X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=src%2Fcore%2Fexecute.c;h=fec4b3b13a0cfe2f714ccd818bc13d58ea61fcc1;hb=e66cf1a3f94fff48a572f6dbd19b43c9bcf7b8c7;hp=4033470e5b704022aabcb83ee3135b626c9cd773;hpb=351a19b17d51ba0a5737f35d3c5deb8e7975fdee;p=elogind.git diff --git a/src/core/execute.c b/src/core/execute.c index 4033470e5..fec4b3b13 100644 --- a/src/core/execute.c +++ b/src/core/execute.c @@ -39,6 +39,7 @@ #include #include #include +#include #include #undef basename @@ -54,6 +55,10 @@ #include #endif +#ifdef HAVE_APPARMOR +#include +#endif + #include "execute.h" #include "strv.h" #include "macro.h" @@ -76,6 +81,13 @@ #include "async.h" #include "selinux-util.h" #include "errno-list.h" +#include "af-list.h" +#include "mkdir.h" +#include "apparmor-util.h" + +#ifdef HAVE_SECCOMP +#include "seccomp-util.h" +#endif #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC) #define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC) @@ -953,21 +965,161 @@ static int apply_seccomp(ExecContext *c) { if (!seccomp) return -ENOMEM; - action = c->syscall_whitelist ? SCMP_ACT_ALLOW : negative_action; + if (c->syscall_archs) { + + SET_FOREACH(id, c->syscall_archs, i) { + r = seccomp_arch_add(seccomp, PTR_TO_UINT32(id) - 1); + if (r == -EEXIST) + continue; + if (r < 0) + goto finish; + } + } else { + r = seccomp_add_secondary_archs(seccomp); + if (r < 0) + goto finish; + } + + action = c->syscall_whitelist ? SCMP_ACT_ALLOW : negative_action; SET_FOREACH(id, c->syscall_filter, i) { r = seccomp_rule_add(seccomp, action, PTR_TO_INT(id) - 1, 0); - if (r < 0) { - seccomp_release(seccomp); - return r; - } + if (r < 0) + goto finish; } + r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0); + if (r < 0) + goto finish; + r = seccomp_load(seccomp); + +finish: seccomp_release(seccomp); + return r; +} + +static int apply_address_families(ExecContext *c) { + scmp_filter_ctx *seccomp; + Iterator i; + int r; + + assert(c); + + seccomp = seccomp_init(SCMP_ACT_ALLOW); + if (!seccomp) + return -ENOMEM; + + r = seccomp_add_secondary_archs(seccomp); + if (r < 0) + goto finish; + + if (c->address_families_whitelist) { + int af, first = 0, last = 0; + void *afp; + /* If this is a whitelist, we first block the address + * families that are out of range and then everything + * that is not in the set. First, we find the lowest + * and highest address family in the set. */ + + SET_FOREACH(afp, c->address_families, i) { + af = PTR_TO_INT(afp); + + if (af <= 0 || af >= af_max()) + continue; + + if (first == 0 || af < first) + first = af; + + if (last == 0 || af > last) + last = af; + } + + assert((first == 0) == (last == 0)); + + if (first == 0) { + + /* No entries in the valid range, block everything */ + r = seccomp_rule_add( + seccomp, + SCMP_ACT_ERRNO(EPROTONOSUPPORT), + SCMP_SYS(socket), + 0); + if (r < 0) + goto finish; + + } else { + + /* Block everything below the first entry */ + r = seccomp_rule_add( + seccomp, + SCMP_ACT_ERRNO(EPROTONOSUPPORT), + SCMP_SYS(socket), + 1, + SCMP_A0(SCMP_CMP_LT, first)); + if (r < 0) + goto finish; + + /* Block everything above the last entry */ + r = seccomp_rule_add( + seccomp, + SCMP_ACT_ERRNO(EPROTONOSUPPORT), + SCMP_SYS(socket), + 1, + SCMP_A0(SCMP_CMP_GT, last)); + if (r < 0) + goto finish; + + /* Block everything between the first and last + * entry */ + for (af = 1; af < af_max(); af++) { + + if (set_contains(c->address_families, INT_TO_PTR(af))) + continue; + + r = seccomp_rule_add( + seccomp, + SCMP_ACT_ERRNO(EPROTONOSUPPORT), + SCMP_SYS(socket), + 1, + SCMP_A0(SCMP_CMP_EQ, af)); + if (r < 0) + goto finish; + } + } + + } else { + void *af; + + /* If this is a blacklist, then generate one rule for + * each address family that are then combined in OR + * checks. */ + + SET_FOREACH(af, c->address_families, i) { + + r = seccomp_rule_add( + seccomp, + SCMP_ACT_ERRNO(EPROTONOSUPPORT), + SCMP_SYS(socket), + 