113d8c6 · nix-bundle · git.iko.soy

git.iko.soy/nix-bundle

on master help sign in

Merge pull request #41 from input-output-hk/escape-hatch

113d8c6Matthew Bauer8 years ago

nix-user-chroot/main.cpp+75−4

compare with master

unifiedsplit

@@ -26,6 +26,10 @@

26using namespace std;

28#define err_exit(format, ...) { fprintf(stderr, format ": %s\n", ##__VA_ARGS__, strerror(errno)); exit(EXIT_FAILURE); }

29+static int child_proc(const char *rootdir, const char *nixdir, uint8_t clear_env, list<struct DirMapping> dirMappings, list<struct SetEnv> envMappings, const char *executable, char * const new_argv[]);

30+

31+volatile uint8_t child_died = 0;

32+int child_pid = 0;

30static void usage(const char *pname) {

34static void usage(const char *pname) {

31 fprintf(stderr, "Usage: %s -n <nixpath> -- <command>\n", pname);

35 fprintf(stderr, "Usage: %s -n <nixpath> -- <command>\n", pname);

@@ -33,6 +37,7 @@ static void usage(const char *pname) {

33 fprintf(stderr, "\t-m <src>:<src>\tmap src on the host to dest in the sandbox\n");

37 fprintf(stderr, "\t-m <src>:<src>\tmap src on the host to dest in the sandbox\n");

34 fprintf(stderr, "\t-d\tdelete all default dir mappings, may break things\n");

38 fprintf(stderr, "\t-d\tdelete all default dir mappings, may break things\n");

35 fprintf(stderr, "\t-p <var>\tpreserve the value of a variable across the -c clear\n");

39 fprintf(stderr, "\t-p <var>\tpreserve the value of a variable across the -c clear\n");

40+ fprintf(stderr, "\t-e\tadd an /escape-hatch to the sandbox, and run (outside the sandbox) any strings written to it\n");

37 exit(EXIT_FAILURE);

42 exit(EXIT_FAILURE);

38}

43}

@@ -91,8 +96,15 @@ struct DirMapping parseMapping(string input) {

91 return (struct DirMapping){ src, dest };

96 return (struct DirMapping){ src, dest };

92}

97}

99+static void handle_child_death(int signo, siginfo_t *info, void *context) {

100+ if ( (child_pid == 0) || (info->si_pid == child_pid) ) {

101+ child_died = 1;

102+ }

103+}

104+

94int main(int argc, char *argv[]) {

105int main(int argc, char *argv[]) {

95 uint8_t clear_env = 0;

106 uint8_t clear_env = 0;

107+ uint8_t enable_escape_hatch = 0;

96 char *nixdir = NULL;

108 char *nixdir = NULL;

97 list<struct DirMapping> dirMappings;

109 list<struct DirMapping> dirMappings;

98 list<struct SetEnv> envMappings;

110 list<struct SetEnv> envMappings;

@@ -111,11 +123,14 @@ int main(int argc, char *argv[]) {

111#undef x

123#undef x

112

124

113 int opt;

125 int opt;

114− while ((opt = getopt(argc, argv, "cn:m:dp:")) != -1) {

126+ while ((opt = getopt(argc, argv, "cen:m:dp:")) != -1) {

115 switch (opt) {

127 switch (opt) {

116 case 'c':

128 case 'c':

117 clear_env = 1;

129 clear_env = 1;

118 break;

130 break;

131+ case 'e':

132+ enable_escape_hatch = 1;

133+ break;

119 case 'n':

134 case 'n':

120 // determine absolute directory for nix dir

135 // determine absolute directory for nix dir

121 nixdir = realpath(optarg, NULL);

136 nixdir = realpath(optarg, NULL);

@@ -163,6 +178,62 @@ int main(int argc, char *argv[]) {

163 err_exit("mkdtemp(%s)", template_);

178 err_exit("mkdtemp(%s)", template_);

