From 4b1cf5afb8d217ae265950e6632d7329b5faae06 Mon Sep 17 00:00:00 2001 From: Yegor Timoshenko Date: Thu, 28 Dec 2017 05:49:35 +0000 Subject: [PATCH] chrootenv: rewrite on top of GLib Changes: * doesn't handle root user separately * doesn't chdir("/") which makes using it seamless * only bind mounts, doesn't symlink (i.e. files) Incidentally, fixes #33106. It's about two times shorter than the previous version, and much easier to read/follow through. It uses GLib quite heavily, along with RAII (available in GCC/Clang). --- .../build-fhs-userenv/chrootenv.c | 238 ------------------ .../build-fhs-userenv/chrootenv/chrootenv.c | 139 ++++++++++ .../build-fhs-userenv/chrootenv/default.nix | 19 ++ .../build-fhs-userenv/default.nix | 11 +- 4 files changed, 160 insertions(+), 247 deletions(-) delete mode 100644 pkgs/build-support/build-fhs-userenv/chrootenv.c create mode 100644 pkgs/build-support/build-fhs-userenv/chrootenv/chrootenv.c create mode 100644 pkgs/build-support/build-fhs-userenv/chrootenv/default.nix diff --git a/pkgs/build-support/build-fhs-userenv/chrootenv.c b/pkgs/build-support/build-fhs-userenv/chrootenv.c deleted file mode 100644 index 43abf976bde9..000000000000 --- a/pkgs/build-support/build-fhs-userenv/chrootenv.c +++ /dev/null @@ -1,238 +0,0 @@ -#define _GNU_SOURCE - -#include -#include - -#define errorf(status, fmt, ...) \ - error_at_line(status, errno, __FILE__, __LINE__, fmt, ##__VA_ARGS__) - -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - -#include -#include -#include - -#define LEN(x) (sizeof(x) / sizeof(*x)) - -// TODO: fill together with @abbradar when he gets better -const char *environ_blacklist[] = {}; - -void environ_blacklist_filter() { - for (size_t i = 0; i < LEN(environ_blacklist); i++) { - if (unsetenv(environ_blacklist[i]) < 0) - errorf(EX_OSERR, "unsetenv(%s)", environ_blacklist[i]); - } -} - -void bind(const char *from, const char *to) { - if (mkdir(to, 0755) < 0) - errorf(EX_IOERR, "mkdir(%s)", to); - - if (mount(from, to, "bind", MS_BIND | MS_REC, NULL) < 0) - errorf(EX_OSERR, "mount(%s, %s)", from, to); -} - -const char *bind_blacklist[] = {".", "..", "bin", "etc", "host", "usr"}; - -bool str_contains(const char *needle, const char **haystack, size_t len) { - for (size_t i = 0; i < len; i++) { - if (!strcmp(needle, haystack[i])) - return true; - } - - return false; -} - -bool is_dir(const char *path) { - struct stat buf; - - if (stat(path, &buf) < 0) - errorf(EX_IOERR, "stat(%s)", path); - - return S_ISDIR(buf.st_mode); -} - -void bind_to_cwd(const char *prefix) { - DIR *prefix_dir = opendir(prefix); - - if (prefix_dir == NULL) - errorf(EX_IOERR, "opendir(%s)", prefix); - - struct dirent *prefix_dirent; - - while (prefix_dirent = readdir(prefix_dir)) { - if (str_contains(prefix_dirent->d_name, bind_blacklist, - LEN(bind_blacklist))) - continue; - - char *prefix_dirent_path; - - if (asprintf(&prefix_dirent_path, "%s%s", prefix, prefix_dirent->d_name) < - 0) - errorf(EX_IOERR, "asprintf"); - - if (is_dir(prefix_dirent_path)) { - bind(prefix_dirent_path, prefix_dirent->d_name); - } else { - char *host_target; - - if (asprintf(&host_target, "host/%s", prefix_dirent->d_name) < 0) - errorf(EX_IOERR, "asprintf"); - - if (symlink(host_target, prefix_dirent->d_name) < 0) - errorf(EX_IOERR, "symlink(%s, %s)", host_target, prefix_dirent->d_name); - - free(host_target); - } - - free(prefix_dirent_path); - } - - bind(prefix, "host"); - - if (closedir(prefix_dir) < 0) - errorf(EX_IOERR, "closedir(%s)", prefix); -} - -void spitf(const char *path, char *fmt, ...) { - va_list args; - va_start(args, fmt); - - FILE *f = fopen(path, "w"); - - if (f == NULL) - errorf(EX_IOERR, "spitf(%s): fopen", path); - - if (vfprintf(f, fmt, args) < 0) - errorf(EX_IOERR, "spitf(%s): vfprintf", path); - - if (fclose(f) < 0) - errorf(EX_IOERR, "spitf(%s): fclose", path); -} - -int nftw_remove(const char *path, const struct stat *sb, int type, - struct FTW *ftw) { - return remove(path); -} - -#define REQUIREMENTS \ - "Requires Linux version >= 3.19 built with CONFIG_USER_NS option.