#include "log.h"
#include "seccomp-oci.h"
#include "cgroups.h"
+#include "netifd.h"
#include <libubox/blobmsg.h>
#include <libubox/blobmsg_json.h>
#endif
#define STACK_SIZE (1024 * 1024)
-#define OPT_ARGS "S:C:n:h:r:w:d:psulocU:G:NR:fFO:T:EyJ:iP:"
+#define OPT_ARGS "cC:d:EfFG:h:ij:J:ln:NoO:pP:r:R:sS:uU:w:T:y"
#define OCI_VERSION_STRING "1.0.2"
free(opts.uidmap);
free(opts.gidmap);
free(opts.annotations);
+ free(opts.extroot);
+ free(opts.overlaydir);
free_hooklist(opts.hooks.createRuntime);
free_hooklist(opts.hooks.createContainer);
free_hooklist(opts.hooks.startContainer);
goto upper_etc_printf;
fd = creat(upperresolvconf, 0644);
- if (fd == -1) {
+ if (fd < 0) {
if (errno != EEXIST)
ERROR("creat(%s) failed: %m\n", upperresolvconf);
} else {
/* Open UNIX/98 virtual console */
console_fd = posix_openpt(O_RDWR | O_NOCTTY);
- if (console_fd == -1)
+ if (console_fd < 0)
return -1;
console_fname = ptsname(console_fd);
/* use PTY slave for stdio */
slave_console_fd = open(console_fname, O_RDWR); /* | O_NOCTTY */
+ if (slave_console_fd < 0)
+ goto no_console;
+
dup2(slave_console_fd, 0);
dup2(slave_console_fd, 1);
dup2(slave_console_fd, 2);
struct stat s;
if (!hook)
- hook_return_cb();
+ return hook_return_cb();
DEBUG("executing hook %s\n", hook->file);
if (!opts.sysctl)
return 0;
- asprintf(&procdir, "%s/proc", jail_root);
- if (!procdir)
+ if (asprintf(&procdir, "%s/proc", jail_root) < 0)
return ENOMEM;
mkdir(procdir, 0700);
cur = opts.sysctl;
while (*cur) {
- asprintf(&fname, "%s/sys/%s", procdir, (*cur)->entry);
- if (!fname)
+ if (asprintf(&fname, "%s/sys/%s", procdir, (*cur)->entry) < 0)
return ENOMEM;
DEBUG("sysctl: writing '%s' to %s\n", (*cur)->value, fname);
f = open(fname, O_WRONLY);
- if (f == -1) {
+ if (f < 0) {
ERROR("sysctl: can't open %s\n", fname);
+ free(fname);
+ return errno;
+ }
+ if (write(f, (*cur)->value, strlen((*cur)->value)) < 0) {
+ ERROR("sysctl: write to %s\n", fname);
+ free(fname);
+ close(f);
return errno;
}
- write(f, (*cur)->value, strlen((*cur)->value));
free(fname);
close(f);
static int create_devices(void)
{
struct mknod_args **cur, *curdef;
+ char *path, *tmp;
if (!opts.devices)
goto only_default_devices;
cur = opts.devices;
while (*cur) {
- DEBUG("creating %s (mode=%08o)\n", (*cur)->path, (*cur)->mode);
- if (mknod((*cur)->path, (*cur)->mode, (*cur)->dev))
+ path = (*cur)->path;
+ /* don't allow devices outside of /dev */
+ if (strncmp(path, "/dev", 4))
+ return EPERM;
+
+ /* make sure parent folder exists */
+ tmp = strrchr(path, '/');
+ if (!tmp)
+ return EINVAL;
+
+ *tmp = '\0';
+ if (strcmp(path, "/dev")) {
+ DEBUG("creating directory %s\n", path);
+
+ mkdir_p(path, 0755);
+ }
+ *tmp = '/';
+
+ DEBUG("creating %s (mode=%08o)\n", path, (*cur)->mode);
+
+ /* create device */
+ if (mknod(path, (*cur)->mode, (*cur)->dev))
return errno;
+ /* change owner, if needed */
if (((*cur)->uid || (*cur)->gid) &&
- chown((*cur)->path, (*cur)->uid, (*cur)->gid))
+ chown(path, (*cur)->uid, (*cur)->gid))
return errno;
++cur;
}
/* Dev symbolic links as defined in OCI spec */
- symlink("/dev/pts/ptmx", "/dev/ptmx");
- symlink("/proc/self/fd", "/dev/fd");
- symlink("/proc/self/fd/0", "/dev/stdin");
- symlink("/proc/self/fd/1", "/dev/stdout");
- symlink("/proc/self/fd/2", "/dev/stderr");
