/* bubblewrap

 * Copyright (C) 2016 Alexander Larsson

 *

 * This program is free software; you can redistribute it and/or

 * modify it under the terms of the GNU Lesser General Public

 * License as published by the Free Software Foundation; either

 * version 2 of the License, or (at your option) any later version.

 *

 * This library is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public

 * License along with this library. If not, see <http://www.gnu.org/licenses/>.

 *

 */

#include "config.h"

#include <poll.h>

#include <sched.h>

#include <pwd.h>

#include <grp.h>

#include <sys/mount.h>

#include <sys/socket.h>

#include <sys/wait.h>

#include <sys/eventfd.h>

#include <sys/fsuid.h>

#include <sys/signalfd.h>

#include <sys/capability.h>

#include <sys/prctl.h>

#include <linux/sched.h>

#include <linux/seccomp.h>

#include <linux/filter.h>

#include "utils.h"

#include "network.h"

#include "bind-mount.h"

#ifndef CLONE_NEWCGROUP

#define CLONE_NEWCGROUP 0x02000000 /* New cgroup namespace */

#endif

#ifndef TEMP_FAILURE_RETRY

#define TEMP_FAILURE_RETRY(expression) \

  (__extension__                                                              \

    ({ long int __result;                                                     \

       do __result = (long int) (expression);                                 \

       while (__result == -1L && errno == EINTR);                             \

       __result; }))

#endif

/* Globals to avoid having to use getuid(), since the uid/gid changes during runtime */

static uid_t real_uid;

static gid_t real_gid;

static uid_t overflow_uid;

static gid_t overflow_gid;

static bool is_privileged; /* See acquire_privs() */

static const char *argv0;

static const char *host_tty_dev;

static int proc_fd = -1;

static const char *opt_exec_label = NULL;

static const char *opt_file_label = NULL;

static bool opt_as_pid_1;

const char *opt_chdir_path = NULL;

bool opt_unshare_user = FALSE;

bool opt_unshare_user_try = FALSE;

bool opt_unshare_pid = FALSE;

bool opt_unshare_ipc = FALSE;

bool opt_unshare_net = FALSE;

bool opt_unshare_uts = FALSE;

bool opt_unshare_cgroup = FALSE;

bool opt_unshare_cgroup_try = FALSE;

bool opt_needs_devpts = FALSE;

bool opt_new_session = FALSE;

bool opt_die_with_parent = FALSE;

uid_t opt_sandbox_uid = -1;

gid_t opt_sandbox_gid = -1;

int opt_sync_fd = -1;

int opt_block_fd = -1;

int opt_userns_block_fd = -1;

int opt_info_fd = -1;

int opt_json_status_fd = -1;

int opt_seccomp_fd = -1;

const char *opt_sandbox_hostname = NULL;

char *opt_args_data = NULL;  /* owned */

int opt_userns_fd = -1;

int opt_userns2_fd = -1;

int opt_pidns_fd = -1;

#define CAP_TO_MASK_0(x) (1L << ((x) & 31))

#define CAP_TO_MASK_1(x) CAP_TO_MASK_0(x - 32)

typedef struct _NsInfo NsInfo;

struct _NsInfo {

  const char *name;

  bool       *do_unshare;

  ino_t       id;

};

static NsInfo ns_infos[] = {

  {"cgroup", &opt_unshare_cgroup, 0},

  {"ipc",    &opt_unshare_ipc,    0},

  {"mnt",    NULL,                0},

  {"net",    &opt_unshare_net,    0},

  {"pid",    &opt_unshare_pid,    0},

  /* user namespace info omitted because it

   * is not (yet) valid when we obtain the

   * namespace info (get un-shared later) */

  {"uts",    &opt_unshare_uts,    0},

  {NULL,     NULL,                0}

};

typedef enum {

  SETUP_BIND_MOUNT,

  SETUP_RO_BIND_MOUNT,

  SETUP_DEV_BIND_MOUNT,

  SETUP_MOUNT_PROC,

  SETUP_MOUNT_DEV,

  SETUP_MOUNT_TMPFS,

  SETUP_MOUNT_MQUEUE,

  SETUP_MAKE_DIR,

  SETUP_MAKE_FILE,

  SETUP_MAKE_BIND_FILE,

  SETUP_MAKE_RO_BIND_FILE,

  SETUP_MAKE_SYMLINK,

  SETUP_REMOUNT_RO_NO_RECURSIVE,

  SETUP_SET_HOSTNAME,

} SetupOpType;

typedef enum {

  NO_CREATE_DEST = (1 << 0),

  ALLOW_NOTEXIST = (2 << 0),

} SetupOpFlag;

typedef struct _SetupOp SetupOp;

struct _SetupOp

{

  SetupOpType type;

  const char *source;

  const char *dest;

  int         fd;

