libminijail.c revision db0bc67ee176f4c897c46974b6c5c36d60ddb39f
1/* Copyright (c) 2012 The Chromium OS Authors. All rights reserved. 2 * Use of this source code is governed by a BSD-style license that can be 3 * found in the LICENSE file. 4 */ 5 6#define _BSD_SOURCE 7#define _DEFAULT_SOURCE 8#define _GNU_SOURCE 9 10#include <asm/unistd.h> 11#include <ctype.h> 12#include <errno.h> 13#include <fcntl.h> 14#include <grp.h> 15#include <inttypes.h> 16#include <limits.h> 17#include <linux/capability.h> 18#include <pwd.h> 19#include <sched.h> 20#include <signal.h> 21#include <stdarg.h> 22#include <stdbool.h> 23#include <stddef.h> 24#include <stdio.h> 25#include <stdlib.h> 26#include <string.h> 27#include <syscall.h> 28#include <sys/capability.h> 29#include <sys/mount.h> 30#include <sys/param.h> 31#include <sys/prctl.h> 32#include <sys/stat.h> 33#include <sys/types.h> 34#include <sys/user.h> 35#include <sys/utsname.h> 36#include <sys/wait.h> 37#include <unistd.h> 38 39#include "libminijail.h" 40#include "libminijail-private.h" 41 42#include "signal_handler.h" 43#include "syscall_filter.h" 44#include "util.h" 45 46#ifdef HAVE_SECUREBITS_H 47# include <linux/securebits.h> 48#else 49# define SECURE_ALL_BITS 0x55 50# define SECURE_ALL_LOCKS (SECURE_ALL_BITS << 1) 51#endif 52/* For kernels < 4.3. */ 53#define OLD_SECURE_ALL_BITS 0x15 54#define OLD_SECURE_ALL_LOCKS (OLD_SECURE_ALL_BITS << 1) 55 56/* 57 * Assert the value of SECURE_ALL_BITS at compile-time. 58 * Brillo devices are currently compiled against 4.4 kernel headers. Kernel 4.3 59 * added a new securebit. 60 * When a new securebit is added, the new SECURE_ALL_BITS mask will return EPERM 61 * when used on older kernels. The compile-time assert will catch this situation 62 * at compile time. 63 */ 64#ifdef __BRILLO__ 65_Static_assert(SECURE_ALL_BITS == 0x55, "SECURE_ALL_BITS == 0x55."); 66#endif 67 68/* Until these are reliably available in linux/prctl.h. */ 69#ifndef PR_SET_SECCOMP 70# define PR_SET_SECCOMP 22 71#endif 72 73#ifndef PR_ALT_SYSCALL 74# define PR_ALT_SYSCALL 0x43724f53 75#endif 76 77/* For seccomp_filter using BPF. */ 78#ifndef PR_SET_NO_NEW_PRIVS 79# define PR_SET_NO_NEW_PRIVS 38 80#endif 81#ifndef SECCOMP_MODE_FILTER 82# define SECCOMP_MODE_FILTER 2 /* uses user-supplied filter. */ 83#endif 84 85#ifdef USE_SECCOMP_SOFTFAIL 86# define SECCOMP_SOFTFAIL 1 87#else 88# define SECCOMP_SOFTFAIL 0 89#endif 90 91/* New cgroup namespace might not be in linux-headers yet. */ 92#ifndef CLONE_NEWCGROUP 93# define CLONE_NEWCGROUP 0x02000000 94#endif 95 96#define MAX_CGROUPS 10 /* 10 different controllers supported by Linux. */ 97 98struct mountpoint { 99 char *src; 100 char *dest; 101 char *type; 102 char *data; 103 int has_data; 104 unsigned long flags; 105 struct mountpoint *next; 106}; 107 108struct minijail { 109 /* 110 * WARNING: if you add a flag here you need to make sure it's 111 * accounted for in minijail_pre{enter|exec}() below. 112 */ 113 struct { 114 int uid:1; 115 int gid:1; 116 int usergroups:1; 117 int suppl_gids:1; 118 int use_caps:1; 119 int capbset_drop:1; 120 int vfs:1; 121 int enter_vfs:1; 122 int skip_remount_private:1; 123 int pids:1; 124 int ipc:1; 125 int net:1; 126 int enter_net:1; 127 int ns_cgroups:1; 128 int userns:1; 129 int seccomp:1; 130 int remount_proc_ro:1; 131 int no_new_privs:1; 132 int seccomp_filter:1; 133 int log_seccomp_filter:1; 134 int chroot:1; 135 int pivot_root:1; 136 int mount_tmp:1; 137 int do_init:1; 138 int pid_file:1; 139 int cgroups:1; 140 int alt_syscall:1; 141 int reset_signal_mask:1; 142 } flags; 143 uid_t uid; 144 gid_t gid; 145 gid_t usergid; 146 char *user; 147 size_t suppl_gid_count; 148 gid_t *suppl_gid_list; 149 uint64_t caps; 150 uint64_t cap_bset; 151 pid_t initpid; 152 int mountns_fd; 153 int netns_fd; 154 char *chrootdir; 155 char *pid_file_path; 156 char *uidmap; 157 char *gidmap; 158 size_t filter_len; 159 struct sock_fprog *filter_prog; 160 char *alt_syscall_table; 161 struct mountpoint *mounts_head; 162 struct mountpoint *mounts_tail; 163 size_t mounts_count; 164 char *cgroups[MAX_CGROUPS]; 165 size_t cgroup_count; 166}; 167 168/* 169 * Strip out flags meant for the parent. 170 * We keep things that are not inherited across execve(2) (e.g. capabilities), 171 * or are easier to set after execve(2) (e.g. seccomp filters). 172 */ 173void minijail_preenter(struct minijail *j) 174{ 175 j->flags.vfs = 0; 176 j->flags.enter_vfs = 0; 177 j->flags.skip_remount_private = 0; 178 j->flags.remount_proc_ro = 0; 179 j->flags.pids = 0; 180 j->flags.do_init = 0; 181 j->flags.pid_file = 0; 182 j->flags.cgroups = 0; 183} 184 185/* 186 * Strip out flags meant for the child. 187 * We keep things that are inherited across execve(2). 188 */ 189void minijail_preexec(struct minijail *j) 190{ 191 int vfs = j->flags.vfs; 192 int enter_vfs = j->flags.enter_vfs; 193 int skip_remount_private = j->flags.skip_remount_private; 194 int remount_proc_ro = j->flags.remount_proc_ro; 195 int userns = j->flags.userns; 196 if (j->user) 197 free(j->user); 198 j->user = NULL; 199 if (j->suppl_gid_list) 200 free(j->suppl_gid_list); 201 j->suppl_gid_list = NULL; 202 memset(&j->flags, 0, sizeof(j->flags)); 203 /* Now restore anything we meant to keep. */ 204 j->flags.vfs = vfs; 205 j->flags.enter_vfs = enter_vfs; 206 j->flags.skip_remount_private = skip_remount_private; 207 j->flags.remount_proc_ro = remount_proc_ro; 208 j->flags.userns = userns; 209 /* Note, |pids| will already have been used before this call. */ 210} 211 212/* Returns true if the kernel version is less than 3.8. */ 213int seccomp_kernel_support_not_required() 214{ 215 int major, minor; 216 struct utsname uts; 217 return (uname(&uts) != -1 && 218 sscanf(uts.release, "%d.%d", &major, &minor) == 2 && 219 ((major < 3) || ((major == 3) && (minor < 8)))); 220} 221 222/* Allow seccomp soft-fail on Android devices with kernel version < 3.8. */ 223int can_softfail() 224{ 225#if SECCOMP_SOFTFAIL 226 if (is_android()) { 227 if (seccomp_kernel_support_not_required()) 228 return 1; 229 else 230 return 0; 231 } else { 232 return 1; 233 } 234#endif 235 return 0; 236} 237 238/* Minijail API. */ 239 240struct minijail API *minijail_new(void) 241{ 242 return calloc(1, sizeof(struct minijail)); 243} 244 245void API minijail_change_uid(struct minijail *j, uid_t uid) 246{ 247 if (uid == 0) 248 die("useless change to uid 0"); 249 j->uid = uid; 250 j->flags.uid = 1; 251} 252 253void API minijail_change_gid(struct minijail *j, gid_t gid) 254{ 255 if (gid == 0) 256 die("useless change to gid 0"); 257 j->gid = gid; 258 j->flags.gid = 1; 259} 260 261void API minijail_set_supplementary_gids(struct minijail *j, size_t size, 262 const gid_t *list) 263{ 264 size_t i; 265 266 if (j->flags.usergroups) 267 die("cannot inherit *and* set supplementary groups"); 268 269 if (size == 0) { 270 /* Clear supplementary groups. */ 271 j->suppl_gid_list = NULL; 272 j->suppl_gid_count = 0; 273 j->flags.suppl_gids = 1; 274 return; 275 } 276 277 /* Copy the gid_t array. */ 278 j->suppl_gid_list = calloc(size, sizeof(gid_t)); 279 if (!j->suppl_gid_list) { 280 die("failed to allocate internal supplementary group array"); 281 } 282 for (i = 0; i < size; i++) { 283 j->suppl_gid_list[i] = list[i]; 284 } 285 j->suppl_gid_count = size; 286 j->flags.suppl_gids = 1; 287} 288 289int API minijail_change_user(struct minijail *j, const char *user) 290{ 291 char *buf = NULL; 292 struct passwd pw; 293 struct passwd *ppw = NULL; 294 ssize_t sz = sysconf(_SC_GETPW_R_SIZE_MAX); 295 if (sz == -1) 296 sz = 65536; /* your guess is as good as mine... */ 297 298 /* 299 * sysconf(_SC_GETPW_R_SIZE_MAX), under glibc, is documented to return 300 * the maximum needed size of the buffer, so we don't have to search. 