]>
git.wh0rd.org - home.git/blob - vunshare.c
2 * Written by Mike Frysinger <vapier@gmail.com>
3 * Released into the public domain.
7 * - Add userns support.
8 * - Make pidns init optional.
9 * - Make setproctitle nicer and include program argv[0].
10 * - Set up prctl(PR_SET_PDEATHSIG).
11 * - Set up prctl(PR_SET_CHILD_SUBREAPER).
30 #include <sys/ioctl.h>
31 #include <sys/mount.h>
32 #include <sys/prctl.h>
33 #include <sys/socket.h>
34 #include <sys/types.h>
37 #define PROG "vunshare"
39 static bool vunshare(int flags
)
41 if (unshare(flags
) == -1) {
43 err(1, "unshare failed");
49 static void unshare_net(void)
51 if (!vunshare(CLONE_NEWNET
))
54 int sock
= socket(AF_LOCAL
, SOCK_DGRAM
|SOCK_CLOEXEC
, 0);
57 /* Equiv of `ip link set up lo`. Kernel will assign 127.0.0.1 for us. */
58 strcpy(ifr
.ifr_name
, "lo");
59 if (ioctl(sock
, SIOCGIFFLAGS
, &ifr
) < 0)
60 err(1, "ioctl(SIOCGIFFLAGS) failed");
61 strcpy(ifr
.ifr_name
, "lo");
62 ifr
.ifr_flags
|= IFF_UP
| IFF_RUNNING
;
63 if (ioctl(sock
, SIOCSIFFLAGS
, &ifr
) < 0)
64 err(1, "ioctl(SIOCSIFFLAGS) failed");
67 static char **title_argv
;
68 static void setproctitle(const char *title
)
70 /* Hopefully 1k is all we ever need. */
72 memset(newtitle
, 0, sizeof(newtitle
));
73 int len
= sprintf(newtitle
, "%s: %s [pid ns]", PROG
, title
);
75 prctl(PR_SET_NAME
, (uintptr_t)newtitle
);
77 /* Clobber argv to set the title. Need to figure out how much space though. */
80 while (title_argv
[argc
])
81 i
+= strlen(title_argv
[argc
++]) + 1;
82 /* Now scan the environ table. */
83 while (title_argv
[argc
])
84 i
+= strlen(title_argv
[argc
++]) + 1;
88 /* This will NUL pad the string for us too. */
89 strncpy(title_argv
[0], newtitle
, i
);
92 static void close_fds(void)
95 for (i
= 3; i
< 10; ++i
)
99 static void exit_as_status_ext(int status
)
102 int exit_status
= WEXITSTATUS(status
);
104 if (WIFSIGNALED(status
)) {
105 sig_status
= WTERMSIG(status
);
106 } else if (exit_status
> 128) {
107 /* For the external init, translate the signal status back.
108 * TODO: This gets it wrong when the child actually exited.
109 * We need to set up a pipe between the two inits so we can
110 * get back the proper details.
112 sig_status
= exit_status
- 128;
116 signal(sig_status
, SIG_DFL
);
117 kill(getpid(), sig_status
);
119 /* Still here ? Maybe the signal was masked. Just exit. */
120 exit_status
= 128 + sig_status
;
126 static void exit_as_status_int(int status
)
128 /* If we are the init for the pid ns, we can't kill ourselves --
129 * the kernel explicitly disallows this. Just exit with a high
130 * status value instead. Our parent will handle it themselves.
134 if (WIFSIGNALED(status
))
135 exit_status
= 128 + WTERMSIG(status
);
137 exit_status
= WEXITSTATUS(status
);
142 static int reap_children(void)
154 static pid_t child_pid
;
155 static void signal_passthru(int sig
, siginfo_t
*siginfo
, void *context
)
160 /* If the signal is coming from our children, ignore it.
161 * If it's coming from outside the pid ns, pass it along.
163 if (siginfo
->si_pid
!= 0)
166 /* Kill all the children! */
171 /* Just forward signal to the child. */
172 kill(child_pid
, sig
);
176 /* We want to forward some signals to the child process. Block the rest.
177 * We don't actually exit as we wait for the child to die/process the signal
178 * first, and then we'll kill/exit after that point.
