[OpenWrt-Devel] [PATCH procd 2/2] ujail: rework file dependencies detection (use ldd)
Etienne CHAMPETIER
champetier.etienne at gmail.com
Fri Nov 20 18:05:09 EST 2015
Using ldd (via popen()) is a hack, but it's simpler (and working)
we have 3 libc and many archs, too many ways to resolve .so
Current code:
-do not parse the intepreter (PT_INTERP) part of the elf
-do not get the library path priority right (/lib64 is before /lib,
musl take the libs in /lib even on 64bits images)
-do not handle RPATH
This patch:
-use ldd to detect ELF dependencies
-add support for shell script
uClibc ldd doesn't work with shared lib, thus this patch break
seccomp with uClibc
Signed-off-by: Etienne CHAMPETIER <champetier.etienne at gmail.com>
---
CMakeLists.txt | 2 +-
jail/deps.c | 198 ++++++++++++++++++++++++++++++++
jail/deps.h | 23 ++++
jail/elf.c | 355 ---------------------------------------------------------
jail/elf.h | 38 ------
jail/jail.c | 138 +++++++---------------
jail/jail.h | 18 +++
7 files changed, 284 insertions(+), 488 deletions(-)
create mode 100644 jail/deps.c
create mode 100644 jail/deps.h
delete mode 100644 jail/elf.c
delete mode 100644 jail/elf.h
create mode 100644 jail/jail.h
diff --git a/CMakeLists.txt b/CMakeLists.txt
index d749c25..8e3f7ea 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -87,7 +87,7 @@ ADD_DEPENDENCIES(preload-seccomp syscall-names-h)
endif()
IF(JAIL_SUPPORT)
-ADD_EXECUTABLE(ujail jail/jail.c jail/elf.c jail/capabilities.c)
+ADD_EXECUTABLE(ujail jail/jail.c jail/deps.c jail/capabilities.c)
TARGET_LINK_LIBRARIES(ujail ubox blobmsg_json)
INSTALL(TARGETS ujail
RUNTIME DESTINATION ${CMAKE_INSTALL_SBINDIR}
diff --git a/jail/deps.c b/jail/deps.c
new file mode 100644
index 0000000..0141cef
--- /dev/null
+++ b/jail/deps.c
@@ -0,0 +1,198 @@
+/*
+ * Copyright (C) 2015 John Crispin <blogic at openwrt.org>
+ * Copyright (C) 2015 Etienne Champetier <champetier.etienne at gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License version 2.1
+ * as published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+
+#define _GNU_SOURCE
+
+#include <assert.h>
+#include <elf.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <libgen.h>
+#include <linux/limits.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/mount.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#include <libubox/avl.h>
+#include <libubox/avl-cmp.h>
+
+#include "deps.h"
+#include "log.h"
+#include "jail.h"
+
+struct mount {
+ struct avl_node avl;
+ const char *path;
+ int readonly;
+ int error;
+};
+
+struct avl_tree mounts;
+
+static int add_mount(const char *path, int readonly, int error)
+{
+ if (avl_find(&mounts, path))
+ return 1;
+
+ struct mount *m;
+ m = calloc(1, sizeof(struct mount));
+ assert(m != NULL);
+ m->avl.key = m->path = strdup(path);
+ m->readonly = readonly;
+ m->error = error;
+
+ avl_insert(&mounts, &m->avl);
+ DEBUG("adding mount %s ro(%d) err(%d)\n", m->path, m->readonly, m->error != 0);
+ return 0;
+}
+
+int add_mount_if_exists(const char *path, int readonly, int error) {
+ struct stat s;
+ if (stat(path, &s) == -1) {
+ DEBUG("%s doesn't exist\n", path);
+ return -1;
+ }
+ return add_mount(path, readonly, error);
+}
+
+int mount_all(const char *jailroot) {
+ struct mount *m;
+ avl_for_each_element(&mounts, m, avl)
+ if (mount_bind(jailroot, m->path, m->readonly, m->error))
+ return -1;
+
+ return 0;
+}
+
+void mount_list_init() {
+ avl_init(&mounts, avl_strcmp, false, NULL);
+}
+
+//we already read 2 char from f (#!)
