<div dir="ltr">Hi,<br><div class="gmail_extra"><br></div><div class="gmail_extra">first sorry, i've forgot to add the ticket reference<br><a href="https://dev.openwrt.org/ticket/20785">https://dev.openwrt.org/ticket/20785</a><br></div><div class="gmail_extra"><br></div><div class="gmail_extra">also full disclore, I'm only writing C for OpenWrt<br></div><div class="gmail_extra">so is there a compilation flag to disable C++,<br></div><div class="gmail_extra">or can you be more specific on what C++ ism i'm using ?<br></div><div class="gmail_extra"><br><div class="gmail_quote">2015-11-21 9:08 GMT+01:00 John Crispin <span dir="ltr"><<a href="mailto:john@phrozen.org" target="_blank">john@phrozen.org</a>></span>:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class=""><br>
<br>
On 21/11/2015 00:05, Etienne CHAMPETIER wrote:<br>
</span><span class="">> Using ldd (via popen()) is a hack, but it's simpler (and working)<br>
<br>
</span>indeed<br>
<span class=""><br>
> we have 3 libc and many archs, too many ways to resolve .so<br>
</span>where does it break ?<br>
<span class=""><br>
<br>
> Current code:<br>
> -do not parse the intepreter (PT_INTERP) part of the elf<br>
</span>why should it ?<br></blockquote><div><br></div><div><br>here is the output of "objdump -x -s" on /bin/cat (subtarget x86_64 / DD)<br><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote"><pre class="">Dynamic Section:
NEEDED libgcc_s.so.1
NEEDED libc.so
Contents of section .interp:
/lib/ld-musl-x86_64.so.1</pre></blockquote><div>and the output of ldd /bin/cat<br><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote">root@OpenWrt:/# ldd /bin/cat<br> /lib/ld-musl-x86_64.so.1 (0x7fbe78583000)<br> libgcc_s.so.1 => /lib/libgcc_s.so.1 (0x7fbe78371000)<br> libc.so => /lib/ld-musl-x86_64.so.1 (0x7fbe78583000)<br></blockquote><br></div><div>if you run "ujail -d1 -p -- /bin/cat /proc/self/mounts"<br></div><div>the execve() call fail with "ENOENT (No such file or directory)"</div><div><br></div><div>now if you add "/lib/ld-musl-x86_64.so.1" to the jail (-r), and you remove symlink<br></div><div>from /lib64 to /lib, it works<br></div><div><br></div><div>the good question is why does it fails with musl/DD and work with uclibc/CC and glibc?<br></div><div><br> </div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<span class=""><br>
> -do not get the library path priority right (/lib64 is before /lib,<br>
> musl take the libs in /lib even on 64bits images)<br>
<br>
</span>libc dependent and not procd depended<br></blockquote><div><br></div><div>ujail has to resolve the same libs as the libc does,<br></div><div>so it depends on the libc, but it's still a ujail problem<br></div><div>that was my main motivation to use ldd <br></div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<span class=""><br>
> -do not handle RPATH<br>
><br>
> This patch:<br>
> -use ldd to detect ELF dependencies<br>
> -add support for shell script<br>
<br>
</span>elaborate that please<br></blockquote><div><br></div><div>if the file start with #!, add the exec and it dependencies to the jail<br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<span class=""><br>
<br>
> uClibc ldd doesn't work with shared lib, thus this patch break<br>
> seccomp with uClibc<br>
<br>
</span>so after you patch we can never again update procd in CC ?<br></blockquote><div><br></div><div>yes<br><br></div><div>i will try to improve the current elf parsing code,<br></div><div>but i'm afraid that it will break depending on the arch and ...<br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<span class=""><font color="#888888"><br>
John<br>
</font></span><div class=""><div class="h5"><br>
><br>
> Signed-off-by: Etienne CHAMPETIER <<a href="mailto:champetier.etienne@gmail.com">champetier.etienne@gmail.com</a>><br>
> ---<br>
> CMakeLists.txt | 2 +-<br>
> jail/deps.c | 198 ++++++++++++++++++++++++++++++++<br>
> jail/deps.h | 23 ++++<br>
> jail/elf.c | 355 ---------------------------------------------------------<br>
> jail/elf.h | 38 ------<br>