180 static void setup_signal_handler(pid_t pid
)
184 struct sigaction sa
= {
185 .sa_sigaction
= signal_passthru
,
186 .sa_flags
= SA_SIGINFO
| SA_RESTART
,
191 for (i
= 1; i
< SIGUNUSED
; ++i
)
192 if (sigaction(i
, &sa
, NULL
) && errno
!= EINVAL
)
193 fprintf(stderr
, "sigaction(%i) failed: %s\n", i
, strerror(errno
));
194 for (i
= SIGRTMIN
; i
<= SIGRTMAX
; ++i
)
195 if (sigaction(i
, &sa
, NULL
) && errno
!= EINVAL
)
196 fprintf(stderr
, "sigaction(%i) failed: %s\n", i
, strerror(errno
));
198 /* As an init, we will reap the children via wait(). */
199 signal(SIGCHLD
, SIG_DFL
);
202 static bool unshare_pid(bool daemonize
)
204 if (!vunshare(CLONE_NEWPID
))
209 /* Set up external init process. */
212 case -1: err(1, "fork() failed");
217 setproctitle("ext init");
218 setup_signal_handler(pid
);
220 exit_as_status_ext(reap_children());
225 err(1, "setsid() failed");
227 int fd
= open("/dev/null", O_RDWR
);
229 err(1, "open(/dev/null) failed");
230 if (dup2(fd
, 0) == -1 || dup2(fd
, 1) == -1 || dup2(fd
, 2) == -1)
231 err(1, "dup2() failed");
236 /* Set up fresh /proc. */
237 if (mount("none", "/proc", 0, MS_PRIVATE
| MS_REC
, ""))
238 err(1, "mount(/proc, MS_PRIVATE) failed");
239 if (mount("proc", "/proc", "proc", MS_NOSUID
| MS_NODEV
| MS_NOEXEC
| MS_RELATIME
, ""))
240 err(1, "mount(/proc) failed");
242 /* Set up internal init process. */
245 case -1: err(1, "fork() failed");
248 setproctitle("int init");
249 setup_signal_handler(pid
);
251 exit_as_status_int(reap_children());
257 static void map_uid_gid(uid_t iuid
, gid_t igid
, uid_t ouid
, gid_t ogid
)
261 fp
= fopen("/proc/self/setgroups", "w");
267 fp
= fopen("/proc/self/uid_map", "w");
268 fprintf(fp
, "%u %u 1\n", iuid
, ouid
);
271 fp
= fopen("/proc/self/gid_map", "w");
272 fprintf(fp
, "%u %u 1\n", igid
, ogid
);
276 #define a_argument required_argument
277 static const struct option opts
[] = {
278 { "pid", a_argument
, NULL
, 1 },
279 { NULL
, 0, NULL
, 0 },
282 static void usage(void)
284 puts("Usage: unshare [options] <program>");
288 int main(int argc
, char *argv
[])
292 const char *pid
= NULL
;
299 bool daemonize
= false;
305 while ((c
= getopt_long(argc
, argv
, "+DimnpuU", opts
, NULL
)) != -1) {
310 case 'i': newipc
= true; break;
311 case 'm': newmnt
= true; break;
312 case 'n': newnet
= true; break;
313 case 'p': newpid
= true; break;
314 case 'u': newuts
= true; break;
315 case 'U': newusr
= true; break;
316 case 'D': daemonize
= true; break;
330 if (vunshare(CLONE_NEWUSER
))
331 map_uid_gid(0, 0, uid
, gid
);
336 if (newmnt
|| newpid
)
337 vunshare(CLONE_NEWNS
);
339 vunshare(CLONE_NEWUTS
);
341 vunshare(CLONE_NEWIPC
);
346 pidfp
= fopen(pid
, "we");
348 err(1, "fopen(%s) failed", pid
);
351 if (newpid
&& unshare_pid(daemonize
)) {
353 } else if (daemonize
)
355 err(1, "daemon() failed");
358 fprintf(pidfp
, "%u\n", getpid());
363 if (vunshare(CLONE_NEWUSER
))
364 map_uid_gid(uid
, gid
, 0, 0);
366 execvp(argv
[0], argv
);
367 fprintf(stderr
, "%s: %s\n", argv
[0], strerror(errno
));