1 /* Copyright 2018 The Chromium OS Authors. All rights reserved. 2 * Use of this source code is governed by a BSD-style license that can be 3 * found in the LICENSE file. 4 */ 5 6 #include <dlfcn.h> 7 #include <errno.h> 8 #include <getopt.h> 9 #include <inttypes.h> 10 #include <stdbool.h> 11 #include <stdio.h> 12 #include <stdlib.h> 13 #include <string.h> 14 #include <sys/capability.h> 15 #include <sys/mount.h> 16 #include <sys/types.h> 17 #include <unistd.h> 18 19 #include <linux/filter.h> 20 21 #include "libminijail.h" 22 #include "libsyscalls.h" 23 24 #include "elfparse.h" 25 #include "minijail0_cli.h" 26 #include "system.h" 27 #include "util.h" 28 29 #define IDMAP_LEN 32U 30 #define DEFAULT_TMP_SIZE (64 * 1024 * 1024) 31 32 static void set_user(struct minijail *j, const char *arg, uid_t *out_uid, 33 gid_t *out_gid) 34 { 35 char *end = NULL; 36 int uid = strtod(arg, &end); 37 if (!*end && *arg) { 38 *out_uid = uid; 39 minijail_change_uid(j, uid); 40 return; 41 } 42 43 if (lookup_user(arg, out_uid, out_gid)) { 44 fprintf(stderr, "Bad user: '%s'\n", arg); 45 exit(1); 46 } 47 48 if (minijail_change_user(j, arg)) { 49 fprintf(stderr, "Bad user: '%s'\n", arg); 50 exit(1); 51 } 52 } 53 54 static void set_group(struct minijail *j, const char *arg, gid_t *out_gid) 55 { 56 char *end = NULL; 57 int gid = strtod(arg, &end); 58 if (!*end && *arg) { 59 *out_gid = gid; 60 minijail_change_gid(j, gid); 61 return; 62 } 63 64 if (lookup_group(arg, out_gid)) { 65 fprintf(stderr, "Bad group: '%s'\n", arg); 66 exit(1); 67 } 68 69 if (minijail_change_group(j, arg)) { 70 fprintf(stderr, "Bad group: '%s'\n", arg); 71 exit(1); 72 } 73 } 74 75 static void skip_securebits(struct minijail *j, const char *arg) 76 { 77 uint64_t securebits_skip_mask; 78 char *end = NULL; 79 securebits_skip_mask = strtoull(arg, &end, 16); 80 if (*end) { 81 fprintf(stderr, "Invalid securebit mask: '%s'\n", arg); 82 exit(1); 83 } 84 minijail_skip_setting_securebits(j, securebits_skip_mask); 85 } 86 87 static void use_caps(struct minijail *j, const char *arg) 88 { 89 uint64_t caps = 0; 90 cap_t parsed_caps = cap_from_text(arg); 91 92 if (parsed_caps != NULL) { 93 unsigned int i; 94 const uint64_t one = 1; 95 cap_flag_value_t cap_value; 96 unsigned int last_valid_cap = get_last_valid_cap(); 97 98 for (i = 0; i <= last_valid_cap; ++i) { 99 if (cap_get_flag(parsed_caps, i, CAP_EFFECTIVE, 100 &cap_value)) { 101 if (errno == EINVAL) { 102 /* 103 * Some versions of libcap reject any 104 * capabilities they were not compiled 105 * with by returning EINVAL. 106 */ 107 continue; 108 } 109 fprintf(stderr, 110 "Could not get the value of " 111 "the %d-th capability: %m\n", 112 i); 113 exit(1); 114 } 115 if (cap_value == CAP_SET) 116 caps |= (one << i); 117 } 118 cap_free(parsed_caps); 119 } else { 120 char *end = NULL; 121 caps = strtoull(arg, &end, 16); 122 if (*end) { 123 fprintf(stderr, "Invalid cap set: '%s'\n", arg); 124 exit(1); 125 } 126 } 127 128 minijail_use_caps(j, caps); 129 } 130 131 static void add_binding(struct minijail *j, char *arg) 132 { 133 char *src = tokenize(&arg, ","); 134 char *dest = tokenize(&arg, ","); 135 char *flags = tokenize(&arg, ","); 136 if (!src || src[0] == '\0' || arg != NULL) { 137 fprintf(stderr, "Bad binding: %s %s\n", src, dest); 138 exit(1); 139 } 140 if (dest == NULL || dest[0] == '\0') 141 dest = src; 142 if (flags == NULL || flags[0] == '\0') 143 flags = "0"; 144 if (minijail_bind(j, src, dest, atoi(flags))) { 145 fprintf(stderr, "minijail_bind failed.