jail: nuke old capabilities code in favour of reusing OCI code

Previsously capabilities could be defined for slim-containers using
our own JSON format, only allowing to modify capabilities in the
bouding set. As apparently that was never used by even a single
package, drop that old parser and logic in favour of reusing the now
existing OCI capability handling functions.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

diff --git a/jail/capabilities.c b/jail/capabilities.c
index 8b8e1a38f22dc297450fb2f0579240c2c1fc22a5..2eb154e77d0a9ca56808d8178572b0f52f81afb7 100644 (file)
--- a/jail/capabilities.c
+++ b/jail/capabilities.c
@@ -203,84 +203,23 @@ int applyOCIcapabilities(struct jail_capset ocicapset)
        return 0;
 }
 
-int drop_capabilities(const char *file)
+int parseOCIcapabilities_from_file(struct jail_capset *capset, const char *file)
 {
-       enum {
-               CAP_KEEP,
-               CAP_DROP,
-               __CAP_MAX
-       };
-       static const struct blobmsg_policy policy[__CAP_MAX] = {
-               [CAP_KEEP] = { .name = "cap.keep", .type = BLOBMSG_TYPE_ARRAY },
-               [CAP_DROP] = { .name = "cap.drop", .type = BLOBMSG_TYPE_ARRAY },
-       };
        struct blob_buf b = { 0 };
-       struct blob_attr *tb[__CAP_MAX];
-       struct blob_attr *cur;
-       int rem, cap;
-       char *name;
-       uint64_t capdrop = 0LLU;
+       int ret;
 
        DEBUG("dropping capabilities\n");
 
        blob_buf_init(&b, 0);
-       if (!blobmsg_add_json_from_file(&b, file)) {
+       ret = !blobmsg_add_json_from_file(&b, file);
+       if (ret) {
                ERROR("failed to load %s\n", file);
-               return -1;
-       }
-
-       blobmsg_parse(policy, __CAP_MAX, tb, blob_data(b.head), blob_len(b.head));
-       if (!tb[CAP_KEEP] && !tb[CAP_DROP]) {
-               ERROR("failed to parse %s\n", file);
-               return -1;
+               goto err;
        }
 
-       blobmsg_for_each_attr(cur, tb[CAP_KEEP], rem) {
-               name = blobmsg_get_string(cur);
-               if (!name) {
-                       ERROR("invalid capability name in cap.keep\n");
-                       return -1;
-               }
-               cap = find_capabilities(name);
-               if (cap == -1) {
-                       ERROR("unknown capability %s in cap.keep\n", name);
-                       return -1;
-               }
-               capdrop |= (1LLU << cap);
-       }
-
-       if (capdrop == 0LLU) {
-               DEBUG("cap.keep empty -> only dropping capabilities from cap.drop (blacklist)\n");
-               capdrop = JAIL_CAP_ALL;
-       } else {
-               DEBUG("cap.keep has at least one capability -> dropping every capabilities not in cap.keep (whitelist)\n");
-       }
+       ret = parseOCIcapabilities(capset, b.head);
 
-       blobmsg_for_each_attr(cur, tb[CAP_DROP], rem) {
-               name = blobmsg_get_string(cur);
-               if (!name) {
-                       ERROR("invalid capability name in cap.drop\n");
-                       return -1;
-               }
-               cap = find_capabilities(name);
-               if (cap == -1) {
-                       ERROR("unknown capability %s in cap.drop\n", name);
-                       return -1;
-               }
-               capdrop &= ~(1LLU << cap);
-       }
-
-       for (cap = 0; cap <= CAP_LAST_CAP; cap++) {
-               if ( (capdrop & (1LLU << cap)) == 0) {
-                       DEBUG("dropping capability %s (%d)\n", capabilities_names[cap], cap);
-                       if (prctl(PR_CAPBSET_DROP, cap, 0, 0, 0)) {
-                               ERROR("prctl(PR_CAPBSET_DROP, %d) failed: %m\n", cap);
-                               return errno;
-                       }
-               } else {
-                       DEBUG("keeping capability %s (%d)\n", capabilities_names[cap], cap);
-               }
-       }
-
-       return 0;
+err:
+       blob_buf_free(&b);
+       return ret;
 }

diff --git a/jail/capabilities.h b/jail/capabilities.h
index f75a34f9434f6bf25320fe6f70c0a05bed144f01..7185fd482a8d29b5fc02e6fff4e712a349254dfb 100644 (file)
--- a/jail/capabilities.h
+++ b/jail/capabilities.h
@@ -25,9 +25,8 @@ struct jail_capset {
        uint8_t apply;
 };
 
-int drop_capabilities(const char *file);
-
 int parseOCIcapabilities(struct jail_capset *capset, struct blob_attr *msg);
+int parseOCIcapabilities_from_file(struct jail_capset *capset, const char *file);
 int applyOCIcapabilities(struct jail_capset capset);
 
 /* capget/capset syscall wrappers are provided by libc */

diff --git a/jail/jail.c b/jail/jail.c
index ec2ec956684bae003072dcd67181db0faf8956e7..ede09442487f25df33345b91de5a9357c941cde6 100644 (file)
--- a/jail/jail.c
+++ b/jail/jail.c
@@ -1172,6 +1172,9 @@ static void post_jail_fs(void)
 
 static void post_start_hook(void)
 {
+       if (applyOCIcapabilities(opts.capset))
+               exit(EXIT_FAILURE);
+
        if (!(opts.namespace & CLONE_NEWUSER) && (opts.setns.user == -1)) {
                int pw_uid, pw_gid, gr_gid;
                get_jail_user(&pw_uid, &pw_gid, &gr_gid);
@@ -1188,12 +1191,6 @@ static void post_start_hook(void)
        if (opts.set_umask)
                umask(opts.umask);
 
-       if (applyOCIcapabilities(opts.capset))
-               exit(EXIT_FAILURE);
-
-       if (opts.capabilities && drop_capabilities(opts.capabilities))
-               exit(EXIT_FAILURE);
-
        if (opts.no_new_privs && prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
                 ERROR("prctl(PR_SET_NO_NEW_PRIVS) failed: %m\n");
                exit(EXIT_FAILURE);
@@ -2482,6 +2479,11 @@ int main(int argc, char **argv)
        opts.setns.time = -1;
 #endif
 
+       if (opts.capabilities && parseOCIcapabilities_from_file(&opts.capset, opts.capabilities)) {
+               ERROR("failed to read capabilities from file %s\n", opts.capabilities);
+               return -1;
+       }
+
        if (opts.ocibundle) {
                char *jsonfile;
                int ocires;
@@ -2512,7 +2514,7 @@ int main(int argc, char **argv)
        }
        DEBUG("Using namespaces(0x%08x), capabilities(%d), seccomp(%d)\n",
                opts.namespace,
-               opts.capabilities != 0 || opts.capset.apply,
+               opts.capset.apply,
                opts.seccomp != 0 || opts.ociseccomp != 0);
 
        uloop_init();