301 */ 302 buf = malloc(sz); 303 if (!buf) 304 return -ENOMEM; 305 getpwnam_r(user, &pw, buf, sz, &ppw); 306 /* 307 * We're safe to free the buffer here. The strings inside |pw| point 308 * inside |buf|, but we don't use any of them; this leaves the pointers 309 * dangling but it's safe. |ppw| points at |pw| if getpwnam_r(3) 310 * succeeded. 311 */ 312 free(buf); 313 /* getpwnam_r(3) does *not* set errno when |ppw| is NULL. */ 314 if (!ppw) 315 return -1; 316 minijail_change_uid(j, ppw->pw_uid); 317 j->user = strdup(user); 318 if (!j->user) 319 return -ENOMEM; 320 j->usergid = ppw->pw_gid; 321 return 0; 322} 323 324int API minijail_change_group(struct minijail *j, const char *group) 325{ 326 char *buf = NULL; 327 struct group gr; 328 struct group *pgr = NULL; 329 ssize_t sz = sysconf(_SC_GETGR_R_SIZE_MAX); 330 if (sz == -1) 331 sz = 65536; /* and mine is as good as yours, really */ 332 333 /* 334 * sysconf(_SC_GETGR_R_SIZE_MAX), under glibc, is documented to return 335 * the maximum needed size of the buffer, so we don't have to search. 336 */ 337 buf = malloc(sz); 338 if (!buf) 339 return -ENOMEM; 340 getgrnam_r(group, &gr, buf, sz, &pgr); 341 /* 342 * We're safe to free the buffer here. The strings inside gr point 343 * inside buf, but we don't use any of them; this leaves the pointers 344 * dangling but it's safe. pgr points at gr if getgrnam_r succeeded. 345 */ 346 free(buf); 347 /* getgrnam_r(3) does *not* set errno when |pgr| is NULL. */ 348 if (!pgr) 349 return -1; 350 minijail_change_gid(j, pgr->gr_gid); 351 return 0; 352} 353 354void API minijail_use_seccomp(struct minijail *j) 355{ 356 j->flags.seccomp = 1; 357} 358 359void API minijail_no_new_privs(struct minijail *j) 360{ 361 j->flags.no_new_privs = 1; 362} 363 364void API minijail_use_seccomp_filter(struct minijail *j) 365{ 366 j->flags.seccomp_filter = 1; 367} 368 369void API minijail_log_seccomp_filter_failures(struct minijail *j) 370{ 371 j->flags.log_seccomp_filter = 1; 372} 373 374void API minijail_use_caps(struct minijail *j, uint64_t capmask) 375{ 376 /* 377 * 'minijail_use_caps' configures a runtime-capabilities-only 378 * environment, including a bounding set matching the thread's runtime 379 * (permitted|inheritable|effective) sets. 380 * Therefore, it will override any existing bounding set configurations 381 * since the latter would allow gaining extra runtime capabilities from 382 * file capabilities. 383 */ 384 if (j->flags.capbset_drop) { 385 warn("overriding bounding set configuration"); 386 j->cap_bset = 0; 387 j->flags.capbset_drop = 0; 388 } 389 j->caps = capmask; 390 j->flags.use_caps = 1; 391} 392 393void API minijail_capbset_drop(struct minijail *j, uint64_t capmask) 394{ 395 if (j->flags.use_caps) { 396 /* 397 * 'minijail_use_caps' will have already configured a capability 398 * bounding set matching the (permitted|inheritable|effective) 399 * sets. Abort if the user tries to configure a separate 400 * bounding set. 'minijail_capbset_drop' and 'minijail_use_caps' 401 * are mutually exclusive. 402 */ 403 die("runtime capabilities already configured, can't drop " 404 "bounding set separately"); 405 } 406 j->cap_bset = capmask; 407 j->flags.capbset_drop = 1; 408} 409 410void API minijail_reset_signal_mask(struct minijail *j) 411{ 412 j->flags.reset_signal_mask = 1; 413} 414 415void API minijail_namespace_vfs(struct minijail *j) 416{ 417 j->flags.vfs = 1; 418} 419 420void API minijail_namespace_enter_vfs(struct minijail *j, const char *ns_path) 421{ 422 int ns_fd = open(ns_path, O_RDONLY | O_CLOEXEC); 423 if (ns_fd < 0) { 424 pdie("failed to open namespace '%s'", ns_path); 425 } 426 j->mountns_fd = ns_fd; 427 j->flags.enter_vfs = 1; 428} 429 430void API minijail_skip_remount_private(struct minijail *j) 431{ 432 j->flags.skip_remount_private = 1; 433} 434 435void API minijail_namespace_pids(struct minijail *j) 436{ 437 j->flags.vfs = 1; 438 j->flags.remount_proc_ro = 1; 439 j->flags.pids = 1; 440 j->flags.do_init = 1; 441} 442 443void API minijail_namespace_ipc(struct minijail *j) 444{ 445 j->flags.ipc = 1; 446} 447 448void API minijail_namespace_net(struct minijail *j) 449{ 450 j->flags.net = 1; 451} 452 453void API minijail_namespace_enter_net(struct minijail *j, const char *ns_path) 454{ 455 int ns_fd = open(ns_path, O_RDONLY | O_CLOEXEC); 456 if (ns_fd < 0) { 457 pdie("failed to open namespace '%s'", ns_path); 458 } 459 j->netns_fd = ns_fd; 460 j->flags.enter_net = 1; 461} 462 463void API minijail_namespace_cgroups(struct minijail *j) 464{ 465 j->flags.ns_cgroups = 1; 466} 467 468void API minijail_remount_proc_readonly(struct minijail *j) 469{ 470 j->flags.vfs = 1; 471 j->flags.remount_proc_ro = 1; 472} 473 474void API minijail_namespace_user(struct minijail *j) 475{ 476 j->flags.userns = 1; 477} 478 479int API minijail_uidmap(struct minijail *j, const char *uidmap) 480{ 481 j->uidmap = strdup(uidmap); 482 if (!j->uidmap) 483 return -ENOMEM; 484 char *ch; 485 for (ch = j->uidmap; *ch; ch++) { 486 if (*ch == ',') 487 *ch = '\n'; 488 } 489 return 0; 490} 491 492int API minijail_gidmap(struct minijail *j, const char *gidmap) 493{ 494 j->gidmap = strdup(gidmap); 495 if (!j->gidmap) 496 return -ENOMEM; 497 char *ch; 498 for (ch = j->gidmap; *ch; ch++) { 499 if (*ch == ',') 500 *ch = '\n'; 501 } 502 return 0; 503} 504 505void API minijail_inherit_usergroups(struct minijail *j) 506{ 507 j->flags.usergroups = 1; 508} 509 510void API minijail_run_as_init(struct minijail *j) 511{ 512 /* 513 * Since the jailed program will become 'init' in the new PID namespace, 514 * Minijail does not need to fork an 'init' process. 515 */ 516 j->flags.do_init = 0; 517} 518 519int API minijail_enter_chroot(struct minijail *j, const char *dir) 520{ 521 if (j->chrootdir) 522 return -EINVAL; 523 j->chrootdir = strdup(dir); 524 if (!j->chrootdir) 525 return -ENOMEM; 526 j->flags.chroot = 1; 527 return 0; 528} 529 530int API minijail_enter_pivot_root(struct minijail *j, const char *dir) 531{ 532 if (j->chrootdir) 533 return -EINVAL; 534 j->chrootdir = strdup(dir); 535 if (!j->chrootdir) 536 return -ENOMEM; 537 j->flags.pivot_root = 1; 538 return 0; 539} 540 541static char *append_external_path(const char *external_path, 542 const char *path_inside_chroot) 543{ 544 char *path; 545 size_t pathlen; 546 547 /* One extra char for '/' and one for '\0', hence + 2. */ 548 pathlen = strlen(path_inside_chroot) + strlen(external_path) + 2; 549 path = malloc(pathlen); 550 snprintf(path, pathlen, "%s/%s", external_path, path_inside_chroot); 551 552 return path; 553} 554 555char API *minijail_get_original_path(struct minijail *j, 556 const char *path_inside_chroot) 557{ 558 struct mountpoint *b; 559 560 b = j->mounts_head; 561 while (b) { 562 /* 563 * If |path_inside_chroot| is the exact destination of a 564 * mount, then the original path is exactly the source of 565 * the mount. 566 * for example: "-b /some/path/exe,/chroot/path/exe" 567 * mount source = /some/path/exe, mount dest = 568 * /chroot/path/exe Then when getting the original path of 569 * "/chroot/path/exe", the source of that mount, 570 * "/some/path/exe" is what should be returned. 