#include "instance.h"
#define UJAIL_BIN_PATH "/sbin/ujail"
+#define CGROUP_BASEDIR "/sys/fs/cgroup/services"
enum {
INSTANCE_ATTR_COMMAND,
INSTANCE_ATTR_JAIL,
INSTANCE_ATTR_TRACE,
INSTANCE_ATTR_SECCOMP,
+ INSTANCE_ATTR_CAPABILITIES,
INSTANCE_ATTR_PIDFILE,
INSTANCE_ATTR_RELOADSIG,
INSTANCE_ATTR_TERMTIMEOUT,
[INSTANCE_ATTR_JAIL] = { "jail", BLOBMSG_TYPE_TABLE },
[INSTANCE_ATTR_TRACE] = { "trace", BLOBMSG_TYPE_BOOL },
[INSTANCE_ATTR_SECCOMP] = { "seccomp", BLOBMSG_TYPE_STRING },
+ [INSTANCE_ATTR_CAPABILITIES] = { "capabilities", BLOBMSG_TYPE_STRING },
[INSTANCE_ATTR_PIDFILE] = { "pidfile", BLOBMSG_TYPE_STRING },
[INSTANCE_ATTR_RELOADSIG] = { "reload_signal", BLOBMSG_TYPE_INT32 },
[INSTANCE_ATTR_TERMTIMEOUT] = { "term_timeout", BLOBMSG_TYPE_INT32 },
JAIL_ATTR_CONSOLE,
JAIL_ATTR_REQUIREJAIL,
JAIL_ATTR_IMMEDIATELY,
+ JAIL_ATTR_PIDFILE,
+ JAIL_ATTR_SETNS,
__JAIL_ATTR_MAX,
};
[JAIL_ATTR_CONSOLE] = { "console", BLOBMSG_TYPE_BOOL },
[JAIL_ATTR_REQUIREJAIL] = { "requirejail", BLOBMSG_TYPE_BOOL },
[JAIL_ATTR_IMMEDIATELY] = { "immediately", BLOBMSG_TYPE_BOOL },
+ [JAIL_ATTR_PIDFILE] = { "pidfile", BLOBMSG_TYPE_STRING },
+ [JAIL_ATTR_SETNS] = { "setns", BLOBMSG_TYPE_ARRAY },
+};
+
+enum {
+ JAIL_SETNS_ATTR_PID,
+ JAIL_SETNS_ATTR_NS,
+ __JAIL_SETNS_ATTR_MAX,
+};
+
+static const struct blobmsg_policy jail_setns_attr[__JAIL_SETNS_ATTR_MAX] = {
+ [JAIL_SETNS_ATTR_PID] = { "pid", BLOBMSG_TYPE_INT32 },
+ [JAIL_SETNS_ATTR_NS] = { "namespaces", BLOBMSG_TYPE_ARRAY },
};
struct instance_netdev {
}
}
+static char *
+instance_gen_setns_argstr(struct blob_attr *attr)
+{
+ struct blob_attr *tb[__JAIL_SETNS_ATTR_MAX];
+ struct blob_attr *cur;
+ int rem, len, total;
+ char *ret;
+
+ blobmsg_parse(jail_setns_attr, __JAIL_SETNS_ATTR_MAX, tb,
+ blobmsg_data(attr), blobmsg_data_len(attr));
+
+ if (!tb[JAIL_SETNS_ATTR_PID] || !tb[JAIL_SETNS_ATTR_NS])
+ return NULL;
+
+ len = snprintf(NULL, 0, "%d:", blobmsg_get_u32(tb[JAIL_SETNS_ATTR_PID]));
+
+ blobmsg_for_each_attr(cur, tb[JAIL_SETNS_ATTR_NS], rem) {
+ char *tmp;
+
+ if (blobmsg_type(cur) != BLOBMSG_TYPE_STRING)
+ return NULL;
+
+ tmp = blobmsg_get_string(cur);
+ if (!tmp)
+ return NULL;
+
+ len += strlen(tmp) + 1;
+ }
+
+ total = len;
+ ret = malloc(total);
+ if (!ret)
+ return NULL;
+
+ len = snprintf(ret, total, "%d:", blobmsg_get_u32(tb[JAIL_SETNS_ATTR_PID]));
+
+ blobmsg_for_each_attr(cur, tb[JAIL_SETNS_ATTR_NS], rem) {
+ strncpy(&ret[len], blobmsg_get_string(cur), total - len);
+ len += strlen(blobmsg_get_string(cur));
+ ret[len++] = ',';
+ }
+ ret[total - 1] = '\0';
+
+ return ret;
+}
+
static inline int
jail_run(struct service_instance *in, char **argv)
{
argv[argc++] = in->group;
}
+ if (in->capabilities) {
