[OpenWrt-Devel] [PATCH procd 2/2] ujail: rework file dependencies detection (use ldd)
Etienne Champetier
champetier.etienne at gmail.com
Sat Nov 21 06:06:05 EST 2015
Hi,
first sorry, i've forgot to add the ticket reference
https://dev.openwrt.org/ticket/20785
also full disclore, I'm only writing C for OpenWrt
so is there a compilation flag to disable C++,
or can you be more specific on what C++ ism i'm using ?
2015-11-21 9:08 GMT+01:00 John Crispin <john at phrozen.org>:
>
>
> On 21/11/2015 00:05, Etienne CHAMPETIER wrote:
> > Using ldd (via popen()) is a hack, but it's simpler (and working)
>
> indeed
>
> > we have 3 libc and many archs, too many ways to resolve .so
> where does it break ?
>
>
> > Current code:
> > -do not parse the intepreter (PT_INTERP) part of the elf
> why should it ?
>
here is the output of "objdump -x -s" on /bin/cat (subtarget x86_64 / DD)
> Dynamic Section:
> NEEDED libgcc_s.so.1
> NEEDED libc.so
> Contents of section .interp:
> /lib/ld-musl-x86_64.so.1
>
> and the output of ldd /bin/cat
> root at OpenWrt:/# ldd /bin/cat
> /lib/ld-musl-x86_64.so.1 (0x7fbe78583000)
> libgcc_s.so.1 => /lib/libgcc_s.so.1 (0x7fbe78371000)
> libc.so => /lib/ld-musl-x86_64.so.1 (0x7fbe78583000)
>
if you run "ujail -d1 -p -- /bin/cat /proc/self/mounts"
the execve() call fail with "ENOENT (No such file or directory)"
now if you add "/lib/ld-musl-x86_64.so.1" to the jail (-r), and you remove
symlink
from /lib64 to /lib, it works
the good question is why does it fails with musl/DD and work with uclibc/CC
and glibc?
> > -do not get the library path priority right (/lib64 is before /lib,
> > musl take the libs in /lib even on 64bits images)
>
> libc dependent and not procd depended
>
ujail has to resolve the same libs as the libc does,
so it depends on the libc, but it's still a ujail problem
that was my main motivation to use ldd
> > -do not handle RPATH
> >
> > This patch:
> > -use ldd to detect ELF dependencies
> > -add support for shell script
>
> elaborate that please
>
if the file start with #!, add the exec and it dependencies to the jail
>
>
> > uClibc ldd doesn't work with shared lib, thus this patch break
> > seccomp with uClibc
>
> so after you patch we can never again update procd in CC ?
>
yes
i will try to improve the current elf parsing code,
but i'm afraid that it will break depending on the arch and ...
>
> John
>
> >
> > Signed-off-by: Etienne CHAMPETIER <champetier.etienne at gmail.com>
> > ---
> > CMakeLists.txt | 2 +-
> > jail/deps.c | 198 ++++++++++++++++++++++++++++++++
> > jail/deps.h | 23 ++++
> > jail/elf.c | 355
> ---------------------------------------------------------
> > jail/elf.h | 38 ------
> > jail/jail.c | 138 +++++++---------------
> > jail/jail.h | 18 +++
> > 7 files changed, 284 insertions(+), 488 deletions(-)
> > create mode 100644 jail/deps.c
> > create mode 100644 jail/deps.h
> > delete mode 100644 jail/elf.c
> > delete mode 100644 jail/elf.h
> > create mode 100644 jail/jail.h
> >
> > diff --git a/CMakeLists.txt b/CMakeLists.txt
> > index d749c25..8e3f7ea 100644
> > --- a/CMakeLists.txt
> > +++ b/CMakeLists.txt
> > @@ -87,7 +87,7 @@ ADD_DEPENDENCIES(preload-seccomp syscall-names-h)
> > endif()
> >
> > IF(JAIL_SUPPORT)
> > -ADD_EXECUTABLE(ujail jail/jail.c jail/elf.c jail/capabilities.c)
> > +ADD_EXECUTABLE(ujail jail/jail.c jail/deps.c jail/capabilities.c)
> > TARGET_LINK_LIBRARIES(ujail ubox blobmsg_json)
> > INSTALL(TARGETS ujail
> > RUNTIME DESTINATION ${CMAKE_INSTALL_SBINDIR}
> > diff --git a/jail/deps.c b/jail/deps.c
> > new file mode 100644
> > index 0000000..0141cef
> > --- /dev/null
> > +++ b/jail/deps.c
> > @@ -0,0 +1,198 @@
> > +/*
> > + * Copyright (C) 2015 John Crispin <blogic at openwrt.org>
> > + * Copyright (C) 2015 Etienne Champetier <champetier.etienne at gmail.com>
> > + *
> > + * This program is free software; you can redistribute it and/or modify
> > + * it under the terms of the GNU Lesser General Public License version
> 2.1
> > + * as published by the Free Software Foundation
> > + *
> > + * This program is distributed in the hope that it will be useful,
> > + * but WITHOUT ANY WARRANTY; without even the implied warranty of
> > + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
> > + * GNU General Public License for more details.
