this patch: -add script (#!) dependencies detection (we add interpreter and it's dependencies) -add dependencies detection for all files added with -r or -w (ELF and scripts) -use PATH_MAX for path related buffers -check magic ELF header before trying to parse the file -search in /lib before /lib64 -add ELF interpreter (DT_INTERP)
we still don't handle -DT_RPATH, DT_RUNPATH, nodeflib, ... see http://man7.org/linux/man-pages/man8/ld.so.8.html -musl ld conf file -coffee :) quickly run tested on DD r47603 (x86_64 kvm) and ubuntu not tested yet on CC should fix https://dev.openwrt.org/ticket/20785 Signed-off-by: Etienne CHAMPETIER <champetier.etie...@gmail.com> --- CMakeLists.txt | 2 +- jail/elf.c | 132 +++++++++++++++--------------------------- jail/elf.h | 9 ++- jail/fs.c | 179 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ jail/fs.h | 20 +++++++ jail/jail.c | 112 +++++++++++------------------------- jail/jail.h | 18 ++++++ jail/log.h | 1 + 8 files changed, 303 insertions(+), 170 deletions(-) create mode 100644 jail/fs.c create mode 100644 jail/fs.h create mode 100644 jail/jail.h diff --git a/CMakeLists.txt b/CMakeLists.txt index d749c25..2718125 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -87,7 +87,7 @@ ADD_DEPENDENCIES(preload-seccomp syscall-names-h) endif() IF(JAIL_SUPPORT) -ADD_EXECUTABLE(ujail jail/jail.c jail/elf.c jail/capabilities.c) +ADD_EXECUTABLE(ujail jail/jail.c jail/elf.c jail/fs.c jail/capabilities.c) TARGET_LINK_LIBRARIES(ujail ubox blobmsg_json) INSTALL(TARGETS ujail RUNTIME DESTINATION ${CMAKE_INSTALL_SBINDIR} diff --git a/jail/elf.c b/jail/elf.c index a26aa0b..c8d1221 100644 --- a/jail/elf.c +++ b/jail/elf.c @@ -12,26 +12,25 @@ */ #define _GNU_SOURCE -#include <sys/mman.h> -#include <stdlib.h> -#include <unistd.h> -#include <stdio.h> #include <string.h> #include <sys/stat.h> #include <fcntl.h> -#include <libgen.h> #include <glob.h> #include <elf.h> +#include <assert.h> +#include <linux/limits.h> #include <libubox/utils.h> +#include "fs.h" #include "elf.h" +#include "log.h" struct avl_tree libraries; static LIST_HEAD(library_paths); -void alloc_library_path(const char *path) +static void alloc_library_path(const char *path) { struct stat s; if (stat(path, &s)) @@ -51,7 +50,11 @@ void alloc_library_path(const char *path) DEBUG("adding ld.so path %s\n", path); } -static void alloc_library(const char *path, const char *name) +/* + * path = full path + * name = soname/avl key + */ +void alloc_library(const char *path, const char *name) { struct library *l; char *_name, *_path; @@ -66,52 +69,39 @@ static void alloc_library(const char *path, const char *name) l->path = strcpy(_path, path); avl_insert(&libraries, &l->avl); - DEBUG("adding library %s/%s\n", path, name); + DEBUG("adding library %s (%s)\n", path, name); } -static int elf_open(char **dir, const char *file) +int elf_open(char **fullpath, const char *file) { + *fullpath = NULL; + assert(file[0] != '/'); + struct library_path *p; - char path[256]; + char path[PATH_MAX]; int fd = -1; - *dir = NULL; - list_for_each_entry(p, &library_paths, list) { - if (strlen(p->path)) - snprintf(path, sizeof(path), "%s/%s", p->path, file); - else - strncpy(path, file, sizeof(path)); + snprintf(path, sizeof(path), "%s/%s", p->path, file); fd = open(path, O_RDONLY); if (fd >= 0) { - *dir = p->path; + *fullpath = strdup(path); break; } } - if (fd == -1) - fd = open(file, O_RDONLY); - return fd; } char* find_lib(const char *file) { struct library *l; - static char path[256]; - const char *p; l = avl_find_element(&libraries, file, l, avl); if (!l) return NULL; - p = l->path; - if (strstr(p, "local")) - p = "/lib"; - - snprintf(path, sizeof(path), "%s/%s", p, file); - - return path; + return