RepoMirrors/selinux
1
0
Fork 0
mirror of https://github.com/SELinuxProject/selinux synced 2024-12-14 10:05:02 +00:00
Code Issues Packages Projects Releases Wiki Activity
f8a46ac9b3
selinux/policycoreutils/sandbox/seunshare.c
Eric Paris 221e6d4665 policycoreutils: seunshare: do checking on setfsuid 
setfsuid return codes were not being checked.  Add checks to make sure
we are switching from and to what we expect.  Bail (most places) if we
didn't switch successfully.

Signed-off-by: Eric Paris <eparis@redhat.com>
2013-02-05 20:14:51 -05:00

1059 lines
25 KiB
C
Raw Blame History

/*
* Authors: Dan Walsh <dwalsh@redhat.com>
* Authors: Thomas Liu <tliu@fedoraproject.org>
*/
#define _GNU_SOURCE
#include <signal.h>
#include <sys/fsuid.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <syslog.h>
#include <sys/mount.h>
#include <glob.h>
#include <pwd.h>
#include <sched.h>
#include <libcgroup.h>
#include <string.h>
#include <stdio.h>
#include <regex.h>
#include <unistd.h>
#include <stdlib.h>
#include <cap-ng.h>
#include <getopt.h> /* for getopt_long() form of getopt() */
#include <limits.h>
#include <stdlib.h>
#include <errno.h>
#include <fcntl.h>
#include <selinux/selinux.h>
#include <selinux/context.h> /* for context-mangling functions */
#include <dirent.h>
#ifdef USE_NLS
#include <locale.h> /* for setlocale() */
#include <libintl.h> /* for gettext() */
#define _(msgid) gettext (msgid)
#else
#define _(msgid) (msgid)
#endif
#ifndef MS_REC
#define MS_REC 1<<14
#endif
#ifndef MS_SLAVE
#define MS_SLAVE 1<<19
#endif
#ifndef PACKAGE
#define PACKAGE "policycoreutils" /* the name of this package lang translation */
#endif
#define BUF_SIZE 1024
#define DEFAULT_PATH "/usr/bin:/bin"
#define USAGE_STRING _("USAGE: seunshare [ -v ] [ -C ] [ -c ] [ -k ] [ -t tmpdir ] [ -h homedir ] [ -Z CONTEXT ] -- executable [args] ")
static int verbose = 0;
static int child = 0;
static capng_select_t cap_set = CAPNG_SELECT_CAPS;
/**
* This function will drop all capabilities.
*/
static int drop_caps()
{
if (capng_have_capabilities(cap_set) == CAPNG_NONE)
return 0;
capng_clear(cap_set);
if (capng_lock() == -1 || capng_apply(cap_set) == -1) {
fprintf(stderr, _("Failed to drop all capabilities\n"));
return -1;
}
return 0;
}
/**
* This function will drop all privileges.
*/
static int drop_privs(uid_t uid)
{
if (drop_caps() == -1 || setresuid(uid, uid, uid) == -1) {
fprintf(stderr, _("Failed to drop privileges\n"));
return -1;
}
return 0;
}
/**
* If the user sends a siginto to seunshare, kill the child's session
*/
void handler(int sig) {
if (child > 0) kill(-child,sig);
}
/**
* Take care of any signal setup.
*/
static int set_signal_handles(void)
{
sigset_t empty;
/* Empty the signal mask in case someone is blocking a signal */
if (sigemptyset(&empty)) {
fprintf(stderr, "Unable to obtain empty signal set\n");
return -1;
}
(void)sigprocmask(SIG_SETMASK, &empty, NULL);
/* Terminate on SIGHUP */
if (signal(SIGHUP, SIG_DFL) == SIG_ERR) {
perror("Unable to set SIGHUP handler");
return -1;
}
if (signal(SIGINT, handler) == SIG_ERR) {
perror("Unable to set SIGINT handler");
return -1;
}
return 0;
}
#define status_to_retval(status,retval) do { \
if ((status) == -1) \
retval = -1; \
else if (WIFEXITED((status))) \
retval = WEXITSTATUS((status)); \
else if (WIFSIGNALED((status))) \
retval = 128 + WTERMSIG((status)); \
else \
retval = -1; \
} while(0)
/**
* Spawn external command using system() with dropped privileges.
