blob: 4987001fb9eb2d93262bc7e6574544b48e1e09a4 [file] [log] [blame]
Elly Jonese58176c2012-01-23 11:46:17 -05001/* Copyright (c) 2012 The Chromium OS Authors. All rights reserved.
Elly Jonescd7a9042011-07-22 13:56:51 -04002 * Use of this source code is governed by a BSD-style license that can be
Will Drewry32ac9f52011-08-18 21:36:27 -05003 * found in the LICENSE file.
4 */
Elly Jonescd7a9042011-07-22 13:56:51 -04005
Jorge Lucangeli Obes4b2d5ee2014-01-09 15:47:47 -08006#include <dlfcn.h>
Elly Jonescd7a9042011-07-22 13:56:51 -04007#include <stdio.h>
8#include <stdlib.h>
9#include <string.h>
10#include <unistd.h>
11
12#include "libminijail.h"
Will Drewry32ac9f52011-08-18 21:36:27 -050013#include "libsyscalls.h"
Elly Jonescd7a9042011-07-22 13:56:51 -040014
Lee Campbell1e4fc6a2014-06-06 17:40:02 -070015#include "elfparse.h"
Jorge Lucangeli Obesbda833c2012-07-31 16:25:56 -070016#include "util.h"
17
Elly Jonese1749eb2011-10-07 13:54:59 -040018static void set_user(struct minijail *j, const char *arg)
19{
20 char *end = NULL;
21 int uid = strtod(arg, &end);
22 if (!*end && *arg) {
23 minijail_change_uid(j, uid);
24 return;
25 }
Elly Jonescd7a9042011-07-22 13:56:51 -040026
Elly Jonese1749eb2011-10-07 13:54:59 -040027 if (minijail_change_user(j, arg)) {
28 fprintf(stderr, "Bad user: '%s'\n", arg);
29 exit(1);
30 }
Elly Jonescd7a9042011-07-22 13:56:51 -040031}
32
Elly Jonese1749eb2011-10-07 13:54:59 -040033static void set_group(struct minijail *j, const char *arg)
34{
35 char *end = NULL;
36 int gid = strtod(arg, &end);
37 if (!*end && *arg) {
38 minijail_change_gid(j, gid);
39 return;
40 }
Elly Jonescd7a9042011-07-22 13:56:51 -040041
Elly Jonese1749eb2011-10-07 13:54:59 -040042 if (minijail_change_group(j, arg)) {
43 fprintf(stderr, "Bad group: '%s'\n", arg);
44 exit(1);
45 }
Elly Jonescd7a9042011-07-22 13:56:51 -040046}
47
Elly Jonese1749eb2011-10-07 13:54:59 -040048static void use_caps(struct minijail *j, const char *arg)
49{
50 uint64_t caps;
51 char *end = NULL;
52 caps = strtoull(arg, &end, 16);
53 if (*end) {
54 fprintf(stderr, "Invalid cap set: '%s'\n", arg);
55 exit(1);
56 }
57 minijail_use_caps(j, caps);
Elly Jonescd7a9042011-07-22 13:56:51 -040058}
59
Elly Jones51a5b6c2011-10-12 19:09:26 -040060static void add_binding(struct minijail *j, char *arg) {
61 char *src = strtok(arg, ",");
Elly Jones5ba42b52011-12-07 13:31:43 -050062 char *dest = strtok(NULL, ",");
63 char *flags = strtok(NULL, ",");
Elly Jones51a5b6c2011-10-12 19:09:26 -040064 if (!src || !dest) {
65 fprintf(stderr, "Bad binding: %s %s\n", src, dest);
66 exit(1);
67 }
68 if (minijail_bind(j, src, dest, flags ? atoi(flags) : 0)) {
69 fprintf(stderr, "Bind failure\n");
70 exit(1);
71 }
72}
73
Elly Jonese1749eb2011-10-07 13:54:59 -040074static void usage(const char *progn)
75{
Jorge Lucangeli Obesbda833c2012-07-31 16:25:56 -070076 size_t i;
77
Lee Campbell11af0622014-05-22 12:36:04 -070078 printf("Usage: %s [-Ghinprsvt] [-b <src>,<dest>[,<writeable>]] "
Jorge Lucangeli Obesc2c9bcc2012-05-01 09:30:24 -070079 "[-c <caps>] [-C <dir>] [-g <group>] [-S <file>] [-u <user>] "
80 "<program> [args...]\n"
Elly Jonesa8d1e1b2011-10-21 15:38:00 -040081 " -b: binds <src> to <dest> in chroot. Multiple "
82 "instances allowed\n"
Elly Jonese1749eb2011-10-07 13:54:59 -040083 " -c <caps>: restrict caps to <caps>\n"
Elly Jonesa8d1e1b2011-10-21 15:38:00 -040084 " -C <dir>: chroot to <dir>\n"
Lee Campbell11af0622014-05-22 12:36:04 -070085 " -t: mount tmpfs at /tmp inside chroot\n"
86 " -e: enter a network namespace\n"
Elly Jonese1749eb2011-10-07 13:54:59 -040087 " -G: inherit secondary groups from uid\n"
88 " -g <group>: change gid to <group>\n"
