blob: e36653318fe087a374dff33ec5eead3efdfe482e [file] [log] [blame]
Mike Frysinger5ef22ca2018-01-20 13:42:10 -05001/* Copyright 2018 The Chromium OS Authors. All rights reserved.
2 * Use of this source code is governed by a BSD-style license that can be
3 * found in the LICENSE file.
4 */
5
6#include <dlfcn.h>
7#include <errno.h>
8#include <getopt.h>
9#include <stdio.h>
10#include <stdlib.h>
11#include <string.h>
12#include <sys/capability.h>
Mike Frysinger785b1c32018-02-23 15:47:24 -050013#include <sys/mount.h>
Mike Frysinger5ef22ca2018-01-20 13:42:10 -050014#include <sys/types.h>
15#include <unistd.h>
16
17#include "libminijail.h"
18#include "libsyscalls.h"
19
20#include "elfparse.h"
21#include "minijail0_cli.h"
22#include "system.h"
23#include "util.h"
24
25#define IDMAP_LEN 32U
26#define DEFAULT_TMP_SIZE (64 * 1024 * 1024)
27
28static void set_user(struct minijail *j, const char *arg, uid_t *out_uid,
29 gid_t *out_gid)
30{
31 char *end = NULL;
32 int uid = strtod(arg, &end);
33 if (!*end && *arg) {
34 *out_uid = uid;
35 minijail_change_uid(j, uid);
36 return;
37 }
38
39 if (lookup_user(arg, out_uid, out_gid)) {
40 fprintf(stderr, "Bad user: '%s'\n", arg);
41 exit(1);
42 }
43
44 if (minijail_change_user(j, arg)) {
45 fprintf(stderr, "Bad user: '%s'\n", arg);
46 exit(1);
47 }
48}
49
50static void set_group(struct minijail *j, const char *arg, gid_t *out_gid)
51{
52 char *end = NULL;
53 int gid = strtod(arg, &end);
54 if (!*end && *arg) {
55 *out_gid = gid;
56 minijail_change_gid(j, gid);
57 return;
58 }
59
60 if (lookup_group(arg, out_gid)) {
61 fprintf(stderr, "Bad group: '%s'\n", arg);
62 exit(1);
63 }
64
65 if (minijail_change_group(j, arg)) {
66 fprintf(stderr, "Bad group: '%s'\n", arg);
67 exit(1);
68 }
69}
70
71static void skip_securebits(struct minijail *j, const char *arg)
72{
73 uint64_t securebits_skip_mask;
74 char *end = NULL;
75 securebits_skip_mask = strtoull(arg, &end, 16);
76 if (*end) {
77 fprintf(stderr, "Invalid securebit mask: '%s'\n", arg);
78 exit(1);
79 }
80 minijail_skip_setting_securebits(j, securebits_skip_mask);
81}
82
83static void use_caps(struct minijail *j, const char *arg)
84{
85 uint64_t caps;
86 char *end = NULL;
87 caps = strtoull(arg, &end, 16);
88 if (*end) {
89 fprintf(stderr, "Invalid cap set: '%s'\n", arg);
90 exit(1);
91 }
92 minijail_use_caps(j, caps);
93}
94
95static void add_binding(struct minijail *j, char *arg)
96{
97 char *src = tokenize(&arg, ",");
98 char *dest = tokenize(&arg, ",");
99 char *flags = tokenize(&arg, ",");
100 if (!src || src[0] == '\0' || arg != NULL) {
101 fprintf(stderr, "Bad binding: %s %s\n", src, dest);
