blob: aa789cd2edd9e3053fce74657197a3e1762dec14 [file] [log] [blame]
Jorge Lucangeli Obesd613ab22015-03-03 14:22:50 -08001/* Copyright (c) 2012 The Chromium OS Authors. All rights reserved.
Elly Jonescd7a9042011-07-22 13:56:51 -04002 * Use of this source code is governed by a BSD-style license that can be
Will Drewry32ac9f52011-08-18 21:36:27 -05003 * found in the LICENSE file.
4 */
Elly Jonescd7a9042011-07-22 13:56:51 -04005
6#define _BSD_SOURCE
Arthur Gautier7a569072016-04-23 17:25:20 +00007#define _DEFAULT_SOURCE
Elly Jonescd7a9042011-07-22 13:56:51 -04008#define _GNU_SOURCE
Jorge Lucangeli Obesc2c9bcc2012-05-01 09:30:24 -07009
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -080010#include <asm/unistd.h>
Will Drewry32ac9f52011-08-18 21:36:27 -050011#include <ctype.h>
Luis Hector Chavez43ff0802016-10-07 12:21:07 -070012#include <dirent.h>
Elly Jonescd7a9042011-07-22 13:56:51 -040013#include <errno.h>
Jorge Lucangeli Obes1563b5b2014-07-10 07:01:53 -070014#include <fcntl.h>
Elly Jonescd7a9042011-07-22 13:56:51 -040015#include <grp.h>
16#include <inttypes.h>
Will Drewryfe4a3722011-09-16 14:50:50 -050017#include <limits.h>
Elly Jonescd7a9042011-07-22 13:56:51 -040018#include <linux/capability.h>
Mike Frysinger7559dfe2016-11-15 18:58:39 -050019#include <net/if.h>
Elly Jonescd7a9042011-07-22 13:56:51 -040020#include <pwd.h>
21#include <sched.h>
22#include <signal.h>
Will Drewry2f54b6a2011-09-16 13:45:31 -050023#include <stdarg.h>
Jorge Lucangeli Obes54714502015-09-30 10:08:45 -070024#include <stdbool.h>
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -080025#include <stddef.h>
Elly Jonescd7a9042011-07-22 13:56:51 -040026#include <stdio.h>
27#include <stdlib.h>
28#include <string.h>
Elly Jonescd7a9042011-07-22 13:56:51 -040029#include <sys/capability.h>
30#include <sys/mount.h>
Will Drewryf89aef52011-09-16 16:48:57 -050031#include <sys/param.h>
Elly Jonescd7a9042011-07-22 13:56:51 -040032#include <sys/prctl.h>
Mike Frysinger7559dfe2016-11-15 18:58:39 -050033#include <sys/socket.h>
Jorge Lucangeli Obes1563b5b2014-07-10 07:01:53 -070034#include <sys/stat.h>
35#include <sys/types.h>
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -080036#include <sys/user.h>
Elly Jonescd7a9042011-07-22 13:56:51 -040037#include <sys/wait.h>
Luis Hector Chavezfb449ab2016-10-14 09:49:22 -070038#include <syscall.h>
Elly Jonescd7a9042011-07-22 13:56:51 -040039#include <unistd.h>
40
41#include "libminijail.h"
42#include "libminijail-private.h"
43
Jorge Lucangeli Obesa21c8fc2015-07-15 16:22:34 -070044#include "signal_handler.h"
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -080045#include "syscall_filter.h"
Jorge Lucangeli Obes13650612016-09-02 11:27:29 -040046#include "syscall_wrapper.h"
Jorge Lucangeli Obesa6b034d2012-08-07 15:29:20 -070047#include "util.h"
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -080048
Lei Zhangeee31552012-10-17 21:27:10 -070049#ifdef HAVE_SECUREBITS_H
Jorge Lucangeli Obesf783b522016-03-14 14:34:10 -070050# include <linux/securebits.h>
Lei Zhangeee31552012-10-17 21:27:10 -070051#else
Jorge Lucangeli Obesf783b522016-03-14 14:34:10 -070052# define SECURE_ALL_BITS 0x55
53# define SECURE_ALL_LOCKS (SECURE_ALL_BITS << 1)
54#endif
55/* For kernels < 4.3. */
56#define OLD_SECURE_ALL_BITS 0x15
57#define OLD_SECURE_ALL_LOCKS (OLD_SECURE_ALL_BITS << 1)
58
59/*
60 * Assert the value of SECURE_ALL_BITS at compile-time.
61 * Brillo devices are currently compiled against 4.4 kernel headers. Kernel 4.3
62 * added a new securebit.
63 * When a new securebit is added, the new SECURE_ALL_BITS mask will return EPERM
64 * when used on older kernels. The compile-time assert will catch this situation
65 * at compile time.
66 */
67#ifdef __BRILLO__
68_Static_assert(SECURE_ALL_BITS == 0x55, "SECURE_ALL_BITS == 0x55.");
Lei Zhangeee31552012-10-17 21:27:10 -070069#endif
70
Jorge Lucangeli Obesf783b522016-03-14 14:34:10 -070071/* Until these are reliably available in linux/prctl.h. */
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -080072#ifndef PR_SET_SECCOMP
Jorge Lucangeli Obesc2c9bcc2012-05-01 09:30:24 -070073# define PR_SET_SECCOMP 22
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -080074#endif
75
Andrew Brestickereac28942015-11-11 16:04:46 -080076#ifndef PR_ALT_SYSCALL
77# define PR_ALT_SYSCALL 0x43724f53
78#endif
79
Jorge Lucangeli Obes13650612016-09-02 11:27:29 -040080/* Seccomp filter related flags. */
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -080081#ifndef PR_SET_NO_NEW_PRIVS
82# define PR_SET_NO_NEW_PRIVS 38
83#endif
Jorge Lucangeli Obes13650612016-09-02 11:27:29 -040084
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -080085#ifndef SECCOMP_MODE_FILTER
86# define SECCOMP_MODE_FILTER 2 /* uses user-supplied filter. */
Will Drewry32ac9f52011-08-18 21:36:27 -050087#endif
88
Jorge Lucangeli Obes13650612016-09-02 11:27:29 -040089#ifndef SECCOMP_SET_MODE_STRICT
90# define SECCOMP_SET_MODE_STRICT 0
91#endif
92#ifndef SECCOMP_SET_MODE_FILTER
93# define SECCOMP_SET_MODE_FILTER 1
94#endif
95
96#ifndef SECCOMP_FILTER_FLAG_TSYNC
97# define SECCOMP_FILTER_FLAG_TSYNC 1
98#endif
99/* End seccomp filter related flags. */
100
Dylan Reid4cbc2a52016-06-17 19:06:07 -0700101/* New cgroup namespace might not be in linux-headers yet. */
102#ifndef CLONE_NEWCGROUP
103# define CLONE_NEWCGROUP 0x02000000
104#endif
105
Dylan Reid605ce7f2016-01-19 19:21:00 -0800106#define MAX_CGROUPS 10 /* 10 different controllers supported by Linux. */
107
Dylan Reid648b2202015-10-23 00:50:00 -0700108struct mountpoint {
Elly Jones51a5b6c2011-10-12 19:09:26 -0400109 char *src;
110 char *dest;
Dylan Reid648b2202015-10-23 00:50:00 -0700111 char *type;
Dylan Reid81e23972016-05-18 14:06:35 -0700112 char *data;
113 int has_data;
Dylan Reid648b2202015-10-23 00:50:00 -0700114 unsigned long flags;
115 struct mountpoint *next;
Elly Jones51a5b6c2011-10-12 19:09:26 -0400116};
117
Will Drewryf89aef52011-09-16 16:48:57 -0500118struct minijail {
Jorge Lucangeli Obes4ae30cc2014-04-10 15:35:33 -0700119 /*
Jorge Lucangeli Obesc8b21e12014-06-13 14:26:16 -0700120 * WARNING: if you add a flag here you need to make sure it's
121 * accounted for in minijail_pre{enter|exec}() below.
Jorge Lucangeli Obes4ae30cc2014-04-10 15:35:33 -0700122 */
Elly Jonese1749eb2011-10-07 13:54:59 -0400123 struct {
Luis Hector Chavezfb449ab2016-10-14 09:49:22 -0700124 int uid : 1;
125 int gid : 1;
Lutz Justen13807cb2017-01-03 17:11:55 +0100126 int inherit_suppl_gids : 1;
127 int set_suppl_gids : 1;
128 int keep_suppl_gids : 1;
Luis Hector Chavezfb449ab2016-10-14 09:49:22 -0700129 int use_caps : 1;
130 int capbset_drop : 1;
131 int vfs : 1;
132 int enter_vfs : 1;
133 int skip_remount_private : 1;
134 int pids : 1;
135 int ipc : 1;
136 int net : 1;
137 int enter_net : 1;
138 int ns_cgroups : 1;
139 int userns : 1;
140 int disable_setgroups : 1;
141 int seccomp : 1;
142 int remount_proc_ro : 1;
143 int no_new_privs : 1;
144 int seccomp_filter : 1;
145 int seccomp_filter_tsync : 1;
146 int seccomp_filter_logging : 1;
147 int chroot : 1;
148 int pivot_root : 1;
149 int mount_tmp : 1;
150 int do_init : 1;
151 int pid_file : 1;
152 int cgroups : 1;
153 int alt_syscall : 1;
154 int reset_signal_mask : 1;
155 int close_open_fds : 1;
Elly Jonese1749eb2011-10-07 13:54:59 -0400156 } flags;
157 uid_t uid;
158 gid_t gid;
159 gid_t usergid;
160 char *user;
Jorge Lucangeli Obesd16ac492015-12-03 14:44:35 -0800161 size_t suppl_gid_count;
162 gid_t *suppl_gid_list;
Elly Jonese1749eb2011-10-07 13:54:59 -0400163 uint64_t caps;
Jorge Lucangeli Obesf9fcdbe2016-02-19 15:04:09 -0800164 uint64_t cap_bset;
Elly Jonese1749eb2011-10-07 13:54:59 -0400165 pid_t initpid;
Jorge Lucangeli Obes1563b5b2014-07-10 07:01:53 -0700166 int mountns_fd;
Dylan Reid1102f5a2015-09-15 11:52:20 -0700167 int netns_fd;
Elly Jones51a5b6c2011-10-12 19:09:26 -0400168 char *chrootdir;
Yu-Hsi Chiang3cc05ea2015-08-11 11:23:17 +0800169 char *pid_file_path;
Yu-Hsi Chiang10e91232015-08-05 14:40:45 +0800170 char *uidmap;
171 char *gidmap;
Jorge Lucangeli Obesc2ba9f52015-12-01 07:58:10 -0800172 size_t filter_len;
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -0800173 struct sock_fprog *filter_prog;
Jorge Lucangeli Obesc2ba9f52015-12-01 07:58:10 -0800174 char *alt_syscall_table;
Dylan Reid648b2202015-10-23 00:50:00 -0700175 struct mountpoint *mounts_head;
176 struct mountpoint *mounts_tail;
Jorge Lucangeli Obesc2ba9f52015-12-01 07:58:10 -0800177 size_t mounts_count;
Dylan Reid605ce7f2016-01-19 19:21:00 -0800178 char *cgroups[MAX_CGROUPS];
179 size_t cgroup_count;
Will Drewryf89aef52011-09-16 16:48:57 -0500180};
181
Jorge Lucangeli Obes4ae30cc2014-04-10 15:35:33 -0700182/*
183 * Strip out flags meant for the parent.
184 * We keep things that are not inherited across execve(2) (e.g. capabilities),
185 * or are easier to set after execve(2) (e.g. seccomp filters).
186 */
187void minijail_preenter(struct minijail *j)
188{
189 j->flags.vfs = 0;
Jorge Lucangeli Obes1563b5b2014-07-10 07:01:53 -0700190 j->flags.enter_vfs = 0;
Shuhei Takahashi3da40312016-03-07 17:37:49 +0900191 j->flags.skip_remount_private = 0;
Dylan Reid791f5772015-09-14 20:02:42 -0700192 j->flags.remount_proc_ro = 0;
Jorge Lucangeli Obes4ae30cc2014-04-10 15:35:33 -0700193 j->flags.pids = 0;
Yu-Hsi Chiang3e954ec2015-07-28 16:48:14 +0800194 j->flags.do_init = 0;
Yu-Hsi Chiang3cc05ea2015-08-11 11:23:17 +0800195 j->flags.pid_file = 0;
Jorge Lucangeli Obesb8a51382016-01-25 20:08:22 -0800196 j->flags.cgroups = 0;
Jorge Lucangeli Obes4ae30cc2014-04-10 15:35:33 -0700197}
198
199/*
200 * Strip out flags meant for the child.
201 * We keep things that are inherited across execve(2).
202 */
203void minijail_preexec(struct minijail *j)
204{
205 int vfs = j->flags.vfs;
Jorge Lucangeli Obes1563b5b2014-07-10 07:01:53 -0700206 int enter_vfs = j->flags.enter_vfs;
Jorge Lucangeli Obes87bf01d2016-03-08 11:20:03 -0800207 int skip_remount_private = j->flags.skip_remount_private;
Dylan Reid791f5772015-09-14 20:02:42 -0700208 int remount_proc_ro = j->flags.remount_proc_ro;
Yu-Hsi Chiang10e91232015-08-05 14:40:45 +0800209 int userns = j->flags.userns;
Jorge Lucangeli Obes4ae30cc2014-04-10 15:35:33 -0700210 if (j->user)
211 free(j->user);
212 j->user = NULL;
Jorge Lucangeli Obese81a52f2015-12-04 16:05:23 -0800213 if (j->suppl_gid_list)
214 free(j->suppl_gid_list);
215 j->suppl_gid_list = NULL;
Jorge Lucangeli Obes4ae30cc2014-04-10 15:35:33 -0700216 memset(&j->flags, 0, sizeof(j->flags));
217 /* Now restore anything we meant to keep. */
218 j->flags.vfs = vfs;
Jorge Lucangeli Obes1563b5b2014-07-10 07:01:53 -0700219 j->flags.enter_vfs = enter_vfs;
Jorge Lucangeli Obes87bf01d2016-03-08 11:20:03 -0800220 j->flags.skip_remount_private = skip_remount_private;
Dylan Reid791f5772015-09-14 20:02:42 -0700221 j->flags.remount_proc_ro = remount_proc_ro;
Yu-Hsi Chiang10e91232015-08-05 14:40:45 +0800222 j->flags.userns = userns;
Jorge Lucangeli Obes4ae30cc2014-04-10 15:35:33 -0700223 /* Note, |pids| will already have been used before this call. */
224}
225
226/* Minijail API. */
227
Will Drewry6ac91122011-10-21 16:38:58 -0500228struct minijail API *minijail_new(void)
Elly Jonese1749eb2011-10-07 13:54:59 -0400229{
Elly Jones51a5b6c2011-10-12 19:09:26 -0400230 return calloc(1, sizeof(struct minijail));
Elly Jonescd7a9042011-07-22 13:56:51 -0400231}
232
Will Drewry6ac91122011-10-21 16:38:58 -0500233void API minijail_change_uid(struct minijail *j, uid_t uid)
Elly Jonese1749eb2011-10-07 13:54:59 -0400234{
235 if (uid == 0)
236 die("useless change to uid 0");
237 j->uid = uid;
238 j->flags.uid = 1;
Elly Jonescd7a9042011-07-22 13:56:51 -0400239}
240
Will Drewry6ac91122011-10-21 16:38:58 -0500241void API minijail_change_gid(struct minijail *j, gid_t gid)
Elly Jonese1749eb2011-10-07 13:54:59 -0400242{
243 if (gid == 0)
244 die("useless change to gid 0");
245 j->gid = gid;
246 j->flags.gid = 1;
Elly Jonescd7a9042011-07-22 13:56:51 -0400247}
248
Jorge Lucangeli Obesbc67f442016-01-08 14:43:45 -0800249void API minijail_set_supplementary_gids(struct minijail *j, size_t size,
250 const gid_t *list)
Jorge Lucangeli Obesd16ac492015-12-03 14:44:35 -0800251{
Jorge Lucangeli Obes06940be2015-12-04 18:09:21 -0800252 size_t i;
253
Jorge Lucangeli Obes34543192017-01-11 16:07:57 -0500254 if (j->flags.inherit_suppl_gids)
255 die("cannot inherit *and* set supplementary groups");
256 if (j->flags.keep_suppl_gids)
257 die("cannot keep *and* set supplementary groups");
Jorge Lucangeli Obesd16ac492015-12-03 14:44:35 -0800258
Jorge Lucangeli Obesfd5fc562016-01-08 10:29:27 -0800259 if (size == 0) {
260 /* Clear supplementary groups. */
261 j->suppl_gid_list = NULL;
262 j->suppl_gid_count = 0;
Lutz Justen13807cb2017-01-03 17:11:55 +0100263 j->flags.set_suppl_gids = 1;
Jorge Lucangeli Obesbc67f442016-01-08 14:43:45 -0800264 return;
Jorge Lucangeli Obesfd5fc562016-01-08 10:29:27 -0800265 }
Jorge Lucangeli Obesd16ac492015-12-03 14:44:35 -0800266
267 /* Copy the gid_t array. */
268 j->suppl_gid_list = calloc(size, sizeof(gid_t));
269 if (!j->suppl_gid_list) {
Jorge Lucangeli Obesfd5fc562016-01-08 10:29:27 -0800270 die("failed to allocate internal supplementary group array");
Jorge Lucangeli Obesd16ac492015-12-03 14:44:35 -0800271 }
Jorge Lucangeli Obes06940be2015-12-04 18:09:21 -0800272 for (i = 0; i < size; i++) {
Jorge Lucangeli Obesd16ac492015-12-03 14:44:35 -0800273 j->suppl_gid_list[i] = list[i];
274 }
275 j->suppl_gid_count = size;
Lutz Justen13807cb2017-01-03 17:11:55 +0100276 j->flags.set_suppl_gids = 1;
277}
278
279void API minijail_keep_supplementary_gids(struct minijail *j) {
280 j->flags.keep_suppl_gids = 1;
Jorge Lucangeli Obesd16ac492015-12-03 14:44:35 -0800281}
282
Will Drewry6ac91122011-10-21 16:38:58 -0500283int API minijail_change_user(struct minijail *j, const char *user)
Elly Jonese1749eb2011-10-07 13:54:59 -0400284{
285 char *buf = NULL;
286 struct passwd pw;
287 struct passwd *ppw = NULL;
288 ssize_t sz = sysconf(_SC_GETPW_R_SIZE_MAX);
289 if (sz == -1)
290 sz = 65536; /* your guess is as good as mine... */
Elly Joneseb300c52011-09-22 14:35:43 -0400291
Elly Jonesdd3e8512012-01-23 15:13:38 -0500292 /*
293 * sysconf(_SC_GETPW_R_SIZE_MAX), under glibc, is documented to return
Elly Jonese1749eb2011-10-07 13:54:59 -0400294 * the maximum needed size of the buffer, so we don't have to search.