* TODO: avoid system() and use exec*() instead
*/
static int spawn_command(const char *cmd, uid_t uid){
int child;
int status = -1;
if (verbose > 1)
printf("spawn_command: %s\n", cmd);
child = fork();
if (child == -1) {
perror(_("Unable to fork"));
return status;
}
if (child == 0) {
if (drop_privs(uid) != 0) exit(-1);
status = system(cmd);
status_to_retval(status, status);
exit(status);
}
waitpid(child, &status, 0);
status_to_retval(status, status);
return status;
}
/**
* Check file/directory ownership, struct stat * must be passed to the
* functions.
*/
static int check_owner_uid(uid_t uid, const char *file, struct stat *st) {
if (S_ISLNK(st->st_mode)) {
fprintf(stderr, _("Error: %s must not be a symbolic link\n"), file);
return -1;
}
if (st->st_uid != uid) {
fprintf(stderr, _("Error: %s not owned by UID %d\n"), file, uid);
return -1;
}
return 0;
}
static int check_owner_gid(gid_t gid, const char *file, struct stat *st) {
if (S_ISLNK(st->st_mode)) {
fprintf(stderr, _("Error: %s must not be a symbolic link\n"), file);
return -1;
}
if (st->st_gid != gid) {
fprintf(stderr, _("Error: %s not owned by GID %d\n"), file, gid);
return -1;
}
return 0;
}
#define equal_stats(one,two) \
((one)->st_dev == (two)->st_dev && (one)->st_ino == (two)->st_ino && \
(one)->st_uid == (two)->st_uid && (one)->st_gid == (two)->st_gid && \
(one)->st_mode == (two)->st_mode)
/**
* Sanity check specified directory. Store stat info for future comparison, or
* compare with previously saved info to detect replaced directories.
* Note: This function does not perform owner checks.
*/
static int verify_directory(const char *dir, struct stat *st_in, struct stat *st_out) {
struct stat sb;
if (st_out == NULL) st_out = &sb;
if (lstat(dir, st_out) == -1) {
fprintf(stderr, _("Failed to stat %s: %s\n"), dir, strerror(errno));
return -1;
}
if (! S_ISDIR(st_out->st_mode)) {
fprintf(stderr, _("Error: %s is not a directory: %s\n"), dir, strerror(errno));
return -1;
}
if (st_in && !equal_stats(st_in, st_out)) {
fprintf(stderr, _("Error: %s was replaced by a different directory\n"), dir);
return -1;
}
return 0;
}
/**
* This function checks to see if the shell is known in /etc/shells.
* If so, it returns 0. On error or illegal shell, it returns -1.
*/
static int verify_shell(const char *shell_name)
{
int rc = -1;
const char *buf;
if (!(shell_name && shell_name[0]))
return rc;
while ((buf = getusershell()) != NULL) {
/* ignore comments */
if (*buf == '#')
continue;
/* check the shell skipping newline char */
if (!strcmp(shell_name, buf)) {
rc = 0;
break;
}
}
endusershell();
return rc;
}
/**
* Mount directory and check that we mounted the right directory.
*/
static int seunshare_mount(const char *src, const char *dst, struct stat *src_st)
{
int flags = 0;
int is_tmp = 0;
if (verbose)
printf(_("Mounting %s on %s\n"), src, dst);
if (strcmp("/tmp", dst) == 0) {
flags = flags | MS_NODEV | MS_NOSUID | MS_NOEXEC;
is_tmp = 1;
}
/* mount directory */
if (mount(src, dst, NULL, MS_BIND | flags, NULL) < 0) {
fprintf(stderr, _("Failed to mount %s on %s: %s\n"), src, dst, strerror(errno));
return -1;
}
/* verify whether we mounted what we expected to mount */
if (verify_directory(dst, src_st, NULL) < 0) return -1;
/* bind mount /tmp on /var/tmp too */
if (is_tmp) {
if (verbose)
printf(_("Mounting /tmp on /var/tmp\n"));
if (mount("/tmp", "/var/tmp", NULL, MS_BIND | flags, NULL) < 0) {
fprintf(stderr, _("Failed to mount /tmp on /var/tmp: %s\n"), strerror(errno));
return -1;
}
}
return 0;
}
/**
* Error logging used by cgroups code.