  SetupOpFlag flags;

  SetupOp    *next;

};

typedef struct _LockFile LockFile;

struct _LockFile

{

  const char *path;

  int         fd;

  LockFile   *next;

};

static SetupOp *ops = NULL;

static SetupOp *last_op = NULL;

static LockFile *lock_files = NULL;

static LockFile *last_lock_file = NULL;

enum {

  PRIV_SEP_OP_DONE,

  PRIV_SEP_OP_BIND_MOUNT,

  PRIV_SEP_OP_PROC_MOUNT,

  PRIV_SEP_OP_TMPFS_MOUNT,

  PRIV_SEP_OP_DEVPTS_MOUNT,

  PRIV_SEP_OP_MQUEUE_MOUNT,

  PRIV_SEP_OP_REMOUNT_RO_NO_RECURSIVE,

  PRIV_SEP_OP_SET_HOSTNAME,

};

typedef struct

{

  uint32_t op;

  uint32_t flags;

  uint32_t arg1_offset;

  uint32_t arg2_offset;

} PrivSepOp;

static SetupOp *

setup_op_new (SetupOpType type)

{

  SetupOp *op = xcalloc (sizeof (SetupOp));

  op->type = type;

  op->fd = -1;

  op->flags = 0;

  if (last_op != NULL)

    last_op->next = op;

  else

    ops = op;

  last_op = op;

  return op;

}

static LockFile *

lock_file_new (const char *path)

{

  LockFile *lock = xcalloc (sizeof (LockFile));

  lock->path = path;

  if (last_lock_file != NULL)

    last_lock_file->next = lock;

  else

    lock_files = lock;

  last_lock_file = lock;

  return lock;

}

static void

usage (int ecode, FILE *out)

{

  fprintf (out, "usage: %s [OPTIONS...] [--] COMMAND [ARGS...]\n\n", argv0);

  fprintf (out,

           "    --help                       Print this help\n"

           "    --version                    Print version\n"

           "    --args FD                    Parse NUL-separated args from FD\n"

           "    --unshare-all                Unshare every namespace we support by default\n"

           "    --share-net                  Retain the network namespace (can only combine with --unshare-all)\n"

           "    --unshare-user               Create new user namespace (may be automatically implied if not setuid)\n"

           "    --unshare-user-try           Create new user namespace if possible else continue by skipping it\n"

           "    --unshare-ipc                Create new ipc namespace\n"

           "    --unshare-pid                Create new pid namespace\n"

           "    --unshare-net                Create new network namespace\n"

           "    --unshare-uts                Create new uts namespace\n"

           "    --unshare-cgroup             Create new cgroup namespace\n"

           "    --unshare-cgroup-try         Create new cgroup namespace if possible else continue by skipping it\n"

           "    --userns FD                  Use this user namespace (cannot combine with --unshare-user)\n"

           "    --userns2 FD                 After setup switch to this user namspace, only useful with --userns\n"

           "    --pidns FD                   Use this user namespace (as parent namespace if using --unshare-pid)\n"

           "    --uid UID                    Custom uid in the sandbox (requires --unshare-user or --userns)\n"

           "    --gid GID                    Custom gid in the sandbox (requires --unshare-user or --userns)\n"

           "    --hostname NAME              Custom hostname in the sandbox (requires --unshare-uts)\n"

           "    --chdir DIR                  Change directory to DIR\n"

           "    --setenv VAR VALUE           Set an environment variable\n"

           "    --unsetenv VAR               Unset an environment variable\n"

           "    --lock-file DEST             Take a lock on DEST while sandbox is running\n"

           "    --sync-fd FD                 Keep this fd open while sandbox is running\n"

           "    --bind SRC DEST              Bind mount the host path SRC on DEST\n"

           "    --bind-try SRC DEST          Equal to --bind but ignores non-existent SRC\n"

           "    --dev-bind SRC DEST          Bind mount the host path SRC on DEST, allowing device access\n"

