59beb159d3
jail and change configuration instructions as well. Change default configuration instructions to specify setting root of the chroot jail as owned by root.root.
170 lines
6.6 KiB
Plaintext
170 lines
6.6 KiB
Plaintext
ifchd, copyright (c) 2004-2011 Nicholas Kain. Licensed under GNU GPL.
|
|
|
|
Requirements:
|
|
|
|
Linux kernel (tested: 2.4, 2.6)
|
|
* libcap is required (available via ftp.kernel.org)
|
|
|
|
C99-compliant C compiler (for C99 struct subobject init)
|
|
* any modern GCC should be sufficient
|
|
|
|
CMake (tested: 2.8)
|
|
|
|
Tested with glibc. dietlibc is not compatible. I have not tested uclibc.
|
|
|
|
INTRODUCTION
|
|
------------
|
|
|
|
ndhc consists of a set of daemons that cooperate in order to provide
|
|
privilege-seperated dhcp client services. Each daemon runs with the minimal
|
|
necessary privileges in order to perform its task. Currently, ndhc consists of
|
|
two daemons: the eponymous ndhc and ifchd.
|
|
|
|
ndhc communicates with dhcp servers and handles the vagaries of the dhcp
|
|
client protocol. It runs as a non-root user inside a chroot. ndhc retains
|
|
only the minimum necessary set of privileges required to perform its duties.
|
|
These powers include the ability to bind to a low port, the ability to open a
|
|
raw socket, and the ability to communicate on broadcast channels. ndhc holds
|
|
no other powers and is restricted to a chroot that contains nothing more than a
|
|
domain socket filesystem object and a urandom device node.
|
|
|
|
ifchd handles interface change requests. It listens on a UNIX domain socket
|
|
for such requests, and denies any client that does not match an authorized gid,
|
|
uid, or pid. ifchd runs as a non-root user inside a chroot, and retains only
|
|
the power to configure network interfaces. ifchd is designed so that it has
|
|
the ability to service multiple client requests simultaneously; a single ifchd
|
|
is sufficient for multiple ndhc clients. Only exotic setups should require
|
|
this functionality, but it does exist.
|
|
|
|
Note that ndhc does not support the entire DHCP client protocol. Only the
|
|
minimum necessary featureset is implemented. This behavior should be familiar
|
|
to anyone who has used software that purports to be be secure.
|
|
|
|
USAGE
|
|
-----
|
|
|
|
1) Compile and install ifchd and ndhc.
|
|
a) Create a build directory:
|
|
mkdir build && cd build
|
|
b) Create the makefiles:
|
|
cmake ..
|
|
c) Build ifchd and ndhc:
|
|
make
|
|
d) Install the ifchd/ifchd and ndhc/ndhc executables in a normal place. I
|
|
would suggest /usr/sbin or /usr/local/sbin.
|
|
|
|
2) Time to create the jail in which ifchd and ndhc will run.
|
|
a) Become root and create new group "ifchd".
|
|
|
|
$ su -
|
|
# umask 077
|
|
# groupadd ifchd
|
|
|
|
b) Create new users "ifchd" and "dhcp". The primary group of these
|
|
users should be "ifchd".
|
|
|
|
# useradd -d /var/lib/ndhc -s /sbin/nologin -g ifchd ifchd
|
|
# useradd -d /var/lib/ndhc -s /sbin/nologin -g ifchd dhcp
|
|
|
|
b) Create the jail directory and set its ownership properly.
|
|
|
|
# mkdir /var/lib/ndhc
|
|
# chown root.root /var/lib/ndhc
|
|
# chmod a+rx /var/lib/ndhc
|
|
# cd /var/lib/ndhc
|
|
# mkdir var
|
|
# mkdir var/state
|
|
# mkdir var/run
|
|
# chown -R ifchd.ifchd var
|
|
# chmod -R a+rx var
|
|
|
|
c) Create a urandom device for ndhc to use within the jail.
