jail/jail.c

   1 /*
   2  * Copyright (C) 2015 John Crispin <blogic@openwrt.org>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU Lesser General Public License version 2.1
   6  * as published by the Free Software Foundation
   7  *
   8  * This program is distributed in the hope that it will be useful,
   9  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  11  * GNU General Public License for more details.
  12  */
  13
  14 #define _GNU_SOURCE
  15 #include <sys/mount.h>
  16 #include <sys/prctl.h>
  17 #include <sys/wait.h>
  18 #include <sys/types.h>
  19
  20 #include <stdlib.h>
  21 #include <unistd.h>
  22 #include <errno.h>
  23 #include <pwd.h>
  24 #include <grp.h>
  25 #include <string.h>
  26 #include <sys/stat.h>
  27 #include <fcntl.h>
  28 #include <libgen.h>
  29 #include <sched.h>
  30 #include <linux/limits.h>
  31 #include <linux/filter.h>
  32 #include <signal.h>
  33
  34 #include "capabilities.h"
  35 #include "elf.h"
  36 #include "fs.h"
  37 #include "jail.h"
  38 #include "log.h"
  39 #include "seccomp-oci.h"
  40
  41 #include <libubox/utils.h>
  42 #include <libubox/blobmsg.h>
  43 #include <libubox/blobmsg_json.h>
  44 #include <libubox/list.h>
  45 #include <libubox/vlist.h>
  46 #include <libubox/uloop.h>
  47 #include <libubus.h>
  48
  49 #ifndef CLONE_NEWCGROUP
  50 #define CLONE_NEWCGROUP 0x02000000
  51 #endif
  52
  53 #define STACK_SIZE      (1024 * 1024)
  54 #define OPT_ARGS        "S:C:n:h:r:w:d:psulocU:G:NR:fFO:T:EyJ:"
  55
  56 static struct {
  57         char *name;
  58         char *hostname;
  59         char **jail_argv;
  60         char *cwd;
  61         char *seccomp;
  62         struct sock_fprog *ociseccomp;
  63         char *capabilities;
  64         struct jail_capset capset;
  65         char *user;
  66         char *group;
  67         char *extroot;
  68         char *overlaydir;
  69         char *tmpoverlaysize;
  70         char **envp;
  71         char *uidmap;
  72         char *gidmap;
  73         int no_new_privs;
  74         int namespace;
  75         int procfs;
  76         int ronly;
  77         int sysfs;
  78         int console;
  79         int pw_uid;
  80         int pw_gid;
  81         int gr_gid;
  82         int require_jail;
  83 } opts;
  84
  85 static struct blob_buf ocibuf;
  86
  87 extern int pivot_root(const char *new_root, const char *put_old);
  88
  89 int debug = 0;
  90
  91 static char child_stack[STACK_SIZE];
  92
  93 int console_fd;
  94
  95 static int mkdir_p(char *dir, mode_t mask)
  96 {
  97         char *l = strrchr(dir, '/');
  98         int ret;
  99
 100         if (!l)
 101                 return 0;
 102
 103         *l = '\0';
 104
 105         if (mkdir_p(dir, mask))
 106                 return -1;
 107
 108         *l = '/';
 109
 110         ret = mkdir(dir, mask);
 111         if (ret && errno == EEXIST)
 112                 return 0;
 113
 114         if (ret)
 115                 ERROR("mkdir(%s, %d) failed: %m\n", dir, mask);
 116
 117         return ret;
 118 }
 119
 120 static int _mount_bind(const char *root, const char *path, const char *target, int readonly, int strict, int error)
 121 {
 122         struct stat s;
 123         char new[PATH_MAX];
 124         int fd;
 125         int remount_flags = MS_BIND | MS_REMOUNT;
 126
 127         if (stat(path, &s)) {
 128                 ERROR("stat(%s) failed: %m\n", path);
 129                 return error;
 130         }
 131
 132         snprintf(new, sizeof(new), "%s%s", root, target?target:path);
 133
 134         if (S_ISDIR(s.st_mode)) {
 135                 mkdir_p(new, 0755);
 136         } else {
 137                 mkdir_p(dirname(new), 0755);
 138                 snprintf(new, sizeof(new), "%s%s", root, target?target:path);
 139                 fd = creat(new, 0644);
 140                 if (fd == -1) {
 141                         ERROR("creat(%s) failed: %m\n", new);
 142                         return -1;
 143                 }
 144                 close(fd);
 145         }
 146
 147         if (mount(path, new, NULL, MS_BIND, NULL)) {
 148                 ERROR("failed to mount -B %s %s: %m\n", path, new);
 149                 return -1;
 150         }
 151
 152         if (readonly)
 153                 remount_flags |= MS_RDONLY;
 154
 155         if (strict)
 156                 remount_flags |= MS_NOEXEC | MS_NOSUID | MS_NODEV;
 157
 158         if ((strict || readonly) && mount(NULL, new, NULL, remount_flags, NULL)) {
 159                 ERROR("failed to remount (%s%s%s) %s: %m\n", readonly?"ro":"rw",
 160                       (readonly && strict)?", ":"", strict?"strict":"", new);
 161                 return -1;
 162         }
 163
 164         DEBUG("mount -B %s %s (%s%s%s)\n", path, new,
 165               readonly?"ro":"rw", (readonly && strict)?", ":"", strict?"strict":"");
 166
 167         return 0;
 168 }
 169
 170 int mount_bind(const char *root, const char *path, int readonly, int error) {
 171         return _mount_bind(root, path, NULL, readonly, 0, error);
 172 }
 173
 174 static int mount_overlay(char *jail_root, char *overlaydir) {
 175         char *upperdir, *workdir, *optsstr, *upperetc, *upperresolvconf;
 176         const char mountoptsformat[] = "lowerdir=%s,upperdir=%s,workdir=%s";
 177         int ret = -1, fd;
 178
 179         if (asprintf(&upperdir, "%s%s", overlaydir, "/upper") < 0)
 180                 goto out;
 181
 182         if (asprintf(&workdir, "%s%s", overlaydir, "/work") < 0)
 183                 goto upper_printf;
 184
 185         if (asprintf(&optsstr, mountoptsformat, jail_root, upperdir, workdir) < 0)
 186                 goto work_printf;
 187
 188         if (mkdir_p(upperdir, 0755) || mkdir_p(workdir, 0755))
 189                 goto opts_printf;
 190
 191 /*
 192  * make sure /etc/resolv.conf exists in overlay and is owned by jail userns root
 193  * this is to work-around a bug in overlayfs described in the overlayfs-userns
 194  * patch:
 195  * 3. modification of a file 'hithere' which is in l but not yet
 196  * in u, and which is not owned by T, is not allowed, even if
 197  * writes to u are allowed.  This may be a bug in overlayfs,
 198  * but it is safe behavior.