571 */ 572 if (!strcmp(b->dest, path_inside_chroot)) 573 return strdup(b->src); 574 575 /* 576 * If |path_inside_chroot| is within the destination path of a 577 * mount, take the suffix of the chroot path relative to the 578 * mount destination path, and append it to the mount source 579 * path. 580 */ 581 if (!strncmp(b->dest, path_inside_chroot, strlen(b->dest))) { 582 const char *relative_path = 583 path_inside_chroot + strlen(b->dest); 584 return append_external_path(b->src, relative_path); 585 } 586 b = b->next; 587 } 588 589 /* If there is a chroot path, append |path_inside_chroot| to that. */ 590 if (j->chrootdir) 591 return append_external_path(j->chrootdir, path_inside_chroot); 592 593 /* No chroot, so the path outside is the same as it is inside. */ 594 return strdup(path_inside_chroot); 595} 596 597void API minijail_mount_tmp(struct minijail *j) 598{ 599 j->flags.mount_tmp = 1; 600} 601 602int API minijail_write_pid_file(struct minijail *j, const char *path) 603{ 604 j->pid_file_path = strdup(path); 605 if (!j->pid_file_path) 606 return -ENOMEM; 607 j->flags.pid_file = 1; 608 return 0; 609} 610 611int API minijail_add_to_cgroup(struct minijail *j, const char *path) 612{ 613 if (j->cgroup_count >= MAX_CGROUPS) 614 return -ENOMEM; 615 j->cgroups[j->cgroup_count] = strdup(path); 616 if (!j->cgroups[j->cgroup_count]) 617 return -ENOMEM; 618 j->cgroup_count++; 619 j->flags.cgroups = 1; 620 return 0; 621} 622 623int API minijail_mount_with_data(struct minijail *j, const char *src, 624 const char *dest, const char *type, 625 unsigned long flags, const char *data) 626{ 627 struct mountpoint *m; 628 629 if (*dest != '/') 630 return -EINVAL; 631 m = calloc(1, sizeof(*m)); 632 if (!m) 633 return -ENOMEM; 634 m->dest = strdup(dest); 635 if (!m->dest) 636 goto error; 637 m->src = strdup(src); 638 if (!m->src) 639 goto error; 640 m->type = strdup(type); 641 if (!m->type) 642 goto error; 643 if (data) { 644 m->data = strdup(data); 645 if (!m->data) 646 goto error; 647 m->has_data = 1; 648 } 649 m->flags = flags; 650 651 info("mount %s -> %s type '%s'", src, dest, type); 652 653 /* 654 * Force vfs namespacing so the mounts don't leak out into the 655 * containing vfs namespace. 656 */ 657 minijail_namespace_vfs(j); 658 659 if (j->mounts_tail) 660 j->mounts_tail->next = m; 661 else 662 j->mounts_head = m; 663 j->mounts_tail = m; 664 j->mounts_count++; 665 666 return 0; 667 668error: 669 free(m->type); 670 free(m->src); 671 free(m->dest); 672 free(m); 673 return -ENOMEM; 674} 675 676int API minijail_mount(struct minijail *j, const char *src, const char *dest, 677 const char *type, unsigned long flags) 678{ 679 return minijail_mount_with_data(j, src, dest, type, flags, NULL); 680} 681 682int API minijail_bind(struct minijail *j, const char *src, const char *dest, 683 int writeable) 684{ 685 unsigned long flags = MS_BIND; 686 687 if (!writeable) 688 flags |= MS_RDONLY; 689 690 return minijail_mount(j, src, dest, "", flags); 691} 692 693void API minijail_parse_seccomp_filters(struct minijail *j, const char *path) 694{ 695 if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, NULL)) { 696 if ((errno == EINVAL) && can_softfail()) { 697 warn("not loading seccomp filter," 698 " seccomp not supported"); 699 j->flags.seccomp_filter = 0; 700 j->flags.log_seccomp_filter = 0; 701 j->filter_len = 0; 702 j->filter_prog = NULL; 703 j->flags.no_new_privs = 0; 704 } 705 } 706 FILE *file = fopen(path, "r"); 707 if (!file) { 708 pdie("failed to open seccomp filter file '%s'", path); 709 } 710 711 struct sock_fprog *fprog = malloc(sizeof(struct sock_fprog)); 712 if (compile_filter(file, fprog, j->flags.log_seccomp_filter)) { 713 die("failed to compile seccomp filter BPF program in '%s'", 714 path); 715 } 716 717 j->filter_len = fprog->len; 718 j->filter_prog = fprog; 719 720 fclose(file); 721} 722 723int API minijail_use_alt_syscall(struct minijail *j, const char *table) 724{ 725 j->alt_syscall_table = strdup(table); 726 if (!j->alt_syscall_table) 727 return -ENOMEM; 728 j->flags.alt_syscall = 1; 729 return 0; 730} 731 732struct marshal_state { 733 size_t available; 734 size_t total; 735 char *buf; 736}; 737 738void marshal_state_init(struct marshal_state *state, char *buf, 739 size_t available) 740{ 741 state->available = available; 742 state->buf = buf; 743 state->total = 0; 744} 745 746void marshal_append(struct marshal_state *state, void *src, size_t length) 747{ 748 size_t copy_len = MIN(state->available, length); 749 750 /* Up to |available| will be written. */ 751 if (copy_len) { 752 memcpy(state->buf, src, copy_len); 753 state->buf += copy_len; 754 state->available -= copy_len; 755 } 756 /* |total| will contain the expected length. */ 757 state->total += length; 758} 759 760static void minijail_marshal_mount(struct marshal_state *state, 761 const struct mountpoint *m) 762{ 763 marshal_append(state, m->src, strlen(m->src) + 1); 764 marshal_append(state, m->dest, strlen(m->dest) + 1); 765 marshal_append(state, m->type, strlen(m->type) + 1); 766 marshal_append(state, (char *)&m->has_data, sizeof(m->has_data)); 767 if (m->has_data) 768 marshal_append(state, m->data, strlen(m->data) + 1); 769 marshal_append(state, (char *)&m->flags, sizeof(m->flags)); 770} 771 772void minijail_marshal_helper(struct marshal_state *state, 773 const struct minijail *j) 774{ 775 struct mountpoint *m = NULL; 776 size_t i; 777 778 marshal_append(state, (char *)j, sizeof(*j)); 779 if (j->user) 780 marshal_append(state, j->user, strlen(j->user) + 1); 781 if (j->suppl_gid_list) { 782 marshal_append(state, j->suppl_gid_list, 783 j->suppl_gid_count * sizeof(gid_t)); 784 } 785 if (j->chrootdir) 786 marshal_append(state, j->chrootdir, strlen(j->chrootdir) + 1); 787 if (j->alt_syscall_table) { 788 marshal_append(state, j->alt_syscall_table, 789 strlen(j->alt_syscall_table) + 1); 790 } 791 if (j->flags.seccomp_filter && j->filter_prog) { 792 struct sock_fprog *fp = j->filter_prog; 793 marshal_append(state, (char *)fp->filter, 794 fp->len * sizeof(struct sock_filter)); 795 } 796 for (m = j->mounts_head; m; m = m->next) { 797 minijail_marshal_mount(state, m); 798 } 799 for (i = 0; i < j->cgroup_count; ++i) 800 marshal_append(state, j->cgroups[i], strlen(j->cgroups[i]) + 1); 801} 802 803size_t API minijail_size(const struct minijail *j) 804{ 805 struct marshal_state state; 806 marshal_state_init(&state, NULL, 0); 807 minijail_marshal_helper(&state, j); 808 return state.total; 809} 810 811int minijail_marshal(const struct minijail *j, char *buf, size_t available) 812{ 813 struct marshal_state state; 814 marshal_state_init(&state, buf, available); 815 minijail_marshal_helper(&state, j); 816 return (state.total > available); 817} 818 819/* 820 * consumebytes: consumes @length bytes from a buffer @buf of length @buflength 821 * @length Number of bytes to consume 822 * @buf Buffer to consume from 823 * @buflength Size of @buf 824 * 825 * Returns a pointer to the base of the bytes, or NULL for errors. 826 */ 827void *consumebytes(size_t length, char **buf, size_t *buflength) 828{ 829 char *p = *buf; 830 if (length > *buflength) 831 return NULL; 832 *buf += length; 833 *buflength -= length; 834 return p; 835} 836 837/* 838 * consumestr: consumes a C string from a buffer @buf of length @length 839 * @buf Buffer to consume 840 * @length Length of buffer 841 * 842 * Returns a pointer to the base of the string, or NULL for errors. 843 */ 844char *consumestr(char **buf, size_t *buflength) 845{ 846 size_t len = strnlen(*buf, *buflength); 847 if (len == *buflength) 848 /* There's no null-terminator. */ 849 return NULL; 850 return consumebytes(len + 1, buf, buflength); 851} 852 853int minijail_unmarshal(struct minijail *j, char *serialized, size_t length) 854{ 855 size_t i; 856 size_t count; 857 int ret = -EINVAL; 858 859 if (length < sizeof(*j)) 860 goto out; 861 memcpy((void *)j, serialized, sizeof(*j)); 862 serialized += sizeof(*j); 863 length -= sizeof(*j); 864 865 /* Potentially stale pointers not used as signals. */ 866 j->mounts_head = NULL; 867 j->mounts_tail = NULL; 868 j->filter_prog = NULL; 869 870 if (j->user) { /* stale pointer */ 871 char *user = consumestr(&serialized, &length); 872 if (!user) 873 goto clear_pointers; 874 j->user = strdup(user); 875 if (!j->user) 876 goto clear_pointers; 877 } 878 879 if (j->suppl_gid_list) { /* stale pointer */ 880 if (j->suppl_gid_count > NGROUPS_MAX) { 881 goto bad_gid_list; 882 } 883 size_t gid_list_size = j->suppl_gid_count * sizeof(gid_t); 884 void *gid_list_bytes = 885 consumebytes(gid_list_size, &serialized, &length); 886 if (!gid_list_bytes) 887 goto