* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
-#define _GNU_SOURCE
+#ifndef _GNU_SOURCE
+#define _GNU_SOURCE 1
+#endif
#include <errno.h>
#include <fcntl.h>
-#include <termios.h>
#include <grp.h>
+#include <linux/unistd.h>
#include <pwd.h>
+#include <pthread.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
-#include <unistd.h>
-#include <linux/unistd.h>
#include <sys/mount.h>
#include <sys/param.h>
#include <sys/prctl.h>
#include <sys/socket.h>
#include <sys/syscall.h>
#include <sys/wait.h>
+#include <termios.h>
+#include <unistd.h>
#include <lxc/lxccontainer.h>
-#ifndef HAVE_DECL_PR_CAPBSET_DROP
-#define PR_CAPBSET_DROP 24
-#endif
-
-#ifndef HAVE_DECL_PR_SET_NO_NEW_PRIVS
-#define PR_SET_NO_NEW_PRIVS 38
-#endif
-
-#ifndef HAVE_DECL_PR_GET_NO_NEW_PRIVS
-#define PR_GET_NO_NEW_PRIVS 39
-#endif
-
#include "af_unix.h"
#include "attach.h"
#include "caps.h"
#include "lsm/lsm.h"
#include "lxclock.h"
#include "lxcseccomp.h"
+#include "macro.h"
#include "mainloop.h"
+#include "memory_utils.h"
#include "namespace.h"
+#include "raw_syscalls.h"
+#include "syscall_wrappers.h"
#include "terminal.h"
#include "utils.h"
#include <sys/personality.h>
#endif
-#ifndef SOCK_CLOEXEC
-#define SOCK_CLOEXEC 02000000
-#endif
-
-#ifndef MS_REC
-#define MS_REC 16384
-#endif
-
-#ifndef MS_SLAVE
-#define MS_SLAVE (1 << 19)
-#endif
-
lxc_log_define(attach, lxc);
-/* /proc/pid-to-str/status\0 = (5 + 21 + 7 + 1) */
-#define __PROC_STATUS_LEN (5 + (LXC_NUMSTRLEN64) + 7 + 1)
+/* Define default options if no options are supplied by the user. */
+static lxc_attach_options_t attach_static_default_options = LXC_ATTACH_OPTIONS_DEFAULT;
+
static struct lxc_proc_context_info *lxc_proc_get_context_info(pid_t pid)
{
+ __do_free char *line = NULL;
+ __do_fclose FILE *proc_file = NULL;
int ret;
bool found;
- FILE *proc_file;
- char proc_fn[__PROC_STATUS_LEN];
+ char proc_fn[LXC_PROC_STATUS_LEN];
+ struct lxc_proc_context_info *info;
size_t line_bufsz = 0;
- char *line = NULL;
- struct lxc_proc_context_info *info = NULL;
/* Read capabilities. */
- ret = snprintf(proc_fn, __PROC_STATUS_LEN, "/proc/%d/status", pid);
- if (ret < 0 || ret >= __PROC_STATUS_LEN)
- goto on_error;
+ ret = snprintf(proc_fn, LXC_PROC_STATUS_LEN, "/proc/%d/status", pid);
+ if (ret < 0 || ret >= LXC_PROC_STATUS_LEN)
+ return NULL;
proc_file = fopen(proc_fn, "r");
if (!proc_file) {
- SYSERROR("Could not open %s", proc_fn);
- goto on_error;
+ SYSERROR("Failed to open %s", proc_fn);
+ return NULL;
}
info = calloc(1, sizeof(*info));
- if (!info) {
- SYSERROR("Could not allocate memory");
- fclose(proc_file);
+ if (!info)
return NULL;
- }
