1 /* Copyright (c) 2012 The Chromium OS Authors. All rights reserved.
2 * Use of this source code is governed by a BSD-style license that can be
3 * found in the LICENSE file.
4 */
5
6 #include <dlfcn.h>
7 #include <getopt.h>
8 #include <stdio.h>
9 #include <stdlib.h>
10 #include <string.h>
11 #include <unistd.h>
12
13 #include "libminijail.h"
14 #include "libsyscalls.h"
15
16 #include "elfparse.h"
17 #include "util.h"
18
19 #define IDMAP_LEN 32U
20
set_user(struct minijail * j,const char * arg)21 static void set_user(struct minijail *j, const char *arg)
22 {
23 char *end = NULL;
24 int uid = strtod(arg, &end);
25 if (!*end && *arg) {
26 minijail_change_uid(j, uid);
27 return;
28 }
29
30 if (minijail_change_user(j, arg)) {
31 fprintf(stderr, "Bad user: '%s'\n", arg);
32 exit(1);
33 }
34 }
35
set_group(struct minijail * j,const char * arg)36 static void set_group(struct minijail *j, const char *arg)
37 {
38 char *end = NULL;
39 int gid = strtod(arg, &end);
40 if (!*end && *arg) {
41 minijail_change_gid(j, gid);
42 return;
43 }
44
45 if (minijail_change_group(j, arg)) {
46 fprintf(stderr, "Bad group: '%s'\n", arg);
47 exit(1);
48 }
49 }
50
skip_securebits(struct minijail * j,const char * arg)51 static void skip_securebits(struct minijail *j, const char *arg)
52 {
53 uint64_t securebits_skip_mask;
54 char *end = NULL;
55 securebits_skip_mask = strtoull(arg, &end, 16);
56 if (*end) {
57 fprintf(stderr, "Invalid securebit mask: '%s'\n", arg);
58 exit(1);
59 }
60 minijail_skip_setting_securebits(j, securebits_skip_mask);
61 }
62
use_caps(struct minijail * j,const char * arg)63 static void use_caps(struct minijail *j, const char *arg)
64 {
65 uint64_t caps;
66 char *end = NULL;
67 caps = strtoull(arg, &end, 16);
68 if (*end) {
69 fprintf(stderr, "Invalid cap set: '%s'\n", arg);
70 exit(1);
71 }
72 minijail_use_caps(j, caps);
73 }
74
add_binding(struct minijail * j,char * arg)75 static void add_binding(struct minijail *j, char *arg)
76 {
77 char *src = strtok(arg, ",");
78 char *dest = strtok(NULL, ",");
79 char *flags = strtok(NULL, ",");
80 if (!src || !dest) {
81 fprintf(stderr, "Bad binding: %s %s\n", src, dest);
82 exit(1);
83 }
84 if (minijail_bind(j, src, dest, flags ? atoi(flags) : 0)) {
85 fprintf(stderr, "minijail_bind failed.\n");
86 exit(1);
87 }
88 }
89
add_rlimit(struct minijail * j,char * arg)90 static void add_rlimit(struct minijail *j, char *arg)
91 {
92 char *type = strtok(arg, ",");
93 char *cur = strtok(NULL, ",");
94 char *max = strtok(NULL, ",");
95 if (!type || !cur || !max) {
96 fprintf(stderr, "Bad rlimit '%s'.\n", arg);
97 exit(1);
98 }
99 if (minijail_rlimit(j, atoi(type), atoi(cur), atoi(max))) {
100 fprintf(stderr, "minijail_rlimit '%s,%s,%s' failed.\n",
101 type, cur, max);
102 exit(1);
103 }
104 }
105
add_mount(struct minijail * j,char * arg)106 static void add_mount(struct minijail *j, char *arg)
107 {
108 char *src = strtok(arg, ",");
109 char *dest = strtok(NULL, ",");
110 char *type = strtok(NULL, ",");
111 char *flags = strtok(NULL, ",");
112 char *data = strtok(NULL, ",");
113 if (!src || !dest || !type) {
114 fprintf(stderr, "Bad mount: %s %s %s\n", src, dest, type);
115 exit(1);
116 }
117 if (minijail_mount_with_data(j, src, dest, type,
118 flags ? strtoul(flags, NULL, 16) : 0,
119 data)) {
120 fprintf(stderr, "minijail_mount failed.\n");
121 exit(1);
122 }
123 }
124
