292 lines
8.1 KiB
C
292 lines
8.1 KiB
C
/* vi: set sw=4 ts=4: */
|
|
/*
|
|
* Mini nsenter implementation for busybox.
|
|
*
|
|
* Copyright (C) 2016 by Bartosz Golaszewski <bartekgola@gmail.com>
|
|
*
|
|
* Licensed under GPLv2 or later, see file LICENSE in this source tree.
|
|
*/
|
|
|
|
//config:config NSENTER
|
|
//config: bool "nsenter (8.6 kb)"
|
|
//config: default y
|
|
//config: select PLATFORM_LINUX
|
|
//config: help
|
|
//config: Run program with namespaces of other processes.
|
|
//config:
|
|
//config:config FEATURE_NSENTER_LONG_OPTS
|
|
//config: bool "Enable long options"
|
|
//config: default y
|
|
//config: depends on NSENTER && LONG_OPTS
|
|
//config: help
|
|
//config: Support long options for the nsenter applet. This makes
|
|
//config: the busybox implementation more compatible with upstream.
|
|
|
|
//applet:IF_NSENTER(APPLET(nsenter, BB_DIR_USR_BIN, BB_SUID_DROP))
|
|
|
|
//kbuild:lib-$(CONFIG_NSENTER) += nsenter.o
|
|
|
|
//usage:#define nsenter_trivial_usage
|
|
//usage: "[OPTIONS] [PROG [ARGS]]"
|
|
//usage:#if ENABLE_FEATURE_NSENTER_LONG_OPTS
|
|
//usage:#define nsenter_full_usage "\n"
|
|
//usage: "\n -t,--target PID Target process to get namespaces from"
|
|
//usage: "\n -m,--mount[=FILE] Enter mount namespace"
|
|
//usage: "\n -u,--uts[=FILE] Enter UTS namespace (hostname etc)"
|
|
//usage: "\n -i,--ipc[=FILE] Enter System V IPC namespace"
|
|
//usage: "\n -n,--net[=FILE] Enter network namespace"
|
|
//usage: "\n -p,--pid[=FILE] Enter pid namespace"
|
|
//usage: "\n -U,--user[=FILE] Enter user namespace"
|
|
//usage: "\n -S,--setuid UID Set uid in entered namespace"
|
|
//usage: "\n -G,--setgid GID Set gid in entered namespace"
|
|
//usage: "\n --preserve-credentials Don't touch uids or gids"
|
|
//usage: "\n -r,--root[=DIR] Set root directory"
|
|
//usage: "\n -w,--wd[=DIR] Set working directory"
|
|
//usage: "\n -F,--no-fork Don't fork before exec'ing PROG"
|
|
//usage:#else
|
|
//usage:#define nsenter_full_usage "\n"
|
|
//usage: "\n -t PID Target process to get namespaces from"
|
|
//usage: "\n -m[FILE] Enter mount namespace"
|
|
//usage: "\n -u[FILE] Enter UTS namespace (hostname etc)"
|
|
//usage: "\n -i[FILE] Enter System V IPC namespace"
|
|
//usage: "\n -n[FILE] Enter network namespace"
|
|
//usage: "\n -p[FILE] Enter pid namespace"
|
|
//usage: "\n -U[FILE] Enter user namespace"
|
|
//usage: "\n -S UID Set uid in entered namespace"
|
|
//usage: "\n -G GID Set gid in entered namespace"
|
|
//usage: "\n -r[DIR] Set root directory"
|
|
//usage: "\n -w[DIR] Set working directory"
|
|
//usage: "\n -F Don't fork before exec'ing PROG"
|
|
//usage:#endif
|
|
|
|
#include <sched.h>
|
|
#ifndef CLONE_NEWUTS
|
|
# define CLONE_NEWUTS 0x04000000
|
|
#endif
|
|
#ifndef CLONE_NEWIPC
|
|
# define CLONE_NEWIPC 0x08000000
|
|
#endif
|
|
#ifndef CLONE_NEWUSER
|
|
# define CLONE_NEWUSER 0x10000000
|
|
#endif
|
|
#ifndef CLONE_NEWPID
|
|
# define CLONE_NEWPID 0x20000000
|
|
#endif
|
|
#ifndef CLONE_NEWNET
|
|
# define CLONE_NEWNET 0x40000000
|
|
#endif
|
|
|
|
#include "libbb.h"
|
|
|
|
struct namespace_descr {
|
|
int flag; /* value passed to setns() */
|
|
char ns_nsfile8[8]; /* "ns/" + namespace file in process' procfs entry */
|
|
};
|
|
|
|
struct namespace_ctx {
|
|
char *path; /* optional path to a custom ns file */
|
|
int fd; /* opened namespace file descriptor */
|
|
};
|
|
|
|
enum {
|
|
OPT_user = 1 << 0,
|
|
OPT_ipc = 1 << 1,
|
|
OPT_uts = 1 << 2,
|
|
OPT_network = 1 << 3,
|
|
OPT_pid = 1 << 4,
|
|
OPT_mount = 1 << 5,
|
|
OPT_target = 1 << 6,
|
|
OPT_setuid = 1 << 7,
|
|
OPT_setgid = 1 << 8,
|
|
OPT_root = 1 << 9,
|
|
OPT_wd = 1 << 10,
|
|
OPT_nofork = 1 << 11,
|
|
OPT_prescred = (1 << 12) * ENABLE_FEATURE_NSENTER_LONG_OPTS,
|
|
};
|
|
enum {
|
|
NS_USR_POS = 0,
|
|
NS_IPC_POS,
|
|
NS_UTS_POS,
|
|
NS_NET_POS,
|
|
NS_PID_POS,
|
|
NS_MNT_POS,
|
|
NS_COUNT,
|
|
};
|
|
/*
|
|
* The order is significant in nsenter.