+static int add_script_deps(FILE *f, const char *path, int readonly, int error)
+{
+ char buf[PATH_MAX];
+ int i = 0;
+ int c;
+ while ((c = fgetc(f)) != EOF) {
+ if (i == 0 && c != '/')
+ continue;
+ if (c <= 0x20 || c > 0x7e)
+ break;
+ buf[i] = c;
+ i++;
+ if (i >= sizeof(buf)) {
+ ERROR("script interpretor too long (%s)\n", path);
+ return -1;
+ }
+ }
+ buf[i] = '\0';
+ return add_path_and_deps(buf, readonly, error);
+}
+
+static int add_elf_deps(const char *path, int readonly, int error)
+{
+ char buf[PATH_MAX];
+ int nb = snprintf(buf, sizeof(buf), "ldd %s", path);
+ assert(nb >= 0);
+
+ FILE *f = popen(buf, "r");
+ char c;
+ int i = 0;
+ while (((c = fgetc(f)) != EOF)) {
+ if (i == 0 && c != '/') {
+ continue;
+ } else if (i > 0 && (c <= ' ' || c > '~')) {
+ buf[i] = '\0';
+ add_mount(buf, readonly, error);
+ i = 0;
+ } else if (i > 0 || c == '/') {
+ buf[i] = c;
+ i++;
+ }
+
+ if (i >= sizeof(buf)) {
+ ERROR("shared lib too long (%s)\n", path);
+ return -1;
+ }
+ }
+ pclose(f);
+ return 0;
+}
+
+int add_path_and_deps(const char *path, int readonly, int error)
+{
+ assert(path != NULL);
+
+ if (path[0] != '/') {
+ ERROR("only absolute path are supported (%s)\n", path);
+ return error;
+ }
+
+ struct stat s;
+ if (stat(path, &s) == -1) {
+ ERROR("stat(%s) failed: %s\n", path, strerror(errno));
+ return error;
+ }
+
+ //path already in list
+ if (add_mount(path, readonly, error) == 1)
+ return 0;
+
+ if (!S_ISREG(s.st_mode))
+ return 0;
+
+ //too small to be an ELF or a script
+ if (s.st_size < 4)
+ return 0;
+
+ FILE *f;
+ if ((f = fopen(path, "r")) == NULL) {
+ ERROR("fopen(%s) failed: %s\n", path, strerror(errno));
+ return error;
+ }
+
+ int ret = 0;
+ int c = fgetc(f);
+ switch(c) {
+ //script ?
+ case '#':
+ c = fgetc(f);
+ if (c != '!') {
+ goto out;
+ }
+ //this is a script
+ ret = add_script_deps(f, path, readonly, error);
+ goto out;
+ //elf ?