> > + */
> > +
> > +#define _GNU_SOURCE
> > +
> > +#include <assert.h>
> > +#include <elf.h>
> > +#include <errno.h>
> > +#include <fcntl.h>
> > +#include <libgen.h>
> > +#include <linux/limits.h>
> > +#include <stdio.h>
> > +#include <stdlib.h>
> > +#include <string.h>
> > +#include <sys/mount.h>
> > +#include <sys/stat.h>
> > +#include <sys/types.h>
> > +#include <unistd.h>
> > +
> > +#include <libubox/avl.h>
> > +#include <libubox/avl-cmp.h>
> > +
> > +#include "deps.h"
> > +#include "log.h"
> > +#include "jail.h"
> > +
> > +struct mount {
> > + struct avl_node avl;
> > + const char *path;
> > + int readonly;
> > + int error;
> > +};
> > +
> > +struct avl_tree mounts;
> > +
> > +static int add_mount(const char *path, int readonly, int error)
> > +{
> > + if (avl_find(&mounts, path))
> > + return 1;
> > +
> > + struct mount *m;
> > + m = calloc(1, sizeof(struct mount));
> > + assert(m != NULL);
> > + m->avl.key = m->path = strdup(path);
> > + m->readonly = readonly;
> > + m->error = error;
> > +
> > + avl_insert(&mounts, &m->avl);
> > + DEBUG("adding mount %s ro(%d) err(%d)\n", m->path, m->readonly,
> m->error != 0);
> > + return 0;
> > +}
> > +
> > +int add_mount_if_exists(const char *path, int readonly, int error) {
> > + struct stat s;
> > + if (stat(path, &s) == -1) {
> > + DEBUG("%s doesn't exist\n", path);
> > + return -1;
> > + }
> > + return add_mount(path, readonly, error);
> > +}
> > +
> > +int mount_all(const char *jailroot) {
> > + struct mount *m;
> > + avl_for_each_element(&mounts, m, avl)
> > + if (mount_bind(jailroot, m->path, m->readonly, m->error))
> > + return -1;
> > +
> > + return 0;
> > +}
> > +
> > +void mount_list_init() {
> > + avl_init(&mounts, avl_strcmp, false, NULL);
> > +}
> > +
> > +//we already read 2 char from f (#!)
> > +static int add_script_deps(FILE *f, const char *path, int readonly, int
> error)
> > +{
> > + char buf[PATH_MAX];
> > + int i = 0;
> > + int c;
> > + while ((c = fgetc(f)) != EOF) {
> > + if (i == 0 && c != '/')
> > + continue;
> > + if (c <= 0x20 || c > 0x7e)
> > + break;
> > + buf[i] = c;
> > + i++;
> > + if (i >= sizeof(buf)) {
> > + ERROR("script interpretor too long (%s)\n", path);
> > + return -1;
> > + }
> > + }
> > + buf[i] = '\0';
> > + return add_path_and_deps(buf, readonly, error);
> > +}
> > +
> > +static int add_elf_deps(const char *path, int readonly, int error)
> > +{
> > + char buf[PATH_MAX];
> > + int nb = snprintf(buf, sizeof(buf), "ldd %s", path);
> > + assert(nb >= 0);
> > +
> > + FILE *f = popen(buf, "r");
> > + char c;
> > + int i = 0;
> > + while (((c = fgetc(f)) != EOF)) {
> > + if (i == 0 && c != '/') {
> > + continue;
> > + } else if (i > 0 && (c <= ' ' || c > '~')) {
> > + buf[i] = '\0';
> > + add_mount(buf, readonly, error);
> > + i = 0;
> > + } else if (i > 0 || c == '/') {
> > + buf[i] = c;
> > + i++;
> > + }
> > +
> > + if (i >= sizeof(buf)) {
> > + ERROR("shared lib too long (%s)\n", path);
> > + return -1;
> > + }
> > + }
> > + pclose(f);
> > + return 0;
> > +}
> > +
> > +int add_path_and_deps(const char *path, int readonly, int error)
> > +{
> > + assert(path != NULL);
> > +
> > + if (path[0] != '/') {
> > + ERROR("only absolute path are supported (%s)\n", path);
> > + return error;
> > + }
> > +
> > + struct stat s;
> > + if (stat(path, &s) == -1) {
> > + ERROR("stat(%s) failed: %s\n", path, strerror(errno));
> > + return error;
> > + }
> > +
> > + //path already in list
> > + if (add_mount(path, readonly, error) == 1)
> > + return 0;
> > +
> > + if (!S_ISREG(s.st_mode))
> > + return 0;
> > +
> > + //too small to be an ELF or a script
> > + if (s.st_size < 4)
> > + return 0;
> > +
> > + FILE *f;
> > + if ((f = fopen(path, "r")) == NULL) {
> > + ERROR("fopen(%s) failed: %s\n", path, strerror(errno));
> > + return error;
> > + }
> > +
> > + int ret = 0;
> > + int c = fgetc(f);
> > + switch(c) {
> > + //script ?