295 */
296 buf = malloc(sz);
297 if (!buf)
298 return -ENOMEM;
299 getpwnam_r(user, &pw, buf, sz, &ppw);
Elly Jonesdd3e8512012-01-23 15:13:38 -0500300 /*
Jorge Lucangeli Obesb8a51382016-01-25 20:08:22 -0800301 * We're safe to free the buffer here. The strings inside |pw| point
302 * inside |buf|, but we don't use any of them; this leaves the pointers
Jorge Lucangeli Obes87bf01d2016-03-08 11:20:03 -0800303 * dangling but it's safe. |ppw| points at |pw| if getpwnam_r(3)
304 * succeeded.
Elly Jonesdd3e8512012-01-23 15:13:38 -0500305 */
Elly Jonese1749eb2011-10-07 13:54:59 -0400306 free(buf);
Jorge Lucangeli Obes4e480652014-03-26 10:56:42 -0700307 /* getpwnam_r(3) does *not* set errno when |ppw| is NULL. */
Elly Jonese1749eb2011-10-07 13:54:59 -0400308 if (!ppw)
Jorge Lucangeli Obes4e480652014-03-26 10:56:42 -0700309 return -1;
Elly Jonese1749eb2011-10-07 13:54:59 -0400310 minijail_change_uid(j, ppw->pw_uid);
311 j->user = strdup(user);
312 if (!j->user)
313 return -ENOMEM;
314 j->usergid = ppw->pw_gid;
315 return 0;
Elly Jonescd7a9042011-07-22 13:56:51 -0400316}
317
Will Drewry6ac91122011-10-21 16:38:58 -0500318int API minijail_change_group(struct minijail *j, const char *group)
Elly Jonese1749eb2011-10-07 13:54:59 -0400319{
Jorge Lucangeli Obesa21c8fc2015-07-15 16:22:34 -0700320 char *buf = NULL;
Yabin Cui1b21c8f2015-07-22 10:34:45 -0700321 struct group gr;
322 struct group *pgr = NULL;
Elly Jonese1749eb2011-10-07 13:54:59 -0400323 ssize_t sz = sysconf(_SC_GETGR_R_SIZE_MAX);
324 if (sz == -1)
325 sz = 65536; /* and mine is as good as yours, really */
Elly Joneseb300c52011-09-22 14:35:43 -0400326
Elly Jonesdd3e8512012-01-23 15:13:38 -0500327 /*
328 * sysconf(_SC_GETGR_R_SIZE_MAX), under glibc, is documented to return
Elly Jonese1749eb2011-10-07 13:54:59 -0400329 * the maximum needed size of the buffer, so we don't have to search.
330 */
331 buf = malloc(sz);
332 if (!buf)
333 return -ENOMEM;
334 getgrnam_r(group, &gr, buf, sz, &pgr);
Elly Jonesdd3e8512012-01-23 15:13:38 -0500335 /*
336 * We're safe to free the buffer here. The strings inside gr point
337 * inside buf, but we don't use any of them; this leaves the pointers
338 * dangling but it's safe. pgr points at gr if getgrnam_r succeeded.
339 */
Elly Jonese1749eb2011-10-07 13:54:59 -0400340 free(buf);
Jorge Lucangeli Obes4e480652014-03-26 10:56:42 -0700341 /* getgrnam_r(3) does *not* set errno when |pgr| is NULL. */
Elly Jonese1749eb2011-10-07 13:54:59 -0400342 if (!pgr)
Jorge Lucangeli Obes4e480652014-03-26 10:56:42 -0700343 return -1;
Elly Jonese1749eb2011-10-07 13:54:59 -0400344 minijail_change_gid(j, pgr->gr_gid);
345 return 0;
Elly Jonescd7a9042011-07-22 13:56:51 -0400346}
347
Will Drewry6ac91122011-10-21 16:38:58 -0500348void API minijail_use_seccomp(struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -0400349{
350 j->flags.seccomp = 1;
Elly Jonescd7a9042011-07-22 13:56:51 -0400351}
352
Jorge Lucangeli Obesc2c9bcc2012-05-01 09:30:24 -0700353void API minijail_no_new_privs(struct minijail *j)
354{
355 j->flags.no_new_privs = 1;
356}
357
Will Drewry6ac91122011-10-21 16:38:58 -0500358void API minijail_use_seccomp_filter(struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -0400359{
360 j->flags.seccomp_filter = 1;
Will Drewry32ac9f52011-08-18 21:36:27 -0500361}
362
Jorge Lucangeli Obes13650612016-09-02 11:27:29 -0400363void API minijail_set_seccomp_filter_tsync(struct minijail *j)
364{
Jorge Lucangeli Obes713f6fb2016-10-03 13:03:25 -0400365 if (j->filter_len > 0 && j->filter_prog != NULL) {
366 die("minijail_set_seccomp_filter_tsync() must be called "
367 "before minijail_parse_seccomp_filters()");
368 }
Jorge Lucangeli Obes13650612016-09-02 11:27:29 -0400369 j->flags.seccomp_filter_tsync = 1;
370}
371
Jorge Lucangeli Obesbda833c2012-07-31 16:25:56 -0700372void API minijail_log_seccomp_filter_failures(struct minijail *j)
373{
Jorge Lucangeli Obes713f6fb2016-10-03 13:03:25 -0400374 if (j->filter_len > 0 && j->filter_prog != NULL) {
375 die("minijail_log_seccomp_filter_failures() must be called "
376 "before minijail_parse_seccomp_filters()");
377 }
378 j->flags.seccomp_filter_logging = 1;
Jorge Lucangeli Obesbda833c2012-07-31 16:25:56 -0700379}
380
Will Drewry6ac91122011-10-21 16:38:58 -0500381void API minijail_use_caps(struct minijail *j, uint64_t capmask)
Elly Jonese1749eb2011-10-07 13:54:59 -0400382{
Jorge Lucangeli Obesf9fcdbe2016-02-19 15:04:09 -0800383 /*
384 * 'minijail_use_caps' configures a runtime-capabilities-only
385 * environment, including a bounding set matching the thread's runtime
386 * (permitted|inheritable|effective) sets.
387 * Therefore, it will override any existing bounding set configurations
388 * since the latter would allow gaining extra runtime capabilities from
389 * file capabilities.
390 */
391 if (j->flags.capbset_drop) {
392 warn("overriding bounding set configuration");
393 j->cap_bset = 0;
394 j->flags.capbset_drop = 0;
395 }
Elly Jonese1749eb2011-10-07 13:54:59 -0400396 j->caps = capmask;
Jorge Lucangeli Obesf9fcdbe2016-02-19 15:04:09 -0800397 j->flags.use_caps = 1;
Elly Jonescd7a9042011-07-22 13:56:51 -0400398}
399
Jorge Lucangeli Obesf9fcdbe2016-02-19 15:04:09 -0800400void API minijail_capbset_drop(struct minijail *j, uint64_t capmask)
401{
402 if (j->flags.use_caps) {
403 /*
404 * 'minijail_use_caps' will have already configured a capability
405 * bounding set matching the (permitted|inheritable|effective)
406 * sets. Abort if the user tries to configure a separate
407 * bounding set. 'minijail_capbset_drop' and 'minijail_use_caps'
408 * are mutually exclusive.
409 */
410 die("runtime capabilities already configured, can't drop "
411 "bounding set separately");
412 }
413 j->cap_bset = capmask;
414 j->flags.capbset_drop = 1;
415}
416
417void API minijail_reset_signal_mask(struct minijail *j)
418{
Peter Qiu2860c462015-12-16 15:13:06 -0800419 j->flags.reset_signal_mask = 1;
420}
421
Will Drewry6ac91122011-10-21 16:38:58 -0500422void API minijail_namespace_vfs(struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -0400423{
424 j->flags.vfs = 1;
Elly Jonescd7a9042011-07-22 13:56:51 -0400425}
426
Jorge Lucangeli Obes1563b5b2014-07-10 07:01:53 -0700427void API minijail_namespace_enter_vfs(struct minijail *j, const char *ns_path)
428{
Ricky Zhoubce609d2016-03-02 21:47:56 -0800429 int ns_fd = open(ns_path, O_RDONLY | O_CLOEXEC);
Jorge Lucangeli Obes1563b5b2014-07-10 07:01:53 -0700430 if (ns_fd < 0) {
431 pdie("failed to open namespace '%s'", ns_path);
432 }
433 j->mountns_fd = ns_fd;
434 j->flags.enter_vfs = 1;
435}
436
Jorge Lucangeli Obesa521bee2016-03-03 13:47:57 -0800437void API minijail_skip_remount_private(struct minijail *j)
438{
439 j->flags.skip_remount_private = 1;
440}
441
Will Drewry6ac91122011-10-21 16:38:58 -0500442void API minijail_namespace_pids(struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -0400443{
Elly Jonese58176c2012-01-23 11:46:17 -0500444 j->flags.vfs = 1;
Dylan Reid791f5772015-09-14 20:02:42 -0700445 j->flags.remount_proc_ro = 1;
Elly Jonese1749eb2011-10-07 13:54:59 -0400446 j->flags.pids = 1;
Yu-Hsi Chiang3e954ec2015-07-28 16:48:14 +0800447 j->flags.do_init = 1;
Elly Jonescd7a9042011-07-22 13:56:51 -0400448}
449
Dylan Reidf7942472015-11-18 17:55:26 -0800450void API minijail_namespace_ipc(struct minijail *j)
451{
452 j->flags.ipc = 1;
453}
454
Elly Fong-Jones6c086302013-03-20 17:15:28 -0400455void API minijail_namespace_net(struct minijail *j)
456{
457 j->flags.net = 1;
458}
459
Dylan Reid1102f5a2015-09-15 11:52:20 -0700460void API minijail_namespace_enter_net(struct minijail *j, const char *ns_path)
461{
Ricky Zhoubce609d2016-03-02 21:47:56 -0800462 int ns_fd = open(ns_path, O_RDONLY | O_CLOEXEC);
Dylan Reid1102f5a2015-09-15 11:52:20 -0700463 if (ns_fd < 0) {
464 pdie("failed to open namespace '%s'", ns_path);
465 }
466 j->netns_fd = ns_fd;
467 j->flags.enter_net = 1;
468}
469
Dylan Reid4cbc2a52016-06-17 19:06:07 -0700470void API minijail_namespace_cgroups(struct minijail *j)
471{
472 j->flags.ns_cgroups = 1;
473}
474
Luis Hector Chavez43ff0802016-10-07 12:21:07 -0700475void API minijail_close_open_fds(struct minijail *j)
476{
477 j->flags.close_open_fds = 1;
478}
479
Dylan Reid791f5772015-09-14 20:02:42 -0700480void API minijail_remount_proc_readonly(struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -0400481{
482 j->flags.vfs = 1;
Dylan Reid791f5772015-09-14 20:02:42 -0700483 j->flags.remount_proc_ro = 1;
Elly Jonescd7a9042011-07-22 13:56:51 -0400484}
485
Yu-Hsi Chiang10e91232015-08-05 14:40:45 +0800486void API minijail_namespace_user(struct minijail *j)
487{
488 j->flags.userns = 1;
489}
490
Jorge Lucangeli Obes200299c2016-09-23 15:21:57 -0400491void API minijail_namespace_user_disable_setgroups(struct minijail *j)
492{
493 j->flags.disable_setgroups = 1;
494}
495
Yu-Hsi Chiang10e91232015-08-05 14:40:45 +0800496int API minijail_uidmap(struct minijail *j, const char *uidmap)
497{
498 j->uidmap = strdup(uidmap);
499 if (!j->uidmap)
500 return -ENOMEM;
Yu-Hsi Chiang1912c5b2015-08-31 18:59:49 +0800501 char *ch;
502 for (ch = j->uidmap; *ch; ch++) {
503 if (*ch == ',')
504 *ch = '\n';
505 }
Yu-Hsi Chiang10e91232015-08-05 14:40:45 +0800506 return 0;
507}
508
509int API minijail_gidmap(struct minijail *j, const char *gidmap)
510{
511 j->gidmap = strdup(gidmap);
512 if (!j->gidmap)
513 return -ENOMEM;
Yu-Hsi Chiang1912c5b2015-08-31 18:59:49 +0800514 char *ch;
515 for (ch = j->gidmap; *ch; ch++) {
516 if (*ch == ',')
517 *ch = '\n';
518 }
Yu-Hsi Chiang10e91232015-08-05 14:40:45 +0800519 return 0;
520}
521
Will Drewry6ac91122011-10-21 16:38:58 -0500522void API minijail_inherit_usergroups(struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -0400523{
Lutz Justen13807cb2017-01-03 17:11:55 +0100524 j->flags.inherit_suppl_gids = 1;
Elly Jonescd7a9042011-07-22 13:56:51 -0400525}
526
Yu-Hsi Chiang3e954ec2015-07-28 16:48:14 +0800527void API minijail_run_as_init(struct minijail *j)
528{
529 /*
530 * Since the jailed program will become 'init' in the new PID namespace,
531 * Minijail does not need to fork an 'init' process.
532 */
533 j->flags.do_init = 0;
534}
535
Jorge Lucangeli Obesc8b21e12014-06-13 14:26:16 -0700536int API minijail_enter_chroot(struct minijail *j, const char *dir)
537{
Elly Jones51a5b6c2011-10-12 19:09:26 -0400538 if (j->chrootdir)
539 return -EINVAL;
540 j->chrootdir = strdup(dir);
541 if (!j->chrootdir)
542 return -ENOMEM;
543 j->flags.chroot = 1;
544 return 0;
545}
546
Yu-Hsi Chiang64d65a72015-08-13 17:43:27 +0800547int API minijail_enter_pivot_root(struct minijail *j, const char *dir)
548{
549 if (j->chrootdir)
550 return -EINVAL;
551 j->chrootdir = strdup(dir);
552 if (!j->chrootdir)
553 return -ENOMEM;
554 j->flags.pivot_root = 1;
555 return 0;
556}
557
Dylan Reida14e08d2015-10-22 21:05:29 -0700558char API *minijail_get_original_path(struct minijail *j,
559 const char *path_inside_chroot)
560{
Dylan Reid648b2202015-10-23 00:50:00 -0700561 struct mountpoint *b;
Dylan Reida14e08d2015-10-22 21:05:29 -0700562
Dylan Reid648b2202015-10-23 00:50:00 -0700563 b = j->mounts_head;
Dylan Reida14e08d2015-10-22 21:05:29 -0700564 while (b) {
565 /*
566 * If |path_inside_chroot| is the exact destination of a
Dylan Reid648b2202015-10-23 00:50:00 -0700567 * mount, then the original path is exactly the source of
568 * the mount.
Dylan Reida14e08d2015-10-22 21:05:29 -0700569 * for example: "-b /some/path/exe,/chroot/path/exe"
Dylan Reid648b2202015-10-23 00:50:00 -0700570 * mount source = /some/path/exe, mount dest =
571 * /chroot/path/exe Then when getting the original path of
572 * "/chroot/path/exe", the source of that mount,
573 * "/some/path/exe" is what should be returned.
Dylan Reida14e08d2015-10-22 21:05:29 -0700574 */
575 if (!strcmp(b->dest, path_inside_chroot))
576 return strdup(b->src);
577
578 /*
579 * If |path_inside_chroot| is within the destination path of a
Dylan Reid648b2202015-10-23 00:50:00 -0700580 * mount, take the suffix of the chroot path relative to the
581 * mount destination path, and append it to the mount source
582 * path.
