jail/jail.c

   1 /*
   2  * Copyright (C) 2015 John Crispin <blogic@openwrt.org>
   3  * Copyright (C) 2020 Daniel Golle <daniel@makrotopia.org>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU Lesser General Public License version 2.1
   7  * as published by the Free Software Foundation
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  */
  14
  15 #define _GNU_SOURCE
  16 #include <sys/mount.h>
  17 #include <sys/prctl.h>
  18 #include <sys/wait.h>
  19 #include <sys/types.h>
  20 #include <sys/time.h>
  21 #include <sys/resource.h>
  22 #include <sys/stat.h>
  23 #include <sys/sysmacros.h>
  24
  25 /* musl only defined 15 limit types, make sure all 16 are supported */
  26 #ifndef RLIMIT_RTTIME
  27 #define RLIMIT_RTTIME 15
  28 #undef RLIMIT_NLIMITS
  29 #define RLIMIT_NLIMITS 16
  30 #undef RLIM_NLIMITS
  31 #define RLIM_NLIMITS 16
  32 #endif
  33
  34 #include <stdlib.h>
  35 #include <unistd.h>
  36 #include <errno.h>
  37 #include <pwd.h>
  38 #include <grp.h>
  39 #include <string.h>
  40 #include <fcntl.h>
  41 #include <sched.h>
  42 #include <linux/limits.h>
  43 #include <linux/filter.h>
  44 #include <signal.h>
  45 #include <inttypes.h>
  46
  47 #include "capabilities.h"
  48 #include "elf.h"
  49 #include "fs.h"
  50 #include "jail.h"
  51 #include "log.h"
  52 #include "seccomp-oci.h"
  53
  54 #include <libubox/utils.h>
  55 #include <libubox/blobmsg.h>
  56 #include <libubox/blobmsg_json.h>
  57 #include <libubox/list.h>
  58 #include <libubox/vlist.h>
  59 #include <libubox/uloop.h>
  60 #include <libubus.h>
  61
  62 #ifndef CLONE_NEWCGROUP
  63 #define CLONE_NEWCGROUP 0x02000000
  64 #endif
  65
  66 #define STACK_SIZE      (1024 * 1024)
  67 #define OPT_ARGS        "S:C:n:h:r:w:d:psulocU:G:NR:fFO:T:EyJ:"
  68
  69 struct hook_execvpe {
  70         char *file;
  71         char **argv;
  72         char **envp;
  73         int timeout;
  74 };
  75
  76 struct sysctl_val {
  77         char *entry;
  78         char *value;
  79 };
  80
  81 struct mknod_args {
  82         char *path;
  83         mode_t mode;
  84         dev_t dev;
  85         uid_t uid;
  86         gid_t gid;
  87 };
  88
  89 static struct {
  90         char *name;
  91         char *hostname;
  92         char **jail_argv;
  93         char *cwd;
  94         char *seccomp;
  95         struct sock_fprog *ociseccomp;
  96         char *capabilities;
  97         struct jail_capset capset;
  98         char *user;
  99         char *group;
 100         char *extroot;
 101         char *overlaydir;
 102         char *tmpoverlaysize;
 103         char **envp;
 104         char *uidmap;
 105         char *gidmap;
 106         struct sysctl_val **sysctl;
 107         int no_new_privs;
 108         int namespace;
 109         int procfs;
 110         int ronly;
 111         int sysfs;
 112         int console;
 113         int pw_uid;
 114         int pw_gid;
 115         int gr_gid;
 116         gid_t *additional_gids;
 117         size_t num_additional_gids;
 118         mode_t umask;
 119         bool set_umask;
 120         int require_jail;
 121         struct {
 122                 struct hook_execvpe **createRuntime;
 123                 struct hook_execvpe **createContainer;
 124                 struct hook_execvpe **startContainer;
 125                 struct hook_execvpe **poststart;
 126                 struct hook_execvpe **poststop;
 127         } hooks;
 128         struct rlimit *rlimits[RLIM_NLIMITS];
 129         int oom_score_adj;
 130         bool set_oom_score_adj;
 131         struct mknod_args **devices;
 132 } opts;
 133
 134 static void free_hooklist(struct hook_execvpe **hooklist)
 135 {
 136         struct hook_execvpe *cur;
 137         char **tmp;
 138
 139         if (!hooklist)
 140                 return;
 141
 142         cur = *hooklist;
 143         while (cur) {
 144                 free(cur->file);
 145                 tmp = cur->argv;
 146                 while (tmp)
 147                         free(*(tmp++));
 148
 149                 free(cur->argv);
 150
 151                 tmp = cur->envp;
 152                 while (tmp)
 153                         free(*(tmp++));
 154
 155                 free(cur->envp);
 156                 free(cur++);
 157         }
 158         free(hooklist);
 159 }
 160
 161 static void free_sysctl(void) {
 162         struct sysctl_val *cur;
 163         cur = *opts.sysctl;
 164
 165         while (cur) {
 166                 free(cur->entry);
 167                 free(cur->value);
 168                 free(cur++);
 169         }
 170         free(opts.sysctl);
 171 }
 172
 173 static void free_devices(void) {
 174         struct mknod_args **cur;
 175
 176         if (!opts.devices)
 177                 return;
 178
 179         cur = opts.devices;
 180
 181         while (*cur) {
 182                 free((*cur)->path);
 183                 free(*(cur++));
 184         }
 185         free(opts.devices);
 186 }
 187
 188 static void free_rlimits(void) {
 189         int type;
 190
 191         for (type = 0; type < RLIM_NLIMITS; ++type)
 192                 free(opts.rlimits[type]);
 193 }
 194
 195 static void free_opts(bool child) {
 196         char **tmp;
 197
 198         /* we need to keep argv, envp and seccomp filter in child */
 199         if (child) {
 200                 if (opts.ociseccomp) {
 201                         free(opts.ociseccomp->filter);
 202                         free(opts.ociseccomp);
 203                 }
 204
 205                 tmp = opts.jail_argv;
 206                 while(tmp)
 207                         free(*(tmp++));
 208
 209                 free(opts.jail_argv);
 210
 211                 tmp = opts.envp;
 212                 while (tmp)
 213                         free(*(tmp++));
 214
 215                 free(opts.envp);
 216         };
 217
 218         free_rlimits();
 219         free_sysctl();
 220         free_devices();
 221         free(opts.hostname);
 222         free(opts.cwd);
 223         free(opts.extroot);
 224         free(opts.uidmap);
 225         free(opts.gidmap);
 226         free_hooklist(opts.hooks.createRuntime);
 227         free_hooklist(opts.hooks.createContainer);
 228         free_hooklist(opts.hooks.startContainer);
 229         free_hooklist(opts.hooks.poststart);
 230         free_hooklist(opts.hooks.poststop);
 231 }
 232
 233 static struct blob_buf ocibuf;
 234
 235 extern int pivot_root(const char *new_root, const char *put_old);
 236
 237 int debug = 0;
 238
 239 static char child_stack[STACK_SIZE];
 240
 241 int console_fd;
 242
 243 static int mount_overlay(char *jail_root, char *overlaydir) {
 244         char *upperdir, *workdir, *optsstr, *upperetc, *upperresolvconf;
 245         const char mountoptsformat[] = "lowerdir=%s,upperdir=%s,workdir=%s";
 246         int ret = -1, fd;
 247
 248         if (asprintf(&upperdir, "%s%s", overlaydir, "/upper") < 0)
 249                 goto out;
 250
 251         if (asprintf(&workdir, "%s%s", overlaydir, "/work") < 0)
 252                 goto upper_printf;
 253
 254         if (asprintf(&optsstr, mountoptsformat, jail_root, upperdir, workdir) < 0)
 255                 goto work_printf;
 256
 257         if (mkdir_p(upperdir, 0755) || mkdir_p(workdir, 0755))
 258                 goto opts_printf;
 259
 260 /*
 261  * make sure /etc/resolv.conf exists in overlay and is owned by jail userns root
 262  * this is to work-around a bug in overlayfs described in the overlayfs-userns
 263  * patch:
 264  * 3. modification of a file 'hithere' which is in l but not yet
 265  * in u, and which is not owned by T, is not allowed, even if
 266  * writes to u are allowed.  This may be a bug in overlayfs,
 267  * but it is safe behavior.