           "    --dev-bind-try SRC DEST      Equal to --dev-bind but ignores non-existent SRC\n"

           "    --ro-bind SRC DEST           Bind mount the host path SRC readonly on DEST\n"

           "    --ro-bind-try SRC DEST       Equal to --ro-bind but ignores non-existent SRC\n"

           "    --remount-ro DEST            Remount DEST as readonly; does not recursively remount\n"

           "    --exec-label LABEL           Exec label for the sandbox\n"

           "    --file-label LABEL           File label for temporary sandbox content\n"

           "    --proc DEST                  Mount new procfs on DEST\n"

           "    --dev DEST                   Mount new dev on DEST\n"

           "    --tmpfs DEST                 Mount new tmpfs on DEST\n"

           "    --mqueue DEST                Mount new mqueue on DEST\n"

           "    --dir DEST                   Create dir at DEST\n"

           "    --file FD DEST               Copy from FD to destination DEST\n"

           "    --bind-data FD DEST          Copy from FD to file which is bind-mounted on DEST\n"

           "    --ro-bind-data FD DEST       Copy from FD to file which is readonly bind-mounted on DEST\n"

           "    --symlink SRC DEST           Create symlink at DEST with target SRC\n"

           "    --seccomp FD                 Load and use seccomp rules from FD\n"

           "    --block-fd FD                Block on FD until some data to read is available\n"

           "    --userns-block-fd FD         Block on FD until the user namespace is ready\n"

           "    --info-fd FD                 Write information about the running container to FD\n"

           "    --json-status-fd FD          Write container status to FD as multiple JSON documents\n"

           "    --new-session                Create a new terminal session\n"

           "    --die-with-parent            Kills with SIGKILL child process (COMMAND) when bwrap or bwrap's parent dies.\n"

           "    --as-pid-1                   Do not install a reaper process with PID=1\n"

           "    --cap-add CAP                Add cap CAP when running as privileged user\n"

           "    --cap-drop CAP               Drop cap CAP when running as privileged user\n"

          );

  exit (ecode);

}

/* If --die-with-parent was specified, use PDEATHSIG to ensure SIGKILL

 * is sent to the current process when our parent dies.

 */

static void

handle_die_with_parent (void)

{

  if (opt_die_with_parent && prctl (PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0) != 0)

    die_with_error ("prctl");

}

static void

block_sigchild (void)

{

  sigset_t mask;

  int status;

  sigemptyset (&mask);

  sigaddset (&mask, SIGCHLD);

  if (sigprocmask (SIG_BLOCK, &mask, NULL) == -1)

    die_with_error ("sigprocmask");

  /* Reap any outstanding zombies that we may have inherited */

  while (waitpid (-1, &status, WNOHANG) > 0)

    ;

}

static void

unblock_sigchild (void)

{

  sigset_t mask;

  sigemptyset (&mask);

  sigaddset (&mask, SIGCHLD);

  if (sigprocmask (SIG_UNBLOCK, &mask, NULL) == -1)

    die_with_error ("sigprocmask");

}

/* Closes all fd:s except 0,1,2 and the passed in array of extra fds */

static int

close_extra_fds (void *data, int fd)

{

  int *extra_fds = (int *) data;

  int i;

  for (i = 0; extra_fds[i] != -1; i++)

    if (fd == extra_fds[i])

      return 0;

  if (fd <= 2)

    return 0;

  close (fd);

  return 0;

}

static int

propagate_exit_status (int status)

{

  if (WIFEXITED (status))

    return WEXITSTATUS (status);

  /* The process died of a signal, we can't really report that, but we

   * can at least be bash-compatible. The bash manpage says:

   *   The return value of a simple command is its

   *   exit status, or 128+n if the command is

   *   terminated by signal n.