*/
static int sandbox_error(const char *string)
{
fprintf(stderr, "%s", string);
syslog(LOG_AUTHPRIV | LOG_ALERT, "%s", string);
exit(-1);
}
/**
* Regular expression match.
*/
static int match(const char *string, char *pattern)
{
int status;
regex_t re;
if (regcomp(&re, pattern, REG_EXTENDED|REG_NOSUB) != 0) {
return 0;
}
status = regexec(&re, string, (size_t)0, NULL, 0);
regfree(&re);
if (status != 0) {
return 0;
}
return 1;
}
/**
* Apply cgroups settings from the /etc/sysconfig/sandbox config file.
*/
static int setup_cgroups()
{
char *cpus = NULL; /* which CPUs to use */
char *cgroupname = NULL;/* name for the cgroup */
char *mem = NULL; /* string for memory amount to pass to cgroup */
int64_t memusage = 0; /* amount of memory to use max (percent) */
int cpupercentage = 0; /* what percentage of cpu to allow usage */
FILE* fp;
char buf[BUF_SIZE];
char *tok = NULL;
int rc = -1;
char *str = NULL;
const char* fname = "/etc/sysconfig/sandbox";
if ((fp = fopen(fname, "rt")) == NULL) {
fprintf(stderr, "Error opening sandbox config file.");
return rc;
}
while(fgets(buf, BUF_SIZE, fp) != NULL) {
/* Skip comments */
if (buf[0] == '#') continue;
/* Copy the string, ignoring whitespace */
int len = strlen(buf);
free(str);
str = malloc((len + 1) * sizeof(char));
if (!str)
goto err;
int ind = 0;
int i;
for (i = 0; i < len; i++) {
char cur = buf[i];
if (cur != ' ' && cur != '\t') {
str[ind] = cur;
ind++;
}
}
str[ind] = '\0';
tok = strtok(str, "=\n");
if (tok != NULL) {
if (!strcmp(tok, "CPUAFFINITY")) {
tok = strtok(NULL, "=\n");
cpus = strdup(tok);
if (!strcmp(cpus, "ALL")) {
free(cpus);
cpus = NULL;
}
} else if (!strcmp(tok, "MEMUSAGE")) {
tok = strtok(NULL, "=\n");
if (match(tok, "^[0-9]+[kKmMgG%]")) {
char *ind = strchr(tok, '%');
if (ind != NULL) {
*ind = '\0';;
memusage = atoi(tok);
} else {
mem = strdup(tok);
}
} else {
fprintf(stderr, "Error parsing config file.");
goto err;
}
} else if (!strcmp(tok, "CPUUSAGE")) {
tok = strtok(NULL, "=\n");
if (match(tok, "^[0-9]+\%")) {
char* ind = strchr(tok, '%');
*ind = '\0';
cpupercentage = atoi(tok);
} else {
fprintf(stderr, "Error parsing config file.");
goto err;
}
} else if (!strcmp(tok, "NAME")) {
tok = strtok(NULL, "=\n");
cgroupname = strdup(tok);
} else {
continue;
}
}
}
if (mem == NULL) {
long phypz = sysconf(_SC_PHYS_PAGES);
long psize = sysconf(_SC_PAGE_SIZE);
memusage = phypz * psize * (float) memusage / 100.0;
}
cgroup_init();
int64_t current_runtime = 0;
int64_t current_period = 0 ;
int64_t current_mem = 0;
char *curr_cpu_path = NULL;
char *curr_mem_path = NULL;
int ret = cgroup_get_current_controller_path(getpid(), "cpu", &curr_cpu_path);
if (ret) {
sandbox_error("Error while trying to get current controller path.\n");
} else {