found = false;
}
}
- free(line);
- fclose(proc_file);
-
if (!found) {
- ERROR("Could not read capability bounding set from %s",
- proc_fn);
- goto on_error;
+ ERROR("Could not read capability bounding set from %s", proc_fn);
+ free(info);
+ return NULL;
}
info->lsm_label = lsm_process_label_get(pid);
memset(info->ns_fd, -1, sizeof(int) * LXC_NS_MAX);
return info;
-
-on_error:
- free(info);
- return NULL;
}
static inline void lxc_proc_close_ns_fd(struct lxc_proc_context_info *ctx)
{
- int i;
-
- for (i = 0; i < LXC_NS_MAX; i++) {
- if (ctx->ns_fd[i] < 0)
- continue;
-
- close(ctx->ns_fd[i]);
- ctx->ns_fd[i] = -EBADF;
+ for (int i = 0; i < LXC_NS_MAX; i++) {
+ __do_close_prot_errno int fd ATTR_UNUSED = move_fd(ctx->ns_fd[i]);
}
}
*/
static int in_same_namespace(pid_t pid1, pid_t pid2, const char *ns)
{
- int ns_fd1 = -1, ns_fd2 = -1, ret = -1;
- int saved_errno;
+ __do_close_prot_errno int ns_fd1 = -1, ns_fd2 = -1;
+ int ret = -1;
struct stat ns_st1, ns_st2;
ns_fd1 = lxc_preserve_ns(pid1, ns);
if (errno == ENOENT)
return -EINVAL;
- goto out;
+ return -1;
}
ns_fd2 = lxc_preserve_ns(pid2, ns);
if (ns_fd2 < 0)
- goto out;
+ return -1;
ret = fstat(ns_fd1, &ns_st1);
if (ret < 0)
- goto out;
+ return -1;
ret = fstat(ns_fd2, &ns_st2);
if (ret < 0)
- goto out;
+ return -1;
/* processes are in the same namespace */
- if ((ns_st1.st_dev == ns_st2.st_dev ) && (ns_st1.st_ino == ns_st2.st_ino)) {
- ret = -EINVAL;
- goto out;
- }
+ if ((ns_st1.st_dev == ns_st2.st_dev) && (ns_st1.st_ino == ns_st2.st_ino))
+ return -EINVAL;
/* processes are in different namespaces */
- ret = ns_fd2;
- ns_fd2 = -1;
-
-out:
- saved_errno = errno;
-
- if (ns_fd1 >= 0)
- close(ns_fd1);
-
- if (ns_fd2 >= 0)
- close(ns_fd2);
-
- errno = saved_errno;
- return ret;
+ return move_fd(ns_fd2);
}
static int lxc_attach_to_ns(pid_t pid, struct lxc_proc_context_info *ctx)
return 0;
}
-static int lxc_attach_remount_sys_proc(void)
+int lxc_attach_remount_sys_proc(void)
{
int ret;
if (ctx->capability_mask & (1LL << cap))
continue;
- if (prctl(PR_CAPBSET_DROP, cap, 0, 0, 0)) {
+ if (prctl(PR_CAPBSET_DROP, prctl_arg(cap), prctl_arg(0),
+ prctl_arg(0), prctl_arg(0))) {
SYSERROR("Failed to drop capability %d", cap);
return -1;
}
static char *lxc_attach_getpwshell(uid_t uid)
{
+ __do_free char *line = NULL;
+ __do_fclose FILE *pipe_f = NULL;
int fd, ret;
pid_t pid;
int pipes[2];
- FILE *pipe_f;
bool found = false;
size_t line_bufsz = 0;
- char *line = NULL, *result = NULL;
+ char *result = NULL;
/* We need to fork off a process that runs the getent program, and we
* need to capture its output, so we use a pipe for that purpose.
