Elly Jones | cd7a904 | 2011-07-22 13:56:51 -0400 | [diff] [blame] | 1 | /* libminijailpreload.c - preload hack library |
| 2 | * Copyright (c) 2011 The Chromium OS Authors. All rights reserved. |
| 3 | * Use of this source code is governed by a BSD-style license that can be |
| 4 | * found in the LICENSE file. |
| 5 | * |
| 6 | * This library is preloaded into every program launched by minijail_run(). |
| 7 | * DO NOT EXPORT ANY SYMBOLS FROM THIS LIBRARY. They will replace other symbols |
| 8 | * in the programs it is preloaded into and cause impossible-to-debug failures. |
Elly Jones | e1749eb | 2011-10-07 13:54:59 -0400 | [diff] [blame] | 9 | * See the minijail0.1 for a design explanation. |
| 10 | */ |
Elly Jones | cd7a904 | 2011-07-22 13:56:51 -0400 | [diff] [blame] | 11 | |
| 12 | #include "libminijail.h" |
| 13 | #include "libminijail-private.h" |
| 14 | |
| 15 | #include <dlfcn.h> |
Will Drewry | 2f54b6a | 2011-09-16 13:45:31 -0500 | [diff] [blame] | 16 | #include <stdio.h> |
Elly Jones | cd7a904 | 2011-07-22 13:56:51 -0400 | [diff] [blame] | 17 | #include <stdlib.h> |
| 18 | #include <string.h> |
| 19 | #include <sys/types.h> |
| 20 | #include <syslog.h> |
| 21 | #include <unistd.h> |
| 22 | |
Elly Jones | e1749eb | 2011-10-07 13:54:59 -0400 | [diff] [blame] | 23 | static int (*real_main) (int, char **, char **); |
| 24 | static void *libc_handle; |
Elly Jones | cd7a904 | 2011-07-22 13:56:51 -0400 | [diff] [blame] | 25 | |
Elly Jones | e1749eb | 2011-10-07 13:54:59 -0400 | [diff] [blame] | 26 | static void die(const char *failed) |
| 27 | { |
| 28 | syslog(LOG_ERR, "libminijail: %s", failed); |
| 29 | abort(); |
Elly Jones | cd7a904 | 2011-07-22 13:56:51 -0400 | [diff] [blame] | 30 | } |
| 31 | |
Elly Jones | e1749eb | 2011-10-07 13:54:59 -0400 | [diff] [blame] | 32 | static void unset_in_env(char **envp, const char *name) |
| 33 | { |
| 34 | int i; |
| 35 | for (i = 0; envp[i]; i++) |
| 36 | if (!strncmp(envp[i], name, strlen(name))) |
| 37 | envp[i][0] = '\0'; |
Elly Jones | cd7a904 | 2011-07-22 13:56:51 -0400 | [diff] [blame] | 38 | } |
| 39 | |
Elly Jones | cd7a904 | 2011-07-22 13:56:51 -0400 | [diff] [blame] | 40 | /** @brief Fake main(), spliced in before the real call to main() by |
| 41 | * __libc_start_main (see below). |
Will Drewry | 2f54b6a | 2011-09-16 13:45:31 -0500 | [diff] [blame] | 42 | * We get serialized commands from our invoking process over an fd specified |
| 43 | * by an environment variable (kFdEnvVar). The environment variable is a list |
| 44 | * of key=value pairs (see move_commands_to_env); we use them to construct a |
| 45 | * jail, then enter it. |
Elly Jones | cd7a904 | 2011-07-22 13:56:51 -0400 | [diff] [blame] | 46 | */ |
Elly Jones | e1749eb | 2011-10-07 13:54:59 -0400 | [diff] [blame] | 47 | static int fake_main(int argc, char **argv, char **envp) |
| 48 | { |
| 49 | char *fd_name = getenv(kFdEnvVar); |
| 50 | int fd = -1; |
| 51 | struct minijail *j; |
Jorge Lucangeli Obes | db0bc67 | 2016-08-03 10:45:21 -0400 | [diff] [blame] | 52 | if (geteuid() != getuid() || getegid() != getgid()) { |