|
|
* The user namespace comes first, so that it is entered first.
|
|
* This gives an unprivileged user the potential to enter other namespaces.
|
|
*/
|
|
static const struct namespace_descr ns_list[] = {
|
|
{ CLONE_NEWUSER, "ns/user", },
|
|
{ CLONE_NEWIPC, "ns/ipc", },
|
|
{ CLONE_NEWUTS, "ns/uts", },
|
|
{ CLONE_NEWNET, "ns/net", },
|
|
{ CLONE_NEWPID, "ns/pid", },
|
|
{ CLONE_NEWNS, "ns/mnt", },
|
|
};
|
|
/*
|
|
* Upstream nsenter doesn't support the short option for --preserve-credentials
|
|
*/
|
|
static const char opt_str[] ALIGN1 = "U::i::u::n::p::m::""t+S+G+r::w::F";
|
|
|
|
#if ENABLE_FEATURE_NSENTER_LONG_OPTS
|
|
static const char nsenter_longopts[] ALIGN1 =
|
|
"user\0" Optional_argument "U"
|
|
"ipc\0" Optional_argument "i"
|
|
"uts\0" Optional_argument "u"
|
|
"network\0" Optional_argument "n"
|
|
"pid\0" Optional_argument "p"
|
|
"mount\0" Optional_argument "m"
|
|
"target\0" Required_argument "t"
|
|
"setuid\0" Required_argument "S"
|
|
"setgid\0" Required_argument "G"
|
|
"root\0" Optional_argument "r"
|
|
"wd\0" Optional_argument "w"
|
|
"no-fork\0" No_argument "F"
|
|
"preserve-credentials\0" No_argument "\xff"
|
|
;
|
|
#endif
|
|
|
|
/*
|
|
* Open a file and return the new descriptor. If a full path is provided in
|
|
* fs_path, then the file to which it points is opened. Otherwise (fd_path is
|
|
* NULL) the routine builds a path to a procfs file using the following
|
|
* template: '/proc/<target_pid>/<target_file>'.
|
|
*/
|
|
static int open_by_path_or_target(const char *path,
|
|
pid_t target_pid, const char *target_file)
|
|
{
|
|
char proc_path_buf[sizeof("/proc/%u/1234567890") + sizeof(int)*3];
|
|
|
|
if (!path) {
|
|
if (target_pid == 0) {
|
|
/* Example:
|
|
* "nsenter -p PROG" - neither -pFILE nor -tPID given.