> > + case '#':
> > + c = fgetc(f);
> > + if (c != '!') {
> > + goto out;
> > + }
> > + //this is a script
> > + ret = add_script_deps(f, path, readonly, error);
> > + goto out;
> > + //elf ?
> > + case ELFMAG0:
> > + if ((c = fgetc(f)) != ELFMAG1
> > + || (c = fgetc(f)) != ELFMAG2
> > + || (c = fgetc(f)) != ELFMAG3) {
> > + goto out;
> > + }
> > + ret = add_elf_deps(path, readonly, error);
> > + goto out;
> > + }
> > +out:
> > + if (f != NULL)
> > + fclose(f);
> > +
> > + return ret;
> > +}
> > +
> > diff --git a/jail/deps.h b/jail/deps.h
> > new file mode 100644
> > index 0000000..da2a914
> > --- /dev/null
> > +++ b/jail/deps.h
> > @@ -0,0 +1,23 @@
> > +/*
> > + * Copyright (C) 2015 Etienne Champetier <champetier.etienne at gmail.com>
> > + *
> > + * This program is free software; you can redistribute it and/or modify
> > + * it under the terms of the GNU Lesser General Public License version
> 2.1
> > + * as published by the Free Software Foundation
> > + *
> > + * This program is distributed in the hope that it will be useful,
> > + * but WITHOUT ANY WARRANTY; without even the implied warranty of
> > + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
> > + * GNU General Public License for more details.
> > + */
> > +
> > +#ifndef _DEPS_H__
> > +
> > +#include "log.h"
> > +
> > +int add_mount_if_exists(const char *path, int readonly, int error);
> > +int add_path_and_deps(const char *path, int readonly, int error);
> > +int mount_all(const char *jailroot);
> > +void mount_list_init();
> > +
> > +#endif
> > diff --git a/jail/elf.c b/jail/elf.c
> > deleted file mode 100644
> > index cbb3051..0000000
> > --- a/jail/elf.c
> > +++ /dev/null
> > @@ -1,355 +0,0 @@
> > -/*
> > - * Copyright (C) 2015 John Crispin <blogic at openwrt.org>
> > - *
> > - * This program is free software; you can redistribute it and/or modify
> > - * it under the terms of the GNU Lesser General Public License version
> 2.1
> > - * as published by the Free Software Foundation
> > - *
> > - * This program is distributed in the hope that it will be useful,
> > - * but WITHOUT ANY WARRANTY; without even the implied warranty of
> > - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
> > - * GNU General Public License for more details.