102 exit(1);
103 }
104 if (dest == NULL || dest[0] == '\0')
105 dest = src;
106 if (flags == NULL || flags[0] == '\0')
107 flags = "0";
108 if (minijail_bind(j, src, dest, atoi(flags))) {
109 fprintf(stderr, "minijail_bind failed.\n");
110 exit(1);
111 }
112}
113
114static void add_rlimit(struct minijail *j, char *arg)
115{
116 char *type = tokenize(&arg, ",");
117 char *cur = tokenize(&arg, ",");
118 char *max = tokenize(&arg, ",");
Luis Hector Chavez7058a2d2018-01-29 08:41:34 -0800119 char *end;
Mike Frysinger5ef22ca2018-01-20 13:42:10 -0500120 if (!type || type[0] == '\0' || !cur || cur[0] == '\0' ||
121 !max || max[0] == '\0' || arg != NULL) {
122 fprintf(stderr, "Bad rlimit '%s'.\n", arg);
123 exit(1);
124 }
Luis Hector Chavez7058a2d2018-01-29 08:41:34 -0800125 rlim_t cur_rlim;
126 rlim_t max_rlim;
127 if (!strcmp(cur, "unlimited")) {
128 cur_rlim = RLIM_INFINITY;
129 } else {
130 end = NULL;
131 cur_rlim = strtoul(cur, &end, 10);
132 if (*end) {
133 fprintf(stderr, "Bad soft limit: '%s'.\n", cur);
134 exit(1);
135 }
136 }
137 if (!strcmp(max, "unlimited")) {
138 max_rlim = RLIM_INFINITY;
139 } else {
140 end = NULL;
141 max_rlim = strtoul(max, &end, 10);
142 if (*end) {
143 fprintf(stderr, "Bad hard limit: '%s'.\n", max);
144 exit(1);
145 }
146 }
147 if (minijail_rlimit(j, atoi(type), cur_rlim, max_rlim)) {
Mike Frysinger5ef22ca2018-01-20 13:42:10 -0500148 fprintf(stderr, "minijail_rlimit '%s,%s,%s' failed.\n", type,
149 cur, max);
150 exit(1);
151 }
152}
153
154static void add_mount(struct minijail *j, char *arg)
155{
156 char *src = tokenize(&arg, ",");
157 char *dest = tokenize(&arg, ",");
158 char *type = tokenize(&arg, ",");
159 char *flags = tokenize(&arg, ",");
160 char *data = tokenize(&arg, ",");
161 if (!src || src[0] == '\0' || !dest || dest[0] == '\0' ||
Mike Frysinger4f3e09f2018-01-24 18:01:16 -0500162 !type || type[0] == '\0') {
Mike Frysinger5ef22ca2018-01-20 13:42:10 -0500163 fprintf(stderr, "Bad mount: %s %s %s\n", src, dest, type);
164 exit(1);
165 }
Mike Frysinger4f3e09f2018-01-24 18:01:16 -0500166
167 /*
168 * Fun edge case: the data option itself is comma delimited. If there
169 * were no more options, then arg would be set to NULL. But if we had
170 * more pending, it'll be pointing to the next token. Back up and undo
171 * the null byte so it'll be merged back.
172 * An example:
173 * none,/tmp,tmpfs,0xe,mode=0755,uid=10,gid=10
174 * The tokenize calls above will turn this memory into:
175 * none\0/tmp\0tmpfs\00xe\0mode=0755\0uid=10,gid=10
176 * With data pointing at mode=0755 and arg pointing at uid=10,gid=10.