|
|
*/
|
|
bb_show_usage();
|
|
}
|
|
snprintf(proc_path_buf, sizeof(proc_path_buf),
|
|
"/proc/%u/%s", (unsigned)target_pid, target_file);
|
|
path = proc_path_buf;
|
|
}
|
|
|
|
return xopen(path, O_RDONLY);
|
|
}
|
|
|
|
int nsenter_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
|
|
int nsenter_main(int argc UNUSED_PARAM, char **argv)
|
|
{
|
|
int i;
|
|
unsigned int opts;
|
|
const char *root_dir_str = NULL;
|
|
const char *wd_str = NULL;
|
|
struct namespace_ctx ns_ctx_list[NS_COUNT];
|
|
int setgroups_failed;
|
|
int root_fd, wd_fd;
|
|
int target_pid = 0;
|
|
int uid = 0;
|
|
int gid = 0;
|
|
|
|
memset(ns_ctx_list, 0, sizeof(ns_ctx_list));
|
|
|
|
IF_FEATURE_NSENTER_LONG_OPTS(applet_long_options = nsenter_longopts);
|
|
opts = getopt32(argv, opt_str,
|
|
&ns_ctx_list[NS_USR_POS].path,
|
|
&ns_ctx_list[NS_IPC_POS].path,
|
|
&ns_ctx_list[NS_UTS_POS].path,
|
|
&ns_ctx_list[NS_NET_POS].path,
|
|
&ns_ctx_list[NS_PID_POS].path,
|
|
&ns_ctx_list[NS_MNT_POS].path,
|
|
&target_pid, &uid, &gid,
|
|
&root_dir_str, &wd_str
|
|
);
|
|
argv += optind;
|
|
|
|
root_fd = wd_fd = -1;
|
|
if (opts & OPT_root)
|
|
root_fd = open_by_path_or_target(root_dir_str,
|
|
target_pid, "root");
|
|
if (opts & OPT_wd)
|
|
wd_fd = open_by_path_or_target(wd_str, target_pid, "cwd");
|
|
|
|
for (i = 0; i < NS_COUNT; i++) {
|
|
const struct namespace_descr *ns = &ns_list[i];
|
|
struct namespace_ctx *ns_ctx = &ns_ctx_list[i];
|
|
|
|
ns_ctx->fd = -1;
|
|
if (opts & (1 << i))
|
|
ns_ctx->fd = open_by_path_or_target(ns_ctx->path,
|
|
target_pid, ns->ns_nsfile8);
|
|
}
|
|
|
|
/*
|
|
* Entering the user namespace without --preserve-credentials implies
|
|
* --setuid & --setgid and clearing root's groups.
|
|
*/
|
|
setgroups_failed = 0;
|
|
if ((opts & OPT_user) && !(opts & OPT_prescred)) {
|
|
opts |= (OPT_setuid | OPT_setgid);
|
|
/*
|
|
* We call setgroups() before and after setns() and only
|
|
* bail-out if it fails twice.
|
|
*/
|
|
setgroups_failed = (setgroups(0, NULL) < 0);
|
|
}
|
|
|
|
for (i = 0; i < NS_COUNT; i++) {
|
|
const struct namespace_descr *ns = &ns_list[i];
|
|
struct namespace_ctx *ns_ctx = &ns_ctx_list[i];
|
|
|
|
if (ns_ctx->fd < 0)
|
|
continue;
|
|
if (setns(ns_ctx->fd, ns->flag)) {
|
|
bb_perror_msg_and_die(
|
|
"setns(): can't reassociate to namespace '%s'",
|
|
ns->ns_nsfile8 + 3 /* skip over "ns/" */
|
|
);
|
|
}
|
|
close(ns_ctx->fd); /* should close fds, to not confuse exec'ed PROG */
|
|
/*ns_ctx->fd = -1;*/
|
|
}
|
|
|
|
if (root_fd >= 0) {
|
|
if (wd_fd < 0) {
|
|
/*
|
|
* Save the current working directory if we're not
|
|
* changing it.
|
|
*/
|
|
wd_fd = xopen(".", O_RDONLY);
|
|
}
|
|
xfchdir(root_fd);
|
|
xchroot(".");
|
|
close(root_fd);
|
|
/*root_fd = -1;*/
|
|
}
|
|
|
|
if (wd_fd >= 0) {
|
|
xfchdir(wd_fd);
|
|
close(wd_fd);
|
|
/*wd_fd = -1;*/
|
|
}
|
|
|
|
/*
|
|
* Entering the pid namespace implies forking unless it's been
|
|
* explicitly requested by the user not to.
|
|
*/
|
|
if (!(opts & OPT_nofork) && (opts & OPT_pid)) {
|
|
xvfork_parent_waits_and_exits();
|
|
/* Child continues */
|
|
}
|
|
|
|
if (opts & OPT_setgid) {
|
|
if (setgroups(0, NULL) < 0 && setgroups_failed)
|
|
bb_perror_msg_and_die("setgroups");
|
|
xsetgid(gid);
|
|
}
|
|
if (opts & OPT_setuid)
|
|
xsetuid(uid);
|
|
|
|
exec_prog_or_SHELL(argv);
|
|
}
|