\n" - -int main(int argc, char *argv[]) { - const char *self = *argv++; - - if (argc < 2) { - fprintf(stderr, "Usage: %s command [arguments...]\n" REQUIREMENTS, self); - exit(EX_USAGE); - } - - if (getenv("NIX_CHROOTENV") != NULL) { - fputs("Can't create chrootenv inside chrootenv!\n", stderr); - exit(EX_USAGE); - } - - if (setenv("NIX_CHROOTENV", "1", false) < 0) - errorf(EX_OSERR, "setenv(NIX_CHROOTENV, 1)"); - - const char *temp = getenv("TMPDIR"); - - if (temp == NULL) - temp = "/tmp"; - - char *root; - - if (asprintf(&root, "%s/chrootenvXXXXXX", temp) < 0) - errorf(EX_IOERR, "asprintf"); - - root = mkdtemp(root); - - if (root == NULL) - errorf(EX_IOERR, "mkdtemp(%s)", root); - - // Don't make root private so that privilege drops inside chroot are possible: - if (chmod(root, 0755) < 0) - errorf(EX_IOERR, "chmod(%s, 0755)", root); - - pid_t cpid = fork(); - - if (cpid < 0) - errorf(EX_OSERR, "fork"); - - if (cpid == 0) { - uid_t uid = getuid(); - gid_t gid = getgid(); - - // If we are root, no need to create new user namespace. - if (uid == 0) { - if (unshare(CLONE_NEWNS) < 0) { - fputs(REQUIREMENTS, stderr); - errorf(EX_OSERR, "unshare"); - } - // Mark all mounted filesystems as slave so changes - // don't propagate to the parent mount namespace. - if (mount(NULL, "/", NULL, MS_REC | MS_SLAVE, NULL) < 0) - errorf(EX_OSERR, "mount"); - } else { - // Create new mount and user namespaces. CLONE_NEWUSER - // requires a program to be non-threaded. - if (unshare(CLONE_NEWNS | CLONE_NEWUSER) < 0) { - fputs(access("/proc/sys/kernel/unprivileged_userns_clone", F_OK) - ? REQUIREMENTS - : "Run: sudo sysctl -w kernel.unprivileged_userns_clone=1\n", - stderr); - errorf(EX_OSERR, "unshare"); - } - - // Map users and groups to the parent namespace. - // setgroups is only available since Linux 3.19: - spitf("/proc/self/setgroups", "deny"); - - spitf("/proc/self/uid_map", "%d %d 1", uid, uid); - spitf("/proc/self/gid_map", "%d %d 1", gid, gid); - } - - if (chdir(root) < 0) - errorf(EX_IOERR, "chdir(%s)", root); - - bind_to_cwd("/"); - - if (chroot(root) < 0) - errorf(EX_OSERR, "chroot(%s)", root); - - if (chdir("/") < 0) - errorf(EX_IOERR, "chdir(/)"); - - environ_blacklist_filter(); - - if (execvp(*argv, argv) < 0) - errorf(EX_OSERR, "execvp(%s)", *argv); - } - - int status; - - if (waitpid(cpid, &status, 0) < 0) - errorf(EX_OSERR, "waitpid(%d)", cpid); - - if (nftw(root, nftw_remove, getdtablesize(), - FTW_DEPTH | FTW_MOUNT | FTW_PHYS) < 0) - errorf(EX_IOERR, "nftw(%s)", root); - - free(root); - - if (WIFEXITED(status)) { - return WEXITSTATUS(status); - } else if (WIFSIGNALED(status)) { - kill(getpid(), WTERMSIG(status)); - } - - return EX_OSERR; -} diff --git a/pkgs/build-support/build-fhs-userenv/chrootenv/chrootenv.c b/pkgs/build-support/build-fhs-userenv/chrootenv/chrootenv.c new file mode 100644 index 000000000000..c03a1710f451 --- /dev/null +++ b/pkgs/build-support/build-fhs-userenv/chrootenv/chrootenv.c @@ -0,0 +1,139 @@ +#define _GNU_SOURCE + +#include +#include + +#include +#include +#include + +#define fail(s, err) g_error("%s: %s: %s", __func__, s, g_strerror(err)) +#define fail_if(expr) \ + if (expr) \ + fail(#expr, errno); + +#include + +#include +#include +#include +#include + +const gchar *bind_blacklist[] = {"bin", "etc", "host", "usr", NULL}; + +void bind_mount(const gchar *source, const gchar *target) { + fail_if(g_mkdir(target, 0755)); + fail_if(mount(source, target, "bind", MS_BIND | MS_REC, NULL)); +} + +void bind_mount_host(const gchar *host, const gchar *guest) { + g_autofree gchar *point = g_build_filename(guest, "host", NULL); + bind_mount(host, point); +} + +void bind_mount_item(const gchar *host, const gchar *guest, const gchar *name) { + g_autofree gchar *source = g_build_filename(host, name, NULL); + g_autofree gchar *target = g_build_filename(guest, name, NULL); + + if (G_LIKELY(g_file_test(source, G_FILE_TEST_IS_DIR))) + bind_mount(source, target); +} + +void bind(const gchar *host, const gchar *guest) { + g_autoptr(GError) err = NULL; + g_autoptr(GDir) dir = g_dir_open(host, 0, &err); + + if (err != NULL) + fail("g_dir_open", errno); + + const gchar *item; + + while (item = g_dir_read_name(dir)) + if (!g_strv_contains(bind_blacklist, item)) + bind_mount_item(host, guest, item); + + bind_mount_host(host, guest); +} + +void spit(const char *path, char *fmt, ...) { + va_list args; + va_start(args, fmt); + + FILE *f = g_fopen(path, "w"); + + if (f == NULL) + fail("g_fopen", errno); + + g_vfprintf(f, fmt, args); + fclose(f); +} + +int nftw_remove(const char *path, const struct stat *sb, int type, + struct FTW *ftw) { + return remove(path); +} + +int main(gint argc, gchar **argv) { + const gchar *self = *argv++; + + if (argc < 2) { + g_message("%s command [arguments...]", self); + return 1; + } + + if (g_getenv("NIX_CHROOTENV")) + g_warning("chrootenv doesn't stack!"); + else + g_setenv("NIX_CHROOTENV", "", TRUE); + + g_autofree gchar *prefix = + g_build_filename(g_get_tmp_dir(), "chrootenvXXXXXX", NULL); + + fail_if(!g_mkdtemp_full(prefix, 0755)); + + pid_t cpid = fork(); + + if (cpid < 0) + fail("fork", errno); + + else if (cpid == 0) { + uid_t uid = getuid(); + gid_t gid = getgid(); + + if (unshare(CLONE_NEWNS | CLONE_NEWUSER) < 0) { + int unshare_errno = errno; + + g_message("Requires Linux version >= 3.19 built with CONFIG_USER_NS"); + if (g_file_test("/proc/sys/kernel/unprivileged_userns_clone", + G_FILE_TEST_EXISTS)) + g_message("Run: sudo sysctl -w kernel.unprivileged_userns_clone=1"); + + fail("unshare", unshare_errno); + } + + spit("/proc/self/setgroups", "deny"); + spit("/proc/self/uid_map", "%d %d 1", uid, uid); + spit("/proc/self/gid_map", "%d %d 1", gid, gid); + + bind("/", prefix); + + fail_if(chroot(prefix)); + fail_if(execvp(*argv, argv)); + } + + else { + int status; + + fail_if(waitpid(cpid, &status, 0) != cpid); + fail_if(nftw(prefix, nftw_remove, getdtablesize(), + FTW_DEPTH | FTW_MOUNT | FTW_PHYS)); + + if (WIFEXITED(status)) + return WEXITSTATUS(status); + + else if (WIFSIGNALED(status)) + kill(getpid(), WTERMSIG(status)); + + return 1; + } +} diff --git a/pkgs/build-support/build-fhs-userenv/chrootenv/default.nix b/pkgs/build-support/build-fhs-userenv/chrootenv/default.nix new file mode 100644 index 000000000000..375c30e1e463 --- /dev/null +++ b/pkgs/build-support/build-fhs-userenv/chrootenv/default.nix @@ -0,0 +1,19 @@ +{ stdenv, pkgconfig, glib }: + +stdenv.mkDerivation { + name = "chrootenv"; + + nativeBuildInputs = [ pkgconfig ]; + buildInputs = [ glib ]; + + buildCommand = '' + cc ${./chrootenv.c} $(pkg-config --cflags --libs glib-2.0) -o $out + ''; + + meta = with stdenv.lib; { + description = "Setup mount/user namespace for FHS emulation"; + license = licenses.free; + maintainers = with maintainers; [ yegortimoshenko ]; + platforms = platforms.linux; + }; +} diff --git a/pkgs/build-support/build-fhs-userenv/default.nix b/pkgs/build-support/build-fhs-userenv/default.nix index 5f3ec4dc8eaf..219530a67bd8 100644 --- a/pkgs/build-support/build-fhs-userenv/default.nix +++ b/pkgs/build-support/build-fhs-userenv/default.nix @@ -1,4 +1,4 @@ -{ callPackage, runCommand, lib, writeScript, stdenv, coreutils, ruby }: +{ callPackage, runCommand, lib, writeScript, stdenv, coreutils }: let buildFHSEnv = callPackage ./env.nix { }; in @@ -7,14 +7,7 @@ args@{ name, runScript ? "bash", extraInstallCommands ? "", meta ? {}, passthru let env = buildFHSEnv (removeAttrs args [ "runScript" "extraInstallCommands" "meta" "passthru" ]); - chrootenv = stdenv.mkDerivation { - name = "chrootenv"; - - unpackPhase = "cp ${./chrootenv.c} chrootenv.c"; - installPhase = "cp chrootenv $out"; - - makeFlags = [ "chrootenv" ]; - }; + chrootenv = callPackage ./chrootenv {}; init = run: writeScript "${name}-init" '' #! ${stdenv.shell}