> jail/jail.c | 138 +++++++---------------<br>
> jail/jail.h | 18 +++<br>
> 7 files changed, 284 insertions(+), 488 deletions(-)<br>
> create mode 100644 jail/deps.c<br>
> create mode 100644 jail/deps.h<br>
> delete mode 100644 jail/elf.c<br>
> delete mode 100644 jail/elf.h<br>
> create mode 100644 jail/jail.h<br>
><br>
> diff --git a/CMakeLists.txt b/CMakeLists.txt<br>
> index d749c25..8e3f7ea 100644<br>
> --- a/CMakeLists.txt<br>
> +++ b/CMakeLists.txt<br>
> @@ -87,7 +87,7 @@ ADD_DEPENDENCIES(preload-seccomp syscall-names-h)<br>
> endif()<br>
><br>
> IF(JAIL_SUPPORT)<br>
> -ADD_EXECUTABLE(ujail jail/jail.c jail/elf.c jail/capabilities.c)<br>
> +ADD_EXECUTABLE(ujail jail/jail.c jail/deps.c jail/capabilities.c)<br>
> TARGET_LINK_LIBRARIES(ujail ubox blobmsg_json)<br>
> INSTALL(TARGETS ujail<br>
> RUNTIME DESTINATION ${CMAKE_INSTALL_SBINDIR}<br>
> diff --git a/jail/deps.c b/jail/deps.c<br>
> new file mode 100644<br>
> index 0000000..0141cef<br>
> --- /dev/null<br>
> +++ b/jail/deps.c<br>
> @@ -0,0 +1,198 @@<br>
> +/*<br>
> + * Copyright (C) 2015 John Crispin <<a href="mailto:blogic@openwrt.org">blogic@openwrt.org</a>><br>
> + * Copyright (C) 2015 Etienne Champetier <<a href="mailto:champetier.etienne@gmail.com">champetier.etienne@gmail.com</a>><br>
> + *<br>
> + * This program is free software; you can redistribute it and/or modify<br>
> + * it under the terms of the GNU Lesser General Public License version 2.1<br>
> + * as published by the Free Software Foundation<br>
> + *<br>
> + * This program is distributed in the hope that it will be useful,<br>
> + * but WITHOUT ANY WARRANTY; without even the implied warranty of<br>
> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the<br>
> + * GNU General Public License for more details.<br>
> + */<br>
> +<br>
> +#define _GNU_SOURCE<br>
> +<br>
> +#include <assert.h><br>
> +#include <elf.h><br>
> +#include <errno.h><br>
> +#include <fcntl.h><br>
> +#include <libgen.h><br>
> +#include <linux/limits.h><br>
> +#include <stdio.h><br>
> +#include <stdlib.h><br>
> +#include <string.h><br>
> +#include <sys/mount.h><br>
> +#include <sys/stat.h><br>
> +#include <sys/types.h><br>
> +#include <unistd.h><br>
> +<br>
> +#include <libubox/avl.h><br>
> +#include <libubox/avl-cmp.h><br>
> +<br>
> +#include "deps.h"<br>
> +#include "log.h"<br>
> +#include "jail.h"<br>
> +<br>
> +struct mount {<br>
> + struct avl_node avl;<br>
> + const char *path;<br>
> + int readonly;<br>
> + int error;<br>
> +};<br>
> +<br>
> +struct avl_tree mounts;<br>
> +<br>
> +static int add_mount(const char *path, int readonly, int error)<br>
> +{<br>
> + if (avl_find(&mounts, path))<br>
> + return 1;<br>
> +<br>
> + struct mount *m;<br>
> + m = calloc(1, sizeof(struct mount));<br>
> + assert(m != NULL);<br>
> + m->avl.key = m->path = strdup(path);<br>
> + m->readonly = readonly;<br>
> + m->error = error;<br>
> +<br>
> + avl_insert(&mounts, &m->avl);<br>
> + DEBUG("adding mount %s ro(%d) err(%d)\n", m->path, m->readonly, m->error != 0);<br>
> + return 0;<br>
> +}<br>
> +<br>
> +int add_mount_if_exists(const char *path, int readonly, int error) {<br>
> + struct stat s;<br>
> + if (stat(path, &s) == -1) {<br>
> + DEBUG("%s doesn't exist\n", path);<br>
> + return -1;<br>
> + }<br>
> + return add_mount(path, readonly, error);<br>
> +}<br>
> +<br>
> +int mount_all(const char *jailroot) {<br>
> + struct mount *m;<br>
> + avl_for_each_element(&mounts, m, avl)<br>
> + if (mount_bind(jailroot, m->path, m->readonly, m->error))<br>
> + return -1;<br>
> +<br>
> + return 0;<br>
> +}<br>
> +<br>
> +void mount_list_init() {<br>
> + avl_init(&mounts, avl_strcmp, false, NULL);<br>
> +}<br>
> +<br>
> +//we already read 2 char from f (#!)<br>
> +static int add_script_deps(FILE *f, const char *path, int readonly, int error)<br>
> +{<br>
> + char buf[PATH_MAX];<br>
> + int i = 0;<br>
> + int c;<br>
> + while ((c = fgetc(f)) != EOF) {<br>
> + if (i == 0 && c != '/')<br>
> + continue;<br>
> + if (c <= 0x20 || c > 0x7e)<br>
> + break;<br>
> + buf[i] = c;<br>