 199  */
 200         if (asprintf(&upperetc, "%s/etc", upperdir) < 0)
 201                 goto opts_printf;
 202
 203         if (mkdir_p(upperetc, 0755))
 204                 goto upper_etc_printf;
 205
 206         if (asprintf(&upperresolvconf, "%s/resolv.conf", upperetc) < 0)
 207                 goto upper_etc_printf;
 208
 209         fd = creat(upperresolvconf, 0644);
 210         if (fd == -1) {
 211                 ERROR("creat(%s) failed: %m\n", upperresolvconf);
 212                 goto upper_resolvconf_printf;
 213         }
 214         close(fd);
 215
 216         DEBUG("mount -t overlay %s %s (%s)\n", jail_root, jail_root, optsstr);
 217
 218         if (mount(jail_root, jail_root, "overlay", MS_NOATIME, optsstr))
 219                 goto opts_printf;
 220
 221         ret = 0;
 222
 223 upper_resolvconf_printf:
 224         free(upperresolvconf);
 225 upper_etc_printf:
 226         free(upperetc);
 227 opts_printf:
 228         free(optsstr);
 229 work_printf:
 230         free(workdir);
 231 upper_printf:
 232         free(upperdir);
 233 out:
 234         return ret;
 235 }
 236
 237 static void pass_console(int console_fd)
 238 {
 239         struct ubus_context *ctx = ubus_connect(NULL);
 240         static struct blob_buf req;
 241         uint32_t id;
 242
 243         if (!ctx)
 244                 return;
 245
 246         blob_buf_init(&req, 0);
 247         blobmsg_add_string(&req, "name", opts.name);
 248
 249         if (ubus_lookup_id(ctx, "container", &id) ||
 250             ubus_invoke_fd(ctx, id, "console_set", req.head, NULL, NULL, 3000, console_fd))
 251                 INFO("ubus request failed\n");
 252         else
 253                 close(console_fd);
 254
 255         blob_buf_free(&req);
 256         ubus_free(ctx);
 257 }
 258
 259 static int create_dev_console(const char *jail_root)
 260 {
 261         char *console_fname;
 262         char dev_console_path[PATH_MAX];
 263         int slave_console_fd;
 264
 265         /* Open UNIX/98 virtual console */
 266         console_fd = posix_openpt(O_RDWR | O_NOCTTY);
 267         if (console_fd == -1)
 268                 return -1;
 269
 270         console_fname = ptsname(console_fd);
 271         DEBUG("got console fd %d and PTS client name %s\n", console_fd, console_fname);
 272         if (!console_fname)
 273                 goto no_console;
 274
 275         grantpt(console_fd);
 276         unlockpt(console_fd);
 277
 278         /* pass PTY master to procd */
 279         pass_console(console_fd);
 280
 281         /* mount-bind PTY slave to /dev/console in jail */
 282         snprintf(dev_console_path, sizeof(dev_console_path), "%s/dev/console", jail_root);
 283         close(creat(dev_console_path, 0620));
 284
 285         if (mount(console_fname, dev_console_path, NULL, MS_BIND, NULL))
 286                 goto no_console;
 287
 288         /* use PTY slave for stdio */
 289         slave_console_fd = open(console_fname, O_RDWR); /* | O_NOCTTY */
 290         dup2(slave_console_fd, 0);
 291         dup2(slave_console_fd, 1);
 292         dup2(slave_console_fd, 2);
 293         close(slave_console_fd);
 294
 295         INFO("using guest console %s\n", console_fname);
 296
 297         return 0;
 298
 299 no_console:
 300         close(console_fd);
 301         return 1;
 302 }
 303
 304 static int build_jail_fs(void)
 305 {
 306         char jail_root[] = "/tmp/ujail-XXXXXX";
 307         char tmpovdir[] = "/tmp/ujail-overlay-XXXXXX";
 308         char tmpdevdir[] = "/tmp/ujail-XXXXXX/dev";
 309         char tmpdevptsdir[] = "/tmp/ujail-XXXXXX/dev/pts";
 310         char *overlaydir = NULL;
 311
 312         if (mkdtemp(jail_root) == NULL) {
 313                 ERROR("mkdtemp(%s) failed: %m\n", jail_root);
 314                 return -1;
 315         }
 316
 317         /* oldroot can't be MS_SHARED else pivot_root() fails */
 318         if (mount("none", "/", NULL, MS_REC|MS_PRIVATE, NULL)) {
 319                 ERROR("private mount failed %m\n");
 320                 return -1;
 321         }
 322
 323         if (opts.extroot) {
 324                 if (mount(opts.extroot, jail_root, NULL, MS_BIND, NULL)) {
 325                         ERROR("extroot mount failed %m\n");
 326                         return -1;
 327                 }
 328         } else {
 329                 if (mount("tmpfs", jail_root, "tmpfs", MS_NOATIME, "mode=0755")) {
 330                         ERROR("tmpfs mount failed %m\n");
 331                         return -1;
 332                 }
 333         }
 334
 335         if (opts.tmpoverlaysize) {
 336                 char mountoptsstr[] = "mode=0755,size=XXXXXXXX";
 337
 338                 snprintf(mountoptsstr, sizeof(mountoptsstr),
 339                          "mode=0755,size=%s", opts.tmpoverlaysize);
 340                 if (mkdtemp(tmpovdir) == NULL) {
 341                         ERROR("mkdtemp(%s) failed: %m\n", jail_root);
 342                         return -1;
 343                 }
 344                 if (mount("tmpfs", tmpovdir, "tmpfs", MS_NOATIME,
 345                           mountoptsstr)) {
 346                         ERROR("failed to mount tmpfs for overlay (size=%s)\n", opts.tmpoverlaysize);
 347                         return -1;
 348                 }
 349                 overlaydir = tmpovdir;
 350         }
 351
 352         if (opts.overlaydir)
 353                 overlaydir = opts.overlaydir;
 354
 355         if (overlaydir)
 356                 mount_overlay(jail_root, overlaydir);
 357
 358         if (chdir(jail_root)) {
 359                 ERROR("chdir(%s) (jail_root) failed: %m\n", jail_root);
 360                 return -1;
 361         }
 362
 363         snprintf(tmpdevdir, sizeof(tmpdevdir), "%s/dev", jail_root);
 364         mkdir_p(tmpdevdir, 0755);
 365         if (mount(NULL, tmpdevdir, "tmpfs", MS_NOATIME | MS_NOEXEC | MS_NOSUID, "size=1M"))
 366                 return -1;
 367
 368         snprintf(tmpdevptsdir, sizeof(tmpdevptsdir), "%s/dev/pts", jail_root);
 369         mkdir_p(tmpdevptsdir, 0755);
 370         if (mount(NULL, tmpdevptsdir, "devpts", MS_NOATIME | MS_NOEXEC | MS_NOSUID, NULL))
 371                 return -1;
 372
 373         if (opts.console)
 374                 create_dev_console(jail_root);
 375
 376         if (mount_all(jail_root)) {
 377                 ERROR("mount_all() failed\n");
 378                 return -1;
 379         }
 380
 381         if (opts.namespace & CLONE_NEWNET) {
 382                 char hostdir[PATH_MAX], jailetc[PATH_MAX], jaillink[PATH_MAX];
 383
 384                 snprintf(hostdir, PATH_MAX, "/tmp/resolv.conf-%s.d", opts.name);
 385                 mkdir_p(hostdir, 0755);
 386                 _mount_bind(jail_root, hostdir, "/tmp/resolv.conf.d", 1, 1, -1);
 387                 snprintf(jailetc, PATH_MAX, "%s/etc", jail_root);
 388                 mkdir_p(jailetc, 0755);
 389                 snprintf(jaillink, PATH_MAX, "%s/etc/resolv.conf", jail_root);
 390                 if (overlaydir)
 391                         unlink(jaillink);
 392                 symlink("../tmp/resolv.conf.d/resolv.conf.auto", jaillink);
 393         }
 394
 395         char dirbuf[sizeof(jail_root) + 4];
 396         snprintf(dirbuf, sizeof(dirbuf), "%s/old", jail_root);
 397         mkdir(dirbuf, 0755);
 398
 399         if (pivot_root(jail_root, dirbuf) == -1) {
 400                 ERROR("pivot_root(%s, %s) failed: %m\n", jail_root, dirbuf);
 401                 return -1;
 402         }
 403         if (chdir("/")) {
 404                 ERROR("chdir(/) (after pivot_root) failed: %m\n");
 405                 return -1;
 406         }
 407
 408         snprintf(dirbuf, sizeof(dirbuf), "/old%s", jail_root);
 409         umount2(dirbuf, MNT_DETACH);
 410         rmdir(dirbuf);
 411         if (opts.tmpoverlaysize) {
 412                 char tmpdirbuf[sizeof(tmpovdir) + 4];
 413                 snprintf(tmpdirbuf, sizeof(tmpdirbuf), "/old%s", tmpovdir);
 414                 umount2(tmpdirbuf, MNT_DETACH);
 415                 rmdir(tmpdirbuf);
 416         }
 417
 418         umount2("/old", MNT_DETACH);
 419         rmdir("/old");
 420
 421         if (opts.procfs) {
 422                 mkdir("/proc", 0755);
 423                 mount("proc", "/proc", "proc", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, 0);
 424                 /*
 425                  * make /proc/sys read-only while keeping read-write to
 426                  * /proc/sys/net if CLONE_NEWNET is set.