Dylan Reida14e08d2015-10-22 21:05:29 -0700583 */
584 if (!strncmp(b->dest, path_inside_chroot, strlen(b->dest))) {
585 const char *relative_path =
586 path_inside_chroot + strlen(b->dest);
Jorge Lucangeli Obes7b2e29c2016-08-04 12:21:03 -0400587 return path_join(b->src, relative_path);
Dylan Reida14e08d2015-10-22 21:05:29 -0700588 }
589 b = b->next;
590 }
591
592 /* If there is a chroot path, append |path_inside_chroot| to that. */
593 if (j->chrootdir)
Jorge Lucangeli Obes7b2e29c2016-08-04 12:21:03 -0400594 return path_join(j->chrootdir, path_inside_chroot);
Dylan Reida14e08d2015-10-22 21:05:29 -0700595
596 /* No chroot, so the path outside is the same as it is inside. */
597 return strdup(path_inside_chroot);
Dylan Reid08946cc2015-09-16 19:10:57 -0700598}
599
Lee Campbell11af0622014-05-22 12:36:04 -0700600void API minijail_mount_tmp(struct minijail *j)
601{
602 j->flags.mount_tmp = 1;
603}
604
Yu-Hsi Chiang3cc05ea2015-08-11 11:23:17 +0800605int API minijail_write_pid_file(struct minijail *j, const char *path)
606{
607 j->pid_file_path = strdup(path);
608 if (!j->pid_file_path)
609 return -ENOMEM;
610 j->flags.pid_file = 1;
611 return 0;
612}
613
Dylan Reid605ce7f2016-01-19 19:21:00 -0800614int API minijail_add_to_cgroup(struct minijail *j, const char *path)
615{
616 if (j->cgroup_count >= MAX_CGROUPS)
617 return -ENOMEM;
618 j->cgroups[j->cgroup_count] = strdup(path);
619 if (!j->cgroups[j->cgroup_count])
620 return -ENOMEM;
621 j->cgroup_count++;
Jorge Lucangeli Obesb8a51382016-01-25 20:08:22 -0800622 j->flags.cgroups = 1;
Dylan Reid605ce7f2016-01-19 19:21:00 -0800623 return 0;
624}
625
Dylan Reid81e23972016-05-18 14:06:35 -0700626int API minijail_mount_with_data(struct minijail *j, const char *src,
627 const char *dest, const char *type,
628 unsigned long flags, const char *data)
Jorge Lucangeli Obesc8b21e12014-06-13 14:26:16 -0700629{
Dylan Reid648b2202015-10-23 00:50:00 -0700630 struct mountpoint *m;
Elly Jones51a5b6c2011-10-12 19:09:26 -0400631
632 if (*dest != '/')
633 return -EINVAL;
Dylan Reid648b2202015-10-23 00:50:00 -0700634 m = calloc(1, sizeof(*m));
635 if (!m)
Elly Jones51a5b6c2011-10-12 19:09:26 -0400636 return -ENOMEM;
Dylan Reid648b2202015-10-23 00:50:00 -0700637 m->dest = strdup(dest);
638 if (!m->dest)
Elly Jones51a5b6c2011-10-12 19:09:26 -0400639 goto error;
Dylan Reid648b2202015-10-23 00:50:00 -0700640 m->src = strdup(src);
641 if (!m->src)
Elly Jones51a5b6c2011-10-12 19:09:26 -0400642 goto error;
Dylan Reid648b2202015-10-23 00:50:00 -0700643 m->type = strdup(type);
644 if (!m->type)
645 goto error;
Dylan Reid81e23972016-05-18 14:06:35 -0700646 if (data) {
647 m->data = strdup(data);
648 if (!m->data)
649 goto error;
650 m->has_data = 1;
651 }
Dylan Reid648b2202015-10-23 00:50:00 -0700652 m->flags = flags;
Elly Jones51a5b6c2011-10-12 19:09:26 -0400653
Jorge Lucangeli Obes6c755d22016-01-28 15:24:40 -0800654 info("mount %s -> %s type '%s'", src, dest, type);
Elly Jones51a5b6c2011-10-12 19:09:26 -0400655
Elly Jonesdd3e8512012-01-23 15:13:38 -0500656 /*
Dylan Reid648b2202015-10-23 00:50:00 -0700657 * Force vfs namespacing so the mounts don't leak out into the
Elly Jones51a5b6c2011-10-12 19:09:26 -0400658 * containing vfs namespace.
659 */
660 minijail_namespace_vfs(j);
661
Dylan Reid648b2202015-10-23 00:50:00 -0700662 if (j->mounts_tail)
663 j->mounts_tail->next = m;
Elly Jones51a5b6c2011-10-12 19:09:26 -0400664 else
Dylan Reid648b2202015-10-23 00:50:00 -0700665 j->mounts_head = m;
666 j->mounts_tail = m;
667 j->mounts_count++;
Elly Jones51a5b6c2011-10-12 19:09:26 -0400668
669 return 0;
670
671error:
Dylan Reid81e23972016-05-18 14:06:35 -0700672 free(m->type);
Dylan Reid648b2202015-10-23 00:50:00 -0700673 free(m->src);
674 free(m->dest);
675 free(m);
Elly Jones51a5b6c2011-10-12 19:09:26 -0400676 return -ENOMEM;
677}
678
Dylan Reid81e23972016-05-18 14:06:35 -0700679int API minijail_mount(struct minijail *j, const char *src, const char *dest,
680 const char *type, unsigned long flags)
681{
682 return minijail_mount_with_data(j, src, dest, type, flags, NULL);
683}
684
Dylan Reid648b2202015-10-23 00:50:00 -0700685int API minijail_bind(struct minijail *j, const char *src, const char *dest,
686 int writeable)
687{
688 unsigned long flags = MS_BIND;
689
690 if (!writeable)
691 flags |= MS_RDONLY;
692
693 return minijail_mount(j, src, dest, "", flags);
694}
695
Jorge Lucangeli Obes13650612016-09-02 11:27:29 -0400696static void clear_seccomp_options(struct minijail *j)
697{
698 j->flags.seccomp_filter = 0;
699 j->flags.seccomp_filter_tsync = 0;
Jorge Lucangeli Obes713f6fb2016-10-03 13:03:25 -0400700 j->flags.seccomp_filter_logging = 0;
Jorge Lucangeli Obes13650612016-09-02 11:27:29 -0400701 j->filter_len = 0;
702 j->filter_prog = NULL;
703 j->flags.no_new_privs = 0;
704}
705
Jorge Lucangeli Obes4d4b3be2016-08-16 16:58:14 -0400706static int seccomp_should_parse_filters(struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -0400707{
Jorge Lucangeli Obes13650612016-09-02 11:27:29 -0400708 if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, NULL) == -1) {
Jorge Lucangeli Obes4d4b3be2016-08-16 16:58:14 -0400709 /*
710 * |errno| will be set to EINVAL when seccomp has not been
711 * compiled into the kernel. On certain platforms and kernel
712 * versions this is not a fatal failure. In that case, and only
713 * in that case, disable seccomp and skip loading the filters.
714 */
Jorge Lucangeli Obes7b2e29c2016-08-04 12:21:03 -0400715 if ((errno == EINVAL) && seccomp_can_softfail()) {
Jorge Lucangeli Obes13650612016-09-02 11:27:29 -0400716 warn("not loading seccomp filters, seccomp filter not "
717 "supported");
718 clear_seccomp_options(j);
Jorge Lucangeli Obes4d4b3be2016-08-16 16:58:14 -0400719 return 0;
Utkarsh Sanghi0ef8a662014-08-18 15:50:11 -0700720 }
Jorge Lucangeli Obes4d4b3be2016-08-16 16:58:14 -0400721 /*
722 * If |errno| != EINVAL or seccomp_can_softfail() is false,
723 * we can proceed. Worst case scenario minijail_enter() will
724 * abort() if seccomp fails.
725 */
Utkarsh Sanghi0ef8a662014-08-18 15:50:11 -0700726 }
Jorge Lucangeli Obes13650612016-09-02 11:27:29 -0400727 if (j->flags.seccomp_filter_tsync) {
728 /* Are the seccomp(2) syscall and the TSYNC option supported? */
729 if (sys_seccomp(SECCOMP_SET_MODE_FILTER,
730 SECCOMP_FILTER_FLAG_TSYNC, NULL) == -1) {
731 int saved_errno = errno;
Jorge Lucangeli Obes713f6fb2016-10-03 13:03:25 -0400732 if (saved_errno == ENOSYS && seccomp_can_softfail()) {
733 warn("seccomp(2) syscall not supported");
734 clear_seccomp_options(j);
735 return 0;
736 } else if (saved_errno == EINVAL &&
737 seccomp_can_softfail()) {
738 warn(
739 "seccomp filter thread sync not supported");
740 clear_seccomp_options(j);
Jorge Lucangeli Obes13650612016-09-02 11:27:29 -0400741 return 0;
742 }
743 /*
744 * Similar logic here. If seccomp_can_softfail() is
745 * false, or |errno| != ENOSYS, or |errno| != EINVAL,
746 * we can proceed. Worst case scenario minijail_enter()
747 * will abort() if seccomp or TSYNC fail.
748 */
749 }
750 }
Jorge Lucangeli Obes4d4b3be2016-08-16 16:58:14 -0400751 return 1;
752}
753
754static int parse_seccomp_filters(struct minijail *j, FILE *policy_file)
755{
756 struct sock_fprog *fprog = malloc(sizeof(struct sock_fprog));
Jorge Lucangeli Obes713f6fb2016-10-03 13:03:25 -0400757 int use_ret_trap =
758 j->flags.seccomp_filter_tsync || j->flags.seccomp_filter_logging;
759 int allow_logging = j->flags.seccomp_filter_logging;
760
761 if (compile_filter(policy_file, fprog, use_ret_trap, allow_logging)) {
Jorge Lucangeli Obes4d4b3be2016-08-16 16:58:14 -0400762 free(fprog);
763 return -1;
764 }
765
766 j->filter_len = fprog->len;
767 j->filter_prog = fprog;
768 return 0;
769}
770
771void API minijail_parse_seccomp_filters(struct minijail *j, const char *path)
772{
773 if (!seccomp_should_parse_filters(j))
774 return;
775
Elly Jonese1749eb2011-10-07 13:54:59 -0400776 FILE *file = fopen(path, "r");
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -0800777 if (!file) {
Jorge Lucangeli Obes224e4272012-08-02 14:31:39 -0700778 pdie("failed to open seccomp filter file '%s'", path);
Elly Jonese1749eb2011-10-07 13:54:59 -0400779 }
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -0800780
Jorge Lucangeli Obes4d4b3be2016-08-16 16:58:14 -0400781 if (parse_seccomp_filters(j, file) != 0) {
Jorge Lucangeli Obesbda833c2012-07-31 16:25:56 -0700782 die("failed to compile seccomp filter BPF program in '%s'",
783 path);
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -0800784 }
Jorge Lucangeli Obes4d4b3be2016-08-16 16:58:14 -0400785 fclose(file);
786}
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -0800787
Jorge Lucangeli Obes4d4b3be2016-08-16 16:58:14 -0400788void API minijail_parse_seccomp_filters_from_fd(struct minijail *j, int fd)
789{
790 if (!seccomp_should_parse_filters(j))
791 return;
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -0800792
Jorge Lucangeli Obes4d4b3be2016-08-16 16:58:14 -0400793 FILE *file = fdopen(fd, "r");
794 if (!file) {
795 pdie("failed to associate stream with fd %d", fd);
796 }
797
798 if (parse_seccomp_filters(j, file) != 0) {
799 die("failed to compile seccomp filter BPF program from fd %d",
800 fd);
801 }
Elly Jonese1749eb2011-10-07 13:54:59 -0400802 fclose(file);
Will Drewry32ac9f52011-08-18 21:36:27 -0500803}
804
Andrew Brestickereac28942015-11-11 16:04:46 -0800805int API minijail_use_alt_syscall(struct minijail *j, const char *table)
806{
807 j->alt_syscall_table = strdup(table);
808 if (!j->alt_syscall_table)
809 return -ENOMEM;
810 j->flags.alt_syscall = 1;
811 return 0;
812}
813
Will Drewryf89aef52011-09-16 16:48:57 -0500814struct marshal_state {
Elly Jonese1749eb2011-10-07 13:54:59 -0400815 size_t available;
816 size_t total;
817 char *buf;
Will Drewryf89aef52011-09-16 16:48:57 -0500818};
819
Jorge Lucangeli Obesa521bee2016-03-03 13:47:57 -0800820void marshal_state_init(struct marshal_state *state, char *buf,
821 size_t available)
Elly Jonese1749eb2011-10-07 13:54:59 -0400822{
823 state->available = available;
824 state->buf = buf;
825 state->total = 0;
Will Drewryf89aef52011-09-16 16:48:57 -0500826}
827
Jorge Lucangeli Obesa521bee2016-03-03 13:47:57 -0800828void marshal_append(struct marshal_state *state, void *src, size_t length)
Elly Jonese1749eb2011-10-07 13:54:59 -0400829{
830 size_t copy_len = MIN(state->available, length);
Will Drewryf89aef52011-09-16 16:48:57 -0500831
Elly Jonese1749eb2011-10-07 13:54:59 -0400832 /* Up to |available| will be written. */
833 if (copy_len) {
834 memcpy(state->buf, src, copy_len);
835 state->buf += copy_len;
836 state->available -= copy_len;
837 }
838 /* |total| will contain the expected length. */
839 state->total += length;
Will Drewryf89aef52011-09-16 16:48:57 -0500840}
841
Jorge Lucangeli Obes7b2e29c2016-08-04 12:21:03 -0400842void marshal_mount(struct marshal_state *state, const struct mountpoint *m)
Dylan Reid81e23972016-05-18 14:06:35 -0700843{
844 marshal_append(state, m->src, strlen(m->src) + 1);
845 marshal_append(state, m->dest, strlen(m->dest) + 1);
846 marshal_append(state, m->type, strlen(m->type) + 1);
847 marshal_append(state, (char *)&m->has_data, sizeof(m->has_data));
848 if (m->has_data)
849 marshal_append(state, m->data, strlen(m->data) + 1);
850 marshal_append(state, (char *)&m->flags, sizeof(m->flags));
851}
852
Will Drewry6ac91122011-10-21 16:38:58 -0500853void minijail_marshal_helper(struct marshal_state *state,
854 const struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -0400855{
Dylan Reid648b2202015-10-23 00:50:00 -0700856 struct mountpoint *m = NULL;
Dylan Reid605ce7f2016-01-19 19:21:00 -0800857 size_t i;
858
Elly Jonese1749eb2011-10-07 13:54:59 -0400859 marshal_append(state, (char *)j, sizeof(*j));
860 if (j->user)
861 marshal_append(state, j->user, strlen(j->user) + 1);
Jorge Lucangeli Obesde02a5b2015-12-11 15:28:52 -0800862 if (j->suppl_gid_list) {
863 marshal_append(state, j->suppl_gid_list,
864 j->suppl_gid_count * sizeof(gid_t));
865 }
Elly Jones51a5b6c2011-10-12 19:09:26 -0400866 if (j->chrootdir)
867 marshal_append(state, j->chrootdir, strlen(j->chrootdir) + 1);
Andrew Brestickereac28942015-11-11 16:04:46 -0800868 if (j->alt_syscall_table) {
869 marshal_append(state, j->alt_syscall_table,
870 strlen(j->alt_syscall_table) + 1);
871 }
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -0800872 if (j->flags.seccomp_filter && j->filter_prog) {
873 struct sock_fprog *fp = j->filter_prog;
874 marshal_append(state, (char *)fp->filter,
Jorge Lucangeli Obesa521bee2016-03-03 13:47:57 -0800875 fp->len * sizeof(struct sock_filter));
Elly Jonese1749eb2011-10-07 13:54:59 -0400876 }
Dylan Reid648b2202015-10-23 00:50:00 -0700877 for (m = j->mounts_head; m; m = m->next) {
Jorge Lucangeli Obes7b2e29c2016-08-04 12:21:03 -0400878 marshal_mount(state, m);
Elly Jones51a5b6c2011-10-12 19:09:26 -0400879 }
Dylan Reid605ce7f2016-01-19 19:21:00 -0800880 for (i = 0; i < j->cgroup_count; ++i)
881 marshal_append(state, j->cgroups[i], strlen(j->cgroups[i]) + 1);
Will Drewryf89aef52011-09-16 16:48:57 -0500882}
883
Will Drewry6ac91122011-10-21 16:38:58 -0500884size_t API minijail_size(const struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -0400885{
886 struct marshal_state state;
887 marshal_state_init(&state, NULL, 0);
888 minijail_marshal_helper(&state, j);
889 return state.total;
Will Drewry2ddaad02011-09-16 11:36:08 -0500890}
891
Elly Jonese1749eb2011-10-07 13:54:59 -0400892int minijail_marshal(const struct minijail *j, char *buf, size_t available)
893{
894 struct marshal_state state;
895 marshal_state_init(&state, buf, available);
896 minijail_marshal_helper(&state, j);
897 return (state.total > available);
Will Drewry2ddaad02011-09-16 11:36:08 -0500898}
899
Elly Jonese1749eb2011-10-07 13:54:59 -0400900int minijail_unmarshal(struct minijail *j, char *serialized, size_t length)
901{
Jorge Lucangeli Obesc2ba9f52015-12-01 07:58:10 -0800902 size_t i;
903 size_t count;
Will Drewrybee7ba72011-10-21 20:47:01 -0500904 int ret = -EINVAL;
905
Elly Jonese1749eb2011-10-07 13:54:59 -0400906 if (length < sizeof(*j))
Will Drewrybee7ba72011-10-21 20:47:01 -0500907 goto out;