> + i++;<br>
> + if (i >= sizeof(buf)) {<br>
> + ERROR("script interpretor too long (%s)\n", path);<br>
> + return -1;<br>
> + }<br>
> + }<br>
> + buf[i] = '\0';<br>
> + return add_path_and_deps(buf, readonly, error);<br>
> +}<br>
> +<br>
> +static int add_elf_deps(const char *path, int readonly, int error)<br>
> +{<br>
> + char buf[PATH_MAX];<br>
> + int nb = snprintf(buf, sizeof(buf), "ldd %s", path);<br>
> + assert(nb >= 0);<br>
> +<br>
> + FILE *f = popen(buf, "r");<br>
> + char c;<br>
> + int i = 0;<br>
> + while (((c = fgetc(f)) != EOF)) {<br>
> + if (i == 0 && c != '/') {<br>
> + continue;<br>
> + } else if (i > 0 && (c <= ' ' || c > '~')) {<br>
> + buf[i] = '\0';<br>
> + add_mount(buf, readonly, error);<br>
> + i = 0;<br>
> + } else if (i > 0 || c == '/') {<br>
> + buf[i] = c;<br>
> + i++;<br>
> + }<br>
> +<br>
> + if (i >= sizeof(buf)) {<br>
> + ERROR("shared lib too long (%s)\n", path);<br>
> + return -1;<br>
> + }<br>
> + }<br>
> + pclose(f);<br>
> + return 0;<br>
> +}<br>
> +<br>
> +int add_path_and_deps(const char *path, int readonly, int error)<br>
> +{<br>
> + assert(path != NULL);<br>
> +<br>
> + if (path[0] != '/') {<br>
> + ERROR("only absolute path are supported (%s)\n", path);<br>
> + return error;<br>
> + }<br>
> +<br>
> + struct stat s;<br>
> + if (stat(path, &s) == -1) {<br>
> + ERROR("stat(%s) failed: %s\n", path, strerror(errno));<br>
> + return error;<br>
> + }<br>
> +<br>
> + //path already in list<br>
> + if (add_mount(path, readonly, error) == 1)<br>
> + return 0;<br>
> +<br>
> + if (!S_ISREG(s.st_mode))<br>
> + return 0;<br>
> +<br>
> + //too small to be an ELF or a script<br>
> + if (s.st_size < 4)<br>
> + return 0;<br>
> +<br>
> + FILE *f;<br>
> + if ((f = fopen(path, "r")) == NULL) {<br>
> + ERROR("fopen(%s) failed: %s\n", path, strerror(errno));<br>
> + return error;<br>
> + }<br>
> +<br>
> + int ret = 0;<br>
> + int c = fgetc(f);<br>
> + switch(c) {<br>
> + //script ?<br>
> + case '#':<br>
> + c = fgetc(f);<br>
> + if (c != '!') {<br>
> + goto out;<br>
> + }<br>
> + //this is a script<br>
> + ret = add_script_deps(f, path, readonly, error);<br>
> + goto out;<br>
> + //elf ?<br>
> + case ELFMAG0:<br>
> + if ((c = fgetc(f)) != ELFMAG1<br>
> + || (c = fgetc(f)) != ELFMAG2<br>
> + || (c = fgetc(f)) != ELFMAG3) {<br>
> + goto out;<br>
> + }<br>
> + ret = add_elf_deps(path, readonly, error);<br>
> + goto out;<br>
> + }<br>
> +out:<br>
> + if (f != NULL)<br>
> + fclose(f);<br>
> +<br>
> + return ret;<br>
> +}<br>
> +<br>
> diff --git a/jail/deps.h b/jail/deps.h<br>
> new file mode 100644<br>
> index 0000000..da2a914<br>
> --- /dev/null<br>
> +++ b/jail/deps.h<br>
> @@ -0,0 +1,23 @@<br>
> +/*<br>
> + * Copyright (C) 2015 Etienne Champetier <<a href="mailto:champetier.etienne@gmail.com">champetier.etienne@gmail.com</a>><br>
> + *<br>
> + * This program is free software; you can redistribute it and/or modify<br>
> + * it under the terms of the GNU Lesser General Public License version 2.1<br>
> + * as published by the Free Software Foundation<br>
> + *<br>
> + * This program is distributed in the hope that it will be useful,<br>
> + * but WITHOUT ANY WARRANTY; without even the implied warranty of<br>
> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the<br>
> + * GNU General Public License for more details.<br>
> + */<br>
> +<br>
> +#ifndef _DEPS_H__<br>
> +<br>
> +#include "log.h"<br>
> +<br>
> +int add_mount_if_exists(const char *path, int readonly, int error);<br>
> +int add_path_and_deps(const char *path, int readonly, int error);<br>
> +int mount_all(const char *jailroot);<br>
> +void mount_list_init();<br>
> +<br>
> +#endif<br>
> diff --git a/jail/elf.c b/jail/elf.c<br>
> deleted file mode 100644<br>
> index cbb3051..0000000<br>
> --- a/jail/elf.c<br>
> +++ /dev/null<br>
> @@ -1,355 +0,0 @@<br>
> -/*<br>
> - * Copyright (C) 2015 John Crispin <<a href="mailto:blogic@openwrt.org">blogic@openwrt.org</a>><br>
> - *<br>
> - * This program is free software; you can redistribute it and/or modify<br>
