jail/jail.c

   1 /*
   2  * Copyright (C) 2015 John Crispin <blogic@openwrt.org>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU Lesser General Public License version 2.1
   6  * as published by the Free Software Foundation
   7  *
   8  * This program is distributed in the hope that it will be useful,
   9  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  11  * GNU General Public License for more details.
  12  */
  13
  14 #define _GNU_SOURCE
  15 #include <sys/mount.h>
  16 #include <sys/prctl.h>
  17 #include <sys/wait.h>
  18 #include <sys/types.h>
  19
  20 #include <stdlib.h>
  21 #include <unistd.h>
  22 #include <errno.h>
  23 #include <pwd.h>
  24 #include <grp.h>
  25 #include <string.h>
  26 #include <sys/stat.h>
  27 #include <fcntl.h>
  28 #include <libgen.h>
  29 #include <sched.h>
  30 #include <linux/limits.h>
  31 #include <signal.h>
  32
  33 #include "capabilities.h"
  34 #include "elf.h"
  35 #include "fs.h"
  36 #include "jail.h"
  37 #include "log.h"
  38
  39 #include <libubox/uloop.h>
  40 #include <libubus.h>
  41
  42 #define STACK_SIZE      (1024 * 1024)
  43 #define OPT_ARGS        "S:C:n:h:r:w:d:psulocU:G:NR:fFO:T:"
  44
  45 static struct {
  46         char *name;
  47         char *hostname;
  48         char **jail_argv;
  49         char *seccomp;
  50         char *capabilities;
  51         char *user;
  52         char *group;
  53         char *extroot;
  54         char *overlaydir;
  55         char *tmpoverlaysize;
  56         int no_new_privs;
  57         int namespace;
  58         int procfs;
  59         int ronly;
  60         int sysfs;
  61         int pw_uid;
  62         int pw_gid;
  63         int gr_gid;
  64 } opts;
  65
  66
  67 extern int pivot_root(const char *new_root, const char *put_old);
  68
  69 int debug = 0;
  70
  71 static char child_stack[STACK_SIZE];
  72
  73 static int mkdir_p(char *dir, mode_t mask)
  74 {
  75         char *l = strrchr(dir, '/');
  76         int ret;
  77
  78         if (!l)
  79                 return 0;
  80
  81         *l = '\0';
  82
  83         if (mkdir_p(dir, mask))
  84                 return -1;
  85
  86         *l = '/';
  87
  88         ret = mkdir(dir, mask);
  89         if (ret && errno == EEXIST)
  90                 return 0;
  91
  92         if (ret)
  93                 ERROR("mkdir(%s, %d) failed: %m\n", dir, mask);
  94
  95         return ret;
  96 }
  97
  98 static int _mount_bind(const char *root, const char *path, const char *target, int readonly, int strict, int error)
  99 {
 100         struct stat s;
 101         char new[PATH_MAX];
 102         int fd;
 103         int remount_flags = MS_BIND | MS_REMOUNT;
 104
 105         if (stat(path, &s)) {
 106                 ERROR("stat(%s) failed: %m\n", path);
 107                 return error;
 108         }
 109
 110         snprintf(new, sizeof(new), "%s%s", root, target?target:path);
 111
 112         if (S_ISDIR(s.st_mode)) {
 113                 mkdir_p(new, 0755);
 114         } else {
 115                 mkdir_p(dirname(new), 0755);
 116                 snprintf(new, sizeof(new), "%s%s", root, target?target:path);
 117                 fd = creat(new, 0644);
 118                 if (fd == -1) {
 119                         ERROR("creat(%s) failed: %m\n", new);
 120                         return -1;
 121                 }
 122                 close(fd);
 123         }
 124
 125         if (mount(path, new, NULL, MS_BIND, NULL)) {
 126                 ERROR("failed to mount -B %s %s: %m\n", path, new);
 127                 return -1;
 128         }
 129
 130         if (readonly)
 131                 remount_flags |= MS_RDONLY;
 132
 133         if (strict)
 134                 remount_flags |= MS_NOEXEC | MS_NOSUID | MS_NODEV;
 135
 136         if ((strict || readonly) && mount(NULL, new, NULL, remount_flags, NULL)) {
 137                 ERROR("failed to remount (%s%s%s) %s: %m\n", readonly?"ro":"rw",
 138                       (readonly && strict)?", ":"", strict?"strict":"", new);
 139                 return -1;
 140         }
 141