89 " -h: help (this message)\n"
90 " -H: seccomp filter help message\n"
Christopher Wiley88f76a72013-11-01 14:12:56 -070091 " -i: exit immediately after fork (do not act as init)\n"
92 " Not compatible with -p\n"
Jorge Lucangeli Obesbda833c2012-07-31 16:25:56 -070093 " -L: log blocked syscalls when using seccomp filter. "
94 "Forces the following syscalls to be allowed:\n"
95 " ", progn);
96 for (i = 0; i < log_syscalls_len; i++)
97 printf("%s ", log_syscalls[i]);
98
99 printf("\n"
Jorge Lucangeli Obesc2c9bcc2012-05-01 09:30:24 -0700100 " -n: set no_new_privs\n"
Elly Jonese58176c2012-01-23 11:46:17 -0500101 " -p: use pid namespace (implies -vr)\n"
Elly Jonesfdd5f2d2012-01-23 13:27:43 -0500102 " -r: remount /proc readonly (implies -v)\n"
Elly Jonese1749eb2011-10-07 13:54:59 -0400103 " -s: use seccomp\n"
Jorge Lucangeli Obesbda833c2012-07-31 16:25:56 -0700104 " -S <file>: set seccomp filter using <file>\n"
Elly Jonese1749eb2011-10-07 13:54:59 -0400105 " E.g., -S /usr/share/filters/<prog>.$(uname -m)\n"
106 " -u <user>: change uid to <user>\n"
Jorge Lucangeli Obesbda833c2012-07-31 16:25:56 -0700107 " -v: use vfs namespace\n");
Elly Jonescd7a9042011-07-22 13:56:51 -0400108}
109
Elly Jonese1749eb2011-10-07 13:54:59 -0400110static void seccomp_filter_usage(const char *progn)
111{
112 const struct syscall_entry *entry = syscall_table;
113 printf("Usage: %s -S <policy.file> <program> [args...]\n\n"
114 "System call names supported:\n", progn);
115 for (; entry->name && entry->nr >= 0; ++entry)
116 printf(" %s [%d]\n", entry->name, entry->nr);
117 printf("\nSee minijail0(5) for example policies.\n");
Will Drewry32ac9f52011-08-18 21:36:27 -0500118}
119
Christopher Wiley88f76a72013-11-01 14:12:56 -0700120static int parse_args(struct minijail *j, int argc, char *argv[],
121 int *exit_immediately)
Elly Jonese1749eb2011-10-07 13:54:59 -0400122{
Elly Jonese1749eb2011-10-07 13:54:59 -0400123 int opt;
Christopher Wiley88f76a72013-11-01 14:12:56 -0700124 int use_pid_ns = 0;
Lee Campbell11af0622014-05-22 12:36:04 -0700125 int chroot = 0;
126 int mount_tmp = 0;
Elly Fong-Jonesf65c9fe2013-01-22 13:55:02 -0500127 if (argc > 1 && argv[1][0] != '-')
128 return 1;
Lee Campbell11af0622014-05-22 12:36:04 -0700129 while ((opt = getopt(argc, argv, "u:g:sS:c:C:b:vrGhHinpLet")) != -1) {
Elly Jonese1749eb2011-10-07 13:54:59 -0400130 switch (opt) {
131 case 'u':
132 set_user(j, optarg);
133 break;
134 case 'g':
135 set_group(j, optarg);
136 break;
Jorge Lucangeli Obesc2c9bcc2012-05-01 09:30:24 -0700137 case 'n':
138 minijail_no_new_privs(j);
Jorge Lucangeli Obes0341d6c2012-07-16 15:27:31 -0700139 break;
Elly Jonese1749eb2011-10-07 13:54:59 -0400140 case 's':
141 minijail_use_seccomp(j);
142 break;
143 case 'S':
144 minijail_parse_seccomp_filters(j, optarg);
145 minijail_use_seccomp_filter(j);
146 break;
Jorge Lucangeli Obesbda833c2012-07-31 16:25:56 -0700147 case 'L':
148 minijail_log_seccomp_filter_failures(j);
149 break;
Elly Jones51a5b6c2011-10-12 19:09:26 -0400150 case 'b':
151 add_binding(j, optarg);
152 break;
Elly Jonese1749eb2011-10-07 13:54:59 -0400153 case 'c':
154 use_caps(j, optarg);
155 break;
Elly Jones51a5b6c2011-10-12 19:09:26 -0400156 case 'C':
Lee Campbell11af0622014-05-22 12:36:04 -0700157 if (0 != minijail_enter_chroot(j, optarg))
158 exit(1);
159 chroot = 1;
160 break;
161 case 't':
162 minijail_mount_tmp(j);
163 mount_tmp = 1;
Elly Jones51a5b6c2011-10-12 19:09:26 -0400164 break;
Elly Jonese1749eb2011-10-07 13:54:59 -0400165 case 'v':
166 minijail_namespace_vfs(j);
167 break;
168 case 'r':
169 minijail_remount_readonly(j);
170 break;
171 case 'G':
172 minijail_inherit_usergroups(j);
