Home | History | Annotate | Download | only in minijail
      1 /* Copyright 2018 The Chromium OS Authors. All rights reserved.
      2  * Use of this source code is governed by a BSD-style license that can be
      3  * found in the LICENSE file.
      4  */
      5 
      6 #include <dlfcn.h>
      7 #include <errno.h>
      8 #include <getopt.h>
      9 #include <inttypes.h>
     10 #include <stdbool.h>
     11 #include <stdio.h>
     12 #include <stdlib.h>
     13 #include <string.h>
     14 #include <sys/capability.h>
     15 #include <sys/mount.h>
     16 #include <sys/types.h>
     17 #include <unistd.h>
     18 
     19 #include <linux/filter.h>
     20 
     21 #include "libminijail.h"
     22 #include "libsyscalls.h"
     23 
     24 #include "elfparse.h"
     25 #include "minijail0_cli.h"
     26 #include "system.h"
     27 #include "util.h"
     28 
     29 #define IDMAP_LEN 32U
     30 #define DEFAULT_TMP_SIZE (64 * 1024 * 1024)
     31 
     32 static void set_user(struct minijail *j, const char *arg, uid_t *out_uid,
     33 		     gid_t *out_gid)
     34 {
     35 	char *end = NULL;
     36 	int uid = strtod(arg, &end);
     37 	if (!*end && *arg) {
     38 		*out_uid = uid;
     39 		minijail_change_uid(j, uid);
     40 		return;
     41 	}
     42 
     43 	if (lookup_user(arg, out_uid, out_gid)) {
     44 		fprintf(stderr, "Bad user: '%s'\n", arg);
     45 		exit(1);
     46 	}
     47 
     48 	if (minijail_change_user(j, arg)) {
     49 		fprintf(stderr, "Bad user: '%s'\n", arg);
     50 		exit(1);
     51 	}
     52 }
     53 
     54 static void set_group(struct minijail *j, const char *arg, gid_t *out_gid)
     55 {
     56 	char *end = NULL;
     57 	int gid = strtod(arg, &end);
     58 	if (!*end && *arg) {
     59 		*out_gid = gid;
     60 		minijail_change_gid(j, gid);
     61 		return;
     62 	}
     63 
     64 	if (lookup_group(arg, out_gid)) {
     65 		fprintf(stderr, "Bad group: '%s'\n", arg);
     66 		exit(1);
     67 	}
     68 
     69 	if (minijail_change_group(j, arg)) {
     70 		fprintf(stderr, "Bad group: '%s'\n", arg);
     71 		exit(1);
     72 	}
     73 }
     74 
     75 static void skip_securebits(struct minijail *j, const char *arg)
     76 {
     77 	uint64_t securebits_skip_mask;
     78 	char *end = NULL;
     79 	securebits_skip_mask = strtoull(arg, &end, 16);
     80 	if (*end) {
     81 		fprintf(stderr, "Invalid securebit mask: '%s'\n", arg);
     82 		exit(1);
     83 	}
     84 	minijail_skip_setting_securebits(j, securebits_skip_mask);
     85 }
     86 
     87 static void use_caps(struct minijail *j, const char *arg)
     88 {
     89 	uint64_t caps = 0;
     90 	cap_t parsed_caps = cap_from_text(arg);
     91 
     92 	if (parsed_caps != NULL) {
     93 		unsigned int i;
     94 		const uint64_t one = 1;
     95 		cap_flag_value_t cap_value;
     96 		unsigned int last_valid_cap = get_last_valid_cap();
     97 
     98 		for (i = 0; i <= last_valid_cap; ++i) {
     99 			if (cap_get_flag(parsed_caps, i, CAP_EFFECTIVE,
    100 					 &cap_value)) {
    101 				if (errno == EINVAL) {
    102 					/*
    103 					 * Some versions of libcap reject any
    104 					 * capabilities they were not compiled
    105 					 * with by returning EINVAL.