 142         DEBUG("mount -B %s %s (%s%s%s)\n", path, new,
 143               readonly?"ro":"rw", (readonly && strict)?", ":"", strict?"strict":"");
 144
 145         return 0;
 146 }
 147
 148 int mount_bind(const char *root, const char *path, int readonly, int error) {
 149         return _mount_bind(root, path, NULL, readonly, 0, error);
 150 }
 151
 152 static int mount_overlay(char *jail_root, char *overlaydir) {
 153         char *upperdir, *workdir, *optsstr;
 154         const char mountoptsformat[] = "lowerdir=%s,upperdir=%s,workdir=%s";
 155         int ret = -1;
 156
 157         if (asprintf(&upperdir, "%s%s", overlaydir, "/upper") < 0)
 158                 goto out;
 159
 160         if (asprintf(&workdir, "%s%s", overlaydir, "/work") < 0)
 161                 goto upper_printf;
 162
 163         if (asprintf(&optsstr, mountoptsformat, jail_root, upperdir, workdir) < 0)
 164                 goto work_printf;
 165
 166         if (mkdir_p(upperdir, 0755) || mkdir_p(workdir, 0755))
 167                 goto opts_printf;
 168
 169         DEBUG("mount -t overlay %s %s (%s)\n", jail_root, jail_root, optsstr);
 170
 171         if (mount(jail_root, jail_root, "overlay", MS_NOATIME, optsstr))
 172                 goto opts_printf;
 173
 174         ret = 0;
 175
 176 opts_printf:
 177         free(optsstr);
 178 work_printf:
 179         free(workdir);
 180 upper_printf:
 181         free(upperdir);
 182 out:
 183         return ret;
 184 }
 185
 186 static int build_jail_fs(void)
 187 {
 188         char jail_root[] = "/tmp/ujail-XXXXXX";
 189         char tmpovdir[] = "/tmp/ujail-overlay-XXXXXX";
 190         char tmpdevdir[] = "/tmp/ujail-XXXXXX/dev";
 191         char *overlaydir = NULL;
 192
 193         if (mkdtemp(jail_root) == NULL) {
 194                 ERROR("mkdtemp(%s) failed: %m\n", jail_root);
 195                 return -1;
 196         }
 197
 198         /* oldroot can't be MS_SHARED else pivot_root() fails */
 199         if (mount("none", "/", NULL, MS_REC|MS_PRIVATE, NULL)) {
 200                 ERROR("private mount failed %m\n");
 201                 return -1;
 202         }
 203
 204         if (opts.extroot) {
 205                 if (mount(opts.extroot, jail_root, NULL, MS_BIND, NULL)) {
 206                         ERROR("extroot mount failed %m\n");
 207                         return -1;
 208                 }
 209         } else {
 210                 if (mount("tmpfs", jail_root, "tmpfs", MS_NOATIME, "mode=0755")) {
 211                         ERROR("tmpfs mount failed %m\n");
 212                         return -1;
 213                 }
 214         }
 215
 216         if (opts.tmpoverlaysize) {
 217                 char mountoptsstr[] = "mode=0755,size=XXXXXXXX";
 218
 219                 snprintf(mountoptsstr, sizeof(mountoptsstr),
 220                          "mode=0755,size=%s", opts.tmpoverlaysize);
 221                 if (mkdtemp(tmpovdir) == NULL) {
 222                         ERROR("mkdtemp(%s) failed: %m\n", jail_root);
 223                         return -1;
 224                 }
 225                 if (mount("tmpfs", tmpovdir, "tmpfs", MS_NOATIME,
 226                           mountoptsstr)) {
 227                         ERROR("failed to mount tmpfs for overlay (size=%s)\n", opts.tmpoverlaysize);
 228                         return -1;
 229                 }
 230                 overlaydir = tmpovdir;
 231         }
 232
 233         if (opts.overlaydir)
 234                 overlaydir = opts.overlaydir;
 235
 236         if (overlaydir)
 237                 mount_overlay(jail_root, overlaydir);
 238
 239         if (chdir(jail_root)) {
 240                 ERROR("chdir(%s) (jail_root) failed: %m\n", jail_root);
 241                 return -1;
 242         }
 243
 244         snprintf(tmpdevdir, sizeof(tmpdevdir), "%s/dev", jail_root);
 245         mkdir_p(tmpdevdir, 0755);
 246         if (mount(NULL, tmpdevdir, "tmpfs", MS_NOATIME | MS_NOEXEC | MS_NOSUID, "size=1M"))
 247                 return -1;
 248
 249         if (mount_all(jail_root)) {
 250                 ERROR("mount_all() failed\n");
 251                 return -1;