 268  */
 269         if (asprintf(&upperetc, "%s/etc", upperdir) < 0)
 270                 goto opts_printf;
 271
 272         if (mkdir_p(upperetc, 0755))
 273                 goto upper_etc_printf;
 274
 275         if (asprintf(&upperresolvconf, "%s/resolv.conf", upperetc) < 0)
 276                 goto upper_etc_printf;
 277
 278         fd = creat(upperresolvconf, 0644);
 279         if (fd == -1) {
 280                 ERROR("creat(%s) failed: %m\n", upperresolvconf);
 281                 goto upper_resolvconf_printf;
 282         }
 283         close(fd);
 284
 285         DEBUG("mount -t overlay %s %s (%s)\n", jail_root, jail_root, optsstr);
 286
 287         if (mount(jail_root, jail_root, "overlay", MS_NOATIME, optsstr))
 288                 goto opts_printf;
 289
 290         ret = 0;
 291
 292 upper_resolvconf_printf:
 293         free(upperresolvconf);
 294 upper_etc_printf:
 295         free(upperetc);
 296 opts_printf:
 297         free(optsstr);
 298 work_printf:
 299         free(workdir);
 300 upper_printf:
 301         free(upperdir);
 302 out:
 303         return ret;
 304 }
 305
 306 static void pass_console(int console_fd)
 307 {
 308         struct ubus_context *ctx = ubus_connect(NULL);
 309         static struct blob_buf req;
 310         uint32_t id;
 311
 312         if (!ctx)
 313                 return;
 314
 315         blob_buf_init(&req, 0);
 316         blobmsg_add_string(&req, "name", opts.name);
 317
 318         if (ubus_lookup_id(ctx, "container", &id) ||
 319             ubus_invoke_fd(ctx, id, "console_set", req.head, NULL, NULL, 3000, console_fd))
 320                 INFO("ubus request failed\n");
 321         else
 322                 close(console_fd);
 323
 324         blob_buf_free(&req);
 325         ubus_free(ctx);
 326 }
 327
 328 static int create_dev_console(const char *jail_root)
 329 {
 330         char *console_fname;
 331         char dev_console_path[PATH_MAX];
 332         int slave_console_fd;
 333
 334         /* Open UNIX/98 virtual console */
 335         console_fd = posix_openpt(O_RDWR | O_NOCTTY);
 336         if (console_fd == -1)
 337                 return -1;
 338
 339         console_fname = ptsname(console_fd);
 340         DEBUG("got console fd %d and PTS client name %s\n", console_fd, console_fname);
 341         if (!console_fname)
 342                 goto no_console;
 343
 344         grantpt(console_fd);
 345         unlockpt(console_fd);
 346
 347         /* pass PTY master to procd */
 348         pass_console(console_fd);
 349
 350         /* mount-bind PTY slave to /dev/console in jail */
 351         snprintf(dev_console_path, sizeof(dev_console_path), "%s/dev/console", jail_root);
 352         close(creat(dev_console_path, 0620));
 353
 354         if (mount(console_fname, dev_console_path, NULL, MS_BIND, NULL))
 355                 goto no_console;
 356
 357         /* use PTY slave for stdio */
 358         slave_console_fd = open(console_fname, O_RDWR); /* | O_NOCTTY */
 359         dup2(slave_console_fd, 0);
 360         dup2(slave_console_fd, 1);
 361         dup2(slave_console_fd, 2);
 362         close(slave_console_fd);
 363
 364         INFO("using guest console %s\n", console_fname);
 365
 366         return 0;
 367
 368 no_console:
 369         close(console_fd);
 370         return 1;
 371 }
 372
 373 static int hook_running = 0;
 374 static int hook_return_code = 0;
 375
 376 static void hook_process_timeout_cb(struct uloop_timeout *t);
 377 static struct uloop_timeout hook_process_timeout = {
 378         .cb = hook_process_timeout_cb,
 379 };
 380
 381 static void hook_process_handler(struct uloop_process *c, int ret)
 382 {
 383         uloop_timeout_cancel(&hook_process_timeout);
 384         if (WIFEXITED(ret)) {
 385                 hook_return_code = WEXITSTATUS(ret);
 386                 DEBUG("hook (%d) exited with exit: %d\n", c->pid, hook_return_code);
 387         } else {
 388                 hook_return_code = WTERMSIG(ret);
 389                 DEBUG("hook (%d) exited with signal: %d\n", c->pid, hook_return_code);
 390         }
 391         hook_running = 0;
 392         uloop_end();
 393 }
 394
 395 static struct uloop_process hook_process = {
 396         .cb = hook_process_handler,
 397 };
 398
 399 static void hook_process_timeout_cb(struct uloop_timeout *t)
 400 {
 401         DEBUG("hook process failed to stop, sending SIGKILL\n");
 402         kill(hook_process.pid, SIGKILL);
 403 }
 404
 405 static int run_hook(struct hook_execvpe *hook)
 406 {
 407         struct stat s;
 408
 409         DEBUG("executing hook %s\n", hook->file);
 410
 411         if (stat(hook->file, &s))
 412                 return ENOENT;
 413
 414         if (!((unsigned long)s.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH)))
 415                 return EPERM;
 416
 417         if (!((unsigned long)s.st_mode & (S_IRUSR | S_IRGRP | S_IROTH)))
 418                 return EPERM;
 419
 420         uloop_init();
 421
 422         hook_running = 1;
 423         hook_process.pid = fork();
 424         if (hook_process.pid > 0) {
 425                 /* parent */
 426                 uloop_process_add(&hook_process);
 427
 428                 if (hook->timeout > 0)
 429                         uloop_timeout_set(&hook_process_timeout, 1000 * hook->timeout);
 430
 431                 uloop_run();
 432                 if (hook_running) {
 433                         DEBUG("uloop interrupted, killing hook process\n");
 434                         kill(hook_process.pid, SIGTERM);
 435                         uloop_timeout_set(&hook_process_timeout, 1000);
 436                         uloop_run();
 437                 }
 438                 uloop_done();
 439
 440                 waitpid(hook_process.pid, NULL, WCONTINUED);
 441
 442                 return hook_return_code;
 443         } else if (hook_process.pid == 0) {
 444                 /* child */
 445                 execvpe(hook->file, hook->argv, hook->envp);
 446                 hook_running = 0;
 447                 _exit(errno);
 448         } else {
 449                 /* fork error */
 450                 hook_running = 0;
 451                 return errno;
 452         }
 453 }
 454
 455 static int run_hooks(struct hook_execvpe **hooklist)
 456 {
 457         struct hook_execvpe **cur;
 458         int res;
 459
 460         if (!hooklist)
 461                 return 0; /* Nothing to do */
 462
 463         cur = hooklist;
 464
 465         while (*cur) {
 466                 res = run_hook(*cur);
 467                 if (res)
 468                         DEBUG(" error running hook %s\n", (*cur)->file);
 469                 else
 470                         DEBUG(" success running hook %s\n", (*cur)->file);
 471
 472                 ++cur;
 473         }
 474
 475         return 0;
 476 }
 477
 478 static int apply_sysctl(const char *jail_root)
 479 {
 480         struct sysctl_val **cur;
 481         char *procdir, *fname;
 482         int f;
 483
 484         if (!opts.sysctl)
 485                 return 0;
 486
 487         asprintf(&procdir, "%s/proc", jail_root);
 488         if (!procdir)
 489                 return ENOMEM;
 490
 491         mkdir(procdir, 0700);
 492         if (mount("proc", procdir, "proc", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, 0))
 493                 return EPERM;
 494
 495         cur = opts.sysctl;
 496
 497         while (*cur) {
 498                 asprintf(&fname, "%s/sys/%s", procdir, (*cur)->entry);
 499                 if (!fname)
 500                         return ENOMEM;
 501
 502                 DEBUG("sysctl: writing '%s' to %s\n", (*cur)->value, fname);
 503
 504                 f = open(fname, O_WRONLY);
 505                 if (f == -1) {
 506                         ERROR("sysctl: can't open %s\n", fname);
 507                         return errno;
 508                 }
 509                 write(f, (*cur)->value, strlen((*cur)->value));
 510
 511                 free(fname);
 512                 close(f);
 513                 ++cur;
 514         }
 515         umount(procdir);
 516         rmdir(procdir);
 517         free(procdir);
 518
 519         return 0;
 520 }
 521
 522 static struct mknod_args default_devices[] = {
 523         { .path = "/dev/null", .mode = (S_IFCHR|S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH), .dev = makedev(1, 3) },
 524         { .path = "/dev/zero", .mode = (S_IFCHR|S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH), .dev = makedev(1, 5) },
 525         { .path = "/dev/full", .mode = (S_IFCHR|S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH), .dev = makedev(1, 7) },
 526         { .path = "/dev/random", .mode = (S_IFCHR|S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH), .dev = makedev(1, 8) },
 527         { .path = "/dev/urandom", .mode = (S_IFCHR|S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH), .dev = makedev(1, 9) },
 528         { .path = "/dev/tty", .mode = (S_IFCHR|S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP), .dev = makedev(5, 0), .gid = 5 },
 529         { 0 },
 530 };
 531
 532 static int create_devices(void)
 533 {
 534         struct mknod_args **cur, *curdef;
 535
 536         if (!opts.devices)
 537                 goto only_default_devices;
 538
 539         cur = opts.devices;
 540
 541         while (*cur) {
 542                 DEBUG("creating %s (mode=%08o)\n", (*cur)->path, (*cur)->mode);
 543                 if (mknod((*cur)->path, (*cur)->mode, (*cur)->dev))
 544                         return errno;
 545
 546                 if (((*cur)->uid || (*cur)->gid) &&
 547                     chown((*cur)->path, (*cur)->uid, (*cur)->gid))
 548                         return errno;
 549
 550                 ++cur;
 551         }
 552
 553 only_default_devices:
 554         curdef = default_devices;
 555         while(curdef->path) {
 556                 DEBUG("creating %s (mode=%08o)\n", curdef->path, curdef->mode);
 557                 if (mknod(curdef->path, curdef->mode, curdef->dev)) {
 558                         ++curdef;
 559                         continue; /* may already exist, eg. due to a bind-mount */
 560                 }
 561                 if ((curdef->uid || curdef->gid) &&
 562                     chown(curdef->path, curdef->uid, curdef->gid))
 563                         return errno;
 564
 565                 ++curdef;
 566         }
 567
 568         /* Dev symbolic links as defined in OCI spec */
 569         symlink("/dev/pts/ptmx", "/dev/ptmx");
 570         symlink("/proc/self/fd", "/dev/fd");
 571         symlink("/proc/self/fd/0", "/dev/stdin");
 572         symlink("/proc/self/fd/1", "/dev/stdout");
 573         symlink("/proc/self/fd/2", "/dev/stderr");
 574
 575         return 0;
 576 }
 577
 578 static int build_jail_fs(void)
 579 {
 580         char jail_root[] = "/tmp/ujail-XXXXXX";
 581         char tmpovdir[] = "/tmp/ujail-overlay-XXXXXX";
 582         char *overlaydir = NULL;
 583         mode_t old_umask;
 584
 585         old_umask = umask(0);
 586
 587         if (mkdtemp(jail_root) == NULL) {
 588                 ERROR("mkdtemp(%s) failed: %m\n", jail_root);
 589                 return -1;
 590         }
 591
 592         if (apply_sysctl(jail_root)) {
 593                 ERROR("failed to apply sysctl values\n");
 594                 return -1;
 595         }
 596
 597         /* oldroot can't be MS_SHARED else pivot_root() fails */
 598         if (mount("none", "/", NULL, MS_REC|MS_PRIVATE, NULL)) {
 599                 ERROR("private mount failed %m\n");