    106 					 */
    107 					continue;
    108 				}
    109 				fprintf(stderr,
    110 					"Could not get the value of "
    111 					"the %d-th capability: %m\n",
    112 					i);
    113 				exit(1);
    114 			}
    115 			if (cap_value == CAP_SET)
    116 				caps |= (one << i);
    117 		}
    118 		cap_free(parsed_caps);
    119 	} else {
    120 		char *end = NULL;
    121 		caps = strtoull(arg, &end, 16);
    122 		if (*end) {
    123 			fprintf(stderr, "Invalid cap set: '%s'\n", arg);
    124 			exit(1);
    125 		}
    126 	}
    127 
    128 	minijail_use_caps(j, caps);
    129 }
    130 
    131 static void add_binding(struct minijail *j, char *arg)
    132 {
    133 	char *src = tokenize(&arg, ",");
    134 	char *dest = tokenize(&arg, ",");
    135 	char *flags = tokenize(&arg, ",");
    136 	if (!src || src[0] == '\0' || arg != NULL) {
    137 		fprintf(stderr, "Bad binding: %s %s\n", src, dest);
    138 		exit(1);
    139 	}
    140 	if (dest == NULL || dest[0] == '\0')
    141 		dest = src;
    142 	if (flags == NULL || flags[0] == '\0')
    143 		flags = "0";
    144 	if (minijail_bind(j, src, dest, atoi(flags))) {
    145 		fprintf(stderr, "minijail_bind failed.\n");
    146 		exit(1);
    147 	}
    148 }
    149 
    150 static void add_rlimit(struct minijail *j, char *arg)
    151 {
    152 	char *type = tokenize(&arg, ",");
    153 	char *cur = tokenize(&arg, ",");
    154 	char *max = tokenize(&arg, ",");
    155 	char *end;
    156 	if (!type || type[0] == '\0' || !cur || cur[0] == '\0' ||
    157 	    !max || max[0] == '\0' || arg != NULL) {
    158 		fprintf(stderr, "Bad rlimit '%s'.\n", arg);
    159 		exit(1);
    160 	}
    161 	rlim_t cur_rlim;
    162 	rlim_t max_rlim;
    163 	if (!strcmp(cur, "unlimited")) {
    164 		cur_rlim = RLIM_INFINITY;
    165 	} else {
    166 		end = NULL;
    167 		cur_rlim = strtoul(cur, &end, 0);
    168 		if (*end) {
    169 			fprintf(stderr, "Bad soft limit: '%s'.\n", cur);
    170 			exit(1);
    171 		}
    172 	}
    173 	if (!strcmp(max, "unlimited")) {
    174 		max_rlim = RLIM_INFINITY;
    175 	} else {
    176 		end = NULL;
    177 		max_rlim = strtoul(max, &end, 0);
    178 		if (*end) {
    179 			fprintf(stderr, "Bad hard limit: '%s'.\n", max);
    180 			exit(1);
    181 		}
    182 	}
    183 
    184 	end = NULL;
    185 	int resource = parse_single_constant(type, &end);
    186 	if (type == end) {
    187 		fprintf(stderr, "Bad rlimit: '%s'.\n", type);
    188 		exit(1);
    189 	}
    190 
    191 	if (minijail_rlimit(j, resource, cur_rlim, max_rlim)) {
    192 		fprintf(stderr, "minijail_rlimit '%s,%s,%s' failed.\n", type,
    193 			cur, max);
    194 		exit(1);
    195 	}
    196 }
    197 
    198 static void add_mount(struct minijail *j, char *arg)
    199 {
    200 	char *src = tokenize(&arg, ",");
    201 	char *dest = tokenize(&arg, ",");
    202 	char *type = tokenize(&arg, ",");
    203 	char *flags = tokenize(&arg, ",");
    204 	char *data = tokenize(&arg, ",");
    205 	char *end;
    206 	if (!src || src[0] == '\0' || !dest || dest[0] == '\0' ||
    207 	    !type || type[0] == '\0') {
    208 		fprintf(stderr, "Bad mount: %s %s %s\n", src, dest, type);
    209 		exit(1);
    210 	}
    211 
    212 	/*
    213 	 * Fun edge case: the data option itself is comma delimited.  If there
    214 	 * were no more options, then arg would be set to NULL.  But if we had
    215 	 * more pending, it'll be pointing to the next token.  Back up and undo
    216 	 * the null byte so it'll be merged back.
    217 	 * An example:
    218 	 *   none,/tmp,tmpfs,0xe,mode=0755,uid=10,gid=10
    219 	 * The tokenize calls above will turn this memory into:
    220 	 *   none\0/tmp\0tmpfs\00xe\0mode=0755\0uid=10,gid=10
    221 	 * With data pointing at mode=0755 and arg pointing at uid=10,gid=10.
    222 	 */
    223 	if (arg != NULL)
    224 		arg[-1] = ',';
    225 
    226 	unsigned long mountflags;
    227 	if (flags == NULL || flags[0] == '\0') {
    228 		mountflags = 0;
    229 	} else {
    230 		end = NULL;
    231 		mountflags = parse_constant(flags, &end);
    232 		if (flags == end) {
    233 			fprintf(stderr, "Bad mount flags: %s\n", flags);
    234 			exit(1);
    235 		}
    236 	}
    237 
    238 	if (minijail_mount_with_data(j, src, dest, type,
    239 				     mountflags, data)) {
    240 		fprintf(stderr, "minijail_mount failed.\n");
    241 		exit(1);
    242 	}
    243 }
    244 
    245 static char *build_idmap(id_t id, id_t lowerid)
    246 {
    247 	int ret;
    248 	char *idmap = malloc(IDMAP_LEN);
    249 	ret = snprintf(idmap, IDMAP_LEN, "%d %d 1", id, lowerid);
    250 	if (ret < 0 || (size_t)ret >= IDMAP_LEN) {
    251 		free(idmap);
    252 		fprintf(stderr, "Could not build id map.\n");
    253 		exit(1);
    254 	}
    255 	return idmap;
    256 }
    257 
    258 static int has_cap_setgid(void)
    259 {
    260 	cap_t caps;
    261 	cap_flag_value_t cap_value;
    262 
    263 	if (!CAP_IS_SUPPORTED(CAP_SETGID))
    264 		return 0;
    265 
    266 	caps = cap_get_proc();
    267 	if (!caps) {
    268 		fprintf(stderr, "Could not get process' capabilities: %m\n");
    269 		exit(1);
    270 	}
    271 
    272 	if (cap_get_flag(caps, CAP_SETGID, CAP_EFFECTIVE, &cap_value)) {
    273 		fprintf(stderr, "Could not get the value of CAP_SETGID: %m\n");
    274 		exit(1);
    275 	}
    276 
    277 	if (cap_free(caps)) {
    278 		fprintf(stderr, "Could not free capabilities: %m\n");
    279 		exit(1);
    280 	}
    281 
    282 	return cap_value == CAP_SET;
    283 }
    284 
    285 static void set_ugid_mapping(struct minijail *j, int set_uidmap, uid_t uid,
    286 			     char *uidmap, int set_gidmap, gid_t gid,
    287 			     char *gidmap)
    288 {
    289 	if (set_uidmap) {
    290 		minijail_namespace_user(j);
    291 		minijail_namespace_pids(j);
    292 
    293 		if (!uidmap) {
    294 			/*
    295 			 * If no map is passed, map the current uid to the
    296 			 * chosen uid in the target namespace (or root, if none
    297 			 * was chosen).
