1 /* Copyright 2018 The Chromium OS Authors. All rights reserved.
2 * Use of this source code is governed by a BSD-style license that can be
3 * found in the LICENSE file.
4 */
5
6 #include <dlfcn.h>
7 #include <errno.h>
8 #include <getopt.h>
9 #include <inttypes.h>
10 #include <stdbool.h>
11 #include <stdio.h>
12 #include <stdlib.h>
13 #include <string.h>
14 #include <sys/capability.h>
15 #include <sys/mount.h>
16 #include <sys/types.h>
17 #include <unistd.h>
18
19 #include <linux/filter.h>
20
21 #include "libminijail.h"
22 #include "libsyscalls.h"
23
24 #include "elfparse.h"
25 #include "minijail0_cli.h"
26 #include "system.h"
27 #include "util.h"
28
29 #define IDMAP_LEN 32U
30 #define DEFAULT_TMP_SIZE (64 * 1024 * 1024)
31
set_user(struct minijail * j,const char * arg,uid_t * out_uid,gid_t * out_gid)32 static void set_user(struct minijail *j, const char *arg, uid_t *out_uid,
33 gid_t *out_gid)
34 {
35 char *end = NULL;
36 int uid = strtod(arg, &end);
37 if (!*end && *arg) {
38 *out_uid = uid;
39 minijail_change_uid(j, uid);
40 return;
41 }
42
43 if (lookup_user(arg, out_uid, out_gid)) {
44 fprintf(stderr, "Bad user: '%s'\n", arg);
45 exit(1);
46 }
47
48 if (minijail_change_user(j, arg)) {
49 fprintf(stderr, "Bad user: '%s'\n", arg);
50 exit(1);
51 }
52 }
53
set_group(struct minijail * j,const char * arg,gid_t * out_gid)54 static void set_group(struct minijail *j, const char *arg, gid_t *out_gid)
55 {
56 char *end = NULL;
57 int gid = strtod(arg, &end);
58 if (!*end && *arg) {
59 *out_gid = gid;
60 minijail_change_gid(j, gid);
61 return;
62 }
63
64 if (lookup_group(arg, out_gid)) {
65 fprintf(stderr, "Bad group: '%s'\n", arg);
66 exit(1);
67 }
68
69 if (minijail_change_group(j, arg)) {
70 fprintf(stderr, "Bad group: '%s'\n", arg);
71 exit(1);
72 }
73 }
74
skip_securebits(struct minijail * j,const char * arg)75 static void skip_securebits(struct minijail *j, const char *arg)
76 {
77 uint64_t securebits_skip_mask;
78 char *end = NULL;
79 securebits_skip_mask = strtoull(arg, &end, 16);
80 if (*end) {
81 fprintf(stderr, "Invalid securebit mask: '%s'\n", arg);
82 exit(1);
83 }
84 minijail_skip_setting_securebits(j, securebits_skip_mask);
85 }
86
use_caps(struct minijail * j,const char * arg)87 static void use_caps(struct minijail *j, const char *arg)
88 {
89 uint64_t caps = 0;
90 cap_t parsed_caps = cap_from_text(arg);
91
92 if (parsed_caps != NULL) {
93 unsigned int i;
94 const uint64_t one = 1;
95 cap_flag_value_t cap_value;
96 unsigned int last_valid_cap = get_last_valid_cap();
97
98 for (i = 0; i <= last_valid_cap; ++i) {
99 if (cap_get_flag(parsed_caps, i, CAP_EFFECTIVE,
100 &cap_value)) {
101 if (errno == EINVAL) {
102 /*
103 * Some versions of libcap reject any
104 * capabilities they were not compiled
105 * with by returning EINVAL.