 427                  */
 428                 if (opts.namespace & CLONE_NEWNET)
 429                         mount("/proc/sys/net", "/proc/self/net", NULL, MS_BIND, 0);
 430
 431                 mount("/proc/sys", "/proc/sys", NULL, MS_BIND, 0);
 432                 mount(NULL, "/proc/sys", NULL, MS_REMOUNT | MS_RDONLY, 0);
 433                 mount(NULL, "/proc", NULL, MS_REMOUNT, 0);
 434
 435                 if (opts.namespace & CLONE_NEWNET)
 436                         mount("/proc/self/net", "/proc/sys/net", NULL, MS_MOVE, 0);
 437         }
 438         if (opts.sysfs) {
 439                 mkdir("/sys", 0755);
 440                 mount("sysfs", "/sys", "sysfs", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID | MS_RDONLY, 0);
 441         }
 442         if (opts.ronly)
 443                 mount(NULL, "/", NULL, MS_RDONLY | MS_REMOUNT, 0);
 444
 445         return 0;
 446 }
 447
 448 static int write_uid_gid_map(pid_t child_pid, bool gidmap, char *mapstr)
 449 {
 450         int map_file;
 451         char map_path[64];
 452
 453         if (snprintf(map_path, sizeof(map_path), "/proc/%d/%s",
 454                 child_pid, gidmap?"gid_map":"uid_map") < 0)
 455                 return -1;
 456
 457         if ((map_file = open(map_path, O_WRONLY)) == -1)
 458                 return -1;
 459
 460         if (dprintf(map_file, "%s", mapstr)) {
 461                 close(map_file);
 462                 return -1;
 463         }
 464
 465         close(map_file);
 466         free(mapstr);
 467         return 0;
 468 }
 469
 470 static int write_single_uid_gid_map(pid_t child_pid, bool gidmap, int id)
 471 {
 472         int map_file;
 473         char map_path[64];
 474         const char *map_format = "%d %d %d\n";
 475         if (snprintf(map_path, sizeof(map_path), "/proc/%d/%s",
 476                 child_pid, gidmap?"gid_map":"uid_map") < 0)
 477                 return -1;
 478
 479         if ((map_file = open(map_path, O_WRONLY)) == -1)
 480                 return -1;
 481
 482         if (dprintf(map_file, map_format, 0, id, 1) == -1) {
 483                 close(map_file);
 484                 return -1;
 485         }
 486
 487         close(map_file);
 488         return 0;
 489 }
 490
 491 static int write_setgroups(pid_t child_pid, bool allow)
 492 {
 493         int setgroups_file;
 494         char setgroups_path[64];
 495
 496         if (snprintf(setgroups_path, sizeof(setgroups_path), "/proc/%d/setgroups",
 497                 child_pid) < 0) {
 498                 return -1;
 499         }
 500
 501         if ((setgroups_file = open(setgroups_path, O_WRONLY)) == -1) {
 502                 return -1;
 503         }
 504
 505         if (dprintf(setgroups_file, "%s", allow?"allow":"deny") == -1) {
 506                 close(setgroups_file);
 507                 return -1;
 508         }
 509
 510         close(setgroups_file);
 511         return 0;
 512 }
 513
 514 static void get_jail_user(int *user, int *user_gid, int *gr_gid)
 515 {
 516         struct passwd *p = NULL;
 517         struct group *g = NULL;
 518
 519         if (opts.user) {
 520                 p = getpwnam(opts.user);
 521                 if (!p) {
 522                         ERROR("failed to get uid/gid for user %s: %d (%s)\n",
 523                               opts.user, errno, strerror(errno));
 524                         exit(EXIT_FAILURE);
 525                 }
 526                 *user = p->pw_uid;
 527                 *user_gid = p->pw_gid;
 528         } else {
 529                 *user = -1;
 530                 *user_gid = -1;
 531         }
 532
 533         if (opts.group) {
 534                 g = getgrnam(opts.group);
 535                 if (!g) {
 536                         ERROR("failed to get gid for group %s: %m\n", opts.group);
 537                         exit(EXIT_FAILURE);
 538                 }
 539                 *gr_gid = g->gr_gid;
 540         } else {
 541                 *gr_gid = -1;
 542         }
 543 };
 544
 545 static void set_jail_user(int pw_uid, int user_gid, int gr_gid)
 546 {
 547         if (opts.user && (user_gid != -1) && initgroups(opts.user, user_gid)) {
 548                 ERROR("failed to initgroups() for user %s: %m\n", opts.user);
 549                 exit(EXIT_FAILURE);
 550         }
 551
 552         if ((gr_gid != -1) && setregid(gr_gid, gr_gid)) {
 553                 ERROR("failed to set group id %d: %m\n", gr_gid);
 554                 exit(EXIT_FAILURE);
 555         }
 556
 557         if ((pw_uid != -1) && setreuid(pw_uid, pw_uid)) {
 558                 ERROR("failed to set user id %d: %m\n", pw_uid);
 559                 exit(EXIT_FAILURE);
 560         }
 561 }
 562
 563 #define MAX_ENVP        8
 564 static char** build_envp(const char *seccomp, char **ocienvp)
 565 {
 566         static char *envp[MAX_ENVP];
 567         static char preload_var[PATH_MAX];
 568         static char seccomp_var[PATH_MAX];
 569         static char debug_var[] = "LD_DEBUG=all";
 570         static char container_var[] = "container=ujail";
 571         const char *preload_lib = find_lib("libpreload-seccomp.so");
 572         char **addenv;
 573
 574         int count = 0;
 575
 576         if (seccomp && !preload_lib) {
 577                 ERROR("failed to add preload-lib to env\n");
 578                 return NULL;
 579         }
 580         if (seccomp) {
 581                 snprintf(seccomp_var, sizeof(seccomp_var), "SECCOMP_FILE=%s", seccomp);
 582                 envp[count++] = seccomp_var;
 583                 snprintf(preload_var, sizeof(preload_var), "LD_PRELOAD=%s", preload_lib);
 584                 envp[count++] = preload_var;
 585         }
 586
 587         envp[count++] = container_var;
 588
 589         if (debug > 1)
 590                 envp[count++] = debug_var;
 591
 592         addenv = ocienvp;
 593         while (addenv && *addenv) {
 594                 envp[count++] = *(addenv++);
 595                 if (count >= MAX_ENVP) {
 596                         ERROR("environment limited to %d extra records, truncating\n", MAX_ENVP);
 597                         break;
 598                 }
 599         }
 600         return envp;
 601 }
 602
 603 static void usage(void)
 604 {
 605         fprintf(stderr, "ujail <options> -- <binary> <params ...>\n");
 606         fprintf(stderr, "  -d <num>\tshow debug log (increase num to increase verbosity)\n");
 607         fprintf(stderr, "  -S <file>\tseccomp filter config\n");
 608         fprintf(stderr, "  -C <file>\tcapabilities drop config\n");
 609         fprintf(stderr, "  -c\t\tset PR_SET_NO_NEW_PRIVS\n");
 610         fprintf(stderr, "  -n <name>\tthe name of the jail\n");
 611         fprintf(stderr, "namespace jail options:\n");
 612         fprintf(stderr, "  -h <hostname>\tchange the hostname of the jail\n");
 613         fprintf(stderr, "  -N\t\tjail has network namespace\n");
 614         fprintf(stderr, "  -f\t\tjail has user namespace\n");
 615         fprintf(stderr, "  -F\t\tjail has cgroups namespace\n");
 616         fprintf(stderr, "  -r <file>\treadonly files that should be staged\n");
