blob: 13434f6a3109f474b00e61622a9b1b4d97d019e6 [file] [log] [blame]
Elly Jonesdd3e8512012-01-23 15:13:38 -05001/*
2 * Copyright (c) 2012 The Chromium OS Authors. All rights reserved.
Elly Jonescd7a9042011-07-22 13:56:51 -04003 * Use of this source code is governed by a BSD-style license that can be
Will Drewry32ac9f52011-08-18 21:36:27 -05004 * found in the LICENSE file.
5 */
Elly Jonescd7a9042011-07-22 13:56:51 -04006
7#define _BSD_SOURCE
8#define _GNU_SOURCE
Jorge Lucangeli Obesc2c9bcc2012-05-01 09:30:24 -07009
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -080010#include <asm/unistd.h>
Will Drewry32ac9f52011-08-18 21:36:27 -050011#include <ctype.h>
Elly Jonescd7a9042011-07-22 13:56:51 -040012#include <errno.h>
13#include <grp.h>
14#include <inttypes.h>
Will Drewryfe4a3722011-09-16 14:50:50 -050015#include <limits.h>
Elly Jonescd7a9042011-07-22 13:56:51 -040016#include <linux/capability.h>
17#include <linux/securebits.h>
18#include <pwd.h>
19#include <sched.h>
20#include <signal.h>
Will Drewry2f54b6a2011-09-16 13:45:31 -050021#include <stdarg.h>
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -080022#include <stddef.h>
Elly Jonescd7a9042011-07-22 13:56:51 -040023#include <stdio.h>
24#include <stdlib.h>
25#include <string.h>
26#include <syscall.h>
27#include <sys/capability.h>
28#include <sys/mount.h>
Will Drewryf89aef52011-09-16 16:48:57 -050029#include <sys/param.h>
Elly Jonescd7a9042011-07-22 13:56:51 -040030#include <sys/prctl.h>
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -080031#include <sys/user.h>
Elly Jonescd7a9042011-07-22 13:56:51 -040032#include <sys/wait.h>
Elly Jonescd7a9042011-07-22 13:56:51 -040033#include <unistd.h>
34
35#include "libminijail.h"
Will Drewry32ac9f52011-08-18 21:36:27 -050036#include "libsyscalls.h"
Elly Jonescd7a9042011-07-22 13:56:51 -040037#include "libminijail-private.h"
Jorge Lucangeli Obes224e4272012-08-02 14:31:39 -070038#include "logging.h"
Elly Jonescd7a9042011-07-22 13:56:51 -040039
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -080040#include "syscall_filter.h"
41
Will Drewry32ac9f52011-08-18 21:36:27 -050042/* Until these are reliably available in linux/prctl.h */
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -080043#ifndef PR_SET_SECCOMP
Jorge Lucangeli Obesc2c9bcc2012-05-01 09:30:24 -070044# define PR_SET_SECCOMP 22
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -080045#endif
46
47/* For seccomp_filter using BPF. */
48#ifndef PR_SET_NO_NEW_PRIVS
49# define PR_SET_NO_NEW_PRIVS 38
50#endif
51#ifndef SECCOMP_MODE_FILTER
52# define SECCOMP_MODE_FILTER 2 /* uses user-supplied filter. */
Will Drewry32ac9f52011-08-18 21:36:27 -050053#endif
54
Elly Jones51a5b6c2011-10-12 19:09:26 -040055struct binding {
56 char *src;
57 char *dest;
58 int writeable;
59 struct binding *next;
60};
61
Will Drewryf89aef52011-09-16 16:48:57 -050062struct minijail {
Elly Jonese1749eb2011-10-07 13:54:59 -040063 struct {
64 int uid:1;
65 int gid:1;
66 int caps:1;
67 int vfs:1;
68 int pids:1;
69 int seccomp:1;
70 int readonly:1;
71 int usergroups:1;
72 int ptrace:1;
Jorge Lucangeli Obesc2c9bcc2012-05-01 09:30:24 -070073 int no_new_privs:1;
Elly Jonese1749eb2011-10-07 13:54:59 -040074 int seccomp_filter:1;
Elly Jones51a5b6c2011-10-12 19:09:26 -040075 int chroot:1;
Elly Jonese1749eb2011-10-07 13:54:59 -040076 } flags;
77 uid_t uid;
78 gid_t gid;
79 gid_t usergid;
80 char *user;
81 uint64_t caps;
82 pid_t initpid;
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -080083 int filter_len;
Elly Jones51a5b6c2011-10-12 19:09:26 -040084 int binding_count;
85 char *chrootdir;
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -080086 struct sock_fprog *filter_prog;
Elly Jones51a5b6c2011-10-12 19:09:26 -040087 struct binding *bindings_head;
88 struct binding *bindings_tail;
Will Drewryf89aef52011-09-16 16:48:57 -050089};
90
Will Drewry6ac91122011-10-21 16:38:58 -050091struct minijail API *minijail_new(void)
Elly Jonese1749eb2011-10-07 13:54:59 -040092{
Elly Jones51a5b6c2011-10-12 19:09:26 -040093 return calloc(1, sizeof(struct minijail));
Elly Jonescd7a9042011-07-22 13:56:51 -040094}
95
Will Drewry6ac91122011-10-21 16:38:58 -050096void API minijail_change_uid(struct minijail *j, uid_t uid)
Elly Jonese1749eb2011-10-07 13:54:59 -040097{
98 if (uid == 0)
99 die("useless change to uid 0");
100 j->uid = uid;
101 j->flags.uid = 1;
Elly Jonescd7a9042011-07-22 13:56:51 -0400102}
103
Will Drewry6ac91122011-10-21 16:38:58 -0500104void API minijail_change_gid(struct minijail *j, gid_t gid)
Elly Jonese1749eb2011-10-07 13:54:59 -0400105{
106 if (gid == 0)
107 die("useless change to gid 0");
108 j->gid = gid;
109 j->flags.gid = 1;
Elly Jonescd7a9042011-07-22 13:56:51 -0400110}
111
Will Drewry6ac91122011-10-21 16:38:58 -0500112int API minijail_change_user(struct minijail *j, const char *user)
Elly Jonese1749eb2011-10-07 13:54:59 -0400113{
114 char *buf = NULL;
115 struct passwd pw;
116 struct passwd *ppw = NULL;
117 ssize_t sz = sysconf(_SC_GETPW_R_SIZE_MAX);
118 if (sz == -1)
119 sz = 65536; /* your guess is as good as mine... */
Elly Joneseb300c52011-09-22 14:35:43 -0400120
Elly Jonesdd3e8512012-01-23 15:13:38 -0500121 /*
122 * sysconf(_SC_GETPW_R_SIZE_MAX), under glibc, is documented to return
Elly Jonese1749eb2011-10-07 13:54:59 -0400123 * the maximum needed size of the buffer, so we don't have to search.