106 */
107 continue;
108 }
109 fprintf(stderr,
110 "Could not get the value of "
111 "the %d-th capability: %m\n",
112 i);
113 exit(1);
114 }
115 if (cap_value == CAP_SET)
116 caps |= (one << i);
117 }
118 cap_free(parsed_caps);
119 } else {
120 char *end = NULL;
121 caps = strtoull(arg, &end, 16);
122 if (*end) {
123 fprintf(stderr, "Invalid cap set: '%s'\n", arg);
124 exit(1);
125 }
126 }
127
128 minijail_use_caps(j, caps);
129 }
130
add_binding(struct minijail * j,char * arg)131 static void add_binding(struct minijail *j, char *arg)
132 {
133 char *src = tokenize(&arg, ",");
134 char *dest = tokenize(&arg, ",");
135 char *flags = tokenize(&arg, ",");
136 if (!src || src[0] == '\0' || arg != NULL) {
137 fprintf(stderr, "Bad binding: %s %s\n", src, dest);
138 exit(1);
139 }
140 if (dest == NULL || dest[0] == '\0')
141 dest = src;
142 if (flags == NULL || flags[0] == '\0')
143 flags = "0";
144 if (minijail_bind(j, src, dest, atoi(flags))) {
145 fprintf(stderr, "minijail_bind failed.\n");
146 exit(1);
147 }
148 }
149
add_rlimit(struct minijail * j,char * arg)150 static void add_rlimit(struct minijail *j, char *arg)
151 {
152 char *type = tokenize(&arg, ",");
153 char *cur = tokenize(&arg, ",");
154 char *max = tokenize(&arg, ",");
155 char *end;
156 if (!type || type[0] == '\0' || !cur || cur[0] == '\0' ||
157 !max || max[0] == '\0' || arg != NULL) {
158 fprintf(stderr, "Bad rlimit '%s'.\n", arg);
159 exit(1);
160 }
161 rlim_t cur_rlim;
162 rlim_t max_rlim;
163 if (!strcmp(cur, "unlimited")) {
164 cur_rlim = RLIM_INFINITY;
165 } else {
166 end = NULL;
167 cur_rlim = strtoul(cur, &end, 0);
168 if (*end) {
169 fprintf(stderr, "Bad soft limit: '%s'.\n", cur);
170 exit(1);
171 }
172 }
173 if (!strcmp(max, "unlimited")) {
174 max_rlim = RLIM_INFINITY;
175 } else {
176 end = NULL;
177 max_rlim = strtoul(max, &end, 0);
178 if (*end) {
179 fprintf(stderr, "Bad hard limit: '%s'.\n", max);
180 exit(1);
181 }
182 }
183
184 end = NULL;
185 int resource = parse_single_constant(type, &end);
186 if (type == end) {
187 fprintf(stderr, "Bad rlimit: '%s'.\n", type);
188 exit(1);
189 }
190
191 if (minijail_rlimit(j, resource, cur_rlim, max_rlim)) {
192 fprintf(stderr, "minijail_rlimit '%s,%s,%s' failed.\n", type,
193 cur, max);
194 exit(1);
195 }
196 }
197
add_mount(struct minijail * j,char * arg)198 static void add_mount(struct minijail *j, char *arg)
199 {
200 char *src = tokenize(&arg, ",");
201 char *dest = tokenize(&arg, ",");
202 char *type = tokenize(&arg, ",");
203 char *flags = tokenize(&arg, ",");
204 char *data = tokenize(&arg, ",");
205 char *end;
206 if (!src || src[0] == '\0' || !dest || dest[0] == '\0' ||
207 !type || type[0] == '\0') {
208 fprintf(stderr, "Bad mount: %s %s %s\n", src, dest, type);
209 exit(1);
210 }
211
212 /*
213 * Fun edge case: the data option itself is comma delimited. If there
214 * were no more options, then arg would be set to NULL. But if we had
215 * more pending, it'll be pointing to the next token. Back up and undo
216 * the null byte so it'll be merged back.
217 * An example:
218 * none,/tmp,tmpfs,0xe,mode=0755,uid=10,gid=10
219 * The tokenize calls above will turn this memory into:
220 * none\0/tmp\0tmpfs\00xe\0mode=0755\0uid=10,gid=10
221 * With data pointing at mode=0755 and arg pointing at uid=10,gid=10.