bad_gid_list; 888 889 j->suppl_gid_list = calloc(j->suppl_gid_count, sizeof(gid_t)); 890 if (!j->suppl_gid_list) 891 goto bad_gid_list; 892 893 memcpy(j->suppl_gid_list, gid_list_bytes, gid_list_size); 894 } 895 896 if (j->chrootdir) { /* stale pointer */ 897 char *chrootdir = consumestr(&serialized, &length); 898 if (!chrootdir) 899 goto bad_chrootdir; 900 j->chrootdir = strdup(chrootdir); 901 if (!j->chrootdir) 902 goto bad_chrootdir; 903 } 904 905 if (j->alt_syscall_table) { /* stale pointer */ 906 char *alt_syscall_table = consumestr(&serialized, &length); 907 if (!alt_syscall_table) 908 goto bad_syscall_table; 909 j->alt_syscall_table = strdup(alt_syscall_table); 910 if (!j->alt_syscall_table) 911 goto bad_syscall_table; 912 } 913 914 if (j->flags.seccomp_filter && j->filter_len > 0) { 915 size_t ninstrs = j->filter_len; 916 if (ninstrs > (SIZE_MAX / sizeof(struct sock_filter)) || 917 ninstrs > USHRT_MAX) 918 goto bad_filters; 919 920 size_t program_len = ninstrs * sizeof(struct sock_filter); 921 void *program = consumebytes(program_len, &serialized, &length); 922 if (!program) 923 goto bad_filters; 924 925 j->filter_prog = malloc(sizeof(struct sock_fprog)); 926 if (!j->filter_prog) 927 goto bad_filters; 928 929 j->filter_prog->len = ninstrs; 930 j->filter_prog->filter = malloc(program_len); 931 if (!j->filter_prog->filter) 932 goto bad_filter_prog_instrs; 933 934 memcpy(j->filter_prog->filter, program, program_len); 935 } 936 937 count = j->mounts_count; 938 j->mounts_count = 0; 939 for (i = 0; i < count; ++i) { 940 unsigned long *flags; 941 int *has_data; 942 const char *dest; 943 const char *type; 944 const char *data = NULL; 945 const char *src = consumestr(&serialized, &length); 946 if (!src) 947 goto bad_mounts; 948 dest = consumestr(&serialized, &length); 949 if (!dest) 950 goto bad_mounts; 951 type = consumestr(&serialized, &length); 952 if (!type) 953 goto bad_mounts; 954 has_data = consumebytes(sizeof(*has_data), &serialized, 955 &length); 956 if (!has_data) 957 goto bad_mounts; 958 if (*has_data) { 959 data = consumestr(&serialized, &length); 960 if (!data) 961 goto bad_mounts; 962 } 963 flags = consumebytes(sizeof(*flags), &serialized, &length); 964 if (!flags) 965 goto bad_mounts; 966 if (minijail_mount_with_data(j, src, dest, type, *flags, data)) 967 goto bad_mounts; 968 } 969 970 count = j->cgroup_count; 971 j->cgroup_count = 0; 972 for (i = 0; i < count; ++i) { 973 char *cgroup = consumestr(&serialized, &length); 974 if (!cgroup) 975 goto bad_cgroups; 976 j->cgroups[i] = strdup(cgroup); 977 if (!j->cgroups[i]) 978 goto bad_cgroups; 979 ++j->cgroup_count; 980 } 981 982 return 0; 983 984bad_cgroups: 985 while (j->mounts_head) { 986 struct mountpoint *m = j->mounts_head; 987 j->mounts_head = j->mounts_head->next; 988 free(m->data); 989 free(m->type); 990 free(m->dest); 991 free(m->src); 992 free(m); 993 } 994 for (i = 0; i < j->cgroup_count; ++i) 995 free(j->cgroups[i]); 996bad_mounts: 997 if (j->flags.seccomp_filter && j->filter_len > 0) { 998 free(j->filter_prog->filter); 999 free(j->filter_prog); 1000 } 1001bad_filter_prog_instrs: 1002 if (j->filter_prog) 1003 free(j->filter_prog); 1004bad_filters: 1005 if (j->alt_syscall_table) 1006 free(j->alt_syscall_table); 1007bad_syscall_table: 1008 if (j->chrootdir) 1009 free(j->chrootdir); 1010bad_chrootdir: 1011 if (j->suppl_gid_list) 1012 free(j->suppl_gid_list); 1013bad_gid_list: 1014 if (j->user) 1015 free(j->user); 1016clear_pointers: 1017 j->user = NULL; 1018 j->suppl_gid_list = NULL; 1019 j->chrootdir = NULL; 1020 j->alt_syscall_table = NULL; 1021 j->cgroup_count = 0; 1022out: 1023 return ret; 1024} 1025 1026static void write_ugid_mappings(const struct minijail *j) 1027{ 1028 int fd, ret, len; 1029 size_t sz; 1030 char fname[32]; 1031 1032 sz = sizeof(fname); 1033 if (j->uidmap) { 1034 ret = snprintf(fname, sz, "/proc/%d/uid_map", j->initpid); 1035 if (ret < 0 || (size_t)ret >= sz) 1036 die("failed to write file name of uid_map"); 1037 fd = open(fname, O_WRONLY | O_CLOEXEC); 1038 if (fd < 0) 1039 pdie("failed to open '%s'", fname); 1040 len = strlen(j->uidmap); 1041 if (write(fd, j->uidmap, len) < len) 1042 die("failed to set uid_map"); 1043 close(fd); 1044 } 1045 if (j->gidmap) { 1046 ret = snprintf(fname, sz, "/proc/%d/gid_map", j->initpid); 1047 if (ret < 0 || (size_t)ret >= sz) 1048 die("failed to write file name of gid_map"); 1049 fd = open(fname, O_WRONLY | O_CLOEXEC); 1050 if (fd < 0) 1051 pdie("failed to open '%s'", fname); 1052 len = strlen(j->gidmap); 1053 if (write(fd, j->gidmap, len) < len) 1054 die("failed to set gid_map"); 1055 close(fd); 1056 } 1057} 1058 1059static void parent_setup_complete(int *pipe_fds) 1060{ 1061 close(pipe_fds[0]); 1062 close(pipe_fds[1]); 1063} 1064 1065/* 1066 * wait_for_parent_setup: Called by the child process to wait for any 1067 * further parent-side setup to complete before continuing. 1068 */ 1069static void wait_for_parent_setup(int *pipe_fds) 1070{ 1071 char buf; 1072 1073 close(pipe_fds[1]); 1074 1075 /* Wait for parent to complete setup and close the pipe. */ 1076 if (read(pipe_fds[0], &buf, 1) != 0) 1077 die("failed to sync with parent"); 1078 close(pipe_fds[0]); 1079} 1080 1081static void enter_user_namespace(const struct minijail *j) 1082{ 1083 if (j->uidmap && setresuid(0, 0, 0)) 1084 pdie("setresuid"); 1085 if (j->gidmap && setresgid(0, 0, 0)) 1086 pdie("setresgid"); 1087} 1088 1089/* 1090 * Make sure the mount target exists. Create it if needed and possible. 1091 */ 1092static int setup_mount_destination(const char *source, const char *dest, 1093 uid_t uid, uid_t gid) 1094{ 1095 int rc; 1096 struct stat st_buf; 1097 1098 rc = stat(dest, &st_buf); 1099 if (rc == 0) /* destination exists */ 1100 return 0; 1101 1102 /* 1103 * Try to create the destination. 1104 * Either make a directory or touch a file depending on the source type. 1105 * If the source doesn't exist, assume it is a filesystem type such as 1106 * "tmpfs" and create a directory to mount it on. 1107 */ 1108 rc = stat(source, &st_buf); 1109 if (rc || S_ISDIR(st_buf.st_mode) || S_ISBLK(st_buf.st_mode)) { 1110 if (mkdir(dest, 0700)) 1111 return -errno; 1112 } else { 1113 int fd = open(dest, O_RDWR | O_CREAT, 0700); 1114 if (fd < 0) 1115 return -errno; 1116 close(fd); 1117 } 1118 return chown(dest, uid, gid); 1119} 1120 1121/* 1122 * mount_one: Applies mounts from @m for @j, recursing as needed. 1123 * @j Minijail these mounts are for 1124 * @m Head of list of mounts 1125 * 1126 * Returns 0 for success. 1127 */ 1128static int mount_one(const struct minijail *j, struct mountpoint *m) 1129{ 1130 int ret; 1131 char *dest; 1132 int remount_ro = 0; 1133 1134 /* |dest| has a leading "/". */ 1135 if (asprintf(&dest, "%s%s", j->chrootdir, m->dest) < 0) 1136 return -ENOMEM; 1137 1138 if (setup_mount_destination(m->src, dest, j->uid, j->gid)) 1139 pdie("creating mount target '%s' failed", dest); 1140 1141 /* 1142 * R/O bind mounts have to be remounted since 'bind' and 'ro' 1143 * can't both be specified in the original bind mount. 1144 * Remount R/O after the initial mount. 1145 */ 1146 if ((m->flags & MS_BIND) && (m->flags & MS_RDONLY)) { 1147 remount_ro = 1; 1148 m->flags &= ~MS_RDONLY; 1149 } 1150 1151 ret = mount(m->src, dest, m->type, m->flags, m->data); 1152 if (ret) 1153 pdie("mount: %s -> %s", m->src, dest); 1154 1155 if (remount_ro) { 1156 m->flags |= MS_RDONLY; 1157 ret = mount(m->src, dest, NULL, 1158 m->flags | MS_REMOUNT, m->data); 1159 if (ret) 1160 pdie("bind ro: %s -> %s", m->src, dest); 1161 } 1162 1163 free(dest); 1164 if (m->next) 1165 return mount_one(j, m->next); 1166 return ret; 1167} 1168 1169int enter_chroot(const struct minijail *j) 1170{ 1171 int ret; 1172 1173 if (j->mounts_head && (ret = mount_one(j, j->mounts_head))) 1174 return ret; 1175 1176 if (chroot(j->chrootdir)) 1177 return -errno; 1178 1179 if (chdir("/")) 1180 return -errno; 1181 1182 return 0; 1183} 1184 1185int enter_pivot_root(const struct minijail *j) 1186{ 1187 int ret, oldroot, newroot; 1188 1189 if (j->mounts_head && (ret = mount_one(j, j->mounts_head))) 1190 return ret; 1191 1192 /* 1193 * Keep the fd for both old and new root. 1194 * It will be used in fchdir(2) later. 