close(STDERR_FILENO);
} else {
(void)dup3(fd, STDIN_FILENO, O_CLOEXEC);
- (void)dup3(fd, STDOUT_FILENO, O_CLOEXEC);
+ (void)dup3(fd, STDERR_FILENO, O_CLOEXEC);
close(fd);
}
if (found)
continue;
+ if (!line)
+ continue;
+
/* Trim line on the right hand side. */
for (i = strlen(line); i > 0 && (line[i - 1] == '\n' || line[i - 1] == '\r'); --i)
line[i - 1] = '\0';
found = true;
}
- free(line);
- fclose(pipe_f);
-
ret = wait_for_pid(pid);
if (ret < 0) {
free(result);
static void lxc_attach_get_init_uidgid(uid_t *init_uid, gid_t *init_gid)
{
- FILE *proc_file;
- char proc_fn[__PROC_STATUS_LEN];
+ __do_free char *line = NULL;
+ __do_fclose FILE *proc_file = NULL;
+ char proc_fn[LXC_PROC_STATUS_LEN];
int ret;
- char *line = NULL;
size_t line_bufsz = 0;
long value = -1;
uid_t uid = (uid_t)-1;
gid_t gid = (gid_t)-1;
- ret = snprintf(proc_fn, __PROC_STATUS_LEN, "/proc/%d/status", 1);
- if (ret < 0 || ret >= __PROC_STATUS_LEN)
+ ret = snprintf(proc_fn, LXC_PROC_STATUS_LEN, "/proc/%d/status", 1);
+ if (ret < 0 || ret >= LXC_PROC_STATUS_LEN)
return;
proc_file = fopen(proc_fn, "r");
break;
}
- fclose(proc_file);
- free(line);
-
/* Only override arguments if we found something. */
if (uid != (uid_t)-1)
*init_uid = uid;
*/
}
-/* Help the optimizer along if it doesn't know that exit always exits. */
-#define rexit(c) \
- do { \
- int __c = (c); \
- _exit(__c); \
- return __c; \
- } while (0)
-
-/* Define default options if no options are supplied by the user. */
-static lxc_attach_options_t attach_static_default_options = LXC_ATTACH_OPTIONS_DEFAULT;
-
static bool fetch_seccomp(struct lxc_container *c, lxc_attach_options_t *options)
{
+ __do_free char *path = NULL;
int ret;
bool bret;
- char *path;
if (!(options->namespaces & CLONE_NEWNS) ||
!(options->attach_flags & LXC_ATTACH_LSM)) {
- free(c->lxc_conf->seccomp);
- c->lxc_conf->seccomp = NULL;
+ free(c->lxc_conf->seccomp.seccomp);
+ c->lxc_conf->seccomp.seccomp = NULL;
return true;
}
/* Copy the value into the new lxc_conf. */
bret = c->set_config_item(c, "lxc.seccomp.profile", path);
- free(path);
if (!bret)
return false;
static bool no_new_privs(struct lxc_container *c, lxc_attach_options_t *options)
{
- bool bret;
- char *val;
+ __do_free char *val = NULL;
/* Remove current setting. */
if (!c->set_config_item(c, "lxc.no_new_privs", "")) {
}
/* Set currently active setting. */
- bret = c->set_config_item(c, "lxc.no_new_privs", val);
- free(val);
- return bret;
+ return c->set_config_item(c, "lxc.no_new_privs", val);
}
static signed long get_personality(const char *name, const char *lxcpath)
{
- char *p;
- signed long ret;
+ __do_free char *p = NULL;
p = lxc_cmd_get_config_item(name, "lxc.arch", lxcpath);
if (!p)
return -1;
- ret = lxc_config_parse_arch(p);
- free(p);
-
- return ret;
+ return lxc_config_parse_arch(p);
}
struct attach_clone_payload {
static void lxc_put_attach_clone_payload(struct attach_clone_payload *p)
{
- if (p->ipc_socket >= 0) {
- shutdown(p->ipc_socket, SHUT_RDWR);
- close(p->ipc_socket);
- p->ipc_socket = -EBADF;
- }
-
- if (p->terminal_slave_fd >= 0) {
- close(p->terminal_slave_fd);
- p->terminal_slave_fd = -EBADF;
- }
+ __do_close_prot_errno int ipc_socket ATTR_UNUSED = p->ipc_socket;
+ __do_close_prot_errno int terminal_slave_fd ATTR_UNUSED = p->terminal_slave_fd;
if (p->init_ctx) {
lxc_proc_put_context_info(p->init_ctx);
static int attach_child_main(struct attach_clone_payload *payload)
{
- int fd, lsm_fd, ret;
+ int lsm_fd, ret;
uid_t new_uid;
gid_t new_gid;
+ uid_t ns_root_uid = 0;
+ gid_t ns_root_gid = 0;
lxc_attach_options_t* options = payload->options;
struct lxc_proc_context_info* init_ctx = payload->init_ctx;
bool needs_lsm = (options->namespaces & CLONE_NEWNS) &&
goto on_error;
}
- /* Set {u,g}id. */
- new_uid = 0;
- new_gid = 0;
+ if (options->namespaces & CLONE_NEWUSER) {
+ /* Check whether nsuid 0 has a mapping. */
+ ns_root_uid = get_ns_uid(0);
- /* Ignore errors, we will fall back to root in that case (/proc was not
- * mounted etc.).
