@@ -0,0 +1,144 @@
1+#define _GNU_SOURCE
2+#include <sched.h>
3+#include <unistd.h>
4+#include <stdlib.h>
5+#include <sys/wait.h>
6+#include <signal.h>
7+#include <fcntl.h>
8+#include <stdio.h>
9+#include <string.h>
10+#include <limits.h>
11+#include <errno.h>
12+#include <sys/mount.h>
13+#include <sys/types.h>
14+#include <dirent.h>
15+#include <sys/stat.h>
16+
17+#define err_exit(format, ...) { fprintf(stderr, format ": %s\n", ##__VA_ARGS__, strerror(errno)); exit(EXIT_FAILURE); }
18+
19+static void usage(char *pname) {
20+ fprintf(stderr, "Usage: %s <nixpath> <command>\n", pname);
21+
22+ exit(EXIT_FAILURE);
23+}
24+
25+static void update_map(char *mapping, char *map_file) {
26+ int fd;
27+
28+ fd = open(map_file, O_WRONLY);
29+ if (fd < 0) {
30+ err_exit("map open");
31+ }
32+
33+ int map_len = strlen(mapping);
34+ if (write(fd, mapping, map_len) != map_len) {
35+ err_exit("map write");
36+ }
37+
38+ close(fd);
39+}
40+
41+static void add_path(const char* name, const char* rootdir) {
42+ char path_buf[PATH_MAX];
43+ char path_buf2[PATH_MAX];
44+
45+ snprintf(path_buf, sizeof(path_buf), "/%s", name);
46+
47+ struct stat statbuf;
48+ if (stat(path_buf, &statbuf) < 0) {
49+ fprintf(stderr, "Cannot stat %s: %s\n", path_buf, strerror(errno));
50+ return;
51+ }
52+
53+ snprintf(path_buf2, sizeof(path_buf2), "%s/%s", rootdir, name);
54+
55+ if (S_ISDIR(statbuf.st_mode)) {
56+ mkdir(path_buf2, statbuf.st_mode & ~S_IFMT);
57+ if (mount(path_buf, path_buf2, "none", MS_BIND | MS_REC, NULL) < 0) {
58+ fprintf(stderr, "Cannot bind mount %s to %s: %s\n", path_buf, path_buf2, strerror(errno));
59+ }
60+ }
61+}
62+
63+int main(int argc, char *argv[]) {
64+ if (argc < 3) {
65+ usage(argv[0]);
66+ }
67+
68+ char template[] = "/tmp/nixXXXXXX";
69+ char *rootdir = mkdtemp(template);
70+ if (!rootdir) {
71+ err_exit("mkdtemp(%s)", template);
72+ }
73+
74+ char *nixdir = realpath(argv[1], NULL);
75+ if (!nixdir) {
76+ err_exit("realpath(%s)", argv[1]);
77+ }
78+
79+ uid_t uid = getuid();
80+ gid_t gid = getgid();
81+
82+ if (unshare(CLONE_NEWNS | CLONE_NEWUSER) < 0) {
83+ err_exit("unshare()");
84+ }
85+
86+ // bind mount all / stuff into rootdir
87+ DIR* d = opendir("/");
88+ if (!d) {
89+ err_exit("open /");
90+ }
91+
92+ add_path("dev", rootdir);
93+ add_path("proc", rootdir);
94+ add_path("sys", rootdir);
95+ add_path("run", rootdir);
96+ add_path("tmp", rootdir);
97+ add_path("var", rootdir);
98+
99+ struct stat statbuf2;
100+ if (stat(nixdir, &statbuf2) < 0) {
101+ err_exit("stat(%s)", nixdir);
102+ }
103+
104+ char path_buf[PATH_MAX];
105+
106+ snprintf(path_buf, sizeof(path_buf), "%s/nix", rootdir);
107+ mkdir(path_buf, statbuf2.st_mode & ~S_IFMT);
108+ if (mount(nixdir, path_buf, "none", MS_BIND | MS_REC, NULL) < 0) {
109+ err_exit("mount(%s, %s)", nixdir, path_buf);
110+ }
111+
112+ // fixes issue #1 where writing to /proc/self/gid_map fails
113+ // see user_namespaces(7) for more documentation
114+ int fd_setgroups = open("/proc/self/setgroups", O_WRONLY);
115+ if (fd_setgroups > 0) {
116+ write(fd_setgroups, "deny", 4);
117+ }
118+
119+ char map_buf[1024];
120+
121+ // map the original uid/gid in the new ns
122+ snprintf(map_buf, sizeof(map_buf), "%d %d 1", uid, uid);
123+ update_map(map_buf, "/proc/self/uid_map");
124+
125+ snprintf(map_buf, sizeof(map_buf), "%d %d 1", gid, gid);
126+ update_map(map_buf, "/proc/self/gid_map");
127+
128+ char cwd[PATH_MAX];
129+
130+ if (!getcwd(cwd, PATH_MAX)) {
131+ err_exit("getcwd()");
132+ }
133+
134+ chdir("/");
135+ if (chroot(rootdir) < 0) {
136+ err_exit("chroot(%s)", rootdir);
137+ }
138+ chdir(cwd);
139+
140+ // execute the command
141+
142+ execvp(argv[2], argv+2);
143+ err_exit("execvp(%s)", argv[2]);
144+}