 600                 return -1;
 601         }
 602
 603         if (opts.extroot) {
 604                 if (mount(opts.extroot, jail_root, NULL, MS_BIND, NULL)) {
 605                         ERROR("extroot mount failed %m\n");
 606                         return -1;
 607                 }
 608         } else {
 609                 if (mount("tmpfs", jail_root, "tmpfs", MS_NOATIME, "mode=0755")) {
 610                         ERROR("tmpfs mount failed %m\n");
 611                         return -1;
 612                 }
 613         }
 614
 615         if (opts.tmpoverlaysize) {
 616                 char mountoptsstr[] = "mode=0755,size=XXXXXXXX";
 617
 618                 snprintf(mountoptsstr, sizeof(mountoptsstr),
 619                          "mode=0755,size=%s", opts.tmpoverlaysize);
 620                 if (mkdtemp(tmpovdir) == NULL) {
 621                         ERROR("mkdtemp(%s) failed: %m\n", jail_root);
 622                         return -1;
 623                 }
 624                 if (mount("tmpfs", tmpovdir, "tmpfs", MS_NOATIME,
 625                           mountoptsstr)) {
 626                         ERROR("failed to mount tmpfs for overlay (size=%s)\n", opts.tmpoverlaysize);
 627                         return -1;
 628                 }
 629                 overlaydir = tmpovdir;
 630         }
 631
 632         if (opts.overlaydir)
 633                 overlaydir = opts.overlaydir;
 634
 635         if (overlaydir)
 636                 mount_overlay(jail_root, overlaydir);
 637
 638         if (chdir(jail_root)) {
 639                 ERROR("chdir(%s) (jail_root) failed: %m\n", jail_root);
 640                 return -1;
 641         }
 642
 643         if (mount_all(jail_root)) {
 644                 ERROR("mount_all() failed\n");
 645                 return -1;
 646         }
 647
 648         if (opts.console)
 649                 create_dev_console(jail_root);
 650
 651         /* make sure /etc/resolv.conf exists if in new network namespace */
 652         if (opts.namespace & CLONE_NEWNET) {
 653                 char jailetc[PATH_MAX], jaillink[PATH_MAX];
 654
 655                 snprintf(jailetc, PATH_MAX, "%s/etc", jail_root);
 656                 mkdir_p(jailetc, 0755);
 657                 snprintf(jaillink, PATH_MAX, "%s/etc/resolv.conf", jail_root);
 658                 if (overlaydir)
 659                         unlink(jaillink);
 660
 661                 symlink("../dev/resolv.conf.d/resolv.conf.auto", jaillink);
 662         }
 663
 664         run_hooks(opts.hooks.createContainer);
 665
 666         char dirbuf[sizeof(jail_root) + 4];
 667         snprintf(dirbuf, sizeof(dirbuf), "%s/old", jail_root);
 668         mkdir(dirbuf, 0755);
 669
 670         if (pivot_root(jail_root, dirbuf) == -1) {
 671                 ERROR("pivot_root(%s, %s) failed: %m\n", jail_root, dirbuf);
 672                 return -1;
 673         }
 674         if (chdir("/")) {
 675                 ERROR("chdir(/) (after pivot_root) failed: %m\n");
 676                 return -1;
 677         }
 678
 679         snprintf(dirbuf, sizeof(dirbuf), "/old%s", jail_root);
 680         umount2(dirbuf, MNT_DETACH);
 681         rmdir(dirbuf);
 682         if (opts.tmpoverlaysize) {
 683                 char tmpdirbuf[sizeof(tmpovdir) + 4];
 684                 snprintf(tmpdirbuf, sizeof(tmpdirbuf), "/old%s", tmpovdir);
 685                 umount2(tmpdirbuf, MNT_DETACH);
 686                 rmdir(tmpdirbuf);
 687         }
 688
 689         umount2("/old", MNT_DETACH);
 690         rmdir("/old");
 691
 692         if (create_devices()) {
 693                 ERROR("create_devices() failed\n");
 694                 return -1;
 695         }
 696         if (opts.ronly)
 697                 mount(NULL, "/", NULL, MS_REMOUNT | MS_BIND | MS_RDONLY, 0);
 698
 699         umask(old_umask);
 700
 701         return 0;
 702 }
 703
 704 static int write_uid_gid_map(pid_t child_pid, bool gidmap, char *mapstr)
 705 {
 706         int map_file;
 707         char map_path[64];
 708
 709         if (snprintf(map_path, sizeof(map_path), "/proc/%d/%s",
 710                 child_pid, gidmap?"gid_map":"uid_map") < 0)
 711                 return -1;
 712
 713         if ((map_file = open(map_path, O_WRONLY)) == -1)
 714                 return -1;
 715
 716         if (dprintf(map_file, "%s", mapstr)) {
 717                 close(map_file);
 718                 return -1;
 719         }
 720
 721         close(map_file);
 722         free(mapstr);
 723         return 0;
 724 }
 725
 726 static int write_single_uid_gid_map(pid_t child_pid, bool gidmap, int id)
 727 {
 728         int map_file;
 729         char map_path[64];
 730         const char *map_format = "%d %d %d\n";
 731         if (snprintf(map_path, sizeof(map_path), "/proc/%d/%s",
 732                 child_pid, gidmap?"gid_map":"uid_map") < 0)
 733                 return -1;
 734
 735         if ((map_file = open(map_path, O_WRONLY)) == -1)
 736                 return -1;
 737
 738         if (dprintf(map_file, map_format, 0, id, 1) == -1) {
 739                 close(map_file);
 740                 return -1;
 741         }
 742
 743         close(map_file);
 744         return 0;
 745 }
 746
 747 static int write_setgroups(pid_t child_pid, bool allow)
 748 {
 749         int setgroups_file;
 750         char setgroups_path[64];
 751
 752         if (snprintf(setgroups_path, sizeof(setgroups_path), "/proc/%d/setgroups",
 753                 child_pid) < 0) {
 754                 return -1;
 755         }
 756
 757         if ((setgroups_file = open(setgroups_path, O_WRONLY)) == -1) {
 758                 return -1;
 759         }
 760
 761         if (dprintf(setgroups_file, "%s", allow?"allow":"deny") == -1) {
 762                 close(setgroups_file);
 763                 return -1;
 764         }
 765
 766         close(setgroups_file);
 767         return 0;
 768 }
 769
 770 static void get_jail_user(int *user, int *user_gid, int *gr_gid)
 771 {
 772         struct passwd *p = NULL;
 773         struct group *g = NULL;
 774
 775         if (opts.user) {
 776                 p = getpwnam(opts.user);
 777                 if (!p) {
 778                         ERROR("failed to get uid/gid for user %s: %d (%s)\n",
 779                               opts.user, errno, strerror(errno));
 780                         exit(EXIT_FAILURE);
 781                 }
 782                 *user = p->pw_uid;
 783                 *user_gid = p->pw_gid;
 784         } else {
 785                 *user = -1;
 786                 *user_gid = -1;
 787         }
 788
 789         if (opts.group) {
 790                 g = getgrnam(opts.group);
 791                 if (!g) {
 792                         ERROR("failed to get gid for group %s: %m\n", opts.group);
 793                         exit(EXIT_FAILURE);
 794                 }
 795                 *gr_gid = g->gr_gid;
 796         } else {
 797                 *gr_gid = -1;
 798         }
 799 };
 800
 801 static void set_jail_user(int pw_uid, int user_gid, int gr_gid)
 802 {
 803         if (opts.user && (user_gid != -1) && initgroups(opts.user, user_gid)) {
 804                 ERROR("failed to initgroups() for user %s: %m\n", opts.user);
 805                 exit(EXIT_FAILURE);
 806         }
 807
 808         if ((gr_gid != -1) && setregid(gr_gid, gr_gid)) {
 809                 ERROR("failed to set group id %d: %m\n", gr_gid);
 810                 exit(EXIT_FAILURE);
 811         }
 812
 813         if ((pw_uid != -1) && setreuid(pw_uid, pw_uid)) {
 814                 ERROR("failed to set user id %d: %m\n", pw_uid);
 815                 exit(EXIT_FAILURE);
 816         }
 817 }
 818
 819 static int apply_rlimits(void)
 820 {
 821         int resource;
 822
 823         for (resource = 0; resource < RLIM_NLIMITS; ++resource) {
 824                 if (opts.rlimits[resource])
 825                         DEBUG("applying limits to resource %u\n", resource);
 826
 827                 if (opts.rlimits[resource] &&
 828                     setrlimit(resource, opts.rlimits[resource]))
 829                         return errno;
 830         }
 831
 832         return 0;
 833 }
 834
 835 #define MAX_ENVP        8
 836 static char** build_envp(const char *seccomp, char **ocienvp)
 837 {
 838         static char *envp[MAX_ENVP];
 839         static char preload_var[PATH_MAX];
 840         static char seccomp_var[PATH_MAX];
 841         static char debug_var[] = "LD_DEBUG=all";
 842         static char container_var[] = "container=ujail";
 843         const char *preload_lib = find_lib("libpreload-seccomp.so");
 844         char **addenv;
 845
 846         int count = 0;
 847
 848         if (seccomp && !preload_lib) {
 849                 ERROR("failed to add preload-lib to env\n");
 850                 return NULL;
 851         }
 852         if (seccomp) {
 853                 snprintf(seccomp_var, sizeof(seccomp_var), "SECCOMP_FILE=%s", seccomp);
 854                 envp[count++] = seccomp_var;
 855                 snprintf(preload_var, sizeof(preload_var), "LD_PRELOAD=%s", preload_lib);
 856                 envp[count++] = preload_var;
 857         }
 858
 859         envp[count++] = container_var;
 860
 861         if (debug > 1)
 862                 envp[count++] = debug_var;
 863
 864         addenv = ocienvp;
 865         while (addenv && *addenv) {
 866                 envp[count++] = *(addenv++);
 867                 if (count >= MAX_ENVP) {
 868                         ERROR("environment limited to %d extra records, truncating\n", MAX_ENVP);
 869                         break;
 870                 }
 871         }
 872         return envp;
 873 }
 874
 875 static void usage(void)
 876 {
 877         fprintf(stderr, "ujail <options> -- <binary> <params ...>\n");
 878         fprintf(stderr, "  -d <num>\tshow debug log (increase num to increase verbosity)\n");
 879         fprintf(stderr, "  -S <file>\tseccomp filter config\n");
 880         fprintf(stderr, "  -C <file>\tcapabilities drop config\n");
 881         fprintf(stderr, "  -c\t\tset PR_SET_NO_NEW_PRIVS\n");
 882         fprintf(stderr, "  -n <name>\tthe name of the jail\n");
 883         fprintf(stderr, "namespace jail options:\n");
 884         fprintf(stderr, "  -h <hostname>\tchange the hostname of the jail\n");
 885         fprintf(stderr, "  -N\t\tjail has network namespace\n");
 886         fprintf(stderr, "  -f\t\tjail has user namespace\n");
 887         fprintf(stderr, "  -F\t\tjail has cgroups namespace\n");
 888         fprintf(stderr, "  -r <file>\treadonly files that should be staged\n");
 889         fprintf(stderr, "  -w <file>\twriteable files that should be staged\n");
 890         fprintf(stderr, "  -p\t\tjail has /proc\n");
 891         fprintf(stderr, "  -s\t\tjail has /sys\n");
 892         fprintf(stderr, "  -l\t\tjail has /dev/log\n");
 893         fprintf(stderr, "  -u\t\tjail has a ubus socket\n");
 894         fprintf(stderr, "  -U <name>\tuser to run jailed process\n");
 895         fprintf(stderr, "  -G <name>\tgroup to run jailed process\n");
 896         fprintf(stderr, "  -o\t\tremont jail root (/) read only\n");
 897         fprintf(stderr, "  -R <dir>\texternal jail rootfs (system container)\n");
 898         fprintf(stderr, "  -O <dir>\tdirectory for r/w overlayfs\n");
 899         fprintf(stderr, "  -T <size>\tuse tmpfs r/w overlayfs with <size>\n");
 900         fprintf(stderr, "  -E\t\tfail if jail cannot be setup\n");
 901         fprintf(stderr, "  -y\t\tprovide jail console\n");