177 */
178 if (arg != NULL)
179 arg[-1] = ',';
180
Mike Frysinger5ef22ca2018-01-20 13:42:10 -0500181 if (minijail_mount_with_data(j, src, dest, type,
182 flags ? strtoul(flags, NULL, 16) : 0,
183 data)) {
184 fprintf(stderr, "minijail_mount failed.\n");
185 exit(1);
186 }
187}
188
189static char *build_idmap(id_t id, id_t lowerid)
190{
191 int ret;
192 char *idmap = malloc(IDMAP_LEN);
193 ret = snprintf(idmap, IDMAP_LEN, "%d %d 1", id, lowerid);
194 if (ret < 0 || (size_t)ret >= IDMAP_LEN) {
195 free(idmap);
196 fprintf(stderr, "Could not build id map.\n");
197 exit(1);
198 }
199 return idmap;
200}
201
202static int has_cap_setgid(void)
203{
204 cap_t caps;
205 cap_flag_value_t cap_value;
206
207 if (!CAP_IS_SUPPORTED(CAP_SETGID))
208 return 0;
209
210 caps = cap_get_proc();
211 if (!caps) {
212 fprintf(stderr, "Could not get process' capabilities: %m\n");
213 exit(1);
214 }
215
216 if (cap_get_flag(caps, CAP_SETGID, CAP_EFFECTIVE, &cap_value)) {
217 fprintf(stderr, "Could not get the value of CAP_SETGID: %m\n");
218 exit(1);
219 }
220
221 if (cap_free(caps)) {
222 fprintf(stderr, "Could not free capabilities: %m\n");
223 exit(1);
224 }
225
226 return cap_value == CAP_SET;
227}
228
229static void set_ugid_mapping(struct minijail *j, int set_uidmap, uid_t uid,
230 char *uidmap, int set_gidmap, gid_t gid,
231 char *gidmap)
232{
233 if (set_uidmap) {
234 minijail_namespace_user(j);
235 minijail_namespace_pids(j);
236
237 if (!uidmap) {
238 /*
239 * If no map is passed, map the current uid to the
240 * chosen uid in the target namespace (or root, if none
241 * was chosen).
242 */
243 uidmap = build_idmap(uid, getuid());
244 }
245 if (0 != minijail_uidmap(j, uidmap)) {
246 fprintf(stderr, "Could not set uid map.\n");
247 exit(1);
248 }
249 free(uidmap);
250 }
251 if (set_gidmap) {
252 minijail_namespace_user(j);
253 minijail_namespace_pids(j);
254
255 if (!gidmap) {
256 /*
257 * If no map is passed, map the current gid to the
258 * chosen gid in the target namespace.
259 */
260 gidmap = build_idmap(gid, getgid());
261 }
262 if (!has_cap_setgid()) {
263 /*
264 * This means that we are not running as root,
265 * so we also have to disable setgroups(2) to
266 * be able to set the gid map.
267 * See
268 * http://man7.org/linux/man-pages/man7/user_namespaces.7.html
269 */
270 minijail_namespace_user_disable_setgroups(j);
271 }
272 if (0 != minijail_gidmap(j, gidmap)) {
273 fprintf(stderr, "Could not set gid map.\n");
274 exit(1);
275 }
276 free(gidmap);
277 }
278}
279
280static void use_chroot(struct minijail *j, const char *path, int *chroot,
281 int pivot_root)
282{
283 if (pivot_root) {
284 fprintf(stderr, "Could not set chroot because "
285 "'-P' was specified.\n");
286 exit(1);
287 }
288 if (minijail_enter_chroot(j, path)) {
289 fprintf(stderr, "Could not set chroot.\n");
290 exit(1);
291 }
292 *chroot = 1;
293}
294
295static void use_pivot_root(struct minijail *j, const char *path,
296 int *pivot_root, int chroot)
297{
298 if (chroot) {
299 fprintf(stderr, "Could not set pivot_root because "
300 "'-C' was specified.\n");
301 exit(1);
302 }
303 if (minijail_enter_pivot_root(j, path)) {
304 fprintf(stderr, "Could not set pivot_root.\n");
305 exit(1);
306 }
307 minijail_namespace_vfs(j);
308 *pivot_root = 1;
309}
310
311static void use_profile(struct minijail *j, const char *profile,