build_idmap(id_t id,id_t lowerid)125 static char *build_idmap(id_t id, id_t lowerid)
126 {
127 int ret;
128 char *idmap = malloc(IDMAP_LEN);
129 ret = snprintf(idmap, IDMAP_LEN, "%d %d 1", id, lowerid);
130 if (ret < 0 || (size_t)ret >= IDMAP_LEN) {
131 free(idmap);
132 fprintf(stderr, "Could not build id map.\n");
133 exit(1);
134 }
135 return idmap;
136 }
137
usage(const char * progn)138 static void usage(const char *progn)
139 {
140 size_t i;
141 /* clang-format off */
142 printf("Usage: %s [-GhHiIKlLnNprRstUvyYz]\n"
143 " [-a <table>]\n"
144 " [-b <src>,<dest>[,<writeable>]] [-k <src>,<dest>,<type>[,<flags>][,<data>]]\n"
145 " [-c <caps>] [-C <dir>] [-P <dir>] [-e[file]] [-f <file>] [-g <group>]\n"
146 " [-m[<uid> <loweruid> <count>]*] [-M[<gid> <lowergid> <count>]*]\n"
147 " [-R <type,cur,max>] [-S <file>] [-t[size]] [-T <type>] [-u <user>] [-V <file>]\n"
148 " <program> [args...]\n"
149 " -a <table>: Use alternate syscall table <table>.\n"
150 " -b: Bind <src> to <dest> in chroot.\n"
151 " Multiple instances allowed.\n"
152 " -B <mask> Skip setting securebits in <mask> when restricting capabilities (-c).\n"
153 " By default, SECURE_NOROOT, SECURE_NO_SETUID_FIXUP, and \n"
154 " SECURE_KEEP_CAPS (together with their respective locks) are set.\n"
155 " -k: Mount <src> at <dest> in chroot.\n"
156 " <flags> and <data> can be specified as in mount(2).\n"
157 " Multiple instances allowed.\n"
158 " -c <caps>: Restrict caps to <caps>.\n"
159 " -C <dir>: chroot(2) to <dir>.\n"
160 " Not compatible with -P.\n"
161 " -P <dir>: pivot_root(2) to <dir> (implies -v).\n"
162 " Not compatible with -C.\n"
163 " -e[file]: Enter new network namespace, or existing one if |file| is provided.\n"
164 " -f <file>: Write the pid of the jailed process to <file>.\n"
165 " -g <group>: Change gid to <group>.\n"
166 " -G: Inherit supplementary groups from uid.\n"
167 " Not compatible with -y.\n"
168 " -y: Keep uid's supplementary groups.\n"
169 " Not compatible with -G.\n"
170 " -h: Help (this message).\n"
171 " -H: Seccomp filter help message.\n"
172 " -i: Exit immediately after fork (do not act as init).\n"
173 " -I: Run <program> as init (pid 1) inside a new pid namespace (implies -p).\n"
174 " -K: Don't mark all existing mounts as MS_PRIVATE.\n"
175 " -l: Enter new IPC namespace.\n"
176 " -L: Report blocked syscalls to syslog when using seccomp filter.\n"
177 " Forces the following syscalls to be allowed:\n"
178 " ", progn);
179 /* clang-format on */
180 for (i = 0; i < log_syscalls_len; i++)
181 printf("%s ", log_syscalls[i]);
182
183 /* clang-format off */
184 printf("\n"
185 " -m[map]: Set the uid map of a user namespace (implies -pU).\n"
186 " Same arguments as newuidmap(1), multiple mappings should be separated by ',' (comma).\n"
187 " With no mapping, map the current uid to root inside the user namespace.\n"
188 " Not compatible with -b without the 'writable' option.\n"
189 " -M[map]: Set the gid map of a user namespace (implies -pU).\n"
190 " Same arguments as newgidmap(1), multiple mappings should be separated by ',' (comma).\n"
191 " With no mapping, map the current gid to root inside the user namespace.\n"
192 " Not compatible with -b without the 'writable' option.\n"
193 " -n: Set no_new_privs.\n"
194 " -N: Enter a new cgroup namespace.\n"
195 " -p: Enter new pid namespace (implies -vr).\n"