 902         fprintf(stderr, "  -J <dir>\tstart OCI bundle\n");
 903         fprintf(stderr, "\nWarning: by default root inside the jail is the same\n\
 904 and he has the same powers as root outside the jail,\n\
 905 thus he can escape the jail and/or break stuff.\n\
 906 Please use seccomp/capabilities (-S/-C) to restrict his powers\n\n\
 907 If you use none of the namespace jail options,\n\
 908 ujail will not use namespace/build a jail,\n\
 909 and will only drop capabilities/apply seccomp filter.\n\n");
 910 }
 911
 912 static int exec_jail(void *pipes_ptr)
 913 {
 914         int *pipes = (int*)pipes_ptr;
 915         char buf[1];
 916         int pw_uid, pw_gid, gr_gid;
 917
 918         close(pipes[0]);
 919         close(pipes[3]);
 920
 921         buf[0] = 'i';
 922         if (write(pipes[1], buf, 1) < 1) {
 923                 ERROR("can't write to parent\n");
 924                 exit(EXIT_FAILURE);
 925         }
 926         if (read(pipes[2], buf, 1) < 1) {
 927                 ERROR("can't read from parent\n");
 928                 exit(EXIT_FAILURE);
 929         }
 930         if (buf[0] != 'O') {
 931                 ERROR("parent had an error, child exiting\n");
 932                 exit(EXIT_FAILURE);
 933         }
 934
 935         close(pipes[1]);
 936         close(pipes[2]);
 937
 938         if (opts.namespace & CLONE_NEWUSER) {
 939                 if (setregid(0, 0) < 0) {
 940                         ERROR("setgid\n");
 941                         exit(EXIT_FAILURE);
 942                 }
 943                 if (setreuid(0, 0) < 0) {
 944                         ERROR("setuid\n");
 945                         exit(EXIT_FAILURE);
 946                 }
 947                 if (setgroups(0, NULL) < 0) {
 948                         ERROR("setgroups\n");
 949                         exit(EXIT_FAILURE);
 950                 }
 951         }
 952
 953         if (opts.namespace && opts.hostname && strlen(opts.hostname) > 0
 954                         && sethostname(opts.hostname, strlen(opts.hostname))) {
 955                 ERROR("sethostname(%s) failed: %m\n", opts.hostname);
 956                 exit(EXIT_FAILURE);
 957         }
 958
 959         if ((opts.namespace & CLONE_NEWNS) && build_jail_fs()) {
 960                 ERROR("failed to build jail fs\n");
 961                 exit(EXIT_FAILURE);
 962         }
 963         run_hooks(opts.hooks.startContainer);
 964
 965         if (!(opts.namespace & CLONE_NEWUSER)) {
 966                 get_jail_user(&pw_uid, &pw_gid, &gr_gid);
 967
 968                 set_jail_user(opts.pw_uid?:pw_uid, opts.pw_gid?:pw_gid, opts.gr_gid?:gr_gid);
 969         }
 970
 971         if (opts.additional_gids &&
 972             (setgroups(opts.num_additional_gids, opts.additional_gids) < 0)) {
 973                 ERROR("setgroups failed: %m\n");
 974                 exit(EXIT_FAILURE);
 975         }
 976
 977         if (opts.set_umask)
 978                 umask(opts.umask);
 979
 980         if (applyOCIcapabilities(opts.capset))
 981                 exit(EXIT_FAILURE);
 982
 983         if (opts.capabilities && drop_capabilities(opts.capabilities))
 984                 exit(EXIT_FAILURE);
 985
 986         if (opts.no_new_privs && prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
 987                 ERROR("prctl(PR_SET_NO_NEW_PRIVS) failed: %m\n");
 988                 exit(EXIT_FAILURE);
 989         }
 990
 991         char **envp = build_envp(opts.seccomp, opts.envp);
 992         if (!envp)
 993                 exit(EXIT_FAILURE);
 994
 995         if (opts.cwd && chdir(opts.cwd))
 996                 exit(EXIT_FAILURE);
 997
 998         if (opts.ociseccomp && applyOCIlinuxseccomp(opts.ociseccomp))
 999                 exit(EXIT_FAILURE);
1000
1001         uloop_end();
1002         free_opts(false);
1003         INFO("exec-ing %s\n", *opts.jail_argv);
1004         if (opts.envp) /* respect PATH if potentially set in ENV */
1005                 execvpe(*opts.jail_argv, opts.jail_argv, envp);
1006         else
1007                 execve(*opts.jail_argv, opts.jail_argv, envp);
1008
1009         /* we get there only if execve fails */
1010         ERROR("failed to execve %s: %m\n", *opts.jail_argv);
1011         exit(EXIT_FAILURE);
1012 }
1013
1014 static int jail_running = 0;
1015 static int jail_return_code = 0;
1016
1017 static void jail_process_timeout_cb(struct uloop_timeout *t);
1018 static struct uloop_timeout jail_process_timeout = {
1019         .cb = jail_process_timeout_cb,
1020 };
1021
1022 static void jail_process_handler(struct uloop_process *c, int ret)
1023 {
1024         uloop_timeout_cancel(&jail_process_timeout);
1025         if (WIFEXITED(ret)) {
1026                 jail_return_code = WEXITSTATUS(ret);
1027                 INFO("jail (%d) exited with exit: %d\n", c->pid, jail_return_code);
1028         } else {
1029                 jail_return_code = WTERMSIG(ret);
1030                 INFO("jail (%d) exited with signal: %d\n", c->pid, jail_return_code);
1031         }
1032         jail_running = 0;
1033         uloop_end();
1034 }
1035
1036 static struct uloop_process jail_process = {
1037         .cb = jail_process_handler,
1038 };
1039
1040 static void jail_process_timeout_cb(struct uloop_timeout *t)
1041 {
1042         DEBUG("jail process failed to stop, sending SIGKILL\n");
1043         kill(jail_process.pid, SIGKILL);
1044 }
1045
1046 static void jail_handle_signal(int signo)
1047 {
1048         if (hook_running) {
1049                 DEBUG("forwarding signal %d to the hook process\n", signo);
1050                 kill(hook_process.pid, signo);
1051         }
1052
1053         if (jail_running) {
1054                 DEBUG("forwarding signal %d to the jailed process\n", signo);
1055                 kill(jail_process.pid, signo);
1056         }
1057 }
1058
1059 static int netns_open_pid(const pid_t target_ns)
1060 {
1061         char pid_net_path[PATH_MAX];
1062
1063         snprintf(pid_net_path, sizeof(pid_net_path), "/proc/%u/ns/net", target_ns);
1064
1065         return open(pid_net_path, O_RDONLY);
1066 }
1067
1068 static void netns_updown(pid_t pid, bool start)
1069 {
1070         struct ubus_context *ctx = ubus_connect(NULL);
1071         static struct blob_buf req;
1072         uint32_t id;
1073
1074         if (!ctx)
1075                 return;
1076
1077         blob_buf_init(&req, 0);
1078         blobmsg_add_string(&req, "jail", opts.name);
1079         blobmsg_add_u32(&req, "pid", pid);
1080         blobmsg_add_u8(&req, "start", start);
1081
1082         if (ubus_lookup_id(ctx, "network", &id) ||
1083             ubus_invoke(ctx, id, "netns_updown", req.head, NULL, NULL, 3000))
1084                 INFO("ubus request failed\n");
1085
1086         blob_buf_free(&req);
1087         ubus_free(ctx);
1088 }
1089
1090 static int parseOCIenvarray(struct blob_attr *msg, char ***envp)
1091 {
1092         struct blob_attr *cur;
1093         int sz = 0, rem;
1094
1095         blobmsg_for_each_attr(cur, msg, rem)
1096                 ++sz;
1097
1098         if (sz > 0) {
1099                 *envp = calloc(1 + sz, sizeof(char*));
1100                 if (!(*envp))
1101                         return ENOMEM;
1102         } else {
1103                 *envp = NULL;
1104                 return 0;
1105         }
1106
1107         sz = 0;
1108         blobmsg_for_each_attr(cur, msg, rem)
1109                 (*envp)[sz++] = strdup(blobmsg_get_string(cur));
1110
1111         if (sz)
1112                 (*envp)[sz] = NULL;
1113
1114         return 0;
1115 }
1116
1117 enum {
1118         OCI_ROOT_PATH,
1119         OCI_ROOT_READONLY,
1120         __OCI_ROOT_MAX,
1121 };
1122
1123 static const struct blobmsg_policy oci_root_policy[] = {
1124         [OCI_ROOT_PATH] = { "path", BLOBMSG_TYPE_STRING },
1125         [OCI_ROOT_READONLY] = { "readonly", BLOBMSG_TYPE_BOOL },
1126 };
1127
1128 static int parseOCIroot(const char *jsonfile, struct blob_attr *msg)
1129 {
1130         static char rootpath[PATH_MAX] = { 0 };
1131         struct blob_attr *tb[__OCI_ROOT_MAX];
1132         char *cur;
1133
1134         blobmsg_parse(oci_root_policy, __OCI_ROOT_MAX, tb, blobmsg_data(msg), blobmsg_len(msg));
1135
1136         if (!tb[OCI_ROOT_PATH])
1137                 return ENODATA;
1138
1139         strncpy(rootpath, jsonfile, PATH_MAX);
1140         cur = strrchr(rootpath, '/');
1141
1142         if (!cur)
1143                 return ENOTDIR;
1144
1145         *(++cur) = '\0';
1146         strncat(rootpath, blobmsg_get_string(tb[OCI_ROOT_PATH]), PATH_MAX - (strlen(rootpath) + 1));
1147
1148         opts.extroot = rootpath;
1149
1150         opts.ronly = blobmsg_get_bool(tb[OCI_ROOT_READONLY]);
1151
1152         return 0;
1153 }
1154
1155
1156 enum {
1157         OCI_HOOK_PATH,
1158         OCI_HOOK_ARGS,
1159         OCI_HOOK_ENV,
1160         OCI_HOOK_TIMEOUT,
1161         __OCI_HOOK_MAX,
1162 };
1163
1164 static const struct blobmsg_policy oci_hook_policy[] = {
1165         [OCI_HOOK_PATH] = { "path", BLOBMSG_TYPE_STRING },
1166         [OCI_HOOK_ARGS] = { "args", BLOBMSG_TYPE_ARRAY },
1167         [OCI_HOOK_ENV] = { "env", BLOBMSG_TYPE_ARRAY },
1168         [OCI_HOOK_TIMEOUT] = { "timeout", BLOBMSG_TYPE_INT32 },
1169 };
1170
1171
1172 static int parseOCIhook(struct hook_execvpe ***hooklist, struct blob_attr *msg)
1173 {
1174         struct blob_attr *tb[__OCI_HOOK_MAX];
1175         struct blob_attr *cur;
1176         int rem, ret = 0;
1177         int idx = 0;
1178
1179         blobmsg_for_each_attr(cur, msg, rem)
1180                 ++idx;
1181
1182         if (!idx)
1183                 return 0;
1184
1185         *hooklist = calloc(idx + 1, sizeof(struct hook_execvpe *));
1186         idx = 0;
1187
1188         if (!(*hooklist))
1189                 return ENOMEM;
1190
1191         blobmsg_for_each_attr(cur, msg, rem) {
1192                 blobmsg_parse(oci_hook_policy, __OCI_HOOK_MAX, tb, blobmsg_data(cur), blobmsg_len(cur));
1193
1194                 if (!tb[OCI_HOOK_PATH]) {
1195                         ret = EINVAL;
1196                         goto errout;
1197                 }
1198
1199                 (*hooklist)[idx] = malloc(sizeof(struct hook_execvpe));
1200                 if (tb[OCI_HOOK_ARGS]) {
1201                         ret = parseOCIenvarray(tb[OCI_HOOK_ARGS], &((*hooklist)[idx]->argv));
1202                         if (ret)
1203                                 goto errout;
1204                 } else {
1205                         (*hooklist)[idx]->argv = calloc(2, sizeof(char *));
1206                         ((*hooklist)[idx]->argv)[0] = strdup(blobmsg_get_string(tb[OCI_HOOK_PATH]));
1207                         ((*hooklist)[idx]->argv)[1] = NULL;
1208                 };
1209
1210
1211                 if (tb[OCI_HOOK_ENV]) {
1212                         ret = parseOCIenvarray(tb[OCI_HOOK_ENV], &((*hooklist)[idx]->envp));
1213                         if (ret)
1214                                 goto errout;
1215                 }
1216
1217                 if (tb[OCI_HOOK_TIMEOUT])
1218                         (*hooklist)[idx]->timeout = blobmsg_get_u32(tb[OCI_HOOK_TIMEOUT]);
1219
1220                 (*hooklist)[idx]->file = strdup(blobmsg_get_string(tb[OCI_HOOK_PATH]));
1221
1222                 ++idx;
1223         }
1224
1225         (*hooklist)[idx] = NULL;
1226
1227         DEBUG("added %d hooks\n", idx);
1228
1229         return 0;
1230
1231 errout:
1232         free_hooklist(*hooklist);
1233         *hooklist = NULL;
1234
1235         return ret;