312 int *pivot_root, int chroot, size_t *tmp_size)
313{
Mike Frysinger4d2a81e2018-01-22 16:43:33 -0500314 /* Note: New profiles should be added in minijail0_cli_unittest.cc. */
315
Mike Frysinger5ef22ca2018-01-20 13:42:10 -0500316 if (!strcmp(profile, "minimalistic-mountns")) {
317 minijail_namespace_vfs(j);
318 if (minijail_bind(j, "/", "/", 0)) {
319 fprintf(stderr, "minijail_bind failed.\n");
320 exit(1);
321 }
322 if (minijail_bind(j, "/proc", "/proc", 0)) {
323 fprintf(stderr, "minijail_bind failed.\n");
324 exit(1);
325 }
326 minijail_mount_dev(j);
327 if (!*tmp_size) {
328 /* Avoid clobbering |tmp_size| if it was already set. */
329 *tmp_size = DEFAULT_TMP_SIZE;
330 }
331 minijail_remount_proc_readonly(j);
332 use_pivot_root(j, "/var/empty", pivot_root, chroot);
333 } else {
334 fprintf(stderr, "Unrecognized profile name '%s'\n", profile);
335 exit(1);
336 }
337}
338
Mike Frysinger785b1c32018-02-23 15:47:24 -0500339static void set_remount_mode(struct minijail *j, const char *mode)
340{
341 unsigned long msmode;
342 if (!strcmp(mode, "shared"))
343 msmode = MS_SHARED;
344 else if (!strcmp(mode, "private"))
345 msmode = MS_PRIVATE;
346 else if (!strcmp(mode, "slave"))
347 msmode = MS_SLAVE;
348 else if (!strcmp(mode, "unbindable"))
349 msmode = MS_UNBINDABLE;
350 else {
351 fprintf(stderr, "Unknown remount mode: '%s'\n", mode);
352 exit(1);
353 }
354 minijail_remount_mode(j, msmode);
355}
356
Mike Frysinger5ef22ca2018-01-20 13:42:10 -0500357static void usage(const char *progn)
358{
359 size_t i;
360 /* clang-format off */
361 printf("Usage: %s [-dGhHiIKlLnNprRstUvyYz]\n"
362 " [-a <table>]\n"
363 " [-b <src>[,<dest>[,<writeable>]]] [-k <src>,<dest>,<type>[,<flags>[,<data>]]]\n"
364 " [-c <caps>] [-C <dir>] [-P <dir>] [-e[file]] [-f <file>] [-g <group>]\n"
365 " [-m[<uid> <loweruid> <count>]*] [-M[<gid> <lowergid> <count>]*] [--profile <name>]\n"
366 " [-R <type,cur,max>] [-S <file>] [-t[size]] [-T <type>] [-u <user>] [-V <file>]\n"
367 " <program> [args...]\n"
368 " -a <table>: Use alternate syscall table <table>.\n"
369 " -b <...>: Bind <src> to <dest> in chroot.\n"
370 " Multiple instances allowed.\n"
371 " -B <mask>: Skip setting securebits in <mask> when restricting capabilities (-c).\n"
372 " By default, SECURE_NOROOT, SECURE_NO_SETUID_FIXUP, and \n"
373 " SECURE_KEEP_CAPS (together with their respective locks) are set.\n"
374 " -k <...>: Mount <src> at <dest> in chroot.\n"
375 " <flags> and <data> can be specified as in mount(2).\n"
376 " Multiple instances allowed.\n"
377 " -c <caps>: Restrict caps to <caps>.\n"
378 " -C <dir>: chroot(2) to <dir>.\n"
379 " Not compatible with -P.\n"
380 " -P <dir>: pivot_root(2) to <dir> (implies -v).\n"
381 " Not compatible with -C.\n"
382 " --mount-dev, Create a new /dev with a minimal set of device nodes (implies -v).\n"
383 " -d: See the minijail0(1) man page for the exact set.\n"
384 " -e[file]: Enter new network namespace, or existing one if |file| is provided.\n"
385 " -f <file>: Write the pid of the jailed process to <file>.\n"
386 " -g <group>: Change gid to <group>.\n"
387 " -G: Inherit supplementary groups from uid.\n"
388 " Not compatible with -y.\n"
389 " -y: Keep uid's supplementary groups.\n"
390 " Not compatible with -G.\n"
391 " -h: Help (this message).\n"
392 " -H: Seccomp filter help message.\n"