   */

  if (WIFSIGNALED (status))

    return 128 + WTERMSIG (status);

  /* Weird? */

  return 255;

}

static void

dump_info (int fd, const char *output, bool exit_on_error)

{

  size_t len = strlen (output);

  if (write_to_fd (fd, output, len))

    {

      if (exit_on_error)

        die_with_error ("Write to info_fd");

    }

}

static void

report_child_exit_status (int exitc, int setup_finished_fd)

{

  ssize_t s;

  char data[2];

  cleanup_free char *output = NULL;

  if (opt_json_status_fd == -1 || setup_finished_fd == -1)

    return;

  s = TEMP_FAILURE_RETRY (read (setup_finished_fd, data, sizeof data));

  if (s == -1 && errno != EAGAIN)

    die_with_error ("read eventfd");

  if (s != 1) // Is 0 if pipe closed before exec, is 2 if closed after exec.

    return;

  output = xasprintf ("{ \"exit-code\": %i }\n", exitc);

  dump_info (opt_json_status_fd, output, FALSE);

  close (opt_json_status_fd);

  opt_json_status_fd = -1;

  close (setup_finished_fd);

}

/* This stays around for as long as the initial process in the app does

 * and when that exits it exits, propagating the exit status. We do this

 * by having pid 1 in the sandbox detect this exit and tell the monitor

 * the exit status via a eventfd. We also track the exit of the sandbox

 * pid 1 via a signalfd for SIGCHLD, and exit with an error in this case.

 * This is to catch e.g. problems during setup. */

static int

monitor_child (int event_fd, pid_t child_pid, int setup_finished_fd)

{

  int res;

  uint64_t val;

  ssize_t s;

  int signal_fd;

  sigset_t mask;

  struct pollfd fds[2];

  int num_fds;

  struct signalfd_siginfo fdsi;

  int dont_close[] = {-1, -1, -1, -1};

  int j = 0;

  int exitc;

  pid_t died_pid;

  int died_status;

  /* Close all extra fds in the monitoring process.

     Any passed in fds have been passed on to the child anyway. */

  if (event_fd != -1)

    dont_close[j++] = event_fd;

  if (opt_json_status_fd != -1)

    dont_close[j++] = opt_json_status_fd;

  if (setup_finished_fd != -1)

    dont_close[j++] = setup_finished_fd;

  assert (j < sizeof(dont_close)/sizeof(*dont_close));

  fdwalk (proc_fd, close_extra_fds, dont_close);

  sigemptyset (&mask);

  sigaddset (&mask, SIGCHLD);

  signal_fd = signalfd (-1, &mask, SFD_CLOEXEC | SFD_NONBLOCK);

  if (signal_fd == -1)

    die_with_error ("Can't create signalfd");

  num_fds = 1;

  fds[0].fd = signal_fd;

  fds[0].events = POLLIN;

  if (event_fd != -1)

    {

      fds[1].fd = event_fd;

      fds[1].events = POLLIN;

      num_fds++;

    }

  while (1)

    {

      fds[0].revents = fds[1].revents = 0;

      res = poll (fds, num_fds, -1);

      if (res == -1 && errno != EINTR)

        die_with_error ("poll");

      /* Always read from the eventfd first, if pid 2 died then pid 1 often

       * dies too, and we could race, reporting that first and we'd lose

       * the real exit status. */

      if (event_fd != -1)

        {

          s = read (event_fd, &val, 8);

          if (s == -1 && errno != EINTR && errno != EAGAIN)

            die_with_error ("read eventfd");

          else if (s == 8)

            {

              exitc = (int) val - 1;

              report_child_exit_status (exitc, setup_finished_fd);

              return exitc;

            }

        }

      /* We need to read the signal_fd, or it will keep polling as read,

       * however we ignore the details as we get them from waitpid

       * below anyway */

      s = read (signal_fd, &fdsi, sizeof (struct signalfd_siginfo));

      if (s == -1 && errno != EINTR && errno != EAGAIN)

        die_with_error ("read signalfd");

      /* We may actually get several sigchld compressed into one

         SIGCHLD, so we have to handle all of them. */

      while ((died_pid = waitpid (-1, &died_status, WNOHANG)) > 0)

        {

          /* We may be getting sigchild from other children too. For instance if

             someone created a child process, and then exec:ed bubblewrap. Ignore them */

          if (died_pid == child_pid)

            {

              exitc = propagate_exit_status (died_status);

              report_child_exit_status (exitc, setup_finished_fd);

              return exitc;

            }

        }

    }

  die ("Should not be reached");

  return 0;

}

/* This is pid 1 in the app sandbox. It is needed because we're using

 * pid namespaces, and someone has to reap zombies in it. We also detect

 * when the initial process (pid 2) dies and report its exit status to

 * the monitor so that it can return it to the original spawner.