    298 			 */
    299 			uidmap = build_idmap(uid, getuid());
    300 		}
    301 		if (0 != minijail_uidmap(j, uidmap)) {
    302 			fprintf(stderr, "Could not set uid map.\n");
    303 			exit(1);
    304 		}
    305 		free(uidmap);
    306 	}
    307 	if (set_gidmap) {
    308 		minijail_namespace_user(j);
    309 		minijail_namespace_pids(j);
    310 
    311 		if (!gidmap) {
    312 			/*
    313 			 * If no map is passed, map the current gid to the
    314 			 * chosen gid in the target namespace.
    315 			 */
    316 			gidmap = build_idmap(gid, getgid());
    317 		}
    318 		if (!has_cap_setgid()) {
    319 			/*
    320 			 * This means that we are not running as root,
    321 			 * so we also have to disable setgroups(2) to
    322 			 * be able to set the gid map.
    323 			 * See
    324 			 * http://man7.org/linux/man-pages/man7/user_namespaces.7.html
    325 			 */
    326 			minijail_namespace_user_disable_setgroups(j);
    327 		}
    328 		if (0 != minijail_gidmap(j, gidmap)) {
    329 			fprintf(stderr, "Could not set gid map.\n");
    330 			exit(1);
    331 		}
    332 		free(gidmap);
    333 	}
    334 }
    335 
    336 static void use_chroot(struct minijail *j, const char *path, int *chroot,
    337 		       int pivot_root)
    338 {
    339 	if (pivot_root) {
    340 		fprintf(stderr, "Could not set chroot because "
    341 				"'-P' was specified.\n");
    342 		exit(1);
    343 	}
    344 	if (minijail_enter_chroot(j, path)) {
    345 		fprintf(stderr, "Could not set chroot.\n");
    346 		exit(1);
    347 	}
    348 	*chroot = 1;
    349 }
    350 
    351 static void use_pivot_root(struct minijail *j, const char *path,
    352 			   int *pivot_root, int chroot)
    353 {
    354 	if (chroot) {
    355 		fprintf(stderr, "Could not set pivot_root because "
    356 				"'-C' was specified.\n");
    357 		exit(1);
    358 	}
    359 	if (minijail_enter_pivot_root(j, path)) {
    360 		fprintf(stderr, "Could not set pivot_root.\n");
    361 		exit(1);
    362 	}
    363 	minijail_namespace_vfs(j);
    364 	*pivot_root = 1;
    365 }
    366 
    367 static void use_profile(struct minijail *j, const char *profile,
    368 			int *pivot_root, int chroot, size_t *tmp_size)
    369 {
    370 	/* Note: New profiles should be added in minijail0_cli_unittest.cc. */
    371 
    372 	if (!strcmp(profile, "minimalistic-mountns")) {
    373 		minijail_namespace_vfs(j);
    374 		if (minijail_bind(j, "/", "/", 0)) {
    375 			fprintf(stderr, "minijail_bind(/) failed.\n");
    376 			exit(1);
    377 		}
    378 		if (minijail_bind(j, "/proc", "/proc", 0)) {
    379 			fprintf(stderr, "minijail_bind(/proc) failed.\n");
    380 			exit(1);
    381 		}
    382 		if (minijail_bind(j, "/dev/log", "/dev/log", 0)) {
    383 			fprintf(stderr, "minijail_bind(/dev/log) failed.\n");
    384 			exit(1);
    385 		}
    386 		minijail_mount_dev(j);
    387 		if (!*tmp_size) {
    388 			/* Avoid clobbering |tmp_size| if it was already set. */
    389 			*tmp_size = DEFAULT_TMP_SIZE;
    390 		}
    391 		minijail_remount_proc_readonly(j);
    392 		use_pivot_root(j, DEFAULT_PIVOT_ROOT, pivot_root, chroot);
    393 	} else {
    394 		fprintf(stderr, "Unrecognized profile name '%s'\n", profile);
    395 		exit(1);
    396 	}
    397 }
    398 
    399 static void set_remount_mode(struct minijail *j, const char *mode)
    400 {
    401 	unsigned long msmode;
    402 	if (!strcmp(mode, "shared"))
    403 		msmode = MS_SHARED;
    404 	else if (!strcmp(mode, "private"))
    405 		msmode = MS_PRIVATE;
    406 	else if (!strcmp(mode, "slave"))
    407 		msmode = MS_SLAVE;
    408 	else if (!strcmp(mode, "unbindable"))
    409 		msmode = MS_UNBINDABLE;
    410 	else {
    411 		fprintf(stderr, "Unknown remount mode: '%s'\n", mode);
    412 		exit(1);
    413 	}
    414 	minijail_remount_mode(j, msmode);
    415 }
    416 
    417 static void read_seccomp_filter(const char *filter_path,
    418 				struct sock_fprog *filter)
    419 {
    420 	FILE *f = fopen(filter_path, "re");
    421 	if (!f) {
    422 		fprintf(stderr, "failed to open %s: %m", filter_path);
    423 		exit(1);
    424 	}
    425 	off_t filter_size = 0;
    426 	if (fseeko(f, 0, SEEK_END) == -1 || (filter_size = ftello(f)) == -1) {