+ argv[argc++] = "-C";
+ argv[argc++] = in->capabilities;
+ }
+
if (in->no_new_privs)
argv[argc++] = "-c";
if (in->immediately)
argv[argc++] = "-i";
+ if (jail->pidfile) {
+ argv[argc++] = "-P";
+ argv[argc++] = jail->pidfile;
+ }
+
if (in->bundle) {
argv[argc++] = "-J";
argv[argc++] = in->bundle;
argv[argc++] = (char *) blobmsg_name(var->data);
}
+ blobmsg_list_for_each(&jail->setns, var) {
+ char *setns_arg = instance_gen_setns_argstr(var->data);
+
+ if (setns_arg) {
+ argv[argc++] = "-j";
+ argv[argc++] = setns_arg;
+ }
+ }
+
argv[argc++] = "--";
return argc;
exit(127);
}
+static void
+instance_add_cgroup(const char *service, const char *instance)
+{
+ struct stat sb;
+ char cgnamebuf[256];
+ int fd;
+
+ if (stat("/sys/fs/cgroup/cgroup.subtree_control", &sb))
+ return;
+
+ mkdir(CGROUP_BASEDIR, 0700);
+
+ snprintf(cgnamebuf, sizeof(cgnamebuf), "%s/%s", CGROUP_BASEDIR, service);
+ mkdir(cgnamebuf, 0700);
+ snprintf(cgnamebuf, sizeof(cgnamebuf), "%s/%s/%s", CGROUP_BASEDIR, service, instance);
+ mkdir(cgnamebuf, 0700);
+ strcat(cgnamebuf, "/cgroup.procs");
+
+ fd = open(cgnamebuf, O_WRONLY);
+ if (fd == -1)
+ return;
+
+ dprintf(fd, "%d", getpid());
+ close(fd);
+}
+
static void
instance_free_stdio(struct service_instance *in)
{
uloop_done();
closefd(opipe[0]);
closefd(epipe[0]);
+ instance_add_cgroup(in->srv->name, in->name);
instance_run(in, opipe[1], epipe[1]);
return;
}
if (!blob_attr_equal(in->command, in_new->command))
return true;
+ if (string_changed(in->bundle, in_new->bundle))
+ return true;
+
+ if (string_changed(in->extroot, in_new->extroot))
+ return true;
+
+ if (string_changed(in->overlaydir, in_new->overlaydir))
+ return true;
+
+ if (string_changed(in->tmpoverlaysize, in_new->tmpoverlaysize))
+ return true;
+
if (!blobmsg_list_equal(&in->env, &in_new->env))
return true;
if (in->pw_gid != in_new->pw_gid)
return true;
+ if (in->gr_gid != in_new->gr_gid)
+ return true;
+
if (string_changed(in->pidfile, in_new->pidfile))
return true;
return true;
if (in->respawn_timeout != in_new->respawn_timeout)
return true;
- if (in->bundle && in_new->bundle && strcmp(in->bundle, in_new->bundle))
+
+ if (in->reload_signal != in_new->reload_signal)
+ return true;
+
+ if (in->term_timeout != in_new->term_timeout)
+ return true;
+
+ if (string_changed(in->seccomp, in_new->seccomp))
return true;
- if ((!in->seccomp && in_new->seccomp) ||
- (in->seccomp && !in_new->seccomp) ||
- (in->seccomp && in_new->seccomp && strcmp(in->seccomp, in_new->seccomp)))
+
+ if (string_changed(in->capabilities, in_new->capabilities))
return true;
if (!blobmsg_list_equal(&in->limits, &in_new->limits))
if (!blobmsg_list_equal(&in->jail.mount, &in_new->jail.mount))
return true;