1236 };
1237
1238
1239 enum {
1240         OCI_HOOKS_PRESTART,
1241         OCI_HOOKS_CREATERUNTIME,
1242         OCI_HOOKS_CREATECONTAINER,
1243         OCI_HOOKS_STARTCONTAINER,
1244         OCI_HOOKS_POSTSTART,
1245         OCI_HOOKS_POSTSTOP,
1246         __OCI_HOOKS_MAX,
1247 };
1248
1249 static const struct blobmsg_policy oci_hooks_policy[] = {
1250         [OCI_HOOKS_PRESTART] = { "prestart", BLOBMSG_TYPE_ARRAY },
1251         [OCI_HOOKS_CREATERUNTIME] = { "createRuntime", BLOBMSG_TYPE_ARRAY },
1252         [OCI_HOOKS_CREATECONTAINER] = { "createContainer", BLOBMSG_TYPE_ARRAY },
1253         [OCI_HOOKS_STARTCONTAINER] = { "startContainer", BLOBMSG_TYPE_ARRAY },
1254         [OCI_HOOKS_POSTSTART] = { "poststart", BLOBMSG_TYPE_ARRAY },
1255         [OCI_HOOKS_POSTSTOP] = { "poststop", BLOBMSG_TYPE_ARRAY },
1256 };
1257
1258 static int parseOCIhooks(struct blob_attr *msg)
1259 {
1260         struct blob_attr *tb[__OCI_HOOKS_MAX];
1261         int ret;
1262
1263         blobmsg_parse(oci_hooks_policy, __OCI_HOOKS_MAX, tb, blobmsg_data(msg), blobmsg_len(msg));
1264
1265         if (tb[OCI_HOOKS_PRESTART])
1266                 INFO("warning: ignoring deprecated prestart hook\n");
1267
1268         if (tb[OCI_HOOKS_CREATERUNTIME]) {
1269                 ret = parseOCIhook(&opts.hooks.createRuntime, tb[OCI_HOOKS_CREATERUNTIME]);
1270                 if (ret)
1271                         return ret;
1272         }
1273
1274         if (tb[OCI_HOOKS_CREATECONTAINER]) {
1275                 ret = parseOCIhook(&opts.hooks.createContainer, tb[OCI_HOOKS_CREATECONTAINER]);
1276                 if (ret)
1277                         goto out_createruntime;
1278         }
1279
1280         if (tb[OCI_HOOKS_STARTCONTAINER]) {
1281                 ret = parseOCIhook(&opts.hooks.startContainer, tb[OCI_HOOKS_STARTCONTAINER]);
1282                 if (ret)
1283                         goto out_createcontainer;
1284         }
1285
1286         if (tb[OCI_HOOKS_POSTSTART]) {
1287                 ret = parseOCIhook(&opts.hooks.poststart, tb[OCI_HOOKS_POSTSTART]);
1288                 if (ret)
1289                         goto out_startcontainer;
1290         }
1291
1292         if (tb[OCI_HOOKS_POSTSTOP]) {
1293                 ret = parseOCIhook(&opts.hooks.poststop, tb[OCI_HOOKS_POSTSTOP]);
1294                 if (ret)
1295                         goto out_poststart;
1296         }
1297
1298         return 0;
1299
1300 out_poststart:
1301         free_hooklist(opts.hooks.poststart);
1302 out_startcontainer:
1303         free_hooklist(opts.hooks.startContainer);
1304 out_createcontainer:
1305         free_hooklist(opts.hooks.createContainer);
1306 out_createruntime:
1307         free_hooklist(opts.hooks.createRuntime);
1308
1309         return ret;
1310 };
1311
1312
1313 enum {
1314         OCI_PROCESS_USER_UID,
1315         OCI_PROCESS_USER_GID,
1316         OCI_PROCESS_USER_UMASK,
1317         OCI_PROCESS_USER_ADDITIONALGIDS,
1318         __OCI_PROCESS_USER_MAX,
1319 };
1320
1321 static const struct blobmsg_policy oci_process_user_policy[] = {
1322         [OCI_PROCESS_USER_UID] = { "uid", BLOBMSG_TYPE_INT32 },
1323         [OCI_PROCESS_USER_GID] = { "gid", BLOBMSG_TYPE_INT32 },
1324         [OCI_PROCESS_USER_UMASK] = { "umask", BLOBMSG_TYPE_INT32 },
1325         [OCI_PROCESS_USER_ADDITIONALGIDS] = { "additionalGids", BLOBMSG_TYPE_ARRAY },
1326 };
1327
1328 static int parseOCIprocessuser(struct blob_attr *msg) {
1329         struct blob_attr *tb[__OCI_PROCESS_USER_MAX];
1330         struct blob_attr *cur;
1331         int rem;
1332         int has_gid = 0;
1333
1334         blobmsg_parse(oci_process_user_policy, __OCI_PROCESS_USER_MAX, tb, blobmsg_data(msg), blobmsg_len(msg));
1335
1336         if (tb[OCI_PROCESS_USER_UID])
1337                 opts.pw_uid = blobmsg_get_u32(tb[OCI_PROCESS_USER_UID]);
1338
1339         if (tb[OCI_PROCESS_USER_GID]) {
1340                 opts.pw_gid = blobmsg_get_u32(tb[OCI_PROCESS_USER_GID]);
1341                 opts.gr_gid = blobmsg_get_u32(tb[OCI_PROCESS_USER_GID]);
1342                 has_gid = 1;
1343         }
1344
1345         if (tb[OCI_PROCESS_USER_ADDITIONALGIDS]) {
1346                 size_t gidcnt = 0;
1347
1348                 blobmsg_for_each_attr(cur, tb[OCI_PROCESS_USER_ADDITIONALGIDS], rem) {
1349                         ++gidcnt;
1350                         if (has_gid && (blobmsg_get_u32(cur) == opts.gr_gid))
1351                                 continue;
1352                 }
1353
1354                 if (gidcnt) {
1355                         opts.additional_gids = calloc(gidcnt + has_gid, sizeof(gid_t));
1356                         gidcnt = 0;
1357
1358                         /* always add primary GID to set of GIDs if set */
1359                         if (has_gid)
1360                                 opts.additional_gids[gidcnt++] = opts.gr_gid;
1361
1362                         blobmsg_for_each_attr(cur, tb[OCI_PROCESS_USER_ADDITIONALGIDS], rem) {
1363                                 if (has_gid && (blobmsg_get_u32(cur) == opts.gr_gid))
1364                                         continue;
1365                                 opts.additional_gids[gidcnt++] = blobmsg_get_u32(cur);
1366                         }
1367                         opts.num_additional_gids = gidcnt;
1368                 }
1369                 DEBUG("read %lu additional groups\n", gidcnt);
1370         }
1371
1372         if (tb[OCI_PROCESS_USER_UMASK]) {
1373                 opts.umask = blobmsg_get_u32(tb[OCI_PROCESS_USER_UMASK]);
1374                 opts.set_umask = true;
1375         }
1376
1377         return 0;
1378 }
1379
1380 /* from manpage GETRLIMIT(2) */
1381 static const char* const rlimit_names[RLIM_NLIMITS] = {
1382         [RLIMIT_AS] = "AS",
1383         [RLIMIT_CORE] = "CORE",
1384         [RLIMIT_CPU] = "CPU",
1385         [RLIMIT_DATA] = "DATA",
1386         [RLIMIT_FSIZE] = "FSIZE",
1387         [RLIMIT_LOCKS] = "LOCKS",
1388         [RLIMIT_MEMLOCK] = "MEMLOCK",
1389         [RLIMIT_MSGQUEUE] = "MSGQUEUE",
1390         [RLIMIT_NICE] = "NICE",
1391         [RLIMIT_NOFILE] = "NOFILE",
1392         [RLIMIT_NPROC] = "NPROC",
1393         [RLIMIT_RSS] = "RSS",
1394         [RLIMIT_RTPRIO] = "RTPRIO",
1395         [RLIMIT_RTTIME] = "RTTIME",
1396         [RLIMIT_SIGPENDING] = "SIGPENDING",
1397         [RLIMIT_STACK] = "STACK",
1398 };
1399
1400 static int resolve_rlimit(char *type) {
1401         unsigned int rltype;
1402
1403         for (rltype = 0; rltype < RLIM_NLIMITS; ++rltype)
1404                 if (rlimit_names[rltype] &&
1405                     !strncmp("RLIMIT_", type, 7) &&
1406                     !strcmp(rlimit_names[rltype], type + 7))
1407                         return rltype;
1408
1409         return -1;
1410 }
1411
1412
1413 static int parseOCIrlimits(struct blob_attr *msg)
1414 {
1415         struct blob_attr *cur, *cure;
1416         int rem, reme;
1417         int limtype = -1;
1418         struct rlimit *curlim;
1419         rlim_t soft, hard;
1420         bool sethard = false, setsoft = false;
1421
1422         blobmsg_for_each_attr(cur, msg, rem) {
1423                 blobmsg_for_each_attr(cure, cur, reme) {
1424                         if (!strcmp(blobmsg_name(cure), "type") && (blobmsg_type(cure) == BLOBMSG_TYPE_STRING)) {
1425                                 limtype = resolve_rlimit(blobmsg_get_string(cure));
1426                         } else if (!strcmp(blobmsg_name(cure), "soft")) {
1427                                 switch (blobmsg_type(cure)) {
1428                                         case BLOBMSG_TYPE_INT32:
1429                                                 soft = blobmsg_get_u32(cure);
1430                                                 break;
1431                                         case BLOBMSG_TYPE_INT64:
1432                                                 soft = blobmsg_get_u64(cure);
1433                                                 break;
1434                                         default:
1435                                                 return EINVAL;
1436                                 }
1437                                 setsoft = true;
1438                         } else if (!strcmp(blobmsg_name(cure), "hard")) {
1439                                 switch (blobmsg_type(cure)) {
1440                                         case BLOBMSG_TYPE_INT32:
1441                                                 hard = blobmsg_get_u32(cure);
1442                                                 break;
1443                                         case BLOBMSG_TYPE_INT64:
1444                                                 hard = blobmsg_get_u64(cure);
1445                                                 break;
1446                                         default:
1447                                                 return EINVAL;
1448                                 }
1449                                 sethard = true;
1450                         } else {
1451                                 return EINVAL;
1452                         }
1453                 }
1454
1455                 if (limtype < 0)
1456                         return EINVAL;
1457
1458                 if (opts.rlimits[limtype])
1459                         return ENOTUNIQ;
1460
1461                 if (!sethard || !setsoft)
1462                         return ENODATA;
1463
1464                 curlim = malloc(sizeof(struct rlimit));
1465                 curlim->rlim_cur = soft;
1466                 curlim->rlim_max = hard;
1467
1468                 opts.rlimits[limtype] = curlim;
1469         }
1470
1471         return 0;
1472 };
1473
1474 enum {
1475         OCI_PROCESS_ARGS,
1476         OCI_PROCESS_CAPABILITIES,
1477         OCI_PROCESS_CWD,
1478         OCI_PROCESS_ENV,
1479         OCI_PROCESS_OOMSCOREADJ,
1480         OCI_PROCESS_NONEWPRIVILEGES,
1481         OCI_PROCESS_RLIMITS,
1482         OCI_PROCESS_TERMINAL,
1483         OCI_PROCESS_USER,
1484         __OCI_PROCESS_MAX,
1485 };
1486
1487 static const struct blobmsg_policy oci_process_policy[] = {
1488         [OCI_PROCESS_ARGS] = { "args", BLOBMSG_TYPE_ARRAY },
1489         [OCI_PROCESS_CAPABILITIES] = { "capabilities", BLOBMSG_TYPE_TABLE },
1490         [OCI_PROCESS_CWD] = { "cwd", BLOBMSG_TYPE_STRING },
1491         [OCI_PROCESS_ENV] = { "env", BLOBMSG_TYPE_ARRAY },
1492         [OCI_PROCESS_OOMSCOREADJ] = { "oomScoreAdj", BLOBMSG_TYPE_INT32 },
1493         [OCI_PROCESS_NONEWPRIVILEGES] = { "noNewPrivileges", BLOBMSG_TYPE_BOOL },
1494         [OCI_PROCESS_RLIMITS] = { "rlimits", BLOBMSG_TYPE_ARRAY },
1495         [OCI_PROCESS_TERMINAL] = { "terminal", BLOBMSG_TYPE_BOOL },
1496         [OCI_PROCESS_USER] = { "user", BLOBMSG_TYPE_TABLE },
1497 };
1498
1499
1500 static int parseOCIprocess(struct blob_attr *msg)
1501 {
1502         struct blob_attr *tb[__OCI_PROCESS_MAX];
1503         int res;
1504
1505         blobmsg_parse(oci_process_policy, __OCI_PROCESS_MAX, tb, blobmsg_data(msg), blobmsg_len(msg));
1506
1507         if (!tb[OCI_PROCESS_ARGS])
1508                 return ENOENT;
1509
1510         res = parseOCIenvarray(tb[OCI_PROCESS_ARGS], &opts.jail_argv);
1511         if (res)
1512                 return res;
1513
1514         opts.console = blobmsg_get_bool(tb[OCI_PROCESS_TERMINAL]);
1515         opts.no_new_privs = blobmsg_get_bool(tb[OCI_PROCESS_NONEWPRIVILEGES]);
1516
1517         if (tb[OCI_PROCESS_CWD])
1518                 opts.cwd = strdup(blobmsg_get_string(tb[OCI_PROCESS_CWD]));
1519
1520         if (tb[OCI_PROCESS_ENV]) {