Luis Hector Chavez9dd13fd2018-04-19 20:14:47 -0700393 " -i: Exit immediately after fork(2). The jailed process will run\n"
394 " in the background.\n"
Mike Frysinger5ef22ca2018-01-20 13:42:10 -0500395 " -I: Run <program> as init (pid 1) inside a new pid namespace (implies -p).\n"
Mike Frysinger785b1c32018-02-23 15:47:24 -0500396 " -K: Do not change share mode of any existing mounts.\n"
397 " -K<mode>: Mark all existing mounts as <mode> instead of MS_PRIVATE.\n"
Mike Frysinger5ef22ca2018-01-20 13:42:10 -0500398 " -l: Enter new IPC namespace.\n"
399 " -L: Report blocked syscalls to syslog when using seccomp filter.\n"
400 " Forces the following syscalls to be allowed:\n"
401 " ", progn);
402 /* clang-format on */
403 for (i = 0; i < log_syscalls_len; i++)
404 printf("%s ", log_syscalls[i]);
405
406 /* clang-format off */
407 printf("\n"
408 " -m[map]: Set the uid map of a user namespace (implies -pU).\n"
409 " Same arguments as newuidmap(1), multiple mappings should be separated by ',' (comma).\n"
410 " With no mapping, map the current uid to root inside the user namespace.\n"
411 " Not compatible with -b without the 'writable' option.\n"
412 " -M[map]: Set the gid map of a user namespace (implies -pU).\n"
413 " Same arguments as newgidmap(1), multiple mappings should be separated by ',' (comma).\n"
414 " With no mapping, map the current gid to root inside the user namespace.\n"
415 " Not compatible with -b without the 'writable' option.\n"
416 " -n: Set no_new_privs.\n"
417 " -N: Enter a new cgroup namespace.\n"
418 " -p: Enter new pid namespace (implies -vr).\n"
419 " -r: Remount /proc read-only (implies -v).\n"
420 " -R: Set rlimits, can be specified multiple times.\n"
421 " -s: Use seccomp mode 1 (not the same as -S).\n"
422 " -S <file>: Set seccomp filter using <file>.\n"
423 " E.g., '-S /usr/share/filters/<prog>.$(uname -m)'.\n"
424 " Requires -n when not running as root.\n"
425 " -t[size]: Mount tmpfs at /tmp (implies -v).\n"
426 " Optional argument specifies size (default \"64M\").\n"
427 " -T <type>: Assume <program> is a <type> ELF binary; <type> can be 'static' or 'dynamic'.\n"
428 " This will avoid accessing <program> binary before execve(2).\n"
429 " Type 'static' will avoid preload hooking.\n"
430 " -u <user>: Change uid to <user>.\n"
431 " -U: Enter new user namespace (implies -p).\n"
432 " -v: Enter new mount namespace.\n"
433 " -V <file>: Enter specified mount namespace.\n"
434 " -w: Create and join a new anonymous session keyring.\n"
435 " -Y: Synchronize seccomp filters across thread group.\n"
436 " -z: Don't forward signals to jailed process.\n"
437 " --ambient: Raise ambient capabilities. Requires -c.\n"
438 " --uts[=name]: Enter a new UTS namespace (and set hostname).\n"
439 " --logging=<s>:Use <s> as the logging system.\n"
440 " <s> must be 'syslog' (default) or 'stderr'.\n"
441 " --profile <p>,Configure minijail0 to run with the <p> sandboxing profile,\n"
442 " which is a convenient way to express multiple flags\n"
443 " that are typically used together.\n"
444 " See the minijail0(1) man page for the full list.\n");
445 /* clang-format on */
446}
447
448static void seccomp_filter_usage(const char *progn)
449{
450 const struct syscall_entry *entry = syscall_table;
451 printf("Usage: %s -S <policy.file> <program> [args...]\n\n"
452 "System call names supported:\n",
453 progn);