+ if (!blobmsg_list_equal(&in->jail.setns, &in_new->jail.setns))
+ return true;
+
if (!blobmsg_list_equal(&in->errors, &in_new->errors))
return true;
+ if (in->has_jail != in_new->has_jail)
+ return true;
+
+ if (in->trace != in_new->trace)
+ return true;
+
+ if (in->require_jail != in_new->require_jail)
+ return true;
+
+ if (in->immediately != in_new->immediately)
+ return true;
+
+ if (in->no_new_privs != in_new->no_new_privs)
+ return true;
+
+ if (string_changed(in->jail.name, in_new->jail.name))
+ return true;
+
+ if (string_changed(in->jail.hostname, in_new->jail.hostname))
+ return true;
+
+ if (string_changed(in->jail.pidfile, in_new->jail.pidfile))
+ return true;
+
+ if (in->jail.procfs != in_new->jail.procfs)
+ return true;
+
+ if (in->jail.sysfs != in_new->jail.sysfs)
+ return true;
+
+ if (in->jail.ubus != in_new->jail.ubus)
+ return true;
+
+ if (in->jail.log != in_new->jail.log)
+ return true;
+
+ if (in->jail.ronly != in_new->jail.ronly)
+ return true;
+
+ if (in->jail.netns != in_new->jail.netns)
+ return true;
+
+ if (in->jail.userns != in_new->jail.userns)
+ return true;
+
+ if (in->jail.cgroupsns != in_new->jail.cgroupsns)
+ return true;
+
+ if (in->jail.console != in_new->jail.console)
+ return true;
+
if (in->watchdog.mode != in_new->watchdog.mode)
return true;
jail->argc = 2;
- if (tb[JAIL_ATTR_REQUIREJAIL]) {
+ if (tb[JAIL_ATTR_REQUIREJAIL] && blobmsg_get_bool(tb[JAIL_ATTR_REQUIREJAIL])) {
in->require_jail = true;
jail->argc++;
}
jail->hostname = strdup(blobmsg_get_string(tb[JAIL_ATTR_HOSTNAME]));
jail->argc += 2;
}
- if (tb[JAIL_ATTR_PROCFS]) {
- jail->procfs = blobmsg_get_bool(tb[JAIL_ATTR_PROCFS]);
+ if (tb[JAIL_ATTR_PROCFS] && blobmsg_get_bool(tb[JAIL_ATTR_PROCFS])) {
+ jail->procfs = true;
jail->argc++;
}
- if (tb[JAIL_ATTR_SYSFS]) {
- jail->sysfs = blobmsg_get_bool(tb[JAIL_ATTR_SYSFS]);
+ if (tb[JAIL_ATTR_SYSFS] && blobmsg_get_bool(tb[JAIL_ATTR_SYSFS])) {
+ jail->sysfs = true;
jail->argc++;
}
- if (tb[JAIL_ATTR_UBUS]) {
- jail->ubus = blobmsg_get_bool(tb[JAIL_ATTR_UBUS]);
+ if (tb[JAIL_ATTR_UBUS] && blobmsg_get_bool(tb[JAIL_ATTR_UBUS])) {
+ jail->ubus = true;
jail->argc++;
}
- if (tb[JAIL_ATTR_LOG]) {
- jail->log = blobmsg_get_bool(tb[JAIL_ATTR_LOG]);
+ if (tb[JAIL_ATTR_LOG] && blobmsg_get_bool(tb[JAIL_ATTR_LOG])) {
+ jail->log = true;
jail->argc++;
}
- if (tb[JAIL_ATTR_RONLY]) {
- jail->ronly = blobmsg_get_bool(tb[JAIL_ATTR_RONLY]);
+ if (tb[JAIL_ATTR_RONLY] && blobmsg_get_bool(tb[JAIL_ATTR_RONLY])) {
+ jail->ronly = true;
jail->argc++;
}
- if (tb[JAIL_ATTR_NETNS]) {
- jail->netns = blobmsg_get_bool(tb[JAIL_ATTR_NETNS]);
+ if (tb[JAIL_ATTR_NETNS] && blobmsg_get_bool(tb[JAIL_ATTR_NETNS])) {
+ jail->netns = true;
jail->argc++;