 617         fprintf(stderr, "  -w <file>\twriteable files that should be staged\n");
 618         fprintf(stderr, "  -p\t\tjail has /proc\n");
 619         fprintf(stderr, "  -s\t\tjail has /sys\n");
 620         fprintf(stderr, "  -l\t\tjail has /dev/log\n");
 621         fprintf(stderr, "  -u\t\tjail has a ubus socket\n");
 622         fprintf(stderr, "  -U <name>\tuser to run jailed process\n");
 623         fprintf(stderr, "  -G <name>\tgroup to run jailed process\n");
 624         fprintf(stderr, "  -o\t\tremont jail root (/) read only\n");
 625         fprintf(stderr, "  -R <dir>\texternal jail rootfs (system container)\n");
 626         fprintf(stderr, "  -O <dir>\tdirectory for r/w overlayfs\n");
 627         fprintf(stderr, "  -T <size>\tuse tmpfs r/w overlayfs with <size>\n");
 628         fprintf(stderr, "  -E\t\tfail if jail cannot be setup\n");
 629         fprintf(stderr, "  -y\t\tprovide jail console\n");
 630         fprintf(stderr, "  -J <dir>\tstart OCI bundle\n");
 631         fprintf(stderr, "\nWarning: by default root inside the jail is the same\n\
 632 and he has the same powers as root outside the jail,\n\
 633 thus he can escape the jail and/or break stuff.\n\
 634 Please use seccomp/capabilities (-S/-C) to restrict his powers\n\n\
 635 If you use none of the namespace jail options,\n\
 636 ujail will not use namespace/build a jail,\n\
 637 and will only drop capabilities/apply seccomp filter.\n\n");
 638 }
 639
 640 static int exec_jail(void *pipes_ptr)
 641 {
 642         int *pipes = (int*)pipes_ptr;
 643         char buf[1];
 644         int pw_uid, pw_gid, gr_gid;
 645
 646         close(pipes[0]);
 647         close(pipes[3]);
 648
 649         buf[0] = 'i';
 650         if (write(pipes[1], buf, 1) < 1) {
 651                 ERROR("can't write to parent\n");
 652                 exit(EXIT_FAILURE);
 653         }
 654         if (read(pipes[2], buf, 1) < 1) {
 655                 ERROR("can't read from parent\n");
 656                 exit(EXIT_FAILURE);
 657         }
 658         if (buf[0] != 'O') {
 659                 ERROR("parent had an error, child exiting\n");
 660                 exit(EXIT_FAILURE);
 661         }
 662
 663         close(pipes[1]);
 664         close(pipes[2]);
 665
 666         if (opts.namespace & CLONE_NEWUSER) {
 667                 if (setregid(0, 0) < 0) {
 668                         ERROR("setgid\n");
 669                         exit(EXIT_FAILURE);
 670                 }
 671                 if (setreuid(0, 0) < 0) {
 672                         ERROR("setuid\n");
 673                         exit(EXIT_FAILURE);
 674                 }
 675                 if (setgroups(0, NULL) < 0) {
 676                         ERROR("setgroups\n");
 677                         exit(EXIT_FAILURE);
 678                 }
 679         }
 680
 681         if (opts.namespace && opts.hostname && strlen(opts.hostname) > 0
 682                         && sethostname(opts.hostname, strlen(opts.hostname))) {
 683                 ERROR("sethostname(%s) failed: %m\n", opts.hostname);
 684                 exit(EXIT_FAILURE);
 685         }
 686
 687         if ((opts.namespace & CLONE_NEWNS) && build_jail_fs()) {
 688                 ERROR("failed to build jail fs\n");
 689                 exit(EXIT_FAILURE);
 690         }
 691
 692         if (applyOCIcapabilities(opts.capset))
 693                 exit(EXIT_FAILURE);
 694
 695         if (opts.capabilities && drop_capabilities(opts.capabilities))
 696                 exit(EXIT_FAILURE);
 697
 698         if (opts.no_new_privs && prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
 699                 ERROR("prctl(PR_SET_NO_NEW_PRIVS) failed: %m\n");
 700                 exit(EXIT_FAILURE);
 701         }
 702
 703         if (!(opts.namespace & CLONE_NEWUSER)) {
 704                 get_jail_user(&pw_uid, &pw_gid, &gr_gid);
 705
 706                 set_jail_user(opts.pw_uid?:pw_uid, opts.pw_gid?:pw_gid, opts.gr_gid?:gr_gid);
 707         }
 708
 709         char **envp = build_envp(opts.seccomp, opts.envp);
 710         if (!envp)
 711                 exit(EXIT_FAILURE);
 712
 713         if (opts.ociseccomp && applyOCIlinuxseccomp(opts.ociseccomp))
 714                 exit(EXIT_FAILURE);
 715
 716         INFO("exec-ing %s\n", *opts.jail_argv);
 717         if (opts.envp) /* respect PATH if potentially set in ENV */
 718                 execvpe(*opts.jail_argv, opts.jail_argv, envp);
 719         else
 720                 execve(*opts.jail_argv, opts.jail_argv, envp);
 721
 722         /* we get there only if execve fails */
 723         ERROR("failed to execve %s: %m\n", *opts.jail_argv);
 724         exit(EXIT_FAILURE);
 725 }
 726
 727 static int jail_running = 1;
 728 static int jail_return_code = 0;
 729
 730 static void jail_process_timeout_cb(struct uloop_timeout *t);
 731 static struct uloop_timeout jail_process_timeout = {
 732         .cb = jail_process_timeout_cb,
 733 };
 734
 735 static void jail_process_handler(struct uloop_process *c, int ret)
 736 {
 737         uloop_timeout_cancel(&jail_process_timeout);
 738         if (WIFEXITED(ret)) {
 739                 jail_return_code = WEXITSTATUS(ret);
 740                 INFO("jail (%d) exited with exit: %d\n", c->pid, jail_return_code);
 741         } else {
 742                 jail_return_code = WTERMSIG(ret);
 743                 INFO("jail (%d) exited with signal: %d\n", c->pid, jail_return_code);
 744         }
 745         jail_running = 0;
 746         uloop_end();
 747 }
 748
 749 static struct uloop_process jail_process = {
 750         .cb = jail_process_handler,
 751 };
 752
 753 static void jail_process_timeout_cb(struct uloop_timeout *t)
 754 {
 755         DEBUG("jail process failed to stop, sending SIGKILL\n");
 756         kill(jail_process.pid, SIGKILL);
 757 }
 758
 759 static void jail_handle_signal(int signo)
 760 {
 761         DEBUG("forwarding signal %d to the jailed process\n", signo);
 762         kill(jail_process.pid, signo);
 763 }
 764
 765 static int netns_open_pid(const pid_t target_ns)
 766 {
 767         char pid_net_path[PATH_MAX];
 768
 769         snprintf(pid_net_path, sizeof(pid_net_path), "/proc/%u/ns/net", target_ns);
 770
 771         return open(pid_net_path, O_RDONLY);
 772 }
 773
 774 static void netns_updown(pid_t pid, bool start)
 775 {
 776         struct ubus_context *ctx = ubus_connect(NULL);
 777         static struct blob_buf req;
 778         uint32_t id;
 779
 780         if (!ctx)
 781                 return;
 782
 783         blob_buf_init(&req, 0);
 784         blobmsg_add_string(&req, "jail", opts.name);
 785         blobmsg_add_u32(&req, "pid", pid);
 786         blobmsg_add_u8(&req, "start", start);
 787
 788         if (ubus_lookup_id(ctx, "network", &id) ||
 789             ubus_invoke(ctx, id, "netns_updown", req.head, NULL, NULL, 3000))
 790                 INFO("ubus request failed\n");
 791
 792         blob_buf_free(&req);
 793         ubus_free(ctx);
 794 }
 795
 796
 797 enum {
 798         OCI_ROOT_PATH,
 799         OCI_ROOT_READONLY,
 800         __OCI_ROOT_MAX,
 801 };
 802