> > - */
> > -
> > -#define _GNU_SOURCE
> > -#include <sys/mman.h>
> > -
> > -#include <stdlib.h>
> > -#include <unistd.h>
> > -#include <stdio.h>
> > -#include <string.h>
> > -#include <sys/stat.h>
> > -#include <fcntl.h>
> > -#include <libgen.h>
> > -#include <glob.h>
> > -#include <elf.h>
> > -
> > -#include <libubox/utils.h>
> > -
> > -#include "elf.h"
> > -
> > -struct avl_tree libraries;
> > -static LIST_HEAD(library_paths);
> > -
> > -void alloc_library_path(const char *path)
> > -{
> > - struct library_path *p;
> > - char *_path;
> > -
> > - p = calloc_a(sizeof(*p),
> > - &_path, strlen(path) + 1);
> > - if (!p)
> > - return;
> > -
> > - p->path = strcpy(_path, path);
> > -
> > - list_add_tail(&p->list, &library_paths);
> > - DEBUG("adding ld.so path %s\n", path);
> > -}
> > -
> > -static void alloc_library(const char *path, const char *name)
> > -{
> > - struct library *l;
> > - char *_name, *_path;
> > -
> > - l = calloc_a(sizeof(*l),
> > - &_path, strlen(path) + 1,
> > - &_name, strlen(name) + 1);
> > - if (!l)
> > - return;
> > -
> > - l->avl.key = l->name = strcpy(_name, name);
> > - l->path = strcpy(_path, path);
> > -
> > - avl_insert(&libraries, &l->avl);
> > - DEBUG("adding library %s/%s\n", path, name);
> > -}
> > -
> > -static int elf_open(char **dir, char *file)
> > -{
> > - struct library_path *p;
> > - char path[256];
> > - int fd = -1;
> > -
> > - *dir = NULL;
> > -
> > - list_for_each_entry(p, &library_paths, list) {
> > - if (strlen(p->path))
> > - snprintf(path, sizeof(path), "%s/%s", p->path,
> file);
> > - else
> > - strncpy(path, file, sizeof(path));
> > - fd = open(path, O_RDONLY);
> > - if (fd >= 0) {
> > - *dir = p->path;
> > - break;
> > - }
> > - }
> > -
> > - if (fd == -1)
> > - fd = open(file, O_RDONLY);
> > -
> > - return fd;
> > -}
> > -
> > -char* find_lib(char *file)
> > -{
> > - struct library *l;
> > - static char path[256];
> > - const char *p;
> > -
> > - l = avl_find_element(&libraries, file, l, avl);
> > - if (!l)
> > - return NULL;
> > -
> > - p = l->path;
> > - if (strstr(p, "local"))
> > - p = "/lib";
> > -
> > - snprintf(path, sizeof(path), "%s/%s", p, file);
> > -
> > - return path;
> > -}
> > -
> > -static int elf64_find_section(char *map, unsigned int type, unsigned
> int *offset, unsigned int *size, unsigned int *vaddr)
> > -{
> > - Elf64_Ehdr *e;
> > - Elf64_Phdr *ph;
> > - int i;
> > -
> > - e = (Elf64_Ehdr *) map;
> > - ph = (Elf64_Phdr *) (map + e->e_phoff);
> > -
> > - for (i = 0; i < e->e_phnum; i++) {
> > - if (ph[i].p_type == type) {
> > - *offset = ph[i].p_offset;
> > - if (size)
> > - *size = ph[i].p_filesz;
> > - if (vaddr)
> > - *vaddr = ph[i].p_vaddr;
> > - return 0;
> > - }
> > - }
> > -
> > - return -1;
> > -}
> > -
> > -static int elf32_find_section(char *map, unsigned int type, unsigned
> int *offset, unsigned int *size, unsigned int *vaddr)
> > -{
> > - Elf32_Ehdr *e;
> > - Elf32_Phdr *ph;
> > - int i;
> > -
> > - e = (Elf32_Ehdr *) map;
> > - ph = (Elf32_Phdr *) (map + e->e_phoff);
> > -
> > - for (i = 0; i < e->e_phnum; i++) {
> > - if (ph[i].p_type == type) {
> > - *offset = ph[i].p_offset;
> > - if (size)
> > - *size = ph[i].p_filesz;
> > - if (vaddr)
> > - *vaddr = ph[i].p_vaddr;
> > - return 0;
> > - }
> > - }
> > -
> > - return -1;
> > -}
> > -
> > -static int elf_find_section(char *map, unsigned int type, unsigned int
> *offset, unsigned int *size, unsigned int *vaddr)
> > -{
> > - int clazz = map[EI_CLASS];
> > -
> > - if (clazz == ELFCLASS32)
> > - return elf32_find_section(map, type, offset, size, vaddr);
> > - else if (clazz == ELFCLASS64)
> > - return elf64_find_section(map, type, offset, size, vaddr);
> > -
> > - ERROR("unknown elf format %d\n", clazz);