1, + SCMP_A0(SCMP_CMP_EQ, PTR_TO_INT(af))); + if (r < 0) + goto finish; + } + } + + r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0); + if (r < 0) + goto finish; + + r = seccomp_load(seccomp); + +finish: + seccomp_release(seccomp); return r; } + #endif static void do_idle_pipe_dance(int idle_pipe[4]) { @@ -1096,6 +1248,7 @@ int exec_spawn(ExecCommand *command, bool confirm_spawn, CGroupControllerMask cgroup_supported, const char *cgroup_path, + const char *runtime_prefix, const char *unit_id, usec_t watchdog_usec, int idle_pipe[4], @@ -1349,6 +1502,13 @@ int exec_spawn(ExecCommand *command, goto fail_child; } + if (context->personality != 0xffffffffUL) + if (personality(context->personality) < 0) { + err = -errno; + r = EXIT_PERSONALITY; + goto fail_child; + } + if (context->utmp_id) utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path); @@ -1386,6 +1546,27 @@ int exec_spawn(ExecCommand *command, } #endif + if (!strv_isempty(context->runtime_directory) && runtime_prefix) { + char **rt; + + STRV_FOREACH(rt, context->runtime_directory) { + _cleanup_free_ char *p; + + p = strjoin(runtime_prefix, "/", *rt, NULL); + if (!p) { + r = EXIT_RUNTIME_DIRECTORY; + err = -ENOMEM; + goto fail_child; + } + + err = mkdir_safe(p, context->runtime_directory_mode, uid, gid); + if (err < 0) { + r = EXIT_RUNTIME_DIRECTORY; + goto fail_child; + } + } + } + if (apply_permissions) { err = enforce_groups(context, username, gid); if (err < 0) { @@ -1548,7 +1729,18 @@ int exec_spawn(ExecCommand *command, } #ifdef HAVE_SECCOMP - if (context->syscall_filter) { + if (context->address_families_whitelist || + !set_isempty(context->address_families)) { + err = apply_address_families(context); + if (err < 0) { + r = EXIT_ADDRESS_FAMILIES; + goto fail_child; + } + } + + if (context->syscall_whitelist || + !set_isempty(context->syscall_filter) || + !set_isempty(context->syscall_archs)) { err = apply_seccomp(context); if (err < 0) { r = EXIT_SECCOMP; @@ -1559,23 +1751,23 @@ int exec_spawn(ExecCommand *command, #ifdef HAVE_SELINUX if (context->selinux_context && use_selinux()) { - bool ignore; - char* c; - - c = context->selinux_context; - if (c[0] == '-') { - c++; - ignore = true; - } else - ignore = false; - - err = setexeccon(c); - if (err < 0 && !ignore) { + err = setexeccon(context->selinux_context); + if (err < 0 && !context->selinux_context_ignore) { r = EXIT_SELINUX_CONTEXT; goto fail_child; } } #endif + +#ifdef HAVE_APPARMOR + if (context->apparmor_profile && use_apparmor()) { + err = aa_change_onexec(context->apparmor_profile); + if (err < 0 && !context->apparmor_profile_ignore) { + r = EXIT_APPARMOR_PROFILE; + goto fail_child; + } + } +#endif } err = build_environment(context, n_fds, watchdog_usec, home, username, shell, &our_env); @@ -1670,6 +1862,8 @@ void exec_context_init(ExecContext *c) { c->syslog_level_prefix = true; c->ignore_sigpipe = true; c->timer_slack_nsec = (nsec_t) -1; + c->personality = 0xffffffffUL; + c->runtime_directory_mode = 0755; } void exec_context_done(ExecContext *c) { @@ -1737,10 +1931,44 @@ void exec_context_done(ExecContext *c) { free(c->selinux_context); c->selinux_context = NULL; -#ifdef HAVE_SECCOMP + free(c->apparmor_profile); + c->apparmor_profile = NULL; + set_free(c->syscall_filter); c->syscall_filter = NULL; -#endif + + set_free(c->syscall_archs); + c->syscall_archs = NULL; + + set_free(c->address_families); + c->address_families = NULL; + + strv_free(c->runtime_directory); + c->runtime_directory = NULL; +} + +int exec_context_destroy_runtime_directory(ExecContext *c, const char *runtime_prefix) { + char **i; + + assert(c); + + if (!runtime_prefix) + return 0; + + STRV_FOREACH(i, c->runtime_directory) { + _cleanup_free_ char *p; + + p = strjoin(runtime_prefix, "/", *i, NULL); + if (!p) + return -ENOMEM; + + /* We execute this synchronously, since