blob: e4ade5daea237f344bf332537928153319bd8e62
1 | /* vi: set sw=4 ts=4: */ |
2 | /* |
3 | * Mini nsenter implementation for busybox. |
4 | * |
5 | * Copyright (C) 2016 by Bartosz Golaszewski <bartekgola@gmail.com> |
6 | * |
7 | * Licensed under GPLv2 or later, see file LICENSE in this source tree. |
8 | */ |
9 | |
10 | //config:config NSENTER |
11 | //config: bool "nsenter" |
12 | //config: default y |
13 | //config: select PLATFORM_LINUX |
14 | //config: help |
15 | //config: Run program with namespaces of other processes. |
16 | //config: |
17 | //config:config FEATURE_NSENTER_LONG_OPTS |
18 | //config: bool "Enable long options" |
19 | //config: default y |
20 | //config: depends on NSENTER && LONG_OPTS |
21 | //config: help |
22 | //config: Support long options for the nsenter applet. This makes |
23 | //config: the busybox implementation more compatible with upstream. |
24 | |
25 | //applet:IF_NSENTER(APPLET(nsenter, BB_DIR_USR_BIN, BB_SUID_DROP)) |
26 | |
27 | //kbuild:lib-$(CONFIG_NSENTER) += nsenter.o |
28 | |
29 | //usage:#define nsenter_trivial_usage |
30 | //usage: "[OPTIONS] [PROG [ARGS]]" |
31 | //usage:#if ENABLE_FEATURE_NSENTER_LONG_OPTS |
32 | //usage:#define nsenter_full_usage "\n" |
33 | //usage: "\n -t, --target=PID Target process to get namespaces from" |
34 | //usage: "\n -m, --mount[=FILE] Enter mount namespace" |
35 | //usage: "\n -u, --uts[=FILE] Enter UTS namespace (hostname etc)" |
36 | //usage: "\n -i, --ipc[=FILE] Enter System V IPC namespace" |
37 | //usage: "\n -n, --net[=FILE] Enter network namespace" |
38 | //usage: "\n -p, --pid[=FILE] Enter pid namespace" |
39 | //usage: "\n -U, --user[=FILE] Enter user namespace" |
40 | //usage: "\n -S, --setuid=UID Set uid in entered namespace" |
41 | //usage: "\n -G, --setgid=GID Set gid in entered namespace" |
42 | //usage: "\n --preserve-credentials Don't touch uids or gids" |
43 | //usage: "\n -r, --root[=DIR] Set root directory" |
44 | //usage: "\n -w, --wd[=DIR] Set working directory" |
45 | //usage: "\n -F, --no-fork Don't fork before exec'ing PROG" |
46 | //usage:#else |
47 | //usage:#define nsenter_full_usage "\n" |
48 | //usage: "\n -t PID Target process to get namespaces from" |
49 | //usage: "\n -m[FILE] Enter mount namespace" |
50 | //usage: "\n -u[FILE] Enter UTS namespace (hostname etc)" |
51 | //usage: "\n -i[FILE] Enter System V IPC namespace" |
52 | //usage: "\n -n[FILE] Enter network namespace" |
53 | //usage: "\n -p[FILE] Enter pid namespace" |
54 | //usage: "\n -U[FILE] Enter user namespace" |
55 | //usage: "\n -S UID Set uid in entered namespace" |
56 | //usage: "\n -G GID Set gid in entered namespace" |
57 | //usage: "\n -r[DIR] Set root directory" |
58 | //usage: "\n -w[DIR] Set working directory" |
59 | //usage: "\n -F Don't fork before exec'ing PROG" |
60 | //usage:#endif |
61 | |
62 | #include <sched.h> |
63 | #ifndef CLONE_NEWUTS |
64 | # define CLONE_NEWUTS 0x04000000 |
65 | #endif |
66 | #ifndef CLONE_NEWIPC |
67 | # define CLONE_NEWIPC 0x08000000 |
68 | #endif |
69 | #ifndef CLONE_NEWUSER |
70 | # define CLONE_NEWUSER 0x10000000 |
71 | #endif |
72 | #ifndef CLONE_NEWPID |
73 | # define CLONE_NEWPID 0x20000000 |
74 | #endif |
75 | #ifndef CLONE_NEWNET |
76 | # define CLONE_NEWNET 0x40000000 |
77 | #endif |
78 | |
79 | #include "libbb.h" |
80 | |
81 | struct namespace_descr { |