    427 		fclose(f);
    428 		fprintf(stderr, "failed to get file size of %s: %m",
    429 			filter_path);
    430 		exit(1);
    431 	}
    432 	if (filter_size % sizeof(struct sock_filter) != 0) {
    433 		fclose(f);
    434 		fprintf(stderr,
    435 			"filter size (%" PRId64
    436 			") of %s is not a multiple of %zu: %m",
    437 			filter_size, filter_path, sizeof(struct sock_filter));
    438 		exit(1);
    439 	}
    440 	rewind(f);
    441 
    442 	filter->len = filter_size / sizeof(struct sock_filter);
    443 	filter->filter = malloc(filter_size);
    444 	if (!filter->filter) {
    445 		fclose(f);
    446 		fprintf(stderr, "failed to allocate memory for filter: %m");
    447 		exit(1);
    448 	}
    449 	if (fread(filter->filter, sizeof(struct sock_filter), filter->len, f) !=
    450 	    filter->len) {
    451 		fclose(f);
    452 		fprintf(stderr, "failed read %s: %m", filter_path);
    453 		exit(1);
    454 	}
    455 	fclose(f);
    456 }
    457 
    458 static void usage(const char *progn)
    459 {
    460 	size_t i;
    461 	/* clang-format off */
    462 	printf("Usage: %s [-dGhHiIKlLnNprRstUvyYz]\n"
    463 	       "  [-a <table>]\n"
    464 	       "  [-b <src>[,<dest>[,<writeable>]]] [-k <src>,<dest>,<type>[,<flags>[,<data>]]]\n"
    465 	       "  [-c <caps>] [-C <dir>] [-P <dir>] [-e[file]] [-f <file>] [-g <group>]\n"
    466 	       "  [-m[<uid> <loweruid> <count>]*] [-M[<gid> <lowergid> <count>]*] [--profile <name>]\n"
    467 	       "  [-R <type,cur,max>] [-S <file>] [-t[size]] [-T <type>] [-u <user>] [-V <file>]\n"
    468 	       "  <program> [args...]\n"
    469 	       "  -a <table>:   Use alternate syscall table <table>.\n"
    470 	       "  -b <...>:     Bind <src> to <dest> in chroot.\n"
    471 	       "                Multiple instances allowed.\n"
    472 	       "  -B <mask>:    Skip setting securebits in <mask> when restricting capabilities (-c).\n"
    473 	       "                By default, SECURE_NOROOT, SECURE_NO_SETUID_FIXUP, and \n"
    474 	       "                SECURE_KEEP_CAPS (together with their respective locks) are set.\n"
    475 	       "                There are eight securebits in total.\n"
    476 	       "  -k <...>:     Mount <src> at <dest> in chroot.\n"
    477 	       "                <flags> and <data> can be specified as in mount(2).\n"
    478 	       "                Multiple instances allowed.\n"
    479 	       "  -c <caps>:    Restrict caps to <caps>.\n"
    480 	       "  -C <dir>:     chroot(2) to <dir>.\n"
    481 	       "                Not compatible with -P.\n"
    482 	       "  -P <dir>:     pivot_root(2) to <dir> (implies -v).\n"
    483 	       "                Not compatible with -C.\n"
    484 	       "  --mount-dev,  Create a new /dev with a minimal set of device nodes (implies -v).\n"
    485 	       "           -d:  See the minijail0(1) man page for the exact set.\n"
    486 	       "  -e[file]:     Enter new network namespace, or existing one if |file| is provided.\n"
    487 	       "  -f <file>:    Write the pid of the jailed process to <file>.\n"
    488 	       "  -g <group>:   Change gid to <group>.\n"
    489 	       "  -G:           Inherit supplementary groups from uid.\n"
    490 	       "                Not compatible with -y.\n"
    491 	       "  -y:           Keep uid's supplementary groups.\n"
    492 	       "                Not compatible with -G.\n"
    493 	       "  -h:           Help (this message).\n"
    494 	       "  -H:           Seccomp filter help message.\n"
    495 	       "  -i:           Exit immediately after fork(2). The jailed process will run\n"
    496 	       "                in the background.\n"
    497 	       "  -I:           Run <program> as init (pid 1) inside a new pid namespace (implies -p).\n"
    498 	       "  -K:           Do not change share mode of any existing mounts.\n"
    499 	       "  -K<mode>:     Mark all existing mounts as <mode> instead of MS_PRIVATE.\n"
    500 	       "  -l:           Enter new IPC namespace.\n"
    501 	       "  -L:           Report blocked syscalls to syslog when using seccomp filter.\n"
    502 	       "                Forces the following syscalls to be allowed:\n"
    503 	       "                  ", progn);