\n"); 146 exit(1); 147 } 148 } 149 150 static void add_rlimit(struct minijail *j, char *arg) 151 { 152 char *type = tokenize(&arg, ","); 153 char *cur = tokenize(&arg, ","); 154 char *max = tokenize(&arg, ","); 155 char *end; 156 if (!type || type[0] == '\0' || !cur || cur[0] == '\0' || 157 !max || max[0] == '\0' || arg != NULL) { 158 fprintf(stderr, "Bad rlimit '%s'.\n", arg); 159 exit(1); 160 } 161 rlim_t cur_rlim; 162 rlim_t max_rlim; 163 if (!strcmp(cur, "unlimited")) { 164 cur_rlim = RLIM_INFINITY; 165 } else { 166 end = NULL; 167 cur_rlim = strtoul(cur, &end, 0); 168 if (*end) { 169 fprintf(stderr, "Bad soft limit: '%s'.\n", cur); 170 exit(1); 171 } 172 } 173 if (!strcmp(max, "unlimited")) { 174 max_rlim = RLIM_INFINITY; 175 } else { 176 end = NULL; 177 max_rlim = strtoul(max, &end, 0); 178 if (*end) { 179 fprintf(stderr, "Bad hard limit: '%s'.\n", max); 180 exit(1); 181 } 182 } 183 184 end = NULL; 185 int resource = parse_single_constant(type, &end); 186 if (type == end) { 187 fprintf(stderr, "Bad rlimit: '%s'.\n", type); 188 exit(1); 189 } 190 191 if (minijail_rlimit(j, resource, cur_rlim, max_rlim)) { 192 fprintf(stderr, "minijail_rlimit '%s,%s,%s' failed.\n", type, 193 cur, max); 194 exit(1); 195 } 196 } 197 198 static void add_mount(struct minijail *j, char *arg) 199 { 200 char *src = tokenize(&arg, ","); 201 char *dest = tokenize(&arg, ","); 202 char *type = tokenize(&arg, ","); 203 char *flags = tokenize(&arg, ","); 204 char *data = tokenize(&arg, ","); 205 char *end; 206 if (!src || src[0] == '\0' || !dest || dest[0] == '\0' || 207 !type || type[0] == '\0') { 208 fprintf(stderr, "Bad mount: %s %s %s\n", src, dest, type); 209 exit(1); 210 } 211 212 /* 213 * Fun edge case: the data option itself is comma delimited. If there 214 * were no more options, then arg would be set to NULL. But if we had 215 * more pending, it'll be pointing to the next token. Back up and undo 216 * the null byte so it'll be merged back. 217 * An example: 218 * none,/tmp,tmpfs,0xe,mode=0755,uid=10,gid=10 219 * The tokenize calls above will turn this memory into: 220 * none\0/tmp\0tmpfs\00xe\0mode=0755\0uid=10,gid=10 221 * With data pointing at mode=0755 and arg pointing at uid=10,gid=10. 222 */ 223 if (arg != NULL) 224 arg[-1] = ','; 225 226 unsigned long mountflags; 227 if (flags == NULL || flags[0] == '\0') { 228 mountflags = 0; 229 } else { 230 end = NULL; 231 mountflags = parse_constant(flags, &end); 232 if (flags == end) { 233 fprintf(stderr, "Bad mount flags: %s\n", flags); 234 exit(1); 235 } 236 } 237 238 if (minijail_mount_with_data(j, src, dest, type, 239 mountflags, data)) { 240 fprintf(stderr, "minijail_mount failed.\n"); 241 exit(1); 242 } 243 } 244 245 static char *build_idmap(id_t id, id_t lowerid) 246 { 247 int ret; 248 char *idmap = malloc(IDMAP_LEN); 249 ret = snprintf(idmap, IDMAP_LEN, "%d %d 1", id, lowerid); 250 if (ret < 0 || (size_t)ret >= IDMAP_LEN) { 251 free(idmap); 252 fprintf(stderr, "Could not build id map.