1195 */ 1196 oldroot = open("/", O_DIRECTORY | O_RDONLY | O_CLOEXEC); 1197 if (oldroot < 0) 1198 pdie("failed to open / for fchdir"); 1199 newroot = open(j->chrootdir, O_DIRECTORY | O_RDONLY | O_CLOEXEC); 1200 if (newroot < 0) 1201 pdie("failed to open %s for fchdir", j->chrootdir); 1202 1203 /* 1204 * To ensure j->chrootdir is the root of a filesystem, 1205 * do a self bind mount. 1206 */ 1207 if (mount(j->chrootdir, j->chrootdir, "bind", MS_BIND | MS_REC, "")) 1208 pdie("failed to bind mount '%s'", j->chrootdir); 1209 if (chdir(j->chrootdir)) 1210 return -errno; 1211 if (syscall(SYS_pivot_root, ".", ".")) 1212 pdie("pivot_root"); 1213 1214 /* 1215 * Now the old root is mounted on top of the new root. Use fchdir(2) to 1216 * change to the old root and unmount it. 1217 */ 1218 if (fchdir(oldroot)) 1219 pdie("failed to fchdir to old /"); 1220 1221 /* 1222 * If j->flags.skip_remount_private was enabled for minijail_enter(), 1223 * there could be a shared mount point under |oldroot|. In that case, 1224 * mounts under this shared mount point will be unmounted below, and 1225 * this unmounting will propagate to the original mount namespace 1226 * (because the mount point is shared). To prevent this unexpected 1227 * unmounting, remove these mounts from their peer groups by recursively 1228 * remounting them as MS_PRIVATE. 1229 */ 1230 if (mount(NULL, ".", NULL, MS_REC | MS_PRIVATE, NULL)) 1231 pdie("failed to mount(/, private) before umount(/)"); 1232 /* The old root might be busy, so use lazy unmount. */ 1233 if (umount2(".", MNT_DETACH)) 1234 pdie("umount(/)"); 1235 /* Change back to the new root. */ 1236 if (fchdir(newroot)) 1237 return -errno; 1238 if (close(oldroot)) 1239 return -errno; 1240 if (close(newroot)) 1241 return -errno; 1242 if (chroot("/")) 1243 return -errno; 1244 /* Set correct CWD for getcwd(3). */ 1245 if (chdir("/")) 1246 return -errno; 1247 1248 return 0; 1249} 1250 1251int mount_tmp(void) 1252{ 1253 return mount("none", "/tmp", "tmpfs", 0, "size=64M,mode=777"); 1254} 1255 1256int remount_proc_readonly(const struct minijail *j) 1257{ 1258 const char *kProcPath = "/proc"; 1259 const unsigned int kSafeFlags = MS_NODEV | MS_NOEXEC | MS_NOSUID; 1260 /* 1261 * Right now, we're holding a reference to our parent's old mount of 1262 * /proc in our namespace, which means using MS_REMOUNT here would 1263 * mutate our parent's mount as well, even though we're in a VFS 1264 * namespace (!). Instead, remove their mount from our namespace lazily 1265 * (MNT_DETACH) and make our own. 1266 */ 1267 if (umount2(kProcPath, MNT_DETACH)) { 1268 /* 1269 * If we are in a new user namespace, umount(2) will fail. 1270 * See http://man7.org/linux/man-pages/man7/user_namespaces.7.html 1271 */ 1272 if (j->flags.userns) { 1273 info("umount(/proc, MNT_DETACH) failed, " 1274 "this is expected when using user namespaces"); 1275 } else { 1276 return -errno; 1277 } 1278 } 1279 if (mount("", kProcPath, "proc", kSafeFlags | MS_RDONLY, "")) 1280 return -errno; 1281 return 0; 1282} 1283 1284static void write_pid_to_path(pid_t pid, const char *path) 1285{ 1286 FILE *fp = fopen(path, "w"); 1287 1288 if (!fp) 1289 pdie("failed to open '%s'", path); 1290 if (fprintf(fp, "%d\n", (int)pid) < 0) 1291 pdie("fprintf(%s)", path); 1292 if (fclose(fp)) 1293 pdie("fclose(%s)", path); 1294} 1295 1296static void write_pid_file(const struct minijail *j) 1297{ 1298 write_pid_to_path(j->initpid, j->pid_file_path); 1299} 1300 1301static void add_to_cgroups(const struct minijail *j) 1302{ 1303 size_t i; 1304 1305 for (i = 0; i < j->cgroup_count; ++i) 1306 write_pid_to_path(j->initpid, j->cgroups[i]); 1307} 1308 1309void drop_ugid(const struct minijail *j) 1310{ 1311 if (j->flags.usergroups && j->flags.suppl_gids) { 1312 die("tried to inherit *and* set supplementary groups;" 1313 " can only do one"); 1314 } 1315 1316 if (j->flags.usergroups) { 1317 if (initgroups(j->user, j->usergid)) 1318 pdie("initgroups"); 1319 } else if (j->flags.suppl_gids) { 1320 if (setgroups(j->suppl_gid_count, j->suppl_gid_list)) { 1321 pdie("setgroups"); 1322 } 1323 } else { 1324 /* 1325 * Only attempt to clear supplementary groups if we are changing 1326 * users. 1327 */ 1328 if ((j->uid || j->gid) && setgroups(0, NULL)) 1329 pdie("setgroups"); 1330 } 1331 1332 if (j->flags.gid && setresgid(j->gid, j->gid, j->gid)) 1333 pdie("setresgid"); 1334 1335 if (j->flags.uid && setresuid(j->uid, j->uid, j->uid)) 1336 pdie("setresuid"); 1337} 1338 1339/* 1340 * We specifically do not use cap_valid() as that only tells us the last 1341 * valid cap we were *compiled* against (i.e. what the version of kernel 1342 * headers says). If we run on a different kernel version, then it's not 1343 * uncommon for that to be less (if an older kernel) or more (if a newer 1344 * kernel). 1345 * Normally, we suck up the answer via /proc. On Android, not all processes are 1346 * guaranteed to be able to access '/proc/sys/kernel/cap_last_cap' so we 1347 * programmatically find the value by calling prctl(PR_CAPBSET_READ). 1348 */ 1349static unsigned int get_last_valid_cap() 1350{ 1351 unsigned int last_valid_cap = 0; 1352 if (is_android()) { 1353 for (; prctl(PR_CAPBSET_READ, last_valid_cap, 0, 0, 0) >= 0; 1354 ++last_valid_cap); 1355 1356 /* |last_valid_cap| will be the first failing value. */ 1357 if (last_valid_cap > 0) { 1358 last_valid_cap--; 1359 } 1360 } else { 1361 const char cap_file[] = "/proc/sys/kernel/cap_last_cap"; 1362 FILE *fp = fopen(cap_file, "re"); 1363 if (fscanf(fp, "%u", &last_valid_cap) != 1) 1364 pdie("fscanf(%s)", cap_file); 1365 fclose(fp); 1366 } 1367 return last_valid_cap; 1368} 1369 1370static void drop_capbset(uint64_t keep_mask, unsigned int last_valid_cap) 1371{ 1372 const uint64_t one = 1; 1373 unsigned int i; 1374 for (i = 0; i < sizeof(keep_mask) * 8 && i <= last_valid_cap; ++i) { 1375 if (keep_mask & (one << i)) 1376 continue; 1377 if (prctl(PR_CAPBSET_DROP, i)) 1378 pdie("could not drop capability from bounding set"); 1379 } 1380} 1381 1382void drop_caps(const struct minijail *j, unsigned int last_valid_cap) 1383{ 1384 if (!j->flags.use_caps) 1385 return; 1386 1387 cap_t caps = cap_get_proc(); 1388 cap_value_t flag[1]; 1389 const uint64_t one = 1; 1390 unsigned int i; 1391 if (!caps) 1392 die("can't get process caps"); 1393 if (cap_clear_flag(caps, CAP_INHERITABLE)) 1394 die("can't clear inheritable caps"); 1395 if (cap_clear_flag(caps, CAP_EFFECTIVE)) 1396 die("can't clear effective caps"); 1397 if (cap_clear_flag(caps, CAP_PERMITTED)) 1398 die("can't clear permitted caps"); 1399 for (i = 0; i < sizeof(j->caps) * 8 && i <= last_valid_cap; ++i) { 1400 /* Keep CAP_SETPCAP for dropping bounding set bits. */ 1401 if (i != CAP_SETPCAP && !(j->caps & (one << i))) 1402 continue; 1403 flag[0] = i; 1404 if (cap_set_flag(caps, CAP_EFFECTIVE, 1, flag, CAP_SET)) 1405 die("can't add effective cap"); 1406 if (cap_set_flag(caps, CAP_PERMITTED, 1, flag, CAP_SET)) 1407 die("can't add permitted cap"); 1408 if (cap_set_flag(caps, CAP_INHERITABLE, 1, flag, CAP_SET)) 1409 die("can't add inheritable cap"); 1410 } 1411 if (cap_set_proc(caps)) 1412 die("can't apply initial cleaned capset"); 1413 1414 /* 1415 * Instead of dropping bounding set first, do it here in case 1416 * the caller had a more permissive bounding set which could 1417 * have been used above to raise a capability that wasn't already 1418 * present. This requires CAP_SETPCAP, so we raised/kept it above. 