+ (void) symlink("/dev/pts/ptmx", "/dev/ptmx");
+ (void) symlink("/proc/self/fd", "/dev/fd");
+ (void) symlink("/proc/self/fd/0", "/dev/stdin");
+ (void) symlink("/proc/self/fd/1", "/dev/stdout");
+ (void) symlink("/proc/self/fd/2", "/dev/stderr");
return 0;
}
static int build_jail_fs(void)
{
char *overlaydir = NULL;
+ int ret;
old_umask = umask(0);
if (opts.overlaydir)
overlaydir = opts.overlaydir;
- if (overlaydir)
- mount_overlay(jail_root, overlaydir);
+ if (overlaydir) {
+ ret = mount_overlay(jail_root, overlaydir);
+ if (ret)
+ return ret;
+ }
if (chdir(jail_root)) {
ERROR("chdir(%s) (jail_root) failed: %m\n", jail_root);
if (overlaydir)
unlink(jaillink);
- symlink("../dev/resolv.conf.d/resolv.conf.auto", jaillink);
+ (void) symlink("../dev/resolv.conf.d/resolv.conf.auto", jaillink);
}
run_hooks(opts.hooks.createContainer, enter_jail_fs);
child_pid, gidmap?"gid_map":"uid_map") < 0)
return -1;
- if ((map_file = open(map_path, O_WRONLY)) == -1)
+ if ((map_file = open(map_path, O_WRONLY)) < 0)
return -1;
if (dprintf(map_file, "%s", mapstr)) {
child_pid, gidmap?"gid_map":"uid_map") < 0)
return -1;
- if ((map_file = open(map_path, O_WRONLY)) == -1)
+ if ((map_file = open(map_path, O_WRONLY)) < 0)
return -1;
- if (dprintf(map_file, map_format, 0, id, 1) == -1) {
+ if (dprintf(map_file, map_format, 0, id, 1) < 0) {
close(map_file);
return -1;
}
return -1;
}
- if ((setgroups_file = open(setgroups_path, O_WRONLY)) == -1) {
+ if ((setgroups_file = open(setgroups_path, O_WRONLY)) < 0) {
return -1;
}
return 0;
}
-#define MAX_ENVP 16
+#define MAX_ENVP 64
static char** build_envp(const char *seccomp, char **ocienvp)
{
static char *envp[MAX_ENVP];
assert(fd != NULL);
- if (*fd == -1)
+ if (*fd < 0)
return 0;
if (setns(*fd, nstype) == -1) {
static int parseOCIroot(const char *jsonfile, struct blob_attr *msg)
{
- static char extroot[PATH_MAX] = { 0 };
+ char extroot[PATH_MAX] = { 0 };
struct blob_attr *tb[__OCI_ROOT_MAX];
char *cur;
char *root_path;
/* prepend bundle directory in case of relative paths */
if (root_path[0] != '/') {
- strncpy(extroot, jsonfile, PATH_MAX);
+ strncpy(extroot, jsonfile, PATH_MAX - 1);
+
cur = strrchr(extroot, '/');
if (!cur)
strncat(extroot, root_path, PATH_MAX - (strlen(extroot) + 1));
- opts.extroot = extroot;
+ /* follow symbolic link(s) */
+ opts.extroot = realpath(extroot, NULL);
+ if (!opts.extroot)
+ return errno;
if (tb[OCI_ROOT_READONLY])
opts.ronly = blobmsg_get_bool(tb[OCI_ROOT_READONLY]);
return CLONE_NEWPID;
else if (!strcmp("network", type))
return CLONE_NEWNET;
+ else if (!strcmp("net", type))
+ return CLONE_NEWNET;
else if (!strcmp("mount", type))
return CLONE_NEWNS;
else if (!strcmp("ipc", type))
blobmsg_get_string(tb[OCI_LINUX_NAMESPACE_PATH]));
fd = open(blobmsg_get_string(tb[OCI_LINUX_NAMESPACE_PATH]), O_RDONLY);
- if (fd == -1)
+ if (fd < 0)
return errno?:ESTALE;
- if (ioctl(fd, NS_GET_NSTYPE) != nstype)
+ if (ioctl(fd, NS_GET_NSTYPE) != nstype) {
+ close(fd);
return EINVAL;
+ }
DEBUG("opened existing %s namespace got filehandler %u\n",
blobmsg_get_string(tb[OCI_LINUX_NAMESPACE_TYPE]),
return 0;
}
+/*
+ * join namespace of existing PID
+ * The string argument is the reference PID followed by ':' and a
+ * ',' separated list of namespaces to to join.