struct cgroup *curr = cgroup_new_cgroup(curr_cpu_path);
cgroup_get_cgroup(curr);
cgroup_get_value_int64(cgroup_get_controller(curr, "cpu"), "cpu.rt_runtime_us", &current_runtime);
cgroup_get_value_int64(cgroup_get_controller(curr, "cpu"), "cpu.rt_period_us", &current_period);
}
ret = cgroup_get_current_controller_path(getpid(), "memory", &curr_mem_path);
if (ret) {
sandbox_error("Error while trying to get current controller path.\n");
} else {
struct cgroup *curr = cgroup_new_cgroup(curr_mem_path);
cgroup_get_cgroup(curr);
cgroup_get_value_int64(cgroup_get_controller(curr, "memory"), "memory.limit_in_bytes", &current_mem);
}
if (((float) cpupercentage) / 100.0> (float)current_runtime / (float) current_period) {
sandbox_error("CPU usage restricted!\n");
goto err;
}
if (mem == NULL) {
if (memusage > current_mem) {
sandbox_error("Attempting to use more memory than allowed!");
goto err;
}
}
long nprocs = sysconf(_SC_NPROCESSORS_ONLN);
struct sched_param sp;
sp.sched_priority = sched_get_priority_min(SCHED_FIFO);
sched_setscheduler(getpid(), SCHED_FIFO, &sp);
struct cgroup *sandbox_group = cgroup_new_cgroup(cgroupname);
cgroup_add_controller(sandbox_group, "memory");
cgroup_add_controller(sandbox_group, "cpu");
if (mem == NULL) {
if (memusage > 0) {
cgroup_set_value_uint64(cgroup_get_controller(sandbox_group, "memory"), "memory.limit_in_bytes", memusage);
}
} else {
cgroup_set_value_string(cgroup_get_controller(sandbox_group, "memory"), "memory.limit_in_bytes", mem);
}
if (cpupercentage > 0) {
cgroup_set_value_uint64(cgroup_get_controller(sandbox_group, "cpu"), "cpu.rt_runtime_us",
(float) cpupercentage / 100.0 * 60000);
cgroup_set_value_uint64(cgroup_get_controller(sandbox_group, "cpu"), "cpu.rt_period_us",60000 * nprocs);
}
if (cpus != NULL) {
cgroup_set_value_string(cgroup_get_controller(sandbox_group, "cpu"), "cgroup.procs",cpus);
}
uint64_t allocated_mem;
if (cgroup_get_value_uint64(cgroup_get_controller(sandbox_group, "memory"), "memory.limit_in_bytes", &allocated_mem) > current_mem) {
sandbox_error("Attempting to use more memory than allowed!\n");
goto err;
}
rc = cgroup_create_cgroup(sandbox_group, 1);
if (rc != 0) {
sandbox_error("Failed to create group. Ensure that cgconfig service is running. \n");
goto err;
}
cgroup_attach_task(sandbox_group);
rc = 0;
err:
fclose(fp);
free(str);
free(mem);
free(cgroupname);
free(cpus);
return rc;
}
/*
If path is empy or ends with "/." or "/.. return -1 else return 0;
*/
static int bad_path(const char *path) {
const char *ptr;
ptr = path;
while (*ptr) ptr++;
if (ptr == path) return -1; // ptr null
ptr--;
if (ptr != path && *ptr == '.') {
ptr--;
if (*ptr == '/') return -1; // path ends in /.
if (*ptr == '.') {
if (ptr != path) {
ptr--;
if (*ptr == '/') return -1; // path ends in /..