we need to be + * sure this is gone when we start the service + * next. */ + rm_rf_dangerous(p, false, true, false); + } + + return 0; } void exec_command_done(ExecCommand *c) { @@ -1952,27 +2180,20 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) { fprintf(f, "%s%s: %llu\n", prefix, rlimit_to_string(i), (unsigned long long) c->rlimit[i]->rlim_max); if (c->ioprio_set) { - char *class_str; - int r; + _cleanup_free_ char *class_str = NULL; - r = ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c->ioprio), &class_str); - if (r < 0) - class_str = NULL; + ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c->ioprio), &class_str); fprintf(f, "%sIOSchedulingClass: %s\n" "%sIOPriority: %i\n", prefix, strna(class_str), prefix, (int) IOPRIO_PRIO_DATA(c->ioprio)); - free(class_str); } if (c->cpu_sched_set) { - char *policy_str; - int r; + _cleanup_free_ char *policy_str = NULL; - r = sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str); - if (r < 0) - policy_str = NULL; + sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str); fprintf(f, "%sCPUSchedulingPolicy: %s\n" "%sCPUSchedulingPriority: %i\n" @@ -1980,7 +2201,6 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) { prefix, strna(policy_str), prefix, c->cpu_sched_priority, prefix, yes_no(c->cpu_sched_reset_on_fork)); - free(policy_str); } if (c->cpuset) { @@ -2111,8 +2331,13 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) { if (c->selinux_context) fprintf(f, - "%sSELinuxContext: %s\n", - prefix, c->selinux_context); + "%sSELinuxContext: %s%s\n", + prefix, c->selinux_context_ignore ? "-" : "", c->selinux_context); + + if (c->personality != 0xffffffffUL) + fprintf(f, + "%sPersonality: %s\n", + prefix, strna(personality_to_string(c->personality))); if (c->syscall_filter) { #ifdef HAVE_SECCOMP @@ -2122,7 +2347,7 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) { #endif fprintf(f, - "%sSystemCallFilter: \n", + "%sSystemCallFilter: ", prefix); if (!c->syscall_whitelist) @@ -2137,7 +2362,7 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) { else fputc(' ', f); - name = seccomp_syscall_resolve_num_arch(PTR_TO_INT(id)-1, SCMP_ARCH_NATIVE); + name = seccomp_syscall_resolve_num_arch(SCMP_ARCH_NATIVE, PTR_TO_INT(id) - 1); fputs(strna(name), f); } #endif @@ -2145,10 +2370,32 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) { fputc('\n', f); } + if (c->syscall_archs) { +#ifdef HAVE_SECCOMP + Iterator j; + void *id; +#endif + + fprintf(f, + "%sSystemCallArchitectures:", + prefix); + +#ifdef HAVE_SECCOMP + SET_FOREACH(id, c->syscall_archs, j) + fprintf(f, " %s", strna(seccomp_arch_to_string(PTR_TO_UINT32(id) - 1))); +#endif + fputc('\n', f); + } + if (c->syscall_errno != 0) fprintf(f, "%sSystemCallErrorNumber: %s\n", prefix, strna(errno_to_name(c->syscall_errno))); + + if (c->apparmor_profile) + fprintf(f, + "%sAppArmorProfile: %s%s\n", + prefix, c->apparmor_profile_ignore ? "-" : "", c->apparmor_profile); } void exec_status_start(ExecStatus *s, pid_t pid) { @@ -2517,6 +2764,8 @@ static void *remove_tmpdir_thread(void *p) { } void exec_runtime_destroy(ExecRuntime *rt) { + int r; + if (!rt) return; @@ -2526,13 +2775,25 @@ void exec_runtime_destroy(ExecRuntime *rt) { if (rt->tmp_dir) { log_debug("Spawning thread to nuke %s", rt->tmp_dir); - asynchronous_job(remove_tmpdir_thread, rt->tmp_dir); + + r = asynchronous_job(remove_tmpdir_thread, rt->tmp_dir); + if (r < 0) { + log_warning("Failed to nuke %s: %s", rt->tmp_dir, strerror(-r)); + free(rt->tmp_dir); + } + rt->tmp_dir = NULL; } if (rt->var_tmp_dir) { log_debug("Spawning thread to nuke %s", rt->var_tmp_dir); - asynchronous_job(remove_tmpdir_thread, rt->var_tmp_dir); + + r = asynchronous_job(remove_tmpdir_thread, rt->var_tmp_dir); + if (r < 0) { + log_warning("Failed to nuke %s: %s", rt->var_tmp_dir, strerror(-r)); + free(rt->var_tmp_dir); + } + rt->var_tmp_dir = NULL; }