+ */
+static int jail_join_ns(char *arg)
+{
+ pid_t pid;
+ int fd;
+ int nstype;
+ char *tmp, *etmp, *nspath;
+ int *setns;
+
+ tmp = strchr(arg, ':');
+ if (!tmp)
+ return EINVAL;
+
+ *tmp = '\0';
+ pid = atoi(arg);
+
+ do {
+ ++tmp;
+ etmp = strchr(tmp, ',');
+ if (etmp)
+ *etmp = '\0';
+
+ nstype = resolve_nstype(tmp);
+ if (!nstype)
+ return EINVAL;
+
+ if (opts.namespace & nstype)
+ return ENOTUNIQ;
+
+ setns = get_namespace_fd(nstype);
+
+ if (!setns)
+ return EFAULT;
+
+ if (*setns != -1)
+ return ENOTUNIQ;
+
+ if (asprintf(&nspath, "/proc/%d/ns/%s", pid, tmp) < 0)
+ return ENOMEM;
+
+ fd = open(nspath, O_RDONLY);
+ free(nspath);
+
+ if (fd < 0)
+ return errno?:ESTALE;
+
+ *setns = fd;
+
+ if (etmp)
+ tmp = etmp;
+ else
+ tmp = NULL;
+ } while (tmp);
+
+ return 0;
+}
+
static void get_jail_root_user(bool is_gidmap, uint32_t container_id, uint32_t host_id, uint32_t size)
{
if (container_id == 0 && size >= 1)
return ENOMEM;
tmp->mode = resolve_devtype(blobmsg_get_string(tb[OCI_DEVICES_TYPE]));
- if (!tmp->mode)
+ if (!tmp->mode) {
+ free(tmp);
return EINVAL;
+ }
if (tmp->mode != S_IFIFO) {
- if (!tb[OCI_DEVICES_MAJOR] || !tb[OCI_DEVICES_MINOR])
+ if (!tb[OCI_DEVICES_MAJOR] || !tb[OCI_DEVICES_MINOR]) {
+ free(tmp);
return ENODATA;
+ }
tmp->dev = makedev(blobmsg_get_u32(tb[OCI_DEVICES_MAJOR]),
blobmsg_get_u32(tb[OCI_DEVICES_MINOR]));
}
if (tb[OCI_DEVICES_FILEMODE]) {
- if (~(S_IRWXU|S_IRWXG|S_IRWXO) & blobmsg_get_u32(tb[OCI_DEVICES_FILEMODE]))
+ if (~(S_IRWXU|S_IRWXG|S_IRWXO) & blobmsg_get_u32(tb[OCI_DEVICES_FILEMODE])) {
+ free(tmp);
return EINVAL;
+ }
tmp->mode |= blobmsg_get_u32(tb[OCI_DEVICES_FILEMODE]);
} else {
if (tb[OCI_LINUX_CGROUPSPATH]) {
cgpath = blobmsg_get_string(tb[OCI_LINUX_CGROUPSPATH]);
if (cgpath[0] == '/') {
- if (strlen(cgpath) >= (sizeof(cgfullpath) - strlen(cgfullpath)))
+ if (strlen(cgpath) + 1 >= (sizeof(cgfullpath) - strlen(cgfullpath)))
return E2BIG;
strcat(cgfullpath, cgpath);
} else {
strcat(cgfullpath, "/containers/");
- strcat(cgfullpath, opts.name); /* should be container name rather than jail name */
- strcat(cgfullpath, "/");
- if (strlen(cgpath) >= (sizeof(cgfullpath) - strlen(cgfullpath)))
+ if (strlen(opts.name) + strlen(cgpath) + 2 >= (sizeof(cgfullpath) - strlen(cgfullpath)))
return E2BIG;
+ strcat(cgfullpath, opts.name); /* should be container name rather than jail name */
+ strcat(cgfullpath, "/");
strcat(cgfullpath, cgpath);
}
} else {
strcat(cgfullpath, "/containers/");
+ if (2 * strlen(opts.name) + 2 >= (sizeof(cgfullpath) - strlen(cgfullpath)))
+ return E2BIG;
+
strcat(cgfullpath, opts.name); /* should be container name rather than jail name */
strcat(cgfullpath, "/");
strcat(cgfullpath, opts.name); /* should be container instance name rather than jail name */
snprintf(fname, sizeof(fname), "/proc/%u/oom_score_adj", jail_process.pid);
f = open(fname, O_WRONLY | O_TRUNC);
- if (f == -1)
+ if (f < 0)
return errno;
dprintf(f, "%d", opts.oom_score_adj);