- */
- if (options->namespaces & CLONE_NEWUSER)
- lxc_attach_get_init_uidgid(&new_uid, &new_gid);
+ /* Check whether nsgid 0 has a mapping. */
+ ns_root_gid = get_ns_gid(0);
- if (options->uid != (uid_t)-1)
- new_uid = options->uid;
+ /* If there's no mapping for nsuid 0 try to retrieve the nsuid
+ * init was started with.
+ */
+ if (ns_root_uid == LXC_INVALID_UID)
+ lxc_attach_get_init_uidgid(&ns_root_uid, &ns_root_gid);
- if (options->gid != (gid_t)-1)
- new_gid = options->gid;
+ if (ns_root_uid == LXC_INVALID_UID)
+ goto on_error;
- /* Try to set the {u,g}id combination. */
- if (new_uid != 0 || new_gid != 0 || options->namespaces & CLONE_NEWUSER) {
- ret = lxc_switch_uid_gid(new_uid, new_gid);
- if (ret < 0)
+ if (!lxc_switch_uid_gid(ns_root_uid, ns_root_gid))
goto on_error;
}
- ret = lxc_setgroups(0, NULL);
- if (ret < 0 && errno != EPERM)
+ if (!lxc_setgroups(0, NULL) && errno != EPERM)
goto on_error;
+ /* Set {u,g}id. */
+ if (options->uid != LXC_INVALID_UID)
+ new_uid = options->uid;
+ else
+ new_uid = ns_root_uid;
+
+ if (options->gid != LXC_INVALID_GID)
+ new_gid = options->gid;
+ else
+ new_gid = ns_root_gid;
+
if ((init_ctx->container && init_ctx->container->lxc_conf &&
init_ctx->container->lxc_conf->no_new_privs) ||
(options->attach_flags & LXC_ATTACH_NO_NEW_PRIVS)) {
- ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
+ ret = prctl(PR_SET_NO_NEW_PRIVS, prctl_arg(1), prctl_arg(0),
+ prctl_arg(0), prctl_arg(0));
if (ret < 0)
goto on_error;
}
if (init_ctx->container && init_ctx->container->lxc_conf &&
- init_ctx->container->lxc_conf->seccomp) {
- ret = lxc_seccomp_load(init_ctx->container->lxc_conf);
+ init_ctx->container->lxc_conf->seccomp.seccomp) {
+ struct lxc_conf *conf = init_ctx->container->lxc_conf;
+
+ ret = lxc_seccomp_load(conf);
if (ret < 0)
goto on_error;
TRACE("Loaded seccomp profile");
+
+ ret = lxc_seccomp_send_notifier_fd(&conf->seccomp, payload->ipc_socket);
+ if (ret < 0)
+ goto on_error;
}
- shutdown(payload->ipc_socket, SHUT_RDWR);
close(payload->ipc_socket);
payload->ipc_socket = -EBADF;
lxc_proc_put_context_info(init_ctx);
if (options->stderr_fd > STDERR_FILENO)
close(options->stderr_fd);
- /* Try to remove FD_CLOEXEC flag from stdin/stdout/stderr, but also
+ /*
+ * Try to remove FD_CLOEXEC flag from stdin/stdout/stderr, but also
* here, ignore errors.
