libminijail.c

/* Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
 * Use of this source code is governed by a BSD-style license that can be
 * found in the LICENSE file.
 */

#define _BSD_SOURCE
#define _GNU_SOURCE
#include <ctype.h>
#include <errno.h>
#include <grp.h>
#include <inttypes.h>
#include <limits.h>
#include <linux/capability.h>
#include <linux/securebits.h>
#include <pwd.h>
#include <sched.h>
#include <signal.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <syscall.h>
#include <sys/capability.h>
#include <sys/mount.h>
#include <sys/param.h>
#include <sys/prctl.h>
#include <sys/wait.h>
#include <syslog.h>
#include <unistd.h>

#include "libminijail.h"
#include "libsyscalls.h"
#include "libminijail-private.h"

/* Until these are reliably available in linux/prctl.h */
#ifndef PR_SET_SECCOMP_FILTER
# define PR_SECCOMP_FILTER_SYSCALL 0
# define PR_SECCOMP_FILTER_EVENT 1
# define PR_GET_SECCOMP_FILTER 35
# define PR_SET_SECCOMP_FILTER 36
# define PR_CLEAR_SECCOMP_FILTER 37
#endif

#define die(_msg, ...) do { \
	syslog(LOG_ERR, "libminijail: " _msg, ## __VA_ARGS__); \
	abort(); \
} while (0)

#define pdie(_msg, ...) \
	die(_msg ": %s", ## __VA_ARGS__, strerror(errno))

#define warn(_msg, ...) \
	syslog(LOG_WARNING, "libminijail: " _msg, ## __VA_ARGS__)

struct seccomp_filter {
	int nr;
	char *filter;
	struct seccomp_filter *next, *prev;
};

struct minijail {
	struct {
		int uid:1;
		int gid:1;
		int caps:1;
		int vfs:1;
		int pids:1;
		int seccomp:1;
		int readonly:1;
		int usergroups:1;
		int ptrace:1;
		int seccomp_filter:1;
	} flags;
	uid_t uid;
	gid_t gid;
	gid_t usergid;
	char *user;
	uint64_t caps;
	pid_t initpid;
	int filter_count;
	struct seccomp_filter *filters;
};

struct minijail *minijail_new(void)
{
	struct minijail *j = malloc(sizeof(*j));
	if (j)
		memset(j, 0, sizeof(*j));
	return j;
}

void minijail_change_uid(struct minijail *j, uid_t uid)
{
	if (uid == 0)
		die("useless change to uid 0");
	j->uid = uid;
	j->flags.uid = 1;
}

void minijail_change_gid(struct minijail *j, gid_t gid)
{
	if (gid == 0)
		die("useless change to gid 0");
	j->gid = gid;
	j->flags.gid = 1;
}

int minijail_change_user(struct minijail *j, const char *user)
{
	char *buf = NULL;
	struct passwd pw;
	struct passwd *ppw = NULL;
	ssize_t sz = sysconf(_SC_GETPW_R_SIZE_MAX);
	if (sz == -1)
		sz = 65536;	/* your guess is as good as mine... */

	/* sysconf(_SC_GETPW_R_SIZE_MAX), under glibc, is documented to return
	 * the maximum needed size of the buffer, so we don't have to search.
	 */
	buf = malloc(sz);
	if (!buf)
		return -ENOMEM;
	getpwnam_r(user, &pw, buf, sz, &ppw);
	free(buf);
	if (!ppw)
		return -errno;
	minijail_change_uid(j, ppw->pw_uid);
	j->user = strdup(user);
	if (!j->user)
		return -ENOMEM;
	j->usergid = ppw->pw_gid;
	return 0;
}

int minijail_change_group(struct minijail *j, const char *group)
{
	char *buf = NULL;
	struct group gr;
	struct group *pgr = NULL;
	ssize_t sz = sysconf(_SC_GETGR_R_SIZE_MAX);
	if (sz == -1)
		sz = 65536;	/* and mine is as good as yours, really */