}
}
}
return 0;
}
static int rsynccmd(const char * src, const char *dst, char **cmdbuf)
{
char *buf = NULL;
char *newbuf = NULL;
glob_t fglob;
fglob.gl_offs = 0;
int flags = GLOB_PERIOD;
unsigned int i = 0;
int rc = -1;
/* match glob for all files in src dir */
if (asprintf(&buf, "%s/*", src) == -1) {
fprintf(stderr, "Out of memory\n");
return -1;
}
if (glob(buf, flags, NULL, &fglob) != 0) {
free(buf); buf = NULL;
return -1;
}
free(buf); buf = NULL;
for ( i=0; i < fglob.gl_pathc; i++) {
const char *path = fglob.gl_pathv[i];
if (bad_path(path)) continue;
if (!buf) {
if (asprintf(&newbuf, "\'%s\'", path) == -1) {
fprintf(stderr, "Out of memory\n");
goto err;
}
} else {
if (asprintf(&newbuf, "%s \'%s\'", buf, path) == -1) {
fprintf(stderr, "Out of memory\n");
goto err;
}
}
free(buf); buf = newbuf;
newbuf = NULL;
}
if (buf) {
if (asprintf(&newbuf, "/usr/bin/rsync -trlHDq %s '%s'", buf, dst) == -1) {
fprintf(stderr, "Out of memory\n");
goto err;
}
*cmdbuf=newbuf;
}
else {
*cmdbuf=NULL;
}
rc = 0;
err:
free(buf); buf = NULL;
globfree(&fglob);
return rc;
}
/**
* Clean up runtime temporary directory. Returns 0 if no problem was detected,
* >0 if some error was detected, but errors here are treated as non-fatal and
* left to tmpwatch to finish incomplete cleanup.
*/
static int cleanup_tmpdir(const char *tmpdir, const char *src,
struct passwd *pwd, int copy_content)
{
char *cmdbuf = NULL;
int rc = 0;
/* rsync files back */
if (copy_content) {
if (asprintf(&cmdbuf, "/usr/bin/rsync --exclude=.X11-unix -utrlHDq --delete '%s/' '%s/'", tmpdir, src) == -1) {
fprintf(stderr, _("Out of memory\n"));
cmdbuf = NULL;
rc++;
}
if (cmdbuf && spawn_command(cmdbuf, pwd->pw_uid) != 0) {
fprintf(stderr, _("Failed to copy files from the runtime temporary directory\n"));
rc++;
}
free(cmdbuf); cmdbuf = NULL;
}
/* remove files from the runtime temporary directory */
if (asprintf(&cmdbuf, "/bin/rm -r '%s/' 2>/dev/null", tmpdir) == -1) {
fprintf(stderr, _("Out of memory\n"));
cmdbuf = NULL;
rc++;
}
/* this may fail if there's root-owned file left in the runtime tmpdir */
if (cmdbuf && spawn_command(cmdbuf, pwd->pw_uid) != 0) rc++;
free(cmdbuf); cmdbuf = NULL;
/* remove runtime temporary directory */
if ((uid_t)setfsuid(0) != pwd->pw_uid) {
fprintf(stderr, _("Unable to switch to root to clear tmp dir\n"));
rc++;
}
if (rmdir(tmpdir) == -1)
fprintf(stderr, _("Failed to remove directory %s: %s\n"), tmpdir, strerror(errno));
if ((uid_t)setfsuid(pwd->pw_uid) != 0) {
fprintf(stderr, _("unable to switch back to user after clearing tmp dir\n"));
rc++;
}
return rc;
}
/**
* seunshare will create a tmpdir in /tmp, with root ownership. The parent
* process waits for it child to exit to attempt to remove the directory. If
* it fails to remove the directory, we will need to rely on tmpreaper/tmpwatch
* to clean it up.