}
- if (tb[JAIL_ATTR_USERNS]) {
- jail->userns = blobmsg_get_bool(tb[JAIL_ATTR_USERNS]);
+ if (tb[JAIL_ATTR_USERNS] && blobmsg_get_bool(tb[JAIL_ATTR_USERNS])) {
+ jail->userns = true;
jail->argc++;
}
- if (tb[JAIL_ATTR_CGROUPSNS]) {
- jail->cgroupsns = blobmsg_get_bool(tb[JAIL_ATTR_CGROUPSNS]);
+ if (tb[JAIL_ATTR_CGROUPSNS] && blobmsg_get_bool(tb[JAIL_ATTR_CGROUPSNS])) {
+ jail->cgroupsns = true;
jail->argc++;
}
- if (tb[JAIL_ATTR_CONSOLE]) {
- jail->console = blobmsg_get_bool(tb[JAIL_ATTR_CONSOLE]);
+ if (tb[JAIL_ATTR_CONSOLE] && blobmsg_get_bool(tb[JAIL_ATTR_CONSOLE])) {
+ jail->console = true;
jail->argc++;
}
+ if (tb[JAIL_ATTR_PIDFILE]) {
+ jail->pidfile = strdup(blobmsg_get_string(tb[JAIL_ATTR_PIDFILE]));
+ jail->argc += 2;
+ }
+
+ if (tb[JAIL_ATTR_SETNS]) {
+ struct blob_attr *cur;
+ int rem;
+
+ blobmsg_for_each_attr(cur, tb[JAIL_ATTR_SETNS], rem)
+ jail->argc += 2;
+ blobmsg_list_fill(&jail->setns, blobmsg_data(tb[JAIL_ATTR_SETNS]),
+ blobmsg_data_len(tb[JAIL_ATTR_SETNS]), true);
+ }
if (tb[JAIL_ATTR_MOUNT]) {
struct blob_attr *cur;
jail->argc += 2;
instance_fill_array(&jail->mount, tb[JAIL_ATTR_MOUNT], NULL, false);
}
+
if (in->seccomp)
jail->argc += 2;
+ if (in->capabilities)
+ jail->argc += 2;
+
if (in->user)
jail->argc += 2;
if (!in->trace && tb[INSTANCE_ATTR_SECCOMP])
in->seccomp = strdup(blobmsg_get_string(tb[INSTANCE_ATTR_SECCOMP]));
+ if (tb[INSTANCE_ATTR_CAPABILITIES])
+ in->capabilities = strdup(blobmsg_get_string(tb[INSTANCE_ATTR_CAPABILITIES]));
+
if (tb[INSTANCE_ATTR_EXTROOT])
in->extroot = strdup(blobmsg_get_string(tb[INSTANCE_ATTR_EXTROOT]));
blobmsg_list_free(&in->limits);
blobmsg_list_free(&in->errors);
blobmsg_list_free(&in->jail.mount);
+ blobmsg_list_free(&in->jail.setns);
}
static void
blobmsg_list_move(&in->limits, &in_src->limits);
blobmsg_list_move(&in->errors, &in_src->errors);
blobmsg_list_move(&in->jail.mount, &in_src->jail.mount);
+ blobmsg_list_move(&in->jail.setns, &in_src->jail.setns);
in->trigger = in_src->trigger;
in->command = in_src->command;
in->respawn = in_src->respawn;
in->respawn_retry = in_src->respawn_retry;
in->respawn_threshold = in_src->respawn_threshold;
in->respawn_timeout = in_src->respawn_timeout;
+ in->reload_signal = in_src->reload_signal;
+ in->term_timeout = in_src->term_timeout;
+ in->watchdog.mode = in_src->watchdog.mode;
+ in->watchdog.freq = in_src->watchdog.freq;
+ in->watchdog.timeout = in_src->watchdog.timeout;
in->name = in_src->name;
+ in->nice = in_src->nice;
in->trace = in_src->trace;
in->node.avl.key = in_src->node.avl.key;
in->syslog_facility = in_src->syslog_facility;
+ in->require_jail = in_src->require_jail;
+ in->no_new_privs = in_src->no_new_privs;
