treewide: replace local mkdir_p implementations
[project/procd.git] / jail / fs.c
1 /*
2 * Copyright (C) 2015 John Crispin <blogic@openwrt.org>
3 * Copyright (C) 2015 Etienne Champetier <champetier.etienne@gmail.com>
4 * Copyright (C) 2020 Daniel Golle <daniel@makrotopia.org>
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU Lesser General Public License version 2.1
8 * as published by the Free Software Foundation
9 *
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
14 */
15
16 #define _GNU_SOURCE
17
18 #include <assert.h>
19 #include <elf.h>
20 #include <errno.h>
21 #include <fcntl.h>
22 #include <linux/limits.h>
23 #include <stdlib.h>
24 #include <stdio.h>
25 #include <string.h>
26 #include <sys/stat.h>
27 #include <sys/mman.h>
28 #include <unistd.h>
29 #include <libgen.h>
30
31 #include <libubox/avl.h>
32 #include <libubox/avl-cmp.h>
33 #include <libubox/blobmsg.h>
34 #include <libubox/list.h>
35 #include <libubox/utils.h>
36
37 #include "elf.h"
38 #include "fs.h"
39 #include "jail.h"
40 #include "log.h"
41
42 #define UJAIL_NOAFILE "/tmp/.ujailnoafile"
43
44 struct mount {
45 struct avl_node avl;
46 const char *source;
47 const char *target;
48 const char *filesystemtype;
49 unsigned long mountflags;
50 unsigned long propflags;
51 const char *optstr;
52 int error;
53 bool inner;
54 };
55
56 struct avl_tree mounts;
57
58 static int do_mount(const char *root, const char *orig_source, const char *target, const char *filesystemtype,
59 unsigned long orig_mountflags, unsigned long propflags, const char *optstr, int error, bool inner)
60 {
61 struct stat s;
62 char new[PATH_MAX];
63 char *source = (char *)orig_source;
64 int fd;
65 bool is_bind = (orig_mountflags & MS_BIND);
66 bool is_mask = (source == (void *)(-1));
67 unsigned long mountflags = orig_mountflags;
68
69 if (source && is_bind && stat(source, &s)) {
70 ERROR("stat(%s) failed: %m\n", source);
71 return error;
72 }
73
74 if (!is_mask && orig_source && inner) {
75 if (asprintf(&source, "%s%s", root, orig_source) < 0)
76 return ENOMEM;
77 }
78
79 snprintf(new, sizeof(new), "%s%s", root, target?target:source);
80
81 if (is_mask) {
82 if (stat(new, &s))
83 return 0; /* doesn't exists, nothing to mask */
84
85 if (S_ISDIR(s.st_mode)) {/* use empty 0-sized tmpfs for directories */
86 if (mount(NULL, new, "tmpfs", MS_RDONLY | MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_NOATIME, "size=0,mode=000"))
87 return error;
88 } else {
89 /* mount-bind 0-sized file having mode 000 */
90 if (mount(UJAIL_NOAFILE, new, "bind", MS_BIND, NULL))
91 return error;
92
93 if (mount(UJAIL_NOAFILE, new, "bind", MS_REMOUNT | MS_BIND | MS_RDONLY | MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_NOATIME, NULL))
94 return error;
95 }
96
97 DEBUG("masked path %s\n", new);
98 return 0;
99 }
100
101
102 if (!is_bind || (source && S_ISDIR(s.st_mode))) {
103 mkdir_p(new, 0755);
104 } else if (is_bind && source) {
105 mkdir_p(dirname(new), 0755);