*/
static char *create_tmpdir(const char *src, struct stat *src_st,
struct stat *out_st, struct passwd *pwd, security_context_t execcon)
{
char *tmpdir = NULL;
char *cmdbuf = NULL;
int fd_t = -1, fd_s = -1;
struct stat tmp_st;
security_context_t con = NULL;
/* get selinux context */
if (execcon) {
if ((uid_t)setfsuid(pwd->pw_uid) != 0)
goto err;
if ((fd_s = open(src, O_RDONLY)) < 0) {
fprintf(stderr, _("Failed to open directory %s: %s\n"), src, strerror(errno));
goto err;
}
if (fstat(fd_s, &tmp_st) == -1) {
fprintf(stderr, _("Failed to stat directory %s: %s\n"), src, strerror(errno));
goto err;
}
if (!equal_stats(src_st, &tmp_st)) {
fprintf(stderr, _("Error: %s was replaced by a different directory\n"), src);
goto err;
}
if (fgetfilecon(fd_s, &con) == -1) {
fprintf(stderr, _("Failed to get context of the directory %s: %s\n"), src, strerror(errno));
goto err;
}
/* ok to not reach this if there is an error */
if ((uid_t)setfsuid(0) != pwd->pw_uid)
goto err;
}
if (asprintf(&tmpdir, "/tmp/.sandbox-%s-XXXXXX", pwd->pw_name) == -1) {
fprintf(stderr, _("Out of memory\n"));
tmpdir = NULL;
goto err;
}
if (mkdtemp(tmpdir) == NULL) {
fprintf(stderr, _("Failed to create temporary directory: %s\n"), strerror(errno));
goto err;
}
/* temporary directory must be owned by root:user */
if (verify_directory(tmpdir, NULL, out_st) < 0) {
goto err;
}
if (check_owner_uid(0, tmpdir, out_st) < 0)
goto err;
if (check_owner_gid(getgid(), tmpdir, out_st) < 0)
goto err;
/* change permissions of the temporary directory */
if ((fd_t = open(tmpdir, O_RDONLY)) < 0) {
fprintf(stderr, _("Failed to open directory %s: %s\n"), tmpdir, strerror(errno));
goto err;
}
if (fstat(fd_t, &tmp_st) == -1) {
fprintf(stderr, _("Failed to stat directory %s: %s\n"), tmpdir, strerror(errno));
goto err;
}
if (!equal_stats(out_st, &tmp_st)) {
fprintf(stderr, _("Error: %s was replaced by a different directory\n"), tmpdir);
goto err;
}
if (fchmod(fd_t, 01770) == -1) {
fprintf(stderr, _("Unable to change mode on %s: %s\n"), tmpdir, strerror(errno));
goto err;
}
/* re-stat again to pick change mode */
if (fstat(fd_t, out_st) == -1) {
fprintf(stderr, _("Failed to stat directory %s: %s\n"), tmpdir, strerror(errno));
goto err;
}
/* copy selinux context */
if (execcon) {
if (fsetfilecon(fd_t, con) == -1) {
fprintf(stderr, _("Failed to set context of the directory %s: %s\n"), tmpdir, strerror(errno));
goto err;
}
}
if ((uid_t)setfsuid(pwd->pw_uid) != 0)
goto err;
if (rsynccmd(src, tmpdir, &cmdbuf) < 0) {
goto err;
}
/* ok to not reach this if there is an error */
if ((uid_t)setfsuid(0) != pwd->pw_uid)
goto err;
if (cmdbuf && spawn_command(cmdbuf, pwd->pw_uid) != 0) {
fprintf(stderr, _("Failed to populate runtime temporary directory\n"));
cleanup_tmpdir(tmpdir, src, pwd, 0);
goto err;
}
goto good;
err:
free(tmpdir); tmpdir = NULL;
good:
free(cmdbuf); cmdbuf = NULL;
freecon(con); con = NULL;
if (fd_t >= 0) close(fd_t);
if (fd_s >= 0) close(fd_s);
return tmpdir;
}
#define PROC_BASE "/proc"
static int
killall (security_context_t execcon)
{
DIR *dir;
security_context_t scon;
struct dirent *de;
pid_t *pid_table, pid, self;
int i;