\n"); 253 exit(1); 254 } 255 return idmap; 256 } 257 258 static int has_cap_setgid(void) 259 { 260 cap_t caps; 261 cap_flag_value_t cap_value; 262 263 if (!CAP_IS_SUPPORTED(CAP_SETGID)) 264 return 0; 265 266 caps = cap_get_proc(); 267 if (!caps) { 268 fprintf(stderr, "Could not get process' capabilities: %m\n"); 269 exit(1); 270 } 271 272 if (cap_get_flag(caps, CAP_SETGID, CAP_EFFECTIVE, &cap_value)) { 273 fprintf(stderr, "Could not get the value of CAP_SETGID: %m\n"); 274 exit(1); 275 } 276 277 if (cap_free(caps)) { 278 fprintf(stderr, "Could not free capabilities: %m\n"); 279 exit(1); 280 } 281 282 return cap_value == CAP_SET; 283 } 284 285 static void set_ugid_mapping(struct minijail *j, int set_uidmap, uid_t uid, 286 char *uidmap, int set_gidmap, gid_t gid, 287 char *gidmap) 288 { 289 if (set_uidmap) { 290 minijail_namespace_user(j); 291 minijail_namespace_pids(j); 292 293 if (!uidmap) { 294 /* 295 * If no map is passed, map the current uid to the 296 * chosen uid in the target namespace (or root, if none 297 * was chosen). 298 */ 299 uidmap = build_idmap(uid, getuid()); 300 } 301 if (0 != minijail_uidmap(j, uidmap)) { 302 fprintf(stderr, "Could not set uid map.\n"); 303 exit(1); 304 } 305 free(uidmap); 306 } 307 if (set_gidmap) { 308 minijail_namespace_user(j); 309 minijail_namespace_pids(j); 310 311 if (!gidmap) { 312 /* 313 * If no map is passed, map the current gid to the 314 * chosen gid in the target namespace. 315 */ 316 gidmap = build_idmap(gid, getgid()); 317 } 318 if (!has_cap_setgid()) { 319 /* 320 * This means that we are not running as root, 321 * so we also have to disable setgroups(2) to 322 * be able to set the gid map. 323 * See 324 * http://man7.org/linux/man-pages/man7/user_namespaces.7.html 325 */ 326 minijail_namespace_user_disable_setgroups(j); 327 } 328 if (0 != minijail_gidmap(j, gidmap)) { 329 fprintf(stderr, "Could not set gid map.\n"); 330 exit(1); 331 } 332 free(gidmap); 333 } 334 } 335 336 static void use_chroot(struct minijail *j, const char *path, int *chroot, 337 int pivot_root) 338 { 339 if (pivot_root) { 340 fprintf(stderr, "Could not set chroot because " 341 "'-P' was specified.\n"); 342 exit(1); 343 } 344 if (minijail_enter_chroot(j, path)) { 345 fprintf(stderr, "Could not set chroot.\n"); 346 exit(1); 347 } 348 *chroot = 1; 349 } 350 351 static void use_pivot_root(struct minijail *j, const char *path, 352 int *pivot_root, int chroot) 353 { 354 if (chroot) { 355 fprintf(stderr, "Could not set pivot_root because " 356 "'-C' was specified.\n"); 357 exit(1); 358 } 359 if (minijail_enter_pivot_root(j, path)) { 360 fprintf(stderr, "Could not set pivot_root.\n"); 361 exit(1); 362 } 363 minijail_namespace_vfs(j); 364 *pivot_root = 1; 365 } 366 367 static void use_profile(struct minijail *j, const char *profile, 368 int *pivot_root, int chroot, size_t *tmp_size) 369 { 370 /* Note: New profiles should be added in minijail0_cli_unittest.cc. */ 371 372 if (!strcmp(profile, "minimalistic-mountns")) { 373 minijail_namespace_vfs(j); 374 if (minijail_bind(j, "/", "/", 0)) { 375 fprintf(stderr, "minijail_bind(/) failed.\n"); 376 exit(1); 377 } 378 if (minijail_bind(j, "/proc", "/proc", 0)) { 379 fprintf(stderr, "minijail_bind(/proc) failed.\n"); 380 exit(1); 381 } 382 if (minijail_bind(j, "/dev/log", "/dev/log", 0)) { 383 fprintf(stderr, "minijail_bind(/dev/log) failed.\n"); 384 exit(1); 385 } 386 minijail_mount_dev(j); 387 if (!