|
|
|
|
# mkdir dev
|
|
# mknod dev/urandom c 1 9
|
|
# mknod dev/null c 1 3
|
|
# chown -R root.root dev
|
|
# chmod a+rx dev
|
|
# chmod a+r dev/urandom
|
|
# chmod a+rw dev/null
|
|
|
|
d) (optional) If you wish for logging to properly work, you
|
|
will need to properly configure your logging daemon so that it
|
|
opens a domain socket in the proper location within the jail.
|
|
Since this varies per-daemon, I cannot provide a general
|
|
configuration.
|
|
|
|
3) At this point the jail is usable; ifchd and ndhc are ready to
|
|
be used. As an example of a sample configuration, here is my
|
|
rc.dhcp:
|
|
|
|
--START--
|
|
|
|
#!/bin/sh
|
|
case "$1" in
|
|
start)
|
|
ifchd -i wan0 -p /var/run/ifchd.pid -u ifchd -g ifchd -U dhcp \
|
|
-G ifchd -c /var/lib/ndhc &> /dev/null
|
|
ndhc -b -i wan0 -u dhcp -C /var/lib/ndhc &> /dev/null
|
|
;;
|
|
stop)
|
|
killall ndhc ifchd
|
|
;;
|
|
esac
|
|
|
|
--END--
|
|
|
|
This script works fine with my personal machines, which are set up
|
|
exactly as I have outlined above. If you have not entirely followed my
|
|
directions, the script will of course require modifications.
|
|
|
|
4o) If you encounter problems, I suggest running both ifchd and ndhc in the
|
|
foreground, and perhaps compiling ndhc with extra debugging output
|
|
(uncomment DEBUG=1 in the Makefile).
|
|
|
|
|
|
BEHAVIOR NOTES
|
|
--------------
|
|
|
|
ifchd does not enable updates of the local hostname and resolv.conf by default.
|
|
If you wish to enable these functions, use the --resolve (-r) and --hostname
|
|
(-o) flags. See ifchd --help.
|
|
|
|
ifchd can be set such that it only allows clients to configure particular
|
|
network interfaces. The --interface (-i) argument does the trick, and may
|
|
be used multiple times to allow multiple interfaces.
|
|
|
|
GRSECURITY NOTES
|
|
----------------
|
|
|
|
Make sure that CONFIG_GRKERNSEC_CHROOT_CAPS is disabled. Otherwise, ifchd will
|
|
lose its capabilities (in particular, the ability to reconfigure interfaces)
|
|
when it chroots.
|
|
|
|
|
|
PORTING NOTES
|
|
-------------
|
|
|
|
There are seven major functions that ifchd depends upon that are not generally
|
|
portable. First, it uses the SO_PEERCRED flag of getsockopt() to discriminate
|
|
authorized connections by uid, gid, and pid. Similar functionality exists in
|
|
at least the BSDs; however, it has a different API. Second, ifchd takes
|
|
advantage of Linux capabilities so that it does not need full root privileges.
|
|
Capabilities were a proposed POSIX feature that was not made part of the
|
|
official standard, so any implemention that may exist will be system-dependent.
|
|
Third and fourth, ifchd configures network interfaces and routes. Interface
|
|
and route configuration is entirely non-portable, usually requiring calls to
|
|
the catch-all ioctl(), and will almost certainly require platform-dependent
|
|
code. Fifth and sixth, both ifchd and ndhc use epoll() and signalfd(), which
|
|
are Linux-specific. Seventh, ndhc uses netlink sockets extensively for
|
|
both fetching data and hardware link state change notification events.
|
|
|
|
Some standard C libraries include a native implementation of strlcpy() and
|
|
strlcat(). Such defines may conflict with my implementations in strl.c/strl.h.
|
|
It is up to the user whether the standard C library implementations should be
|
|
used. Note that some machines implement strlcpy() and strlcat() with
|
|
nonstandard semantics (notably Solaris). On these systems, using the
|
|
system-provided implementations may lead to security problems. Such problems
|
|
are the fault of the vendor. If you are unsure whether your system is correct
|
|
or not, I suggest using the implementation that I provide.
|