82 | int flag; /* value passed to setns() */ |
83 | char ns_nsfile8[8]; /* "ns/" + namespace file in process' procfs entry */ |
84 | }; |
85 | |
86 | struct namespace_ctx { |
87 | char *path; /* optional path to a custom ns file */ |
88 | int fd; /* opened namespace file descriptor */ |
89 | }; |
90 | |
91 | enum { |
92 | OPT_user = 1 << 0, |
93 | OPT_ipc = 1 << 1, |
94 | OPT_uts = 1 << 2, |
95 | OPT_network = 1 << 3, |
96 | OPT_pid = 1 << 4, |
97 | OPT_mount = 1 << 5, |
98 | OPT_target = 1 << 6, |
99 | OPT_setuid = 1 << 7, |
100 | OPT_setgid = 1 << 8, |
101 | OPT_root = 1 << 9, |
102 | OPT_wd = 1 << 10, |
103 | OPT_nofork = 1 << 11, |
104 | OPT_prescred = (1 << 12) * ENABLE_FEATURE_NSENTER_LONG_OPTS, |
105 | }; |
106 | enum { |
107 | NS_USR_POS = 0, |
108 | NS_IPC_POS, |
109 | NS_UTS_POS, |
110 | NS_NET_POS, |
111 | NS_PID_POS, |
112 | NS_MNT_POS, |
113 | NS_COUNT, |
114 | }; |
115 | /* |
116 | * The order is significant in nsenter. |
117 | * The user namespace comes first, so that it is entered first. |
118 | * This gives an unprivileged user the potential to enter other namespaces. |
119 | */ |
120 | static const struct namespace_descr ns_list[] = { |
121 | { CLONE_NEWUSER, "ns/user", }, |
122 | { CLONE_NEWIPC, "ns/ipc", }, |
123 | { CLONE_NEWUTS, "ns/uts", }, |
124 | { CLONE_NEWNET, "ns/net", }, |
125 | { CLONE_NEWPID, "ns/pid", }, |
126 | { CLONE_NEWNS, "ns/mnt", }, |
127 | }; |
128 | /* |
129 | * Upstream nsenter doesn't support the short option for --preserve-credentials |
130 | */ |
131 | static const char opt_str[] ALIGN1 = "U::i::u::n::p::m::""t+S+G+r::w::F"; |
132 | |
133 | #if ENABLE_FEATURE_NSENTER_LONG_OPTS |
134 | static const char nsenter_longopts[] ALIGN1 = |
135 | "user\0" Optional_argument "U" |
136 | "ipc\0" Optional_argument "i" |
137 | "uts\0" Optional_argument "u" |
138 | "network\0" Optional_argument "n" |
139 | "pid\0" Optional_argument "p" |
140 | "mount\0" Optional_argument "m" |
141 | "target\0" Required_argument "t" |
142 | "setuid\0" Required_argument "S" |
143 | "setgid\0" Required_argument "G" |
144 | "root\0" Optional_argument "r" |
145 | "wd\0" Optional_argument "w" |
146 | "no-fork\0" No_argument "F" |
147 | "preserve-credentials\0" No_argument "\xff" |
148 | ; |
149 | #endif |
150 | |
151 | /* |
152 | * Open a file and return the new descriptor. If a full path is provided in |
153 | * fs_path, then the file to which it points is opened. Otherwise (fd_path is |
154 | * NULL) the routine builds a path to a procfs file using the following |
155 | * template: '/proc/<target_pid>/<target_file>'. |
156 | */ |
157 | static int open_by_path_or_target(const char *path, |
158 | pid_t target_pid, const char *target_file) |
159 | { |
160 | char proc_path_buf[sizeof("/proc/%u/1234567890") + sizeof(int)*3]; |
161 | |
162 | if (!path) { |
163 | if (target_pid == 0) { |
164 | /* Example: |
165 | * "nsenter -p PROG" - neither -pFILE nor -tPID given. |
166 | */ |
167 | bb_show_usage(); |
168 | } |
169 | snprintf(proc_path_buf, sizeof(proc_path_buf), |
170 | "/proc/%u/%s", (unsigned)target_pid, target_file); |
171 | path = proc_path_buf; |
172 | } |
173 | |
174 | return xopen(path, O_RDONLY); |
175 | } |
176 | |
177 | int nsenter_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE; |
178 | int nsenter_main(int argc UNUSED_PARAM, char **argv) |
179 | { |
180 | int i; |
181 | unsigned int opts; |