 *

 * When there are no other processes in the sandbox the wait will return

 * ECHILD, and we then exit pid 1 to clean up the sandbox. */

static int

do_init (int event_fd, pid_t initial_pid, struct sock_fprog *seccomp_prog)

{

  int initial_exit_status = 1;

  LockFile *lock;

  for (lock = lock_files; lock != NULL; lock = lock->next)

    {

      int fd = open (lock->path, O_RDONLY | O_CLOEXEC);

      if (fd == -1)

        die_with_error ("Unable to open lock file %s", lock->path);

      struct flock l = {

        .l_type = F_RDLCK,

        .l_whence = SEEK_SET,

        .l_start = 0,

        .l_len = 0

      };

      if (fcntl (fd, F_SETLK, &l) < 0)

        die_with_error ("Unable to lock file %s", lock->path);

      /* Keep fd open to hang on to lock */

      lock->fd = fd;

    }

  /* Optionally bind our lifecycle to that of the caller */

  handle_die_with_parent ();

  if (seccomp_prog != NULL &&

      prctl (PR_SET_SECCOMP, SECCOMP_MODE_FILTER, seccomp_prog) != 0)

    die_with_error ("prctl(PR_SET_SECCOMP)");

  while (TRUE)

    {

      pid_t child;

      int status;

      child = wait (&status);

      if (child == initial_pid && event_fd != -1)

        {

          uint64_t val;

          int res UNUSED;

          initial_exit_status = propagate_exit_status (status);

          val = initial_exit_status + 1;

          res = write (event_fd, &val, 8);

          /* Ignore res, if e.g. the parent died and closed event_fd

             we don't want to error out here */

        }

      if (child == -1 && errno != EINTR)

        {

          if (errno != ECHILD)

            die_with_error ("init wait()");

          break;

        }

    }

  /* Close FDs. */

  for (lock = lock_files; lock != NULL; lock = lock->next)

    {

      if (lock->fd >= 0)

        {

          close (lock->fd);

          lock->fd = -1;

        }

    }

  return initial_exit_status;

}

#define CAP_TO_MASK_0(x) (1L << ((x) & 31))

#define CAP_TO_MASK_1(x) CAP_TO_MASK_0(x - 32)

/* Set if --cap-add or --cap-drop were used */

static bool opt_cap_add_or_drop_used;

/* The capability set we'll target, used if above is true */

static uint32_t requested_caps[2] = {0, 0};

/* low 32bit caps needed */

/* CAP_SYS_PTRACE is needed to dereference the symlinks in /proc/<pid>/ns/, see namespaces(7) */

#define REQUIRED_CAPS_0 (CAP_TO_MASK_0 (CAP_SYS_ADMIN) | CAP_TO_MASK_0 (CAP_SYS_CHROOT) | CAP_TO_MASK_0 (CAP_NET_ADMIN) | CAP_TO_MASK_0 (CAP_SETUID) | CAP_TO_MASK_0 (CAP_SETGID) | CAP_TO_MASK_0 (CAP_SYS_PTRACE))

/* high 32bit caps needed */

#define REQUIRED_CAPS_1 0

static void

set_required_caps (void)

{

  struct __user_cap_header_struct hdr = { _LINUX_CAPABILITY_VERSION_3, 0 };

  struct __user_cap_data_struct data[2] = { { 0 } };

  /* Drop all non-require capabilities */

  data[0].effective = REQUIRED_CAPS_0;

  data[0].permitted = REQUIRED_CAPS_0;

  data[0].inheritable = 0;

  data[1].effective = REQUIRED_CAPS_1;

  data[1].permitted = REQUIRED_CAPS_1;

  data[1].inheritable = 0;

  if (capset (&hdr, data) < 0)

    die_with_error ("capset failed");

}

static void

drop_all_caps (bool keep_requested_caps)

{

  struct __user_cap_header_struct hdr = { _LINUX_CAPABILITY_VERSION_3, 0 };

  struct __user_cap_data_struct data[2] = { { 0 } };

  if (keep_requested_caps)

    {

      /* Avoid calling capset() unless we need to; currently

       * systemd-nspawn at least is known to install a seccomp

       * policy denying capset() for dubious reasons.