222 */
223 if (arg != NULL)
224 arg[-1] = ',';
225
226 unsigned long mountflags;
227 if (flags == NULL || flags[0] == '\0') {
228 mountflags = 0;
229 } else {
230 end = NULL;
231 mountflags = parse_constant(flags, &end);
232 if (flags == end) {
233 fprintf(stderr, "Bad mount flags: %s\n", flags);
234 exit(1);
235 }
236 }
237
238 if (minijail_mount_with_data(j, src, dest, type,
239 mountflags, data)) {
240 fprintf(stderr, "minijail_mount failed.\n");
241 exit(1);
242 }
243 }
244
build_idmap(id_t id,id_t lowerid)245 static char *build_idmap(id_t id, id_t lowerid)
246 {
247 int ret;
248 char *idmap = malloc(IDMAP_LEN);
249 ret = snprintf(idmap, IDMAP_LEN, "%d %d 1", id, lowerid);
250 if (ret < 0 || (size_t)ret >= IDMAP_LEN) {
251 free(idmap);
252 fprintf(stderr, "Could not build id map.\n");
253 exit(1);
254 }
255 return idmap;
256 }
257
has_cap_setgid(void)258 static int has_cap_setgid(void)
259 {
260 cap_t caps;
261 cap_flag_value_t cap_value;
262
263 if (!CAP_IS_SUPPORTED(CAP_SETGID))
264 return 0;
265
266 caps = cap_get_proc();
267 if (!caps) {
268 fprintf(stderr, "Could not get process' capabilities: %m\n");
269 exit(1);
270 }
271
272 if (cap_get_flag(caps, CAP_SETGID, CAP_EFFECTIVE, &cap_value)) {
273 fprintf(stderr, "Could not get the value of CAP_SETGID: %m\n");
274 exit(1);
275 }
276
277 if (cap_free(caps)) {
278 fprintf(stderr, "Could not free capabilities: %m\n");
279 exit(1);
280 }
281
282 return cap_value == CAP_SET;
283 }
284
set_ugid_mapping(struct minijail * j,int set_uidmap,uid_t uid,char * uidmap,int set_gidmap,gid_t gid,char * gidmap)285 static void set_ugid_mapping(struct minijail *j, int set_uidmap, uid_t uid,
286 char *uidmap, int set_gidmap, gid_t gid,
287 char *gidmap)
288 {
289 if (set_uidmap) {
290 minijail_namespace_user(j);
291 minijail_namespace_pids(j);
292
293 if (!uidmap) {
294 /*
295 * If no map is passed, map the current uid to the
296 * chosen uid in the target namespace (or root, if none
297 * was chosen).
298 */
299 uidmap = build_idmap(uid, getuid());
300 }
301 if (0 != minijail_uidmap(j, uidmap)) {
302 fprintf(stderr, "Could not set uid map.\n");
303 exit(1);
304 }
305 free(uidmap);
306 }
307 if (set_gidmap) {
308 minijail_namespace_user(j);
309 minijail_namespace_pids(j);
310
311 if (!gidmap) {
312 /*
313 * If no map is passed, map the current gid to the
314 * chosen gid in the target namespace.
315 */
316 gidmap = build_idmap(gid, getgid());
317 }
318 if (!has_cap_setgid()) {
319 /*
320 * This means that we are not running as root,
321 * so we also have to disable setgroups(2) to
322 * be able to set the gid map.
323 * See
324 * http://man7.org/linux/man-pages/man7/user_namespaces.7.html
325 */
326 minijail_namespace_user_disable_setgroups(j);
327 }
328 if (0 != minijail_gidmap(j, gidmap)) {
329 fprintf(stderr, "Could not set gid map.\n");
330 exit(1);
331 }
332 free(gidmap);
333 }
334 }
335
use_chroot(struct minijail * j,const char * path,int * chroot,int pivot_root)336 static void use_chroot(struct minijail *j, const char *path, int *chroot,
337 int pivot_root)
338 {
339 if (pivot_root) {
340 fprintf(stderr, "Could not set chroot because "
341 "'-P' was specified.\n");
342 exit(1);
343 }
344 if (minijail_enter_chroot(j, path)) {
345 fprintf(stderr, "Could not set chroot.\n");
346 exit(1);
347 }
348 *chroot = 1;
349 }
350
use_pivot_root(struct minijail * j,const char * path,int * pivot_root,int chroot)351 static void use_pivot_root(struct minijail *j, const char *path,
352 int *pivot_root, int chroot)
353 {
354 if (chroot) {
355 fprintf(stderr, "Could not set pivot_root because "
356 "'-C' was specified.\n");
357 exit(1);
358 }
359 if (minijail_enter_pivot_root(j, path)) {
360 fprintf(stderr, "Could not set pivot_root.\n");
361 exit(1);
362 }
363 minijail_namespace_vfs(j);
364 *pivot_root = 1;
365 }
366
use_profile(struct minijail * j,const char * profile,int * pivot_root,int chroot,size_t * tmp_size)367 static void use_profile(struct minijail *j, const char *profile,