> - * it under the terms of the GNU Lesser General Public License version 2.1<br>
> - * as published by the Free Software Foundation<br>
> - *<br>
> - * This program is distributed in the hope that it will be useful,<br>
> - * but WITHOUT ANY WARRANTY; without even the implied warranty of<br>
> - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the<br>
> - * GNU General Public License for more details.<br>
> - */<br>
> -<br>
> -#define _GNU_SOURCE<br>
> -#include <sys/mman.h><br>
> -<br>
> -#include <stdlib.h><br>
> -#include <unistd.h><br>
> -#include <stdio.h><br>
> -#include <string.h><br>
> -#include <sys/stat.h><br>
> -#include <fcntl.h><br>
> -#include <libgen.h><br>
> -#include <glob.h><br>
> -#include <elf.h><br>
> -<br>
> -#include <libubox/utils.h><br>
> -<br>
> -#include "elf.h"<br>
> -<br>
> -struct avl_tree libraries;<br>
> -static LIST_HEAD(library_paths);<br>
> -<br>
> -void alloc_library_path(const char *path)<br>
> -{<br>
> - struct library_path *p;<br>
> - char *_path;<br>
> -<br>
> - p = calloc_a(sizeof(*p),<br>
> - &_path, strlen(path) + 1);<br>
> - if (!p)<br>
> - return;<br>
> -<br>
> - p->path = strcpy(_path, path);<br>
> -<br>
> - list_add_tail(&p->list, &library_paths);<br>
> - DEBUG("adding ld.so path %s\n", path);<br>
> -}<br>
> -<br>
> -static void alloc_library(const char *path, const char *name)<br>
> -{<br>
> - struct library *l;<br>
> - char *_name, *_path;<br>
> -<br>
> - l = calloc_a(sizeof(*l),<br>
> - &_path, strlen(path) + 1,<br>
> - &_name, strlen(name) + 1);<br>
> - if (!l)<br>
> - return;<br>
> -<br>
> - l->avl.key = l->name = strcpy(_name, name);<br>
> - l->path = strcpy(_path, path);<br>
> -<br>
> - avl_insert(&libraries, &l->avl);<br>
> - DEBUG("adding library %s/%s\n", path, name);<br>
> -}<br>
> -<br>
> -static int elf_open(char **dir, char *file)<br>
> -{<br>
> - struct library_path *p;<br>
> - char path[256];<br>
> - int fd = -1;<br>
> -<br>
> - *dir = NULL;<br>
> -<br>
> - list_for_each_entry(p, &library_paths, list) {<br>
> - if (strlen(p->path))<br>
> - snprintf(path, sizeof(path), "%s/%s", p->path, file);<br>
> - else<br>
> - strncpy(path, file, sizeof(path));<br>
> - fd = open(path, O_RDONLY);<br>
> - if (fd >= 0) {<br>
> - *dir = p->path;<br>
> - break;<br>
> - }<br>
> - }<br>
> -<br>
> - if (fd == -1)<br>
> - fd = open(file, O_RDONLY);<br>
> -<br>
> - return fd;<br>
> -}<br>
> -<br>
> -char* find_lib(char *file)<br>
> -{<br>
> - struct library *l;<br>
> - static char path[256];<br>
> - const char *p;<br>
> -<br>
> - l = avl_find_element(&libraries, file, l, avl);<br>
> - if (!l)<br>
> - return NULL;<br>
> -<br>
> - p = l->path;<br>
> - if (strstr(p, "local"))<br>
> - p = "/lib";<br>
> -<br>
> - snprintf(path, sizeof(path), "%s/%s", p, file);<br>
> -<br>
> - return path;<br>
> -}<br>
> -<br>
> -static int elf64_find_section(char *map, unsigned int type, unsigned int *offset, unsigned int *size, unsigned int *vaddr)<br>
> -{<br>
> - Elf64_Ehdr *e;<br>
> - Elf64_Phdr *ph;<br>
> - int i;<br>
> -<br>
> - e = (Elf64_Ehdr *) map;<br>
> - ph = (Elf64_Phdr *) (map + e->e_phoff);<br>
> -<br>
> - for (i = 0; i < e->e_phnum; i++) {<br>
> - if (ph[i].p_type == type) {<br>
> - *offset = ph[i].p_offset;<br>
> - if (size)<br>
> - *size = ph[i].p_filesz;<br>
> - if (vaddr)<br>
> - *vaddr = ph[i].p_vaddr;<br>
> - return 0;<br>
> - }<br>
> - }<br>
> -<br>
> - return -1;<br>
> -}<br>
> -<br>
> -static int elf32_find_section(char *map, unsigned int type, unsigned int *offset, unsigned int *size, unsigned int *vaddr)<br>
> -{<br>
> - Elf32_Ehdr *e;<br>
> - Elf32_Phdr *ph;<br>
> - int i;<br>
> -<br>
> - e = (Elf32_Ehdr *) map;<br>
> - ph = (Elf32_Phdr *) (map + e->e_phoff);<br>
> -<br>
> - for (i = 0; i < e->e_phnum; i++) {<br>
> - if (ph[i].p_type == type) {<br>
> - *offset = ph[i].p_offset;<br>
> - if (size)<br>
> - *size = ph[i].p_filesz;<br>
> - if (vaddr)<br>
> - *vaddr = ph[i].p_vaddr;<br>
> - return 0;<br>
> - }<br>
> - }<br>
> -<br>
> - return -1;<br>
> -}<br>
> -<br>