1521                 res = parseOCIenvarray(tb[OCI_PROCESS_ENV], &opts.envp);
1522                 if (res)
1523                         return res;
1524         }
1525
1526         if (tb[OCI_PROCESS_USER] && (res = parseOCIprocessuser(tb[OCI_PROCESS_USER])))
1527                 return res;
1528
1529         if (tb[OCI_PROCESS_CAPABILITIES] &&
1530             (res = parseOCIcapabilities(&opts.capset, tb[OCI_PROCESS_CAPABILITIES])))
1531                 return res;
1532
1533         if (tb[OCI_PROCESS_RLIMITS] &&
1534             (res = parseOCIrlimits(tb[OCI_PROCESS_RLIMITS])))
1535                 return res;
1536
1537         if (tb[OCI_PROCESS_OOMSCOREADJ]) {
1538                 opts.oom_score_adj = blobmsg_get_u32(tb[OCI_PROCESS_OOMSCOREADJ]);
1539                 opts.set_oom_score_adj = true;
1540         }
1541
1542         return 0;
1543 }
1544
1545 enum {
1546         OCI_LINUX_NAMESPACE_TYPE,
1547         OCI_LINUX_NAMESPACE_PATH,
1548         __OCI_LINUX_NAMESPACE_MAX,
1549 };
1550
1551 static const struct blobmsg_policy oci_linux_namespace_policy[] = {
1552         [OCI_LINUX_NAMESPACE_TYPE] = { "type", BLOBMSG_TYPE_STRING },
1553         [OCI_LINUX_NAMESPACE_PATH] = { "path", BLOBMSG_TYPE_STRING },
1554 };
1555
1556 static unsigned int resolve_nstype(char *type) {
1557         if (!strcmp("pid", type))
1558                 return CLONE_NEWPID;
1559         else if (!strcmp("network", type))
1560                 return CLONE_NEWNET;
1561         else if (!strcmp("mount", type))
1562                 return CLONE_NEWNS;
1563         else if (!strcmp("ipc", type))
1564                 return CLONE_NEWIPC;
1565         else if (!strcmp("uts", type))
1566                 return CLONE_NEWUTS;
1567         else if (!strcmp("user", type))
1568                 return CLONE_NEWUSER;
1569         else if (!strcmp("cgroup", type))
1570                 return CLONE_NEWCGROUP;
1571         else
1572                 return 0;
1573 }
1574
1575 static int parseOCIlinuxns(struct blob_attr *msg)
1576 {
1577         struct blob_attr *tb[__OCI_LINUX_NAMESPACE_MAX];
1578
1579         blobmsg_parse(oci_linux_namespace_policy, __OCI_LINUX_NAMESPACE_MAX, tb, blobmsg_data(msg), blobmsg_len(msg));
1580
1581         if (!tb[OCI_LINUX_NAMESPACE_TYPE])
1582                 return EINVAL;
1583
1584         if (tb[OCI_LINUX_NAMESPACE_PATH])
1585                 return ENOTSUP; /* ToDo */
1586
1587         opts.namespace |= resolve_nstype(blobmsg_get_string(tb[OCI_LINUX_NAMESPACE_TYPE]));
1588
1589         return 0;
1590 };
1591
1592
1593 enum {
1594         OCI_LINUX_UIDGIDMAP_CONTAINERID,
1595         OCI_LINUX_UIDGIDMAP_HOSTID,
1596         OCI_LINUX_UIDGIDMAP_SIZE,
1597         __OCI_LINUX_UIDGIDMAP_MAX,
1598 };
1599
1600 static const struct blobmsg_policy oci_linux_uidgidmap_policy[] = {
1601         [OCI_LINUX_UIDGIDMAP_CONTAINERID] = { "containerID", BLOBMSG_TYPE_INT32 },
1602         [OCI_LINUX_UIDGIDMAP_HOSTID] = { "hostID", BLOBMSG_TYPE_INT32 },
1603         [OCI_LINUX_UIDGIDMAP_SIZE] = { "size", BLOBMSG_TYPE_INT32 },
1604 };
1605
1606 static int parseOCIuidgidmappings(struct blob_attr *msg, bool is_gidmap)
1607 {
1608         const char *map_format = "%d %d %d\n";
1609         struct blob_attr *tb[__OCI_LINUX_UIDGIDMAP_MAX];
1610         struct blob_attr *cur;
1611         int rem, len;
1612         char **mappings;
1613         char *map, *curstr;
1614         unsigned int cnt = 0;
1615         size_t totallen = 0;
1616
1617         /* count number of mappings */
1618         blobmsg_for_each_attr(cur, msg, rem)
1619                 cnt++;
1620
1621         if (!cnt)
1622                 return 0;
1623
1624         /* allocate array for mappings */
1625         mappings = calloc(1 + cnt, sizeof(char*));
1626         if (!mappings)
1627                 return ENOMEM;
1628
1629         mappings[cnt] = NULL;
1630
1631         cnt = 0;
1632         blobmsg_for_each_attr(cur, msg, rem) {
1633                 blobmsg_parse(oci_linux_uidgidmap_policy, __OCI_LINUX_UIDGIDMAP_MAX, tb, blobmsg_data(cur), blobmsg_len(cur));
1634
1635                 if (!tb[OCI_LINUX_UIDGIDMAP_CONTAINERID] ||
1636                     !tb[OCI_LINUX_UIDGIDMAP_HOSTID] ||
1637                     !tb[OCI_LINUX_UIDGIDMAP_SIZE])
1638                         return EINVAL;
1639
1640                 /* write mapping line into allocated string */
1641                 len = asprintf(&mappings[cnt++], map_format,
1642                          blobmsg_get_u32(tb[OCI_LINUX_UIDGIDMAP_CONTAINERID]),
1643                          blobmsg_get_u32(tb[OCI_LINUX_UIDGIDMAP_HOSTID]),
1644                          blobmsg_get_u32(tb[OCI_LINUX_UIDGIDMAP_SIZE]));
1645
1646                 if (len < 0)
1647                         return ENOMEM;
1648
1649                 totallen += len;
1650         }
1651
1652         /* allocate combined mapping string */
1653         map = calloc(1 + totallen, sizeof(char));
1654         if (!map)
1655                 return ENOMEM;
1656
1657         map[0] = '\0';
1658
1659         /* concatenate mapping strings into combined string */
1660         curstr = mappings[0];
1661         while (curstr) {
1662                 strcat(map, curstr);
1663                 free(curstr++);
1664         }
1665         free(mappings);
1666
1667         if (is_gidmap)
1668                 opts.gidmap = map;
1669         else
1670                 opts.uidmap = map;
1671
1672         return 0;
1673 }
1674
1675 enum {
1676         OCI_DEVICES_TYPE,
1677         OCI_DEVICES_PATH,
1678         OCI_DEVICES_MAJOR,
1679         OCI_DEVICES_MINOR,
1680         OCI_DEVICES_FILEMODE,
1681         OCI_DEVICES_UID,
1682         OCI_DEVICES_GID,
1683         __OCI_DEVICES_MAX,
1684 };
1685
1686 static const struct blobmsg_policy oci_devices_policy[] = {
1687         [OCI_DEVICES_TYPE] = { "type", BLOBMSG_TYPE_STRING },
1688         [OCI_DEVICES_PATH] = { "path", BLOBMSG_TYPE_STRING },
1689         [OCI_DEVICES_MAJOR] = { "major", BLOBMSG_TYPE_INT32 },
1690         [OCI_DEVICES_MINOR] = { "minor", BLOBMSG_TYPE_INT32 },
1691         [OCI_DEVICES_FILEMODE] = { "fileMode", BLOBMSG_TYPE_INT32 },
1692         [OCI_DEVICES_UID] = { "uid", BLOBMSG_TYPE_INT32 },
1693         [OCI_DEVICES_GID] = { "uid", BLOBMSG_TYPE_INT32 },
1694 };
1695
1696 static mode_t resolve_devtype(char *tstr)
1697 {
1698         if (!strcmp("c", tstr) ||
1699             !strcmp("u", tstr))
1700                 return S_IFCHR;
1701         else if (!strcmp("b", tstr))
1702                 return S_IFBLK;
1703         else if (!strcmp("p", tstr))
1704                 return S_IFIFO;
1705         else
1706                 return 0;
1707 }
1708
1709 static int parseOCIdevices(struct blob_attr *msg)
1710 {
1711         struct blob_attr *tb[__OCI_DEVICES_MAX];
1712         struct blob_attr *cur;
1713         int rem;
1714         size_t cnt = 0;
1715         struct mknod_args *tmp;
1716
1717         blobmsg_for_each_attr(cur, msg, rem)
1718                 ++cnt;
1719
1720         opts.devices = calloc(cnt + 1, sizeof(struct mknod_args *));
1721
1722         cnt = 0;
1723         blobmsg_for_each_attr(cur, msg, rem) {
1724                 blobmsg_parse(oci_devices_policy, __OCI_DEVICES_MAX, tb, blobmsg_data(cur), blobmsg_len(cur));
1725                 if (!tb[OCI_DEVICES_TYPE] ||
1726                     !tb[OCI_DEVICES_PATH])
1727                         return ENODATA;
1728
1729                 tmp = calloc(1, sizeof(struct mknod_args));
1730                 if (!tmp)
1731                         return ENOMEM;
1732
1733                 tmp->mode = resolve_devtype(blobmsg_get_string(tb[OCI_DEVICES_TYPE]));
1734                 if (!tmp->mode)
1735                         return EINVAL;
1736
1737                 if (tmp->mode != S_IFIFO) {
1738                         if (!tb[OCI_DEVICES_MAJOR] || !tb[OCI_DEVICES_MINOR])
1739                                 return ENODATA;
1740
1741                         tmp->dev = makedev(blobmsg_get_u32(tb[OCI_DEVICES_MAJOR]),
1742                                            blobmsg_get_u32(tb[OCI_DEVICES_MINOR]));
1743                 }
1744
1745                 if (tb[OCI_DEVICES_FILEMODE]) {
1746                         if (~(S_IRWXU|S_IRWXG|S_IRWXO) & blobmsg_get_u32(tb[OCI_DEVICES_FILEMODE]))
1747                                 return EINVAL;
1748
1749                         tmp->mode |= blobmsg_get_u32(tb[OCI_DEVICES_FILEMODE]);
1750                 } else {
1751                         tmp->mode |= (S_IRUSR|S_IWUSR); /* 0600 */
1752                 }
1753
1754                 tmp->path = strdup(blobmsg_get_string(tb[OCI_DEVICES_PATH]));
1755
1756                 if (tb[OCI_DEVICES_UID])
1757                         tmp->uid = blobmsg_get_u32(tb[OCI_DEVICES_UID]);
1758                 else
1759                         tmp->uid = -1;
1760
1761                 if (tb[OCI_DEVICES_GID])
1762                         tmp->gid = blobmsg_get_u32(tb[OCI_DEVICES_GID]);
1763                 else
1764                         tmp->gid = -1;
1765
1766                 DEBUG("read device %s (%s)\n", blobmsg_get_string(tb[OCI_DEVICES_PATH]), blobmsg_get_string(tb[OCI_DEVICES_TYPE]));
1767                 opts.devices[cnt++] = tmp;
1768         }
1769
1770         opts.devices[cnt] = NULL;
1771
1772         return 0;
1773 }
1774
1775 enum {
1776         OCI_LINUX_RESOURCES,
1777         OCI_LINUX_SECCOMP,
1778         OCI_LINUX_SYSCTL,
1779         OCI_LINUX_NAMESPACES,
1780         OCI_LINUX_DEVICES,
1781         OCI_LINUX_UIDMAPPINGS,
1782         OCI_LINUX_GIDMAPPINGS,
1783         OCI_LINUX_MASKEDPATHS,
1784         OCI_LINUX_READONLYPATHS,
1785         OCI_LINUX_ROOTFSPROPAGATION,
1786         __OCI_LINUX_MAX,
1787 };
1788
1789 static const struct blobmsg_policy oci_linux_policy[] = {
1790         [OCI_LINUX_RESOURCES] = { "resources", BLOBMSG_TYPE_TABLE },
1791         [OCI_LINUX_SECCOMP] = { "seccomp", BLOBMSG_TYPE_TABLE },
1792         [OCI_LINUX_SYSCTL] = { "sysctl", BLOBMSG_TYPE_TABLE },
1793         [OCI_LINUX_NAMESPACES] = { "namespaces", BLOBMSG_TYPE_ARRAY },
1794         [OCI_LINUX_DEVICES] = { "devices", BLOBMSG_TYPE_ARRAY },
1795         [OCI_LINUX_UIDMAPPINGS] = { "uidMappings", BLOBMSG_TYPE_ARRAY },
1796         [OCI_LINUX_GIDMAPPINGS] = { "gidMappings", BLOBMSG_TYPE_ARRAY },
1797         [OCI_LINUX_MASKEDPATHS] = { "maskedPaths", BLOBMSG_TYPE_ARRAY },
1798         [OCI_LINUX_READONLYPATHS] = { "readonlyPaths", BLOBMSG_TYPE_ARRAY },
1799         [OCI_LINUX_ROOTFSPROPAGATION] = { "rootfsPropagation", BLOBMSG_TYPE_STRING },
1800 };
1801
1802 static int parseOCIsysctl(struct blob_attr *msg)
1803 {
1804         struct blob_attr *cur;
1805         int rem;
1806         char *tmp, *tc;
1807         size_t cnt = 0;
1808
1809         blobmsg_for_each_attr(cur, msg, rem) {
1810                 if (!blobmsg_name(cur) || !blobmsg_get_string(cur))
1811                         return EINVAL;
1812
1813                 ++cnt;
1814         }
1815
1816         if (!cnt)
1817                 return 0;
1818
1819         opts.sysctl = calloc(cnt + 1, sizeof(struct sysctl_val *));
1820         if (!opts.sysctl)
1821                 return ENOMEM;
1822
1823         cnt = 0;
1824         blobmsg_for_each_attr(cur, msg, rem) {
1825                 opts.sysctl[cnt] = malloc(sizeof(struct sysctl_val));
1826                 if (!opts.sysctl[cnt])
1827                         return ENOMEM;
1828
1829                 /* replace '.' with '/' in entry name */
1830                 tc = tmp = strdup(blobmsg_name(cur));
1831                 while ((tc = strchr(tc, '.')))