368 int *pivot_root, int chroot, size_t *tmp_size)
369 {
370 /* Note: New profiles should be added in minijail0_cli_unittest.cc. */
371
372 if (!strcmp(profile, "minimalistic-mountns")) {
373 minijail_namespace_vfs(j);
374 if (minijail_bind(j, "/", "/", 0)) {
375 fprintf(stderr, "minijail_bind(/) failed.\n");
376 exit(1);
377 }
378 if (minijail_bind(j, "/proc", "/proc", 0)) {
379 fprintf(stderr, "minijail_bind(/proc) failed.\n");
380 exit(1);
381 }
382 if (minijail_bind(j, "/dev/log", "/dev/log", 0)) {
383 fprintf(stderr, "minijail_bind(/dev/log) failed.\n");
384 exit(1);
385 }
386 minijail_mount_dev(j);
387 if (!*tmp_size) {
388 /* Avoid clobbering |tmp_size| if it was already set. */
389 *tmp_size = DEFAULT_TMP_SIZE;
390 }
391 minijail_remount_proc_readonly(j);
392 use_pivot_root(j, DEFAULT_PIVOT_ROOT, pivot_root, chroot);
393 } else {
394 fprintf(stderr, "Unrecognized profile name '%s'\n", profile);
395 exit(1);
396 }
397 }
398
set_remount_mode(struct minijail * j,const char * mode)399 static void set_remount_mode(struct minijail *j, const char *mode)
400 {
401 unsigned long msmode;
402 if (!strcmp(mode, "shared"))
403 msmode = MS_SHARED;
404 else if (!strcmp(mode, "private"))
405 msmode = MS_PRIVATE;
406 else if (!strcmp(mode, "slave"))
407 msmode = MS_SLAVE;
408 else if (!strcmp(mode, "unbindable"))
409 msmode = MS_UNBINDABLE;
410 else {
411 fprintf(stderr, "Unknown remount mode: '%s'\n", mode);
412 exit(1);
413 }
414 minijail_remount_mode(j, msmode);
415 }
416
read_seccomp_filter(const char * filter_path,struct sock_fprog * filter)417 static void read_seccomp_filter(const char *filter_path,
418 struct sock_fprog *filter)
419 {
420 FILE *f = fopen(filter_path, "re");
421 if (!f) {
422 fprintf(stderr, "failed to open %s: %m", filter_path);
423 exit(1);
424 }
425 off_t filter_size = 0;
426 if (fseeko(f, 0, SEEK_END) == -1 || (filter_size = ftello(f)) == -1) {
427 fclose(f);
428 fprintf(stderr, "failed to get file size of %s: %m",
429 filter_path);
430 exit(1);
431 }
432 if (filter_size % sizeof(struct sock_filter) != 0) {
433 fclose(f);
434 fprintf(stderr,
435 "filter size (%" PRId64
436 ") of %s is not a multiple of %zu: %m",
437 filter_size, filter_path, sizeof(struct sock_filter));
438 exit(1);
439 }
440 rewind(f);
441
442 filter->len = filter_size / sizeof(struct sock_filter);
443 filter->filter = malloc(filter_size);
444 if (!filter->filter) {
445 fclose(f);
446 fprintf(stderr, "failed to allocate memory for filter: %m");
447 exit(1);
448 }
449 if (fread(filter->filter, sizeof(struct sock_filter), filter->len, f) !=
450 filter->len) {
451 fclose(f);
452 fprintf(stderr, "failed read %s: %m", filter_path);
453 exit(1);
454 }
455 fclose(f);
456 }
457
usage(const char * progn)458 static void usage(const char *progn)
459 {
460 size_t i;
461 /* clang-format off */
462 printf("Usage: %s [-dGhHiIKlLnNprRstUvyYz]\n"
463 " [-a <table>]\n"
464 " [-b <src>[,<dest>[,<writeable>]]] [-k <src>,<dest>,<type>[,<flags>[,<data>]]]\n"
465 " [-c <caps>] [-C <dir>] [-P <dir>] [-e[file]] [-f <file>] [-g <group>]\n"
466 " [-m[<uid> <loweruid> <count>]*] [-M[<gid> <lowergid> <count>]*] [--profile <name>]\n"
467 " [-R <type,cur,max>] [-S <file>] [-t[size]] [-T <type>] [-u <user>] [-V <file>]\n"
468 " <program> [args...]\n"
469 " -a <table>: Use alternate syscall table <table>.\n"
470 " -b <...>: Bind <src> to <dest> in chroot.\n"
471 " Multiple instances allowed.\n"
472 " -B <mask>: Skip setting securebits in <mask> when restricting capabilities (-c).\n"
473 " By default, SECURE_NOROOT, SECURE_NO_SETUID_FIXUP, and \n"
474 " SECURE_KEEP_CAPS (together with their respective locks) are set.\n"
475 " There are eight securebits in total.\n"
476 " -k <...>: Mount <src> at <dest> in chroot.\n"
477 " <flags> and <data> can be specified as in mount(2).\n"
478 " Multiple instances allowed.\n"
479 " -c <caps>: Restrict caps to <caps>.\n"
480 " -C <dir>: chroot(2) to <dir>.\n"