106 snprintf(new, sizeof(new), "%s%s", root, target?target:source);
107 fd = creat(new, 0644);
108 if (fd == -1) {
109 ERROR("creat(%s) failed: %m\n", new);
110 return error;
111 }
112 close(fd);
113 }
114
115 if (is_bind) {
116 if (mount(source?:new, new, filesystemtype?:"bind", MS_BIND | (mountflags & MS_REC), optstr)) {
117 if (error)
118 ERROR("failed to mount -B %s %s: %m\n", source, new);
119
120 if (inner)
121 free(source);
122
123 return error;
124 }
125 mountflags |= MS_REMOUNT;
126 }
127
128 const char *hack_fstype = ((!filesystemtype || strcmp(filesystemtype, "cgroup"))?filesystemtype:"cgroup2");
129 if (mount(source?:(is_bind?new:NULL), new, hack_fstype?:"none", mountflags, optstr)) {
130 if (error)
131 ERROR("failed to mount %s %s: %m\n", source, new);
132
133 if (inner)
134 free(source);
135
136 return error;
137 }
138
139 DEBUG("mount %s%s %s (%s)\n", (mountflags & MS_BIND)?"-B ":"", source, new,
140 (mountflags & MS_RDONLY)?"ro":"rw");
141
142 if (propflags && mount("none", new, "none", propflags, NULL)) {
143 if (error)
144 ERROR("failed to mount --make-... %s \n", new);
145
146 if (inner)
147 free(source);
148
149 return error;
150 }
151
152 if (inner)
153 free(source);
154
155 return 0;
156 }
157
158 static int _add_mount(const char *source, const char *target, const char *filesystemtype,
159 unsigned long mountflags, unsigned long propflags, const char *optstr,
160 int error, bool inner)
161 {
162 assert(target != NULL);
163
164 if (avl_find(&mounts, target))
165 return 1;
166
167 struct mount *m;
168 m = calloc(1, sizeof(struct mount));
169 assert(m != NULL);
170 m->avl.key = m->target = strdup(target);
171 if (source) {
172 if (source != (void*)(-1))
173 m->source = strdup(source);
174 else
175 m->source = (void*)(-1);
176 }
177 if (filesystemtype)
178 m->filesystemtype = strdup(filesystemtype);
179
180 if (optstr)
181 m->optstr = strdup(optstr);
182
183 m->mountflags = mountflags;
184 m->propflags = propflags;
185 m->error = error;
186 m->inner = inner;
187
188 avl_insert(&mounts, &m->avl);
189 DEBUG("adding mount %s %s bind(%d) ro(%d) err(%d)\n", (m->source == (void*)(-1))?"mask":m->source, m->target,
190 !!(m->mountflags & MS_BIND), !!(m->mountflags & MS_RDONLY), m->error != 0);
191
192 return 0;
193 }
194
195 int add_mount(const char *source, const char *target, const char *filesystemtype,
196 unsigned long mountflags, unsigned long propflags, const char *optstr, int error)
197 {
198 return _add_mount(source, target, filesystemtype, mountflags, propflags, optstr, error, false);
199 }
200
201 int add_mount_inner(const char *source, const char *target, const char *filesystemtype,
202 unsigned long mountflags, unsigned long propflags, const char *optstr, int error)
203 {
204 return _add_mount(source, target, filesystemtype, mountflags, propflags, optstr, error, true);
205 }
206
207 int add_mount_bind(const char *path, int readonly, int error)
208 {