int pids, max_pids;
int running = 0;
self = getpid();
if (!(dir = opendir(PROC_BASE))) {
return -1;
}
max_pids = 256;
pid_table = malloc(max_pids * sizeof (pid_t));
if (!pid_table) {
(void)closedir(dir);
return -1;
}
pids = 0;
context_t con;
con = context_new(execcon);
const char *mcs = context_range_get(con);
printf("mcs=%s\n", mcs);
while ((de = readdir (dir)) != NULL) {
if (!(pid = (pid_t)atoi(de->d_name)) || pid == self)
continue;
if (pids == max_pids) {
pid_t *new_pid_table = realloc(pid_table, 2*pids*sizeof(pid_t));
if (!new_pid_table) {
free(pid_table);
(void)closedir(dir);
return -1;
}
pid_table = new_pid_table;
max_pids *= 2;
}
pid_table[pids++] = pid;
}
(void)closedir(dir);
for (i = 0; i < pids; i++) {
pid_t id = pid_table[i];
if (getpidcon(id, &scon) == 0) {
context_t pidcon = context_new(scon);
/* Attempt to kill remaining processes */
if (strcmp(context_range_get(pidcon), mcs) == 0)
kill(id, SIGKILL);
context_free(pidcon);
freecon(scon);
}
running++;
}
context_free(con);
free(pid_table);
return running;
}
int main(int argc, char **argv) {
int status = -1;
security_context_t execcon = NULL;
int clflag; /* holds codes for command line flags */
int usecgroups = 0;
int kill_all = 0;
char *homedir_s = NULL; /* homedir spec'd by user in argv[] */
char *tmpdir_s = NULL; /* tmpdir spec'd by user in argv[] */
char *tmpdir_r = NULL; /* tmpdir created by seunshare */
struct stat st_homedir;
struct stat st_tmpdir_s;
struct stat st_tmpdir_r;
const struct option long_options[] = {
{"homedir", 1, 0, 'h'},
{"tmpdir", 1, 0, 't'},
{"kill", 1, 0, 'k'},
{"verbose", 1, 0, 'v'},
{"cgroups", 1, 0, 'c'},
{"context", 1, 0, 'Z'},
{"capabilities", 1, 0, 'C'},
{NULL, 0, 0, 0}
};
uid_t uid = getuid();
/*
if (!uid) {
fprintf(stderr, _("Must not be root"));
return -1;
}
*/
#ifdef USE_NLS
setlocale(LC_ALL, "");
bindtextdomain(PACKAGE, LOCALEDIR);
textdomain(PACKAGE);
#endif
struct passwd *pwd=getpwuid(uid);
if (!pwd) {
perror(_("getpwduid failed"));
return -1;
}
if (verify_shell(pwd->pw_shell) < 0) {
fprintf(stderr, _("Error: User shell is not valid\n"));
return -1;
}
while (1) {
clflag = getopt_long(argc, argv, "Ccvh:t:Z:", long_options, NULL);
if (clflag == -1)
break;
switch (clflag) {
case 't':
tmpdir_s = optarg;
break;
case 'k':
kill_all = 1;
break;
case 'h':
homedir_s = optarg;
break;
case 'v':
verbose++;
break;
case 'c':
usecgroups = 1;
break;
case 'C':
cap_set = CAPNG_SELECT_CAPS;
break;
case 'Z':
execcon = optarg;
break;
default:
fprintf(stderr, "%s\n", USAGE_STRING);
return -1;
}
}
if (! homedir_s && ! tmpdir_s) {
fprintf(stderr, _("Error: tmpdir and/or homedir required\n %s\n"), USAGE_STRING);
return -1;
}
if (argc - optind < 1) {
fprintf(stderr, _("Error: executable required\n %s\n"), USAGE_STRING);
return -1;
}
if (execcon && is_selinux_enabled() != 1) {
fprintf(stderr, _("Error: execution context specified, but SELinux is not enabled\n"));
return -1;
}
if (set_signal_handles())
return -1;
if (usecgroups && setup_cgroups() < 0)
return -1;
/* set fsuid to ruid */
/* Changing fsuid is usually required when user-specified directory is
* on an NFS mount. It's also desired to avoid leaking info about