 252         }
 253
 254         if (opts.namespace & CLONE_NEWNET) {
 255                 char hostdir[PATH_MAX], jailetc[PATH_MAX], jaillink[PATH_MAX];
 256
 257                 snprintf(hostdir, PATH_MAX, "/tmp/resolv.conf-%s.d", opts.name);
 258                 mkdir_p(hostdir, 0755);
 259                 _mount_bind(jail_root, hostdir, "/tmp/resolv.conf.d", 1, 1, -1);
 260                 snprintf(jailetc, PATH_MAX, "%s/etc", jail_root);
 261                 mkdir_p(jailetc, 0755);
 262                 snprintf(jaillink, PATH_MAX, "%s/etc/resolv.conf", jail_root);
 263                 if (overlaydir)
 264                         unlink(jaillink);
 265                 symlink("../tmp/resolv.conf.d/resolv.conf.auto", jaillink);
 266         }
 267
 268         char dirbuf[sizeof(jail_root) + 4];
 269         snprintf(dirbuf, sizeof(dirbuf), "%s/old", jail_root);
 270         mkdir(dirbuf, 0755);
 271
 272         if (pivot_root(jail_root, dirbuf) == -1) {
 273                 ERROR("pivot_root(%s, %s) failed: %m\n", jail_root, dirbuf);
 274                 return -1;
 275         }
 276         if (chdir("/")) {
 277                 ERROR("chdir(/) (after pivot_root) failed: %m\n");
 278                 return -1;
 279         }
 280
 281         snprintf(dirbuf, sizeof(dirbuf), "/old%s", jail_root);
 282         umount2(dirbuf, MNT_DETACH);
 283         rmdir(dirbuf);
 284         if (opts.tmpoverlaysize) {
 285                 char tmpdirbuf[sizeof(tmpovdir) + 4];
 286                 snprintf(tmpdirbuf, sizeof(tmpdirbuf), "/old%s", tmpovdir);
 287                 umount2(tmpdirbuf, MNT_DETACH);
 288                 rmdir(tmpdirbuf);
 289         }
 290
 291         umount2("/old", MNT_DETACH);
 292         rmdir("/old");
 293
 294         if (opts.procfs) {
 295                 mkdir("/proc", 0755);
 296                 mount("proc", "/proc", "proc", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, 0);
 297                 /*
 298                  * make /proc/sys read-only while keeping read-write to
 299                  * /proc/sys/net if CLONE_NEWNET is set.
 300                  */
 301                 if (opts.namespace & CLONE_NEWNET)
 302                         mount("/proc/sys/net", "/proc/self/net", NULL, MS_BIND, 0);
 303
 304                 mount("/proc/sys", "/proc/sys", NULL, MS_BIND, 0);
 305                 mount(NULL, "/proc/sys", NULL, MS_REMOUNT | MS_RDONLY, 0);
 306                 mount(NULL, "/proc", NULL, MS_REMOUNT, 0);
 307
 308                 if (opts.namespace & CLONE_NEWNET)
 309                         mount("/proc/self/net", "/proc/sys/net", NULL, MS_MOVE, 0);
 310         }
 311         if (opts.sysfs) {
 312                 mkdir("/sys", 0755);
 313                 mount("sysfs", "/sys", "sysfs", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID | MS_RDONLY, 0);
 314         }
 315         if (opts.ronly)
 316                 mount(NULL, "/", NULL, MS_RDONLY | MS_REMOUNT, 0);
 317
 318         return 0;
 319 }
 320
 321 static int write_uid_gid_map(pid_t child_pid, bool gidmap, int id)
 322 {
 323         int map_file;
 324         char map_path[64];
 325         const char *map_format = "%d %d %d\n";
 326         if (snprintf(map_path, sizeof(map_path), "/proc/%d/%s",
 327                 child_pid, gidmap?"gid_map":"uid_map") < 0)
 328                 return -1;
 329
 330         if ((map_file = open(map_path, O_WRONLY)) == -1)
 331                 return -1;
 332
 333         if (dprintf(map_file, map_format, 0, id, 1) == -1) {
 334                 close(map_file);
 335                 return -1;
 336         }
 337
 338         close(map_file);
 339         return 0;
 340 }
 341
 342 static int write_setgroups(pid_t child_pid, bool allow)
 343 {
 344         int setgroups_file;
 345         char setgroups_path[64];
 346
 347         if (snprintf(setgroups_path, sizeof(setgroups_path), "/proc/%d/setgroups",
 348                 child_pid) < 0) {
 349                 return -1;
 350         }
 351
 352         if ((setgroups_file = open(setgroups_path, O_WRONLY)) == -1) {
 353                 return -1;