> > -
> > - return -1;
> > -}
> > -
> > -static int elf32_scan_dynamic(char *map, int dyn_offset, int dyn_size,
> int load_offset)
> > -{
> > - Elf32_Dyn *dynamic = (Elf32_Dyn *) (map + dyn_offset);
> > - char *strtab = NULL;
> > -
> > - while ((void *) dynamic < (void *) (map + dyn_offset + dyn_size)) {
> > - Elf32_Dyn *curr = dynamic;
> > -
> > - dynamic++;
> > - if (curr->d_tag != DT_STRTAB)
> > - continue;
> > -
> > - strtab = map + (curr->d_un.d_val - load_offset);
> > - break;
> > - }
> > -
> > - if (!strtab)
> > - return -1;
> > -
> > - dynamic = (Elf32_Dyn *) (map + dyn_offset);
> > - while ((void *) dynamic < (void *) (map + dyn_offset + dyn_size)) {
> > - Elf32_Dyn *curr = dynamic;
> > -
> > - dynamic++;
> > - if (curr->d_tag != DT_NEEDED)
> > - continue;
> > -
> > - if (elf_load_deps(&strtab[curr->d_un.d_val]))
> > - return -1;
> > - }
> > -
> > - return 0;
> > -}
> > -
> > -static int elf64_scan_dynamic(char *map, int dyn_offset, int dyn_size,
> int load_offset)
> > -{
> > - Elf64_Dyn *dynamic = (Elf64_Dyn *) (map + dyn_offset);
> > - char *strtab = NULL;
> > -
> > - while ((void *) dynamic < (void *) (map + dyn_offset + dyn_size)) {
> > - Elf64_Dyn *curr = dynamic;
> > -
> > - dynamic++;
> > - if (curr->d_tag != DT_STRTAB)
> > - continue;
> > -
> > - strtab = map + (curr->d_un.d_val - load_offset);
> > - break;
> > - }
> > -
> > - if (!strtab)
> > - return -1;
> > -
> > - dynamic = (Elf64_Dyn *) (map + dyn_offset);
> > - while ((void *) dynamic < (void *) (map + dyn_offset + dyn_size)) {
> > - Elf64_Dyn *curr = dynamic;
> > -
> > - dynamic++;
> > - if (curr->d_tag != DT_NEEDED)
> > - continue;
> > -
> > - if (elf_load_deps(&strtab[curr->d_un.d_val]))
> > - return -1;
> > - }
> > -
> > - return 0;
> > -}
> > -
> > -int elf_load_deps(char *library)
> > -{
> > - unsigned int dyn_offset, dyn_size;
> > - unsigned int load_offset, load_vaddr;
> > - struct stat s;
> > - char *map = NULL, *dir = NULL;
> > - int clazz, fd, ret = -1;
> > -
> > - if (avl_find(&libraries, library))
> > - return 0;
> > -
> > - fd = elf_open(&dir, library);
> > -
> > - if (fd < 0) {
> > - ERROR("failed to open %s\n", library);
> > - return -1;
> > - }
> > -
> > - if (fstat(fd, &s) == -1) {
> > - ERROR("failed to stat %s\n", library);
> > - ret = -1;
> > - goto err_out;
> > - }
> > -
> > - map = mmap(NULL, s.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
> > - if (map == MAP_FAILED) {
> > - ERROR("failed to mmap %s\n", library);
> > - ret = -1;
> > - goto err_out;
> > - }
> > -
> > - if (elf_find_section(map, PT_LOAD, &load_offset, NULL,
> &load_vaddr)) {
> > - ERROR("failed to load the .load section from %s\n",
> library);
> > - ret = -1;
> > - goto err_out;
> > - }
> > -
> > - if (elf_find_section(map, PT_DYNAMIC, &dyn_offset, &dyn_size,
> NULL)) {
> > - ERROR("failed to load the .dynamic section from %s\n",
> library);
> > - ret = -1;
> > - goto err_out;
> > - }
> > -
> > - if (dir) {
> > - alloc_library(dir, library);
> > - } else {
> > - char *elf = strdup(library);
> > -
> > - alloc_library(dirname(elf), basename(library));
> > - free(elf);
> > - }
> > - clazz = map[EI_CLASS];
> > -
> > - if (clazz == ELFCLASS32)
> > - ret = elf32_scan_dynamic(map, dyn_offset, dyn_size,
> load_vaddr - load_offset);
> > - else if (clazz == ELFCLASS64)
> > - ret = elf64_scan_dynamic(map, dyn_offset, dyn_size,
> load_vaddr - load_offset);
> > -
> > -err_out:
> > - if (map)
> > - munmap(map, s.st_size);
> > - close(fd);
> > -
> > - return ret;
> > -}
> > -
> > -void load_ldso_conf(const char *conf)
> > -{
> > - FILE* fp = fopen(conf, "r");
> > - char line[256];
> > -
> > - if (!fp) {
> > - DEBUG("failed to open %s\n", conf);