196 " -r: Remount /proc read-only (implies -v).\n"
197 " -R: Set rlimits, can be specified multiple times.\n"
198 " -s: Use seccomp mode 1 (not the same as -S).\n"
199 " -S <file>: Set seccomp filter using <file>.\n"
200 " E.g., '-S /usr/share/filters/<prog>.$(uname -m)'.\n"
201 " Requires -n when not running as root.\n"
202 " -t[size]: Mount tmpfs at /tmp (implies -v).\n"
203 " Optional argument specifies size (default \"64M\").\n"
204 " -T <type>: Don't access <program> before execve(2), assume <type> ELF binary.\n"
205 " <type> must be 'static' or 'dynamic'.\n"
206 " -u <user>: Change uid to <user>.\n"
207 " -U: Enter new user namespace (implies -p).\n"
208 " -v: Enter new mount namespace.\n"
209 " -V <file>: Enter specified mount namespace.\n"
210 " -w: Create and join a new anonymous session keyring.\n"
211 " -Y: Synchronize seccomp filters across thread group.\n"
212 " -z: Don't forward signals to jailed process.\n"
213 " --ambient: Raise ambient capabilities. Requires -c.\n"
214 " --uts[=name]: Enter a new UTS namespace (and set hostname).\n");
215 /* clang-format on */
216 }
217
seccomp_filter_usage(const char * progn)218 static void seccomp_filter_usage(const char *progn)
219 {
220 const struct syscall_entry *entry = syscall_table;
221 printf("Usage: %s -S <policy.file> <program> [args...]\n\n"
222 "System call names supported:\n",
223 progn);
224 for (; entry->name && entry->nr >= 0; ++entry)
225 printf(" %s [%d]\n", entry->name, entry->nr);
226 printf("\nSee minijail0(5) for example policies.\n");
227 }
228
parse_args(struct minijail * j,int argc,char * argv[],int * exit_immediately,ElfType * elftype)229 static int parse_args(struct minijail *j, int argc, char *argv[],
230 int *exit_immediately, ElfType *elftype)
231 {
232 int opt;
233 int use_seccomp_filter = 0;
234 int forward = 1;
235 int binding = 0;
236 int chroot = 0, pivot_root = 0;
237 int mount_ns = 0, skip_remount = 0;
238 int inherit_suppl_gids = 0, keep_suppl_gids = 0;
239 int caps = 0, ambient_caps = 0;
240 int seccomp = -1;
241 const size_t path_max = 4096;
242 char *map;
243 size_t size;
244 const char *filter_path;
245
246 const char *optstring =
247 "+u:g:sS:c:C:P:b:B:V:f:m::M::k:a:e::R:T:vrGhHinNplLt::IUKwyYz";
248 int longoption_index = 0;
249 /* clang-format off */
250 const struct option long_options[] = {
251 {"ambient", no_argument, 0, 128},
252 {"uts", optional_argument, 0, 129},
253 {0, 0, 0, 0},
254 };
255 /* clang-format on */
256
257 while ((opt = getopt_long(argc, argv, optstring, long_options,
258 &longoption_index)) != -1) {
259 switch (opt) {
260 case 'u':
261 set_user(j, optarg);
262 break;
263 case 'g':
264 set_group(j, optarg);
265 break;
266 case 'n':
267 minijail_no_new_privs(j);
268 break;
269 case 's':
270 if (seccomp != -1 && seccomp != 1) {
271 fprintf(stderr, "Do not use -s & -S together.\n");
272 exit(1);
273 }
274 seccomp = 1;
275 minijail_use_seccomp(j);
276 break;
277 case 'S':
278 if (seccomp != -1 && seccomp != 2) {
279 fprintf(stderr, "Do not use -s & -S together.\n");
280 exit(1);
281 }
282 seccomp = 2;
283 minijail_use_seccomp_filter(j);
284 if (strlen(optarg) >= path_max) {
285 fprintf(stderr, "Filter path is too long.\n");
286 exit(1);
287 }
288 filter_path = strndup(optarg, path_max);
289 if (!filter_path) {
290 fprintf(stderr,
291 "Could not strndup(3) filter path.\n");
292 exit(1);
293 }
294 use_seccomp_filter = 1;