481 " Not compatible with -P.\n"
482 " -P <dir>: pivot_root(2) to <dir> (implies -v).\n"
483 " Not compatible with -C.\n"
484 " --mount-dev, Create a new /dev with a minimal set of device nodes (implies -v).\n"
485 " -d: See the minijail0(1) man page for the exact set.\n"
486 " -e[file]: Enter new network namespace, or existing one if |file| is provided.\n"
487 " -f <file>: Write the pid of the jailed process to <file>.\n"
488 " -g <group>: Change gid to <group>.\n"
489 " -G: Inherit supplementary groups from uid.\n"
490 " Not compatible with -y.\n"
491 " -y: Keep uid's supplementary groups.\n"
492 " Not compatible with -G.\n"
493 " -h: Help (this message).\n"
494 " -H: Seccomp filter help message.\n"
495 " -i: Exit immediately after fork(2). The jailed process will run\n"
496 " in the background.\n"
497 " -I: Run <program> as init (pid 1) inside a new pid namespace (implies -p).\n"
498 " -K: Do not change share mode of any existing mounts.\n"
499 " -K<mode>: Mark all existing mounts as <mode> instead of MS_PRIVATE.\n"
500 " -l: Enter new IPC namespace.\n"
501 " -L: Report blocked syscalls to syslog when using seccomp filter.\n"
502 " Forces the following syscalls to be allowed:\n"
503 " ", progn);
504 /* clang-format on */
505 for (i = 0; i < log_syscalls_len; i++)
506 printf("%s ", log_syscalls[i]);
507
508 /* clang-format off */
509 printf("\n"
510 " -m[map]: Set the uid map of a user namespace (implies -pU).\n"
511 " Same arguments as newuidmap(1), multiple mappings should be separated by ',' (comma).\n"
512 " With no mapping, map the current uid to root inside the user namespace.\n"
513 " Not compatible with -b without the 'writable' option.\n"
514 " -M[map]: Set the gid map of a user namespace (implies -pU).\n"
515 " Same arguments as newgidmap(1), multiple mappings should be separated by ',' (comma).\n"
516 " With no mapping, map the current gid to root inside the user namespace.\n"
517 " Not compatible with -b without the 'writable' option.\n"
518 " -n: Set no_new_privs.\n"
519 " -N: Enter a new cgroup namespace.\n"
520 " -p: Enter new pid namespace (implies -vr).\n"
521 " -r: Remount /proc read-only (implies -v).\n"
522 " -R: Set rlimits, can be specified multiple times.\n"
523 " -s: Use seccomp mode 1 (not the same as -S).\n"
524 " -S <file>: Set seccomp filter using <file>.\n"
525 " E.g., '-S /usr/share/filters/<prog>.$(uname -m)'.\n"
526 " Requires -n when not running as root.\n"
527 " -t[size]: Mount tmpfs at /tmp (implies -v).\n"
528 " Optional argument specifies size (default \"64M\").\n"
529 " -T <type>: Assume <program> is a <type> ELF binary; <type> can be 'static' or 'dynamic'.\n"
530 " This will avoid accessing <program> binary before execve(2).\n"
531 " Type 'static' will avoid preload hooking.\n"
532 " -u <user>: Change uid to <user>.\n"
533 " -U: Enter new user namespace (implies -p).\n"
534 " -v: Enter new mount namespace.\n"
535 " -V <file>: Enter specified mount namespace.\n"
536 " -w: Create and join a new anonymous session keyring.\n"
537 " -Y: Synchronize seccomp filters across thread group.\n"
538 " -z: Don't forward signals to jailed process.\n"
539 " --ambient: Raise ambient capabilities. Requires -c.\n"
540 " --uts[=name]: Enter a new UTS namespace (and set hostname).\n"
541 " --logging=<s>:Use <s> as the logging system.\n"
542 " <s> must be 'syslog' (default) or 'stderr'.\n"
543 " --profile <p>:Configure minijail0 to run with the <p> sandboxing profile,\n"
544 " which is a convenient way to express multiple flags\n"
545 " that are typically used together.\n"
546 " See the minijail0(1) man page for the full list.\n"
547 " --preload-library=<f>:Overrides the path to \"" PRELOADPATH "\".\n"
548 " This is only really useful for local testing.\n"
549 " --seccomp-bpf-binary=<f>:Set a pre-compiled seccomp filter using <f>.\n"
550 " E.g., '-S /usr/share/filters/<prog>.$(uname -m).bpf'.\n"
551 " Requires -n when not running as root.\n"
552 " The user is responsible for ensuring that the binary\n"