454 for (; entry->name && entry->nr >= 0; ++entry)
455 printf(" %s [%d]\n", entry->name, entry->nr);
456 printf("\nSee minijail0(5) for example policies.\n");
457}
458
459int parse_args(struct minijail *j, int argc, char * const argv[],
460 int *exit_immediately, ElfType *elftype)
461{
462 int opt;
463 int use_seccomp_filter = 0;
464 int forward = 1;
465 int binding = 0;
466 int chroot = 0, pivot_root = 0;
467 int mount_ns = 0, skip_remount = 0;
468 int inherit_suppl_gids = 0, keep_suppl_gids = 0;
469 int caps = 0, ambient_caps = 0;
470 int seccomp = -1;
471 const size_t path_max = 4096;
472 uid_t uid = 0;
473 gid_t gid = 0;
474 char *uidmap = NULL, *gidmap = NULL;
475 int set_uidmap = 0, set_gidmap = 0;
476 size_t tmp_size = 0;
477 const char *filter_path = NULL;
478 int log_to_stderr = 0;
479
480 const char *optstring =
Mike Frysinger785b1c32018-02-23 15:47:24 -0500481 "+u:g:sS:c:C:P:b:B:V:f:m::M::k:a:e::R:T:vrGhHinNplLt::IUK::wyYzd";
Mike Frysinger5ef22ca2018-01-20 13:42:10 -0500482 /* clang-format off */
483 const struct option long_options[] = {
484 {"help", no_argument, 0, 'h'},
485 {"mount-dev", no_argument, 0, 'd'},
486 {"ambient", no_argument, 0, 128},
487 {"uts", optional_argument, 0, 129},
488 {"logging", required_argument, 0, 130},
489 {"profile", required_argument, 0, 131},
490 {0, 0, 0, 0},
491 };
492 /* clang-format on */
493
494 while ((opt = getopt_long(argc, argv, optstring, long_options, NULL)) !=
495 -1) {
496 switch (opt) {
497 case 'u':
498 set_user(j, optarg, &uid, &gid);
499 break;
500 case 'g':
501 set_group(j, optarg, &gid);
502 break;
503 case 'n':
504 minijail_no_new_privs(j);
505 break;
506 case 's':
507 if (seccomp != -1 && seccomp != 1) {
508 fprintf(stderr,
509 "Do not use -s & -S together.\n");
510 exit(1);
511 }
512 seccomp = 1;
513 minijail_use_seccomp(j);
514 break;
515 case 'S':
516 if (seccomp != -1 && seccomp != 2) {
517 fprintf(stderr,
518 "Do not use -s & -S together.\n");
519 exit(1);
520 }
521 seccomp = 2;
522 minijail_use_seccomp_filter(j);
523 if (strlen(optarg) >= path_max) {
524 fprintf(stderr, "Filter path is too long.\n");
525 exit(1);
526 }
527 filter_path = strndup(optarg, path_max);
528 if (!filter_path) {
529 fprintf(stderr,
530 "Could not strndup(3) filter path.\n");
531 exit(1);
532 }
533 use_seccomp_filter = 1;
534 break;
535 case 'l':
536 minijail_namespace_ipc(j);
537 break;
538 case 'L':
539 minijail_log_seccomp_filter_failures(j);
540 break;
541 case 'b':
542 add_binding(j, optarg);
543 binding = 1;
544 break;
545 case 'B':
546 skip_securebits(j, optarg);
547 break;
548 case 'c':
549 caps = 1;
550 use_caps(j, optarg);
551 break;
552 case 'C':
553 use_chroot(j, optarg, &chroot, pivot_root);
554 break;
555 case 'k':
556 add_mount(j, optarg);
557 break;
558 case 'K':
Mike Frysinger785b1c32018-02-23 15:47:24 -0500559 if (optarg)
560 set_remount_mode(j, optarg);
561 else
562 minijail_skip_remount_private(j);
Mike Frysinger5ef22ca2018-01-20 13:42:10 -0500563 skip_remount = 1;
564 break;
565 case 'P':
566 use_pivot_root(j, optarg, &pivot_root, chroot);
567 break;
568 case 'f':
569 if (0 != minijail_write_pid_file(j, optarg)) {
570 fprintf(stderr,
571 "Could not prepare pid file path.\n");
572 exit(1);
573 }
574 break;
575 case 't':
576 minijail_namespace_vfs(j);
577 if (!tmp_size) {
578 /*
579 * Avoid clobbering |tmp_size| if it was already
580 * set.