+ case ELFMAG0:
+ if ((c = fgetc(f)) != ELFMAG1
+ || (c = fgetc(f)) != ELFMAG2
+ || (c = fgetc(f)) != ELFMAG3) {
+ goto out;
+ }
+ ret = add_elf_deps(path, readonly, error);
+ goto out;
+ }
+out:
+ if (f != NULL)
+ fclose(f);
+
+ return ret;
+}
+
diff --git a/jail/deps.h b/jail/deps.h
new file mode 100644
index 0000000..da2a914
--- /dev/null
+++ b/jail/deps.h
@@ -0,0 +1,23 @@
+/*
+ * Copyright (C) 2015 Etienne Champetier <champetier.etienne at gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License version 2.1
+ * as published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+
+#ifndef _DEPS_H__
+
+#include "log.h"
+
+int add_mount_if_exists(const char *path, int readonly, int error);
+int add_path_and_deps(const char *path, int readonly, int error);
+int mount_all(const char *jailroot);
+void mount_list_init();
+
+#endif
diff --git a/jail/elf.c b/jail/elf.c
deleted file mode 100644
index cbb3051..0000000
--- a/jail/elf.c
+++ /dev/null
@@ -1,355 +0,0 @@
-/*
- * Copyright (C) 2015 John Crispin <blogic at openwrt.org>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License version 2.1
- * as published by the Free Software Foundation
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- */
-
-#define _GNU_SOURCE
-#include <sys/mman.h>
-
-#include <stdlib.h>
-#include <unistd.h>
-#include <stdio.h>
-#include <string.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-#include <libgen.h>
-#include <glob.h>
-#include <elf.h>
-
-#include <libubox/utils.h>
-
-#include "elf.h"
-
-struct avl_tree libraries;
-static LIST_HEAD(library_paths);
-
-void alloc_library_path(const char *path)
-{
- struct library_path *p;
- char *_path;
-
- p = calloc_a(sizeof(*p),
- &_path, strlen(path) + 1);
- if (!p)
- return;
-
- p->path = strcpy(_path, path);
-
- list_add_tail(&p->list, &library_paths);
- DEBUG("adding ld.so path %s\n", path);
-}
-
-static void alloc_library(const char *path, const char *name)
-{
- struct library *l;
- char *_name, *_path;
-
- l = calloc_a(sizeof(*l),
- &_path, strlen(path) + 1,
- &_name, strlen(name) + 1);
- if (!l)
- return;
-
- l->avl.key = l->name = strcpy(_name, name);
- l->path = strcpy(_path, path);
-
- avl_insert(&libraries, &l->avl);
- DEBUG("adding library %s/%s\n", path, name);
-}
-
-static int elf_open(char **dir, char *file)
-{
- struct library_path *p;
- char path[256];
- int fd = -1;
-
- *dir = NULL;
-
- list_for_each_entry(p, &library_paths, list) {
- if (strlen(p->path))
- snprintf(path, sizeof(path), "%s/%s", p->path, file);
- else
- strncpy(path, file, sizeof(path));
- fd = open(path, O_RDONLY);
- if (fd >= 0) {
- *dir = p->path;
- break;
- }
- }
-
- if (fd == -1)
- fd = open(file, O_RDONLY);
-
- return fd;
-}
-
-char* find_lib(char *file)
-{
- struct library *l;
- static char path[256];
- const char *p;
-
- l = avl_find_element(&libraries, file, l, avl);
- if (!l)
- return NULL;
-
- p = l->path;
- if (strstr(p, "local"))
- p = "/lib";
-
- snprintf(path, sizeof(path), "%s/%s", p, file);
-
- return path;
-}
-
-static int elf64_find_section(char *map, unsigned int type, unsigned int *offset, unsigned int *size, unsigned int *vaddr)
-{
- Elf64_Ehdr *e;
- Elf64_Phdr *ph;
- int i;
-