Elly Jonese1749eb2011-10-07 13:54:59 -0400908 memcpy((void *)j, serialized, sizeof(*j));
909 serialized += sizeof(*j);
910 length -= sizeof(*j);
Will Drewryf89aef52011-09-16 16:48:57 -0500911
Will Drewrybee7ba72011-10-21 20:47:01 -0500912 /* Potentially stale pointers not used as signals. */
Jorge Lucangeli Obes3b2e6e42016-08-04 12:26:19 -0400913 j->pid_file_path = NULL;
914 j->uidmap = NULL;
915 j->gidmap = NULL;
Dylan Reid648b2202015-10-23 00:50:00 -0700916 j->mounts_head = NULL;
917 j->mounts_tail = NULL;
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -0800918 j->filter_prog = NULL;
Will Drewrybee7ba72011-10-21 20:47:01 -0500919
Elly Jonese1749eb2011-10-07 13:54:59 -0400920 if (j->user) { /* stale pointer */
Elly Jones51a5b6c2011-10-12 19:09:26 -0400921 char *user = consumestr(&serialized, &length);
922 if (!user)
Will Drewrybee7ba72011-10-21 20:47:01 -0500923 goto clear_pointers;
Elly Jones51a5b6c2011-10-12 19:09:26 -0400924 j->user = strdup(user);
Will Drewrybee7ba72011-10-21 20:47:01 -0500925 if (!j->user)
926 goto clear_pointers;
Elly Jonese1749eb2011-10-07 13:54:59 -0400927 }
Will Drewryf89aef52011-09-16 16:48:57 -0500928
Jorge Lucangeli Obesde02a5b2015-12-11 15:28:52 -0800929 if (j->suppl_gid_list) { /* stale pointer */
930 if (j->suppl_gid_count > NGROUPS_MAX) {
931 goto bad_gid_list;
932 }
933 size_t gid_list_size = j->suppl_gid_count * sizeof(gid_t);
934 void *gid_list_bytes =
935 consumebytes(gid_list_size, &serialized, &length);
936 if (!gid_list_bytes)
937 goto bad_gid_list;
938
939 j->suppl_gid_list = calloc(j->suppl_gid_count, sizeof(gid_t));
940 if (!j->suppl_gid_list)
941 goto bad_gid_list;
942
943 memcpy(j->suppl_gid_list, gid_list_bytes, gid_list_size);
944 }
945
Elly Jonesa8d1e1b2011-10-21 15:38:00 -0400946 if (j->chrootdir) { /* stale pointer */
947 char *chrootdir = consumestr(&serialized, &length);
948 if (!chrootdir)
Will Drewrybee7ba72011-10-21 20:47:01 -0500949 goto bad_chrootdir;
Elly Jonesa8d1e1b2011-10-21 15:38:00 -0400950 j->chrootdir = strdup(chrootdir);
Will Drewrybee7ba72011-10-21 20:47:01 -0500951 if (!j->chrootdir)
952 goto bad_chrootdir;
Elly Jonesa8d1e1b2011-10-21 15:38:00 -0400953 }
954
Andrew Brestickereac28942015-11-11 16:04:46 -0800955 if (j->alt_syscall_table) { /* stale pointer */
956 char *alt_syscall_table = consumestr(&serialized, &length);
957 if (!alt_syscall_table)
958 goto bad_syscall_table;
959 j->alt_syscall_table = strdup(alt_syscall_table);
960 if (!j->alt_syscall_table)
961 goto bad_syscall_table;
962 }
963
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -0800964 if (j->flags.seccomp_filter && j->filter_len > 0) {
965 size_t ninstrs = j->filter_len;
966 if (ninstrs > (SIZE_MAX / sizeof(struct sock_filter)) ||
967 ninstrs > USHRT_MAX)
968 goto bad_filters;
969
970 size_t program_len = ninstrs * sizeof(struct sock_filter);
971 void *program = consumebytes(program_len, &serialized, &length);
972 if (!program)
973 goto bad_filters;
974
975 j->filter_prog = malloc(sizeof(struct sock_fprog));
Jorge Lucangeli Obesde02a5b2015-12-11 15:28:52 -0800976 if (!j->filter_prog)
977 goto bad_filters;
978
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -0800979 j->filter_prog->len = ninstrs;
980 j->filter_prog->filter = malloc(program_len);
Jorge Lucangeli Obesde02a5b2015-12-11 15:28:52 -0800981 if (!j->filter_prog->filter)
982 goto bad_filter_prog_instrs;
983
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -0800984 memcpy(j->filter_prog->filter, program, program_len);
Elly Jonese1749eb2011-10-07 13:54:59 -0400985 }
Elly Jones51a5b6c2011-10-12 19:09:26 -0400986
Dylan Reid648b2202015-10-23 00:50:00 -0700987 count = j->mounts_count;
988 j->mounts_count = 0;
Elly Jones51a5b6c2011-10-12 19:09:26 -0400989 for (i = 0; i < count; ++i) {
Dylan Reid648b2202015-10-23 00:50:00 -0700990 unsigned long *flags;
Dylan Reid81e23972016-05-18 14:06:35 -0700991 int *has_data;
Elly Jones51a5b6c2011-10-12 19:09:26 -0400992 const char *dest;
Dylan Reid648b2202015-10-23 00:50:00 -0700993 const char *type;
Dylan Reid81e23972016-05-18 14:06:35 -0700994 const char *data = NULL;
Elly Jones51a5b6c2011-10-12 19:09:26 -0400995 const char *src = consumestr(&serialized, &length);
996 if (!src)
Dylan Reid648b2202015-10-23 00:50:00 -0700997 goto bad_mounts;
Elly Jones51a5b6c2011-10-12 19:09:26 -0400998 dest = consumestr(&serialized, &length);
999 if (!dest)
Dylan Reid648b2202015-10-23 00:50:00 -07001000 goto bad_mounts;
1001 type = consumestr(&serialized, &length);
1002 if (!type)
1003 goto bad_mounts;
Dylan Reid81e23972016-05-18 14:06:35 -07001004 has_data = consumebytes(sizeof(*has_data), &serialized,
1005 &length);
1006 if (!has_data)
1007 goto bad_mounts;
1008 if (*has_data) {
1009 data = consumestr(&serialized, &length);
1010 if (!data)
1011 goto bad_mounts;
1012 }
Dylan Reid648b2202015-10-23 00:50:00 -07001013 flags = consumebytes(sizeof(*flags), &serialized, &length);
1014 if (!flags)
1015 goto bad_mounts;
Dylan Reid81e23972016-05-18 14:06:35 -07001016 if (minijail_mount_with_data(j, src, dest, type, *flags, data))
Dylan Reid648b2202015-10-23 00:50:00 -07001017 goto bad_mounts;
Elly Jones51a5b6c2011-10-12 19:09:26 -04001018 }
1019
Dylan Reid605ce7f2016-01-19 19:21:00 -08001020 count = j->cgroup_count;
1021 j->cgroup_count = 0;
1022 for (i = 0; i < count; ++i) {
1023 char *cgroup = consumestr(&serialized, &length);
1024 if (!cgroup)
1025 goto bad_cgroups;
1026 j->cgroups[i] = strdup(cgroup);
1027 if (!j->cgroups[i])
1028 goto bad_cgroups;
1029 ++j->cgroup_count;
1030 }
1031
Elly Jonese1749eb2011-10-07 13:54:59 -04001032 return 0;
Will Drewrybee7ba72011-10-21 20:47:01 -05001033
Dylan Reid605ce7f2016-01-19 19:21:00 -08001034bad_cgroups:
1035 while (j->mounts_head) {
1036 struct mountpoint *m = j->mounts_head;
1037 j->mounts_head = j->mounts_head->next;
Dylan Reid81e23972016-05-18 14:06:35 -07001038 free(m->data);
Dylan Reid605ce7f2016-01-19 19:21:00 -08001039 free(m->type);
1040 free(m->dest);
1041 free(m->src);
1042 free(m);
1043 }
1044 for (i = 0; i < j->cgroup_count; ++i)
1045 free(j->cgroups[i]);
Dylan Reid648b2202015-10-23 00:50:00 -07001046bad_mounts:
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -08001047 if (j->flags.seccomp_filter && j->filter_len > 0) {
1048 free(j->filter_prog->filter);
1049 free(j->filter_prog);
1050 }
Jorge Lucangeli Obesde02a5b2015-12-11 15:28:52 -08001051bad_filter_prog_instrs:
1052 if (j->filter_prog)
1053 free(j->filter_prog);
Will Drewrybee7ba72011-10-21 20:47:01 -05001054bad_filters:
Andrew Brestickereac28942015-11-11 16:04:46 -08001055 if (j->alt_syscall_table)
1056 free(j->alt_syscall_table);
1057bad_syscall_table:
Will Drewrybee7ba72011-10-21 20:47:01 -05001058 if (j->chrootdir)
1059 free(j->chrootdir);
1060bad_chrootdir:
Jorge Lucangeli Obesde02a5b2015-12-11 15:28:52 -08001061 if (j->suppl_gid_list)
1062 free(j->suppl_gid_list);
1063bad_gid_list:
Will Drewrybee7ba72011-10-21 20:47:01 -05001064 if (j->user)
1065 free(j->user);
1066clear_pointers:
1067 j->user = NULL;
Jorge Lucangeli Obesde02a5b2015-12-11 15:28:52 -08001068 j->suppl_gid_list = NULL;
Will Drewrybee7ba72011-10-21 20:47:01 -05001069 j->chrootdir = NULL;
Andrew Brestickereac28942015-11-11 16:04:46 -08001070 j->alt_syscall_table = NULL;
Dylan Reid605ce7f2016-01-19 19:21:00 -08001071 j->cgroup_count = 0;
Will Drewrybee7ba72011-10-21 20:47:01 -05001072out:
1073 return ret;
Will Drewry2ddaad02011-09-16 11:36:08 -05001074}
1075
Jorge Lucangeli Obesd0a6e2f2015-11-24 14:21:21 -08001076/*
Jorge Lucangeli Obes7b2e29c2016-08-04 12:21:03 -04001077 * setup_mount_destination: Ensures the mount target exists.
1078 * Creates it if needed and possible.
Dylan Reideec77962016-06-30 19:35:10 -07001079 */
Jorge Lucangeli Obesf205fff2016-08-06 09:06:21 -04001080static int setup_mount_destination(const char *source, const char *dest,
1081 uid_t uid, uid_t gid)
Dylan Reideec77962016-06-30 19:35:10 -07001082{
1083 int rc;
1084 struct stat st_buf;
1085
1086 rc = stat(dest, &st_buf);
1087 if (rc == 0) /* destination exists */
1088 return 0;
1089
1090 /*
1091 * Try to create the destination.
1092 * Either make a directory or touch a file depending on the source type.
1093 * If the source doesn't exist, assume it is a filesystem type such as
1094 * "tmpfs" and create a directory to mount it on.
1095 */
1096 rc = stat(source, &st_buf);
1097 if (rc || S_ISDIR(st_buf.st_mode) || S_ISBLK(st_buf.st_mode)) {
1098 if (mkdir(dest, 0700))
1099 return -errno;
1100 } else {
1101 int fd = open(dest, O_RDWR | O_CREAT, 0700);
1102 if (fd < 0)
1103 return -errno;
1104 close(fd);
1105 }
1106 return chown(dest, uid, gid);
1107}
1108
1109/*
Jorge Lucangeli Obesd0a6e2f2015-11-24 14:21:21 -08001110 * mount_one: Applies mounts from @m for @j, recursing as needed.
Dylan Reid648b2202015-10-23 00:50:00 -07001111 * @j Minijail these mounts are for
1112 * @m Head of list of mounts
Elly Jones51a5b6c2011-10-12 19:09:26 -04001113 *
1114 * Returns 0 for success.
1115 */
Dylan Reid648b2202015-10-23 00:50:00 -07001116static int mount_one(const struct minijail *j, struct mountpoint *m)
Jorge Lucangeli Obesc8b21e12014-06-13 14:26:16 -07001117{
Dylan Reid648b2202015-10-23 00:50:00 -07001118 int ret;
1119 char *dest;
1120 int remount_ro = 0;
1121
Jorge Lucangeli Obes2b12ba42016-01-26 10:37:51 -08001122 /* |dest| has a leading "/". */
Dylan Reid648b2202015-10-23 00:50:00 -07001123 if (asprintf(&dest, "%s%s", j->chrootdir, m->dest) < 0)
Elly Jones51a5b6c2011-10-12 19:09:26 -04001124 return -ENOMEM;
Dylan Reid648b2202015-10-23 00:50:00 -07001125
Dylan Reideec77962016-06-30 19:35:10 -07001126 if (setup_mount_destination(m->src, dest, j->uid, j->gid))
1127 pdie("creating mount target '%s' failed", dest);
1128
Dylan Reid648b2202015-10-23 00:50:00 -07001129 /*
Jorge Lucangeli Obes2b12ba42016-01-26 10:37:51 -08001130 * R/O bind mounts have to be remounted since 'bind' and 'ro'
1131 * can't both be specified in the original bind mount.
1132 * Remount R/O after the initial mount.
Dylan Reid648b2202015-10-23 00:50:00 -07001133 */
1134 if ((m->flags & MS_BIND) && (m->flags & MS_RDONLY)) {
1135 remount_ro = 1;
1136 m->flags &= ~MS_RDONLY;
Elly Jonesa1059632011-12-15 15:17:07 -05001137 }
Dylan Reid648b2202015-10-23 00:50:00 -07001138
Dylan Reid81e23972016-05-18 14:06:35 -07001139 ret = mount(m->src, dest, m->type, m->flags, m->data);
Dylan Reid648b2202015-10-23 00:50:00 -07001140 if (ret)
1141 pdie("mount: %s -> %s", m->src, dest);
1142
1143 if (remount_ro) {
1144 m->flags |= MS_RDONLY;
1145 ret = mount(m->src, dest, NULL,
Dylan Reid81e23972016-05-18 14:06:35 -07001146 m->flags | MS_REMOUNT, m->data);
Dylan Reid648b2202015-10-23 00:50:00 -07001147 if (ret)
1148 pdie("bind ro: %s -> %s", m->src, dest);
1149 }
1150
Elly Jones51a5b6c2011-10-12 19:09:26 -04001151 free(dest);
Dylan Reid648b2202015-10-23 00:50:00 -07001152 if (m->next)
1153 return mount_one(j, m->next);
Elly Jones51a5b6c2011-10-12 19:09:26 -04001154 return ret;
1155}
1156
Jorge Lucangeli Obesf205fff2016-08-06 09:06:21 -04001157static int enter_chroot(const struct minijail *j)
Jorge Lucangeli Obesc8b21e12014-06-13 14:26:16 -07001158{
Elly Jones51a5b6c2011-10-12 19:09:26 -04001159 int ret;
Dylan Reid648b2202015-10-23 00:50:00 -07001160
1161 if (j->mounts_head && (ret = mount_one(j, j->mounts_head)))
Elly Jones51a5b6c2011-10-12 19:09:26 -04001162 return ret;
1163
1164 if (chroot(j->chrootdir))
1165 return -errno;
1166
1167 if (chdir("/"))
1168 return -errno;
1169
1170 return 0;
1171}
1172
Jorge Lucangeli Obesf205fff2016-08-06 09:06:21 -04001173static int enter_pivot_root(const struct minijail *j)
Yu-Hsi Chiang64d65a72015-08-13 17:43:27 +08001174{
Yu-Hsi Chiange0a530e2015-09-08 18:49:49 +08001175 int ret, oldroot, newroot;
Dylan Reid648b2202015-10-23 00:50:00 -07001176
1177 if (j->mounts_head && (ret = mount_one(j, j->mounts_head)))
Yu-Hsi Chiang64d65a72015-08-13 17:43:27 +08001178 return ret;
1179
Jorge Lucangeli Obes43a6a862015-12-04 14:53:36 -08001180 /*
1181 * Keep the fd for both old and new root.
Jorge Lucangeli Obes6b0de9b2016-03-16 22:41:34 -07001182 * It will be used in fchdir(2) later.
Jorge Lucangeli Obes43a6a862015-12-04 14:53:36 -08001183 */
Ricky Zhoubce609d2016-03-02 21:47:56 -08001184 oldroot = open("/", O_DIRECTORY | O_RDONLY | O_CLOEXEC);
Yu-Hsi Chiange0a530e2015-09-08 18:49:49 +08001185 if (oldroot < 0)
1186 pdie("failed to open / for fchdir");
Ricky Zhoubce609d2016-03-02 21:47:56 -08001187 newroot = open(j->chrootdir, O_DIRECTORY | O_RDONLY | O_CLOEXEC);
Yu-Hsi Chiange0a530e2015-09-08 18:49:49 +08001188 if (newroot < 0)
1189 pdie("failed to open %s for fchdir", j->chrootdir);
1190
Jorge Lucangeli Obes43a6a862015-12-04 14:53:36 -08001191 /*
Jorge Lucangeli Obes6b0de9b2016-03-16 22:41:34 -07001192 * To ensure j->chrootdir is the root of a filesystem,
Jorge Lucangeli Obes43a6a862015-12-04 14:53:36 -08001193 * do a self bind mount.
1194 */
Yu-Hsi Chiang64d65a72015-08-13 17:43:27 +08001195 if (mount(j->chrootdir, j->chrootdir, "bind", MS_BIND | MS_REC, ""))
1196 pdie("failed to bind mount '%s'", j->chrootdir);
1197 if (chdir(j->chrootdir))
1198 return -errno;
Yu-Hsi Chiange0a530e2015-09-08 18:49:49 +08001199 if (syscall(SYS_pivot_root, ".", "."))
Yu-Hsi Chiang64d65a72015-08-13 17:43:27 +08001200 pdie("pivot_root");
Yu-Hsi Chiange0a530e2015-09-08 18:49:49 +08001201
1202 /*
Jorge Lucangeli Obes6b0de9b2016-03-16 22:41:34 -07001203 * Now the old root is mounted on top of the new root. Use fchdir(2) to
Yu-Hsi Chiange0a530e2015-09-08 18:49:49 +08001204 * change to the old root and unmount it.
1205 */
1206 if (fchdir(oldroot))
1207 pdie("failed to fchdir to old /");
Hidehiko Abe097b7192016-03-16 18:00:36 +09001208
1209 /*
Jorge Lucangeli Obesdf7fab12016-06-01 17:15:31 -07001210 * If j->flags.skip_remount_private was enabled for minijail_enter(),
1211 * there could be a shared mount point under |oldroot|. In that case,
1212 * mounts under this shared mount point will be unmounted below, and
1213 * this unmounting will propagate to the original mount namespace
1214 * (because the mount point is shared). To prevent this unexpected
1215 * unmounting, remove these mounts from their peer groups by recursively
1216 * remounting them as MS_PRIVATE.