> > - return;
> > - }
> > -
> > - while (!feof(fp)) {
> > - int len;
> > -
> > - if (!fgets(line, 256, fp))
> > - break;
> > - len = strlen(line);
> > - if (len < 2)
> > - continue;
> > - if (*line == '#')
> > - continue;
> > - if (line[len - 1] == '\n')
> > - line[len - 1] = '\0';
> > - if (!strncmp(line, "include ", 8)) {
> > - char *sep = strstr(line, " ");
> > - glob_t gl;
> > - int i;
> > -
> > - if (!sep)
> > - continue;;
> > - while (*sep == ' ')
> > - sep++;
> > - if (glob(sep, GLOB_NOESCAPE | GLOB_MARK, NULL,
> &gl)) {
> > - ERROR("glob failed on %s\n", sep);
> > - continue;
> > - }
> > - for (i = 0; i < gl.gl_pathc; i++)
> > - load_ldso_conf(gl.gl_pathv[i]);
> > - globfree(&gl);
> > - } else {
> > - struct stat s;
> > -
> > - if (stat(line, &s))
> > - continue;
> > - alloc_library_path(line);
> > - }
> > - }
> > -
> > - fclose(fp);
> > -}
> > diff --git a/jail/elf.h b/jail/elf.h
> > deleted file mode 100644
> > index 3ae311e..0000000
> > --- a/jail/elf.h
> > +++ /dev/null
> > @@ -1,38 +0,0 @@
> > -/*
> > - * Copyright (C) 2015 John Crispin <blogic at openwrt.org>
> > - *
> > - * This program is free software; you can redistribute it and/or modify
> > - * it under the terms of the GNU Lesser General Public License version
> 2.1
> > - * as published by the Free Software Foundation
> > - *
> > - * This program is distributed in the hope that it will be useful,
> > - * but WITHOUT ANY WARRANTY; without even the implied warranty of
> > - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
> > - * GNU General Public License for more details.
> > - */
> > -
> > -#ifndef _ELF_H__
> > -#include <libubox/avl.h>
> > -#include <libubox/avl-cmp.h>
> > -
> > -#include "log.h"
> > -
> > -struct library {
> > - struct avl_node avl;
> > - char *name;
> > - char *path;
> > -};
> > -
> > -struct library_path {
> > - struct list_head list;
> > - char *path;
> > -};
> > -
> > -extern struct avl_tree libraries;
> > -
> > -extern void alloc_library_path(const char *path);
> > -extern char* find_lib(char *file);
> > -extern int elf_load_deps(char *library);
> > -extern void load_ldso_conf(const char *conf);
> > -
> > -#endif
> > diff --git a/jail/jail.c b/jail/jail.c
> > index 08babde..391c196 100644
> > --- a/jail/jail.c
> > +++ b/jail/jail.c
> > @@ -12,27 +12,28 @@
> > */
> >
> > #define _GNU_SOURCE
> > -#include <sys/mount.h>
> > -#include <sys/prctl.h>
> > -#include <sys/wait.h>
> >
> > -#include <stdlib.h>
> > -#include <unistd.h>
> > -#include <values.h>
> > #include <errno.h>
> > -#include <stdio.h>
> > -#include <string.h>
> > -#include <sys/stat.h>
> > #include <fcntl.h>
> > #include <libgen.h>
> > +#include <linux/limits.h>
> > #include <sched.h>
> > +#include <stdio.h>
> > +#include <stdlib.h>
> > +#include <string.h>
> > +#include <sys/mount.h>
> > +#include <sys/prctl.h>
> > +#include <sys/stat.h>
> > +#include <sys/wait.h>
> > +#include <unistd.h>
> >
> > -#include "elf.h"
> > -#include "capabilities.h"
> > -
> > -#include <libubox/list.h>
> > #include <libubox/uloop.h>
> >
> > +#include "capabilities.h"
> > +#include "deps.h"
> > +#include "jail.h"
> > +#include "log.h"
> > +
> > #define STACK_SIZE (1024 * 1024)
> > #define OPT_ARGS "P:S:C:n:r:w:d:psulo"
> >
> > @@ -48,16 +49,6 @@ static struct {
> > int sysfs;
> > } opts;
> >
> > -struct extra {
> > - struct list_head list;
> > -
> > - const char *path;
> > - const char *name;
> > - int readonly;
> > -};
> > -
> > -static LIST_HEAD(extras);
> > -
> > extern int pivot_root(const char *new_root, const char *put_old);
> >
> > int debug = 0;
> > @@ -89,42 +80,34 @@ static int mkdir_p(char *dir, mode_t mask)
> > return ret;
> > }
> >
> > -static int mount_bind(const char *root, const char *path, const char