173 break;
174 case 'p':
Christopher Wiley88f76a72013-11-01 14:12:56 -0700175 if (*exit_immediately) {
176 fprintf(stderr,
177 "Could not enter pid namespace because "
Lee Campbell11af0622014-05-22 12:36:04 -0700178 "'-i' was specified.\n");
Christopher Wiley88f76a72013-11-01 14:12:56 -0700179 exit(1);
180 }
181 use_pid_ns = 1;
Elly Jonese1749eb2011-10-07 13:54:59 -0400182 minijail_namespace_pids(j);
183 break;
Elly Fong-Jones6c086302013-03-20 17:15:28 -0400184 case 'e':
185 minijail_namespace_net(j);
186 break;
Christopher Wiley88f76a72013-11-01 14:12:56 -0700187 case 'i':
188 if (use_pid_ns) {
189 fprintf(stderr,
190 "Could not disable init loop because "
Lee Campbell11af0622014-05-22 12:36:04 -0700191 "'-p' was specified.\n");
Christopher Wiley88f76a72013-11-01 14:12:56 -0700192 exit(1);
193 }
194 *exit_immediately = 1;
195 break;
Elly Jonese1749eb2011-10-07 13:54:59 -0400196 case 'H':
197 seccomp_filter_usage(argv[0]);
198 exit(1);
199 default:
200 usage(argv[0]);
201 exit(1);
202 }
Elly Fong-Jonesf65c9fe2013-01-22 13:55:02 -0500203 if (optind < argc && argv[optind][0] != '-')
Lee Campbell11af0622014-05-22 12:36:04 -0700204 break;
Elly Jonese1749eb2011-10-07 13:54:59 -0400205 }
Elly Jonescd7a9042011-07-22 13:56:51 -0400206
Elly Jonese1749eb2011-10-07 13:54:59 -0400207 if (argc == optind) {
208 usage(argv[0]);
209 exit(1);
210 }
Lee Campbell11af0622014-05-22 12:36:04 -0700211
212 if (mount_tmp && !chroot) {
213 fprintf(stderr,
214 "Could not mount tmpfs at /tmp "
215 "because '-C' was not specified.\n");
216 exit(1);
217 }
218
Elly Fong-Jonesf65c9fe2013-01-22 13:55:02 -0500219 return optind;
220}
Elly Jonescd7a9042011-07-22 13:56:51 -0400221
Elly Fong-Jonesf65c9fe2013-01-22 13:55:02 -0500222int main(int argc, char *argv[])
223{
224 struct minijail *j = minijail_new();
Jorge Lucangeli Obes4b2d5ee2014-01-09 15:47:47 -0800225 char *dl_mesg = NULL;
Christopher Wiley88f76a72013-11-01 14:12:56 -0700226 int exit_immediately = 0;
227 int consumed = parse_args(j, argc, argv, &exit_immediately);
Lee Campbell1e4fc6a2014-06-06 17:40:02 -0700228 ElfType elftype = ELFERROR;
Elly Fong-Jonesf65c9fe2013-01-22 13:55:02 -0500229 argc -= consumed;
230 argv += consumed;
Jorge Lucangeli Obes4b2d5ee2014-01-09 15:47:47 -0800231 /* Check that we can access the target program. */
Elly Fong-Jones6d717852013-03-19 16:29:03 -0400232 if (access(argv[0], X_OK)) {
233 fprintf(stderr, "Target program '%s' not accessible\n",
234 argv[0]);
235 return 1;
236 }
Lee Campbell1e4fc6a2014-06-06 17:40:02 -0700237 /* Check if target is statically or dynamically linked. */
238 elftype = get_elf_linkage(argv[0]);
239 if (elftype == ELFSTATIC) {
240 /* Target binary is static. */
241 minijail_run_static(j, argv[0], argv);
242 } else if (elftype == ELFDYNAMIC) {
243 /*
244 * Target binary is dynamically linked so we can
245 * inject libminijailpreload.so into it.
246 */
247
248 /* Check that we can dlopen() libminijailpreload.so. */
249 if (!dlopen(PRELOADPATH, RTLD_LAZY | RTLD_LOCAL)) {
250 dl_mesg = dlerror();
251 fprintf(stderr, "dlopen(): %s\n", dl_mesg);
252 return 1;
253 }
254 minijail_run(j, argv[0], argv);
255 } else {
256 fprintf(stderr, "Target program '%s' is not an ELF executable.\n",
257 argv[0]);
Jorge Lucangeli Obes4b2d5ee2014-01-09 15:47:47 -0800258 return 1;
259 }
Lee Campbell1e4fc6a2014-06-06 17:40:02 -0700260
Christopher Wiley88f76a72013-11-01 14:12:56 -0700261 if (exit_immediately) {
262 info("not running init loop, exiting immediately");
263 return 0;
264 }
Elly Jonese1749eb2011-10-07 13:54:59 -0400265 return minijail_wait(j);
Elly Jonescd7a9042011-07-22 13:56:51 -0400266}