*tmp_size) { 388 /* Avoid clobbering |tmp_size| if it was already set. */ 389 *tmp_size = DEFAULT_TMP_SIZE; 390 } 391 minijail_remount_proc_readonly(j); 392 use_pivot_root(j, DEFAULT_PIVOT_ROOT, pivot_root, chroot); 393 } else { 394 fprintf(stderr, "Unrecognized profile name '%s'\n", profile); 395 exit(1); 396 } 397 } 398 399 static void set_remount_mode(struct minijail *j, const char *mode) 400 { 401 unsigned long msmode; 402 if (!strcmp(mode, "shared")) 403 msmode = MS_SHARED; 404 else if (!strcmp(mode, "private")) 405 msmode = MS_PRIVATE; 406 else if (!strcmp(mode, "slave")) 407 msmode = MS_SLAVE; 408 else if (!strcmp(mode, "unbindable")) 409 msmode = MS_UNBINDABLE; 410 else { 411 fprintf(stderr, "Unknown remount mode: '%s'\n", mode); 412 exit(1); 413 } 414 minijail_remount_mode(j, msmode); 415 } 416 417 static void read_seccomp_filter(const char *filter_path, 418 struct sock_fprog *filter) 419 { 420 FILE *f = fopen(filter_path, "re"); 421 if (!f) { 422 fprintf(stderr, "failed to open %s: %m", filter_path); 423 exit(1); 424 } 425 off_t filter_size = 0; 426 if (fseeko(f, 0, SEEK_END) == -1 || (filter_size = ftello(f)) == -1) { 427 fclose(f); 428 fprintf(stderr, "failed to get file size of %s: %m", 429 filter_path); 430 exit(1); 431 } 432 if (filter_size % sizeof(struct sock_filter) != 0) { 433 fclose(f); 434 fprintf(stderr, 435 "filter size (%" PRId64 436 ") of %s is not a multiple of %zu: %m", 437 filter_size, filter_path, sizeof(struct sock_filter)); 438 exit(1); 439 } 440 rewind(f); 441 442 filter->len = filter_size / sizeof(struct sock_filter); 443 filter->filter = malloc(filter_size); 444 if (!filter->filter) { 445 fclose(f); 446 fprintf(stderr, "failed to allocate memory for filter: %m"); 447 exit(1); 448 } 449 if (fread(filter->filter, sizeof(struct sock_filter), filter->len, f) != 450 filter->len) { 451 fclose(f); 452 fprintf(stderr, "failed read %s: %m", filter_path); 453 exit(1); 454 } 455 fclose(f); 456 } 457 458 static void usage(const char *progn) 459 { 460 size_t i; 461 /* clang-format off */ 462 printf("Usage: %s [-dGhHiIKlLnNprRstUvyYz]\n" 463 " [-a <table>]\n" 464 " [-b <src>[,<dest>[,<writeable>]]] [-k <src>,<dest>,<type>[,<flags>[,<data>]]]\n" 465 " [-c <caps>] [-C <dir>] [-P <dir>] [-e[file]] [-f <file>] [-g <group>]\n" 466 " [-m[<uid> <loweruid> <count>]*] [-M[<gid> <lowergid> <count>]*] [--profile <name>]\n" 467 " [-R <type,cur,max>] [-S <file>] [-t[size]] [-T <type>] [-u <user>] [-V <file>]\n" 468 " <program> [args...]\n" 469 " -a <table>: Use alternate syscall table <table>.\n" 470 " -b <...>: Bind <src> to <dest> in chroot.\n" 471 " Multiple instances allowed.\n" 472 " -B <mask>: Skip setting securebits in <mask> when restricting capabilities (-c).\n" 473 " By default, SECURE_NOROOT, SECURE_NO_SETUID_FIXUP, and \n" 474 " SECURE_KEEP_CAPS (together with their respective locks) are set.\n" 475 " There are eight securebits in total.\n" 476 " -k <...>: Mount <src> at <dest> in chroot.\n" 477 " <flags> and <data> can be specified as in mount(2).\n" 478 " Multiple instances allowed.\n" 479 " -c <caps>: Restrict caps to <caps>.\n" 480 " -C <dir>: chroot(2) to <dir>.\n" 481 " Not compatible with -P.\n" 482 " -P <dir>: pivot_root(2) to <dir> (implies -v).\n" 483 " Not compatible with -C.\n" 484 " --mount-dev, Create a new /dev with a minimal set of device nodes (implies -v).\n" 485 " -d: See the minijail0(1) man page for the exact set.\n" 486 " -e[file]: Enter new network namespace, or existing one if |file| is provided.\n" 487 " -f <file>: Write the pid of the jailed process to <file>.\n" 488 " -g <group>: Change gid to <group>.\n" 489 " -G: Inherit supplementary groups from uid.\n" 490 " Not compatible with -y.\n" 491 " -y: Keep uid's supplementary groups.\n" 492 " Not compatible with -G.\n" 493 " -h: Help (this message).