581 */
582 tmp_size = DEFAULT_TMP_SIZE;
583 }
584 if (optarg != NULL &&
585 0 != parse_size(&tmp_size, optarg)) {
586 fprintf(stderr, "Invalid /tmp tmpfs size.\n");
587 exit(1);
588 }
589 break;
590 case 'v':
591 minijail_namespace_vfs(j);
592 mount_ns = 1;
593 break;
594 case 'V':
595 minijail_namespace_enter_vfs(j, optarg);
596 break;
597 case 'r':
598 minijail_remount_proc_readonly(j);
599 break;
600 case 'G':
601 if (keep_suppl_gids) {
602 fprintf(stderr,
603 "-y and -G are not compatible.\n");
604 exit(1);
605 }
606 minijail_inherit_usergroups(j);
607 inherit_suppl_gids = 1;
608 break;
609 case 'y':
610 if (inherit_suppl_gids) {
611 fprintf(stderr,
612 "-y and -G are not compatible.\n");
613 exit(1);
614 }
615 minijail_keep_supplementary_gids(j);
616 keep_suppl_gids = 1;
617 break;
618 case 'N':
619 minijail_namespace_cgroups(j);
620 break;
621 case 'p':
622 minijail_namespace_pids(j);
623 break;
624 case 'e':
625 if (optarg)
626 minijail_namespace_enter_net(j, optarg);
627 else
628 minijail_namespace_net(j);
629 break;
630 case 'i':
631 *exit_immediately = 1;
632 break;
633 case 'H':
634 seccomp_filter_usage(argv[0]);
635 exit(0);
636 case 'I':
637 minijail_namespace_pids(j);
638 minijail_run_as_init(j);
639 break;
640 case 'U':
641 minijail_namespace_user(j);
642 minijail_namespace_pids(j);
643 break;
644 case 'm':
645 set_uidmap = 1;
646 if (uidmap) {
647 free(uidmap);
648 uidmap = NULL;
649 }
650 if (optarg)
651 uidmap = strdup(optarg);
652 break;
653 case 'M':
654 set_gidmap = 1;
655 if (gidmap) {
656 free(gidmap);
657 gidmap = NULL;
658 }
659 if (optarg)
660 gidmap = strdup(optarg);
661 break;
662 case 'a':
663 if (0 != minijail_use_alt_syscall(j, optarg)) {
664 fprintf(stderr,
665 "Could not set alt-syscall table.\n");
666 exit(1);
667 }
668 break;
669 case 'R':
670 add_rlimit(j, optarg);
671 break;
672 case 'T':
673 if (!strcmp(optarg, "static"))
674 *elftype = ELFSTATIC;
675 else if (!strcmp(optarg, "dynamic"))
676 *elftype = ELFDYNAMIC;
677 else {
678 fprintf(stderr, "ELF type must be 'static' or "
679 "'dynamic'.\n");
680 exit(1);
681 }
682 break;
683 case 'w':
684 minijail_new_session_keyring(j);
685 break;
686 case 'Y':
687 minijail_set_seccomp_filter_tsync(j);
688 break;
689 case 'z':
690 forward = 0;
691 break;
692 case 'd':
693 minijail_namespace_vfs(j);
694 minijail_mount_dev(j);
695 break;
696 /* Long options. */
697 case 128: /* Ambient caps. */
698 ambient_caps = 1;
699 minijail_set_ambient_caps(j);
700 break;
701 case 129: /* UTS/hostname namespace. */
702 minijail_namespace_uts(j);
703 if (optarg)
704 minijail_namespace_set_hostname(j, optarg);
705 break;
706 case 130: /* Logging. */
707 if (!strcmp(optarg, "syslog"))
708 log_to_stderr = 0;
709 else if (!strcmp(optarg, "stderr")) {
710 log_to_stderr = 1;
711 } else {
712 fprintf(stderr, "--logger must be 'syslog' or "
713 "'stderr'.\n");
714 exit(1);
715 }
716 break;
717 case 131: /* Profile */
718 use_profile(j, optarg, &pivot_root, chroot, &tmp_size);
719 break;
720 default:
721 usage(argv[0]);
722 exit(opt == 'h' ? 0 : 1);
723 }
724 }
725
726 if (log_to_stderr) {
727 init_logging(LOG_TO_FD, STDERR_FILENO, LOG_INFO);
728 /*
729 * When logging to stderr, ensure the FD survives the jailing.