* existence of the files not accessible to the user. */
if ((uid_t)setfsuid(uid) != 0)
return -1;
/* verify homedir and tmpdir */
if (homedir_s && (
verify_directory(homedir_s, NULL, &st_homedir) < 0 ||
check_owner_uid(uid, homedir_s, &st_homedir))) return -1;
if (tmpdir_s && (
verify_directory(tmpdir_s, NULL, &st_tmpdir_s) < 0 ||
check_owner_uid(uid, tmpdir_s, &st_tmpdir_s))) return -1;
if ((uid_t)setfsuid(0) != uid) return -1;
/* create runtime tmpdir */
if (tmpdir_s && (tmpdir_r = create_tmpdir(tmpdir_s, &st_tmpdir_s,
&st_tmpdir_r, pwd, execcon)) == NULL) {
fprintf(stderr, _("Failed to create runtime temporary directory\n"));
return -1;
}
/* spawn child process */
child = fork();
if (child == -1) {
perror(_("Unable to fork"));
goto err;
}
if (child == 0) {
char *display = NULL;
char *LANG = NULL;
int rc = -1;
if (unshare(CLONE_NEWNS) < 0) {
perror(_("Failed to unshare"));
goto childerr;
}
/* Remount / as SLAVE so that nothing mounted in the namespace
shows up in the parent */
if (mount("none", "/", NULL, MS_SLAVE | MS_REC , NULL) < 0) {
perror(_("Failed to make / a SLAVE mountpoint\n"));
goto childerr;
}
/* assume fsuid==ruid after this point */
if ((uid_t)setfsuid(uid) != 0) goto childerr;
/* mount homedir and tmpdir, in this order */
if (homedir_s && seunshare_mount(homedir_s, pwd->pw_dir,
&st_homedir) != 0) goto childerr;
if (tmpdir_s && seunshare_mount(tmpdir_r, "/tmp",
&st_tmpdir_r) != 0) goto childerr;
if (drop_privs(uid) != 0) goto childerr;
/* construct a new environment */
if ((display = getenv("DISPLAY")) != NULL) {
if ((display = strdup(display)) == NULL) {
perror(_("Out of memory"));
goto childerr;
}
}
/* construct a new environment */
if ((LANG = getenv("LANG")) != NULL) {
if ((LANG = strdup(LANG)) == NULL) {
perror(_("Out of memory"));
goto childerr;
}
}
if ((rc = clearenv()) != 0) {
perror(_("Failed to clear environment"));
goto childerr;
}
if (display)
rc |= setenv("DISPLAY", display, 1);
if (LANG)
rc |= setenv("LANG", LANG, 1);
rc |= setenv("HOME", pwd->pw_dir, 1);
rc |= setenv("SHELL", pwd->pw_shell, 1);
rc |= setenv("USER", pwd->pw_name, 1);
rc |= setenv("LOGNAME", pwd->pw_name, 1);
rc |= setenv("PATH", DEFAULT_PATH, 1);
if (rc != 0) {
fprintf(stderr, _("Failed to construct environment\n"));
goto childerr;
}
/* selinux context */
if (execcon && setexeccon(execcon) != 0) {
fprintf(stderr, _("Could not set exec context to %s. %s\n"), execcon, strerror(errno));
goto childerr;
}
if (chdir(pwd->pw_dir)) {
perror(_("Failed to change dir to homedir"));
goto childerr;
}
setsid();
execv(argv[optind], argv + optind);
fprintf(stderr, _("Failed to execute command %s: %s\n"), argv[optind], strerror(errno));
childerr:
free(display);
free(LANG);
exit(-1);
}
drop_caps();
/* parent waits for child exit to do the cleanup */
waitpid(child, &status, 0);
status_to_retval(status, status);
/* Make sure all child processes exit */
kill(-child,SIGTERM);
if (execcon && kill_all)
killall(execcon);
if (tmpdir_r) cleanup_tmpdir(tmpdir_r, tmpdir_s, pwd, 1);
err:
free(tmpdir_r);
return status;
}
Reference in New Issue View Git Blame Copy Permalink