295 break;
296 case 'l':
297 minijail_namespace_ipc(j);
298 break;
299 case 'L':
300 minijail_log_seccomp_filter_failures(j);
301 break;
302 case 'b':
303 add_binding(j, optarg);
304 binding = 1;
305 break;
306 case 'B':
307 skip_securebits(j, optarg);
308 break;
309 case 'c':
310 caps = 1;
311 use_caps(j, optarg);
312 break;
313 case 'C':
314 if (pivot_root) {
315 fprintf(stderr, "Could not set chroot because "
316 "'-P' was specified.\n");
317 exit(1);
318 }
319 if (0 != minijail_enter_chroot(j, optarg)) {
320 fprintf(stderr, "Could not set chroot.\n");
321 exit(1);
322 }
323 chroot = 1;
324 break;
325 case 'k':
326 add_mount(j, optarg);
327 break;
328 case 'K':
329 minijail_skip_remount_private(j);
330 skip_remount = 1;
331 break;
332 case 'P':
333 if (chroot) {
334 fprintf(stderr,
335 "Could not set pivot_root because "
336 "'-C' was specified.\n");
337 exit(1);
338 }
339 if (0 != minijail_enter_pivot_root(j, optarg)) {
340 fprintf(stderr, "Could not set pivot_root.\n");
341 exit(1);
342 }
343 minijail_namespace_vfs(j);
344 pivot_root = 1;
345 break;
346 case 'f':
347 if (0 != minijail_write_pid_file(j, optarg)) {
348 fprintf(stderr,
349 "Could not prepare pid file path.\n");
350 exit(1);
351 }
352 break;
353 case 't':
354 minijail_namespace_vfs(j);
355 size = 64 * 1024 * 1024;
356 if (optarg != NULL && 0 != parse_size(&size, optarg)) {
357 fprintf(stderr, "Invalid /tmp tmpfs size.\n");
358 exit(1);
359 }
360 minijail_mount_tmp_size(j, size);
361 break;
362 case 'v':
363 minijail_namespace_vfs(j);
364 mount_ns = 1;
365 break;
366 case 'V':
367 minijail_namespace_enter_vfs(j, optarg);
368 break;
369 case 'r':
370 minijail_remount_proc_readonly(j);
371 break;
372 case 'G':
373 if (keep_suppl_gids) {
374 fprintf(stderr,
375 "-y and -G are not compatible.\n");
376 exit(1);
377 }
378 minijail_inherit_usergroups(j);
379 inherit_suppl_gids = 1;
380 break;
381 case 'y':
382 if (inherit_suppl_gids) {
383 fprintf(stderr,
384 "-y and -G are not compatible.\n");
385 exit(1);
386 }
387 minijail_keep_supplementary_gids(j);
388 keep_suppl_gids = 1;
389 break;
390 case 'N':
391 minijail_namespace_cgroups(j);
392 break;
393 case 'p':
394 minijail_namespace_pids(j);
395 break;
396 case 'e':
397 if (optarg)
398 minijail_namespace_enter_net(j, optarg);
399 else
400 minijail_namespace_net(j);
401 break;
402 case 'i':
403 *exit_immediately = 1;
404 break;
405 case 'H':
406 seccomp_filter_usage(argv[0]);
407 exit(1);
408 case 'I':
409 minijail_namespace_pids(j);
410 minijail_run_as_init(j);
411 break;
412 case 'U':
413 minijail_namespace_user(j);
414 minijail_namespace_pids(j);
415 break;
416 case 'm':
417 minijail_namespace_user(j);
418 minijail_namespace_pids(j);
419
420 if (optarg) {
421 map = strdup(optarg);
422 } else {
423 /*
424 * If no map is passed, map the current uid to
425 * root.
426 */
427 map = build_idmap(0, getuid());
428 }
429 if (0 != minijail_uidmap(j, map)) {
430 fprintf(stderr, "Could not set uid map.\n");
431 exit(1);
432 }
433 free(map);
434 break;
435 case 'M':
436 minijail_namespace_user(j);
437 minijail_namespace_pids(j);
438
439 if (optarg) {
440 map = strdup(optarg);
441 } else {
442 /*
443 * If no map is passed, map the current gid to
444 * root.
445 * This means that we're likely *not* running as
446 * root, so we also have to disable
447 * setgroups(2) to be able to set the gid map.