       * <https://github.com/projectatomic/bubblewrap/pull/122>

       */

      if (!opt_cap_add_or_drop_used && real_uid == 0)

        {

          assert (!is_privileged);

          return;

        }

      data[0].effective = requested_caps[0];

      data[0].permitted = requested_caps[0];

      data[0].inheritable = requested_caps[0];

      data[1].effective = requested_caps[1];

      data[1].permitted = requested_caps[1];

      data[1].inheritable = requested_caps[1];

    }

  if (capset (&hdr, data) < 0)

    {

      /* While the above logic ensures we don't call capset() for the primary

       * process unless configured to do so, we still try to drop privileges for

       * the init process unconditionally. Since due to the systemd seccomp

       * filter that will fail, let's just ignore it.

       */

      if (errno == EPERM && real_uid == 0 && !is_privileged)

        return;

      else

        die_with_error ("capset failed");

    }

}

static bool

has_caps (void)

{

  struct __user_cap_header_struct hdr = { _LINUX_CAPABILITY_VERSION_3, 0 };

  struct __user_cap_data_struct data[2] = { { 0 } };

  if (capget (&hdr, data)  < 0)

    die_with_error ("capget failed");

  return data[0].permitted != 0 || data[1].permitted != 0;

}

/* Most of the code here is used both to add caps to the ambient capabilities

 * and drop caps from the bounding set.  Handle both cases here and add

 * drop_cap_bounding_set/set_ambient_capabilities wrappers to facilitate its usage.

 */

static void

prctl_caps (uint32_t *caps, bool do_cap_bounding, bool do_set_ambient)

{

  unsigned long cap;

  /* We ignore both EINVAL and EPERM, as we are actually relying

   * on PR_SET_NO_NEW_PRIVS to ensure the right capabilities are

   * available.  EPERM in particular can happen with old, buggy

   * kernels.  See:

   *  https://github.com/projectatomic/bubblewrap/pull/175#issuecomment-278051373

   *  https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/security/commoncap.c?id=160da84dbb39443fdade7151bc63a88f8e953077

   */

  for (cap = 0; cap <= CAP_LAST_CAP; cap++)

    {

      bool keep = FALSE;

      if (cap < 32)

        {

          if (CAP_TO_MASK_0 (cap) & caps[0])

            keep = TRUE;

        }

      else

        {

          if (CAP_TO_MASK_1 (cap) & caps[1])

            keep = TRUE;

        }

      if (keep && do_set_ambient)

        {

#ifdef PR_CAP_AMBIENT

          int res = prctl (PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, cap, 0, 0);

          if (res == -1 && !(errno == EINVAL || errno == EPERM))

            die_with_error ("Adding ambient capability %ld", cap);

#else

          /* We ignore the EINVAL that results from not having PR_CAP_AMBIENT

           * in the current kernel at runtime, so also ignore not having it

           * in the current kernel headers at compile-time */

#endif

        }

      if (!keep && do_cap_bounding)

        {

          int res = prctl (PR_CAPBSET_DROP, cap, 0, 0, 0);

          if (res == -1 && !(errno == EINVAL || errno == EPERM))

            die_with_error ("Dropping capability %ld from bounds", cap);

        }

    }

}

static void

drop_cap_bounding_set (bool drop_all)

{

  if (!drop_all)

    prctl_caps (requested_caps, TRUE, FALSE);

  else

    {

      uint32_t no_caps[2] = {0, 0};

      prctl_caps (no_caps, TRUE, FALSE);

    }

}

static void

set_ambient_capabilities (void)

{

  if (is_privileged)

    return;

  prctl_caps (requested_caps, FALSE, TRUE);

}

/* This acquires the privileges that the bwrap will need it to work.

 * If bwrap is not setuid, then this does nothing, and it relies on

 * unprivileged user namespaces to be used. This case is

 * "is_privileged = FALSE".

 *

 * If bwrap is setuid, then we do things in phases.

 * The first part is run as euid 0, but with fsuid as the real user.

 * The second part, inside the child, is run as the real user but with

 * capabilities.

 * And finally we drop all capabilities.

 * The reason for the above dance is to avoid having the setup phase

 * being able to read files the user can't, while at the same time

 * working around various kernel issues. See below for details.

 */

static void

acquire_privs (void)

{

  uid_t euid, new_fsuid;

  euid = geteuid ();

  /* Are we setuid ? */

  if (real_uid != euid)

    {

      if (euid != 0)

        die ("Unexpected setuid user %d, should be 0", euid);

      is_privileged = TRUE;

      /* We want to keep running as euid=0 until at the clone()

       * operation because doing so will make the user namespace be

       * owned by root, which makes it not ptrace:able by the user as

       * it otherwise would be. After that we will run fully as the

       * user, which is necessary e.g. to be able to read from a fuse

       * mount from the user.