> -static int elf_find_section(char *map, unsigned int type, unsigned int *offset, unsigned int *size, unsigned int *vaddr)<br>
> -{<br>
> - int clazz = map[EI_CLASS];<br>
> -<br>
> - if (clazz == ELFCLASS32)<br>
> - return elf32_find_section(map, type, offset, size, vaddr);<br>
> - else if (clazz == ELFCLASS64)<br>
> - return elf64_find_section(map, type, offset, size, vaddr);<br>
> -<br>
> - ERROR("unknown elf format %d\n", clazz);<br>
> -<br>
> - return -1;<br>
> -}<br>
> -<br>
> -static int elf32_scan_dynamic(char *map, int dyn_offset, int dyn_size, int load_offset)<br>
> -{<br>
> - Elf32_Dyn *dynamic = (Elf32_Dyn *) (map + dyn_offset);<br>
> - char *strtab = NULL;<br>
> -<br>
> - while ((void *) dynamic < (void *) (map + dyn_offset + dyn_size)) {<br>
> - Elf32_Dyn *curr = dynamic;<br>
> -<br>
> - dynamic++;<br>
> - if (curr->d_tag != DT_STRTAB)<br>
> - continue;<br>
> -<br>
> - strtab = map + (curr->d_un.d_val - load_offset);<br>
> - break;<br>
> - }<br>
> -<br>
> - if (!strtab)<br>
> - return -1;<br>
> -<br>
> - dynamic = (Elf32_Dyn *) (map + dyn_offset);<br>
> - while ((void *) dynamic < (void *) (map + dyn_offset + dyn_size)) {<br>
> - Elf32_Dyn *curr = dynamic;<br>
> -<br>
> - dynamic++;<br>
> - if (curr->d_tag != DT_NEEDED)<br>
> - continue;<br>
> -<br>
> - if (elf_load_deps(&strtab[curr->d_un.d_val]))<br>
> - return -1;<br>
> - }<br>
> -<br>
> - return 0;<br>
> -}<br>
> -<br>
> -static int elf64_scan_dynamic(char *map, int dyn_offset, int dyn_size, int load_offset)<br>
> -{<br>
> - Elf64_Dyn *dynamic = (Elf64_Dyn *) (map + dyn_offset);<br>
> - char *strtab = NULL;<br>
> -<br>
> - while ((void *) dynamic < (void *) (map + dyn_offset + dyn_size)) {<br>
> - Elf64_Dyn *curr = dynamic;<br>
> -<br>
> - dynamic++;<br>
> - if (curr->d_tag != DT_STRTAB)<br>
> - continue;<br>
> -<br>
> - strtab = map + (curr->d_un.d_val - load_offset);<br>
> - break;<br>
> - }<br>
> -<br>
> - if (!strtab)<br>
> - return -1;<br>
> -<br>
> - dynamic = (Elf64_Dyn *) (map + dyn_offset);<br>
> - while ((void *) dynamic < (void *) (map + dyn_offset + dyn_size)) {<br>
> - Elf64_Dyn *curr = dynamic;<br>
> -<br>
> - dynamic++;<br>
> - if (curr->d_tag != DT_NEEDED)<br>
> - continue;<br>
> -<br>
> - if (elf_load_deps(&strtab[curr->d_un.d_val]))<br>
> - return -1;<br>
> - }<br>
> -<br>
> - return 0;<br>
> -}<br>
> -<br>
> -int elf_load_deps(char *library)<br>
> -{<br>
> - unsigned int dyn_offset, dyn_size;<br>
> - unsigned int load_offset, load_vaddr;<br>
> - struct stat s;<br>
> - char *map = NULL, *dir = NULL;<br>
> - int clazz, fd, ret = -1;<br>
> -<br>
> - if (avl_find(&libraries, library))<br>
> - return 0;<br>
> -<br>
> - fd = elf_open(&dir, library);<br>
> -<br>
> - if (fd < 0) {<br>
> - ERROR("failed to open %s\n", library);<br>
> - return -1;<br>
> - }<br>
> -<br>
> - if (fstat(fd, &s) == -1) {<br>
> - ERROR("failed to stat %s\n", library);<br>
> - ret = -1;<br>
> - goto err_out;<br>
> - }<br>
> -<br>
> - map = mmap(NULL, s.st_size, PROT_READ, MAP_PRIVATE, fd, 0);<br>
> - if (map == MAP_FAILED) {<br>
> - ERROR("failed to mmap %s\n", library);<br>
> - ret = -1;<br>
> - goto err_out;<br>
> - }<br>
> -<br>
> - if (elf_find_section(map, PT_LOAD, &load_offset, NULL, &load_vaddr)) {<br>
> - ERROR("failed to load the .load section from %s\n", library);<br>
> - ret = -1;<br>
> - goto err_out;<br>
> - }<br>
> -<br>
> - if (elf_find_section(map, PT_DYNAMIC, &dyn_offset, &dyn_size, NULL)) {<br>
> - ERROR("failed to load the .dynamic section from %s\n", library);<br>
> - ret = -1;<br>
> - goto err_out;<br>
> - }<br>
> -<br>
> - if (dir) {<br>
> - alloc_library(dir, library);<br>
> - } else {<br>
> - char *elf = strdup(library);<br>
> -<br>
> - alloc_library(dirname(elf), basename(library));<br>
> - free(elf);<br>
> - }<br>
> - clazz = map[EI_CLASS];<br>
> -<br>
> - if (clazz == ELFCLASS32)<br>
> - ret = elf32_scan_dynamic(map, dyn_offset, dyn_size, load_vaddr - load_offset);<br>
> - else if (clazz == ELFCLASS64)<br>
> - ret = elf64_scan_dynamic(map, dyn_offset, dyn_size, load_vaddr - load_offset);<br>
> -<br>
> -err_out:<br>