 803 static const struct blobmsg_policy oci_root_policy[] = {
 804         [OCI_ROOT_PATH] = { "path", BLOBMSG_TYPE_STRING },
 805         [OCI_ROOT_READONLY] = { "readonly", BLOBMSG_TYPE_BOOL },
 806 };
 807
 808 static int parseOCIroot(const char *jsonfile, struct blob_attr *msg)
 809 {
 810         static char rootpath[PATH_MAX] = { 0 };
 811         struct blob_attr *tb[__OCI_ROOT_MAX];
 812         char *cur;
 813
 814         blobmsg_parse(oci_root_policy, __OCI_ROOT_MAX, tb, blobmsg_data(msg), blobmsg_len(msg));
 815
 816         if (!tb[OCI_ROOT_PATH])
 817                 return ENODATA;
 818
 819         strncpy(rootpath, jsonfile, PATH_MAX);
 820         cur = strrchr(rootpath, '/');
 821
 822         if (!cur)
 823                 return ENOTDIR;
 824
 825         *(++cur) = '\0';
 826         strncat(rootpath, blobmsg_get_string(tb[OCI_ROOT_PATH]), PATH_MAX - (strlen(rootpath) + 1));
 827
 828         opts.extroot = rootpath;
 829
 830         opts.ronly = blobmsg_get_bool(tb[OCI_ROOT_READONLY]);
 831
 832         return 0;
 833 }
 834
 835
 836 enum {
 837         OCI_MOUNT_SOURCE,
 838         OCI_MOUNT_DESTINATION,
 839         OCI_MOUNT_TYPE,
 840         OCI_MOUNT_OPTIONS,
 841         __OCI_MOUNT_MAX,
 842 };
 843
 844 static const struct blobmsg_policy oci_mount_policy[] = {
 845         [OCI_MOUNT_SOURCE] = { "source", BLOBMSG_TYPE_STRING },
 846         [OCI_MOUNT_DESTINATION] = { "destination", BLOBMSG_TYPE_STRING },
 847         [OCI_MOUNT_TYPE] = { "type", BLOBMSG_TYPE_STRING },
 848         [OCI_MOUNT_OPTIONS] = { "options", BLOBMSG_TYPE_ARRAY },
 849 };
 850
 851 static int parseOCImount(struct blob_attr *msg)
 852 {
 853         struct blob_attr *tb[__OCI_MOUNT_MAX];
 854
 855         blobmsg_parse(oci_mount_policy, __OCI_MOUNT_MAX, tb, blobmsg_data(msg), blobmsg_len(msg));
 856
 857         if (!tb[OCI_MOUNT_DESTINATION])
 858                 return EINVAL;
 859
 860         if (!strcmp("proc", blobmsg_get_string(tb[OCI_MOUNT_TYPE])) &&
 861             !strcmp("/proc", blobmsg_get_string(tb[OCI_MOUNT_DESTINATION]))) {
 862                 opts.procfs = true;
 863                 return 0;
 864         }
 865
 866         if (!strcmp("sysfs", blobmsg_get_string(tb[OCI_MOUNT_TYPE])) &&
 867             !strcmp("/sys", blobmsg_get_string(tb[OCI_MOUNT_DESTINATION]))) {
 868                 opts.sysfs = true;
 869                 return 0;
 870         }
 871
 872         if (!strcmp("tmpfs", blobmsg_get_string(tb[OCI_MOUNT_TYPE])) &&
 873             !strcmp("/dev", blobmsg_get_string(tb[OCI_MOUNT_DESTINATION]))) {
 874                 /* we always mount a small tmpfs on /dev */
 875                 return 0;
 876         }
 877
 878         INFO("ignoring unsupported mount %s %s -t %s -o %s\n",
 879                 blobmsg_get_string(tb[OCI_MOUNT_SOURCE]),
 880                 blobmsg_get_string(tb[OCI_MOUNT_DESTINATION]),
 881                 blobmsg_get_string(tb[OCI_MOUNT_TYPE]),
 882                 blobmsg_format_json(tb[OCI_MOUNT_OPTIONS], true));
 883
 884         return 0;
 885 };
 886
 887
 888 enum {
 889         OCI_PROCESS_USER_UID,
 890         OCI_PROCESS_USER_GID,
 891         OCI_PROCESS_USER_UMASK,
 892         OCI_PROCESS_USER_ADDITIONALGIDS,
 893         __OCI_PROCESS_USER_MAX,
 894 };
 895
 896 static const struct blobmsg_policy oci_process_user_policy[] = {
 897         [OCI_PROCESS_USER_UID] = { "uid", BLOBMSG_TYPE_INT32 },
 898         [OCI_PROCESS_USER_GID] = { "gid", BLOBMSG_TYPE_INT32 },
 899         [OCI_PROCESS_USER_UMASK] = { "umask", BLOBMSG_TYPE_INT32 },
 900         [OCI_PROCESS_USER_ADDITIONALGIDS] = { "additionalGids", BLOBMSG_TYPE_ARRAY },
 901 };
 902
 903 static int parseOCIprocessuser(struct blob_attr *msg) {
 904         struct blob_attr *tb[__OCI_PROCESS_USER_MAX];
 905
 906         blobmsg_parse(oci_process_user_policy, __OCI_PROCESS_USER_MAX, tb, blobmsg_data(msg), blobmsg_len(msg));
 907
 908         if (tb[OCI_PROCESS_USER_UID])
 909                 opts.pw_uid = blobmsg_get_u32(tb[OCI_PROCESS_USER_UID]);
 910
 911         if (tb[OCI_PROCESS_USER_GID]) {
 912                 opts.pw_gid = blobmsg_get_u32(tb[OCI_PROCESS_USER_GID]);
 913                 opts.gr_gid = blobmsg_get_u32(tb[OCI_PROCESS_USER_GID]);
 914         }
 915
 916         /* ToDo: umask, additional GIDs */
 917
 918         return 0;
 919 }
 920
 921 enum {
 922         OCI_PROCESS_ARGS,
 923         OCI_PROCESS_CAPABILITIES,
 924         OCI_PROCESS_CWD,
 925         OCI_PROCESS_ENV,
 926         OCI_PROCESS_NONEWPRIVILEGES,
 927         OCI_PROCESS_RLIMITS,
 928         OCI_PROCESS_TERMINAL,
 929         OCI_PROCESS_USER,
 930         __OCI_PROCESS_MAX,
 931 };
 932
 933 static const struct blobmsg_policy oci_process_policy[] = {
 934         [OCI_PROCESS_ARGS] = { "args", BLOBMSG_TYPE_ARRAY },
 935         [OCI_PROCESS_CAPABILITIES] = { "capabilities", BLOBMSG_TYPE_TABLE },
 936         [OCI_PROCESS_CWD] = { "cwd", BLOBMSG_TYPE_STRING },
 937         [OCI_PROCESS_ENV] = { "env", BLOBMSG_TYPE_ARRAY },
 938         [OCI_PROCESS_NONEWPRIVILEGES] = { "noNewPrivileges", BLOBMSG_TYPE_BOOL },
 939         [OCI_PROCESS_RLIMITS] = { "rlimits", BLOBMSG_TYPE_ARRAY },
 940         [OCI_PROCESS_TERMINAL] = { "terminal", BLOBMSG_TYPE_BOOL },
 941         [OCI_PROCESS_USER] = { "user", BLOBMSG_TYPE_TABLE },
 942 };
 943
 944 static int parseOCIprocess(struct blob_attr *msg)
 945 {
 946         struct blob_attr *tb[__OCI_PROCESS_MAX];
 947         struct blob_attr *cur;
 948         unsigned int sz = 0;
 949         int rem;
 950         int res;
 951
 952         blobmsg_parse(oci_process_policy, __OCI_PROCESS_MAX, tb, blobmsg_data(msg), blobmsg_len(msg));
 953
 954         if (!tb[OCI_PROCESS_ARGS])
 955                 return ENOENT;
 956
 957         blobmsg_for_each_attr(cur, tb[OCI_PROCESS_ARGS], rem)
 958                 ++sz;
 959
 960         if (!sz)
 961                 return ENODATA;
 962
 963         opts.jail_argv = calloc(1 + sz, sizeof(char*));
 964         if (!opts.jail_argv)
 965                 return ENOMEM;
 966
 967         sz = 0;
 968         blobmsg_for_each_attr(cur, tb[OCI_PROCESS_ARGS], rem)
 969                 opts.jail_argv[sz++] = blobmsg_get_string(cur);
 970
 971         opts.console = blobmsg_get_bool(tb[OCI_PROCESS_TERMINAL]);
 972         opts.no_new_privs = blobmsg_get_bool(tb[OCI_PROCESS_NONEWPRIVILEGES]);
 973
 974         if (tb[OCI_PROCESS_CWD])
 975                 opts.cwd = blobmsg_get_string(tb[OCI_PROCESS_CWD]);
 976
 977         sz = 0;
 978         blobmsg_for_each_attr(cur, tb[OCI_PROCESS_ENV], rem)
 979                 ++sz;
 980
 981         if (sz > 0) {
 982                 opts.envp = calloc(1 + sz, sizeof(char*));
 983                 if (!opts.envp)
 984                         return ENOMEM;
 985         }
 986
 987         sz = 0;
 988         blobmsg_for_each_attr(cur, tb[OCI_PROCESS_ENV], rem)
 989                 opts.envp[sz++] = strdup(blobmsg_get_string(cur));
 990
 991         if (tb[OCI_PROCESS_USER] && (res = parseOCIprocessuser(tb[OCI_PROCESS_USER])))
 992                 return res;
 993
 994         if (tb[OCI_PROCESS_CAPABILITIES] &&