Hidehiko Abe097b7192016-03-16 18:00:36 +09001217 */
1218 if (mount(NULL, ".", NULL, MS_REC | MS_PRIVATE, NULL))
Jorge Lucangeli Obes6b0de9b2016-03-16 22:41:34 -07001219 pdie("failed to mount(/, private) before umount(/)");
Yu-Hsi Chiang64d65a72015-08-13 17:43:27 +08001220 /* The old root might be busy, so use lazy unmount. */
Yu-Hsi Chiange0a530e2015-09-08 18:49:49 +08001221 if (umount2(".", MNT_DETACH))
1222 pdie("umount(/)");
1223 /* Change back to the new root. */
1224 if (fchdir(newroot))
Yu-Hsi Chiang64d65a72015-08-13 17:43:27 +08001225 return -errno;
Ricky Zhoubce609d2016-03-02 21:47:56 -08001226 if (close(oldroot))
1227 return -errno;
1228 if (close(newroot))
1229 return -errno;
Yu-Hsi Chiang64d65a72015-08-13 17:43:27 +08001230 if (chroot("/"))
1231 return -errno;
Jorge Lucangeli Obes46a55092015-10-12 15:31:59 -07001232 /* Set correct CWD for getcwd(3). */
1233 if (chdir("/"))
1234 return -errno;
Yu-Hsi Chiang64d65a72015-08-13 17:43:27 +08001235
1236 return 0;
1237}
1238
Jorge Lucangeli Obesf205fff2016-08-06 09:06:21 -04001239static int mount_tmp(void)
Lee Campbell11af0622014-05-22 12:36:04 -07001240{
Mike Frysingerb91d4042017-01-13 19:03:34 -05001241 return mount("none", "/tmp", "tmpfs", MS_NODEV | MS_NOEXEC | MS_NOSUID,
1242 "size=64M,mode=1777");
Lee Campbell11af0622014-05-22 12:36:04 -07001243}
1244
Jorge Lucangeli Obesf205fff2016-08-06 09:06:21 -04001245static int remount_proc_readonly(const struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -04001246{
1247 const char *kProcPath = "/proc";
1248 const unsigned int kSafeFlags = MS_NODEV | MS_NOEXEC | MS_NOSUID;
Elly Jonesdd3e8512012-01-23 15:13:38 -05001249 /*
1250 * Right now, we're holding a reference to our parent's old mount of
Elly Jonese1749eb2011-10-07 13:54:59 -04001251 * /proc in our namespace, which means using MS_REMOUNT here would
1252 * mutate our parent's mount as well, even though we're in a VFS
Jorge Lucangeli Obesdf7fab12016-06-01 17:15:31 -07001253 * namespace (!). Instead, remove their mount from our namespace lazily
1254 * (MNT_DETACH) and make our own.
Elly Jonese1749eb2011-10-07 13:54:59 -04001255 */
Jorge Lucangeli Obesdf7fab12016-06-01 17:15:31 -07001256 if (umount2(kProcPath, MNT_DETACH)) {
1257 /*
1258 * If we are in a new user namespace, umount(2) will fail.
1259 * See http://man7.org/linux/man-pages/man7/user_namespaces.7.html
1260 */
1261 if (j->flags.userns) {
1262 info("umount(/proc, MNT_DETACH) failed, "
1263 "this is expected when using user namespaces");
1264 } else {
1265 return -errno;
1266 }
1267 }
Mike Frysinger3ba81572017-01-17 23:33:28 -05001268 if (mount("proc", kProcPath, "proc", kSafeFlags | MS_RDONLY, ""))
Elly Jonese1749eb2011-10-07 13:54:59 -04001269 return -errno;
1270 return 0;
Elly Jonescd7a9042011-07-22 13:56:51 -04001271}
1272
Jorge Lucangeli Obesf205fff2016-08-06 09:06:21 -04001273static void kill_child_and_die(const struct minijail *j, const char *msg)
Yu-Hsi Chiang3cc05ea2015-08-11 11:23:17 +08001274{
Jorge Lucangeli Obesf205fff2016-08-06 09:06:21 -04001275 kill(j->initpid, SIGKILL);
1276 die("%s", msg);
Dylan Reid605ce7f2016-01-19 19:21:00 -08001277}
1278
Jorge Lucangeli Obesf205fff2016-08-06 09:06:21 -04001279static void write_pid_file_or_die(const struct minijail *j)
Dylan Reid605ce7f2016-01-19 19:21:00 -08001280{
Keshav Santhanamdb6dab42016-08-10 16:33:34 -07001281 if (write_pid_to_path(j->initpid, j->pid_file_path))
Jorge Lucangeli Obesf205fff2016-08-06 09:06:21 -04001282 kill_child_and_die(j, "failed to write pid file");
Dylan Reid605ce7f2016-01-19 19:21:00 -08001283}
1284
Jorge Lucangeli Obesf205fff2016-08-06 09:06:21 -04001285static void add_to_cgroups_or_die(const struct minijail *j)
Dylan Reid605ce7f2016-01-19 19:21:00 -08001286{
1287 size_t i;
1288
Jorge Lucangeli Obesf205fff2016-08-06 09:06:21 -04001289 for (i = 0; i < j->cgroup_count; ++i) {
Keshav Santhanamdb6dab42016-08-10 16:33:34 -07001290 if (write_pid_to_path(j->initpid, j->cgroups[i]))
Jorge Lucangeli Obesf205fff2016-08-06 09:06:21 -04001291 kill_child_and_die(j, "failed to add to cgroups");
1292 }
Yu-Hsi Chiang3cc05ea2015-08-11 11:23:17 +08001293}
1294
Jorge Lucangeli Obesf205fff2016-08-06 09:06:21 -04001295static void write_ugid_maps_or_die(const struct minijail *j)
1296{
1297 if (j->uidmap && write_proc_file(j->initpid, j->uidmap, "uid_map") != 0)
1298 kill_child_and_die(j, "failed to write uid_map");
Mike Frysinger6b190c02017-01-04 17:18:42 -05001299 if (j->gidmap && j->flags.disable_setgroups) {
1300 /* Older kernels might not have the /proc/<pid>/setgroups files. */
1301 int ret = write_proc_file(j->initpid, "deny", "setgroups");
Mike Frysingereea841b2017-01-13 18:11:57 -05001302 if (ret != 0) {
Mike Frysinger6b190c02017-01-04 17:18:42 -05001303 if (ret == -ENOENT) {
1304 /* See http://man7.org/linux/man-pages/man7/user_namespaces.7.html. */
1305 warn("could not disable setgroups(2)");
1306 } else
1307 kill_child_and_die(j, "failed to disable setgroups(2)");
1308 }
1309 }
Jorge Lucangeli Obesf205fff2016-08-06 09:06:21 -04001310 if (j->gidmap && write_proc_file(j->initpid, j->gidmap, "gid_map") != 0)
1311 kill_child_and_die(j, "failed to write gid_map");
1312}
1313
1314static void enter_user_namespace(const struct minijail *j)
1315{
1316 if (j->uidmap && setresuid(0, 0, 0))
1317 pdie("user_namespaces: setresuid(0, 0, 0) failed");
1318 if (j->gidmap && setresgid(0, 0, 0))
1319 pdie("user_namespaces: setresgid(0, 0, 0) failed");
1320}
1321
1322static void parent_setup_complete(int *pipe_fds)
1323{
1324 close(pipe_fds[0]);
1325 close(pipe_fds[1]);
1326}
1327
1328/*
1329 * wait_for_parent_setup: Called by the child process to wait for any
1330 * further parent-side setup to complete before continuing.
1331 */
1332static void wait_for_parent_setup(int *pipe_fds)
1333{
1334 char buf;
1335
1336 close(pipe_fds[1]);
1337
1338 /* Wait for parent to complete setup and close the pipe. */
1339 if (read(pipe_fds[0], &buf, 1) != 0)
1340 die("failed to sync with parent");
1341 close(pipe_fds[0]);
1342}
1343
1344static void drop_ugid(const struct minijail *j)
Jorge Lucangeli Obes6201cf52012-08-23 11:42:27 -07001345{
Lutz Justen13807cb2017-01-03 17:11:55 +01001346 if (j->flags.inherit_suppl_gids + j->flags.keep_suppl_gids +
1347 j->flags.set_suppl_gids > 1) {
Jorge Lucangeli Obes34543192017-01-11 16:07:57 -05001348 die("can only do one of inherit, keep, or set supplementary "
1349 "groups");
Jorge Lucangeli Obesd16ac492015-12-03 14:44:35 -08001350 }
1351
Lutz Justen13807cb2017-01-03 17:11:55 +01001352 if (j->flags.inherit_suppl_gids) {
Jorge Lucangeli Obes6201cf52012-08-23 11:42:27 -07001353 if (initgroups(j->user, j->usergid))
Jorge Lucangeli Obes457a5e32016-11-23 15:18:56 -05001354 pdie("initgroups(%s, %d) failed", j->user, j->usergid);
Lutz Justen13807cb2017-01-03 17:11:55 +01001355 } else if (j->flags.set_suppl_gids) {
1356 if (setgroups(j->suppl_gid_count, j->suppl_gid_list))
Jorge Lucangeli Obes457a5e32016-11-23 15:18:56 -05001357 pdie("setgroups(suppl_gids) failed");
Lutz Justen13807cb2017-01-03 17:11:55 +01001358 } else if (!j->flags.keep_suppl_gids) {
Jorge Lucangeli Obesd0a6e2f2015-11-24 14:21:21 -08001359 /*
Jorge Lucangeli Obesd16ac492015-12-03 14:44:35 -08001360 * Only attempt to clear supplementary groups if we are changing
Lutz Justen13807cb2017-01-03 17:11:55 +01001361 * users or groups.
Jorge Lucangeli Obesd0a6e2f2015-11-24 14:21:21 -08001362 */
Jorge Lucangeli Obes24499562016-12-01 11:59:27 -05001363 if ((j->flags.uid || j->flags.gid) && setgroups(0, NULL))
Jorge Lucangeli Obes457a5e32016-11-23 15:18:56 -05001364 pdie("setgroups(0, NULL) failed");
Jorge Lucangeli Obes6201cf52012-08-23 11:42:27 -07001365 }
1366
1367 if (j->flags.gid && setresgid(j->gid, j->gid, j->gid))
Jorge Lucangeli Obes457a5e32016-11-23 15:18:56 -05001368 pdie("setresgid(%d, %d, %d) failed", j->gid, j->gid, j->gid);
Jorge Lucangeli Obes6201cf52012-08-23 11:42:27 -07001369
1370 if (j->flags.uid && setresuid(j->uid, j->uid, j->uid))
Jorge Lucangeli Obes457a5e32016-11-23 15:18:56 -05001371 pdie("setresuid(%d, %d, %d) failed", j->uid, j->uid, j->uid);
Jorge Lucangeli Obes6201cf52012-08-23 11:42:27 -07001372}
1373
Mike Frysinger3adfef72013-05-09 17:19:08 -04001374/*
1375 * We specifically do not use cap_valid() as that only tells us the last
1376 * valid cap we were *compiled* against (i.e. what the version of kernel
Jorge Lucangeli Obes4b276a62016-01-07 14:31:33 -08001377 * headers says). If we run on a different kernel version, then it's not
Mike Frysinger3adfef72013-05-09 17:19:08 -04001378 * uncommon for that to be less (if an older kernel) or more (if a newer
Jorge Lucangeli Obes4b276a62016-01-07 14:31:33 -08001379 * kernel).
1380 * Normally, we suck up the answer via /proc. On Android, not all processes are
1381 * guaranteed to be able to access '/proc/sys/kernel/cap_last_cap' so we
1382 * programmatically find the value by calling prctl(PR_CAPBSET_READ).
Mike Frysinger3adfef72013-05-09 17:19:08 -04001383 */
Jorge Lucangeli Obes20342742015-10-27 11:39:59 -07001384static unsigned int get_last_valid_cap()
Mike Frysinger3adfef72013-05-09 17:19:08 -04001385{
Jorge Lucangeli Obes4b276a62016-01-07 14:31:33 -08001386 unsigned int last_valid_cap = 0;
1387 if (is_android()) {
1388 for (; prctl(PR_CAPBSET_READ, last_valid_cap, 0, 0, 0) >= 0;
1389 ++last_valid_cap);
Mike Frysinger3adfef72013-05-09 17:19:08 -04001390
Jorge Lucangeli Obes4b276a62016-01-07 14:31:33 -08001391 /* |last_valid_cap| will be the first failing value. */
1392 if (last_valid_cap > 0) {
1393 last_valid_cap--;
1394 }
1395 } else {
1396 const char cap_file[] = "/proc/sys/kernel/cap_last_cap";
1397 FILE *fp = fopen(cap_file, "re");
1398 if (fscanf(fp, "%u", &last_valid_cap) != 1)
1399 pdie("fscanf(%s)", cap_file);
1400 fclose(fp);
1401 }
Dylan Reidf682d472015-09-17 21:39:07 -07001402 return last_valid_cap;
Mike Frysinger3adfef72013-05-09 17:19:08 -04001403}
1404
Jorge Lucangeli Obesf9fcdbe2016-02-19 15:04:09 -08001405static void drop_capbset(uint64_t keep_mask, unsigned int last_valid_cap)
1406{
1407 const uint64_t one = 1;
1408 unsigned int i;
1409 for (i = 0; i < sizeof(keep_mask) * 8 && i <= last_valid_cap; ++i) {
1410 if (keep_mask & (one << i))
1411 continue;
1412 if (prctl(PR_CAPBSET_DROP, i))
1413 pdie("could not drop capability from bounding set");
1414 }
1415}
1416
Jorge Lucangeli Obesf205fff2016-08-06 09:06:21 -04001417static void drop_caps(const struct minijail *j, unsigned int last_valid_cap)
Elly Jonese1749eb2011-10-07 13:54:59 -04001418{
Jorge Lucangeli Obes7ea269e2016-02-26 22:07:09 -08001419 if (!j->flags.use_caps)
1420 return;
1421
Elly Jonese1749eb2011-10-07 13:54:59 -04001422 cap_t caps = cap_get_proc();
Kees Cook323878a2013-02-05 15:35:24 -08001423 cap_value_t flag[1];
Kees Cooke5609ac2013-02-06 14:12:41 -08001424 const uint64_t one = 1;
Elly Jonese1749eb2011-10-07 13:54:59 -04001425 unsigned int i;
1426 if (!caps)
1427 die("can't get process caps");
1428 if (cap_clear_flag(caps, CAP_INHERITABLE))
1429 die("can't clear inheritable caps");
1430 if (cap_clear_flag(caps, CAP_EFFECTIVE))
1431 die("can't clear effective caps");
1432 if (cap_clear_flag(caps, CAP_PERMITTED))
1433 die("can't clear permitted caps");
Dylan Reidf682d472015-09-17 21:39:07 -07001434 for (i = 0; i < sizeof(j->caps) * 8 && i <= last_valid_cap; ++i) {
Kees Cook323878a2013-02-05 15:35:24 -08001435 /* Keep CAP_SETPCAP for dropping bounding set bits. */
Kees Cooke5609ac2013-02-06 14:12:41 -08001436 if (i != CAP_SETPCAP && !(j->caps & (one << i)))
Elly Jonese1749eb2011-10-07 13:54:59 -04001437 continue;
Kees Cook323878a2013-02-05 15:35:24 -08001438 flag[0] = i;
1439 if (cap_set_flag(caps, CAP_EFFECTIVE, 1, flag, CAP_SET))
Elly Jonese1749eb2011-10-07 13:54:59 -04001440 die("can't add effective cap");
Kees Cook323878a2013-02-05 15:35:24 -08001441 if (cap_set_flag(caps, CAP_PERMITTED, 1, flag, CAP_SET))
Elly Jonese1749eb2011-10-07 13:54:59 -04001442 die("can't add permitted cap");
Kees Cook323878a2013-02-05 15:35:24 -08001443 if (cap_set_flag(caps, CAP_INHERITABLE, 1, flag, CAP_SET))
Elly Jonese1749eb2011-10-07 13:54:59 -04001444 die("can't add inheritable cap");
1445 }
1446 if (cap_set_proc(caps))
Kees Cook323878a2013-02-05 15:35:24 -08001447 die("can't apply initial cleaned capset");
1448
1449 /*
1450 * Instead of dropping bounding set first, do it here in case
1451 * the caller had a more permissive bounding set which could
1452 * have been used above to raise a capability that wasn't already
1453 * present. This requires CAP_SETPCAP, so we raised/kept it above.
1454 */
Jorge Lucangeli Obesf9fcdbe2016-02-19 15:04:09 -08001455 drop_capbset(j->caps, last_valid_cap);
Kees Cook323878a2013-02-05 15:35:24 -08001456
1457 /* If CAP_SETPCAP wasn't specifically requested, now we remove it. */
Kees Cooke5609ac2013-02-06 14:12:41 -08001458 if ((j->caps & (one << CAP_SETPCAP)) == 0) {
Kees Cook323878a2013-02-05 15:35:24 -08001459 flag[0] = CAP_SETPCAP;
1460 if (cap_set_flag(caps, CAP_EFFECTIVE, 1, flag, CAP_CLEAR))
1461 die("can't clear effective cap");
1462 if (cap_set_flag(caps, CAP_PERMITTED, 1, flag, CAP_CLEAR))
1463 die("can't clear permitted cap");
1464 if (cap_set_flag(caps, CAP_INHERITABLE, 1, flag, CAP_CLEAR))
1465 die("can't clear inheritable cap");
1466 }
1467
1468 if (cap_set_proc(caps))
1469 die("can't apply final cleaned capset");
1470
1471 cap_free(caps);
Elly Jonescd7a9042011-07-22 13:56:51 -04001472}
1473
Jorge Lucangeli Obesf205fff2016-08-06 09:06:21 -04001474static void set_seccomp_filter(const struct minijail *j)
Jorge Lucangeli Obes6201cf52012-08-23 11:42:27 -07001475{
1476 /*
1477 * Set no_new_privs. See </kernel/seccomp.c> and </kernel/sys.c>
1478 * in the kernel source tree for an explanation of the parameters.