- e = (Elf64_Ehdr *) map;
- ph = (Elf64_Phdr *) (map + e->e_phoff);
-
- for (i = 0; i < e->e_phnum; i++) {
- if (ph[i].p_type == type) {
- *offset = ph[i].p_offset;
- if (size)
- *size = ph[i].p_filesz;
- if (vaddr)
- *vaddr = ph[i].p_vaddr;
- return 0;
- }
- }
-
- return -1;
-}
-
-static int elf32_find_section(char *map, unsigned int type, unsigned int *offset, unsigned int *size, unsigned int *vaddr)
-{
- Elf32_Ehdr *e;
- Elf32_Phdr *ph;
- int i;
-
- e = (Elf32_Ehdr *) map;
- ph = (Elf32_Phdr *) (map + e->e_phoff);
-
- for (i = 0; i < e->e_phnum; i++) {
- if (ph[i].p_type == type) {
- *offset = ph[i].p_offset;
- if (size)
- *size = ph[i].p_filesz;
- if (vaddr)
- *vaddr = ph[i].p_vaddr;
- return 0;
- }
- }
-
- return -1;
-}
-
-static int elf_find_section(char *map, unsigned int type, unsigned int *offset, unsigned int *size, unsigned int *vaddr)
-{
- int clazz = map[EI_CLASS];
-
- if (clazz == ELFCLASS32)
- return elf32_find_section(map, type, offset, size, vaddr);
- else if (clazz == ELFCLASS64)
- return elf64_find_section(map, type, offset, size, vaddr);
-
- ERROR("unknown elf format %d\n", clazz);
-
- return -1;
-}
-
-static int elf32_scan_dynamic(char *map, int dyn_offset, int dyn_size, int load_offset)
-{
- Elf32_Dyn *dynamic = (Elf32_Dyn *) (map + dyn_offset);
- char *strtab = NULL;
-
- while ((void *) dynamic < (void *) (map + dyn_offset + dyn_size)) {
- Elf32_Dyn *curr = dynamic;
-
- dynamic++;
- if (curr->d_tag != DT_STRTAB)
- continue;
-
- strtab = map + (curr->d_un.d_val - load_offset);
- break;
- }
-
- if (!strtab)
- return -1;
-
- dynamic = (Elf32_Dyn *) (map + dyn_offset);
- while ((void *) dynamic < (void *) (map + dyn_offset + dyn_size)) {
- Elf32_Dyn *curr = dynamic;
-
- dynamic++;
- if (curr->d_tag != DT_NEEDED)
- continue;
-
- if (elf_load_deps(&strtab[curr->d_un.d_val]))
- return -1;
- }
-
- return 0;
-}
-
-static int elf64_scan_dynamic(char *map, int dyn_offset, int dyn_size, int load_offset)
-{
- Elf64_Dyn *dynamic = (Elf64_Dyn *) (map + dyn_offset);
- char *strtab = NULL;
-
- while ((void *) dynamic < (void *) (map + dyn_offset + dyn_size)) {
- Elf64_Dyn *curr = dynamic;
-
- dynamic++;
- if (curr->d_tag != DT_STRTAB)
- continue;
-
- strtab = map + (curr->d_un.d_val - load_offset);
- break;
- }
-
- if (!strtab)
- return -1;
-
- dynamic = (Elf64_Dyn *) (map + dyn_offset);
- while ((void *) dynamic < (void *) (map + dyn_offset + dyn_size)) {
- Elf64_Dyn *curr = dynamic;
-
- dynamic++;
- if (curr->d_tag != DT_NEEDED)
- continue;
-
- if (elf_load_deps(&strtab[curr->d_un.d_val]))
- return -1;
- }
-
- return 0;
-}
-
-int elf_load_deps(char *library)
-{
- unsigned int dyn_offset, dyn_size;
- unsigned int load_offset, load_vaddr;
- struct stat s;
- char *map = NULL, *dir = NULL;
- int clazz, fd, ret = -1;
-
- if (avl_find(&libraries, library))
- return 0;
-
- fd = elf_open(&dir, library);
-
- if (fd < 0) {
- ERROR("failed to open %s\n", library);
- return -1;
- }
-
- if (fstat(fd, &s) == -1) {
- ERROR("failed to stat %s\n", library);
- ret = -1;
- goto err_out;
- }
-
- map = mmap(NULL, s.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
- if (map == MAP_FAILED) {
- ERROR("failed to mmap %s\n", library);
- ret = -1;