 995             (res = parseOCIcapabilities(&opts.capset, tb[OCI_PROCESS_CAPABILITIES])))
 996                 return res;
 997
 998         /* ToDo: rlimits, capabilities */
 999
1000         return 0;
1001 }
1002
1003 enum {
1004         OCI_LINUX_NAMESPACE_TYPE,
1005         OCI_LINUX_NAMESPACE_PATH,
1006         __OCI_LINUX_NAMESPACE_MAX,
1007 };
1008
1009 static const struct blobmsg_policy oci_linux_namespace_policy[] = {
1010         [OCI_LINUX_NAMESPACE_TYPE] = { "type", BLOBMSG_TYPE_STRING },
1011         [OCI_LINUX_NAMESPACE_PATH] = { "path", BLOBMSG_TYPE_STRING },
1012 };
1013
1014 static unsigned int resolve_nstype(char *type) {
1015         if (!strcmp("pid", type))
1016                 return CLONE_NEWPID;
1017         else if (!strcmp("network", type))
1018                 return CLONE_NEWNET;
1019         else if (!strcmp("mount", type))
1020                 return CLONE_NEWNS;
1021         else if (!strcmp("ipc", type))
1022                 return CLONE_NEWIPC;
1023         else if (!strcmp("uts", type))
1024                 return CLONE_NEWUTS;
1025         else if (!strcmp("user", type))
1026                 return CLONE_NEWUSER;
1027         else if (!strcmp("cgroup", type))
1028                 return CLONE_NEWCGROUP;
1029         else
1030                 return 0;
1031 }
1032
1033 static int parseOCIlinuxns(struct blob_attr *msg)
1034 {
1035         struct blob_attr *tb[__OCI_LINUX_NAMESPACE_MAX];
1036
1037
1038         blobmsg_parse(oci_linux_namespace_policy, __OCI_LINUX_NAMESPACE_MAX, tb, blobmsg_data(msg), blobmsg_len(msg));
1039
1040         if (!tb[OCI_LINUX_NAMESPACE_TYPE])
1041                 return EINVAL;
1042
1043         if (tb[OCI_LINUX_NAMESPACE_PATH])
1044                 return ENOTSUP; /* ToDo */
1045
1046         opts.namespace |= resolve_nstype(blobmsg_get_string(tb[OCI_LINUX_NAMESPACE_TYPE]));
1047
1048         return 0;
1049 };
1050
1051
1052 enum {
1053         OCI_LINUX_UIDGIDMAP_CONTAINERID,
1054         OCI_LINUX_UIDGIDMAP_HOSTID,
1055         OCI_LINUX_UIDGIDMAP_SIZE,
1056         __OCI_LINUX_UIDGIDMAP_MAX,
1057 };
1058
1059 static const struct blobmsg_policy oci_linux_uidgidmap_policy[] = {
1060         [OCI_LINUX_UIDGIDMAP_CONTAINERID] = { "containerID", BLOBMSG_TYPE_INT32 },
1061         [OCI_LINUX_UIDGIDMAP_HOSTID] = { "hostID", BLOBMSG_TYPE_INT32 },
1062         [OCI_LINUX_UIDGIDMAP_SIZE] = { "size", BLOBMSG_TYPE_INT32 },
1063 };
1064
1065 static int parseOCIuidgidmappings(struct blob_attr *msg, bool is_gidmap)
1066 {
1067         const char *map_format = "%d %d %d\n";
1068         struct blob_attr *tb[__OCI_LINUX_UIDGIDMAP_MAX];
1069         struct blob_attr *cur;
1070         int rem, len;
1071         char **mappings;
1072         char *map, *curstr;
1073         unsigned int cnt = 0;
1074         size_t totallen = 0;
1075
1076         /* count number of mappings */
1077         blobmsg_for_each_attr(cur, msg, rem)
1078                 cnt++;
1079
1080         if (!cnt)
1081                 return 0;
1082
1083         /* allocate array for mappings */
1084         mappings = calloc(1 + cnt, sizeof(char*));
1085         if (!mappings)
1086                 return ENOMEM;
1087
1088         mappings[cnt] = NULL;
1089
1090         cnt = 0;
1091         blobmsg_for_each_attr(cur, msg, rem) {
1092                 blobmsg_parse(oci_linux_uidgidmap_policy, __OCI_LINUX_UIDGIDMAP_MAX, tb, blobmsg_data(cur), blobmsg_len(cur));
1093
1094                 if (!tb[OCI_LINUX_UIDGIDMAP_CONTAINERID] ||
1095                     !tb[OCI_LINUX_UIDGIDMAP_HOSTID] ||
1096                     !tb[OCI_LINUX_UIDGIDMAP_SIZE])
1097                         return EINVAL;
1098
1099                 /* write mapping line into allocated string */
1100                 len = asprintf(&mappings[cnt++], map_format,
1101                          blobmsg_get_u32(tb[OCI_LINUX_UIDGIDMAP_CONTAINERID]),
1102                          blobmsg_get_u32(tb[OCI_LINUX_UIDGIDMAP_HOSTID]),
1103                          blobmsg_get_u32(tb[OCI_LINUX_UIDGIDMAP_SIZE]));
1104
1105                 if (len < 0)
1106                         return ENOMEM;
1107
1108                 totallen += len;
1109         }
1110
1111         /* allocate combined mapping string */
1112         map = calloc(1 + totallen, sizeof(char));
1113         if (!map)
1114                 return ENOMEM;
1115
1116         map[0] = '\0';
1117
1118         /* concatenate mapping strings into combined string */
1119         curstr = mappings[0];
1120         while (curstr) {
1121                 strcat(map, curstr);
1122                 free(curstr++);
1123         }
1124         free(mappings);
1125
1126         if (is_gidmap)
1127                 opts.gidmap = map;
1128         else
1129                 opts.uidmap = map;
1130
1131         return 0;
1132 }
1133
1134 enum {
1135         OCI_LINUX_RESOURCES,
1136         OCI_LINUX_SECCOMP,
1137         OCI_LINUX_SYSCTL,
1138         OCI_LINUX_NAMESPACES,
1139         OCI_LINUX_UIDMAPPINGS,
1140         OCI_LINUX_GIDMAPPINGS,
1141         OCI_LINUX_MASKEDPATHS,
1142         OCI_LINUX_READONLYPATHS,
1143         OCI_LINUX_ROOTFSPROPAGATION,
1144         __OCI_LINUX_MAX,
1145 };
1146
1147 static const struct blobmsg_policy oci_linux_policy[] = {
1148         [OCI_LINUX_RESOURCES] = { "resources", BLOBMSG_TYPE_TABLE },
1149         [OCI_LINUX_SECCOMP] = { "seccomp", BLOBMSG_TYPE_TABLE },
1150         [OCI_LINUX_SYSCTL] = { "sysctl", BLOBMSG_TYPE_TABLE },
1151         [OCI_LINUX_NAMESPACES] = { "namespaces", BLOBMSG_TYPE_ARRAY },
1152         [OCI_LINUX_UIDMAPPINGS] = { "uidMappings", BLOBMSG_TYPE_ARRAY },
1153         [OCI_LINUX_GIDMAPPINGS] = { "gidMappings", BLOBMSG_TYPE_ARRAY },
1154         [OCI_LINUX_MASKEDPATHS] = { "maskedPaths", BLOBMSG_TYPE_ARRAY },
1155         [OCI_LINUX_READONLYPATHS] = { "readonlyPaths", BLOBMSG_TYPE_ARRAY },
1156         [OCI_LINUX_ROOTFSPROPAGATION] = { "rootfsPropagation", BLOBMSG_TYPE_STRING },
1157 };
1158
1159 static int parseOCIlinux(struct blob_attr *msg)
1160 {
1161         struct blob_attr *tb[__OCI_LINUX_MAX];
1162         struct blob_attr *cur;
1163         int rem;
1164         int res = 0;
1165
1166         blobmsg_parse(oci_linux_policy, __OCI_LINUX_MAX, tb, blobmsg_data(msg), blobmsg_len(msg));
1167
1168         if (tb[OCI_LINUX_NAMESPACES]) {
1169                 blobmsg_for_each_attr(cur, tb[OCI_LINUX_NAMESPACES], rem) {
1170                         res = parseOCIlinuxns(cur);
1171                         if (res)
1172                                 return res;
1173                 }
1174         }
1175
1176         if (tb[OCI_LINUX_UIDMAPPINGS]) {
1177                 res = parseOCIuidgidmappings(tb[OCI_LINUX_GIDMAPPINGS], 0);
1178                 if (res)
1179                         return res;
1180         }
1181
1182         if (tb[OCI_LINUX_GIDMAPPINGS]) {
1183                 res = parseOCIuidgidmappings(tb[OCI_LINUX_GIDMAPPINGS], 1);
1184                 if (res)
1185                         return res;
1186         }
1187
1188         if (tb[OCI_LINUX_SECCOMP]) {
1189                 opts.ociseccomp = parseOCIlinuxseccomp(tb[OCI_LINUX_SECCOMP]);
