// we need this so sched.h exports unshare and CLONE_* #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include pid_t pid_child; void fatal(const char* str, int errcode) { printf("%s (%d)\n", str, errcode); exit(errcode); } void drop_root(void) { /// Drop root privileges // First group then user because we might not // be able to drop group once we dropped user gid_t gid = getgid(); if (setresgid(-1,gid,gid) == -1) fatal("Failed to drop root privileges with setresgid", errno); uid_t uid = getuid(); if (setresuid(-1,uid,uid) == -1) fatal("Failed to drop root privileges with setresuid", errno); // sanity check if (seteuid(0) != -1) fatal("Sanity check failed. Able to regain root", 42); } struct sigaction forward_signal_descriptor; void forward_signal(int sig) { if (kill(pid_child, sig) == -1) { if (sig == SIGTERM) exit(1); } } char** argdup(int argc, const char** argv) { char** newargs = malloc(sizeof(char*) * (argc+1)); for (size_t i = 0; i < argc; i++) { newargs[i] = strdup(argv[i]); } newargs[argc] = NULL; return newargs; } int main(int argc, const char** argv) { int err; forward_signal_descriptor.sa_flags = SA_RESTART; forward_signal_descriptor.sa_handler = &forward_signal; if (argc == 1) { fprintf(stderr,"Usage: %s PROGRAM ARGUMENTS...\n" "Run command within its own pid namespace. Integrated init process.\n", argv[0]); return 0; } // next fork shall be in a new pid namespace if (unshare(CLONE_NEWPID) != 0) { fatal("Failed to unshare pid namespace", errno); } // Drop root privileges, we only needed those for the unshare call. drop_root(); pid_t pid = fork(); if (pid == -1) { fatal("Failed to fork", errno); } if (pid != 0) { /// Head process // Wait for the init process in the PID namespace to terminate and forward its exit code. // Also forward SIGTERM signals towards that init process. // Setup signal handler to forward SIGTERM pid_child = pid; if (sigaction(SIGTERM, &forward_signal_descriptor, NULL) == -1) { printf("Unable to setup signal handler in head\n"); } // parent waits for child then exits // Could be interrupt due to a signal. Retry in that case. int status; if (waitpid(pid, &status, 0) == -1) { fatal("Failed to wait for init process", errno); } return WEXITSTATUS(status); } else { // Child should be in new pid namespace and // functions as the the init process // it needs to fork again then wait for any child. // if the forked child exits then exit. pid = fork(); if (pid == -1) { fatal("Failed to fork in init process", errno); } if (pid != 0) { /// Init process // This part of the program runs as first process in the pid namespace // When this terminates then Linux terminates all remaining processes // in the PID namespace. As we want this to happen when our first child // terminates, we wait for our first child to terminate before terminating // ourselves. // As first process in the PID namespace, this also functions as adopting parent // for orphaned processes in the PID namespace and therefore has to wait for // any child process and then check if the a child process that has terminated // is the one we were waiting for. pid_t first_child = pid; pid_t exited_child; int child_status; // Setup forward for SIGTERM pid_child = first_child; if (sigaction(SIGTERM, &forward_signal_descriptor, NULL) == -1) { fatal("Unable to setup signal forward in init", 1); } // wait could be interrupt due to a signal. In that case just call wait again. do { exited_child = wait(&child_status); err = errno; } while (!(exited_child == first_child || (exited_child == -1 && err == ECHILD))); if (exited_child == -1) { return err; } else { int exit_code = WEXITSTATUS(child_status); return exit_code; } } else { // First child of init process. do exec here // use cli arguments for subprocess. skip 0 as it's our programs name. char** newargs = argdup(argc-1, &argv[1]); if (execvp(newargs[0], newargs) == -1) { fatal("Failed to exec", errno); } } } }