124 */
125 buf = malloc(sz);
126 if (!buf)
127 return -ENOMEM;
128 getpwnam_r(user, &pw, buf, sz, &ppw);
Elly Jonesdd3e8512012-01-23 15:13:38 -0500129 /*
130 * We're safe to free the buffer here. The strings inside pw point
131 * inside buf, but we don't use any of them; this leaves the pointers
132 * dangling but it's safe. ppw points at pw if getpwnam_r succeeded.
133 */
Elly Jonese1749eb2011-10-07 13:54:59 -0400134 free(buf);
135 if (!ppw)
136 return -errno;
137 minijail_change_uid(j, ppw->pw_uid);
138 j->user = strdup(user);
139 if (!j->user)
140 return -ENOMEM;
141 j->usergid = ppw->pw_gid;
142 return 0;
Elly Jonescd7a9042011-07-22 13:56:51 -0400143}
144
Will Drewry6ac91122011-10-21 16:38:58 -0500145int API minijail_change_group(struct minijail *j, const char *group)
Elly Jonese1749eb2011-10-07 13:54:59 -0400146{
147 char *buf = NULL;
148 struct group gr;
149 struct group *pgr = NULL;
150 ssize_t sz = sysconf(_SC_GETGR_R_SIZE_MAX);
151 if (sz == -1)
152 sz = 65536; /* and mine is as good as yours, really */
Elly Joneseb300c52011-09-22 14:35:43 -0400153
Elly Jonesdd3e8512012-01-23 15:13:38 -0500154 /*
155 * sysconf(_SC_GETGR_R_SIZE_MAX), under glibc, is documented to return
Elly Jonese1749eb2011-10-07 13:54:59 -0400156 * the maximum needed size of the buffer, so we don't have to search.
157 */
158 buf = malloc(sz);
159 if (!buf)
160 return -ENOMEM;
161 getgrnam_r(group, &gr, buf, sz, &pgr);
Elly Jonesdd3e8512012-01-23 15:13:38 -0500162 /*
163 * We're safe to free the buffer here. The strings inside gr point
164 * inside buf, but we don't use any of them; this leaves the pointers
165 * dangling but it's safe. pgr points at gr if getgrnam_r succeeded.
166 */
Elly Jonese1749eb2011-10-07 13:54:59 -0400167 free(buf);
168 if (!pgr)
169 return -errno;
170 minijail_change_gid(j, pgr->gr_gid);
171 return 0;
Elly Jonescd7a9042011-07-22 13:56:51 -0400172}
173
Will Drewry6ac91122011-10-21 16:38:58 -0500174void API minijail_use_seccomp(struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -0400175{
176 j->flags.seccomp = 1;
Elly Jonescd7a9042011-07-22 13:56:51 -0400177}
178
Jorge Lucangeli Obesc2c9bcc2012-05-01 09:30:24 -0700179void API minijail_no_new_privs(struct minijail *j)
180{
181 j->flags.no_new_privs = 1;
182}
183
Will Drewry6ac91122011-10-21 16:38:58 -0500184void API minijail_use_seccomp_filter(struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -0400185{
186 j->flags.seccomp_filter = 1;
Will Drewry32ac9f52011-08-18 21:36:27 -0500187}
188
Will Drewry6ac91122011-10-21 16:38:58 -0500189void API minijail_use_caps(struct minijail *j, uint64_t capmask)
Elly Jonese1749eb2011-10-07 13:54:59 -0400190{
191 j->caps = capmask;
192 j->flags.caps = 1;
Elly Jonescd7a9042011-07-22 13:56:51 -0400193}
194
Will Drewry6ac91122011-10-21 16:38:58 -0500195void API minijail_namespace_vfs(struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -0400196{
197 j->flags.vfs = 1;
Elly Jonescd7a9042011-07-22 13:56:51 -0400198}
199
Will Drewry6ac91122011-10-21 16:38:58 -0500200void API minijail_namespace_pids(struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -0400201{
Elly Jonese58176c2012-01-23 11:46:17 -0500202 j->flags.vfs = 1;
203 j->flags.readonly = 1;
Elly Jonese1749eb2011-10-07 13:54:59 -0400204 j->flags.pids = 1;
Elly Jonescd7a9042011-07-22 13:56:51 -0400205}
206
Will Drewry6ac91122011-10-21 16:38:58 -0500207void API minijail_remount_readonly(struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -0400208{
209 j->flags.vfs = 1;
210 j->flags.readonly = 1;
Elly Jonescd7a9042011-07-22 13:56:51 -0400211}
212
Will Drewry6ac91122011-10-21 16:38:58 -0500213void API minijail_inherit_usergroups(struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -0400214{
215 j->flags.usergroups = 1;
Elly Jonescd7a9042011-07-22 13:56:51 -0400216}
217
Will Drewry6ac91122011-10-21 16:38:58 -0500218void API minijail_disable_ptrace(struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -0400219{
220 j->flags.ptrace = 1;
Elly Jonescd7a9042011-07-22 13:56:51 -0400221}
222
Will Drewry6ac91122011-10-21 16:38:58 -0500223int API minijail_enter_chroot(struct minijail *j, const char *dir) {
Elly Jones51a5b6c2011-10-12 19:09:26 -0400224 if (j->chrootdir)
225 return -EINVAL;
226 j->chrootdir = strdup(dir);
227 if (!j->chrootdir)
228 return -ENOMEM;
229 j->flags.chroot = 1;
230 return 0;
231}
232
Will Drewry6ac91122011-10-21 16:38:58 -0500233int API minijail_bind(struct minijail *j, const char *src, const char *dest,
234 int writeable) {
Elly Jones51a5b6c2011-10-12 19:09:26 -0400235 struct binding *b;
236
237 if (*dest != '/')
238 return -EINVAL;
239 b = calloc(1, sizeof(*b));
240 if (!b)
241 return -ENOMEM;
242 b->dest = strdup(dest);
243 if (!b->dest)
244 goto error;
245 b->src = strdup(src);
246 if (!b->src)
247 goto error;
248 b->writeable = writeable;
249
Jorge Lucangeli Obes224e4272012-08-02 14:31:39 -0700250 info("bind %s -> %s", src, dest);
Elly Jones51a5b6c2011-10-12 19:09:26 -0400251
Elly Jonesdd3e8512012-01-23 15:13:38 -0500252 /*
253 * Force vfs namespacing so the bind mounts don't leak out into the
Elly Jones51a5b6c2011-10-12 19:09:26 -0400254 * containing vfs namespace.