> *name, int readonly, int error)
> > +int mount_bind(const char *root, const char *path, int readonly, int
> error)
> > {
> > - const char *p = path;
> > struct stat s;
> > - char old[256];
> > - char new[256];
> > + char new[PATH_MAX];
> > int fd;
> >
> > - if (strstr(p, "local"))
> > - p = "/lib";
> > -
> > - snprintf(old, sizeof(old), "%s/%s", path, name);
> > - snprintf(new, sizeof(new), "%s%s", root, p);
> > -
> > - mkdir_p(new, 0755);
> > -
> > - snprintf(new, sizeof(new), "%s%s/%s", root, p, name);
> > -
> > - if (stat(old, &s)) {
> > - ERROR("%s does not exist\n", old);
> > + if (stat(path, &s)) {
> > + ERROR("stat(%s) failed: %s\n", path, strerror(errno));
> > return error;
> > }
> >
> > + snprintf(new, sizeof(new), "%s%s", root, path);
> > if (S_ISDIR(s.st_mode)) {
> > mkdir_p(new, 0755);
> > } else {
> > + mkdir_p(dirname(new), 0755);
> > +
> > + snprintf(new, sizeof(new), "%s%s", root, path);
> > fd = creat(new, 0644);
> > if (fd == -1) {
> > - ERROR("failed to create %s: %s\n", new,
> strerror(errno));
> > + ERROR("creat(%s) failed: %s\n", new,
> strerror(errno));
> > return -1;
> > }
> > close(fd);
> > }
> >
> > - if (mount(old, new, NULL, MS_BIND, NULL)) {
> > - ERROR("failed to mount -B %s %s: %s\n", old, new,
> strerror(errno));
> > + if (mount(path, new, NULL, MS_BIND, NULL)) {
> > + ERROR("failed to mount -B %s %s: %s\n", path, new,
> strerror(errno));
> > return -1;
> > }
> >
> > @@ -133,16 +116,14 @@ static int mount_bind(const char *root, const char
> *path, const char *name, int
> > return -1;
> > }
> >
> > - DEBUG("mount -B %s %s\n", old, new);
> > + DEBUG("mount -B %s %s\n", path, new);
> >
> > return 0;
> > }
> >
> > +#define PRELOAD_SECCOMP "/lib/libpreload-seccomp.so"
> > static int build_jail_fs()
> > {
> > - struct library *l;
> > - struct extra *m;
> > -
> > if (mount("tmpfs", opts.path, "tmpfs", MS_NOATIME, "mode=0755")) {
> > ERROR("tmpfs mount failed %s\n", strerror(errno));
> > return -1;
> > @@ -153,29 +134,20 @@ static int build_jail_fs()
> > return -1;
> > }
> >
> > - avl_init(&libraries, avl_strcmp, false, NULL);
> > - alloc_library_path("/lib64");
> > - alloc_library_path("/lib");
> > - alloc_library_path("/usr/lib");
> > - load_ldso_conf("/etc/ld.so.conf");
> > + add_mount_if_exists("/etc/ld.so.conf", 1, -1);
> >
> > - if (elf_load_deps(*opts.jail_argv)) {
> > + if (add_path_and_deps(*opts.jail_argv, 1, -1)) {
> > ERROR("failed to load dependencies\n");
> > return -1;
> > }
> >
> > - if (opts.seccomp && elf_load_deps("libpreload-seccomp.so")) {
> > + if (opts.seccomp && add_path_and_deps(PRELOAD_SECCOMP, 1, -1) ==
> -1) {
> > ERROR("failed to load libpreload-seccomp.so\n");
> > return -1;
> > }
> >
> > - avl_for_each_element(&libraries, l, avl)
> > - if (mount_bind(opts.path, l->path, l->name, 1, -1))
> > - return -1;
> > -
> > - list_for_each_entry(m, &extras, list)
> > - if (mount_bind(opts.path, m->path, m->name, m->readonly,
> 0))
> > - return -1;
> > + if (mount_all(opts.path))
> > + return -1;
> >
> > char *mpoint;
> > if (asprintf(&mpoint, "%s/old", opts.path) < 0) {
> > @@ -205,24 +177,19 @@ static int build_jail_fs()
> > return 0;
> > }
> >
> > -#define MAX_ENVP 8
> > +#define MAX_ENVP 4
> > +#define LD_PRELOAD_SECCOMP "LD_PRELOAD=" PRELOAD_SECCOMP
> > static char** build_envp(const char *seccomp)
> > {
> > static char *envp[MAX_ENVP];
> > - static char preload_var[64];
> > - static char seccomp_var[64];
> > + static char seccomp_var[PATH_MAX];
> > + static char preload_var[] = LD_PRELOAD_SECCOMP;
> > static char debug_var[] = "LD_DEBUG=all";
> > - char *preload_lib = find_lib("libpreload-seccomp.so");
> > int count = 0;
> >
> > - if (seccomp && !preload_lib) {