 354         }
 355
 356         if (dprintf(setgroups_file, allow?"allow":"deny") == -1) {
 357                 close(setgroups_file);
 358                 return -1;
 359         }
 360
 361         close(setgroups_file);
 362         return 0;
 363 }
 364
 365 static void get_jail_user(int *user, int *user_gid, int *gr_gid)
 366 {
 367         struct passwd *p = NULL;
 368         struct group *g = NULL;
 369
 370         if (opts.user) {
 371                 p = getpwnam(opts.user);
 372                 if (!p) {
 373                         ERROR("failed to get uid/gid for user %s: %d (%s)\n",
 374                               opts.user, errno, strerror(errno));
 375                         exit(EXIT_FAILURE);
 376                 }
 377                 *user = p->pw_uid;
 378                 *user_gid = p->pw_gid;
 379         } else {
 380                 *user = -1;
 381                 *user_gid = -1;
 382         }
 383
 384         if (opts.group) {
 385                 g = getgrnam(opts.group);
 386                 if (!g) {
 387                         ERROR("failed to get gid for group %s: %m\n", opts.group);
 388                         exit(EXIT_FAILURE);
 389                 }
 390                 *gr_gid = g->gr_gid;
 391         } else {
 392                 *gr_gid = -1;
 393         }
 394 };
 395
 396 static void set_jail_user(int pw_uid, int user_gid, int gr_gid)
 397 {
 398         if ((user_gid != -1) && initgroups(opts.user, user_gid)) {
 399                 ERROR("failed to initgroups() for user %s: %m\n", opts.user);
 400                 exit(EXIT_FAILURE);
 401         }
 402
 403         if ((gr_gid != -1) && setregid(gr_gid, gr_gid)) {
 404                 ERROR("failed to set group id %d: %m\n", gr_gid);
 405                 exit(EXIT_FAILURE);
 406         }
 407
 408         if ((pw_uid != -1) && setreuid(pw_uid, pw_uid)) {
 409                 ERROR("failed to set user id %d: %m\n", pw_uid);
 410                 exit(EXIT_FAILURE);
 411         }
 412 }
 413
 414 #define MAX_ENVP        8
 415 static char** build_envp(const char *seccomp)
 416 {
 417         static char *envp[MAX_ENVP];
 418         static char preload_var[PATH_MAX];
 419         static char seccomp_var[PATH_MAX];
 420         static char debug_var[] = "LD_DEBUG=all";
 421         static char container_var[] = "container=ujail";
 422         const char *preload_lib = find_lib("libpreload-seccomp.so");
 423         int count = 0;
 424
 425         if (seccomp && !preload_lib) {
 426                 ERROR("failed to add preload-lib to env\n");
 427                 return NULL;
 428         }
 429         if (seccomp) {
 430                 snprintf(seccomp_var, sizeof(seccomp_var), "SECCOMP_FILE=%s", seccomp);
 431                 envp[count++] = seccomp_var;
 432                 snprintf(preload_var, sizeof(preload_var), "LD_PRELOAD=%s", preload_lib);
 433                 envp[count++] = preload_var;
 434         }
 435
 436         envp[count++] = container_var;
 437
 438         if (debug > 1)
 439                 envp[count++] = debug_var;
 440
 441         return envp;
 442 }
 443
 444 static void usage(void)
 445 {
 446         fprintf(stderr, "ujail <options> -- <binary> <params ...>\n");
 447         fprintf(stderr, "  -d <num>\tshow debug log (increase num to increase verbosity)\n");
 448         fprintf(stderr, "  -S <file>\tseccomp filter config\n");
 449         fprintf(stderr, "  -C <file>\tcapabilities drop config\n");
 450         fprintf(stderr, "  -c\t\tset PR_SET_NO_NEW_PRIVS\n");
 451         fprintf(stderr, "  -n <name>\tthe name of the jail\n");
 452         fprintf(stderr, "namespace jail options:\n");
 453         fprintf(stderr, "  -h <hostname>\tchange the hostname of the jail\n");
 454         fprintf(stderr, "  -N\t\tjail has network namespace\n");
 455         fprintf(stderr, "  -f\t\tjail has user namespace\n");
 456         fprintf(stderr, "  -F\t\tjail has cgroups namespace\n");
 457         fprintf(stderr, "  -r <file>\treadonly files that should be staged\n");
 458         fprintf(stderr, "  -w <file>\twriteable files that should be staged\n");