255 */
256 minijail_namespace_vfs(j);
257
258 if (j->bindings_tail)
259 j->bindings_tail->next = b;
260 else
261 j->bindings_head = b;
262 j->bindings_tail = b;
263 j->binding_count++;
264
265 return 0;
266
267error:
268 free(b->src);
269 free(b->dest);
270 free(b);
271 return -ENOMEM;
272}
273
Will Drewry6ac91122011-10-21 16:38:58 -0500274void API minijail_parse_seccomp_filters(struct minijail *j, const char *path)
Elly Jonese1749eb2011-10-07 13:54:59 -0400275{
276 FILE *file = fopen(path, "r");
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -0800277 if (!file) {
Jorge Lucangeli Obes224e4272012-08-02 14:31:39 -0700278 pdie("failed to open seccomp filter file '%s'", path);
Elly Jonese1749eb2011-10-07 13:54:59 -0400279 }
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -0800280
281 struct sock_fprog *fprog = malloc(sizeof(struct sock_fprog));
282 if (compile_filter(file, fprog)) {
Jorge Lucangeli Obes224e4272012-08-02 14:31:39 -0700283 die("failed to compile seccomp filter BPF program in '%s'", path);
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -0800284 }
285
286 j->filter_len = fprog->len;
287 j->filter_prog = fprog;
288
Elly Jonese1749eb2011-10-07 13:54:59 -0400289 fclose(file);
Will Drewry32ac9f52011-08-18 21:36:27 -0500290}
291
Will Drewryf89aef52011-09-16 16:48:57 -0500292struct marshal_state {
Elly Jonese1749eb2011-10-07 13:54:59 -0400293 size_t available;
294 size_t total;
295 char *buf;
Will Drewryf89aef52011-09-16 16:48:57 -0500296};
297
Will Drewry6ac91122011-10-21 16:38:58 -0500298void marshal_state_init(struct marshal_state *state,
299 char *buf, size_t available)
Elly Jonese1749eb2011-10-07 13:54:59 -0400300{
301 state->available = available;
302 state->buf = buf;
303 state->total = 0;
Will Drewryf89aef52011-09-16 16:48:57 -0500304}
305
Will Drewry6ac91122011-10-21 16:38:58 -0500306void marshal_append(struct marshal_state *state,
307 char *src, size_t length)
Elly Jonese1749eb2011-10-07 13:54:59 -0400308{
309 size_t copy_len = MIN(state->available, length);
Will Drewryf89aef52011-09-16 16:48:57 -0500310
Elly Jonese1749eb2011-10-07 13:54:59 -0400311 /* Up to |available| will be written. */
312 if (copy_len) {
313 memcpy(state->buf, src, copy_len);
314 state->buf += copy_len;
315 state->available -= copy_len;
316 }
317 /* |total| will contain the expected length. */
318 state->total += length;
Will Drewryf89aef52011-09-16 16:48:57 -0500319}
320
Will Drewry6ac91122011-10-21 16:38:58 -0500321void minijail_marshal_helper(struct marshal_state *state,
322 const struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -0400323{
Elly Jones51a5b6c2011-10-12 19:09:26 -0400324 struct binding *b = NULL;
Elly Jonese1749eb2011-10-07 13:54:59 -0400325 marshal_append(state, (char *)j, sizeof(*j));
326 if (j->user)
327 marshal_append(state, j->user, strlen(j->user) + 1);
Elly Jones51a5b6c2011-10-12 19:09:26 -0400328 if (j->chrootdir)
329 marshal_append(state, j->chrootdir, strlen(j->chrootdir) + 1);
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -0800330 if (j->flags.seccomp_filter && j->filter_prog) {
331 struct sock_fprog *fp = j->filter_prog;
332 marshal_append(state, (char *)fp->filter,
333 fp->len * sizeof(struct sock_filter));
Elly Jonese1749eb2011-10-07 13:54:59 -0400334 }
Elly Jones51a5b6c2011-10-12 19:09:26 -0400335 for (b = j->bindings_head; b; b = b->next) {
336 marshal_append(state, b->src, strlen(b->src) + 1);
337 marshal_append(state, b->dest, strlen(b->dest) + 1);
338 marshal_append(state, (char *)&b->writeable, sizeof(b->writeable));
339 }
Will Drewryf89aef52011-09-16 16:48:57 -0500340}
341
Will Drewry6ac91122011-10-21 16:38:58 -0500342size_t API minijail_size(const struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -0400343{
344 struct marshal_state state;
345 marshal_state_init(&state, NULL, 0);
346 minijail_marshal_helper(&state, j);
347 return state.total;
Will Drewry2ddaad02011-09-16 11:36:08 -0500348}
349
Elly Jonese1749eb2011-10-07 13:54:59 -0400350int minijail_marshal(const struct minijail *j, char *buf, size_t available)
351{
352 struct marshal_state state;
353 marshal_state_init(&state, buf, available);
354 minijail_marshal_helper(&state, j);
355 return (state.total > available);
Will Drewry2ddaad02011-09-16 11:36:08 -0500356}
357
Elly Jones51a5b6c2011-10-12 19:09:26 -0400358/* consumebytes: consumes @length bytes from a buffer @buf of length @buflength
359 * @length Number of bytes to consume
360 * @buf Buffer to consume from
361 * @buflength Size of @buf
362 *
363 * Returns a pointer to the base of the bytes, or NULL for errors.