164 }

179 }

165

180

181+ int unrace[2];

182+

183+ if (pipe(unrace)) {

184+ err_exit("pipe()");

185+ }

186+

187+ struct sigaction handle_child;

188+ handle_child.sa_sigaction = handle_child_death;

189+ handle_child.sa_flags = SA_SIGINFO;

190+

191+ struct sigaction old_handler;

192+ if (sigaction(SIGCHLD, &handle_child, &old_handler)) {

193+ err_exit("sigaction()");

194+ }

195+

196+ int child;

197+ child = child_pid = fork();

198+ if (child < 0) {

199+ err_exit("fork()");

200+ } else if (child == 0) {

201+ sigaction(SIGCHLD, &old_handler, NULL);

202+ close(unrace[1]);

203+ char buf[10];

204+ read(unrace[0], buf, 10);

205+ close(unrace[0]);

206+ return child_proc(rootdir, nixdir, clear_env, dirMappings, envMappings, argv[optind], argv + optind);

207+ } else {

208+ close(unrace[0]);

209+ char fifopath[PATH_MAX];

210+ if (enable_escape_hatch) {

211+ snprintf(fifopath, PATH_MAX, "%s/escape-hatch", rootdir);

212+ mkfifo(fifopath, 0600);

213+ }

214+ close(unrace[1]);

215+ if (enable_escape_hatch) {

216+ char buffer[1024];

217+ while (!child_died) {

218+ int fd = open(fifopath, O_RDONLY);

219+ if (fd < 0) {

220+ if (errno == EINTR) continue;

221+ fprintf(stderr, "error opening escape-hatch: %s\n", strerror(errno));

222+ continue;

223+ }

224+ int size = read(fd, buffer, 1024);

225+ buffer[size] = 0;

226+ system(buffer);

227+ close(fd);

228+ }

229+ }

230+ int status;

231+ int ret = waitpid(child, &status, 0);

232+ return WEXITSTATUS(status);

233+ }

234+}

235+

236+static int child_proc(const char *rootdir, const char *nixdir, uint8_t clear_env, list<struct DirMapping> dirMappings, list<struct SetEnv> envMappings, const char *executable, char * const new_argv[]) {

166 // get uid, gid before going to new namespace

237 // get uid, gid before going to new namespace

167 uid_t uid = getuid();

238 uid_t uid = getuid();

168 gid_t gid = getgid();

239 gid_t gid = getgid();

@@ -170,7 +241,7 @@ int main(int argc, char *argv[]) {

170 // "unshare" into new namespace

241 // "unshare" into new namespace

171 if (unshare(CLONE_NEWNS | CLONE_NEWUSER) < 0) {

242 if (unshare(CLONE_NEWNS | CLONE_NEWUSER) < 0) {

172 if (errno == EPERM) {

243 if (errno == EPERM) {

173− fputs("Run the following as root to enable unprivileged namespace use:\nsysctl -w kernel.unprivileged_userns_clone=1 ; echo kernel.unprivileged_userns_clone=1 > /etc/sysctl.d/nix-user-chroot.conf\n\n", stderr);

244+ fputs("Run the following to enable unprivileged namespace use:\nsudo bash -c \"sysctl -w kernel.unprivileged_userns_clone=1 ; echo kernel.unprivileged_userns_clone=1 > /etc/sysctl.d/nix-user-chroot.conf\"\n\n", stderr);

174 exit(EXIT_FAILURE);

245 exit(EXIT_FAILURE);

175 } else {

246 } else {

176 err_exit("unshare()");

247 err_exit("unshare()");

@@ -230,6 +301,6 @@ int main(int argc, char *argv[]) {

230 }

301 }

231

302

232 // execute the command

303 // execute the command

233− execvp(argv[optind], argv + optind);

304+ execvp(executable, new_argv);

234− err_exit("execvp(%s)", argv[optind]);

305+ err_exit("execvp(%s)", executable);

235}

306}