1479 */
1480 if (j->flags.no_new_privs) {
1481 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0))
1482 pdie("prctl(PR_SET_NO_NEW_PRIVS)");
1483 }
1484
1485 /*
Jorge Lucangeli Obes2413f372016-04-06 18:43:10 -07001486 * Code running with ASan
1487 * (https://github.com/google/sanitizers/wiki/AddressSanitizer)
1488 * will make system calls not included in the syscall filter policy,
1489 * which will likely crash the program. Skip setting seccomp filter in
1490 * that case.
1491 * 'running_with_asan()' has no inputs and is completely defined at
1492 * build time, so this cannot be used by an attacker to skip setting
1493 * seccomp filter.
1494 */
1495 if (j->flags.seccomp_filter && running_with_asan()) {
1496 warn("running with ASan, not setting seccomp filter");
1497 return;
1498 }
1499
Jorge Lucangeli Obes713f6fb2016-10-03 13:03:25 -04001500 if (j->flags.seccomp_filter) {
1501 if (j->flags.seccomp_filter_logging) {
1502 /*
1503 * If logging seccomp filter failures,
1504 * install the SIGSYS handler first.
1505 */
1506 if (install_sigsys_handler())
1507 pdie("failed to install SIGSYS handler");
1508 warn("logging seccomp filter failures");
1509 } else if (j->flags.seccomp_filter_tsync) {
1510 /*
1511 * If setting thread sync,
1512 * reset the SIGSYS signal handler so that
1513 * the entire thread group is killed.
1514 */
1515 if (signal(SIGSYS, SIG_DFL) == SIG_ERR)
1516 pdie("failed to reset SIGSYS disposition");
1517 info("reset SIGSYS disposition");
1518 }
Jorge Lucangeli Obes6201cf52012-08-23 11:42:27 -07001519 }
1520
1521 /*
1522 * Install the syscall filter.
1523 */
1524 if (j->flags.seccomp_filter) {
Jorge Lucangeli Obes13650612016-09-02 11:27:29 -04001525 if (j->flags.seccomp_filter_tsync) {
1526 if (sys_seccomp(SECCOMP_SET_MODE_FILTER,
1527 SECCOMP_FILTER_FLAG_TSYNC,
1528 j->filter_prog)) {
1529 pdie("seccomp(tsync) failed");
Utkarsh Sanghi0ef8a662014-08-18 15:50:11 -07001530 }
Jorge Lucangeli Obes13650612016-09-02 11:27:29 -04001531 } else {
1532 if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER,
1533 j->filter_prog)) {
1534 pdie("prctl(seccomp_filter) failed");
1535 }
Utkarsh Sanghi0ef8a662014-08-18 15:50:11 -07001536 }
Jorge Lucangeli Obes6201cf52012-08-23 11:42:27 -07001537 }
1538}
1539
Jorge Lucangeli Obes457a5e32016-11-23 15:18:56 -05001540static void config_net_loopback(void)
Mike Frysinger7559dfe2016-11-15 18:58:39 -05001541{
1542 static const char ifname[] = "lo";
1543 int sock;
1544 struct ifreq ifr;
1545
1546 /* Make sure people don't try to add really long names. */
1547 _Static_assert(sizeof(ifname) <= IFNAMSIZ, "interface name too long");
1548
1549 sock = socket(AF_LOCAL, SOCK_DGRAM|SOCK_CLOEXEC, 0);
1550 if (sock < 0)
1551 pdie("socket(AF_LOCAL) failed");
1552
1553 /*
1554 * Do the equiv of `ip link set up lo`. The kernel will assign
1555 * IPv4 (127.0.0.1) & IPv6 (::1) addresses automatically!
1556 */
1557 strcpy(ifr.ifr_name, ifname);
1558 if (ioctl(sock, SIOCGIFFLAGS, &ifr) < 0)
1559 pdie("ioctl(SIOCGIFFLAGS) failed");
1560
1561 /* The kernel preserves ifr.ifr_name for use. */
1562 ifr.ifr_flags |= IFF_UP | IFF_RUNNING;
1563 if (ioctl(sock, SIOCSIFFLAGS, &ifr) < 0)
1564 pdie("ioctl(SIOCSIFFLAGS) failed");
1565
1566 close(sock);
1567}
1568
Will Drewry6ac91122011-10-21 16:38:58 -05001569void API minijail_enter(const struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -04001570{
Dylan Reidf682d472015-09-17 21:39:07 -07001571 /*
Jorge Lucangeli Obes43e29b32015-12-08 21:07:14 -08001572 * If we're dropping caps, get the last valid cap from /proc now,
1573 * since /proc can be unmounted before drop_caps() is called.
Dylan Reidf682d472015-09-17 21:39:07 -07001574 */
Jorge Lucangeli Obes43e29b32015-12-08 21:07:14 -08001575 unsigned int last_valid_cap = 0;
Jorge Lucangeli Obesf9fcdbe2016-02-19 15:04:09 -08001576 if (j->flags.capbset_drop || j->flags.use_caps)
Jorge Lucangeli Obes43e29b32015-12-08 21:07:14 -08001577 last_valid_cap = get_last_valid_cap();
Dylan Reidf682d472015-09-17 21:39:07 -07001578
Elly Jonese1749eb2011-10-07 13:54:59 -04001579 if (j->flags.pids)
1580 die("tried to enter a pid-namespaced jail;"
Jorge Lucangeli Obes1563b5b2014-07-10 07:01:53 -07001581 " try minijail_run()?");
Elly Jonescd7a9042011-07-22 13:56:51 -04001582
Lutz Justen13807cb2017-01-03 17:11:55 +01001583 if (j->flags.inherit_suppl_gids && !j->user)
Jorge Lucangeli Obes34543192017-01-11 16:07:57 -05001584 die("cannot inherit supplementary groups without setting a "
1585 "username");
Elly Jonescd7a9042011-07-22 13:56:51 -04001586
Elly Jonesdd3e8512012-01-23 15:13:38 -05001587 /*
1588 * We can't recover from failures if we've dropped privileges partially,
Elly Jonese1749eb2011-10-07 13:54:59 -04001589 * so we don't even try. If any of our operations fail, we abort() the
1590 * entire process.
1591 */
Jorge Lucangeli Obes1563b5b2014-07-10 07:01:53 -07001592 if (j->flags.enter_vfs && setns(j->mountns_fd, CLONE_NEWNS))
Jorge Lucangeli Obes457a5e32016-11-23 15:18:56 -05001593 pdie("setns(CLONE_NEWNS) failed");
Jorge Lucangeli Obes1563b5b2014-07-10 07:01:53 -07001594
Jorge Lucangeli Obes805be392015-10-12 15:55:59 -07001595 if (j->flags.vfs) {
Jorge Lucangeli Obesf7a38682015-12-04 15:43:30 -08001596 if (unshare(CLONE_NEWNS))
Jorge Lucangeli Obes457a5e32016-11-23 15:18:56 -05001597 pdie("unshare(CLONE_NEWNS) failed");
Jorge Lucangeli Obesf7a38682015-12-04 15:43:30 -08001598 /*
Jorge Lucangeli Obesa521bee2016-03-03 13:47:57 -08001599 * Unless asked not to, remount all filesystems as private.
1600 * If they are shared, new bind mounts will creep out of our
1601 * namespace.
Jorge Lucangeli Obesf7a38682015-12-04 15:43:30 -08001602 * https://www.kernel.org/doc/Documentation/filesystems/sharedsubtree.txt
1603 */
Jorge Lucangeli Obesa521bee2016-03-03 13:47:57 -08001604 if (!j->flags.skip_remount_private) {
1605 if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL))
Jorge Lucangeli Obes457a5e32016-11-23 15:18:56 -05001606 pdie("mount(NULL, /, NULL, MS_REC | MS_PRIVATE,"
1607 " NULL) failed");
Jorge Lucangeli Obesa521bee2016-03-03 13:47:57 -08001608 }
Jorge Lucangeli Obesf7a38682015-12-04 15:43:30 -08001609 }
Elly Fong-Jones6c086302013-03-20 17:15:28 -04001610
Dylan Reidf7942472015-11-18 17:55:26 -08001611 if (j->flags.ipc && unshare(CLONE_NEWIPC)) {
Jorge Lucangeli Obes457a5e32016-11-23 15:18:56 -05001612 pdie("unshare(CLONE_NEWIPC) failed");
Dylan Reidf7942472015-11-18 17:55:26 -08001613 }
1614
Dylan Reid1102f5a2015-09-15 11:52:20 -07001615 if (j->flags.enter_net) {
1616 if (setns(j->netns_fd, CLONE_NEWNET))
Jorge Lucangeli Obes457a5e32016-11-23 15:18:56 -05001617 pdie("setns(CLONE_NEWNET) failed");
Mike Frysinger7559dfe2016-11-15 18:58:39 -05001618 } else if (j->flags.net) {
1619 if (unshare(CLONE_NEWNET))
Jorge Lucangeli Obes457a5e32016-11-23 15:18:56 -05001620 pdie("unshare(CLONE_NEWNET) failed");
1621 config_net_loopback();
Dylan Reid1102f5a2015-09-15 11:52:20 -07001622 }
Elly Jonescd7a9042011-07-22 13:56:51 -04001623
Dylan Reid4cbc2a52016-06-17 19:06:07 -07001624 if (j->flags.ns_cgroups && unshare(CLONE_NEWCGROUP))
Jorge Lucangeli Obes457a5e32016-11-23 15:18:56 -05001625 pdie("unshare(CLONE_NEWCGROUP) failed");
Dylan Reid4cbc2a52016-06-17 19:06:07 -07001626
Elly Jones51a5b6c2011-10-12 19:09:26 -04001627 if (j->flags.chroot && enter_chroot(j))
1628 pdie("chroot");
1629
Yu-Hsi Chiang64d65a72015-08-13 17:43:27 +08001630 if (j->flags.pivot_root && enter_pivot_root(j))
1631 pdie("pivot_root");
1632
Jorge Lucangeli Obes3901da62015-03-03 13:55:11 -08001633 if (j->flags.mount_tmp && mount_tmp())
Lee Campbell11af0622014-05-22 12:36:04 -07001634 pdie("mount_tmp");
1635
Dylan Reid791f5772015-09-14 20:02:42 -07001636 if (j->flags.remount_proc_ro && remount_proc_readonly(j))
Elly Jonese1749eb2011-10-07 13:54:59 -04001637 pdie("remount");
Elly Jonescd7a9042011-07-22 13:56:51 -04001638
Jorge Lucangeli Obesf9fcdbe2016-02-19 15:04:09 -08001639 /*
1640 * If we're only dropping capabilities from the bounding set, but not
1641 * from the thread's (permitted|inheritable|effective) sets, do it now.
1642 */
1643 if (j->flags.capbset_drop) {
1644 drop_capbset(j->cap_bset, last_valid_cap);
1645 }
1646
1647 if (j->flags.use_caps) {
Elly Jonesdd3e8512012-01-23 15:13:38 -05001648 /*
1649 * POSIX capabilities are a bit tricky. If we drop our
Elly Jonese1749eb2011-10-07 13:54:59 -04001650 * capability to change uids, our attempt to use setuid()
1651 * below will fail. Hang on to root caps across setuid(), then
1652 * lock securebits.
1653 */
1654 if (prctl(PR_SET_KEEPCAPS, 1))
Jorge Lucangeli Obes457a5e32016-11-23 15:18:56 -05001655 pdie("prctl(PR_SET_KEEPCAPS) failed");
Jorge Lucangeli Obesf783b522016-03-14 14:34:10 -07001656
1657 /*
1658 * Kernels 4.3+ define a new securebit
1659 * (SECURE_NO_CAP_AMBIENT_RAISE), so using the SECURE_ALL_BITS
1660 * and SECURE_ALL_LOCKS masks from newer kernel headers will
1661 * return EPERM on older kernels. Detect this, and retry with
1662 * the right mask for older (2.6.26-4.2) kernels.
1663 */
1664 int securebits_ret = prctl(PR_SET_SECUREBITS,
1665 SECURE_ALL_BITS | SECURE_ALL_LOCKS);
1666 if (securebits_ret < 0) {
1667 if (errno == EPERM) {
1668 /* Possibly running on kernel < 4.3. */
1669 securebits_ret = prctl(
1670 PR_SET_SECUREBITS,
1671 OLD_SECURE_ALL_BITS | OLD_SECURE_ALL_LOCKS);
1672 }
1673 }
1674 if (securebits_ret < 0)
Jorge Lucangeli Obes457a5e32016-11-23 15:18:56 -05001675 pdie("prctl(PR_SET_SECUREBITS) failed");
Elly Jonese1749eb2011-10-07 13:54:59 -04001676 }
Elly Jonescd7a9042011-07-22 13:56:51 -04001677
Jorge Lucangeli Obesc2c9bcc2012-05-01 09:30:24 -07001678 if (j->flags.no_new_privs) {
Jorge Lucangeli Obesd8c82052016-02-25 16:00:32 -08001679 /*
1680 * If we're setting no_new_privs, we can drop privileges
1681 * before setting seccomp filter. This way filter policies
1682 * don't need to allow privilege-dropping syscalls.
1683 */
Jorge Lucangeli Obes6201cf52012-08-23 11:42:27 -07001684 drop_ugid(j);
Jorge Lucangeli Obesd8c82052016-02-25 16:00:32 -08001685 drop_caps(j, last_valid_cap);
Jorge Lucangeli Obes6201cf52012-08-23 11:42:27 -07001686 set_seccomp_filter(j);
Elly Jonese1749eb2011-10-07 13:54:59 -04001687 } else {
Jorge Lucangeli Obes6201cf52012-08-23 11:42:27 -07001688 /*
1689 * If we're not setting no_new_privs,
1690 * we need to set seccomp filter *before* dropping privileges.
1691 * WARNING: this means that filter policies *must* allow
1692 * setgroups()/setresgid()/setresuid() for dropping root and
1693 * capget()/capset()/prctl() for dropping caps.
1694 */
1695 set_seccomp_filter(j);
Jorge Lucangeli Obes6201cf52012-08-23 11:42:27 -07001696 drop_ugid(j);
Jorge Lucangeli Obesd8c82052016-02-25 16:00:32 -08001697 drop_caps(j, last_valid_cap);
Elly Jonese1749eb2011-10-07 13:54:59 -04001698 }
Elly Jonescd7a9042011-07-22 13:56:51 -04001699
Elly Jonesdd3e8512012-01-23 15:13:38 -05001700 /*
Andrew Brestickereac28942015-11-11 16:04:46 -08001701 * Select the specified alternate syscall table. The table must not
1702 * block prctl(2) if we're using seccomp as well.
1703 */
1704 if (j->flags.alt_syscall) {
1705 if (prctl(PR_ALT_SYSCALL, 1, j->alt_syscall_table))
Jorge Lucangeli Obes457a5e32016-11-23 15:18:56 -05001706 pdie("prctl(PR_ALT_SYSCALL) failed");
Andrew Brestickereac28942015-11-11 16:04:46 -08001707 }
1708
1709 /*
Elly Jonesdd3e8512012-01-23 15:13:38 -05001710 * seccomp has to come last since it cuts off all the other
Elly Jonese1749eb2011-10-07 13:54:59 -04001711 * privilege-dropping syscalls :)
1712 */
Utkarsh Sanghi0ef8a662014-08-18 15:50:11 -07001713 if (j->flags.seccomp && prctl(PR_SET_SECCOMP, 1)) {
Jorge Lucangeli Obes7b2e29c2016-08-04 12:21:03 -04001714 if ((errno == EINVAL) && seccomp_can_softfail()) {
Utkarsh Sanghi0ef8a662014-08-18 15:50:11 -07001715 warn("seccomp not supported");
1716 return;
1717 }
Jorge Lucangeli Obes457a5e32016-11-23 15:18:56 -05001718 pdie("prctl(PR_SET_SECCOMP) failed");
Utkarsh Sanghi0ef8a662014-08-18 15:50:11 -07001719 }
Elly Jonescd7a9042011-07-22 13:56:51 -04001720}
1721
Jorge Lucangeli Obesdb0bc672016-08-03 10:45:21 -04001722/* TODO(wad): will visibility affect this variable? */
Elly Jonescd7a9042011-07-22 13:56:51 -04001723static int init_exitstatus = 0;
1724
Will Drewry6ac91122011-10-21 16:38:58 -05001725void init_term(int __attribute__ ((unused)) sig)
Elly Jonese1749eb2011-10-07 13:54:59 -04001726{
1727 _exit(init_exitstatus);
Elly Jonescd7a9042011-07-22 13:56:51 -04001728}
1729
Jorge Lucangeli Obes963eeec2016-08-10 16:02:43 -04001730void init(pid_t rootpid)
Elly Jonese1749eb2011-10-07 13:54:59 -04001731{
1732 pid_t pid;
1733 int status;
Jorge Lucangeli Obesdb0bc672016-08-03 10:45:21 -04001734 /* So that we exit with the right status. */
Elly Jonese1749eb2011-10-07 13:54:59 -04001735 signal(SIGTERM, init_term);
Jorge Lucangeli Obesdb0bc672016-08-03 10:45:21 -04001736 /* TODO(wad): self jail with seccomp filters here. */
Elly Jonese1749eb2011-10-07 13:54:59 -04001737 while ((pid = wait(&status)) > 0) {
Elly Jonesdd3e8512012-01-23 15:13:38 -05001738 /*
1739 * This loop will only end when either there are no processes
Elly Jonese1749eb2011-10-07 13:54:59 -04001740 * left inside our pid namespace or we get a signal.