l->path; } static int elf64_find_section(const char *map, unsigned int type, unsigned int *offset, unsigned int *size, unsigned int *vaddr) @@ -201,7 +191,7 @@ static int elf32_scan_dynamic(const char *map, int dyn_offset, int dyn_size, int if (curr->d_tag != DT_NEEDED) continue; - if (elf_load_deps(&strtab[curr->d_un.d_val])) + if (add_path_and_deps(&strtab[curr->d_un.d_val], 1, -1, 1) == -1) return -1; } @@ -235,85 +225,48 @@ static int elf64_scan_dynamic(const char *map, int dyn_offset, int dyn_size, int if (curr->d_tag != DT_NEEDED) continue; - if (elf_load_deps(&strtab[curr->d_un.d_val])) + if (add_path_and_deps(&strtab[curr->d_un.d_val], 1, -1, 1) == -1) return -1; } return 0; } -int elf_load_deps(const char *library) +int elf_load_deps(const char *path, const char *map) { unsigned int dyn_offset, dyn_size; unsigned int load_offset, load_vaddr; - struct stat s; - char *map = NULL, *dir = NULL; - int clazz, fd, ret = -1; - - if (avl_find(&libraries, library)) - return 0; - - fd = elf_open(&dir, library); - - if (fd < 0) { - ERROR("failed to open %s\n", library); - return -1; - } - - if (fstat(fd, &s) == -1) { - ERROR("failed to stat %s\n", library); - ret = -1; - goto err_out; - } - - map = mmap(NULL, s.st_size, PROT_READ, MAP_PRIVATE, fd, 0); - if (map == MAP_FAILED) { - ERROR("failed to mmap %s\n", library); - ret = -1; - goto err_out; - } + unsigned int interp_offset; if (elf_find_section(map, PT_LOAD, &load_offset, NULL, &load_vaddr)) { - ERROR("failed to load the .load section from %s\n", library); - ret = -1; - goto err_out; + ERROR("failed to load the .load section from %s\n", path); + return -1; } if (elf_find_section(map, PT_DYNAMIC, &dyn_offset, &dyn_size, NULL)) { - ERROR("failed to load the .dynamic section from %s\n", library); - ret = -1; - goto err_out; + ERROR("failed to load the .dynamic section from %s\n", path); + return -1; } - if (dir) { - alloc_library(dir, library); - } else { - char *elf1 = strdup(library); - char *elf2 = strdup(library); - - alloc_library(dirname(elf1), basename(elf2)); - free(elf1); - free(elf2); + if (elf_find_section(map, PT_INTERP, &interp_offset, NULL, NULL) == 0) { + add_path_and_deps(map+interp_offset, 1, -1, 0); } - clazz = map[EI_CLASS]; + + int clazz = map[EI_CLASS]; if (clazz == ELFCLASS32) - ret = elf32_scan_dynamic(map, dyn_offset, dyn_size, load_vaddr - load_offset); + return elf32_scan_dynamic(map, dyn_offset, dyn_size, load_vaddr - load_offset); else if (clazz == ELFCLASS64) - ret = elf64_scan_dynamic(map, dyn_offset, dyn_size, load_vaddr - load_offset); - -err_out: - if (map) - munmap(map, s.st_size); - close(fd); + return elf64_scan_dynamic(map, dyn_offset, dyn_size, load_vaddr - load_offset); - return ret; + ERROR("unknown elf format %d\n", clazz); + return -1; } -void load_ldso_conf(const char *conf) +static void load_ldso_conf(const char *conf) { FILE* fp = fopen(conf, "r"); - char line[256]; + char line[PATH_MAX]; if (!fp) { DEBUG("failed to open %s\n", conf); @@ -323,7 +276,7 @@ void load_ldso_conf(const char *conf) while (!feof(fp)) { int len; - if (!fgets(line, 256, fp)) + if (!fgets(line, sizeof(line), fp)) break; len = strlen(line); if (len < 2) @@ -355,3 +308,12 @@ void load_ldso_conf(const char *conf) fclose(fp); } + +void init_library_path(void) +{ + avl_init(&libraries, avl_strcmp, false, NULL); + alloc_library_path("/lib"); + alloc_library_path("/lib64"); + alloc_library_path("/usr/lib"); + load_ldso_conf("/etc/ld.so.conf"); +} diff --git a/jail/elf.h b/jail/elf.h index 6c14c39..ea67837 100644 --- a/jail/elf.h +++ b/jail/elf.h @@ -15,8 +15,6 @@ #include <libubox/avl.h> #include <libubox/avl-cmp.h> -#include "log.h" - struct library { struct avl_node avl; char *name; @@ -30,9 +28,10 @@ struct library_path { struct avl_tree libraries; -void alloc_library_path(const char *path); -int elf_load_deps(const char *library); +void alloc_library(const char *path, const char *name); +int elf_open(char **fullpath, const char *file); +int elf_load_deps(const char *path, const char *map); char* find_lib(const char *file); -void load_ldso_conf(const char *conf); +void init_library_path(void); #endif diff --git a/jail/fs.c b/jail/fs.c new file mode 100644 index 0000000..c1ae1da --- /dev/null +++ b/jail/fs.c @@ -0,0 +1,179 @@ +/* + * Copyright (C) 2015 John Crispin <blo...@openwrt.org> + * Copyright (C) 2015 Etienne Champetier <champetier.etie...@gmail.com> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License version 2.1 + * as published by the Free Software Foundation + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ + +#define _GNU_SOURCE + +#include <assert.h> +#include <elf.h> +#include <errno.h> +#include <fcntl.h> +#include <linux/limits.h> +#include <stdlib.h> +#include <string.h> +#include <sys/stat.h> +#include <sys/mman.h> +#include <unistd.h> + +#include <libubox/avl.h> +#include <libubox/avl-cmp.h> + +#include "elf.h" +#include "fs.h" +#include "jail.h" +#include "log.h" + +struct mount { + struct avl_node avl; + const char *path; + int readonly; + int error; +}; + +struct avl_tree mounts; + +static int add_mount(const char *path, int readonly, int error) +{ + if (avl_find(&mounts, path)) + return 1; + + struct mount *m; + m = calloc(1, sizeof(struct mount)); + assert(m != NULL); + m->avl.key = m->path = strdup(path); + m->readonly = readonly; + m->error = error; + + avl_insert(&mounts, &m->avl); + DEBUG("adding mount %s ro(%d) err(%d)\n", m->path, m->readonly, m->error != 0); + return 0; +} + +int mount_all(const char *jailroot) { + struct library *l; + struct mount *m; + + avl_for_each_element(&libraries, l, avl) + add_mount(l->path, 1, -1); + + avl_for_each_element(&mounts, m, avl) + if (mount_bind(jailroot, m->path, m->readonly, m->error)) + return -1; + + return 0; +} + +void mount_list_init(void) { + avl_init(&mounts, avl_strcmp, false, NULL); +} + +static int add_script_interp(const char *path, const char *map, int size) +{ + int start = 2; + while (start < size && map[start] != '/') { + start++; + } + if (start >= size) { + ERROR("bad script interp (%s)", path); + return -1; + } + int stop = start + 1; + while (stop < size && map[stop] > 0x20 && map[stop] <= 0x7e) { + stop++; + } + if (stop >= size || (stop-start) > PATH_MAX) { + ERROR("bad script interp (%s)", path); + return -1; + } + char buf[PATH_MAX]; + strncpy(buf, map+start, stop-start); + return add_path_and_deps(buf, 1, -1, 0); +} + +int add_path_and_deps(const char *path, int readonly, int error, int lib) +{ + assert(path != NULL); + + if (lib == 0 && path[0] != '/') { + ERROR("%s is not an absolute path\n", path); + return error; + } + + char *map = NULL; + int fd, ret = -1; + if (path[0] == '/') { + if (avl_find(&mounts, path)) + return 0; + fd = open(path, O_RDONLY); + if (fd == -1) + return error; + add_mount(path, readonly, error); + } else { + if (avl_find(&libraries, path)) + return 0; + char *fullpath; + fd = elf_open(&fullpath, path); + if (fd == -1) + return error; + if (fullpath) { + alloc_library(fullpath, path); + free(fullpath); + } + } + + struct stat s; + if (fstat(fd, &s) == -1) { + ERROR("fstat(%s) failed: %s\n", path, strerror(errno)); + ret = error; + goto out; + } + + if (!S_ISREG(s.st_mode)) { + ret = 0; + goto out; + } + + /* too small to be an ELF or a script */ + if (s.st_size < 4) { + ret = 0; + goto out; + } + + map = mmap(NULL, s.st_size, PROT_READ, MAP_PRIVATE, fd, 0); + if (map == MAP_FAILED) { + ERROR("failed to