 459         fprintf(stderr, "  -p\t\tjail has /proc\n");
 460         fprintf(stderr, "  -s\t\tjail has /sys\n");
 461         fprintf(stderr, "  -l\t\tjail has /dev/log\n");
 462         fprintf(stderr, "  -u\t\tjail has a ubus socket\n");
 463         fprintf(stderr, "  -U <name>\tuser to run jailed process\n");
 464         fprintf(stderr, "  -G <name>\tgroup to run jailed process\n");
 465         fprintf(stderr, "  -o\t\tremont jail root (/) read only\n");
 466         fprintf(stderr, "  -R <dir>\texternal jail rootfs (system container)\n");
 467         fprintf(stderr, "  -O <dir>\tdirectory for r/w overlayfs\n");
 468         fprintf(stderr, "  -T <size>\tuse tmpfs r/w overlayfs with <size>\n");
 469         fprintf(stderr, "\nWarning: by default root inside the jail is the same\n\
 470 and he has the same powers as root outside the jail,\n\
 471 thus he can escape the jail and/or break stuff.\n\
 472 Please use seccomp/capabilities (-S/-C) to restrict his powers\n\n\
 473 If you use none of the namespace jail options,\n\
 474 ujail will not use namespace/build a jail,\n\
 475 and will only drop capabilities/apply seccomp filter.\n\n");
 476 }
 477
 478 static int exec_jail(void *pipes_ptr)
 479 {
 480         int *pipes = (int*)pipes_ptr;
 481         char buf[1];
 482         int pw_uid, pw_gid, gr_gid;
 483
 484         close(pipes[0]);
 485         close(pipes[3]);
 486
 487
 488         buf[0] = 'i';
 489         if (write(pipes[1], buf, 1) < 1) {
 490                 ERROR("can't write to parent\n");
 491                 exit(EXIT_FAILURE);
 492         }
 493         if (read(pipes[2], buf, 1) < 1) {
 494                 ERROR("can't read from parent\n");
 495                 exit(EXIT_FAILURE);
 496         }
 497         if (buf[0] != 'O') {
 498                 ERROR("parent had an error, child exiting\n");
 499                 exit(EXIT_FAILURE);
 500         }
 501
 502         close(pipes[1]);
 503         close(pipes[2]);
 504
 505         if (opts.namespace & CLONE_NEWUSER) {
 506                 if (setgid(0) < 0) {
 507                         ERROR("setgid\n");
 508                         exit(EXIT_FAILURE);
 509                 }
 510                 if (setuid(0) < 0) {
 511                         ERROR("setuid\n");
 512                         exit(EXIT_FAILURE);
 513                 }
 514 //              if (setgroups(0, NULL) < 0) {
 515 //                      ERROR("setgroups\n");
 516 //                      exit(EXIT_FAILURE);
 517 //              }
 518         }
 519
 520         if (opts.namespace && opts.hostname && strlen(opts.hostname) > 0
 521                         && sethostname(opts.hostname, strlen(opts.hostname))) {
 522                 ERROR("sethostname(%s) failed: %m\n", opts.hostname);
 523                 exit(EXIT_FAILURE);
 524         }
 525
 526         if ((opts.namespace & CLONE_NEWNS) && build_jail_fs()) {
 527                 ERROR("failed to build jail fs\n");
 528                 exit(EXIT_FAILURE);
 529         }
 530
 531         if (opts.capabilities && drop_capabilities(opts.capabilities))
 532                 exit(EXIT_FAILURE);
 533
 534         if (opts.no_new_privs && prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
 535                 ERROR("prctl(PR_SET_NO_NEW_PRIVS) failed: %m\n");
 536                 exit(EXIT_FAILURE);
 537         }
 538
 539         if (!(opts.namespace & CLONE_NEWUSER)) {
 540                 get_jail_user(&pw_uid, &pw_gid, &gr_gid);
 541                 set_jail_user(pw_uid, pw_gid, gr_gid);
 542         }
 543
 544         char **envp = build_envp(opts.seccomp);
 545         if (!envp)
 546                 exit(EXIT_FAILURE);
 547
 548         INFO("exec-ing %s\n", *opts.jail_argv);
 549         execve(*opts.jail_argv, opts.jail_argv, envp);
 550         /* we get there only if execve fails */
 551         ERROR("failed to execve %s: %m\n", *opts.jail_argv);
 552         exit(EXIT_FAILURE);
 553 }
 554
 555 static int jail_running = 1;
 556 static int jail_return_code = 0;
 557
 558 static void jail_process_timeout_cb(struct uloop_timeout *t);