1419 */ 1420 drop_capbset(j->caps, last_valid_cap); 1421 1422 /* If CAP_SETPCAP wasn't specifically requested, now we remove it. */ 1423 if ((j->caps & (one << CAP_SETPCAP)) == 0) { 1424 flag[0] = CAP_SETPCAP; 1425 if (cap_set_flag(caps, CAP_EFFECTIVE, 1, flag, CAP_CLEAR)) 1426 die("can't clear effective cap"); 1427 if (cap_set_flag(caps, CAP_PERMITTED, 1, flag, CAP_CLEAR)) 1428 die("can't clear permitted cap"); 1429 if (cap_set_flag(caps, CAP_INHERITABLE, 1, flag, CAP_CLEAR)) 1430 die("can't clear inheritable cap"); 1431 } 1432 1433 if (cap_set_proc(caps)) 1434 die("can't apply final cleaned capset"); 1435 1436 cap_free(caps); 1437} 1438 1439void set_seccomp_filter(const struct minijail *j) 1440{ 1441 /* 1442 * Set no_new_privs. See </kernel/seccomp.c> and </kernel/sys.c> 1443 * in the kernel source tree for an explanation of the parameters. 1444 */ 1445 if (j->flags.no_new_privs) { 1446 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) 1447 pdie("prctl(PR_SET_NO_NEW_PRIVS)"); 1448 } 1449 1450 /* 1451 * Code running with ASan 1452 * (https://github.com/google/sanitizers/wiki/AddressSanitizer) 1453 * will make system calls not included in the syscall filter policy, 1454 * which will likely crash the program. Skip setting seccomp filter in 1455 * that case. 1456 * 'running_with_asan()' has no inputs and is completely defined at 1457 * build time, so this cannot be used by an attacker to skip setting 1458 * seccomp filter. 1459 */ 1460 if (j->flags.seccomp_filter && running_with_asan()) { 1461 warn("running with ASan, not setting seccomp filter"); 1462 return; 1463 } 1464 1465 /* 1466 * If we're logging seccomp filter failures, 1467 * install the SIGSYS handler first. 1468 */ 1469 if (j->flags.seccomp_filter && j->flags.log_seccomp_filter) { 1470 if (install_sigsys_handler()) 1471 pdie("install SIGSYS handler"); 1472 warn("logging seccomp filter failures"); 1473 } 1474 1475 /* 1476 * Install the syscall filter. 1477 */ 1478 if (j->flags.seccomp_filter) { 1479 if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, 1480 j->filter_prog)) { 1481 if ((errno == EINVAL) && can_softfail()) { 1482 warn("seccomp not supported"); 1483 return; 1484 } 1485 pdie("prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER)"); 1486 } 1487 } 1488} 1489 1490void API minijail_enter(const struct minijail *j) 1491{ 1492 /* 1493 * If we're dropping caps, get the last valid cap from /proc now, 1494 * since /proc can be unmounted before drop_caps() is called. 1495 */ 1496 unsigned int last_valid_cap = 0; 1497 if (j->flags.capbset_drop || j->flags.use_caps) 1498 last_valid_cap = get_last_valid_cap(); 1499 1500 if (j->flags.pids) 1501 die("tried to enter a pid-namespaced jail;" 1502 " try minijail_run()?"); 1503 1504 if (j->flags.usergroups && !j->user) 1505 die("usergroup inheritance without username"); 1506 1507 /* 1508 * We can't recover from failures if we've dropped privileges partially, 1509 * so we don't even try. If any of our operations fail, we abort() the 1510 * entire process. 1511 */ 1512 if (j->flags.enter_vfs && setns(j->mountns_fd, CLONE_NEWNS)) 1513 pdie("setns(CLONE_NEWNS)"); 1514 1515 if (j->flags.vfs) { 1516 if (unshare(CLONE_NEWNS)) 1517 pdie("unshare(vfs)"); 1518 /* 1519 * Unless asked not to, remount all filesystems as private. 1520 * If they are shared, new bind mounts will creep out of our 1521 * namespace. 1522 * https://www.kernel.org/doc/Documentation/filesystems/sharedsubtree.txt 1523 */ 1524 if (!j->flags.skip_remount_private) { 1525 if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) 1526 pdie("mount(/, private)"); 1527 } 1528 } 1529 1530 if (j->flags.ipc && unshare(CLONE_NEWIPC)) { 1531 pdie("unshare(ipc)"); 1532 } 1533 1534 if (j->flags.enter_net) { 1535 if (setns(j->netns_fd, CLONE_NEWNET)) 1536 pdie("setns(CLONE_NEWNET)"); 1537 } else if (j->flags.net && unshare(CLONE_NEWNET)) { 1538 pdie("unshare(net)"); 1539 } 1540 1541 if (j->flags.ns_cgroups && unshare(CLONE_NEWCGROUP)) 1542 pdie("unshare(cgroups)"); 1543 1544 if (j->flags.chroot && enter_chroot(j)) 1545 pdie("chroot"); 1546 1547 if (j->flags.pivot_root && enter_pivot_root(j)) 1548 pdie("pivot_root"); 1549 1550 if (j->flags.mount_tmp && mount_tmp()) 1551 pdie("mount_tmp"); 1552 1553 if (j->flags.remount_proc_ro && remount_proc_readonly(j)) 1554 pdie("remount"); 1555 1556 /* 1557 * If we're only dropping capabilities from the bounding set, but not 1558 * from the thread's (permitted|inheritable|effective) sets, do it now. 1559 */ 1560 if (j->flags.capbset_drop) { 1561 drop_capbset(j->cap_bset, last_valid_cap); 1562 } 1563 1564 if (j->flags.use_caps) { 1565 /* 1566 * POSIX capabilities are a bit tricky. If we drop our 1567 * capability to change uids, our attempt to use setuid() 1568 * below will fail. Hang on to root caps across setuid(), then 1569 * lock securebits. 1570 */ 1571 if (prctl(PR_SET_KEEPCAPS, 1)) 1572 pdie("prctl(PR_SET_KEEPCAPS)"); 1573 1574 /* 1575 * Kernels 4.3+ define a new securebit 1576 * (SECURE_NO_CAP_AMBIENT_RAISE), so using the SECURE_ALL_BITS 1577 * and SECURE_ALL_LOCKS masks from newer kernel headers will 1578 * return EPERM on older kernels. Detect this, and retry with 1579 * the right mask for older (2.6.26-4.2) kernels. 1580 */ 1581 int securebits_ret = prctl(PR_SET_SECUREBITS, 1582 SECURE_ALL_BITS | SECURE_ALL_LOCKS); 1583 if (securebits_ret < 0) { 1584 if (errno == EPERM) { 1585 /* Possibly running on kernel < 4.3. */ 1586 securebits_ret = prctl( 1587 PR_SET_SECUREBITS, 1588 OLD_SECURE_ALL_BITS | OLD_SECURE_ALL_LOCKS); 1589 } 1590 } 1591 if (securebits_ret < 0) 1592 pdie("prctl(PR_SET_SECUREBITS)"); 1593 } 1594 1595 if (j->flags.no_new_privs) { 1596 /* 1597 * If we're setting no_new_privs, we can drop privileges 1598 * before setting seccomp filter. This way filter policies 1599 * don't need to allow privilege-dropping syscalls. 1600 */ 1601 drop_ugid(j); 1602 drop_caps(j, last_valid_cap); 1603 set_seccomp_filter(j); 1604 } else { 1605 /* 1606 * If we're not setting no_new_privs, 1607 * we need to set seccomp filter *before* dropping privileges. 1608 * WARNING: this means that filter policies *must* allow 1609 * setgroups()/setresgid()/setresuid() for dropping root and 1610 * capget()/capset()/prctl() for dropping caps. 1611 */ 1612 set_seccomp_filter(j); 1613 drop_ugid(j); 1614 drop_caps(j, last_valid_cap); 1615 } 1616 1617 /* 1618 * Select the specified alternate syscall table. The table must not 1619 * block prctl(2) if we're using seccomp as well. 1620 */ 1621 if (j->flags.alt_syscall) { 1622 if (prctl(PR_ALT_SYSCALL, 1, j->alt_syscall_table)) 1623 pdie("prctl(PR_ALT_SYSCALL)"); 1624 } 1625 1626 /* 1627 * seccomp has to come last since it cuts off all the other 1628 * privilege-dropping syscalls :) 1629 */ 1630 if (j->flags.seccomp && prctl(PR_SET_SECCOMP, 1)) { 1631 if ((errno == EINVAL) && can_softfail()) { 1632 warn("seccomp not supported"); 1633 return; 1634 } 1635 pdie("prctl(PR_SET_SECCOMP)"); 1636 } 1637} 1638 1639/* TODO(wad): will visibility affect this variable? */ 1640static int init_exitstatus = 0; 1641 1642void init_term(int __attribute__ ((unused)) sig) 1643{ 1644 _exit(init_exitstatus); 1645} 1646 1647int init(pid_t rootpid) 1648{ 1649 pid_t pid; 1650 int status; 1651 /* So that we exit with the right status. */ 1652 signal(SIGTERM, init_term); 1653 /* TODO(wad): self jail with seccomp filters here. */ 1654 while ((pid = wait(&status)) > 0) { 1655 /* 1656 * This loop will only end when either there are no processes 1657 * left inside our pid namespace or we get a signal. 