return 0;
}
+static int checkpath(const char *path)
+{
+ int dirfd = open(path, O_RDONLY | O_DIRECTORY | O_CLOEXEC);
+ if (dirfd < 0) {
+ ERROR("path %s open failed %m\n", path);
+ return -1;
+ }
+ close(dirfd);
+
+ return 0;
+}
+
static struct ubus_method container_methods[] = {
UBUS_METHOD_NOARG("start", handle_start),
UBUS_METHOD_NOARG("state", handle_state),
uid_t uid = getuid();
const char log[] = "/dev/log";
const char ubus[] = "/var/run/ubus/ubus.sock";
- int ch, ret;
+ int ret = EXIT_FAILURE;
+ int ch;
+ char *tmp;
if (uid) {
ERROR("not root, aborting: %m\n");
return EXIT_FAILURE;
}
+ /* those are filehandlers, so -1 indicates unused */
+ opts.setns.pid = -1;
+ opts.setns.net = -1;
+ opts.setns.ns = -1;
+ opts.setns.ipc = -1;
+ opts.setns.uts = -1;
+ opts.setns.user = -1;
+ opts.setns.cgroup = -1;
+#ifdef CLONE_NEWTIME
+ opts.setns.time = -1;
+#endif
+
umask(022);
mount_list_init();
init_library_search();
opts.namespace |= CLONE_NEWCGROUP;
break;
case 'R':
- opts.extroot = optarg;
+ opts.extroot = realpath(optarg, NULL);
break;
case 's':
opts.namespace |= CLONE_NEWNS;
opts.namespace |= CLONE_NEWUTS;
opts.hostname = strdup(optarg);
break;
+ case 'j':
+ jail_join_ns(optarg);
+ break;
case 'r':
opts.namespace |= CLONE_NEWNS;
- add_path_and_deps(optarg, 1, 0, 0);
+ tmp = strchr(optarg, ':');
+ if (tmp) {
+ *(tmp++) = '\0';
+ add_2paths_and_deps(optarg, tmp, 1, 0, 0);
+ } else {
+ add_path_and_deps(optarg, 1, 0, 0);
+ }
break;
case 'w':
opts.namespace |= CLONE_NEWNS;
- add_path_and_deps(optarg, 0, 0, 0);
+ tmp = strchr(optarg, ':');
+ if (tmp) {
+ *(tmp++) = '\0';
+ add_2paths_and_deps(optarg, tmp, 0, 0, 0);
+ } else {
+ add_path_and_deps(optarg, 0, 0, 0);
+ }
break;
case 'u':
opts.namespace |= CLONE_NEWNS;
opts.group = optarg;
break;
case 'O':
- opts.overlaydir = optarg;
+ opts.overlaydir = realpath(optarg, NULL);
break;
case 'T':
opts.tmpoverlaysize = optarg;
if (opts.namespace && !opts.ocibundle)
opts.namespace |= CLONE_NEWIPC | CLONE_NEWPID;
- /* those are filehandlers, so -1 indicates unused */
- opts.setns.pid = -1;
- opts.setns.net = -1;
- opts.setns.ns = -1;
- opts.setns.ipc = -1;
- opts.setns.uts = -1;
- opts.setns.user = -1;
- opts.setns.cgroup = -1;
-#ifdef CLONE_NEWTIME
- opts.setns.time = -1;
-#endif
-
/*
* uid in parent user namespace representing root user in new
* user namespace, defaults to nobody unless specified in uidMappings
ret=-1;
goto errout;
}
- asprintf(&jsonfile, "%s/config.json", opts.ocibundle);
+ if (asprintf(&jsonfile, "%s/config.json", opts.ocibundle) < 0) {
+ ret=-ENOMEM;
+ goto errout;
+ }
ocires = parseOCI(jsonfile);
free(jsonfile);
if (ocires) {
goto errout;
}
+ if (opts.extroot && checkpath(opts.extroot)) {
+ ERROR("invalid rootfs path '%s'", opts.extroot);
+ ret=-1;
+ goto errout;
+ }
+
+ if (opts.overlaydir && checkpath(opts.overlaydir)) {
+ ERROR("invalid rootfs overlay path '%s'", opts.overlaydir);
+ ret=-1;
+ goto errout;
+ }
+
/* no <binary> param found */