 559 static struct uloop_timeout jail_process_timeout = {
 560         .cb = jail_process_timeout_cb,
 561 };
 562
 563 static void jail_process_handler(struct uloop_process *c, int ret)
 564 {
 565         uloop_timeout_cancel(&jail_process_timeout);
 566         if (WIFEXITED(ret)) {
 567                 jail_return_code = WEXITSTATUS(ret);
 568                 INFO("jail (%d) exited with exit: %d\n", c->pid, jail_return_code);
 569         } else {
 570                 jail_return_code = WTERMSIG(ret);
 571                 INFO("jail (%d) exited with signal: %d\n", c->pid, jail_return_code);
 572         }
 573         jail_running = 0;
 574         uloop_end();
 575 }
 576
 577 static struct uloop_process jail_process = {
 578         .cb = jail_process_handler,
 579 };
 580
 581 static void jail_process_timeout_cb(struct uloop_timeout *t)
 582 {
 583         DEBUG("jail process failed to stop, sending SIGKILL\n");
 584         kill(jail_process.pid, SIGKILL);
 585 }
 586
 587 static void jail_handle_signal(int signo)
 588 {
 589         DEBUG("forwarding signal %d to the jailed process\n", signo);
 590         kill(jail_process.pid, signo);
 591 }
 592
 593 static int netns_open_pid(const pid_t target_ns)
 594 {
 595         char pid_net_path[PATH_MAX];
 596
 597         snprintf(pid_net_path, sizeof(pid_net_path), "/proc/%u/ns/net", target_ns);
 598
 599         return open(pid_net_path, O_RDONLY);
 600 }
 601
 602 static void netns_updown(pid_t pid, bool start)
 603 {
 604         struct ubus_context *ctx = ubus_connect(NULL);
 605         static struct blob_buf req;
 606         uint32_t id;
 607
 608         if (!ctx)
 609                 return;
 610
 611         blob_buf_init(&req, 0);
 612         blobmsg_add_string(&req, "jail", opts.name);
 613         blobmsg_add_u32(&req, "pid", pid);
 614         blobmsg_add_u8(&req, "start", start);
 615
 616         if (ubus_lookup_id(ctx, "network", &id) ||
 617             ubus_invoke(ctx, id, "netns_updown", req.head, NULL, NULL, 3000))
 618                 INFO("ubus request failed\n");
 619
 620         blob_buf_free(&req);
 621         ubus_free(ctx);
 622 }
 623
 624 int main(int argc, char **argv)
 625 {
 626         sigset_t sigmask;
 627         uid_t uid = getuid();
 628         char log[] = "/dev/log";
 629         char ubus[] = "/var/run/ubus.sock";
 630         int ch, i;
 631         int pipes[4];
 632         char sig_buf[1];
 633         int netns_fd;
 634
 635         if (uid) {
 636                 ERROR("not root, aborting: %m\n");
 637                 return EXIT_FAILURE;
 638         }
 639
 640         umask(022);
 641         mount_list_init();
 642         init_library_search();
 643
 644         while ((ch = getopt(argc, argv, OPT_ARGS)) != -1) {
 645                 switch (ch) {
 646                 case 'd':
 647                         debug = atoi(optarg);
 648                         break;
 649                 case 'p':
 650                         opts.namespace |= CLONE_NEWNS;
 651                         opts.procfs = 1;
 652                         break;
 653                 case 'o':
 654                         opts.namespace |= CLONE_NEWNS;
 655                         opts.ronly = 1;
 656                         break;
 657                 case 'f':
 658                         opts.namespace |= CLONE_NEWUSER;
 659                         break;
 660                 case 'F':
 661                         opts.namespace |= CLONE_NEWCGROUP;
 662                         break;
 663                 case 'R':
 664                         opts.extroot = optarg;
 665                         break;
 666                 case 's':
 667                         opts.namespace |= CLONE_NEWNS;
 668                         opts.sysfs = 1;
 669                         break;
 670                 case 'S':
 671                         opts.seccomp = optarg;
 672                         add_mount(optarg, 1, -1);
 673                         break;
 674                 case 'C':
 675                         opts.capabilities = optarg;
 676                         break;