364 */
Will Drewry6ac91122011-10-21 16:38:58 -0500365void *consumebytes(size_t length, char **buf, size_t *buflength) {
Elly Jones51a5b6c2011-10-12 19:09:26 -0400366 char *p = *buf;
367 if (length > *buflength)
368 return NULL;
369 *buf += length;
370 *buflength -= length;
371 return p;
372}
373
374/* consumestr: consumes a C string from a buffer @buf of length @length
375 * @buf Buffer to consume
376 * @length Length of buffer
377 *
378 * Returns a pointer to the base of the string, or NULL for errors.
379 */
Will Drewry6ac91122011-10-21 16:38:58 -0500380char *consumestr(char **buf, size_t *buflength) {
Elly Jones51a5b6c2011-10-12 19:09:26 -0400381 size_t len = strnlen(*buf, *buflength);
382 if (len == *buflength)
383 /* There's no null-terminator */
384 return NULL;
385 return consumebytes(len + 1, buf, buflength);
386}
387
Elly Jonese1749eb2011-10-07 13:54:59 -0400388int minijail_unmarshal(struct minijail *j, char *serialized, size_t length)
389{
Elly Jones51a5b6c2011-10-12 19:09:26 -0400390 int i;
391 int count;
Will Drewrybee7ba72011-10-21 20:47:01 -0500392 int ret = -EINVAL;
393
Elly Jonese1749eb2011-10-07 13:54:59 -0400394 if (length < sizeof(*j))
Will Drewrybee7ba72011-10-21 20:47:01 -0500395 goto out;
Elly Jonese1749eb2011-10-07 13:54:59 -0400396 memcpy((void *)j, serialized, sizeof(*j));
397 serialized += sizeof(*j);
398 length -= sizeof(*j);
Will Drewryf89aef52011-09-16 16:48:57 -0500399
Will Drewrybee7ba72011-10-21 20:47:01 -0500400 /* Potentially stale pointers not used as signals. */
401 j->bindings_head = NULL;
402 j->bindings_tail = NULL;
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -0800403 j->filter_prog = NULL;
Will Drewrybee7ba72011-10-21 20:47:01 -0500404
Elly Jonese1749eb2011-10-07 13:54:59 -0400405 if (j->user) { /* stale pointer */
Elly Jones51a5b6c2011-10-12 19:09:26 -0400406 char *user = consumestr(&serialized, &length);
407 if (!user)
Will Drewrybee7ba72011-10-21 20:47:01 -0500408 goto clear_pointers;
Elly Jones51a5b6c2011-10-12 19:09:26 -0400409 j->user = strdup(user);
Will Drewrybee7ba72011-10-21 20:47:01 -0500410 if (!j->user)
411 goto clear_pointers;
Elly Jonese1749eb2011-10-07 13:54:59 -0400412 }
Will Drewryf89aef52011-09-16 16:48:57 -0500413
Elly Jonesa8d1e1b2011-10-21 15:38:00 -0400414 if (j->chrootdir) { /* stale pointer */
415 char *chrootdir = consumestr(&serialized, &length);
416 if (!chrootdir)
Will Drewrybee7ba72011-10-21 20:47:01 -0500417 goto bad_chrootdir;
Elly Jonesa8d1e1b2011-10-21 15:38:00 -0400418 j->chrootdir = strdup(chrootdir);
Will Drewrybee7ba72011-10-21 20:47:01 -0500419 if (!j->chrootdir)
420 goto bad_chrootdir;
Elly Jonesa8d1e1b2011-10-21 15:38:00 -0400421 }
422
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -0800423 if (j->flags.seccomp_filter && j->filter_len > 0) {
424 size_t ninstrs = j->filter_len;
425 if (ninstrs > (SIZE_MAX / sizeof(struct sock_filter)) ||
426 ninstrs > USHRT_MAX)
427 goto bad_filters;
428
429 size_t program_len = ninstrs * sizeof(struct sock_filter);
430 void *program = consumebytes(program_len, &serialized, &length);
431 if (!program)
432 goto bad_filters;
433
434 j->filter_prog = malloc(sizeof(struct sock_fprog));
435 j->filter_prog->len = ninstrs;
436 j->filter_prog->filter = malloc(program_len);
437 memcpy(j->filter_prog->filter, program, program_len);
Elly Jonese1749eb2011-10-07 13:54:59 -0400438 }
Elly Jones51a5b6c2011-10-12 19:09:26 -0400439
440 count = j->binding_count;
Elly Jones51a5b6c2011-10-12 19:09:26 -0400441 j->binding_count = 0;
442 for (i = 0; i < count; ++i) {
443 int *writeable;
444 const char *dest;
445 const char *src = consumestr(&serialized, &length);
446 if (!src)
Will Drewrybee7ba72011-10-21 20:47:01 -0500447 goto bad_bindings;
Elly Jones51a5b6c2011-10-12 19:09:26 -0400448 dest = consumestr(&serialized, &length);
449 if (!dest)
Will Drewrybee7ba72011-10-21 20:47:01 -0500450 goto bad_bindings;
Elly Jones51a5b6c2011-10-12 19:09:26 -0400451 writeable = consumebytes(sizeof(*writeable), &serialized, &length);
452 if (!writeable)
Will Drewrybee7ba72011-10-21 20:47:01 -0500453 goto bad_bindings;
Elly Jones51a5b6c2011-10-12 19:09:26 -0400454 if (minijail_bind(j, src, dest, *writeable))
Will Drewrybee7ba72011-10-21 20:47:01 -0500455 goto bad_bindings;
Elly Jones51a5b6c2011-10-12 19:09:26 -0400456 }
457
Elly Jonese1749eb2011-10-07 13:54:59 -0400458 return 0;
Will Drewrybee7ba72011-10-21 20:47:01 -0500459
460bad_bindings:
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -0800461 if (j->flags.seccomp_filter && j->filter_len > 0) {
462 free(j->filter_prog->filter);
463 free(j->filter_prog);
464 }
Will Drewrybee7ba72011-10-21 20:47:01 -0500465bad_filters:
466 if (j->chrootdir)
467 free(j->chrootdir);
468bad_chrootdir:
469 if (j->user)
470 free(j->user);
471clear_pointers:
472 j->user = NULL;
473 j->chrootdir = NULL;
474out:
475 return ret;
Will Drewry2ddaad02011-09-16 11:36:08 -0500476}
477
Elly Jonese1749eb2011-10-07 13:54:59 -0400478void minijail_preenter(struct minijail *j)
479{
480 /* Strip out options which are minijail_run() only. */
481 j->flags.vfs = 0;
482 j->flags.readonly = 0;
483 j->flags.pids = 0;
Will Drewryfe4a3722011-09-16 14:50:50 -0500484}
485
Elly Jonese1749eb2011-10-07 13:54:59 -0400486void minijail_preexec(struct minijail *j)
487{
488 int vfs = j->flags.vfs;
489 int readonly = j->flags.readonly;
490 if (j->user)
491 free(j->user);
492 j->user = NULL;
493 memset(&j->flags, 0, sizeof(j->flags));
494 /* Now restore anything we meant to keep. */
495 j->flags.vfs = vfs;
496 j->flags.readonly = readonly;
497 /* Note, pidns will already have been used before this call. */
Will Drewry2ddaad02011-09-16 11:36:08 -0500498}
499
Elly Jones51a5b6c2011-10-12 19:09:26 -0400500/* bind_one: Applies bindings from @b for @j, recursing as needed.