> - if (map)<br>
> - munmap(map, s.st_size);<br>
> - close(fd);<br>
> -<br>
> - return ret;<br>
> -}<br>
> -<br>
> -void load_ldso_conf(const char *conf)<br>
> -{<br>
> - FILE* fp = fopen(conf, "r");<br>
> - char line[256];<br>
> -<br>
> - if (!fp) {<br>
> - DEBUG("failed to open %s\n", conf);<br>
> - return;<br>
> - }<br>
> -<br>
> - while (!feof(fp)) {<br>
> - int len;<br>
> -<br>
> - if (!fgets(line, 256, fp))<br>
> - break;<br>
> - len = strlen(line);<br>
> - if (len < 2)<br>
> - continue;<br>
> - if (*line == '#')<br>
> - continue;<br>
> - if (line[len - 1] == '\n')<br>
> - line[len - 1] = '\0';<br>
> - if (!strncmp(line, "include ", 8)) {<br>
> - char *sep = strstr(line, " ");<br>
> - glob_t gl;<br>
> - int i;<br>
> -<br>
> - if (!sep)<br>
> - continue;;<br>
> - while (*sep == ' ')<br>
> - sep++;<br>
> - if (glob(sep, GLOB_NOESCAPE | GLOB_MARK, NULL, &gl)) {<br>
> - ERROR("glob failed on %s\n", sep);<br>
> - continue;<br>
> - }<br>
> - for (i = 0; i < gl.gl_pathc; i++)<br>
> - load_ldso_conf(gl.gl_pathv[i]);<br>
> - globfree(&gl);<br>
> - } else {<br>
> - struct stat s;<br>
> -<br>
> - if (stat(line, &s))<br>
> - continue;<br>
> - alloc_library_path(line);<br>
> - }<br>
> - }<br>
> -<br>
> - fclose(fp);<br>
> -}<br>
> diff --git a/jail/elf.h b/jail/elf.h<br>
> deleted file mode 100644<br>
> index 3ae311e..0000000<br>
> --- a/jail/elf.h<br>
> +++ /dev/null<br>
> @@ -1,38 +0,0 @@<br>
> -/*<br>
> - * Copyright (C) 2015 John Crispin <<a href="mailto:blogic@openwrt.org">blogic@openwrt.org</a>><br>
> - *<br>
> - * This program is free software; you can redistribute it and/or modify<br>
> - * it under the terms of the GNU Lesser General Public License version 2.1<br>
> - * as published by the Free Software Foundation<br>
> - *<br>
> - * This program is distributed in the hope that it will be useful,<br>
> - * but WITHOUT ANY WARRANTY; without even the implied warranty of<br>
> - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the<br>
> - * GNU General Public License for more details.<br>
> - */<br>
> -<br>
> -#ifndef _ELF_H__<br>
> -#include <libubox/avl.h><br>
> -#include <libubox/avl-cmp.h><br>
> -<br>
> -#include "log.h"<br>
> -<br>
> -struct library {<br>
> - struct avl_node avl;<br>
> - char *name;<br>
> - char *path;<br>
> -};<br>
> -<br>
> -struct library_path {<br>
> - struct list_head list;<br>
> - char *path;<br>
> -};<br>
> -<br>
> -extern struct avl_tree libraries;<br>
> -<br>
> -extern void alloc_library_path(const char *path);<br>
> -extern char* find_lib(char *file);<br>
> -extern int elf_load_deps(char *library);<br>
> -extern void load_ldso_conf(const char *conf);<br>
> -<br>
> -#endif<br>
> diff --git a/jail/jail.c b/jail/jail.c<br>
> index 08babde..391c196 100644<br>
> --- a/jail/jail.c<br>
> +++ b/jail/jail.c<br>
> @@ -12,27 +12,28 @@<br>
> */<br>
><br>
> #define _GNU_SOURCE<br>
> -#include <sys/mount.h><br>
> -#include <sys/prctl.h><br>
> -#include <sys/wait.h><br>
><br>
> -#include <stdlib.h><br>
> -#include <unistd.h><br>
> -#include <values.h><br>
> #include <errno.h><br>
> -#include <stdio.h><br>
> -#include <string.h><br>
> -#include <sys/stat.h><br>
> #include <fcntl.h><br>
> #include <libgen.h><br>
> +#include <linux/limits.h><br>
> #include <sched.h><br>
> +#include <stdio.h><br>
> +#include <stdlib.h><br>
> +#include <string.h><br>
> +#include <sys/mount.h><br>
> +#include <sys/prctl.h><br>
> +#include <sys/stat.h><br>
> +#include <sys/wait.h><br>
> +#include <unistd.h><br>
><br>
> -#include "elf.h"<br>
> -#include "capabilities.h"<br>
> -<br>
> -#include <libubox/list.h><br>
> #include <libubox/uloop.h><br>
><br>
> +#include "capabilities.h"<br>
> +#include "deps.h"<br>
> +#include "jail.h"<br>
> +#include "log.h"<br>
> +<br>
> #define STACK_SIZE (1024 * 1024)<br>
> #define OPT_ARGS "P:S:C:n:r:w:d:psulo"<br>
><br>
> @@ -48,16 +49,6 @@ static struct {<br>
> int sysfs;<br>
> } opts;<br>
><br>
> -struct extra {<br>
> - struct list_head list;<br>
> -<br>
> - const char *path;<br>
> - const char *name;<br>
> - int readonly;<br>