209 unsigned long mountflags = MS_BIND;
210
211 if (readonly)
212 mountflags |= MS_RDONLY;
213
214 return add_mount(path, path, NULL, mountflags, 0, NULL, error);
215 }
216
217 enum {
218 OCI_MOUNT_SOURCE,
219 OCI_MOUNT_DESTINATION,
220 OCI_MOUNT_TYPE,
221 OCI_MOUNT_OPTIONS,
222 __OCI_MOUNT_MAX,
223 };
224
225 static const struct blobmsg_policy oci_mount_policy[] = {
226 [OCI_MOUNT_SOURCE] = { "source", BLOBMSG_TYPE_STRING },
227 [OCI_MOUNT_DESTINATION] = { "destination", BLOBMSG_TYPE_STRING },
228 [OCI_MOUNT_TYPE] = { "type", BLOBMSG_TYPE_STRING },
229 [OCI_MOUNT_OPTIONS] = { "options", BLOBMSG_TYPE_ARRAY },
230 };
231
232 struct mount_opt {
233 struct list_head list;
234 char *optstr;
235 };
236
237 #ifndef MS_LAZYTIME
238 #define MS_LAZYTIME (1 << 25)
239 #endif
240
241 static int parseOCImountopts(struct blob_attr *msg, unsigned long *mount_flags, unsigned long *propagation_flags, char **mount_data, int *error)
242 {
243 struct blob_attr *cur;
244 int rem;
245 unsigned long mf = 0;
246 unsigned long pf = 0;
247 char *tmp;
248 struct list_head fsopts = LIST_HEAD_INIT(fsopts);
249 size_t len = 0;
250 struct mount_opt *opt, *tmpopt;
251
252 blobmsg_for_each_attr(cur, msg, rem) {
253 tmp = blobmsg_get_string(cur);
254 if (!strcmp("ro", tmp))
255 mf |= MS_RDONLY;
256 else if (!strcmp("rw", tmp))
257 mf &= ~MS_RDONLY;
258 else if (!strcmp("bind", tmp))
259 mf = MS_BIND;
260 else if (!strcmp("rbind", tmp))
261 mf |= MS_BIND | MS_REC;
262 else if (!strcmp("sync", tmp))
263 mf |= MS_SYNCHRONOUS;
264 else if (!strcmp("async", tmp))
265 mf &= ~MS_SYNCHRONOUS;
266 else if (!strcmp("atime", tmp))
267 mf &= ~MS_NOATIME;
268 else if (!strcmp("noatime", tmp))
269 mf |= MS_NOATIME;
270 else if (!strcmp("defaults", tmp))
271 mf = 0; /* rw, suid, dev, exec, auto, nouser, and async */
272 else if (!strcmp("dev", tmp))
273 mf &= ~MS_NODEV;
274 else if (!strcmp("nodev", tmp))
275 mf |= MS_NODEV;
276 else if (!strcmp("iversion", tmp))
277 mf |= MS_I_VERSION;
278 else if (!strcmp("noiversion", tmp))
279 mf &= ~MS_I_VERSION;
280 else if (!strcmp("diratime", tmp))
281 mf &= ~MS_NODIRATIME;
282 else if (!strcmp("nodiratime", tmp))
283 mf |= MS_NODIRATIME;
284 else if (!strcmp("dirsync", tmp))
285 mf |= MS_DIRSYNC;
286 else if (!strcmp("exec", tmp))
287 mf &= ~MS_NOEXEC;
288 else if (!strcmp("noexec", tmp))
289 mf |= MS_NOEXEC;
290 else if (!strcmp("mand", tmp))
291 mf |= MS_MANDLOCK;
292 else if (!strcmp("nomand", tmp))
293 mf &= ~MS_MANDLOCK;
294 else if (!strcmp("relatime", tmp))
295 mf |= MS_RELATIME;
296 else if (!strcmp("norelatime", tmp))
297 mf &= ~MS_RELATIME;
298 else if (!strcmp("strictatime", tmp))
299 mf |= MS_STRICTATIME;
300 else if (!strcmp("nostrictatime", tmp))
301 mf &= ~MS_STRICTATIME;
302 else if (!strcmp("lazytime", tmp))
303 mf |= MS_LAZYTIME;
304 else if (!strcmp("nolazytime", tmp))
305 mf &= ~MS_LAZYTIME;
306 else if (!strcmp("suid", tmp))
307 mf &= ~MS_NOSUID;
308 else if (!strcmp("nosuid", tmp))