553 " was compiled for the correct architecture / kernel version.\n");
554 /* clang-format on */
555 }
556
seccomp_filter_usage(const char * progn)557 static void seccomp_filter_usage(const char *progn)
558 {
559 const struct syscall_entry *entry = syscall_table;
560 printf("Usage: %s -S <policy.file> <program> [args...]\n\n"
561 "System call names supported:\n",
562 progn);
563 for (; entry->name && entry->nr >= 0; ++entry)
564 printf(" %s [%d]\n", entry->name, entry->nr);
565 printf("\nSee minijail0(5) for example policies.\n");
566 }
567
parse_args(struct minijail * j,int argc,char * const argv[],int * exit_immediately,ElfType * elftype,const char ** preload_path)568 int parse_args(struct minijail *j, int argc, char *const argv[],
569 int *exit_immediately, ElfType *elftype,
570 const char **preload_path)
571 {
572 int opt;
573 int use_seccomp_filter = 0, use_seccomp_filter_binary = 0;
574 int forward = 1;
575 int binding = 0;
576 int chroot = 0, pivot_root = 0;
577 int mount_ns = 0, skip_remount = 0;
578 int inherit_suppl_gids = 0, keep_suppl_gids = 0;
579 int caps = 0, ambient_caps = 0;
580 int seccomp = -1;
581 bool use_uid = false, use_gid = false;
582 uid_t uid = 0;
583 gid_t gid = 0;
584 char *uidmap = NULL, *gidmap = NULL;
585 int set_uidmap = 0, set_gidmap = 0;
586 size_t tmp_size = 0;
587 const char *filter_path = NULL;
588 int log_to_stderr = 0;
589
590 const char *optstring =
591 "+u:g:sS:c:C:P:b:B:V:f:m::M::k:a:e::R:T:vrGhHinNplLt::IUK::wyYzd";
592 /* clang-format off */
593 const struct option long_options[] = {
594 {"help", no_argument, 0, 'h'},
595 {"mount-dev", no_argument, 0, 'd'},
596 {"ambient", no_argument, 0, 128},
597 {"uts", optional_argument, 0, 129},
598 {"logging", required_argument, 0, 130},
599 {"profile", required_argument, 0, 131},
600 {"preload-library", required_argument, 0, 132},
601 {"seccomp-bpf-binary", required_argument, 0, 133},
602 {0, 0, 0, 0},
603 };
604 /* clang-format on */
605
606 while ((opt = getopt_long(argc, argv, optstring, long_options, NULL)) !=
607 -1) {
608 switch (opt) {
609 case 'u':
610 if (use_uid) {
611 fprintf(stderr,
612 "-u provided multiple times.\n");
613 exit(1);
614 }
615 use_uid = true;
616 set_user(j, optarg, &uid, &gid);
617 break;
618 case 'g':
619 if (use_gid) {
620 fprintf(stderr,
621 "-g provided multiple times.\n");
622 exit(1);
623 }
624 use_gid = true;
625 set_group(j, optarg, &gid);
626 break;
627 case 'n':
628 minijail_no_new_privs(j);
629 break;
630 case 's':
631 if (seccomp != -1 && seccomp != 1) {
632 fprintf(stderr,
633 "Do not use -s, -S, or "
634 "--seccomp-bpf-binary together.\n");
635 exit(1);
636 }
637 seccomp = 1;
638 minijail_use_seccomp(j);
639 break;
640 case 'S':
641 if (seccomp != -1 && seccomp != 2) {
642 fprintf(stderr,
643 "Do not use -s, -S, or "
644 "--seccomp-bpf-binary together.\n");
645 exit(1);
646 }
647 seccomp = 2;
648 minijail_use_seccomp_filter(j);
649 filter_path = optarg;
650 use_seccomp_filter = 1;
651 break;
652 case 'l':
653 minijail_namespace_ipc(j);
654 break;
655 case 'L':
656 minijail_log_seccomp_filter_failures(j);
657 break;
658 case 'b':
659 add_binding(j, optarg);
660 binding = 1;
661 break;
662 case 'B':
663 skip_securebits(j, optarg);
664 break;
665 case 'c':
666 caps = 1;
667 use_caps(j, optarg);
668 break;
669 case 'C':
670 use_chroot(j, optarg, &chroot, pivot_root);
671 break;
672 case 'k':
673 add_mount(j, optarg);
674 break;
675 case 'K':
676 if (optarg)
677 set_remount_mode(j, optarg);
678 else
679 minijail_skip_remount_private(j);
680 skip_remount = 1;
681 break;
682 case 'P':
683 use_pivot_root(j, optarg, &pivot_root, chroot);
684 break;
685 case 'f':
686 if (0 != minijail_write_pid_file(j, optarg)) {
687 fprintf(stderr,
688 "Could not prepare pid file path.\n");
689 exit(1);
690 }
691 break;
692 case 't':
693 minijail_namespace_vfs(j);
694 if (!tmp_size) {
695 /*
696 * Avoid clobbering |tmp_size| if it was already
697 * set.