 677                 case 'c':
 678                         opts.no_new_privs = 1;
 679                         break;
 680                 case 'n':
 681                         opts.name = optarg;
 682                         break;
 683                 case 'N':
 684                         opts.namespace |= CLONE_NEWNET;
 685                         break;
 686                 case 'h':
 687                         opts.namespace |= CLONE_NEWUTS;
 688                         opts.hostname = optarg;
 689                         break;
 690                 case 'r':
 691                         opts.namespace |= CLONE_NEWNS;
 692                         add_path_and_deps(optarg, 1, 0, 0);
 693                         break;
 694                 case 'w':
 695                         opts.namespace |= CLONE_NEWNS;
 696                         add_path_and_deps(optarg, 0, 0, 0);
 697                         break;
 698                 case 'u':
 699                         opts.namespace |= CLONE_NEWNS;
 700                         add_mount(ubus, 0, -1);
 701                         break;
 702                 case 'l':
 703                         opts.namespace |= CLONE_NEWNS;
 704                         add_mount(log, 0, -1);
 705                         break;
 706                 case 'U':
 707                         opts.user = optarg;
 708                         break;
 709                 case 'G':
 710                         opts.group = optarg;
 711                         break;
 712                 case 'O':
 713                         opts.overlaydir = optarg;
 714                         break;
 715                 case 'T':
 716                         opts.tmpoverlaysize = optarg;
 717                         break;
 718                 }
 719         }
 720
 721         if (opts.namespace)
 722                 opts.namespace |= CLONE_NEWIPC | CLONE_NEWPID;
 723
 724         if (opts.tmpoverlaysize && strlen(opts.tmpoverlaysize) > 8) {
 725                 ERROR("size parameter too long: \"%s\"\n", opts.tmpoverlaysize);
 726                 return -1;
 727         }
 728
 729         /* no <binary> param found */
 730         if (argc - optind < 1) {
 731                 usage();
 732                 return EXIT_FAILURE;
 733         }
 734         if (!(opts.namespace||opts.capabilities||opts.seccomp)) {
 735                 ERROR("Not using namespaces, capabilities or seccomp !!!\n\n");
 736                 usage();
 737                 return EXIT_FAILURE;
 738         }
 739         DEBUG("Using namespaces(0x%08x), capabilities(%d), seccomp(%d)\n",
 740                 opts.namespace,
 741                 opts.capabilities != 0,
 742                 opts.seccomp != 0);
 743
 744         opts.jail_argv = &argv[optind];
 745
 746         get_jail_user(&opts.pw_uid, &opts.pw_gid, &opts.gr_gid);
 747
 748         if (!opts.extroot) {
 749                 if (opts.namespace && add_path_and_deps(*opts.jail_argv, 1, -1, 0)) {
 750                         ERROR("failed to load dependencies\n");
 751                         return -1;
 752                 }
 753         }
 754
 755         if (opts.namespace && opts.seccomp && add_path_and_deps("libpreload-seccomp.so", 1, -1, 1)) {
 756                 ERROR("failed to load libpreload-seccomp.so\n");
 757                 return -1;
 758         }
 759
 760         if (opts.name)
 761                 prctl(PR_SET_NAME, opts.name, NULL, NULL, NULL);
 762
 763         uloop_init();
 764
 765         sigfillset(&sigmask);
 766         for (i = 0; i < _NSIG; i++) {
 767                 struct sigaction s = { 0 };
 768
 769                 if (!sigismember(&sigmask, i))
 770                         continue;
 771                 if ((i == SIGCHLD) || (i == SIGPIPE))
 772                         continue;
 773
 774                 s.sa_handler = jail_handle_signal;
 775                 sigaction(i, &s, NULL);
 776         }
 777
 778         if (opts.namespace) {
 779                 if (opts.namespace & CLONE_NEWNS) {
 780                         add_mount("/dev/full", 0, -1);