\n" 494 " -H: Seccomp filter help message.\n" 495 " -i: Exit immediately after fork(2). The jailed process will run\n" 496 " in the background.\n" 497 " -I: Run <program> as init (pid 1) inside a new pid namespace (implies -p).\n" 498 " -K: Do not change share mode of any existing mounts.\n" 499 " -K<mode>: Mark all existing mounts as <mode> instead of MS_PRIVATE.\n" 500 " -l: Enter new IPC namespace.\n" 501 " -L: Report blocked syscalls to syslog when using seccomp filter.\n" 502 " Forces the following syscalls to be allowed:\n" 503 " ", progn); 504 /* clang-format on */ 505 for (i = 0; i < log_syscalls_len; i++) 506 printf("%s ", log_syscalls[i]); 507 508 /* clang-format off */ 509 printf("\n" 510 " -m[map]: Set the uid map of a user namespace (implies -pU).\n" 511 " Same arguments as newuidmap(1), multiple mappings should be separated by ',' (comma).\n" 512 " With no mapping, map the current uid to root inside the user namespace.\n" 513 " Not compatible with -b without the 'writable' option.\n" 514 " -M[map]: Set the gid map of a user namespace (implies -pU).\n" 515 " Same arguments as newgidmap(1), multiple mappings should be separated by ',' (comma).\n" 516 " With no mapping, map the current gid to root inside the user namespace.\n" 517 " Not compatible with -b without the 'writable' option.\n" 518 " -n: Set no_new_privs.\n" 519 " -N: Enter a new cgroup namespace.\n" 520 " -p: Enter new pid namespace (implies -vr).\n" 521 " -r: Remount /proc read-only (implies -v).\n" 522 " -R: Set rlimits, can be specified multiple times.\n" 523 " -s: Use seccomp mode 1 (not the same as -S).\n" 524 " -S <file>: Set seccomp filter using <file>.\n" 525 " E.g., '-S /usr/share/filters/<prog>.$(uname -m)'.\n" 526 " Requires -n when not running as root.\n" 527 " -t[size]: Mount tmpfs at /tmp (implies -v).\n" 528 " Optional argument specifies size (default \"64M\").\n" 529 " -T <type>: Assume <program> is a <type> ELF binary; <type> can be 'static' or 'dynamic'.\n" 530 " This will avoid accessing <program> binary before execve(2).\n" 531 " Type 'static' will avoid preload hooking.\n" 532 " -u <user>: Change uid to <user>.\n" 533 " -U: Enter new user namespace (implies -p).\n" 534 " -v: Enter new mount namespace.\n" 535 " -V <file>: Enter specified mount namespace.\n" 536 " -w: Create and join a new anonymous session keyring.\n" 537 " -Y: Synchronize seccomp filters across thread group.\n" 538 " -z: Don't forward signals to jailed process.\n" 539 " --ambient: Raise ambient capabilities. Requires -c.\n" 540 " --uts[=name]: Enter a new UTS namespace (and set hostname).\n" 541 " --logging=<s>:Use <s> as the logging system.\n" 542 " <s> must be 'syslog' (default) or 'stderr'.\n" 543 " --profile <p>:Configure minijail0 to run with the <p> sandboxing profile,\n" 544 " which is a convenient way to express multiple flags\n" 545 " that are typically used together.\n" 546 " See the minijail0(1) man page for the full list.\n" 547 " --preload-library=<f>:Overrides the path to \"" PRELOADPATH "\".\n" 548 " This is only really useful for local testing.\n" 549 " --seccomp-bpf-binary=<f>:Set a pre-compiled seccomp filter using <f>.\n" 550 " E.g., '-S /usr/share/filters/<prog>.$(uname -m).bpf'.\n" 551 " Requires -n when not running as root.\n" 552 " The user is responsible for ensuring that the binary\n" 553 " was compiled for the correct architecture / kernel version.