*/
- for (fd = STDIN_FILENO; fd <= STDERR_FILENO; fd++) {
+ for (int fd = STDIN_FILENO; fd <= STDERR_FILENO; fd++) {
ret = fd_cloexec(fd, false);
if (ret < 0) {
SYSERROR("Failed to clear FD_CLOEXEC from file descriptor %d", fd);
TRACE("Prepared terminal file descriptor %d", payload->terminal_slave_fd);
}
+ /* Avoid unnecessary syscalls. */
+ if (new_uid == ns_root_uid)
+ new_uid = LXC_INVALID_UID;
+
+ if (new_gid == ns_root_gid)
+ new_gid = LXC_INVALID_GID;
+
+ if (!lxc_switch_uid_gid(new_uid, new_gid))
+ goto on_error;
+
/* We're done, so we can now do whatever the user intended us to do. */
- rexit(payload->exec_function(payload->exec_payload));
+ _exit(payload->exec_function(payload->exec_payload));
on_error:
lxc_put_attach_clone_payload(payload);
- rexit(EXIT_FAILURE);
+ _exit(EXIT_FAILURE);
}
static int lxc_attach_terminal(struct lxc_conf *conf,
static inline void lxc_attach_terminal_close_master(struct lxc_terminal *terminal)
{
- if (terminal->master < 0)
- return;
-
- close(terminal->master);
- terminal->master = -EBADF;
+ close_prot_errno_disarm(terminal->master);
}
static inline void lxc_attach_terminal_close_slave(struct lxc_terminal *terminal)
{
- if (terminal->slave < 0)
- return;
-
- close(terminal->slave);
- terminal->slave = -EBADF;
+ close_prot_errno_disarm(terminal->slave);
}
static inline void lxc_attach_terminal_close_peer(struct lxc_terminal *terminal)
{
- if (terminal->peer < 0)
- return;
-
- close(terminal->peer);
- terminal->peer = -EBADF;
+ close_prot_errno_disarm(terminal->peer);
}
static inline void lxc_attach_terminal_close_log(struct lxc_terminal *terminal)
{
- if (terminal->log_fd < 0)
- return;
-
- close(terminal->log_fd);
- terminal->log_fd = -EBADF;
+ close_prot_errno_disarm(terminal->log_fd);
}
-int lxc_attach(const char *name, const char *lxcpath,
- lxc_attach_exec_t exec_function, void *exec_payload,
- lxc_attach_options_t *options, pid_t *attached_process)
+int lxc_attach(struct lxc_container *container, lxc_attach_exec_t exec_function,
+ void *exec_payload, lxc_attach_options_t *options,
+ pid_t *attached_process)
{
int i, ret, status;
int ipc_sockets[2];
struct lxc_proc_context_info *init_ctx;
struct lxc_terminal terminal;
struct lxc_conf *conf;
+ char *name, *lxcpath;
struct attach_clone_payload payload = {0};
ret = access("/proc/self/ns", X_OK);
return -1;
}
+ if (!container)
+ return minus_one_set_errno(EINVAL);
+
+ if (!lxc_container_get(container))
+ return minus_one_set_errno(EINVAL);
+
+ name = container->name;
+ lxcpath = container->config_path;
+
if (!options)
options = &attach_static_default_options;
init_pid = lxc_cmd_get_init_pid(name, lxcpath);
if (init_pid < 0) {
ERROR("Failed to get init pid");
+ lxc_container_put(container);
return -1;
}
init_ctx = lxc_proc_get_context_info(init_pid);
if (!init_ctx) {
ERROR("Failed to get context of init process: %ld", (long)init_pid);
+ lxc_container_put(container);
return -1;
}
+ init_ctx->container = container;
+
personality = get_personality(name, lxcpath);
if (init_ctx->personality < 0) {
ERROR("Failed to get personality of the container");
}
init_ctx->personality = personality;
- init_ctx->container = lxc_container_new(name, lxcpath);
- if (!init_ctx->container) {
- lxc_proc_put_context_info(init_ctx);
- return -1;
- }
-
if (!init_ctx->container->lxc_conf) {
init_ctx->container->lxc_conf = lxc_conf_init();
if (!init_ctx->container->lxc_conf) {
* just fork()s away without exec'ing directly after, the socket fd will
* exist in the forked process from the other thread and any close() in
* our own child process will not really cause the socket to close
- * properly, potentiall causing the parent to hang.
+ * properly, potentially causing the parent to hang.