1190                 if (!opts.ociseccomp)
1191                         return EINVAL;
1192         }
1193
1194         return 0;
1195 }
1196
1197 enum {
1198         OCI_VERSION,
1199         OCI_HOSTNAME,
1200         OCI_PROCESS,
1201         OCI_ROOT,
1202         OCI_MOUNTS,
1203         OCI_LINUX,
1204         __OCI_MAX,
1205 };
1206
1207 static const struct blobmsg_policy oci_policy[] = {
1208         [OCI_VERSION] = { "ociVersion", BLOBMSG_TYPE_STRING },
1209         [OCI_HOSTNAME] = { "hostname", BLOBMSG_TYPE_STRING },
1210         [OCI_PROCESS] = { "process", BLOBMSG_TYPE_TABLE },
1211         [OCI_ROOT] = { "root", BLOBMSG_TYPE_TABLE },
1212         [OCI_MOUNTS] = { "mounts", BLOBMSG_TYPE_ARRAY },
1213         [OCI_LINUX] = { "linux", BLOBMSG_TYPE_TABLE },
1214 };
1215
1216 static int parseOCI(const char *jsonfile)
1217 {
1218         struct blob_attr *tb[__OCI_MAX];
1219         struct blob_attr *cur;
1220         int rem;
1221         int res;
1222
1223         blob_buf_init(&ocibuf, 0);
1224         if (!blobmsg_add_json_from_file(&ocibuf, jsonfile))
1225                 return ENOENT;
1226
1227         blobmsg_parse(oci_policy, __OCI_MAX, tb, blob_data(ocibuf.head), blob_len(ocibuf.head));
1228
1229         if (!tb[OCI_VERSION])
1230                 return ENOMSG;
1231
1232         if (strncmp("1.0", blobmsg_get_string(tb[OCI_VERSION]), 3)) {
1233                 ERROR("unsupported ociVersion %s\n", blobmsg_get_string(tb[OCI_VERSION]));
1234                 return ENOTSUP;
1235         }
1236
1237         if (tb[OCI_HOSTNAME])
1238                 opts.hostname = blobmsg_get_string(tb[OCI_HOSTNAME]);
1239
1240         if (!tb[OCI_PROCESS])
1241                 return ENODATA;
1242
1243         if ((res = parseOCIprocess(tb[OCI_PROCESS])))
1244                 return res;
1245
1246         if (!tb[OCI_ROOT])
1247                 return ENODATA;
1248
1249         if ((res = parseOCIroot(jsonfile, tb[OCI_ROOT])))
1250                 return res;
1251
1252         if (!tb[OCI_MOUNTS])
1253                 return ENODATA;
1254
1255         blobmsg_for_each_attr(cur, tb[OCI_MOUNTS], rem)
1256                 if ((res = parseOCImount(cur)))
1257                         return res;
1258
1259         if (tb[OCI_LINUX] && (res = parseOCIlinux(tb[OCI_LINUX])))
1260                 return res;
1261
1262         return 0;
1263 }
1264
1265 int main(int argc, char **argv)
1266 {
1267         sigset_t sigmask;
1268         uid_t uid = getuid();
1269         const char log[] = "/dev/log";
1270         const char ubus[] = "/var/run/ubus.sock";
1271         char *jsonfile = NULL;
1272         int ch, i;
1273         int pipes[4];
1274         char sig_buf[1];
1275         int netns_fd;
1276
1277         if (uid) {
1278                 ERROR("not root, aborting: %m\n");
1279                 return EXIT_FAILURE;
1280         }
1281
1282         umask(022);
1283         mount_list_init();
1284         init_library_search();
1285
1286         while ((ch = getopt(argc, argv, OPT_ARGS)) != -1) {
1287                 switch (ch) {
1288                 case 'd':
1289                         debug = atoi(optarg);
1290                         break;
1291                 case 'p':
1292                         opts.namespace |= CLONE_NEWNS;
1293                         opts.procfs = 1;
1294                         break;
1295                 case 'o':
1296                         opts.namespace |= CLONE_NEWNS;
1297                         opts.ronly = 1;
1298                         break;
1299                 case 'f':
1300                         opts.namespace |= CLONE_NEWUSER;
1301                         break;
1302                 case 'F':
1303                         opts.namespace |= CLONE_NEWCGROUP;
1304                         break;
1305                 case 'R':
1306                         opts.extroot = optarg;
1307                         break;
1308                 case 's':
1309                         opts.namespace |= CLONE_NEWNS;
1310                         opts.sysfs = 1;
1311                         break;
1312                 case 'S':
1313                         opts.seccomp = optarg;
1314                         add_mount(optarg, 1, -1);
1315                         break;
1316                 case 'C':
1317                         opts.capabilities = optarg;
1318                         break;
1319                 case 'c':
1320                         opts.no_new_privs = 1;
1321                         break;
1322                 case 'n':
1323                         opts.name = optarg;
1324                         break;
1325                 case 'N':
1326                         opts.namespace |= CLONE_NEWNET;
1327                         break;
1328                 case 'h':
1329                         opts.namespace |= CLONE_NEWUTS;
1330                         opts.hostname = optarg;
1331                         break;
1332                 case 'r':
1333                         opts.namespace |= CLONE_NEWNS;
1334                         add_path_and_deps(optarg, 1, 0, 0);
1335                         break;
1336                 case 'w':
1337                         opts.namespace |= CLONE_NEWNS;
1338                         add_path_and_deps(optarg, 0, 0, 0);
1339                         break;
1340                 case 'u':
1341                         opts.namespace |= CLONE_NEWNS;
1342                         add_mount(ubus, 0, -1);
1343                         break;
1344                 case 'l':
1345                         opts.namespace |= CLONE_NEWNS;
1346                         add_mount(log, 0, -1);
1347                         break;
1348                 case 'U':
1349                         opts.user = optarg;
1350                         break;
1351                 case 'G':
1352                         opts.group = optarg;
1353                         break;
1354                 case 'O':
1355                         opts.overlaydir = optarg;
1356                         break;
1357                 case 'T':
1358                         opts.tmpoverlaysize = optarg;
1359                         break;
1360                 case 'E':
1361                         opts.require_jail = 1;
1362                         break;
1363                 case 'y':
1364                         opts.console = 1;
1365                         break;
1366                 case 'J':
1367                         asprintf(&jsonfile, "%s/config.json", optarg);
1368                         break;
1369                 }
1370         }
1371
1372         if (opts.namespace)
1373                 opts.namespace |= CLONE_NEWIPC | CLONE_NEWPID;
1374
1375         if (jsonfile) {
1376                 int ocires;
1377                 ocires = parseOCI(jsonfile);
1378                 free(jsonfile);
1379                 if (ocires) {
1380                         ERROR("parsing of OCI JSON spec has failed: %s (%d)\n", strerror(ocires), ocires);
1381                         return ocires;
1382                 }
1383         }
1384
1385         if (opts.tmpoverlaysize && strlen(opts.tmpoverlaysize) > 8) {