\n"); 554 /* clang-format on */ 555 } 556 557 static void seccomp_filter_usage(const char *progn) 558 { 559 const struct syscall_entry *entry = syscall_table; 560 printf("Usage: %s -S <policy.file> <program> [args...]\n\n" 561 "System call names supported:\n", 562 progn); 563 for (; entry->name && entry->nr >= 0; ++entry) 564 printf(" %s [%d]\n", entry->name, entry->nr); 565 printf("\nSee minijail0(5) for example policies.\n"); 566 } 567 568 int parse_args(struct minijail *j, int argc, char *const argv[], 569 int *exit_immediately, ElfType *elftype, 570 const char **preload_path) 571 { 572 int opt; 573 int use_seccomp_filter = 0, use_seccomp_filter_binary = 0; 574 int forward = 1; 575 int binding = 0; 576 int chroot = 0, pivot_root = 0; 577 int mount_ns = 0, skip_remount = 0; 578 int inherit_suppl_gids = 0, keep_suppl_gids = 0; 579 int caps = 0, ambient_caps = 0; 580 int seccomp = -1; 581 bool use_uid = false, use_gid = false; 582 uid_t uid = 0; 583 gid_t gid = 0; 584 char *uidmap = NULL, *gidmap = NULL; 585 int set_uidmap = 0, set_gidmap = 0; 586 size_t tmp_size = 0; 587 const char *filter_path = NULL; 588 int log_to_stderr = 0; 589 590 const char *optstring = 591 "+u:g:sS:c:C:P:b:B:V:f:m::M::k:a:e::R:T:vrGhHinNplLt::IUK::wyYzd"; 592 /* clang-format off */ 593 const struct option long_options[] = { 594 {"help", no_argument, 0, 'h'}, 595 {"mount-dev", no_argument, 0, 'd'}, 596 {"ambient", no_argument, 0, 128}, 597 {"uts", optional_argument, 0, 129}, 598 {"logging", required_argument, 0, 130}, 599 {"profile", required_argument, 0, 131}, 600 {"preload-library", required_argument, 0, 132}, 601 {"seccomp-bpf-binary", required_argument, 0, 133}, 602 {0, 0, 0, 0}, 603 }; 604 /* clang-format on */ 605 606 while ((opt = getopt_long(argc, argv, optstring, long_options, NULL)) != 607 -1) { 608 switch (opt) { 609 case 'u': 610 if (use_uid) { 611 fprintf(stderr, 612 "-u provided multiple times.\n"); 613 exit(1); 614 } 615 use_uid = true; 616 set_user(j, optarg, &uid, &gid); 617 break; 618 case 'g': 619 if (use_gid) { 620 fprintf(stderr, 621 "-g provided multiple times.\n"); 622 exit(1); 623 } 624 use_gid = true; 625 set_group(j, optarg, &gid); 626 break; 627 case 'n': 628 minijail_no_new_privs(j); 629 break; 630 case 's': 631 if (seccomp != -1 && seccomp != 1) { 632 fprintf(stderr, 633 "Do not use -s, -S, or " 634 "--seccomp-bpf-binary together.\n"); 635 exit(1); 636 } 637 seccomp = 1; 638 minijail_use_seccomp(j); 639 break; 640 case 'S': 641 if (seccomp != -1 && seccomp != 2) { 642 fprintf(stderr, 643 "Do not use -s, -S, or " 644 "--seccomp-bpf-binary together.\n"); 645 exit(1); 646 } 647 seccomp = 2; 648 minijail_use_seccomp_filter(j); 649 filter_path = optarg; 650 use_seccomp_filter = 1; 651 break; 652 case 'l': 653 minijail_namespace_ipc(j); 654 break; 655 case 'L': 656 minijail_log_seccomp_filter_failures(j); 657 break; 658 case 'b': 659 add_binding(j, optarg); 660 binding = 1; 661 break; 662 case 'B': 663 skip_securebits(j, optarg); 664 break; 665 case 'c': 666 caps = 1; 667 use_caps(j, optarg); 668 break; 669 case 'C': 670 use_chroot(j, optarg, &chroot, pivot_root); 671 break; 672 case 'k': 673 add_mount(j, optarg); 674 break; 675 case 'K': 676 if (optarg) 677 set_remount_mode(j, optarg); 678 else 679 minijail_skip_remount_private(j); 680 skip_remount = 1; 681 break; 682 case 'P': 683 use_pivot_root(j, optarg, &pivot_root, chroot); 684 break; 685 case 'f': 686 if (0 != minijail_write_pid_file(j, optarg)) { 687 fprintf(stderr, 688 "Could not prepare pid file path.