*
* For this reason, while IPC is still active, we have to use shutdown()
* if the child exits prematurely in order to signal that the socket is
if (options->attach_flags & LXC_ATTACH_MOVE_TO_CGROUP) {
struct cgroup_ops *cgroup_ops;
- cgroup_ops = cgroup_init(NULL);
+ cgroup_ops = cgroup_init(conf);
if (!cgroup_ops)
goto on_error;
if ((options->namespaces & CLONE_NEWNS) &&
(options->attach_flags & LXC_ATTACH_LSM) &&
init_ctx->lsm_label) {
- int ret = -1;
int labelfd;
bool on_exec;
+ ret = -1;
on_exec = options->attach_flags & LXC_ATTACH_LSM_EXEC ? true : false;
labelfd = lsm_process_label_fd_get(attached_pid, on_exec);
if (labelfd < 0)
TRACE("Sent LSM label file descriptor %d to child", labelfd);
}
+ if (conf && conf->seccomp.seccomp) {
+ ret = lxc_seccomp_recv_notifier_fd(&conf->seccomp, ipc_sockets[0]);
+ if (ret < 0)
+ goto close_mainloop;
+
+ ret = lxc_seccomp_add_notifier(name, lxcpath, &conf->seccomp);
+ if (ret < 0)
+ goto close_mainloop;
+ }
+
/* We're done, the child process should now execute whatever it
* is that the user requested. The parent can now track it with
* waitpid() or similar.
if (ret != sizeof(status)) {
shutdown(ipc_sockets[1], SHUT_RDWR);
lxc_proc_put_context_info(init_ctx);
- rexit(-1);
+ _exit(EXIT_FAILURE);
}
TRACE("Intermediate process starting to initialize");
ERROR("Failed to enter namespaces");
shutdown(ipc_sockets[1], SHUT_RDWR);
lxc_proc_put_context_info(init_ctx);
- rexit(-1);
+ _exit(EXIT_FAILURE);
}
/* close namespace file descriptors */
payload.exec_function = exec_function;
payload.exec_payload = exec_payload;
- pid = lxc_raw_clone(CLONE_PARENT);
+ pid = lxc_raw_clone(CLONE_PARENT, NULL);
if (pid < 0) {
SYSERROR("Failed to clone attached process");
shutdown(ipc_sockets[1], SHUT_RDWR);
lxc_proc_put_context_info(init_ctx);
- rexit(-1);
+ _exit(EXIT_FAILURE);
}
if (pid == 0) {
+ if (options->attach_flags & LXC_ATTACH_TERMINAL) {
+ ret = pthread_sigmask(SIG_SETMASK,
+ &terminal.tty_state->oldmask, NULL);
+ if (ret < 0) {
+ SYSERROR("Failed to reset signal mask");
+ _exit(EXIT_FAILURE);
+ }
+ }
+
ret = attach_child_main(&payload);
if (ret < 0)
ERROR("Failed to exec");
*/
shutdown(ipc_sockets[1], SHUT_RDWR);
lxc_proc_put_context_info(init_ctx);
- rexit(-1);
+ _exit(EXIT_FAILURE);
}
TRACE("Sending pid %d of attached process", pid);
/* The rest is in the hands of the initial and the attached process. */
lxc_proc_put_context_info(init_ctx);
- rexit(0);
+ _exit(EXIT_SUCCESS);
}
-int lxc_attach_run_command(void* payload)
+int lxc_attach_run_command(void *payload)
{
- lxc_attach_command_t* cmd = (lxc_attach_command_t*)payload;
+ int ret = -1;
+ lxc_attach_command_t *cmd = payload;
- execvp(cmd->program, cmd->argv);
+ ret = execvp(cmd->program, cmd->argv);
+ if (ret < 0) {
+ switch (errno) {
+ case ENOEXEC:
+ ret = 126;
+ break;
+ case ENOENT:
+ ret = 127;
+ break;
+ }
+ }
SYSERROR("Failed to exec \"%s\"", cmd->program);
- return -1;
+ return ret;
}
int lxc_attach_run_shell(void* payload)
{
+ __do_free char *buf = NULL;
uid_t uid;
struct passwd pwent;
struct passwd *pwentp = NULL;
char *user_shell;
- char *buf;
size_t bufsize;
int ret;
if (!pwentp)
free(user_shell);
- free(buf);
return -1;
}