| 53 | /* |
| 54 | * If we didn't do this check, an attacker could set kFdEnvVar |
Elly Jones | e1749eb | 2011-10-07 13:54:59 -0400 | [diff] [blame] | 55 | * for any setuid program that uses libminijail to cause it to |
| 56 | * get capabilities or a uid it did not expect. |
| 57 | */ |
Jorge Lucangeli Obes | db0bc67 | 2016-08-03 10:45:21 -0400 | [diff] [blame] | 58 | /* TODO(wad): why would libminijail interact here? */ |
Elly Jones | e1749eb | 2011-10-07 13:54:59 -0400 | [diff] [blame] | 59 | return MINIJAIL_ERR_PRELOAD; |
Jorge Lucangeli Obes | db0bc67 | 2016-08-03 10:45:21 -0400 | [diff] [blame] | 60 | } |
Elly Jones | e1749eb | 2011-10-07 13:54:59 -0400 | [diff] [blame] | 61 | if (!fd_name) |
| 62 | return MINIJAIL_ERR_PRELOAD; |
| 63 | fd = atoi(fd_name); |
| 64 | if (fd < 0) |
| 65 | return MINIJAIL_ERR_PRELOAD; |
Will Drewry | 2f54b6a | 2011-09-16 13:45:31 -0500 | [diff] [blame] | 66 | |
Elly Jones | e1749eb | 2011-10-07 13:54:59 -0400 | [diff] [blame] | 67 | j = minijail_new(); |
| 68 | if (!j) |
| 69 | die("preload: out of memory"); |
| 70 | if (minijail_from_fd(fd, j)) |
| 71 | die("preload: failed to parse minijail from parent"); |
| 72 | close(fd); |
Will Drewry | fe4a372 | 2011-09-16 14:50:50 -0500 | [diff] [blame] | 73 | |
Elly Jones | e1749eb | 2011-10-07 13:54:59 -0400 | [diff] [blame] | 74 | /* TODO(ellyjones): this trashes existing preloads, so one can't do: |
| 75 | * LD_PRELOAD="/tmp/test.so libminijailpreload.so" prog; the |
| 76 | * descendants of prog will have no LD_PRELOAD set at all. |
| 77 | */ |
| 78 | unset_in_env(envp, kLdPreloadEnvVar); |
| 79 | /* Strip out flags meant for the parent. */ |
| 80 | minijail_preenter(j); |
| 81 | minijail_enter(j); |
| 82 | minijail_destroy(j); |
| 83 | dlclose(libc_handle); |
| 84 | return real_main(argc, argv, envp); |
Elly Jones | cd7a904 | 2011-07-22 13:56:51 -0400 | [diff] [blame] | 85 | } |
| 86 | |
| 87 | /** @brief LD_PRELOAD override of __libc_start_main. |
| 88 | * |
Elly Jones | e1749eb | 2011-10-07 13:54:59 -0400 | [diff] [blame] | 89 | * It is really best if you do not look too closely at this function. We need |
| 90 | * to ensure that some of our code runs before the target program (see the |
| 91 | * minijail0.1 file in this directory for high-level details about this), and |
Elly Jones | cd7a904 | 2011-07-22 13:56:51 -0400 | [diff] [blame] | 92 | * the only available place to hook is this function, which is normally |
| 93 | * responsible for calling main(). Our LD_PRELOAD will overwrite the real |
| 94 | * __libc_start_main with this one, so we have to look up the real one from |
| 95 | * libc and invoke it with a pointer to the fake main() we'd like to run before |
| 96 | * the real main(). We can't just run our setup code *here* because |
| 97 | * __libc_start_main is responsible for setting up the C runtime environment, |
| 98 | * so we can't rely on things like malloc() being available yet. |
| 99 | */ |
| 100 | |