	/* sysconf(_SC_GETGR_R_SIZE_MAX), under glibc, is documented to return
	 * the maximum needed size of the buffer, so we don't have to search.
	 */
	buf = malloc(sz);
	if (!buf)
		return -ENOMEM;
	getgrnam_r(group, &gr, buf, sz, &pgr);
	free(buf);
	if (!pgr)
		return -errno;
	minijail_change_gid(j, pgr->gr_gid);
	return 0;
}

void minijail_use_seccomp(struct minijail *j)
{
	j->flags.seccomp = 1;
}

void minijail_use_seccomp_filter(struct minijail *j)
{
	j->flags.seccomp_filter = 1;
}

void minijail_use_caps(struct minijail *j, uint64_t capmask)
{
	j->caps = capmask;
	j->flags.caps = 1;
}

void minijail_namespace_vfs(struct minijail *j)
{
	j->flags.vfs = 1;
}

void minijail_namespace_pids(struct minijail *j)
{
	j->flags.pids = 1;
}

void minijail_remount_readonly(struct minijail *j)
{
	j->flags.vfs = 1;
	j->flags.readonly = 1;
}

void minijail_inherit_usergroups(struct minijail *j)
{
	j->flags.usergroups = 1;
}

void minijail_disable_ptrace(struct minijail *j)
{
	j->flags.ptrace = 1;
}

int minijail_add_seccomp_filter(struct minijail *j, int nr, const char *filter)
{
	struct seccomp_filter *sf;
	if (!filter || nr < 0)
		return -EINVAL;

	sf = malloc(sizeof(*sf));
	if (!sf)
		return -ENOMEM;
	sf->nr = nr;
	sf->filter = strndup(filter, MINIJAIL_MAX_SECCOMP_FILTER_LINE);
	if (!sf->filter) {
		free(sf);
		return -ENOMEM;
	}

	j->filter_count++;

	if (!j->filters) {
		j->filters = sf;
		sf->next = sf;
		sf->prev = sf;
		return 0;
	}
	sf->next = j->filters;
	sf->prev = j->filters->prev;
	sf->prev->next = sf;
	j->filters->prev = sf;
	return 0;
}

int minijail_lookup_syscall(const char *name)
{
	const struct syscall_entry *entry = syscall_table;
	for (; entry->name && entry->nr >= 0; ++entry)
		if (!strcmp(entry->name, name))
			return entry->nr;
	return -1;
}

static char *strip(char *s)
{
	char *end;
	while (*s && isblank(*s))
		s++;
	end = s + strlen(s) - 1;
	while (*end && (isblank(*end) || *end == '\n'))
		end--;
	*(end + 1) = '\0';
	return s;
}

void minijail_parse_seccomp_filters(struct minijail *j, const char *path)
{
	FILE *file = fopen(path, "r");
	char line[MINIJAIL_MAX_SECCOMP_FILTER_LINE];
	int count = 1;
	if (!file)
		pdie("failed to open seccomp filters file");

	/* Format is simple:
	 * syscall_name<COLON><FILTER STRING>[\n|EOF]
	 * #...comment...
	 * <empty line?
	 */
	while (fgets(line, sizeof(line), file)) {
		char *filter = line;
		char *name = strsep(&filter, ":");
		char *name_end = NULL;
		int nr = -1;

		if (!name)
			die("invalid filter on line %d", count);

		name = strip(name);

		if (!filter) {
			if (strlen(name))
				die("invalid filter on line %d", count);
			/* Allow empty lines */
			continue;
		}

		/* Allow comment lines */
		if (*name == '#')
			continue;

		filter = strip(filter);