       *

       * However, we don't want to accidentally mis-use euid=0 for

       * escalated filesystem access before the clone(), so we set

       * fsuid to the uid.

       */

      if (setfsuid (real_uid) < 0)

        die_with_error ("Unable to set fsuid");

      /* setfsuid can't properly report errors, check that it worked (as per manpage) */

      new_fsuid = setfsuid (-1);

      if (new_fsuid != real_uid)

        die ("Unable to set fsuid (was %d)", (int)new_fsuid);

      /* We never need capabilities after execve(), so lets drop everything from the bounding set */

      drop_cap_bounding_set (TRUE);

      /* Keep only the required capabilities for setup */

      set_required_caps ();

    }

  else if (real_uid != 0 && has_caps ())

    {

      /* We have some capabilities in the non-setuid case, which should not happen.

         Probably caused by the binary being setcap instead of setuid which we

         don't support anymore */

      die ("Unexpected capabilities but not setuid, old file caps config?");

    }

  else if (real_uid == 0)

    {

      /* If our uid is 0, default to inheriting all caps; the caller

       * can drop them via --cap-drop.  This is used by at least rpm-ostree.

       * Note this needs to happen before the argument parsing of --cap-drop.

       */

      struct __user_cap_header_struct hdr = { _LINUX_CAPABILITY_VERSION_3, 0 };

      struct __user_cap_data_struct data[2] = { { 0 } };

      if (capget (&hdr, data) < 0)

        die_with_error ("capget (for uid == 0) failed");

      requested_caps[0] = data[0].effective;

      requested_caps[1] = data[1].effective;

    }

  /* Else, we try unprivileged user namespaces */

}

/* This is called once we're inside the namespace */

static void

switch_to_user_with_privs (void)

{

  /* If we're in a new user namespace, we got back the bounding set, clear it again */

  if (opt_unshare_user || opt_userns_fd != -1)

    drop_cap_bounding_set (FALSE);

  /* If we switched to a new user namespace it may allow other uids/gids, so switch to the target one */

  if (opt_userns_fd != -1)

    {

      if (opt_sandbox_uid != real_uid && setuid (opt_sandbox_uid) < 0)

        die_with_error ("unable to switch to uid %d", opt_sandbox_uid);

      if (opt_sandbox_gid != real_gid && setgid (opt_sandbox_gid) < 0)

        die_with_error ("unable to switch to gid %d", opt_sandbox_gid);

    }

  if (!is_privileged)

    return;

  /* Tell kernel not clear capabilities when later dropping root uid */

  if (prctl (PR_SET_KEEPCAPS, 1, 0, 0, 0) < 0)

    die_with_error ("prctl(PR_SET_KEEPCAPS) failed");

  if (setuid (opt_sandbox_uid) < 0)

    die_with_error ("unable to drop root uid");

  /* Regain effective required capabilities from permitted */

  set_required_caps ();

}

/* Call setuid() and use capset() to adjust capabilities */

static void

drop_privs (bool keep_requested_caps)

{

  assert (!keep_requested_caps || !is_privileged);

  /* Drop root uid */

  if (geteuid () == 0 && setuid (opt_sandbox_uid) < 0)

    die_with_error ("unable to drop root uid");

  drop_all_caps (keep_requested_caps);

  /* We don't have any privs now, so mark us dumpable which makes /proc/self be owned by the user instead of root */

  if (prctl (PR_SET_DUMPABLE, 1, 0, 0, 0) != 0)

    die_with_error ("can't set dumpable");

}

static char *

get_newroot_path (const char *path)

{

  while (*path == '/')

    path++;

  return strconcat ("/newroot/", path);

}

static char *

get_oldroot_path (const char *path)

{

  while (*path == '/')

    path++;

  return strconcat ("/oldroot/", path);

}

static void

write_uid_gid_map (uid_t sandbox_uid,

                   uid_t parent_uid,

                   uid_t sandbox_gid,

                   uid_t parent_gid,

                   pid_t pid,

                   bool  deny_groups,

                   bool  map_root)

{

  cleanup_free char *uid_map = NULL;

  cleanup_free char *gid_map = NULL;

  cleanup_free char *dir = NULL;

  cleanup_fd int dir_fd = -1;

  uid_t old_fsuid = -1;