1658 */ 1659 if (pid == rootpid) 1660 init_exitstatus = status; 1661 } 1662 if (!WIFEXITED(init_exitstatus)) 1663 _exit(MINIJAIL_ERR_INIT); 1664 _exit(WEXITSTATUS(init_exitstatus)); 1665} 1666 1667int API minijail_from_fd(int fd, struct minijail *j) 1668{ 1669 size_t sz = 0; 1670 size_t bytes = read(fd, &sz, sizeof(sz)); 1671 char *buf; 1672 int r; 1673 if (sizeof(sz) != bytes) 1674 return -EINVAL; 1675 if (sz > USHRT_MAX) /* arbitrary sanity check */ 1676 return -E2BIG; 1677 buf = malloc(sz); 1678 if (!buf) 1679 return -ENOMEM; 1680 bytes = read(fd, buf, sz); 1681 if (bytes != sz) { 1682 free(buf); 1683 return -EINVAL; 1684 } 1685 r = minijail_unmarshal(j, buf, sz); 1686 free(buf); 1687 return r; 1688} 1689 1690int API minijail_to_fd(struct minijail *j, int fd) 1691{ 1692 char *buf; 1693 size_t sz = minijail_size(j); 1694 ssize_t written; 1695 int r; 1696 1697 if (!sz) 1698 return -EINVAL; 1699 buf = malloc(sz); 1700 r = minijail_marshal(j, buf, sz); 1701 if (r) { 1702 free(buf); 1703 return r; 1704 } 1705 /* Sends [size][minijail]. */ 1706 written = write(fd, &sz, sizeof(sz)); 1707 if (written != sizeof(sz)) { 1708 free(buf); 1709 return -EFAULT; 1710 } 1711 written = write(fd, buf, sz); 1712 if (written < 0 || (size_t) written != sz) { 1713 free(buf); 1714 return -EFAULT; 1715 } 1716 free(buf); 1717 return 0; 1718} 1719 1720int setup_preload(void) 1721{ 1722#if defined(__ANDROID__) 1723 /* Don't use LDPRELOAD on Brillo. */ 1724 return 0; 1725#else 1726 char *oldenv = getenv(kLdPreloadEnvVar) ? : ""; 1727 char *newenv = malloc(strlen(oldenv) + 2 + strlen(PRELOADPATH)); 1728 if (!newenv) 1729 return -ENOMEM; 1730 1731 /* Only insert a separating space if we have something to separate... */ 1732 sprintf(newenv, "%s%s%s", oldenv, strlen(oldenv) ? " " : "", 1733 PRELOADPATH); 1734 1735 /* setenv() makes a copy of the string we give it. */ 1736 setenv(kLdPreloadEnvVar, newenv, 1); 1737 free(newenv); 1738 return 0; 1739#endif 1740} 1741 1742int setup_pipe(int fds[2]) 1743{ 1744 int r = pipe(fds); 1745 char fd_buf[11]; 1746 if (r) 1747 return r; 1748 r = snprintf(fd_buf, sizeof(fd_buf), "%d", fds[0]); 1749 if (r <= 0) 1750 return -EINVAL; 1751 setenv(kFdEnvVar, fd_buf, 1); 1752 return 0; 1753} 1754 1755int setup_pipe_end(int fds[2], size_t index) 1756{ 1757 if (index > 1) 1758 return -1; 1759 1760 close(fds[1 - index]); 1761 return fds[index]; 1762} 1763 1764int setup_and_dupe_pipe_end(int fds[2], size_t index, int fd) 1765{ 1766 if (index > 1) 1767 return -1; 1768 1769 close(fds[1 - index]); 1770 /* dup2(2) the corresponding end of the pipe into |fd|. */ 1771 return dup2(fds[index], fd); 1772} 1773 1774int minijail_run_internal(struct minijail *j, const char *filename, 1775 char *const argv[], pid_t *pchild_pid, 1776 int *pstdin_fd, int *pstdout_fd, int *pstderr_fd, 1777 int use_preload); 1778 1779int API minijail_run(struct minijail *j, const char *filename, 1780 char *const argv[]) 1781{ 1782 return minijail_run_internal(j, filename, argv, NULL, NULL, NULL, NULL, 1783 true); 1784} 1785 1786int API minijail_run_pid(struct minijail *j, const char *filename, 1787 char *const argv[], pid_t *pchild_pid) 1788{ 1789 return minijail_run_internal(j, filename, argv, pchild_pid, 1790 NULL, NULL, NULL, true); 1791} 1792 1793int API minijail_run_pipe(struct minijail *j, const char *filename, 1794 char *const argv[], int *pstdin_fd) 1795{ 1796 return minijail_run_internal(j, filename, argv, NULL, pstdin_fd, 1797 NULL, NULL, true); 1798} 1799 1800int API minijail_run_pid_pipes(struct minijail *j, const char *filename, 1801 char *const argv[], pid_t *pchild_pid, 1802 int *pstdin_fd, int *pstdout_fd, int *pstderr_fd) 1803{ 1804 return minijail_run_internal(j, filename, argv, pchild_pid, 1805 pstdin_fd, pstdout_fd, pstderr_fd, true); 1806} 1807 1808int API minijail_run_no_preload(struct minijail *j, const char *filename, 1809 char *const argv[]) 1810{ 1811 return minijail_run_internal(j, filename, argv, NULL, NULL, NULL, NULL, 1812 false); 1813} 1814 1815int API minijail_run_pid_pipes_no_preload(struct minijail *j, 1816 const char *filename, 1817 char *const argv[], 1818 pid_t *pchild_pid, 1819 int *pstdin_fd, int *pstdout_fd, 1820 int *pstderr_fd) 1821{ 1822 return minijail_run_internal(j, filename, argv, pchild_pid, 1823 pstdin_fd, pstdout_fd, pstderr_fd, false); 1824} 1825 1826int minijail_run_internal(struct minijail *j, const char *filename, 1827 char *const argv[], pid_t *pchild_pid, 1828 int *pstdin_fd, int *pstdout_fd, int *pstderr_fd, 1829 int use_preload) 1830{ 1831 char *oldenv, *oldenv_copy = NULL; 1832 pid_t child_pid; 1833 int pipe_fds[2]; 1834 int stdin_fds[2]; 1835 int stdout_fds[2]; 1836 int stderr_fds[2]; 1837 int child_sync_pipe_fds[2]; 1838 int sync_child = 0; 1839 int ret; 1840 /* We need to remember this across the minijail_preexec() call. */ 1841 int pid_namespace = j->flags.pids; 1842 int do_init = j->flags.do_init; 1843 1844 if (use_preload) { 1845 oldenv = getenv(kLdPreloadEnvVar); 1846 if (oldenv) { 1847 oldenv_copy = strdup(oldenv); 1848 if (!oldenv_copy) 1849 return -ENOMEM; 1850 } 1851 1852 if (setup_preload()) 1853 return -EFAULT; 1854 } 1855 1856 if (!use_preload) { 1857 if (j->flags.use_caps && j->caps != 0) 1858 die("non-empty capabilities are not supported without LD_PRELOAD"); 1859 } 1860 1861 /* 1862 * Make the process group ID of this process equal to its PID, so that 1863 * both the Minijail process and the jailed process can be killed 1864 * together. 1865 * Don't fail on EPERM, since setpgid(0, 0) can only EPERM when 1866 * the process is already a process group leader. 1867 */ 1868 if (setpgid(0 /* use calling PID */, 0 /* make PGID = PID */)) { 1869 if (errno != EPERM) { 1870 pdie("setpgid(0, 0)"); 1871 } 1872 } 1873 1874 if (use_preload) { 1875 /* 1876 * Before we fork(2) and execve(2) the child process, we need 1877 * to open a pipe(2) to send the minijail configuration over. 1878 */ 1879 if (setup_pipe(pipe_fds)) 1880 return -EFAULT; 1881 } 1882 1883 /* 1884 * If we want to write to the child process' standard input, 1885 * create the pipe(2) now. 1886 */ 1887 if (pstdin_fd) { 1888 if (pipe(stdin_fds)) 1889 return -EFAULT; 1890 } 1891 1892 /* 1893 * If we want to read from the child process' standard output, 1894 * create the pipe(2) now. 1895 */ 1896 if (pstdout_fd) { 1897 if (pipe(stdout_fds)) 1898 return -EFAULT; 1899 } 1900 1901 /* 1902 * If we want to read from the child process' standard error, 1903 * create the pipe(2) now. 1904 */ 1905 if (pstderr_fd) { 1906 if (pipe(stderr_fds)) 1907 return -EFAULT; 1908 } 1909 1910 /* 1911 * If we want to set up a new uid/gid mapping in the user namespace, 1912 * or if we need to add the child process to cgroups, create the pipe(2) 1913 * to sync between parent and child. 1914 */ 1915 if (j->flags.userns || j->flags.cgroups) { 1916 sync_child = 1; 1917 if (pipe(child_sync_pipe_fds)) 1918 return -EFAULT; 1919 } 1920 1921 /* 1922 * Use sys_clone() if and only if we're creating a pid namespace. 1923 * 1924 * tl;dr: WARNING: do not mix pid namespaces and multithreading. 1925 * 1926 * In multithreaded programs, there are a bunch of locks inside libc, 1927 * some of which may be held by other threads at the time that we call 1928 * minijail_run_pid(). If we call fork(), glibc does its level best to 1929 * ensure that we hold all of these locks before it calls clone() 1930 * internally and drop them after clone() returns, but when we call 1931 * sys_clone(2) directly, all that gets bypassed and we end up with a 1932 * child address space where some of libc's important locks are held by 1933 * other threads (which did not get cloned, and hence will never release 1934 * those locks). This is okay so long as we call exec() immediately 1935 * after, but a bunch of seemingly-innocent libc functions like setenv() 1936 * take locks. 1937 * 1938 * Hence, only call sys_clone() if we need to, in order to get at pid 1939 * namespacing. If we follow this path, the child's address space might 1940 * have broken locks; you may only call functions that do not acquire 1941 * any locks. 