+ in->immediately = in_src->immediately;
+ in->uid = in_src->uid;
+ in->pw_gid = in_src->pw_gid;
+ in->gr_gid = in_src->gr_gid;
+
+ in->has_jail = in_src->has_jail;
+ in->jail.procfs = in_src->jail.procfs;
+ in->jail.sysfs = in_src->jail.sysfs;
+ in->jail.ubus = in_src->jail.ubus;
+ in->jail.log = in_src->jail.log;
+ in->jail.ronly = in_src->jail.ronly;
+ in->jail.netns = in_src->jail.netns;
+ in->jail.cgroupsns = in_src->jail.cgroupsns;
+ in->jail.console = in_src->jail.console;
+ in->jail.argc = in_src->jail.argc;
instance_config_move_strdup(&in->pidfile, in_src->pidfile);
instance_config_move_strdup(&in->seccomp, in_src->seccomp);
+ instance_config_move_strdup(&in->capabilities, in_src->capabilities);
+ instance_config_move_strdup(&in->bundle, in_src->bundle);
+ instance_config_move_strdup(&in->extroot, in_src->extroot);
+ instance_config_move_strdup(&in->overlaydir, in_src->overlaydir);
+ instance_config_move_strdup(&in->tmpoverlaysize, in_src->tmpoverlaysize);
+ instance_config_move_strdup(&in->user, in_src->user);
+ instance_config_move_strdup(&in->group, in_src->group);
instance_config_move_strdup(&in->jail.name, in_src->jail.name);
instance_config_move_strdup(&in->jail.hostname, in_src->jail.hostname);
+ instance_config_move_strdup(&in->jail.pidfile, in_src->jail.pidfile);
free(in->config);
in->config = in_src->config;
free(in->bundle);
free(in->jail.name);
free(in->jail.hostname);
+ free(in->jail.pidfile);
free(in->seccomp);
+ free(in->capabilities);
free(in->pidfile);
free(in);
}
blobmsg_list_simple_init(&in->limits);
blobmsg_list_simple_init(&in->errors);
blobmsg_list_simple_init(&in->jail.mount);
+ blobmsg_list_simple_init(&in->jail.setns);
in->watchdog.timeout.cb = instance_watchdog;
if (in->seccomp)
blobmsg_add_string(b, "seccomp", in->seccomp);
+ if (in->capabilities)
+ blobmsg_add_string(b, "capabilities", in->capabilities);
+
if (in->pidfile)
blobmsg_add_string(b, "pidfile", in->pidfile);
blobmsg_add_u8(b, "netns", in->jail.netns);
blobmsg_add_u8(b, "userns", in->jail.userns);
blobmsg_add_u8(b, "cgroupsns", in->jail.cgroupsns);
+ } else {
+ if (in->jail.pidfile)
+ blobmsg_add_string(b, "pidfile", in->jail.pidfile);
+
+ blobmsg_add_u8(b, "immediately", in->immediately);
}
blobmsg_add_u8(b, "console", (in->console.fd.fd > -1));
blobmsg_close_table(b, r);
blobmsg_add_string(b, blobmsg_name(var->data), blobmsg_data(var->data));
blobmsg_close_table(b, e);
}
+
+ if (!avl_is_empty(&in->jail.setns.avl)) {
+ struct blobmsg_list_node *var;
+ void *s = blobmsg_open_array(b, "setns");
+ blobmsg_list_for_each(&in->jail.setns, var)
+ blobmsg_add_blob(b, var->data);
+ blobmsg_close_array(b, s);
+ }
}
if (in->extroot)
projects / project / procd.git / blobdiff