mmap %s\n", path); + ret = -1; + goto out; + } + + if (map[0] == '#' && map[1] == '!') { + ret = add_script_interp(path, map, s.st_size); + goto out; + } + + if (map[0] == ELFMAG0 && map[1] == ELFMAG1 && map[2] == ELFMAG2 && map[3] == ELFMAG3) { + ret = elf_load_deps(path, map); + goto out; + } + + ret = 0; + +out: + if (fd >= 0) + close(fd); + if (map) + munmap(map, s.st_size); + + return ret; +} + diff --git a/jail/fs.h b/jail/fs.h new file mode 100644 index 0000000..0839d5c --- /dev/null +++ b/jail/fs.h @@ -0,0 +1,20 @@ +/* + * Copyright (C) 2015 Etienne Champetier <champetier.etie...@gmail.com> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License version 2.1 + * as published by the Free Software Foundation + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ + +#ifndef _FS_H__ + +int add_path_and_deps(const char *path, int readonly, int error, int lib); +int mount_all(const char *jailroot); +void mount_list_init(void); + +#endif diff --git a/jail/jail.c b/jail/jail.c index 08babde..db74504 100644 --- a/jail/jail.c +++ b/jail/jail.c @@ -18,19 +18,20 @@ #include <stdlib.h> #include <unistd.h> -#include <values.h> #include <errno.h> -#include <stdio.h> #include <string.h> #include <sys/stat.h> #include <fcntl.h> #include <libgen.h> #include <sched.h> +#include <linux/limits.h> -#include "elf.h" #include "capabilities.h" +#include "elf.h" +#include "fs.h" +#include "jail.h" +#include "log.h" -#include <libubox/list.h> #include <libubox/uloop.h> #define STACK_SIZE (1024 * 1024) @@ -48,16 +49,6 @@ static struct { int sysfs; } opts; -struct extra { - struct list_head list; - - const char *path; - const char *name; - int readonly; -}; - -static LIST_HEAD(extras); - extern int pivot_root(const char *new_root, const char *put_old); int debug = 0; @@ -89,32 +80,23 @@ static int mkdir_p(char *dir, mode_t mask) return ret; } -static int mount_bind(const char *root, const char *path, const char *name, int readonly, int error) +int mount_bind(const char *root, const char *path, int readonly, int error) { - const char *p = path; struct stat s; - char old[256]; - char new[256]; + char new[PATH_MAX]; int fd; - if (strstr(p, "local")) - p = "/lib"; - - snprintf(old, sizeof(old), "%s/%s", path, name); - snprintf(new, sizeof(new), "%s%s", root, p); - - mkdir_p(new, 0755); - - snprintf(new, sizeof(new), "%s%s/%s", root, p, name); - - if (stat(old, &s)) { - ERROR("%s does not exist\n", old); + if (stat(path, &s)) { + ERROR("%s does not exist\n", path); return error; } + snprintf(new, sizeof(new), "%s%s", root, path); if (S_ISDIR(s.st_mode)) { mkdir_p(new, 0755); } else { + mkdir_p(dirname(new), 0755); + snprintf(new, sizeof(new), "%s%s", root, path); fd = creat(new, 0644); if (fd == -1) { ERROR("failed to create %s: %s\n", new, strerror(errno)); @@ -123,8 +105,8 @@ static int mount_bind(const char *root, const char *path, const char *name, int close(fd); } - if (mount(old, new, NULL, MS_BIND, NULL)) { - ERROR("failed to mount -B %s %s: %s\n", old, new, strerror(errno)); + if (mount(path, new, NULL, MS_BIND, NULL)) { + ERROR("failed to mount -B %s %s: %s\n", path, new, strerror(errno)); return -1; } @@ -133,16 +115,13 @@ static int mount_bind(const char *root, const char *path, const char *name, int return -1; } - DEBUG("mount -B %s %s\n", old, new); + DEBUG("mount -B %s %s\n", path, new); return 0; } -static int build_jail_fs() +static int build_jail_fs(void) { - struct library *l; - struct extra *m; - if (mount("tmpfs", opts.path, "tmpfs", MS_NOATIME, "mode=0755")) { ERROR("tmpfs mount failed %s\n", strerror(errno)); return -1; @@ -153,29 +132,20 @@ static int build_jail_fs() return -1; } - avl_init(&libraries, avl_strcmp, false, NULL); - alloc_library_path("/lib64"); - alloc_library_path("/lib"); - alloc_library_path("/usr/lib"); - load_ldso_conf("/etc/ld.so.conf"); - - if (elf_load_deps(*opts.jail_argv)) { + if (add_path_and_deps(*opts.jail_argv, 1, -1, 0)) { ERROR("failed to load dependencies\n"); return -1; } - if (opts.seccomp && elf_load_deps("libpreload-seccomp.so")) { + if (opts.seccomp && add_path_and_deps("libpreload-seccomp.so", 1, -1, 1)) { ERROR("failed to load libpreload-seccomp.so\n"); return -1; } - avl_for_each_element(&libraries, l, avl) - if (mount_bind(opts.path, l->path, l->name, 1, -1)) - return -1; - - list_for_each_entry(m, &extras, list) - if (mount_bind(opts.path, m->path, m->name, m->readonly, 0)) - return -1; + if (mount_all(opts.path)) { + ERROR("mount_all() failed\n"); + return -1; + } char *mpoint; if (asprintf(&mpoint, "%s/old", opts.path) < 0) { @@ -209,8 +179,8 @@ static int build_jail_fs() static char** build_envp(const char *seccomp) { static char *envp[MAX_ENVP]; - static char preload_var[64]; - static char seccomp_var[64]; + static char preload_var[PATH_MAX]; + static char seccomp_var[PATH_MAX]; static char debug_var[] = "LD_DEBUG=all"; char *preload_lib = find_lib("libpreload-seccomp.so"); int count = 0; @@ -256,7 +226,7 @@ ujail will not use namespace/build a jail,\n\ and will only drop capabilities/apply seccomp filter.\n\n"); } -static int exec_jail() +static int exec_jail(void) { char **envp = build_envp(opts.seccomp); if (!envp) @@ -306,24 +276,6 @@ static struct uloop_process jail_process = { .cb = jail_process_handler, }; -static void add_extra(char *name, int readonly) -{ - struct extra *f; - - if (*name != '/') { - ERROR("%s is not an absolute path\n", name); - return; - } - - f = calloc(1, sizeof(struct extra)); - - f->name = basename(name); - f->path = dirname(strdup(name)); - f->readonly = readonly; - - list_add_tail(&f->list, &extras); -} - int main(int argc, char **argv) { uid_t uid = getuid(); @@ -338,6 +290,8 @@ int main(int argc, char **argv) } umask(022); + mount_list_init(); + init_library_path(); while ((ch = getopt(argc, argv, OPT_ARGS)) != -1) { switch (ch) { @@ -358,11 +312,11 @@ int main(int argc, char **argv) break; case 'S': opts.seccomp = optarg; - add_extra(optarg, 1); + add_path_and_deps(optarg, 1, -1, 0); break; case 'C': opts.capabilities = optarg; - add_extra(optarg, 1); + add_path_and_deps(optarg, 1, -1, 0); break; case 'P': opts.namespace = 1; @@ -373,19 +327,19 @@ int main(int argc, char **argv) break; case 'r': opts.namespace = 1; - add_extra(optarg, 1); + add_path_and_deps(optarg, 1, 0, 0); break; case 'w': opts.namespace = 1; - add_extra(optarg, 0); + add_path_and_deps(optarg, 0, 0, 0); break; case 'u': opts.namespace = 1; - add_extra(ubus, 0); + add_path_and_deps(ubus, 0, -1, 0); break; case 'l': opts.namespace = 1; - add_extra(log, 0); + add_path_and_deps(log, 0, -1, 0); break; } } diff --git a/jail/jail.h b/jail/jail.h new file mode 100644 index 0000000..fc69ef6 --- /dev/null +++ b/jail/jail.h @@ -0,0 +1,18 @@ +/* + * Copyright (C) 2015 Etienne Champetier <champetier.etie...@gmail.com> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License version 2.1 + * as published by the Free Software Foundation + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ + +#ifndef _JAIL_H__ + +int mount_bind(const char *root, const char *path, int readonly, int error); + +#endif diff --git a/jail/log.h b/jail/log.h index b1d201e..e56fc6a 100644 --- a/jail/log.h +++ b/jail/log.h @@ -12,6 +12,7 @@ */ extern int debug; +#include <stdio.h> #include <syslog.h> #define INFO(fmt, ...) do { \ -- 1.9.1 _______________________________________________ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.openwrt.org/cgi-bin/mailman/listinfo/openwrt-devel