698 */
699 tmp_size = DEFAULT_TMP_SIZE;
700 }
701 if (optarg != NULL &&
702 0 != parse_size(&tmp_size, optarg)) {
703 fprintf(stderr, "Invalid /tmp tmpfs size.\n");
704 exit(1);
705 }
706 break;
707 case 'v':
708 minijail_namespace_vfs(j);
709 mount_ns = 1;
710 break;
711 case 'V':
712 minijail_namespace_enter_vfs(j, optarg);
713 break;
714 case 'r':
715 minijail_remount_proc_readonly(j);
716 break;
717 case 'G':
718 if (keep_suppl_gids) {
719 fprintf(stderr,
720 "-y and -G are not compatible.\n");
721 exit(1);
722 }
723 minijail_inherit_usergroups(j);
724 inherit_suppl_gids = 1;
725 break;
726 case 'y':
727 if (inherit_suppl_gids) {
728 fprintf(stderr,
729 "-y and -G are not compatible.\n");
730 exit(1);
731 }
732 minijail_keep_supplementary_gids(j);
733 keep_suppl_gids = 1;
734 break;
735 case 'N':
736 minijail_namespace_cgroups(j);
737 break;
738 case 'p':
739 minijail_namespace_pids(j);
740 break;
741 case 'e':
742 if (optarg)
743 minijail_namespace_enter_net(j, optarg);
744 else
745 minijail_namespace_net(j);
746 break;
747 case 'i':
748 *exit_immediately = 1;
749 break;
750 case 'H':
751 seccomp_filter_usage(argv[0]);
752 exit(0);
753 case 'I':
754 minijail_namespace_pids(j);
755 minijail_run_as_init(j);
756 break;
757 case 'U':
758 minijail_namespace_user(j);
759 minijail_namespace_pids(j);
760 break;
761 case 'm':
762 set_uidmap = 1;
763 if (uidmap) {
764 free(uidmap);
765 uidmap = NULL;
766 }
767 if (optarg)
768 uidmap = strdup(optarg);
769 break;
770 case 'M':
771 set_gidmap = 1;
772 if (gidmap) {
773 free(gidmap);
774 gidmap = NULL;
775 }
776 if (optarg)
777 gidmap = strdup(optarg);
778 break;
779 case 'a':
780 if (0 != minijail_use_alt_syscall(j, optarg)) {
781 fprintf(stderr,
782 "Could not set alt-syscall table.\n");
783 exit(1);
784 }
785 break;
786 case 'R':
787 add_rlimit(j, optarg);
788 break;
789 case 'T':
790 if (!strcmp(optarg, "static"))
791 *elftype = ELFSTATIC;
792 else if (!strcmp(optarg, "dynamic"))
793 *elftype = ELFDYNAMIC;
794 else {
795 fprintf(stderr, "ELF type must be 'static' or "
796 "'dynamic'.\n");
797 exit(1);
798 }
799 break;
800 case 'w':
801 minijail_new_session_keyring(j);
802 break;
803 case 'Y':
804 minijail_set_seccomp_filter_tsync(j);
805 break;
806 case 'z':
807 forward = 0;
808 break;
809 case 'd':
810 minijail_namespace_vfs(j);
811 minijail_mount_dev(j);
812 break;
813 /* Long options. */
814 case 128: /* Ambient caps. */
815 ambient_caps = 1;
816 minijail_set_ambient_caps(j);
817 break;
818 case 129: /* UTS/hostname namespace. */
819 minijail_namespace_uts(j);
820 if (optarg)
821 minijail_namespace_set_hostname(j, optarg);
822 break;
823 case 130: /* Logging. */
824 if (!strcmp(optarg, "syslog"))
825 log_to_stderr = 0;
826 else if (!strcmp(optarg, "stderr")) {
827 log_to_stderr = 1;
828 } else {
829 fprintf(stderr, "--logger must be 'syslog' or "
830 "'stderr'.\n");
831 exit(1);
832 }
833 break;
834 case 131: /* Profile */
835 use_profile(j, optarg, &pivot_root, chroot, &tmp_size);
836 break;
837 case 132: /* PRELOADPATH */
838 *preload_path = optarg;
839 break;
840 case 133: /* seccomp-bpf binary. */
841 if (seccomp != -1 && seccomp != 3) {
842 fprintf(stderr,
843 "Do not use -s, -S, or "
844 "--seccomp-bpf-binary together.\n");
845 exit(1);
846 }
847 seccomp = 3;
848 minijail_use_seccomp_filter(j);
849 filter_path = optarg;
850 use_seccomp_filter_binary = 1;
851 break;
852 default:
853 usage(argv[0]);
854 exit(opt == 'h' ? 0 : 1);
855 }
856 }
857
858 if (log_to_stderr) {
859 init_logging(LOG_TO_FD, STDERR_FILENO, LOG_INFO);
860 /*
861 * When logging to stderr, ensure the FD survives the jailing.