309 mf |= MS_NOSUID;
310 else if (!strcmp("remount", tmp))
311 mf |= MS_REMOUNT;
312 /* propagation flags */
313 else if (!strcmp("private", tmp))
314 pf |= MS_PRIVATE;
315 else if (!strcmp("rprivate", tmp))
316 pf |= MS_PRIVATE | MS_REC;
317 else if (!strcmp("slave", tmp))
318 pf |= MS_SLAVE;
319 else if (!strcmp("rslave", tmp))
320 pf |= MS_SLAVE | MS_REC;
321 else if (!strcmp("shared", tmp))
322 pf |= MS_SHARED;
323 else if (!strcmp("rshared", tmp))
324 pf |= MS_SHARED | MS_REC;
325 else if (!strcmp("unbindable", tmp))
326 pf |= MS_UNBINDABLE;
327 else if (!strcmp("runbindable", tmp))
328 pf |= MS_UNBINDABLE | MS_REC;
329 /* special case: 'nofail' */
330 else if(!strcmp("nofail", tmp))
331 *error = 0;
332 else if (!strcmp("auto", tmp) ||
333 !strcmp("noauto", tmp) ||
334 !strcmp("user", tmp) ||
335 !strcmp("group", tmp) ||
336 !strcmp("_netdev", tmp))
337 DEBUG("ignoring built-in mount option %s\n", tmp);
338 else {
339 /* filesystem-specific free-form option */
340 opt = calloc(1, sizeof(*opt));
341 opt->optstr = tmp;
342 list_add_tail(&opt->list, &fsopts);
343 }
344 };
345
346 *mount_flags = mf;
347 *propagation_flags = pf;
348
349 list_for_each_entry(opt, &fsopts, list) {
350 if (len)
351 ++len;
352
353 len += strlen(opt->optstr);
354 };
355
356 if (len) {
357 *mount_data = calloc(len + 1, sizeof(char));
358 if (!mount_data)
359 return ENOMEM;
360
361 len = 0;
362 list_for_each_entry(opt, &fsopts, list) {
363 if (len)
364 strcat(*mount_data, ",");
365
366 strcat(*mount_data, opt->optstr);
367 ++len;
368 }
369
370 list_for_each_entry_safe(opt, tmpopt, &fsopts, list) {
371 list_del(&opt->list);
372 free(opt);
373 }
374 }
375
376 DEBUG("mount flags(%08lx) propagation(%08lx) fsopts(\"%s\")\n", mf, pf, *mount_data?:"");
377
378 return 0;
379 }
380
381 int parseOCImount(struct blob_attr *msg)
382 {
383 struct blob_attr *tb[__OCI_MOUNT_MAX];
384 unsigned long mount_flags = 0;
385 unsigned long propagation_flags = 0;
386 char *mount_data = NULL;
387 int ret, err = -1;
388
389 blobmsg_parse(oci_mount_policy, __OCI_MOUNT_MAX, tb, blobmsg_data(msg), blobmsg_len(msg));
390
391 if (!tb[OCI_MOUNT_DESTINATION])
392 return EINVAL;
393
394 if (tb[OCI_MOUNT_OPTIONS]) {
395 ret = parseOCImountopts(tb[OCI_MOUNT_OPTIONS], &mount_flags, &propagation_flags, &mount_data, &err);
396 if (ret)
397 return ret;
398 }
399
400 ret = add_mount(tb[OCI_MOUNT_SOURCE] ? blobmsg_get_string(tb[OCI_MOUNT_SOURCE]) : NULL,
401 blobmsg_get_string(tb[OCI_MOUNT_DESTINATION]),
402 tb[OCI_MOUNT_TYPE] ? blobmsg_get_string(tb[OCI_MOUNT_TYPE]) : NULL,
403 mount_flags, propagation_flags, mount_data, err);
404
405 if (mount_data)
406 free(mount_data);
407
408 return ret;
409 }
410
411 static void build_noafile(void) {
412 int fd;
413
414 fd = creat(UJAIL_NOAFILE, 0000);
415 if (fd == -1)
416 return;
417
418 close(fd);
419 return;
420 }
421
422 int mount_all(const char *jailroot) {
423 struct library *l;
424 struct mount *m;
425