		/* Take direct syscall numbers */
		nr = strtol(name, &name_end, 0);
		/* Or fail-over to using names */
		if (*name_end != '\0')
			nr = minijail_lookup_syscall(name);
		if (nr < 0)
			die("syscall '%s' unknown", name);

		if (minijail_add_seccomp_filter(j, nr, filter))
			pdie("failed to add filter for syscall '%s'", name);
	}
	fclose(file);
}

struct marshal_state {
	size_t available;
	size_t total;
	char *buf;
};

static void marshal_state_init(struct marshal_state *state,
			       char *buf, size_t available)
{
	state->available = available;
	state->buf = buf;
	state->total = 0;
}

static void marshal_append(struct marshal_state *state,
			   char *src, size_t length)
{
	size_t copy_len = MIN(state->available, length);

	/* Up to |available| will be written. */
	if (copy_len) {
		memcpy(state->buf, src, copy_len);
		state->buf += copy_len;
		state->available -= copy_len;
	}
	/* |total| will contain the expected length. */
	state->total += length;
}

static void minijail_marshal_helper(struct marshal_state *state,
				    const struct minijail *j)
{
	marshal_append(state, (char *)j, sizeof(*j));
	if (j->user)
		marshal_append(state, j->user, strlen(j->user) + 1);
	if (j->flags.seccomp_filter && j->filters) {
		struct seccomp_filter *f = j->filters;
		do {
			marshal_append(state, (char *)&f->nr, sizeof(f->nr));
			marshal_append(state, f->filter, strlen(f->filter) + 1);
			f = f->next;
		} while (f != j->filters);
	}
}

size_t minijail_size(const struct minijail *j)
{
	struct marshal_state state;
	marshal_state_init(&state, NULL, 0);
	minijail_marshal_helper(&state, j);
	return state.total;
}

int minijail_marshal(const struct minijail *j, char *buf, size_t available)
{
	struct marshal_state state;
	marshal_state_init(&state, buf, available);
	minijail_marshal_helper(&state, j);
	return (state.total > available);
}

int minijail_unmarshal(struct minijail *j, char *serialized, size_t length)
{
	if (length < sizeof(*j))
		return -EINVAL;
	memcpy((void *)j, serialized, sizeof(*j));
	serialized += sizeof(*j);
	length -= sizeof(*j);

	if (j->user) {		/* stale pointer */
		if (!length)
			return -EINVAL;
		j->user = strndup(serialized, length);
		length -= strlen(j->user) + 1;
		serialized += strlen(j->user) + 1;
	}

	if (j->flags.seccomp_filter && j->filter_count) {
		int count = j->filter_count;
		/* Let add_seccomp_filter recompute the value. */
		j->filter_count = 0;
		j->filters = NULL;	/* Don't follow the stale pointer. */
		for (; count > 0; --count) {
			int *nr = (int *)serialized;
			char *filter;
			if (length < sizeof(*nr))
				return -EINVAL;
			length -= sizeof(*nr);
			serialized += sizeof(*nr);
			if (!length)
				return -EINVAL;
			filter = serialized;
			if (minijail_add_seccomp_filter(j, *nr, filter))
				return -EINVAL;
			length -= strlen(filter) + 1;
			serialized += strlen(filter) + 1;
		}
	}
	return 0;
}

void minijail_preenter(struct minijail *j)
{
	/* Strip out options which are minijail_run() only. */
	j->flags.vfs = 0;
	j->flags.readonly = 0;
	j->flags.pids = 0;
}

void minijail_preexec(struct minijail *j)
{
	int vfs = j->flags.vfs;
	int readonly = j->flags.readonly;
	if (j->user)
		free(j->user);
	j->user = NULL;
	memset(&j->flags, 0, sizeof(j->flags));
	/* Now restore anything we meant to keep. */
	j->flags.vfs = vfs;
	j->flags.readonly = readonly;
	/* Note, pidns will already have been used before this call. */
}

static int remount_readonly(void)
{
	const char *kProcPath = "/proc";
	const unsigned int kSafeFlags = MS_NODEV | MS_NOEXEC | MS_NOSUID;
	/* Right now, we're holding a reference to our parent's old mount of
	 * /proc in our namespace, which means using MS_REMOUNT here would
	 * mutate our parent's mount as well, even though we're in a VFS
	 * namespace (!). Instead, remove their mount from our namespace
	 * and make our own.
	 */
	if (umount(kProcPath))
		return -errno;
	if (mount("", kProcPath, "proc", kSafeFlags | MS_RDONLY, ""))
		return -errno;
	return 0;
}