501 * @j Minijail these bindings are for
502 * @b Head of list of bindings
503 *
504 * Returns 0 for success.
505 */
Will Drewry6ac91122011-10-21 16:38:58 -0500506int bind_one(const struct minijail *j, struct binding *b) {
Elly Jones51a5b6c2011-10-12 19:09:26 -0400507 int ret = 0;
508 char *dest = NULL;
Elly Jones51a5b6c2011-10-12 19:09:26 -0400509 if (ret)
510 return ret;
511 /* dest has a leading "/" */
512 if (asprintf(&dest, "%s%s", j->chrootdir, b->dest) < 0)
513 return -ENOMEM;
Elly Jonesa1059632011-12-15 15:17:07 -0500514 ret = mount(b->src, dest, NULL, MS_BIND, NULL);
Elly Jones51a5b6c2011-10-12 19:09:26 -0400515 if (ret)
516 pdie("bind: %s -> %s", b->src, dest);
Elly Jonesa1059632011-12-15 15:17:07 -0500517 if (!b->writeable) {
518 ret = mount(b->src, dest, NULL,
519 MS_BIND | MS_REMOUNT | MS_RDONLY, NULL);
520 if (ret)
521 pdie("bind ro: %s -> %s", b->src, dest);
522 }
Elly Jones51a5b6c2011-10-12 19:09:26 -0400523 free(dest);
524 if (b->next)
525 return bind_one(j, b->next);
526 return ret;
527}
528
Will Drewry6ac91122011-10-21 16:38:58 -0500529int enter_chroot(const struct minijail *j) {
Elly Jones51a5b6c2011-10-12 19:09:26 -0400530 int ret;
531 if (j->bindings_head && (ret = bind_one(j, j->bindings_head)))
532 return ret;
533
534 if (chroot(j->chrootdir))
535 return -errno;
536
537 if (chdir("/"))
538 return -errno;
539
540 return 0;
541}
542
Will Drewry6ac91122011-10-21 16:38:58 -0500543int remount_readonly(void)
Elly Jonese1749eb2011-10-07 13:54:59 -0400544{
545 const char *kProcPath = "/proc";
546 const unsigned int kSafeFlags = MS_NODEV | MS_NOEXEC | MS_NOSUID;
Elly Jonesdd3e8512012-01-23 15:13:38 -0500547 /*
548 * Right now, we're holding a reference to our parent's old mount of
Elly Jonese1749eb2011-10-07 13:54:59 -0400549 * /proc in our namespace, which means using MS_REMOUNT here would
550 * mutate our parent's mount as well, even though we're in a VFS
551 * namespace (!). Instead, remove their mount from our namespace
552 * and make our own.
553 */
554 if (umount(kProcPath))
555 return -errno;
556 if (mount("", kProcPath, "proc", kSafeFlags | MS_RDONLY, ""))
557 return -errno;
558 return 0;
Elly Jonescd7a9042011-07-22 13:56:51 -0400559}
560
Will Drewry6ac91122011-10-21 16:38:58 -0500561void drop_caps(const struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -0400562{
563 cap_t caps = cap_get_proc();
564 cap_value_t raise_flag[1];
565 unsigned int i;
566 if (!caps)
567 die("can't get process caps");
568 if (cap_clear_flag(caps, CAP_INHERITABLE))
569 die("can't clear inheritable caps");
570 if (cap_clear_flag(caps, CAP_EFFECTIVE))
571 die("can't clear effective caps");
572 if (cap_clear_flag(caps, CAP_PERMITTED))
573 die("can't clear permitted caps");
574 for (i = 0; i < sizeof(j->caps) * 8 && cap_valid((int)i); ++i) {
575 if (i != CAP_SETPCAP && !(j->caps & (1 << i)))
576 continue;
577 raise_flag[0] = i;
578 if (cap_set_flag(caps, CAP_EFFECTIVE, 1, raise_flag, CAP_SET))
579 die("can't add effective cap");
580 if (cap_set_flag(caps, CAP_PERMITTED, 1, raise_flag, CAP_SET))
581 die("can't add permitted cap");
582 if (cap_set_flag(caps, CAP_INHERITABLE, 1, raise_flag, CAP_SET))
583 die("can't add inheritable cap");
584 }
585 if (cap_set_proc(caps))
586 die("can't apply cleaned capset");
587 cap_free(caps);
588 for (i = 0; i < sizeof(j->caps) * 8 && cap_valid((int)i); ++i) {
589 if (j->caps & (1 << i))
590 continue;
591 if (prctl(PR_CAPBSET_DROP, i))
592 pdie("prctl(PR_CAPBSET_DROP)");
593 }
Elly Jonescd7a9042011-07-22 13:56:51 -0400594}
595
Will Drewry6ac91122011-10-21 16:38:58 -0500596void API minijail_enter(const struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -0400597{
598 if (j->flags.pids)
599 die("tried to enter a pid-namespaced jail;"
600 "try minijail_run()?");
Elly Jonescd7a9042011-07-22 13:56:51 -0400601
Elly Jonese1749eb2011-10-07 13:54:59 -0400602 if (j->flags.usergroups && !j->user)
603 die("usergroup inheritance without username");
Elly Jonescd7a9042011-07-22 13:56:51 -0400604
Elly Jonesdd3e8512012-01-23 15:13:38 -0500605 /*
606 * We can't recover from failures if we've dropped privileges partially,
Elly Jonese1749eb2011-10-07 13:54:59 -0400607 * so we don't even try. If any of our operations fail, we abort() the
608 * entire process.