 781                         add_mount("/dev/null", 0, -1);
 782                         add_mount("/dev/random", 0, -1);
 783                         add_mount("/dev/urandom", 0, -1);
 784                         add_mount("/dev/tty", 0, -1);
 785                         add_mount("/dev/zero", 0, -1);
 786                         add_mount("/dev/console", 0, -1);
 787
 788                         if (!opts.extroot && (opts.user || opts.group)) {
 789                                 add_mount("/etc/passwd", 0, -1);
 790                                 add_mount("/etc/group", 0, -1);
 791                         }
 792
 793 #if defined(__GLIBC__)
 794                         if (!opts.extroot)
 795                                 add_mount("/etc/nsswitch.conf", 0, -1);
 796 #endif
 797
 798                         if (!(opts.namespace & CLONE_NEWNET)) {
 799                                 add_mount("/etc/resolv.conf", 0, -1);
 800                         }
 801                 }
 802
 803                 if (pipe(&pipes[0]) < 0 || pipe(&pipes[2]) < 0)
 804                         return -1;
 805
 806                 jail_process.pid = clone(exec_jail, child_stack + STACK_SIZE, SIGCHLD | opts.namespace, &pipes);
 807         } else {
 808                 jail_process.pid = fork();
 809         }
 810
 811         if (jail_process.pid > 0) {
 812                 seteuid(0);
 813                 /* parent process */
 814                 close(pipes[1]);
 815                 close(pipes[2]);
 816                 if (read(pipes[0], sig_buf, 1) < 1) {
 817                         ERROR("can't read from child\n");
 818                         return -1;
 819                 }
 820                 close(pipes[0]);
 821                 if (opts.namespace & CLONE_NEWUSER) {
 822                         bool has_gr = (opts.gr_gid != -1);
 823                         if (write_setgroups(jail_process.pid, false)) {
 824                                 ERROR("can't write setgroups\n");
 825                                 return -1;
 826                         }
 827                         if (opts.pw_uid != -1) {
 828                                 write_uid_gid_map(jail_process.pid, 0, opts.pw_uid);
 829                                 write_uid_gid_map(jail_process.pid, 1, has_gr?opts.gr_gid:opts.pw_gid);
 830                         } else {
 831                                 write_uid_gid_map(jail_process.pid, 0, 65534);
 832                                 write_uid_gid_map(jail_process.pid, 1, has_gr?opts.gr_gid:65534);
 833                         }
 834                 }
 835
 836                 if (opts.namespace & CLONE_NEWNET) {
 837                         netns_fd = netns_open_pid(jail_process.pid);
 838                         netns_updown(jail_process.pid, true);
 839                 }
 840
 841                 sig_buf[0] = 'O';
 842                 if (write(pipes[3], sig_buf, 1) < 0) {
 843                         ERROR("can't write to child\n");
 844                         return -1;
 845                 }
 846                 close(pipes[3]);
 847                 uloop_process_add(&jail_process);
 848                 uloop_run();
 849                 if (jail_running) {
 850                         DEBUG("uloop interrupted, killing jail process\n");
 851                         kill(jail_process.pid, SIGTERM);
 852                         uloop_timeout_set(&jail_process_timeout, 1000);
 853                         uloop_run();
 854                 }
 855                 uloop_done();
 856                 if (opts.namespace & CLONE_NEWNET) {
 857                         setns(netns_fd, CLONE_NEWNET);
 858                         netns_updown(getpid(), false);
 859                         close(netns_fd);
 860                 }
 861                 return jail_return_code;
 862         } else if (jail_process.pid == 0) {
 863                 /* fork child process */
 864                 return exec_jail(NULL);
 865         } else {
 866                 ERROR("failed to clone/fork: %m\n");
 867                 return EXIT_FAILURE;
 868         }
 869 }