426 build_noafile();
427
428 avl_for_each_element(&libraries, l, avl)
429 add_mount_bind(l->path, 1, -1);
430
431 avl_for_each_element(&mounts, m, avl)
432 if (do_mount(jailroot, m->source, m->target, m->filesystemtype, m->mountflags,
433 m->propflags, m->optstr, m->error, m->inner))
434 return -1;
435
436 return 0;
437 }
438
439 void mount_free(void) {
440 struct mount *m, *tmp;
441
442 avl_remove_all_elements(&mounts, m, avl, tmp) {
443 if (m->source != (void*)(-1))
444 free((void*)m->source);
445 free((void*)m->target);
446 free((void*)m->filesystemtype);
447 free((void*)m->optstr);
448 free(m);
449 }
450 }
451
452 void mount_list_init(void) {
453 avl_init(&mounts, avl_strcmp, false, NULL);
454 }
455
456 static int add_script_interp(const char *path, const char *map, int size)
457 {
458 int start = 2;
459 while (start < size && map[start] != '/') {
460 start++;
461 }
462 if (start >= size) {
463 ERROR("bad script interp (%s)\n", path);
464 return -1;
465 }
466 int stop = start + 1;
467 while (stop < size && map[stop] > 0x20 && map[stop] <= 0x7e) {
468 stop++;
469 }
470 if (stop >= size || (stop-start) > PATH_MAX) {
471 ERROR("bad script interp (%s)\n", path);
472 return -1;
473 }
474 char buf[PATH_MAX];
475 strncpy(buf, map+start, stop-start);
476 return add_path_and_deps(buf, 1, -1, 0);
477 }
478
479 int add_path_and_deps(const char *path, int readonly, int error, int lib)
480 {
481 assert(path != NULL);
482
483 if (lib == 0 && path[0] != '/') {
484 ERROR("%s is not an absolute path\n", path);
485 return error;
486 }
487
488 char *map = NULL;
489 int fd, ret = -1;
490 if (path[0] == '/') {
491 if (avl_find(&mounts, path))
492 return 0;
493 fd = open(path, O_RDONLY|O_CLOEXEC);
494 if (fd == -1)
495 return error;
496 add_mount_bind(path, readonly, error);
497 } else {
498 if (avl_find(&libraries, path))
499 return 0;
500 char *fullpath;
501 fd = lib_open(&fullpath, path);
502 if (fd == -1)
503 return error;
504 if (fullpath) {
505 alloc_library(fullpath, path);
506 free(fullpath);
507 }
508 }
509
510 struct stat s;
511 if (fstat(fd, &s) == -1) {
512 ERROR("fstat(%s) failed: %m\n", path);
513 ret = error;
514 goto out;
515 }
516
517 if (!S_ISREG(s.st_mode)) {
518 ret = 0;
519 goto out;
520 }
521
522 /* too small to be an ELF or a script -> "normal" file */
523 if (s.st_size < 4) {
524 ret = 0;
525 goto out;
526 }
527
528 map = mmap(NULL, s.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
529 if (map == MAP_FAILED) {
530 ERROR("failed to mmap %s: %m\n", path);
531 ret = -1;
532 goto out;
533 }
534
535 if (map[0] == '#' && map[1] == '!') {
536 ret = add_script_interp(path, map, s.st_size);
537 goto out;
538 }
539
540 if (map[0] == ELFMAG0 && map[1] == ELFMAG1 && map[2] == ELFMAG2 && map[3] == ELFMAG3) {
541 ret = elf_load_deps(path, map);
542 goto out;
543 }
544
545 ret = 0;
546
547 out:
548 if (fd >= 0)
549 close(fd);
550 if (map)
551 munmap(map, s.st_size);
552
553 return ret;
554 }