A small utility program that sets up a new pid namespace and starts a process within that. Needs root via suid bit but later drops root priviliges to calling user.
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 

170 lines
4.9 KiB

// we need this so sched.h exports unshare and CLONE_*
#define _GNU_SOURCE
#include <sched.h>
#include <errno.h>
#include <err.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <signal.h>
static
pid_t pid_child;
static
void drop_root(void)
{
/// Drop root privileges
// First group then user because we might not
// be able to drop group once we dropped user
gid_t gid = getgid();
if (setresgid(-1,gid,gid) == -1)
err(errno, "Failed to drop root privileges with setresgid");
uid_t uid = getuid();
if (setresuid(-1,uid,uid) == -1)
err(errno, "Failed to drop root privileges with setresuid");
// sanity check
if (seteuid(0) != -1)
errx(1, "Sanity check failed. Able to regain root");
}
static
void forward_signal(int sig)
{
if (kill(pid_child, sig) == -1)
{
if (sig == SIGTERM)
exit(1);
}
}
int main(int argc, char* const* argv)
{
struct sigaction forward_signal_descriptor;
forward_signal_descriptor.sa_flags = SA_RESTART;
forward_signal_descriptor.sa_handler = &forward_signal;
if (argc == 1)
{
fprintf(stderr,"Usage: %s PROGRAM ARGUMENTS...\n"
"Run command within its own pid namespace. Integrated init process.\n",
argv[0]);
return 0;
}
// next fork shall be in a new pid namespace
if (unshare(CLONE_NEWPID) != 0)
{
err(errno, "Failed to unshare pid namespace");
}
// Drop root privileges, we only needed those for the unshare call.
drop_root();
pid_t pid = fork();
if (pid == -1)
{
err(errno, "Failed to fork");
}
if (pid != 0)
{
/// Head process
// Wait for the init process in the PID namespace to terminate and forward its exit code.
// Also forward SIGTERM signals towards that init process.
// Setup signal handler to forward SIGTERM
pid_child = pid;
if (sigaction(SIGTERM, &forward_signal_descriptor, NULL) == -1)
{
int saved_errno = errno;
// Have to kill child here, otherwise that gets orphaned and runs anyway.
// Use SIGKILL here because it might forward SIGTERM to its child and that
// decides not to stop.
kill(pid_child, SIGKILL);
// Restore errno as it might've been overwritten by kill
errno = saved_errno;
err(errno, "Unable to set up signal handler in head process");
}
// parent waits for child then exits
// Could be interrupt due to a signal. Retry in that case.
int status;
if (waitpid(pid, &status, 0) == -1)
{
err(errno, "Failed to wait for init process");
}
return WEXITSTATUS(status);
}
else
{
// Child should be in new pid namespace and
// functions as the the init process
// it needs to fork again then wait for any child.
// if the forked child exits then exit.
pid = fork();
if (pid == -1)
{
err(errno, "Failed to fork in init process");
}
if (pid != 0)
{
/// Init process
// This part of the program runs as first process in the pid namespace
// When this terminates then Linux terminates all remaining processes
// in the PID namespace. As we want this to happen when our first child
// terminates, we wait for our first child to terminate before terminating
// ourselves.
// As first process in the PID namespace, this also functions as adopting parent
// for orphaned processes in the PID namespace and therefore has to wait for
// any child process and then check if the a child process that has terminated
// is the one we were waiting for.
pid_t first_child = pid;
pid_t exited_child;
int child_status;
// Setup forward for SIGTERM
pid_child = first_child;
if (sigaction(SIGTERM, &forward_signal_descriptor, NULL) == -1)
{
err(1, "Unable to setup signal forward in init");
}
int wait_errno;
// wait could be interrupt due to a signal. In that case just call wait again.
do {
exited_child = wait(&child_status);
wait_errno = errno;
} while (!(exited_child == first_child || (exited_child == -1 && wait_errno == ECHILD)));
if (exited_child == -1)
{
err(wait_errno, "Error while waiting for subprocess");
}
else
{
return WEXITSTATUS(child_status);
}
}
else
{
// First child of init process. do exec here
// use cli arguments for subprocess. skip 0 as it's our programs name.
argv++;
if (execvp(argv[0], argv) == -1)
{
err(errno, "Failed to exec");
}
}
}
}