static void drop_caps(const struct minijail *j)
{
	cap_t caps = cap_get_proc();
	cap_value_t raise_flag[1];
	unsigned int i;
	if (!caps)
		die("can't get process caps");
	if (cap_clear_flag(caps, CAP_INHERITABLE))
		die("can't clear inheritable caps");
	if (cap_clear_flag(caps, CAP_EFFECTIVE))
		die("can't clear effective caps");
	if (cap_clear_flag(caps, CAP_PERMITTED))
		die("can't clear permitted caps");
	for (i = 0; i < sizeof(j->caps) * 8 && cap_valid((int)i); ++i) {
		if (i != CAP_SETPCAP && !(j->caps & (1 << i)))
			continue;
		raise_flag[0] = i;
		if (cap_set_flag(caps, CAP_EFFECTIVE, 1, raise_flag, CAP_SET))
			die("can't add effective cap");
		if (cap_set_flag(caps, CAP_PERMITTED, 1, raise_flag, CAP_SET))
			die("can't add permitted cap");
		if (cap_set_flag(caps, CAP_INHERITABLE, 1, raise_flag, CAP_SET))
			die("can't add inheritable cap");
	}
	if (cap_set_proc(caps))
		die("can't apply cleaned capset");
	cap_free(caps);
	for (i = 0; i < sizeof(j->caps) * 8 && cap_valid((int)i); ++i) {
		if (j->caps & (1 << i))
			continue;
		if (prctl(PR_CAPBSET_DROP, i))
			pdie("prctl(PR_CAPBSET_DROP)");
	}
}

static int setup_seccomp_filters(const struct minijail *j)
{
	const struct seccomp_filter *sf = j->filters;
	int ret = 0;
	int broaden = 0;

	/* No filters installed isn't necessarily an error. */
	if (!sf)
		return ret;

	do {
		errno = 0;
		ret = prctl(PR_SET_SECCOMP_FILTER, PR_SECCOMP_FILTER_SYSCALL,
			    sf->nr, broaden ? "1" : sf->filter);
		if (ret) {
			switch (errno) {
			case ENOSYS:
				/* TODO(wad) make this a config option */
				if (broaden)
					die("CONFIG_SECCOMP_FILTER is not"
					    "supported by your kernel");
				warn("missing CONFIG_FTRACE_SYSCALLS; relaxing"
				     "the filter for %d", sf->nr);
				broaden = 1;
				continue;
			case E2BIG:
				warn("seccomp filter too long: %d", sf->nr);
				pdie("filter too long");
			case ENOSPC:
				pdie("too many seccomp filters");
			case EPERM:
				warn("syscall filter disallowed for %d",
				     sf->nr);
				pdie("failed to install seccomp filter");
			case EINVAL:
				warn("seccomp filter or call method is"
				     " invalid. %d:'%s'", sf->nr, sf->filter);
			default:
				pdie("failed to install seccomp filter");
			}
		}
		sf = sf->next;
		broaden = 0;
	} while (sf != j->filters);
	return ret;
}

void minijail_enter(const struct minijail *j)
{
	if (j->flags.pids)
		die("tried to enter a pid-namespaced jail;"
		    "try minijail_run()?");

	if (j->flags.seccomp_filter && setup_seccomp_filters(j))
		pdie("failed to configure seccomp filters");

	if (j->flags.usergroups && !j->user)
		die("usergroup inheritance without username");