    504 	/* clang-format on */
    505 	for (i = 0; i < log_syscalls_len; i++)
    506 		printf("%s ", log_syscalls[i]);
    507 
    508 	/* clang-format off */
    509 	printf("\n"
    510 	       "  -m[map]:      Set the uid map of a user namespace (implies -pU).\n"
    511 	       "                Same arguments as newuidmap(1), multiple mappings should be separated by ',' (comma).\n"
    512 	       "                With no mapping, map the current uid to root inside the user namespace.\n"
    513 	       "                Not compatible with -b without the 'writable' option.\n"
    514 	       "  -M[map]:      Set the gid map of a user namespace (implies -pU).\n"
    515 	       "                Same arguments as newgidmap(1), multiple mappings should be separated by ',' (comma).\n"
    516 	       "                With no mapping, map the current gid to root inside the user namespace.\n"
    517 	       "                Not compatible with -b without the 'writable' option.\n"
    518 	       "  -n:           Set no_new_privs.\n"
    519 	       "  -N:           Enter a new cgroup namespace.\n"
    520 	       "  -p:           Enter new pid namespace (implies -vr).\n"
    521 	       "  -r:           Remount /proc read-only (implies -v).\n"
    522 	       "  -R:           Set rlimits, can be specified multiple times.\n"
    523 	       "  -s:           Use seccomp mode 1 (not the same as -S).\n"
    524 	       "  -S <file>:    Set seccomp filter using <file>.\n"
    525 	       "                E.g., '-S /usr/share/filters/<prog>.$(uname -m)'.\n"
    526 	       "                Requires -n when not running as root.\n"
    527 	       "  -t[size]:     Mount tmpfs at /tmp (implies -v).\n"
    528 	       "                Optional argument specifies size (default \"64M\").\n"
    529 	       "  -T <type>:    Assume <program> is a <type> ELF binary; <type> can be 'static' or 'dynamic'.\n"
    530 	       "                This will avoid accessing <program> binary before execve(2).\n"
    531 	       "                Type 'static' will avoid preload hooking.\n"
    532 	       "  -u <user>:    Change uid to <user>.\n"
    533 	       "  -U:           Enter new user namespace (implies -p).\n"
    534 	       "  -v:           Enter new mount namespace.\n"
    535 	       "  -V <file>:    Enter specified mount namespace.\n"
    536 	       "  -w:           Create and join a new anonymous session keyring.\n"
    537 	       "  -Y:           Synchronize seccomp filters across thread group.\n"
    538 	       "  -z:           Don't forward signals to jailed process.\n"
    539 	       "  --ambient:    Raise ambient capabilities. Requires -c.\n"
    540 	       "  --uts[=name]: Enter a new UTS namespace (and set hostname).\n"
    541 	       "  --logging=<s>:Use <s> as the logging system.\n"
    542 	       "                <s> must be 'syslog' (default) or 'stderr'.\n"
    543 	       "  --profile <p>:Configure minijail0 to run with the <p> sandboxing profile,\n"
    544 	       "                which is a convenient way to express multiple flags\n"
    545 	       "                that are typically used together.\n"
    546 	       "                See the minijail0(1) man page for the full list.\n"
    547 	       "  --preload-library=<f>:Overrides the path to \"" PRELOADPATH "\".\n"
    548 	       "                This is only really useful for local testing.\n"
    549 	       "  --seccomp-bpf-binary=<f>:Set a pre-compiled seccomp filter using <f>.\n"
    550 	       "                E.g., '-S /usr/share/filters/<prog>.$(uname -m).bpf'.\n"
    551 	       "                Requires -n when not running as root.\n"
    552 	       "                The user is responsible for ensuring that the binary\n"
    553 	       "                was compiled for the correct architecture / kernel version.\n");
    554 	/* clang-format on */
    555 }
    556 
    557 static void seccomp_filter_usage(const char *progn)
    558 {
    559 	const struct syscall_entry *entry = syscall_table;
    560 	printf("Usage: %s -S <policy.file> <program> [args...]\n\n"
    561 	       "System call names supported:\n",
    562 	       progn);
    563 	for (; entry->name && entry->nr >= 0; ++entry)