- goto err_out;
- }
-
- if (elf_find_section(map, PT_LOAD, &load_offset, NULL, &load_vaddr)) {
- ERROR("failed to load the .load section from %s\n", library);
- ret = -1;
- goto err_out;
- }
-
- if (elf_find_section(map, PT_DYNAMIC, &dyn_offset, &dyn_size, NULL)) {
- ERROR("failed to load the .dynamic section from %s\n", library);
- ret = -1;
- goto err_out;
- }
-
- if (dir) {
- alloc_library(dir, library);
- } else {
- char *elf = strdup(library);
-
- alloc_library(dirname(elf), basename(library));
- free(elf);
- }
- clazz = map[EI_CLASS];
-
- if (clazz == ELFCLASS32)
- ret = elf32_scan_dynamic(map, dyn_offset, dyn_size, load_vaddr - load_offset);
- else if (clazz == ELFCLASS64)
- ret = elf64_scan_dynamic(map, dyn_offset, dyn_size, load_vaddr - load_offset);
-
-err_out:
- if (map)
- munmap(map, s.st_size);
- close(fd);
-
- return ret;
-}
-
-void load_ldso_conf(const char *conf)
-{
- FILE* fp = fopen(conf, "r");
- char line[256];
-
- if (!fp) {
- DEBUG("failed to open %s\n", conf);
- return;
- }
-
- while (!feof(fp)) {
- int len;
-
- if (!fgets(line, 256, fp))
- break;
- len = strlen(line);
- if (len < 2)
- continue;
- if (*line == '#')
- continue;
- if (line[len - 1] == '\n')
- line[len - 1] = '\0';
- if (!strncmp(line, "include ", 8)) {
- char *sep = strstr(line, " ");
- glob_t gl;
- int i;
-
- if (!sep)
- continue;;
- while (*sep == ' ')
- sep++;
- if (glob(sep, GLOB_NOESCAPE | GLOB_MARK, NULL, &gl)) {
- ERROR("glob failed on %s\n", sep);
- continue;
- }
- for (i = 0; i < gl.gl_pathc; i++)
- load_ldso_conf(gl.gl_pathv[i]);
- globfree(&gl);
- } else {
- struct stat s;
-
- if (stat(line, &s))
- continue;
- alloc_library_path(line);
- }
- }
-
- fclose(fp);
-}
diff --git a/jail/elf.h b/jail/elf.h
deleted file mode 100644
index 3ae311e..0000000
--- a/jail/elf.h
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- * Copyright (C) 2015 John Crispin <blogic at openwrt.org>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License version 2.1
- * as published by the Free Software Foundation
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- */
-
-#ifndef _ELF_H__
-#include <libubox/avl.h>
-#include <libubox/avl-cmp.h>
-
-#include "log.h"
-
-struct library {
- struct avl_node avl;
- char *name;
- char *path;
-};
-
-struct library_path {
- struct list_head list;
- char *path;
-};
-
-extern struct avl_tree libraries;
-
-extern void alloc_library_path(const char *path);
-extern char* find_lib(char *file);
-extern int elf_load_deps(char *library);
-extern void load_ldso_conf(const char *conf);
-
-#endif
diff --git a/jail/jail.c b/jail/jail.c
index 08babde..391c196 100644
--- a/jail/jail.c
+++ b/jail/jail.c
@@ -12,27 +12,28 @@
*/
#define _GNU_SOURCE
-#include <sys/mount.h>
-#include <sys/prctl.h>
-#include <sys/wait.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <values.h>
#include <errno.h>
-#include <stdio.h>
-#include <string.h>
-#include <sys/stat.h>
#include <fcntl.h>
#include <libgen.h>
+#include <linux/limits.h>
#include <sched.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/mount.h>
+#include <sys/prctl.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+#include <unistd.h>
-#include "elf.h"
-#include "capabilities.h"