1832                         *tc = '/';
1833
1834                 opts.sysctl[cnt]->value = strdup(blobmsg_get_string(cur));
1835                 opts.sysctl[cnt]->entry = tmp;
1836
1837                 ++cnt;
1838         }
1839
1840         opts.sysctl[cnt] = NULL;
1841
1842         return 0;
1843 }
1844
1845 static int parseOCIlinux(struct blob_attr *msg)
1846 {
1847         struct blob_attr *tb[__OCI_LINUX_MAX];
1848         struct blob_attr *cur;
1849         int rem;
1850         int res = 0;
1851
1852         blobmsg_parse(oci_linux_policy, __OCI_LINUX_MAX, tb, blobmsg_data(msg), blobmsg_len(msg));
1853
1854         if (tb[OCI_LINUX_NAMESPACES]) {
1855                 blobmsg_for_each_attr(cur, tb[OCI_LINUX_NAMESPACES], rem) {
1856                         res = parseOCIlinuxns(cur);
1857                         if (res)
1858                                 return res;
1859                 }
1860         }
1861
1862         if (tb[OCI_LINUX_UIDMAPPINGS]) {
1863                 res = parseOCIuidgidmappings(tb[OCI_LINUX_GIDMAPPINGS], 0);
1864                 if (res)
1865                         return res;
1866         }
1867
1868         if (tb[OCI_LINUX_GIDMAPPINGS]) {
1869                 res = parseOCIuidgidmappings(tb[OCI_LINUX_GIDMAPPINGS], 1);
1870                 if (res)
1871                         return res;
1872         }
1873
1874         if (tb[OCI_LINUX_READONLYPATHS]) {
1875                 blobmsg_for_each_attr(cur, tb[OCI_LINUX_READONLYPATHS], rem) {
1876                         res = add_mount(NULL, blobmsg_get_string(cur), NULL, MS_BIND | MS_REC | MS_RDONLY, NULL, 0);
1877                         if (res)
1878                                 return res;
1879                 }
1880         }
1881
1882         if (tb[OCI_LINUX_MASKEDPATHS]) {
1883                 blobmsg_for_each_attr(cur, tb[OCI_LINUX_MASKEDPATHS], rem) {
1884                         res = add_mount((void *)(-1), blobmsg_get_string(cur), NULL, 0, NULL, 1);
1885                         if (res)
1886                                 return res;
1887                 }
1888         }
1889
1890         if (tb[OCI_LINUX_SYSCTL]) {
1891                 res = parseOCIsysctl(tb[OCI_LINUX_SYSCTL]);
1892                 if (res)
1893                         return res;
1894         }
1895
1896         if (tb[OCI_LINUX_SECCOMP]) {
1897                 opts.ociseccomp = parseOCIlinuxseccomp(tb[OCI_LINUX_SECCOMP]);
1898                 if (!opts.ociseccomp)
1899                         return EINVAL;
1900         }
1901
1902         if (tb[OCI_LINUX_DEVICES]) {
1903                 res = parseOCIdevices(tb[OCI_LINUX_DEVICES]);
1904                 if (res)
1905                         return res;
1906         }
1907
1908         return 0;
1909 }
1910
1911 enum {
1912         OCI_VERSION,
1913         OCI_HOSTNAME,
1914         OCI_PROCESS,
1915         OCI_ROOT,
1916         OCI_MOUNTS,
1917         OCI_HOOKS,
1918         OCI_LINUX,
1919         __OCI_MAX,
1920 };
1921
1922 static const struct blobmsg_policy oci_policy[] = {
1923         [OCI_VERSION] = { "ociVersion", BLOBMSG_TYPE_STRING },
1924         [OCI_HOSTNAME] = { "hostname", BLOBMSG_TYPE_STRING },
1925         [OCI_PROCESS] = { "process", BLOBMSG_TYPE_TABLE },
1926         [OCI_ROOT] = { "root", BLOBMSG_TYPE_TABLE },
1927         [OCI_MOUNTS] = { "mounts", BLOBMSG_TYPE_ARRAY },
1928         [OCI_HOOKS] = { "hooks", BLOBMSG_TYPE_TABLE },
1929         [OCI_LINUX] = { "linux", BLOBMSG_TYPE_TABLE },
1930 };
1931
1932 static int parseOCI(const char *jsonfile)
1933 {
1934         struct blob_attr *tb[__OCI_MAX];
1935         struct blob_attr *cur;
1936         int rem;
1937         int res;
1938
1939         blob_buf_init(&ocibuf, 0);
1940         if (!blobmsg_add_json_from_file(&ocibuf, jsonfile))
1941                 return ENOENT;
1942
1943         blobmsg_parse(oci_policy, __OCI_MAX, tb, blob_data(ocibuf.head), blob_len(ocibuf.head));
1944
1945         if (!tb[OCI_VERSION])
1946                 return ENOMSG;
1947
1948         if (strncmp("1.0", blobmsg_get_string(tb[OCI_VERSION]), 3)) {
1949                 ERROR("unsupported ociVersion %s\n", blobmsg_get_string(tb[OCI_VERSION]));
1950                 return ENOTSUP;
1951         }
1952
1953         if (tb[OCI_HOSTNAME])
1954                 opts.hostname = strdup(blobmsg_get_string(tb[OCI_HOSTNAME]));
1955
1956         if (!tb[OCI_PROCESS])
1957                 return ENODATA;
1958
1959         if ((res = parseOCIprocess(tb[OCI_PROCESS])))
1960                 return res;
1961
1962         if (!tb[OCI_ROOT])
1963                 return ENODATA;
1964
1965         if ((res = parseOCIroot(jsonfile, tb[OCI_ROOT])))
1966                 return res;
1967
1968         if (!tb[OCI_MOUNTS])
1969                 return ENODATA;
1970
1971         blobmsg_for_each_attr(cur, tb[OCI_MOUNTS], rem)
1972                 if ((res = parseOCImount(cur)))
1973                         return res;
1974
1975         if (tb[OCI_LINUX] && (res = parseOCIlinux(tb[OCI_LINUX])))
1976                 return res;
1977
1978         if (tb[OCI_HOOKS] && (res = parseOCIhooks(tb[OCI_HOOKS])))
1979                 return res;
1980
1981         blob_buf_free(&ocibuf);
1982
1983         return 0;
1984 }
1985
1986 static int set_oom_score_adj(void)
1987 {
1988         int f;
1989         char fname[32];
1990
1991         if (!opts.set_oom_score_adj)
1992                 return 0;
1993
1994         snprintf(fname, sizeof(fname), "/proc/%u/oom_score_adj", jail_process.pid);
1995         f = open(fname, O_WRONLY | O_TRUNC);
1996         if (f == -1)
1997                 return errno;
1998
1999         dprintf(f, "%d", opts.oom_score_adj);
2000         close(f);
2001
2002         return 0;
2003 }
2004
2005 int main(int argc, char **argv)
2006 {
2007         sigset_t sigmask;
2008         uid_t uid = getuid();
2009         const char log[] = "/dev/log";
2010         const char ubus[] = "/var/run/ubus.sock";
2011         char *jsonfile = NULL;
2012         int i, ch;
2013         int pipes[4];
2014         char sig_buf[1];
2015         int netns_fd;
2016
2017         if (uid) {
2018                 ERROR("not root, aborting: %m\n");
2019                 return EXIT_FAILURE;
2020         }
2021
2022         umask(022);
2023         mount_list_init();
2024         init_library_search();
2025
2026         while ((ch = getopt(argc, argv, OPT_ARGS)) != -1) {
2027                 switch (ch) {
2028                 case 'd':
2029                         debug = atoi(optarg);
2030                         break;
2031                 case 'p':
2032                         opts.namespace |= CLONE_NEWNS;
2033                         opts.procfs = 1;
2034                         break;
2035                 case 'o':
2036                         opts.namespace |= CLONE_NEWNS;
2037                         opts.ronly = 1;
2038                         break;
2039                 case 'f':
2040                         opts.namespace |= CLONE_NEWUSER;
2041                         break;
2042                 case 'F':
2043                         opts.namespace |= CLONE_NEWCGROUP;
2044                         break;
2045                 case 'R':
2046                         opts.extroot = strdup(optarg);
2047                         break;
2048                 case 's':
2049                         opts.namespace |= CLONE_NEWNS;
2050                         opts.sysfs = 1;
2051                         break;
2052                 case 'S':
2053                         opts.seccomp = optarg;
2054                         add_mount_bind(optarg, 1, -1);
2055                         break;
2056                 case 'C':
2057                         opts.capabilities = optarg;
2058                         break;
2059                 case 'c':
2060                         opts.no_new_privs = 1;
2061                         break;
2062                 case 'n':
2063                         opts.name = optarg;
2064                         break;
2065                 case 'N':
2066                         opts.namespace |= CLONE_NEWNET;
2067                         break;
2068                 case 'h':
2069                         opts.namespace |= CLONE_NEWUTS;
2070                         opts.hostname = strdup(optarg);
2071                         break;
2072                 case 'r':
2073                         opts.namespace |= CLONE_NEWNS;
2074                         add_path_and_deps(optarg, 1, 0, 0);
2075                         break;
2076                 case 'w':
2077                         opts.namespace |= CLONE_NEWNS;
2078                         add_path_and_deps(optarg, 0, 0, 0);
2079                         break;
2080                 case 'u':
2081                         opts.namespace |= CLONE_NEWNS;
2082                         add_mount_bind(ubus, 0, -1);
2083                         break;
2084                 case 'l':
2085                         opts.namespace |= CLONE_NEWNS;
2086                         add_mount_bind(log, 0, -1);
2087                         break;
2088                 case 'U':
2089                         opts.user = optarg;
2090                         break;
2091                 case 'G':
2092                         opts.group = optarg;
2093                         break;
2094                 case 'O':
2095                         opts.overlaydir = optarg;
2096                         break;
2097                 case 'T':
2098                         opts.tmpoverlaysize = optarg;
2099                         break;
2100                 case 'E':
2101                         opts.require_jail = 1;
2102                         break;
2103                 case 'y':
2104                         opts.console = 1;
2105                         break;
2106                 case 'J':
2107                         asprintf(&jsonfile, "%s/config.json", optarg);
2108                         break;
2109                 }
2110         }
2111
2112         if (opts.namespace)
2113                 opts.namespace |= CLONE_NEWIPC | CLONE_NEWPID;
2114
2115         if (jsonfile) {
2116                 int ocires;
2117                 ocires = parseOCI(jsonfile);
2118                 free(jsonfile);
2119                 if (ocires) {
2120                         ERROR("parsing of OCI JSON spec has failed: %s (%d)\n", strerror(ocires), ocires);
2121                         return ocires;
2122                 }
2123         }
2124
2125         if (opts.tmpoverlaysize && strlen(opts.tmpoverlaysize) > 8) {
2126                 ERROR("size parameter too long: \"%s\"\n", opts.tmpoverlaysize);
2127                 return -1;
2128         }
2129
2130         /* no <binary> param found */