Jorge Lucangeli Obes | db0bc67 | 2016-08-03 10:45:21 -0400 | [diff] [blame] | 101 | int API __libc_start_main(int (*main)(int, char **, char **), int argc, |
| 102 | char **ubp_av, void (*init)(void), void (*fini)(void), |
| 103 | void (*rtld_fini)(void), void(*stack_end)) |
Elly Jones | e1749eb | 2011-10-07 13:54:59 -0400 | [diff] [blame] | 104 | { |
| 105 | void *sym; |
Jorge Lucangeli Obes | db0bc67 | 2016-08-03 10:45:21 -0400 | [diff] [blame] | 106 | /* |
| 107 | * This hack is unfortunately required by C99 - casting directly from |
Elly Jones | e1749eb | 2011-10-07 13:54:59 -0400 | [diff] [blame] | 108 | * void* to function pointers is left undefined. See POSIX.1-2003, the |
| 109 | * Rationale for the specification of dlsym(), and dlsym(3). This |
| 110 | * deliberately violates strict-aliasing rules, but gcc can't tell. |
| 111 | */ |
| 112 | union { |
Jorge Lucangeli Obes | db0bc67 | 2016-08-03 10:45:21 -0400 | [diff] [blame] | 113 | int (*fn)(int (*main)(int, char **, char **), int argc, |
| 114 | char **ubp_av, void (*init)(void), void (*fini)(void), |
| 115 | void (*rtld_fini)(void), void(*stack_end)); |
Elly Jones | e1749eb | 2011-10-07 13:54:59 -0400 | [diff] [blame] | 116 | void *symval; |
| 117 | } real_libc_start_main; |
Elly Jones | cd7a904 | 2011-07-22 13:56:51 -0400 | [diff] [blame] | 118 | |
Jorge Lucangeli Obes | db0bc67 | 2016-08-03 10:45:21 -0400 | [diff] [blame] | 119 | /* |
| 120 | * We hold this handle for the duration of the real __libc_start_main() |
Elly Jones | e1749eb | 2011-10-07 13:54:59 -0400 | [diff] [blame] | 121 | * and drop it just before calling the real main(). |
| 122 | */ |
| 123 | libc_handle = dlopen("libc.so.6", RTLD_NOW); |
Elly Jones | cd7a904 | 2011-07-22 13:56:51 -0400 | [diff] [blame] | 124 | |
Elly Jones | e1749eb | 2011-10-07 13:54:59 -0400 | [diff] [blame] | 125 | if (!libc_handle) { |
| 126 | syslog(LOG_ERR, "can't dlopen() libc"); |
Jorge Lucangeli Obes | db0bc67 | 2016-08-03 10:45:21 -0400 | [diff] [blame] | 127 | /* |
| 128 | * We dare not use abort() here because it will run atexit() |
Elly Jones | e1749eb | 2011-10-07 13:54:59 -0400 | [diff] [blame] | 129 | * handlers and try to flush stdio. |
| 130 | */ |
| 131 | _exit(1); |
| 132 | } |
| 133 | sym = dlsym(libc_handle, "__libc_start_main"); |
| 134 | if (!sym) { |
| 135 | syslog(LOG_ERR, "can't find the real __libc_start_main()"); |
| 136 | _exit(1); |
| 137 | } |
| 138 | real_libc_start_main.symval = sym; |
| 139 | real_main = main; |
Elly Jones | cd7a904 | 2011-07-22 13:56:51 -0400 | [diff] [blame] | 140 | |
Jorge Lucangeli Obes | db0bc67 | 2016-08-03 10:45:21 -0400 | [diff] [blame] | 141 | /* |
| 142 | * Note that we swap fake_main in for main - fake_main knows that it |
Elly Jones | e1749eb | 2011-10-07 13:54:59 -0400 | [diff] [blame] | 143 | * should call real_main after it's done. |
| 144 | */ |
| 145 | return real_libc_start_main.fn(fake_main, argc, ubp_av, init, fini, |
| 146 | rtld_fini, stack_end); |
Elly Jones | cd7a904 | 2011-07-22 13:56:51 -0400 | [diff] [blame] | 147 | } |