\n"); 689 exit(1); 690 } 691 break; 692 case 't': 693 minijail_namespace_vfs(j); 694 if (!tmp_size) { 695 /* 696 * Avoid clobbering |tmp_size| if it was already 697 * set. 698 */ 699 tmp_size = DEFAULT_TMP_SIZE; 700 } 701 if (optarg != NULL && 702 0 != parse_size(&tmp_size, optarg)) { 703 fprintf(stderr, "Invalid /tmp tmpfs size.\n"); 704 exit(1); 705 } 706 break; 707 case 'v': 708 minijail_namespace_vfs(j); 709 mount_ns = 1; 710 break; 711 case 'V': 712 minijail_namespace_enter_vfs(j, optarg); 713 break; 714 case 'r': 715 minijail_remount_proc_readonly(j); 716 break; 717 case 'G': 718 if (keep_suppl_gids) { 719 fprintf(stderr, 720 "-y and -G are not compatible.\n"); 721 exit(1); 722 } 723 minijail_inherit_usergroups(j); 724 inherit_suppl_gids = 1; 725 break; 726 case 'y': 727 if (inherit_suppl_gids) { 728 fprintf(stderr, 729 "-y and -G are not compatible.\n"); 730 exit(1); 731 } 732 minijail_keep_supplementary_gids(j); 733 keep_suppl_gids = 1; 734 break; 735 case 'N': 736 minijail_namespace_cgroups(j); 737 break; 738 case 'p': 739 minijail_namespace_pids(j); 740 break; 741 case 'e': 742 if (optarg) 743 minijail_namespace_enter_net(j, optarg); 744 else 745 minijail_namespace_net(j); 746 break; 747 case 'i': 748 *exit_immediately = 1; 749 break; 750 case 'H': 751 seccomp_filter_usage(argv[0]); 752 exit(0); 753 case 'I': 754 minijail_namespace_pids(j); 755 minijail_run_as_init(j); 756 break; 757 case 'U': 758 minijail_namespace_user(j); 759 minijail_namespace_pids(j); 760 break; 761 case 'm': 762 set_uidmap = 1; 763 if (uidmap) { 764 free(uidmap); 765 uidmap = NULL; 766 } 767 if (optarg) 768 uidmap = strdup(optarg); 769 break; 770 case 'M': 771 set_gidmap = 1; 772 if (gidmap) { 773 free(gidmap); 774 gidmap = NULL; 775 } 776 if (optarg) 777 gidmap = strdup(optarg); 778 break; 779 case 'a': 780 if (0 != minijail_use_alt_syscall(j, optarg)) { 781 fprintf(stderr, 782 "Could not set alt-syscall table.\n"); 783 exit(1); 784 } 785 break; 786 case 'R': 787 add_rlimit(j, optarg); 788 break; 789 case 'T': 790 if (!strcmp(optarg, "static")) 791 *elftype = ELFSTATIC; 792 else if (!strcmp(optarg, "dynamic")) 793 *elftype = ELFDYNAMIC; 794 else { 795 fprintf(stderr, "ELF type must be 'static' or " 796 "'dynamic'.\n"); 797 exit(1); 798 } 799 break; 800 case 'w': 801 minijail_new_session_keyring(j); 802 break; 803 case 'Y': 804 minijail_set_seccomp_filter_tsync(j); 805 break; 806 case 'z': 807 forward = 0; 808 break; 809 case 'd': 810 minijail_namespace_vfs(j); 811 minijail_mount_dev(j); 812 break; 813 /* Long options. */ 814 case 128: /* Ambient caps. */ 815 ambient_caps = 1; 816 minijail_set_ambient_caps(j); 817 break; 818 case 129: /* UTS/hostname namespace. */ 819 minijail_namespace_uts(j); 820 if (optarg) 821 minijail_namespace_set_hostname(j, optarg); 822 break; 823 case 130: /* Logging. */ 824 if (!strcmp(optarg, "syslog")) 825 log_to_stderr = 0; 826 else if (!strcmp(optarg, "stderr")) { 827 log_to_stderr = 1; 828 } else { 829 fprintf(stderr, "--logger must be 'syslog' or " 830 "'stderr'.\n"); 831 exit(1); 832 } 833 break; 834 case 131: /* Profile */ 835 use_profile(j, optarg, &pivot_root, chroot, &tmp_size); 836 break; 837 case 132: /* PRELOADPATH */ 838 *preload_path = optarg; 839 break; 840 case 133: /* seccomp-bpf binary. */ 841 if (seccomp != -1 && seccomp != 3) { 842 fprintf(stderr, 843 "Do not use -s, -S, or " 844 "--seccomp-bpf-binary together.