1741 */
1742 if (pid == rootpid)
1743 init_exitstatus = status;
1744 }
1745 if (!WIFEXITED(init_exitstatus))
1746 _exit(MINIJAIL_ERR_INIT);
1747 _exit(WEXITSTATUS(init_exitstatus));
Elly Jonescd7a9042011-07-22 13:56:51 -04001748}
1749
Will Drewry6ac91122011-10-21 16:38:58 -05001750int API minijail_from_fd(int fd, struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -04001751{
1752 size_t sz = 0;
1753 size_t bytes = read(fd, &sz, sizeof(sz));
1754 char *buf;
1755 int r;
1756 if (sizeof(sz) != bytes)
1757 return -EINVAL;
Jorge Lucangeli Obes54714502015-09-30 10:08:45 -07001758 if (sz > USHRT_MAX) /* arbitrary sanity check */
Elly Jonese1749eb2011-10-07 13:54:59 -04001759 return -E2BIG;
1760 buf = malloc(sz);
1761 if (!buf)
1762 return -ENOMEM;
1763 bytes = read(fd, buf, sz);
1764 if (bytes != sz) {
1765 free(buf);
1766 return -EINVAL;
1767 }
1768 r = minijail_unmarshal(j, buf, sz);
1769 free(buf);
1770 return r;
Will Drewry2f54b6a2011-09-16 13:45:31 -05001771}
1772
Will Drewry6ac91122011-10-21 16:38:58 -05001773int API minijail_to_fd(struct minijail *j, int fd)
Elly Jonese1749eb2011-10-07 13:54:59 -04001774{
1775 char *buf;
1776 size_t sz = minijail_size(j);
1777 ssize_t written;
1778 int r;
Elly Jonescd7a9042011-07-22 13:56:51 -04001779
Elly Jonese1749eb2011-10-07 13:54:59 -04001780 if (!sz)
1781 return -EINVAL;
1782 buf = malloc(sz);
1783 r = minijail_marshal(j, buf, sz);
1784 if (r) {
1785 free(buf);
1786 return r;
1787 }
1788 /* Sends [size][minijail]. */
1789 written = write(fd, &sz, sizeof(sz));
1790 if (written != sizeof(sz)) {
1791 free(buf);
1792 return -EFAULT;
1793 }
1794 written = write(fd, buf, sz);
1795 if (written < 0 || (size_t) written != sz) {
1796 free(buf);
1797 return -EFAULT;
1798 }
1799 free(buf);
1800 return 0;
Will Drewry2f54b6a2011-09-16 13:45:31 -05001801}
Elly Jonescd7a9042011-07-22 13:56:51 -04001802
Will Drewry6ac91122011-10-21 16:38:58 -05001803int setup_preload(void)
Elly Jonese1749eb2011-10-07 13:54:59 -04001804{
Daniel Erat5b7a3182015-08-19 16:06:22 -06001805#if defined(__ANDROID__)
Jorge Lucangeli Obesa21c8fc2015-07-15 16:22:34 -07001806 /* Don't use LDPRELOAD on Brillo. */
1807 return 0;
1808#else
Elly Jonese1749eb2011-10-07 13:54:59 -04001809 char *oldenv = getenv(kLdPreloadEnvVar) ? : "";
1810 char *newenv = malloc(strlen(oldenv) + 2 + strlen(PRELOADPATH));
1811 if (!newenv)
1812 return -ENOMEM;
Elly Jonescd7a9042011-07-22 13:56:51 -04001813
Elly Jonese1749eb2011-10-07 13:54:59 -04001814 /* Only insert a separating space if we have something to separate... */
1815 sprintf(newenv, "%s%s%s", oldenv, strlen(oldenv) ? " " : "",
1816 PRELOADPATH);
Elly Jonescd7a9042011-07-22 13:56:51 -04001817
Jorge Lucangeli Obes54714502015-09-30 10:08:45 -07001818 /* setenv() makes a copy of the string we give it. */
Elly Jonese1749eb2011-10-07 13:54:59 -04001819 setenv(kLdPreloadEnvVar, newenv, 1);
1820 free(newenv);
1821 return 0;
Jorge Lucangeli Obesa21c8fc2015-07-15 16:22:34 -07001822#endif
Elly Jonescd7a9042011-07-22 13:56:51 -04001823}
1824
Will Drewry6ac91122011-10-21 16:38:58 -05001825int setup_pipe(int fds[2])
Elly Jonese1749eb2011-10-07 13:54:59 -04001826{
1827 int r = pipe(fds);
1828 char fd_buf[11];
1829 if (r)
1830 return r;
1831 r = snprintf(fd_buf, sizeof(fd_buf), "%d", fds[0]);
1832 if (r <= 0)
1833 return -EINVAL;
1834 setenv(kFdEnvVar, fd_buf, 1);
1835 return 0;
Will Drewryf89aef52011-09-16 16:48:57 -05001836}
1837
Jorge Lucangeli Obes339a1132013-02-15 16:53:47 -08001838int setup_pipe_end(int fds[2], size_t index)
1839{
1840 if (index > 1)
1841 return -1;
1842
1843 close(fds[1 - index]);
1844 return fds[index];
1845}
1846
1847int setup_and_dupe_pipe_end(int fds[2], size_t index, int fd)
1848{
1849 if (index > 1)
1850 return -1;
1851
1852 close(fds[1 - index]);
1853 /* dup2(2) the corresponding end of the pipe into |fd|. */
1854 return dup2(fds[index], fd);
1855}
1856
Luis Hector Chavez43ff0802016-10-07 12:21:07 -07001857int close_open_fds(int *inheritable_fds, size_t size)
1858{
1859 const char *kFdPath = "/proc/self/fd";
1860
1861 DIR *d = opendir(kFdPath);
1862 struct dirent *dir_entry;
1863
1864 if (d == NULL)
1865 return -1;
1866 int dir_fd = dirfd(d);
1867 while ((dir_entry = readdir(d)) != NULL) {
1868 size_t i;
1869 char *end;
1870 bool should_close = true;
1871 const int fd = strtol(dir_entry->d_name, &end, 10);
1872
1873 if ((*end) != '\0') {
1874 continue;
1875 }
1876 /*
1877 * We might have set up some pipes that we want to share with
1878 * the parent process, and should not be closed.
1879 */
1880 for (i = 0; i < size; ++i) {
1881 if (fd == inheritable_fds[i]) {
1882 should_close = false;
1883 break;
1884 }
1885 }
1886 /* Also avoid closing the directory fd. */
1887 if (should_close && fd != dir_fd)
1888 close(fd);
1889 }
1890 closedir(d);
1891 return 0;
1892}
1893
Jorge Lucangeli Obes54714502015-09-30 10:08:45 -07001894int minijail_run_internal(struct minijail *j, const char *filename,
1895 char *const argv[], pid_t *pchild_pid,
1896 int *pstdin_fd, int *pstdout_fd, int *pstderr_fd,
1897 int use_preload);
1898
Will Drewry6ac91122011-10-21 16:38:58 -05001899int API minijail_run(struct minijail *j, const char *filename,
1900 char *const argv[])
Elly Jonese1749eb2011-10-07 13:54:59 -04001901{
Jorge Lucangeli Obes54714502015-09-30 10:08:45 -07001902 return minijail_run_internal(j, filename, argv, NULL, NULL, NULL, NULL,
1903 true);
Jorge Lucangeli Obes9807d032012-04-17 13:36:00 -07001904}
1905
1906int API minijail_run_pid(struct minijail *j, const char *filename,
1907 char *const argv[], pid_t *pchild_pid)
1908{
Jorge Lucangeli Obes54714502015-09-30 10:08:45 -07001909 return minijail_run_internal(j, filename, argv, pchild_pid,
1910 NULL, NULL, NULL, true);
Jorge Lucangeli Obesdf4bd352012-08-29 19:12:28 -07001911}
1912
1913int API minijail_run_pipe(struct minijail *j, const char *filename,
Jorge Lucangeli Obes6537a562012-09-05 10:39:40 -07001914 char *const argv[], int *pstdin_fd)
Jorge Lucangeli Obesdf4bd352012-08-29 19:12:28 -07001915{
Jorge Lucangeli Obes54714502015-09-30 10:08:45 -07001916 return minijail_run_internal(j, filename, argv, NULL, pstdin_fd,
1917 NULL, NULL, true);
Jorge Lucangeli Obesdf4bd352012-08-29 19:12:28 -07001918}
1919
Jorge Lucangeli Obes339a1132013-02-15 16:53:47 -08001920int API minijail_run_pid_pipes(struct minijail *j, const char *filename,
Jorge Lucangeli Obes4ae30cc2014-04-10 15:35:33 -07001921 char *const argv[], pid_t *pchild_pid,
1922 int *pstdin_fd, int *pstdout_fd, int *pstderr_fd)
Jorge Lucangeli Obes339a1132013-02-15 16:53:47 -08001923{
Jorge Lucangeli Obes54714502015-09-30 10:08:45 -07001924 return minijail_run_internal(j, filename, argv, pchild_pid,
1925 pstdin_fd, pstdout_fd, pstderr_fd, true);
1926}
1927
1928int API minijail_run_no_preload(struct minijail *j, const char *filename,
1929 char *const argv[])
1930{
1931 return minijail_run_internal(j, filename, argv, NULL, NULL, NULL, NULL,
1932 false);
1933}
1934
Samuel Tan63187f42015-10-16 13:01:53 -07001935int API minijail_run_pid_pipes_no_preload(struct minijail *j,
Jorge Lucangeli Obes43a6a862015-12-04 14:53:36 -08001936 const char *filename,
1937 char *const argv[],
Samuel Tan63187f42015-10-16 13:01:53 -07001938 pid_t *pchild_pid,
Jorge Lucangeli Obes43a6a862015-12-04 14:53:36 -08001939 int *pstdin_fd, int *pstdout_fd,
Jorge Lucangeli Obesa521bee2016-03-03 13:47:57 -08001940 int *pstderr_fd)
1941{
Samuel Tan63187f42015-10-16 13:01:53 -07001942 return minijail_run_internal(j, filename, argv, pchild_pid,
1943 pstdin_fd, pstdout_fd, pstderr_fd, false);
1944}
1945
Jorge Lucangeli Obes54714502015-09-30 10:08:45 -07001946int minijail_run_internal(struct minijail *j, const char *filename,
1947 char *const argv[], pid_t *pchild_pid,
1948 int *pstdin_fd, int *pstdout_fd, int *pstderr_fd,
1949 int use_preload)
1950{
Elly Jonese1749eb2011-10-07 13:54:59 -04001951 char *oldenv, *oldenv_copy = NULL;
1952 pid_t child_pid;
1953 int pipe_fds[2];
Jorge Lucangeli Obesdf4bd352012-08-29 19:12:28 -07001954 int stdin_fds[2];
Jorge Lucangeli Obes339a1132013-02-15 16:53:47 -08001955 int stdout_fds[2];
1956 int stderr_fds[2];
Dylan Reidce5b55e2016-01-13 11:04:16 -08001957 int child_sync_pipe_fds[2];
1958 int sync_child = 0;
Elly Jonese1749eb2011-10-07 13:54:59 -04001959 int ret;
Elly Jonesa05d7bb2012-06-14 14:09:27 -04001960 /* We need to remember this across the minijail_preexec() call. */
1961 int pid_namespace = j->flags.pids;
Yu-Hsi Chiang3e954ec2015-07-28 16:48:14 +08001962 int do_init = j->flags.do_init;
Ben Chan541c7e52011-08-26 14:55:53 -07001963
Jorge Lucangeli Obes54714502015-09-30 10:08:45 -07001964 if (use_preload) {
1965 oldenv = getenv(kLdPreloadEnvVar);
1966 if (oldenv) {
1967 oldenv_copy = strdup(oldenv);
1968 if (!oldenv_copy)
1969 return -ENOMEM;
1970 }
1971
1972 if (setup_preload())
1973 return -EFAULT;
Elly Jonese1749eb2011-10-07 13:54:59 -04001974 }
Will Drewryf89aef52011-09-16 16:48:57 -05001975
Jorge Lucangeli Obes54714502015-09-30 10:08:45 -07001976 if (!use_preload) {
Jorge Lucangeli Obesa2053902016-08-02 12:08:15 -04001977 if (j->flags.use_caps && j->caps != 0)
Jorge Lucangeli Obes457a5e32016-11-23 15:18:56 -05001978 die("non-empty capabilities are not supported without "
1979 "LD_PRELOAD");
Jorge Lucangeli Obes54714502015-09-30 10:08:45 -07001980 }
Will Drewry2f54b6a2011-09-16 13:45:31 -05001981
Elly Jonesdd3e8512012-01-23 15:13:38 -05001982 /*
Jorge Lucangeli Obesaa235b92016-11-23 13:48:15 -05001983 * Make the process group ID of this process equal to its PID.
1984 * In the non-interactive case (e.g. when the parent process is started
1985 * from init) this ensures the parent process and the jailed process
1986 * can be killed together.
1987 * When the parent process is started from the console this ensures
1988 * the call to setsid(2) in the jailed process succeeds.
1989 *
Jorge Lucangeli Obes3c84df12015-05-14 17:37:58 -07001990 * Don't fail on EPERM, since setpgid(0, 0) can only EPERM when
1991 * the process is already a process group leader.
1992 */
1993 if (setpgid(0 /* use calling PID */, 0 /* make PGID = PID */)) {
1994 if (errno != EPERM) {
Jorge Lucangeli Obesaa235b92016-11-23 13:48:15 -05001995 pdie("setpgid(0, 0) failed");
Jorge Lucangeli Obes3c84df12015-05-14 17:37:58 -07001996 }
1997 }
1998
Jorge Lucangeli Obes54714502015-09-30 10:08:45 -07001999 if (use_preload) {
2000 /*
2001 * Before we fork(2) and execve(2) the child process, we need
2002 * to open a pipe(2) to send the minijail configuration over.
2003 */
2004 if (setup_pipe(pipe_fds))
2005 return -EFAULT;
2006 }
Elly Jonescd7a9042011-07-22 13:56:51 -04002007
Jorge Lucangeli Obesdf4bd352012-08-29 19:12:28 -07002008 /*
2009 * If we want to write to the child process' standard input,
2010 * create the pipe(2) now.
2011 */
2012 if (pstdin_fd) {
2013 if (pipe(stdin_fds))
2014 return -EFAULT;
2015 }
2016
Jorge Lucangeli Obes339a1132013-02-15 16:53:47 -08002017 /*
2018 * If we want to read from the child process' standard output,
2019 * create the pipe(2) now.
2020 */
2021 if (pstdout_fd) {
2022 if (pipe(stdout_fds))
2023 return -EFAULT;
2024 }
2025
2026 /*
2027 * If we want to read from the child process' standard error,
2028 * create the pipe(2) now.
2029 */
2030 if (pstderr_fd) {
2031 if (pipe(stderr_fds))
2032 return -EFAULT;
2033 }
2034
Yu-Hsi Chiang10e91232015-08-05 14:40:45 +08002035 /*
Jorge Lucangeli Obesab6fa6f2016-08-04 15:42:48 -04002036 * If we want to set up a new uid/gid map in the user namespace,
Jorge Lucangeli Obesb8a51382016-01-25 20:08:22 -08002037 * or if we need to add the child process to cgroups, create the pipe(2)
2038 * to sync between parent and child.
Yu-Hsi Chiang10e91232015-08-05 14:40:45 +08002039 */
Jorge Lucangeli Obesb8a51382016-01-25 20:08:22 -08002040 if (j->flags.userns || j->flags.cgroups) {
Dylan Reidce5b55e2016-01-13 11:04:16 -08002041 sync_child = 1;
2042 if (pipe(child_sync_pipe_fds))
Yu-Hsi Chiang10e91232015-08-05 14:40:45 +08002043 return -EFAULT;
2044 }
2045
Jorge Lucangeli Obesd0a6e2f2015-11-24 14:21:21 -08002046 /*
2047 * Use sys_clone() if and only if we're creating a pid namespace.
Elly Jones761b7412012-06-13 15:49:52 -04002048 *
2049 * tl;dr: WARNING: do not mix pid namespaces and multithreading.
2050 *
2051 * In multithreaded programs, there are a bunch of locks inside libc,
2052 * some of which may be held by other threads at the time that we call
2053 * minijail_run_pid(). If we call fork(), glibc does its level best to
2054 * ensure that we hold all of these locks before it calls clone()
2055 * internally and drop them after clone() returns, but when we call
2056 * sys_clone(2) directly, all that gets bypassed and we end up with a
2057 * child address space where some of libc's important locks are held by
2058 * other threads (which did not get cloned, and hence will never release
2059 * those locks). This is okay so long as we call exec() immediately
2060 * after, but a bunch of seemingly-innocent libc functions like setenv()
2061 * take locks.
2062 *
2063 * Hence, only call sys_clone() if we need to, in order to get at pid
2064 * namespacing. If we follow this path, the child's address space might
2065 * have broken locks; you may only call functions that do not acquire
2066 * any locks.
2067 *
2068 * Unfortunately, fork() acquires every lock it can get its hands on, as
2069 * previously detailed, so this function is highly likely to deadlock
2070 * later on (see "deadlock here") if we're multithreaded.
2071 *
2072 * We might hack around this by having the clone()d child (init of the
2073 * pid namespace) return directly, rather than leaving the clone()d
2074 * process hanging around to be init for the new namespace (and having
Jorge Lucangeli Obesa521bee2016-03-03 13:47:57 -08002075 * its fork()ed child return in turn), but that process would be
2076 * crippled with its libc locks potentially broken. We might try
2077 * fork()ing in the parent before we clone() to ensure that we own all
2078 * the locks, but then we have to have the forked child hanging around
2079 * consuming resources (and possibly having file descriptors / shared
2080 * memory regions / etc attached). We'd need to keep the child around to
2081 * avoid having its children get reparented to init.
Elly Jones761b7412012-06-13 15:49:52 -04002082 *
2083 * TODO(ellyjones): figure out if the "forked child hanging around"
2084 * problem is fixable or not. It would be nice if we worked in this
2085 * case.