	/* We can't recover from failures if we've dropped privileges partially,
	 * so we don't even try. If any of our operations fail, we abort() the
	 * entire process.
	 */
	if (j->flags.vfs && unshare(CLONE_NEWNS))
		pdie("unshare");

	if (j->flags.readonly && remount_readonly())
		pdie("remount");

	if (j->flags.caps) {
		/* POSIX capabilities are a bit tricky. If we drop our
		 * capability to change uids, our attempt to use setuid()
		 * below will fail. Hang on to root caps across setuid(), then
		 * lock securebits.
		 */
		if (prctl(PR_SET_KEEPCAPS, 1))
			pdie("prctl(PR_SET_KEEPCAPS)");
		if (prctl
		    (PR_SET_SECUREBITS, SECURE_ALL_BITS | SECURE_ALL_LOCKS))
			pdie("prctl(PR_SET_SECUREBITS)");
	}

	if (j->flags.usergroups) {
		if (initgroups(j->user, j->usergid))
			pdie("initgroups");
	} else {
		/* Only attempt to clear supplemental groups if we are changing
		 * users. */
		if ((j->uid || j->gid) && setgroups(0, NULL))
			pdie("setgroups");
	}

	if (j->flags.gid && setresgid(j->gid, j->gid, j->gid))
		pdie("setresgid");

	if (j->flags.uid && setresuid(j->uid, j->uid, j->uid))
		pdie("setresuid");

	if (j->flags.caps)
		drop_caps(j);

	/* seccomp has to come last since it cuts off all the other
	 * privilege-dropping syscalls :)
	 */
	if (j->flags.seccomp_filter && prctl(PR_SET_SECCOMP, 13))
		pdie("prctl(PR_SET_SECCOMP, 13)");

	if (j->flags.seccomp && prctl(PR_SET_SECCOMP, 1))
		pdie("prctl(PR_SET_SECCOMP)");
}

static int init_exitstatus = 0;

static void init_term(int __attribute__ ((unused)) sig)
{
	_exit(init_exitstatus);
}

static int init(pid_t rootpid)
{
	pid_t pid;
	int status;
	/* so that we exit with the right status */
	signal(SIGTERM, init_term);
	/* TODO(wad) self jail with seccomp_filters here. */
	while ((pid = wait(&status)) > 0) {
		/* This loop will only end when either there are no processes
		 * left inside our pid namespace or we get a signal.
		 */
		if (pid == rootpid)
			init_exitstatus = status;
	}
	if (!WIFEXITED(init_exitstatus))
		_exit(MINIJAIL_ERR_INIT);
	_exit(WEXITSTATUS(init_exitstatus));
}

int minijail_from_fd(int fd, struct minijail *j)
{
	size_t sz = 0;
	size_t bytes = read(fd, &sz, sizeof(sz));
	char *buf;
	int r;
	if (sizeof(sz) != bytes)
		return -EINVAL;
	if (sz > USHRT_MAX)	/* Arbitrary sanity check */
		return -E2BIG;
	buf = malloc(sz);
	if (!buf)
		return -ENOMEM;
	bytes = read(fd, buf, sz);
	if (bytes != sz) {
		free(buf);
		return -EINVAL;
	}
	r = minijail_unmarshal(j, buf, sz);
	free(buf);
	return r;
}

int minijail_to_fd(struct minijail *j, int fd)
{
	char *buf;
	size_t sz = minijail_size(j);
	ssize_t written;
	int r;

	if (!sz)
		return -EINVAL;
	buf = malloc(sz);
	r = minijail_marshal(j, buf, sz);
	if (r) {
		free(buf);
		return r;
	}
	/* Sends [size][minijail]. */
	written = write(fd, &sz, sizeof(sz));
	if (written != sizeof(sz)) {
		free(buf);
		return -EFAULT;
	}
	written = write(fd, buf, sz);
	if (written < 0 || (size_t) written != sz) {
		free(buf);
		return -EFAULT;
	}
	free(buf);
	return 0;
}

static int setup_preload(void)
{
	char *oldenv = getenv(kLdPreloadEnvVar) ? : "";
	char *newenv = malloc(strlen(oldenv) + 2 + strlen(PRELOADPATH));
	if (!newenv)
		return -ENOMEM;