\n"); 845 exit(1); 846 } 847 seccomp = 3; 848 minijail_use_seccomp_filter(j); 849 filter_path = optarg; 850 use_seccomp_filter_binary = 1; 851 break; 852 default: 853 usage(argv[0]); 854 exit(opt == 'h' ? 0 : 1); 855 } 856 } 857 858 if (log_to_stderr) { 859 init_logging(LOG_TO_FD, STDERR_FILENO, LOG_INFO); 860 /* 861 * When logging to stderr, ensure the FD survives the jailing. 862 */ 863 if (0 != 864 minijail_preserve_fd(j, STDERR_FILENO, STDERR_FILENO)) { 865 fprintf(stderr, "Could not preserve stderr.\n"); 866 exit(1); 867 } 868 } 869 870 /* Set up uid/gid mapping. */ 871 if (set_uidmap || set_gidmap) { 872 set_ugid_mapping(j, set_uidmap, uid, uidmap, set_gidmap, gid, 873 gidmap); 874 } 875 876 /* Can only set ambient caps when using regular caps. */ 877 if (ambient_caps && !caps) { 878 fprintf(stderr, "Can't set ambient capabilities (--ambient) " 879 "without actually using capabilities (-c).\n"); 880 exit(1); 881 } 882 883 /* Set up signal handlers in minijail unless asked not to. */ 884 if (forward) 885 minijail_forward_signals(j); 886 887 /* 888 * Only allow bind mounts when entering a chroot, using pivot_root, or 889 * a new mount namespace. 890 */ 891 if (binding && !(chroot || pivot_root || mount_ns)) { 892 fprintf(stderr, "Bind mounts require a chroot, pivot_root, or " 893 " new mount namespace.\n"); 894 exit(1); 895 } 896 897 /* 898 * Remounting / as MS_PRIVATE only happens when entering a new mount 899 * namespace, so skipping it only applies in that case. 900 */ 901 if (skip_remount && !mount_ns) { 902 fprintf(stderr, "Can't skip marking mounts as MS_PRIVATE" 903 " without mount namespaces.\n"); 904 exit(1); 905 } 906 907 /* 908 * We parse seccomp filters here to make sure we've collected all 909 * cmdline options. 910 */ 911 if (use_seccomp_filter) { 912 minijail_parse_seccomp_filters(j, filter_path); 913 } else if (use_seccomp_filter_binary) { 914 struct sock_fprog filter; 915 read_seccomp_filter(filter_path, &filter); 916 minijail_set_seccomp_filters(j, &filter); 917 free((void *)filter.filter); 918 } 919 920 /* Mount a tmpfs under /tmp and set its size. */ 921 if (tmp_size) 922 minijail_mount_tmp_size(j, tmp_size); 923 924 /* 925 * There should be at least one additional unparsed argument: the 926 * executable name. 927 */ 928 if (argc == optind) { 929 usage(argv[0]); 930 exit(1); 931 } 932 933 if (*elftype == ELFERROR) { 934 /* 935 * -T was not specified. 936 * Get the path to the program adjusted for changing root. 937 */ 938 char *program_path = 939 minijail_get_original_path(j, argv[optind]); 940 941 /* Check that we can access the target program. */ 942 if (access(program_path, X_OK)) { 943 fprintf(stderr, 944 "Target program '%s' is not accessible.\n", 945 argv[optind]); 946 exit(1); 947 } 948 949 /* Check if target is statically or dynamically linked. */ 950 *elftype = get_elf_linkage(program_path); 951 free(program_path); 952 } 953 954 /* 955 * Setting capabilities need either a dynamically-linked binary, or the 956 * use of ambient capabilities for them to be able to survive an 957 * execve(2). 958 */ 959 if (caps && *elftype == ELFSTATIC && !ambient_caps) { 960 fprintf(stderr, "Can't run statically-linked binaries with " 961 "capabilities (-c) without also setting " 962 "ambient capabilities. Try passing " 963 "--ambient.\n"); 964 exit(1); 965 } 966 967 return optind; 968 } 969