    564 		printf("  %s [%d]\n", entry->name, entry->nr);
    565 	printf("\nSee minijail0(5) for example policies.\n");
    566 }
    567 
    568 int parse_args(struct minijail *j, int argc, char *const argv[],
    569 	       int *exit_immediately, ElfType *elftype,
    570 	       const char **preload_path)
    571 {
    572 	int opt;
    573 	int use_seccomp_filter = 0, use_seccomp_filter_binary = 0;
    574 	int forward = 1;
    575 	int binding = 0;
    576 	int chroot = 0, pivot_root = 0;
    577 	int mount_ns = 0, skip_remount = 0;
    578 	int inherit_suppl_gids = 0, keep_suppl_gids = 0;
    579 	int caps = 0, ambient_caps = 0;
    580 	int seccomp = -1;
    581 	bool use_uid = false, use_gid = false;
    582 	uid_t uid = 0;
    583 	gid_t gid = 0;
    584 	char *uidmap = NULL, *gidmap = NULL;
    585 	int set_uidmap = 0, set_gidmap = 0;
    586 	size_t tmp_size = 0;
    587 	const char *filter_path = NULL;
    588 	int log_to_stderr = 0;
    589 
    590 	const char *optstring =
    591 	    "+u:g:sS:c:C:P:b:B:V:f:m::M::k:a:e::R:T:vrGhHinNplLt::IUK::wyYzd";
    592 	/* clang-format off */
    593 	const struct option long_options[] = {
    594 		{"help", no_argument, 0, 'h'},
    595 		{"mount-dev", no_argument, 0, 'd'},
    596 		{"ambient", no_argument, 0, 128},
    597 		{"uts", optional_argument, 0, 129},
    598 		{"logging", required_argument, 0, 130},
    599 		{"profile", required_argument, 0, 131},
    600 		{"preload-library", required_argument, 0, 132},
    601 		{"seccomp-bpf-binary", required_argument, 0, 133},
    602 		{0, 0, 0, 0},
    603 	};
    604 	/* clang-format on */
    605 
    606 	while ((opt = getopt_long(argc, argv, optstring, long_options, NULL)) !=
    607 	       -1) {
    608 		switch (opt) {
    609 		case 'u':
    610 			if (use_uid) {
    611 				fprintf(stderr,
    612 					"-u provided multiple times.\n");
    613 				exit(1);
    614 			}
    615 			use_uid = true;
    616 			set_user(j, optarg, &uid, &gid);
    617 			break;
    618 		case 'g':
    619 			if (use_gid) {
    620 				fprintf(stderr,
    621 					"-g provided multiple times.\n");
    622 				exit(1);
    623 			}
    624 			use_gid = true;
    625 			set_group(j, optarg, &gid);
    626 			break;
    627 		case 'n':
    628 			minijail_no_new_privs(j);
    629 			break;
    630 		case 's':
    631 			if (seccomp != -1 && seccomp != 1) {
    632 				fprintf(stderr,
    633 					"Do not use -s, -S, or "
    634 					"--seccomp-bpf-binary together.\n");
    635 				exit(1);
    636 			}
    637 			seccomp = 1;
    638 			minijail_use_seccomp(j);
    639 			break;
    640 		case 'S':
    641 			if (seccomp != -1 && seccomp != 2) {
    642 				fprintf(stderr,
    643 					"Do not use -s, -S, or "
    644 					"--seccomp-bpf-binary together.\n");
    645 				exit(1);
    646 			}
    647 			seccomp = 2;
    648 			minijail_use_seccomp_filter(j);
    649 			filter_path = optarg;
    650 			use_seccomp_filter = 1;
    651 			break;
    652 		case 'l':
    653 			minijail_namespace_ipc(j);
    654 			break;
    655 		case 'L':
    656 			minijail_log_seccomp_filter_failures(j);
    657 			break;
    658 		case 'b':
    659 			add_binding(j, optarg);
    660 			binding = 1;
    661 			break;
    662 		case 'B':
    663 			skip_securebits(j, optarg);
    664 			break;
    665 		case 'c':
    666 			caps = 1;
    667 			use_caps(j, optarg);
    668 			break;
    669 		case 'C':
    670 			use_chroot(j, optarg, &chroot, pivot_root);
    671 			break;
    672 		case 'k':
    673 			add_mount(j, optarg);
    674 			break;
    675 		case 'K':
    676 			if (optarg)
    677 				set_remount_mode(j, optarg);
    678 			else
    679 				minijail_skip_remount_private(j);
    680 			skip_remount = 1;
    681 			break;
    682 		case 'P':
    683 			use_pivot_root(j, optarg, &pivot_root, chroot);
    684 			break;
    685 		case 'f':
    686 			if (0 != minijail_write_pid_file(j, optarg)) {
    687 				fprintf(stderr,
    688 					"Could not prepare pid file path.\n");
    689 				exit(1);
    690 			}
    691 			break;
    692 		case 't':
    693 			minijail_namespace_vfs(j);
    694 			if (!tmp_size) {
    695 				/*
    696 				 * Avoid clobbering |tmp_size| if it was already
    697 				 * set.