> -};<br>
> -<br>
> -static LIST_HEAD(extras);<br>
> -<br>
> extern int pivot_root(const char *new_root, const char *put_old);<br>
><br>
> int debug = 0;<br>
> @@ -89,42 +80,34 @@ static int mkdir_p(char *dir, mode_t mask)<br>
> return ret;<br>
> }<br>
><br>
> -static int mount_bind(const char *root, const char *path, const char *name, int readonly, int error)<br>
> +int mount_bind(const char *root, const char *path, int readonly, int error)<br>
> {<br>
> - const char *p = path;<br>
> struct stat s;<br>
> - char old[256];<br>
> - char new[256];<br>
> + char new[PATH_MAX];<br>
> int fd;<br>
><br>
> - if (strstr(p, "local"))<br>
> - p = "/lib";<br>
> -<br>
> - snprintf(old, sizeof(old), "%s/%s", path, name);<br>
> - snprintf(new, sizeof(new), "%s%s", root, p);<br>
> -<br>
> - mkdir_p(new, 0755);<br>
> -<br>
> - snprintf(new, sizeof(new), "%s%s/%s", root, p, name);<br>
> -<br>
> - if (stat(old, &s)) {<br>
> - ERROR("%s does not exist\n", old);<br>
> + if (stat(path, &s)) {<br>
> + ERROR("stat(%s) failed: %s\n", path, strerror(errno));<br>
> return error;<br>
> }<br>
><br>
> + snprintf(new, sizeof(new), "%s%s", root, path);<br>
> if (S_ISDIR(s.st_mode)) {<br>
> mkdir_p(new, 0755);<br>
> } else {<br>
> + mkdir_p(dirname(new), 0755);<br>
> +<br>
> + snprintf(new, sizeof(new), "%s%s", root, path);<br>
> fd = creat(new, 0644);<br>
> if (fd == -1) {<br>
> - ERROR("failed to create %s: %s\n", new, strerror(errno));<br>
> + ERROR("creat(%s) failed: %s\n", new, strerror(errno));<br>
> return -1;<br>
> }<br>
> close(fd);<br>
> }<br>
><br>
> - if (mount(old, new, NULL, MS_BIND, NULL)) {<br>
> - ERROR("failed to mount -B %s %s: %s\n", old, new, strerror(errno));<br>
> + if (mount(path, new, NULL, MS_BIND, NULL)) {<br>
> + ERROR("failed to mount -B %s %s: %s\n", path, new, strerror(errno));<br>
> return -1;<br>
> }<br>
><br>
> @@ -133,16 +116,14 @@ static int mount_bind(const char *root, const char *path, const char *name, int<br>
> return -1;<br>
> }<br>
><br>
> - DEBUG("mount -B %s %s\n", old, new);<br>
> + DEBUG("mount -B %s %s\n", path, new);<br>
><br>
> return 0;<br>
> }<br>
><br>
> +#define PRELOAD_SECCOMP "/lib/libpreload-seccomp.so"<br>
> static int build_jail_fs()<br>
> {<br>
> - struct library *l;<br>
> - struct extra *m;<br>
> -<br>
> if (mount("tmpfs", opts.path, "tmpfs", MS_NOATIME, "mode=0755")) {<br>
> ERROR("tmpfs mount failed %s\n", strerror(errno));<br>
> return -1;<br>
> @@ -153,29 +134,20 @@ static int build_jail_fs()<br>
> return -1;<br>
> }<br>
><br>
> - avl_init(&libraries, avl_strcmp, false, NULL);<br>
> - alloc_library_path("/lib64");<br>
> - alloc_library_path("/lib");<br>
> - alloc_library_path("/usr/lib");<br>
> - load_ldso_conf("/etc/ld.so.conf");<br>
> + add_mount_if_exists("/etc/ld.so.conf", 1, -1);<br>
><br>
> - if (elf_load_deps(*opts.jail_argv)) {<br>
> + if (add_path_and_deps(*opts.jail_argv, 1, -1)) {<br>
> ERROR("failed to load dependencies\n");<br>
> return -1;<br>
> }<br>
><br>
> - if (opts.seccomp && elf_load_deps("libpreload-seccomp.so")) {<br>
> + if (opts.seccomp && add_path_and_deps(PRELOAD_SECCOMP, 1, -1) == -1) {<br>
> ERROR("failed to load libpreload-seccomp.so\n");<br>
> return -1;<br>
> }<br>
><br>
> - avl_for_each_element(&libraries, l, avl)<br>
> - if (mount_bind(opts.path, l->path, l->name, 1, -1))<br>
> - return -1;<br>
> -<br>
> - list_for_each_entry(m, &extras, list)<br>
> - if (mount_bind(opts.path, m->path, m->name, m->readonly, 0))<br>
> - return -1;<br>
> + if (mount_all(opts.path))<br>
> + return -1;<br>
><br>
> char *mpoint;<br>
> if (asprintf(&mpoint, "%s/old", opts.path) < 0) {<br>
> @@ -205,24 +177,19 @@ static int build_jail_fs()<br>
> return 0;<br>
> }<br>
><br>
> -#define MAX_ENVP 8<br>
> +#define MAX_ENVP 4<br>
> +#define LD_PRELOAD_SECCOMP "LD_PRELOAD=" PRELOAD_SECCOMP<br>
> static char** build_envp(const char *seccomp)<br>
> {<br>
> static char *envp[MAX_ENVP];<br>
> - static char preload_var[64];<br>
> - static char seccomp_var[64];<br>
> + static char seccomp_var[PATH_MAX];<br>