1942 * 1943 * Unfortunately, fork() acquires every lock it can get its hands on, as 1944 * previously detailed, so this function is highly likely to deadlock 1945 * later on (see "deadlock here") if we're multithreaded. 1946 * 1947 * We might hack around this by having the clone()d child (init of the 1948 * pid namespace) return directly, rather than leaving the clone()d 1949 * process hanging around to be init for the new namespace (and having 1950 * its fork()ed child return in turn), but that process would be 1951 * crippled with its libc locks potentially broken. We might try 1952 * fork()ing in the parent before we clone() to ensure that we own all 1953 * the locks, but then we have to have the forked child hanging around 1954 * consuming resources (and possibly having file descriptors / shared 1955 * memory regions / etc attached). We'd need to keep the child around to 1956 * avoid having its children get reparented to init. 1957 * 1958 * TODO(ellyjones): figure out if the "forked child hanging around" 1959 * problem is fixable or not. It would be nice if we worked in this 1960 * case. 1961 */ 1962 if (pid_namespace) { 1963 int clone_flags = CLONE_NEWPID | SIGCHLD; 1964 if (j->flags.userns) 1965 clone_flags |= CLONE_NEWUSER; 1966 child_pid = syscall(SYS_clone, clone_flags, NULL); 1967 } else { 1968 child_pid = fork(); 1969 } 1970 1971 if (child_pid < 0) { 1972 if (use_preload) { 1973 free(oldenv_copy); 1974 } 1975 die("failed to fork child"); 1976 } 1977 1978 if (child_pid) { 1979 if (use_preload) { 1980 /* Restore parent's LD_PRELOAD. */ 1981 if (oldenv_copy) { 1982 setenv(kLdPreloadEnvVar, oldenv_copy, 1); 1983 free(oldenv_copy); 1984 } else { 1985 unsetenv(kLdPreloadEnvVar); 1986 } 1987 unsetenv(kFdEnvVar); 1988 } 1989 1990 j->initpid = child_pid; 1991 1992 if (j->flags.pid_file) 1993 write_pid_file(j); 1994 1995 if (j->flags.cgroups) 1996 add_to_cgroups(j); 1997 1998 if (j->flags.userns) 1999 write_ugid_mappings(j); 2000 2001 if (sync_child) 2002 parent_setup_complete(child_sync_pipe_fds); 2003 2004 if (use_preload) { 2005 /* Send marshalled minijail. */ 2006 close(pipe_fds[0]); /* read endpoint */ 2007 ret = minijail_to_fd(j, pipe_fds[1]); 2008 close(pipe_fds[1]); /* write endpoint */ 2009 if (ret) { 2010 kill(j->initpid, SIGKILL); 2011 die("failed to send marshalled minijail"); 2012 } 2013 } 2014 2015 if (pchild_pid) 2016 *pchild_pid = child_pid; 2017 2018 /* 2019 * If we want to write to the child process' standard input, 2020 * set up the write end of the pipe. 2021 */ 2022 if (pstdin_fd) 2023 *pstdin_fd = setup_pipe_end(stdin_fds, 2024 1 /* write end */); 2025 2026 /* 2027 * If we want to read from the child process' standard output, 2028 * set up the read end of the pipe. 2029 */ 2030 if (pstdout_fd) 2031 *pstdout_fd = setup_pipe_end(stdout_fds, 2032 0 /* read end */); 2033 2034 /* 2035 * If we want to read from the child process' standard error, 2036 * set up the read end of the pipe. 2037 */ 2038 if (pstderr_fd) 2039 *pstderr_fd = setup_pipe_end(stderr_fds, 2040 0 /* read end */); 2041 2042 return 0; 2043 } 2044 /* Child process. */ 2045 free(oldenv_copy); 2046 2047 if (j->flags.reset_signal_mask) { 2048 sigset_t signal_mask; 2049 if (sigemptyset(&signal_mask) != 0) 2050 pdie("sigemptyset failed"); 2051 if (sigprocmask(SIG_SETMASK, &signal_mask, NULL) != 0) 2052 pdie("sigprocmask failed"); 2053 } 2054 2055 if (sync_child) 2056 wait_for_parent_setup(child_sync_pipe_fds); 2057 2058 if (j->flags.userns) 2059 enter_user_namespace(j); 2060 2061 /* 2062 * If we want to write to the jailed process' standard input, 2063 * set up the read end of the pipe. 2064 */ 2065 if (pstdin_fd) { 2066 if (setup_and_dupe_pipe_end(stdin_fds, 0 /* read end */, 2067 STDIN_FILENO) < 0) 2068 die("failed to set up stdin pipe"); 2069 } 2070 2071 /* 2072 * If we want to read from the jailed process' standard output, 2073 * set up the write end of the pipe. 2074 */ 2075 if (pstdout_fd) { 2076 if (setup_and_dupe_pipe_end(stdout_fds, 1 /* write end */, 2077 STDOUT_FILENO) < 0) 2078 die("failed to set up stdout pipe"); 2079 } 2080 2081 /* 2082 * If we want to read from the jailed process' standard error, 2083 * set up the write end of the pipe. 2084 */ 2085 if (pstderr_fd) { 2086 if (setup_and_dupe_pipe_end(stderr_fds, 1 /* write end */, 2087 STDERR_FILENO) < 0) 2088 die("failed to set up stderr pipe"); 2089 } 2090 2091 /* If running an init program, let it decide when/how to mount /proc. */ 2092 if (pid_namespace && !do_init) 2093 j->flags.remount_proc_ro = 0; 2094 2095 if (use_preload) { 2096 /* Strip out flags that cannot be inherited across execve(2). */ 2097 minijail_preexec(j); 2098 } else { 2099 /* 2100 * If not using LD_PRELOAD, do all jailing before execve(2). 2101 * Note that PID namespaces can only be entered on fork(2), 2102 * so that flag is still cleared. 2103 */ 2104 j->flags.pids = 0; 2105 } 2106 /* Jail this process, then execve(2) the target. */ 2107 minijail_enter(j); 2108 2109 if (pid_namespace && do_init) { 2110 /* 2111 * pid namespace: this process will become init inside the new 2112 * namespace. We don't want all programs we might exec to have 2113 * to know how to be init. Normally (do_init == 1) we fork off 2114 * a child to actually run the program. If |do_init == 0|, we 2115 * let the program keep pid 1 and be init. 2116 * 2117 * If we're multithreaded, we'll probably deadlock here. See 2118 * WARNING above. 2119 */ 2120 child_pid = fork(); 2121 if (child_pid < 0) 2122 _exit(child_pid); 2123 else if (child_pid > 0) 2124 init(child_pid); /* never returns */ 2125 } 2126 2127 /* 2128 * If we aren't pid-namespaced, or the jailed program asked to be init: 2129 * calling process 2130 * -> execve()-ing process 2131 * If we are: 2132 * calling process 2133 * -> init()-ing process 2134 * -> execve()-ing process 2135 */ 2136 ret = execve(filename, argv, environ); 2137 if (ret == -1) { 2138 pwarn("execve(%s) failed", filename); 2139 } 2140 _exit(ret); 2141} 2142 2143int API minijail_kill(struct minijail *j) 2144{ 2145 int st; 2146 if (kill(j->initpid, SIGTERM)) 2147 return -errno; 2148 if (waitpid(j->initpid, &st, 0) < 0) 2149 return -errno; 2150 return st; 2151} 2152 2153int API minijail_wait(struct minijail *j) 2154{ 2155 int st; 2156 if (waitpid(j->initpid, &st, 0) < 0) 2157 return -errno; 2158 2159 if (!WIFEXITED(st)) { 2160 int error_status = st; 2161 if (WIFSIGNALED(st)) { 2162 int signum = WTERMSIG(st); 2163 warn("child process %d received signal %d", 2164 j->initpid, signum); 2165 /* 2166 * We return MINIJAIL_ERR_JAIL if the process received 2167 * SIGSYS, which happens when a syscall is blocked by 2168 * seccomp filters. 2169 * If not, we do what bash(1) does: 2170 * $? = 128 + signum 2171 */ 2172 if (signum == SIGSYS) { 2173 error_status = MINIJAIL_ERR_JAIL; 2174 } else { 2175 error_status = 128 + signum; 2176 } 2177 } 2178 return error_status; 2179 } 2180 2181 int exit_status = WEXITSTATUS(st); 2182 if (exit_status != 0) 2183 info("child process %d exited with status %d", 2184 j->initpid, exit_status); 2185 2186 return exit_status; 2187} 2188 2189void API minijail_destroy(struct minijail *j) 2190{ 2191 size_t i; 2192 2193 if (j->flags.seccomp_filter && j->filter_prog) { 2194 free(j->filter_prog->filter); 2195 free(j->filter_prog); 2196 } 2197 while (j->mounts_head) { 2198 struct mountpoint *m = j->mounts_head; 2199 j->mounts_head = j->mounts_head->next; 2200 free(m->data); 2201 free(m->type); 2202 free(m->dest); 2203 free(m->src); 2204 free(m); 2205 } 2206 j->mounts_tail = NULL; 2207 if (j->user) 2208 free(j->user); 2209 if (j->suppl_gid_list) 2210 free(j->suppl_gid_list); 2211 if (j->chrootdir) 2212 free(j->chrootdir); 2213 if (j->alt_syscall_table) 2214 free(j->alt_syscall_table); 2215 for (i = 0; i < j->cgroup_count; ++i) 2216 free(j->cgroups[i]); 2217 free(j); 2218} 2219