	/* Only insert a separating space if we have something to separate... */
	sprintf(newenv, "%s%s%s", oldenv, strlen(oldenv) ? " " : "",
		PRELOADPATH);

	/* setenv() makes a copy of the string we give it */
	setenv(kLdPreloadEnvVar, newenv, 1);
	free(newenv);
	return 0;
}

static int setup_pipe(int fds[2])
{
	int r = pipe(fds);
	char fd_buf[11];
	if (r)
		return r;
	r = snprintf(fd_buf, sizeof(fd_buf), "%d", fds[0]);
	if (r <= 0)
		return -EINVAL;
	setenv(kFdEnvVar, fd_buf, 1);
	return 0;
}

int minijail_run(struct minijail *j, const char *filename, char *const argv[])
{
	unsigned int pidns = j->flags.pids ? CLONE_NEWPID : 0;
	char *oldenv, *oldenv_copy = NULL;
	pid_t child_pid;
	int pipe_fds[2];
	int ret;

	oldenv = getenv(kLdPreloadEnvVar);
	if (oldenv) {
		oldenv_copy = strdup(oldenv);
		if (!oldenv_copy)
			return -ENOMEM;
	}

	if (setup_preload())
		return -EFAULT;

	/* Before we fork(2) and execve(2) the child process, we need to open
	 * a pipe(2) to send the minijail configuration over.
	 */
	if (setup_pipe(pipe_fds))
		return -EFAULT;

	child_pid = syscall(SYS_clone, pidns | SIGCHLD, NULL);
	if (child_pid < 0) {
		free(oldenv_copy);
		return child_pid;
	}

	if (child_pid) {
		/* Restore parent's LD_PRELOAD. */
		if (oldenv_copy) {
			setenv(kLdPreloadEnvVar, oldenv_copy, 1);
			free(oldenv_copy);
		} else {
			unsetenv(kLdPreloadEnvVar);
		}
		unsetenv(kFdEnvVar);
		j->initpid = child_pid;
		close(pipe_fds[0]);	/* read endpoint */
		ret = minijail_to_fd(j, pipe_fds[1]);
		close(pipe_fds[1]);	/* write endpoint */
		if (ret) {
			kill(j->initpid, SIGKILL);
			die("failed to send marshalled minijail");
		}
		return 0;
	}
	free(oldenv_copy);

	/* Drop everything that cannot be inherited across execve. */
	minijail_preexec(j);
	/* Jail this process and its descendants... */
	minijail_enter(j);

	if (pidns) {
		/* pid namespace: this process will become init inside the new
		 * namespace, so fork off a child to actually run the program
		 * (we don't want all programs we might exec to have to know
		 * how to be init).
		 */
		child_pid = fork();
		if (child_pid < 0)
			_exit(child_pid);
		else if (child_pid > 0)
			init(child_pid);	/* never returns */
	}

	/* If we aren't pid-namespaced:
	 *   calling process
	 *   -> execve()-ing process
	 * If we are:
	 *   calling process
	 *   -> init()-ing process
	 *      -> execve()-ing process
	 */
	_exit(execve(filename, argv, environ));
}

int minijail_kill(struct minijail *j)
{
	int st;
	if (kill(j->initpid, SIGTERM))
		return -errno;
	if (waitpid(j->initpid, &st, 0) < 0)
		return -errno;
	return st;
}

int minijail_wait(struct minijail *j)
{
	int st;
	if (waitpid(j->initpid, &st, 0) < 0)
		return -errno;
	if (!WIFEXITED(st))
		return MINIJAIL_ERR_JAIL;
	return WEXITSTATUS(st);
}

void minijail_destroy(struct minijail *j)
{
	struct seccomp_filter *f = j->filters;
	/* Unlink the tail and head */
	if (f)
		f->prev->next = NULL;
	while (f) {
		struct seccomp_filter *next = f->next;
		free(f->filter);
		free(f);
		f = next;
	}
	if (j->user)
		free(j->user);
	free(j);
}