_SHARED else pivot_root() fails */ + if (mount("none", "/", NULL, MS_REC|MS_PRIVATE, NULL)) { + ERROR("private mount failed %s\n", strerror(errno)); return -1; } - if (add_path_and_deps(*opts.jail_argv, 1, -1, 0)) { - ERROR("failed to load dependencies\n"); + if (mount("tmpfs", jail_root, "tmpfs", MS_NOATIME, "mode=0755")) { + ERROR("tmpfs mount failed %s\n", strerror(errno)); return -1; } - if (opts.seccomp && add_path_and_deps("libpreload-seccomp.so", 1, -1, 1)) { - ERROR("failed to load libpreload-seccomp.so\n"); + if (chdir(jail_root)) { + ERROR("chdir(%s) (jail_root) failed: %s\n", jail_root, strerror(errno)); return -1; } - if (mount_all(opts.path)) { + if (mount_all(jail_root)) { ERROR("mount_all() failed\n"); return -1; } - char *mpoint; - if (asprintf(&mpoint, "%s/old", opts.path) < 0) { - ERROR("failed to alloc pivot path: %s\n", strerror(errno)); + char dirbuf[sizeof(jail_root) + 4]; + snprintf(dirbuf, sizeof(dirbuf), "%s/old", jail_root); + mkdir(dirbuf, 0755); + + if (pivot_root(jail_root, dirbuf) == -1) { + ERROR("pivot_root(%s, %s) failed: %s\n", jail_root, dirbuf, strerror(errno)); return -1; } - mkdir_p(mpoint, 0755); - if (pivot_root(opts.path, mpoint) == -1) { - ERROR("pivot_root failed:%s\n", strerror(errno)); - free(mpoint); + if (chdir("/")) { + ERROR("chdir(/) (after pivot_root) failed: %s\n", strerror(errno)); return -1; } - free(mpoint); + + snprintf(dirbuf, sizeof(dirbuf), "/old%s", jail_root); + rmdir(dirbuf); umount2("/old", MNT_DETACH); rmdir("/old"); + if (opts.procfs) { mkdir("/proc", 0755); mount("proc", "/proc", "proc", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, 0); @@ -207,9 +214,10 @@ static void usage(void) fprintf(stderr, " -d \tshow debug log (increase num to increase verbosity)\n"); fprintf(stderr, " -S \tseccomp filter config\n"); fprintf(stderr, " -C \tcapabilities drop config\n"); + fprintf(stderr, " -c\t\tset PR_SET_NO_NEW_PRIVS\n"); fprintf(stderr, " -n \tthe name of the jail\n"); fprintf(stderr, "namespace jail options:\n"); - fprintf(stderr, " -P \tpath where the jail will be staged\n"); + fprintf(stderr, " -h \tchange the hostname of the jail\n"); fprintf(stderr, " -r \treadonly files that should be staged\n"); fprintf(stderr, " -w \twriteable files that should be staged\n"); fprintf(stderr, " -p\t\tjail has /proc\n"); @@ -226,34 +234,36 @@ ujail will not use namespace/build a jail,\n\ and will only drop capabilities/apply seccomp filter.\n\n"); } -static int exec_jail(void) +static int exec_jail(void *_notused) { - char **envp = build_envp(opts.seccomp); - if (!envp) - exit(EXIT_FAILURE); - if (opts.capabilities && drop_capabilities(opts.capabilities)) exit(EXIT_FAILURE); - INFO("exec-ing %s\n", *opts.jail_argv); - execve(*opts.jail_argv, opts.jail_argv, envp); - /* we get there only if execve fails */ - ERROR("failed to execve %s: %s\n", *opts.jail_argv, strerror(errno)); - exit(EXIT_FAILURE); -} + if (opts.no_new_privs && prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { + ERROR("prctl(PR_SET_NO_NEW_PRIVS) failed: %s\n", strerror(errno)); + exit(EXIT_FAILURE); + } -static int spawn_jail(void *_notused) -{ - if (opts.name && sethostname(opts.name, strlen(opts.name))) { - ERROR("failed