    698 				 */
    699 				tmp_size = DEFAULT_TMP_SIZE;
    700 			}
    701 			if (optarg != NULL &&
    702 			    0 != parse_size(&tmp_size, optarg)) {
    703 				fprintf(stderr, "Invalid /tmp tmpfs size.\n");
    704 				exit(1);
    705 			}
    706 			break;
    707 		case 'v':
    708 			minijail_namespace_vfs(j);
    709 			mount_ns = 1;
    710 			break;
    711 		case 'V':
    712 			minijail_namespace_enter_vfs(j, optarg);
    713 			break;
    714 		case 'r':
    715 			minijail_remount_proc_readonly(j);
    716 			break;
    717 		case 'G':
    718 			if (keep_suppl_gids) {
    719 				fprintf(stderr,
    720 					"-y and -G are not compatible.\n");
    721 				exit(1);
    722 			}
    723 			minijail_inherit_usergroups(j);
    724 			inherit_suppl_gids = 1;
    725 			break;
    726 		case 'y':
    727 			if (inherit_suppl_gids) {
    728 				fprintf(stderr,
    729 					"-y and -G are not compatible.\n");
    730 				exit(1);
    731 			}
    732 			minijail_keep_supplementary_gids(j);
    733 			keep_suppl_gids = 1;
    734 			break;
    735 		case 'N':
    736 			minijail_namespace_cgroups(j);
    737 			break;
    738 		case 'p':
    739 			minijail_namespace_pids(j);
    740 			break;
    741 		case 'e':
    742 			if (optarg)
    743 				minijail_namespace_enter_net(j, optarg);
    744 			else
    745 				minijail_namespace_net(j);
    746 			break;
    747 		case 'i':
    748 			*exit_immediately = 1;
    749 			break;
    750 		case 'H':
    751 			seccomp_filter_usage(argv[0]);
    752 			exit(0);
    753 		case 'I':
    754 			minijail_namespace_pids(j);
    755 			minijail_run_as_init(j);
    756 			break;
    757 		case 'U':
    758 			minijail_namespace_user(j);
    759 			minijail_namespace_pids(j);
    760 			break;
    761 		case 'm':
    762 			set_uidmap = 1;
    763 			if (uidmap) {
    764 				free(uidmap);
    765 				uidmap = NULL;
    766 			}
    767 			if (optarg)
    768 				uidmap = strdup(optarg);
    769 			break;
    770 		case 'M':
    771 			set_gidmap = 1;
    772 			if (gidmap) {
    773 				free(gidmap);
    774 				gidmap = NULL;
    775 			}
    776 			if (optarg)
    777 				gidmap = strdup(optarg);
    778 			break;
    779 		case 'a':
    780 			if (0 != minijail_use_alt_syscall(j, optarg)) {
    781 				fprintf(stderr,
    782 					"Could not set alt-syscall table.\n");
    783 				exit(1);
    784 			}
    785 			break;
    786 		case 'R':
    787 			add_rlimit(j, optarg);
    788 			break;
    789 		case 'T':
    790 			if (!strcmp(optarg, "static"))
    791 				*elftype = ELFSTATIC;
    792 			else if (!strcmp(optarg, "dynamic"))
    793 				*elftype = ELFDYNAMIC;
    794 			else {
    795 				fprintf(stderr, "ELF type must be 'static' or "
    796 						"'dynamic'.\n");
    797 				exit(1);
    798 			}
    799 			break;
    800 		case 'w':
    801 			minijail_new_session_keyring(j);
    802 			break;
    803 		case 'Y':
    804 			minijail_set_seccomp_filter_tsync(j);
    805 			break;
    806 		case 'z':
    807 			forward = 0;
    808 			break;
    809 		case 'd':
    810 			minijail_namespace_vfs(j);
    811 			minijail_mount_dev(j);
    812 			break;
    813 		/* Long options. */
    814 		case 128: /* Ambient caps. */
    815 			ambient_caps = 1;
    816 			minijail_set_ambient_caps(j);
    817 			break;
    818 		case 129: /* UTS/hostname namespace. */
    819 			minijail_namespace_uts(j);
    820 			if (optarg)
    821 				minijail_namespace_set_hostname(j, optarg);
    822 			break;
    823 		case 130: /* Logging. */
    824 			if (!strcmp(optarg, "syslog"))
    825 				log_to_stderr = 0;
    826 			else if (!strcmp(optarg, "stderr")) {
    827 				log_to_stderr = 1;
    828 			} else {
    829 				fprintf(stderr, "--logger must be 'syslog' or "
    830 						"'stderr'.\n");
    831 				exit(1);
    832 			}
    833 			break;
    834 		case 131: /* Profile */
    835 			use_profile(j, optarg, &pivot_root, chroot, &tmp_size);
    836 			break;
    837 		case 132: /* PRELOADPATH */
    838 			*preload_path = optarg;
    839 			break;
    840 		case 133: /* seccomp-bpf binary. */
    841 			if (seccomp != -1 && seccomp != 3) {
    842 				fprintf(stderr,
    843 					"Do not use -s, -S, or "
    844 					"--seccomp-bpf-binary together.\n");
    845 				exit(1);
    846 			}
    847 			seccomp = 3;
    848 			minijail_use_seccomp_filter(j);
    849 			filter_path = optarg;
    850 			use_seccomp_filter_binary = 1;
    851 			break;
    852 		default:
    853 			usage(argv[0]);
    854 			exit(opt == 'h' ? 0 : 1);
    855 		}
    856 	}
    857 
    858 	if (log_to_stderr) {
    859 		init_logging(LOG_TO_FD, STDERR_FILENO, LOG_INFO);
    860 		/*
    861 		 * When logging to stderr, ensure the FD survives the jailing.