-
-#include <libubox/list.h>
#include <libubox/uloop.h>
+#include "capabilities.h"
+#include "deps.h"
+#include "jail.h"
+#include "log.h"
+
#define STACK_SIZE (1024 * 1024)
#define OPT_ARGS "P:S:C:n:r:w:d:psulo"
@@ -48,16 +49,6 @@ static struct {
int sysfs;
} opts;
-struct extra {
- struct list_head list;
-
- const char *path;
- const char *name;
- int readonly;
-};
-
-static LIST_HEAD(extras);
-
extern int pivot_root(const char *new_root, const char *put_old);
int debug = 0;
@@ -89,42 +80,34 @@ static int mkdir_p(char *dir, mode_t mask)
return ret;
}
-static int mount_bind(const char *root, const char *path, const char *name, int readonly, int error)
+int mount_bind(const char *root, const char *path, int readonly, int error)
{
- const char *p = path;
struct stat s;
- char old[256];
- char new[256];
+ char new[PATH_MAX];
int fd;
- if (strstr(p, "local"))
- p = "/lib";
-
- snprintf(old, sizeof(old), "%s/%s", path, name);
- snprintf(new, sizeof(new), "%s%s", root, p);
-
- mkdir_p(new, 0755);
-
- snprintf(new, sizeof(new), "%s%s/%s", root, p, name);
-
- if (stat(old, &s)) {
- ERROR("%s does not exist\n", old);
+ if (stat(path, &s)) {
+ ERROR("stat(%s) failed: %s\n", path, strerror(errno));
return error;
}
+ snprintf(new, sizeof(new), "%s%s", root, path);
if (S_ISDIR(s.st_mode)) {
mkdir_p(new, 0755);
} else {
+ mkdir_p(dirname(new), 0755);
+
+ snprintf(new, sizeof(new), "%s%s", root, path);
fd = creat(new, 0644);
if (fd == -1) {
- ERROR("failed to create %s: %s\n", new, strerror(errno));
+ ERROR("creat(%s) failed: %s\n", new, strerror(errno));
return -1;
}
close(fd);
}
- if (mount(old, new, NULL, MS_BIND, NULL)) {
- ERROR("failed to mount -B %s %s: %s\n", old, new, strerror(errno));
+ if (mount(path, new, NULL, MS_BIND, NULL)) {
+ ERROR("failed to mount -B %s %s: %s\n", path, new, strerror(errno));
return -1;
}
@@ -133,16 +116,14 @@ static int mount_bind(const char *root, const char *path, const char *name, int
return -1;
}
- DEBUG("mount -B %s %s\n", old, new);
+ DEBUG("mount -B %s %s\n", path, new);
return 0;
}
+#define PRELOAD_SECCOMP "/lib/libpreload-seccomp.so"
static int build_jail_fs()
{
- struct library *l;
- struct extra *m;
-
if (mount("tmpfs", opts.path, "tmpfs", MS_NOATIME, "mode=0755")) {
ERROR("tmpfs mount failed %s\n", strerror(errno));
return -1;
@@ -153,29 +134,20 @@ static int build_jail_fs()
return -1;
}
- avl_init(&libraries, avl_strcmp, false, NULL);
- alloc_library_path("/lib64");
- alloc_library_path("/lib");
- alloc_library_path("/usr/lib");
- load_ldso_conf("/etc/ld.so.conf");
+ add_mount_if_exists("/etc/ld.so.conf", 1, -1);
- if (elf_load_deps(*opts.jail_argv)) {
+ if (add_path_and_deps(*opts.jail_argv, 1, -1)) {
ERROR("failed to load dependencies\n");
return -1;
}
- if (opts.seccomp && elf_load_deps("libpreload-seccomp.so")) {
+ if (opts.seccomp && add_path_and_deps(PRELOAD_SECCOMP, 1, -1) == -1) {
ERROR("failed to load libpreload-seccomp.so\n");
return -1;
}
- avl_for_each_element(&libraries, l, avl)
- if (mount_bind(opts.path, l->path, l->name, 1, -1))
- return -1;
-
- list_for_each_entry(m, &extras, list)
- if (mount_bind(opts.path, m->path, m->name, m->readonly, 0))
- return -1;