to sethostname: %s\n", strerror(errno)); + if (opts.namespace && opts.hostname && strlen(opts.hostname) > 0 + && sethostname(opts.hostname, strlen(opts.hostname))) { + ERROR("sethostname(%s) failed: %s\n", opts.hostname, strerror(errno)); + exit(EXIT_FAILURE); } - if (build_jail_fs()) { - ERROR("failed to build jail fs"); + if (opts.namespace && build_jail_fs()) { + ERROR("failed to build jail fs\n"); exit(EXIT_FAILURE); } - return exec_jail(); + char **envp = build_envp(opts.seccomp); + if (!envp) + exit(EXIT_FAILURE); + + INFO("exec-ing %s\n", *opts.jail_argv); + execve(*opts.jail_argv, opts.jail_argv, envp); + /* we get there only if execve fails */ + ERROR("failed to execve %s: %s\n", *opts.jail_argv, strerror(errno)); + exit(EXIT_FAILURE); } static int jail_running = 1; @@ -281,7 +291,6 @@ int main(int argc, char **argv) uid_t uid = getuid(); char log[] = "/dev/log"; char ubus[] = "/var/run/ubus.sock"; - int ret = EXIT_SUCCESS; int ch; if (uid) { @@ -316,15 +325,16 @@ int main(int argc, char **argv) break; case 'C': opts.capabilities = optarg; - add_mount(optarg, 1, -1); break; - case 'P': - opts.namespace = 1; - opts.path = optarg; + case 'c': + opts.no_new_privs = 1; break; case 'n': opts.name = optarg; break; + case 'h': + opts.hostname = optarg; + break; case 'r': opts.namespace = 1; add_path_and_deps(optarg, 1, 0, 0); @@ -361,24 +371,25 @@ int main(int argc, char **argv) opts.jail_argv = &argv[optind]; - if (opts.name) - prctl(PR_SET_NAME, opts.name, NULL, NULL, NULL); - - if (opts.namespace && !opts.path && asprintf(&opts.path, "/tmp/%s", basename(*opts.jail_argv)) == -1) { - ERROR("failed to asprintf root path: %s\n", strerror(errno)); - return EXIT_FAILURE; + if (opts.namespace && add_path_and_deps(*opts.jail_argv, 1, -1, 0)) { + ERROR("failed to load dependencies\n"); + return -1; } - if (opts.namespace && mkdir(opts.path, 0755)) { - ERROR("unable to create root path: %s (%s)\n", opts.path, strerror(errno)); - return EXIT_FAILURE; + if (opts.namespace && opts.seccomp && add_path_and_deps("libpreload-seccomp.so", 1, -1, 1)) { + ERROR("failed to load libpreload-seccomp.so\n"); + return -1; } + if (opts.name) + prctl(PR_SET_NAME, opts.name, NULL, NULL, NULL); + uloop_init(); if (opts.namespace) { - jail_process.pid = clone(spawn_jail, - child_stack + STACK_SIZE, - CLONE_NEWUTS | CLONE_NEWPID | CLONE_NEWNS | CLONE_NEWIPC | SIGCHLD, NULL); + int flags = CLONE_NEWPID | CLONE_NEWNS | CLONE_NEWIPC | SIGCHLD; + if (opts.hostname) + flags |= CLONE_NEWUTS; + jail_process.pid = clone(exec_jail, child_stack + STACK_SIZE, flags, NULL); } else { jail_process.pid = fork(); } @@ -393,21 +404,12 @@ int main(int argc, char **argv) kill(jail_process.pid, SIGTERM); waitpid(jail_process.pid, NULL, 0); } + return jail_return_code; } else if (jail_process.pid == 0) { /* fork child process */ - return exec_jail(); + return exec_jail(NULL); } else { ERROR("failed to clone/fork: %s\n", strerror(errno)); - ret = EXIT_FAILURE; - } - - if (opts.namespace && rmdir(opts.path)) { - ERROR("Unable to remove root path: %s (%s)\n", opts.path, strerror(errno)); - ret = EXIT_FAILURE; + return EXIT_FAILURE; } - - if (ret) - return ret; - - return jail_return_code; }