2086 */
Yu-Hsi Chiang10e91232015-08-05 14:40:45 +08002087 if (pid_namespace) {
2088 int clone_flags = CLONE_NEWPID | SIGCHLD;
2089 if (j->flags.userns)
2090 clone_flags |= CLONE_NEWUSER;
2091 child_pid = syscall(SYS_clone, clone_flags, NULL);
Jorge Lucangeli Obes54714502015-09-30 10:08:45 -07002092 } else {
Elly Jones761b7412012-06-13 15:49:52 -04002093 child_pid = fork();
Jorge Lucangeli Obes54714502015-09-30 10:08:45 -07002094 }
Elly Jones761b7412012-06-13 15:49:52 -04002095
Elly Jonese1749eb2011-10-07 13:54:59 -04002096 if (child_pid < 0) {
Jorge Lucangeli Obes54714502015-09-30 10:08:45 -07002097 if (use_preload) {
2098 free(oldenv_copy);
2099 }
Lee Campbell1e4fc6a2014-06-06 17:40:02 -07002100 die("failed to fork child");
Elly Jonese1749eb2011-10-07 13:54:59 -04002101 }
Will Drewryf89aef52011-09-16 16:48:57 -05002102
Elly Jonese1749eb2011-10-07 13:54:59 -04002103 if (child_pid) {
Jorge Lucangeli Obes54714502015-09-30 10:08:45 -07002104 if (use_preload) {
2105 /* Restore parent's LD_PRELOAD. */
2106 if (oldenv_copy) {
2107 setenv(kLdPreloadEnvVar, oldenv_copy, 1);
2108 free(oldenv_copy);
2109 } else {
2110 unsetenv(kLdPreloadEnvVar);
2111 }
2112 unsetenv(kFdEnvVar);
Elly Jonese1749eb2011-10-07 13:54:59 -04002113 }
Jorge Lucangeli Obesdf4bd352012-08-29 19:12:28 -07002114
Elly Jonese1749eb2011-10-07 13:54:59 -04002115 j->initpid = child_pid;
Jorge Lucangeli Obesdf4bd352012-08-29 19:12:28 -07002116
Yu-Hsi Chiang3cc05ea2015-08-11 11:23:17 +08002117 if (j->flags.pid_file)
Jorge Lucangeli Obesf205fff2016-08-06 09:06:21 -04002118 write_pid_file_or_die(j);
Yu-Hsi Chiang3cc05ea2015-08-11 11:23:17 +08002119
Jorge Lucangeli Obesb8a51382016-01-25 20:08:22 -08002120 if (j->flags.cgroups)
Jorge Lucangeli Obesf205fff2016-08-06 09:06:21 -04002121 add_to_cgroups_or_die(j);
Dylan Reid605ce7f2016-01-19 19:21:00 -08002122
Yu-Hsi Chiang10e91232015-08-05 14:40:45 +08002123 if (j->flags.userns)
Jorge Lucangeli Obesf205fff2016-08-06 09:06:21 -04002124 write_ugid_maps_or_die(j);
Dylan Reidce5b55e2016-01-13 11:04:16 -08002125
2126 if (sync_child)
2127 parent_setup_complete(child_sync_pipe_fds);
Yu-Hsi Chiang10e91232015-08-05 14:40:45 +08002128
Jorge Lucangeli Obes54714502015-09-30 10:08:45 -07002129 if (use_preload) {
2130 /* Send marshalled minijail. */
2131 close(pipe_fds[0]); /* read endpoint */
2132 ret = minijail_to_fd(j, pipe_fds[1]);
2133 close(pipe_fds[1]); /* write endpoint */
2134 if (ret) {
2135 kill(j->initpid, SIGKILL);
2136 die("failed to send marshalled minijail");
2137 }
Elly Jonese1749eb2011-10-07 13:54:59 -04002138 }
Jorge Lucangeli Obesdf4bd352012-08-29 19:12:28 -07002139
Jorge Lucangeli Obes9807d032012-04-17 13:36:00 -07002140 if (pchild_pid)
2141 *pchild_pid = child_pid;
Jorge Lucangeli Obesdf4bd352012-08-29 19:12:28 -07002142
2143 /*
2144 * If we want to write to the child process' standard input,
2145 * set up the write end of the pipe.
2146 */
Jorge Lucangeli Obes339a1132013-02-15 16:53:47 -08002147 if (pstdin_fd)
2148 *pstdin_fd = setup_pipe_end(stdin_fds,
Jorge Lucangeli Obes54714502015-09-30 10:08:45 -07002149 1 /* write end */);
Jorge Lucangeli Obes339a1132013-02-15 16:53:47 -08002150
2151 /*
2152 * If we want to read from the child process' standard output,
2153 * set up the read end of the pipe.
2154 */
2155 if (pstdout_fd)
2156 *pstdout_fd = setup_pipe_end(stdout_fds,
Jorge Lucangeli Obes54714502015-09-30 10:08:45 -07002157 0 /* read end */);
Jorge Lucangeli Obes339a1132013-02-15 16:53:47 -08002158
2159 /*
2160 * If we want to read from the child process' standard error,
2161 * set up the read end of the pipe.
2162 */
2163 if (pstderr_fd)
2164 *pstderr_fd = setup_pipe_end(stderr_fds,
Jorge Lucangeli Obes54714502015-09-30 10:08:45 -07002165 0 /* read end */);
Jorge Lucangeli Obesdf4bd352012-08-29 19:12:28 -07002166
Elly Jonese1749eb2011-10-07 13:54:59 -04002167 return 0;
2168 }
Jorge Lucangeli Obesa2053902016-08-02 12:08:15 -04002169 /* Child process. */
Elly Jonese1749eb2011-10-07 13:54:59 -04002170 free(oldenv_copy);
Ben Chan541c7e52011-08-26 14:55:53 -07002171
Peter Qiu2860c462015-12-16 15:13:06 -08002172 if (j->flags.reset_signal_mask) {
2173 sigset_t signal_mask;
2174 if (sigemptyset(&signal_mask) != 0)
2175 pdie("sigemptyset failed");
2176 if (sigprocmask(SIG_SETMASK, &signal_mask, NULL) != 0)
2177 pdie("sigprocmask failed");
2178 }
2179
Luis Hector Chavez43ff0802016-10-07 12:21:07 -07002180 if (j->flags.close_open_fds) {
2181 const size_t kMaxInheritableFdsSize = 10;
2182 int inheritable_fds[kMaxInheritableFdsSize];
2183 size_t size = 0;
2184 if (use_preload) {
2185 inheritable_fds[size++] = pipe_fds[0];
2186 inheritable_fds[size++] = pipe_fds[1];
2187 }
2188 if (sync_child) {
2189 inheritable_fds[size++] = child_sync_pipe_fds[0];
2190 inheritable_fds[size++] = child_sync_pipe_fds[1];
2191 }
2192 if (pstdin_fd) {
2193 inheritable_fds[size++] = stdin_fds[0];
2194 inheritable_fds[size++] = stdin_fds[1];
2195 }
2196 if (pstdout_fd) {
2197 inheritable_fds[size++] = stdout_fds[0];
2198 inheritable_fds[size++] = stdout_fds[1];
2199 }
2200 if (pstderr_fd) {
2201 inheritable_fds[size++] = stderr_fds[0];
2202 inheritable_fds[size++] = stderr_fds[1];
2203 }
2204
2205 if (close_open_fds(inheritable_fds, size) < 0)
2206 die("failed to close open file descriptors");
2207 }
2208
Dylan Reidce5b55e2016-01-13 11:04:16 -08002209 if (sync_child)
2210 wait_for_parent_setup(child_sync_pipe_fds);
2211
Yu-Hsi Chiang10e91232015-08-05 14:40:45 +08002212 if (j->flags.userns)
Dylan Reidce5b55e2016-01-13 11:04:16 -08002213 enter_user_namespace(j);
Yu-Hsi Chiang10e91232015-08-05 14:40:45 +08002214
Jorge Lucangeli Obesdf4bd352012-08-29 19:12:28 -07002215 /*
2216 * If we want to write to the jailed process' standard input,
2217 * set up the read end of the pipe.
2218 */
2219 if (pstdin_fd) {
Jorge Lucangeli Obes339a1132013-02-15 16:53:47 -08002220 if (setup_and_dupe_pipe_end(stdin_fds, 0 /* read end */,
2221 STDIN_FILENO) < 0)
Jorge Lucangeli Obesdf4bd352012-08-29 19:12:28 -07002222 die("failed to set up stdin pipe");
2223 }
2224
Jorge Lucangeli Obes339a1132013-02-15 16:53:47 -08002225 /*
2226 * If we want to read from the jailed process' standard output,
2227 * set up the write end of the pipe.
2228 */
2229 if (pstdout_fd) {
2230 if (setup_and_dupe_pipe_end(stdout_fds, 1 /* write end */,
2231 STDOUT_FILENO) < 0)
2232 die("failed to set up stdout pipe");
2233 }
2234
2235 /*
2236 * If we want to read from the jailed process' standard error,
2237 * set up the write end of the pipe.
2238 */
2239 if (pstderr_fd) {
2240 if (setup_and_dupe_pipe_end(stderr_fds, 1 /* write end */,
2241 STDERR_FILENO) < 0)
2242 die("failed to set up stderr pipe");
2243 }
2244
Jorge Lucangeli Obesaa235b92016-11-23 13:48:15 -05002245 /*
2246 * If any of stdin, stdout, or stderr are TTYs, create a new session.
2247 * This prevents the jailed process from using the TIOCSTI ioctl
2248 * to push characters into the parent process terminal's input buffer,
2249 * therefore escaping the jail.
2250 */
2251 if (isatty(STDIN_FILENO) || isatty(STDOUT_FILENO) ||
2252 isatty(STDERR_FILENO)) {
2253 if (setsid() < 0) {
2254 pdie("setsid() failed");
2255 }
2256 }
2257
Dylan Reid791f5772015-09-14 20:02:42 -07002258 /* If running an init program, let it decide when/how to mount /proc. */
2259 if (pid_namespace && !do_init)
2260 j->flags.remount_proc_ro = 0;
2261
Jorge Lucangeli Obes54714502015-09-30 10:08:45 -07002262 if (use_preload) {
2263 /* Strip out flags that cannot be inherited across execve(2). */
2264 minijail_preexec(j);
2265 } else {
Jorge Lucangeli Obesa2053902016-08-02 12:08:15 -04002266 /*
2267 * If not using LD_PRELOAD, do all jailing before execve(2).
2268 * Note that PID namespaces can only be entered on fork(2),
2269 * so that flag is still cleared.
2270 */
Jorge Lucangeli Obes54714502015-09-30 10:08:45 -07002271 j->flags.pids = 0;
2272 }
Jorge Lucangeli Obesa2053902016-08-02 12:08:15 -04002273 /* Jail this process, then execve(2) the target. */
Elly Jonese1749eb2011-10-07 13:54:59 -04002274 minijail_enter(j);
Elly Jonescd7a9042011-07-22 13:56:51 -04002275
Yu-Hsi Chiang3e954ec2015-07-28 16:48:14 +08002276 if (pid_namespace && do_init) {
Elly Jonesdd3e8512012-01-23 15:13:38 -05002277 /*
2278 * pid namespace: this process will become init inside the new
Yu-Hsi Chiang3e954ec2015-07-28 16:48:14 +08002279 * namespace. We don't want all programs we might exec to have
Jorge Lucangeli Obes54714502015-09-30 10:08:45 -07002280 * to know how to be init. Normally (do_init == 1) we fork off
Yu-Hsi Chiang3e954ec2015-07-28 16:48:14 +08002281 * a child to actually run the program. If |do_init == 0|, we
2282 * let the program keep pid 1 and be init.
Elly Jones761b7412012-06-13 15:49:52 -04002283 *
2284 * If we're multithreaded, we'll probably deadlock here. See
2285 * WARNING above.
Elly Jonese1749eb2011-10-07 13:54:59 -04002286 */
2287 child_pid = fork();
Jorge Lucangeli Obes963eeec2016-08-10 16:02:43 -04002288 if (child_pid < 0) {
Elly Jonese1749eb2011-10-07 13:54:59 -04002289 _exit(child_pid);
Jorge Lucangeli Obes963eeec2016-08-10 16:02:43 -04002290 } else if (child_pid > 0) {
Jorge Lucangeli Obes13650612016-09-02 11:27:29 -04002291 /*
2292 * Best effort. Don't bother checking the return value.
2293 */
Jorge Lucangeli Obes963eeec2016-08-10 16:02:43 -04002294 prctl(PR_SET_NAME, "minijail-init");
2295 init(child_pid); /* Never returns. */
2296 }
Elly Jonese1749eb2011-10-07 13:54:59 -04002297 }
Elly Jonescd7a9042011-07-22 13:56:51 -04002298
Elly Jonesdd3e8512012-01-23 15:13:38 -05002299 /*
Jorge Lucangeli Obes54714502015-09-30 10:08:45 -07002300 * If we aren't pid-namespaced, or the jailed program asked to be init:
Elly Jonese1749eb2011-10-07 13:54:59 -04002301 * calling process
2302 * -> execve()-ing process
2303 * If we are:
2304 * calling process
2305 * -> init()-ing process
2306 * -> execve()-ing process
2307 */
Jorge Lucangeli Obesa2053902016-08-02 12:08:15 -04002308 ret = execve(filename, argv, environ);
2309 if (ret == -1) {
2310 pwarn("execve(%s) failed", filename);
2311 }
2312 _exit(ret);
Elly Jonescd7a9042011-07-22 13:56:51 -04002313}
2314
Will Drewry6ac91122011-10-21 16:38:58 -05002315int API minijail_kill(struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -04002316{
2317 int st;
2318 if (kill(j->initpid, SIGTERM))
2319 return -errno;
2320 if (waitpid(j->initpid, &st, 0) < 0)
2321 return -errno;
2322 return st;
Elly Jonescd7a9042011-07-22 13:56:51 -04002323}
2324
Will Drewry6ac91122011-10-21 16:38:58 -05002325int API minijail_wait(struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -04002326{
2327 int st;
2328 if (waitpid(j->initpid, &st, 0) < 0)
2329 return -errno;
Jorge Lucangeli Obes1530b742012-12-11 14:08:09 -08002330
Jorge Lucangeli Obesc2c9bcc2012-05-01 09:30:24 -07002331 if (!WIFEXITED(st)) {
Jorge Lucangeli Obes18d1eba2014-04-18 13:58:20 -07002332 int error_status = st;
2333 if (WIFSIGNALED(st)) {
2334 int signum = WTERMSIG(st);
mukesh agrawalc420a262013-06-11 17:22:42 -07002335 warn("child process %d received signal %d",
Jorge Lucangeli Obes18d1eba2014-04-18 13:58:20 -07002336 j->initpid, signum);
2337 /*
2338 * We return MINIJAIL_ERR_JAIL if the process received
2339 * SIGSYS, which happens when a syscall is blocked by
2340 * seccomp filters.
2341 * If not, we do what bash(1) does:
2342 * $? = 128 + signum
2343 */
2344 if (signum == SIGSYS) {
2345 error_status = MINIJAIL_ERR_JAIL;
2346 } else {
2347 error_status = 128 + signum;
2348 }
2349 }
2350 return error_status;
Jorge Lucangeli Obesc2c9bcc2012-05-01 09:30:24 -07002351 }
Jorge Lucangeli Obes1530b742012-12-11 14:08:09 -08002352
2353 int exit_status = WEXITSTATUS(st);
2354 if (exit_status != 0)
mukesh agrawalc420a262013-06-11 17:22:42 -07002355 info("child process %d exited with status %d",
2356 j->initpid, exit_status);
Jorge Lucangeli Obes1530b742012-12-11 14:08:09 -08002357
2358 return exit_status;
Elly Jonescd7a9042011-07-22 13:56:51 -04002359}
2360
Will Drewry6ac91122011-10-21 16:38:58 -05002361void API minijail_destroy(struct minijail *j)
Elly Jonese1749eb2011-10-07 13:54:59 -04002362{
Dylan Reid605ce7f2016-01-19 19:21:00 -08002363 size_t i;
2364
Jorge Lucangeli Obes524c0402012-01-17 11:30:23 -08002365 if (j->flags.seccomp_filter && j->filter_prog) {
2366 free(j->filter_prog->filter);
2367 free(j->filter_prog);
Elly Jonese1749eb2011-10-07 13:54:59 -04002368 }
Dylan Reid648b2202015-10-23 00:50:00 -07002369 while (j->mounts_head) {
2370 struct mountpoint *m = j->mounts_head;
2371 j->mounts_head = j->mounts_head->next;
Dylan Reid81e23972016-05-18 14:06:35 -07002372 free(m->data);
Dylan Reid648b2202015-10-23 00:50:00 -07002373 free(m->type);
2374 free(m->dest);
2375 free(m->src);
2376 free(m);
Elly Jones51a5b6c2011-10-12 19:09:26 -04002377 }
Dylan Reid648b2202015-10-23 00:50:00 -07002378 j->mounts_tail = NULL;
Elly Jonese1749eb2011-10-07 13:54:59 -04002379 if (j->user)
2380 free(j->user);
Jorge Lucangeli Obese81a52f2015-12-04 16:05:23 -08002381 if (j->suppl_gid_list)
2382 free(j->suppl_gid_list);
Will Drewrybee7ba72011-10-21 20:47:01 -05002383 if (j->chrootdir)
2384 free(j->chrootdir);
Jorge Lucangeli Obes3b2e6e42016-08-04 12:26:19 -04002385 if (j->pid_file_path)
2386 free(j->pid_file_path);
2387 if (j->uidmap)
2388 free(j->uidmap);
2389 if (j->gidmap)
2390 free(j->gidmap);
Andrew Brestickereac28942015-11-11 16:04:46 -08002391 if (j->alt_syscall_table)
2392 free(j->alt_syscall_table);
Dylan Reid605ce7f2016-01-19 19:21:00 -08002393 for (i = 0; i < j->cgroup_count; ++i)
2394 free(j->cgroups[i]);
Elly Jonese1749eb2011-10-07 13:54:59 -04002395 free(j);
Elly Jonescd7a9042011-07-22 13:56:51 -04002396}