730 */
731 if (0 !=
732 minijail_preserve_fd(j, STDERR_FILENO, STDERR_FILENO)) {
733 fprintf(stderr, "Could not preserve stderr.\n");
734 exit(1);
735 }
736 }
737
738 /* Set up uid/gid mapping. */
739 if (set_uidmap || set_gidmap) {
740 set_ugid_mapping(j, set_uidmap, uid, uidmap, set_gidmap, gid,
741 gidmap);
742 }
743
744 /* Can only set ambient caps when using regular caps. */
745 if (ambient_caps && !caps) {
746 fprintf(stderr, "Can't set ambient capabilities (--ambient) "
747 "without actually using capabilities (-c).\n");
748 exit(1);
749 }
750
751 /* Set up signal handlers in minijail unless asked not to. */
752 if (forward)
753 minijail_forward_signals(j);
754
755 /*
756 * Only allow bind mounts when entering a chroot, using pivot_root, or
757 * a new mount namespace.
758 */
759 if (binding && !(chroot || pivot_root || mount_ns)) {
760 fprintf(stderr, "Bind mounts require a chroot, pivot_root, or "
761 " new mount namespace.\n");
762 exit(1);
763 }
764
765 /*
766 * Remounting / as MS_PRIVATE only happens when entering a new mount
767 * namespace, so skipping it only applies in that case.
768 */
769 if (skip_remount && !mount_ns) {
770 fprintf(stderr, "Can't skip marking mounts as MS_PRIVATE"
771 " without mount namespaces.\n");
772 exit(1);
773 }
774
775 /*
776 * We parse seccomp filters here to make sure we've collected all
777 * cmdline options.
778 */
779 if (use_seccomp_filter) {
780 minijail_parse_seccomp_filters(j, filter_path);
781 free((void *)filter_path);
782 }
783
784 /* Mount a tmpfs under /tmp and set its size. */
785 if (tmp_size)
786 minijail_mount_tmp_size(j, tmp_size);
787
788 /*
789 * There should be at least one additional unparsed argument: the
790 * executable name.
791 */
792 if (argc == optind) {
793 usage(argv[0]);
794 exit(1);
795 }
796
797 if (*elftype == ELFERROR) {
798 /*
799 * -T was not specified.
800 * Get the path to the program adjusted for changing root.
801 */
802 char *program_path =
803 minijail_get_original_path(j, argv[optind]);
804
805 /* Check that we can access the target program. */
806 if (access(program_path, X_OK)) {
807 fprintf(stderr,
808 "Target program '%s' is not accessible.\n",
809 argv[optind]);
810 exit(1);
811 }
812
813 /* Check if target is statically or dynamically linked. */
814 *elftype = get_elf_linkage(program_path);
815 free(program_path);
816 }
817
818 /*
819 * Setting capabilities need either a dynamically-linked binary, or the
820 * use of ambient capabilities for them to be able to survive an
821 * execve(2).
822 */
823 if (caps && *elftype == ELFSTATIC && !ambient_caps) {
824 fprintf(stderr, "Can't run statically-linked binaries with "
825 "capabilities (-c) without also setting "
826 "ambient capabilities. Try passing "
827 "--ambient.\n");
828 exit(1);
829 }
830
831 return optind;
832}