2131         if (!jsonfile && (argc - optind < 1)) {
2132                 usage();
2133                 return EXIT_FAILURE;
2134         }
2135         if (!(opts.namespace||opts.capabilities||opts.seccomp)) {
2136                 ERROR("Not using namespaces, capabilities or seccomp !!!\n\n");
2137                 usage();
2138                 return EXIT_FAILURE;
2139         }
2140         DEBUG("Using namespaces(0x%08x), capabilities(%d), seccomp(%d)\n",
2141                 opts.namespace,
2142                 opts.capabilities != 0 || opts.capset.apply,
2143                 opts.seccomp != 0 || opts.ociseccomp != 0);
2144
2145         if (!jsonfile) {
2146                 /* allocate NULL-terminated array for argv */
2147                 opts.jail_argv = calloc(1 + argc - optind, sizeof(char**));
2148                 if (!opts.jail_argv)
2149                         return EXIT_FAILURE;
2150
2151                 for (size_t s = optind; s < argc; s++)
2152                         opts.jail_argv[s - optind] = strdup(argv[s]);
2153
2154                 if (opts.namespace & CLONE_NEWUSER)
2155                         get_jail_user(&opts.pw_uid, &opts.pw_gid, &opts.gr_gid);
2156         }
2157
2158         if (!opts.extroot) {
2159                 if (opts.namespace && add_path_and_deps(*opts.jail_argv, 1, -1, 0)) {
2160                         ERROR("failed to load dependencies\n");
2161                         return -1;
2162                 }
2163         }
2164
2165         if (opts.namespace && opts.seccomp && add_path_and_deps("libpreload-seccomp.so", 1, -1, 1)) {
2166                 ERROR("failed to load libpreload-seccomp.so\n");
2167                 opts.seccomp = 0;
2168                 if (opts.require_jail)
2169                         return -1;
2170         }
2171
2172         if (apply_rlimits()) {
2173                 ERROR("error applying resource limits\n");
2174                 exit(EXIT_FAILURE);
2175         }
2176
2177         if (opts.name)
2178                 prctl(PR_SET_NAME, opts.name, NULL, NULL, NULL);
2179
2180         sigfillset(&sigmask);
2181         for (i = 0; i < _NSIG; i++) {
2182                 struct sigaction s = { 0 };
2183
2184                 if (!sigismember(&sigmask, i))
2185                         continue;
2186                 if ((i == SIGCHLD) || (i == SIGPIPE) || (i == SIGSEGV))
2187                         continue;
2188
2189                 s.sa_handler = jail_handle_signal;
2190                 sigaction(i, &s, NULL);
2191         }
2192
2193         if (opts.namespace) {
2194                 if (opts.namespace & CLONE_NEWNS) {
2195                         if (!opts.extroot && (opts.user || opts.group)) {
2196                                 add_mount_bind("/etc/passwd", 0, -1);
2197                                 add_mount_bind("/etc/group", 0, -1);
2198                         }
2199
2200 #if defined(__GLIBC__)
2201                         if (!opts.extroot)
2202                                 add_mount_bind("/etc/nsswitch.conf", 0, -1);
2203 #endif
2204
2205                         if (!(opts.namespace & CLONE_NEWNET)) {
2206                                 add_mount_bind("/etc/resolv.conf", 0, -1);
2207                         } else {
2208                                 char hostdir[PATH_MAX];
2209
2210                                 snprintf(hostdir, PATH_MAX, "/tmp/resolv.conf-%s.d", opts.name);
2211                                 mkdir_p(hostdir, 0755);
2212                                 add_mount(hostdir, "/dev/resolv.conf.d", NULL, MS_BIND | MS_NOEXEC | MS_NOATIME | MS_NOSUID | MS_NODEV | MS_RDONLY, NULL, -1);
2213                         }
2214
2215                         /* default mounts */
2216                         add_mount(NULL, "/dev", "tmpfs", MS_NOATIME | MS_NOEXEC | MS_NOSUID, "size=1M", -1);
2217                         add_mount(NULL, "/dev/pts", "devpts", MS_NOATIME | MS_NOEXEC | MS_NOSUID, "newinstance,ptmxmode=0666,mode=0620,gid=5", 0);
2218
2219                         if (opts.procfs || jsonfile) {
2220                                 add_mount("proc", "/proc", "proc", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, NULL, -1);
2221
2222                                 /*
2223                                  * hack to make /proc/sys/net read-write while the rest of /proc/sys is read-only
2224                                  * which cannot be expressed with OCI spec, but happends to be very useful.
2225                                  * Only apply it if '/proc/sys' is not already listed as mount, maskedPath or
2226                                  * readonlyPath.
2227                                  * If not running in a new network namespace, only make /proc/sys read-only.
2228                                  * If running in a new network namespace, temporarily stash (ie. mount-bind)
2229                                  * /proc/sys/net into (totally unrelated, but surely existing) /proc/self/net.
2230                                  * Then we mount-bind /proc/sys read-only and then mount-move /proc/self/net into
2231                                  * /proc/sys/net.
2232                                  * This works because mounts are executed in incrementing strcmp() order and
2233                                  * /proc/self/net appears there before /proc/sys/net and hence the operation
2234                                  * succeeds as the bind-mount of /proc/self/net is performed first and then
2235                                  * move-mount of /proc/sys/net follows because 'e' preceeds 'y' in the ASCII
2236                                  * table (and in the alphabet).
2237                                  */
2238                                 if (!add_mount(NULL, "/proc/sys", NULL, MS_BIND | MS_RDONLY, NULL, -1))
2239                                         if (opts.namespace & CLONE_NEWNET)
2240                                                 if (!add_mount_inner("/proc/self/net", "/proc/sys/net", NULL, MS_MOVE, NULL, -1))
2241                                                         add_mount_inner("/proc/sys/net", "/proc/self/net", NULL, MS_BIND, NULL, -1);
2242
2243                         }
2244                         if (opts.sysfs || jsonfile)
2245                                 add_mount("sysfs", "/sys", "sysfs", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID | MS_RDONLY, NULL, -1);
2246
2247                         if (jsonfile)
2248                                 add_mount("shm", "/dev/shm", "tmpfs", MS_NOSUID | MS_NOEXEC | MS_NODEV, "mode=1777", -1);
2249
2250                 }
2251
2252                 if (pipe(&pipes[0]) < 0 || pipe(&pipes[2]) < 0)
2253                         return -1;
2254
2255                 jail_process.pid = clone(exec_jail, child_stack + STACK_SIZE, SIGCHLD | opts.namespace, &pipes);
2256         } else {
2257                 jail_process.pid = fork();
2258         }
2259
2260         if (jail_process.pid > 0) {
2261                 jail_running = 1;
2262                 seteuid(0);
2263                 /* parent process */
2264                 close(pipes[1]);
2265                 close(pipes[2]);
2266                 run_hooks(opts.hooks.createRuntime);
2267                 if (read(pipes[0], sig_buf, 1) < 1) {
2268                         ERROR("can't read from child\n");
2269                         return -1;
2270                 }
2271                 close(pipes[0]);
2272                 set_oom_score_adj();
2273
2274                 if (opts.namespace & CLONE_NEWUSER) {
2275                         if (write_setgroups(jail_process.pid, true)) {
2276                                 ERROR("can't write setgroups\n");
2277                                 return -1;
2278                         }
2279                         if (!opts.uidmap) {
2280                                 bool has_gr = (opts.gr_gid != -1);
2281                                 if (opts.pw_uid != -1) {
2282                                         write_single_uid_gid_map(jail_process.pid, 0, opts.pw_uid);
2283                                         write_single_uid_gid_map(jail_process.pid, 1, has_gr?opts.gr_gid:opts.pw_gid);
2284                                 } else {
2285                                         write_single_uid_gid_map(jail_process.pid, 0, 65534);
2286                                         write_single_uid_gid_map(jail_process.pid, 1, has_gr?opts.gr_gid:65534);
2287                                 }
2288                         } else {
2289                                 write_uid_gid_map(jail_process.pid, 0, opts.uidmap);
2290                                 if (opts.gidmap)
2291                                         write_uid_gid_map(jail_process.pid, 1, opts.gidmap);
2292                         }
2293                 }
2294
2295                 if (opts.namespace & CLONE_NEWNET) {
2296                         if (!opts.name) {
2297                                 ERROR("netns needs a named jail\n");
2298                                 return -1;
2299                         }
2300                         netns_fd = netns_open_pid(jail_process.pid);
2301                         netns_updown(jail_process.pid, true);
2302                 }
2303
2304                 sig_buf[0] = 'O';
2305                 if (write(pipes[3], sig_buf, 1) < 0) {
2306                         ERROR("can't write to child\n");
2307                         return -1;
2308                 }
2309                 close(pipes[3]);
2310                 run_hooks(opts.hooks.poststart);
2311
2312                 uloop_init();
2313                 uloop_process_add(&jail_process);
2314                 uloop_run();
2315                 if (jail_running) {
2316                         DEBUG("uloop interrupted, killing jail process\n");
2317                         kill(jail_process.pid, SIGTERM);
2318                         uloop_timeout_set(&jail_process_timeout, 1000);
2319                         uloop_run();
2320                 }
2321                 uloop_done();
2322                 if (opts.namespace & CLONE_NEWNET) {
2323                         setns(netns_fd, CLONE_NEWNET);
2324                         netns_updown(getpid(), false);
2325                         close(netns_fd);
2326                 }
2327                 run_hooks(opts.hooks.poststop);
2328                 free_opts(true);
2329                 return jail_return_code;
2330         } else if (jail_process.pid == 0) {
2331                 /* fork child process */
2332                 return exec_jail(NULL);
2333         } else {
2334                 ERROR("failed to clone/fork: %m\n");
2335                 return EXIT_FAILURE;
2336         }
2337 }