> > - ERROR("failed to add preload-lib to env\n");
> > - return NULL;
> > - }
> > if (seccomp) {
> > snprintf(seccomp_var, sizeof(seccomp_var),
> "SECCOMP_FILE=%s", seccomp);
> > envp[count++] = seccomp_var;
> > - snprintf(preload_var, sizeof(preload_var),
> "LD_PRELOAD=%s", preload_lib);
> > envp[count++] = preload_var;
> > }
> > if (debug > 1)
> > @@ -279,7 +246,7 @@ static int spawn_jail()
> > }
> >
> > if (build_jail_fs()) {
> > - ERROR("failed to build jail fs");
> > + ERROR("failed to build jail fs\n");
> > exit(EXIT_FAILURE);
> > }
> >
> > @@ -306,24 +273,6 @@ static struct uloop_process jail_process = {
> > .cb = jail_process_handler,
> > };
> >
> > -static void add_extra(char *name, int readonly)
> > -{
> > - struct extra *f;
> > -
> > - if (*name != '/') {
> > - ERROR("%s is not an absolute path\n", name);
> > - return;
> > - }
> > -
> > - f = calloc(1, sizeof(struct extra));
> > -
> > - f->name = basename(name);
> > - f->path = dirname(strdup(name));
> > - f->readonly = readonly;
> > -
> > - list_add_tail(&f->list, &extras);
> > -}
> > -
> > int main(int argc, char **argv)
> > {
> > uid_t uid = getuid();
> > @@ -338,6 +287,7 @@ int main(int argc, char **argv)
> > }
> >
> > umask(022);
> > + mount_list_init();
> >
> > while ((ch = getopt(argc, argv, OPT_ARGS)) != -1) {
> > switch (ch) {
> > @@ -358,11 +308,11 @@ int main(int argc, char **argv)
> > break;
> > case 'S':
> > opts.seccomp = optarg;
> > - add_extra(optarg, 1);
> > + add_path_and_deps(optarg, 1, -1);
> > break;
> > case 'C':
> > opts.capabilities = optarg;
> > - add_extra(optarg, 1);
> > + add_path_and_deps(optarg, 1, -1);
> > break;
> > case 'P':
> > opts.namespace = 1;
> > @@ -373,19 +323,19 @@ int main(int argc, char **argv)
> > break;
> > case 'r':
> > opts.namespace = 1;
> > - add_extra(optarg, 1);
> > + add_path_and_deps(optarg, 1, 0);
> > break;
> > case 'w':
> > opts.namespace = 1;
> > - add_extra(optarg, 0);
> > + add_path_and_deps(optarg, 0, 0);
> > break;
> > case 'u':
> > opts.namespace = 1;
> > - add_extra(ubus, 0);
> > + add_path_and_deps(ubus, 0, -1);
> > break;
> > case 'l':
> > opts.namespace = 1;
> > - add_extra(log, 0);
> > + add_path_and_deps(log, 0, -1);
> > break;
> > }
> > }
> > diff --git a/jail/jail.h b/jail/jail.h
> > new file mode 100644
> > index 0000000..fc69ef6
> > --- /dev/null
> > +++ b/jail/jail.h
> > @@ -0,0 +1,18 @@
> > +/*
> > + * Copyright (C) 2015 Etienne Champetier <champetier.etienne at gmail.com>
> > + *
> > + * This program is free software; you can redistribute it and/or modify
> > + * it under the terms of the GNU Lesser General Public License version
> 2.1
> > + * as published by the Free Software Foundation
> > + *
> > + * This program is distributed in the hope that it will be useful,
> > + * but WITHOUT ANY WARRANTY; without even the implied warranty of
> > + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
> > + * GNU General Public License for more details.
> > + */
> > +
> > +#ifndef _JAIL_H__
> > +
> > +int mount_bind(const char *root, const char *path, int readonly, int
> error);
> > +
> > +#endif
> >
> _______________________________________________
> openwrt-devel mailing list
> openwrt-devel at lists.openwrt.org
> https://lists.openwrt.org/cgi-bin/mailman/listinfo/openwrt-devel
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.infradead.org/pipermail/openwrt-devel/attachments/20151121/5f065dd5/attachment.htm>
-------------- next part --------------
_______________________________________________
openwrt-devel mailing list
openwrt-devel at lists.openwrt.org
https://lists.openwrt.org/cgi-bin/mailman/listinfo/openwrt-devel
More information about the openwrt-devel
mailing list