> + static char preload_var[] = LD_PRELOAD_SECCOMP;<br>
> static char debug_var[] = "LD_DEBUG=all";<br>
> - char *preload_lib = find_lib("libpreload-seccomp.so");<br>
> int count = 0;<br>
><br>
> - if (seccomp && !preload_lib) {<br>
> - ERROR("failed to add preload-lib to env\n");<br>
> - return NULL;<br>
> - }<br>
> if (seccomp) {<br>
> snprintf(seccomp_var, sizeof(seccomp_var), "SECCOMP_FILE=%s", seccomp);<br>
> envp[count++] = seccomp_var;<br>
> - snprintf(preload_var, sizeof(preload_var), "LD_PRELOAD=%s", preload_lib);<br>
> envp[count++] = preload_var;<br>
> }<br>
> if (debug > 1)<br>
> @@ -279,7 +246,7 @@ static int spawn_jail()<br>
> }<br>
><br>
> if (build_jail_fs()) {<br>
> - ERROR("failed to build jail fs");<br>
> + ERROR("failed to build jail fs\n");<br>
> exit(EXIT_FAILURE);<br>
> }<br>
><br>
> @@ -306,24 +273,6 @@ static struct uloop_process jail_process = {<br>
> .cb = jail_process_handler,<br>
> };<br>
><br>
> -static void add_extra(char *name, int readonly)<br>
> -{<br>
> - struct extra *f;<br>
> -<br>
> - if (*name != '/') {<br>
> - ERROR("%s is not an absolute path\n", name);<br>
> - return;<br>
> - }<br>
> -<br>
> - f = calloc(1, sizeof(struct extra));<br>
> -<br>
> - f->name = basename(name);<br>
> - f->path = dirname(strdup(name));<br>
> - f->readonly = readonly;<br>
> -<br>
> - list_add_tail(&f->list, &extras);<br>
> -}<br>
> -<br>
> int main(int argc, char **argv)<br>
> {<br>
> uid_t uid = getuid();<br>
> @@ -338,6 +287,7 @@ int main(int argc, char **argv)<br>
> }<br>
><br>
> umask(022);<br>
> + mount_list_init();<br>
><br>
> while ((ch = getopt(argc, argv, OPT_ARGS)) != -1) {<br>
> switch (ch) {<br>
> @@ -358,11 +308,11 @@ int main(int argc, char **argv)<br>
> break;<br>
> case 'S':<br>
> opts.seccomp = optarg;<br>
> - add_extra(optarg, 1);<br>
> + add_path_and_deps(optarg, 1, -1);<br>
> break;<br>
> case 'C':<br>
> opts.capabilities = optarg;<br>
> - add_extra(optarg, 1);<br>
> + add_path_and_deps(optarg, 1, -1);<br>
> break;<br>
> case 'P':<br>
> opts.namespace = 1;<br>
> @@ -373,19 +323,19 @@ int main(int argc, char **argv)<br>
> break;<br>
> case 'r':<br>
> opts.namespace = 1;<br>
> - add_extra(optarg, 1);<br>
> + add_path_and_deps(optarg, 1, 0);<br>
> break;<br>
> case 'w':<br>
> opts.namespace = 1;<br>
> - add_extra(optarg, 0);<br>
> + add_path_and_deps(optarg, 0, 0);<br>
> break;<br>
> case 'u':<br>
> opts.namespace = 1;<br>
> - add_extra(ubus, 0);<br>
> + add_path_and_deps(ubus, 0, -1);<br>
> break;<br>
> case 'l':<br>
> opts.namespace = 1;<br>
> - add_extra(log, 0);<br>
> + add_path_and_deps(log, 0, -1);<br>
> break;<br>
> }<br>
> }<br>
> diff --git a/jail/jail.h b/jail/jail.h<br>
> new file mode 100644<br>
> index 0000000..fc69ef6<br>
> --- /dev/null<br>
> +++ b/jail/jail.h<br>
> @@ -0,0 +1,18 @@<br>
> +/*<br>
> + * Copyright (C) 2015 Etienne Champetier <<a href="mailto:champetier.etienne@gmail.com">champetier.etienne@gmail.com</a>><br>
> + *<br>
> + * This program is free software; you can redistribute it and/or modify<br>
> + * it under the terms of the GNU Lesser General Public License version 2.1<br>
> + * as published by the Free Software Foundation<br>
> + *<br>
> + * This program is distributed in the hope that it will be useful,<br>
> + * but WITHOUT ANY WARRANTY; without even the implied warranty of<br>
> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the<br>
> + * GNU General Public License for more details.<br>
> + */<br>
> +<br>
> +#ifndef _JAIL_H__<br>
> +<br>
> +int mount_bind(const char *root, const char *path, int readonly, int error);<br>
> +<br>
> +#endif<br>
><br>
</div></div><div class=""><div class="h5">_______________________________________________<br>
openwrt-devel mailing list<br>
<a href="mailto:openwrt-devel@lists.openwrt.org">openwrt-devel@lists.openwrt.org</a><br>
<a href="https://lists.openwrt.org/cgi-bin/mailman/listinfo/openwrt-devel" rel="noreferrer" target="_blank">https://lists.openwrt.org/cgi-bin/mailman/listinfo/openwrt-devel</a><br>
</div></div></blockquote></div><br></div></div>