1386                 ERROR("size parameter too long: \"%s\"\n", opts.tmpoverlaysize);
1387                 return -1;
1388         }
1389
1390         /* no <binary> param found */
1391         if (!jsonfile && (argc - optind < 1)) {
1392                 usage();
1393                 return EXIT_FAILURE;
1394         }
1395         if (!(opts.namespace||opts.capabilities||opts.seccomp)) {
1396                 ERROR("Not using namespaces, capabilities or seccomp !!!\n\n");
1397                 usage();
1398                 return EXIT_FAILURE;
1399         }
1400         DEBUG("Using namespaces(0x%08x), capabilities(%d), seccomp(%d)\n",
1401                 opts.namespace,
1402                 opts.capabilities != 0 || opts.capset.apply,
1403                 opts.seccomp != 0 || opts.ociseccomp != 0);
1404
1405         if (!jsonfile) {
1406                 opts.jail_argv = &argv[optind];
1407                 if (opts.namespace & CLONE_NEWUSER)
1408                         get_jail_user(&opts.pw_uid, &opts.pw_gid, &opts.gr_gid);
1409         }
1410
1411         if (!opts.extroot) {
1412                 if (opts.namespace && add_path_and_deps(*opts.jail_argv, 1, -1, 0)) {
1413                         ERROR("failed to load dependencies\n");
1414                         return -1;
1415                 }
1416         }
1417
1418         if (opts.namespace && opts.seccomp && add_path_and_deps("libpreload-seccomp.so", 1, -1, 1)) {
1419                 ERROR("failed to load libpreload-seccomp.so\n");
1420                 opts.seccomp = 0;
1421                 if (opts.require_jail)
1422                         return -1;
1423         }
1424
1425         if (opts.name)
1426                 prctl(PR_SET_NAME, opts.name, NULL, NULL, NULL);
1427
1428         uloop_init();
1429
1430         sigfillset(&sigmask);
1431         for (i = 0; i < _NSIG; i++) {
1432                 struct sigaction s = { 0 };
1433
1434                 if (!sigismember(&sigmask, i))
1435                         continue;
1436                 if ((i == SIGCHLD) || (i == SIGPIPE) || (i == SIGSEGV))
1437                         continue;
1438
1439                 s.sa_handler = jail_handle_signal;
1440                 sigaction(i, &s, NULL);
1441         }
1442
1443         if (opts.namespace) {
1444                 if (opts.namespace & CLONE_NEWNS) {
1445                         add_mount("/dev/full", 0, -1);
1446                         add_mount("/dev/null", 0, -1);
1447                         add_mount("/dev/random", 0, -1);
1448                         add_mount("/dev/urandom", 0, -1);
1449                         add_mount("/dev/zero", 0, -1);
1450                         add_mount("/dev/ptmx", 0, -1);
1451                         add_mount("/dev/tty", 0, -1);
1452
1453                         if (!opts.extroot && (opts.user || opts.group)) {
1454                                 add_mount("/etc/passwd", 0, -1);
1455                                 add_mount("/etc/group", 0, -1);
1456                         }
1457
1458 #if defined(__GLIBC__)
1459                         if (!opts.extroot)
1460                                 add_mount("/etc/nsswitch.conf", 0, -1);
1461 #endif
1462
1463                         if (!(opts.namespace & CLONE_NEWNET)) {
1464                                 add_mount("/etc/resolv.conf", 0, -1);
1465                         }
1466                 }
1467
1468                 if (pipe(&pipes[0]) < 0 || pipe(&pipes[2]) < 0)
1469                         return -1;
1470
1471                 jail_process.pid = clone(exec_jail, child_stack + STACK_SIZE, SIGCHLD | opts.namespace, &pipes);
1472         } else {
1473                 jail_process.pid = fork();
1474         }
1475
1476         if (jail_process.pid > 0) {
1477                 seteuid(0);
1478                 /* parent process */
1479                 close(pipes[1]);
1480                 close(pipes[2]);
1481                 if (read(pipes[0], sig_buf, 1) < 1) {
1482                         ERROR("can't read from child\n");
1483                         return -1;
1484                 }
1485                 close(pipes[0]);
1486                 if (opts.namespace & CLONE_NEWUSER) {
1487                         if (write_setgroups(jail_process.pid, true)) {
1488                                 ERROR("can't write setgroups\n");
1489                                 return -1;
1490                         }
1491                         if (!opts.uidmap) {
1492                                 bool has_gr = (opts.gr_gid != -1);
1493                                 if (opts.pw_uid != -1) {
1494                                         write_single_uid_gid_map(jail_process.pid, 0, opts.pw_uid);
1495                                         write_single_uid_gid_map(jail_process.pid, 1, has_gr?opts.gr_gid:opts.pw_gid);
1496                                 } else {
1497                                         write_single_uid_gid_map(jail_process.pid, 0, 65534);
1498                                         write_single_uid_gid_map(jail_process.pid, 1, has_gr?opts.gr_gid:65534);
1499                                 }
1500                         } else {
1501                                 write_uid_gid_map(jail_process.pid, 0, opts.uidmap);
1502                                 if (opts.gidmap)
1503                                         write_uid_gid_map(jail_process.pid, 1, opts.gidmap);
1504                         }
1505                 }
1506
1507                 if (opts.namespace & CLONE_NEWNET) {
1508                         if (!opts.name) {
1509                                 ERROR("netns needs a named jail\n");
1510                                 return -1;
1511                         }
1512                         netns_fd = netns_open_pid(jail_process.pid);
1513                         netns_updown(jail_process.pid, true);
1514                 }
1515
1516                 sig_buf[0] = 'O';
1517                 if (write(pipes[3], sig_buf, 1) < 0) {
1518                         ERROR("can't write to child\n");
1519                         return -1;
1520                 }
1521                 close(pipes[3]);
1522                 uloop_process_add(&jail_process);
1523                 uloop_run();
1524                 if (jail_running) {
1525                         DEBUG("uloop interrupted, killing jail process\n");
1526                         kill(jail_process.pid, SIGTERM);
1527                         uloop_timeout_set(&jail_process_timeout, 1000);
1528                         uloop_run();
1529                 }
1530                 uloop_done();
1531                 if (opts.namespace & CLONE_NEWNET) {
1532                         setns(netns_fd, CLONE_NEWNET);
1533                         netns_updown(getpid(), false);
1534                         close(netns_fd);
1535                 }
1536                 return jail_return_code;
1537         } else if (jail_process.pid == 0) {
1538                 /* fork child process */
1539                 return exec_jail(NULL);
1540         } else {
1541                 ERROR("failed to clone/fork: %m\n");
1542                 return EXIT_FAILURE;
1543         }
1544 }