609 */
610 if (j->flags.vfs && unshare(CLONE_NEWNS))
611 pdie("unshare");
Elly Jonescd7a9042011-07-22 13:56:51 -0400612
Elly Jones51a5b6c2011-10-12 19:09:26 -0400613 if (j->flags.chroot && enter_chroot(j))
614 pdie("chroot");
615
Elly Jonese1749eb2011-10-07 13:54:59 -0400616 if (j->flags.readonly && remount_readonly())
617 pdie("remount");
Elly Jonescd7a9042011-07-22 13:56:51 -0400618
Elly Jonese1749eb2011-10-07 13:54:59 -0400619 if (j->flags.caps) {
Elly Jonesdd3e8512012-01-23 15:13:38 -0500620 /*
621 * POSIX capabilities are a bit tricky. If we drop our
Elly Jonese1749eb2011-10-07 13:54:59 -0400622 * capability to change uids, our attempt to use setuid()
623 * below will fail. Hang on to root caps across setuid(), then
624 * lock securebits.
625 */
626 if (prctl(PR_SET_KEEPCAPS, 1))
627 pdie("prctl(PR_SET_KEEPCAPS)");
628 if (prctl
629 (PR_SET_SECUREBITS, SECURE_ALL_BITS | SECURE_ALL_LOCKS))
630 pdie("prctl(PR_SET_SECUREBITS)");
631 }
Elly Jonescd7a9042011-07-22 13:56:51 -0400632
Jorge Lucangeli Obesc2c9bcc2012-05-01 09:30:24 -0700633 /*
Elly Jones1c888ae2012-07-31 12:23:47 -0400634 * Set no_new_privs before installing seccomp filter. See
635 * </kernel/seccomp.c> and </kernel/sys.c> in the kernel source tree for
636 * an explanation of the parameters.
Jorge Lucangeli Obesc2c9bcc2012-05-01 09:30:24 -0700637 */
638 if (j->flags.no_new_privs) {
639 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0))
640 pdie("prctl(PR_SET_NO_NEW_PRIVS)");
641 }
642
643 /*
644 * Install seccomp filter before dropping root and caps.
645 * WARNING: this means that filter policies *must* allow
646 * setgroups()/setresgid()/setresuid() for dropping root and
647 * capget()/capset()/prctl() for dropping caps.
648 */
649 if (j->flags.seccomp_filter) {
650 if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, j->filter_prog))
651 pdie("prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER)");
652 }
653
Elly Jonese1749eb2011-10-07 13:54:59 -0400654 if (j->flags.usergroups) {
655 if (initgroups(j->user, j->usergid))
656 pdie("initgroups");
657 } else {
658 /* Only attempt to clear supplemental groups if we are changing
659 * users. */
660 if ((j->uid || j->gid) && setgroups(0, NULL))
661 pdie("setgroups");
662 }
Elly Jonescd7a9042011-07-22 13:56:51 -0400663
Elly Jonese1749eb2011-10-07 13:54:59 -0400664 if (j->flags.gid && setresgid(j->gid, j->gid, j->gid))
665 pdie("setresgid");
Elly Jonescd7a9042011-07-22 13:56:51 -0400666
Elly Jonese1749eb2011-10-07 13:54:59 -0400667 if (j->flags.uid && setresuid(j->uid, j->uid, j->uid))
668 pdie("setresuid");
Elly Jonescd7a9042011-07-22 13:56:51 -0400669
Elly Jonese1749eb2011-10-07 13:54:59 -0400670 if (j->flags.caps)
671 drop_caps(j);
Elly Jonescd7a9042011-07-22 13:56:51 -0400672
Elly Jonesdd3e8512012-01-23 15:13:38 -0500673 /*
674 * seccomp has to come last since it cuts off all the other
Elly Jonese1749eb2011-10-07 13:54:59 -0400675 * privilege-dropping syscalls :)
676 */
Elly Jonese1749eb2011-10-07 13:54:59 -0400677 if (j->flags.seccomp && prctl(PR_SET_SECCOMP, 1))
678 pdie("prctl(PR_SET_SECCOMP)");
Elly Jonescd7a9042011-07-22 13:56:51 -0400679}
680
Will Drewry6ac91122011-10-21 16:38:58 -0500681/* TODO(wad) will visibility affect this variable? */
Elly Jonescd7a9042011-07-22 13:56:51 -0400682static int init_exitstatus = 0;
683
Will Drewry6ac91122011-10-21 16:38:58 -0500684void init_term(int __attribute__ ((unused)) sig)
Elly Jonese1749eb2011-10-07 13:54:59 -0400685{
686 _exit(init_exitstatus);
Elly Jonescd7a9042011-07-22 13:56:51 -0400687}
688
Will Drewry6ac91122011-10-21 16:38:58 -0500689int init(pid_t rootpid)
Elly Jonese1749eb2011-10-07 13:54:59 -0400690{
691 pid_t pid;
692 int status;
693 /* so that we exit with the right status */
694 signal(SIGTERM, init_term);
695 /* TODO(wad) self jail with seccomp_filters here. */
696 while ((pid = wait(&status)) > 0) {
Elly Jonesdd3e8512012-01-23 15:13:38 -0500697 /*
698 * This loop will only end when either there are no processes
Elly Jonese1749eb2011-10-07 13:54:59 -0400699 * left inside our pid namespace or we get a signal.