+ if (mount_all(opts.path))
+ return -1;
char *mpoint;
if (asprintf(&mpoint, "%s/old", opts.path) < 0) {
@@ -205,24 +177,19 @@ static int build_jail_fs()
return 0;
}
-#define MAX_ENVP 8
+#define MAX_ENVP 4
+#define LD_PRELOAD_SECCOMP "LD_PRELOAD=" PRELOAD_SECCOMP
static char** build_envp(const char *seccomp)
{
static char *envp[MAX_ENVP];
- static char preload_var[64];
- static char seccomp_var[64];
+ static char seccomp_var[PATH_MAX];
+ static char preload_var[] = LD_PRELOAD_SECCOMP;
static char debug_var[] = "LD_DEBUG=all";
- char *preload_lib = find_lib("libpreload-seccomp.so");
int count = 0;
- if (seccomp && !preload_lib) {
- ERROR("failed to add preload-lib to env\n");
- return NULL;
- }
if (seccomp) {
snprintf(seccomp_var, sizeof(seccomp_var), "SECCOMP_FILE=%s", seccomp);
envp[count++] = seccomp_var;
- snprintf(preload_var, sizeof(preload_var), "LD_PRELOAD=%s", preload_lib);
envp[count++] = preload_var;
}
if (debug > 1)
@@ -279,7 +246,7 @@ static int spawn_jail()
}
if (build_jail_fs()) {
- ERROR("failed to build jail fs");
+ ERROR("failed to build jail fs\n");
exit(EXIT_FAILURE);
}
@@ -306,24 +273,6 @@ static struct uloop_process jail_process = {
.cb = jail_process_handler,
};
-static void add_extra(char *name, int readonly)
-{
- struct extra *f;
-
- if (*name != '/') {
- ERROR("%s is not an absolute path\n", name);
- return;
- }
-
- f = calloc(1, sizeof(struct extra));
-
- f->name = basename(name);
- f->path = dirname(strdup(name));
- f->readonly = readonly;
-
- list_add_tail(&f->list, &extras);
-}
-
int main(int argc, char **argv)
{
uid_t uid = getuid();
@@ -338,6 +287,7 @@ int main(int argc, char **argv)
}
umask(022);
+ mount_list_init();
while ((ch = getopt(argc, argv, OPT_ARGS)) != -1) {
switch (ch) {
@@ -358,11 +308,11 @@ int main(int argc, char **argv)
break;
case 'S':
opts.seccomp = optarg;
- add_extra(optarg, 1);
+ add_path_and_deps(optarg, 1, -1);
break;
case 'C':
opts.capabilities = optarg;
- add_extra(optarg, 1);
+ add_path_and_deps(optarg, 1, -1);
break;
case 'P':
opts.namespace = 1;
@@ -373,19 +323,19 @@ int main(int argc, char **argv)
break;
case 'r':
opts.namespace = 1;
- add_extra(optarg, 1);
+ add_path_and_deps(optarg, 1, 0);
break;
case 'w':
opts.namespace = 1;
- add_extra(optarg, 0);
+ add_path_and_deps(optarg, 0, 0);
break;
case 'u':
opts.namespace = 1;
- add_extra(ubus, 0);
+ add_path_and_deps(ubus, 0, -1);
break;
case 'l':
opts.namespace = 1;
- add_extra(log, 0);
+ add_path_and_deps(log, 0, -1);
break;
}
}
diff --git a/jail/jail.h b/jail/jail.h
new file mode 100644
index 0000000..fc69ef6
--- /dev/null
+++ b/jail/jail.h
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) 2015 Etienne Champetier <champetier.etienne at gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License version 2.1
+ * as published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+
+#ifndef _JAIL_H__
+
+int mount_bind(const char *root, const char *path, int readonly, int error);
+
+#endif
--
1.9.1
_______________________________________________
openwrt-devel mailing list
openwrt-devel at lists.openwrt.org
https://lists.openwrt.org/cgi-bin/mailman/listinfo/openwrt-devel
More information about the openwrt-devel
mailing list