jail: include necessary files for per-netns netifd instance

Up to now only proto 'static' and 'none' have been supported for
in-jail interfaces as Shell-based protocol handlers needed some more
utilities, PATH set in the environment and /var/ubus/ubus.sock to be
mounted on the per-netns-jail ubus socket.
Include files needed by shell proto handler, set PATH in env and bend
ubus socket path to get DHCP client to work for per-jail netns.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

diff --git a/jail/netifd.c b/jail/netifd.c
index bb205d0b241f450142304ed9fd73fbad66791f55..6f9cd7271d4b93c1f510f2046245900944409a0a 100644 (file)
--- a/jail/netifd.c
+++ b/jail/netifd.c
@@ -46,6 +46,7 @@
 static const char ubusd_path[] = "/sbin/ubusd";
 static const char netifd_path[] = "/sbin/netifd";
 static const char uci_net[] = "network";
+static const char ubus_sock_name[] = "ubus.sock";
 
 static char *jail_name, *ubus_sock_path, *ubus_sock_dir, *uci_config_network = NULL;
 
@@ -193,8 +194,8 @@ static void run_ubusd(struct uloop_timeout *t)
 static void run_netifd(struct uloop_timeout *t)
 {
        static struct blob_buf req;
-       void *ins, *in, *cmd, *jail, *setns, *setnso, *namespaces, *mount;
-       char *resolvconf_dir, *resolvconf, *ucimount;
+       void *ins, *in, *cmd, *jail, *setns, *setnso, *namespaces, *mount, *pathenv;
+       char *resolvconf_dir, *resolvconf, *ucimount, *ubusmount;
        char uci_dir[] = "/var/containers/ujail-uci-XXXXXX";
 
        uint32_t id;
@@ -222,9 +223,12 @@ static void run_netifd(struct uloop_timeout *t)
        if (asprintf(&ucimount, "%s:/etc/config", uci_dir) == -1)
                goto netifd_out_ucinetconf;
 
-       if (gen_jail_uci_network())
+       if (asprintf(&ubusmount, "%s:/var/run/ubus", ubus_sock_dir) == -1)
                goto netifd_out_ucimount;
 
+       if (gen_jail_uci_network())
+               goto netifd_out_ubusmount;
+
        blob_buf_init(&req, 0);
        blobmsg_add_string(&req, "name", jail_name);
        ins = blobmsg_open_table(&req, "instances");
@@ -234,10 +238,12 @@ static void run_netifd(struct uloop_timeout *t)
        blobmsg_add_string(&req, "", netifd_path);
        blobmsg_add_string(&req, "", "-r");
        blobmsg_add_string(&req, "", resolvconf);
-       blobmsg_add_string(&req, "", "-s");
-       blobmsg_add_string(&req, "", ubus_sock_path);
        blobmsg_close_array(&req, cmd);
 
+       pathenv = blobmsg_open_table(&req, "env");
+       blobmsg_add_string(&req, "PATH", "/usr/sbin:/usr/bin:/sbin:/bin");
+       blobmsg_close_table(&req, pathenv);
+
        jail = blobmsg_open_table(&req, "jail");
 
        setns = blobmsg_open_array(&req, "setns");
@@ -252,13 +258,20 @@ static void run_netifd(struct uloop_timeout *t)
        blobmsg_close_array(&req, setns);
 
        mount = blobmsg_open_table(&req, "mount");
-       blobmsg_add_string(&req, ubus_sock_dir, "1");
+       blobmsg_add_string(&req, ubusmount, "1");
        blobmsg_add_string(&req, resolvconf_dir, "1");
        blobmsg_add_string(&req, ucimount, "0");
+       blobmsg_add_string(&req, "/bin/cat", "0");
+       blobmsg_add_string(&req, "/bin/ipcalc.sh", "0");
+       blobmsg_add_string(&req, "/bin/kill", "0");
+       blobmsg_add_string(&req, "/bin/ubus", "0");
        blobmsg_add_string(&req, "/etc/hotplug.d", "0");
+       blobmsg_add_string(&req, "/lib/functions", "0");
        blobmsg_add_string(&req, "/lib/functions.sh", "0");
        blobmsg_add_string(&req, "/lib/netifd", "0");
        blobmsg_add_string(&req, "/lib/network", "0");
+       blobmsg_add_string(&req, "/usr/bin/awk", "0");
+       blobmsg_add_string(&req, "/usr/bin/killall", "0");
        blobmsg_add_string(&req, "/usr/bin/logger", "0");
        blobmsg_add_string(&req, "/usr/bin/jshn", "0");
        blobmsg_add_string(&req, "/usr/share/libubox/jshn.sh", "0");
@@ -285,6 +298,8 @@ static void run_netifd(struct uloop_timeout *t)
 
        if (!running)
                blob_buf_free(&req);
+netifd_out_ubusmount:
+       free(ubusmount);
 netifd_out_ucimount:
        free(ucimount);
 netifd_out_ucinetconf:
@@ -326,7 +341,7 @@ static void inotify_read_handler(struct uloop_fd *u, unsigned int events)
                if (in->len < 4)
                        continue;
 
-               if (!strncmp("ubus", in->name, in->len))
+               if (!strncmp(ubus_sock_name, in->name, in->len))
                        uloop_timeout_add(&netifd_start_timeout);
         }
 }
@@ -431,7 +446,7 @@ int jail_network_start(struct ubus_context *new_ctx, char *new_jail_name, pid_t
                goto errout_dir;
        }
 
-       if (asprintf(&ubus_sock_path, "%s/ubus", ubus_sock_dir) == -1) {
+       if (asprintf(&ubus_sock_path, "%s/%s", ubus_sock_dir, ubus_sock_name) == -1) {
                ret = ENOMEM;
                goto errout_path;
        }