862 */
863 if (0 !=
864 minijail_preserve_fd(j, STDERR_FILENO, STDERR_FILENO)) {
865 fprintf(stderr, "Could not preserve stderr.\n");
866 exit(1);
867 }
868 }
869
870 /* Set up uid/gid mapping. */
871 if (set_uidmap || set_gidmap) {
872 set_ugid_mapping(j, set_uidmap, uid, uidmap, set_gidmap, gid,
873 gidmap);
874 }
875
876 /* Can only set ambient caps when using regular caps. */
877 if (ambient_caps && !caps) {
878 fprintf(stderr, "Can't set ambient capabilities (--ambient) "
879 "without actually using capabilities (-c).\n");
880 exit(1);
881 }
882
883 /* Set up signal handlers in minijail unless asked not to. */
884 if (forward)
885 minijail_forward_signals(j);
886
887 /*
888 * Only allow bind mounts when entering a chroot, using pivot_root, or
889 * a new mount namespace.
890 */
891 if (binding && !(chroot || pivot_root || mount_ns)) {
892 fprintf(stderr, "Bind mounts require a chroot, pivot_root, or "
893 " new mount namespace.\n");
894 exit(1);
895 }
896
897 /*
898 * Remounting / as MS_PRIVATE only happens when entering a new mount
899 * namespace, so skipping it only applies in that case.
900 */
901 if (skip_remount && !mount_ns) {
902 fprintf(stderr, "Can't skip marking mounts as MS_PRIVATE"
903 " without mount namespaces.\n");
904 exit(1);
905 }
906
907 /*
908 * We parse seccomp filters here to make sure we've collected all
909 * cmdline options.
910 */
911 if (use_seccomp_filter) {
912 minijail_parse_seccomp_filters(j, filter_path);
913 } else if (use_seccomp_filter_binary) {
914 struct sock_fprog filter;
915 read_seccomp_filter(filter_path, &filter);
916 minijail_set_seccomp_filters(j, &filter);
917 free((void *)filter.filter);
918 }
919
920 /* Mount a tmpfs under /tmp and set its size. */
921 if (tmp_size)
922 minijail_mount_tmp_size(j, tmp_size);
923
924 /*
925 * There should be at least one additional unparsed argument: the
926 * executable name.
927 */
928 if (argc == optind) {
929 usage(argv[0]);
930 exit(1);
931 }
932
933 if (*elftype == ELFERROR) {
934 /*
935 * -T was not specified.
936 * Get the path to the program adjusted for changing root.
937 */
938 char *program_path =
939 minijail_get_original_path(j, argv[optind]);
940
941 /* Check that we can access the target program. */
942 if (access(program_path, X_OK)) {
943 fprintf(stderr,
944 "Target program '%s' is not accessible.\n",
945 argv[optind]);
946 exit(1);
947 }
948
949 /* Check if target is statically or dynamically linked. */
950 *elftype = get_elf_linkage(program_path);
951 free(program_path);
952 }
953
954 /*
955 * Setting capabilities need either a dynamically-linked binary, or the
956 * use of ambient capabilities for them to be able to survive an
957 * execve(2).
958 */
959 if (caps && *elftype == ELFSTATIC && !ambient_caps) {
960 fprintf(stderr, "Can't run statically-linked binaries with "
961 "capabilities (-c) without also setting "
962 "ambient capabilities. Try passing "
963 "--ambient.\n");
964 exit(1);
965 }
966
967 return optind;
968 }
969