700 */
701 if (pid == rootpid)
702 init_exitstatus = status;
703 }
704 if (!WIFEXITED(init_exitstatus))
705 _exit(MINIJAIL_ERR_INIT);
706 _exit(WEXITSTATUS(init_exitstatus));
Elly Jonescd7a9042011-07-22 13:56:51 -0400707}
708
Will Drewry6ac91122011-10-21 16:38:58 -0500709int API minijail_from_fd(int fd, struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -0400710{
711 size_t sz = 0;
712 size_t bytes = read(fd, &sz, sizeof(sz));
713 char *buf;
714 int r;
715 if (sizeof(sz) != bytes)
716 return -EINVAL;
717 if (sz > USHRT_MAX) /* Arbitrary sanity check */
718 return -E2BIG;
719 buf = malloc(sz);
720 if (!buf)
721 return -ENOMEM;
722 bytes = read(fd, buf, sz);
723 if (bytes != sz) {
724 free(buf);
725 return -EINVAL;
726 }
727 r = minijail_unmarshal(j, buf, sz);
728 free(buf);
729 return r;
Will Drewry2f54b6a2011-09-16 13:45:31 -0500730}
731
Will Drewry6ac91122011-10-21 16:38:58 -0500732int API minijail_to_fd(struct minijail *j, int fd)
Elly Jonese1749eb2011-10-07 13:54:59 -0400733{
734 char *buf;
735 size_t sz = minijail_size(j);
736 ssize_t written;
737 int r;
Elly Jonescd7a9042011-07-22 13:56:51 -0400738
Elly Jonese1749eb2011-10-07 13:54:59 -0400739 if (!sz)
740 return -EINVAL;
741 buf = malloc(sz);
742 r = minijail_marshal(j, buf, sz);
743 if (r) {
744 free(buf);
745 return r;
746 }
747 /* Sends [size][minijail]. */
748 written = write(fd, &sz, sizeof(sz));
749 if (written != sizeof(sz)) {
750 free(buf);
751 return -EFAULT;
752 }
753 written = write(fd, buf, sz);
754 if (written < 0 || (size_t) written != sz) {
755 free(buf);
756 return -EFAULT;
757 }
758 free(buf);
759 return 0;
Will Drewry2f54b6a2011-09-16 13:45:31 -0500760}
Elly Jonescd7a9042011-07-22 13:56:51 -0400761
Will Drewry6ac91122011-10-21 16:38:58 -0500762int setup_preload(void)
Elly Jonese1749eb2011-10-07 13:54:59 -0400763{
764 char *oldenv = getenv(kLdPreloadEnvVar) ? : "";
765 char *newenv = malloc(strlen(oldenv) + 2 + strlen(PRELOADPATH));
766 if (!newenv)
767 return -ENOMEM;
Elly Jonescd7a9042011-07-22 13:56:51 -0400768
Elly Jonese1749eb2011-10-07 13:54:59 -0400769 /* Only insert a separating space if we have something to separate... */
770 sprintf(newenv, "%s%s%s", oldenv, strlen(oldenv) ? " " : "",
771 PRELOADPATH);
Elly Jonescd7a9042011-07-22 13:56:51 -0400772
Elly Jonese1749eb2011-10-07 13:54:59 -0400773 /* setenv() makes a copy of the string we give it */
774 setenv(kLdPreloadEnvVar, newenv, 1);
775 free(newenv);
776 return 0;
Elly Jonescd7a9042011-07-22 13:56:51 -0400777}
778
Will Drewry6ac91122011-10-21 16:38:58 -0500779int setup_pipe(int fds[2])
Elly Jonese1749eb2011-10-07 13:54:59 -0400780{
781 int r = pipe(fds);
782 char fd_buf[11];
783 if (r)
784 return r;
785 r = snprintf(fd_buf, sizeof(fd_buf), "%d", fds[0]);
786 if (r <= 0)
787 return -EINVAL;
788 setenv(kFdEnvVar, fd_buf, 1);
789 return 0;
Will Drewryf89aef52011-09-16 16:48:57 -0500790}
791
Will Drewry6ac91122011-10-21 16:38:58 -0500792int API minijail_run(struct minijail *j, const char *filename,
793 char *const argv[])
Elly Jonese1749eb2011-10-07 13:54:59 -0400794{
Jorge Lucangeli Obes9807d032012-04-17 13:36:00 -0700795 return minijail_run_pid(j, filename, argv, NULL);
796}
797
798int API minijail_run_pid(struct minijail *j, const char *filename,
799 char *const argv[], pid_t *pchild_pid)
800{
Elly Jonese1749eb2011-10-07 13:54:59 -0400801 char *oldenv, *oldenv_copy = NULL;
802 pid_t child_pid;
803 int pipe_fds[2];
804 int ret;
Elly Jonesa05d7bb2012-06-14 14:09:27 -0400805 /* We need to remember this across the minijail_preexec() call. */
806 int pid_namespace = j->flags.pids;
Ben Chan541c7e52011-08-26 14:55:53 -0700807
Elly Jonese1749eb2011-10-07 13:54:59 -0400808 oldenv = getenv(kLdPreloadEnvVar);
809 if (oldenv) {
810 oldenv_copy = strdup(oldenv);
811 if (!oldenv_copy)
812 return -ENOMEM;
813 }
Will Drewryf89aef52011-09-16 16:48:57 -0500814
Elly Jonese1749eb2011-10-07 13:54:59 -0400815 if (setup_preload())
816 return -EFAULT;
Will Drewry2f54b6a2011-09-16 13:45:31 -0500817
Elly Jonesdd3e8512012-01-23 15:13:38 -0500818 /*
819 * Before we fork(2) and execve(2) the child process, we need to open
Elly Jonese1749eb2011-10-07 13:54:59 -0400820 * a pipe(2) to send the minijail configuration over.
821 */
822 if (setup_pipe(pipe_fds))
823 return -EFAULT;
Elly Jonescd7a9042011-07-22 13:56:51 -0400824
Elly Jones761b7412012-06-13 15:49:52 -0400825 /* Use sys_clone() if and only if we're creating a pid namespace.
826 *
827 * tl;dr: WARNING: do not mix pid namespaces and multithreading.
828 *
829 * In multithreaded programs, there are a bunch of locks inside libc,
830 * some of which may be held by other threads at the time that we call
831 * minijail_run_pid(). If we call fork(), glibc does its level best to
832 * ensure that we hold all of these locks before it calls clone()
833 * internally and drop them after clone() returns, but when we call
834 * sys_clone(2) directly, all that gets bypassed and we end up with a
835 * child address space where some of libc's important locks are held by
836 * other threads (which did not get cloned, and hence will never release
837 * those locks). This is okay so long as we call exec() immediately
838 * after, but a bunch of seemingly-innocent libc functions like setenv()
839 * take locks.
840 *
841 * Hence, only call sys_clone() if we need to, in order to get at pid
842 * namespacing. If we follow this path, the child's address space might
843 * have broken locks; you may only call functions that do not acquire
844 * any locks.
845 *
846 * Unfortunately, fork() acquires every lock it can get its hands on, as
847 * previously detailed, so this function is highly likely to deadlock
848 * later on (see "deadlock here") if we're multithreaded.