182 | const char *root_dir_str = NULL; |
183 | const char *wd_str = NULL; |
184 | struct namespace_ctx ns_ctx_list[NS_COUNT]; |
185 | int setgroups_failed; |
186 | int root_fd, wd_fd; |
187 | int target_pid = 0; |
188 | int uid = 0; |
189 | int gid = 0; |
190 | |
191 | memset(ns_ctx_list, 0, sizeof(ns_ctx_list)); |
192 | |
193 | IF_FEATURE_NSENTER_LONG_OPTS(applet_long_options = nsenter_longopts); |
194 | opts = getopt32(argv, opt_str, |
195 | &ns_ctx_list[NS_USR_POS].path, |
196 | &ns_ctx_list[NS_IPC_POS].path, |
197 | &ns_ctx_list[NS_UTS_POS].path, |
198 | &ns_ctx_list[NS_NET_POS].path, |
199 | &ns_ctx_list[NS_PID_POS].path, |
200 | &ns_ctx_list[NS_MNT_POS].path, |
201 | &target_pid, &uid, &gid, |
202 | &root_dir_str, &wd_str |
203 | ); |
204 | argv += optind; |
205 | |
206 | root_fd = wd_fd = -1; |
207 | if (opts & OPT_root) |
208 | root_fd = open_by_path_or_target(root_dir_str, |
209 | target_pid, "root"); |
210 | if (opts & OPT_wd) |
211 | wd_fd = open_by_path_or_target(wd_str, target_pid, "cwd"); |
212 | |
213 | for (i = 0; i < NS_COUNT; i++) { |
214 | const struct namespace_descr *ns = &ns_list[i]; |
215 | struct namespace_ctx *ns_ctx = &ns_ctx_list[i]; |
216 | |
217 | ns_ctx->fd = -1; |
218 | if (opts & (1 << i)) |
219 | ns_ctx->fd = open_by_path_or_target(ns_ctx->path, |
220 | target_pid, ns->ns_nsfile8); |
221 | } |
222 | |
223 | /* |
224 | * Entering the user namespace without --preserve-credentials implies |
225 | * --setuid & --setgid and clearing root's groups. |
226 | */ |
227 | setgroups_failed = 0; |
228 | if ((opts & OPT_user) && !(opts & OPT_prescred)) { |
229 | opts |= (OPT_setuid | OPT_setgid); |
230 | /* |
231 | * We call setgroups() before and after setns() and only |
232 | * bail-out if it fails twice. |
233 | */ |
234 | setgroups_failed = (setgroups(0, NULL) < 0); |
235 | } |
236 | |
237 | for (i = 0; i < NS_COUNT; i++) { |
238 | const struct namespace_descr *ns = &ns_list[i]; |
239 | struct namespace_ctx *ns_ctx = &ns_ctx_list[i]; |
240 | |
241 | if (ns_ctx->fd < 0) |
242 | continue; |
243 | /*if (setns(ns_ctx->fd, ns->flag)) { |
244 | bb_perror_msg_and_die( |
245 | "setns(): can't reassociate to namespace '%s'", |
246 | ns->ns_nsfile8 + 3 |
247 | ); |
248 | }*/ |
249 | close(ns_ctx->fd); /* should close fds, to not confuse exec'ed PROG */ |
250 | /*ns_ctx->fd = -1;*/ |
251 | } |
252 | |
253 | if (root_fd >= 0) { |
254 | if (wd_fd < 0) { |
255 | /* |
256 | * Save the current working directory if we're not |
257 | * changing it. |
258 | */ |
259 | wd_fd = xopen(".", O_RDONLY); |
260 | } |
261 | xfchdir(root_fd); |
262 | xchroot("."); |
263 | close(root_fd); |
264 | /*root_fd = -1;*/ |
265 | } |
266 | |
267 | if (wd_fd >= 0) { |
268 | xfchdir(wd_fd); |
269 | close(wd_fd); |
270 | /*wd_fd = -1;*/ |
271 | } |
272 | |
273 | /* |
274 | * Entering the pid namespace implies forking unless it's been |
275 | * explicitly requested by the user not to. |
276 | */ |
277 | if (!(opts & OPT_nofork) && (opts & OPT_pid)) { |
278 | xvfork_parent_waits_and_exits(); |
279 | /* Child continues */ |
280 | } |
281 | |
282 | if (opts & OPT_setgid) { |
283 | if (setgroups(0, NULL) < 0 && setgroups_failed) |
284 | bb_perror_msg_and_die("setgroups"); |
285 | xsetgid(gid); |
286 | } |
287 | if (opts & OPT_setuid) |
288 | xsetuid(uid); |
289 | |
290 | exec_prog_or_SHELL(argv); |
291 | } |
292 |