    862 		 */
    863 		if (0 !=
    864 		    minijail_preserve_fd(j, STDERR_FILENO, STDERR_FILENO)) {
    865 			fprintf(stderr, "Could not preserve stderr.\n");
    866 			exit(1);
    867 		}
    868 	}
    869 
    870 	/* Set up uid/gid mapping. */
    871 	if (set_uidmap || set_gidmap) {
    872 		set_ugid_mapping(j, set_uidmap, uid, uidmap, set_gidmap, gid,
    873 				 gidmap);
    874 	}
    875 
    876 	/* Can only set ambient caps when using regular caps. */
    877 	if (ambient_caps && !caps) {
    878 		fprintf(stderr, "Can't set ambient capabilities (--ambient) "
    879 				"without actually using capabilities (-c).\n");
    880 		exit(1);
    881 	}
    882 
    883 	/* Set up signal handlers in minijail unless asked not to. */
    884 	if (forward)
    885 		minijail_forward_signals(j);
    886 
    887 	/*
    888 	 * Only allow bind mounts when entering a chroot, using pivot_root, or
    889 	 * a new mount namespace.
    890 	 */
    891 	if (binding && !(chroot || pivot_root || mount_ns)) {
    892 		fprintf(stderr, "Bind mounts require a chroot, pivot_root, or "
    893 				" new mount namespace.\n");
    894 		exit(1);
    895 	}
    896 
    897 	/*
    898 	 * Remounting / as MS_PRIVATE only happens when entering a new mount
    899 	 * namespace, so skipping it only applies in that case.
    900 	 */
    901 	if (skip_remount && !mount_ns) {
    902 		fprintf(stderr, "Can't skip marking mounts as MS_PRIVATE"
    903 				" without mount namespaces.\n");
    904 		exit(1);
    905 	}
    906 
    907 	/*
    908 	 * We parse seccomp filters here to make sure we've collected all
    909 	 * cmdline options.
    910 	 */
    911 	if (use_seccomp_filter) {
    912 		minijail_parse_seccomp_filters(j, filter_path);
    913 	} else if (use_seccomp_filter_binary) {
    914 		struct sock_fprog filter;
    915 		read_seccomp_filter(filter_path, &filter);
    916 		minijail_set_seccomp_filters(j, &filter);
    917 		free((void *)filter.filter);
    918 	}
    919 
    920 	/* Mount a tmpfs under /tmp and set its size. */
    921 	if (tmp_size)
    922 		minijail_mount_tmp_size(j, tmp_size);
    923 
    924 	/*
    925 	 * There should be at least one additional unparsed argument: the
    926 	 * executable name.
    927 	 */
    928 	if (argc == optind) {
    929 		usage(argv[0]);
    930 		exit(1);
    931 	}
    932 
    933 	if (*elftype == ELFERROR) {
    934 		/*
    935 		 * -T was not specified.
    936 		 * Get the path to the program adjusted for changing root.
    937 		 */
    938 		char *program_path =
    939 		    minijail_get_original_path(j, argv[optind]);
    940 
    941 		/* Check that we can access the target program. */
    942 		if (access(program_path, X_OK)) {
    943 			fprintf(stderr,
    944 				"Target program '%s' is not accessible.\n",
    945 				argv[optind]);
    946 			exit(1);
    947 		}
    948 
    949 		/* Check if target is statically or dynamically linked. */
    950 		*elftype = get_elf_linkage(program_path);
    951 		free(program_path);
    952 	}
    953 
    954 	/*
    955 	 * Setting capabilities need either a dynamically-linked binary, or the
    956 	 * use of ambient capabilities for them to be able to survive an
    957 	 * execve(2).
    958 	 */
    959 	if (caps && *elftype == ELFSTATIC && !ambient_caps) {
    960 		fprintf(stderr, "Can't run statically-linked binaries with "
    961 				"capabilities (-c) without also setting "
    962 				"ambient capabilities. Try passing "
    963 				"--ambient.\n");
    964 		exit(1);
    965 	}
    966 
    967 	return optind;
    968 }
    969