if (!opts.ocibundle && (argc - optind < 1)) {
usage();
ret=EXIT_FAILURE;
goto errout;
}
- if (!(opts.ocibundle||opts.namespace||opts.capabilities||opts.seccomp)) {
+ if (!(opts.ocibundle||opts.namespace||opts.capabilities||opts.seccomp||
+ (opts.setns.net != -1) ||
+ (opts.setns.ns != -1) ||
+ (opts.setns.ipc != -1) ||
+ (opts.setns.uts != -1) ||
+ (opts.setns.user != -1) ||
+ (opts.setns.cgroup != -1))) {
ERROR("Not using namespaces, capabilities or seccomp !!!\n\n");
usage();
ret=EXIT_FAILURE;
/* deliberately not using 'else' on unrelated conditional branches */
if (!opts.ocibundle) {
/* allocate NULL-terminated array for argv */
- opts.jail_argv = calloc(1 + argc - optind, sizeof(char**));
+ opts.jail_argv = calloc(1 + argc - optind, sizeof(void *));
if (!opts.jail_argv) {
ret=EXIT_FAILURE;
goto errout;
if (!opts.extroot)
add_mount_bind("/etc/nsswitch.conf", 1, -1);
#endif
+ if (opts.setns.ns == -1) {
+ if (!(opts.namespace & CLONE_NEWNET)) {
+ add_mount_bind("/etc/resolv.conf", 1, 0);
+ } else {
+ /* new mount namespace to provide /dev/resolv.conf.d */
+ char hostdir[PATH_MAX];
- if (!(opts.namespace & CLONE_NEWNET)) {
- add_mount_bind("/etc/resolv.conf", 1, 0);
- } else if (opts.setns.net == -1) {
- char hostdir[PATH_MAX];
-
- snprintf(hostdir, PATH_MAX, "/tmp/resolv.conf-%s.d", opts.name);
- mkdir_p(hostdir, 0755);
- add_mount(hostdir, "/dev/resolv.conf.d", NULL, MS_BIND | MS_NOEXEC | MS_NOATIME | MS_NOSUID | MS_NODEV | MS_RDONLY, 0, NULL, 0);
+ snprintf(hostdir, PATH_MAX, "/tmp/resolv.conf-%s.d", opts.name);
+ mkdir_p(hostdir, 0755);
+ add_mount(hostdir, "/dev/resolv.conf.d", NULL,
+ MS_BIND | MS_NOEXEC | MS_NOATIME | MS_NOSUID | MS_NODEV | MS_RDONLY, 0, NULL, 0);
+ }
}
-
/* default mounts */
add_mount(NULL, "/dev", "tmpfs", MS_NOATIME | MS_NOEXEC | MS_NOSUID, 0, "size=1M", -1);
add_mount(NULL, "/dev/pts", "devpts", MS_NOATIME | MS_NOEXEC | MS_NOSUID, 0, "newinstance,ptmxmode=0666,mode=0620,gid=5", 0);
ERROR("prctl(PR_SET_SECUREBITS) failed: %m\n");
free_and_exit(EXIT_FAILURE);
}
- seteuid(opts.root_map_uid);
+ if (seteuid(opts.root_map_uid)) {
+ ERROR("seteuid(%d) failed: %m\n", opts.root_map_uid);
+ free_and_exit(EXIT_FAILURE);
+ }
}
jail_process.pid = clone(exec_jail, child_stack + STACK_SIZE, SIGCHLD | (opts.namespace & (~CLONE_NEWCGROUP)), NULL);
uloop_process_add(&jail_process);
jail_running = 1;
- seteuid(0);
+ if (seteuid(0)) {
+ ERROR("seteuid(%d) failed: %m\n", opts.root_map_uid);
+ free_and_exit(EXIT_FAILURE);
+ }
+
prctl(PR_SET_SECUREBITS, 0);
if (pidns_fd != -1) {
}
if (opts.namespace & CLONE_NEWNET) {
+ jail_network_start(parent_ctx, opts.name, jail_process.pid);
netns_fd = ns_open_pid("net", jail_process.pid);
netns_updown(jail_process.pid, true);
}
if (opts.namespace & CLONE_NEWNET) {
setns(netns_fd, CLONE_NEWNET);
netns_updown(getpid(), false);
+ jail_network_stop();
close(netns_fd);
}
run_hooks(opts.hooks.poststop, post_poststop);
projects / project / procd.git / blobdiff