nixpkgs/pkgs/build-support/build-fhs-userenv/chrootenv.c

183 lines
4.6 KiB
C

#define _GNU_SOURCE
#include <errno.h>
#include <error.h>
#define errorf(status, fmt, ...) \
error_at_line(status, errno, __FILE__, __LINE__, fmt, ##__VA_ARGS__)
#include <dirent.h>
#include <ftw.h>
#include <sched.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sysexits.h>
#include <unistd.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/wait.h>
char *env_whitelist[] = {"TERM",
"DISPLAY",
"XAUTHORITY",
"HOME",
"XDG_RUNTIME_DIR",
"LANG",
"SSL_CERT_FILE",
"DBUS_SESSION_BUS_ADDRESS"};
char **env_build(char *names[], size_t len) {
char *env, **ret = malloc((len + 1) * sizeof(char *)), **ptr = ret;
for (size_t i = 0; i < len; i++) {
if ((env = getenv(names[i]))) {
if (asprintf(ptr++, "%s=%s", names[i], env) < 0)
errorf(EX_OSERR, "asprintf");
}
}
*ptr = NULL;
return ret;
}
struct bind {
char *from;
char *to;
};
struct bind binds[] = {{"/", "host"}, {"/proc", "proc"}, {"/sys", "sys"},
{"/nix", "nix"}, {"/tmp", "tmp"}, {"/var", "var"},
{"/run", "run"}, {"/dev", "dev"}, {"/home", "home"}};
void bind(struct bind *bind) {
DIR *src = opendir(bind->from);
if (src) {
if (closedir(src) < 0)
errorf(EX_IOERR, "closedir");
if (mkdir(bind->to, 0755) < 0)
errorf(EX_IOERR, "mkdir");
if (mount(bind->from, bind->to, "bind", MS_BIND | MS_REC, NULL) < 0)
errorf(EX_OSERR, "mount");
} else {
// https://github.com/NixOS/nixpkgs/issues/31104
if (errno != ENOENT)
errorf(EX_OSERR, "opendir");
}
}
void spitf(char *path, char *fmt, ...) {
va_list args;
va_start(args, fmt);
FILE *f = fopen(path, "w");
if (f == NULL)
errorf(EX_IOERR, "spitf(%s): fopen", path);
if (vfprintf(f, fmt, args) < 0)
errorf(EX_IOERR, "spitf(%s): vfprintf", path);
if (fclose(f) < 0)
errorf(EX_IOERR, "spitf(%s): fclose", path);
}
int nftw_rm(const char *path, const struct stat *sb, int type,
struct FTW *ftw) {
if (remove(path) < 0)
errorf(EX_IOERR, "nftw_rm");
return 0;
}
#define LEN(x) sizeof(x) / sizeof(*x)
int main(int argc, char *argv[]) {
if (argc < 2) {
fprintf(stderr, "Usage: %s command [arguments...]\n"
"Requires Linux kernel >= 3.19 with CONFIG_USER_NS.\n",
argv[0]);
exit(EX_USAGE);
}
char tmpl[] = "/tmp/chrootenvXXXXXX";
char *root = mkdtemp(tmpl);
if (root == NULL)
errorf(EX_IOERR, "mkdtemp");
// Don't make root private so that privilege drops inside chroot are possible:
if (chmod(root, 0755) < 0)
errorf(EX_IOERR, "chmod");
pid_t cpid = fork();
if (cpid < 0)
errorf(EX_OSERR, "fork");
if (cpid == 0) {
uid_t uid = getuid();
gid_t gid = getgid();
// If we are root, no need to create new user namespace.
if (uid == 0) {
if (unshare(CLONE_NEWNS) < 0)
errorf(EX_OSERR, "unshare() failed: You may have an old kernel or have CLONE_NEWUSER disabled by your distribution security settings.");
// Mark all mounted filesystems as slave so changes
// don't propagate to the parent mount namespace.
if (mount(NULL, "/", NULL, MS_REC | MS_SLAVE, NULL) < 0)
errorf(EX_OSERR, "mount");
} else {
// Create new mount and user namespaces. CLONE_NEWUSER
// requires a program to be non-threaded.
if (unshare(CLONE_NEWNS | CLONE_NEWUSER) < 0)
errorf(EX_OSERR, "unshare");
// Map users and groups to the parent namespace.
// setgroups is only available since Linux 3.19:
spitf("/proc/self/setgroups", "deny");
spitf("/proc/self/uid_map", "%d %d 1", uid, uid);
spitf("/proc/self/gid_map", "%d %d 1", gid, gid);
}
if (chdir(root) < 0)
errorf(EX_IOERR, "chdir");
for (size_t i = 0; i < LEN(binds); i++)
bind(&binds[i]);
if (chroot(root) < 0)
errorf(EX_OSERR, "chroot");
if (chdir("/") < 0)
errorf(EX_OSERR, "chdir");
argv++;
if (execvpe(*argv, argv, env_build(env_whitelist, LEN(env_whitelist))) < 0)
errorf(EX_OSERR, "execvpe");
}
int status;
if (waitpid(cpid, &status, 0) < 0)
errorf(EX_OSERR, "waitpid");
if (nftw(root, nftw_rm, getdtablesize(), FTW_DEPTH | FTW_MOUNT | FTW_PHYS) < 0)
errorf(EX_IOERR, "nftw");
if (WIFEXITED(status))
return WEXITSTATUS(status);
else if (WIFSIGNALED(status))
kill(getpid(), WTERMSIG(status));
return EX_OSERR;
}