448 * See
449 * http://man7.org/linux/man-pages/man7/user_namespaces.7.html
450 */
451 minijail_namespace_user_disable_setgroups(j);
452
453 map = build_idmap(0, getgid());
454 }
455 if (0 != minijail_gidmap(j, map)) {
456 fprintf(stderr, "Could not set gid map.\n");
457 exit(1);
458 }
459 free(map);
460 break;
461 case 'a':
462 if (0 != minijail_use_alt_syscall(j, optarg)) {
463 fprintf(stderr,
464 "Could not set alt-syscall table.\n");
465 exit(1);
466 }
467 break;
468 case 'R':
469 add_rlimit(j, optarg);
470 break;
471 case 'T':
472 if (!strcmp(optarg, "static"))
473 *elftype = ELFSTATIC;
474 else if (!strcmp(optarg, "dynamic"))
475 *elftype = ELFDYNAMIC;
476 else {
477 fprintf(stderr, "ELF type must be 'static' or "
478 "'dynamic'.\n");
479 exit(1);
480 }
481 break;
482 case 'w':
483 minijail_new_session_keyring(j);
484 break;
485 case 'Y':
486 minijail_set_seccomp_filter_tsync(j);
487 break;
488 case 'z':
489 forward = 0;
490 break;
491 /* Long options. */
492 case 128: /* Ambient caps. */
493 ambient_caps = 1;
494 minijail_set_ambient_caps(j);
495 break;
496 case 129: /* UTS/hostname namespace. */
497 minijail_namespace_uts(j);
498 if (optarg)
499 minijail_namespace_set_hostname(j, optarg);
500 break;
501 default:
502 usage(argv[0]);
503 exit(1);
504 }
505 }
506
507 /* Can only set ambient caps when using regular caps. */
508 if (ambient_caps && !caps) {
509 fprintf(stderr, "Can't set ambient capabilities (--ambient) "
510 "without actually using capabilities (-c).\n");
511 exit(1);
512 }
513
514 /* Set up signal handlers in minijail unless asked not to. */
515 if (forward)
516 minijail_forward_signals(j);
517
518 /* Only allow bind mounts when entering a chroot or using pivot_root. */
519 if (binding && !(chroot || pivot_root)) {
520 fprintf(stderr, "Can't add bind mounts without chroot or"
521 " pivot_root.\n");
522 exit(1);
523 }
524
525 /*
526 * Remounting / as MS_PRIVATE only happens when entering a new mount
527 * namespace, so skipping it only applies in that case.
528 */
529 if (skip_remount && !mount_ns) {
530 fprintf(stderr, "Can't skip marking mounts as MS_PRIVATE"
531 " without mount namespaces.\n");
532 exit(1);
533 }
534
535 /*
536 * We parse seccomp filters here to make sure we've collected all
537 * cmdline options.
538 */
539 if (use_seccomp_filter) {
540 minijail_parse_seccomp_filters(j, filter_path);
541 free((void *)filter_path);
542 }
543
544 /*
545 * There should be at least one additional unparsed argument: the
546 * executable name.
547 */
548 if (argc == optind) {
549 usage(argv[0]);
550 exit(1);
551 }
552
553 if (*elftype == ELFERROR) {
554 /*
555 * -T was not specified.
556 * Get the path to the program adjusted for changing root.
557 */
558 char *program_path =
559 minijail_get_original_path(j, argv[optind]);
560
561 /* Check that we can access the target program. */
562 if (access(program_path, X_OK)) {
563 fprintf(stderr,
564 "Target program '%s' is not accessible.\n",
565 argv[optind]);
566 exit(1);
567 }
568
569 /* Check if target is statically or dynamically linked. */
570 *elftype = get_elf_linkage(program_path);
571 free(program_path);
572 }
573
574 /*
575 * Setting capabilities need either a dynamically-linked binary, or the
576 * use of ambient capabilities for them to be able to survive an
577 * execve(2).
578 */
579 if (caps && *elftype == ELFSTATIC && !ambient_caps) {
580 fprintf(stderr, "Can't run statically-linked binaries with "
581 "capabilities (-c) without also setting "
582 "ambient capabilities. Try passing "
583 "--ambient.\n");
584 exit(1);
585 }
586
587 return optind;
588 }
589
main(int argc,char * argv[])590 int main(int argc, char *argv[])
591 {
592 struct minijail *j = minijail_new();
593 const char *dl_mesg = NULL;
594 int exit_immediately = 0;
595 ElfType elftype = ELFERROR;
596 int consumed = parse_args(j, argc, argv, &exit_immediately, &elftype);
597 argc -= consumed;
598 argv += consumed;
599
600 if (elftype == ELFSTATIC) {
601 /*
602 * Target binary is statically linked so we cannot use
603 * libminijailpreload.so.
604 */
605 minijail_run_no_preload(j, argv[0], argv);
606 } else if (elftype == ELFDYNAMIC) {
607 /*
608 * Target binary is dynamically linked so we can
609 * inject libminijailpreload.so into it.
610 */
611
612 /* Check that we can dlopen() libminijailpreload.so. */
613 if (!dlopen(PRELOADPATH, RTLD_LAZY | RTLD_LOCAL)) {
614 dl_mesg = dlerror();
615 fprintf(stderr, "dlopen(): %s\n", dl_mesg);
616 return 1;
617 }
618 minijail_run(j, argv[0], argv);
619 } else {
620 fprintf(stderr,
621 "Target program '%s' is not a valid ELF file.\n",
622 argv[0]);
623 return 1;
624 }
625
626 if (exit_immediately) {
627 info("not running init loop, exiting immediately");
628 return 0;
629 }
630 return minijail_wait(j);
631 }
632