849 *
850 * We might hack around this by having the clone()d child (init of the
851 * pid namespace) return directly, rather than leaving the clone()d
852 * process hanging around to be init for the new namespace (and having
853 * its fork()ed child return in turn), but that process would be crippled
854 * with its libc locks potentially broken. We might try fork()ing in the
855 * parent before we clone() to ensure that we own all the locks, but
856 * then we have to have the forked child hanging around consuming
857 * resources (and possibly having file descriptors / shared memory
858 * regions / etc attached). We'd need to keep the child around to avoid
859 * having its children get reparented to init.
860 *
861 * TODO(ellyjones): figure out if the "forked child hanging around"
862 * problem is fixable or not. It would be nice if we worked in this
863 * case.
864 */
Elly Jonesa05d7bb2012-06-14 14:09:27 -0400865 if (pid_namespace)
Elly Jones761b7412012-06-13 15:49:52 -0400866 child_pid = syscall(SYS_clone, CLONE_NEWPID | SIGCHLD, NULL);
867 else
868 child_pid = fork();
869
Elly Jonese1749eb2011-10-07 13:54:59 -0400870 if (child_pid < 0) {
871 free(oldenv_copy);
872 return child_pid;
873 }
Will Drewryf89aef52011-09-16 16:48:57 -0500874
Elly Jonese1749eb2011-10-07 13:54:59 -0400875 if (child_pid) {
876 /* Restore parent's LD_PRELOAD. */
877 if (oldenv_copy) {
878 setenv(kLdPreloadEnvVar, oldenv_copy, 1);
879 free(oldenv_copy);
880 } else {
881 unsetenv(kLdPreloadEnvVar);
882 }
883 unsetenv(kFdEnvVar);
884 j->initpid = child_pid;
885 close(pipe_fds[0]); /* read endpoint */
886 ret = minijail_to_fd(j, pipe_fds[1]);
887 close(pipe_fds[1]); /* write endpoint */
888 if (ret) {
889 kill(j->initpid, SIGKILL);
890 die("failed to send marshalled minijail");
891 }
Jorge Lucangeli Obes9807d032012-04-17 13:36:00 -0700892 if (pchild_pid)
893 *pchild_pid = child_pid;
Elly Jonese1749eb2011-10-07 13:54:59 -0400894 return 0;
895 }
896 free(oldenv_copy);
Ben Chan541c7e52011-08-26 14:55:53 -0700897
Elly Jonese1749eb2011-10-07 13:54:59 -0400898 /* Drop everything that cannot be inherited across execve. */
899 minijail_preexec(j);
900 /* Jail this process and its descendants... */
901 minijail_enter(j);
Elly Jonescd7a9042011-07-22 13:56:51 -0400902
Elly Jonesa05d7bb2012-06-14 14:09:27 -0400903 if (pid_namespace) {
Elly Jonesdd3e8512012-01-23 15:13:38 -0500904 /*
905 * pid namespace: this process will become init inside the new
Elly Jonese1749eb2011-10-07 13:54:59 -0400906 * namespace, so fork off a child to actually run the program
907 * (we don't want all programs we might exec to have to know
908 * how to be init).
Elly Jones761b7412012-06-13 15:49:52 -0400909 *
910 * If we're multithreaded, we'll probably deadlock here. See
911 * WARNING above.
Elly Jonese1749eb2011-10-07 13:54:59 -0400912 */
913 child_pid = fork();
914 if (child_pid < 0)
915 _exit(child_pid);
916 else if (child_pid > 0)
917 init(child_pid); /* never returns */
918 }
Elly Jonescd7a9042011-07-22 13:56:51 -0400919
Elly Jonesdd3e8512012-01-23 15:13:38 -0500920 /*
921 * If we aren't pid-namespaced:
Elly Jonese1749eb2011-10-07 13:54:59 -0400922 * calling process
923 * -> execve()-ing process
924 * If we are:
925 * calling process
926 * -> init()-ing process
927 * -> execve()-ing process
928 */
929 _exit(execve(filename, argv, environ));
Elly Jonescd7a9042011-07-22 13:56:51 -0400930}
931
Will Drewry6ac91122011-10-21 16:38:58 -0500932int API minijail_kill(struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -0400933{
934 int st;
935 if (kill(j->initpid, SIGTERM))
936 return -errno;
937 if (waitpid(j->initpid, &st, 0) < 0)
938 return -errno;
939 return st;
Elly Jonescd7a9042011-07-22 13:56:51 -0400940}
941
Will Drewry6ac91122011-10-21 16:38:58 -0500942int API minijail_wait(struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -0400943{
944 int st;
945 if (waitpid(j->initpid, &st, 0) < 0)
946 return -errno;
Jorge Lucangeli Obesc2c9bcc2012-05-01 09:30:24 -0700947 if (!WIFEXITED(st)) {
948 if (WIFSIGNALED(st))
949 warn("child process received signal %d", WTERMSIG(st));
Elly Jonese1749eb2011-10-07 13:54:59 -0400950 return MINIJAIL_ERR_JAIL;
Jorge Lucangeli Obesc2c9bcc2012-05-01 09:30:24 -0700951 }
Elly Jonese1749eb2011-10-07 13:54:59 -0400952 return WEXITSTATUS(st);
Elly Jonescd7a9042011-07-22 13:56:51 -0400953}
954
Will Drewry6ac91122011-10-21 16:38:58 -0500955void API minijail_destroy(struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -0400956{
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -0800957 if (j->flags.seccomp_filter && j->filter_prog) {
958 free(j->filter_prog->filter);
959 free(j->filter_prog);
Elly Jonese1749eb2011-10-07 13:54:59 -0400960 }
Elly Jones51a5b6c2011-10-12 19:09:26 -0400961 while (j->bindings_head) {
962 struct binding *b = j->bindings_head;
963 j->bindings_head = j->bindings_head->next;
964 free(b->dest);
965 free(b->src);
966 free(b);
967 }
968 j->bindings_tail = NULL;
Elly Jonese1749eb2011-10-07 13:54:59 -0400969 if (j->user)
970 free(j->user);
Will Drewrybee7ba72011-10-21 20:47:01 -0500971 if (j->chrootdir)
972 free(j->chrootdir);
Elly Jonese1749eb2011-10-07 13:54:59 -0400973 free(j);
Elly Jonescd7a9042011-07-22 13:56:51 -0400974}